{"id":18790,"url":"https://patchwork.libcamera.org/api/patches/18790/?format=json","web_url":"https://patchwork.libcamera.org/patch/18790/","project":{"id":1,"url":"https://patchwork.libcamera.org/api/projects/1/?format=json","name":"libcamera","link_name":"libcamera","list_id":"libcamera_core","list_email":"libcamera-devel@lists.libcamera.org","web_url":"","scm_url":"","webscm_url":""},"msgid":"<20230704234422.11863-3-laurent.pinchart@ideasonboard.com>","date":"2023-07-04T23:44:22","name":"[libcamera-devel,v2,2/2] apps: Add ipa-verify application","commit_ref":null,"pull_url":null,"state":"accepted","archived":false,"hash":"d347ba301d5424bf2b429725b8b116d6295116af","submitter":{"id":2,"url":"https://patchwork.libcamera.org/api/people/2/?format=json","name":"Laurent Pinchart","email":"laurent.pinchart@ideasonboard.com"},"delegate":null,"mbox":"https://patchwork.libcamera.org/patch/18790/mbox/","series":[{"id":3954,"url":"https://patchwork.libcamera.org/api/series/3954/?format=json","web_url":"https://patchwork.libcamera.org/project/libcamera/list/?series=3954","date":"2023-07-04T23:44:20","name":"libcamera: Add an application to verify IPA module signatures","version":2,"mbox":"https://patchwork.libcamera.org/series/3954/mbox/"}],"comments":"https://patchwork.libcamera.org/api/patches/18790/comments/","check":"pending","checks":"https://patchwork.libcamera.org/api/patches/18790/checks/","tags":{},"headers":{"Return-Path":"","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id D2420BE175\n\tfor ;\n\tTue, 4 Jul 2023 23:44:27 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id 85773628C6;\n\tWed, 5 Jul 2023 01:44:27 +0200 (CEST)","from perceval.ideasonboard.com (perceval.ideasonboard.com\n\t[213.167.242.64])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id 23917628BB\n\tfor ;\n\tWed, 5 Jul 2023 01:44:25 +0200 (CEST)","from pendragon.ideasonboard.com (85-160-42-71.reb.o2.cz\n\t[85.160.42.71])\n\tby perceval.ideasonboard.com (Postfix) with ESMTPSA id 9892E8CC\n\tfor ;\n\tWed, 5 Jul 2023 01:43:40 +0200 (CEST)"],"DKIM-Signature":["v=1; a=rsa-sha256; c=relaxed/simple; d=libcamera.org;\n\ts=mail; t=1688514267;\n\tbh=iEdix/OWABLXGxrQNNTgQQnpSHQbkuYsrSoxBnMEMQw=;\n\th=To:Date:In-Reply-To:References:Subject:List-Id:List-Unsubscribe:\n\tList-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:\n\tFrom;\n\tb=HcgEPo3xlY4/IWHr8QAwC1J4eeMpcgDa3UM3ujumRvB05Tgn/4ebqLZ/LFGtM6XLt\n\tPgrtQG9/MYPcgo5f20gwegCVssnllpAtSp2X1hGl71XfNrzWfkGuQ6C7tk+Tw/Q2ts\n\t2JLYJq2SsoFX7SSu+maD58VR8VzeXiusq+oCCscwwnZIf34Yy8A2pBrnOjH0YinlRw\n\tO/3THXIoqTyQp3V5k3oagbV9Pvvz15L7YRvLyU/wbss068PMPhfNA8dzfZIEi3dAxk\n\tA3lW3/sAvp9JlxioJFDJfDUfngSLnXzTnKVFVAZ6utM/xzWVnAjJgKnbuKFhW1aRZt\n\tEgk/mnW53nLow==","v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com;\n\ts=mail; t=1688514220;\n\tbh=iEdix/OWABLXGxrQNNTgQQnpSHQbkuYsrSoxBnMEMQw=;\n\th=From:To:Subject:Date:In-Reply-To:References:From;\n\tb=L7WH24bvsfc1M5IjtcUFaZCydgzGhPyPDErWmGmgrLm3zXZ6aBf9F1y7PQAMwFgpp\n\tThsZyvS+VjrhucddT5ZLnGUVSb1hamt4lT4HlS7YtOawBLKgnhZBaBy0D9K7X2c2w3\n\toRwoVeqOqJDRHgDfUtbO2liB5htllymKmTRpgA1E="],"Authentication-Results":"lancelot.ideasonboard.com; dkim=pass (1024-bit key; \n\tunprotected) header.d=ideasonboard.com\n\theader.i=@ideasonboard.com\n\theader.b=\"L7WH24bv\"; dkim-atps=neutral","To":"libcamera-devel@lists.libcamera.org","Date":"Wed, 5 Jul 2023 02:44:22 +0300","Message-Id":"<20230704234422.11863-3-laurent.pinchart@ideasonboard.com>","X-Mailer":"git-send-email 2.39.3","In-Reply-To":"<20230704234422.11863-1-laurent.pinchart@ideasonboard.com>","References":"<20230704234422.11863-1-laurent.pinchart@ideasonboard.com>","MIME-Version":"1.0","Content-Transfer-Encoding":"8bit","Subject":"[libcamera-devel] [PATCH v2 2/2] apps: Add ipa-verify application","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","From":"Laurent Pinchart via libcamera-devel\n\t","Reply-To":"Laurent Pinchart ","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" "},"content":"When packaging libcamera, distributions may break IPA module signatures\nif the packaging process strips binaries. This can be fixed by resigning\nthe modules, but the process is error-prone.\n\nAdd a command line ipa-verify utility that tests the signature on an IPA\nmodule to help packagers. The tool takes a single argument, the path to\nan IPA module shared object, and expects the signature file (.sign) to\nbe in the same directory.\n\nIn order to access the public key needed for signature verification, add\na static function to the IPAManager class. As the class is internal to\nlibcamera, this doesn't affect the public API.\n\nSigned-off-by: Laurent Pinchart \nReviewed-by: Umang Jain \n---\n include/libcamera/internal/ipa_manager.h | 7 +++\n src/apps/ipa-verify/main.cpp | 64 ++++++++++++++++++++++++\n src/apps/ipa-verify/meson.build | 15 ++++++\n src/apps/meson.build | 2 +\n src/libcamera/ipa_manager.cpp | 13 +++++\n 5 files changed, 101 insertions(+)\n create mode 100644 src/apps/ipa-verify/main.cpp\n create mode 100644 src/apps/ipa-verify/meson.build","diff":"diff --git a/include/libcamera/internal/ipa_manager.h b/include/libcamera/internal/ipa_manager.h\nindex 7f36e58e8bfa..bf823563c91c 100644\n--- a/include/libcamera/internal/ipa_manager.h\n+++ b/include/libcamera/internal/ipa_manager.h\n@@ -47,6 +47,13 @@ public:\n \t\treturn proxy;\n \t}\n \n+#if HAVE_IPA_PUBKEY\n+\tstatic const PubKey &pubKey()\n+\t{\n+\t\treturn pubKey_;\n+\t}\n+#endif\n+\n private:\n \tstatic IPAManager *self_;\n \ndiff --git a/src/apps/ipa-verify/main.cpp b/src/apps/ipa-verify/main.cpp\nnew file mode 100644\nindex 000000000000..76ba5073d25a\n--- /dev/null\n+++ b/src/apps/ipa-verify/main.cpp\n@@ -0,0 +1,64 @@\n+/* SPDX-License-Identifier: GPL-2.0-or-later */\n+/*\n+ * Copyright (C) 2023, Ideas on Board Oy\n+ *\n+ * ipa_verify.cpp - Verify signature on an IPA module\n+ */\n+\n+#include \n+#include \n+\n+#include \n+#include \n+\n+#include \"libcamera/internal/ipa_manager.h\"\n+#include \"libcamera/internal/ipa_module.h\"\n+\n+using namespace libcamera;\n+\n+namespace {\n+\n+bool isSignatureValid(IPAModule *ipa)\n+{\n+\tFile file{ ipa->path() };\n+\tif (!file.open(File::OpenModeFlag::ReadOnly))\n+\t\treturn false;\n+\n+\tSpan data = file.map();\n+\tif (data.empty())\n+\t\treturn false;\n+\n+\treturn IPAManager::pubKey().verify(data, ipa->signature());\n+}\n+\n+void usage(char *argv0)\n+{\n+\tstd::cout << \"Usage: \" << basename(argv0) << \" ipa_name.so\" << std::endl;\n+\tstd::cout << std::endl;\n+\tstd::cout << \"Verify the signature of an IPA module. The signature file ipa_name.so.sign is\" << std::endl;\n+\tstd::cout << \"expected to be in the same directory as the IPA module.\" << std::endl;\n+}\n+\n+} /* namespace */\n+\n+int main(int argc, char **argv)\n+{\n+\tif (argc != 2) {\n+\t\tusage(argv[0]);\n+\t\treturn EXIT_FAILURE;\n+\t}\n+\n+\tIPAModule module{ argv[1] };\n+\tif (!module.isValid()) {\n+\t\tstd::cout << \"Invalid IPA module \" << argv[1] << std::endl;\n+\t\treturn EXIT_FAILURE;\n+\t}\n+\n+\tif (!isSignatureValid(&module)) {\n+\t\tstd::cout << \"IPA module signature is invalid\" << std::endl;\n+\t\treturn EXIT_FAILURE;\n+\t}\n+\n+\tstd::cout << \"IPA module signature is valid\" << std::endl;\n+\treturn 0;\n+}\ndiff --git a/src/apps/ipa-verify/meson.build b/src/apps/ipa-verify/meson.build\nnew file mode 100644\nindex 000000000000..7fdda3b9af4b\n--- /dev/null\n+++ b/src/apps/ipa-verify/meson.build\n@@ -0,0 +1,15 @@\n+# SPDX-License-Identifier: CC0-1.0\n+\n+if not ipa_sign_module\n+ subdir_done()\n+endif\n+\n+ipa_verify_sources = files([\n+ 'main.cpp',\n+])\n+\n+ipa_verify = executable('ipa_verify', ipa_verify_sources,\n+ dependencies : [\n+ libcamera_private,\n+ ],\n+ install : false)\ndiff --git a/src/apps/meson.build b/src/apps/meson.build\nindex 099876356bd1..af632b9a7b0b 100644\n--- a/src/apps/meson.build\n+++ b/src/apps/meson.build\n@@ -18,3 +18,5 @@ subdir('lc-compliance')\n \n subdir('cam')\n subdir('qcam')\n+\n+subdir('ipa-verify')\ndiff --git a/src/libcamera/ipa_manager.cpp b/src/libcamera/ipa_manager.cpp\nindex ac5397003b50..7a4515d90d7b 100644\n--- a/src/libcamera/ipa_manager.cpp\n+++ b/src/libcamera/ipa_manager.cpp\n@@ -279,6 +279,19 @@ IPAModule *IPAManager::module(PipelineHandler *pipe, uint32_t minVersion,\n * found or if the IPA proxy fails to initialize\n */\n \n+#if HAVE_IPA_PUBKEY\n+/**\n+ * \\fn IPAManager::pubKey()\n+ * \\brief Retrieve the IPA module signing public key\n+ *\n+ * IPA module signature verification is normally handled internally by the\n+ * IPAManager class. This function is meant to be used by utilities that need to\n+ * verify signatures externally.\n+ *\n+ * \\return The IPA module signing public key\n+ */\n+#endif\n+\n bool IPAManager::isSignatureValid([[maybe_unused]] IPAModule *ipa) const\n {\n #if HAVE_IPA_PUBKEY\n","prefixes":["libcamera-devel","v2","2/2"]}