kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

rust/utils: Replace get_verified_hkds with get_verified_hkds_new

Browse Source 
Now as no users of get_verified_hkds exists, replace it with
get_verified_hkds_new.

Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
This commit is contained in:
Marc Hartmayer
2026-07-23 17:55:38 +02:00
committed by Steffen Eiden
parent 9a5c9cd7f9
commit 175b336d32
5 changed files with 6 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
rust/pvattest/src/cmd/create.rs
View File

@@ -62,7 +62,7 @@ fn determine_version(
}
pub fn create(opt: &CreateAttOpt) -> Result<ExitCode> {
let hkds = opt.certificate_args.get_verified_hkds_new(
let hkds = opt.certificate_args.get_verified_hkds(
"attestation request",
AttVersionSelection::Explicit(opt.att_version).map(|v| v.into()),
)?;

2
rust/pvimg/src/cmd/create.rs
View File

@@ -313,7 +313,7 @@ fn determine_version(cli_version: HdrVersionSelection, host_keys: &[HostKey]) ->
pub fn create(opt: &CreateBootImageArgs) -> Result<OwnExitCode> {
// Verify host key documents first, because if they are not valid there is
// no reason to continue.
let verified_host_keys = opt.certificate_args.get_verified_hkds_new(
let verified_host_keys = opt.certificate_args.get_verified_hkds(
"Secure Execution image",
HdrVersionSelection::Explicit(opt.hdr_version).map(|v| v.into()),
)?;

2
rust/pvsecret/src/cmd/create.rs
View File

@@ -201,7 +201,7 @@ fn build_asrcb(opt: &CreateSecretOpt) -> Result<AddSecretRequest> {
let (boot_tags, _) = BootHdrTags::from_se_image(&mut se_hdr)
.with_context(|| format!("Provided SE-header in '{}' is malformed", &opt.hdr))?;
let hkds = opt.certificate_args.get_verified_hkds_new(
let hkds = opt.certificate_args.get_verified_hkds(
"secret",
SecretVersionSelection::Explicit(opt.secret_version).map(|v| v.into()),
)?;

2
rust/pvverify/src/main.rs
View File

@@ -16,7 +16,7 @@ fn main() -> Result<()> {
LOGGER.start(LevelFilter::Trace)?;
let opt = cli::CliOptions::parse();
opt.certificate_args
.get_verified_hkds_new("info", opt.hkd_version.map(|v| v.into()))?;
.get_verified_hkds("info", opt.hkd_version.map(|v| v.into()))?;
info!("Host-key documents verified.");
Ok(())
}

42
rust/utils/src/cli.rs
View File

@@ -13,7 +13,7 @@ use clap::{Arg, ArgAction, ArgGroup, Args, Command, ValueEnum, ValueHint};
use log::{info, warn, LevelFilter};
use openssl::Nid;
use pv::misc::{create_file, open_file, read_certs, read_file};
use pv::request::openssl::pkey::{KeyType, PKey, PKeyRef, Public};
use pv::request::openssl::pkey::{KeyType, PKeyRef, Public};
use pv::request::{openssl, HkdVerifier, HostKey, HybridPKey};
use pv::{Error, Result};
use utils_macros::{ValueEnumDisplay, ValueEnumFromStr};
@@ -239,44 +239,6 @@ impl CertificateOptions {
}
}
/// Read the host-keys specified and verifies them if required
///
/// - `protectee`: what you want to create. e.g. add-secret request or SE-image
///
/// # Error
/// Returns an error if something went wrong during parsing the HKDs, the verification chain
/// could not built, or when the verification
/// failed.
pub fn get_verified_hkds(&self, protectee: &'static str) -> Result<Vec<PKey<Public>>> {
let hkds = &self.host_key_documents;
let verifier = self.verifier(protectee)?;
let mut res = Vec::with_capacity(hkds.len());
for hkd in hkds {
let hk = read_file(hkd, "host-key document")?;
let certs = read_certs(&hk).map_err(|source| Error::HkdNotPemOrDer {
hkd: hkd.display().to_string(),
source,
})?;
if certs.is_empty() {
return Err(Error::NoHkdInFile(hkd.display().to_string()));
}
if certs.len() != 1 {
warn!(
"The host-key document in '{}' contains more than one certificate!",
hkd.display()
)
}
// Panic: len is == 1 -> unwrap will succeed/not panic
let c = certs.first().unwrap();
verifier.verify(c)?;
res.push(c.public_key()?);
info!("Use host-key document at '{}'", hkd.display());
}
Ok(res)
}
fn is_ec_p521_key(key: &PKeyRef<Public>) -> bool {
if key.id() == openssl::pkey::Id::EC {
let ec_key = key.ec_key().unwrap();
@@ -301,7 +263,7 @@ impl CertificateOptions {
/// Returns an error if something went wrong during parsing the HKDs, the verification chain
/// could not built, or when the verification
/// failed.
pub fn get_verified_hkds_new(
pub fn get_verified_hkds(
&self,
protectee: &'static str,
requested_version: HkdVersionSelection,