Radish alpha
H
HardenedBSD-pkg
rad:z3QDZAW2FAfuLvihrhiyDC9fAD8G9
HardenedBSD Package Manager
Radicle
Git
Commits › 91f59cb
libpkg: implement generate/pubout for the ossl signer
Kyle Evans committed 2 years ago
commit 91f59cb259c01cbd074fbcb0a3477d53da3de10c
parent 9132ae0
3 files changed +106 -15
modified libpkg/pkgsign_ossl.c
@@ -476,6 +476,102 @@ ossl_sign(struct pkgsign_ctx *sctx, const char *path, unsigned char **sigret,
}



static int
+ 
ossl_generate(struct pkgsign_ctx *sctx, const struct iovec *iov __unused,
+ 
    int niov __unused)
+ 
{
+ 
	char errbuf[1024];
+ 
	struct ossl_sign_ctx *keyinfo = OSSL_CTX(sctx);
+ 
	const char *path = sctx->path;
+ 
	EVP_PKEY_CTX *ctx;
+ 
	EVP_PKEY *pkey;
+ 
	FILE *fp;
+ 
	int rc;
+
+ 
	if (niov != 0)
+ 
		return (EPKG_FATAL);
+
+ 
	fp = fopen(path, "w");
+ 
	if (fp == NULL) {
+ 
		pkg_emit_errno("fopen write", path);
+ 
		return (EPKG_FATAL);
+ 
	}
+
+ 
	if (fchmod(fileno(fp), 0400) != 0) {
+ 
		pkg_emit_errno("fchmod", path);
+ 
		fclose(fp);
+ 
		return (EPKG_FATAL);
+ 
	}
+
+ 
	pkey = NULL;
+ 
	rc = EPKG_FATAL;
+ 
	ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_RSA, NULL);
+ 
	if (ctx == NULL)
+ 
		goto out;
+
+ 
	if (EVP_PKEY_keygen_init(ctx) <= 0)
+ 
		goto out;
+
+ 
	if (EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, 2048) <= 0)
+ 
		goto out;
+
+ 
	if (EVP_PKEY_keygen(ctx, &pkey) <= 0)
+ 
		goto out;
+
+ 
	if (PEM_write_PrivateKey(fp, pkey, NULL, NULL, 0, 0, NULL) <= 0)
+ 
		goto out;
+
+ 
	rc = EPKG_OK;
+ 
	if (keyinfo->key != NULL)
+ 
		EVP_PKEY_free(keyinfo->key);
+ 
	keyinfo->key = pkey;
+ 
out:
+ 
	if (rc != EPKG_OK) {
+ 
		pkg_emit_error("%s: %s", path,
+ 
		    ERR_error_string(ERR_get_error(), errbuf));
+
+ 
		/* keyinfo claims the pkey on success for any future operations. */
+ 
		EVP_PKEY_free(pkey);
+ 
	}
+
+ 
	fclose(fp);
+ 
	EVP_PKEY_CTX_free(ctx);
+ 
	return (rc);
+ 
}
+
+ 
static int
+ 
ossl_pubkey(struct pkgsign_ctx *sctx, char **pubkey, size_t *pubkeylen)
+ 
{
+ 
	char errbuf[1024];
+ 
	struct ossl_sign_ctx *keyinfo = OSSL_CTX(sctx);
+ 
	BIO *bp;
+
+ 
	if (keyinfo->key == NULL && _load_private_key(keyinfo) != EPKG_OK) {
+ 
		pkg_emit_error("can't load key from %s", sctx->path);
+ 
		return (EPKG_FATAL);
+ 
	}
+
+ 
	bp = BIO_new(BIO_s_mem());
+ 
	if (bp == NULL) {
+ 
		pkg_emit_error("error allocating public key bio: %s",
+ 
		    ERR_error_string(ERR_get_error(), errbuf));
+ 
		return (EPKG_FATAL);
+ 
	}
+
+ 
	BIO_set_close(bp, BIO_NOCLOSE);
+
+ 
	if (PEM_write_bio_PUBKEY(bp, keyinfo->key) <= 0) {
+ 
		pkg_emit_error("error writing public key: %s",
+ 
		    ERR_error_string(ERR_get_error(), errbuf));
+ 
		BIO_free(bp);
+ 
		return (EPKG_FATAL);
+ 
	}
+
+ 
	*pubkeylen = BIO_get_mem_data(bp, pubkey);
+ 
	BIO_free(bp);
+ 
	return (EPKG_OK);
+ 
}
+
+ 
static int

ossl_new(const char *name __unused, struct pkgsign_ctx *sctx __unused)

{
@@ -506,4 +602,7 @@ const struct pkgsign_ops pkgsign_ossl = {
	.pkgsign_sign = ossl_sign,

	.pkgsign_verify = ossl_verify,

	.pkgsign_verify_cert = ossl_verify_cert,
+
+ 
	.pkgsign_generate = ossl_generate,
+ 
	.pkgsign_pubkey = ossl_pubkey,

};
modified tests/frontend/fingerprint.sh
@@ -13,14 +13,12 @@ setup() {
	atf_skip_on Darwin Test fails on Darwin

	atf_skip_on Linux Test fails on Linux
- 
	atf_check -o ignore -e ignore \
- 
		openssl genrsa -out repo.key 2048
+ 
	atf_check -o save:repo.pub -e ignore \
+ 
		pkg key --create repo.key
+ 


	rm -rf ${TMPDIR}/keys || :

	mkdir -p ${_root}/${TMPDIR}/keys/trusted

	mkdir -p ${_root}/${TMPDIR}/keys/revoked
- 
	chmod 0400 repo.key
- 
	atf_check -o ignore -e ignore \
- 
		openssl rsa -in repo.key -out repo.pub -pubout

	_fingerprint=$(openssl dgst -sha256 -hex repo.pub | sed 's/^.* //')

	echo "function: sha256" > ${_root}/${TMPDIR}/keys/trusted/key

	echo "fingerprint: \"${_fingerprint}\"" >> ${_root}/${TMPDIR}/keys/trusted/key
modified tests/frontend/pubkey.sh
@@ -8,11 +8,8 @@ tests_init \


# New format, prefix the key type

pubkey_body() {
- 
	atf_check -o ignore -e ignore \
- 
		openssl genrsa -out repo.key 2048
- 
	chmod 0400 repo.key
- 
	atf_check -o ignore -e ignore \
- 
		openssl rsa -in repo.key -out repo.pub -pubout
+ 
	atf_check -o save:repo.pub -e ignore \
+ 
		pkg key --create repo.key

	mkdir fakerepo



	cat >> test.ucl << EOF
@@ -50,11 +47,8 @@ EOF


# Legacy format, unprefixed key passed to pkg-repo

pubkey_legacy_body() {
- 
	atf_check -o ignore -e ignore \
- 
		openssl genrsa -out repo.key 2048
- 
	chmod 0400 repo.key
- 
	atf_check -o ignore -e ignore \
- 
		openssl rsa -in repo.key -out repo.pub -pubout
+ 
	atf_check -o save:repo.pub -e ignore \
+ 
		pkg key --create repo.key

	mkdir fakerepo



	cat >> test.ucl << EOF