Change log leaf encoding am: b611df2423 am: d67b07f1c6
Change-Id: I0bfccd26e2df669f793896d1f7f51bfebd3ebee0
diff --git a/Android.bp b/Android.bp
index 19ea97e..6a80a62 100644
--- a/Android.bp
+++ b/Android.bp
@@ -94,7 +94,6 @@
name: "aftl_proto",
srcs: [
"proto/api.proto",
- "proto/aftl.proto",
"proto/crypto/sigpb/sigpb.proto",
"proto/crypto/keyspb/keyspb.proto",
"proto/trillian.proto",
diff --git a/aftltool.py b/aftltool.py
index 192ad9b..613e83b 100755
--- a/aftltool.py
+++ b/aftltool.py
@@ -24,10 +24,11 @@
#
"""Command-line tool for AFTL support for Android Verified Boot images."""
+import abc
import argparse
-import base64
+import enum
import hashlib
-import json
+import io
import multiprocessing
import os
import queue
@@ -46,9 +47,7 @@
# pylint: disable=wrong-import-position,import-error
import avbtool
-import aftl_pb2
import api_pb2
-from crypto.sigpb import sigpb_pb2
# pylint: enable=wrong-import-position,import-error
@@ -350,14 +349,16 @@
log_url_size: Length of the string representing the transparency log URL.
leaf_index: Leaf index in the transparency log representing this entry.
log_root_descriptor_size: Size of the transparency log's SignedLogRoot.
- fw_info_leaf_size: Size of the FirmwareInfo leaf passed to the log.
+ annotation_leaf_size: Size of the SignedVBMetaPrimaryAnnotationLeaf passed
+ to the log.
log_root_sig_size: Size in bytes of the log_root_signature
proof_hash_count: Number of hashes comprising the inclusion proof.
inc_proof_size: The total size of the inclusion proof, in bytes.
log_url: The URL for the transparency log that generated this inclusion
proof.
log_root_descriptor: The data comprising the signed tree head structure.
- fw_info_leaf: The data comprising the FirmwareInfo leaf.
+ annotation_leaf: The data comprising the SignedVBMetaPrimaryAnnotationLeaf
+ leaf.
log_root_signature: The data comprising the log root signature.
proofs: The hashes comprising the inclusion proof.
@@ -370,9 +371,8 @@
'H' # log root signature size
'B' # number of hashes in the inclusion proof
'L') # size of the inclusion proof in bytes
- # These are used to capture the log_url, log_root_descriptor,
- # fw_info leaf, log root signature, and the proofs elements for the
- # encode function.
+ # This header is followed by the log_url, log_root_descriptor,
+ # annotation leaf, log root signature, and the proofs elements.
def __init__(self, data=None):
"""Initializes a new ICP entry object.
@@ -391,7 +391,7 @@
(self._log_url_size_expected,
self.leaf_index,
self._log_root_descriptor_size_expected,
- self._fw_info_leaf_size_expected,
+ self._annotation_leaf_size_expected,
self._log_root_sig_size_expected,
self._proof_hash_count_expected,
self._inc_proof_size_expected) = struct.unpack(self.FORMAT_STRING,
@@ -401,18 +401,20 @@
expected_format_string = '{}s{}s{}s{}s{}s'.format(
self._log_url_size_expected,
self._log_root_descriptor_size_expected,
- self._fw_info_leaf_size_expected,
+ self._annotation_leaf_size_expected,
self._log_root_sig_size_expected,
self._inc_proof_size_expected)
- (log_url, log_root_descriptor_bytes, fw_info_leaf_bytes,
+ (log_url, log_root_descriptor_bytes, annotation_leaf_bytes,
self.log_root_signature, proof_bytes) = struct.unpack(
expected_format_string, data[self.SIZE:self.get_expected_size()])
self.log_url = log_url.decode('ascii')
self.log_root_descriptor = TrillianLogRootDescriptor(
log_root_descriptor_bytes)
- self.fw_info_leaf = FirmwareInfoLeaf(fw_info_leaf_bytes)
+
+ self.annotation_leaf = SignedVBMetaPrimaryAnnotationLeaf.parse(
+ annotation_leaf_bytes)
self.proofs = []
if self._proof_hash_count_expected > 0:
@@ -427,7 +429,7 @@
self.leaf_index = 0
self.log_url = ''
self.log_root_descriptor = TrillianLogRootDescriptor()
- self.fw_info_leaf = FirmwareInfoLeaf()
+ self.annotation_leaf = SignedVBMetaPrimaryAnnotationLeaf()
self.log_root_signature = b''
self.proofs = []
if not self.is_valid():
@@ -448,11 +450,11 @@
return self._log_root_descriptor_size_expected
@property
- def fw_info_leaf_size(self):
- """Gets the size of the fw_info_leaf attribute."""
- if hasattr(self, 'fw_info_leaf'):
- return self.fw_info_leaf.get_expected_size()
- return self._fw_info_leaf_size_expected
+ def annotation_leaf_size(self):
+ """Gets the size of the annotation_leaf attribute."""
+ if hasattr(self, 'annotation_leaf'):
+ return self.annotation_leaf.get_expected_size()
+ return self._annotation_leaf_size_expected
@property
def log_root_sig_size(self):
@@ -490,7 +492,7 @@
if not transparency_log_pub_key:
return False
- leaf_hash = rfc6962_hash_leaf(self.fw_info_leaf.encode())
+ leaf_hash = rfc6962_hash_leaf(self.annotation_leaf.encode())
calc_root = root_from_icp(self.leaf_index,
self.log_root_descriptor.tree_size,
self.proofs,
@@ -513,7 +515,7 @@
Returns:
True if the inclusion proof validates and the vbmeta hash of the given
- VBMeta image matches the one in the fw_info_leaf; otherwise False.
+ VBMeta image matches the one in the annotation leaf; otherwise False.
"""
if not vbmeta_image:
return False
@@ -524,13 +526,13 @@
# Validates the inclusion proof and then compare the calculated vbmeta_hash
# against the one in the inclusion proof.
return (self.verify_icp(transparency_log_pub_key)
- and self.fw_info_leaf.vbmeta_hash == vbmeta_hash)
+ and self.annotation_leaf.annotation.vbmeta_hash == vbmeta_hash)
def encode(self):
- """Serializes the header |SIZE| and data to a bytearray().
+ """Serializes the header |SIZE| and data to bytes.
Returns:
- A bytearray() with the encoded header.
+ bytes with the encoded header.
Raises:
AftlError: If invalid entry structure.
@@ -543,7 +545,7 @@
self.FORMAT_STRING,
self.log_url_size,
self.log_root_descriptor_size,
- self.fw_info_leaf_size,
+ self.annotation_leaf_size,
self.log_root_sig_size,
self.inc_proof_size)
@@ -552,30 +554,31 @@
return struct.pack(expected_format_string,
self.log_url_size, self.leaf_index,
- self.log_root_descriptor_size, self.fw_info_leaf_size,
+ self.log_root_descriptor_size, self.annotation_leaf_size,
self.log_root_sig_size, self.proof_hash_count,
self.inc_proof_size, self.log_url.encode('ascii'),
self.log_root_descriptor.encode(),
- self.fw_info_leaf.encode(),
+ self.annotation_leaf.encode(),
self.log_root_signature,
proof_bytes)
- def translate_response(self, log_url, afi_response):
- """Translates an AddFirmwareInfoResponse object to an AftlIcpEntry.
+ def translate_response(self, log_url, avbm_response):
+ """Translates an AddVBMetaResponse object to an AftlIcpEntry.
Arguments:
log_url: String representing the transparency log URL.
- afi_response: The AddFirmwareResponse object to translate.
+ avbm_response: The AddVBMetaResponse object to translate.
"""
self.log_url = log_url
- # Deserializes from AddFirmwareInfoResponse.
- self.leaf_index = afi_response.fw_info_proof.proof.leaf_index
- self.log_root_descriptor = TrillianLogRootDescriptor(
- afi_response.fw_info_proof.sth.log_root)
- self.fw_info_leaf = FirmwareInfoLeaf(afi_response.fw_info_leaf)
- self.log_root_signature = afi_response.fw_info_proof.sth.log_root_signature
- self.proofs = afi_response.fw_info_proof.proof.hashes
+ # Deserializes from AddVBMetaResponse.
+ proof = avbm_response.annotation_proof
+ self.leaf_index = proof.proof.leaf_index
+ self.log_root_descriptor = TrillianLogRootDescriptor(proof.sth.log_root)
+ self.annotation_leaf = SignedVBMetaPrimaryAnnotationLeaf.parse(
+ avbm_response.annotation_leaf)
+ self.log_root_signature = proof.sth.log_root_signature
+ self.proofs = proof.proof.hashes
def get_expected_size(self):
"""Gets the expected size of the full entry out of the header.
@@ -584,7 +587,7 @@
The expected size of the AftlIcpEntry from the header.
"""
return (self.SIZE + self.log_url_size + self.log_root_descriptor_size +
- self.fw_info_leaf_size + self.log_root_sig_size +
+ self.annotation_leaf_size + self.log_root_sig_size +
self.inc_proof_size)
def is_valid(self):
@@ -604,9 +607,9 @@
sys.stderr.write('ICP entry: invalid TrillianLogRootDescriptor.\n')
return False
- if (not self.fw_info_leaf or
- not isinstance(self.fw_info_leaf, FirmwareInfoLeaf)):
- sys.stderr.write('ICP entry: invalid FirmwareInfo.\n')
+ if (not self.annotation_leaf or
+ not isinstance(self.annotation_leaf, Leaf)):
+ sys.stderr.write('ICP entry: invalid Leaf.\n')
return False
return True
@@ -626,7 +629,7 @@
o.write(' ' * 29)
o.write('{}\n'.format(proof_hash.hex()))
self.log_root_descriptor.print_desc(o)
- self.fw_info_leaf.print_desc(o)
+ self.annotation_leaf.print_desc(o)
class TrillianLogRootDescriptor(object):
@@ -793,139 +796,268 @@
o.write(fmt.format(i, 'Metadata:', self.metadata.hex()))
-class FirmwareInfoLeaf(object):
- """A class representing the FirmwareInfo leaf.
+def tls_decode_bytes(byte_size, stream):
+ """Decodes a variable-length vector.
- AFTL returns the fw_info_leaf as a JSON blob and this class is able to
- parse the blog and provide necessary attributes needed for validation.
+ In the TLS presentation language, a variable-length vector is a pair
+ (size, value). |size| describes the size of the |value| to read
+ in bytes. All values are encoded in big-endian.
+ See https://tools.ietf.org/html/rfc8446#section-3 for more details.
+
+ Arguments:
+ byte_size: A format character as described in the struct module
+ which describes the expected length of the size. For
+ instance, "B", "H", "L" or "Q".
+ stream: a BytesIO which contains the value to decode.
+
+ Returns:
+ A bytes containing the value decoded.
+
+ Raises:
+ AftlError: If |byte_size| is not a known format character, or if not
+ enough data is available to decode the size or the value.
+ """
+ byte_size_format = "!" + byte_size
+ try:
+ byte_size_length = struct.calcsize(byte_size_format)
+ except struct.error:
+ raise AftlError("Invalid byte_size character: {}. It must be a "
+ "format supported by struct.".format(byte_size))
+ try:
+ value_size = struct.unpack(byte_size_format,
+ stream.read(byte_size_length))[0]
+ except struct.error:
+ raise AftlError("Not enough data to read size: {}".format(byte_size))
+ value = stream.read(value_size)
+ if value_size != len(value):
+ raise AftlError("Not enough data to read value: "
+ "{} != {}".format(value_size, len(value)))
+ return value
+
+def tls_encode_bytes(byte_size, value, stream):
+ """Encodes a variable-length vector.
+
+ In the TLS presentation language, a variable-length vector is a pair
+ (size, value). |size| describes the size of the |value| to read
+ in bytes. All values are encoded in big-endian.
+ See https://tools.ietf.org/html/rfc8446#section-3 for more details.
+
+ Arguments:
+ byte_size: A format character as described in the struct module
+ which describes the expected length of the size. For
+ instance, "B", "H", "L" or "Q".
+ value: the value to encode. The length of |value| must be
+ representable with |byte_size|.
+ stream: a BytesIO to which the value is encoded to.
+
+ Raises:
+ AftlError: If |byte_size| is not a known format character, or if
+ |value|'s length cannot be represent with |byte_size|.
+ """
+ byte_size_format = "!" + byte_size
+ try:
+ stream.write(struct.pack(byte_size_format, len(value)))
+ except struct.error:
+ # Whether byte_size is invalid or not large enough to represent value,
+ # struct returns an struct.error exception. Instead of matching on the
+ # exception message, capture both cases in a generic message.
+ raise AftlError("Invalid byte_size to store {} bytes".format(len(value)))
+ stream.write(value)
+
+class HashAlgorithm(enum.Enum):
+ SHA256 = 0
+
+class SignatureAlgorithm(enum.Enum):
+ RSA = 0
+ ECDSA = 1
+
+class Signature(object):
+ """Represents a signature of some data.
+
+ It is usually made using a manufacturer key and used to sign part of a leaf
+ that belongs to the transparency log. The encoding of this structure must
+ match the server expectation.
Attributes:
- vbmeta_hash: This is the SHA256 hash of vbmeta.
- version_incremental: Subcomponent of the build fingerprint as defined at
- https://source.android.com/compatibility/android-cdd#3_2_2_build_parameters.
- For example, a Pixel device with the following build fingerprint
- google/crosshatch/crosshatch:9/PQ3A.190605.003/5524043:user/release-keys,
- would have 5524043 for the version incremental.
- platform_key: Public key of the platform. This is the same key used to sign
- the vbmeta.
- manufacturer_key_hash: SHA256 of the manufacturer public key (DER-encoded,
- x509 subjectPublicKeyInfo format). The public key MUST already be in the
- list of root keys known and trusted by the AFTL.
- description: Free form description field. It can be used to annotate this
- message with further context on the build (e.g., carrier specific build).
+ hash_algorithm: the HashAlgorithm used for the signature.
+ signature_algorithm: the SignatureAlgorithm used.
+ signature: the raw signature in bytes.
"""
+ FORMAT_STRING = ('!B' # Hash algorithm
+ 'B' # Signing algorithm
+ )
+ # Followed by the raw signature, encoded as a TLS variable-length vector
+ # which size is represented using 2 bytes.
- def __init__(self, data=None):
- """Initializes a new FirmwareInfoLeaf descriptor."""
- if data:
- # We have to preserve the original fw_info_leaf bytes in order to preserve
- # hash equivalence with what is stored in the Trillian log and matches up
- # with the proofs.
- self._fw_info_leaf_bytes = data
+ def __init__(self, hash_algorithm=HashAlgorithm.SHA256,
+ signature_algorithm=SignatureAlgorithm.RSA, signature=b''):
+ self.hash_algorithm = hash_algorithm
+ self.signature_algorithm = signature_algorithm
+ self.signature = signature
- # Deserialize the JSON blob and keep only the FirmwareInfo parts.
- try:
- fw_info_leaf = json.loads(self._fw_info_leaf_bytes)
- self._fw_info_leaf_dict = (
- fw_info_leaf['Value']['FwInfo']['info']['info'])
- except (ValueError, KeyError) as e:
- raise AftlError('Invalid structure for FirmwareInfoLeaf: {}'.format(e))
- else:
- self._fw_info_leaf_bytes = b''
- self._fw_info_leaf_dict = dict()
-
- if not self.is_valid():
- raise AftlError('Invalid structure for FirmwareInfoLeaf.')
-
- @property
- def vbmeta_hash(self):
- """Gets the vbmeta_hash attribute."""
- return self._lookup_base64_attribute('vbmeta_hash')
-
- @property
- def version_incremental(self):
- """Gets the version_incremental attribute."""
- return self._fw_info_leaf_dict.get('version_incremental')
-
- @property
- def platform_key(self):
- """Gets the platform key attribute."""
- return self._lookup_base64_attribute('platform_key')
-
- @property
- def manufacturer_key_hash(self):
- """Gets the manufacturer_key_hash attribute."""
- return self._lookup_base64_attribute('manufacturer_key_hash')
-
- @property
- def description(self):
- """Gets the description attribute."""
- return self._fw_info_leaf_dict.get('description')
-
- def _lookup_base64_attribute(self, key):
- """Looks up an attribute that is Base64 encoded and decodes it.
+ @classmethod
+ def parse(cls, stream):
+ """Parses a TLS-encoded structure and returns a new Signature.
Arguments:
- key: The name of the attribute to look up.
+ stream: a BytesIO to read the signature from.
Returns:
- The attribute value or None if not defined.
+ A new Signature object.
+
+ Raises:
+ AftlError: If the hash algorithm or signature algorithm value is
+ unknown; or if the decoding failed.
"""
- result = self._fw_info_leaf_dict.get(key)
- if result:
- result = base64.b64decode(result)
- return result
+ data_length = struct.calcsize(cls.FORMAT_STRING)
+ (hash_algorithm, signature_algorithm) = struct.unpack(
+ cls.FORMAT_STRING, stream.read(data_length))
+ try:
+ hash_algorithm = HashAlgorithm(hash_algorithm)
+ except ValueError:
+ raise AftlError('unknown hash algorithm: {}'.format(hash_algorithm))
+ try:
+ signature_algorithm = SignatureAlgorithm(signature_algorithm)
+ except ValueError:
+ raise AftlError('unknown signature algorithm: {}'.format(
+ signature_algorithm))
+ signature = tls_decode_bytes('H', stream)
+ return Signature(hash_algorithm, signature_algorithm, signature)
def get_expected_size(self):
- """Gets the expected size of the JSON-serialized FirmwareInfoLeaf.
+ """Returns the size of the encoded Signature."""
+ return struct.calcsize(self.FORMAT_STRING) + \
+ struct.calcsize('H') + len(self.signature)
+
+ def encode(self, stream):
+ """Encodes the Signature.
+
+ Arguments:
+ stream: a BytesIO to which the signature is written.
+ """
+ stream.write(struct.pack(self.FORMAT_STRING, self.hash_algorithm.value,
+ self.signature_algorithm.value))
+ tls_encode_bytes('H', self.signature, stream)
+
+class VBMetaPrimaryAnnotation(object):
+ """An annotation that contains metadata about a VBMeta image.
+
+ Attributes:
+ vbmeta_hash: the SHA256 of the VBMeta it references.
+ version_incremental: the version incremental of the build, as string.
+ manufacturer_key_hash: the hash of the manufacturer key that will
+ sign this annotation.
+ description: a free-form field.
+ """
+
+ def __init__(self, vbmeta_hash=b'', version_incremental='',
+ manufacturer_key_hash=b'', description=''):
+ """Default constructor."""
+ self.vbmeta_hash = vbmeta_hash
+ self.version_incremental = version_incremental
+ self.manufacturer_key_hash = manufacturer_key_hash
+ self.description = description
+
+ @classmethod
+ def parse(cls, stream):
+ """Parses a VBMetaPrimaryAnnotation from data.
+
+ Arguments:
+ stream: an io.BytesIO to decode the annotation from.
Returns:
- The expected size of the FirmwareInfo leaf in byte or 0 if not initalized.
- """
- if not self._fw_info_leaf_bytes:
- return 0
- return len(self._fw_info_leaf_bytes)
+ A new VBMetaPrimaryAnnotation.
- def encode(self):
- """Serializes the FirmwareInfoLeaf.
+ Raises:
+ AftlError: If an error occured while parsing the annotation.
+ """
+ vbmeta_hash = tls_decode_bytes("B", stream)
+ version_incremental = tls_decode_bytes("B", stream)
+ try:
+ version_incremental = version_incremental.decode("ascii")
+ except UnicodeError:
+ raise AftlError('Failed to convert version incremental to an ASCII'
+ 'string')
+ manufacturer_key_hash = tls_decode_bytes("B", stream)
+ description = tls_decode_bytes("H", stream)
+ try:
+ description = description.decode("utf-8")
+ except UnicodeError:
+ raise AftlError('Failed to convert description to an UTF-8 string')
+ return cls(vbmeta_hash, version_incremental, manufacturer_key_hash,
+ description)
+
+ def sign(self, manufacturer_key_path, signing_helper=None,
+ signing_helper_with_files=None):
+ """Signs the annotation.
+
+ Arguments:
+ manufacturer_key_path: Path to key used to sign messages sent to the
+ transparency log servers.
+ signing_helper: Program which signs a hash and returns a signature.
+ signing_helper_with_files: Same as signing_helper but uses files instead.
Returns:
- A bytearray() with the JSON-serialized FirmwareInfoLeaf.
- """
- return self._fw_info_leaf_bytes
+ A new SignedVBMetaPrimaryAnnotation.
- def is_valid(self):
- """Ensures that values in the descritor are sane.
-
- Returns:
- True if the values are sane; otherwise False.
+ Raises:
+ AftlError: If an error occured while signing the annotation.
"""
- # Checks that the decode fw_info_leaf at max contains values defined in the
- # FirmwareInfo proto buf.
- expected_fields = set(aftl_pb2.FirmwareInfo()
- .DESCRIPTOR.fields_by_name.keys())
- actual_fields = set(self._fw_info_leaf_dict.keys())
- if actual_fields.issubset(expected_fields):
- return True
- return False
+ # AFTL supports SHA256_RSA4096 for now, more will be available.
+ algorithm_name = 'SHA256_RSA4096'
+ encoded_leaf = io.BytesIO()
+ self.encode(encoded_leaf)
+ try:
+ rsa_key = avbtool.RSAPublicKey(manufacturer_key_path)
+ raw_signature = rsa_key.sign(algorithm_name, encoded_leaf.getvalue(),
+ signing_helper, signing_helper_with_files)
+ except avbtool.AvbError as e:
+ raise AftlError('Failed to sign VBMetaPrimaryAnnotation with '
+ '--manufacturer_key: {}'.format(e))
+ signature = Signature(hash_algorithm=HashAlgorithm.SHA256,
+ signature_algorithm=SignatureAlgorithm.RSA,
+ signature=raw_signature)
+ return SignedVBMetaPrimaryAnnotation(signature=signature, annotation=self)
+
+ def encode(self, stream):
+ """Encodes the VBMetaPrimaryAnnotation.
+
+ Arguments:
+ stream: a BytesIO to which the signature is written.
+
+ Raises:
+ AftlError: If the encoding failed.
+ """
+ tls_encode_bytes("B", self.vbmeta_hash, stream)
+ try:
+ tls_encode_bytes("B", self.version_incremental.encode("ascii"), stream)
+ except UnicodeError:
+ raise AftlError('Unable to encode version incremental to ASCII')
+ tls_encode_bytes("B", self.manufacturer_key_hash, stream)
+ try:
+ tls_encode_bytes("H", self.description.encode("utf-8"), stream)
+ except UnicodeError:
+ raise AftlError('Unable to encode description to UTF-8')
+
+ def get_expected_size(self):
+ """Returns the size of the encoded annotation."""
+ b = io.BytesIO()
+ self.encode(b)
+ return len(b.getvalue())
def print_desc(self, o):
- """Print the FirmwareInfoLeaf.
+ """Print the VBMetaPrimaryAnnotation.
Arguments:
o: The object to write the output to.
"""
- o.write(' Firmware Info Leaf:\n')
- # The order of the fields is based on the definition in
- # proto.aftl_pb2.FirmwareInfo.
- i = ' ' * 6
+ o.write(' VBMeta Primary Annotation:\n')
+ i = ' ' * 8
fmt = '{}{:23}{}\n'
if self.vbmeta_hash:
o.write(fmt.format(i, 'VBMeta hash:', self.vbmeta_hash.hex()))
if self.version_incremental:
o.write(fmt.format(i, 'Version incremental:', self.version_incremental))
- if self.platform_key:
- o.write(fmt.format(i, 'Platform key:', self.platform_key))
if self.manufacturer_key_hash:
o.write(fmt.format(i, 'Manufacturer key hash:',
self.manufacturer_key_hash.hex()))
@@ -933,6 +1065,244 @@
o.write(fmt.format(i, 'Description:', self.description))
+class SignedVBMetaPrimaryAnnotation(object):
+ """A Signed VBMetaPrimaryAnnotation.
+
+ Attributes:
+ signature: a Signature.
+ annotation: a VBMetaPrimaryAnnotation.
+ """
+
+ def __init__(self, signature=None, annotation=None):
+ """Default constructor."""
+ if not signature:
+ signature = Signature()
+ self.signature = signature
+ if not annotation:
+ annotation = VBMetaPrimaryAnnotation()
+ self.annotation = annotation
+
+ @classmethod
+ def parse(cls, stream):
+ """Parses a signed annotation."""
+ signature = Signature.parse(stream)
+ annotation = VBMetaPrimaryAnnotation.parse(stream)
+ return cls(signature, annotation)
+
+ def get_expected_size(self):
+ """Returns the size of the encoded signed annotation."""
+ return self.signature.get_expected_size() + \
+ self.annotation.get_expected_size()
+
+ def encode(self, stream):
+ """Encodes the SignedVBMetaPrimaryAnnotation.
+
+ Arguments:
+ stream: a BytesIO to which the object is written.
+
+ Raises:
+ AftlError: If the encoding failed.
+ """
+ self.signature.encode(stream)
+ self.annotation.encode(stream)
+
+ def print_desc(self, o):
+ """Prints the annotation.
+
+ Arguments:
+ o: The object to write the output to.
+ """
+ self.annotation.print_desc(o)
+
+class Leaf(abc.ABC):
+ """An abstract class to represent the leaves in the transparency log."""
+ FORMAT_STRING = ('!B' # Version
+ 'Q' # Timestamp
+ 'B' # LeafType
+ )
+
+ class LeafType(enum.Enum):
+ VBMetaType = 0
+ SignedVBMetaPrimaryAnnotationType = 1
+
+ def __init__(self, version=1, timestamp=0, leaf_type=LeafType.VBMetaType):
+ """Build a new leaf."""
+ self.version = version
+ self.timestamp = timestamp
+ self.leaf_type = leaf_type
+
+ @classmethod
+ def _parse_header(cls, stream):
+ """Parses the header of a leaf.
+
+ This is called with the parse method of the subclasses.
+
+ Arguments:
+ stream: a BytesIO to read the header from.
+
+ Returns:
+ A tuple (version, timestamp, leaf_type).
+
+ Raises:
+ AftlError: If the header cannot be decoded; or if the leaf type is
+ unknown.
+ """
+ data_length = struct.calcsize(cls.FORMAT_STRING)
+ try:
+ (version, timestamp, leaf_type) = struct.unpack(
+ cls.FORMAT_STRING, stream.read(data_length))
+ except struct.error:
+ raise AftlError("Not enough data to parse leaf header")
+ try:
+ leaf_type = cls.LeafType(leaf_type)
+ except ValueError:
+ raise AftlError("Unknown leaf type: {}".format(leaf_type))
+ return version, timestamp, leaf_type
+
+ @classmethod
+ @abc.abstractmethod
+ def parse(cls, data):
+ """Parses a leaf and returned a new object.
+
+ This abstract method must be implemented by the subclass. It may use
+ _parse_header to parse the common fields.
+
+ Arguments:
+ data: a bytes-like object.
+
+ Returns:
+ An object of the type of the particular subclass.
+
+ Raises:
+ AftlError: If the leaf type is incorrect; or if the decoding failed.
+ """
+
+ @abc.abstractmethod
+ def encode(self):
+ """Encodes a leaf.
+
+ This abstract method must be implemented by the subclass. It may use
+ _encode_header to encode the common fields.
+
+ Returns:
+ A bytes with the encoded leaf.
+
+ Raises:
+ AftlError: If the encoding failed.
+ """
+
+ def _get_expected_header_size(self):
+ """Returns the size of the leaf header."""
+ return struct.calcsize(self.FORMAT_STRING)
+
+ def _encode_header(self, stream):
+ """Encodes the header of the leaf.
+
+ This method is called by the encode method in the subclass.
+
+ Arguments:
+ stream: a BytesIO to which the object is written.
+
+ Raises:
+ AftlError: If the encoding failed.
+ """
+ try:
+ stream.write(struct.pack(self.FORMAT_STRING, self.version, self.timestamp,
+ self.leaf_type.value))
+ except struct.error:
+ raise AftlError('Unable to encode the leaf header')
+
+ def print_desc(self, o):
+ """Prints the leaf header.
+
+ Arguments:
+ o: The object to write the output to.
+ """
+ i = ' ' * 6
+ fmt = '{}{:23}{}\n'
+ o.write(fmt.format(i, 'Version:', self.version))
+ o.write(fmt.format(i, 'Timestamp:', self.timestamp))
+ o.write(fmt.format(i, 'Type:', self.leaf_type))
+
+
+class SignedVBMetaPrimaryAnnotationLeaf(Leaf):
+ """A Signed VBMetaPrimaryAnnotation leaf."""
+
+ def __init__(self, version=1, timestamp=0,
+ signed_vbmeta_primary_annotation=None):
+ """Builds a new Signed VBMeta Primary Annotation leaf."""
+ super(SignedVBMetaPrimaryAnnotationLeaf, self).__init__(
+ version=version, timestamp=timestamp,
+ leaf_type=self.LeafType.SignedVBMetaPrimaryAnnotationType)
+ if not signed_vbmeta_primary_annotation:
+ signed_vbmeta_primary_annotation = SignedVBMetaPrimaryAnnotation()
+ self.signed_vbmeta_primary_annotation = signed_vbmeta_primary_annotation
+
+ @property
+ def annotation(self):
+ """Returns the VBMetaPrimaryAnnotation contained in the leaf."""
+ return self.signed_vbmeta_primary_annotation.annotation
+
+ @property
+ def signature(self):
+ """Returns the Signature contained in the leaf."""
+ return self.signed_vbmeta_primary_annotation.signature
+
+ @classmethod
+ def parse(cls, data):
+ """Parses an encoded contained in data.
+
+ Arguments:
+ data: a bytes-like object.
+
+ Returns:
+ A SignedVBMetaPrimaryAnnotationLeaf.
+
+ Raises:
+ AftlError if the leaf type is incorrect; or if the decoding failed.
+ """
+ encoded_leaf = io.BytesIO(data)
+ version, timestamp, leaf_type = Leaf._parse_header(encoded_leaf)
+ if leaf_type != Leaf.LeafType.SignedVBMetaPrimaryAnnotationType:
+ raise AftlError("Incorrect leaf type")
+ signed_annotation = SignedVBMetaPrimaryAnnotation.parse(encoded_leaf)
+ return cls(version=version, timestamp=timestamp,
+ signed_vbmeta_primary_annotation=signed_annotation)
+
+ def get_expected_size(self):
+ """Returns the size of the leaf."""
+ size = self._get_expected_header_size()
+ if self.signed_vbmeta_primary_annotation:
+ size += self.signed_vbmeta_primary_annotation.get_expected_size()
+ return size
+
+ def encode(self):
+ """Encodes the leaf.
+
+ Returns:
+ bytes which contains the encoded leaf.
+
+ Raises:
+ AftlError: If the encoding failed.
+ """
+ stream = io.BytesIO()
+ self._encode_header(stream)
+ self.signed_vbmeta_primary_annotation.encode(stream)
+ return stream.getvalue()
+
+ def print_desc(self, o):
+ """Prints the leaf.
+
+ Arguments:
+ o: The object to write the output to.
+ """
+ i = ' ' * 4
+ fmt = '{}{:25}{}\n'
+ o.write(fmt.format(i, 'Leaf:', ''))
+ super(SignedVBMetaPrimaryAnnotationLeaf, self).print_desc(o)
+ self.signed_vbmeta_primary_annotation.print_desc(o)
+
+
class AftlImage(object):
"""A class for the AFTL image, which contains the transparency log ICPs.
@@ -1087,40 +1457,40 @@
else:
self.timeout = None
- def add_firmware_info(self, request):
- """Calls the AddFirmwareInfo RPC on the AFTL server.
+ def add_vbmeta(self, request):
+ """Calls the AddVBMeta RPC on the AFTL server.
Arguments:
- request: A AddFirmwareInfoRequest message.
+ request: An AddVBMetaRequest message.
Returns:
- An AddFirmwareInfoReponse message.
+ An AddVBMetaResponse message.
Raises:
AftlError: If grpc or the proto modules cannot be loaded, if there is an
error communicating with the log.
"""
raise NotImplementedError(
- 'AddFirmwareInfo() needs to be implemented by subclass.')
+ 'add_vbmeta() needs to be implemented by subclass.')
class AftlGrpcCommunication(AftlCommunication):
"""Class that implements GRPC communication to the AFTL server."""
- def add_firmware_info(self, request):
- """Calls the AddFirmwareInfo RPC on the AFTL server.
+ def add_vbmeta(self, request):
+ """Calls the AddVBMeta RPC on the AFTL server.
Arguments:
- request: A AddFirmwareInfoRequest message.
+ request: An AddVBMetaRequest message.
Returns:
- An AddFirmwareInfoReponse message.
+ An AddVBMetaResponse message.
Raises:
AftlError: If grpc or the proto modules cannot be loaded, if there is an
error communicating with the log.
"""
- # Import grpc now to avoid global dependencies as it otherwise breakes
+ # Import grpc now to avoid global dependencies as it otherwise breaks
# running unittest with atest.
try:
import grpc # pylint: disable=import-outside-toplevel
@@ -1145,8 +1515,8 @@
'with domain {}.\n'.format(
self.transparency_log_config.target))
try:
- response = stub.AddFirmwareInfo(request, timeout=self.timeout,
- metadata=metadata)
+ response = stub.AddVBMeta(request, timeout=self.timeout,
+ metadata=metadata)
except grpc.RpcError as e:
raise AftlError('Error: grpc failure ({})'.format(e))
return response
@@ -1340,34 +1710,26 @@
# Calculate the hash of the manufacturer key data.
m_key_hash = hashlib.sha256(manufacturer_key_data).digest()
- # Create an AddFirmwareInfoRequest protobuf for transmission to AFTL.
- fw_info = aftl_pb2.FirmwareInfo(vbmeta_hash=vbmeta_hash,
- version_incremental=version_inc,
- manufacturer_key_hash=m_key_hash)
- signed_fw_info = b''
- # AFTL supports SHA256_RSA4096 for now, more will be available.
- algorithm_name = 'SHA256_RSA4096'
- try:
- rsa_key = avbtool.RSAPublicKey(manufacturer_key_path)
- signed_fw_info = rsa_key.sign(algorithm_name, fw_info.SerializeToString(),
- signing_helper, signing_helper_with_files)
- except avbtool.AvbError as e:
- raise AftlError('Failed to sign FirmwareInfo with '
- '--manufacturer_key: {}'.format(e))
- fw_info_sig = sigpb_pb2.DigitallySigned(
- hash_algorithm='SHA256',
- signature_algorithm='RSA',
- signature=signed_fw_info)
+ # Build VBMetaPrimaryAnnotation with that data.
+ annotation = VBMetaPrimaryAnnotation(
+ vbmeta_hash=vbmeta_hash, version_incremental=version_inc,
+ manufacturer_key_hash=m_key_hash)
- sfw_info = aftl_pb2.SignedFirmwareInfo(info=fw_info,
- info_signature=fw_info_sig)
- request = api_pb2.AddFirmwareInfoRequest(
- vbmeta=vbmeta_image, fw_info=sfw_info)
+ # Sign annotation and add it to the request.
+ signed_annotation = annotation.sign(
+ manufacturer_key_path, signing_helper=signing_helper,
+ signing_helper_with_files=signing_helper_with_files)
- # Submit signed FirmwareInfo to the server.
+ encoded_signed_annotation = io.BytesIO()
+ signed_annotation.encode(encoded_signed_annotation)
+ request = api_pb2.AddVBMetaRequest(
+ vbmeta=vbmeta_image,
+ signed_vbmeta_primary_annotation=encoded_signed_annotation.getvalue())
+
+ # Submit signed VBMeta annotation to the server.
if not aftl_comms:
aftl_comms = AftlGrpcCommunication(transparency_log_config, timeout)
- response = aftl_comms.add_firmware_info(request)
+ response = aftl_comms.add_vbmeta(request)
# Return an AftlIcpEntry representing this response.
icp_entry = AftlIcpEntry()
@@ -1870,14 +2232,14 @@
sub_parser.set_defaults(func=self.load_test_aftl)
args = parser.parse_args(argv[1:])
- try:
- success = args.func(args)
- except AttributeError:
+ if not 'func' in args:
# This error gets raised when the command line tool is called without any
# arguments. It mimics the original Python 2 behavior.
parser.print_usage()
print('aftltool: error: too few arguments')
sys.exit(2)
+ try:
+ success = args.func(args)
except AftlError as e:
# Signals to calling tools that an unhandled exception occured.
sys.stderr.write('Unhandled AftlError occured: {}\n'.format(e))
diff --git a/aftltool_test.py b/aftltool_test.py
index 006deb9..5fe9446 100755
--- a/aftltool_test.py
+++ b/aftltool_test.py
@@ -25,7 +25,6 @@
"""Unit tests for aftltool."""
import argparse
-import base64
import binascii
import io
import os
@@ -47,6 +46,107 @@
# TODO(b/149307145): Remove workaround once the referenced bug is fixed.
TEST_EXEC_PATH = os.path.dirname(os.path.realpath(__file__))
+class TlsDataTest(unittest.TestCase):
+
+ def test_decode(self):
+ data = io.BytesIO(b'\x01\x02')
+ value = aftltool.tls_decode_bytes('B', data)
+ self.assertEqual(value, b'\x02')
+ self.assertEqual(data.read(), b'')
+
+ data = io.BytesIO(b'\x00\x01\x03\xff')
+ value = aftltool.tls_decode_bytes('H', data)
+ self.assertEqual(value, b'\x03')
+ self.assertEqual(data.read(), b'\xff')
+
+ data = io.BytesIO(b'\x00\x00\x00\x02\x04\x05\xff\xff')
+ value = aftltool.tls_decode_bytes('L', data)
+ self.assertEqual(value, b'\x04\x05')
+ self.assertEqual(data.read(), b'\xff\xff')
+
+ def test_decode_invalid(self):
+ # Insufficient data for reading the size.
+ with self.assertRaises(aftltool.AftlError):
+ aftltool.tls_decode_bytes('B', io.BytesIO(b''))
+
+ # Invalid byte_size character.
+ with self.assertRaises(aftltool.AftlError):
+ aftltool.tls_decode_bytes('/o/', io.BytesIO(b'\x01\x02\xff'))
+
+ # Insufficient data for reading the value.
+ with self.assertRaises(aftltool.AftlError):
+ aftltool.tls_decode_bytes('B', io.BytesIO(b'\x01'))
+
+ def test_encode(self):
+ stream = io.BytesIO()
+ aftltool.tls_encode_bytes('B', b'\x01\x02\x03\x04', stream)
+ self.assertEqual(stream.getvalue(), b'\x04\x01\x02\x03\x04')
+
+ stream = io.BytesIO()
+ aftltool.tls_encode_bytes('H', b'\x01\x02\x03\x04', stream)
+ self.assertEqual(stream.getvalue(), b'\x00\x04\x01\x02\x03\x04')
+
+ def test_encode_invalid(self):
+ # Byte size is not large enough to encode the value.
+ stream = io.BytesIO()
+ with self.assertRaises(aftltool.AftlError):
+ aftltool.tls_encode_bytes('B', b'\x01'*256, stream)
+
+ # Invalid byte_size character.
+ stream = io.BytesIO()
+ with self.assertRaises(aftltool.AftlError):
+ aftltool.tls_encode_bytes('/o/', b'\x01\x02', stream)
+
+
+class VBMetaPrimaryAnnotationTest(unittest.TestCase):
+
+ def test_decode(self):
+ stream = io.BytesIO(b'\x00\x00\x00\x00\x00')
+ anno = aftltool.VBMetaPrimaryAnnotation.parse(stream)
+ self.assertEqual(anno.vbmeta_hash, b'')
+ self.assertEqual(anno.version_incremental, '')
+ self.assertEqual(anno.manufacturer_key_hash, b'')
+ self.assertEqual(anno.description, '')
+
+ def test_encode(self):
+ stream = io.BytesIO()
+ anno = aftltool.VBMetaPrimaryAnnotation()
+ anno.encode(stream)
+ self.assertEqual(stream.getvalue(), b'\x00\x00\x00\x00\x00')
+
+ def test_encode_invalid(self):
+ stream = io.BytesIO()
+ anno = aftltool.VBMetaPrimaryAnnotation()
+ # Version incremental should be ASCII only.
+ anno.version_incremental = 'ā'
+ with self.assertRaises(aftltool.AftlError):
+ anno.encode(stream)
+
+
+class SignedVBMetaAnnotationLeafTest(unittest.TestCase):
+
+ def test_encode(self):
+ leaf = aftltool.SignedVBMetaPrimaryAnnotationLeaf()
+ self.assertEqual(leaf.encode(),
+ b'\x01' # Version
+ b'\x00\x00\x00\x00\x00\x00\x00\x00' # Timestamp
+ b'\x01' + # Leaf Type
+ b'\x00' * 4 + # Empty Signature
+ b'\x00' * 5) # Empty Annotation
+
+ def test_encode_invalid_type(self):
+ # The version field must be a 1-byte integer.
+ leaf = aftltool.SignedVBMetaPrimaryAnnotationLeaf()
+ leaf.version = 'x'
+ with self.assertRaises(aftltool.AftlError):
+ leaf.encode()
+
+ def test_encode_invalid_size(self):
+ leaf = aftltool.SignedVBMetaPrimaryAnnotationLeaf()
+ leaf.version = 256
+ with self.assertRaises(aftltool.AftlError):
+ leaf.encode()
+
class AftltoolTestCase(unittest.TestCase):
@@ -99,6 +199,28 @@
b'' # metadata (empty)
)
+ # Test Annotation #1
+ anno_1 = aftltool.VBMetaPrimaryAnnotation(vbmeta_hash=b'w'*32,
+ version_incremental='x'*5,
+ manufacturer_key_hash=b'y'*32,
+ description='z'*51)
+ signed_anno_1 = aftltool.SignedVBMetaPrimaryAnnotation(annotation=anno_1)
+
+ self.test_anno_1 = aftltool.SignedVBMetaPrimaryAnnotationLeaf(
+ signed_vbmeta_primary_annotation=signed_anno_1)
+ self.test_anno_1_bytes = (
+ b'\x01' # version
+ b'\x00\x00\x00\x00\x00\x00\x00\x00' # timestamp
+ b'\x01' # leaf_type
+ b'\x00' # hash_algorithm
+ b'\x00' # signature_algorithm
+ + b'\x00\x00' # signature
+ + b'\x20' + b'w' * 32 # vbmeta_hash
+ + b'\x05' + b'x' * 5 # version_incremental
+ + b'\x20' + b'y' * 32 # manufacturer_key_hash
+ + b'\x00\x33' + b'z' * 51 # description
+ )
+
# Fill each structure with an easily observable pattern for easy validation.
self.test_proof_hashes_1 = []
self.test_proof_hashes_1.append(b'b' * 32)
@@ -110,6 +232,7 @@
self.test_entry_1 = aftltool.AftlIcpEntry()
self.test_entry_1.log_url = self.test_tl_url_1
self.test_entry_1.leaf_index = 1
+ self.test_entry_1.annotation_leaf = self.test_anno_1
self.test_entry_1.log_root_descriptor = self.test_sth_1
self.test_entry_1.proofs = self.test_proof_hashes_1
self.test_entry_1.log_root_signature = b'g' * 512
@@ -118,12 +241,13 @@
b'\x00\x00\x00\x1b' # Transparency log url size.
b'\x00\x00\x00\x00\x00\x00\x00\x01' # Leaf index.
b'\x00\x00\x00\x3d' # Log root descriptor size.
- b'\x00\x00\x00\x00' # Firmware info leaf size.
+ b'\x00\x00\x00\x8b' # Annotation leaf size.
b'\x02\x00' # Log root signature size.
b'\x04' # Number of hashes in ICP.
b'\x00\x00\x00\x80' # Size of ICP in bytes.
+ self.test_tl_url_1.encode('ascii') # Transparency log url.
+ self.test_sth_1_bytes
+ + self.test_anno_1_bytes
+ b'g' * 512 # Log root signature.
+ b'b' * 32 # Hashes...
+ b'c' * 32
@@ -161,6 +285,7 @@
self.test_entry_2 = aftltool.AftlIcpEntry()
self.test_entry_2.log_url = self.test_tl_url_2
self.test_entry_2.leaf_index = 2
+ self.test_entry_2.annotation_leaf = self.test_anno_1
self.test_entry_2.log_root_descriptor = self.test_sth_2
self.test_entry_2.log_root_signature = b'd' * 512
self.test_entry_2.proofs = self.test_proof_hashes_2
@@ -169,12 +294,13 @@
b'\x00\x00\x00\x1a' # Transparency log url size.
b'\x00\x00\x00\x00\x00\x00\x00\x02' # Leaf index.
b'\x00\x00\x00\x3f' # Log root descriptor size.
- b'\x00\x00\x00\x00' # Firmware info leaf size.
+ b'\x00\x00\x00\x8b' # Annotation leaf size.
b'\x02\x00' # Log root signature size.
b'\x02' # Number of hashes in ICP.
b'\x00\x00\x00\x40' # Size of ICP in bytes.
+ self.test_tl_url_2.encode('ascii') # Transparency log url.
+ self.test_sth_2_bytes # Log root
+ + self.test_anno_1_bytes
+ b'd' * 512 # Log root signature.
+ b'g' * 32 # Hashes...
+ b'h' * 32)
@@ -188,61 +314,88 @@
b'AFTL' # Magic.
+ struct.pack('!L', avbtool.AVB_VERSION_MAJOR) # Major version.
+ struct.pack('!L', avbtool.AVB_VERSION_MINOR) # Minor version.
- + b'\x00\x00\x05\xb9' # Image size.
+ + b'\x00\x00\x06\xcf' # Image size.
b'\x00\x02' # Number of ICP entries.
+ self.test_entry_1_bytes
+ self.test_entry_2_bytes)
- # pylint: disable=no-member
- self.test_afi_resp = api_pb2.AddFirmwareInfoResponse()
- self.test_afi_resp.fw_info_proof.proof.leaf_index = 6263
+ self.test_avbm_resp = api_pb2.AddVBMetaResponse()
+ self.test_avbm_resp.annotation_proof.proof.leaf_index = 9127
hashes = [
- '3ad99869646980c0a51d637a9791f892d12e0bc83f6bac5d305a9e289e7f7e8b',
- '2e5c664d2aee64f71cb4d292e787d0eae7ca9ed80d1e08abb41d26baca386c05',
- 'a671dd99f8d97e9155cc2f0a9dc776a112a5ec5b821ec71571bb258ac790717a',
- '78046b839595e4e49ad4b0c73f92bf4803aacd4a3351181086509d057ef0d7a9',
- 'c0a7e013f03e7c69e9402070e113dadb345868cf144ccb174fabc384b5605abf',
- 'dc36e5dbe36abe9f4ad10f14170aa0148b6fe3fcaba9df43deaf4dede01b02e8',
- 'b063e7fb665370a361718208756c363dc5206e2e9af9b4d847d81289cdae30de',
- 'a69ea5ba88a221103636d3f4245c800570eb86ad9276121481521f97d0a04a81']
+ '61076ca285b4982669e67757f55682ddc43ab5c11ba671260f82a8efa8831f94',
+ '89c2fbcc58da25a65ce5e9b4fb22aaf208b20601f0bc023f73f05d35bc1f3bac',
+ '75d26b5f754b4bed332a3ce2a2bfea0334706a974b7e00ee663f0279fa8b446e',
+ 'e1cd9c96feb893b5ef7771e424ac1c6c47509c2b98bc578d22ad07369c9641aa',
+ 'e83e0e4dd352b1670a55f93f88781a73bb41efcadb9927399f59459dfa14bc40',
+ '8d5d25996117c88655d66f685baa3c94390867a040507b10587b17fbe92b496a',
+ '5de4c627e9ca712f207d6056f56f0d3286ed4a5381ed7f3cc1aa470217734138',
+ '19acfdb424d7fe28d1f850c76302f78f9a50146a5b9c65f9fdfbbc0173fd6993']
for h in hashes:
- self.test_afi_resp.fw_info_proof.proof.hashes.append(
+ self.test_avbm_resp.annotation_proof.proof.hashes.append(
binascii.unhexlify(h))
- self.test_afi_resp.fw_info_proof.sth.key_hint = binascii.unhexlify(
+ self.test_avbm_resp.annotation_proof.sth.key_hint = binascii.unhexlify(
'5af859abce8fe1ea')
- self.test_afi_resp.fw_info_proof.sth.log_root = binascii.unhexlify(
- '000100000000000018782053b182b55dc1377197c938637f50093131daea4'
- 'd0696b1eae5b8a014bfde884a15edb28f1fc7954400000000000013a50000'
+ self.test_avbm_resp.annotation_proof.sth.log_root = binascii.unhexlify(
+ '0001'
+ '00000000000023a8'
+ '20'
+ '9a5f71340f8dc98bdc6320f976dda5f34db8554cb273ba5ab60f1697c519d6f6'
+ '1609ae15024774b1'
+ '0000000000001e5a'
+ '0000'
)
- self.test_afi_resp.fw_info_proof.sth.log_root_signature = (
+ self.test_avbm_resp.annotation_proof.sth.log_root_signature = (
binascii.unhexlify(
- 'c264bc7986a1cf56364ca4dd04989f45515cb8764d05b4fb2b880172585ea404'
- '2105f95a0e0471fb6e0f8c762b14b2e526fb78eaddcc61484917795a12f6ab3b'
- '557b5571d492d07d7950595f9ad8647a606c7c633f4697c5eb59c272aeca0419'
- '397c70a3b9b51537537c4ea6b49d356110e70a9286902f814cc6afbeafe612e4'
- '9e180146140e902bdd9e9dae66b37b4943150a9571949027a648db88a4eea3ad'
- 'f930b4fa6a183e97b762ab0e55a3a26aa6b0fd44d30531e2541ecb94bf645e62'
- '59e8e3151e7c3b51a09fe24557ce2fd2c0ecdada7ce99c390d2ef10e5d075801'
- '7c10d49c55cdee930959cc35f0104e04f296591eeb5defbc9ebb237da7b204ca'
- 'a4608cb98d6bc3a01f18585a04441caf8ec7a35aa2d35f7483b92b14fd0f4a41'
- '3a91133545579309adc593222ca5032a103b00d8fcaea911936dbec11349e4dd'
- '419b091ea7d1130570d70e2589dd9445fd77fd7492507e1c87736847b9741cc6'
- '236868af42558ff6e833e12010c8ede786e43ada40ff488f5f1870d1619887d7'
- '66a24ad0a06a47cc14e2f7db07361be191172adf3155f49713807c7c265f5a84'
- '040fc84246ccf7913e44721f0043cea05ee774e457e13206775eee992620c3f9'
- 'd2b2584f58aac19e4afe35f0a17df699c45729f94101083f9fc4302659a7e6e0'
- 'e7eb36f8d1ca0be2c9010160d329bd2d17bb707b010fdd63c30b667a0b886cf9'
+ '7c37903cc76e8689a6b31da9ad56c3daeb6194029510297cc7d147278390da33'
+ '09c4d9eb1f6be0cdcd1de5315b0b3b573cc9fcd8620d3fab956abbe3c597a572'
+ '46e5a5d277c4cc4b590872d0292fa64e1d3285626b1dedeb00b6aa0a7a0717c0'
+ '7d4c89b68fda9091be06180be1369675a7c4ce7f42cca133ef0daf8dcc5ba1ee'
+ '930cef6dcb71b0a7690446e19661c8e18c089a5d6f6fc9299a0592efb33a4db5'
+ '4c640027fa4f0ad0009f8bf75ec5fc17e0fa1091fabe74fe52738443745066ab'
+ '48f99b297809b863c01016abda17a2479fce91f9929c60bc2ce15e474204fc5a'
+ '8e79b2190aadb7c149671e8c76a4da506860f8d6020fb2eaabfee025cc267bad'
+ '3c8257186c8aaf1da9eefe50cae4b3e8deb66033ebc4bfcda2b317f9e7d2dd78'
+ 'b47f2d86795815d82058ad4cba8fc7983a3bbf843e9b8c7ec7f1ae137be6848d'
+ '03c76eefdac40ce5e66cc23d9f3e79ad87acbe7ec0c0bb419a7d368ae1e73c85'
+ '742871f847bde69c871e8797638e0e270282fb058ef1cbcba52aded9dcc8249b'
+ '38fbed8424c33b8cfcde4f49797c64dda8d089d73b84062602fd41c66091543c'
+ 'e13c18cfa7f8300530ad4b7adb8924bbb86d17bcc5f1d3d74c522a7dcc8c3c1f'
+ '28a999f2fe1bfe5520c66f93f7c90996dc7f52e62dd95ace9ceace90324c3040'
+ '669b7f5aeb5c5a53f217f1de46e32f80d0aaaf7d9cc9d0e8f8fd7026c612103a'
)
)
- self.test_afi_resp.fw_info_leaf = (
- b'{\"timestamp\":{\"seconds\":1580115370,\"nanos\":621454825},\"Va'
- b'lue\":{\"FwInfo\":{\"info\":{\"info\":{\"vbmeta_hash\":\"ViNzEQS'
- b'/oc/bJ13yl40fk/cvXw90bxHQbzCRxgHDIGc=\",\"version_incremental\":'
- b'\"1\",\"manufacturer_key_hash\":\"yBCrUOdjvaAh4git5EgqWa5neegUao'
- b'XeLlB67+N8ObY=\"}}}}}')
- self.test_fw_info_leaf = aftltool.FirmwareInfoLeaf(
- self.test_afi_resp.fw_info_leaf)
+ anno = aftltool.VBMetaPrimaryAnnotation(
+ vbmeta_hash=bytes.fromhex(
+ '5623731104bfa1cfdb275df2978d1f93f72f5f0f746f11d06f3091c601c32067'),
+ version_incremental='only_for_testing',
+ manufacturer_key_hash=bytes.fromhex(
+ '83ab3b109b73a1d32dce4153a2de57a1a0485052db8364f3180d98614749d7f7'))
+ raw_signature = bytes.fromhex(
+ '6a523021bc5b933bb58c38c8238be3a5fe1166002f5df8b77dee9dd22d353595'
+ 'be7996656d3824ebf4e1411a05ee3652d64669d3d62b167d3290dbdf4f2741ba'
+ '4b6472e1bd71fc1860465fdcdca1ff08c4ab0420d7dcbf4ad144f64e211d8f92'
+ '081ba51192358e2478195e573d000282423b23e6dd945069907dcf11520ff11a'
+ '250e26643b820f8a5d80ccfe7d5d84f58e549cd05630f2254ade8edc88d9aa8a'
+ 'ec2089f84643854e1f265a4f746598ce4cae529c4eaa637f6e35fa1d1da9254e'
+ 'ec8dfede7a4313f7b151547dcdde98782ce6fb3149326ee5b8e750813d3fd37a'
+ '738fe92f6111bf0dff4091769e216b842980e05716f2e50268a7dcca430e175e'
+ '711f80e41a1a28f20635741ac11a56f97492d30db6d1955a827daf8e83faebe5'
+ 'a96e18a13c558ae561a02c90982514c853db0296c2e791e68b77c30e6232a3b7'
+ 'ed355441d4706277f33a01735f56cb8279336491731939691683f96f1c3e3183'
+ 'a0b77510d6ff0199b7688902044829793106546fd6fd4a5294d63c31c91256ad'
+ 'f7be6d053e77875698ad32ffaaeaac5d54b432e537f72549d2543072ae35578f'
+ '138d82afcadd668511ba276ce02b6f9c18ef3b6f2f6ae0d123e9f8cb930f21a9'
+ 'c49a6d9e95de741c7860593a956735e1b77e9851ecb1f6572abf6e2c8ba15085'
+ 'e37e0f7bab0a30d108b997ed5edd74cf7f89cf082590a6f0af7a3a1f68c0077a')
+ signature = aftltool.Signature(signature=raw_signature)
+ signed_anno = aftltool.SignedVBMetaPrimaryAnnotation(annotation=anno,
+ signature=signature)
+ leaf = aftltool.SignedVBMetaPrimaryAnnotationLeaf(
+ timestamp=1587991742919072870,
+ signed_vbmeta_primary_annotation=signed_anno).encode()
+ self.test_avbm_resp.annotation_leaf = leaf
+
def tearDown(self):
"""Tears down the test bed for the unit tests."""
@@ -448,56 +601,6 @@
# Valid image but checked with empty list of keys.
self.assertFalse(desc.verify_vbmeta_image(vbmeta_image, []))
- def test_verify_vbmeta_image_with_2_icp_from_different_logs(self):
- """Tests the verify_vbmeta_image method."""
- # Valid vbmeta image without footer with 2 ICPs from different logs.
- tool = aftltool.Aftl()
- image_path = self.get_testdata_path(
- 'aftltool/aftl_output_vbmeta_with_2_icp_different_logs.img')
- vbmeta_image, _ = tool.get_vbmeta_image(image_path)
- desc = tool.get_aftl_image(image_path)
-
- # Valid image checked against log keys from both logs.
- self.assertTrue(desc.verify_vbmeta_image(
- vbmeta_image, [
- self.get_testdata_path('aftltool/aftl_pubkey_1.pub'),
- self.get_testdata_path('aftltool/aftl_pubkey_2.pub')
- ]))
-
- # Valid image checked with one of the keys with an invalid file path.
- self.assertFalse(desc.verify_vbmeta_image(
- vbmeta_image, [
- self.get_testdata_path('aftltool/aftl_pubkey_1.pub'),
- self.get_testdata_path('non_existent_blabli')
- ]))
-
- # Valid image checked with one of the keys being a invalid key.
- self.assertFalse(desc.verify_vbmeta_image(
- vbmeta_image, [
- self.get_testdata_path('aftltool/aftl_pubkey_1.pub'),
- self.get_testdata_path('large_blob.bin')
- ]))
-
- # Valid image checked with one of the keys being None.
- self.assertFalse(desc.verify_vbmeta_image(
- vbmeta_image, [
- self.get_testdata_path('aftltool/aftl_pubkey_1.pub'),
- None
- ]))
-
- # Valid vbmeta image checked against only one of the log keys.
- self.assertFalse(desc.verify_vbmeta_image(
- vbmeta_image, [self.get_testdata_path('aftltool/aftl_pubkey_1.pub')]))
- self.assertFalse(desc.verify_vbmeta_image(
- vbmeta_image, [self.get_testdata_path('aftltool/aftl_pubkey_2.pub')]))
-
- # Valid image checked with invalid key.
- self.assertFalse(desc.verify_vbmeta_image(
- vbmeta_image, [self.get_testdata_path('large_blob.bin')]))
-
- # Valid image but checked with empty list of keys.
- self.assertFalse(desc.verify_vbmeta_image(vbmeta_image, []))
-
def test_encode(self):
"""Tests encode method."""
desc_bytes = self.test_aftl_desc.encode()
@@ -649,7 +752,7 @@
self.assertEqual(entry.log_url_size, 0)
self.assertEqual(entry.leaf_index, 0)
self.assertEqual(entry.log_root_descriptor_size, 29)
- self.assertEqual(entry.fw_info_leaf_size, 0)
+ self.assertEqual(entry.annotation_leaf_size, 19)
self.assertEqual(entry.log_root_sig_size, 0)
self.assertEqual(entry.proof_hash_count, 0)
self.assertEqual(entry.inc_proof_size, 0)
@@ -663,7 +766,7 @@
entry = aftltool.AftlIcpEntry(self.test_entry_1_bytes)
self.assertEqual(entry.log_url_size, len(self.test_tl_url_1))
self.assertEqual(entry.leaf_index, 1)
- self.assertEqual(entry.fw_info_leaf_size, 0)
+ self.assertEqual(entry.annotation_leaf_size, 139)
self.assertEqual(entry.log_root_sig_size, 512)
self.assertEqual(entry.proof_hash_count, len(self.test_proof_hashes_1))
self.assertEqual(entry.inc_proof_size, 128)
@@ -680,11 +783,11 @@
"""Tests get_expected_size method."""
# Default record.
entry = aftltool.AftlIcpEntry()
- self.assertEqual(entry.get_expected_size(), 56)
+ self.assertEqual(entry.get_expected_size(), 75)
self.assertEqual(entry.get_expected_size(), len(entry.encode()))
# Test record.
- self.assertEqual(self.test_entry_1.get_expected_size(), 755)
+ self.assertEqual(self.test_entry_1.get_expected_size(), 894)
self.assertEqual(self.test_entry_1.get_expected_size(),
len(self.test_entry_1.encode()))
@@ -717,15 +820,17 @@
def test_translate_response(self):
"""Tests translate_response method."""
entry = aftltool.AftlIcpEntry()
- entry.translate_response('aftl-test.foo.bar:80', self.test_afi_resp)
+ entry.translate_response('aftl-test.foo.bar:80', self.test_avbm_resp)
self.assertEqual(entry.log_url, 'aftl-test.foo.bar:80')
- self.assertEqual(entry.leaf_index, 6263)
+ self.assertEqual(entry.leaf_index, 9127)
self.assertEqual(entry.log_root_descriptor.encode(),
- self.test_afi_resp.fw_info_proof.sth.log_root)
- self.assertEqual(entry.log_root_signature,
- self.test_afi_resp.fw_info_proof.sth.log_root_signature)
- self.assertEqual(entry.proofs,
- self.test_afi_resp.fw_info_proof.proof.hashes)
+ self.test_avbm_resp.annotation_proof.sth.log_root)
+ self.assertEqual(
+ entry.log_root_signature,
+ self.test_avbm_resp.annotation_proof.sth.log_root_signature)
+ self.assertEqual(
+ entry.proofs,
+ self.test_avbm_resp.annotation_proof.proof.hashes)
def test_verify_icp(self):
"""Tests verify_icp method."""
@@ -735,17 +840,18 @@
# Valid ICP.
entry = aftltool.AftlIcpEntry()
- entry.translate_response(self.test_tl_url_1, self.test_afi_resp)
+ entry.translate_response(self.test_tl_url_1, self.test_avbm_resp)
self.assertTrue(entry.verify_icp(key_file.name))
- # Invalid ICP where fw_info_leaf is not matching up with proofs.
+ # Invalid ICP where annotation_leaf is not matching up with proofs.
# pylint: disable=protected-access
entry = aftltool.AftlIcpEntry()
- entry.translate_response(self.test_tl_url_1, self.test_afi_resp)
- fw_info_leaf_bytes = entry.fw_info_leaf._fw_info_leaf_bytes.replace(
- b'ViNzEQS', b'1234567')
- entry.fw_info_leaf._fw_info_leaf_bytes = fw_info_leaf_bytes
- self.assertFalse(entry.verify_icp(key_file.name))
+ entry.translate_response(self.test_tl_url_1, self.test_avbm_resp)
+ vbmeta_hash = entry.annotation_leaf.annotation.vbmeta_hash
+ vbmeta_hash = vbmeta_hash.replace(b"\x56\x23\x73\x11",
+ b"\x00\x00\x00\x00")
+ entry.annotation_leaf.annotation.vbmeta_hash = vbmeta_hash
+ self.assertFalse(entry.verify_icp(key_file))
def test_verify_vbmeta_image(self):
"""Tests the verify_vbmeta_image method."""
@@ -995,94 +1101,54 @@
self.assertIn('Metadata:', desc)
-class FirmwareInfoLeafTest(AftltoolTestCase):
- """Test suite for testing the FirmwareInfoLeaf."""
+class SignedVBMetaPrimaryAnnotationLeafTest(AftltoolTestCase):
+ """Test suite for testing the Leaf."""
def test__init__(self):
"""Tests constructor and properties methods."""
# Calls constructor without data.
- leaf = aftltool.FirmwareInfoLeaf()
- self.assertTrue(leaf.is_valid())
- self.assertEqual(leaf.vbmeta_hash, None)
- self.assertEqual(leaf.version_incremental, None)
- self.assertEqual(leaf.platform_key, None)
- self.assertEqual(leaf.manufacturer_key_hash, None)
- self.assertEqual(leaf.description, None)
+ leaf = aftltool.SignedVBMetaPrimaryAnnotationLeaf()
+ self.assertEqual(leaf.version, 1)
+ self.assertEqual(leaf.timestamp, 0)
+ self.assertEqual(leaf.signature.signature, b'')
+ self.assertEqual(leaf.annotation.vbmeta_hash, b'')
+ self.assertEqual(leaf.annotation.description, '')
- # Calls constructor with data.
- leaf = aftltool.FirmwareInfoLeaf(self.test_afi_resp.fw_info_leaf)
- self.assertTrue(leaf.is_valid())
- self.assertEqual(
- leaf.vbmeta_hash,
- base64.b64decode('ViNzEQS/oc/bJ13yl40fk/cvXw90bxHQbzCRxgHDIGc='))
- self.assertEqual(leaf.version_incremental, '1')
- self.assertEqual(leaf.platform_key, None)
- self.assertEqual(
- leaf.manufacturer_key_hash,
- base64.b64decode('yBCrUOdjvaAh4git5EgqWa5neegUaoXeLlB67+N8ObY='))
- self.assertEqual(leaf.description, None)
+ def test_parse(self):
+ # Calls parse with valid data.
+ leaf = aftltool.SignedVBMetaPrimaryAnnotationLeaf.parse(
+ self.test_anno_1_bytes)
+ self.assertEqual(leaf.annotation.vbmeta_hash, b'w'*32)
+ self.assertEqual(leaf.annotation.version_incremental, 'x'*5)
+ self.assertEqual(leaf.annotation.manufacturer_key_hash, b'y'*32)
+ self.assertEqual(leaf.annotation.description, 'z'*51)
- # Calls constructor with invalid JSON data.
+ # Calls parse with invalid data.
with self.assertRaises(aftltool.AftlError):
- leaf = aftltool.FirmwareInfoLeaf('Invalid JSON.')
+ leaf = aftltool.SignedVBMetaPrimaryAnnotationLeaf.parse(b'Invalid data')
def test_get_expected_size(self):
"""Tests get_expected_size method."""
# Calls constructor without data.
- leaf = aftltool.FirmwareInfoLeaf()
- self.assertEqual(leaf.get_expected_size(), 0)
+ leaf = aftltool.SignedVBMetaPrimaryAnnotationLeaf()
+ self.assertEqual(leaf.get_expected_size(), 19)
# Calls constructor with data.
- leaf = aftltool.FirmwareInfoLeaf(self.test_afi_resp.fw_info_leaf)
+ leaf = aftltool.SignedVBMetaPrimaryAnnotationLeaf.parse(
+ self.test_anno_1_bytes)
self.assertEqual(leaf.get_expected_size(),
- len(self.test_afi_resp.fw_info_leaf))
+ len(self.test_anno_1_bytes))
def test_encode(self):
"""Tests encode method."""
- # Calls constructor without data.
- leaf = aftltool.FirmwareInfoLeaf()
- self.assertEqual(leaf.encode(), b'')
-
# Calls constructor with data.
- self.assertEqual(self.test_fw_info_leaf.encode(),
- self.test_afi_resp.fw_info_leaf)
-
- def test_is_valid(self):
- """Tests is_valid method."""
- # Calls constructor without data.
- leaf = aftltool.FirmwareInfoLeaf()
- self.assertTrue(leaf.is_valid())
-
- # Calls constructor with data.
- self.assertTrue(self.test_fw_info_leaf.is_valid())
-
- # Incorrect name for Value key.
- invalid_value_key_name = (
- b'{\"timestamp\":{\"seconds\":1580115370,\"nanos\":621454825},\"In'
- b'val\":{\"FwInfo\":{\"info\":{\"info\":{\"vbmeta_hash\":\"ViNzEQS'
- b'/oc/bJ13yl40fk/cvXw90bxHQbzCRxgHDIGc=\",\"version_incremental\":'
- b'\"1\",\"manufacturer_key_hash\":\"yBCrUOdjvaAh4git5EgqWa5neegUao'
- b'XeLlB67+N8ObY=\"}}}}}')
-
- with self.assertRaises(aftltool.AftlError):
- aftltool.FirmwareInfoLeaf(invalid_value_key_name)
-
- # Within Firmware Info having a field which does not exist in
- # proto.aftl_pb2.FirmwareInfo.
- invalid_fields = (
- b'{\"timestamp\":{\"seconds\":1580115370,\"nanos\":621454825},\"Va'
- b'lue\":{\"FwInfo\":{\"info\":{\"info\":{\"invalid_field\":\"ViNzEQS'
- b'/oc/bJ13yl40fk/cvXw90bxHQbzCRxgHDIGc=\",\"version_incremental\":'
- b'\"1\",\"manufacturer_key_hash\":\"yBCrUOdjvaAh4git5EgqWa5neegUao'
- b'XeLlB67+N8ObY=\"}}}}}')
-
- with self.assertRaises(aftltool.AftlError):
- aftltool.FirmwareInfoLeaf(invalid_fields)
+ self.assertEqual(self.test_anno_1.encode(),
+ self.test_anno_1_bytes)
def test_print_desc(self):
"""Tests print_desc method."""
buf = io.StringIO()
- self.test_fw_info_leaf.print_desc(buf)
+ self.test_anno_1.print_desc(buf)
desc = buf.getvalue()
# Cursory check whether the printed description contains something useful.
@@ -1098,7 +1164,7 @@
Arguments:
transparency_log_config: An aftltool.TransparencyLogConfig instance.
- canned_response: AddFirmwareInfoResponse to return or the Exception to
+ canned_response: AddVBMetaResponse to return or the Exception to
raise.
"""
super(AftlMockCommunication, self).__init__(transparency_log_config,
@@ -1106,7 +1172,7 @@
self.request = None
self.canned_response = canned_response
- def add_firmware_info(self, request):
+ def add_vbmeta(self, request):
"""Records the request and returns the canned response."""
self.request = request
@@ -1122,7 +1188,7 @@
"""Initializes the object.
Arguments:
- canned_response: AddFirmwareInfoResponse to return or the Exception to
+ canned_response: AddVBMetaResponse to return or the Exception to
raise.
"""
self.mock_canned_response = canned_response
@@ -1284,30 +1350,36 @@
def test_request_inclusion_proof(self):
"""Tests the request_inclusion_proof method."""
# Always work with a mock independent if run as unit or integration tests.
- aftl = AftlMock(self.test_afi_resp)
+ aftl = AftlMock(self.test_avbm_resp)
icp = aftl.request_inclusion_proof(
self.transparency_log_config, b'a' * 1024, '1',
self.get_testdata_path('testkey_rsa4096.pem'), None, None, None)
self.assertEqual(icp.leaf_index,
- self.test_afi_resp.fw_info_proof.proof.leaf_index)
+ self.test_avbm_resp.annotation_proof.proof.leaf_index)
self.assertEqual(icp.proof_hash_count,
- len(self.test_afi_resp.fw_info_proof.proof.hashes))
+ len(self.test_avbm_resp.annotation_proof.proof.hashes))
self.assertEqual(icp.log_url, self.aftl_host)
self.assertEqual(
icp.log_root_descriptor.root_hash, binascii.unhexlify(
- '53b182b55dc1377197c938637f50093131daea4d0696b1eae5b8a014bfde884a'))
+ '9a5f71340f8dc98bdc6320f976dda5f34db8554cb273ba5ab60f1697c519d6f6'))
- self.assertEqual(icp.fw_info_leaf.version_incremental, '1')
+ self.assertEqual(icp.annotation_leaf.annotation.version_incremental,
+ 'only_for_testing')
# To calculate the hash of the a RSA key use the following command:
# openssl rsa -in test/data/testkey_rsa4096.pem -pubout \
# -outform DER | sha256sum
- self.assertEqual(icp.fw_info_leaf.manufacturer_key_hash, base64.b64decode(
- 'yBCrUOdjvaAh4git5EgqWa5neegUaoXeLlB67+N8ObY='))
+ self.assertEqual(
+ icp.annotation_leaf.annotation.manufacturer_key_hash,
+ bytes.fromhex(
+ "83ab3b109b73a1d32dce4153a2de57a1a0485052db8364f3180d98614749d7f7"))
- self.assertEqual(icp.log_root_signature,
- self.test_afi_resp.fw_info_proof.sth.log_root_signature)
- self.assertEqual(icp.proofs, self.test_afi_resp.fw_info_proof.proof.hashes)
+ self.assertEqual(
+ icp.log_root_signature,
+ self.test_avbm_resp.annotation_proof.sth.log_root_signature)
+ self.assertEqual(
+ icp.proofs,
+ self.test_avbm_resp.annotation_proof.proof.hashes)
# pylint: disable=no-member
def test_request_inclusion_proof_failure(self):
@@ -1323,7 +1395,7 @@
def test_request_inclusion_proof_manuf_key_not_4096(self):
"""Tests request_inclusion_proof with manufacturing key not of size 4096."""
# Always work with a mock independent if run as unit or integration tests.
- aftl = AftlMock(self.test_afi_resp)
+ aftl = AftlMock(self.test_avbm_resp)
with self.assertRaises(aftltool.AftlError) as e:
aftl.request_inclusion_proof(
self.transparency_log_config, b'a' * 1024, 'version_inc',
@@ -1332,7 +1404,7 @@
def test_make_and_verify_icp_with_1_log(self):
"""Tests make_icp_from_vbmeta, verify_image_icp & info_image_icp."""
- aftl = self.get_aftl_implementation(self.test_afi_resp)
+ aftl = self.get_aftl_implementation(self.test_avbm_resp)
# Make a VBmeta image with ICP.
with tempfile.NamedTemporaryFile('wb+') as output_file:
@@ -1357,7 +1429,7 @@
def test_make_and_verify_icp_with_2_logs(self):
"""Tests make_icp_from_vbmeta, verify_image_icp & info_image_icp."""
- aftl = self.get_aftl_implementation(self.test_afi_resp)
+ aftl = self.get_aftl_implementation(self.test_avbm_resp)
# Reconfigures default parameters with two transparency logs.
self.make_icp_default_params['transparency_log_configs'] = [
@@ -1388,10 +1460,10 @@
def test_info_image_icp(self):
"""Tests info_image_icp with vbmeta image with 2 ICP."""
# Always work with a mock independent if run as unit or integration tests.
- aftl = AftlMock(self.test_afi_resp)
+ aftl = AftlMock(self.test_avbm_resp)
image_path = self.get_testdata_path(
- 'aftltool/aftl_output_vbmeta_with_2_icp_different_logs.img')
+ 'aftltool/aftl_output_vbmeta_with_2_icp_same_log.img')
self.info_icp_default_params['vbmeta_image_path'] = image_path
# Verifies the generated image.
@@ -1401,7 +1473,7 @@
def test_info_image_icp_fail(self):
"""Tests info_image_icp with invalid vbmeta image."""
# Always work with a mock independent if run as unit or integration tests.
- aftl = AftlMock(self.test_afi_resp)
+ aftl = AftlMock(self.test_avbm_resp)
image_path = self.get_testdata_path('large_blob.bin')
self.info_icp_default_params['vbmeta_image_path'] = image_path
@@ -1413,34 +1485,18 @@
def test_verify_image_icp(self):
"""Tets verify_image_icp with 2 ICP with all matching log keys."""
# Always work with a mock independent if run as unit or integration tests.
- aftl = AftlMock(self.test_afi_resp)
+ aftl = AftlMock(self.test_avbm_resp)
image_path = self.get_testdata_path(
- 'aftltool/aftl_output_vbmeta_with_2_icp_different_logs.img')
+ 'aftltool/aftl_output_vbmeta_with_2_icp_same_log.img')
self.verify_icp_default_params['vbmeta_image_path'] = image_path
self.verify_icp_default_params['transparency_log_pub_keys'] = [
self.get_testdata_path('aftltool/aftl_pubkey_1.pub'),
- self.get_testdata_path('aftltool/aftl_pubkey_2.pub')
]
result = aftl.verify_image_icp(**self.verify_icp_default_params)
self.assertTrue(result)
- def test_verify_image_icp_failure(self):
- """Tests verify_image_icp with 2 ICP but only one matching log key."""
- # Always work with a mock independent if run as unit or integration tests.
- aftl = AftlMock(self.test_afi_resp)
-
- image_path = self.get_testdata_path(
- 'aftltool/aftl_output_vbmeta_with_2_icp_different_logs.img')
- self.verify_icp_default_params['vbmeta_image_path'] = image_path
- self.verify_icp_default_params['transparency_log_pub_keys'] = [
- self.get_testdata_path('aftltool/aftl_pubkey_1.pub')
- ]
-
- result = aftl.verify_image_icp(**self.verify_icp_default_params)
- self.assertFalse(result)
-
def test_make_icp_with_invalid_grpc_service(self):
"""Tests make_icp_from_vbmeta command with a host not supporting GRPC."""
aftl = self.get_aftl_implementation(aftltool.AftlError('Comms error'))
@@ -1468,7 +1524,7 @@
def test_load_test_single_process_single_submission(self):
"""Tests load_test_aftl command with 1 process which does 1 submission."""
- aftl = self.get_aftl_implementation(self.test_afi_resp)
+ aftl = self.get_aftl_implementation(self.test_avbm_resp)
with tempfile.TemporaryDirectory() as tmp_dir:
self.load_test_aftl_default_params[
@@ -1485,7 +1541,7 @@
def test_load_test_multi_process_multi_submission(self):
"""Tests load_test_aftl command with 2 processes and 2 submissions each."""
- aftl = self.get_aftl_implementation(self.test_afi_resp)
+ aftl = self.get_aftl_implementation(self.test_avbm_resp)
self.load_test_aftl_default_params['process_count'] = 2
self.load_test_aftl_default_params['submission_count'] = 2
diff --git a/proto/README.md b/proto/README.md
index eb3966c..ee64b01 100644
--- a/proto/README.md
+++ b/proto/README.md
@@ -2,27 +2,20 @@
---
This directory contains the proto definitions required to communicate with an
-AFTL server. Two (api.proto and aftl.proto) contain the definitions of the
-protos needed to communicate with the AFTL Trillian personality. The remainder
-are dependencies. The original repos and purpose for each proto file are as
+AFTL server. The original repos and purpose for each proto file are as
follows:
-* aftl.proto
- <!-- TODO(danielaustin): Add detailed message descriptions. -->
- Contains messages used by the AFTL frontend and the Trillian log.
* api.proto
- <!-- TODO(danielaustin): Add detailed message descriptions. -->
- Contains the messages to communicate through the AFTL personality.
+ Contains the messages to communicate with the AFTL personality.
* crypto/keyspb/keyspb.proto
From https://github.com/google/trillian
Dependency of trillian.proto
Contains the PublicKey message definition used by Tree.
* crypto/sigpb/sigpb.proto
From https://github.com/google/trillian
- Dependency of trillian.proto and aftl.proto
+ Dependency of trillian.proto
For trillian.proto, contains the DigitallySigned message used by Tree and
- SignedEntryTimestamp. For aftl.proto, contains the DigitallySigned message
- used by SignedFirmwareInfo.
+ SignedEntryTimestamp.
* trillian.proto
From https://github.com/google/trillian
Dependency of aftl.proto
diff --git a/proto/aftl.proto b/proto/aftl.proto
deleted file mode 100644
index 41f1148..0000000
--- a/proto/aftl.proto
+++ /dev/null
@@ -1,112 +0,0 @@
-// Copyright 2019 Google LLC
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-// http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-syntax = "proto3";
-
-package aftl;
-option go_package = "proto";
-
-import "trillian.proto";
-import "crypto/sigpb/sigpb.proto";
-import "google/protobuf/timestamp.proto";
-
-// These messages are used both by the frontend API and the Trillian log.
-message FirmwareInfo {
- // This is the SHA256 hash of vbmeta.
- bytes vbmeta_hash = 1;
-
- // Subcomponent of the build fingerprint as defined at
- // https://source.android.com/compatibility/android-cdd#3_2_2_build_parameters.
- // For example, a Pixel device with the following build fingerprint
- // google/crosshatch/crosshatch:9/PQ3A.190605.003/5524043:user/release-keys,
- // would have 5524043 for the version incremental.
- string version_incremental = 2;
-
- // Public key of the platform. This is the same key used to sign the vbmeta.
- bytes platform_key = 3;
-
- // SHA256 of the manufacturer public key (DER-encoded, x509
- // subjectPublicKeyInfo format). The public key MUST already be in the list
- // of root keys known and trusted by the AFTL.
- // Internal: This field is required to be able to identify which manufacturer
- // this request is coming from.
- bytes manufacturer_key_hash = 4;
-
- // Free form description field. It can be used to annotate this message with
- // further context on the build (e.g., carrier specific build).
- string description = 5;
-}
-
-message SignedFirmwareInfo {
- FirmwareInfo info = 1;
-
- // Signature of the info field, using manufacturer_pub_key.
- // For the signature, info is first serialized to JSON. It is not
- // expected to be able to reconstruct the info field from scratch.
- // When verifying the inclusion proof associated with the info, it is
- // expected that the leaf is provided.
- sigpb.DigitallySigned info_signature = 2;
-}
-
-message FirmwareImageInfo {
- // This is the SHA256 hash of vbmeta.
- bytes vbmeta_hash = 1;
-
- // SHA256 hash of the complete binary image. In case of Pixel, this would be
- // the hash of the ZIP file that is offered for download at:
- // https://developers.google.com/android/images
- bytes hash = 2;
-
- // Build fingerprint, e.g. in case of Pixel
- // google/crosshatch/crosshatch:9/PQ3A.190605.003/5524043:user/release-keys
- // See https://source.android.com/compatibility/android-cdd.html#3_2_2_build_parameters
- // for the expected format of this field.
- string build_fingerprint = 3;
-}
-
-message SignedFirmwareImageInfo {
- FirmwareImageInfo image_info = 1;
- sigpb.DigitallySigned image_info_signature = 2;
-}
-
-
-message InclusionProof {
- trillian.Proof proof = 1;
- trillian.SignedLogRoot sth = 2;
-}
-
-// Trillian-specific data types
-message Leaf {
- int32 version = 1;
-
- // Timestamp when the entry was added to the log.
- google.protobuf.Timestamp timestamp = 2;
-
- oneof value {
- bytes vbmeta = 3;
- FirmwareInfoAnnotation fw_info = 4;
- FirmwareImageInfoAnnotation fw_image_info = 5;
- }
-}
-
-message FirmwareInfoAnnotation {
- SignedFirmwareInfo info = 1;
-}
-
-message FirmwareImageInfoAnnotation {
- SignedFirmwareImageInfo info = 1;
-
- // URL of the firmware image in the Cloud Storage bucket populated by AFTL.
- string url = 2;
-}
diff --git a/proto/aftl_pb2.py b/proto/aftl_pb2.py
deleted file mode 100644
index ed811ae..0000000
--- a/proto/aftl_pb2.py
+++ /dev/null
@@ -1,469 +0,0 @@
-# -*- coding: utf-8 -*-
-# Generated by the protocol buffer compiler. DO NOT EDIT!
-# source: aftl.proto
-
-import sys
-_b=sys.version_info[0]<3 and (lambda x:x) or (lambda x:x.encode('latin1'))
-from google.protobuf import descriptor as _descriptor
-from google.protobuf import message as _message
-from google.protobuf import reflection as _reflection
-from google.protobuf import symbol_database as _symbol_database
-# @@protoc_insertion_point(imports)
-
-_sym_db = _symbol_database.Default()
-
-
-import trillian_pb2 as trillian__pb2
-from crypto.sigpb import sigpb_pb2 as crypto_dot_sigpb_dot_sigpb__pb2
-from google.protobuf import timestamp_pb2 as google_dot_protobuf_dot_timestamp__pb2
-
-
-DESCRIPTOR = _descriptor.FileDescriptor(
- name='aftl.proto',
- package='aftl',
- syntax='proto3',
- serialized_options=_b('Z\005proto'),
- serialized_pb=_b('\n\naftl.proto\x12\x04\x61\x66tl\x1a\x0etrillian.proto\x1a\x18\x63rypto/sigpb/sigpb.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"\x8a\x01\n\x0c\x46irmwareInfo\x12\x13\n\x0bvbmeta_hash\x18\x01 \x01(\x0c\x12\x1b\n\x13version_incremental\x18\x02 \x01(\t\x12\x14\n\x0cplatform_key\x18\x03 \x01(\x0c\x12\x1d\n\x15manufacturer_key_hash\x18\x04 \x01(\x0c\x12\x13\n\x0b\x64\x65scription\x18\x05 \x01(\t\"f\n\x12SignedFirmwareInfo\x12 \n\x04info\x18\x01 \x01(\x0b\x32\x12.aftl.FirmwareInfo\x12.\n\x0einfo_signature\x18\x02 \x01(\x0b\x32\x16.sigpb.DigitallySigned\"Q\n\x11\x46irmwareImageInfo\x12\x13\n\x0bvbmeta_hash\x18\x01 \x01(\x0c\x12\x0c\n\x04hash\x18\x02 \x01(\x0c\x12\x19\n\x11\x62uild_fingerprint\x18\x03 \x01(\t\"|\n\x17SignedFirmwareImageInfo\x12+\n\nimage_info\x18\x01 \x01(\x0b\x32\x17.aftl.FirmwareImageInfo\x12\x34\n\x14image_info_signature\x18\x02 \x01(\x0b\x32\x16.sigpb.DigitallySigned\"V\n\x0eInclusionProof\x12\x1e\n\x05proof\x18\x01 \x01(\x0b\x32\x0f.trillian.Proof\x12$\n\x03sth\x18\x02 \x01(\x0b\x32\x17.trillian.SignedLogRoot\"\xce\x01\n\x04Leaf\x12\x0f\n\x07version\x18\x01 \x01(\x05\x12-\n\ttimestamp\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x10\n\x06vbmeta\x18\x03 \x01(\x0cH\x00\x12/\n\x07\x66w_info\x18\x04 \x01(\x0b\x32\x1c.aftl.FirmwareInfoAnnotationH\x00\x12:\n\rfw_image_info\x18\x05 \x01(\x0b\x32!.aftl.FirmwareImageInfoAnnotationH\x00\x42\x07\n\x05value\"@\n\x16\x46irmwareInfoAnnotation\x12&\n\x04info\x18\x01 \x01(\x0b\x32\x18.aftl.SignedFirmwareInfo\"W\n\x1b\x46irmwareImageInfoAnnotation\x12+\n\x04info\x18\x01 \x01(\x0b\x32\x1d.aftl.SignedFirmwareImageInfo\x12\x0b\n\x03url\x18\x02 \x01(\tB\x07Z\x05protob\x06proto3')
- ,
- dependencies=[trillian__pb2.DESCRIPTOR,crypto_dot_sigpb_dot_sigpb__pb2.DESCRIPTOR,google_dot_protobuf_dot_timestamp__pb2.DESCRIPTOR,])
-
-
-
-
-_FIRMWAREINFO = _descriptor.Descriptor(
- name='FirmwareInfo',
- full_name='aftl.FirmwareInfo',
- filename=None,
- file=DESCRIPTOR,
- containing_type=None,
- fields=[
- _descriptor.FieldDescriptor(
- name='vbmeta_hash', full_name='aftl.FirmwareInfo.vbmeta_hash', index=0,
- number=1, type=12, cpp_type=9, label=1,
- has_default_value=False, default_value=_b(""),
- message_type=None, enum_type=None, containing_type=None,
- is_extension=False, extension_scope=None,
- serialized_options=None, file=DESCRIPTOR),
- _descriptor.FieldDescriptor(
- name='version_incremental', full_name='aftl.FirmwareInfo.version_incremental', index=1,
- number=2, type=9, cpp_type=9, label=1,
- has_default_value=False, default_value=_b("").decode('utf-8'),
- message_type=None, enum_type=None, containing_type=None,
- is_extension=False, extension_scope=None,
- serialized_options=None, file=DESCRIPTOR),
- _descriptor.FieldDescriptor(
- name='platform_key', full_name='aftl.FirmwareInfo.platform_key', index=2,
- number=3, type=12, cpp_type=9, label=1,
- has_default_value=False, default_value=_b(""),
- message_type=None, enum_type=None, containing_type=None,
- is_extension=False, extension_scope=None,
- serialized_options=None, file=DESCRIPTOR),
- _descriptor.FieldDescriptor(
- name='manufacturer_key_hash', full_name='aftl.FirmwareInfo.manufacturer_key_hash', index=3,
- number=4, type=12, cpp_type=9, label=1,
- has_default_value=False, default_value=_b(""),
- message_type=None, enum_type=None, containing_type=None,
- is_extension=False, extension_scope=None,
- serialized_options=None, file=DESCRIPTOR),
- _descriptor.FieldDescriptor(
- name='description', full_name='aftl.FirmwareInfo.description', index=4,
- number=5, type=9, cpp_type=9, label=1,
- has_default_value=False, default_value=_b("").decode('utf-8'),
- message_type=None, enum_type=None, containing_type=None,
- is_extension=False, extension_scope=None,
- serialized_options=None, file=DESCRIPTOR),
- ],
- extensions=[
- ],
- nested_types=[],
- enum_types=[
- ],
- serialized_options=None,
- is_extendable=False,
- syntax='proto3',
- extension_ranges=[],
- oneofs=[
- ],
- serialized_start=96,
- serialized_end=234,
-)
-
-
-_SIGNEDFIRMWAREINFO = _descriptor.Descriptor(
- name='SignedFirmwareInfo',
- full_name='aftl.SignedFirmwareInfo',
- filename=None,
- file=DESCRIPTOR,
- containing_type=None,
- fields=[
- _descriptor.FieldDescriptor(
- name='info', full_name='aftl.SignedFirmwareInfo.info', index=0,
- number=1, type=11, cpp_type=10, label=1,
- has_default_value=False, default_value=None,
- message_type=None, enum_type=None, containing_type=None,
- is_extension=False, extension_scope=None,
- serialized_options=None, file=DESCRIPTOR),
- _descriptor.FieldDescriptor(
- name='info_signature', full_name='aftl.SignedFirmwareInfo.info_signature', index=1,
- number=2, type=11, cpp_type=10, label=1,
- has_default_value=False, default_value=None,
- message_type=None, enum_type=None, containing_type=None,
- is_extension=False, extension_scope=None,
- serialized_options=None, file=DESCRIPTOR),
- ],
- extensions=[
- ],
- nested_types=[],
- enum_types=[
- ],
- serialized_options=None,
- is_extendable=False,
- syntax='proto3',
- extension_ranges=[],
- oneofs=[
- ],
- serialized_start=236,
- serialized_end=338,
-)
-
-
-_FIRMWAREIMAGEINFO = _descriptor.Descriptor(
- name='FirmwareImageInfo',
- full_name='aftl.FirmwareImageInfo',
- filename=None,
- file=DESCRIPTOR,
- containing_type=None,
- fields=[
- _descriptor.FieldDescriptor(
- name='vbmeta_hash', full_name='aftl.FirmwareImageInfo.vbmeta_hash', index=0,
- number=1, type=12, cpp_type=9, label=1,
- has_default_value=False, default_value=_b(""),
- message_type=None, enum_type=None, containing_type=None,
- is_extension=False, extension_scope=None,
- serialized_options=None, file=DESCRIPTOR),
- _descriptor.FieldDescriptor(
- name='hash', full_name='aftl.FirmwareImageInfo.hash', index=1,
- number=2, type=12, cpp_type=9, label=1,
- has_default_value=False, default_value=_b(""),
- message_type=None, enum_type=None, containing_type=None,
- is_extension=False, extension_scope=None,
- serialized_options=None, file=DESCRIPTOR),
- _descriptor.FieldDescriptor(
- name='build_fingerprint', full_name='aftl.FirmwareImageInfo.build_fingerprint', index=2,
- number=3, type=9, cpp_type=9, label=1,
- has_default_value=False, default_value=_b("").decode('utf-8'),
- message_type=None, enum_type=None, containing_type=None,
- is_extension=False, extension_scope=None,
- serialized_options=None, file=DESCRIPTOR),
- ],
- extensions=[
- ],
- nested_types=[],
- enum_types=[
- ],
- serialized_options=None,
- is_extendable=False,
- syntax='proto3',
- extension_ranges=[],
- oneofs=[
- ],
- serialized_start=340,
- serialized_end=421,
-)
-
-
-_SIGNEDFIRMWAREIMAGEINFO = _descriptor.Descriptor(
- name='SignedFirmwareImageInfo',
- full_name='aftl.SignedFirmwareImageInfo',
- filename=None,
- file=DESCRIPTOR,
- containing_type=None,
- fields=[
- _descriptor.FieldDescriptor(
- name='image_info', full_name='aftl.SignedFirmwareImageInfo.image_info', index=0,
- number=1, type=11, cpp_type=10, label=1,
- has_default_value=False, default_value=None,
- message_type=None, enum_type=None, containing_type=None,
- is_extension=False, extension_scope=None,
- serialized_options=None, file=DESCRIPTOR),
- _descriptor.FieldDescriptor(
- name='image_info_signature', full_name='aftl.SignedFirmwareImageInfo.image_info_signature', index=1,
- number=2, type=11, cpp_type=10, label=1,
- has_default_value=False, default_value=None,
- message_type=None, enum_type=None, containing_type=None,
- is_extension=False, extension_scope=None,
- serialized_options=None, file=DESCRIPTOR),
- ],
- extensions=[
- ],
- nested_types=[],
- enum_types=[
- ],
- serialized_options=None,
- is_extendable=False,
- syntax='proto3',
- extension_ranges=[],
- oneofs=[
- ],
- serialized_start=423,
- serialized_end=547,
-)
-
-
-_INCLUSIONPROOF = _descriptor.Descriptor(
- name='InclusionProof',
- full_name='aftl.InclusionProof',
- filename=None,
- file=DESCRIPTOR,
- containing_type=None,
- fields=[
- _descriptor.FieldDescriptor(
- name='proof', full_name='aftl.InclusionProof.proof', index=0,
- number=1, type=11, cpp_type=10, label=1,
- has_default_value=False, default_value=None,
- message_type=None, enum_type=None, containing_type=None,
- is_extension=False, extension_scope=None,
- serialized_options=None, file=DESCRIPTOR),
- _descriptor.FieldDescriptor(
- name='sth', full_name='aftl.InclusionProof.sth', index=1,
- number=2, type=11, cpp_type=10, label=1,
- has_default_value=False, default_value=None,
- message_type=None, enum_type=None, containing_type=None,
- is_extension=False, extension_scope=None,
- serialized_options=None, file=DESCRIPTOR),
- ],
- extensions=[
- ],
- nested_types=[],
- enum_types=[
- ],
- serialized_options=None,
- is_extendable=False,
- syntax='proto3',
- extension_ranges=[],
- oneofs=[
- ],
- serialized_start=549,
- serialized_end=635,
-)
-
-
-_LEAF = _descriptor.Descriptor(
- name='Leaf',
- full_name='aftl.Leaf',
- filename=None,
- file=DESCRIPTOR,
- containing_type=None,
- fields=[
- _descriptor.FieldDescriptor(
- name='version', full_name='aftl.Leaf.version', index=0,
- number=1, type=5, cpp_type=1, label=1,
- has_default_value=False, default_value=0,
- message_type=None, enum_type=None, containing_type=None,
- is_extension=False, extension_scope=None,
- serialized_options=None, file=DESCRIPTOR),
- _descriptor.FieldDescriptor(
- name='timestamp', full_name='aftl.Leaf.timestamp', index=1,
- number=2, type=11, cpp_type=10, label=1,
- has_default_value=False, default_value=None,
- message_type=None, enum_type=None, containing_type=None,
- is_extension=False, extension_scope=None,
- serialized_options=None, file=DESCRIPTOR),
- _descriptor.FieldDescriptor(
- name='vbmeta', full_name='aftl.Leaf.vbmeta', index=2,
- number=3, type=12, cpp_type=9, label=1,
- has_default_value=False, default_value=_b(""),
- message_type=None, enum_type=None, containing_type=None,
- is_extension=False, extension_scope=None,
- serialized_options=None, file=DESCRIPTOR),
- _descriptor.FieldDescriptor(
- name='fw_info', full_name='aftl.Leaf.fw_info', index=3,
- number=4, type=11, cpp_type=10, label=1,
- has_default_value=False, default_value=None,
- message_type=None, enum_type=None, containing_type=None,
- is_extension=False, extension_scope=None,
- serialized_options=None, file=DESCRIPTOR),
- _descriptor.FieldDescriptor(
- name='fw_image_info', full_name='aftl.Leaf.fw_image_info', index=4,
- number=5, type=11, cpp_type=10, label=1,
- has_default_value=False, default_value=None,
- message_type=None, enum_type=None, containing_type=None,
- is_extension=False, extension_scope=None,
- serialized_options=None, file=DESCRIPTOR),
- ],
- extensions=[
- ],
- nested_types=[],
- enum_types=[
- ],
- serialized_options=None,
- is_extendable=False,
- syntax='proto3',
- extension_ranges=[],
- oneofs=[
- _descriptor.OneofDescriptor(
- name='value', full_name='aftl.Leaf.value',
- index=0, containing_type=None, fields=[]),
- ],
- serialized_start=638,
- serialized_end=844,
-)
-
-
-_FIRMWAREINFOANNOTATION = _descriptor.Descriptor(
- name='FirmwareInfoAnnotation',
- full_name='aftl.FirmwareInfoAnnotation',
- filename=None,
- file=DESCRIPTOR,
- containing_type=None,
- fields=[
- _descriptor.FieldDescriptor(
- name='info', full_name='aftl.FirmwareInfoAnnotation.info', index=0,
- number=1, type=11, cpp_type=10, label=1,
- has_default_value=False, default_value=None,
- message_type=None, enum_type=None, containing_type=None,
- is_extension=False, extension_scope=None,
- serialized_options=None, file=DESCRIPTOR),
- ],
- extensions=[
- ],
- nested_types=[],
- enum_types=[
- ],
- serialized_options=None,
- is_extendable=False,
- syntax='proto3',
- extension_ranges=[],
- oneofs=[
- ],
- serialized_start=846,
- serialized_end=910,
-)
-
-
-_FIRMWAREIMAGEINFOANNOTATION = _descriptor.Descriptor(
- name='FirmwareImageInfoAnnotation',
- full_name='aftl.FirmwareImageInfoAnnotation',
- filename=None,
- file=DESCRIPTOR,
- containing_type=None,
- fields=[
- _descriptor.FieldDescriptor(
- name='info', full_name='aftl.FirmwareImageInfoAnnotation.info', index=0,
- number=1, type=11, cpp_type=10, label=1,
- has_default_value=False, default_value=None,
- message_type=None, enum_type=None, containing_type=None,
- is_extension=False, extension_scope=None,
- serialized_options=None, file=DESCRIPTOR),
- _descriptor.FieldDescriptor(
- name='url', full_name='aftl.FirmwareImageInfoAnnotation.url', index=1,
- number=2, type=9, cpp_type=9, label=1,
- has_default_value=False, default_value=_b("").decode('utf-8'),
- message_type=None, enum_type=None, containing_type=None,
- is_extension=False, extension_scope=None,
- serialized_options=None, file=DESCRIPTOR),
- ],
- extensions=[
- ],
- nested_types=[],
- enum_types=[
- ],
- serialized_options=None,
- is_extendable=False,
- syntax='proto3',
- extension_ranges=[],
- oneofs=[
- ],
- serialized_start=912,
- serialized_end=999,
-)
-
-_SIGNEDFIRMWAREINFO.fields_by_name['info'].message_type = _FIRMWAREINFO
-_SIGNEDFIRMWAREINFO.fields_by_name['info_signature'].message_type = crypto_dot_sigpb_dot_sigpb__pb2._DIGITALLYSIGNED
-_SIGNEDFIRMWAREIMAGEINFO.fields_by_name['image_info'].message_type = _FIRMWAREIMAGEINFO
-_SIGNEDFIRMWAREIMAGEINFO.fields_by_name['image_info_signature'].message_type = crypto_dot_sigpb_dot_sigpb__pb2._DIGITALLYSIGNED
-_INCLUSIONPROOF.fields_by_name['proof'].message_type = trillian__pb2._PROOF
-_INCLUSIONPROOF.fields_by_name['sth'].message_type = trillian__pb2._SIGNEDLOGROOT
-_LEAF.fields_by_name['timestamp'].message_type = google_dot_protobuf_dot_timestamp__pb2._TIMESTAMP
-_LEAF.fields_by_name['fw_info'].message_type = _FIRMWAREINFOANNOTATION
-_LEAF.fields_by_name['fw_image_info'].message_type = _FIRMWAREIMAGEINFOANNOTATION
-_LEAF.oneofs_by_name['value'].fields.append(
- _LEAF.fields_by_name['vbmeta'])
-_LEAF.fields_by_name['vbmeta'].containing_oneof = _LEAF.oneofs_by_name['value']
-_LEAF.oneofs_by_name['value'].fields.append(
- _LEAF.fields_by_name['fw_info'])
-_LEAF.fields_by_name['fw_info'].containing_oneof = _LEAF.oneofs_by_name['value']
-_LEAF.oneofs_by_name['value'].fields.append(
- _LEAF.fields_by_name['fw_image_info'])
-_LEAF.fields_by_name['fw_image_info'].containing_oneof = _LEAF.oneofs_by_name['value']
-_FIRMWAREINFOANNOTATION.fields_by_name['info'].message_type = _SIGNEDFIRMWAREINFO
-_FIRMWAREIMAGEINFOANNOTATION.fields_by_name['info'].message_type = _SIGNEDFIRMWAREIMAGEINFO
-DESCRIPTOR.message_types_by_name['FirmwareInfo'] = _FIRMWAREINFO
-DESCRIPTOR.message_types_by_name['SignedFirmwareInfo'] = _SIGNEDFIRMWAREINFO
-DESCRIPTOR.message_types_by_name['FirmwareImageInfo'] = _FIRMWAREIMAGEINFO
-DESCRIPTOR.message_types_by_name['SignedFirmwareImageInfo'] = _SIGNEDFIRMWAREIMAGEINFO
-DESCRIPTOR.message_types_by_name['InclusionProof'] = _INCLUSIONPROOF
-DESCRIPTOR.message_types_by_name['Leaf'] = _LEAF
-DESCRIPTOR.message_types_by_name['FirmwareInfoAnnotation'] = _FIRMWAREINFOANNOTATION
-DESCRIPTOR.message_types_by_name['FirmwareImageInfoAnnotation'] = _FIRMWAREIMAGEINFOANNOTATION
-_sym_db.RegisterFileDescriptor(DESCRIPTOR)
-
-FirmwareInfo = _reflection.GeneratedProtocolMessageType('FirmwareInfo', (_message.Message,), {
- 'DESCRIPTOR' : _FIRMWAREINFO,
- '__module__' : 'aftl_pb2'
- # @@protoc_insertion_point(class_scope:aftl.FirmwareInfo)
- })
-_sym_db.RegisterMessage(FirmwareInfo)
-
-SignedFirmwareInfo = _reflection.GeneratedProtocolMessageType('SignedFirmwareInfo', (_message.Message,), {
- 'DESCRIPTOR' : _SIGNEDFIRMWAREINFO,
- '__module__' : 'aftl_pb2'
- # @@protoc_insertion_point(class_scope:aftl.SignedFirmwareInfo)
- })
-_sym_db.RegisterMessage(SignedFirmwareInfo)
-
-FirmwareImageInfo = _reflection.GeneratedProtocolMessageType('FirmwareImageInfo', (_message.Message,), {
- 'DESCRIPTOR' : _FIRMWAREIMAGEINFO,
- '__module__' : 'aftl_pb2'
- # @@protoc_insertion_point(class_scope:aftl.FirmwareImageInfo)
- })
-_sym_db.RegisterMessage(FirmwareImageInfo)
-
-SignedFirmwareImageInfo = _reflection.GeneratedProtocolMessageType('SignedFirmwareImageInfo', (_message.Message,), {
- 'DESCRIPTOR' : _SIGNEDFIRMWAREIMAGEINFO,
- '__module__' : 'aftl_pb2'
- # @@protoc_insertion_point(class_scope:aftl.SignedFirmwareImageInfo)
- })
-_sym_db.RegisterMessage(SignedFirmwareImageInfo)
-
-InclusionProof = _reflection.GeneratedProtocolMessageType('InclusionProof', (_message.Message,), {
- 'DESCRIPTOR' : _INCLUSIONPROOF,
- '__module__' : 'aftl_pb2'
- # @@protoc_insertion_point(class_scope:aftl.InclusionProof)
- })
-_sym_db.RegisterMessage(InclusionProof)
-
-Leaf = _reflection.GeneratedProtocolMessageType('Leaf', (_message.Message,), {
- 'DESCRIPTOR' : _LEAF,
- '__module__' : 'aftl_pb2'
- # @@protoc_insertion_point(class_scope:aftl.Leaf)
- })
-_sym_db.RegisterMessage(Leaf)
-
-FirmwareInfoAnnotation = _reflection.GeneratedProtocolMessageType('FirmwareInfoAnnotation', (_message.Message,), {
- 'DESCRIPTOR' : _FIRMWAREINFOANNOTATION,
- '__module__' : 'aftl_pb2'
- # @@protoc_insertion_point(class_scope:aftl.FirmwareInfoAnnotation)
- })
-_sym_db.RegisterMessage(FirmwareInfoAnnotation)
-
-FirmwareImageInfoAnnotation = _reflection.GeneratedProtocolMessageType('FirmwareImageInfoAnnotation', (_message.Message,), {
- 'DESCRIPTOR' : _FIRMWAREIMAGEINFOANNOTATION,
- '__module__' : 'aftl_pb2'
- # @@protoc_insertion_point(class_scope:aftl.FirmwareImageInfoAnnotation)
- })
-_sym_db.RegisterMessage(FirmwareImageInfoAnnotation)
-
-
-DESCRIPTOR._options = None
-# @@protoc_insertion_point(module_scope)
diff --git a/proto/aftl_pb2_grpc.py b/proto/aftl_pb2_grpc.py
deleted file mode 100644
index a894352..0000000
--- a/proto/aftl_pb2_grpc.py
+++ /dev/null
@@ -1,3 +0,0 @@
-# Generated by the gRPC Python protocol compiler plugin. DO NOT EDIT!
-import grpc
-
diff --git a/proto/api.proto b/proto/api.proto
index 4c66333..e22ae47 100644
--- a/proto/api.proto
+++ b/proto/api.proto
@@ -1,4 +1,4 @@
-// Copyright 2019 Google LLC
+// Copyright 2019-2020 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
@@ -17,27 +17,35 @@
package aftl;
option go_package = "proto";
-import "aftl.proto";
+import "trillian.proto";
-message AddFirmwareInfoRequest {
+message InclusionProof {
+ trillian.Proof proof = 1;
+ trillian.SignedLogRoot sth = 2;
+}
+
+message AddVBMetaRequest {
// VBMeta structure as described in
// https://android.googlesource.com/platform/external/avb/+/master/README.md.
// In case of chained partitions, each VBMeta is added via a separate call.
// The default size for gRPC payload is about 4MB. We expect vbmeta to be
- // in the order of 1kB.
+ // in the order of 64kB.
bytes vbmeta = 1;
- SignedFirmwareInfo fw_info = 2;
+ // Serialized SignedVBMetaPrimaryAnnotation. This annotation contains the hash
+ // of the vbmeta structure. It is signed using the manufacturer key.
+ // See types/types.go.
+ bytes signed_vbmeta_primary_annotation = 2;
}
-message AddFirmwareInfoResponse {
+message AddVBMetaResponse {
// Inclusion proof and the leaf that was added to the log, which contains
- // information on the firmware.
+ // the annotation on VBMeta.
// It is required to have the complete leaf to validate the inclusion proof.
// For on-device verification, only these first 2 fields are required to
// validate the inclusion.
- InclusionProof fw_info_proof = 1;
- bytes fw_info_leaf = 2;
+ InclusionProof annotation_proof = 1;
+ bytes annotation_leaf = 2;
// Inclusion proof and leaf that was added to the log, which contains the full
// vbmeta partition.
@@ -47,12 +55,13 @@
bytes vbmeta_leaf = 4;
}
-message AddFirmwareImageRequest {
+message AnnotateVBMetaWithBuildRequest {
+ // Serialized SignedVBMetaBuildAnnotation. This annotation contains the hash
+ // of the full build image. See types/types.go.
+ bytes signed_vbmeta_build_annotation = 1;
- SignedFirmwareImageInfo fw_image_info = 1;
-
- // Bytes of the binary images. These are not signed as their final
- // hash value is already signed in fw_image_info.hash
+ // Bytes of the binary images. The hash value of the concatenation of these
+ // chunk is contained in SignedVBMetaBuildAnnotation.
// This is ignored if any of the requests origin_url is set.
bytes image_chunk = 2;
@@ -61,14 +70,13 @@
string origin_url = 3;
}
-message AddFirmwareImageResponse {
-
+message AnnotateVBMetaWithBuildResponse {
// Inclusion proof and leaf for the firmware image. The leaf contains the URL
// where the image was stored.
// It is not required for vendors to keep this information. However, this can
// be used for their records to ensure the correctness of the log.
- InclusionProof fw_image_info_proof = 1;
- Leaf fw_image_info_leaf = 2;
+ InclusionProof annotation_proof = 1;
+ bytes annotation_leaf = 2;
}
service AFTLog {
@@ -76,12 +84,11 @@
// Insert a new VBMeta structure into the log.
// This request will effectively create 2 log entries:
// - VBMeta itself
- // - Vendor annotations, including a reference to the VBMeta leaf.
- rpc AddFirmwareInfo(AddFirmwareInfoRequest) returns (AddFirmwareInfoResponse) {}
+ // - Vendor annotations, which includes a reference to the VBMeta.
+ rpc AddVBMeta(AddVBMetaRequest) returns (AddVBMetaResponse) {}
// Upload (or copy) the complete firmware image.
- rpc AddFirmwareImage(stream AddFirmwareImageRequest) returns (AddFirmwareImageResponse) {}
+ rpc AnnotateVBMetaWithBuild(stream AnnotateVBMetaWithBuildResponse) returns (AnnotateVBMetaWithBuildResponse) {}
- // TODO GetProofByHash, GetSthConsistency, GetEntries, GetRootKeys
+ // TODO(tweek): GetProofByHash, GetSthConsistency, GetEntries, GetRootKeys
}
-
diff --git a/proto/api_pb2.py b/proto/api_pb2.py
index f8f9a01..fbe3bab 100644
--- a/proto/api_pb2.py
+++ b/proto/api_pb2.py
@@ -1,4 +1,3 @@
-# pylint: skip-file
# -*- coding: utf-8 -*-
# Generated by the protocol buffer compiler. DO NOT EDIT!
# source: api.proto
@@ -14,7 +13,7 @@
_sym_db = _symbol_database.Default()
-import aftl_pb2 as aftl__pb2
+import trillian_pb2 as trillian__pb2
DESCRIPTOR = _descriptor.FileDescriptor(
@@ -22,29 +21,29 @@
package='aftl',
syntax='proto3',
serialized_options=_b('Z\005proto'),
- serialized_pb=_b('\n\tapi.proto\x12\x04\x61\x66tl\x1a\naftl.proto\"S\n\x16\x41\x64\x64\x46irmwareInfoRequest\x12\x0e\n\x06vbmeta\x18\x01 \x01(\x0c\x12)\n\x07\x66w_info\x18\x02 \x01(\x0b\x32\x18.aftl.SignedFirmwareInfo\"\x9d\x01\n\x17\x41\x64\x64\x46irmwareInfoResponse\x12+\n\rfw_info_proof\x18\x01 \x01(\x0b\x32\x14.aftl.InclusionProof\x12\x14\n\x0c\x66w_info_leaf\x18\x02 \x01(\x0c\x12*\n\x0cvbmeta_proof\x18\x03 \x01(\x0b\x32\x14.aftl.InclusionProof\x12\x13\n\x0bvbmeta_leaf\x18\x04 \x01(\x0c\"x\n\x17\x41\x64\x64\x46irmwareImageRequest\x12\x34\n\rfw_image_info\x18\x01 \x01(\x0b\x32\x1d.aftl.SignedFirmwareImageInfo\x12\x13\n\x0bimage_chunk\x18\x02 \x01(\x0c\x12\x12\n\norigin_url\x18\x03 \x01(\t\"u\n\x18\x41\x64\x64\x46irmwareImageResponse\x12\x31\n\x13\x66w_image_info_proof\x18\x01 \x01(\x0b\x32\x14.aftl.InclusionProof\x12&\n\x12\x66w_image_info_leaf\x18\x02 \x01(\x0b\x32\n.aftl.Leaf2\xb1\x01\n\x06\x41\x46TLog\x12P\n\x0f\x41\x64\x64\x46irmwareInfo\x12\x1c.aftl.AddFirmwareInfoRequest\x1a\x1d.aftl.AddFirmwareInfoResponse\"\x00\x12U\n\x10\x41\x64\x64\x46irmwareImage\x12\x1d.aftl.AddFirmwareImageRequest\x1a\x1e.aftl.AddFirmwareImageResponse\"\x00(\x01\x42\x07Z\x05protob\x06proto3')
+ serialized_pb=_b('\n\tapi.proto\x12\x04\x61\x66tl\x1a\x0etrillian.proto\"V\n\x0eInclusionProof\x12\x1e\n\x05proof\x18\x01 \x01(\x0b\x32\x0f.trillian.Proof\x12$\n\x03sth\x18\x02 \x01(\x0b\x32\x17.trillian.SignedLogRoot\"L\n\x10\x41\x64\x64VBMetaRequest\x12\x0e\n\x06vbmeta\x18\x01 \x01(\x0c\x12(\n signed_vbmeta_primary_annotation\x18\x02 \x01(\x0c\"\x9d\x01\n\x11\x41\x64\x64VBMetaResponse\x12.\n\x10\x61nnotation_proof\x18\x01 \x01(\x0b\x32\x14.aftl.InclusionProof\x12\x17\n\x0f\x61nnotation_leaf\x18\x02 \x01(\x0c\x12*\n\x0cvbmeta_proof\x18\x03 \x01(\x0b\x32\x14.aftl.InclusionProof\x12\x13\n\x0bvbmeta_leaf\x18\x04 \x01(\x0c\"q\n\x1e\x41nnotateVBMetaWithBuildRequest\x12&\n\x1esigned_vbmeta_build_annotation\x18\x01 \x01(\x0c\x12\x13\n\x0bimage_chunk\x18\x02 \x01(\x0c\x12\x12\n\norigin_url\x18\x03 \x01(\t\"j\n\x1f\x41nnotateVBMetaWithBuildResponse\x12.\n\x10\x61nnotation_proof\x18\x01 \x01(\x0b\x32\x14.aftl.InclusionProof\x12\x17\n\x0f\x61nnotation_leaf\x18\x02 \x01(\x0c\x32\xb5\x01\n\x06\x41\x46TLog\x12>\n\tAddVBMeta\x12\x16.aftl.AddVBMetaRequest\x1a\x17.aftl.AddVBMetaResponse\"\x00\x12k\n\x17\x41nnotateVBMetaWithBuild\x12%.aftl.AnnotateVBMetaWithBuildResponse\x1a%.aftl.AnnotateVBMetaWithBuildResponse\"\x00(\x01\x42\x07Z\x05protob\x06proto3')
,
- dependencies=[aftl__pb2.DESCRIPTOR,])
+ dependencies=[trillian__pb2.DESCRIPTOR,])
-_ADDFIRMWAREINFOREQUEST = _descriptor.Descriptor(
- name='AddFirmwareInfoRequest',
- full_name='aftl.AddFirmwareInfoRequest',
+_INCLUSIONPROOF = _descriptor.Descriptor(
+ name='InclusionProof',
+ full_name='aftl.InclusionProof',
filename=None,
file=DESCRIPTOR,
containing_type=None,
fields=[
_descriptor.FieldDescriptor(
- name='vbmeta', full_name='aftl.AddFirmwareInfoRequest.vbmeta', index=0,
- number=1, type=12, cpp_type=9, label=1,
- has_default_value=False, default_value=_b(""),
+ name='proof', full_name='aftl.InclusionProof.proof', index=0,
+ number=1, type=11, cpp_type=10, label=1,
+ has_default_value=False, default_value=None,
message_type=None, enum_type=None, containing_type=None,
is_extension=False, extension_scope=None,
serialized_options=None, file=DESCRIPTOR),
_descriptor.FieldDescriptor(
- name='fw_info', full_name='aftl.AddFirmwareInfoRequest.fw_info', index=1,
+ name='sth', full_name='aftl.InclusionProof.sth', index=1,
number=2, type=11, cpp_type=10, label=1,
has_default_value=False, default_value=None,
message_type=None, enum_type=None, containing_type=None,
@@ -62,41 +61,79 @@
extension_ranges=[],
oneofs=[
],
- serialized_start=31,
- serialized_end=114,
+ serialized_start=35,
+ serialized_end=121,
)
-_ADDFIRMWAREINFORESPONSE = _descriptor.Descriptor(
- name='AddFirmwareInfoResponse',
- full_name='aftl.AddFirmwareInfoResponse',
+_ADDVBMETAREQUEST = _descriptor.Descriptor(
+ name='AddVBMetaRequest',
+ full_name='aftl.AddVBMetaRequest',
filename=None,
file=DESCRIPTOR,
containing_type=None,
fields=[
_descriptor.FieldDescriptor(
- name='fw_info_proof', full_name='aftl.AddFirmwareInfoResponse.fw_info_proof', index=0,
+ name='vbmeta', full_name='aftl.AddVBMetaRequest.vbmeta', index=0,
+ number=1, type=12, cpp_type=9, label=1,
+ has_default_value=False, default_value=_b(""),
+ message_type=None, enum_type=None, containing_type=None,
+ is_extension=False, extension_scope=None,
+ serialized_options=None, file=DESCRIPTOR),
+ _descriptor.FieldDescriptor(
+ name='signed_vbmeta_primary_annotation', full_name='aftl.AddVBMetaRequest.signed_vbmeta_primary_annotation', index=1,
+ number=2, type=12, cpp_type=9, label=1,
+ has_default_value=False, default_value=_b(""),
+ message_type=None, enum_type=None, containing_type=None,
+ is_extension=False, extension_scope=None,
+ serialized_options=None, file=DESCRIPTOR),
+ ],
+ extensions=[
+ ],
+ nested_types=[],
+ enum_types=[
+ ],
+ serialized_options=None,
+ is_extendable=False,
+ syntax='proto3',
+ extension_ranges=[],
+ oneofs=[
+ ],
+ serialized_start=123,
+ serialized_end=199,
+)
+
+
+_ADDVBMETARESPONSE = _descriptor.Descriptor(
+ name='AddVBMetaResponse',
+ full_name='aftl.AddVBMetaResponse',
+ filename=None,
+ file=DESCRIPTOR,
+ containing_type=None,
+ fields=[
+ _descriptor.FieldDescriptor(
+ name='annotation_proof', full_name='aftl.AddVBMetaResponse.annotation_proof', index=0,
number=1, type=11, cpp_type=10, label=1,
has_default_value=False, default_value=None,
message_type=None, enum_type=None, containing_type=None,
is_extension=False, extension_scope=None,
serialized_options=None, file=DESCRIPTOR),
_descriptor.FieldDescriptor(
- name='fw_info_leaf', full_name='aftl.AddFirmwareInfoResponse.fw_info_leaf', index=1,
+ name='annotation_leaf', full_name='aftl.AddVBMetaResponse.annotation_leaf', index=1,
number=2, type=12, cpp_type=9, label=1,
has_default_value=False, default_value=_b(""),
message_type=None, enum_type=None, containing_type=None,
is_extension=False, extension_scope=None,
serialized_options=None, file=DESCRIPTOR),
_descriptor.FieldDescriptor(
- name='vbmeta_proof', full_name='aftl.AddFirmwareInfoResponse.vbmeta_proof', index=2,
+ name='vbmeta_proof', full_name='aftl.AddVBMetaResponse.vbmeta_proof', index=2,
number=3, type=11, cpp_type=10, label=1,
has_default_value=False, default_value=None,
message_type=None, enum_type=None, containing_type=None,
is_extension=False, extension_scope=None,
serialized_options=None, file=DESCRIPTOR),
_descriptor.FieldDescriptor(
- name='vbmeta_leaf', full_name='aftl.AddFirmwareInfoResponse.vbmeta_leaf', index=3,
+ name='vbmeta_leaf', full_name='aftl.AddVBMetaResponse.vbmeta_leaf', index=3,
number=4, type=12, cpp_type=9, label=1,
has_default_value=False, default_value=_b(""),
message_type=None, enum_type=None, containing_type=None,
@@ -114,34 +151,34 @@
extension_ranges=[],
oneofs=[
],
- serialized_start=117,
- serialized_end=274,
+ serialized_start=202,
+ serialized_end=359,
)
-_ADDFIRMWAREIMAGEREQUEST = _descriptor.Descriptor(
- name='AddFirmwareImageRequest',
- full_name='aftl.AddFirmwareImageRequest',
+_ANNOTATEVBMETAWITHBUILDREQUEST = _descriptor.Descriptor(
+ name='AnnotateVBMetaWithBuildRequest',
+ full_name='aftl.AnnotateVBMetaWithBuildRequest',
filename=None,
file=DESCRIPTOR,
containing_type=None,
fields=[
_descriptor.FieldDescriptor(
- name='fw_image_info', full_name='aftl.AddFirmwareImageRequest.fw_image_info', index=0,
- number=1, type=11, cpp_type=10, label=1,
- has_default_value=False, default_value=None,
+ name='signed_vbmeta_build_annotation', full_name='aftl.AnnotateVBMetaWithBuildRequest.signed_vbmeta_build_annotation', index=0,
+ number=1, type=12, cpp_type=9, label=1,
+ has_default_value=False, default_value=_b(""),
message_type=None, enum_type=None, containing_type=None,
is_extension=False, extension_scope=None,
serialized_options=None, file=DESCRIPTOR),
_descriptor.FieldDescriptor(
- name='image_chunk', full_name='aftl.AddFirmwareImageRequest.image_chunk', index=1,
+ name='image_chunk', full_name='aftl.AnnotateVBMetaWithBuildRequest.image_chunk', index=1,
number=2, type=12, cpp_type=9, label=1,
has_default_value=False, default_value=_b(""),
message_type=None, enum_type=None, containing_type=None,
is_extension=False, extension_scope=None,
serialized_options=None, file=DESCRIPTOR),
_descriptor.FieldDescriptor(
- name='origin_url', full_name='aftl.AddFirmwareImageRequest.origin_url', index=2,
+ name='origin_url', full_name='aftl.AnnotateVBMetaWithBuildRequest.origin_url', index=2,
number=3, type=9, cpp_type=9, label=1,
has_default_value=False, default_value=_b("").decode('utf-8'),
message_type=None, enum_type=None, containing_type=None,
@@ -159,29 +196,29 @@
extension_ranges=[],
oneofs=[
],
- serialized_start=276,
- serialized_end=396,
+ serialized_start=361,
+ serialized_end=474,
)
-_ADDFIRMWAREIMAGERESPONSE = _descriptor.Descriptor(
- name='AddFirmwareImageResponse',
- full_name='aftl.AddFirmwareImageResponse',
+_ANNOTATEVBMETAWITHBUILDRESPONSE = _descriptor.Descriptor(
+ name='AnnotateVBMetaWithBuildResponse',
+ full_name='aftl.AnnotateVBMetaWithBuildResponse',
filename=None,
file=DESCRIPTOR,
containing_type=None,
fields=[
_descriptor.FieldDescriptor(
- name='fw_image_info_proof', full_name='aftl.AddFirmwareImageResponse.fw_image_info_proof', index=0,
+ name='annotation_proof', full_name='aftl.AnnotateVBMetaWithBuildResponse.annotation_proof', index=0,
number=1, type=11, cpp_type=10, label=1,
has_default_value=False, default_value=None,
message_type=None, enum_type=None, containing_type=None,
is_extension=False, extension_scope=None,
serialized_options=None, file=DESCRIPTOR),
_descriptor.FieldDescriptor(
- name='fw_image_info_leaf', full_name='aftl.AddFirmwareImageResponse.fw_image_info_leaf', index=1,
- number=2, type=11, cpp_type=10, label=1,
- has_default_value=False, default_value=None,
+ name='annotation_leaf', full_name='aftl.AnnotateVBMetaWithBuildResponse.annotation_leaf', index=1,
+ number=2, type=12, cpp_type=9, label=1,
+ has_default_value=False, default_value=_b(""),
message_type=None, enum_type=None, containing_type=None,
is_extension=False, extension_scope=None,
serialized_options=None, file=DESCRIPTOR),
@@ -197,49 +234,56 @@
extension_ranges=[],
oneofs=[
],
- serialized_start=398,
- serialized_end=515,
+ serialized_start=476,
+ serialized_end=582,
)
-_ADDFIRMWAREINFOREQUEST.fields_by_name['fw_info'].message_type = aftl__pb2._SIGNEDFIRMWAREINFO
-_ADDFIRMWAREINFORESPONSE.fields_by_name['fw_info_proof'].message_type = aftl__pb2._INCLUSIONPROOF
-_ADDFIRMWAREINFORESPONSE.fields_by_name['vbmeta_proof'].message_type = aftl__pb2._INCLUSIONPROOF
-_ADDFIRMWAREIMAGEREQUEST.fields_by_name['fw_image_info'].message_type = aftl__pb2._SIGNEDFIRMWAREIMAGEINFO
-_ADDFIRMWAREIMAGERESPONSE.fields_by_name['fw_image_info_proof'].message_type = aftl__pb2._INCLUSIONPROOF
-_ADDFIRMWAREIMAGERESPONSE.fields_by_name['fw_image_info_leaf'].message_type = aftl__pb2._LEAF
-DESCRIPTOR.message_types_by_name['AddFirmwareInfoRequest'] = _ADDFIRMWAREINFOREQUEST
-DESCRIPTOR.message_types_by_name['AddFirmwareInfoResponse'] = _ADDFIRMWAREINFORESPONSE
-DESCRIPTOR.message_types_by_name['AddFirmwareImageRequest'] = _ADDFIRMWAREIMAGEREQUEST
-DESCRIPTOR.message_types_by_name['AddFirmwareImageResponse'] = _ADDFIRMWAREIMAGERESPONSE
+_INCLUSIONPROOF.fields_by_name['proof'].message_type = trillian__pb2._PROOF
+_INCLUSIONPROOF.fields_by_name['sth'].message_type = trillian__pb2._SIGNEDLOGROOT
+_ADDVBMETARESPONSE.fields_by_name['annotation_proof'].message_type = _INCLUSIONPROOF
+_ADDVBMETARESPONSE.fields_by_name['vbmeta_proof'].message_type = _INCLUSIONPROOF
+_ANNOTATEVBMETAWITHBUILDRESPONSE.fields_by_name['annotation_proof'].message_type = _INCLUSIONPROOF
+DESCRIPTOR.message_types_by_name['InclusionProof'] = _INCLUSIONPROOF
+DESCRIPTOR.message_types_by_name['AddVBMetaRequest'] = _ADDVBMETAREQUEST
+DESCRIPTOR.message_types_by_name['AddVBMetaResponse'] = _ADDVBMETARESPONSE
+DESCRIPTOR.message_types_by_name['AnnotateVBMetaWithBuildRequest'] = _ANNOTATEVBMETAWITHBUILDREQUEST
+DESCRIPTOR.message_types_by_name['AnnotateVBMetaWithBuildResponse'] = _ANNOTATEVBMETAWITHBUILDRESPONSE
_sym_db.RegisterFileDescriptor(DESCRIPTOR)
-AddFirmwareInfoRequest = _reflection.GeneratedProtocolMessageType('AddFirmwareInfoRequest', (_message.Message,), {
- 'DESCRIPTOR' : _ADDFIRMWAREINFOREQUEST,
+InclusionProof = _reflection.GeneratedProtocolMessageType('InclusionProof', (_message.Message,), {
+ 'DESCRIPTOR' : _INCLUSIONPROOF,
'__module__' : 'api_pb2'
- # @@protoc_insertion_point(class_scope:aftl.AddFirmwareInfoRequest)
+ # @@protoc_insertion_point(class_scope:aftl.InclusionProof)
})
-_sym_db.RegisterMessage(AddFirmwareInfoRequest)
+_sym_db.RegisterMessage(InclusionProof)
-AddFirmwareInfoResponse = _reflection.GeneratedProtocolMessageType('AddFirmwareInfoResponse', (_message.Message,), {
- 'DESCRIPTOR' : _ADDFIRMWAREINFORESPONSE,
+AddVBMetaRequest = _reflection.GeneratedProtocolMessageType('AddVBMetaRequest', (_message.Message,), {
+ 'DESCRIPTOR' : _ADDVBMETAREQUEST,
'__module__' : 'api_pb2'
- # @@protoc_insertion_point(class_scope:aftl.AddFirmwareInfoResponse)
+ # @@protoc_insertion_point(class_scope:aftl.AddVBMetaRequest)
})
-_sym_db.RegisterMessage(AddFirmwareInfoResponse)
+_sym_db.RegisterMessage(AddVBMetaRequest)
-AddFirmwareImageRequest = _reflection.GeneratedProtocolMessageType('AddFirmwareImageRequest', (_message.Message,), {
- 'DESCRIPTOR' : _ADDFIRMWAREIMAGEREQUEST,
+AddVBMetaResponse = _reflection.GeneratedProtocolMessageType('AddVBMetaResponse', (_message.Message,), {
+ 'DESCRIPTOR' : _ADDVBMETARESPONSE,
'__module__' : 'api_pb2'
- # @@protoc_insertion_point(class_scope:aftl.AddFirmwareImageRequest)
+ # @@protoc_insertion_point(class_scope:aftl.AddVBMetaResponse)
})
-_sym_db.RegisterMessage(AddFirmwareImageRequest)
+_sym_db.RegisterMessage(AddVBMetaResponse)
-AddFirmwareImageResponse = _reflection.GeneratedProtocolMessageType('AddFirmwareImageResponse', (_message.Message,), {
- 'DESCRIPTOR' : _ADDFIRMWAREIMAGERESPONSE,
+AnnotateVBMetaWithBuildRequest = _reflection.GeneratedProtocolMessageType('AnnotateVBMetaWithBuildRequest', (_message.Message,), {
+ 'DESCRIPTOR' : _ANNOTATEVBMETAWITHBUILDREQUEST,
'__module__' : 'api_pb2'
- # @@protoc_insertion_point(class_scope:aftl.AddFirmwareImageResponse)
+ # @@protoc_insertion_point(class_scope:aftl.AnnotateVBMetaWithBuildRequest)
})
-_sym_db.RegisterMessage(AddFirmwareImageResponse)
+_sym_db.RegisterMessage(AnnotateVBMetaWithBuildRequest)
+
+AnnotateVBMetaWithBuildResponse = _reflection.GeneratedProtocolMessageType('AnnotateVBMetaWithBuildResponse', (_message.Message,), {
+ 'DESCRIPTOR' : _ANNOTATEVBMETAWITHBUILDRESPONSE,
+ '__module__' : 'api_pb2'
+ # @@protoc_insertion_point(class_scope:aftl.AnnotateVBMetaWithBuildResponse)
+ })
+_sym_db.RegisterMessage(AnnotateVBMetaWithBuildResponse)
DESCRIPTOR._options = None
@@ -250,25 +294,25 @@
file=DESCRIPTOR,
index=0,
serialized_options=None,
- serialized_start=518,
- serialized_end=695,
+ serialized_start=585,
+ serialized_end=766,
methods=[
_descriptor.MethodDescriptor(
- name='AddFirmwareInfo',
- full_name='aftl.AFTLog.AddFirmwareInfo',
+ name='AddVBMeta',
+ full_name='aftl.AFTLog.AddVBMeta',
index=0,
containing_service=None,
- input_type=_ADDFIRMWAREINFOREQUEST,
- output_type=_ADDFIRMWAREINFORESPONSE,
+ input_type=_ADDVBMETAREQUEST,
+ output_type=_ADDVBMETARESPONSE,
serialized_options=None,
),
_descriptor.MethodDescriptor(
- name='AddFirmwareImage',
- full_name='aftl.AFTLog.AddFirmwareImage',
+ name='AnnotateVBMetaWithBuild',
+ full_name='aftl.AFTLog.AnnotateVBMetaWithBuild',
index=1,
containing_service=None,
- input_type=_ADDFIRMWAREIMAGEREQUEST,
- output_type=_ADDFIRMWAREIMAGERESPONSE,
+ input_type=_ANNOTATEVBMETAWITHBUILDRESPONSE,
+ output_type=_ANNOTATEVBMETAWITHBUILDRESPONSE,
serialized_options=None,
),
])
diff --git a/proto/api_pb2_grpc.py b/proto/api_pb2_grpc.py
index b1834c7..d487856 100644
--- a/proto/api_pb2_grpc.py
+++ b/proto/api_pb2_grpc.py
@@ -1,4 +1,3 @@
-# pylint: skip-file
# Generated by the gRPC Python protocol compiler plugin. DO NOT EDIT!
import grpc
@@ -15,15 +14,15 @@
Args:
channel: A grpc.Channel.
"""
- self.AddFirmwareInfo = channel.unary_unary(
- '/aftl.AFTLog/AddFirmwareInfo',
- request_serializer=api__pb2.AddFirmwareInfoRequest.SerializeToString,
- response_deserializer=api__pb2.AddFirmwareInfoResponse.FromString,
+ self.AddVBMeta = channel.unary_unary(
+ '/aftl.AFTLog/AddVBMeta',
+ request_serializer=api__pb2.AddVBMetaRequest.SerializeToString,
+ response_deserializer=api__pb2.AddVBMetaResponse.FromString,
)
- self.AddFirmwareImage = channel.stream_unary(
- '/aftl.AFTLog/AddFirmwareImage',
- request_serializer=api__pb2.AddFirmwareImageRequest.SerializeToString,
- response_deserializer=api__pb2.AddFirmwareImageResponse.FromString,
+ self.AnnotateVBMetaWithBuild = channel.stream_unary(
+ '/aftl.AFTLog/AnnotateVBMetaWithBuild',
+ request_serializer=api__pb2.AnnotateVBMetaWithBuildResponse.SerializeToString,
+ response_deserializer=api__pb2.AnnotateVBMetaWithBuildResponse.FromString,
)
@@ -31,17 +30,17 @@
# missing associated documentation comment in .proto file
pass
- def AddFirmwareInfo(self, request, context):
+ def AddVBMeta(self, request, context):
"""Insert a new VBMeta structure into the log.
This request will effectively create 2 log entries:
- VBMeta itself
- - Vendor annotations, including a reference to the VBMeta leaf.
+ - Vendor annotations, which includes a reference to the VBMeta.
"""
context.set_code(grpc.StatusCode.UNIMPLEMENTED)
context.set_details('Method not implemented!')
raise NotImplementedError('Method not implemented!')
- def AddFirmwareImage(self, request_iterator, context):
+ def AnnotateVBMetaWithBuild(self, request_iterator, context):
"""Upload (or copy) the complete firmware image.
"""
context.set_code(grpc.StatusCode.UNIMPLEMENTED)
@@ -51,15 +50,15 @@
def add_AFTLogServicer_to_server(servicer, server):
rpc_method_handlers = {
- 'AddFirmwareInfo': grpc.unary_unary_rpc_method_handler(
- servicer.AddFirmwareInfo,
- request_deserializer=api__pb2.AddFirmwareInfoRequest.FromString,
- response_serializer=api__pb2.AddFirmwareInfoResponse.SerializeToString,
+ 'AddVBMeta': grpc.unary_unary_rpc_method_handler(
+ servicer.AddVBMeta,
+ request_deserializer=api__pb2.AddVBMetaRequest.FromString,
+ response_serializer=api__pb2.AddVBMetaResponse.SerializeToString,
),
- 'AddFirmwareImage': grpc.stream_unary_rpc_method_handler(
- servicer.AddFirmwareImage,
- request_deserializer=api__pb2.AddFirmwareImageRequest.FromString,
- response_serializer=api__pb2.AddFirmwareImageResponse.SerializeToString,
+ 'AnnotateVBMetaWithBuild': grpc.stream_unary_rpc_method_handler(
+ servicer.AnnotateVBMetaWithBuild,
+ request_deserializer=api__pb2.AnnotateVBMetaWithBuildResponse.FromString,
+ response_serializer=api__pb2.AnnotateVBMetaWithBuildResponse.SerializeToString,
),
}
generic_handler = grpc.method_handlers_generic_handler(
diff --git a/test/data/aftltool/aftl_output_vbmeta_with_1_icp.img b/test/data/aftltool/aftl_output_vbmeta_with_1_icp.img
index 25e0869..74b67bb 100644
--- a/test/data/aftltool/aftl_output_vbmeta_with_1_icp.img
+++ b/test/data/aftltool/aftl_output_vbmeta_with_1_icp.img
Binary files differ
diff --git a/test/data/aftltool/aftl_output_vbmeta_with_2_icp_different_logs.img b/test/data/aftltool/aftl_output_vbmeta_with_2_icp_different_logs.img
deleted file mode 100644
index ad36580..0000000
--- a/test/data/aftltool/aftl_output_vbmeta_with_2_icp_different_logs.img
+++ /dev/null
Binary files differ
diff --git a/test/data/aftltool/aftl_output_vbmeta_with_2_icp_same_log.img b/test/data/aftltool/aftl_output_vbmeta_with_2_icp_same_log.img
index e53178c..2a6368e 100644
--- a/test/data/aftltool/aftl_output_vbmeta_with_2_icp_same_log.img
+++ b/test/data/aftltool/aftl_output_vbmeta_with_2_icp_same_log.img
Binary files differ
