Skip to content

Commit 174a7bd

Browse files
bigbrettbigbrett
committed
add USER_ overrides for pubkey/prvkey/cert chain
1 parent ce7d8e2 commit 174a7bd

File tree

6 files changed

+85
-30
lines changed

6 files changed

+85
-30
lines changed

‎Makefile‎

Lines changed: 78 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -40,17 +40,67 @@ ifneq ($(TARGET),library)
4040
OBJS+=./hal/$(TARGET).o
4141
endif
4242

43+
# User-provided key configuration
44+
# - USER_PRIVATE_KEY: Path to user's private key (DER format)
45+
# - USER_PUBLIC_KEY: Path to user's public key (DER format)
46+
# - USER_CERT_CHAIN: Path to user's certificate chain (DER format)
47+
# All must be provided together, or none at all
48+
49+
# Validate USER_PRIVATE_KEY and USER_PUBLIC_KEY are used together
50+
ifneq ($(USER_PRIVATE_KEY),)
51+
ifeq ($(USER_PUBLIC_KEY),)
52+
$(error USER_PRIVATE_KEY requires USER_PUBLIC_KEY to also be set)
53+
endif
54+
ifeq ($(wildcard $(USER_PRIVATE_KEY)),)
55+
$(error USER_PRIVATE_KEY file not found: $(USER_PRIVATE_KEY))
56+
endif
57+
endif
58+
59+
ifneq ($(USER_PUBLIC_KEY),)
60+
ifeq ($(USER_PRIVATE_KEY),)
61+
$(error USER_PUBLIC_KEY requires USER_PRIVATE_KEY to also be set)
62+
endif
63+
ifeq ($(wildcard $(USER_PUBLIC_KEY)),)
64+
$(error USER_PUBLIC_KEY file not found: $(USER_PUBLIC_KEY))
65+
endif
66+
endif
67+
68+
# Validate USER_CERT_CHAIN requires USER_PRIVATE_KEY and USER_PUBLIC_KEY
69+
ifneq ($(USER_CERT_CHAIN),)
70+
ifeq ($(USER_PRIVATE_KEY),)
71+
$(error USER_CERT_CHAIN requires USER_PRIVATE_KEY to also be set)
72+
endif
73+
ifeq ($(USER_PUBLIC_KEY),)
74+
$(error USER_CERT_CHAIN requires USER_PUBLIC_KEY to also be set)
75+
endif
76+
ifeq ($(wildcard $(USER_CERT_CHAIN)),)
77+
$(error USER_CERT_CHAIN file not found: $(USER_CERT_CHAIN))
78+
endif
79+
endif
80+
4381
ifeq ($(SIGN),NONE)
4482
PRIVATE_KEY=
4583
else
4684
# Key selection logic:
47-
# - Without CERT_CHAIN_GEN: Single key (wolfboot_signing_private_key.der) signs everything
48-
# - With CERT_CHAIN_GEN: Generate cert chain, use leaf key (test-dummy-ca/leaf-prvkey.der) for signing
49-
# - With PRIVATE_KEY override: Use user-provided key (for offline cert chain workflow)
50-
ifneq ($(CERT_CHAIN_GEN),)
51-
PRIVATE_KEY?=test-dummy-ca/leaf-prvkey.der
85+
# 1. User-provided keys take precedence (USER_PRIVATE_KEY)
86+
# 2. If CERT_CHAIN_VERIFY enabled and USER_CERT_CHAIN not provided, auto-generate cert chain
87+
# 3. Otherwise use standard single key mode
88+
# PRIVATE_KEY can still be overridden on CLI
89+
ifneq ($(USER_PRIVATE_KEY),)
90+
PRIVATE_KEY=$(USER_PRIVATE_KEY)
5291
else
53-
PRIVATE_KEY?=wolfboot_signing_private_key.der
92+
ifneq ($(CERT_CHAIN_VERIFY),)
93+
ifeq ($(USER_CERT_CHAIN),)
94+
# Auto-generate cert chain mode - use leaf key
95+
PRIVATE_KEY?=test-dummy-ca/leaf-prvkey.der
96+
else
97+
# User provided cert chain but no USER_PRIVATE_KEY - should have been caught by validation
98+
PRIVATE_KEY?=wolfboot_signing_private_key.der
99+
endif
100+
else
101+
# No cert chain verification - standard single key mode
102+
PRIVATE_KEY?=wolfboot_signing_private_key.der
103+
endif
54104
endif
55105
ifeq ($(FLASH_OTP_KEYSTORE),1)
56106
OBJS+=./src/flash_otp_keystore.o
@@ -269,21 +319,31 @@ hal/$(TARGET).o:
269319

270320
keytools_check: keytools
271321

272-
# Generate the initial signing key
273-
# - Always creates wolfboot_signing_private_key.der
274-
# - If CERT_CHAIN_GEN is set, also generates cert chain with leaf key
322+
# Generate the initial signing key (only if not using user-provided keys)
323+
# - Creates wolfboot_signing_private_key.der when USER_PRIVATE_KEY is not set
324+
# - If CERT_CHAIN_VERIFY is enabled and USER_CERT_CHAIN not provided, also generates cert chain with leaf key
275325
wolfboot_signing_private_key.der:
326+
ifeq ($(USER_PRIVATE_KEY),)
276327
$(Q)$(MAKE) keytools_check
277328
$(Q)(test $(SIGN) = NONE) || ($(SIGN_ENV) "$(KEYGEN_TOOL)" $(KEYGEN_OPTIONS) -g wolfboot_signing_private_key.der) || true
278329
$(Q)(test $(SIGN) = NONE) && (echo "// SIGN=NONE" > src/keystore.c) || true
279330
$(Q)(test "$(FLASH_OTP_KEYSTORE)" = "1") && (make -C tools/keytools/otp) || true
280-
$(Q)(test $(SIGN) = NONE) || (test "$(CERT_CHAIN_VERIFY)" = "") || (test "$(CERT_CHAIN_GEN)" = "") || (tools/scripts/sim-gen-dummy-chain.sh --algo $(CERT_CHAIN_GEN_ALGO) --leaf wolfboot_signing_private_key.der)
331+
$(Q)(test $(SIGN) = NONE) || (test "$(CERT_CHAIN_VERIFY)" = "") || (test "$(USER_CERT_CHAIN)" != "") || (tools/scripts/sim-gen-dummy-chain.sh --algo $(CERT_CHAIN_GEN_ALGO) --leaf wolfboot_signing_private_key.der)
332+
else
333+
@echo "Using user-provided private key: $(USER_PRIVATE_KEY)"
334+
endif
281335

282-
# CERT_CHAIN_GEN only: Ensure leaf key exists after cert chain generation
283-
ifneq ($(CERT_CHAIN_GEN),)
336+
# Auto-generate cert chain mode: Ensure leaf key exists after cert chain generation
337+
# Only applies when CERT_CHAIN_VERIFY is enabled and USER_CERT_CHAIN not provided
338+
# Skip this when using user-provided keys
339+
ifeq ($(USER_PRIVATE_KEY),)
340+
ifneq ($(CERT_CHAIN_VERIFY),)
341+
ifeq ($(USER_CERT_CHAIN),)
284342
$(PRIVATE_KEY): wolfboot_signing_private_key.der
285343
@test -f $(PRIVATE_KEY) || (echo "Error: $(PRIVATE_KEY) not found" && exit 1)
286344
endif
345+
endif
346+
endif
287347

288348
$(SECONDARY_PRIVATE_KEY): $(PRIVATE_KEY) keystore.der
289349
$(Q)$(MAKE) keytools_check
@@ -436,13 +496,12 @@ srec: wolfboot.srec
436496
@echo "\t[ELF2SREC] $@"
437497
@$(OBJCOPY) -O srec $^ $@
438498

439-
# When IMPORT_PUBLIC_KEY is set, generate keystore.c from the imported public key
440-
# instead of relying on key generation. This supports offline cert chain workflow.
441-
ifneq ($(IMPORT_PUBLIC_KEY),)
442-
src/keystore.c: $(IMPORT_PUBLIC_KEY)
443-
@echo "Generating keystore from imported public key: $(IMPORT_PUBLIC_KEY)"
499+
# Keystore generation: use user-provided public key if available
500+
ifneq ($(USER_PUBLIC_KEY),)
501+
src/keystore.c: $(USER_PUBLIC_KEY)
502+
@echo "Generating keystore from user-provided public key: $(USER_PUBLIC_KEY)"
444503
$(Q)$(MAKE) keytools_check
445-
$(Q)$(SIGN_ENV) "$(KEYGEN_TOOL)" $(KEYGEN_OPTIONS) --force -i $(IMPORT_PUBLIC_KEY)
504+
$(Q)$(SIGN_ENV) "$(KEYGEN_TOOL)" $(KEYGEN_OPTIONS) --force -i $(USER_PUBLIC_KEY)
446505
else
447506
src/keystore.c: $(PRIVATE_KEY)
448507
endif
@@ -489,7 +548,7 @@ utilsclean: clean
489548

490549
keysclean: clean
491550
$(Q)rm -f *.pem *.der tags ./src/*_pub_key.c ./src/keystore.c include/target.h
492-
$(Q)(test "$(CERT_CHAIN_GEN)" = "") || rm -rf test-dummy-ca || true
551+
$(Q)(test "$(CERT_CHAIN_VERIFY)" = "" || test "$(USER_CERT_CHAIN)" != "") || rm -rf test-dummy-ca || true
493552

494553
distclean: clean keysclean utilsclean
495554
$(Q)rm -f *.bin *.elf

‎config/examples/aurix-tc375-elf-wolfHSM-certs.config‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,6 @@ ELF_FLASH_SCATTER=1
2626

2727
# Cert chain options
2828
CERT_CHAIN_VERIFY=1
29-
CERT_CHAIN_GEN=1
3029

3130
# Ensure header is large enough to hold the cert chain (check sign tool output)
3231
# for actual length

‎config/examples/aurix-tc375-hsm-wolfHSM-certs.config‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@ WOLFHSM_SERVER=1
2323

2424
# Cert chain options
2525
CERT_CHAIN_VERIFY=1
26-
CERT_CHAIN_GEN=1
2726

2827
# Ensure header is large enough to hold the cert chain (check sign tool output)
2928
# for actual length

‎config/examples/sim-wolfHSM-client-certchain.config‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,6 @@ SPMATH=1
99

1010
# Cert chain options
1111
CERT_CHAIN_VERIFY=1
12-
CERT_CHAIN_GEN=1
1312

1413
# Ensure header is large enough to hold the cert chain (check sign tool output)
1514
# for actual length

‎config/examples/sim-wolfHSM-server-certchain.config‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,6 @@ SPMATH=1
99

1010
# Cert chain options
1111
CERT_CHAIN_VERIFY=1
12-
CERT_CHAIN_GEN=1
1312

1413
# Ensure header is large enough to hold the cert chain (check sign tool output)
1514
# for actual length

‎options.mk‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -992,11 +992,15 @@ ifneq ($(CERT_CHAIN_VERIFY),)
992992
CFLAGS += -DWOLFBOOT_CERT_CHAIN_VERIFY
993993
# export the private key in DER format so it can be used with certificates
994994
KEYGEN_OPTIONS += --der
995-
ifneq ($(CERT_CHAIN_GEN),)
996-
# Use dummy cert chain file if not provided (needs to be generated when keys are generated)
995+
996+
# User-provided cert chain takes precedence
997+
ifneq ($(USER_CERT_CHAIN),)
998+
CERT_CHAIN_FILE = $(USER_CERT_CHAIN)
999+
else
1000+
# Auto-generate dummy cert chain (when USER_CERT_CHAIN not provided)
9971001
CERT_CHAIN_FILE = test-dummy-ca/raw-chain.der
9981002

999-
# Set appropriate cert gen options based on sigalg
1003+
# Set appropriate cert gen algo based on signature algorithm
10001004
ifeq ($(SIGN),ECC256)
10011005
CERT_CHAIN_GEN_ALGO+=ecc256
10021006
endif
@@ -1006,10 +1010,6 @@ ifneq ($(CERT_CHAIN_VERIFY),)
10061010
ifeq ($(SIGN),RSA4096)
10071011
CERT_CHAIN_GEN_ALGO+=rsa4096
10081012
endif
1009-
else
1010-
ifeq ($(CERT_CHAIN_FILE),)
1011-
$(error CERT_CHAIN_FILE must be specified when CERT_CHAIN_VERIFY is enabled and not using CERT_CHAIN_GEN)
1012-
endif
10131013
endif
10141014
SIGN_OPTIONS += --cert-chain $(CERT_CHAIN_FILE)
10151015
endif

0 commit comments

Comments
 (0)