[PATCH v4 11/16] crypto: builtin_keys: Allow to specify multiple keys in CONFIG_CRYPTO_PUBLIC_KEYS

[Sascha Hauer]

On Fri, Sep 13, 2024 at 09:59:19AM +0200, Sascha Hauer wrote:
> This adds the missing pieces to make CONFIG_CRYPTO_PUBLIC_KEYS
> a list of keys rather than a single key only.
> 
> We have to remove the quotes from the key argument in cmd_keys to
> pass the keys as multiple arguments to keytoc.
> 
> For removing the quotes from CONFIG_CRYPTO_PUBLIC_KEYS "%"=% no longer
> matches when the string contains multiple words, so we utilize shell
> to remove the quotes.
> 
> Signed-off-by: Sascha Hauer <s.hauer at pengutronix.de>
> ---
>  crypto/Kconfig       | 11 ++++++-----
>  crypto/Makefile      |  2 +-
>  scripts/Makefile.lib |  2 +-
>  3 files changed, 8 insertions(+), 7 deletions(-)
> 
> diff --git a/crypto/Kconfig b/crypto/Kconfig
> index 612e6f33fc..6b2e73c503 100644
> --- a/crypto/Kconfig
> +++ b/crypto/Kconfig
> @@ -126,11 +126,12 @@ config CRYPTO_PUBLIC_KEYS
>  	depends on CRYPTO_BUILTIN_KEYS
>  	string "public keys to compile in"
>  	help
> -	  This option should be a filename of a PEM-formatted file containing
> -	  X.509 certificates to be included into barebox. If the string starts
> -	  with "pkcs11:" it is interpreted as a PKCS#11 URI rather than a file.
> -	  If the string starts with a <hint>: prefix, <hint> is used as a key
> -	  name hint to find a key without iterating over all keys.
> +	  This option should be a space separated list of filenames of
> +	  PEM-formatted files containing X.509 certificates to be included into
> +	  barebox. If an entry starts with "pkcs11:" it is interpreted as a
> +	  PKCS#11 URI rather than a file. If an entry starts with a <hint>:
> +	  prefix, <hint> is used as a key name hint to find a key without
> +	  iterating over all keys.
>  
>  	  This avoids the mkimage dependency of CONFIG_BOOTM_FITIMAGE_PUBKEY
>  	  at the cost of an openssl build-time dependency.
> diff --git a/crypto/Makefile b/crypto/Makefile
> index d6ce50b386..1c5709c90a 100644
> --- a/crypto/Makefile
> +++ b/crypto/Makefile
> @@ -28,7 +28,7 @@ ifdef CONFIG_CRYPTO_BUILTIN_KEYS
>  
>  $(obj)/public-keys.o: $(obj)/public-keys.h
>  
> -CONFIG_CRYPTO_PUBLIC_KEYS := $(CONFIG_CRYPTO_PUBLIC_KEYS:"%"=%)
> +CONFIG_CRYPTO_PUBLIC_KEYS := $(shell echo $(CONFIG_CRYPTO_PUBLIC_KEYS))
>  
>  $(obj)/public-keys.h: FORCE
>  	$(call cmd,public_keys,$(CONFIG_CRYPTO_PUBLIC_KEYS))
> diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
> index 1881e3c139..3d0a260804 100644
> --- a/scripts/Makefile.lib
> +++ b/scripts/Makefile.lib
> @@ -614,7 +614,7 @@ quiet_cmd_b64dec = B64DEC  $@
>  # target file.
>  quiet_cmd_public_keys = KEY     $@
>  cmd_public_keys = \
> -	$(objtree)/scripts/keytoc -o $@.tmp "$(2)" $(3) &&		\
> +	$(objtree)/scripts/keytoc -o $@.tmp $(2) $(3) &&		\

This doesn't work with pkcs11: uris. These may contain semicolons which
must be quoted from the shell. We must quote the the words in
CONFIG_CRYPTO_PUBLIC_KEYS though, not the whole string. So what we can
do is:

CONFIG_CRYPTO_PUBLIC_KEYS := $(foreach d,$(CONFIG_CRYPTO_PUBLIC_KEYS),"$(d)")

Sascha


-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |