Digi
/
meta-digi
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

trustfence: stm: rework PKI tree generation for CCMP15 platforms 

PKI tree generation for the STM32MP15 cpu provides the undesired file
"publicKeysHashHashes.bin", which is only required by STM32MP13. This commit
generates the PKI tree according to the KeyGen tool documentation to avoid
generate this extra file and avoid confusing the end user.

Signed-off-by: Arturo Buzarra <arturo.buzarra@digi.com>
This commit is contained in:
Arturo Buzarra 2023-08-30 08:52:49 +02:00
parent 4d6947e02a
commit acd2ee22c1
3 changed files with 14 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
meta-digi-arm/recipes-digi/trustfence/trustfence-sign-tools/trustfence-gen-pki-stm.sh
View File

@ -56,15 +56,15 @@ fi
KEY_PASS_FILE="${CONFIG_SIGN_KEYS_PATH}/keys/key_pass.txt" KEY_PASS_FILE="${CONFIG_SIGN_KEYS_PATH}/keys/key_pass.txt"
# Generate random keys if they don't exist # Generate random keys if they don't exist
N_PUBK="$(ls -l "${CONFIG_SIGN_KEYS_PATH}"/keys/publicKey0* 2>/dev/null | wc -l)" N_PUBK="$(ls -l "${CONFIG_SIGN_KEYS_PATH}"/keys/publicKey*.pem 2>/dev/null | wc -l)"
N_PRVK="$(ls -l "${CONFIG_SIGN_KEYS_PATH}"/keys/privateKey0* 2>/dev/null | wc -l)" N_PRVK="$(ls -l "${CONFIG_SIGN_KEYS_PATH}"/keys/privateKey*.pem 2>/dev/null | wc -l)"
if [ "${PLATFORM}" = "ccmp15" ]; then if [ "${PLATFORM}" = "ccmp15" ]; then
if [ "${N_PUBK}" != "1" ] && [ "${N_PRVK}" != 1 ] && [ ! -f "${KEY_PASS_FILE}" ]; then if [ "${N_PUBK}" != "1" ] && [ "${N_PRVK}" != 1 ] && [ ! -f "${KEY_PASS_FILE}" ]; then
install -d "${CONFIG_SIGN_KEYS_PATH}/keys/" install -d "${CONFIG_SIGN_KEYS_PATH}/keys/"
# Random password # Random password
password="$(openssl rand -base64 32)" password="$(openssl rand -base64 32)"
echo "Generating random key" echo "Generating random key"
if ! STM32MP_KeyGen_CLI -abs "${CONFIG_SIGN_KEYS_PATH}/keys/" -pwd ${password} -n 1; then if ! STM32MP_KeyGen_CLI -abs "${CONFIG_SIGN_KEYS_PATH}/keys/" -pwd ${password}; then
echo "[ERROR] Could not generate PKI tree" echo "[ERROR] Could not generate PKI tree"
exit 1 exit 1
fi fi

4
meta-digi-arm/recipes-digi/trustfence/trustfence-sign-tools/trustfence-sign-artifact-stm.sh
View File

@ -70,8 +70,8 @@ if ! trustfence-gen-pki.sh -p ${PLATFORM}; then
fi fi
if [ "${PLATFORM}" = "ccmp15" ]; then if [ "${PLATFORM}" = "ccmp15" ]; then
PUBLIC_KEY="${CONFIG_SIGN_KEYS_PATH}/keys/publicKey00.pem" PUBLIC_KEY="${CONFIG_SIGN_KEYS_PATH}/keys/publicKey.pem"
PRIVATE_KEY="${CONFIG_SIGN_KEYS_PATH}/keys/privateKey00.pem" PRIVATE_KEY="${CONFIG_SIGN_KEYS_PATH}/keys/privateKey.pem"
elif [ "${PLATFORM}" = "ccmp13" ]; then elif [ "${PLATFORM}" = "ccmp13" ]; then
PUBLIC_KEY="${CONFIG_SIGN_KEYS_PATH}/keys/publicKey0*.pem" PUBLIC_KEY="${CONFIG_SIGN_KEYS_PATH}/keys/publicKey0*.pem"
PRIVATE_KEY="${CONFIG_SIGN_KEYS_PATH}/keys/privateKey0${CONFIG_KEY_INDEX}.pem" PRIVATE_KEY="${CONFIG_SIGN_KEYS_PATH}/keys/privateKey0${CONFIG_KEY_INDEX}.pem"

11
meta-digi-dey/classes/trustfence.bbclass
View File

@ -91,7 +91,14 @@ copy_public_key() {
openssl x509 -pubkey -noout -in "${CERT_IMG}" > "${PUBLIC_KEY}" openssl x509 -pubkey -noout -in "${CERT_IMG}" > "${PUBLIC_KEY}"
fi fi
elif [ "${DEY_SOC_VENDOR}" = "STM" ]; then elif [ "${DEY_SOC_VENDOR}" = "STM" ]; then
PUBLIC_KEY="${TRUSTFENCE_SIGN_KEYS_PATH}/keys/publicKey0${TRUSTFENCE_KEY_INDEX}.pem" if [ "${DIGI_SOM}" = "ccmp15" ]; then
PUBLIC_KEY="${TRUSTFENCE_SIGN_KEYS_PATH}/keys/publicKey.pem"
elif [ "${DIGI_SOM}" = "ccmp13" ]; then
PUBLIC_KEY="${TRUSTFENCE_SIGN_KEYS_PATH}/keys/publicKey0${TRUSTFENCE_KEY_INDEX}.pem"
else
bberror "Unknown DIGI_SOM"
exit 1
fi
else else
echo "ERROR: Cannot determine the public key" echo "ERROR: Cannot determine the public key"
exit 1 exit 1
@ -142,7 +149,7 @@ python () {
d.setVar("FIP_SIGN_ENABLE", "1") d.setVar("FIP_SIGN_ENABLE", "1")
d.setVar("FIP_SIGN_KEY_EXTERNAL", "1") d.setVar("FIP_SIGN_KEY_EXTERNAL", "1")
if (d.getVar("DIGI_SOM") == "ccmp15" ): if (d.getVar("DIGI_SOM") == "ccmp15" ):
d.setVar("FIP_SIGN_KEY", d.getVar("TRUSTFENCE_SIGN_KEYS_PATH") + "/keys/privateKey00.pem"); d.setVar("FIP_SIGN_KEY", d.getVar("TRUSTFENCE_SIGN_KEYS_PATH") + "/keys/privateKey.pem");
elif (d.getVar("DIGI_SOM") == "ccmp13" ): elif (d.getVar("DIGI_SOM") == "ccmp13" ):
d.setVar("FIP_SIGN_KEY", d.getVar("TRUSTFENCE_SIGN_KEYS_PATH") + "/keys/privateKey0%s.pem" % d.getVar("TRUSTFENCE_KEY_INDEX")); d.setVar("FIP_SIGN_KEY", d.getVar("TRUSTFENCE_SIGN_KEYS_PATH") + "/keys/privateKey0%s.pem" % d.getVar("TRUSTFENCE_KEY_INDEX"));
d.setVar("TRUSTFENCE_PASSWORD_FILE", d.getVar("TRUSTFENCE_SIGN_KEYS_PATH") + "/keys/key_pass.txt") d.setVar("TRUSTFENCE_PASSWORD_FILE", d.getVar("TRUSTFENCE_SIGN_KEYS_PATH") + "/keys/key_pass.txt")