CaROS/meta-openembedded
3
1
Fork 0
mirror of git://git.openembedded.org/meta-openembedded synced 2026-01-01 13:58:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

signing.bbclass: add signing_get_intermediate_certs

Browse Source 
Add a method that returns a list of intermediary CA roles.

When using a complex PKI structure with for example "openssl cms",
these roles can then be iterated over adding in turn a '-certificate'.
Pseudo-code example:
  for intermediate in $(signing_get_intermediate_certs 'FooBaa'); do
     signing_extract_cert_pem $intermediate $intermediate.pem
     CMD+=" --certificate=$intermediate.pem"
  done

The typical use-case would be adding these intermediate certificates
to the CMS structure so that the relying party can build the chain
from the signing leaf certificate to the locally stored trusted CA
certificate.

Reviewed-by: Jan Luebbe <jlu@pengutronix.de>
Signed-off-by: Johannes Schneider <johannes.schneider@leica-geosystems.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This commit is contained in:
Johannes Schneider 2025-06-27 14:18:20 +02:00 committed by Khem Raj
parent f642526db5
commit b6915f6399
No known key found for this signature in database
GPG Key ID: BB053355919D3314
1 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
meta-oe/classes/signing.bbclass
View File

@ -194,6 +194,27 @@ signing_has_ca() {
return $?
}
# signing_get_intermediate_certs <cert_name>
#
# return a list of role/name intermediary CA certificates for a given
# <cert_name> by walking the chain setup with signing_import_set_ca.
#
# The returned list will not include the the root CA, and can
# potentially be empty.
#
# To be used with SoftHSM.
signing_get_intermediate_certs() {
local cert_name="${1}"
local intermediary=""
while signing_has_ca "${cert_name}"; do
cert_name="$(signing_get_ca ${cert_name})"
if signing_has_ca "${cert_name}"; then
intermediary="${intermediary} ${cert_name}"
fi
done
echo "${intermediary}"
}
# signing_get_root_cert <cert_name>
#
# return the role/name of the CA root certificate for a given