Re: [PATCH v3 10/15] crypto: builtin_keys: Allow to specify multiple keys in CONFIG_CRYPTO_PUBLIC_KEYS

[Ahmad Fatoum <a.fatoum@pengutronix.de>]

Hi Sascha,

On 06.09.24 12:40, Sascha Hauer wrote:
> This adds the missing pieces to make CONFIG_CRYPTO_PUBLIC_KEYS
> a list of keys rather than a single key only.
> 
> We have to remove the quotes from the key argument in cmd_keys to
> pass the keys as multiple arguments to keytoc. While at it the unused
> $(3) argument is removed.

It's not unsed, see test/self/Makefile, which uses it to pass the -s
option.

Cheers,
Ahmad

> 
> For removing the quotes from CONFIG_CRYPTO_PUBLIC_KEYS "%"=% no longer
> matches when the string contains multiple words, so we utilize shell
> to remove the quotes.
> 
> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
> ---
>  crypto/Kconfig       | 11 ++++++-----
>  crypto/Makefile      |  2 +-
>  scripts/Makefile.lib |  2 +-
>  3 files changed, 8 insertions(+), 7 deletions(-)
> 
> diff --git a/crypto/Kconfig b/crypto/Kconfig
> index 612e6f33fc..6b2e73c503 100644
> --- a/crypto/Kconfig
> +++ b/crypto/Kconfig
> @@ -126,11 +126,12 @@ config CRYPTO_PUBLIC_KEYS
>  	depends on CRYPTO_BUILTIN_KEYS
>  	string "public keys to compile in"
>  	help
> -	  This option should be a filename of a PEM-formatted file containing
> -	  X.509 certificates to be included into barebox. If the string starts
> -	  with "pkcs11:" it is interpreted as a PKCS#11 URI rather than a file.
> -	  If the string starts with a <hint>: prefix, <hint> is used as a key
> -	  name hint to find a key without iterating over all keys.
> +	  This option should be a space separated list of filenames of
> +	  PEM-formatted files containing X.509 certificates to be included into
> +	  barebox. If an entry starts with "pkcs11:" it is interpreted as a
> +	  PKCS#11 URI rather than a file. If an entry starts with a <hint>:
> +	  prefix, <hint> is used as a key name hint to find a key without
> +	  iterating over all keys.
>  
>  	  This avoids the mkimage dependency of CONFIG_BOOTM_FITIMAGE_PUBKEY
>  	  at the cost of an openssl build-time dependency.
> diff --git a/crypto/Makefile b/crypto/Makefile
> index b07e5dd8d4..9fa2200f47 100644
> --- a/crypto/Makefile
> +++ b/crypto/Makefile
> @@ -28,7 +28,7 @@ ifdef CONFIG_CRYPTO_BUILTIN_KEYS
>  
>  $(obj)/public-keys.o: $(obj)/public-keys.h
>  
> -CONFIG_CRYPTO_PUBLIC_KEYS := $(CONFIG_CRYPTO_PUBLIC_KEYS:"%"=%)
> +CONFIG_CRYPTO_PUBLIC_KEYS := $(shell echo $(CONFIG_CRYPTO_PUBLIC_KEYS))
>  
>  PUBLIC_KEYS_DEP := $(filter-out pkcs11:% __ENV__%, $(CONFIG_CRYPTO_PUBLIC_KEYS))
>  PUBLIC_KEYS_DEP := $(shell echo $(PUBLIC_KEYS_DEP) | sed -e "s/[[:alnum:]]*://g")
> diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
> index 1881e3c139..1561a30e55 100644
> --- a/scripts/Makefile.lib
> +++ b/scripts/Makefile.lib
> @@ -614,7 +614,7 @@ quiet_cmd_b64dec = B64DEC  $@
>  # target file.
>  quiet_cmd_public_keys = KEY     $@
>  cmd_public_keys = \
> -	$(objtree)/scripts/keytoc -o $@.tmp "$(2)" $(3) &&		\
> +	$(objtree)/scripts/keytoc -o $@.tmp $(2) &&		\
>  	if cmp -s $@.tmp $@; then					\
>  		rm $@.tmp;						\
>  	else								\


-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |