Add a script to generate a keypair for signing Staff RW firmware.
Staff decided to leverage the key format of Hammer therefore this
script calls Hammer's one to generate a key pair and renames them to
key_staff*.
BUG=b:66889892
TEST=Run this script in the chroot and verify the generated key pair.
BRANCH=None
Change-Id: I73162efaba47a8c08336805130ced0be25ab262a
Reviewed-on: https://chromium-review.googlesource.com/688522
Commit-Ready: Marco Chen <marcochen@chromium.org>
Tested-by: Marco Chen <marcochen@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>
diff --git a/scripts/keygeneration/accessory/common_leverage_hammer.sh b/scripts/keygeneration/accessory/common_leverage_hammer.sh
new file mode 100644
index 0000000..1e0f712
--- /dev/null
+++ b/scripts/keygeneration/accessory/common_leverage_hammer.sh
@@ -0,0 +1,69 @@
+#!/bin/bash
+
+# Copyright 2017 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Load common constants and functions.
+. "$(dirname "$0")/../common.sh"
+
+usage() {
+ cat <<EOF
+Usage: ${PROG} [options]
+
+Options:
+ -o, --output_dir <dir>: Where to write the keys (default is cwd)
+EOF
+
+ if [[ $# -ne 0 ]]; then
+ die "$*"
+ else
+ exit 0
+ fi
+}
+
+generate_rsa3072_exp3_key() {
+ local output_dir="$1"
+ local key_name="$2"
+
+ # Generate RSA key.
+ openssl genrsa -3 -out "${output_dir}/temp.pem" 3072
+
+ # Create a keypair from an RSA .pem file generated above.
+ futility create "${output_dir}/temp.pem" "${output_dir}/key_${key_name}"
+
+ # Best attempt to securely delete the temp.pem file.
+ shred --remove "${output_dir}/temp.pem"
+}
+
+# To generate a keypair with the same algorithm of Hammer and rename the kepair
+# to specific accessory's name.
+leverage_hammer_to_create_key() {
+ local output_dir="${PWD}"
+ local key_name="$1"
+ shift
+
+ while [[ $# -gt 0 ]]; do
+ case "$1" in
+ -h|--help)
+ usage
+ ;;
+ -o|--output_dir)
+ output_dir="$2"
+ if [[ ! -d "${output_dir}" ]]; then
+ die "output dir ("${output_dir}") doesn't exist."
+ fi
+ shift
+ ;;
+ -*)
+ usage "Unknown option: "$1""
+ ;;
+ *)
+ usage "Unknown argument "$1""
+ ;;
+ esac
+ shift
+ done
+
+ generate_rsa3072_exp3_key "${output_dir}" "${key_name}"
+}
diff --git a/scripts/keygeneration/accessory/create_new_hammer_keys.sh b/scripts/keygeneration/accessory/create_new_hammer_keys.sh
index 684c0d3..30f005d 100755
--- a/scripts/keygeneration/accessory/create_new_hammer_keys.sh
+++ b/scripts/keygeneration/accessory/create_new_hammer_keys.sh
@@ -5,62 +5,12 @@
# found in the LICENSE file.
# Load common constants and functions.
-. "$(dirname "$0")/../common.sh"
-
-usage() {
- cat <<EOF
-Usage: ${PROG} DIR
-
-DIR: To generate a keypair from an RSA 3072 key (.pem file) for Hammer at DIR
-
-EOF
-
- if [[ $# -ne 0 ]]; then
- die "$*"
- else
- exit 0
- fi
-}
-
-# Generate a keypair at the given directory.
-generate_key() {
- local dir=$1
-
- # Generate RSA key.
- openssl genrsa -3 -out "${dir}/temp.pem" 3072
-
- # Create a keypair from an RSA .pem file generated above.
- futility create "${dir}/temp.pem" "${dir}/key_hammer"
-
- # Best attempt to securely delete the temp.pem file.
- shred --remove "${dir}/temp.pem"
-}
+. "$(dirname "$0")/common_leverage_hammer.sh"
main() {
set -e
- local dir
-
- while [[ $# -gt 0 ]]; do
- case $1 in
- -h|--help)
- usage
- ;;
- -*)
- usage "Unknown option: $1"
- ;;
- *)
- break
- ;;
- esac
- done
-
- if [[ $# -ne 1 ]]; then
- usage "Missing output directory"
- fi
- dir="$1"
-
- generate_key "${dir}"
+ leverage_hammer_to_create_key "hammer" "$@"
}
main "$@"
diff --git a/scripts/keygeneration/accessory/create_new_rose_keys.sh b/scripts/keygeneration/accessory/create_new_rose_keys.sh
index c3be31b..6fcbffa 100755
--- a/scripts/keygeneration/accessory/create_new_rose_keys.sh
+++ b/scripts/keygeneration/accessory/create_new_rose_keys.sh
@@ -5,62 +5,12 @@
# found in the LICENSE file.
# Load common constants and functions.
-. "$(dirname "$0")/../common.sh"
-
-usage() {
- cat <<EOF
-Usage: ${PROG} DIR
-
-DIR: To generate a keypair from an RSA 3072 key (.pem file) for Rose at DIR
-
-EOF
-
- if [[ $# -ne 0 ]]; then
- die "$*"
- else
- exit 0
- fi
-}
-
-# Generate a keypair from hammer's script at the given directory.
-generate_key() {
- local dir=$1
- TMP=$(mktemp -d --suffix=.create_rose_keys)
-
- ./create_new_hammer_keys.sh "${TMP}"
- if [[ $? -ne 0 ]]; then
- die "Failed to call create_new_hammer_keys.sh."
- fi
-
- mv "${TMP}/key_hammer.vbprik2" "${dir}/key_rose.vbprik2"
- mv "${TMP}/key_hammer.vbpubk2" "${dir}/key_rose.vbpubk2"
-}
+. "$(dirname "$0")/common_leverage_hammer.sh"
main() {
set -e
- local dir
-
- while [[ $# -gt 0 ]]; do
- case $1 in
- -h|--help)
- usage
- ;;
- -*)
- usage "Unknown option: $1"
- ;;
- *)
- break
- ;;
- esac
- done
-
- if [[ $# -ne 1 ]]; then
- usage "Missing output directory"
- fi
- dir="$1"
-
- generate_key "${dir}"
+ leverage_hammer_to_create_key "rose" "$@"
}
main "$@"
diff --git a/scripts/keygeneration/accessory/create_new_staff_keys.sh b/scripts/keygeneration/accessory/create_new_staff_keys.sh
new file mode 100755
index 0000000..1a582b5
--- /dev/null
+++ b/scripts/keygeneration/accessory/create_new_staff_keys.sh
@@ -0,0 +1,16 @@
+#!/bin/bash
+
+# Copyright 2017 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Load common constants and functions.
+. "$(dirname "$0")/common_leverage_hammer.sh"
+
+main() {
+ set -e
+
+ leverage_hammer_to_create_key "staff" "$@"
+}
+
+main "$@"
