1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
|
// SPDX-License-Identifier: MIT
/*
* The 'fsverity sign' command
*
* Copyright 2018 Google LLC
*
* Use of this source code is governed by an MIT-style
* license that can be found in the LICENSE file or at
* https://opensource.org/licenses/MIT.
*/
#include "fsverity.h"
#include <fcntl.h>
#include <getopt.h>
static bool write_signature(const char *filename, const u8 *sig, u32 sig_size)
{
struct filedes file;
bool ok;
if (!open_file(&file, filename, O_WRONLY|O_CREAT|O_TRUNC, 0644))
return false;
ok = full_write(&file, sig, sig_size);
ok &= filedes_close(&file);
return ok;
}
static const struct option longopts[] = {
{"key", required_argument, NULL, OPT_KEY},
{"cert", required_argument, NULL, OPT_CERT},
{"pkcs11-engine", required_argument, NULL, OPT_PKCS11_ENGINE},
{"pkcs11-module", required_argument, NULL, OPT_PKCS11_MODULE},
{"pkcs11-keyid", required_argument, NULL, OPT_PKCS11_KEYID},
{"hash-alg", required_argument, NULL, OPT_HASH_ALG},
{"block-size", required_argument, NULL, OPT_BLOCK_SIZE},
{"salt", required_argument, NULL, OPT_SALT},
{"out-merkle-tree", required_argument, NULL, OPT_OUT_MERKLE_TREE},
{"out-descriptor", required_argument, NULL, OPT_OUT_DESCRIPTOR},
{NULL, 0, NULL, 0}
};
/* Sign a file for fs-verity by computing its digest, then signing it. */
int fsverity_cmd_sign(const struct fsverity_command *cmd,
int argc, char *argv[])
{
struct filedes file = { .fd = -1 };
struct libfsverity_merkle_tree_params tree_params = { .version = 1 };
struct libfsverity_signature_params sig_params = {};
struct libfsverity_digest *digest = NULL;
char digest_hex[FS_VERITY_MAX_DIGEST_SIZE * 2 + 1];
u8 *sig = NULL;
size_t sig_size;
int status;
int c;
while ((c = getopt_long(argc, argv, "", longopts, NULL)) != -1) {
switch (c) {
case OPT_KEY:
if (sig_params.keyfile != NULL) {
error_msg("--key can only be specified once");
goto out_usage;
}
sig_params.keyfile = optarg;
break;
case OPT_CERT:
if (sig_params.certfile != NULL) {
error_msg("--cert can only be specified once");
goto out_usage;
}
sig_params.certfile = optarg;
break;
case OPT_PKCS11_ENGINE:
if (sig_params.pkcs11_engine != NULL) {
error_msg("--pkcs11-engine can only be specified once");
goto out_usage;
}
sig_params.pkcs11_engine = optarg;
break;
case OPT_PKCS11_MODULE:
if (sig_params.pkcs11_module != NULL) {
error_msg("--pkcs11-module can only be specified once");
goto out_usage;
}
sig_params.pkcs11_module = optarg;
break;
case OPT_PKCS11_KEYID:
if (sig_params.pkcs11_keyid != NULL) {
error_msg("--pkcs11-keyid can only be specified once");
goto out_usage;
}
sig_params.pkcs11_keyid = optarg;
break;
case OPT_HASH_ALG:
case OPT_BLOCK_SIZE:
case OPT_SALT:
case OPT_OUT_MERKLE_TREE:
case OPT_OUT_DESCRIPTOR:
if (!parse_tree_param(c, optarg, &tree_params))
goto out_usage;
break;
default:
goto out_usage;
}
}
argv += optind;
argc -= optind;
if (argc != 2)
goto out_usage;
if (sig_params.certfile == NULL)
sig_params.certfile = sig_params.keyfile;
if (!open_file(&file, argv[0], O_RDONLY, 0))
goto out_err;
if (!get_file_size(&file, &tree_params.file_size))
goto out_err;
if (libfsverity_compute_digest(&file, read_callback,
&tree_params, &digest) != 0) {
error_msg("failed to compute digest");
goto out_err;
}
if (libfsverity_sign_digest(digest, &sig_params,
&sig, &sig_size) != 0) {
error_msg("failed to sign digest");
goto out_err;
}
if (!write_signature(argv[1], sig, sig_size))
goto out_err;
ASSERT(digest->digest_size <= FS_VERITY_MAX_DIGEST_SIZE);
bin2hex(digest->digest, digest->digest_size, digest_hex);
printf("Signed file '%s' (%s:%s)\n", argv[0],
libfsverity_get_hash_name(digest->digest_algorithm), digest_hex);
status = 0;
out:
filedes_close(&file);
if (!destroy_tree_params(&tree_params) && status == 0)
status = 1;
free(digest);
free(sig);
return status;
out_err:
status = 1;
goto out;
out_usage:
usage(cmd, stderr);
status = 2;
goto out;
}
|
