[libcamera-devel] [PATCH 09/11] libcamera: ipa_manager: Embed IPA module signing public key

[Niklas Söderlund]

Hi Laurent,

Thanks for your work.

On 2020-04-04 04:56:22 +0300, Laurent Pinchart wrote:
> In preparation for verifying the signature of IPA modules, generate a
> public key from the private signing key and embed it in the IPAManager
> class.
> 
> Signed-off-by: Laurent Pinchart <laurent.pinchart at ideasonboard.com>

I have not take the python script for a spin nor linted it so I might 
have missed a miss spelled variable or function, but I trust you have 
tested it and it generates the correct template file ;-)

Reviewed-by: Niklas Söderlund <niklas.soderlund at ragnatech.se>

> ---
>  src/libcamera/gen-ipa-pub-key.py    | 46 +++++++++++++++++++++++++++++
>  src/libcamera/include/ipa_manager.h |  5 ++++
>  src/libcamera/ipa_pub_key.cpp.in    | 20 +++++++++++++
>  src/libcamera/meson.build           |  8 +++++
>  4 files changed, 79 insertions(+)
>  create mode 100755 src/libcamera/gen-ipa-pub-key.py
>  create mode 100644 src/libcamera/ipa_pub_key.cpp.in
> 
> diff --git a/src/libcamera/gen-ipa-pub-key.py b/src/libcamera/gen-ipa-pub-key.py
> new file mode 100755
> index 000000000000..ad575b18c922
> --- /dev/null
> +++ b/src/libcamera/gen-ipa-pub-key.py
> @@ -0,0 +1,46 @@
> +#!/usr/bin/env python3
> +# SPDX-License-Identifier: GPL-2.0-or-later
> +# Copyright (C) 2020, Google Inc.
> +#
> +# Author: Laurent Pinchart <laurent.pinchart at ideasonboard.com>
> +#
> +# ipa-gen-key.py - Generate the IPA module signing public key
> +
> +import string
> +import subprocess
> +import sys
> +
> +
> +def main(argv):
> +    if len(argv) != 4:
> +        print('Usage: %s priv-key template output' % argv[0])
> +        return 1
> +
> +    priv_key = argv[1]
> +    template = argv[2]
> +    output = argv[3]
> +
> +    try:
> +        ret = subprocess.run(['openssl', 'rsa', '-pubout', '-in', priv_key,
> +                              '-outform', 'DER'],
> +                             stdout=subprocess.PIPE)
> +    except FileNotFoundError:
> +        print('Please install openssl to sign IPA modules')
> +        return 1
> +
> +    ipa_key = ', '.join(['0x%02x' % c for c in ret.stdout])
> +    data = {'ipa_key': ipa_key}
> +
> +    template = open(template, 'rb').read()
> +    template = template.decode('utf-8')
> +    template = string.Template(template)
> +
> +    f = open(output, 'wb')
> +    f.write(template.substitute(data).encode('utf-8'))
> +    f.close()
> +
> +    return 0
> +
> +
> +if __name__ == '__main__':
> +    sys.exit(main(sys.argv))
> diff --git a/src/libcamera/include/ipa_manager.h b/src/libcamera/include/ipa_manager.h
> index 467658e40ce9..26edf087461e 100644
> --- a/src/libcamera/include/ipa_manager.h
> +++ b/src/libcamera/include/ipa_manager.h
> @@ -7,6 +7,7 @@
>  #ifndef __LIBCAMERA_IPA_MANAGER_H__
>  #define __LIBCAMERA_IPA_MANAGER_H__
>  
> +#include <stdint.h>
>  #include <vector>
>  
>  #include <ipa/ipa_interface.h>
> @@ -14,6 +15,7 @@
>  
>  #include "ipa_module.h"
>  #include "pipeline_handler.h"
> +#include "pub_key.h"
>  
>  namespace libcamera {
>  
> @@ -35,6 +37,9 @@ private:
>  	void parseDir(const char *libDir, unsigned int maxDepth,
>  		      std::vector<std::string> &files);
>  	unsigned int addDir(const char *libDir, unsigned int maxDepth = 0);
> +
> +	static const uint8_t publicKeyData_[];
> +	static const PubKey pubKey_;
>  };
>  
>  } /* namespace libcamera */
> diff --git a/src/libcamera/ipa_pub_key.cpp.in b/src/libcamera/ipa_pub_key.cpp.in
> new file mode 100644
> index 000000000000..e1fe287c160e
> --- /dev/null
> +++ b/src/libcamera/ipa_pub_key.cpp.in
> @@ -0,0 +1,20 @@
> +/* SPDX-License-Identifier: LGPL-2.1-or-later */
> +/*
> + * Copyright (C) 2020, Laurent Pinchart <laurent.pinchart at ideasonboard.com>
> + *
> + * ipa_key.cpp - IPA module signing public key
> + *
> + * This file is auto-generated. Do not edit.
> + */
> +
> +#include "ipa_manager.h"
> +
> +namespace libcamera {
> +
> +const uint8_t IPAManager::publicKeyData_[] = {
> +	${ipa_key}
> +};
> +
> +const PubKey IPAManager::pubKey_{ { IPAManager::publicKeyData_ } };
> +
> +} /* namespace libcamera */
> diff --git a/src/libcamera/meson.build b/src/libcamera/meson.build
> index c2a657e4938c..c502450c4b2d 100644
> --- a/src/libcamera/meson.build
> +++ b/src/libcamera/meson.build
> @@ -101,6 +101,14 @@ version_cpp = vcs_tag(command : [gen_version, meson.build_root()],
>  
>  libcamera_sources += version_cpp
>  
> +gen_ipa_pub_key = files('gen-ipa-pub-key.py')
> +ipa_pub_key_cpp = custom_target('ipa_pub_key_cpp',
> +                                input : [ ipa_priv_key, 'ipa_pub_key.cpp.in' ],
> +                                output : 'ipa_pub_key.cpp',
> +                                command : [ gen_ipa_pub_key, '@INPUT@', '@OUTPUT@' ])
> +
> +libcamera_sources += ipa_pub_key_cpp
> +
>  libcamera_deps = [
>      libatomic,
>      libdl,
> -- 
> Regards,
> 
> Laurent Pinchart
> 
> _______________________________________________
> libcamera-devel mailing list
> libcamera-devel at lists.libcamera.org
> https://lists.libcamera.org/listinfo/libcamera-devel

-- 
Regards,
Niklas Söderlund