kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

rust/pvimg: Refactor keys arguments into own struct

Browse Source 
This makes it easier to add new user keys related CLI options.

Acked-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
This commit is contained in:
Marc Hartmayer
2025-07-25 10:15:39 +02:00
committed by Steffen Eiden
parent fcaad5a8e2
commit 58337d7f90
3 changed files with 33 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

46
rust/pvimg/src/cli.rs
View File

@@ -93,6 +93,31 @@ pub struct ComponentPaths {
pub parmfile: Option<PathBuf>,
}
/// CLI Argument collection for handling user-provided keys.
#[derive(Args, Debug)]
#[cfg_attr(test, derive(Default))]
pub struct UserKeys {
/// Use the content of FILE as the customer-communication key (CCK).
///
/// The file must contain exactly 32 bytes of data. In previous versions,
/// this option was called '--comm-key'.
#[arg(
long,
value_name = "FILE",
group = "cck-available",
visible_alias = "comm-key"
)]
pub cck: Option<PathBuf>,
/// Use the content of FILE as the Secure Execution header protection key.
///
/// The file must contain exactly 32 bytes of data. If the option is not
/// specified, the Secure Execution header protection key is a randomly
/// generated key.
#[arg(long, value_name = "FILE", alias = "x-header-key")]
pub hdr_key: Option<PathBuf>,
}
#[derive(Args, Debug)]
#[cfg_attr(test, derive(Default))]
#[command(
@@ -342,25 +367,8 @@ pub struct CreateBootImageArgs {
#[arg(long)]
pub overwrite: bool,
/// Use the content of FILE as the customer-communication key (CCK).
///
/// The file must contain exactly 32 bytes of data. In previous versions,
/// this option was called '--comm-key'.
#[arg(
long,
value_name = "FILE",
group = "cck-available",
visible_alias = "comm-key"
)]
pub cck: Option<PathBuf>,
/// Use the content of FILE as the Secure Execution header protection key.
///
/// The file must contain exactly 32 bytes of data. If the option is not
/// specified, the Secure Execution header protection key is a randomly
/// generated key.
#[arg(long, value_name = "FILE", alias = "x-header-key")]
pub hdr_key: Option<PathBuf>,
#[clap(flatten)]
pub keys: UserKeys,
#[clap(flatten)]
pub legacy_flags: CreateBootImageLegacyFlags,

11
rust/pvimg/src/cmd/common.rs
View File

@@ -2,13 +2,13 @@
//
// Copyright IBM Corp. 2024
use std::path::{Path, PathBuf};
use std::path::PathBuf;
use anyhow::Result;
use log::info;
use pv::{misc::read_file, request::Confidential};
use crate::cli::CreateBootImageExperimentalArgs;
use crate::cli::{CreateBootImageExperimentalArgs, UserKeys};
#[macro_export]
/// Makes it easier to
@@ -24,8 +24,7 @@ pub struct UserProvidedKeys {
/// Reads all user provided keys.
pub fn read_user_provided_keys(
cck_path: Option<&Path>,
hdr_key_path: Option<&Path>,
keys: &UserKeys,
experimental_args: &CreateBootImageExperimentalArgs,
) -> Result<UserProvidedKeys> {
let components_key = {
@@ -44,7 +43,7 @@ pub fn read_user_provided_keys(
}
};
let aead_key = {
match hdr_key_path {
match &keys.hdr_key {
Some(key_path) => {
info!(
"Use file '{}' as the Secure Execution header protection",
@@ -63,7 +62,7 @@ pub fn read_user_provided_keys(
};
let cck = {
match cck_path {
match &keys.cck {
Some(key_path) => {
info!(
"Use file '{}' as the customer communication key (CCK)",

6
rust/pvimg/src/cmd/create.rs
View File

@@ -126,11 +126,7 @@ pub fn create(opt: &CreateBootImageArgs) -> Result<OwnExitCode> {
let verified_host_keys = opt
.certificate_args
.get_verified_hkds("Secure Execution image")?;
let user_provided_keys = read_user_provided_keys(
opt.cck.as_deref(),
opt.hdr_key.as_deref(),
&opt.experimental_args,
)?;
let user_provided_keys = read_user_provided_keys(&opt.keys, &opt.experimental_args)?;
let (plaintext_flags, secret_flags) = parse_flags(opt)?;
if plaintext_flags.is_set(PcfV1::NoComponentEncryption) {