From bfc9854eb551a1a88fb6be41630c9b3f59ae1819 Mon Sep 17 00:00:00 2001
From: Steffen Eiden <seiden@linux.ibm.com>
Date: Tue, 3 Jun 2025 15:37:06 +0200
Subject: [PATCH] check_hostkeydoc: Move check_hostkeydoc to scripts &
 deprecation warning
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move the check_hostkeydoc script to scripts. This eliminates the last file
in the genprotimg directory. Additionally, add a deprecation warning to
that script. Every pv tool can verify the chain itself using the pv
library.

Acked-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
---
 rust/Makefile                                    |  1 -
 rust/pvimg/tools/check_hostkeydoc                |  1 -
 {genprotimg/samples => scripts}/check_hostkeydoc | 13 +++++++++++--
 3 files changed, 11 insertions(+), 4 deletions(-)
 delete mode 120000 rust/pvimg/tools/check_hostkeydoc
 rename {genprotimg/samples => scripts}/check_hostkeydoc (92%)

diff --git a/rust/Makefile b/rust/Makefile
index c40e78ce..107dd2be 100644
--- a/rust/Makefile
+++ b/rust/Makefile
@@ -86,7 +86,6 @@ install: $(INSTALL_TARGETS)
 	$(INSTALL) -d -m 755 $(DESTDIR)$(USRBINDIR)
 	$(INSTALL) -g $(GROUP) -o $(OWNER) -m 755 pvattest/tools/pvextract-hdr $(DESTDIR)$(USRBINDIR)
 	$(INSTALL) -d -m 755 $(DESTDIR)$(PVIMG_PKGDATADIR)
-	$(INSTALL) -g $(GROUP) -o $(OWNER) -m 755 pvimg/tools/check_hostkeydoc $(DESTDIR)$(PVIMG_PKGDATADIR)
 	$(MAKE) -C pvimg/boot install
 	ln -sf pvimg $(DESTDIR)$(USRBINDIR)/genprotimg
 
diff --git a/rust/pvimg/tools/check_hostkeydoc b/rust/pvimg/tools/check_hostkeydoc
deleted file mode 120000
index aad8d358..00000000
--- a/rust/pvimg/tools/check_hostkeydoc
+++ /dev/null
@@ -1 +0,0 @@
-../../../genprotimg/samples/check_hostkeydoc
\ No newline at end of file
diff --git a/genprotimg/samples/check_hostkeydoc b/scripts/check_hostkeydoc
similarity index 92%
rename from genprotimg/samples/check_hostkeydoc
rename to scripts/check_hostkeydoc
index 44152d79..50f71a4c 100755
--- a/genprotimg/samples/check_hostkeydoc
+++ b/scripts/check_hostkeydoc
@@ -53,8 +53,13 @@ usage()
     cat <<-EOF
 Usage: $(basename "$1") [-d] [-c CA-cert] [-r CRL] host-key-doc signing-key-cert
 
-Verify an IBM Secure Execution host key document against
-a signing key.
+Verify an IBM Secure Execution host key document against a signing key. Use for
+resolving issues only. Use the built-in functions from pvimg, pvsecret, or
+pvattest directly to verify the host-key documents. This script should only be
+used as a last resort for when the distribution provided binaries have
+unresolved issues regarding the host-key verification. In that case ensure the
+latest version of this script is used.
+Find the latest version here https://github.com/ibm-s390-linux/s390-tools
 
 Options:
 -d         disable default issuer check of host-key-doc
@@ -297,6 +302,10 @@ fi
 HKD_FILE=$1
 HKSK_FILE=$2
 
+printf "DEPRECATED SCRIPT. Use pvimg, pvattest, or pvsecret directly.\n"
+printf "This script is intended for resolving issues only.\n"
+printf "This script may be inaccessible in the future.\n"
+
 # Check whether all specified files exist
 check_file "$HKD_FILE"
 check_file "$HKSK_FILE"