pvimg: Add '--hdr-key' command line option to 'pvimg create'

Add '--hdr-key <FILE>' as a command line option to the 'pvimg create'
command. This key can then be used later to decrypt the Secure Execution
header of a Secure Execution image, e.g. 'pvimg info --key <FILE>
--format json <SE_IMG>'. While updating the manpages, add missing hyphen
escapes in the manpages.

Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Acked-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>

rust/pvimg/src/cmd/common.rs

@@ -25,6 +25,7 @@ pub struct UserProvidedKeys {
 /// Reads all user provided keys.
 pub fn read_user_provided_keys(
     cck_path: Option<&Path>,
+    hdr_key_path: Option<&Path>,
     experimental_args: &CreateBootImageExperimentalArgs,
 ) -> Result<UserProvidedKeys> {
     let components_key = {
@@ -43,7 +44,7 @@ pub fn read_user_provided_keys(
         }
     };
     let aead_key = {
-        match &experimental_args.x_header_key {
+        match hdr_key_path {
             Some(key_path) => {
                 info!(
                     "Use file '{}' as the Secure Execution header protection",

rust/pvimg/src/cmd/create.rs

@@ -137,7 +137,11 @@ pub fn create(opt: &CreateBootImageArgs) -> Result<OwnExitCode> {
     let verified_host_keys = opt
         .certificate_args
         .get_verified_hkds("Secure Execution image")?;
-    let user_provided_keys = read_user_provided_keys(opt.cck.as_deref(), &opt.experimental_args)?;
+    let user_provided_keys = read_user_provided_keys(
+        opt.cck.as_deref(),
+        opt.hdr_key.as_deref(),
+        &opt.experimental_args,
+    )?;
     let (plaintext_flags, secret_flags) = parse_flags(opt)?;
 
     if plaintext_flags.is_set(PcfV1::NoComponentEncryption) {