From 04ac0b3c2711a4cb2f35983e91ff0ee842b52bbd Mon Sep 17 00:00:00 2001 From: laurenw-arm Date: Tue, 9 Jan 2024 20:38:10 -0600 Subject: [PATCH] feat(fconf): support signing-key in root cert node Until now we have only supported describing chain of trusts through the CoT DTB with a single ROTPK so the signing key for root certificates was implicit. Therefore signing key was not a supported property in the root certificates node. Now we want to extend that to describe CoTs with mulitiple roots of trust so we need a way to specify for each root certificate with which ROTPK it should be verified. For that, we reuse the 'signing-key' property already in use for the non-root certificates, but we make it optional for root certificates in single-RoT CoTs and for root certificates signed with the default ROTPK in multi-RoT CoTs. Change-Id: I41eb6579e8f1d01eaf10480fe5e224d2eed9c736 Signed-off-by: Lauren Wehrmeister --- lib/fconf/fconf_cot_getter.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/lib/fconf/fconf_cot_getter.c b/lib/fconf/fconf_cot_getter.c index 1033018d3..b9bc9de0f 100644 --- a/lib/fconf/fconf_cot_getter.c +++ b/lib/fconf/fconf_cot_getter.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2020-2023, Arm Limited. All rights reserved. + * Copyright (c) 2020-2024, Arm Limited. All rights reserved. * * SPDX-License-Identifier: BSD-3-Clause */ @@ -237,13 +237,17 @@ static int populate_and_set_auth_methods(const void *dtb, int node, * verified by signature and images are verified by hash. */ if (type == IMG_CERT) { - if (root_certificate) { - oid = NULL; - } else { - rc = get_oid(dtb, node, "signing-key", &oid); - if (rc < 0) { + rc = get_oid(dtb, node, "signing-key", &oid); + if (rc < 0) { + /* + * The signing-key property is optional in root + * certificates, mandatory otherwise. + */ + if (root_certificate) { + oid = NULL; + } else { ERROR("FCONF: Can't read %s property\n", - "signing-key"); + "signing-key"); return rc; } }