浏览代码

mkimage: use environment variable MKIMAGE_SIGN_PIN to set pin for OpenSSL Engine

This patch adds the possibility to pass the PIN the OpenSSL Engine
used during signing via the environment variable MKIMAGE_SIGN_PIN.
This follows the approach used during kernel module
signing ("KBUILD_SIGN_PIN") or UBIFS image
signing ("MKIMAGE_SIGN_PIN").

Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Marc Kleine-Budde 2 年之前
父节点
当前提交
62b27a561c
共有 2 个文件被更改,包括 13 次插入2 次删除
  1. 2 2
      doc/uImage.FIT/signature.txt
  2. 11 0
      lib/rsa/rsa-sign.c

+ 2 - 2
doc/uImage.FIT/signature.txt

@@ -533,8 +533,8 @@ Generic engine key ids:
 or
 or
   "<key-name-hint>"
   "<key-name-hint>"
 
 
-As mkimage does not at this time support prompting for passwords HSM may need
-key preloading wrapper to be used when invoking mkimage.
+In order to set the pin in the HSM, an environment variable "MKIMAGE_SIGN_PIN"
+can be specified.
 
 
 The following examples use the Nitrokey Pro using pkcs11 engine. Instructions
 The following examples use the Nitrokey Pro using pkcs11 engine. Instructions
 for other devices may vary.
 for other devices may vary.

+ 11 - 0
lib/rsa/rsa-sign.c

@@ -338,6 +338,7 @@ static int rsa_init(void)
 
 
 static int rsa_engine_init(const char *engine_id, ENGINE **pe)
 static int rsa_engine_init(const char *engine_id, ENGINE **pe)
 {
 {
+	const char *key_pass;
 	ENGINE *e;
 	ENGINE *e;
 	int ret;
 	int ret;
 
 
@@ -362,10 +363,20 @@ static int rsa_engine_init(const char *engine_id, ENGINE **pe)
 		goto err_set_rsa;
 		goto err_set_rsa;
 	}
 	}
 
 
+	key_pass = getenv("MKIMAGE_SIGN_PIN");
+	if (key_pass) {
+		if (!ENGINE_ctrl_cmd_string(e, "PIN", key_pass, 0)) {
+			fprintf(stderr, "Couldn't set PIN\n");
+			ret = -1;
+			goto err_set_pin;
+		}
+	}
+
 	*pe = e;
 	*pe = e;
 
 
 	return 0;
 	return 0;
 
 
+err_set_pin:
 err_set_rsa:
 err_set_rsa:
 	ENGINE_finish(e);
 	ENGINE_finish(e);
 err_engine_init:
 err_engine_init: