blob: f7928f52ebef8edb81e558ab00d9fc643c2058eb (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
|
.. _code_signing_helper_functions:
Code Signing Helper Functions
-----------------------------
PTXdist provides various bash helper functions to be used in :ref:`code signing
providers <code_signing_providers>` and :ref:`code signing consumers
<code_signing_consumers>`.
PTXdist stores URIs and CA keyrings using these helpers in
``$(PTXDIST_SYSROOT_HOST)/var/lib/keys/<signing-provider>/<role>/{uri,ca.pem}``.
SoftHSM Provider Functions
~~~~~~~~~~~~~~~~~~~~~~~~~~
These helpers initialize and import public/private keys and certificates into
the SoftHSM.
.. _cs_init_softhsm:
cs_init_softhsm
^^^^^^^^^^^^^^^
Usage:
.. code-block:: bash
cs_init_softhsm
Initialize SoftHSM, and set the initial pins.
.. _cs_import_cert_from_der:
cs_import_cert_from_der
^^^^^^^^^^^^^^^^^^^^^^^
Usage:
.. code-block:: bash
cs_import_cert_from_der <role> <DER>
Import certificate from a given DER file for role.
To be used with SoftHSM only.
Preconditions:
- the role must have been defined (see :ref:`cs_define_role`)
- SoftHSM must have been initialized (see :ref:`cs_init_softhsm`)
.. _cs_import_cert_from_pem:
cs_import_cert_from_pem
^^^^^^^^^^^^^^^^^^^^^^^
Usage:
.. code-block:: bash
cs_import_cert_from_pem <role> <PEM>
Import certificate from a given PEM file for role.
To be used with SoftHSM only.
Preconditions:
- the role must have been defined (see :ref:`cs_define_role`)
- SoftHSM must have been initialized (see :ref:`cs_init_softhsm`)
cs_import_pubkey_from_pem
^^^^^^^^^^^^^^^^^^^^^^^^^
Usage:
.. code-block:: bash
cs_import_pubkey_from_pem <role> <PEM>
Import public key from a given PEM file for role.
To be used with SoftHSM only.
Preconditions:
- the role must have been defined (see :ref:`cs_define_role`)
- SoftHSM must have been initialized (see :ref:`cs_init_softhsm`)
cs_import_privkey_from_pem
^^^^^^^^^^^^^^^^^^^^^^^^^^
Usage:
.. code-block:: bash
cs_import_privkey_from_pem <role> <PEM>
Import private key from a given PEM file for role.
To be used with SoftHSM only.
Preconditions:
- the role must have been defined (see :ref:`cs_define_role`)
- SoftHSM must have been initialized (see :ref:`cs_init_softhsm`)
cs_import_key_from_pem
^^^^^^^^^^^^^^^^^^^^^^
Usage:
.. code-block:: bash
cs_import_key_from_pem <role> <PEM>
Import private/public key pair from a given PEM file for role.
To be used with SoftHSM only.
Preconditions:
- the role must have been defined (see :ref:`cs_define_role`)
- SoftHSM must have been initialized (see :ref:`cs_init_softhsm`)
Generic Provider Functions
~~~~~~~~~~~~~~~~~~~~~~~~~~
These helpers allow to define roles, set PKCS#11 URIs and handle certificate
authorities (CAs).
HSM as well as SoftHSM code signing providers should use them.
.. _cs_define_role:
cs_define_role
^^^^^^^^^^^^^^
Usage:
.. code-block:: bash
cs_define_role <role>
Define new key role.
A default PKCS#11 URI is set implicitly as convenience for SoftHSM use cases.
.. _cs_set_uri:
cs_set_uri
^^^^^^^^^^
Usage:
.. code-block:: bash
cs_set_uri <role> <URI>
Set given PKCS#11 URI for role.
Preconditions:
- the role must have been defined (see :ref:`cs_define_role`)
.. _cs_append_ca_from_pem:
cs_append_ca_from_pem
^^^^^^^^^^^^^^^^^^^^^
Usage:
.. code-block:: bash
cs_append_ca_from_pem <role> <PEM>
Append certificate from a given PEM file to the role's CA keyring.
If no CA keyring exists yet it is created as an empty file before.
Preconditions:
- the role must have been defined (see :ref:`cs_define_role`)
.. _cs_append_ca_from_der:
cs_append_ca_from_der
^^^^^^^^^^^^^^^^^^^^^
Usage:
.. code-block:: bash
cs_append_ca_from_der <role> <DER>
Append certificate from a given DER file to the role's CA keyring.
If no CA keyring exists yet it is created as an empty file before.
Preconditions:
- the role must have been defined (see :ref:`cs_define_role`)
.. _cs_append_ca_from_uri:
cs_append_ca_from_uri
^^^^^^^^^^^^^^^^^^^^^
Usage:
.. code-block:: bash
cs_append_ca_from_uri <role> [<URI>]
Append certificate from a given PKCS#11 URI to the role's CA keyring.
If URI is omitted the already set URI for role is used.
If no CA keyring exists yet it is created as an empty file before.
Preconditions:
- the role must have been defined (see :ref:`cs_define_role`)
- when used with SoftHSM, certificates must have been imported before
(see :ref:`cs_import_cert_from_der`, :ref:`cs_import_cert_from_pem`)
Consumer Functions
~~~~~~~~~~~~~~~~~~
Packages that want to sign something or need access to keys/CAs can retrieve
PKCS#11 URIs and CA keyrings with these helpers.
.. _cs_get_uri:
cs_get_uri
^^^^^^^^^^
Usage:
.. code-block:: bash
cs_get_uri <role>
Get PKCS#11 URI for role.
Preconditions:
- the URI must have been set (see :ref:`cs_set_uri`)
.. _cs_get_ca:
cs_get_ca
^^^^^^^^^
Usage:
.. code-block:: bash
cs_get_ca <role>
Get path to the CA keyring in PEM format for role.
Preconditions:
- a certificate must have been appended to the CA keyring
(see :ref:`cs_append_ca_from_pem`, :ref:`cs_append_ca_from_der`,
:ref:`cs_append_ca_from_uri`)
|
