[{"id":39543,"web_url":"https://patchwork.libcamera.org/comment/39543/","msgid":"<459cfd13-dbb1-43c1-a8a6-d969af35ebf3@ideasonboard.com>","date":"2026-07-01T08:55:56","subject":"Re: [PATCH v4 4/4] meson: Add ipa-signature-algo option","submitter":{"id":216,"url":"https://patchwork.libcamera.org/api/people/216/","name":"Barnabás Pőcze","email":"barnabas.pocze@ideasonboard.com"},"content":"2026. 07. 01. 6:07 keltezéssel, Kate Hsuan írta:\n> Add a combo type \"ipa-signature-algo\" meson option to select signature\n> algorithms, including rsa-sha256 and ml-dsa-65.\n> ras-sha256 is the default setting for now.\n> \n> Signed-off-by: Kate Hsuan <hpa@redhat.com>\n> ---\n>   meson_options.txt         |  8 ++++++++\n>   src/libcamera/meson.build | 11 +++++++++++\n>   src/meson.build           |  6 +++++-\n>   utils/check-algo.sh       | 35 +++++++++++++++++++++++++++++++++++\n>   utils/gen-ipa-priv-key.sh | 21 ++++++++++++++++++---\n>   5 files changed, 77 insertions(+), 4 deletions(-)\n>   create mode 100755 utils/check-algo.sh\n> \n> diff --git a/meson_options.txt b/meson_options.txt\n> index 20baacc4..18488e6b 100644\n> --- a/meson_options.txt\n> +++ b/meson_options.txt\n> @@ -46,6 +46,14 @@ option('gstreamer',\n>           value : 'auto',\n>           description : 'Compile libcamera GStreamer plugin')\n>   \n> +option('ipa-signature-algo',\n> +        type : 'combo',\n> +        choices : [\n> +            'rsa-sha256',\n> +            'ml-dsa-65',\n> +        ],\n> +        description : 'Select a signature algorithm to sign IPA libraries.')\n> +\n>   option('ipas',\n>           type : 'array',\n>           choices : ['ipu3', 'mali-c55', 'rkisp1', 'rpi/pisp', 'rpi/vc4', 'simple',\n> diff --git a/src/libcamera/meson.build b/src/libcamera/meson.build\n> index 575408b2..cabd1041 100644\n> --- a/src/libcamera/meson.build\n> +++ b/src/libcamera/meson.build\n> @@ -89,14 +89,25 @@ libyaml = dependency('yaml-0.1', default_options : [\n>   # Use one of gnutls or libcrypto (provided by OpenSSL), trying gnutls first.\n>   libcrypto = dependency('gnutls', required : false)\n>   if libcrypto.found()\n> +    r = run_command('../../utils/check-algo.sh', 'guntls', get_option('ipa-signature-algo'), check: false)\n> +    if r.returncode() != 0\n> +        error('Unsupported signature algorithm (', 'guntls,', get_option('ipa-signature-algo'), ')')\n> +    endif\n>       config_h.set('HAVE_GNUTLS', 1)\n>   else\n>       libcrypto = dependency('libcrypto', required : false)\n>       if libcrypto.found()\n> +            r = run_command('../../utils/check-algo.sh', 'openssl',  get_option('ipa-signature-algo'), check: false)\n> +            if r.returncode() != 0\n> +                error('Unsupported signature algorithm. (', 'libcrypto,', get_option('ipa-signature-algo'), ')')\n> +            endif\n>           config_h.set('HAVE_CRYPTO', 1)\n>       endif\n>   endif\n>   \n> +# comply with FIPS 204\n> +config_h.set('IPA_MODULE_DIR_SIGNATURE_ALGO', '\"' + get_option('ipa-signature-algo') + '\"')\n> +\n>   if not libcrypto.found()\n>       warning('Neither gnutls nor libcrypto found, all IPA modules will be isolated')\n>       summary({'IPA modules signed with': 'None (modules will run isolated)'},\n> diff --git a/src/meson.build b/src/meson.build\n> index 9b63c8e8..4111f591 100644\n> --- a/src/meson.build\n> +++ b/src/meson.build\n> @@ -19,7 +19,11 @@ openssl = find_program('openssl', required : false)\n>   if openssl.found()\n>       ipa_priv_key = custom_target('ipa-priv-key',\n>                                    output : ['ipa-priv-key.pem'],\n> -                                 command : [gen_ipa_priv_key, '@OUTPUT@'])\n> +                                 command : [\n> +                                    gen_ipa_priv_key,\n> +                                    get_option('ipa-signature-algo'),\n> +                                    '@OUTPUT@'\n> +                                 ])\n>       config_h.set('HAVE_IPA_PUBKEY', 1)\n>       ipa_sign_module = true\n>   else\n> diff --git a/utils/check-algo.sh b/utils/check-algo.sh\n> new file mode 100755\n> index 00000000..2ee6c7cb\n> --- /dev/null\n> +++ b/utils/check-algo.sh\n> @@ -0,0 +1,35 @@\n> +#!/bin/sh\n> +# SPDX-License-Identifier: GPL-2.0-or-later\n> +# Copyright (C) 2026, Red Hat Inc.\n> +#\n> +# Author: Kate Hsuan <hpa@redhat.com>\n> +#\n> +# Check if the given algorithm is supported by the library\n> +\n> +tool=\"$1\"\n> +algo=\"$2\"\n> +\n> +if [ \"$algo\" = \"rsa-sha256\" ]; then\n> +    algo=\"RSA-SHA256\"\n> +elif [ \"$algo\" = \"ml-dsa-65\" ]; then\n> +    algo=\"ML-DSA-65\"\n> +else\n> +    echo \"Invalid algorithm: $algo\"\n> +    exit 1\n> +fi\n> +\n> +if [ \"$tool\" = \"guntls\" ]; then\n> +    gnutls-cli -l | grep \"$algo\" > /dev/null\n> +    ret=$?\n> +elif [ \"$tool\" = \"openssl\" ]; then\n> +    openssl list -signature-algorithms |grep ${algo} > /dev/null\n\nUnfortunately the version in debian 11 does not support this option.\nThis will be dropped in August in any case, so probably not a big issue.\n\n$ podman run --rm -it registry.freedesktop.org/camera/libcamera/debian/bullseye:2026-04-05.0\nroot@3302aa618c1e:/app# openssl list -help\nUsage: list [options]\nValid options are:\n  -help                   Display this summary\n  -1                      List in one column\n  -commands               List of standard commands\n  -digest-commands        List of message digest commands\n  -digest-algorithms      List of message digest algorithms\n  -cipher-commands        List of cipher commands\n  -cipher-algorithms      List of cipher algorithms\n  -public-key-algorithms  List of public key algorithms\n  -public-key-methods     List of public key methods\n  -disabled               List of disabled features\n  -missing-help           List missing detailed help strings\n  -options val            List options for specified command\n\nBut the debian 12 also fails the check:\n\n$ podman run --rm -it registry.freedesktop.org/camera/libcamera/debian/bookworm:2026-04-05.0\nroot@a3962e2aab7f:/app# openssl list -signature-algorithms\n   { 1.2.840.113549.1.1.1, 2.5.8.1.1, RSA, rsaEncryption } @ default\n   { 1.2.840.10040.4.1, 1.2.840.10040.4.3, 1.3.14.3.2.12, 1.3.14.3.2.13, 1.3.14.3.2.27, DSA, DSA-old, DSA-SHA, DSA-SHA1, DSA-SHA1-old, dsaEncryption, dsaEncryption-old, dsaWithSHA, dsaWithSHA1, dsaWithSHA1-old } @ default\n   { 1.3.101.112, ED25519 } @ default\n   { 1.3.101.113, ED448 } @ default\n   { 1.2.156.10197.1.301, SM2 } @ default\n   ECDSA @ default\n   HMAC @ default\n   SIPHASH @ default\n   POLY1305 @ default\n   CMAC @ default\n\n\n> +    ret=$?\n> +else\n> +    echo \"Invalid tool: $tool\"\n> +    exit 1\n> +fi\n> +\n> +if [ $ret -ne 0 ]; then\n> +    echo \"Algorithm $algo is not supported by $tool\"\n> +    exit 1\n> +fi\n> diff --git a/utils/gen-ipa-priv-key.sh b/utils/gen-ipa-priv-key.sh\n> index 2ca7b883..3fc44bcc 100755\n> --- a/utils/gen-ipa-priv-key.sh\n> +++ b/utils/gen-ipa-priv-key.sh\n> @@ -4,8 +4,23 @@\n>   #\n>   # Author: Laurent Pinchart <laurent.pinchart@ideasonboard.com>\n>   #\n> -# Generate an RSA private key to sign IPA modules\n> +# Generate an private key for the given algorithm to sign IPA modules\n>   \n> -key=\"$1\"\n> +algo=\"$1\"\n> +key=\"$2\"\n>   \n> -openssl genpkey -algorithm RSA -out \"${key}\" -pkeyopt rsa_keygen_bits:2048\n> +if [ -e \"${key}\" ]; then\n> +    echo \"File ${key} already exists. Removing it.\"\n> +    rm \"${key}\"\n> +fi\n> +\n> +# Two possible algorithms: RSA and ML-DSA-65\n> +\n> +if [ \"$algo\" = \"rsa-sha256\" ]; then\n> +    openssl genpkey -algorithm RSA -out \"${key}\"\n> +elif [ \"$algo\" = \"ml-dsa-65\" ]; then\n> +    openssl genpkey -algorithm ML-DSA-65 -out \"${key}\"\n> +else\n> +    echo \"Invalid algorithm: $algo\"\n> +    exit 1\n> +fi","headers":{"Return-Path":"<libcamera-devel-bounces@lists.libcamera.org>","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id 4594BC3264\n\tfor <parsemail@patchwork.libcamera.org>;\n\tWed,  1 Jul 2026 08:56:03 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id 4941B65F9D;\n\tWed,  1 Jul 2026 10:56:02 +0200 (CEST)","from perceval.ideasonboard.com (perceval.ideasonboard.com\n\t[IPv6:2001:4b98:dc2:55:216:3eff:fef7:d647])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id 8BD4E65BB8\n\tfor <libcamera-devel@lists.libcamera.org>;\n\tWed,  1 Jul 2026 10:56:00 +0200 (CEST)","from [192.168.33.33] (185.221.140.128.nat.pool.zt.hu\n\t[185.221.140.128])\n\tby perceval.ideasonboard.com (Postfix) with ESMTPSA id 8C6EBE91;\n\tWed,  1 Jul 2026 10:55:15 +0200 (CEST)"],"Authentication-Results":"lancelot.ideasonboard.com; dkim=pass (1024-bit key;\n\tunprotected) header.d=ideasonboard.com header.i=@ideasonboard.com\n\theader.b=\"qA8Zvsg9\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com;\n\ts=mail; t=1782896115;\n\tbh=Dde9hGUmErgR25fAd7SWz5Bho5kZH6XK407bkj0ucwU=;\n\th=Date:Subject:To:References:From:In-Reply-To:From;\n\tb=qA8Zvsg9iHQHWYIMMn9WVI92ZMKXKF4+3vP6+vcQ7QUHZJyEmk5yEY6Z+1ofe7lyi\n\tPvgEajCrsS/by770/43IH7YODp3MnAnbX+3Yhe2Yxozw2TGshdaA2FHh5oRjw37/Zq\n\t0Zu636bN9PYRVAN8Ocw6sZm17IL42NXZfm3M6Xgg=","Message-ID":"<459cfd13-dbb1-43c1-a8a6-d969af35ebf3@ideasonboard.com>","Date":"Wed, 1 Jul 2026 10:55:56 +0200","MIME-Version":"1.0","User-Agent":"Mozilla Thunderbird","Subject":"Re: [PATCH v4 4/4] meson: Add ipa-signature-algo option","To":"Kate Hsuan <hpa@redhat.com>, libcamera-devel@lists.libcamera.org,\n\tKieran Bingham <kieran.bingham@ideasonboard.com>,\n\tLaurent Pinchart <laurent.pinchart@ideasonboard.com>","References":"<20260701040721.145659-1-hpa@redhat.com>\n\t<20260701040721.145659-5-hpa@redhat.com>","From":"=?utf-8?q?Barnab=C3=A1s_P=C5=91cze?= <barnabas.pocze@ideasonboard.com>","Content-Language":"en-US, hu-HU","In-Reply-To":"<20260701040721.145659-5-hpa@redhat.com>","Content-Type":"text/plain; charset=UTF-8; format=flowed","Content-Transfer-Encoding":"8bit","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"<libcamera-devel.lists.libcamera.org>","List-Unsubscribe":"<https://lists.libcamera.org/options/libcamera-devel>,\n\t<mailto:libcamera-devel-request@lists.libcamera.org?subject=unsubscribe>","List-Archive":"<https://lists.libcamera.org/pipermail/libcamera-devel/>","List-Post":"<mailto:libcamera-devel@lists.libcamera.org>","List-Help":"<mailto:libcamera-devel-request@lists.libcamera.org?subject=help>","List-Subscribe":"<https://lists.libcamera.org/listinfo/libcamera-devel>,\n\t<mailto:libcamera-devel-request@lists.libcamera.org?subject=subscribe>","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" <libcamera-devel-bounces@lists.libcamera.org>"}},{"id":39552,"web_url":"https://patchwork.libcamera.org/comment/39552/","msgid":"<20260701144221.GE3433808@killaraus.ideasonboard.com>","date":"2026-07-01T14:42:21","subject":"Re: [PATCH v4 4/4] meson: Add ipa-signature-algo option","submitter":{"id":2,"url":"https://patchwork.libcamera.org/api/people/2/","name":"Laurent Pinchart","email":"laurent.pinchart@ideasonboard.com"},"content":"On Wed, Jul 01, 2026 at 12:07:21PM +0800, Kate Hsuan wrote:\n> Add a combo type \"ipa-signature-algo\" meson option to select signature\n> algorithms, including rsa-sha256 and ml-dsa-65.\n> ras-sha256 is the default setting for now.\n> \n> Signed-off-by: Kate Hsuan <hpa@redhat.com>\n> ---\n>  meson_options.txt         |  8 ++++++++\n>  src/libcamera/meson.build | 11 +++++++++++\n>  src/meson.build           |  6 +++++-\n>  utils/check-algo.sh       | 35 +++++++++++++++++++++++++++++++++++\n>  utils/gen-ipa-priv-key.sh | 21 ++++++++++++++++++---\n>  5 files changed, 77 insertions(+), 4 deletions(-)\n>  create mode 100755 utils/check-algo.sh\n> \n> diff --git a/meson_options.txt b/meson_options.txt\n> index 20baacc4..18488e6b 100644\n> --- a/meson_options.txt\n> +++ b/meson_options.txt\n> @@ -46,6 +46,14 @@ option('gstreamer',\n>          value : 'auto',\n>          description : 'Compile libcamera GStreamer plugin')\n>  \n> +option('ipa-signature-algo',\n> +        type : 'combo',\n> +        choices : [\n> +            'rsa-sha256',\n> +            'ml-dsa-65',\n> +        ],\n> +        description : 'Select a signature algorithm to sign IPA libraries.')\n> +\n>  option('ipas',\n>          type : 'array',\n>          choices : ['ipu3', 'mali-c55', 'rkisp1', 'rpi/pisp', 'rpi/vc4', 'simple',\n> diff --git a/src/libcamera/meson.build b/src/libcamera/meson.build\n> index 575408b2..cabd1041 100644\n> --- a/src/libcamera/meson.build\n> +++ b/src/libcamera/meson.build\n> @@ -89,14 +89,25 @@ libyaml = dependency('yaml-0.1', default_options : [\n>  # Use one of gnutls or libcrypto (provided by OpenSSL), trying gnutls first.\n>  libcrypto = dependency('gnutls', required : false)\n>  if libcrypto.found()\n> +    r = run_command('../../utils/check-algo.sh', 'guntls', get_option('ipa-signature-algo'), check: false)\n\nWrap check-algo.sh in a files() call in utils/meson.build and use it\nhere.\n\ns/guntls/gnutls/\n\n> +    if r.returncode() != 0\n> +        error('Unsupported signature algorithm (', 'guntls,', get_option('ipa-signature-algo'), ')')\n> +    endif\n>      config_h.set('HAVE_GNUTLS', 1)\n>  else\n>      libcrypto = dependency('libcrypto', required : false)\n>      if libcrypto.found()\n> +            r = run_command('../../utils/check-algo.sh', 'openssl',  get_option('ipa-signature-algo'), check: false)\n> +            if r.returncode() != 0\n> +                error('Unsupported signature algorithm. (', 'libcrypto,', get_option('ipa-signature-algo'), ')')\n> +            endif\n>          config_h.set('HAVE_CRYPTO', 1)\n>      endif\n>  endif\n\nIt would be nice to avoid code duplication.\n\nlibcrypto = dependency('gnutls', required : false)\nif libcrypto.found()\n    crypto_library = 'gnutls'\n    config_h.set('HAVE_GNUTLS', 1)\nelse\n    libcrypto = dependency('libcrypto', required : false)\n    if libcrypto.found()\n        crypto_library = 'openssl'\n        config_h.set('HAVE_CRYPTO', 1)\n    endif\nendif\n\nif libcrypto.found()\n    ipa_signature_algo = get_option('ipa-signature-algo')\n\n    r = run_command(check_algo, crypto_library, ipa_signature_algo, check : false)\n    if r.returncode() != 0\n        error('Unsupported signature @0@ algorithm in @1@'\n\t      .format(ipa_signature_algo, crypto_library))\n    endif\n\n    config_h.set('IPA_MODULE_DIR_SIGNATURE_ALGO', '\"' + ipa_signature_algo + '\"')\nendif\n\n\n>  \n> +# comply with FIPS 204\n\ns/comply/Comply/\n\n> +config_h.set('IPA_MODULE_DIR_SIGNATURE_ALGO', '\"' + get_option('ipa-signature-algo') + '\"')\n\nThis change seems unrelated to this patch.\n\n> +\n>  if not libcrypto.found()\n>      warning('Neither gnutls nor libcrypto found, all IPA modules will be isolated')\n>      summary({'IPA modules signed with': 'None (modules will run isolated)'},\n> diff --git a/src/meson.build b/src/meson.build\n> index 9b63c8e8..4111f591 100644\n> --- a/src/meson.build\n> +++ b/src/meson.build\n> @@ -19,7 +19,11 @@ openssl = find_program('openssl', required : false)\n>  if openssl.found()\n>      ipa_priv_key = custom_target('ipa-priv-key',\n>                                   output : ['ipa-priv-key.pem'],\n> -                                 command : [gen_ipa_priv_key, '@OUTPUT@'])\n> +                                 command : [\n> +                                    gen_ipa_priv_key,\n> +                                    get_option('ipa-signature-algo'),\n> +                                    '@OUTPUT@'\n> +                                 ])\n>      config_h.set('HAVE_IPA_PUBKEY', 1)\n>      ipa_sign_module = true\n>  else\n> diff --git a/utils/check-algo.sh b/utils/check-algo.sh\n> new file mode 100755\n> index 00000000..2ee6c7cb\n> --- /dev/null\n> +++ b/utils/check-algo.sh\n> @@ -0,0 +1,35 @@\n> +#!/bin/sh\n> +# SPDX-License-Identifier: GPL-2.0-or-later\n> +# Copyright (C) 2026, Red Hat Inc.\n> +#\n> +# Author: Kate Hsuan <hpa@redhat.com>\n> +#\n> +# Check if the given algorithm is supported by the library\n> +\n> +tool=\"$1\"\n> +algo=\"$2\"\n> +\n> +if [ \"$algo\" = \"rsa-sha256\" ]; then\n> +    algo=\"RSA-SHA256\"\n> +elif [ \"$algo\" = \"ml-dsa-65\" ]; then\n> +    algo=\"ML-DSA-65\"\n> +else\n> +    echo \"Invalid algorithm: $algo\"\n> +    exit 1\n> +fi\n\nalgo=$(echo $algo | tr '[:lower:]' '[:upper:]')\n\nshould also work and be simpler.\n\n> +\n> +if [ \"$tool\" = \"guntls\" ]; then\n> +    gnutls-cli -l | grep \"$algo\" > /dev/null\n> +    ret=$?\n> +elif [ \"$tool\" = \"openssl\" ]; then\n> +    openssl list -signature-algorithms |grep ${algo} > /dev/null\n\ns/grep/ grep/\n\n> +    ret=$?\n> +else\n> +    echo \"Invalid tool: $tool\"\n> +    exit 1\n> +fi\n> +\n> +if [ $ret -ne 0 ]; then\n> +    echo \"Algorithm $algo is not supported by $tool\"\n> +    exit 1\n> +fi\n> diff --git a/utils/gen-ipa-priv-key.sh b/utils/gen-ipa-priv-key.sh\n> index 2ca7b883..3fc44bcc 100755\n> --- a/utils/gen-ipa-priv-key.sh\n> +++ b/utils/gen-ipa-priv-key.sh\n> @@ -4,8 +4,23 @@\n>  #\n>  # Author: Laurent Pinchart <laurent.pinchart@ideasonboard.com>\n>  #\n> -# Generate an RSA private key to sign IPA modules\n> +# Generate an private key for the given algorithm to sign IPA modules\n\ns/an private/a private/\n\n>  \n> -key=\"$1\"\n> +algo=\"$1\"\n> +key=\"$2\"\n>  \n> -openssl genpkey -algorithm RSA -out \"${key}\" -pkeyopt rsa_keygen_bits:2048\n> +if [ -e \"${key}\" ]; then\n> +    echo \"File ${key} already exists. Removing it.\"\n> +    rm \"${key}\"\n> +fi\n\nWhy so ? openssl seems to overwrite the key if it exists.\n\n> +\n> +# Two possible algorithms: RSA and ML-DSA-65\n> +\n> +if [ \"$algo\" = \"rsa-sha256\" ]; then\n> +    openssl genpkey -algorithm RSA -out \"${key}\"\n> +elif [ \"$algo\" = \"ml-dsa-65\" ]; then\n> +    openssl genpkey -algorithm ML-DSA-65 -out \"${key}\"\n> +else\n> +    echo \"Invalid algorithm: $algo\"\n> +    exit 1\n> +fi","headers":{"Return-Path":"<libcamera-devel-bounces@lists.libcamera.org>","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id 4B9AFC3264\n\tfor <parsemail@patchwork.libcamera.org>;\n\tWed,  1 Jul 2026 14:42:26 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id 07DF565FAA;\n\tWed,  1 Jul 2026 16:42:25 +0200 (CEST)","from perceval.ideasonboard.com (perceval.ideasonboard.com\n\t[IPv6:2001:4b98:dc2:55:216:3eff:fef7:d647])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id A4EFA65FA2\n\tfor <libcamera-devel@lists.libcamera.org>;\n\tWed,  1 Jul 2026 16:42:23 +0200 (CEST)","from killaraus.ideasonboard.com\n\t(2001-14ba-70f3-e800--a06.rev.dnainternet.fi\n\t[IPv6:2001:14ba:70f3:e800::a06])\n\tby perceval.ideasonboard.com (Postfix) with ESMTPSA id 9751F8CB;\n\tWed,  1 Jul 2026 16:41:38 +0200 (CEST)"],"Authentication-Results":"lancelot.ideasonboard.com; dkim=pass (1024-bit key;\n\tunprotected) header.d=ideasonboard.com header.i=@ideasonboard.com\n\theader.b=\"Mxgmg7+W\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com;\n\ts=mail; t=1782916898;\n\tbh=Y54gEhMLRdgpFQAjdiytzfvn+5SQgAzGWEz6XiPVlfI=;\n\th=Date:From:To:Cc:Subject:References:In-Reply-To:From;\n\tb=Mxgmg7+WYDbz3xabNoT3OFnWahwbeoJibjKr/2tMnXrGc4zuFR+hR3zriYEZ6v7S5\n\tZNa0c7HFqGlOVzT8X17l8uvKjZRRdSYtLZB9ab7WzHIUb0y/sZTryrM7sWmVM07mEH\n\thg+mZWH+hI33A25u6ZBRg7/uy6SebxZovhabwwUA=","Date":"Wed, 1 Jul 2026 17:42:21 +0300","From":"Laurent Pinchart <laurent.pinchart@ideasonboard.com>","To":"Kate Hsuan <hpa@redhat.com>","Cc":"libcamera-devel@lists.libcamera.org, =?utf-8?b?QmFybmFiw6FzIFDFkWN6?=\n\t=?utf-8?q?e?= <barnabas.pocze@ideasonboard.com>, Kieran Bingham\n\t<kieran.bingham@ideasonboard.com>","Subject":"Re: [PATCH v4 4/4] meson: Add ipa-signature-algo option","Message-ID":"<20260701144221.GE3433808@killaraus.ideasonboard.com>","References":"<20260701040721.145659-1-hpa@redhat.com>\n\t<20260701040721.145659-5-hpa@redhat.com>","MIME-Version":"1.0","Content-Type":"text/plain; charset=utf-8","Content-Disposition":"inline","In-Reply-To":"<20260701040721.145659-5-hpa@redhat.com>","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"<libcamera-devel.lists.libcamera.org>","List-Unsubscribe":"<https://lists.libcamera.org/options/libcamera-devel>,\n\t<mailto:libcamera-devel-request@lists.libcamera.org?subject=unsubscribe>","List-Archive":"<https://lists.libcamera.org/pipermail/libcamera-devel/>","List-Post":"<mailto:libcamera-devel@lists.libcamera.org>","List-Help":"<mailto:libcamera-devel-request@lists.libcamera.org?subject=help>","List-Subscribe":"<https://lists.libcamera.org/listinfo/libcamera-devel>,\n\t<mailto:libcamera-devel-request@lists.libcamera.org?subject=subscribe>","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" <libcamera-devel-bounces@lists.libcamera.org>"}},{"id":39558,"web_url":"https://patchwork.libcamera.org/comment/39558/","msgid":"<CAEth8oFSbw4BdQfsyP_wAahHXk-chX6gY5iVJhhASXnSHPeXCQ@mail.gmail.com>","date":"2026-07-02T04:03:01","subject":"Re: [PATCH v4 4/4] meson: Add ipa-signature-algo option","submitter":{"id":105,"url":"https://patchwork.libcamera.org/api/people/105/","name":"Kate Hsuan","email":"hpa@redhat.com"},"content":"Hi Laurent,\n\nThank your for the review.\n\nOn Wed, Jul 1, 2026 at 10:42 AM Laurent Pinchart\n<laurent.pinchart@ideasonboard.com> wrote:\n>\n> On Wed, Jul 01, 2026 at 12:07:21PM +0800, Kate Hsuan wrote:\n> > Add a combo type \"ipa-signature-algo\" meson option to select signature\n> > algorithms, including rsa-sha256 and ml-dsa-65.\n> > ras-sha256 is the default setting for now.\n> >\n> > Signed-off-by: Kate Hsuan <hpa@redhat.com>\n> > ---\n> >  meson_options.txt         |  8 ++++++++\n> >  src/libcamera/meson.build | 11 +++++++++++\n> >  src/meson.build           |  6 +++++-\n> >  utils/check-algo.sh       | 35 +++++++++++++++++++++++++++++++++++\n> >  utils/gen-ipa-priv-key.sh | 21 ++++++++++++++++++---\n> >  5 files changed, 77 insertions(+), 4 deletions(-)\n> >  create mode 100755 utils/check-algo.sh\n> >\n> > diff --git a/meson_options.txt b/meson_options.txt\n> > index 20baacc4..18488e6b 100644\n> > --- a/meson_options.txt\n> > +++ b/meson_options.txt\n> > @@ -46,6 +46,14 @@ option('gstreamer',\n> >          value : 'auto',\n> >          description : 'Compile libcamera GStreamer plugin')\n> >\n> > +option('ipa-signature-algo',\n> > +        type : 'combo',\n> > +        choices : [\n> > +            'rsa-sha256',\n> > +            'ml-dsa-65',\n> > +        ],\n> > +        description : 'Select a signature algorithm to sign IPA libraries.')\n> > +\n> >  option('ipas',\n> >          type : 'array',\n> >          choices : ['ipu3', 'mali-c55', 'rkisp1', 'rpi/pisp', 'rpi/vc4', 'simple',\n> > diff --git a/src/libcamera/meson.build b/src/libcamera/meson.build\n> > index 575408b2..cabd1041 100644\n> > --- a/src/libcamera/meson.build\n> > +++ b/src/libcamera/meson.build\n> > @@ -89,14 +89,25 @@ libyaml = dependency('yaml-0.1', default_options : [\n> >  # Use one of gnutls or libcrypto (provided by OpenSSL), trying gnutls first.\n> >  libcrypto = dependency('gnutls', required : false)\n> >  if libcrypto.found()\n> > +    r = run_command('../../utils/check-algo.sh', 'guntls', get_option('ipa-signature-algo'), check: false)\n>\n> Wrap check-algo.sh in a files() call in utils/meson.build and use it\n> here.\nOkay.\n\n>\n> s/guntls/gnutls/\nops!\n\n>\n> > +    if r.returncode() != 0\n> > +        error('Unsupported signature algorithm (', 'guntls,', get_option('ipa-signature-algo'), ')')\n> > +    endif\n> >      config_h.set('HAVE_GNUTLS', 1)\n> >  else\n> >      libcrypto = dependency('libcrypto', required : false)\n> >      if libcrypto.found()\n> > +            r = run_command('../../utils/check-algo.sh', 'openssl',  get_option('ipa-signature-algo'), check: false)\n> > +            if r.returncode() != 0\n> > +                error('Unsupported signature algorithm. (', 'libcrypto,', get_option('ipa-signature-algo'), ')')\n> > +            endif\n> >          config_h.set('HAVE_CRYPTO', 1)\n> >      endif\n> >  endif\n>\n> It would be nice to avoid code duplication.\n>\n> libcrypto = dependency('gnutls', required : false)\n> if libcrypto.found()\n>     crypto_library = 'gnutls'\n>     config_h.set('HAVE_GNUTLS', 1)\n> else\n>     libcrypto = dependency('libcrypto', required : false)\n>     if libcrypto.found()\n>         crypto_library = 'openssl'\n>         config_h.set('HAVE_CRYPTO', 1)\n>     endif\n> endif\n>\n> if libcrypto.found()\n>     ipa_signature_algo = get_option('ipa-signature-algo')\n>\n>     r = run_command(check_algo, crypto_library, ipa_signature_algo, check : false)\n>     if r.returncode() != 0\n>         error('Unsupported signature @0@ algorithm in @1@'\n>               .format(ipa_signature_algo, crypto_library))\n>     endif\n>\n>     config_h.set('IPA_MODULE_DIR_SIGNATURE_ALGO', '\"' + ipa_signature_algo + '\"')\n> endif\n>\n>\nOkay.\n\n> >\n> > +# comply with FIPS 204\n>\n> s/comply/Comply/\n>\n> > +config_h.set('IPA_MODULE_DIR_SIGNATURE_ALGO', '\"' + get_option('ipa-signature-algo') + '\"')\n>\n> This change seems unrelated to this patch.\nI try to rearrange the order of the patches.\n\n>\n> > +\n> >  if not libcrypto.found()\n> >      warning('Neither gnutls nor libcrypto found, all IPA modules will be isolated')\n> >      summary({'IPA modules signed with': 'None (modules will run isolated)'},\n> > diff --git a/src/meson.build b/src/meson.build\n> > index 9b63c8e8..4111f591 100644\n> > --- a/src/meson.build\n> > +++ b/src/meson.build\n> > @@ -19,7 +19,11 @@ openssl = find_program('openssl', required : false)\n> >  if openssl.found()\n> >      ipa_priv_key = custom_target('ipa-priv-key',\n> >                                   output : ['ipa-priv-key.pem'],\n> > -                                 command : [gen_ipa_priv_key, '@OUTPUT@'])\n> > +                                 command : [\n> > +                                    gen_ipa_priv_key,\n> > +                                    get_option('ipa-signature-algo'),\n> > +                                    '@OUTPUT@'\n> > +                                 ])\n> >      config_h.set('HAVE_IPA_PUBKEY', 1)\n> >      ipa_sign_module = true\n> >  else\n> > diff --git a/utils/check-algo.sh b/utils/check-algo.sh\n> > new file mode 100755\n> > index 00000000..2ee6c7cb\n> > --- /dev/null\n> > +++ b/utils/check-algo.sh\n> > @@ -0,0 +1,35 @@\n> > +#!/bin/sh\n> > +# SPDX-License-Identifier: GPL-2.0-or-later\n> > +# Copyright (C) 2026, Red Hat Inc.\n> > +#\n> > +# Author: Kate Hsuan <hpa@redhat.com>\n> > +#\n> > +# Check if the given algorithm is supported by the library\n> > +\n> > +tool=\"$1\"\n> > +algo=\"$2\"\n> > +\n> > +if [ \"$algo\" = \"rsa-sha256\" ]; then\n> > +    algo=\"RSA-SHA256\"\n> > +elif [ \"$algo\" = \"ml-dsa-65\" ]; then\n> > +    algo=\"ML-DSA-65\"\n> > +else\n> > +    echo \"Invalid algorithm: $algo\"\n> > +    exit 1\n> > +fi\n>\n> algo=$(echo $algo | tr '[:lower:]' '[:upper:]')\n>\n> should also work and be simpler.\n>\n> > +\n> > +if [ \"$tool\" = \"guntls\" ]; then\n> > +    gnutls-cli -l | grep \"$algo\" > /dev/null\n> > +    ret=$?\n> > +elif [ \"$tool\" = \"openssl\" ]; then\n> > +    openssl list -signature-algorithms |grep ${algo} > /dev/null\n>\n> s/grep/ grep/\ngot it.\n\n>\n> > +    ret=$?\n> > +else\n> > +    echo \"Invalid tool: $tool\"\n> > +    exit 1\n> > +fi\n> > +\n> > +if [ $ret -ne 0 ]; then\n> > +    echo \"Algorithm $algo is not supported by $tool\"\n> > +    exit 1\n> > +fi\n> > diff --git a/utils/gen-ipa-priv-key.sh b/utils/gen-ipa-priv-key.sh\n> > index 2ca7b883..3fc44bcc 100755\n> > --- a/utils/gen-ipa-priv-key.sh\n> > +++ b/utils/gen-ipa-priv-key.sh\n> > @@ -4,8 +4,23 @@\n> >  #\n> >  # Author: Laurent Pinchart <laurent.pinchart@ideasonboard.com>\n> >  #\n> > -# Generate an RSA private key to sign IPA modules\n> > +# Generate an private key for the given algorithm to sign IPA modules\n>\n> s/an private/a private/\n\n\n>\n> >\n> > -key=\"$1\"\n> > +algo=\"$1\"\n> > +key=\"$2\"\n> >\n> > -openssl genpkey -algorithm RSA -out \"${key}\" -pkeyopt rsa_keygen_bits:2048\n> > +if [ -e \"${key}\" ]; then\n> > +    echo \"File ${key} already exists. Removing it.\"\n> > +    rm \"${key}\"\n> > +fi\n>\n> Why so ? openssl seems to overwrite the key if it exists.\nI found foo.pem and foo.pem.1 on my system but after manually testing\nit, it didn't happened again.\nI'll drop this section.\n\n\n>\n> > +\n> > +# Two possible algorithms: RSA and ML-DSA-65\n> > +\n> > +if [ \"$algo\" = \"rsa-sha256\" ]; then\n> > +    openssl genpkey -algorithm RSA -out \"${key}\"\n> > +elif [ \"$algo\" = \"ml-dsa-65\" ]; then\n> > +    openssl genpkey -algorithm ML-DSA-65 -out \"${key}\"\n> > +else\n> > +    echo \"Invalid algorithm: $algo\"\n> > +    exit 1\n> > +fi\n>\n> --\n> Regards,\n>\n> Laurent Pinchart\n>","headers":{"Return-Path":"<libcamera-devel-bounces@lists.libcamera.org>","X-Original-To":"parsemail@patchwork.libcamera.org","Delivered-To":"parsemail@patchwork.libcamera.org","Received":["from lancelot.ideasonboard.com (lancelot.ideasonboard.com\n\t[92.243.16.209])\n\tby patchwork.libcamera.org (Postfix) with ESMTPS id 250CBC3301\n\tfor <parsemail@patchwork.libcamera.org>;\n\tThu,  2 Jul 2026 04:03:21 +0000 (UTC)","from lancelot.ideasonboard.com (localhost [IPv6:::1])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTP id 381DD65FAD;\n\tThu,  2 Jul 2026 06:03:20 +0200 (CEST)","from us-smtp-delivery-124.mimecast.com\n\t(us-smtp-delivery-124.mimecast.com [170.10.129.124])\n\tby lancelot.ideasonboard.com (Postfix) with ESMTPS id D536E65F09\n\tfor <libcamera-devel@lists.libcamera.org>;\n\tThu,  2 Jul 2026 06:03:17 +0200 (CEST)","from mail-oo1-f70.google.com (mail-oo1-f70.google.com\n\t[209.85.161.70]) by relay.mimecast.com with ESMTP with STARTTLS\n\t(version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id\n\tus-mta-567-lXt5g5KJMjOWGEsAKQiOYw-1; Thu, 02 Jul 2026 00:03:14 -0400","by mail-oo1-f70.google.com with SMTP id\n\t006d021491bc7-6a18f3aba30so1699752eaf.1\n\tfor <libcamera-devel@lists.libcamera.org>;\n\tWed, 01 Jul 2026 21:03:14 -0700 (PDT)"],"Authentication-Results":"lancelot.ideasonboard.com; dkim=pass (1024-bit key;\n\tunprotected) header.d=redhat.com header.i=@redhat.com\n\theader.b=\"A59eosQw\"; dkim-atps=neutral","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com;\n\ts=mimecast20190719; t=1782964996;\n\th=from:from:reply-to:subject:subject:date:date:message-id:message-id:\n\tto:to:cc:cc:mime-version:mime-version:content-type:content-type:\n\tcontent-transfer-encoding:content-transfer-encoding:\n\tin-reply-to:in-reply-to:references:references;\n\tbh=fcct/TMAzEersmtv3vRTJfhpyMJFmJqcIKq9TivyN90=;\n\tb=A59eosQwmeapzIm64N/ZV1i4DweSCw7orHOQv6VfjLp3DU6Rf331bDi2VUoBiHluc0lHvH\n\tAWNLDHrYR47QuUS8h06QYDOLtyexHjv0TnupSRZGYrRCiN5sjDAiralmaTNQ9PhSvSjDrL\n\tYQO2+LnT1BJ4ruoynl2HNBBtl1UdKx4=","X-MC-Unique":"lXt5g5KJMjOWGEsAKQiOYw-1","X-Mimecast-MFC-AGG-ID":"lXt5g5KJMjOWGEsAKQiOYw_1782964994","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n\td=1e100.net; s=20251104; t=1782964994; x=1783569794;\n\th=content-transfer-encoding:cc:to:subject:message-id:date:from\n\t:in-reply-to:references:mime-version:x-gm-gg:x-gm-message-state:from\n\t:to:cc:subject:date:message-id:reply-to;\n\tbh=fcct/TMAzEersmtv3vRTJfhpyMJFmJqcIKq9TivyN90=;\n\tb=GhsKeXKsmKXM4qIW66c4uzcIR1CnP/aeSC2DMhLyfwnTeabkQs2Wf902zfWKrJSGjF\n\tX/kLnsB/M8O//i2JOWefGpv48abe5tgTB6wnZ4aC4r9oebi/b2nGl1Ysy+cEJgriQaI8\n\tBvkiIBR1CwfR7qD7BSNmfQXUvOMr0SiZYRCJ07K+hPLQWVTh45tAogU/m5JNSFvIqvj3\n\tHa8yLDOZQ222txLsvUHiWcpl0z4xvVh6L2+tkSvTdIuirwaZUDF9v3ROXKY7tscLNQ0n\n\tVkW9Nend3eOXVXkDMM1znh4XqdxsRD4T3Zwg1Oz9ib90QkuNJrRjkC1NuHc9aLYEqj4t\n\twByQ==","X-Gm-Message-State":"AOJu0YxPfT8iWX++zcSsEoJrrq8EXe2c5DGYkXRACZTpvIbNso6AodwC\n\td+wJwIXpNziJ4O+kiHRbjO9z2wV52SLOJYKy7d0nT/2VkLCSBVtxazuzOf+8jLowKRJ+XBqhhl0\n\tEbgr4kiCP3D7LU2dSBzz7Y/syp22+gCtsLfh9O30NV4npCqo9meVprYW4Hs36ITb7G5rU9HWRPk\n\twhRI8jStbcFhTd68sOcuRBR3Y6zxQTp9/WUy0jeF5ER0N180ijpg==","X-Gm-Gg":"AfdE7ck8rNI0ihEXEQlB040Inpu/HebQWp2f8cvAonCgSNoCqYoFY0hy7x2pNsoWrSB\n\tJK5gd6mAJaAIgqphiCLy9QeW2/FQsV2eATak/x6UZo/1Oki6fA7eLAhGeuHt8XkZiJvndXEKLNv\n\taR73z9bi6mAqv1+9UwMa1tI902ckk3Fb4UdYl/vW888N5lQhprYYXfdu3Au2ViKAGZBkA=","X-Received":["by 2002:a05:6820:188f:b0:6a1:1c1:dc85 with SMTP id\n\t006d021491bc7-6a3096f1a62mr2780457eaf.0.1782964993838; \n\tWed, 01 Jul 2026 21:03:13 -0700 (PDT)","by 2002:a05:6820:188f:b0:6a1:1c1:dc85 with SMTP id\n\t006d021491bc7-6a3096f1a62mr2780430eaf.0.1782964993114;\n\tWed, 01 Jul 2026 21:03:13 -0700 (PDT)"],"MIME-Version":"1.0","References":"<20260701040721.145659-1-hpa@redhat.com>\n\t<20260701040721.145659-5-hpa@redhat.com>\n\t<20260701144221.GE3433808@killaraus.ideasonboard.com>","In-Reply-To":"<20260701144221.GE3433808@killaraus.ideasonboard.com>","From":"Kate Hsuan <hpa@redhat.com>","Date":"Thu, 2 Jul 2026 00:03:01 -0400","X-Gm-Features":"AVVi8CcoEoaiAjGGmRVqDFBnuvkNkP6Q98xZWnW2-WMbL-zghcwKWIp6HyCfLHk","Message-ID":"<CAEth8oFSbw4BdQfsyP_wAahHXk-chX6gY5iVJhhASXnSHPeXCQ@mail.gmail.com>","Subject":"Re: [PATCH v4 4/4] meson: Add ipa-signature-algo option","To":"Laurent Pinchart <laurent.pinchart@ideasonboard.com>","Cc":"libcamera-devel@lists.libcamera.org, =?utf-8?b?QmFybmFiw6FzIFDFkWN6?=\n\t=?utf-8?q?e?= <barnabas.pocze@ideasonboard.com>, Kieran Bingham\n\t<kieran.bingham@ideasonboard.com>","X-Mimecast-Spam-Score":"0","X-Mimecast-MFC-PROC-ID":"AGqTEdAjcxEom9oAwAd_H3HPT_cL_WfU38vBCf1mS-E_1782964994","X-Mimecast-Originator":"redhat.com","Content-Type":"text/plain; charset=\"UTF-8\"","Content-Transfer-Encoding":"quoted-printable","X-BeenThere":"libcamera-devel@lists.libcamera.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"<libcamera-devel.lists.libcamera.org>","List-Unsubscribe":"<https://lists.libcamera.org/options/libcamera-devel>,\n\t<mailto:libcamera-devel-request@lists.libcamera.org?subject=unsubscribe>","List-Archive":"<https://lists.libcamera.org/pipermail/libcamera-devel/>","List-Post":"<mailto:libcamera-devel@lists.libcamera.org>","List-Help":"<mailto:libcamera-devel-request@lists.libcamera.org?subject=help>","List-Subscribe":"<https://lists.libcamera.org/listinfo/libcamera-devel>,\n\t<mailto:libcamera-devel-request@lists.libcamera.org?subject=subscribe>","Errors-To":"libcamera-devel-bounces@lists.libcamera.org","Sender":"\"libcamera-devel\" <libcamera-devel-bounces@lists.libcamera.org>"}}]