diff options
author | Marco Chen <marco.chen@chromium.org> | 2017-09-28 13:53:04 +0800 |
---|---|---|
committer | chrome-bot <chrome-bot@chromium.org> | 2017-10-03 08:16:14 -0700 |
commit | e0a9a13c82b3e9fbba21250be116de5b13d2a974 (patch) | |
tree | 33e6079ee9c75ddded7e3f20a628cb4b9bb829ff | |
parent | fb3c262eb0b2eb5d963680660dbbc5b00c6982df (diff) | |
download | vboot-e0a9a13c82b3e9fbba21250be116de5b13d2a974.tar.gz |
Add a script to generate a keypair for signing Staff RW firmware.
Staff decided to leverage the key format of Hammer therefore this
script calls Hammer's one to generate a key pair and renames them to
key_staff*.
BUG=b:66889892
TEST=Run this script in the chroot and verify the generated key pair.
BRANCH=None
Change-Id: I73162efaba47a8c08336805130ced0be25ab262a
Reviewed-on: https://chromium-review.googlesource.com/688522
Commit-Ready: Marco Chen <marcochen@chromium.org>
Tested-by: Marco Chen <marcochen@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>
4 files changed, 89 insertions, 104 deletions
diff --git a/scripts/keygeneration/accessory/common_leverage_hammer.sh b/scripts/keygeneration/accessory/common_leverage_hammer.sh new file mode 100644 index 00000000..1e0f7123 --- /dev/null +++ b/scripts/keygeneration/accessory/common_leverage_hammer.sh @@ -0,0 +1,69 @@ +#!/bin/bash + +# Copyright 2017 The Chromium OS Authors. All rights reserved. +# Use of this source code is governed by a BSD-style license that can be +# found in the LICENSE file. + +# Load common constants and functions. +. "$(dirname "$0")/../common.sh" + +usage() { + cat <<EOF +Usage: ${PROG} [options] + +Options: + -o, --output_dir <dir>: Where to write the keys (default is cwd) +EOF + + if [[ $# -ne 0 ]]; then + die "$*" + else + exit 0 + fi +} + +generate_rsa3072_exp3_key() { + local output_dir="$1" + local key_name="$2" + + # Generate RSA key. + openssl genrsa -3 -out "${output_dir}/temp.pem" 3072 + + # Create a keypair from an RSA .pem file generated above. + futility create "${output_dir}/temp.pem" "${output_dir}/key_${key_name}" + + # Best attempt to securely delete the temp.pem file. + shred --remove "${output_dir}/temp.pem" +} + +# To generate a keypair with the same algorithm of Hammer and rename the kepair +# to specific accessory's name. +leverage_hammer_to_create_key() { + local output_dir="${PWD}" + local key_name="$1" + shift + + while [[ $# -gt 0 ]]; do + case "$1" in + -h|--help) + usage + ;; + -o|--output_dir) + output_dir="$2" + if [[ ! -d "${output_dir}" ]]; then + die "output dir ("${output_dir}") doesn't exist." + fi + shift + ;; + -*) + usage "Unknown option: "$1"" + ;; + *) + usage "Unknown argument "$1"" + ;; + esac + shift + done + + generate_rsa3072_exp3_key "${output_dir}" "${key_name}" +} diff --git a/scripts/keygeneration/accessory/create_new_hammer_keys.sh b/scripts/keygeneration/accessory/create_new_hammer_keys.sh index 684c0d37..30f005d9 100755 --- a/scripts/keygeneration/accessory/create_new_hammer_keys.sh +++ b/scripts/keygeneration/accessory/create_new_hammer_keys.sh @@ -5,62 +5,12 @@ # found in the LICENSE file. # Load common constants and functions. -. "$(dirname "$0")/../common.sh" - -usage() { - cat <<EOF -Usage: ${PROG} DIR - -DIR: To generate a keypair from an RSA 3072 key (.pem file) for Hammer at DIR - -EOF - - if [[ $# -ne 0 ]]; then - die "$*" - else - exit 0 - fi -} - -# Generate a keypair at the given directory. -generate_key() { - local dir=$1 - - # Generate RSA key. - openssl genrsa -3 -out "${dir}/temp.pem" 3072 - - # Create a keypair from an RSA .pem file generated above. - futility create "${dir}/temp.pem" "${dir}/key_hammer" - - # Best attempt to securely delete the temp.pem file. - shred --remove "${dir}/temp.pem" -} +. "$(dirname "$0")/common_leverage_hammer.sh" main() { set -e - local dir - - while [[ $# -gt 0 ]]; do - case $1 in - -h|--help) - usage - ;; - -*) - usage "Unknown option: $1" - ;; - *) - break - ;; - esac - done - - if [[ $# -ne 1 ]]; then - usage "Missing output directory" - fi - dir="$1" - - generate_key "${dir}" + leverage_hammer_to_create_key "hammer" "$@" } main "$@" diff --git a/scripts/keygeneration/accessory/create_new_rose_keys.sh b/scripts/keygeneration/accessory/create_new_rose_keys.sh index c3be31ba..6fcbffa8 100755 --- a/scripts/keygeneration/accessory/create_new_rose_keys.sh +++ b/scripts/keygeneration/accessory/create_new_rose_keys.sh @@ -5,62 +5,12 @@ # found in the LICENSE file. # Load common constants and functions. -. "$(dirname "$0")/../common.sh" - -usage() { - cat <<EOF -Usage: ${PROG} DIR - -DIR: To generate a keypair from an RSA 3072 key (.pem file) for Rose at DIR - -EOF - - if [[ $# -ne 0 ]]; then - die "$*" - else - exit 0 - fi -} - -# Generate a keypair from hammer's script at the given directory. -generate_key() { - local dir=$1 - TMP=$(mktemp -d --suffix=.create_rose_keys) - - ./create_new_hammer_keys.sh "${TMP}" - if [[ $? -ne 0 ]]; then - die "Failed to call create_new_hammer_keys.sh." - fi - - mv "${TMP}/key_hammer.vbprik2" "${dir}/key_rose.vbprik2" - mv "${TMP}/key_hammer.vbpubk2" "${dir}/key_rose.vbpubk2" -} +. "$(dirname "$0")/common_leverage_hammer.sh" main() { set -e - local dir - - while [[ $# -gt 0 ]]; do - case $1 in - -h|--help) - usage - ;; - -*) - usage "Unknown option: $1" - ;; - *) - break - ;; - esac - done - - if [[ $# -ne 1 ]]; then - usage "Missing output directory" - fi - dir="$1" - - generate_key "${dir}" + leverage_hammer_to_create_key "rose" "$@" } main "$@" diff --git a/scripts/keygeneration/accessory/create_new_staff_keys.sh b/scripts/keygeneration/accessory/create_new_staff_keys.sh new file mode 100755 index 00000000..1a582b57 --- /dev/null +++ b/scripts/keygeneration/accessory/create_new_staff_keys.sh @@ -0,0 +1,16 @@ +#!/bin/bash + +# Copyright 2017 The Chromium OS Authors. All rights reserved. +# Use of this source code is governed by a BSD-style license that can be +# found in the LICENSE file. + +# Load common constants and functions. +. "$(dirname "$0")/common_leverage_hammer.sh" + +main() { + set -e + + leverage_hammer_to_create_key "staff" "$@" +} + +main "$@" |