[{"id":39081,"web_url":"https://patchwork.libcamera.org/comment/39081/","msgid":"<7c73a950-b859-4ed7-b975-93af47c7abb4@ideasonboard.com>","date":"2026-06-15T15:09:40","subject":"Re: [PATCH v3 4/4] meson: Add ipa-signature-algo option","submitter":{"id":216,"url":"https://patchwork.libcamera.org/api/people/216/","name":"Barnabás Pőcze","email":"barnabas.pocze@ideasonboard.com"},"content":"2026. 05. 19. 5:00 keltezéssel, Kate Hsuan írta:\n> Add a combo type \"ipa-signature-algo\" meson option to select signature\n> algorithms, including rsa-sha256 and ml-dsa-65.\n> ras-sha256 is the default setting for now.\n> \n> Signed-off-by: Kate Hsuan \n> ---\n> meson_options.txt | 8 ++++++++\n> src/libcamera/meson.build | 6 ++++++\n> src/meson.build | 14 +++++++++++---\n> utils/gen-ipa-priv-key.sh | 16 ++++++++++++++--\n> 4 files changed, 39 insertions(+), 5 deletions(-)\n> \n> diff --git a/meson_options.txt b/meson_options.txt\n> index 20baacc4..18488e6b 100644\n> --- a/meson_options.txt\n> +++ b/meson_options.txt\n> @@ -46,6 +46,14 @@ option('gstreamer',\n> value : 'auto',\n> description : 'Compile libcamera GStreamer plugin')\n> \n> +option('ipa-signature-algo',\n> + type : 'combo',\n> + choices : [\n> + 'rsa-sha256',\n> + 'ml-dsa-65',\n> + ],\n> + description : 'Select a signature algorithm to sign IPA libraries.')\n> +\n> option('ipas',\n> type : 'array',\n> choices : ['ipu3', 'mali-c55', 'rkisp1', 'rpi/pisp', 'rpi/vc4', 'simple',\n> diff --git a/src/libcamera/meson.build b/src/libcamera/meson.build\n> index 575408b2..55ba6c6d 100644\n> --- a/src/libcamera/meson.build\n> +++ b/src/libcamera/meson.build\n> @@ -97,6 +97,12 @@ else\n> endif\n> endif\n> \n> +# comply with FIPS 204\n> +signature_algo = get_option('ipa-signature-algo')\n> +if signature_algo == 'ml-dsa-65'\n> + config_h.set('WITH_PQC', 1)\n> +endif\n> +\n> if not libcrypto.found()\n> warning('Neither gnutls nor libcrypto found, all IPA modules will be isolated')\n> summary({'IPA modules signed with': 'None (modules will run isolated)'},\n> diff --git a/src/meson.build b/src/meson.build\n> index 9b63c8e8..7f8909b1 100644\n> --- a/src/meson.build\n> +++ b/src/meson.build\n> @@ -15,11 +15,19 @@ summary({\n> }, section : 'Paths')\n> \n> # Module Signing\n> +signature_algo = get_option('ipa-signature-algo')\n> openssl = find_program('openssl', required : false)\n> if openssl.found()\n> - ipa_priv_key = custom_target('ipa-priv-key',\n> - output : ['ipa-priv-key.pem'],\n> - command : [gen_ipa_priv_key, '@OUTPUT@'])\n> + if signature_algo == 'ml-dsa-65'\n> + ipa_priv_key = custom_target('ipa-priv-key',\n> + output : ['ipa-priv-key.pem'],\n> + command : [gen_ipa_priv_key, 'ML-DSA-65', '@OUTPUT@'])\n> + endif\n> + if signature_algo == 'rsa-sha256'\n> + ipa_priv_key = custom_target('ipa-priv-key',\n> + output : ['ipa-priv-key.pem'],\n> + command : [gen_ipa_priv_key, 'RSA', '@OUTPUT@'])\n\nWhy not just pass `signature_algo`? There is already a conditional chain in the script.\n\nBut to be honest, I feel like I would actually remove the script altogether and\nhave something like this:\n\nSIGNATURE_DETAILS = {\n 'rsa-sha256': { 'algo': 'RSA', 'args': [ '-pkeyopt rsa_keygen_bits:2048', ], }\n ...\n}\n\nsignature_details = SIGNATURE_DETAILS[signature_algo]\n\nipa_priv_key = custom_target('ipa-priv-key',\n output : ['ipa-priv-key.pem'],\n command : [ openssl, 'genpkey',\n '-algorithm', signature_details.get('algo'),\n '-out', '@OUTPUT@',\n ] + signature_details.get('args', []))\n\nThis also fixes the (mostly theoretical) issue of using the wrong `openssl` when the\n`openssl` program is overridden in meson but not in $PATH.\n\nAny reason I'm missing why this extra script is useful?\n\n\n> + endif\n> config_h.set('HAVE_IPA_PUBKEY', 1)\n> ipa_sign_module = true\n> else\n> diff --git a/utils/gen-ipa-priv-key.sh b/utils/gen-ipa-priv-key.sh\n> index 2ca7b883..8b86dfb3 100755\n> --- a/utils/gen-ipa-priv-key.sh\n> +++ b/utils/gen-ipa-priv-key.sh\n> @@ -6,6 +6,18 @@\n> #\n> # Generate an RSA private key to sign IPA modules\n> \n> -key=\"$1\"\n> +algo=\"$1\"\n> +key=\"$2\"\n> \n> -openssl genpkey -algorithm RSA -out \"${key}\" -pkeyopt rsa_keygen_bits:2048\n> +# Two possible algorithms: RSA and ML-DSA-65\n> +# openssl genpkey -algorithm RSA -out \"${key}\" -pkeyopt rsa_keygen_bits:2048\n> +# openssl genpkey -algorithm ML-DSA-65 -out \"${key}\"\n> +\n> +if [ \"$algo\" = \"RSA\" ]; then\n> + openssl genpkey -algorithm RSA -out \"${key}\" -pkeyopt rsa_keygen_bits:2048\n> +elif [ \"$algo\" = \"ML-DSA-65\" ]; then\n> + openssl genpkey -algorithm ML-DSA-65 -out \"${key}\"\n> +else\n> + echo \"Invalid algorithm: $algo\"\n> + exit 1\n> +fi\n> \\ No newline at end of file\n> --\n> 2.54.0\n>","headers":{"Return-Path":"","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id 987AFC324C\n\tfor ;\n\tMon, 15 Jun 2026 15:09:47 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id 53D06623EA;\n\tMon, 15 Jun 2026 17:09:46 +0200 (CEST)","from perceval.ideasonboard.com (perceval.ideasonboard.com\n\t[213.167.242.64])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id 03A32623CB\n\tfor ;\n\tMon, 15 Jun 2026 17:09:44 +0200 (CEST)","from [192.168.33.26] (185.221.142.169.nat.pool.zt.hu\n\t[185.221.142.169])\n\tby perceval.ideasonboard.com (Postfix) with ESMTPSA id 1A1FCC59;\n\tMon, 15 Jun 2026 17:09:12 +0200 (CEST)"],"Authentication-Results":"lancelot.ideasonboard.com; dkim=pass (1024-bit key;\n\tunprotected) header.d=ideasonboard.com header.i=@ideasonboard.com\n\theader.b=\"caihqCgW\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com;\n\ts=mail; t=1781536152;\n\tbh=Bo2whTYpgxklvtyjIU7da73m+aeF6z31xU0VWI6mULE=;\n\th=Date:Subject:To:References:From:Cc:In-Reply-To:From;\n\tb=caihqCgW99sxACj7xul6RKw9pPWUqgXBryJ/Pss/VbvrqpJ7TLbq16jRatN8VPMKx\n\tarGP8LD8fXnr26zGn4qOlyDL4JPnWCJlPkr8IbzlpSwZdMFrh7jVzV6LTLl4jI2HBo\n\trmnxo7SeRVMQy1xtWd753pdAUfakTQLsCdIu8Zws=","Message-ID":"<7c73a950-b859-4ed7-b975-93af47c7abb4@ideasonboard.com>","Date":"Mon, 15 Jun 2026 17:09:40 +0200","MIME-Version":"1.0","User-Agent":"Mozilla Thunderbird","Subject":"Re: [PATCH v3 4/4] meson: Add ipa-signature-algo option","To":"Kate Hsuan ,\n\tLaurent Pinchart ","References":"<20260519030020.408693-1-hpa@redhat.com>\n\t\n\t<20260519030020.408693-5-hpa@redhat.com>","From":"=?utf-8?q?Barnab=C3=A1s_P=C5=91cze?= ","Content-Language":"en-US, hu-HU","Cc":"Kieran Bingham ,\n\tlibcamera-devel@lists.libcamera.org","In-Reply-To":"<20260519030020.408693-5-hpa@redhat.com>","Content-Type":"text/plain; charset=UTF-8; format=flowed","Content-Transfer-Encoding":"8bit","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" "}},{"id":39082,"web_url":"https://patchwork.libcamera.org/comment/39082/","msgid":"<20260615151016.GE2849765@killaraus.ideasonboard.com>","date":"2026-06-15T15:10:16","subject":"Re: [PATCH v3 4/4] meson: Add ipa-signature-algo option","submitter":{"id":2,"url":"https://patchwork.libcamera.org/api/people/2/","name":"Laurent Pinchart","email":"laurent.pinchart@ideasonboard.com"},"content":"Hi Kate,\n\nThank you for the patch.\n\nOn Tue, May 19, 2026 at 11:00:20AM +0800, Kate Hsuan wrote:\n> Add a combo type \"ipa-signature-algo\" meson option to select signature\n> algorithms, including rsa-sha256 and ml-dsa-65.\n> ras-sha256 is the default setting for now.\n> \n> Signed-off-by: Kate Hsuan \n> ---\n> meson_options.txt | 8 ++++++++\n> src/libcamera/meson.build | 6 ++++++\n> src/meson.build | 14 +++++++++++---\n> utils/gen-ipa-priv-key.sh | 16 ++++++++++++++--\n> 4 files changed, 39 insertions(+), 5 deletions(-)\n> \n> diff --git a/meson_options.txt b/meson_options.txt\n> index 20baacc4..18488e6b 100644\n> --- a/meson_options.txt\n> +++ b/meson_options.txt\n> @@ -46,6 +46,14 @@ option('gstreamer',\n> value : 'auto',\n> description : 'Compile libcamera GStreamer plugin')\n> \n> +option('ipa-signature-algo',\n> + type : 'combo',\n> + choices : [\n> + 'rsa-sha256',\n> + 'ml-dsa-65',\n> + ],\n> + description : 'Select a signature algorithm to sign IPA libraries.')\n> +\n> option('ipas',\n> type : 'array',\n> choices : ['ipu3', 'mali-c55', 'rkisp1', 'rpi/pisp', 'rpi/vc4', 'simple',\n> diff --git a/src/libcamera/meson.build b/src/libcamera/meson.build\n> index 575408b2..55ba6c6d 100644\n> --- a/src/libcamera/meson.build\n> +++ b/src/libcamera/meson.build\n> @@ -97,6 +97,12 @@ else\n> endif\n> endif\n> \n> +# comply with FIPS 204\n> +signature_algo = get_option('ipa-signature-algo')\n> +if signature_algo == 'ml-dsa-65'\n> + config_h.set('WITH_PQC', 1)\n> +endif\n\nI proposed renaming this HAVE_CRYPTO_ML_DSA_65 in patch 1/4. Thinking\nabout it some more, maybe IPA_MODULE_DIR_SIGNATURE_ALGO would be a\nbetter option. I would then set it unconditionally, with a string value:\n\nconfig_h.set('IPA_MODULE_DIR_SIGNATURE_ALGO', '\"' + get_option('ipa-signature-algo') + '\"')\n\nThe code in patch 1/4 could then be\n\n constexpr gnutls_sign_algorithm_t algo =\n\t\tIPA_MODULE_DIR_SIGNATURE_ALGO == \"ml-dsa-65\" ?\n\t\tGNUTLS_SIGN_MLDSA65 : GNUTLS_SIGN_RSA_SHA256;\n\n int ret = gnutls_pubkey_verify_data2(pubkey_, algo, 0, &gnuTlsData,\n &gnuTlsSig);\n\n(with the necessary adjustments to get it to compile :-)). This would\nremove conditional compilation.\n\n> +\n> if not libcrypto.found()\n> warning('Neither gnutls nor libcrypto found, all IPA modules will be isolated')\n> summary({'IPA modules signed with': 'None (modules will run isolated)'},\n> diff --git a/src/meson.build b/src/meson.build\n> index 9b63c8e8..7f8909b1 100644\n> --- a/src/meson.build\n> +++ b/src/meson.build\n> @@ -15,11 +15,19 @@ summary({\n> }, section : 'Paths')\n> \n> # Module Signing\n> +signature_algo = get_option('ipa-signature-algo')\n> openssl = find_program('openssl', required : false)\n> if openssl.found()\n> - ipa_priv_key = custom_target('ipa-priv-key',\n> - output : ['ipa-priv-key.pem'],\n> - command : [gen_ipa_priv_key, '@OUTPUT@'])\n> + if signature_algo == 'ml-dsa-65'\n> + ipa_priv_key = custom_target('ipa-priv-key',\n> + output : ['ipa-priv-key.pem'],\n> + command : [gen_ipa_priv_key, 'ML-DSA-65', '@OUTPUT@'])\n> + endif\n> + if signature_algo == 'rsa-sha256'\n> + ipa_priv_key = custom_target('ipa-priv-key',\n> + output : ['ipa-priv-key.pem'],\n> + command : [gen_ipa_priv_key, 'RSA', '@OUTPUT@'])\n\nMake this unconditional:\n\n ipa_priv_key = custom_target('ipa-priv-key',\n output : ['ipa-priv-key.pem'],\n command : [\n\t\t\t\t gen_ipa_priv_key,\n\t\t\t\t get_option('ipa-signature-algo'),\n\t\t\t\t '@OUTPUT@'\n\t\t\t\t ])\n\nand update gen-ipa-priv-key.sh accordingly.\n\n> + endif\n> config_h.set('HAVE_IPA_PUBKEY', 1)\n> ipa_sign_module = true\n> else\n> diff --git a/utils/gen-ipa-priv-key.sh b/utils/gen-ipa-priv-key.sh\n> index 2ca7b883..8b86dfb3 100755\n> --- a/utils/gen-ipa-priv-key.sh\n> +++ b/utils/gen-ipa-priv-key.sh\n> @@ -6,6 +6,18 @@\n> #\n> # Generate an RSA private key to sign IPA modules\n\nThis comment needs to be updated.\n\n> \n> -key=\"$1\"\n> +algo=\"$1\"\n> +key=\"$2\"\n> \n> -openssl genpkey -algorithm RSA -out \"${key}\" -pkeyopt rsa_keygen_bits:2048\n> +# Two possible algorithms: RSA and ML-DSA-65\n> +# openssl genpkey -algorithm RSA -out \"${key}\" -pkeyopt rsa_keygen_bits:2048\n> +# openssl genpkey -algorithm ML-DSA-65 -out \"${key}\"\n> +\n> +if [ \"$algo\" = \"RSA\" ]; then\n> + openssl genpkey -algorithm RSA -out \"${key}\" -pkeyopt rsa_keygen_bits:2048\n\nAccording to the openssl-genpkey manpage, 2048 is the default, so maybe\nyou could drop the option and simplify the code.\n\n> +elif [ \"$algo\" = \"ML-DSA-65\" ]; then\n> + openssl genpkey -algorithm ML-DSA-65 -out \"${key}\"\n> +else\n> + echo \"Invalid algorithm: $algo\"\n> + exit 1\n> +fi\n\nOne issue I ran into when testing the series is that changing the value\nof the ipa-signature-algo option doesn't regenerate the key.\n\n> \\ No newline at end of file","headers":{"Return-Path":"","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id A1E7FC324C\n\tfor ;\n\tMon, 15 Jun 2026 15:10:19 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id 64C43623E6;\n\tMon, 15 Jun 2026 17:10:19 +0200 (CEST)","from perceval.ideasonboard.com (perceval.ideasonboard.com\n\t[213.167.242.64])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id B1E50623E6\n\tfor ;\n\tMon, 15 Jun 2026 17:10:17 +0200 (CEST)","from killaraus.ideasonboard.com\n\t(2001-14ba-70f3-e800--a06.rev.dnainternet.fi\n\t[IPv6:2001:14ba:70f3:e800::a06])\n\tby perceval.ideasonboard.com (Postfix) with ESMTPSA id C812F1044;\n\tMon, 15 Jun 2026 17:09:44 +0200 (CEST)"],"Authentication-Results":"lancelot.ideasonboard.com; dkim=pass (1024-bit key;\n\tunprotected) header.d=ideasonboard.com header.i=@ideasonboard.com\n\theader.b=\"JYh7qYWl\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com;\n\ts=mail; t=1781536185;\n\tbh=DP4+13yvCWfRy7R1QFYDNp1E5bzXEBWzqMBJ7KFsYJs=;\n\th=Date:From:To:Cc:Subject:References:In-Reply-To:From;\n\tb=JYh7qYWlQU3tWVhdlzkO7W7/CCwjhF5l247GuMRRJk5M/iG0F3RzM8CXbXEisZzBH\n\tbmDydKiQRrfa/EBvtz437EbPyWU6SdA0Ubw9je2Ah3sowZ91dGtmWnxzZEp77i7AQI\n\tYe1np15i99CBLLjCcjlALahitJpRiqTtCeTuKXZM=","Date":"Mon, 15 Jun 2026 18:10:16 +0300","From":"Laurent Pinchart ","To":"Kate Hsuan ","Cc":"libcamera-devel@lists.libcamera.org, =?utf-8?b?QmFybmFiw6FzIFDFkWN6?=\n\t=?utf-8?q?e?= , Kieran Bingham\n\t","Subject":"Re: [PATCH v3 4/4] meson: Add ipa-signature-algo option","Message-ID":"<20260615151016.GE2849765@killaraus.ideasonboard.com>","References":"<20260519030020.408693-1-hpa@redhat.com>\n\t<20260519030020.408693-5-hpa@redhat.com>","MIME-Version":"1.0","Content-Type":"text/plain; charset=utf-8","Content-Disposition":"inline","In-Reply-To":"<20260519030020.408693-5-hpa@redhat.com>","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" "}},{"id":39084,"web_url":"https://patchwork.libcamera.org/comment/39084/","msgid":"<20260615154405.GG2849765@killaraus.ideasonboard.com>","date":"2026-06-15T15:44:05","subject":"Re: [PATCH v3 4/4] meson: Add ipa-signature-algo option","submitter":{"id":2,"url":"https://patchwork.libcamera.org/api/people/2/","name":"Laurent Pinchart","email":"laurent.pinchart@ideasonboard.com"},"content":"On Mon, Jun 15, 2026 at 05:09:40PM +0200, Barnabás Pőcze wrote:\n> 2026. 05. 19. 5:00 keltezéssel, Kate Hsuan írta:\n> > Add a combo type \"ipa-signature-algo\" meson option to select signature\n> > algorithms, including rsa-sha256 and ml-dsa-65.\n> > ras-sha256 is the default setting for now.\n> > \n> > Signed-off-by: Kate Hsuan \n> > ---\n> > meson_options.txt | 8 ++++++++\n> > src/libcamera/meson.build | 6 ++++++\n> > src/meson.build | 14 +++++++++++---\n> > utils/gen-ipa-priv-key.sh | 16 ++++++++++++++--\n> > 4 files changed, 39 insertions(+), 5 deletions(-)\n> > \n> > diff --git a/meson_options.txt b/meson_options.txt\n> > index 20baacc4..18488e6b 100644\n> > --- a/meson_options.txt\n> > +++ b/meson_options.txt\n> > @@ -46,6 +46,14 @@ option('gstreamer',\n> > value : 'auto',\n> > description : 'Compile libcamera GStreamer plugin')\n> > \n> > +option('ipa-signature-algo',\n> > + type : 'combo',\n> > + choices : [\n> > + 'rsa-sha256',\n> > + 'ml-dsa-65',\n> > + ],\n> > + description : 'Select a signature algorithm to sign IPA libraries.')\n> > +\n> > option('ipas',\n> > type : 'array',\n> > choices : ['ipu3', 'mali-c55', 'rkisp1', 'rpi/pisp', 'rpi/vc4', 'simple',\n> > diff --git a/src/libcamera/meson.build b/src/libcamera/meson.build\n> > index 575408b2..55ba6c6d 100644\n> > --- a/src/libcamera/meson.build\n> > +++ b/src/libcamera/meson.build\n> > @@ -97,6 +97,12 @@ else\n> > endif\n> > endif\n> > \n> > +# comply with FIPS 204\n> > +signature_algo = get_option('ipa-signature-algo')\n> > +if signature_algo == 'ml-dsa-65'\n> > + config_h.set('WITH_PQC', 1)\n> > +endif\n> > +\n> > if not libcrypto.found()\n> > warning('Neither gnutls nor libcrypto found, all IPA modules will be isolated')\n> > summary({'IPA modules signed with': 'None (modules will run isolated)'},\n> > diff --git a/src/meson.build b/src/meson.build\n> > index 9b63c8e8..7f8909b1 100644\n> > --- a/src/meson.build\n> > +++ b/src/meson.build\n> > @@ -15,11 +15,19 @@ summary({\n> > }, section : 'Paths')\n> > \n> > # Module Signing\n> > +signature_algo = get_option('ipa-signature-algo')\n> > openssl = find_program('openssl', required : false)\n> > if openssl.found()\n> > - ipa_priv_key = custom_target('ipa-priv-key',\n> > - output : ['ipa-priv-key.pem'],\n> > - command : [gen_ipa_priv_key, '@OUTPUT@'])\n> > + if signature_algo == 'ml-dsa-65'\n> > + ipa_priv_key = custom_target('ipa-priv-key',\n> > + output : ['ipa-priv-key.pem'],\n> > + command : [gen_ipa_priv_key, 'ML-DSA-65', '@OUTPUT@'])\n> > + endif\n> > + if signature_algo == 'rsa-sha256'\n> > + ipa_priv_key = custom_target('ipa-priv-key',\n> > + output : ['ipa-priv-key.pem'],\n> > + command : [gen_ipa_priv_key, 'RSA', '@OUTPUT@'])\n> \n> Why not just pass `signature_algo`? There is already a conditional chain in the script.\n> \n> But to be honest, I feel like I would actually remove the script altogether and\n> have something like this:\n> \n> SIGNATURE_DETAILS = {\n> 'rsa-sha256': { 'algo': 'RSA', 'args': [ '-pkeyopt rsa_keygen_bits:2048', ], }\n> ...\n> }\n> \n> signature_details = SIGNATURE_DETAILS[signature_algo]\n> \n> ipa_priv_key = custom_target('ipa-priv-key',\n> output : ['ipa-priv-key.pem'],\n> command : [ openssl, 'genpkey',\n> '-algorithm', signature_details.get('algo'),\n> '-out', '@OUTPUT@',\n> ] + signature_details.get('args', []))\n> \n> This also fixes the (mostly theoretical) issue of using the wrong `openssl` when the\n> `openssl` program is overridden in meson but not in $PATH.\n> \n> Any reason I'm missing why this extra script is useful?\n\nNot that I know of.\n\nOn a related note, do we need a nice error message when ml-dsa-65 is\nselected but not available, or is the error output by openssl good\nenough ? I don't have an old version available here for testing.\n\n> > + endif\n> > config_h.set('HAVE_IPA_PUBKEY', 1)\n> > ipa_sign_module = true\n> > else\n> > diff --git a/utils/gen-ipa-priv-key.sh b/utils/gen-ipa-priv-key.sh\n> > index 2ca7b883..8b86dfb3 100755\n> > --- a/utils/gen-ipa-priv-key.sh\n> > +++ b/utils/gen-ipa-priv-key.sh\n> > @@ -6,6 +6,18 @@\n> > #\n> > # Generate an RSA private key to sign IPA modules\n> > \n> > -key=\"$1\"\n> > +algo=\"$1\"\n> > +key=\"$2\"\n> > \n> > -openssl genpkey -algorithm RSA -out \"${key}\" -pkeyopt rsa_keygen_bits:2048\n> > +# Two possible algorithms: RSA and ML-DSA-65\n> > +# openssl genpkey -algorithm RSA -out \"${key}\" -pkeyopt rsa_keygen_bits:2048\n> > +# openssl genpkey -algorithm ML-DSA-65 -out \"${key}\"\n> > +\n> > +if [ \"$algo\" = \"RSA\" ]; then\n> > + openssl genpkey -algorithm RSA -out \"${key}\" -pkeyopt rsa_keygen_bits:2048\n> > +elif [ \"$algo\" = \"ML-DSA-65\" ]; then\n> > + openssl genpkey -algorithm ML-DSA-65 -out \"${key}\"\n> > +else\n> > + echo \"Invalid algorithm: $algo\"\n> > + exit 1\n> > +fi\n> > \\ No newline at end of file","headers":{"Return-Path":"","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id 6EF4EC328C\n\tfor ;\n\tMon, 15 Jun 2026 15:44:09 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id 7C778623F8;\n\tMon, 15 Jun 2026 17:44:08 +0200 (CEST)","from perceval.ideasonboard.com (perceval.ideasonboard.com\n\t[IPv6:2001:4b98:dc2:55:216:3eff:fef7:d647])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id 98BE8623CB\n\tfor ;\n\tMon, 15 Jun 2026 17:44:07 +0200 (CEST)","from killaraus.ideasonboard.com\n\t(2001-14ba-70f3-e800--a06.rev.dnainternet.fi\n\t[IPv6:2001:14ba:70f3:e800::a06])\n\tby perceval.ideasonboard.com (Postfix) with ESMTPSA id F36C7C59;\n\tMon, 15 Jun 2026 17:43:33 +0200 (CEST)"],"Authentication-Results":"lancelot.ideasonboard.com; dkim=pass (1024-bit key;\n\tunprotected) header.d=ideasonboard.com header.i=@ideasonboard.com\n\theader.b=\"LOXQ0vG8\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com;\n\ts=mail; t=1781538214;\n\tbh=A9NGKCAQJS6ZxEQQdIOXO5sbVOYF5Gi1RiIcWa/VMyk=;\n\th=Date:From:To:Cc:Subject:References:In-Reply-To:From;\n\tb=LOXQ0vG8eI2yWqR90jkuxVbmXbV2Y215xSSscnvga3pmkz9c1eNLX/gWXsNIA3WGp\n\tukwaeJyvmqoNGIA2XcXQdiRuja6jqNtqCTVqHHrOmOrrUR0ME5W6SkXcwKvDO2flr1\n\tGoY0feb1OBayW4f47CS5m4HLPtQMs4IAX4Aa//D8=","Date":"Mon, 15 Jun 2026 18:44:05 +0300","From":"Laurent Pinchart ","To":"=?utf-8?q?Barnab=C3=A1s_P=C5=91cze?= ","Cc":"Kate Hsuan ,\n\tKieran Bingham ,\n\tlibcamera-devel@lists.libcamera.org","Subject":"Re: [PATCH v3 4/4] meson: Add ipa-signature-algo option","Message-ID":"<20260615154405.GG2849765@killaraus.ideasonboard.com>","References":"<20260519030020.408693-1-hpa@redhat.com>\n\t\n\t<20260519030020.408693-5-hpa@redhat.com>\n\t<7c73a950-b859-4ed7-b975-93af47c7abb4@ideasonboard.com>","MIME-Version":"1.0","Content-Type":"text/plain; charset=utf-8","Content-Disposition":"inline","Content-Transfer-Encoding":"8bit","In-Reply-To":"<7c73a950-b859-4ed7-b975-93af47c7abb4@ideasonboard.com>","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" "}},{"id":39085,"web_url":"https://patchwork.libcamera.org/comment/39085/","msgid":"<20260615154529.GH2849765@killaraus.ideasonboard.com>","date":"2026-06-15T15:45:29","subject":"Re: [PATCH v3 4/4] meson: Add ipa-signature-algo option","submitter":{"id":2,"url":"https://patchwork.libcamera.org/api/people/2/","name":"Laurent Pinchart","email":"laurent.pinchart@ideasonboard.com"},"content":"On Mon, Jun 15, 2026 at 06:44:07PM +0300, Laurent Pinchart wrote:\n> On Mon, Jun 15, 2026 at 05:09:40PM +0200, Barnabás Pőcze wrote:\n> > 2026. 05. 19. 5:00 keltezéssel, Kate Hsuan írta:\n> > > Add a combo type \"ipa-signature-algo\" meson option to select signature\n> > > algorithms, including rsa-sha256 and ml-dsa-65.\n> > > ras-sha256 is the default setting for now.\n> > > \n> > > Signed-off-by: Kate Hsuan \n> > > ---\n> > > meson_options.txt | 8 ++++++++\n> > > src/libcamera/meson.build | 6 ++++++\n> > > src/meson.build | 14 +++++++++++---\n> > > utils/gen-ipa-priv-key.sh | 16 ++++++++++++++--\n> > > 4 files changed, 39 insertions(+), 5 deletions(-)\n> > > \n> > > diff --git a/meson_options.txt b/meson_options.txt\n> > > index 20baacc4..18488e6b 100644\n> > > --- a/meson_options.txt\n> > > +++ b/meson_options.txt\n> > > @@ -46,6 +46,14 @@ option('gstreamer',\n> > > value : 'auto',\n> > > description : 'Compile libcamera GStreamer plugin')\n> > > \n> > > +option('ipa-signature-algo',\n> > > + type : 'combo',\n> > > + choices : [\n> > > + 'rsa-sha256',\n> > > + 'ml-dsa-65',\n> > > + ],\n> > > + description : 'Select a signature algorithm to sign IPA libraries.')\n> > > +\n> > > option('ipas',\n> > > type : 'array',\n> > > choices : ['ipu3', 'mali-c55', 'rkisp1', 'rpi/pisp', 'rpi/vc4', 'simple',\n> > > diff --git a/src/libcamera/meson.build b/src/libcamera/meson.build\n> > > index 575408b2..55ba6c6d 100644\n> > > --- a/src/libcamera/meson.build\n> > > +++ b/src/libcamera/meson.build\n> > > @@ -97,6 +97,12 @@ else\n> > > endif\n> > > endif\n> > > \n> > > +# comply with FIPS 204\n> > > +signature_algo = get_option('ipa-signature-algo')\n> > > +if signature_algo == 'ml-dsa-65'\n> > > + config_h.set('WITH_PQC', 1)\n> > > +endif\n> > > +\n> > > if not libcrypto.found()\n> > > warning('Neither gnutls nor libcrypto found, all IPA modules will be isolated')\n> > > summary({'IPA modules signed with': 'None (modules will run isolated)'},\n> > > diff --git a/src/meson.build b/src/meson.build\n> > > index 9b63c8e8..7f8909b1 100644\n> > > --- a/src/meson.build\n> > > +++ b/src/meson.build\n> > > @@ -15,11 +15,19 @@ summary({\n> > > }, section : 'Paths')\n> > > \n> > > # Module Signing\n> > > +signature_algo = get_option('ipa-signature-algo')\n> > > openssl = find_program('openssl', required : false)\n> > > if openssl.found()\n> > > - ipa_priv_key = custom_target('ipa-priv-key',\n> > > - output : ['ipa-priv-key.pem'],\n> > > - command : [gen_ipa_priv_key, '@OUTPUT@'])\n> > > + if signature_algo == 'ml-dsa-65'\n> > > + ipa_priv_key = custom_target('ipa-priv-key',\n> > > + output : ['ipa-priv-key.pem'],\n> > > + command : [gen_ipa_priv_key, 'ML-DSA-65', '@OUTPUT@'])\n> > > + endif\n> > > + if signature_algo == 'rsa-sha256'\n> > > + ipa_priv_key = custom_target('ipa-priv-key',\n> > > + output : ['ipa-priv-key.pem'],\n> > > + command : [gen_ipa_priv_key, 'RSA', '@OUTPUT@'])\n> > \n> > Why not just pass `signature_algo`? There is already a conditional chain in the script.\n> > \n> > But to be honest, I feel like I would actually remove the script altogether and\n> > have something like this:\n> > \n> > SIGNATURE_DETAILS = {\n> > 'rsa-sha256': { 'algo': 'RSA', 'args': [ '-pkeyopt rsa_keygen_bits:2048', ], }\n> > ...\n> > }\n> > \n> > signature_details = SIGNATURE_DETAILS[signature_algo]\n> > \n> > ipa_priv_key = custom_target('ipa-priv-key',\n> > output : ['ipa-priv-key.pem'],\n> > command : [ openssl, 'genpkey',\n> > '-algorithm', signature_details.get('algo'),\n> > '-out', '@OUTPUT@',\n> > ] + signature_details.get('args', []))\n> > \n> > This also fixes the (mostly theoretical) issue of using the wrong `openssl` when the\n> > `openssl` program is overridden in meson but not in $PATH.\n> > \n> > Any reason I'm missing why this extra script is useful?\n> \n> Not that I know of.\n> \n> On a related note, do we need a nice error message when ml-dsa-65 is\n> selected but not available, or is the error output by openssl good\n> enough ? I don't have an old version available here for testing.\n\nA check at build time that the openssl or gnutls version for the target\nprovide ml-dsa-65 support would be good too. For gnutls we'll get a\ncompilation error, but for openssl we'll have a runtime failure.\n\n> > > + endif\n> > > config_h.set('HAVE_IPA_PUBKEY', 1)\n> > > ipa_sign_module = true\n> > > else\n> > > diff --git a/utils/gen-ipa-priv-key.sh b/utils/gen-ipa-priv-key.sh\n> > > index 2ca7b883..8b86dfb3 100755\n> > > --- a/utils/gen-ipa-priv-key.sh\n> > > +++ b/utils/gen-ipa-priv-key.sh\n> > > @@ -6,6 +6,18 @@\n> > > #\n> > > # Generate an RSA private key to sign IPA modules\n> > > \n> > > -key=\"$1\"\n> > > +algo=\"$1\"\n> > > +key=\"$2\"\n> > > \n> > > -openssl genpkey -algorithm RSA -out \"${key}\" -pkeyopt rsa_keygen_bits:2048\n> > > +# Two possible algorithms: RSA and ML-DSA-65\n> > > +# openssl genpkey -algorithm RSA -out \"${key}\" -pkeyopt rsa_keygen_bits:2048\n> > > +# openssl genpkey -algorithm ML-DSA-65 -out \"${key}\"\n> > > +\n> > > +if [ \"$algo\" = \"RSA\" ]; then\n> > > + openssl genpkey -algorithm RSA -out \"${key}\" -pkeyopt rsa_keygen_bits:2048\n> > > +elif [ \"$algo\" = \"ML-DSA-65\" ]; then\n> > > + openssl genpkey -algorithm ML-DSA-65 -out \"${key}\"\n> > > +else\n> > > + echo \"Invalid algorithm: $algo\"\n> > > + exit 1\n> > > +fi\n> > > \\ No newline at end of file","headers":{"Return-Path":"","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id 9CEFBC328C\n\tfor ;\n\tMon, 15 Jun 2026 15:45:32 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id 4CECD623F3;\n\tMon, 15 Jun 2026 17:45:32 +0200 (CEST)","from perceval.ideasonboard.com (perceval.ideasonboard.com\n\t[IPv6:2001:4b98:dc2:55:216:3eff:fef7:d647])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id 5EB93623E6\n\tfor ;\n\tMon, 15 Jun 2026 17:45:30 +0200 (CEST)","from killaraus.ideasonboard.com\n\t(2001-14ba-70f3-e800--a06.rev.dnainternet.fi\n\t[IPv6:2001:14ba:70f3:e800::a06])\n\tby perceval.ideasonboard.com (Postfix) with ESMTPSA id 70030C59;\n\tMon, 15 Jun 2026 17:44:57 +0200 (CEST)"],"Authentication-Results":"lancelot.ideasonboard.com; dkim=pass (1024-bit key;\n\tunprotected) header.d=ideasonboard.com header.i=@ideasonboard.com\n\theader.b=\"Yx5H3W1L\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com;\n\ts=mail; t=1781538297;\n\tbh=n615//2rCn9ZmwW/6Ls1Mv8d9h47RTbJ7dDZ1vxG0pc=;\n\th=Date:From:To:Cc:Subject:References:In-Reply-To:From;\n\tb=Yx5H3W1L0CPPb3KH6U19cxeruITBWdzWgMVb0MC/c3VgY8pUOkYQxPbxvWXqhDeMP\n\tq6QrQ4ZvjX34HoD5jA0Ki6/ts5VIZHxCWV40f4Ohgy9qpV1MbCg/GkPsOsY0lUoRsb\n\t6Zl7qO8VbdNUNpKmrnz0Xff5NLIywAL7pfE2J0cc=","Date":"Mon, 15 Jun 2026 18:45:29 +0300","From":"Laurent Pinchart ","To":"=?utf-8?q?Barnab=C3=A1s_P=C5=91cze?= ","Cc":"Kate Hsuan ,\n\tKieran Bingham ,\n\tlibcamera-devel@lists.libcamera.org","Subject":"Re: [PATCH v3 4/4] meson: Add ipa-signature-algo option","Message-ID":"<20260615154529.GH2849765@killaraus.ideasonboard.com>","References":"<20260519030020.408693-1-hpa@redhat.com>\n\t\n\t<20260519030020.408693-5-hpa@redhat.com>\n\t<7c73a950-b859-4ed7-b975-93af47c7abb4@ideasonboard.com>\n\t<20260615154405.GG2849765@killaraus.ideasonboard.com>","MIME-Version":"1.0","Content-Type":"text/plain; charset=utf-8","Content-Disposition":"inline","Content-Transfer-Encoding":"8bit","In-Reply-To":"<20260615154405.GG2849765@killaraus.ideasonboard.com>","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" "}},{"id":39168,"web_url":"https://patchwork.libcamera.org/comment/39168/","msgid":"","date":"2026-06-18T06:13:32","subject":"Re: [PATCH v3 4/4] meson: Add ipa-signature-algo option","submitter":{"id":105,"url":"https://patchwork.libcamera.org/api/people/105/","name":"Kate Hsuan","email":"hpa@redhat.com"},"content":"Hi Barnabás and Laurent\n\nThank you for reviewing this work.\n\nOn Mon, Jun 15, 2026 at 11:10 PM Laurent Pinchart\n wrote:\n>\n> Hi Kate,\n>\n> Thank you for the patch.\n>\n> On Tue, May 19, 2026 at 11:00:20AM +0800, Kate Hsuan wrote:\n> > Add a combo type \"ipa-signature-algo\" meson option to select signature\n> > algorithms, including rsa-sha256 and ml-dsa-65.\n> > ras-sha256 is the default setting for now.\n> >\n> > Signed-off-by: Kate Hsuan \n> > ---\n> > meson_options.txt | 8 ++++++++\n> > src/libcamera/meson.build | 6 ++++++\n> > src/meson.build | 14 +++++++++++---\n> > utils/gen-ipa-priv-key.sh | 16 ++++++++++++++--\n> > 4 files changed, 39 insertions(+), 5 deletions(-)\n> >\n> > diff --git a/meson_options.txt b/meson_options.txt\n> > index 20baacc4..18488e6b 100644\n> > --- a/meson_options.txt\n> > +++ b/meson_options.txt\n> > @@ -46,6 +46,14 @@ option('gstreamer',\n> > value : 'auto',\n> > description : 'Compile libcamera GStreamer plugin')\n> >\n> > +option('ipa-signature-algo',\n> > + type : 'combo',\n> > + choices : [\n> > + 'rsa-sha256',\n> > + 'ml-dsa-65',\n> > + ],\n> > + description : 'Select a signature algorithm to sign IPA libraries.')\n> > +\n> > option('ipas',\n> > type : 'array',\n> > choices : ['ipu3', 'mali-c55', 'rkisp1', 'rpi/pisp', 'rpi/vc4', 'simple',\n> > diff --git a/src/libcamera/meson.build b/src/libcamera/meson.build\n> > index 575408b2..55ba6c6d 100644\n> > --- a/src/libcamera/meson.build\n> > +++ b/src/libcamera/meson.build\n> > @@ -97,6 +97,12 @@ else\n> > endif\n> > endif\n> >\n> > +# comply with FIPS 204\n> > +signature_algo = get_option('ipa-signature-algo')\n> > +if signature_algo == 'ml-dsa-65'\n> > + config_h.set('WITH_PQC', 1)\n> > +endif\n>\n> I proposed renaming this HAVE_CRYPTO_ML_DSA_65 in patch 1/4. Thinking\n> about it some more, maybe IPA_MODULE_DIR_SIGNATURE_ALGO would be a\n> better option. I would then set it unconditionally, with a string value:\nOK, this is a better way if more algorithms are introduced into libcamera.\n\n>\n> config_h.set('IPA_MODULE_DIR_SIGNATURE_ALGO', '\"' + get_option('ipa-signature-algo') + '\"')\n>\n> The code in patch 1/4 could then be\n>\n> constexpr gnutls_sign_algorithm_t algo =\n> IPA_MODULE_DIR_SIGNATURE_ALGO == \"ml-dsa-65\" ?\n> GNUTLS_SIGN_MLDSA65 : GNUTLS_SIGN_RSA_SHA256;\n>\n> int ret = gnutls_pubkey_verify_data2(pubkey_, algo, 0, &gnuTlsData,\n> &gnuTlsSig);\n>\n> (with the necessary adjustments to get it to compile :-)). This would\n> remove conditional compilation.\n\nSounds good. I'll check the code with \"WITH_PQC\" again.\n\n>\n> > +\n> > if not libcrypto.found()\n> > warning('Neither gnutls nor libcrypto found, all IPA modules will be isolated')\n> > summary({'IPA modules signed with': 'None (modules will run isolated)'},\n> > diff --git a/src/meson.build b/src/meson.build\n> > index 9b63c8e8..7f8909b1 100644\n> > --- a/src/meson.build\n> > +++ b/src/meson.build\n> > @@ -15,11 +15,19 @@ summary({\n> > }, section : 'Paths')\n> >\n> > # Module Signing\n> > +signature_algo = get_option('ipa-signature-algo')\n> > openssl = find_program('openssl', required : false)\n> > if openssl.found()\n> > - ipa_priv_key = custom_target('ipa-priv-key',\n> > - output : ['ipa-priv-key.pem'],\n> > - command : [gen_ipa_priv_key, '@OUTPUT@'])\n> > + if signature_algo == 'ml-dsa-65'\n> > + ipa_priv_key = custom_target('ipa-priv-key',\n> > + output : ['ipa-priv-key.pem'],\n> > + command : [gen_ipa_priv_key, 'ML-DSA-65', '@OUTPUT@'])\n> > + endif\n> > + if signature_algo == 'rsa-sha256'\n> > + ipa_priv_key = custom_target('ipa-priv-key',\n> > + output : ['ipa-priv-key.pem'],\n> > + command : [gen_ipa_priv_key, 'RSA', '@OUTPUT@'])\n>\n> Make this unconditional:\nOkay\n\n>\n> ipa_priv_key = custom_target('ipa-priv-key',\n> output : ['ipa-priv-key.pem'],\n> command : [\n> gen_ipa_priv_key,\n> get_option('ipa-signature-algo'),\n> '@OUTPUT@'\n> ])\n\nOk\n\n>\n> and update gen-ipa-priv-key.sh accordingly.\n\nSure.\n\n>\n> > + endif\n> > config_h.set('HAVE_IPA_PUBKEY', 1)\n> > ipa_sign_module = true\n> > else\n> > diff --git a/utils/gen-ipa-priv-key.sh b/utils/gen-ipa-priv-key.sh\n> > index 2ca7b883..8b86dfb3 100755\n> > --- a/utils/gen-ipa-priv-key.sh\n> > +++ b/utils/gen-ipa-priv-key.sh\n> > @@ -6,6 +6,18 @@\n> > #\n> > # Generate an RSA private key to sign IPA modules\n>\n> This comment needs to be updated.\nOK\n\n\n>\n> >\n> > -key=\"$1\"\n> > +algo=\"$1\"\n> > +key=\"$2\"\n> >\n> > -openssl genpkey -algorithm RSA -out \"${key}\" -pkeyopt rsa_keygen_bits:2048\n> > +# Two possible algorithms: RSA and ML-DSA-65\n> > +# openssl genpkey -algorithm RSA -out \"${key}\" -pkeyopt rsa_keygen_bits:2048\n> > +# openssl genpkey -algorithm ML-DSA-65 -out \"${key}\"\n> > +\n> > +if [ \"$algo\" = \"RSA\" ]; then\n> > + openssl genpkey -algorithm RSA -out \"${key}\" -pkeyopt rsa_keygen_bits:2048\n>\n> According to the openssl-genpkey manpage, 2048 is the default, so maybe\n> you could drop the option and simplify the code.\nYes, the default value is 2048 if we don't specify a value. I'll drop it.\n\n>\n> > +elif [ \"$algo\" = \"ML-DSA-65\" ]; then\n> > + openssl genpkey -algorithm ML-DSA-65 -out \"${key}\"\n> > +else\n> > + echo \"Invalid algorithm: $algo\"\n> > + exit 1\n> > +fi\n>\n> One issue I ran into when testing the series is that changing the value\n> of the ipa-signature-algo option doesn't regenerate the key.\n\nI found this too. I'll rename the remove ${key}\".old and rename\n${key}\" to ${key}\".old before running the command.\n\n>\n> > \\ No newline at end of file\n\nI'll drop the line.\n\n>\n> --\n> Regards,\n>\n> Laurent Pinchart\n>","headers":{"Return-Path":"","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id 299EFC3261\n\tfor ;\n\tThu, 18 Jun 2026 06:13:53 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id D352B6297C;\n\tThu, 18 Jun 2026 08:13:51 +0200 (CEST)","from us-smtp-delivery-124.mimecast.com\n\t(us-smtp-delivery-124.mimecast.com [170.10.129.124])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id D4AD3623CC\n\tfor ;\n\tThu, 18 Jun 2026 08:13:50 +0200 (CEST)","from mail-oa1-f71.google.com (mail-oa1-f71.google.com\n\t[209.85.160.71]) by relay.mimecast.com with ESMTP with STARTTLS\n\t(version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id\n\tus-mta-93-ecd62JS0Mcqy0IeEMuy50Q-1; Thu, 18 Jun 2026 02:13:45 -0400","by mail-oa1-f71.google.com with SMTP id\n\t586e51a60fabf-43d1691d2f2so3083885fac.0\n\tfor ;\n\tWed, 17 Jun 2026 23:13:45 -0700 (PDT)"],"Authentication-Results":"lancelot.ideasonboard.com; dkim=pass (1024-bit key;\n\tunprotected) header.d=redhat.com header.i=@redhat.com\n\theader.b=\"Ihnc2QM2\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com;\n\ts=mimecast20190719; t=1781763229;\n\th=from:from:reply-to:subject:subject:date:date:message-id:message-id:\n\tto:to:cc:cc:mime-version:mime-version:content-type:content-type:\n\tcontent-transfer-encoding:content-transfer-encoding:\n\tin-reply-to:in-reply-to:references:references;\n\tbh=6v4C87UphKLljRf3bcmiqPcs7d1iW52XYRiVL6BfgoY=;\n\tb=Ihnc2QM2KF4QRaZYnY32SLOAA5NWSUq7BreMyhwM23/pYJHGk8OTOukvt00SjXjsDpfVMO\n\tY7eLApFHo/vRSN97R22CYacRNtcE7qbmcsI55zgp32w6r7Y4PMaY61a8thmheBxomSBbzw\n\tZXJD0Dem3LYFo9pHIfVcduIfGliBMJk=","X-MC-Unique":"ecd62JS0Mcqy0IeEMuy50Q-1","X-Mimecast-MFC-AGG-ID":"ecd62JS0Mcqy0IeEMuy50Q_1781763225","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20251104; t=1781763225; x=1782368025;\n\th=content-transfer-encoding:cc:to:subject:message-id:date:from\n\t:in-reply-to:references:mime-version:x-gm-gg:x-gm-message-state:from\n\t:to:cc:subject:date:message-id:reply-to;\n\tbh=6v4C87UphKLljRf3bcmiqPcs7d1iW52XYRiVL6BfgoY=;\n\tb=jMvv38Zqh5O5zKv17u0/iDGNkg3eQ9j3P17fvHusLhv9B4qlTfm+gkS77fSLBK2Q1z\n\tknh7tnZfNx8wBgGzJkpEd74XdcSyXIBMbYxZzumPCpQSzp59zzf5BJ4gjf0ZI+rSW5Oo\n\tiNJsNvXT+bC9FHAjll5pQyDJY0cTB0Y+ZnnMRUWxygfB86VMzLiSNjnkCIO/MPJokLI+\n\tAe1OuRvnWGvtsCJJ/spVE0D8WGH+A77E6aJMpUGMFRxvKWCJWSNxNhUTpWN5DwTiYkdT\n\tnkQwiN1YqZ4PiWs+QF9rwZ1Izd1XW9ygXJ9sPcwcS84FcvRuPlXX25zrDRoEuZWoqAQa\n\tz/TA==","X-Gm-Message-State":"AOJu0YwE4p1n004fKx76RdLszgbPUeKtLwntBpxnKb03dJyOnVaLbLZ4\n\tPU357O+jN7dRcAe3YjDAsE5i4qg40JA+6LFtx62okZJKJaqmxNsYar7rartdw3DbMlr2GfWq0YP\n\t2dlQLYz8jqyW7K51EJz1jv7/yipwM7Lz9JNW5ZIbGF5s75kUdtqQlGrUaGRP5UdT4A8pUsZhuOI\n\tFu87187MZMpUdNVpi8xgF6BHA60H+6oxUYqo0nxhi7pO3K07vv+A==","X-Gm-Gg":"AfdE7ckA+TiUxBHOGS2PBKbwxfskMbny62jfp4bYSjKElRBZ7WHEwpYmhdJNKfPXBXH\n\tEdeddMoIujABsfpaaIW12w4dAnRA61+zCUANVe0UIgymtYWW3gBJ0Zvy0QYkQCLxoIwHLJvCeZM\n\tLM+29AvhK0jc+2MilU0bIQ289Ls3IXpTyK1OMx3zdmzrf3w2T6zt49V0zBS45KQF40mBE=","X-Received":["by 2002:a05:6870:1747:b0:440:2737:cb75 with SMTP id\n\t586e51a60fabf-446dd61ef26mr1976890fac.17.1781763224799; \n\tWed, 17 Jun 2026 23:13:44 -0700 (PDT)","by 2002:a05:6870:1747:b0:440:2737:cb75 with SMTP id\n\t586e51a60fabf-446dd61ef26mr1976870fac.17.1781763224306;\n\tWed, 17 Jun 2026 23:13:44 -0700 (PDT)"],"MIME-Version":"1.0","References":"<20260519030020.408693-1-hpa@redhat.com>\n\t<20260519030020.408693-5-hpa@redhat.com>\n\t<20260615151016.GE2849765@killaraus.ideasonboard.com>","In-Reply-To":"<20260615151016.GE2849765@killaraus.ideasonboard.com>","From":"Kate Hsuan ","Date":"Thu, 18 Jun 2026 14:13:32 +0800","X-Gm-Features":"AVVi8Cd3iGR1RWFVgqWPrBb2cz1vLS0esU0Ui9HlHR-aexyCgXX7VrgtrmOX47E","Message-ID":"","Subject":"Re: [PATCH v3 4/4] meson: Add ipa-signature-algo option","To":"Laurent Pinchart ","Cc":"libcamera-devel@lists.libcamera.org, =?utf-8?b?QmFybmFiw6FzIFDFkWN6?=\n\t=?utf-8?q?e?= , Kieran Bingham\n\t","X-Mimecast-Spam-Score":"0","X-Mimecast-MFC-PROC-ID":"tdQV5wbtI6ViOay-PXzmKElzBHmYq2h0XfYPbPidKwI_1781763225","X-Mimecast-Originator":"redhat.com","Content-Type":"text/plain; charset=\"UTF-8\"","Content-Transfer-Encoding":"quoted-printable","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" "}},{"id":39169,"web_url":"https://patchwork.libcamera.org/comment/39169/","msgid":"","date":"2026-06-18T06:36:56","subject":"Re: [PATCH v3 4/4] meson: Add ipa-signature-algo option","submitter":{"id":105,"url":"https://patchwork.libcamera.org/api/people/105/","name":"Kate Hsuan","email":"hpa@redhat.com"},"content":"Hi Laurent,\n\nOn Mon, Jun 15, 2026 at 11:44 PM Laurent Pinchart\n wrote:\n>\n> On Mon, Jun 15, 2026 at 05:09:40PM +0200, Barnabás Pőcze wrote:\n> > 2026. 05. 19. 5:00 keltezéssel, Kate Hsuan írta:\n> > > Add a combo type \"ipa-signature-algo\" meson option to select signature\n> > > algorithms, including rsa-sha256 and ml-dsa-65.\n> > > ras-sha256 is the default setting for now.\n> > >\n> > > Signed-off-by: Kate Hsuan \n> > > ---\n> > > meson_options.txt | 8 ++++++++\n> > > src/libcamera/meson.build | 6 ++++++\n> > > src/meson.build | 14 +++++++++++---\n> > > utils/gen-ipa-priv-key.sh | 16 ++++++++++++++--\n> > > 4 files changed, 39 insertions(+), 5 deletions(-)\n> > >\n> > > diff --git a/meson_options.txt b/meson_options.txt\n> > > index 20baacc4..18488e6b 100644\n> > > --- a/meson_options.txt\n> > > +++ b/meson_options.txt\n> > > @@ -46,6 +46,14 @@ option('gstreamer',\n> > > value : 'auto',\n> > > description : 'Compile libcamera GStreamer plugin')\n> > >\n> > > +option('ipa-signature-algo',\n> > > + type : 'combo',\n> > > + choices : [\n> > > + 'rsa-sha256',\n> > > + 'ml-dsa-65',\n> > > + ],\n> > > + description : 'Select a signature algorithm to sign IPA libraries.')\n> > > +\n> > > option('ipas',\n> > > type : 'array',\n> > > choices : ['ipu3', 'mali-c55', 'rkisp1', 'rpi/pisp', 'rpi/vc4', 'simple',\n> > > diff --git a/src/libcamera/meson.build b/src/libcamera/meson.build\n> > > index 575408b2..55ba6c6d 100644\n> > > --- a/src/libcamera/meson.build\n> > > +++ b/src/libcamera/meson.build\n> > > @@ -97,6 +97,12 @@ else\n> > > endif\n> > > endif\n> > >\n> > > +# comply with FIPS 204\n> > > +signature_algo = get_option('ipa-signature-algo')\n> > > +if signature_algo == 'ml-dsa-65'\n> > > + config_h.set('WITH_PQC', 1)\n> > > +endif\n> > > +\n> > > if not libcrypto.found()\n> > > warning('Neither gnutls nor libcrypto found, all IPA modules will be isolated')\n> > > summary({'IPA modules signed with': 'None (modules will run isolated)'},\n> > > diff --git a/src/meson.build b/src/meson.build\n> > > index 9b63c8e8..7f8909b1 100644\n> > > --- a/src/meson.build\n> > > +++ b/src/meson.build\n> > > @@ -15,11 +15,19 @@ summary({\n> > > }, section : 'Paths')\n> > >\n> > > # Module Signing\n> > > +signature_algo = get_option('ipa-signature-algo')\n> > > openssl = find_program('openssl', required : false)\n> > > if openssl.found()\n> > > - ipa_priv_key = custom_target('ipa-priv-key',\n> > > - output : ['ipa-priv-key.pem'],\n> > > - command : [gen_ipa_priv_key, '@OUTPUT@'])\n> > > + if signature_algo == 'ml-dsa-65'\n> > > + ipa_priv_key = custom_target('ipa-priv-key',\n> > > + output : ['ipa-priv-key.pem'],\n> > > + command : [gen_ipa_priv_key, 'ML-DSA-65', '@OUTPUT@'])\n> > > + endif\n> > > + if signature_algo == 'rsa-sha256'\n> > > + ipa_priv_key = custom_target('ipa-priv-key',\n> > > + output : ['ipa-priv-key.pem'],\n> > > + command : [gen_ipa_priv_key, 'RSA', '@OUTPUT@'])\n> >\n> > Why not just pass `signature_algo`? There is already a conditional chain in the script.\n> >\n> > But to be honest, I feel like I would actually remove the script altogether and\n> > have something like this:\n> >\n> > SIGNATURE_DETAILS = {\n> > 'rsa-sha256': { 'algo': 'RSA', 'args': [ '-pkeyopt rsa_keygen_bits:2048', ], }\n> > ...\n> > }\n> >\n> > signature_details = SIGNATURE_DETAILS[signature_algo]\n> >\n> > ipa_priv_key = custom_target('ipa-priv-key',\n> > output : ['ipa-priv-key.pem'],\n> > command : [ openssl, 'genpkey',\n> > '-algorithm', signature_details.get('algo'),\n> > '-out', '@OUTPUT@',\n> > ] + signature_details.get('args', []))\n> >\n> > This also fixes the (mostly theoretical) issue of using the wrong `openssl` when the\n> > `openssl` program is overridden in meson but not in $PATH.\n> >\n> > Any reason I'm missing why this extra script is useful?\n>\n> Not that I know of.\n>\n> On a related note, do we need a nice error message when ml-dsa-65 is\n> selected but not available, or is the error output by openssl good\n> enough ? I don't have an old version available here for testing.\n\nI may run the command \"openssl list -signature-algorithms |grep\nsignature_algo\" to list and check the available algorithms.\nIf the algorithm is not supported, drop an error message to the\nconsole. That makes the output of \"meson setup\" much friendlier. :)\n\n>\n> > > + endif\n> > > config_h.set('HAVE_IPA_PUBKEY', 1)\n> > > ipa_sign_module = true\n> > > else\n> > > diff --git a/utils/gen-ipa-priv-key.sh b/utils/gen-ipa-priv-key.sh\n> > > index 2ca7b883..8b86dfb3 100755\n> > > --- a/utils/gen-ipa-priv-key.sh\n> > > +++ b/utils/gen-ipa-priv-key.sh\n> > > @@ -6,6 +6,18 @@\n> > > #\n> > > # Generate an RSA private key to sign IPA modules\n> > >\n> > > -key=\"$1\"\n> > > +algo=\"$1\"\n> > > +key=\"$2\"\n> > >\n> > > -openssl genpkey -algorithm RSA -out \"${key}\" -pkeyopt rsa_keygen_bits:2048\n> > > +# Two possible algorithms: RSA and ML-DSA-65\n> > > +# openssl genpkey -algorithm RSA -out \"${key}\" -pkeyopt rsa_keygen_bits:2048\n> > > +# openssl genpkey -algorithm ML-DSA-65 -out \"${key}\"\n> > > +\n> > > +if [ \"$algo\" = \"RSA\" ]; then\n> > > + openssl genpkey -algorithm RSA -out \"${key}\" -pkeyopt rsa_keygen_bits:2048\n> > > +elif [ \"$algo\" = \"ML-DSA-65\" ]; then\n> > > + openssl genpkey -algorithm ML-DSA-65 -out \"${key}\"\n> > > +else\n> > > + echo \"Invalid algorithm: $algo\"\n> > > + exit 1\n> > > +fi\n> > > \\ No newline at end of file\n>\n> --\n> Regards,\n>\n> Laurent Pinchart\n>","headers":{"Return-Path":"","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id 62357BF415\n\tfor ;\n\tThu, 18 Jun 2026 06:37:15 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id 35FBE62986;\n\tThu, 18 Jun 2026 08:37:14 +0200 (CEST)","from us-smtp-delivery-124.mimecast.com\n\t(us-smtp-delivery-124.mimecast.com [170.10.133.124])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id 8F453623CC\n\tfor ;\n\tThu, 18 Jun 2026 08:37:12 +0200 (CEST)","from mail-oo1-f71.google.com (mail-oo1-f71.google.com\n\t[209.85.161.71]) by relay.mimecast.com with ESMTP with STARTTLS\n\t(version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id\n\tus-mta-672-7sNYwSGzN4e9g4txD1iUtg-1; Thu, 18 Jun 2026 02:37:09 -0400","by mail-oo1-f71.google.com with SMTP id\n\t006d021491bc7-69e47dbf2a7so1971807eaf.1\n\tfor ;\n\tWed, 17 Jun 2026 23:37:09 -0700 (PDT)"],"Authentication-Results":"lancelot.ideasonboard.com; dkim=pass (1024-bit key;\n\tunprotected) header.d=redhat.com header.i=@redhat.com\n\theader.b=\"NRjF6uTy\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com;\n\ts=mimecast20190719; t=1781764631;\n\th=from:from:reply-to:subject:subject:date:date:message-id:message-id:\n\tto:to:cc:cc:mime-version:mime-version:content-type:content-type:\n\tcontent-transfer-encoding:content-transfer-encoding:\n\tin-reply-to:in-reply-to:references:references;\n\tbh=BOEm5MKTal3fmI64Cac6cYXad1LAD/VOPc+xMI0YqUs=;\n\tb=NRjF6uTy/E9wZOYVJk18pDEfmlOHTYLrvDcAwpslZpXyHVd1g/8IAE/pBoJy+vHJclEbJU\n\tRDa8oU24250ZD1fujll2WmdZICS6uT4rKYFAHi2MccVPP0X9dR9948172wee0cRZq4JcU7\n\tv66SE31Il1kt6IUnbHIB9mdcnMvaLFk=","X-MC-Unique":"7sNYwSGzN4e9g4txD1iUtg-1","X-Mimecast-MFC-AGG-ID":"7sNYwSGzN4e9g4txD1iUtg_1781764629","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20251104; t=1781764629; x=1782369429;\n\th=content-transfer-encoding:cc:to:subject:message-id:date:from\n\t:in-reply-to:references:mime-version:x-gm-gg:x-gm-message-state:from\n\t:to:cc:subject:date:message-id:reply-to;\n\tbh=BOEm5MKTal3fmI64Cac6cYXad1LAD/VOPc+xMI0YqUs=;\n\tb=fRDNsSE0M63vJA+jesp3NnzM9ghmtU60hcFAI23rBB8aXSYO5VuoalFbi3J1/Efk6K\n\tg5BI0934kxIbL2CLbc4PbtSi7sCMez/9oLWH90Yk4QxSntONEJ6Ij/ZH6x98adaK++PP\n\tzNzyYaU4x4u9uLLxh8Cjtdlf6v/xcG0+TwERSYwx1oSzf+PKDVH5WOrTWzgz/Rs/38D6\n\tTsz0UTvnw7eLpcDs4grSs93Dh97DzNU547AwLhY4bzLCcLCE89fBbrcEWHAnXCvGWZH/\n\teosB4mLpaOjaqhETLMwaUZM7EJyxnZD/3zFE2zOGvKQRJ14zsVLLFa9PzNnhEKVVyb4p\n\txODw==","X-Forwarded-Encrypted":"i=1;\n\tAFNElJ87Yqb0VisfoL9CKy+SINkrgnZndEU/jIlXCpoWCzfa+ruyXiBAHOJp4sMiqJADrCUBX5pr35ZvVG3D/nFUva0=@lists.libcamera.org","X-Gm-Message-State":"AOJu0YxJ6Ifo8NxJMIoj21RXKaVZx5FRcNDZArqeh9URhr+SGjPO6FZn\n\tISaeHJu8lIf2YX2sbykN49HtBSZMMc5/wN0Pv6N1I+agQ4CcSEs+SxTCgyZunabE68vCNLwDwjn\n\tMChc6RmtEtIk3AF3UluOI+tB5AcSs26NVrzbwAjoyH8+KW/lj/2Vbl1JfUk7hMVZRgodnEuIca/\n\tiWulaJO+WMkctvC6jSRb+4WR1Jt/W9HwmP5vWmijBBV/UODyMQBA==","X-Gm-Gg":"Acq92OEjmu9fsb4ZN9hIBBVNqjkhvfCNsfqsO0z9cRmra3WexrGy5Hm0Gw4VnEagQ0B\n\t4+5oIoOPNKMcc8GK0E0DqU6JfxWMm7PXB/WNG7eLOqNlYupSnvDbivyBF9gqNwD1AIXrwkN+RG6\n\tAA7YDe+MzT+BHeHYQO6ZNeDFPnGaJr6UPVKpbsuxH7ToZFeBXV68V9uSLyEDSxv7Q1Y5w=","X-Received":["by 2002:a05:6820:c89:b0:69d:f964:928c with SMTP id\n\t006d021491bc7-6a0c73796b2mr1554403eaf.19.1781764629054; \n\tWed, 17 Jun 2026 23:37:09 -0700 (PDT)","by 2002:a05:6820:c89:b0:69d:f964:928c with SMTP id\n\t006d021491bc7-6a0c73796b2mr1554379eaf.19.1781764628118;\n\tWed, 17 Jun 2026 23:37:08 -0700 (PDT)"],"MIME-Version":"1.0","References":"<20260519030020.408693-1-hpa@redhat.com>\n\t\n\t<20260519030020.408693-5-hpa@redhat.com>\n\t<7c73a950-b859-4ed7-b975-93af47c7abb4@ideasonboard.com>\n\t<20260615154405.GG2849765@killaraus.ideasonboard.com>","In-Reply-To":"<20260615154405.GG2849765@killaraus.ideasonboard.com>","From":"Kate Hsuan ","Date":"Thu, 18 Jun 2026 14:36:56 +0800","X-Gm-Features":"AVVi8CdeVOKbo-UtYWa0eRg9t-RNh7PDxPbWiP8dBQmkrKePbl8CPX3ycztAkNk","Message-ID":"","Subject":"Re: [PATCH v3 4/4] meson: Add ipa-signature-algo option","To":"Laurent Pinchart ","Cc":"=?utf-8?q?Barnab=C3=A1s_P=C5=91cze?= ,\n\tKieran Bingham , \n\tlibcamera-devel@lists.libcamera.org","X-Mimecast-Spam-Score":"0","X-Mimecast-MFC-PROC-ID":"pVZMTACIk_bwJWOiQLoXYo10VZ2XRnmRb2jM4P7yCWI_1781764629","X-Mimecast-Originator":"redhat.com","Content-Type":"text/plain; charset=\"UTF-8\"","Content-Transfer-Encoding":"quoted-printable","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"","List-Unsubscribe":",\n\t","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n\t","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" "}}]