[PATCH v2 0/3] meta-tpm: Update python runtime dependencies

[PATCH v2 0/3] meta-tpm: Update python runtime dependencies

[Omri Sarig]

When adding the package of tpm2-pkcs11-tools to my Yocto build, the file
of pkcs11-tool failed to run.
There were several different errors, all originated in missing python
packages on my target platform.

I've added the relevant python packages as runtime dependencies to the
relevant recipes in the repository, to ensure that the recipes are
always self-contained.

Omri Sarig (3):
  tpm2-pytss: Add python3-asn1crypto runtime dependency
  tpm2-pkcs11: Add tools python runtime dependencies
  oeqa/cases/tpm2: Add tpm2-pkcs11-tools sanity test

 meta-tpm/lib/oeqa/runtime/cases/tpm2.py                      | 5 +++++
 meta-tpm/recipes-tpm2/tpm2-pkcs11/tpm2-pkcs11_1.9.1.bb       | 2 +-
 meta-tpm/recipes-tpm2/tpm2-pytss/python3-tpm2-pytss_2.3.0.bb | 2 +-
 3 files changed, 7 insertions(+), 2 deletions(-)

[PATCH v2 1/3] tpm2-pytss: Add python3-asn1crypto runtime dependency

[Omri Sarig]

The tpm2-pytss module is importing the module asn1crypto in tsskey.py,
however, the current bitbake recipe is not including this python package
as runtime dependency. This causes the module invocation to fail at the
moment.

The commit adds this dependency to the bitbake recipe, to make the
recipe self contained.

Signed-off-by: Omri Sarig <omri.sarig13@gmail.com>
---
 meta-tpm/recipes-tpm2/tpm2-pytss/python3-tpm2-pytss_2.3.0.bb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta-tpm/recipes-tpm2/tpm2-pytss/python3-tpm2-pytss_2.3.0.bb b/meta-tpm/recipes-tpm2/tpm2-pytss/python3-tpm2-pytss_2.3.0.bb
index 57e284b..4ddf287 100644
--- a/meta-tpm/recipes-tpm2/tpm2-pytss/python3-tpm2-pytss_2.3.0.bb
+++ b/meta-tpm/recipes-tpm2/tpm2-pytss/python3-tpm2-pytss_2.3.0.bb
@@ -18,4 +18,4 @@ DEPENDS = " \
     tpm2-tss \
 "
 
-RDEPENDS:${PN} = "libtss2"
+RDEPENDS:${PN} = "libtss2 python3-asn1crypto"

[PATCH v2 2/3] tpm2-pkcs11: Add tools python runtime dependencies

[Omri Sarig]

The tpm2-pkcs11-tools python module is importing several modules which
are not currently included in it's dependencies. This causes the script
invocation to fail. The current commit adds the relevant dependencies,
to ensure that the python module is always able to run.

The relevant dependencies are:
* python3-fcntl: To add the fcntl module, imported in db.py.
* python3-sqlite3: To add the sqlite3 module, imported in db.py.
* python3-tpm2-pytss: To add the tpm2_pytss module, imported in
  utils.py.
* python3-compression: To add the zipfile module, imported through
  "importlib.metadata import distribution" in tpm2_ptool.

Signed-off-by: Omri Sarig <omri.sarig13@gmail.com>
---
 meta-tpm/recipes-tpm2/tpm2-pkcs11/tpm2-pkcs11_1.9.1.bb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta-tpm/recipes-tpm2/tpm2-pkcs11/tpm2-pkcs11_1.9.1.bb b/meta-tpm/recipes-tpm2/tpm2-pkcs11/tpm2-pkcs11_1.9.1.bb
index a7d8170..331dc4f 100644
--- a/meta-tpm/recipes-tpm2/tpm2-pkcs11/tpm2-pkcs11_1.9.1.bb
+++ b/meta-tpm/recipes-tpm2/tpm2-pkcs11/tpm2-pkcs11_1.9.1.bb
@@ -44,6 +44,6 @@ FILES:${PN} += "\
 INSANE_SKIP:${PN}   += "dev-so"
 
 RDEPENDS:${PN} = "p11-kit tpm2-tools "
-RDEPENDS:${PN}-tools = "python3-pyyaml python3-cryptography python3-pyasn1-modules"
+RDEPENDS:${PN}-tools = "python3-pyyaml python3-cryptography python3-pyasn1-modules python3-compression python3-fcntl python3-sqlite3 python3-tpm2-pytss"
 
 BBCLASSEXTEND = "native nativesdk"

[PATCH v2 3/3] oeqa/cases/tpm2: Add tpm2-pkcs11-tools sanity test

[Omri Sarig]

Add a very simple sanity test, which ensures that tpm2_ptool can run
without problems when the relevant package is available.

This test case is available here to help prevent future errors, where
the tool is unable to run after installation, due to missing
dependencies for example.

Contrary to other tests in the file, this test does not communicate with
the TPM module itself, it only ensures that the tool (tpm2_ptool) can be
loaded without any errors. Therefore, we don't need to depend on
anything other than having the package installed.

Signed-off-by: Omri Sarig <omri.sarig13@gmail.com>
---
 meta-tpm/lib/oeqa/runtime/cases/tpm2.py | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/meta-tpm/lib/oeqa/runtime/cases/tpm2.py b/meta-tpm/lib/oeqa/runtime/cases/tpm2.py
index 8e90dc9..c2e6dfa 100644
--- a/meta-tpm/lib/oeqa/runtime/cases/tpm2.py
+++ b/meta-tpm/lib/oeqa/runtime/cases/tpm2.py
@@ -67,3 +67,8 @@ class Tpm2Test(OERuntimeTestCase):
     def test_tpm2_swtpm_reset(self):
          (status, output) = self.target.run('swtpm_ioctl -i --tcp :2322')
          self.assertEqual(status, 0, msg="swtpm reset failed: %s" % output)
+
+    @OEHasPackage(['tpm2-pkcs11-tools'])
+    def test_tpm2_pkcs11_tools(self):
+        (status, output) = self.target.run("tpm2_ptool --help")
+        self.assertEqual(status, 0, msg="Module cannot be run with error: %s" % output)

Re: [yocto-patches] [PATCH v2 3/3] oeqa/cases/tpm2: Add tpm2-pkcs11-tools sanity test

[Mikko Rapeli]

Hi,

On Wed, Mar 12, 2025 at 11:32:41AM +0100, Omri Sarig via lists.yoctoproject.org wrote:
> Add a very simple sanity test, which ensures that tpm2_ptool can run
> without problems when the relevant package is available.
> 
> This test case is available here to help prevent future errors, where
> the tool is unable to run after installation, due to missing
> dependencies for example.
> 
> Contrary to other tests in the file, this test does not communicate with
> the TPM module itself, it only ensures that the tool (tpm2_ptool) can be
> loaded without any errors. Therefore, we don't need to depend on
> anything other than having the package installed.
> 
> Signed-off-by: Omri Sarig <omri.sarig13@gmail.com>
> ---
>  meta-tpm/lib/oeqa/runtime/cases/tpm2.py | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/meta-tpm/lib/oeqa/runtime/cases/tpm2.py b/meta-tpm/lib/oeqa/runtime/cases/tpm2.py
> index 8e90dc9..c2e6dfa 100644
> --- a/meta-tpm/lib/oeqa/runtime/cases/tpm2.py
> +++ b/meta-tpm/lib/oeqa/runtime/cases/tpm2.py
> @@ -67,3 +67,8 @@ class Tpm2Test(OERuntimeTestCase):
>      def test_tpm2_swtpm_reset(self):
>           (status, output) = self.target.run('swtpm_ioctl -i --tcp :2322')
>           self.assertEqual(status, 0, msg="swtpm reset failed: %s" % output)
> +
> +    @OEHasPackage(['tpm2-pkcs11-tools'])
> +    def test_tpm2_pkcs11_tools(self):
> +        (status, output) = self.target.run("tpm2_ptool --help")
> +        self.assertEqual(status, 0, msg="Module cannot be run with error: %s" % output)

Thanks! This good to start with. I think it's a separate question now if
meta-tpm test images will include tpm2-pkcs11-tools and actually run
this test.

Cheers,

-Mikko

Re: [yocto-patches] [PATCH v2 3/3] oeqa/cases/tpm2: Add tpm2-pkcs11-tools sanity test

[Omri Sarig]

On 3/12/25 11:38, Mikko Rapeli wrote:
> Hi,

Thanks for the fast reply!

>
> On Wed, Mar 12, 2025 at 11:32:41AM +0100, Omri Sarig via lists.yoctoproject.org wrote:
>> Add a very simple sanity test, which ensures that tpm2_ptool can run
>> without problems when the relevant package is available.
>>
>> This test case is available here to help prevent future errors, where
>> the tool is unable to run after installation, due to missing
>> dependencies for example.
>>
>> Contrary to other tests in the file, this test does not communicate with
>> the TPM module itself, it only ensures that the tool (tpm2_ptool) can be
>> loaded without any errors. Therefore, we don't need to depend on
>> anything other than having the package installed.
>>
>> Signed-off-by: Omri Sarig <omri.sarig13@gmail.com>
>> ---
>>   meta-tpm/lib/oeqa/runtime/cases/tpm2.py | 5 +++++
>>   1 file changed, 5 insertions(+)
>>
>> diff --git a/meta-tpm/lib/oeqa/runtime/cases/tpm2.py b/meta-tpm/lib/oeqa/runtime/cases/tpm2.py
>> index 8e90dc9..c2e6dfa 100644
>> --- a/meta-tpm/lib/oeqa/runtime/cases/tpm2.py
>> +++ b/meta-tpm/lib/oeqa/runtime/cases/tpm2.py
>> @@ -67,3 +67,8 @@ class Tpm2Test(OERuntimeTestCase):
>>       def test_tpm2_swtpm_reset(self):
>>            (status, output) = self.target.run('swtpm_ioctl -i --tcp :2322')
>>            self.assertEqual(status, 0, msg="swtpm reset failed: %s" % output)
>> +
>> +    @OEHasPackage(['tpm2-pkcs11-tools'])
>> +    def test_tpm2_pkcs11_tools(self):
>> +        (status, output) = self.target.run("tpm2_ptool --help")
>> +        self.assertEqual(status, 0, msg="Module cannot be run with error: %s" % output)
> Thanks! This good to start with. I think it's a separate question now if
> meta-tpm test images will include tpm2-pkcs11-tools and actually run
> this test.

I've looked into it now.
If I understand it correctly, and the image used for testing is 
security-tpm2-image 
(meta-security/meta-tpm/recipes-core/images/security-tpm2-image.bb), 
then the image already have tpm2-pkcs11-tools implicitly installed in it.

This is done as the image have the recipe of swtpm and the config of 
gnutls, which adds tpm2-pkcs11-tools to the runtime dependencies of swtpm.

I think we can do one of the following:

1. Update the image to explicitly install tpm2-pkcs11-tools (as a 
package in IMAGE_INSTALL).
2. Update the commit message to add the above explanation, so users will 
know that the tool is added to the image (and thus tested).
3. Leave the commits as-is.

What do you think makes the most sense?


With Kind Regards,
Omri

Re: [yocto-patches] [PATCH v2 3/3] oeqa/cases/tpm2: Add tpm2-pkcs11-tools sanity test

[Mikko Rapeli]

Hi,

On Wed, Mar 12, 2025 at 12:07:29PM +0100, Omri Sarig wrote:
> On 3/12/25 11:38, Mikko Rapeli wrote:
> > Hi,
> 
> Thanks for the fast reply!
> 
> > 
> > On Wed, Mar 12, 2025 at 11:32:41AM +0100, Omri Sarig via lists.yoctoproject.org wrote:
> > > Add a very simple sanity test, which ensures that tpm2_ptool can run
> > > without problems when the relevant package is available.
> > > 
> > > This test case is available here to help prevent future errors, where
> > > the tool is unable to run after installation, due to missing
> > > dependencies for example.
> > > 
> > > Contrary to other tests in the file, this test does not communicate with
> > > the TPM module itself, it only ensures that the tool (tpm2_ptool) can be
> > > loaded without any errors. Therefore, we don't need to depend on
> > > anything other than having the package installed.
> > > 
> > > Signed-off-by: Omri Sarig <omri.sarig13@gmail.com>
> > > ---
> > >   meta-tpm/lib/oeqa/runtime/cases/tpm2.py | 5 +++++
> > >   1 file changed, 5 insertions(+)
> > > 
> > > diff --git a/meta-tpm/lib/oeqa/runtime/cases/tpm2.py b/meta-tpm/lib/oeqa/runtime/cases/tpm2.py
> > > index 8e90dc9..c2e6dfa 100644
> > > --- a/meta-tpm/lib/oeqa/runtime/cases/tpm2.py
> > > +++ b/meta-tpm/lib/oeqa/runtime/cases/tpm2.py
> > > @@ -67,3 +67,8 @@ class Tpm2Test(OERuntimeTestCase):
> > >       def test_tpm2_swtpm_reset(self):
> > >            (status, output) = self.target.run('swtpm_ioctl -i --tcp :2322')
> > >            self.assertEqual(status, 0, msg="swtpm reset failed: %s" % output)
> > > +
> > > +    @OEHasPackage(['tpm2-pkcs11-tools'])
> > > +    def test_tpm2_pkcs11_tools(self):
> > > +        (status, output) = self.target.run("tpm2_ptool --help")
> > > +        self.assertEqual(status, 0, msg="Module cannot be run with error: %s" % output)
> > Thanks! This good to start with. I think it's a separate question now if
> > meta-tpm test images will include tpm2-pkcs11-tools and actually run
> > this test.
> 
> I've looked into it now.
> If I understand it correctly, and the image used for testing is
> security-tpm2-image
> (meta-security/meta-tpm/recipes-core/images/security-tpm2-image.bb), then
> the image already have tpm2-pkcs11-tools implicitly installed in it.
> 
> This is done as the image have the recipe of swtpm and the config of gnutls,
> which adds tpm2-pkcs11-tools to the runtime dependencies of swtpm.
> 
> I think we can do one of the following:
> 
> 1. Update the image to explicitly install tpm2-pkcs11-tools (as a package in
> IMAGE_INSTALL).
> 2. Update the commit message to add the above explanation, so users will
> know that the tool is added to the image (and thus tested).
> 3. Leave the commits as-is.
> 
> What do you think makes the most sense?

If the image already has it then I think we can leave as is.

But Armin as the layer maintainer can decide.

Cheers,

-Mikko

Re: [yocto-patches] [PATCH v2 3/3] oeqa/cases/tpm2: Add tpm2-pkcs11-tools sanity test

[Omri Sarig]

Hi Armin,

Haven't heard anything in about a week.
Will you consider adding these patches to meta-security?


Thanks,
With Kind Regards,
Omri

On 3/12/25 12:15, Mikko Rapeli wrote:
> Hi,
>
> On Wed, Mar 12, 2025 at 12:07:29PM +0100, Omri Sarig wrote:
>> On 3/12/25 11:38, Mikko Rapeli wrote:
>>> Hi,
>> Thanks for the fast reply!
>>
>>> On Wed, Mar 12, 2025 at 11:32:41AM +0100, Omri Sarig via lists.yoctoproject.org wrote:
>>>> Add a very simple sanity test, which ensures that tpm2_ptool can run
>>>> without problems when the relevant package is available.
>>>>
>>>> This test case is available here to help prevent future errors, where
>>>> the tool is unable to run after installation, due to missing
>>>> dependencies for example.
>>>>
>>>> Contrary to other tests in the file, this test does not communicate with
>>>> the TPM module itself, it only ensures that the tool (tpm2_ptool) can be
>>>> loaded without any errors. Therefore, we don't need to depend on
>>>> anything other than having the package installed.
>>>>
>>>> Signed-off-by: Omri Sarig <omri.sarig13@gmail.com>
>>>> ---
>>>>    meta-tpm/lib/oeqa/runtime/cases/tpm2.py | 5 +++++
>>>>    1 file changed, 5 insertions(+)
>>>>
>>>> diff --git a/meta-tpm/lib/oeqa/runtime/cases/tpm2.py b/meta-tpm/lib/oeqa/runtime/cases/tpm2.py
>>>> index 8e90dc9..c2e6dfa 100644
>>>> --- a/meta-tpm/lib/oeqa/runtime/cases/tpm2.py
>>>> +++ b/meta-tpm/lib/oeqa/runtime/cases/tpm2.py
>>>> @@ -67,3 +67,8 @@ class Tpm2Test(OERuntimeTestCase):
>>>>        def test_tpm2_swtpm_reset(self):
>>>>             (status, output) = self.target.run('swtpm_ioctl -i --tcp :2322')
>>>>             self.assertEqual(status, 0, msg="swtpm reset failed: %s" % output)
>>>> +
>>>> +    @OEHasPackage(['tpm2-pkcs11-tools'])
>>>> +    def test_tpm2_pkcs11_tools(self):
>>>> +        (status, output) = self.target.run("tpm2_ptool --help")
>>>> +        self.assertEqual(status, 0, msg="Module cannot be run with error: %s" % output)
>>> Thanks! This good to start with. I think it's a separate question now if
>>> meta-tpm test images will include tpm2-pkcs11-tools and actually run
>>> this test.
>> I've looked into it now.
>> If I understand it correctly, and the image used for testing is
>> security-tpm2-image
>> (meta-security/meta-tpm/recipes-core/images/security-tpm2-image.bb), then
>> the image already have tpm2-pkcs11-tools implicitly installed in it.
>>
>> This is done as the image have the recipe of swtpm and the config of gnutls,
>> which adds tpm2-pkcs11-tools to the runtime dependencies of swtpm.
>>
>> I think we can do one of the following:
>>
>> 1. Update the image to explicitly install tpm2-pkcs11-tools (as a package in
>> IMAGE_INSTALL).
>> 2. Update the commit message to add the above explanation, so users will
>> know that the tool is added to the image (and thus tested).
>> 3. Leave the commits as-is.
>>
>> What do you think makes the most sense?
> If the image already has it then I think we can leave as is.
>
> But Armin as the layer maintainer can decide.
>
> Cheers,
>
> -Mikko