From 175b336d326da1886eb14a252e263450dbc09358 Mon Sep 17 00:00:00 2001 From: Marc Hartmayer Date: Thu, 23 Jul 2026 17:55:38 +0200 Subject: [PATCH] rust/utils: Replace get_verified_hkds with get_verified_hkds_new Now as no users of get_verified_hkds exists, replace it with get_verified_hkds_new. Signed-off-by: Marc Hartmayer Reviewed-by: Steffen Eiden Signed-off-by: Steffen Eiden --- rust/pvattest/src/cmd/create.rs | 2 +- rust/pvimg/src/cmd/create.rs | 2 +- rust/pvsecret/src/cmd/create.rs | 2 +- rust/pvverify/src/main.rs | 2 +- rust/utils/src/cli.rs | 42 ++------------------------------- 5 files changed, 6 insertions(+), 44 deletions(-) diff --git a/rust/pvattest/src/cmd/create.rs b/rust/pvattest/src/cmd/create.rs index e9d4eea5..3d605dcf 100644 --- a/rust/pvattest/src/cmd/create.rs +++ b/rust/pvattest/src/cmd/create.rs @@ -62,7 +62,7 @@ fn determine_version( } pub fn create(opt: &CreateAttOpt) -> Result { - let hkds = opt.certificate_args.get_verified_hkds_new( + let hkds = opt.certificate_args.get_verified_hkds( "attestation request", AttVersionSelection::Explicit(opt.att_version).map(|v| v.into()), )?; diff --git a/rust/pvimg/src/cmd/create.rs b/rust/pvimg/src/cmd/create.rs index 243bdfe5..239cdf56 100644 --- a/rust/pvimg/src/cmd/create.rs +++ b/rust/pvimg/src/cmd/create.rs @@ -313,7 +313,7 @@ fn determine_version(cli_version: HdrVersionSelection, host_keys: &[HostKey]) -> pub fn create(opt: &CreateBootImageArgs) -> Result { // Verify host key documents first, because if they are not valid there is // no reason to continue. - let verified_host_keys = opt.certificate_args.get_verified_hkds_new( + let verified_host_keys = opt.certificate_args.get_verified_hkds( "Secure Execution image", HdrVersionSelection::Explicit(opt.hdr_version).map(|v| v.into()), )?; diff --git a/rust/pvsecret/src/cmd/create.rs b/rust/pvsecret/src/cmd/create.rs index dc9f263f..5d476b6a 100644 --- a/rust/pvsecret/src/cmd/create.rs +++ b/rust/pvsecret/src/cmd/create.rs @@ -201,7 +201,7 @@ fn build_asrcb(opt: &CreateSecretOpt) -> Result { let (boot_tags, _) = BootHdrTags::from_se_image(&mut se_hdr) .with_context(|| format!("Provided SE-header in '{}' is malformed", &opt.hdr))?; - let hkds = opt.certificate_args.get_verified_hkds_new( + let hkds = opt.certificate_args.get_verified_hkds( "secret", SecretVersionSelection::Explicit(opt.secret_version).map(|v| v.into()), )?; diff --git a/rust/pvverify/src/main.rs b/rust/pvverify/src/main.rs index 2180b1d6..59834a8e 100644 --- a/rust/pvverify/src/main.rs +++ b/rust/pvverify/src/main.rs @@ -16,7 +16,7 @@ fn main() -> Result<()> { LOGGER.start(LevelFilter::Trace)?; let opt = cli::CliOptions::parse(); opt.certificate_args - .get_verified_hkds_new("info", opt.hkd_version.map(|v| v.into()))?; + .get_verified_hkds("info", opt.hkd_version.map(|v| v.into()))?; info!("Host-key documents verified."); Ok(()) } diff --git a/rust/utils/src/cli.rs b/rust/utils/src/cli.rs index 53d7b1cc..314dc0bb 100644 --- a/rust/utils/src/cli.rs +++ b/rust/utils/src/cli.rs @@ -13,7 +13,7 @@ use clap::{Arg, ArgAction, ArgGroup, Args, Command, ValueEnum, ValueHint}; use log::{info, warn, LevelFilter}; use openssl::Nid; use pv::misc::{create_file, open_file, read_certs, read_file}; -use pv::request::openssl::pkey::{KeyType, PKey, PKeyRef, Public}; +use pv::request::openssl::pkey::{KeyType, PKeyRef, Public}; use pv::request::{openssl, HkdVerifier, HostKey, HybridPKey}; use pv::{Error, Result}; use utils_macros::{ValueEnumDisplay, ValueEnumFromStr}; @@ -239,44 +239,6 @@ impl CertificateOptions { } } - /// Read the host-keys specified and verifies them if required - /// - /// - `protectee`: what you want to create. e.g. add-secret request or SE-image - /// - /// # Error - /// Returns an error if something went wrong during parsing the HKDs, the verification chain - /// could not built, or when the verification - /// failed. - pub fn get_verified_hkds(&self, protectee: &'static str) -> Result>> { - let hkds = &self.host_key_documents; - let verifier = self.verifier(protectee)?; - - let mut res = Vec::with_capacity(hkds.len()); - for hkd in hkds { - let hk = read_file(hkd, "host-key document")?; - let certs = read_certs(&hk).map_err(|source| Error::HkdNotPemOrDer { - hkd: hkd.display().to_string(), - source, - })?; - if certs.is_empty() { - return Err(Error::NoHkdInFile(hkd.display().to_string())); - } - if certs.len() != 1 { - warn!( - "The host-key document in '{}' contains more than one certificate!", - hkd.display() - ) - } - - // Panic: len is == 1 -> unwrap will succeed/not panic - let c = certs.first().unwrap(); - verifier.verify(c)?; - res.push(c.public_key()?); - info!("Use host-key document at '{}'", hkd.display()); - } - Ok(res) - } - fn is_ec_p521_key(key: &PKeyRef) -> bool { if key.id() == openssl::pkey::Id::EC { let ec_key = key.ec_key().unwrap(); @@ -301,7 +263,7 @@ impl CertificateOptions { /// Returns an error if something went wrong during parsing the HKDs, the verification chain /// could not built, or when the verification /// failed. - pub fn get_verified_hkds_new( + pub fn get_verified_hkds( &self, protectee: &'static str, requested_version: HkdVersionSelection,