Differential D16335 Diff 52850 lib/libsecureboot/local.trust.mk

Changeset View

Standalone View

lib/libsecureboot/local.trust.mk

This file was added.

Property	Old Value	New Value
svn:eol-style	null	native \ No newline at end of property
svn:keywords	null	FreeBSD=%H \ No newline at end of property
svn:mime-type	null	text/plain \ No newline at end of property

				# $FreeBSD$

				# Consider this file an example.
				#
				# For Junos this is how we obtain trust anchor .pems
				# the signing server (http://www.crufty.net/sjg/blog/signing-server.htm)
				# for each key will provide the appropriate certificate chain on request

				# force these for Junos
				MANIFEST_SKIP_ALWAYS= boot
				VE_HASH_LIST= \
				SHA1 \
				SHA256 \
				SHA384

				VE_SIGNATURE_LIST= \
				ECDSA

				VE_SIGNATURE_EXT_LIST= \
				esig

				VE_SELF_TESTS= yes

				.if ${MACHINE} == "host" && ${.CURDIR:T} == "tests"
				# for testing
				VE_HASH_LIST+= \
				SHA512

				VE_SIGNATURE_LIST+= \
				RSA \
				DEPRECATED_RSA_SHA1

				VE_SIGNATURE_EXT_LIST+= \
				sig
				.endif

				SIGNER ?= ${SB_TOOLS_PATH:U/volume/buildtools/bin}/sign.py

				.if exists(${SIGNER})
				SIGN_HOST ?= ${SB_SITE:Usvl}-junos-signer.juniper.net
				ECDSA_PORT:= ${133%y:L:gmtime}
				SIGN_ECDSA= ${PYTHON} ${SIGNER} -u ${SIGN_HOST}:${ECDSA_PORT} -h sha256
				RSA2_PORT:= ${163%y:L:gmtime}
				SIGN_RSA2= ${PYTHON} ${SIGNER} -u ${SIGN_HOST}:${RSA2_PORT} -h sha256

				.if !empty(OPENPGP_SIGN_URL)
				VE_SIGNATURE_LIST+= OPENPGP
				VE_SIGNATURE_EXT_LIST+= asc

				SIGN_OPENPGP= ${PYTHON} ${SIGNER:H}/openpgp-sign.py -a -u ${OPENPGP_SIGN_URL}

				ta_openpgp.asc:
				${SIGN_OPENPGP} -C ${.TARGET}

				ta.h: ta_openpgp.asc

				.if ${VE_SELF_TESTS} != "no"
				# for self test
				vc_openpgp.asc: ta_openpgp.asc
				${SIGN_OPENPGP} ${.ALLSRC:M*.asc}
				mv ta_openpgp.asc.asc ${.TARGET}

				ta.h: vc_openpgp.asc
				.endif
				.endif

				rcerts.pem:
				${SIGN_RSA2} -C ${.TARGET}

				ecerts.pem:
				${SIGN_ECDSA} -C ${.TARGET}

				.if ${VE_SIGNATURE_LIST:tu:MECDSA} != ""
				# the last cert in the chain is the one we want
				ta_ec.pem: ecerts.pem _LAST_PEM_USE

				.if ${VE_SELF_TESTS} != "no"
				# these are for verification self test
				vc_ec.pem: ecerts.pem _2ndLAST_PEM_USE
				.endif
				.endif

				.if ${VE_SIGNATURE_LIST:tu:MRSA} != ""
				ta_rsa.pem: rcerts.pem _LAST_PEM_USE
				.if ${VE_SELF_TESTS} != "no"
				vc_rsa.pem: rcerts.pem _2ndLAST_PEM_USE
				.endif
				.endif

				# we take the mtime of this as our baseline time
				BUILD_UTC_FILE= ecerts.pem

				.else
				# you need to provide t.pem or t.asc files for each trust anchor
				.if empty(TRUST_ANCHORS)
				TRUST_ANCHORS!= cd ${.CURDIR} && 'ls' -1 .pem t.asc 2> /dev/null
				kdUnsubmitted Not Done Inline Actions Rather than for .pem we should search for t.pem since later only the certificates found in t.pem are parsed. kd:* Rather than for .pem we should search for t.pem since later only the certificates found in t*.
				sjgAuthorUnsubmitted Done Inline Actions Actually we want [tv].pem and [tv].asc The t* are for trust anchors and the v* for verification (should be one per t) sjg:* Actually we want [tv].pem and [tv].asc The t* are for trust anchors and the v* for…
				.endif
				.if empty(TRUST_ANCHORS)
				.error Need TRUST_ANCHORS see ${.CURDIR}/README.rst
				.endif
				.if ${TRUST_ANCHORS:T:Mt*.pem} != ""
				ta.h: ${TRUST_ANCHORS:M*.pem}
				.endif
				.if ${TRUST_ANCHORS:T:Mt*.asc} != ""
				VE_SIGNATURE_LIST+= OPENPGP
				VE_SIGNATURE_EXT_LIST+= asc
				ta_asc.h: ${TRUST_ANCHORS:M*.asc}
				.endif
				# we take the mtime of this as our baseline time
				BUILD_UTC_FILE?= ${TRUST_ANCHORS:[1]}
				.endif