1 2# Consider this file an example. 3# 4# For Junos this is how we obtain trust anchor .pems 5# the signing server (http://www.crufty.net/sjg/blog/signing-server.htm) 6# for each key will provide the appropriate certificate chain on request 7 8# force these for Junos 9#MANIFEST_SKIP_ALWAYS= boot 10VE_HASH_LIST= \ 11 SHA1 \ 12 SHA256 \ 13 SHA384 \ 14 SHA512 15 16VE_SIGNATURE_LIST= \ 17 ECDSA \ 18 RSA 19 20VE_SIGNATURE_EXT_LIST= \ 21 esig \ 22 rsig 23 24VE_SELF_TESTS= yes 25 26.if ${MACHINE} == "host" && ${.CURDIR:T} == "tests" 27 28VE_SIGNATURE_LIST+= \ 29 DEPRECATED_RSA_SHA1 30 31VE_SIGNATURE_EXT_LIST+= \ 32 sig 33.endif 34 35# add OpenPGP support - possibly dormant 36VE_SIGNATURE_LIST+= OPENPGP 37VE_SIGNATURE_EXT_LIST+= asc 38 39SIGNER ?= ${SB_TOOLS_PATH:U/volume/buildtools/bin}/sign.py 40 41.if exists(${SIGNER}) 42SIGN_HOST ?= ${SB_SITE:Usvl}-junos-signer.juniper.net 43ECDSA_PORT:= ${133%y:L:gmtime} 44SIGN_ECDSA= ${PYTHON} ${SIGNER} -u ${SIGN_HOST}:${ECDSA_PORT} -h sha256 45RSA2_PORT:= ${163%y:L:gmtime} 46SIGN_RSA2= ${PYTHON} ${SIGNER} -u ${SIGN_HOST}:${RSA2_PORT} -h sha256 47 48# deal with quirk of our .esig format 49XCFLAGS.vets+= -DVE_ECDSA_HASH_AGAIN 50 51.if !empty(OPENPGP_SIGN_URL) 52XCFLAGS.opgp_key+= -DHAVE_TA_ASC_H 53 54VE_SIGNATURE_LIST+= OPENPGP 55VE_SIGNATURE_EXT_LIST+= asc 56 57SIGN_OPENPGP= ${PYTHON} ${SIGNER:H}/openpgp-sign.py -a -u ${OPENPGP_SIGN_URL} 58 59ta_openpgp.asc: 60 ${SIGN_OPENPGP} -C ${.TARGET} 61 62ta_asc.h: ta_openpgp.asc 63 64.if ${VE_SELF_TESTS} != "no" 65# for self test 66vc_openpgp.asc: ta_openpgp.asc 67 ${SIGN_OPENPGP} ${.ALLSRC:M*.asc} 68 mv ta_openpgp.asc.asc ${.TARGET} 69 70ta_asc.h: vc_openpgp.asc 71.endif 72.endif 73 74rcerts.pem: 75 ${SIGN_RSA2} -C ${.TARGET} 76 77ecerts.pem: 78 ${SIGN_ECDSA} -C ${.TARGET} 79 80.if ${VE_SIGNATURE_LIST:tu:MECDSA} != "" 81# the last cert in the chain is the one we want 82ta_ec.pem: ecerts.pem _LAST_PEM_USE 83ta.h: ta_ec.pem 84.if ${VE_SELF_TESTS} != "no" 85# these are for verification self test 86vc_ec.pem: ecerts.pem _2ndLAST_PEM_USE 87ta.h: vc_ec.pem 88.endif 89.endif 90 91.if ${VE_SIGNATURE_LIST:tu:MRSA} != "" 92ta_rsa.pem: rcerts.pem _LAST_PEM_USE 93ta.h: ta_rsa.pem 94.if ${VE_SELF_TESTS} != "no" 95vc_rsa.pem: rcerts.pem _2ndLAST_PEM_USE 96ta.h: vc_rsa.pem 97.endif 98.endif 99 100# we take the mtime of this as our baseline time 101#BUILD_UTC_FILE= ecerts.pem 102#VE_DEBUG_LEVEL=3 103#VE_VERBOSE_DEFAULT=1 104 105.else 106# you need to provide t*.pem or t*.asc files for each trust anchor 107.if empty(TRUST_ANCHORS) 108TRUST_ANCHORS!= cd ${.CURDIR} && 'ls' -1 *.pem t*.asc 2> /dev/null 109.endif 110.if empty(TRUST_ANCHORS) && ${MK_LOADER_EFI_SECUREBOOT} != "yes" 111.error Need TRUST_ANCHORS see ${.CURDIR}/README.rst 112.endif 113.if ${TRUST_ANCHORS:T:Mt*.pem} != "" 114ta.h: ${TRUST_ANCHORS:M*.pem} 115.endif 116.if ${TRUST_ANCHORS:T:Mt*.asc} != "" 117VE_SIGNATURE_LIST+= OPENPGP 118VE_SIGNATURE_EXT_LIST+= asc 119ta_asc.h: ${TRUST_ANCHORS:M*.asc} 120.endif 121# we take the mtime of this as our baseline time 122BUILD_UTC_FILE?= ${TRUST_ANCHORS:[1]} 123.endif 124 125