mbox series

[v2,0/8] ima-evm-utils: Add support for signing with pkcs11 URIs

Message ID 20210810134557.2444863-1-stefanb@linux.vnet.ibm.com (mailing list archive)
Headers show
Series ima-evm-utils: Add support for signing with pkcs11 URIs | expand

Message

Stefan Berger Aug. 10, 2021, 1:45 p.m. UTC 
From: Stefan Berger <stefanb@linux.ibm.com>

This series of patches adds support for signing with pkcs11 URIs and the
keyid explicitly provided via a command line option.
A test program is provided setting up softhsm for test cases to use. Tests
are passing on gitub actions with some distros not enabled (Debian, Ubuntu)
where I could not reproduce the github actions failure on the same type of
container locally (debian:stable).

   Stefan
   
v2:
  - Use global imaevm_params.eng field for the ENGINE
  - Fix bug on engine initialization in existing code

Stefan Berger (8):
  evmctl: Implement support for EVMCTL_KEY_PASSWORD environment variable
  evmctl: Handle engine initialization properly
  evmctl: Move code setting up engine to own funtion
  evmctl: Extend libimaevm_params with ENGINE field and use it
  evmctl: Setup the pkcs11 engine if key has pkcs11: prefix
  libimaevm: Add support for pkcs11 private keys for signing a v2 hash
  tests: Extend sign_verify test with pkcs11-specific test
  tests: Get the packages for pkcs11 testing on the CI/CD system

 README                 |   5 +
 ci/alt.sh              |   3 +
 ci/fedora.sh           |   8 ++
 ci/tumbleweed.sh       |   3 +
 src/evmctl.c           |  54 +++++---
 src/imaevm.h           |   2 +
 src/libimaevm.c        |  47 +++++--
 tests/functions.sh     |  26 ++++
 tests/sign_verify.test |  50 +++++--
 tests/softhsm_setup    | 290 +++++++++++++++++++++++++++++++++++++++++
 10 files changed, 448 insertions(+), 40 deletions(-)
 create mode 100755 tests/softhsm_setup

Comments

Mimi Zohar Sept. 3, 2021, 12:54 p.m. UTC | #1 
Hi Stefan,

On Tue, 2021-08-10 at 09:45 -0400, Stefan Berger wrote:
> From: Stefan Berger <stefanb@linux.ibm.com>
> 
> This series of patches adds support for signing with pkcs11 URIs and the
> keyid explicitly provided via a command line option.

Before explaining "what" , please provide the motivation for adding
pkcs11 support.

Other than updating the cover letter and the patch descriptions,
patches 1 - 6 look good.  (Still looking at 7/8 and 8/8.)

thanks,

Mimi