summaryrefslogtreecommitdiff
path: root/tools/cert_create
Commit message (Collapse)AuthorAgeFilesLines
* fix(cert-create): change WARN to VERBOSElaurenw-arm2023-02-091-1/+1
| | | | | | | | | | SAVE_KEYS is set to '0' by default, causing cert_create to show the 'Key filename not specified' message on each run even though this is perfectly normal. Show the message only in the VERBOSE log level. Signed-off-by: Baruch Siach <baruch@tkos.co.il> Change-Id: I472cdec2670055ab0edd99d172f79d01ad575972
* feat(cert-create): update for ECDSA brainpoolP256r/t1 supportLionel Debieve2022-11-143-12/+55
| | | | | | | | | Updated cert_tool to be able to select brainpool P256r/t1 or NIST prim256v1 curve for certificates signature. Change-Id: I6e800144697069ea83660053b8ba6e21c229243a Signed-off-by: Nicolas Toromanoff <nicolas.toromanoff@st.com> Signed-off-by: Lionel Debieve <lionel.debieve@foss.st.com>
* refactor(security): add OpenSSL 1.x compatibilityJuan Pablo Conde2022-11-119-39/+199
| | | | | | | | | | | | | | | | | | | | | | | | When updated to work with OpenSSL 3.0, the host tools lost their compatibility with previous versions (1.x) of OpenSSL. This is mainly due to the fact that 1.x APIs became deprecated in 3.0 and therefore their use cause compiling errors. In addition, updating for a newer version of OpenSSL meant improving the stability against security threats. However, although version 1.1.1 is now deprecated, it still receives security updates, so it would not imply major security issues to keep compatibility with it too. This patch adds backwards compatibility with OpenSSL 1.x versions by adding back 1.x API code. It defines a macro USING_OPENSSL3, which will select the appropriate OpenSSL API version depending on the OpenSSL library path chosen (which is determined by the already-existing OPENSSL_DIR variable). In addition, cleanup items were packed in functions and moved to the proper modules in order to make the code more maintainable and legible. Signed-off-by: Juan Pablo Conde <juanpablo.conde@arm.com> Change-Id: I8deceb5e419edc73277792861882404790ccd33c
* feat(cert_create): define the cca chain of trustlaurenw-arm2022-06-144-0/+519
| | | | | | | | | | Selection of the cca chain of trust is done through the COT build option: > make COT=cca Signed-off-by: Lauren Wehrmeister <lauren.wehrmeister@arm.com> Change-Id: I123c0a841f67434633a3123cc1fa3e2318585482
* refactor(security): upgrade tools to OpenSSL 3.0Juan Pablo Conde2022-05-164-78/+64
| | | | | | | | | | | | | | | | | | | | | | | Host tools cert_tool and encrypt_fw refactored to be fully compatible with OpenSSL v3.0. Changes were made following the OpenSSL 3.0 migration guide: https://www.openssl.org/docs/man3.0/man7/migration_guide.html In some cases, those changes are straightforward and only a small modification on the types or API calls was needed (e.g.: replacing BN_pseudo_rand() with BN_rand(). Both identical since v1.1.0). The use of low level APIs is now deprecated. In some cases, the new API provides a simplified solution for our goals and therefore the code was simplified accordingly (e.g.: generating RSA keys through EVP_RSA_gen() without the need of handling the exponent). However, in some cases, a more sophisticated approach was necessary, as the use of a context object was required (e.g.: when retrieving the digest value from an SHA file). Signed-off-by: Juan Pablo Conde <juanpablo.conde@arm.com> Change-Id: I978e8578fe7ab3e71307450ebe7e7812fbcaedb6
* cert_create: updated tool for platform defined certs, keys & extensionsPankaj Gupta2021-03-247-20/+131
| | | | | | | | | | | | | | | | | Changes to 'tools/cert_create' folder, to include platform defined certificates, keys, and extensions. NXP SoC lx2160a : based platforms requires additional FIP DDR to be loaded before initializing the DDR. To enable chain of trust on these platforms, FIP DDR image needs to be authenticated, additionally. Platform specific folder 'tools/nxp/cert_create_helper' is added to support platform specific macros and definitions. Signed-off-by: Pankaj Gupta <pankaj.gupta@nxp.com> Change-Id: I4752a30a9ff3aa1d403e9babe3a07ba0e6b2bf8f
* Merge "tools: cert_create: Create only requested certificates" into integrationSandrine Bailleux2021-01-281-1/+6
|\
| * tools: cert_create: Create only requested certificatesManish V Badarkhe2021-01-271-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | The certification tool creates all the certificates mentioned statically in the code rather than taking explicit certificate requests from the command line parameters. Code is optimized to avoid unnecessary attempts to create non-requested certificates. Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com> Change-Id: I78feac25bc701bf8f08c6aa5a2e1590bec92d0f2
* | Merge "cert-tool: avoid duplicates in extension stack" into integrationLauren Wehrmeister2021-01-271-3/+8
|\ \ | |/ |/|
| * cert-tool: avoid duplicates in extension stackJimmy Brisson2021-01-271-3/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This bug manifests itself as a segfault triggered by a double-free. I noticed that right before the double-free, the sk list contained 2 elements with the same address. (gdb) p sk_X509_EXTENSION_value(sk, 1) $34 = (X509_EXTENSION *) 0x431ad0 (gdb) p sk_X509_EXTENSION_value(sk, 0) $35 = (X509_EXTENSION *) 0x431ad0 (gdb) p sk_X509_EXTENSION_num(sk) $36 = 2 This caused confusion; this should never happen. I figured that this was caused by a ext_new_xxxx function freeing something before it is added to the list, so I put a breakpoint on each of them to step through. I was suprised to find that none of my breakpoints triggered for the second element of the iteration through the outer loop just before the double-free. Looking through the code, I noticed that it's possible to avoid doing a ext_new_xxxx, when either: * ext->type == NVCOUNTER and ext->arg == NULL * ext->type == HASH and ext->arg == NULL and ext->optional == false So I put a breakpoint on both. It turns out that it was the HASH version, but I added a fix for both. The fix for the Hash case is simple, as it was a mistake. The fix for the NVCOUNTER case, however, is a bit more subtle. The NVCOUNTER may be optional, and when it's optional we can skip it. The other case, when the NVCOUNTER is required (not optinal), the `check_cmd_params` function has already verified that the `ext->arg` must be non-NULL. We assert that before processing it to covert any possible segfaults into more descriptive errors. This should no longer cause double-frees by adding the same ext twice. Change-Id: Idae2a24ecd964b0a3929e6193c7f85ec769f6470 Signed-off-by: Jimmy Brisson <jimmy.brisson@arm.com>
* | Merge changes from topic "certtool-memleak" into integrationSandrine Bailleux2021-01-152-26/+50
|\ \ | | | | | | | | | | | | | | | | | | | | | * changes: Use preallocated parts of the HASH struct Free arguments copied with strdup Free keys after use Free X509_EXTENSIONs
| * | Use preallocated parts of the HASH structJimmy Brisson2020-10-201-26/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When OpenSSL's macro allocates the HASH struct, it allocates the fields as well. After this allocation, the prior code would assign over the pointers inside the HASH struct, leaking these fields. This patch avoids allocating extra copies of these members. Change-Id: I50a38b0a04b52ec54d6388db0f694feb578d2818 Signed-off-by: Jimmy Brisson <jimmy.brisson@arm.com>
| * | Free arguments copied with strdupJimmy Brisson2020-10-201-0/+27
| | | | | | | | | | | | | | | Change-Id: I0ad9620145c2a9c4450b9bf20cd1f70c9db6593c Signed-off-by: Jimmy Brisson <jimmy.brisson@arm.com>
| * | Free keys after useJimmy Brisson2020-10-201-0/+7
| | | | | | | | | | | | | | | Change-Id: I16ba4420ffeb9aa439e0a09a1b34d2aba2e1eb6e Signed-off-by: Jimmy Brisson <jimmy.brisson@arm.com>
| * | Free X509_EXTENSIONsJimmy Brisson2020-10-201-0/+5
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | Previously, we would leak these extensions as they are not freed by the stack. An except from the `sk_TYPE_free` documentation: sk_TYPE_free() frees up the sk structure. It does not free up any elements of sk. After this call sk is no longer valid. The fix is to drain the stack and free its elements before freeing the stack. sk_TYPE_pop_free does this, so we use that instead. Change-Id: Ie70c302f9dda5af1a7243f163d36e99916ee639c Signed-off-by: Jimmy Brisson <jimmy.brisson@arm.com>
* | tools: don't clean when buildingRoss Burton2021-01-131-1/+1
|/ | | | | | | | | | | Don't depend on clean when building, as the user is capable of cleaning if required and this introduces a race where "all" depends on both the compile and the clean in parallel. It's quite possible for some of the compile to happen in parallel with the clean, which results in the link failing as objects just built are missing. Change-Id: I710711eea7483cafa13251c5d94ec693148bd001 Signed-off-by: Ross Burton <ross.burton@arm.com>
* tools: Set the tool's default binary nameManish V Badarkhe2020-09-071-0/+1
| | | | | | | | | | | | This patch: fafd3ec9c assumes that tools must build from the main makefile folder. This assumption leads to the error when somebody wants to build a tool from the tool's folder. Hence changes are done to provide the default binary name in the tool's makefile. Change-Id: Iae570a7f8d322151376b6feb19e739300eecc3fc Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
* tools: Get the tool's binary name from the main makefileManish V Badarkhe2020-08-231-2/+1
| | | | | | | | | | Currently, the tool's makefile override the tool's binary name which is already been defined in the main makefile. Hence fix is provided so that the tool's makefile get the tool's binary name from the main makefile instead of overriding it. Change-Id: I8af2bd391a96bba2dbcddef711338a94ebf5f038 Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
* cert_create: add Platform owned secure partitions supportManish Pandey2020-08-122-1/+17
| | | | | | | | | | | | | Add support to generate a certificate named "plat-sp-cert" for Secure Partitions(SP) owned by Platform. Earlier a single certificate file "sip-sp-cert" was generated which contained hash of all 8 SPs, with this change SPs are divided into two categories viz "SiP owned" and "Plat owned" containing 4 SPs each. Platform RoT key pair is used for signing. Signed-off-by: Manish Pandey <manish.pandey2@arm.com> Change-Id: I5bd493cfce4cf3fc14b87c8ed1045f633d0c92b6
* cert_tool: Update cert_tool for fw_config image supportManish V Badarkhe2020-06-245-7/+32
| | | | | | | | Updated cert_tool to add hash information of fw_config image into the existing "trusted boot fw" certificate. Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com> Change-Id: I720319225925806a2a9f50a1ac9c8a464be975f0
* cert_create: extend Secure partition support for tbbr CoTManish Pandey2020-06-114-0/+110
| | | | | | | | | with sha 0792dd7, support to generate certificate for Secure Partitions was added for dualroot CoT only, this patch extends this support for tbbr CoT. Signed-off-by: Manish Pandey <manish.pandey2@arm.com> Change-Id: I451c0333536dd1cbe17861d454bdb0dc7a17c63f
* cert_create: add SiP owned secure partitions supportManish Pandey2020-06-083-1/+113
| | | | | | | | | | | | | | | | | | | | | | | | | Add support to generate certificate "sip-sp-cert" for Secure Partitions(SP) owned by Silicon provider(SiP). To avoid deviation from TBBR specification the support is only added for dualroot CoT and not for TBBR CoT. A single certificate file is generated containing hash of individual packages. Maximum 8 secure partitions are supported. Following new options added to cert_tool: --sip-sp-cert --> SiP owned Secure Partition Content Certificate --sp-pkg1 --> Secure Partition Package1 file --sp-pkg2 ..... --sp-pkg8 Trusted world key pair is used for signing. Going forward, this feature can be extended for Platfrom owned Partitions, if required. Signed-off-by: Manish Pandey <manish.pandey2@arm.com> Change-Id: Ia6dfbc1447cfb41b1fcbd12cf2bf7b88f409bd8d
* cert_create: Define the dualroot CoTSandrine Bailleux2020-02-244-0/+535
| | | | | | | | | Selection of the chain of trust is done through the COT build option: > make COT=dualroot Change-Id: Id87c7a5116bdd13bdb29645ecf31d111ad094c1e Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
* cert_create: Remove references to TBBR in common codeSandrine Bailleux2020-01-292-5/+5
| | | | | | | | In preparation of supporting alternate chains of trust, reword comments and error messages that explicitly mentioned TBBR. Change-Id: I85a0b08e16d0cd82f3b767fcc092d1f20f45939f Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
* cert_create: Introduce COT build optionSandrine Bailleux2020-01-291-2/+7
| | | | | | | | | | | | | It allows to select the desired chain of trust. Right now, only the TBBR CoT is available. At this stage, this build option only affects the tool itself. It is not plugged into the rest of the build system yet. To use it: > make -C tools/cert_create COT=tbbr Change-Id: I4484418f76d3c7b330d8653c978499a181534dcd Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
* cert_create: Introduce TBBR CoT makefileSandrine Bailleux2020-01-292-28/+40
| | | | | | | | | Move all TBBR-specific stuff out of the tool's makefile into a sub-makefile. This will make it easier to define and select an alternate chain of trust in the future. Change-Id: I92e366a1999b74cf51127d1771b64b807cd94b29 Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
* cert_create: Remove some unused header files inclusionsSandrine Bailleux2020-01-143-24/+3
| | | | | | | | The chain of trust definitions are only needed in the part of the code dealing with the TBBR CoT (tbbr/* files). Change-Id: I6f9a86bba4a2d16313b6842a3ec85b7c951074bc Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
* Remove RSA PKCS#1 v1.5 support from cert_toolJustin Chadwell2019-09-125-14/+7
| | | | | | | | | | | | | | | | | Support for PKCS#1 v1.5 was deprecated in SHA 1001202 and fully removed in SHA fe199e3, however, cert_tool is still able to generate certificates in that form. This patch fully removes the ability for cert_tool to generate these certificates. Additionally, this patch also fixes a bug where the issuing certificate was a RSA and the issued certificate was EcDSA. In this case, the issued certificate would be signed using PKCS#1 v1.5 instead of RSAPSS per PKCS#1 v2.1, preventing TF-A from verifying the image signatures. Now that PKCS#1 v1.5 support is removed, all certificates that are signed with RSA now use the more modern padding scheme. Change-Id: Id87d7d915be594a1876a73080528d968e65c4e9a Signed-off-by: Justin Chadwell <justin.chadwell@arm.com>
* Add cert_create tool support for RSA key sizesJustin Chadwell2019-09-123-12/+75
| | | | | | | | | | cert_tool is now able to accept a command line option for specifying the key size. It now supports the following options: 1024, 2048 (default), 3072 and 4096. This is also modifiable by TFA using the build flag KEY_SIZE. Change-Id: Ifadecf84ade3763249ee8cc7123a8178f606f0e5 Signed-off-by: Justin Chadwell <justin.chadwell@arm.com>
* Reduce the number of memory leaks in cert_createJustin Chadwell2019-08-163-3/+5
| | | | | | | | | The valgrind checks for cert_create have not been run in a long while - as such there are a few memory leaks present. This patch fixes a few of the major ones reported by valgrind. However, a few do remain. Change-Id: Iab002fb2b0090043287d43fb54a4d18928c2ed85 Signed-off-by: Justin Chadwell <justin.chadwell@arm.com>
* tools: Remove unused cert_create definesPaul Beesley2019-03-121-4/+0
| | | | | Change-Id: Iea72ef9ba16325cbce07eea1a975d2a96eede274 Signed-off-by: Paul Beesley <paul.beesley@arm.com>
* Standardise header guards across codebaseAntonio Nino Diaz2018-11-089-27/+27
| | | | | | | | | | | | | | | | | | All identifiers, regardless of use, that start with two underscores are reserved. This means they can't be used in header guards. The style that this project is now to use the full name of the file in capital letters followed by 'H'. For example, for a file called "uart_example.h", the header guard is UART_EXAMPLE_H. The exceptions are files that are imported from other projects: - CryptoCell driver - dt-bindings folders - zlib headers Change-Id: I50561bf6c88b491ec440d0c8385c74650f3c106e Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
* tools: Make invocation of host compiler correctAntonio Nino Diaz2018-10-041-9/+9
| | | | | | | | | | | | | | HOSTCC should be used in any of the tools inside the tools/ directory instead of CC. That way it is possible to override both values from the command line when building the Trusted Firmware and the tools at the same time. Also, use HOSTCCFLAGS instead of CFLAGS. Also, instead of printing the strings CC and LD in the console during the compilation of the tools, HOSTCC and HOSTLD have to be used for clarity. This is how it is done in other projects like U-Boot or Linux. Change-Id: Icd6f74c31eb74cdd1c353583399ab19e173e293e Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>
* tools/cert_create: fix makefile to build build_msg.o by HOSTCCYing-Chun Liu (PaulLiu)2018-07-061-1/+1
| | | | | | | Previously build_msg.o is built by CC. It causes FTBFS when CC is not equal to HOSTCC. Signed-off-by: Ying-Chun Liu (PaulLiu) <paulliu@debian.org>
* make_cert: return error when invalid options are usedRoberto Vargas2018-06-271-3/+1
| | | | | | | | | Print_help was used in different contexts and returning no error in that function was hiding the error when incorrect options were used. Change-Id: Ic3f71748be7ff8440c9d54810b986e9f177f4439 Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>
* Dynamic cfg: Enable support on CoT for other configsSoby Mathew2018-05-184-7/+43
| | | | | | | | | | This patch implements support for adding dynamic configurations for BL31 (soc_fw_config), BL32 (tos_fw_config) and BL33 (nt_fw_config). The necessary cert tool support and changes to default chain of trust are made for these configs. Change-Id: I25f266277b5b5501a196d2f2f79639d838794518 Signed-off-by: Soby Mathew <soby.mathew@arm.com>
* cert_create: fix makefile to remove executable on 'make realclean'Jonathan Wright2018-04-301-1/+1
| | | | | | | | Spurious whitespace existed in the BINARY shell variable which meant the cert_tool executable was not being removed on 'make realclean'. Change-Id: Ibfd2fd17889514f6613e33c6df58d53b9232ec14 Signed-off-by: Jonathan Wright <jonathan.wright@arm.com>
* Change PLATFORM_ROOT to TF_PLATFORM_ROOTHeyi Guo2018-03-051-1/+1
| | | | | | | | Since we use "?=" to set PLATFORM_ROOT, it is better to change the name to be more special, or else it may be overridden by some environment variables, such as in some CI build environments. Signed-off-by: Heyi Guo <heyi.guo@linaro.org>
* Dynamic cfg: Update the toolsSoby Mathew2018-02-263-5/+29
| | | | | | | | | | | | | This patch updates the `fiptool` and `cert_create` for the `hw_config` and `tb_fw_config` dynamic configuration files. The necessary UUIDs and OIDs are assigned to these files and the `cert_create` is updated to generate appropriate hashes and include them in the "Trusted Boot FW Certificate". The `fiptool` is updated to allow the configs to be specified via cmdline and included in the generated FIP. Change-Id: I940e751a49621ae681d14e162aa1f5697eb0cb15 Signed-off-by: Soby Mathew <soby.mathew@arm.com>
* tools: add an option -hash-alg for cert_createQixiang Xu2017-11-216-23/+112
| | | | | | | | | | | | This option enables the user to select the secure hash algorithm to be used for generating the hash. It supports the following options: - sha256 (default) - sha384 - sha512 Change-Id: Icb093cec1b5715e248c3d1c3749a2479a7ab4b89 Signed-off-by: Qixiang Xu <qixiang.xu@arm.com>
* Merge pull request #1120 from ↵davidcunado-arm2017-10-114-9/+32
|\ | | | | | | | | michpappas/tf-issues#521_cert_tool_does_not_build_with_openssl_v1.1 cert_tool: update for compatibility with OpenSSL v1.1
| * cert_tool: update for compatibility with OpenSSL v1.1Michalis Pappas2017-10-084-9/+32
| | | | | | | | | | | | | | | | | | | | This patch fixes incompatibility issues that prevent building the cert_tool with OpenSSL >= v1.1.0. The changes introduced are still backwards compatible with OpenSSL v1.0.2. Fixes arm-software/trusted-fw#521 Signed-off-by: Michalis Pappas <mpappas@fastmail.fm>
* | cert_tool: Fix ECDSA certificates create failureQixiang Xu2017-10-091-2/+3
|/ | | | | | | | | | | | | Commit a8eb286adaa73e86305317b9cae15d41c57de8e7 introduced the following error when creating ECDSA certificates. ERROR: Error creating key 'Trusted World key' Makefile:634: recipe for target 'certificates' failed make: *** [certificates] Error 1 this patch adds the function to create PKCS#1 v1.5. Change-Id: Ief96d55969d5e9877aeb528c6bb503b560563537 Signed-off-by: Qixiang Xu <qixiang.xu@arm.com>
* Set default value of USE_TBBR_DEFSSoby Mathew2017-09-111-0/+1
| | | | | | | | | | | | Using the OIDs defined in tbbr_oids.h is the recommended way to build the cert_create tool. This patch hence sets default value of the build flag USE_TBBR_DEFS to 1 in the Makefile in `tools/cert_create` folder when cert_create is built from this folder. Fixes ARM-software/tf-issues#482 Change-Id: Id1d224826b3417770bccbefa1b68d9bdb3b567f0 Signed-off-by: Soby Mathew <soby.mathew@arm.com>
* cert_tool: Support for legacy RSA PKCS#1 v1.5Soby Mathew2017-08-314-18/+29
| | | | | | | | | | | | | | | | This patch enables choice of RSA version at run time to be used for generating signatures by the cert_tool. The RSA PSS as defined in PKCS#1 v2.1 becomes the default version and this patch enables to specify the RSA PKCS#1 v1.5 algorithm to `cert_create` through the command line -a option. Also, the build option `KEY_ALG` can be used to pass this option from the build system. Please note that RSA PSS is mandated by Trusted Board Boot requirements (TBBR) and legacy RSA support is being added for compatibility reasons. Fixes ARM-Software/tf-issues#499 Change-Id: Ifaa3f2f7c9b43f3d7b3effe2cde76bf6745a5d73 Co-Authored-By: Eleanor Bonnici <Eleanor.bonnici@arm.com> Signed-off-by: Soby Mathew <soby.mathew@arm.com>
* Support Trusted OS firmware extra images in TF toolsSummer Qin2017-08-093-4/+28
| | | | | | | | | | | Since Trusted OS firmware may have extra images, need to assign new uuid and image id for them. The TBBR chain of trust has been extended to add support for the new images within the existing Trusted OS firmware content certificate. Change-Id: I678dac7ba1137e85c5779b05e0c4331134c10e06 Signed-off-by: Summer Qin <summer.qin@arm.com>
* Fix order of #includesIsla Mitchell2017-07-124-4/+4
| | | | | | | | | | This fix modifies the order of system includes to meet the ARM TF coding standard. There are some exceptions in order to retain header groupings, minimise changes to imported headers, and where there are headers within the #if and #ifndef statements. Change-Id: I65085a142ba6a83792b26efb47df1329153f1624 Signed-off-by: Isla Mitchell <isla.mitchell@arm.com>
* tools: Use exported quiet flag from top-level Makefiledp-arm2017-06-121-3/+3
| | | | | | | | When V is set from the command line, the value is passed to the tools' Makefiles as well. Change-Id: I91a1f66de5c1ae6f36b6c9f0a9bd550d4a30f092 Signed-off-by: dp-arm <dimitris.papastamos@arm.com>
* cert_create: Use RSASSA-PSS signature scheme for certificatesSoby Mathew2017-06-051-6/+34
| | | | | | | | | | | | | This patch modifies the `cert_create` tool to use RSASSA-PSS scheme for signing the certificates. This is compliant with RSA PKCS_2_1 standard as mandated by TBBR. Note that the certificates generated by using cert_create tool after this patch can be authenticated during TBB only if the corresponding mbedtls driver in ARM Trusted Firmware has the corresponding support. Change-Id: If224f41c76b3c4765ae2af5259e67f73602818a4 Signed-off-by: Soby Mathew <soby.mathew@arm.com>
* build: Introduce HOSTCC flagdp-arm2017-05-241-3/+3
| | | | | | | | Tools are built using the compiler specified in `HOSTCC` instead of reusing the `CC` variable. By default, gcc is used. Change-Id: I83636a375c61f4804b4e80784db9d061fe20af87 Signed-off-by: dp-arm <dimitris.papastamos@arm.com>
View Lorry Controller Status