1
2# Consider this file an example.
3#
4# For Junos this is how we obtain trust anchor .pems
5# the signing server (http://www.crufty.net/sjg/blog/signing-server.htm)
6# for each key will provide the appropriate certificate chain on request
7
8# allow site control
9.-include "site.trust.mk"
10
11#VE_DEBUG_LEVEL?=3
12#VE_VERBOSE_DEFAULT?=2
13
14VE_HASH_LIST?= \
15	SHA256 \
16	SHA384 \
17
18VE_SELF_TESTS?= yes
19
20# client for the signing server above
21SIGNER?= /opt/sigs/sign.py
22
23.if exists(${SIGNER})
24OPENPGP_SIGNER?= ${SIGNER:H}/openpgp-sign.py
25OPENPGP_SIGN_FLAGS= -a
26OPENPGP_SIGN_HOST?= localhost
27SIGN_HOST ?= localhost
28
29# A list of name/ext/url tuples.
30# name should be one of ECDSA, OPENPGP or RSA, they can be repeated
31# Order of ext list implies runtime preference so do not sort!
32VE_SIGN_URL_LIST?= \
33	ECDSA/esig/${SIGN_HOST}:${133%y:L:localtime} \
34	RSA/rsig/${SIGN_HOST}:${163%y:L:localtime} \
35	OPENPGP/asc/${OPENPGP_SIGN_HOST}:1234 \
36
37.for sig ext url in ${VE_SIGN_URL_LIST:@x@${x:H:H} ${x:H:T} ${x:T}@}
38SIGN_${sig}:= ${PYTHON} ${${sig}_SIGNER:U${SIGNER}} -u ${url} ${${sig}_SIGN_FLAGS:U-h sha256}
39
40VE_SIGNATURE_LIST+= ${sig}
41VE_SIGNATURE_EXT_LIST+= ${ext}
42
43_SIGN_${sig}_USE:	.USE
44	${SIGN_${sig}} ${.ALLSRC}
45
46_TA_${sig}_USE:       .USE
47	${SIGN_${sig}} -C ${.TARGET}
48
49.if ${sig} == "OPENPGP"
50ta_${sig:tl}.${ext}: _TA_${sig}_USE
51ta_${ext}.h: ta_${sig:tl}.${ext}
52.else
53${ext:S/sig/certs/}.pem: _TA_${sig}_USE
54# the last cert in the chain is the one we want
55ta_${ext}.pem: ${ext:S/sig/certs/}.pem _LAST_PEM_USE
56ta.h: ta_${ext}.pem
57.if ${VE_SELF_TESTS} != "no"
58# we use the 2nd last cert to test verification
59vc_${ext}.pem: ${ext:S/sig/certs/}.pem _2ndLAST_PEM_USE
60ta.h: vc_${ext}.pem
61.endif
62.endif
63.endfor
64
65# cleanup duplicates
66VE_SIGNATURE_LIST:= ${VE_SIGNATURE_LIST:O:u}
67
68.if target(ta_asc.h)
69XCFLAGS.opgp_key+= -DHAVE_TA_ASC_H
70
71.if ${VE_SELF_TESTS} != "no"
72# for self test
73vc_openpgp.asc: ta_openpgp.asc
74	${SIGN_OPENPGP} ${.ALLSRC:M*.asc}
75	mv ta_openpgp.asc.asc ${.TARGET}
76
77ta_asc.h: vc_openpgp.asc
78.endif
79.endif
80
81.else
82VE_SIGNATURE_LIST?= RSA
83
84# you need to provide t*.pem or t*.asc files for each trust anchor
85# below assumes they are named ta_${ext}.pem eg ta_esig.pem for ECDSA
86.if empty(TRUST_ANCHORS)
87TRUST_ANCHORS!= cd ${.CURDIR} && 'ls' -1 *.pem t*.asc 2> /dev/null
88.endif
89.if empty(TRUST_ANCHORS) && ${MK_LOADER_EFI_SECUREBOOT} != "yes"
90.error Need TRUST_ANCHORS see ${.PARSEDIR}/README.rst
91.endif
92
93.if ${TRUST_ANCHORS:T:Mt*.pem} != ""
94ta.h: ${TRUST_ANCHORS:M*.pem}
95VE_SIGNATURE_EXT_LIST?= ${TRUST_ANCHORS:T:Mt*.pem:R:S/ta_//}
96.if ${VE_SIGNATURE_EXT_LIST:Mesig} != ""
97VE_SIGNATURE_LIST+= ECDSA
98.endif
99.endif
100
101.if ${TRUST_ANCHORS:T:Mt*.asc} != ""
102VE_SIGNATURE_LIST+= OPENPGP
103VE_SIGNATURE_EXT_LIST+= asc
104ta_asc.h: ${TRUST_ANCHORS:M*.asc}
105.endif
106# we take the mtime of this as our baseline time
107BUILD_UTC_FILE?= ${TRUST_ANCHORS:[1]}
108.endif
109