[gentoo-dev] [PATCH 1/3] secureboot.eclass: check and fail early if key or cert in DER format

[gentoo-dev] [PATCH 1/3] secureboot.eclass: check and fail early if key or cert in DER format

[Andrew Ammerlaan]

Bug: https://bugs.gentoo.org/936402
Signed-off-by: Andrew Ammerlaan <andrewammerlaan@gentoo.org>
---
 eclass/secureboot.eclass | 26 +++++++++++++++++++-------
 1 file changed, 19 insertions(+), 7 deletions(-)

diff --git a/eclass/secureboot.eclass b/eclass/secureboot.eclass
index a9ba514cb7a0..4459b0341845 100644
--- a/eclass/secureboot.eclass
+++ b/eclass/secureboot.eclass
@@ -1,4 +1,4 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # @ECLASS: secureboot.eclass
@@ -44,7 +44,12 @@ case ${EAPI} in
 esac
 
 IUSE="secureboot"
-BDEPEND="secureboot? ( app-crypt/sbsigntools )"
+BDEPEND="
+	secureboot? (
+		app-crypt/sbsigntools
+		dev-libs/openssl
+	)
+"
 
 # @ECLASS_VARIABLE: SECUREBOOT_SIGN_KEY
 # @USER_VARIABLE
@@ -75,12 +80,19 @@ _secureboot_die_if_unset() {
 	if [[ -z ${SECUREBOOT_SIGN_KEY} || -z ${SECUREBOOT_SIGN_CERT} ]]; then
 		die "USE=secureboot enabled but SECUREBOOT_SIGN_KEY and/or SECUREBOOT_SIGN_CERT not set."
 	fi
-	if [[ ! ${SECUREBOOT_SIGN_KEY} == pkcs11:* && ! -r ${SECUREBOOT_SIGN_KEY} ]]; then
-		die "SECUREBOOT_SIGN_KEY=${SECUREBOOT_SIGN_KEY} not found or not readable!"
-	fi
-	if [[ ! -r ${SECUREBOOT_SIGN_CERT} ]]; then
-		die "SECUREBOOT_SIGN_CERT=${SECUREBOOT_SIGN_CERT} not found or not readable!"
+
+	# Sanity check: fail early if key/cert in DER format or does not exist
+	local openssl_args=(
+		-inform PEM -in "${SECUREBOOT_SIGN_CERT}"
+		-noout -nocert
+	)
+	if [[ ${SECUREBOOT_SIGN_KEY} == pkcs11:* ]]; then
+		openssl_args+=( -engine pkcs11 -keyform ENGINE -key "${SECUREBOOT_SIGN_KEY}" )
+	else
+		openssl_args+=( -keyform PEM -key "${SECUREBOOT_SIGN_KEY}" )
 	fi
+	openssl x509 "${openssl_args[@]}" ||
+		die "Secure Boot signing certificate or key not found or not PEM format."
 }
 
 # @FUNCTION: secureboot_pkg_setup
-- 
2.45.2

[gentoo-dev] [PATCH 2/3] kernel-build.eclass: check and fail early if key or cert in DER format

[Andrew Ammerlaan]

Bug: https://bugs.gentoo.org/936402
Signed-off-by: Andrew Ammerlaan <andrewammerlaan@gentoo.org>
---
 eclass/kernel-build.eclass | 24 ++++++++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/eclass/kernel-build.eclass b/eclass/kernel-build.eclass
index cf060fa83766..fa01be28723f 100644
--- a/eclass/kernel-build.eclass
+++ b/eclass/kernel-build.eclass
@@ -133,8 +133,28 @@ kernel-build_pkg_setup() {
 	python-any-r1_pkg_setup
 	if [[ ${KERNEL_IUSE_MODULES_SIGN} ]]; then
 		secureboot_pkg_setup
-		if [[ -e ${MODULES_SIGN_KEY} && ${MODULES_SIGN_KEY} != pkcs11:* ]]; then
-			if [[ -e ${MODULES_SIGN_CERT} && ${MODULES_SIGN_CERT} != ${MODULES_SIGN_KEY} ]]; then
+
+		# Sanity check: fail early if key/cert in DER format or does not exist
+		local openssl_args=(
+			-noout -nocert
+		)
+		if [[ -n ${MODULES_SIGN_CERT} ]]; then
+			openssl_args+=( -inform PEM -in "${MODULES_SIGN_CERT}" )
+		else
+			# If no cert specified, we assume the pem key also contains the cert
+			openssl_args+=( -inform PEM -in "${MODULES_SIGN_KEY}" )
+		fi
+		if [[ ${MODULES_SIGN_KEY} == pkcs11:* ]]; then
+			openssl_args+=( -engine pkcs11 -keyform ENGINE -key "${MODULES_SIGN_KEY}" )
+		else
+			openssl_args+=( -keyform PEM -key "${MODULES_SIGN_KEY}" )
+		fi
+
+		openssl x509 "${openssl_args[@]}" ||
+			die "Kernel module signing certificate or key not found or not PEM format."
+
+		if [[ ${MODULES_SIGN_KEY} != pkcs11:* ]]; then
+			if [[ ${MODULES_SIGN_CERT} != ${MODULES_SIGN_KEY} ]]; then
 				MODULES_SIGN_KEY_CONTENTS="$(cat "${MODULES_SIGN_CERT}" "${MODULES_SIGN_KEY}" || die)"
 			else
 				MODULES_SIGN_KEY_CONTENTS="$(< "${MODULES_SIGN_KEY}")"
-- 
2.45.2

[gentoo-dev] [PATCH 3/3] kernel-build.eclass: don't check key/cert if merging binary

[Andrew Ammerlaan]

Signed-off-by: Andrew Ammerlaan <andrewammerlaan@gentoo.org>
---
 eclass/kernel-build.eclass | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/eclass/kernel-build.eclass b/eclass/kernel-build.eclass
index fa01be28723f..aca387bb5abd 100644
--- a/eclass/kernel-build.eclass
+++ b/eclass/kernel-build.eclass
@@ -131,7 +131,7 @@ fi
 # Call python-any-r1 and secureboot pkg_setup
 kernel-build_pkg_setup() {
 	python-any-r1_pkg_setup
-	if [[ ${KERNEL_IUSE_MODULES_SIGN} ]]; then
+	if [[ ${KERNEL_IUSE_MODULES_SIGN} && ${MERGE_TYPE} != binary ]]; then
 		secureboot_pkg_setup
 
 		# Sanity check: fail early if key/cert in DER format or does not exist
-- 
2.45.2