Page MenuHomeFreeBSD
Differential D19093 Diff 53645 lib/libsecureboot/Makefile.inc

Changeset View

Standalone View

View Options

lib/libsecureboot/Makefile.inc

Show First 20 Lines • Show All 98 Lines • ▼ Show 20 Lines
# containing certificates that we can verify for each trust anchor. # containing certificates that we can verify for each trust anchor.
# This is typically a subordinate CA cert. # This is typically a subordinate CA cert.
# Finally we generate a hash of vc_PEM using each supported hash method # Finally we generate a hash of vc_PEM using each supported hash method
# to use as a Known Answer Test (needed for FIPS 140-2) # to use as a Known Answer Test (needed for FIPS 140-2)
# #
vets.o vets.po vets.pico: ta.h vets.o vets.po vets.pico: ta.h
ta.h: ${.ALLTARGETS:M[tv]*pem:O:u} ta.h: ${.ALLTARGETS:M[tv]*pem:O:u}
@( echo '/* Autogenerated - DO NOT EDIT!!! */'; echo; \ @( echo '/* Autogenerated - DO NOT EDIT!!! */'; echo; \
cat ${.ALLSRC:N*crl*:Mt*.pem} /dev/null | \ cat ${.ALLSRC:N*crl*:M*/t*.pem} /dev/null | \
sjgUnsubmitted
Not Done
Inline Actions

Why is this necessary?

sjg: Why is this necessary?
kdAuthorUnsubmitted
Done
Inline Actions

I changed the cert paths to be absolute. Without it the "BUILD_UTC_FILE" looks for the certificate in the object dir. Also IMO using absolute paths when possible is a good idea in general.

kd: I changed the cert paths to be absolute. Without it the "BUILD_UTC_FILE" looks for the…
sjgUnsubmitted
Not Done
Inline Actions

I think it would be preferable to specify BUILD_UTC_FILE as an absolute path if need be.
Leave these rules as flexible as possible

sjg: I think it would be preferable to specify BUILD_UTC_FILE as an absolute path if need be. Leave…
kdAuthorUnsubmitted
Done
Inline Actions

I removed these changes altogether. The BUILD_UTC can now be defined by calling "date +%s" when no BUILD_UTC_FILE is present instead.

kd: I removed these changes altogether. The BUILD_UTC can now be defined by calling "date +%s" when…
file2c -sx 'static const char ta_PEM[] = {' '};'; \ file2c -sx 'static const char ta_PEM[] = {' '};'; \
echo "${.newline}${VE_HASH_LIST:@H@static char vh_$H[] = \"`cat ${.ALLSRC:N*crl*:Mv*.pem} | ${$H:U${H:tl}}`\";${.newline}@}"; ) > ${.TARGET} echo "${.newline}${VE_HASH_LIST:@H@static char vh_$H[] = \"`cat ${.ALLSRC:N*crl*:Mv*.pem} | ${$H:U${H:tl}}`\";${.newline}@}"; ) > ${.TARGET}
.if ${VE_SELF_TESTS} != "no" .if ${VE_SELF_TESTS} != "no"
( cat ${.ALLSRC:N*crl*:Mv*.pem} /dev/null | \ ( cat ${.ALLSRC:N*crl*:M*/v*.pem} /dev/null | \
file2c -sx 'static const char vc_PEM[] = {' '};'; echo ) >> ${.TARGET} file2c -sx 'static const char vc_PEM[] = {' '};'; echo ) >> ${.TARGET}
.endif .endif
.if !empty(BUILD_UTC_FILE) .if !empty(BUILD_UTC_FILE)
echo '#define BUILD_UTC ${${STAT:Ustat} -f %m ${BUILD_UTC_FILE}:L:sh}' >> ${.TARGET} ${.OODATE:MNOMETA_CMP} echo '#define BUILD_UTC ${${STAT:Ustat} -f %m ${BUILD_UTC_FILE}:L:sh}' >> ${.TARGET} ${.OODATE:MNOMETA_CMP}
.endif .endif
sjgUnsubmitted
Not Done
Inline Actions

You do not need to use date, ${%s:L:gmtime} will produce the same output
btw bonus points for the use of .OODATE !

sjg: You do not need to use `date`, `${%s:L:gmtime}` will produce the same output btw bonus points…
kdAuthorUnsubmitted
Done
Inline Actions

Thanks.

kd: Thanks.
sjgUnsubmitted
Not Done
Inline Actions

quotes should encompass the :gmtime} reference

sjg: quotes should encompass the `:gmtime}` reference
mwUnsubmitted
Not Done
Inline Actions

Hi @sjg,

I will commit this change, so to be sure, - is below correct?

echo '#define BUILD_UTC ' ${%s:L:"gmtime"} >> ${.TARGET} ${.OODATE:MNOMETA_CMP}
mw: Hi @sjg, I will commit this change, so to be sure, - is below correct? ``` echo '#define…
sjgUnsubmitted
Not Done
Inline Actions

No. Sorry for being too lazy to type ;-)
I was referring to the single quote:
echo '#define BUILD_UTC ${%s:L:gmtime}' >> ${.TARGET}
ie the closing single quote moved past the variable reference

sjg: No. Sorry for being too lazy to type ;-) I was referring to the single quote: `echo '#define…
emasteUnsubmitted
Not Done
Inline Actions

Wait a moment, how does work with reproducible builds?

emaste: Wait a moment, how does work with reproducible builds?
sjgUnsubmitted
Not Done
Inline Actions

If you want reproducible you'd need to specify BUILD_UTC_FILE
and its mtime will be used

sjg: If you want reproducible you'd need to specify `BUILD_UTC_FILE` and its `mtime` will be used
emasteUnsubmitted
Not Done
Inline Actions

We need to make it reproducible in the default configuration

emaste: We need to make it reproducible in the default configuration
sjgUnsubmitted
Not Done
Inline Actions

All depends on what you call the default configuration.
First off; none of this is enabled by default.
In our build there is a BUILD_UTC_FILE so that's reproducible,
but semihalf are trying to allow for the case where there is no suitable file.
I guess you could allow for forcing BUILD_UTC=0 or any other value you like.
The result will be reproducible - whether it works is a different matter.

BUILD_UTC provides a starting point for the loader's notion of time (it lacks access to RTC), it will get updated with mtime of files it reads (if > current value), so BUILD_UTC=0 could work in most cases, but is not ideal since you cannot handle expired certs

sjg: All depends on what you call the default configuration. First off; none of this is enabled by…
sjgUnsubmitted
Not Done
Inline Actions

Ok this part of the change is now mooted by commit from D19464

sjg: Ok this part of the change is now mooted by commit from D19464
kdAuthorUnsubmitted
Done
Inline Actions

Thanks, the changes discussed above were removed.

kd: Thanks, the changes discussed above were removed.
# This header records our preference for signature extensions. # This header records our preference for signature extensions.
vesigned.o vesigned.po vesigned.pico: vse.h vesigned.o vesigned.po vesigned.pico: vse.h
vse.h: vse.h:
@( echo '/* Autogenerated - DO NOT EDIT!!! */'; echo; \ @( echo '/* Autogenerated - DO NOT EDIT!!! */'; echo; \
echo "static const char *signature_exts[] = {"; \ echo "static const char *signature_exts[] = {"; \
echo '${VE_SIGNATURE_EXT_LIST:@e@"$e",${.newline}@}'; \ echo '${VE_SIGNATURE_EXT_LIST:@e@"$e",${.newline}@}'; \
echo 'NULL };' ) > ${.TARGET} echo 'NULL };' ) > ${.TARGET}
.for s in ${BRSSL_SRCS} brf.c vets.c veta.c .for s in ${BRSSL_SRCS} brf.c vets.c veta.c
$s: brssl.h $s: brssl.h
XCFLAGS.${s:R}+= ${BRSSL_CFLAGS} XCFLAGS.${s:R}+= ${BRSSL_CFLAGS}
.endfor .endfor