From a0804b15fe65a76673563d92274400c1609f91f7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mattias=20Walstr=C3=B6m?= <lazzer@gmail.com>
Date: Wed, 24 Apr 2024 10:07:39 +0200
Subject: [PATCH] Add possibility to have multiple trusted certificates

Today, only one certificate is shipped with infix, it is
selectable in menuconfig. It is also possible to add extra
certificates, useful when using infix as a submodule.
---
 board/common/Config.in                        | 23 +++++++++++++++++--
 board/common/common.mk                        |  4 +++-
 .../development}/infix.crt                    |  0
 .../development}/infix.key                    |  0
 configs/aarch64_defconfig                     |  2 ++
 configs/x86_64_defconfig                      |  2 ++
 6 files changed, 28 insertions(+), 3 deletions(-)
 rename board/common/{dev-key => signing-keys/development}/infix.crt (100%)
 rename board/common/{dev-key => signing-keys/development}/infix.key (100%)

diff --git a/board/common/Config.in b/board/common/Config.in
index 2bad3d29..1726b757 100644
--- a/board/common/Config.in
+++ b/board/common/Config.in
@@ -18,7 +18,27 @@ endchoice
 config SIGN_KEY
 	string "Signing key"
 	depends on SIGN_ENABLED
-	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/dev-key" if SIGN_SRC_DIR
+	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development"  if SIGN_SRC_DIR
+
+menuconfig TRUSTED_KEYS
+	bool "Trusted keys for image"
+	depends on SIGN_ENABLED
+	help
+	 Keys that will be accepted for this image
+
+
+config TRUSTED_KEYS_DEVELOPMENT
+	bool "Development key"
+	depends on TRUSTED_KEYS
+
+config TRUSTED_KEYS_DEVELOPMENT_PATH
+	string
+	depends on TRUSTED_KEYS_DEVELOPMENT
+	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.crt"
+
+config TRUSTED_KEYS_EXTRA_PATH
+	string "Path to extra keys to include in image"
+	depends on TRUSTED_KEYS
 
 menuconfig DISK_IMAGE
 	bool "Disk image"
@@ -140,4 +160,3 @@ config FIT_ARCH
 config FIT_KERNEL_LOAD_ADDR
 	string "Kernel load address"
 	depends on FIT_IMAGE
-
diff --git a/board/common/common.mk b/board/common/common.mk
index bbe1444e..4fa482bb 100644
--- a/board/common/common.mk
+++ b/board/common/common.mk
@@ -1,11 +1,13 @@
 ifeq ($(SIGN_ENABLED),y)
 include $(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/uboot.mk
 
+TRUSTED_KEYS=$(TRUSTED_KEYS_DEVELOPMENT_PATH) $(TRUSTED_KEYS_EXTRA_PATH)
 define RAUC_POST_BUILD_INSTALL_CERT
 	@$(call IXMSG,"Installing signing cert for RAUC")
 	mkdir -p $(TARGET_DIR)/etc/rauc/keys
-	$(foreach crt,$(shell ls $(SIGN_KEY)/*.crt), \
+	$(foreach crt,$(shell ls $(TRUSTED_KEYS)), \
 		cp $(crt) $(TARGET_DIR)/etc/rauc/keys/$(shell openssl x509 -hash -noout <$(crt)).0;)
+
 endef
 RAUC_POST_BUILD_HOOKS += RAUC_POST_BUILD_INSTALL_CERT
 endif
diff --git a/board/common/dev-key/infix.crt b/board/common/signing-keys/development/infix.crt
similarity index 100%
rename from board/common/dev-key/infix.crt
rename to board/common/signing-keys/development/infix.crt
diff --git a/board/common/dev-key/infix.key b/board/common/signing-keys/development/infix.key
similarity index 100%
rename from board/common/dev-key/infix.key
rename to board/common/signing-keys/development/infix.key
diff --git a/configs/aarch64_defconfig b/configs/aarch64_defconfig
index ced47577..17728218 100644
--- a/configs/aarch64_defconfig
+++ b/configs/aarch64_defconfig
@@ -156,3 +156,5 @@ DISK_IMAGE_BOOT_BIN=y
 GNS3_APPLIANCE_RAM=512
 GNS3_APPLIANCE_IFNUM=10
 BR2_PER_PACKAGE_DIRECTORIES=y
+TRUSTED_KEYS=y
+TRUSTED_KEYS_DEVELOPMENT=y
diff --git a/configs/x86_64_defconfig b/configs/x86_64_defconfig
index 25fc96ea..b5f67291 100644
--- a/configs/x86_64_defconfig
+++ b/configs/x86_64_defconfig
@@ -157,3 +157,5 @@ BR2_PACKAGE_TETRIS=y
 GNS3_APPLIANCE_RAM=512
 GNS3_APPLIANCE_IFNUM=10
 BR2_PER_PACKAGE_DIRECTORIES=y
+TRUSTED_KEYS=y
+TRUSTED_KEYS_DEVELOPMENT=y