diff options
author | Bastian Krause <bst@pengutronix.de> | 2020-06-24 18:08:48 +0200 |
---|---|---|
committer | Michael Olbrich <m.olbrich@pengutronix.de> | 2020-06-26 13:00:21 +0200 |
commit | ea9676b3e7839dc38703a0992b5ec15e75fe83c3 (patch) | |
tree | b4a26834fbbc68f33d319dda234a21c26667c57d /doc | |
parent | efcf25c7cbcb2fb1f8ec62076a56653f335c5be3 (diff) | |
download | ptxdist-ea9676b3e7839dc38703a0992b5ec15e75fe83c3.tar.gz ptxdist-ea9676b3e7839dc38703a0992b5ec15e75fe83c3.tar.xz |
doc: ref_code_signing_helpers: clarify CA keyring function usage
Signed-off-by: Bastian Krause <bst@pengutronix.de>
Message-Id: <20200624160849.6966-1-bst@pengutronix.de>
Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
Diffstat (limited to 'doc')
-rw-r--r-- | doc/ref_code_signing_helpers.rst | 24 |
1 files changed, 17 insertions, 7 deletions
diff --git a/doc/ref_code_signing_helpers.rst b/doc/ref_code_signing_helpers.rst index c3ffe01cb..f7928f52e 100644 --- a/doc/ref_code_signing_helpers.rst +++ b/doc/ref_code_signing_helpers.rst @@ -7,7 +7,7 @@ PTXdist provides various bash helper functions to be used in :ref:`code signing providers <code_signing_providers>` and :ref:`code signing consumers <code_signing_consumers>`. -PTXdist stores URIs and CAs using these helpers in +PTXdist stores URIs and CA keyrings using these helpers in ``$(PTXDIST_SYSROOT_HOST)/var/lib/keys/<signing-provider>/<role>/{uri,ca.pem}``. SoftHSM Provider Functions @@ -29,6 +29,8 @@ Usage: Initialize SoftHSM, and set the initial pins. +.. _cs_import_cert_from_der: + cs_import_cert_from_der ^^^^^^^^^^^^^^^^^^^^^^^ @@ -46,6 +48,8 @@ Preconditions: - the role must have been defined (see :ref:`cs_define_role`) - SoftHSM must have been initialized (see :ref:`cs_init_softhsm`) +.. _cs_import_cert_from_pem: + cs_import_cert_from_pem ^^^^^^^^^^^^^^^^^^^^^^^ @@ -164,7 +168,9 @@ Usage: cs_append_ca_from_pem <role> <PEM> -Append certificate from a given PEM file for role. +Append certificate from a given PEM file to the role's CA keyring. +If no CA keyring exists yet it is created as an empty file before. + Preconditions: @@ -181,7 +187,8 @@ Usage: cs_append_ca_from_der <role> <DER> -Append certificate from a given DER file for role. +Append certificate from a given DER file to the role's CA keyring. +If no CA keyring exists yet it is created as an empty file before. Preconditions: @@ -198,18 +205,21 @@ Usage: cs_append_ca_from_uri <role> [<URI>] -Append certificate from a given PKCS#11 URI for role. +Append certificate from a given PKCS#11 URI to the role's CA keyring. If URI is omitted the already set URI for role is used. +If no CA keyring exists yet it is created as an empty file before. Preconditions: - the role must have been defined (see :ref:`cs_define_role`) +- when used with SoftHSM, certificates must have been imported before + (see :ref:`cs_import_cert_from_der`, :ref:`cs_import_cert_from_pem`) Consumer Functions ~~~~~~~~~~~~~~~~~~ Packages that want to sign something or need access to keys/CAs can retrieve -PKCS#11 URIs and CAs with these helpers. +PKCS#11 URIs and CA keyrings with these helpers. .. _cs_get_uri: @@ -239,10 +249,10 @@ Usage: cs_get_ca <role> -Get path to the CA in PEM format for role. +Get path to the CA keyring in PEM format for role. Preconditions: -- a certificate must have been appended to the CA +- a certificate must have been appended to the CA keyring (see :ref:`cs_append_ca_from_pem`, :ref:`cs_append_ca_from_der`, :ref:`cs_append_ca_from_uri`) |