[{"id":27478,"web_url":"https://patchwork.libcamera.org/comment/27478/","msgid":"<168851485825.3298873.5744399492371707160@Monstersaurus>","date":"2023-07-04T23:54:18","subject":"Re: [libcamera-devel] [PATCH v2 2/2] apps: Add ipa-verify\n\tapplication","submitter":{"id":4,"url":"https://patchwork.libcamera.org/api/people/4/","name":"Kieran Bingham","email":"kieran.bingham@ideasonboard.com"},"content":"Hi Laurent,\n\nQuoting Laurent Pinchart via libcamera-devel (2023-07-05 00:44:22)\n> When packaging libcamera, distributions may break IPA module signatures\n> if the packaging process strips binaries. This can be fixed by resigning\n> the modules, but the process is error-prone.\n> \n> Add a command line ipa-verify utility that tests the signature on an IPA\n> module to help packagers. The tool takes a single argument, the path to\n> an IPA module shared object, and expects the signature file (.sign) to\n> be in the same directory.\n> \n> In order to access the public key needed for signature verification, add\n> a static function to the IPAManager class. As the class is internal to\n> libcamera, this doesn't affect the public API.\n> \n> Signed-off-by: Laurent Pinchart \n> Reviewed-by: Umang Jain \n\nI still think this is useful!\n\nReviewed-by: Kieran Bingham \n\n> ---\n> include/libcamera/internal/ipa_manager.h | 7 +++\n> src/apps/ipa-verify/main.cpp | 64 ++++++++++++++++++++++++\n> src/apps/ipa-verify/meson.build | 15 ++++++\n> src/apps/meson.build | 2 +\n> src/libcamera/ipa_manager.cpp | 13 +++++\n> 5 files changed, 101 insertions(+)\n> create mode 100644 src/apps/ipa-verify/main.cpp\n> create mode 100644 src/apps/ipa-verify/meson.build\n> \n> diff --git a/include/libcamera/internal/ipa_manager.h b/include/libcamera/internal/ipa_manager.h\n> index 7f36e58e8bfa..bf823563c91c 100644\n> --- a/include/libcamera/internal/ipa_manager.h\n> +++ b/include/libcamera/internal/ipa_manager.h\n> @@ -47,6 +47,13 @@ public:\n> return proxy;\n> }\n> \n> +#if HAVE_IPA_PUBKEY\n> + static const PubKey &pubKey()\n> + {\n> + return pubKey_;\n> + }\n> +#endif\n> +\n> private:\n> static IPAManager *self_;\n> \n> diff --git a/src/apps/ipa-verify/main.cpp b/src/apps/ipa-verify/main.cpp\n> new file mode 100644\n> index 000000000000..76ba5073d25a\n> --- /dev/null\n> +++ b/src/apps/ipa-verify/main.cpp\n> @@ -0,0 +1,64 @@\n> +/* SPDX-License-Identifier: GPL-2.0-or-later */\n> +/*\n> + * Copyright (C) 2023, Ideas on Board Oy\n> + *\n> + * ipa_verify.cpp - Verify signature on an IPA module\n> + */\n> +\n> +#include \n> +#include \n> +\n> +#include \n> +#include \n> +\n> +#include \"libcamera/internal/ipa_manager.h\"\n> +#include \"libcamera/internal/ipa_module.h\"\n> +\n> +using namespace libcamera;\n> +\n> +namespace {\n> +\n> +bool isSignatureValid(IPAModule *ipa)\n> +{\n> + File file{ ipa->path() };\n> + if (!file.open(File::OpenModeFlag::ReadOnly))\n> + return false;\n> +\n> + Span data = file.map();\n> + if (data.empty())\n> + return false;\n> +\n> + return IPAManager::pubKey().verify(data, ipa->signature());\n> +}\n> +\n> +void usage(char *argv0)\n> +{\n> + std::cout << \"Usage: \" << basename(argv0) << \" ipa_name.so\" << std::endl;\n> + std::cout << std::endl;\n> + std::cout << \"Verify the signature of an IPA module. The signature file ipa_name.so.sign is\" << std::endl;\n> + std::cout << \"expected to be in the same directory as the IPA module.\" << std::endl;\n> +}\n> +\n> +} /* namespace */\n> +\n> +int main(int argc, char **argv)\n> +{\n> + if (argc != 2) {\n> + usage(argv[0]);\n> + return EXIT_FAILURE;\n> + }\n> +\n> + IPAModule module{ argv[1] };\n> + if (!module.isValid()) {\n> + std::cout << \"Invalid IPA module \" << argv[1] << std::endl;\n> + return EXIT_FAILURE;\n> + }\n> +\n> + if (!isSignatureValid(&module)) {\n> + std::cout << \"IPA module signature is invalid\" << std::endl;\n> + return EXIT_FAILURE;\n> + }\n> +\n> + std::cout << \"IPA module signature is valid\" << std::endl;\n> + return 0;\n> +}\n> diff --git a/src/apps/ipa-verify/meson.build b/src/apps/ipa-verify/meson.build\n> new file mode 100644\n> index 000000000000..7fdda3b9af4b\n> --- /dev/null\n> +++ b/src/apps/ipa-verify/meson.build\n> @@ -0,0 +1,15 @@\n> +# SPDX-License-Identifier: CC0-1.0\n> +\n> +if not ipa_sign_module\n> + subdir_done()\n> +endif\n> +\n> +ipa_verify_sources = files([\n> + 'main.cpp',\n> +])\n> +\n> +ipa_verify = executable('ipa_verify', ipa_verify_sources,\n> + dependencies : [\n> + libcamera_private,\n> + ],\n> + install : false)\n> diff --git a/src/apps/meson.build b/src/apps/meson.build\n> index 099876356bd1..af632b9a7b0b 100644\n> --- a/src/apps/meson.build\n> +++ b/src/apps/meson.build\n> @@ -18,3 +18,5 @@ subdir('lc-compliance')\n> \n> subdir('cam')\n> subdir('qcam')\n> +\n> +subdir('ipa-verify')\n> diff --git a/src/libcamera/ipa_manager.cpp b/src/libcamera/ipa_manager.cpp\n> index ac5397003b50..7a4515d90d7b 100644\n> --- a/src/libcamera/ipa_manager.cpp\n> +++ b/src/libcamera/ipa_manager.cpp\n> @@ -279,6 +279,19 @@ IPAModule *IPAManager::module(PipelineHandler *pipe, uint32_t minVersion,\n> * found or if the IPA proxy fails to initialize\n> */\n> \n> +#if HAVE_IPA_PUBKEY\n> +/**\n> + * \\fn IPAManager::pubKey()\n> + * \\brief Retrieve the IPA module signing public key\n> + *\n> + * IPA module signature verification is normally handled internally by the\n> + * IPAManager class. This function is meant to be used by utilities that need to\n> + * verify signatures externally.\n> + *\n> + * \\return The IPA module signing public key\n> + */\n> +#endif\n> +\n> bool IPAManager::isSignatureValid([[maybe_unused]] IPAModule *ipa) const\n> {\n> #if HAVE_IPA_PUBKEY\n> -- \n> Regards,\n> \n> Laurent Pinchart\n>","headers":{"Return-Path":"","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id F2E70BE175\n\tfor ;\n\tTue, 4 Jul 2023 23:54:23 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id 40A40628C0;\n\tWed, 5 Jul 2023 01:54:23 +0200 (CEST)","from perceval.ideasonboard.com (perceval.ideasonboard.com\n\t[IPv6:2001:4b98:dc2:55:216:3eff:fef7:d647])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id 0825D61E38\n\tfor ;\n\tWed, 5 Jul 2023 01:54:22 +0200 (CEST)","from pendragon.ideasonboard.com\n\t(aztw-30-b2-v4wan-166917-cust845.vm26.cable.virginm.net\n\t[82.37.23.78])\n\tby perceval.ideasonboard.com (Postfix) with ESMTPSA id 5FF518CC;\n\tWed, 5 Jul 2023 01:53:37 +0200 (CEST)"],"DKIM-Signature":["v=1; a=rsa-sha256; c=relaxed/simple; d=libcamera.org;\n\ts=mail; t=1688514863;\n\tbh=dO8i9/X64VnYQ7z0jWtZLrGp8xzxE4R9GSTpeUUezpw=;\n\th=In-Reply-To:References:To:Date:Subject:List-Id:List-Unsubscribe:\n\tList-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:\n\tFrom;\n\tb=JeLcUSNeHQsNY+T6w+WW/2CgU9CttHcoet84X+KwR/yXYmk7YmCzUwZdVEaAn8fIS\n\tkkbHaMd9ni4LZ7VHjfC0pVAHd61eNQo4SrQT7Ge/UgHslzP5vx1Ovbl2XhDhdDPl0Z\n\tjQ5/xc+X/puA7rFx2wXa/znPYlnIZpGLPtK/Qm8u7mT45QWjFT3itogWE8swyauJEp\n\tpO8SJlotqJvrvmeHReIAPXHEEIpCtIfEnAu1rl8YNEs3pd/DvcOwCkjRnz7aNF1hM3\n\trY/TwSnqjIYmaBaIqV+I0Kl5JV1ZrMwkJ3dbfjGbCTPFBtudQCwBJ6lXkJEHP/CwZg\n\tKKc+hbQI4amPg==","v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com;\n\ts=mail; t=1688514817;\n\tbh=dO8i9/X64VnYQ7z0jWtZLrGp8xzxE4R9GSTpeUUezpw=;\n\th=In-Reply-To:References:Subject:From:To:Date:From;\n\tb=Ib2KNttu2VC4b7KBGU1Zp+R3Fk48c7mfd4U8MoKbaOkhMDuFkycihLoqiFcTJKXrm\n\tRlo/aLm7nUQZ0dJQNmrxMBd44cs/bOtd7NOnNY9yV+ZLGmu0ck+9VBMkqmDxFtTyD0\n\tRnMJssHFHJx439c41in4IXySKvSqD8mmhyTeXwqk="],"Authentication-Results":"lancelot.ideasonboard.com; dkim=pass (1024-bit key; \n\tunprotected) header.d=ideasonboard.com\n\theader.i=@ideasonboard.com\n\theader.b=\"Ib2KNttu\"; dkim-atps=neutral","Content-Type":"text/plain; charset=\"utf-8\"","MIME-Version":"1.0","Content-Transfer-Encoding":"quoted-printable","In-Reply-To":"<20230704234422.11863-3-laurent.pinchart@ideasonboard.com>","References":"<20230704234422.11863-1-laurent.pinchart@ideasonboard.com>\n\t<20230704234422.11863-3-laurent.pinchart@ideasonboard.com>","To":"Laurent Pinchart ,\n\tlibcamera-devel@lists.libcamera.org","Date":"Wed, 05 Jul 2023 00:54:18 +0100","Message-ID":"<168851485825.3298873.5744399492371707160@Monstersaurus>","User-Agent":"alot/0.10","Subject":"Re: [libcamera-devel] [PATCH v2 2/2] apps: Add ipa-verify\n\tapplication","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","From":"Kieran Bingham via libcamera-devel\n\t","Reply-To":"Kieran Bingham ","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" "}},{"id":27480,"web_url":"https://patchwork.libcamera.org/comment/27480/","msgid":"<87h6qj9q9y.fsf@minerva.mail-host-address-is-not-set>","date":"2023-07-05T00:05:13","subject":"Re: [libcamera-devel] [PATCH v2 2/2] apps: Add ipa-verify\n\tapplication","submitter":{"id":95,"url":"https://patchwork.libcamera.org/api/people/95/","name":"Javier Martinez Canillas","email":"javierm@redhat.com"},"content":"Laurent Pinchart via libcamera-devel \nwrites:\n\n> When packaging libcamera, distributions may break IPA module signatures\n> if the packaging process strips binaries. This can be fixed by resigning\n> the modules, but the process is error-prone.\n>\n> Add a command line ipa-verify utility that tests the signature on an IPA\n> module to help packagers. The tool takes a single argument, the path to\n> an IPA module shared object, and expects the signature file (.sign) to\n> be in the same directory.\n>\n> In order to access the public key needed for signature verification, add\n> a static function to the IPAManager class. As the class is internal to\n> libcamera, this doesn't affect the public API.\n>\n> Signed-off-by: Laurent Pinchart \n> Reviewed-by: Umang Jain \n> ---\n\nI used this tool to verify that the libcamera fedora packages IPA modules\nwere properly signed. I can confirm that it is very useful for packagers.\n\nTested-by: Javier Martinez Canillas ","headers":{"Return-Path":"","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id DE772BE175\n\tfor ;\n\tWed, 5 Jul 2023 00:05:20 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id 28FE9628C1;\n\tWed, 5 Jul 2023 02:05:20 +0200 (CEST)","from us-smtp-delivery-124.mimecast.com\n\t(us-smtp-delivery-124.mimecast.com [170.10.129.124])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id 0740161E38\n\tfor ;\n\tWed, 5 Jul 2023 02:05:18 +0200 (CEST)","from mail-wr1-f70.google.com (mail-wr1-f70.google.com\n\t[209.85.221.70]) by relay.mimecast.com with ESMTP with STARTTLS\n\t(version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id\n\tus-mta-471-wR_LgjGRM8-YPi7gM-FMxw-1; Tue, 04 Jul 2023 20:05:16 -0400","by mail-wr1-f70.google.com with SMTP id\n\tffacd0b85a97d-2f2981b8364so3479318f8f.1\n\tfor ;\n\tTue, 04 Jul 2023 17:05:15 -0700 (PDT)","from localhost (205.pool92-176-231.dynamic.orange.es.\n\t[92.176.231.205]) by smtp.gmail.com with ESMTPSA id\n\te17-20020a5d5951000000b00313f61889ecsm23344943wri.66.2023.07.04.17.05.13\n\t(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n\tTue, 04 Jul 2023 17:05:14 -0700 (PDT)"],"DKIM-Signature":["v=1; a=rsa-sha256; c=relaxed/simple; d=libcamera.org;\n\ts=mail; t=1688515520;\n\tbh=VIjRGTeooEMimet0LFThvYbvD6WzQwJZjVmkGfHDdj8=;\n\th=To:In-Reply-To:References:Date:Subject:List-Id:List-Unsubscribe:\n\tList-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:\n\tFrom;\n\tb=tp3vNlM2FBHVcNcLPR/3yU99A1D0/wmC1bdR72fbr8k1n6mSOx3/PZ48cTEJNRN1N\n\tZ3Zk3uAJTWOalALW0xspzNEKzSNhhTGjvYLXraAKAYh666Tul3XlPXR89MphVxVGDa\n\tSRP9TP/EZWhRAjQufMv3QXDKcOCfUplZb6MzCbNfp61SlMY/EMpWg7JPuFI23Dz8aJ\n\tmuOqZnLCWCQbA3RPGy9ONXwKsYcRC7Zc0O5SXKYT0HB/jYbDB7U8LQIwz9rSKxm86+\n\t0jb551JINisyUZHHDInZQRFUgkQbaslC62U8ET56EwjklMpnHTj4/G+rdGmrYwWOSp\n\twM5mYOWUzQnkg==","v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com;\n\ts=mimecast20190719; t=1688515517;\n\th=from:from:reply-to:subject:subject:date:date:message-id:message-id:\n\tto:to:cc:mime-version:mime-version:content-type:content-type:\n\tin-reply-to:in-reply-to:references:references;\n\tbh=uVMj9r2LXdGFJ35EwkdfGKwwYyt4WItsCB/2ljkC4yQ=;\n\tb=PblOFm++uovucED91xQt6NTdTDxqmujso2fttHkKI0oW+l9q7IlOj4agIba/tbx0bCqkqT\n\tKdemte7zotA/nZZsWdphBfuf05ZrxM/jycIFOXSTU+9E3+aC+VICZHjXQ8xsXDOR3w45vN\n\tnVgn+Sh/iGP6xmyGb9MkHCpKVtg4IlQ="],"Authentication-Results":"lancelot.ideasonboard.com; dkim=pass (1024-bit key; \n\tunprotected) header.d=redhat.com\n\theader.i=@redhat.com header.b=\"PblOFm++\"; \n\tdkim-atps=neutral","X-MC-Unique":"wR_LgjGRM8-YPi7gM-FMxw-1","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20221208; t=1688515514; x=1691107514;\n\th=mime-version:message-id:date:references:in-reply-to:subject:to:from\n\t:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;\n\tbh=uVMj9r2LXdGFJ35EwkdfGKwwYyt4WItsCB/2ljkC4yQ=;\n\tb=f+FKN944HlgJm4W41EZKhAS75Kg/mekun4EHfs5kGw8VY/WIZCkB/6Ff4s173k3rsr\n\tVA0LeKlHen1EVIy3BfTZU/pjEidedu2Gcjl9CbzOj8Wy8XXg/kVtJMGGiQaYlPlfzZie\n\tBxBr2o3Qkm1RUPKzlxRL9ofD41dyOUrh8dpjir/6rmRTMmNC9+hwN9l6FJ2TwmNkqg9B\n\t7tiikVgB5YAFTr8Gz7vQ94UwGnJJSKCXkySGzlTnYn7B8asvPo6XrRsCtrkVg2StaCKv\n\ttaqKN+pSzPLowTDapU9jr/k/KNWEi1yf+QaeU0YpskeTwtTfLvYFyRNR6VQeKBVhJwp3\n\tWKqA==","X-Gm-Message-State":"ABy/qLa8k6ixPEz4ql7yXDeD/5IduZo967Y2OlS3+tF7ek33/KMHeJtf\n\tgLEWwwU6zGbZet5HiSnf1Ez5UyiGcyKM/RQfgPBZkHPsKKHUZCmDn8whR7Qxjj+rKVcSGo/PEPP\n\t1DaebGGmZjfO6RTRVKB6TTVVoMlWDAJm0tPuiywsTtQ==","X-Received":["by 2002:adf:e407:0:b0:314:f18:bc65 with SMTP id\n\tg7-20020adfe407000000b003140f18bc65mr12709118wrm.66.1688515514782; \n\tTue, 04 Jul 2023 17:05:14 -0700 (PDT)","by 2002:adf:e407:0:b0:314:f18:bc65 with SMTP id\n\tg7-20020adfe407000000b003140f18bc65mr12709109wrm.66.1688515514414; \n\tTue, 04 Jul 2023 17:05:14 -0700 (PDT)"],"X-Google-Smtp-Source":"APBJJlHRvQjI4aZmt4WvvwCB3OAswIEXJ/3Een0IvVdC+NlfPpqijdJB1pOBb28k7J3Cy1rEAP4cPw==","To":"Laurent Pinchart ,\n\tlibcamera-devel@lists.libcamera.org","In-Reply-To":"<20230704234422.11863-3-laurent.pinchart@ideasonboard.com>","References":"<20230704234422.11863-1-laurent.pinchart@ideasonboard.com>\n\t<20230704234422.11863-3-laurent.pinchart@ideasonboard.com>","Date":"Wed, 05 Jul 2023 02:05:13 +0200","Message-ID":"<87h6qj9q9y.fsf@minerva.mail-host-address-is-not-set>","MIME-Version":"1.0","X-Mimecast-Spam-Score":"0","X-Mimecast-Originator":"redhat.com","Content-Type":"text/plain","Subject":"Re: [libcamera-devel] [PATCH v2 2/2] apps: Add ipa-verify\n\tapplication","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","From":"Javier Martinez Canillas via libcamera-devel\n\t","Reply-To":"Javier Martinez Canillas ","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" "}}]