* [Buildroot] [PATCH 0/2] Add support for tpm2-tss v4.1.3 and tpm2-tss-engine v1.2.0 @ 2024-11-25 0:02 abelino 2024-11-25 0:02 ` [Buildroot] [PATCH 1/2] package/tpm2-tss: bump version to 4.1.3 abelino 2024-11-25 0:02 ` [Buildroot] [PATCH 2/2] package/tpm2-tss-engine: add version 1.2.0 abelino 0 siblings, 2 replies; 14+ messages in thread From: abelino @ 2024-11-25 0:02 UTC (permalink / raw) To: buildroot; +Cc: Thomas Petazzoni, abelino This patch series introduces updates and additions for the TPM2 software stack, specifically targeting the `tpm2-tss` and `tpm2-tss-engine` packages. These updates have been tested and are in use on a project featuring an Infineon SLB9673 TPM module. The first patch updates `tpm2-tss` to version 4.1.3, which resolves an issue encountered while reading NV indices with earlier versions (i.e., v3.2.2). Additionally, the update incorporates numerous fixes and enhancements introduced in intermediary releases, including a patch for CVE-2024-29040. The second patch adds support for the `tpm2-tss-engine` package at version 1.2.0. This package provides an OpenSSL Engine implementation for TPM2 devices, ensuring compatibility with ecosystems—such as Erlang—that rely on OpenSSL Engines due to incomplete support for OpenSSL Providers. abelino (2): package/tpm2-tss: bump version to 4.1.3 package/tpm2-tss-engine: add version 1.2.0 .checkpackageignore | 1 - package/Config.in | 1 + ...-disabling-of-digest-sign-operations.patch | 46 +++++++++++++++++++ package/tpm2-tss-engine/Config.in | 12 +++++ package/tpm2-tss-engine/tpm2-tss-engine.hash | 3 ++ package/tpm2-tss-engine/tpm2-tss-engine.mk | 19 ++++++++ ...01-Temporary-fix-for-build-without-C.patch | 44 ------------------ package/tpm2-tss/Config.in | 2 + package/tpm2-tss/tpm2-tss.hash | 2 +- package/tpm2-tss/tpm2-tss.mk | 9 ++-- 10 files changed, 87 insertions(+), 52 deletions(-) create mode 100644 package/tpm2-tss-engine/0001-Allow-disabling-of-digest-sign-operations.patch create mode 100644 package/tpm2-tss-engine/Config.in create mode 100644 package/tpm2-tss-engine/tpm2-tss-engine.hash create mode 100644 package/tpm2-tss-engine/tpm2-tss-engine.mk delete mode 100644 package/tpm2-tss/0001-Temporary-fix-for-build-without-C.patch -- 2.47.0 _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply [flat|nested] 14+ messages in thread
* [Buildroot] [PATCH 1/2] package/tpm2-tss: bump version to 4.1.3 2024-11-25 0:02 [Buildroot] [PATCH 0/2] Add support for tpm2-tss v4.1.3 and tpm2-tss-engine v1.2.0 abelino @ 2024-11-25 0:02 ` abelino 2024-11-25 17:18 ` Vincent Jardin 2024-11-27 5:25 ` [Buildroot] [PATCH v2 " abelino 2024-11-25 0:02 ` [Buildroot] [PATCH 2/2] package/tpm2-tss-engine: add version 1.2.0 abelino 1 sibling, 2 replies; 14+ messages in thread From: abelino @ 2024-11-25 0:02 UTC (permalink / raw) To: buildroot; +Cc: Thomas Petazzoni, abelino On v3.2.2, testing with an Infineon SLB9673 resulted in the following error when attempting to read from a previously written NV index. Upgrading to the latest release, v4.1.3, resolves the issue: ```shell ~# tpm2_nvread 0x1900001 WARN: Reading full size of the NV index ERROR:esys:../tpm2-tss-3.2.2/src/tss2-esys/esys_iutil.c:1096:esys_GetResourceObject() Error: Esys handle does not exist (70018). ERROR: Esys_SequenceComplete(0x70018) - esapi:The ESYS_TR resource object is bad ERROR: Failed to get shandle ERROR: Failed to read NVRAM area at index 0x1900001 ERROR: Unable to run tpm2_nvread ``` Between v3.2.2 and v4.1.3, the most notable update is v4.1.0 [1], which includes a fix for CVE-2024-29040, along with 40+ bug fixes and 10+ new features. Bumping to v4.1.3 adds access to these improvements and addresses the NV index read issue. [1] https://github.com/tpm2-software/tpm2-tss/releases/tag/4.1.0 Signed-off-by: abelino <abelino.romo@gmail.com> --- .checkpackageignore | 1 - ...01-Temporary-fix-for-build-without-C.patch | 44 ------------------- package/tpm2-tss/Config.in | 2 + package/tpm2-tss/tpm2-tss.hash | 2 +- package/tpm2-tss/tpm2-tss.mk | 9 ++-- 5 files changed, 6 insertions(+), 52 deletions(-) delete mode 100644 package/tpm2-tss/0001-Temporary-fix-for-build-without-C.patch diff --git a/.checkpackageignore b/.checkpackageignore index b793026881..906a733b7b 100644 --- a/.checkpackageignore +++ b/.checkpackageignore @@ -1237,7 +1237,6 @@ package/tinycompress/0001-wave-add-time.h-missing-header-inclusion.patch lib_pat package/tinydtls/0001-sha2-sha2.c-fix-build-on-big-endian.patch lib_patch.Upstream package/tinyxml/0001-In-stamp-always-advance-the-pointer-if-p-0xef.patch lib_patch.Upstream package/tpm2-abrmd/S80tpm2-abrmd Shellcheck lib_sysv.Indent lib_sysv.Variables -package/tpm2-tss/0001-Temporary-fix-for-build-without-C.patch lib_patch.Upstream package/transmission/S92transmission Shellcheck lib_sysv.ConsecutiveEmptyLines lib_sysv.Indent lib_sysv.Variables package/triggerhappy/S10triggerhappy Shellcheck lib_sysv.Indent lib_sysv.Variables package/trinity/0001-Fix-build-with-GCC-10.patch lib_patch.Upstream diff --git a/package/tpm2-tss/0001-Temporary-fix-for-build-without-C.patch b/package/tpm2-tss/0001-Temporary-fix-for-build-without-C.patch deleted file mode 100644 index 812c753ffb..0000000000 --- a/package/tpm2-tss/0001-Temporary-fix-for-build-without-C.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 7dc753ad27a8cd14c9b00be94ca89b847cf05ce9 Mon Sep 17 00:00:00 2001 -From: Carlos Santos <unixmania@gmail.com> -Date: Mon, 23 Dec 2019 08:02:19 -0300 -Subject: [PATCH] Temporary fix for build without C++ - -C++ is required only for the fuzzing tests but AC_PROG_CXX is included -by configure.ac even when fuzzing is not enabled (which we don't do on -Buildroot). - -The patch applied upstream had issues and was reverted[1]. Use a local -patch to solve the problem temporaryly. - -Fixes: - http://autobuild.buildroot.net/results/13f5e37b47b255da4158bec34e5459136f7e60d4 - http://autobuild.buildroot.net/results/1c26db2509c79e00c0de1165945277eaa57b149f - http://autobuild.buildroot.net/results/b7b6b7b7aca79e847b442cbd2305427d91fe5d70 - http://autobuild.buildroot.net/results/1cd5a82a0e799aa5027e2e2c03b246332cc3a15d - http://autobuild.buildroot.net/results/d7ec878907f714377c83e9a496e97cbf9382d787 - http://autobuild.buildroot.net/results/1c7f0c1b3ce4871cd87bd6059b1f0a6dc4e74a9c - http://autobuild.buildroot.net/results/196b81d580325607c8da90beeb79e1f6b8ab8b47 - http://autobuild.buildroot.net/results/f90f7b4ac710b56686635f8ae27059c11b963e47 - -1. https://github.com/tpm2-software/tpm2-tss/commit/60c26e4c4faba6ba12469485653e17092b510840 - -Signed-off-by: Carlos Santos <unixmania@gmail.com> ---- - configure.ac | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/configure.ac b/configure.ac -index ff59dd7c..3e4028fb 100755 ---- a/configure.ac -+++ b/configure.ac -@@ -26,7 +26,6 @@ AX_IS_RELEASE(dash-version) - AX_CHECK_ENABLE_DEBUG([info]) - - AC_PROG_CC --AC_PROG_CXX - AC_PROG_LN_S - AC_USE_SYSTEM_EXTENSIONS - LT_INIT() --- -2.26.2 - diff --git a/package/tpm2-tss/Config.in b/package/tpm2-tss/Config.in index 857987ae36..d87c1e0d8d 100644 --- a/package/tpm2-tss/Config.in +++ b/package/tpm2-tss/Config.in @@ -39,6 +39,8 @@ config BR2_PACKAGE_TPM2_TSS_FAPI depends on BR2_TOOLCHAIN_HAS_SYNC_4 # json-c select BR2_PACKAGE_JSON_C select BR2_PACKAGE_LIBCURL + select BR2_PACKAGE_UTIL_LINUX + select BR2_PACKAGE_UTIL_LINUX_LIBUUID help This option allows to enable Feature API (FAPI). Feature API (FAPI) as described in the "TSS 2.0 Feature API diff --git a/package/tpm2-tss/tpm2-tss.hash b/package/tpm2-tss/tpm2-tss.hash index c9fa4e6ae0..891c1285b0 100644 --- a/package/tpm2-tss/tpm2-tss.hash +++ b/package/tpm2-tss/tpm2-tss.hash @@ -1,3 +1,3 @@ # Locally computed: -sha256 ba9e52117f254f357ff502e7d60fce652b3bfb26327d236bbf5ab634235e40f1 tpm2-tss-3.2.2.tar.gz +sha256 37f1580200ab78305d1fc872d89241aaee0c93cbe85bc559bf332737a60d3be8 tpm2-tss-4.1.3.tar.gz sha256 18c1bf4b1ba1fb2c4ffa7398c234d83c0d55475298e470ae1e5e3a8a8bd2e448 LICENSE diff --git a/package/tpm2-tss/tpm2-tss.mk b/package/tpm2-tss/tpm2-tss.mk index b76d16e71e..c8a7df7724 100644 --- a/package/tpm2-tss/tpm2-tss.mk +++ b/package/tpm2-tss/tpm2-tss.mk @@ -4,7 +4,7 @@ # ################################################################################ -TPM2_TSS_VERSION = 3.2.2 +TPM2_TSS_VERSION = 4.1.3 TPM2_TSS_SITE = https://github.com/tpm2-software/tpm2-tss/releases/download/$(TPM2_TSS_VERSION) TPM2_TSS_LICENSE = BSD-2-Clause TPM2_TSS_LICENSE_FILES = LICENSE @@ -13,9 +13,6 @@ TPM2_TSS_CPE_ID_PRODUCT = tpm2_software_stack TPM2_TSS_INSTALL_STAGING = YES TPM2_TSS_DEPENDENCIES = openssl host-pkgconf -# 0001-configure-Only-use-CXX-when-fuzzing.patch -TPM2_TSS_AUTORECONF = YES - # systemd-sysusers and systemd-tmpfiles are only used at install time # to trigger the creation of users adn tmpfiles, which we do not care # about at build time. groupadd, useradd, and setfacl are used in the @@ -36,10 +33,10 @@ TPM2_TSS_CONF_OPTS = \ TPM2_TSS_CONF_ENV += CFLAGS="$(TARGET_CFLAGS) -std=c99" ifeq ($(BR2_PACKAGE_TPM2_TSS_FAPI),y) -TPM2_TSS_DEPENDENCIES += json-c libcurl +TPM2_TSS_DEPENDENCIES += json-c libcurl util-linux TPM2_TSS_CONF_OPTS += --enable-fapi else -TPM2_TSS_CONF_OPTS += --disable-fapi +TPM2_TSS_CONF_OPTS += --disable-fapi --disable-policy endif define TPM2_TSS_USERS -- 2.47.0 _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply related [flat|nested] 14+ messages in thread
* Re: [Buildroot] [PATCH 1/2] package/tpm2-tss: bump version to 4.1.3 2024-11-25 0:02 ` [Buildroot] [PATCH 1/2] package/tpm2-tss: bump version to 4.1.3 abelino @ 2024-11-25 17:18 ` Vincent Jardin 2024-11-28 10:46 ` Fiona Klute via buildroot 2024-11-27 5:25 ` [Buildroot] [PATCH v2 " abelino 1 sibling, 1 reply; 14+ messages in thread From: Vincent Jardin @ 2024-11-25 17:18 UTC (permalink / raw) To: abelino; +Cc: buildroot Hi, see below, On Sun, Nov 24, 2024 at 04:02:17PM UTC, abelino wrote: > On v3.2.2, testing with an Infineon SLB9673 resulted in the following > error when attempting to read from a previously written NV index. > Upgrading to the latest release, v4.1.3, resolves the issue: > > ```shell > ~# tpm2_nvread 0x1900001 > WARN: Reading full size of the NV index > ERROR:esys:../tpm2-tss-3.2.2/src/tss2-esys/esys_iutil.c:1096:esys_GetResourceObject() Error: Esys handle does not exist (70018). > ERROR: Esys_SequenceComplete(0x70018) - esapi:The ESYS_TR resource object is bad > ERROR: Failed to get shandle > ERROR: Failed to read NVRAM area at index 0x1900001 > ERROR: Unable to run tpm2_nvread > ``` > > Between v3.2.2 and v4.1.3, the most notable update is v4.1.0 [1], which > includes a fix for CVE-2024-29040, along with 40+ bug fixes and 10+ new > features. Bumping to v4.1.3 adds access to these improvements and > addresses the NV index read issue. > > [1] https://github.com/tpm2-software/tpm2-tss/releases/tag/4.1.0 > > Signed-off-by: abelino <abelino.romo@gmail.com> > --- > .checkpackageignore | 1 - > ...01-Temporary-fix-for-build-without-C.patch | 44 ------------------- > package/tpm2-tss/Config.in | 2 + > package/tpm2-tss/tpm2-tss.hash | 2 +- > package/tpm2-tss/tpm2-tss.mk | 9 ++-- > 5 files changed, 6 insertions(+), 52 deletions(-) > delete mode 100644 package/tpm2-tss/0001-Temporary-fix-for-build-without-C.patch > > diff --git a/.checkpackageignore b/.checkpackageignore > index b793026881..906a733b7b 100644 > --- a/.checkpackageignore > +++ b/.checkpackageignore > @@ -1237,7 +1237,6 @@ package/tinycompress/0001-wave-add-time.h-missing-header-inclusion.patch lib_pat > package/tinydtls/0001-sha2-sha2.c-fix-build-on-big-endian.patch lib_patch.Upstream > package/tinyxml/0001-In-stamp-always-advance-the-pointer-if-p-0xef.patch lib_patch.Upstream > package/tpm2-abrmd/S80tpm2-abrmd Shellcheck lib_sysv.Indent lib_sysv.Variables > -package/tpm2-tss/0001-Temporary-fix-for-build-without-C.patch lib_patch.Upstream > package/transmission/S92transmission Shellcheck lib_sysv.ConsecutiveEmptyLines lib_sysv.Indent lib_sysv.Variables > package/triggerhappy/S10triggerhappy Shellcheck lib_sysv.Indent lib_sysv.Variables > package/trinity/0001-Fix-build-with-GCC-10.patch lib_patch.Upstream > diff --git a/package/tpm2-tss/0001-Temporary-fix-for-build-without-C.patch b/package/tpm2-tss/0001-Temporary-fix-for-build-without-C.patch > deleted file mode 100644 > index 812c753ffb..0000000000 > --- a/package/tpm2-tss/0001-Temporary-fix-for-build-without-C.patch > +++ /dev/null > @@ -1,44 +0,0 @@ > -From 7dc753ad27a8cd14c9b00be94ca89b847cf05ce9 Mon Sep 17 00:00:00 2001 > -From: Carlos Santos <unixmania@gmail.com> > -Date: Mon, 23 Dec 2019 08:02:19 -0300 > -Subject: [PATCH] Temporary fix for build without C++ > - > -C++ is required only for the fuzzing tests but AC_PROG_CXX is included > -by configure.ac even when fuzzing is not enabled (which we don't do on > -Buildroot). > - > -The patch applied upstream had issues and was reverted[1]. Use a local > -patch to solve the problem temporaryly. > - > -Fixes: > - http://autobuild.buildroot.net/results/13f5e37b47b255da4158bec34e5459136f7e60d4 > - http://autobuild.buildroot.net/results/1c26db2509c79e00c0de1165945277eaa57b149f > - http://autobuild.buildroot.net/results/b7b6b7b7aca79e847b442cbd2305427d91fe5d70 > - http://autobuild.buildroot.net/results/1cd5a82a0e799aa5027e2e2c03b246332cc3a15d > - http://autobuild.buildroot.net/results/d7ec878907f714377c83e9a496e97cbf9382d787 > - http://autobuild.buildroot.net/results/1c7f0c1b3ce4871cd87bd6059b1f0a6dc4e74a9c > - http://autobuild.buildroot.net/results/196b81d580325607c8da90beeb79e1f6b8ab8b47 > - http://autobuild.buildroot.net/results/f90f7b4ac710b56686635f8ae27059c11b963e47 > - > -1. https://github.com/tpm2-software/tpm2-tss/commit/60c26e4c4faba6ba12469485653e17092b510840 > - > -Signed-off-by: Carlos Santos <unixmania@gmail.com> > ---- > - configure.ac | 1 - > - 1 file changed, 1 deletion(-) > - > -diff --git a/configure.ac b/configure.ac > -index ff59dd7c..3e4028fb 100755 > ---- a/configure.ac > -+++ b/configure.ac > -@@ -26,7 +26,6 @@ AX_IS_RELEASE(dash-version) > - AX_CHECK_ENABLE_DEBUG([info]) > - > - AC_PROG_CC > --AC_PROG_CXX > - AC_PROG_LN_S > - AC_USE_SYSTEM_EXTENSIONS > - LT_INIT() > --- > -2.26.2 > - > diff --git a/package/tpm2-tss/Config.in b/package/tpm2-tss/Config.in > index 857987ae36..d87c1e0d8d 100644 > --- a/package/tpm2-tss/Config.in > +++ b/package/tpm2-tss/Config.in > @@ -39,6 +39,8 @@ config BR2_PACKAGE_TPM2_TSS_FAPI > depends on BR2_TOOLCHAIN_HAS_SYNC_4 # json-c > select BR2_PACKAGE_JSON_C > select BR2_PACKAGE_LIBCURL > + select BR2_PACKAGE_UTIL_LINUX > + select BR2_PACKAGE_UTIL_LINUX_LIBUUID > help > This option allows to enable Feature API (FAPI). Feature > API (FAPI) as described in the "TSS 2.0 Feature API > diff --git a/package/tpm2-tss/tpm2-tss.hash b/package/tpm2-tss/tpm2-tss.hash > index c9fa4e6ae0..891c1285b0 100644 > --- a/package/tpm2-tss/tpm2-tss.hash > +++ b/package/tpm2-tss/tpm2-tss.hash > @@ -1,3 +1,3 @@ > # Locally computed: > -sha256 ba9e52117f254f357ff502e7d60fce652b3bfb26327d236bbf5ab634235e40f1 tpm2-tss-3.2.2.tar.gz > +sha256 37f1580200ab78305d1fc872d89241aaee0c93cbe85bc559bf332737a60d3be8 tpm2-tss-4.1.3.tar.gz > sha256 18c1bf4b1ba1fb2c4ffa7398c234d83c0d55475298e470ae1e5e3a8a8bd2e448 LICENSE > diff --git a/package/tpm2-tss/tpm2-tss.mk b/package/tpm2-tss/tpm2-tss.mk > index b76d16e71e..c8a7df7724 100644 > --- a/package/tpm2-tss/tpm2-tss.mk > +++ b/package/tpm2-tss/tpm2-tss.mk > @@ -4,7 +4,7 @@ > # > ################################################################################ > > -TPM2_TSS_VERSION = 3.2.2 > +TPM2_TSS_VERSION = 4.1.3 > TPM2_TSS_SITE = https://github.com/tpm2-software/tpm2-tss/releases/download/$(TPM2_TSS_VERSION) You should update it using $(call github,tpm2-software,) too. best regards, Vincent > TPM2_TSS_LICENSE = BSD-2-Clause > TPM2_TSS_LICENSE_FILES = LICENSE > @@ -13,9 +13,6 @@ TPM2_TSS_CPE_ID_PRODUCT = tpm2_software_stack > TPM2_TSS_INSTALL_STAGING = YES > TPM2_TSS_DEPENDENCIES = openssl host-pkgconf > > -# 0001-configure-Only-use-CXX-when-fuzzing.patch > -TPM2_TSS_AUTORECONF = YES > - > # systemd-sysusers and systemd-tmpfiles are only used at install time > # to trigger the creation of users adn tmpfiles, which we do not care > # about at build time. groupadd, useradd, and setfacl are used in the > @@ -36,10 +33,10 @@ TPM2_TSS_CONF_OPTS = \ > TPM2_TSS_CONF_ENV += CFLAGS="$(TARGET_CFLAGS) -std=c99" > > ifeq ($(BR2_PACKAGE_TPM2_TSS_FAPI),y) > -TPM2_TSS_DEPENDENCIES += json-c libcurl > +TPM2_TSS_DEPENDENCIES += json-c libcurl util-linux > TPM2_TSS_CONF_OPTS += --enable-fapi > else > -TPM2_TSS_CONF_OPTS += --disable-fapi > +TPM2_TSS_CONF_OPTS += --disable-fapi --disable-policy > endif > > define TPM2_TSS_USERS > -- > 2.47.0 > > _______________________________________________ > buildroot mailing list > buildroot@buildroot.org > https://lists.buildroot.org/mailman/listinfo/buildroot _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [Buildroot] [PATCH 1/2] package/tpm2-tss: bump version to 4.1.3 2024-11-25 17:18 ` Vincent Jardin @ 2024-11-28 10:46 ` Fiona Klute via buildroot 0 siblings, 0 replies; 14+ messages in thread From: Fiona Klute via buildroot @ 2024-11-28 10:46 UTC (permalink / raw) To: Vincent Jardin, abelino; +Cc: buildroot Am 25.11.24 um 18:18 schrieb Vincent Jardin: > Hi, > > see below, > > On Sun, Nov 24, 2024 at 04:02:17PM UTC, abelino wrote: >> On v3.2.2, testing with an Infineon SLB9673 resulted in the following >> error when attempting to read from a previously written NV index. >> Upgrading to the latest release, v4.1.3, resolves the issue: >> >> ```shell >> ~# tpm2_nvread 0x1900001 >> WARN: Reading full size of the NV index >> ERROR:esys:../tpm2-tss-3.2.2/src/tss2-esys/esys_iutil.c:1096:esys_GetResourceObject() Error: Esys handle does not exist (70018). >> ERROR: Esys_SequenceComplete(0x70018) - esapi:The ESYS_TR resource object is bad >> ERROR: Failed to get shandle >> ERROR: Failed to read NVRAM area at index 0x1900001 >> ERROR: Unable to run tpm2_nvread >> ``` >> >> Between v3.2.2 and v4.1.3, the most notable update is v4.1.0 [1], which >> includes a fix for CVE-2024-29040, along with 40+ bug fixes and 10+ new >> features. Bumping to v4.1.3 adds access to these improvements and >> addresses the NV index read issue. >> >> [1] https://github.com/tpm2-software/tpm2-tss/releases/tag/4.1.0 >> >> Signed-off-by: abelino <abelino.romo@gmail.com> >> --- >> .checkpackageignore | 1 - >> ...01-Temporary-fix-for-build-without-C.patch | 44 ------------------- >> package/tpm2-tss/Config.in | 2 + >> package/tpm2-tss/tpm2-tss.hash | 2 +- >> package/tpm2-tss/tpm2-tss.mk | 9 ++-- >> 5 files changed, 6 insertions(+), 52 deletions(-) >> delete mode 100644 package/tpm2-tss/0001-Temporary-fix-for-build-without-C.patch >> >> diff --git a/.checkpackageignore b/.checkpackageignore >> index b793026881..906a733b7b 100644 >> --- a/.checkpackageignore >> +++ b/.checkpackageignore >> @@ -1237,7 +1237,6 @@ package/tinycompress/0001-wave-add-time.h-missing-header-inclusion.patch lib_pat >> package/tinydtls/0001-sha2-sha2.c-fix-build-on-big-endian.patch lib_patch.Upstream >> package/tinyxml/0001-In-stamp-always-advance-the-pointer-if-p-0xef.patch lib_patch.Upstream >> package/tpm2-abrmd/S80tpm2-abrmd Shellcheck lib_sysv.Indent lib_sysv.Variables >> -package/tpm2-tss/0001-Temporary-fix-for-build-without-C.patch lib_patch.Upstream >> package/transmission/S92transmission Shellcheck lib_sysv.ConsecutiveEmptyLines lib_sysv.Indent lib_sysv.Variables >> package/triggerhappy/S10triggerhappy Shellcheck lib_sysv.Indent lib_sysv.Variables >> package/trinity/0001-Fix-build-with-GCC-10.patch lib_patch.Upstream >> diff --git a/package/tpm2-tss/0001-Temporary-fix-for-build-without-C.patch b/package/tpm2-tss/0001-Temporary-fix-for-build-without-C.patch >> deleted file mode 100644 >> index 812c753ffb..0000000000 >> --- a/package/tpm2-tss/0001-Temporary-fix-for-build-without-C.patch >> +++ /dev/null >> @@ -1,44 +0,0 @@ >> -From 7dc753ad27a8cd14c9b00be94ca89b847cf05ce9 Mon Sep 17 00:00:00 2001 >> -From: Carlos Santos <unixmania@gmail.com> >> -Date: Mon, 23 Dec 2019 08:02:19 -0300 >> -Subject: [PATCH] Temporary fix for build without C++ >> - >> -C++ is required only for the fuzzing tests but AC_PROG_CXX is included >> -by configure.ac even when fuzzing is not enabled (which we don't do on >> -Buildroot). >> - >> -The patch applied upstream had issues and was reverted[1]. Use a local >> -patch to solve the problem temporaryly. >> - >> -Fixes: >> - http://autobuild.buildroot.net/results/13f5e37b47b255da4158bec34e5459136f7e60d4 >> - http://autobuild.buildroot.net/results/1c26db2509c79e00c0de1165945277eaa57b149f >> - http://autobuild.buildroot.net/results/b7b6b7b7aca79e847b442cbd2305427d91fe5d70 >> - http://autobuild.buildroot.net/results/1cd5a82a0e799aa5027e2e2c03b246332cc3a15d >> - http://autobuild.buildroot.net/results/d7ec878907f714377c83e9a496e97cbf9382d787 >> - http://autobuild.buildroot.net/results/1c7f0c1b3ce4871cd87bd6059b1f0a6dc4e74a9c >> - http://autobuild.buildroot.net/results/196b81d580325607c8da90beeb79e1f6b8ab8b47 >> - http://autobuild.buildroot.net/results/f90f7b4ac710b56686635f8ae27059c11b963e47 >> - >> -1. https://github.com/tpm2-software/tpm2-tss/commit/60c26e4c4faba6ba12469485653e17092b510840 >> - >> -Signed-off-by: Carlos Santos <unixmania@gmail.com> >> ---- >> - configure.ac | 1 - >> - 1 file changed, 1 deletion(-) >> - >> -diff --git a/configure.ac b/configure.ac >> -index ff59dd7c..3e4028fb 100755 >> ---- a/configure.ac >> -+++ b/configure.ac >> -@@ -26,7 +26,6 @@ AX_IS_RELEASE(dash-version) >> - AX_CHECK_ENABLE_DEBUG([info]) >> - >> - AC_PROG_CC >> --AC_PROG_CXX >> - AC_PROG_LN_S >> - AC_USE_SYSTEM_EXTENSIONS >> - LT_INIT() >> --- >> -2.26.2 >> - >> diff --git a/package/tpm2-tss/Config.in b/package/tpm2-tss/Config.in >> index 857987ae36..d87c1e0d8d 100644 >> --- a/package/tpm2-tss/Config.in >> +++ b/package/tpm2-tss/Config.in >> @@ -39,6 +39,8 @@ config BR2_PACKAGE_TPM2_TSS_FAPI >> depends on BR2_TOOLCHAIN_HAS_SYNC_4 # json-c >> select BR2_PACKAGE_JSON_C >> select BR2_PACKAGE_LIBCURL >> + select BR2_PACKAGE_UTIL_LINUX >> + select BR2_PACKAGE_UTIL_LINUX_LIBUUID >> help >> This option allows to enable Feature API (FAPI). Feature >> API (FAPI) as described in the "TSS 2.0 Feature API >> diff --git a/package/tpm2-tss/tpm2-tss.hash b/package/tpm2-tss/tpm2-tss.hash >> index c9fa4e6ae0..891c1285b0 100644 >> --- a/package/tpm2-tss/tpm2-tss.hash >> +++ b/package/tpm2-tss/tpm2-tss.hash >> @@ -1,3 +1,3 @@ >> # Locally computed: >> -sha256 ba9e52117f254f357ff502e7d60fce652b3bfb26327d236bbf5ab634235e40f1 tpm2-tss-3.2.2.tar.gz >> +sha256 37f1580200ab78305d1fc872d89241aaee0c93cbe85bc559bf332737a60d3be8 tpm2-tss-4.1.3.tar.gz >> sha256 18c1bf4b1ba1fb2c4ffa7398c234d83c0d55475298e470ae1e5e3a8a8bd2e448 LICENSE >> diff --git a/package/tpm2-tss/tpm2-tss.mk b/package/tpm2-tss/tpm2-tss.mk >> index b76d16e71e..c8a7df7724 100644 >> --- a/package/tpm2-tss/tpm2-tss.mk >> +++ b/package/tpm2-tss/tpm2-tss.mk >> @@ -4,7 +4,7 @@ >> # >> ################################################################################ >> >> -TPM2_TSS_VERSION = 3.2.2 >> +TPM2_TSS_VERSION = 4.1.3 >> TPM2_TSS_SITE = https://github.com/tpm2-software/tpm2-tss/releases/download/$(TPM2_TSS_VERSION) > > You should update it using $(call github,tpm2-software,) too. Isn't pointing _SITE at the HTTPS clone URL and using _SITE_METHOD = git preferred nowadays, to ensure we get reproducible tarballs? Best regards, Fiona _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply [flat|nested] 14+ messages in thread
* [Buildroot] [PATCH v2 1/2] package/tpm2-tss: bump version to 4.1.3 2024-11-25 0:02 ` [Buildroot] [PATCH 1/2] package/tpm2-tss: bump version to 4.1.3 abelino 2024-11-25 17:18 ` Vincent Jardin @ 2024-11-27 5:25 ` abelino 2024-11-28 20:25 ` Thomas Petazzoni via buildroot 2024-11-29 22:10 ` [Buildroot] [PATCH v3 " Abelino Romo 1 sibling, 2 replies; 14+ messages in thread From: abelino @ 2024-11-27 5:25 UTC (permalink / raw) To: buildroot; +Cc: Thomas Petazzoni, abelino On v3.2.2, testing with an Infineon SLB9673 resulted in the following error when attempting to read from a previously written NV index. Upgrading to the latest release, v4.1.3, resolves the issue: ```shell ~# tpm2_nvread 0x1900001 WARN: Reading full size of the NV index ERROR:esys:../tpm2-tss-3.2.2/src/tss2-esys/esys_iutil.c:1096:esys_GetResourceObject() Error: Esys handle does not exist (70018). ERROR: Esys_SequenceComplete(0x70018) - esapi:The ESYS_TR resource object is bad ERROR: Failed to get shandle ERROR: Failed to read NVRAM area at index 0x1900001 ERROR: Unable to run tpm2_nvread ``` Between v3.2.2 and v4.1.3, the most notable update is v4.1.0 [1], which includes a fix for CVE-2024-29040, along with 40+ bug fixes and 10+ new features. Bumping to v4.1.3 adds access to these improvements and addresses the NV index read issue. [1] https://github.com/tpm2-software/tpm2-tss/releases/tag/4.1.0 Signed-off-by: abelino <abelino.romo@gmail.com> --- Changes v1 -> v2: - Update `TPM2_TSS_SITE` to use `$(call github,...)` but required additional changes to properly bootstrap `configure`. The previous URL downloaded the release artifact which is bootstraped ahead of time, while the tagged source archive does not contain a `VERSION` and `configure` file. (suggested by Vincent Jardin) .checkpackageignore | 2 +- .../0001-Prepare-bootstrap-file.patch | 44 +++++++++++++++++++ ...01-Temporary-fix-for-build-without-C.patch | 44 ------------------- package/tpm2-tss/Config.in | 2 + package/tpm2-tss/tpm2-tss.hash | 2 +- package/tpm2-tss/tpm2-tss.mk | 20 ++++++--- 6 files changed, 61 insertions(+), 53 deletions(-) create mode 100644 package/tpm2-tss/0001-Prepare-bootstrap-file.patch delete mode 100644 package/tpm2-tss/0001-Temporary-fix-for-build-without-C.patch diff --git a/.checkpackageignore b/.checkpackageignore index b793026881..1b9e32f4d7 100644 --- a/.checkpackageignore +++ b/.checkpackageignore @@ -1237,7 +1237,7 @@ package/tinycompress/0001-wave-add-time.h-missing-header-inclusion.patch lib_pat package/tinydtls/0001-sha2-sha2.c-fix-build-on-big-endian.patch lib_patch.Upstream package/tinyxml/0001-In-stamp-always-advance-the-pointer-if-p-0xef.patch lib_patch.Upstream package/tpm2-abrmd/S80tpm2-abrmd Shellcheck lib_sysv.Indent lib_sysv.Variables -package/tpm2-tss/0001-Temporary-fix-for-build-without-C.patch lib_patch.Upstream +package/tpm2-tss/0001-Prepare-bootstrap-file.patch lib_patch.Upstream package/transmission/S92transmission Shellcheck lib_sysv.ConsecutiveEmptyLines lib_sysv.Indent lib_sysv.Variables package/triggerhappy/S10triggerhappy Shellcheck lib_sysv.Indent lib_sysv.Variables package/trinity/0001-Fix-build-with-GCC-10.patch lib_patch.Upstream diff --git a/package/tpm2-tss/0001-Prepare-bootstrap-file.patch b/package/tpm2-tss/0001-Prepare-bootstrap-file.patch new file mode 100644 index 0000000000..81ee3b6266 --- /dev/null +++ b/package/tpm2-tss/0001-Prepare-bootstrap-file.patch @@ -0,0 +1,44 @@ +From a0a6c030edf233316b9acc56224bfc0d8f637308 Mon Sep 17 00:00:00 2001 +From: abelino <abelino.romo@gmail.com> +Date: Tue, 26 Nov 2024 16:49:14 -0800 +Subject: [PATCH] Prepare bootstrap file + +The bootstrap script uses git to create a VERSION file and we do not +have access to any git history when pulling the tarball from GitHub's +Archive. Therefore, we move the responsibility of generating the +VERSION file and autoreconf'ing from the bootstrap script and off to +this package's makefile. + +Signed-off-by: abelino <abelino.romo@gmail.com> +--- + bootstrap | 10 ---------- + 1 file changed, 10 deletions(-) + +diff --git a/bootstrap b/bootstrap +index 47135577..2032dde8 100755 +--- a/bootstrap ++++ b/bootstrap +@@ -1,8 +1,6 @@ + #!/bin/sh + set -e + +-git describe --tags --always --dirty > VERSION +- + # generate list of source files for use in Makefile.am + # if you add new source files, you must run ./bootstrap again + src_listvar () { +@@ -89,11 +87,3 @@ if test "${GEN_FUZZ}0" -eq 10; then + else + touch Makefile-fuzz-generated.am + fi +- +-${AUTORECONF} --install --sym $@ +- +-if grep "Invalid policy. Valid policies: git-directory, minor-version." configure >/dev/null; then +- echo "ERROR: ax_is_release.m4 is outdated. ./configure will fail." +- echo "Please download from http://ftpmirror.gnu.org/autoconf-archive/autoconf-archive-2019.01.06.tar.xz" +- exit 1 +-fi +-- +2.47.0 + diff --git a/package/tpm2-tss/0001-Temporary-fix-for-build-without-C.patch b/package/tpm2-tss/0001-Temporary-fix-for-build-without-C.patch deleted file mode 100644 index 812c753ffb..0000000000 --- a/package/tpm2-tss/0001-Temporary-fix-for-build-without-C.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 7dc753ad27a8cd14c9b00be94ca89b847cf05ce9 Mon Sep 17 00:00:00 2001 -From: Carlos Santos <unixmania@gmail.com> -Date: Mon, 23 Dec 2019 08:02:19 -0300 -Subject: [PATCH] Temporary fix for build without C++ - -C++ is required only for the fuzzing tests but AC_PROG_CXX is included -by configure.ac even when fuzzing is not enabled (which we don't do on -Buildroot). - -The patch applied upstream had issues and was reverted[1]. Use a local -patch to solve the problem temporaryly. - -Fixes: - http://autobuild.buildroot.net/results/13f5e37b47b255da4158bec34e5459136f7e60d4 - http://autobuild.buildroot.net/results/1c26db2509c79e00c0de1165945277eaa57b149f - http://autobuild.buildroot.net/results/b7b6b7b7aca79e847b442cbd2305427d91fe5d70 - http://autobuild.buildroot.net/results/1cd5a82a0e799aa5027e2e2c03b246332cc3a15d - http://autobuild.buildroot.net/results/d7ec878907f714377c83e9a496e97cbf9382d787 - http://autobuild.buildroot.net/results/1c7f0c1b3ce4871cd87bd6059b1f0a6dc4e74a9c - http://autobuild.buildroot.net/results/196b81d580325607c8da90beeb79e1f6b8ab8b47 - http://autobuild.buildroot.net/results/f90f7b4ac710b56686635f8ae27059c11b963e47 - -1. https://github.com/tpm2-software/tpm2-tss/commit/60c26e4c4faba6ba12469485653e17092b510840 - -Signed-off-by: Carlos Santos <unixmania@gmail.com> ---- - configure.ac | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/configure.ac b/configure.ac -index ff59dd7c..3e4028fb 100755 ---- a/configure.ac -+++ b/configure.ac -@@ -26,7 +26,6 @@ AX_IS_RELEASE(dash-version) - AX_CHECK_ENABLE_DEBUG([info]) - - AC_PROG_CC --AC_PROG_CXX - AC_PROG_LN_S - AC_USE_SYSTEM_EXTENSIONS - LT_INIT() --- -2.26.2 - diff --git a/package/tpm2-tss/Config.in b/package/tpm2-tss/Config.in index 857987ae36..d87c1e0d8d 100644 --- a/package/tpm2-tss/Config.in +++ b/package/tpm2-tss/Config.in @@ -39,6 +39,8 @@ config BR2_PACKAGE_TPM2_TSS_FAPI depends on BR2_TOOLCHAIN_HAS_SYNC_4 # json-c select BR2_PACKAGE_JSON_C select BR2_PACKAGE_LIBCURL + select BR2_PACKAGE_UTIL_LINUX + select BR2_PACKAGE_UTIL_LINUX_LIBUUID help This option allows to enable Feature API (FAPI). Feature API (FAPI) as described in the "TSS 2.0 Feature API diff --git a/package/tpm2-tss/tpm2-tss.hash b/package/tpm2-tss/tpm2-tss.hash index c9fa4e6ae0..a7a0c5cca8 100644 --- a/package/tpm2-tss/tpm2-tss.hash +++ b/package/tpm2-tss/tpm2-tss.hash @@ -1,3 +1,3 @@ # Locally computed: -sha256 ba9e52117f254f357ff502e7d60fce652b3bfb26327d236bbf5ab634235e40f1 tpm2-tss-3.2.2.tar.gz +sha256 8a389bda64690910e7af7deaf64703a3faed416dc538c9c3e4f893f24893524d tpm2-tss-4.1.3.tar.gz sha256 18c1bf4b1ba1fb2c4ffa7398c234d83c0d55475298e470ae1e5e3a8a8bd2e448 LICENSE diff --git a/package/tpm2-tss/tpm2-tss.mk b/package/tpm2-tss/tpm2-tss.mk index b76d16e71e..ae77d4f313 100644 --- a/package/tpm2-tss/tpm2-tss.mk +++ b/package/tpm2-tss/tpm2-tss.mk @@ -4,17 +4,23 @@ # ################################################################################ -TPM2_TSS_VERSION = 3.2.2 -TPM2_TSS_SITE = https://github.com/tpm2-software/tpm2-tss/releases/download/$(TPM2_TSS_VERSION) +TPM2_TSS_VERSION = 4.1.3 +TPM2_TSS_SITE = $(call github,tpm2-software,tpm2-tss,$(TPM2_TSS_VERSION)) TPM2_TSS_LICENSE = BSD-2-Clause TPM2_TSS_LICENSE_FILES = LICENSE TPM2_TSS_CPE_ID_VENDOR = tpm2_software_stack_project TPM2_TSS_CPE_ID_PRODUCT = tpm2_software_stack TPM2_TSS_INSTALL_STAGING = YES -TPM2_TSS_DEPENDENCIES = openssl host-pkgconf - -# 0001-configure-Only-use-CXX-when-fuzzing.patch +TPM2_TSS_DEPENDENCIES = openssl host-autoconf-archive host-pkgconf TPM2_TSS_AUTORECONF = YES +TPM2_TSS_AUTORECONF_OPTS = --include=$(HOST_DIR)/share/autoconf-archive + +define TPM2_TSS_BOOTSTRAP + echo $(TPM2_TSS_VERSION) > $(@D)/VERSION + cd $(@D) && ./bootstrap +endef + +TPM2_TSS_PRE_CONFIGURE_HOOKS = TPM2_TSS_BOOTSTRAP # systemd-sysusers and systemd-tmpfiles are only used at install time # to trigger the creation of users adn tmpfiles, which we do not care @@ -36,10 +42,10 @@ TPM2_TSS_CONF_OPTS = \ TPM2_TSS_CONF_ENV += CFLAGS="$(TARGET_CFLAGS) -std=c99" ifeq ($(BR2_PACKAGE_TPM2_TSS_FAPI),y) -TPM2_TSS_DEPENDENCIES += json-c libcurl +TPM2_TSS_DEPENDENCIES += json-c libcurl util-linux TPM2_TSS_CONF_OPTS += --enable-fapi else -TPM2_TSS_CONF_OPTS += --disable-fapi +TPM2_TSS_CONF_OPTS += --disable-fapi --disable-policy endif define TPM2_TSS_USERS -- 2.47.0 _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply related [flat|nested] 14+ messages in thread
* Re: [Buildroot] [PATCH v2 1/2] package/tpm2-tss: bump version to 4.1.3 2024-11-27 5:25 ` [Buildroot] [PATCH v2 " abelino @ 2024-11-28 20:25 ` Thomas Petazzoni via buildroot 2024-11-29 22:10 ` [Buildroot] [PATCH v3 " Abelino Romo 1 sibling, 0 replies; 14+ messages in thread From: Thomas Petazzoni via buildroot @ 2024-11-28 20:25 UTC (permalink / raw) To: abelino; +Cc: buildroot Hello, Thanks for your patch! See some comments below. On Tue, 26 Nov 2024 21:25:41 -0800 abelino <abelino.romo@gmail.com> wrote: > On v3.2.2, testing with an Infineon SLB9673 resulted in the following > error when attempting to read from a previously written NV index. > Upgrading to the latest release, v4.1.3, resolves the issue: > > ```shell > ~# tpm2_nvread 0x1900001 > WARN: Reading full size of the NV index > ERROR:esys:../tpm2-tss-3.2.2/src/tss2-esys/esys_iutil.c:1096:esys_GetResourceObject() Error: Esys handle does not exist (70018). > ERROR: Esys_SequenceComplete(0x70018) - esapi:The ESYS_TR resource object is bad > ERROR: Failed to get shandle > ERROR: Failed to read NVRAM area at index 0x1900001 > ERROR: Unable to run tpm2_nvread > ``` > > Between v3.2.2 and v4.1.3, the most notable update is v4.1.0 [1], which > includes a fix for CVE-2024-29040, along with 40+ bug fixes and 10+ new > features. Bumping to v4.1.3 adds access to these improvements and > addresses the NV index read issue. > > [1] https://github.com/tpm2-software/tpm2-tss/releases/tag/4.1.0 > > Signed-off-by: abelino <abelino.romo@gmail.com> Could you please Signed-off-by with a real name, and proper capitalization, i.e probably: Abelino Romo <abelino.romo@gmail.com> ? > Changes v1 -> v2: > - Update `TPM2_TSS_SITE` to use `$(call github,...)` but required additional > changes to properly bootstrap `configure`. The previous URL downloaded > the release artifact which is bootstraped ahead of time, while the tagged > source archive does not contain a `VERSION` and `configure` file. > (suggested by Vincent Jardin) In fact this suggestion from Vincent was not correct. This project provides automatically generated tarballs *and* manually uploaded tarballs, and the original package as well as your v1 was using the manually uploaded tarball, which is good. We should keep doing that. > diff --git a/package/tpm2-tss/0001-Prepare-bootstrap-file.patch b/package/tpm2-tss/0001-Prepare-bootstrap-file.patch > new file mode 100644 > index 0000000000..81ee3b6266 > --- /dev/null > +++ b/package/tpm2-tss/0001-Prepare-bootstrap-file.patch > @@ -0,0 +1,44 @@ > +From a0a6c030edf233316b9acc56224bfc0d8f637308 Mon Sep 17 00:00:00 2001 > +From: abelino <abelino.romo@gmail.com> > +Date: Tue, 26 Nov 2024 16:49:14 -0800 > +Subject: [PATCH] Prepare bootstrap file > + > +The bootstrap script uses git to create a VERSION file and we do not > +have access to any git history when pulling the tarball from GitHub's > +Archive. Therefore, we move the responsibility of generating the > +VERSION file and autoreconf'ing from the bootstrap script and off to > +this package's makefile. > + > +Signed-off-by: abelino <abelino.romo@gmail.com> All patches should be submitted upstream (and have an Upstream: tag pointing to the URL of the upstream submission). But I believe if you use the release tarball this patch is no longer needed? Best regards, Thomas -- Thomas Petazzoni, co-owner and CEO, Bootlin Embedded Linux and Kernel engineering and training https://bootlin.com _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply [flat|nested] 14+ messages in thread
* [Buildroot] [PATCH v3 1/2] package/tpm2-tss: bump version to 4.1.3 2024-11-27 5:25 ` [Buildroot] [PATCH v2 " abelino 2024-11-28 20:25 ` Thomas Petazzoni via buildroot @ 2024-11-29 22:10 ` Abelino Romo 2025-07-07 15:18 ` Fiona Klute via buildroot 1 sibling, 1 reply; 14+ messages in thread From: Abelino Romo @ 2024-11-29 22:10 UTC (permalink / raw) To: buildroot; +Cc: Thomas Petazzoni, Abelino Romo On v3.2.2, testing with an Infineon SLB9673 resulted in the following error when attempting to read from a previously written NV index. Upgrading to the latest release, v4.1.3, resolves the issue: ```shell ~# tpm2_nvread 0x1900001 WARN: Reading full size of the NV index ERROR:esys:../tpm2-tss-3.2.2/src/tss2-esys/esys_iutil.c:1096:esys_GetResourceObject() Error: Esys handle does not exist (70018). ERROR: Esys_SequenceComplete(0x70018) - esapi:The ESYS_TR resource object is bad ERROR: Failed to get shandle ERROR: Failed to read NVRAM area at index 0x1900001 ERROR: Unable to run tpm2_nvread ``` Between v3.2.2 and v4.1.3, the most notable update is v4.1.0 [1], which includes a fix for CVE-2024-29040, along with 40+ bug fixes and 10+ new features. Bumping to v4.1.3 adds access to these improvements and addresses the NV index read issue. [1] https://github.com/tpm2-software/tpm2-tss/releases/tag/4.1.0 Signed-off-by: Abelino Romo <abelino.romo@gmail.com> --- Changes v2 -> v3: - Use manually uploaded tarball - the artifact from releases/download URL - and not the archive tarball. (suggested by Thomas Petazzoni) - Updated Signed-Off formatting. (suggested by Thomas Petazzoni) .checkpackageignore | 1 - ...01-Temporary-fix-for-build-without-C.patch | 44 ------------------- package/tpm2-tss/Config.in | 2 + package/tpm2-tss/tpm2-tss.hash | 2 +- package/tpm2-tss/tpm2-tss.mk | 9 ++-- 5 files changed, 6 insertions(+), 52 deletions(-) delete mode 100644 package/tpm2-tss/0001-Temporary-fix-for-build-without-C.patch diff --git a/.checkpackageignore b/.checkpackageignore index b793026881..906a733b7b 100644 --- a/.checkpackageignore +++ b/.checkpackageignore @@ -1237,7 +1237,6 @@ package/tinycompress/0001-wave-add-time.h-missing-header-inclusion.patch lib_pat package/tinydtls/0001-sha2-sha2.c-fix-build-on-big-endian.patch lib_patch.Upstream package/tinyxml/0001-In-stamp-always-advance-the-pointer-if-p-0xef.patch lib_patch.Upstream package/tpm2-abrmd/S80tpm2-abrmd Shellcheck lib_sysv.Indent lib_sysv.Variables -package/tpm2-tss/0001-Temporary-fix-for-build-without-C.patch lib_patch.Upstream package/transmission/S92transmission Shellcheck lib_sysv.ConsecutiveEmptyLines lib_sysv.Indent lib_sysv.Variables package/triggerhappy/S10triggerhappy Shellcheck lib_sysv.Indent lib_sysv.Variables package/trinity/0001-Fix-build-with-GCC-10.patch lib_patch.Upstream diff --git a/package/tpm2-tss/0001-Temporary-fix-for-build-without-C.patch b/package/tpm2-tss/0001-Temporary-fix-for-build-without-C.patch deleted file mode 100644 index 812c753ffb..0000000000 --- a/package/tpm2-tss/0001-Temporary-fix-for-build-without-C.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 7dc753ad27a8cd14c9b00be94ca89b847cf05ce9 Mon Sep 17 00:00:00 2001 -From: Carlos Santos <unixmania@gmail.com> -Date: Mon, 23 Dec 2019 08:02:19 -0300 -Subject: [PATCH] Temporary fix for build without C++ - -C++ is required only for the fuzzing tests but AC_PROG_CXX is included -by configure.ac even when fuzzing is not enabled (which we don't do on -Buildroot). - -The patch applied upstream had issues and was reverted[1]. Use a local -patch to solve the problem temporaryly. - -Fixes: - http://autobuild.buildroot.net/results/13f5e37b47b255da4158bec34e5459136f7e60d4 - http://autobuild.buildroot.net/results/1c26db2509c79e00c0de1165945277eaa57b149f - http://autobuild.buildroot.net/results/b7b6b7b7aca79e847b442cbd2305427d91fe5d70 - http://autobuild.buildroot.net/results/1cd5a82a0e799aa5027e2e2c03b246332cc3a15d - http://autobuild.buildroot.net/results/d7ec878907f714377c83e9a496e97cbf9382d787 - http://autobuild.buildroot.net/results/1c7f0c1b3ce4871cd87bd6059b1f0a6dc4e74a9c - http://autobuild.buildroot.net/results/196b81d580325607c8da90beeb79e1f6b8ab8b47 - http://autobuild.buildroot.net/results/f90f7b4ac710b56686635f8ae27059c11b963e47 - -1. https://github.com/tpm2-software/tpm2-tss/commit/60c26e4c4faba6ba12469485653e17092b510840 - -Signed-off-by: Carlos Santos <unixmania@gmail.com> ---- - configure.ac | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/configure.ac b/configure.ac -index ff59dd7c..3e4028fb 100755 ---- a/configure.ac -+++ b/configure.ac -@@ -26,7 +26,6 @@ AX_IS_RELEASE(dash-version) - AX_CHECK_ENABLE_DEBUG([info]) - - AC_PROG_CC --AC_PROG_CXX - AC_PROG_LN_S - AC_USE_SYSTEM_EXTENSIONS - LT_INIT() --- -2.26.2 - diff --git a/package/tpm2-tss/Config.in b/package/tpm2-tss/Config.in index 857987ae36..d87c1e0d8d 100644 --- a/package/tpm2-tss/Config.in +++ b/package/tpm2-tss/Config.in @@ -39,6 +39,8 @@ config BR2_PACKAGE_TPM2_TSS_FAPI depends on BR2_TOOLCHAIN_HAS_SYNC_4 # json-c select BR2_PACKAGE_JSON_C select BR2_PACKAGE_LIBCURL + select BR2_PACKAGE_UTIL_LINUX + select BR2_PACKAGE_UTIL_LINUX_LIBUUID help This option allows to enable Feature API (FAPI). Feature API (FAPI) as described in the "TSS 2.0 Feature API diff --git a/package/tpm2-tss/tpm2-tss.hash b/package/tpm2-tss/tpm2-tss.hash index c9fa4e6ae0..891c1285b0 100644 --- a/package/tpm2-tss/tpm2-tss.hash +++ b/package/tpm2-tss/tpm2-tss.hash @@ -1,3 +1,3 @@ # Locally computed: -sha256 ba9e52117f254f357ff502e7d60fce652b3bfb26327d236bbf5ab634235e40f1 tpm2-tss-3.2.2.tar.gz +sha256 37f1580200ab78305d1fc872d89241aaee0c93cbe85bc559bf332737a60d3be8 tpm2-tss-4.1.3.tar.gz sha256 18c1bf4b1ba1fb2c4ffa7398c234d83c0d55475298e470ae1e5e3a8a8bd2e448 LICENSE diff --git a/package/tpm2-tss/tpm2-tss.mk b/package/tpm2-tss/tpm2-tss.mk index b76d16e71e..c8a7df7724 100644 --- a/package/tpm2-tss/tpm2-tss.mk +++ b/package/tpm2-tss/tpm2-tss.mk @@ -4,7 +4,7 @@ # ################################################################################ -TPM2_TSS_VERSION = 3.2.2 +TPM2_TSS_VERSION = 4.1.3 TPM2_TSS_SITE = https://github.com/tpm2-software/tpm2-tss/releases/download/$(TPM2_TSS_VERSION) TPM2_TSS_LICENSE = BSD-2-Clause TPM2_TSS_LICENSE_FILES = LICENSE @@ -13,9 +13,6 @@ TPM2_TSS_CPE_ID_PRODUCT = tpm2_software_stack TPM2_TSS_INSTALL_STAGING = YES TPM2_TSS_DEPENDENCIES = openssl host-pkgconf -# 0001-configure-Only-use-CXX-when-fuzzing.patch -TPM2_TSS_AUTORECONF = YES - # systemd-sysusers and systemd-tmpfiles are only used at install time # to trigger the creation of users adn tmpfiles, which we do not care # about at build time. groupadd, useradd, and setfacl are used in the @@ -36,10 +33,10 @@ TPM2_TSS_CONF_OPTS = \ TPM2_TSS_CONF_ENV += CFLAGS="$(TARGET_CFLAGS) -std=c99" ifeq ($(BR2_PACKAGE_TPM2_TSS_FAPI),y) -TPM2_TSS_DEPENDENCIES += json-c libcurl +TPM2_TSS_DEPENDENCIES += json-c libcurl util-linux TPM2_TSS_CONF_OPTS += --enable-fapi else -TPM2_TSS_CONF_OPTS += --disable-fapi +TPM2_TSS_CONF_OPTS += --disable-fapi --disable-policy endif define TPM2_TSS_USERS -- 2.47.0 _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply related [flat|nested] 14+ messages in thread
* Re: [Buildroot] [PATCH v3 1/2] package/tpm2-tss: bump version to 4.1.3 2024-11-29 22:10 ` [Buildroot] [PATCH v3 " Abelino Romo @ 2025-07-07 15:18 ` Fiona Klute via buildroot 0 siblings, 0 replies; 14+ messages in thread From: Fiona Klute via buildroot @ 2025-07-07 15:18 UTC (permalink / raw) To: Abelino Romo, buildroot; +Cc: Thomas Petazzoni Am 29.11.24 um 23:10 schrieb Abelino Romo: > On v3.2.2, testing with an Infineon SLB9673 resulted in the following > error when attempting to read from a previously written NV index. > Upgrading to the latest release, v4.1.3, resolves the issue: > > ```shell > ~# tpm2_nvread 0x1900001 > WARN: Reading full size of the NV index > ERROR:esys:../tpm2-tss-3.2.2/src/tss2-esys/esys_iutil.c:1096:esys_GetResourceObject() Error: Esys handle does not exist (70018). > ERROR: Esys_SequenceComplete(0x70018) - esapi:The ESYS_TR resource object is bad > ERROR: Failed to get shandle > ERROR: Failed to read NVRAM area at index 0x1900001 > ERROR: Unable to run tpm2_nvread > ``` > > Between v3.2.2 and v4.1.3, the most notable update is v4.1.0 [1], which > includes a fix for CVE-2024-29040, along with 40+ bug fixes and 10+ new > features. Bumping to v4.1.3 adds access to these improvements and > addresses the NV index read issue. > > [1] https://github.com/tpm2-software/tpm2-tss/releases/tag/4.1.0 > > Signed-off-by: Abelino Romo <abelino.romo@gmail.com> Tested-by: Fiona Klute (WIWA) <fiona.klute@gmx.de> I've tested using the TPM with package/tpm2-pkcs11. There's a trivial merge conflict with the package/tpm2-abrmd init script rewrite I sent earlier [1] because both patches remove adjacent lines in .checkpackageignore, but that should be easy to fix and more reason to merge. :-) Best regards, Fiona [1] https://patchwork.ozlabs.org/project/buildroot/patch/20250707141052.280200-3-fiona.klute@gmx.de/ > --- > Changes v2 -> v3: > - Use manually uploaded tarball - the artifact from releases/download URL - > and not the archive tarball. > (suggested by Thomas Petazzoni) > > - Updated Signed-Off formatting. > (suggested by Thomas Petazzoni) > > .checkpackageignore | 1 - > ...01-Temporary-fix-for-build-without-C.patch | 44 ------------------- > package/tpm2-tss/Config.in | 2 + > package/tpm2-tss/tpm2-tss.hash | 2 +- > package/tpm2-tss/tpm2-tss.mk | 9 ++-- > 5 files changed, 6 insertions(+), 52 deletions(-) > delete mode 100644 package/tpm2-tss/0001-Temporary-fix-for-build-without-C.patch > > diff --git a/.checkpackageignore b/.checkpackageignore > index b793026881..906a733b7b 100644 > --- a/.checkpackageignore > +++ b/.checkpackageignore > @@ -1237,7 +1237,6 @@ package/tinycompress/0001-wave-add-time.h-missing-header-inclusion.patch lib_pat > package/tinydtls/0001-sha2-sha2.c-fix-build-on-big-endian.patch lib_patch.Upstream > package/tinyxml/0001-In-stamp-always-advance-the-pointer-if-p-0xef.patch lib_patch.Upstream > package/tpm2-abrmd/S80tpm2-abrmd Shellcheck lib_sysv.Indent lib_sysv.Variables > -package/tpm2-tss/0001-Temporary-fix-for-build-without-C.patch lib_patch.Upstream > package/transmission/S92transmission Shellcheck lib_sysv.ConsecutiveEmptyLines lib_sysv.Indent lib_sysv.Variables > package/triggerhappy/S10triggerhappy Shellcheck lib_sysv.Indent lib_sysv.Variables > package/trinity/0001-Fix-build-with-GCC-10.patch lib_patch.Upstream > diff --git a/package/tpm2-tss/0001-Temporary-fix-for-build-without-C.patch b/package/tpm2-tss/0001-Temporary-fix-for-build-without-C.patch > deleted file mode 100644 > index 812c753ffb..0000000000 > --- a/package/tpm2-tss/0001-Temporary-fix-for-build-without-C.patch > +++ /dev/null > @@ -1,44 +0,0 @@ > -From 7dc753ad27a8cd14c9b00be94ca89b847cf05ce9 Mon Sep 17 00:00:00 2001 > -From: Carlos Santos <unixmania@gmail.com> > -Date: Mon, 23 Dec 2019 08:02:19 -0300 > -Subject: [PATCH] Temporary fix for build without C++ > - > -C++ is required only for the fuzzing tests but AC_PROG_CXX is included > -by configure.ac even when fuzzing is not enabled (which we don't do on > -Buildroot). > - > -The patch applied upstream had issues and was reverted[1]. Use a local > -patch to solve the problem temporaryly. > - > -Fixes: > - http://autobuild.buildroot.net/results/13f5e37b47b255da4158bec34e5459136f7e60d4 > - http://autobuild.buildroot.net/results/1c26db2509c79e00c0de1165945277eaa57b149f > - http://autobuild.buildroot.net/results/b7b6b7b7aca79e847b442cbd2305427d91fe5d70 > - http://autobuild.buildroot.net/results/1cd5a82a0e799aa5027e2e2c03b246332cc3a15d > - http://autobuild.buildroot.net/results/d7ec878907f714377c83e9a496e97cbf9382d787 > - http://autobuild.buildroot.net/results/1c7f0c1b3ce4871cd87bd6059b1f0a6dc4e74a9c > - http://autobuild.buildroot.net/results/196b81d580325607c8da90beeb79e1f6b8ab8b47 > - http://autobuild.buildroot.net/results/f90f7b4ac710b56686635f8ae27059c11b963e47 > - > -1. https://github.com/tpm2-software/tpm2-tss/commit/60c26e4c4faba6ba12469485653e17092b510840 > - > -Signed-off-by: Carlos Santos <unixmania@gmail.com> > ---- > - configure.ac | 1 - > - 1 file changed, 1 deletion(-) > - > -diff --git a/configure.ac b/configure.ac > -index ff59dd7c..3e4028fb 100755 > ---- a/configure.ac > -+++ b/configure.ac > -@@ -26,7 +26,6 @@ AX_IS_RELEASE(dash-version) > - AX_CHECK_ENABLE_DEBUG([info]) > - > - AC_PROG_CC > --AC_PROG_CXX > - AC_PROG_LN_S > - AC_USE_SYSTEM_EXTENSIONS > - LT_INIT() > --- > -2.26.2 > - > diff --git a/package/tpm2-tss/Config.in b/package/tpm2-tss/Config.in > index 857987ae36..d87c1e0d8d 100644 > --- a/package/tpm2-tss/Config.in > +++ b/package/tpm2-tss/Config.in > @@ -39,6 +39,8 @@ config BR2_PACKAGE_TPM2_TSS_FAPI > depends on BR2_TOOLCHAIN_HAS_SYNC_4 # json-c > select BR2_PACKAGE_JSON_C > select BR2_PACKAGE_LIBCURL > + select BR2_PACKAGE_UTIL_LINUX > + select BR2_PACKAGE_UTIL_LINUX_LIBUUID > help > This option allows to enable Feature API (FAPI). Feature > API (FAPI) as described in the "TSS 2.0 Feature API > diff --git a/package/tpm2-tss/tpm2-tss.hash b/package/tpm2-tss/tpm2-tss.hash > index c9fa4e6ae0..891c1285b0 100644 > --- a/package/tpm2-tss/tpm2-tss.hash > +++ b/package/tpm2-tss/tpm2-tss.hash > @@ -1,3 +1,3 @@ > # Locally computed: > -sha256 ba9e52117f254f357ff502e7d60fce652b3bfb26327d236bbf5ab634235e40f1 tpm2-tss-3.2.2.tar.gz > +sha256 37f1580200ab78305d1fc872d89241aaee0c93cbe85bc559bf332737a60d3be8 tpm2-tss-4.1.3.tar.gz > sha256 18c1bf4b1ba1fb2c4ffa7398c234d83c0d55475298e470ae1e5e3a8a8bd2e448 LICENSE > diff --git a/package/tpm2-tss/tpm2-tss.mk b/package/tpm2-tss/tpm2-tss.mk > index b76d16e71e..c8a7df7724 100644 > --- a/package/tpm2-tss/tpm2-tss.mk > +++ b/package/tpm2-tss/tpm2-tss.mk > @@ -4,7 +4,7 @@ > # > ################################################################################ > > -TPM2_TSS_VERSION = 3.2.2 > +TPM2_TSS_VERSION = 4.1.3 > TPM2_TSS_SITE = https://github.com/tpm2-software/tpm2-tss/releases/download/$(TPM2_TSS_VERSION) > TPM2_TSS_LICENSE = BSD-2-Clause > TPM2_TSS_LICENSE_FILES = LICENSE > @@ -13,9 +13,6 @@ TPM2_TSS_CPE_ID_PRODUCT = tpm2_software_stack > TPM2_TSS_INSTALL_STAGING = YES > TPM2_TSS_DEPENDENCIES = openssl host-pkgconf > > -# 0001-configure-Only-use-CXX-when-fuzzing.patch > -TPM2_TSS_AUTORECONF = YES > - > # systemd-sysusers and systemd-tmpfiles are only used at install time > # to trigger the creation of users adn tmpfiles, which we do not care > # about at build time. groupadd, useradd, and setfacl are used in the > @@ -36,10 +33,10 @@ TPM2_TSS_CONF_OPTS = \ > TPM2_TSS_CONF_ENV += CFLAGS="$(TARGET_CFLAGS) -std=c99" > > ifeq ($(BR2_PACKAGE_TPM2_TSS_FAPI),y) > -TPM2_TSS_DEPENDENCIES += json-c libcurl > +TPM2_TSS_DEPENDENCIES += json-c libcurl util-linux > TPM2_TSS_CONF_OPTS += --enable-fapi > else > -TPM2_TSS_CONF_OPTS += --disable-fapi > +TPM2_TSS_CONF_OPTS += --disable-fapi --disable-policy > endif > > define TPM2_TSS_USERS _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply [flat|nested] 14+ messages in thread
* [Buildroot] [PATCH 2/2] package/tpm2-tss-engine: add version 1.2.0 2024-11-25 0:02 [Buildroot] [PATCH 0/2] Add support for tpm2-tss v4.1.3 and tpm2-tss-engine v1.2.0 abelino 2024-11-25 0:02 ` [Buildroot] [PATCH 1/2] package/tpm2-tss: bump version to 4.1.3 abelino @ 2024-11-25 0:02 ` abelino 2024-11-25 17:11 ` Vincent Jardin 2024-11-27 5:27 ` [Buildroot] [PATCH v2 " abelino 1 sibling, 2 replies; 14+ messages in thread From: abelino @ 2024-11-25 0:02 UTC (permalink / raw) To: buildroot; +Cc: Thomas Petazzoni, abelino Introduce the TPM2-TSS OpenSSL Engine to enable TPM2 device support in ecosystems that do not yet support OpenSSL Providers. This is particularly useful in the Erlang space, where OpenSSL 3 Providers are still under development [1]. [1] https://erlangforums.com/t/openssl-3-support-for-provider-deprecated-engine-replacement/2954/2 Signed-off-by: abelino <abelino.romo@gmail.com> --- package/Config.in | 1 + ...-disabling-of-digest-sign-operations.patch | 46 +++++++++++++++++++ package/tpm2-tss-engine/Config.in | 12 +++++ package/tpm2-tss-engine/tpm2-tss-engine.hash | 3 ++ package/tpm2-tss-engine/tpm2-tss-engine.mk | 19 ++++++++ 5 files changed, 81 insertions(+) create mode 100644 package/tpm2-tss-engine/0001-Allow-disabling-of-digest-sign-operations.patch create mode 100644 package/tpm2-tss-engine/Config.in create mode 100644 package/tpm2-tss-engine/tpm2-tss-engine.hash create mode 100644 package/tpm2-tss-engine/tpm2-tss-engine.mk diff --git a/package/Config.in b/package/Config.in index 1eb5e1e020..4f4b7a34d5 100644 --- a/package/Config.in +++ b/package/Config.in @@ -1633,6 +1633,7 @@ menu "Crypto" source "package/tpm2-openssl/Config.in" source "package/tpm2-pkcs11/Config.in" source "package/tpm2-tss/Config.in" + source "package/tpm2-tss-engine/Config.in" source "package/trousers/Config.in" source "package/ustream-ssl/Config.in" source "package/wolfssl/Config.in" diff --git a/package/tpm2-tss-engine/0001-Allow-disabling-of-digest-sign-operations.patch b/package/tpm2-tss-engine/0001-Allow-disabling-of-digest-sign-operations.patch new file mode 100644 index 0000000000..7ce717df4a --- /dev/null +++ b/package/tpm2-tss-engine/0001-Allow-disabling-of-digest-sign-operations.patch @@ -0,0 +1,46 @@ +From af8b26e7ffe69837197fb841e9a31230ae01c9cc Mon Sep 17 00:00:00 2001 +From: Andreas Fuchs <andreas.fuchs@infineon.com> +Date: Mon, 22 May 2023 14:06:41 +0200 +Subject: [PATCH] Configure: Allow disabling of digest-sign operations + +Since the digest-sign operations perform the hash on the TPM and +TPMs in general do not support SHA512, this can lead to errors. +Depending on the use case, it might be preferable to not support +restricted keys (via digest+sign) but to rely on ordinary keys +only. + +Upstream: https://github.com/tpm2-software/tpm2-tss-engine/commit/af8b26e7ffe69837197fb841e9a31230ae01c9cc +Signed-off-by: Andreas Fuchs <andreas.fuchs@infineon.com> +--- + configure.ac | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/configure.ac b/configure.ac +index d4a9356..b379042 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -116,13 +116,19 @@ PKG_CHECK_MODULES([CRYPTO], [libcrypto >= 1.0.2g], + PKG_CHECK_MODULES([TSS2_ESYS], [tss2-esys >= 2.3]) + PKG_CHECK_MODULES([TSS2_MU], [tss2-mu]) + PKG_CHECK_MODULES([TSS2_TCTILDR], [tss2-tctildr]) ++ + AC_CHECK_LIB([crypto], EC_KEY_METHOD_set_compute_key, + [AM_CONDITIONAL([HAVE_OPENSSL_ECDH], true)], + [AM_CONDITIONAL([HAVE_OPENSSL_ECDH], false)]) ++ ++AC_ARG_ENABLE([digestsign], ++ [AS_HELP_STRING([--disable-digestsign], ++ [Disable support for digest and sign methods, helps with TPM unsupported hash algorithms.])],, ++ [enable_digestsign=yes]) + AC_CHECK_LIB([crypto], EVP_PKEY_meth_set_digest_custom, +- [AM_CONDITIONAL([HAVE_OPENSSL_DIGEST_SIGN], true)], ++ [AM_CONDITIONAL([HAVE_OPENSSL_DIGEST_SIGN], [test "x$enable_digestsign" != "xno"])], + [AM_CONDITIONAL([HAVE_OPENSSL_DIGEST_SIGN], false)]) +-AS_IF([test "x$ac_cv_lib_crypto_EVP_PKEY_meth_set_digest_custom" = xyes], ++AS_IF([test "x$ac_cv_lib_crypto_EVP_PKEY_meth_set_digest_custom" = xyes && test "x$enable_digestsign" = "xyes"], + [AC_DEFINE([HAVE_OPENSSL_DIGEST_SIGN], [1], + Have required functionality from OpenSSL to support digest and sign)]) + +-- +2.47.0 + diff --git a/package/tpm2-tss-engine/Config.in b/package/tpm2-tss-engine/Config.in new file mode 100644 index 0000000000..27d925a60f --- /dev/null +++ b/package/tpm2-tss-engine/Config.in @@ -0,0 +1,12 @@ +config BR2_PACKAGE_TPM2_TSS_ENGINE + bool "tpm2-tss-engine" + select BR2_PACKAGE_TPM2_TSS + select BR2_PACKAGE_LIBOPENSSL_ENGINES + help + The tpm2-tss-engine project implements a cryptographic engine + for OpenSSL for Trusted Platform Module (TPM 2.0) using the + tpm2-tss software stack that follows the Trusted Computing + Groups (TCG) TPM Software Stack (TSS 2.0). It uses the + Enhanced System API (ESAPI) interface of the TSS 2.0 for + downwards communication. It supports RSA decryption and + signatures as well as ECDSA signatures. diff --git a/package/tpm2-tss-engine/tpm2-tss-engine.hash b/package/tpm2-tss-engine/tpm2-tss-engine.hash new file mode 100644 index 0000000000..294847d5f8 --- /dev/null +++ b/package/tpm2-tss-engine/tpm2-tss-engine.hash @@ -0,0 +1,3 @@ +# Locally computed: +sha256 3c94fef110dd3630b3c28c5875febba76b7d5ba2fcc04a14c4a30f5d2157c265 tpm2-tss-engine-1.2.0.tar.gz +sha256 7a77915f34caf18d47bc31750dae47dbd7f7895e95bbb8370f477c25009388f6 LICENSE diff --git a/package/tpm2-tss-engine/tpm2-tss-engine.mk b/package/tpm2-tss-engine/tpm2-tss-engine.mk new file mode 100644 index 0000000000..768f9ee3bd --- /dev/null +++ b/package/tpm2-tss-engine/tpm2-tss-engine.mk @@ -0,0 +1,19 @@ +################################################################################ +# +# tpm2-tss-engine +# +################################################################################ + +TPM2_TSS_ENGINE_VERSION = 1.2.0 +TPM2_TSS_ENGINE_SITE = https://github.com/tpm2-software/tpm2-tss-engine/releases/download/$(TPM2_TSS_ENGINE_VERSION) +TPM2_TSS_ENGINE_LICENSE = BSD-3-Clause +TPM2_TSS_ENGINE_LICENSE_FILES = LICENSE +TPM2_TSS_ENGINE_INSTALL_STAGING = YES +TPM2_TSS_ENGINE_DEPENDENCIES = host-pkgconf tpm2-tss +TPM2_TSS_ENGINE_AUTORECONF = YES + +TPM2_TSS_ENGINE_CONF_OPTS = \ + --disable-digestsign \ + --with-enginesdir="/usr/lib/engines-3" + +$(eval $(autotools-package)) -- 2.47.0 _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply related [flat|nested] 14+ messages in thread
* Re: [Buildroot] [PATCH 2/2] package/tpm2-tss-engine: add version 1.2.0 2024-11-25 0:02 ` [Buildroot] [PATCH 2/2] package/tpm2-tss-engine: add version 1.2.0 abelino @ 2024-11-25 17:11 ` Vincent Jardin 2024-11-27 5:27 ` [Buildroot] [PATCH v2 " abelino 1 sibling, 0 replies; 14+ messages in thread From: Vincent Jardin @ 2024-11-25 17:11 UTC (permalink / raw) To: abelino; +Cc: buildroot Hi, thanks for this contribution. See below some comments, On Sun, Nov 24, 2024 at 04:02:18PM UTC, abelino wrote: > Introduce the TPM2-TSS OpenSSL Engine to enable TPM2 device support in > ecosystems that do not yet support OpenSSL Providers. This is > particularly useful in the Erlang space, where OpenSSL 3 Providers are > still under development [1]. Does it imply that we should having sur warning ? src/tpm2-tss-engine-rand.c: In function ‘init_rand’: src/tpm2-tss-engine-rand.c:150:5: warning: ‘ENGINE_set_RAND’ is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations] 150 | return ENGINE_set_RAND(e, &rand_methods); | ^~~~~~ > > [1] https://erlangforums.com/t/openssl-3-support-for-provider-deprecated-engine-replacement/2954/2 > > Signed-off-by: abelino <abelino.romo@gmail.com> > --- > package/Config.in | 1 + > ...-disabling-of-digest-sign-operations.patch | 46 +++++++++++++++++++ > package/tpm2-tss-engine/Config.in | 12 +++++ > package/tpm2-tss-engine/tpm2-tss-engine.hash | 3 ++ > package/tpm2-tss-engine/tpm2-tss-engine.mk | 19 ++++++++ > 5 files changed, 81 insertions(+) > create mode 100644 package/tpm2-tss-engine/0001-Allow-disabling-of-digest-sign-operations.patch > create mode 100644 package/tpm2-tss-engine/Config.in > create mode 100644 package/tpm2-tss-engine/tpm2-tss-engine.hash > create mode 100644 package/tpm2-tss-engine/tpm2-tss-engine.mk > > diff --git a/package/Config.in b/package/Config.in > index 1eb5e1e020..4f4b7a34d5 100644 > --- a/package/Config.in > +++ b/package/Config.in > @@ -1633,6 +1633,7 @@ menu "Crypto" > source "package/tpm2-openssl/Config.in" > source "package/tpm2-pkcs11/Config.in" > source "package/tpm2-tss/Config.in" > + source "package/tpm2-tss-engine/Config.in" > source "package/trousers/Config.in" > source "package/ustream-ssl/Config.in" > source "package/wolfssl/Config.in" > diff --git a/package/tpm2-tss-engine/0001-Allow-disabling-of-digest-sign-operations.patch b/package/tpm2-tss-engine/0001-Allow-disabling-of-digest-sign-operations.patch > new file mode 100644 > index 0000000000..7ce717df4a > --- /dev/null > +++ b/package/tpm2-tss-engine/0001-Allow-disabling-of-digest-sign-operations.patch > @@ -0,0 +1,46 @@ > +From af8b26e7ffe69837197fb841e9a31230ae01c9cc Mon Sep 17 00:00:00 2001 > +From: Andreas Fuchs <andreas.fuchs@infineon.com> > +Date: Mon, 22 May 2023 14:06:41 +0200 > +Subject: [PATCH] Configure: Allow disabling of digest-sign operations > + > +Since the digest-sign operations perform the hash on the TPM and > +TPMs in general do not support SHA512, this can lead to errors. > +Depending on the use case, it might be preferable to not support > +restricted keys (via digest+sign) but to rely on ordinary keys > +only. > + > +Upstream: https://github.com/tpm2-software/tpm2-tss-engine/commit/af8b26e7ffe69837197fb841e9a31230ae01c9cc > +Signed-off-by: Andreas Fuchs <andreas.fuchs@infineon.com> When will a tpm2-tss-engine release update be available to avoid this patch ? Did you suggest/ask for a new release to the tpm2-tss-engine community using a github issue ? > +--- > + configure.ac | 10 ++++++++-- > + 1 file changed, 8 insertions(+), 2 deletions(-) > + > +diff --git a/configure.ac b/configure.ac > +index d4a9356..b379042 100644 > +--- a/configure.ac > ++++ b/configure.ac > +@@ -116,13 +116,19 @@ PKG_CHECK_MODULES([CRYPTO], [libcrypto >= 1.0.2g], > + PKG_CHECK_MODULES([TSS2_ESYS], [tss2-esys >= 2.3]) > + PKG_CHECK_MODULES([TSS2_MU], [tss2-mu]) > + PKG_CHECK_MODULES([TSS2_TCTILDR], [tss2-tctildr]) > ++ > + AC_CHECK_LIB([crypto], EC_KEY_METHOD_set_compute_key, > + [AM_CONDITIONAL([HAVE_OPENSSL_ECDH], true)], > + [AM_CONDITIONAL([HAVE_OPENSSL_ECDH], false)]) > ++ > ++AC_ARG_ENABLE([digestsign], > ++ [AS_HELP_STRING([--disable-digestsign], > ++ [Disable support for digest and sign methods, helps with TPM unsupported hash algorithms.])],, > ++ [enable_digestsign=yes]) > + AC_CHECK_LIB([crypto], EVP_PKEY_meth_set_digest_custom, > +- [AM_CONDITIONAL([HAVE_OPENSSL_DIGEST_SIGN], true)], > ++ [AM_CONDITIONAL([HAVE_OPENSSL_DIGEST_SIGN], [test "x$enable_digestsign" != "xno"])], > + [AM_CONDITIONAL([HAVE_OPENSSL_DIGEST_SIGN], false)]) > +-AS_IF([test "x$ac_cv_lib_crypto_EVP_PKEY_meth_set_digest_custom" = xyes], > ++AS_IF([test "x$ac_cv_lib_crypto_EVP_PKEY_meth_set_digest_custom" = xyes && test "x$enable_digestsign" = "xyes"], > + [AC_DEFINE([HAVE_OPENSSL_DIGEST_SIGN], [1], > + Have required functionality from OpenSSL to support digest and sign)]) > + > +-- > +2.47.0 > + > diff --git a/package/tpm2-tss-engine/Config.in b/package/tpm2-tss-engine/Config.in > new file mode 100644 > index 0000000000..27d925a60f > --- /dev/null > +++ b/package/tpm2-tss-engine/Config.in > @@ -0,0 +1,12 @@ > +config BR2_PACKAGE_TPM2_TSS_ENGINE > + bool "tpm2-tss-engine" > + select BR2_PACKAGE_TPM2_TSS > + select BR2_PACKAGE_LIBOPENSSL_ENGINES > + help > + The tpm2-tss-engine project implements a cryptographic engine > + for OpenSSL for Trusted Platform Module (TPM 2.0) using the > + tpm2-tss software stack that follows the Trusted Computing > + Groups (TCG) TPM Software Stack (TSS 2.0). It uses the > + Enhanced System API (ESAPI) interface of the TSS 2.0 for > + downwards communication. It supports RSA decryption and > + signatures as well as ECDSA signatures. > diff --git a/package/tpm2-tss-engine/tpm2-tss-engine.hash b/package/tpm2-tss-engine/tpm2-tss-engine.hash > new file mode 100644 > index 0000000000..294847d5f8 > --- /dev/null > +++ b/package/tpm2-tss-engine/tpm2-tss-engine.hash > @@ -0,0 +1,3 @@ > +# Locally computed: > +sha256 3c94fef110dd3630b3c28c5875febba76b7d5ba2fcc04a14c4a30f5d2157c265 tpm2-tss-engine-1.2.0.tar.gz > +sha256 7a77915f34caf18d47bc31750dae47dbd7f7895e95bbb8370f477c25009388f6 LICENSE > diff --git a/package/tpm2-tss-engine/tpm2-tss-engine.mk b/package/tpm2-tss-engine/tpm2-tss-engine.mk > new file mode 100644 > index 0000000000..768f9ee3bd > --- /dev/null > +++ b/package/tpm2-tss-engine/tpm2-tss-engine.mk > @@ -0,0 +1,19 @@ > +################################################################################ > +# > +# tpm2-tss-engine > +# > +################################################################################ > + > +TPM2_TSS_ENGINE_VERSION = 1.2.0 > +TPM2_TSS_ENGINE_SITE = https://github.com/tpm2-software/tpm2-tss-engine/releases/download/$(TPM2_TSS_ENGINE_VERSION) You should rather use: TPM2_TSS_ENGINE_SITE = $(call github,tpm2-software,tpm2-tss-engine,$(TPM2_TSS_ENGINE_VERSION)) I did try it, you'll need to update the hash/signature file too. > +TPM2_TSS_ENGINE_LICENSE = BSD-3-Clause > +TPM2_TSS_ENGINE_LICENSE_FILES = LICENSE > +TPM2_TSS_ENGINE_INSTALL_STAGING = YES > +TPM2_TSS_ENGINE_DEPENDENCIES = host-pkgconf tpm2-tss > +TPM2_TSS_ENGINE_AUTORECONF = YES > + > +TPM2_TSS_ENGINE_CONF_OPTS = \ > + --disable-digestsign \ The --disable-digestsign can make sense, but it should be a Config.in flag. > + --with-enginesdir="/usr/lib/engines-3" Could you align it with the libp11 enginesdir too ? They are using: # pkg-config returns a libcrypto enginesdir prefixed with the sysroot, # so let's rip it out. LIBP11_CONF_OPTS = \ --with-enginesdir=`$(PKG_CONFIG_HOST_BINARY) --variable enginesdir libcrypto | xargs readlink -f | sed 's%^$(STAGING_DIR)%%'` best regards, Vincent > + > +$(eval $(autotools-package)) > -- > 2.47.0 > > _______________________________________________ > buildroot mailing list > buildroot@buildroot.org > https://lists.buildroot.org/mailman/listinfo/buildroot _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply [flat|nested] 14+ messages in thread
* [Buildroot] [PATCH v2 2/2] package/tpm2-tss-engine: add version 1.2.0 2024-11-25 0:02 ` [Buildroot] [PATCH 2/2] package/tpm2-tss-engine: add version 1.2.0 abelino 2024-11-25 17:11 ` Vincent Jardin @ 2024-11-27 5:27 ` abelino 2024-11-29 22:13 ` [Buildroot] [PATCH v3 " Abelino Romo 1 sibling, 1 reply; 14+ messages in thread From: abelino @ 2024-11-27 5:27 UTC (permalink / raw) To: buildroot; +Cc: Thomas Petazzoni, abelino Introduce the TPM2-TSS OpenSSL Engine to enable TPM2 device support in ecosystems that do not yet support OpenSSL Providers. This is particularly useful in the Erlang space, where OpenSSL 3 Providers are still under development [1]. [1] https://erlangforums.com/t/openssl-3-support-for-provider-deprecated-engine-replacement/2954/2 Signed-off-by: abelino <abelino.romo@gmail.com> --- > When will a tpm2-tss-engine release update be available to avoid this > patch ? Did you suggest/ask for a new release to the tpm2-tss-engine > community using a github issue ? I just did that today. I will check-in periodically and circle back as soon as a new release is cut. Changes v1 -> v2: - Suppress OpenSSL 3 Engine deprecated API warnings since this package implements an engine and it is known these APIs are deprecated. (suggested by Vincent Jardin) - Update `TPM2_TSS_ENGINE_SITE` to use `$(call github,...)` but required additional changes to properly bootstrap `configure`. The previous URL downloaded the release artifact which contained a `VERSION` file, while the tagged source archive does not contain a `VERSION` file. (suggested by Vincent Jardin) - Added `BR2_PACKAGE_TPM2_TSS_ENGINE_DIGEST_SIGN` to toggle `digestsign` compile time option. `digestsign` is enabled by default, hence the use of `ifneq`. (suggested by Vincent Jardin) - Removed hardcoded `enginesdir` in favor of value from `pkg-config`. I opted on using the `define` directive in hope that it is easier to read/digest. (suggested by Vincent Jardin) package/Config.in | 1 + ...-disabling-of-digest-sign-operations.patch | 46 +++++++++++++++++++ package/tpm2-tss-engine/Config.in | 21 +++++++++ package/tpm2-tss-engine/tpm2-tss-engine.hash | 3 ++ package/tpm2-tss-engine/tpm2-tss-engine.mk | 40 ++++++++++++++++ 5 files changed, 111 insertions(+) create mode 100644 package/tpm2-tss-engine/0001-Allow-disabling-of-digest-sign-operations.patch create mode 100644 package/tpm2-tss-engine/Config.in create mode 100644 package/tpm2-tss-engine/tpm2-tss-engine.hash create mode 100644 package/tpm2-tss-engine/tpm2-tss-engine.mk diff --git a/package/Config.in b/package/Config.in index 1eb5e1e020..4f4b7a34d5 100644 --- a/package/Config.in +++ b/package/Config.in @@ -1633,6 +1633,7 @@ menu "Crypto" source "package/tpm2-openssl/Config.in" source "package/tpm2-pkcs11/Config.in" source "package/tpm2-tss/Config.in" + source "package/tpm2-tss-engine/Config.in" source "package/trousers/Config.in" source "package/ustream-ssl/Config.in" source "package/wolfssl/Config.in" diff --git a/package/tpm2-tss-engine/0001-Allow-disabling-of-digest-sign-operations.patch b/package/tpm2-tss-engine/0001-Allow-disabling-of-digest-sign-operations.patch new file mode 100644 index 0000000000..7ce717df4a --- /dev/null +++ b/package/tpm2-tss-engine/0001-Allow-disabling-of-digest-sign-operations.patch @@ -0,0 +1,46 @@ +From af8b26e7ffe69837197fb841e9a31230ae01c9cc Mon Sep 17 00:00:00 2001 +From: Andreas Fuchs <andreas.fuchs@infineon.com> +Date: Mon, 22 May 2023 14:06:41 +0200 +Subject: [PATCH] Configure: Allow disabling of digest-sign operations + +Since the digest-sign operations perform the hash on the TPM and +TPMs in general do not support SHA512, this can lead to errors. +Depending on the use case, it might be preferable to not support +restricted keys (via digest+sign) but to rely on ordinary keys +only. + +Upstream: https://github.com/tpm2-software/tpm2-tss-engine/commit/af8b26e7ffe69837197fb841e9a31230ae01c9cc +Signed-off-by: Andreas Fuchs <andreas.fuchs@infineon.com> +--- + configure.ac | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/configure.ac b/configure.ac +index d4a9356..b379042 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -116,13 +116,19 @@ PKG_CHECK_MODULES([CRYPTO], [libcrypto >= 1.0.2g], + PKG_CHECK_MODULES([TSS2_ESYS], [tss2-esys >= 2.3]) + PKG_CHECK_MODULES([TSS2_MU], [tss2-mu]) + PKG_CHECK_MODULES([TSS2_TCTILDR], [tss2-tctildr]) ++ + AC_CHECK_LIB([crypto], EC_KEY_METHOD_set_compute_key, + [AM_CONDITIONAL([HAVE_OPENSSL_ECDH], true)], + [AM_CONDITIONAL([HAVE_OPENSSL_ECDH], false)]) ++ ++AC_ARG_ENABLE([digestsign], ++ [AS_HELP_STRING([--disable-digestsign], ++ [Disable support for digest and sign methods, helps with TPM unsupported hash algorithms.])],, ++ [enable_digestsign=yes]) + AC_CHECK_LIB([crypto], EVP_PKEY_meth_set_digest_custom, +- [AM_CONDITIONAL([HAVE_OPENSSL_DIGEST_SIGN], true)], ++ [AM_CONDITIONAL([HAVE_OPENSSL_DIGEST_SIGN], [test "x$enable_digestsign" != "xno"])], + [AM_CONDITIONAL([HAVE_OPENSSL_DIGEST_SIGN], false)]) +-AS_IF([test "x$ac_cv_lib_crypto_EVP_PKEY_meth_set_digest_custom" = xyes], ++AS_IF([test "x$ac_cv_lib_crypto_EVP_PKEY_meth_set_digest_custom" = xyes && test "x$enable_digestsign" = "xyes"], + [AC_DEFINE([HAVE_OPENSSL_DIGEST_SIGN], [1], + Have required functionality from OpenSSL to support digest and sign)]) + +-- +2.47.0 + diff --git a/package/tpm2-tss-engine/Config.in b/package/tpm2-tss-engine/Config.in new file mode 100644 index 0000000000..00f8ac7632 --- /dev/null +++ b/package/tpm2-tss-engine/Config.in @@ -0,0 +1,21 @@ +config BR2_PACKAGE_TPM2_TSS_ENGINE + bool "tpm2-tss-engine" + select BR2_PACKAGE_TPM2_TSS + select BR2_PACKAGE_LIBOPENSSL_ENGINES + help + The tpm2-tss-engine project implements a cryptographic engine + for OpenSSL for Trusted Platform Module (TPM 2.0) using the + tpm2-tss software stack that follows the Trusted Computing + Groups (TCG) TPM Software Stack (TSS 2.0). It uses the + Enhanced System API (ESAPI) interface of the TSS 2.0 for + downwards communication. It supports RSA decryption and + signatures as well as ECDSA signatures. + +if BR2_PACKAGE_TPM2_TSS_ENGINE + +config BR2_PACKAGE_TPM2_TSS_ENGINE_DIGEST_SIGN + bool "enable digest and sign support" + help + Enable digest-sign hash operations on the TPM. + +endif diff --git a/package/tpm2-tss-engine/tpm2-tss-engine.hash b/package/tpm2-tss-engine/tpm2-tss-engine.hash new file mode 100644 index 0000000000..176d41390f --- /dev/null +++ b/package/tpm2-tss-engine/tpm2-tss-engine.hash @@ -0,0 +1,3 @@ +# Locally computed: +sha256 2b1b71aab191cf2a3f4c92a12a9dc7a3d362807693148802ab3335431f904eb2 tpm2-tss-engine-1.2.0.tar.gz +sha256 7a77915f34caf18d47bc31750dae47dbd7f7895e95bbb8370f477c25009388f6 LICENSE diff --git a/package/tpm2-tss-engine/tpm2-tss-engine.mk b/package/tpm2-tss-engine/tpm2-tss-engine.mk new file mode 100644 index 0000000000..d6beee4bf3 --- /dev/null +++ b/package/tpm2-tss-engine/tpm2-tss-engine.mk @@ -0,0 +1,40 @@ +################################################################################ +# +# tpm2-tss-engine +# +################################################################################ + +TPM2_TSS_ENGINE_VERSION = 1.2.0 +TPM2_TSS_ENGINE_SITE = $(call github,tpm2-software,tpm2-tss-engine,$(TPM2_TSS_ENGINE_VERSION)) +TPM2_TSS_ENGINE_LICENSE = BSD-3-Clause +TPM2_TSS_ENGINE_LICENSE_FILES = LICENSE +TPM2_TSS_ENGINE_INSTALL_STAGING = YES +TPM2_TSS_ENGINE_DEPENDENCIES = host-autoconf-archive host-pkgconf tpm2-tss +TPM2_TSS_ENGINE_AUTORECONF = YES +TPM2_TSS_ENGINE_AUTORECONF_OPTS = --include=$(HOST_DIR)/share/autoconf-archive + +define TPM2_TSS_ENGINE_BOOTSTRAP + echo $(TPM2_TSS_ENGINE_VERSION) > $(@D)/VERSION +endef + +TPM2_TSS_ENGINE_PRE_CONFIGURE_HOOKS = TPM2_TSS_ENGINE_BOOTSTRAP + +# Since the OpenSSL 3.0 Engine APIs are deprecated, suppress the warnings. +TPM2_TSS_ENGINE_CFLAGS = $(TARGET_CFLAGS) -Wno-deprecated-declarations +TPM2_TSS_ENGINE_CONF_ENV += CFLAGS="$(TPM2_TSS_ENGINE_CFLAGS)" + +define TPM2_TSS_ENGINE_ENGINESDIR + $(PKG_CONFIG_HOST_BINARY) --variable=enginesdir libcrypto \ + | xargs readlink -f \ + | sed 's%^$(STAGING_DIR)%%' +endef + +TPM2_TSS_ENGINE_CONF_OPTS = \ + --disable-defaultflags \ + --with-enginesdir=`$(TPM2_TSS_ENGINE_ENGINESDIR)` + +ifneq ($(BR2_PACKAGE_TPM2_TSS_ENGINE_DIGEST_SIGN),y) +TPM2_TSS_ENGINE_CONF_OPTS += --disable-digestsign +endif + +$(eval $(autotools-package)) -- 2.47.0 _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply related [flat|nested] 14+ messages in thread
* [Buildroot] [PATCH v3 2/2] package/tpm2-tss-engine: add version 1.2.0 2024-11-27 5:27 ` [Buildroot] [PATCH v2 " abelino @ 2024-11-29 22:13 ` Abelino Romo 2025-12-23 21:23 ` Thomas Petazzoni via buildroot 0 siblings, 1 reply; 14+ messages in thread From: Abelino Romo @ 2024-11-29 22:13 UTC (permalink / raw) To: buildroot; +Cc: Thomas Petazzoni, Abelino Romo Introduce the TPM2-TSS OpenSSL Engine to enable TPM2 device support in ecosystems that do not yet support OpenSSL Providers. This is particularly useful in the Erlang space, where OpenSSL 3 Providers are still under development [1]. [1] https://erlangforums.com/t/openssl-3-support-for-provider-deprecated-engine-replacement/2954/2 Signed-off-by: Abelino Romo <abelino.romo@gmail.com> --- Changes v2 -> v3: - Use manually uploaded tarball - the artifact from releases/download URL - and not the archive tarball. (suggested by Thomas Petazzoni in tpm2-tss patch thread) - Updated Signed-Off formatting. (suggested by Thomas Petazzoni in tpm2-tss patch thread) package/Config.in | 1 + ...-disabling-of-digest-sign-operations.patch | 46 +++++++++++++++++++ package/tpm2-tss-engine/Config.in | 21 +++++++++ package/tpm2-tss-engine/tpm2-tss-engine.hash | 3 ++ package/tpm2-tss-engine/tpm2-tss-engine.mk | 33 +++++++++++++ 5 files changed, 104 insertions(+) create mode 100644 package/tpm2-tss-engine/0001-Allow-disabling-of-digest-sign-operations.patch create mode 100644 package/tpm2-tss-engine/Config.in create mode 100644 package/tpm2-tss-engine/tpm2-tss-engine.hash create mode 100644 package/tpm2-tss-engine/tpm2-tss-engine.mk diff --git a/package/Config.in b/package/Config.in index 1eb5e1e020..4f4b7a34d5 100644 --- a/package/Config.in +++ b/package/Config.in @@ -1633,6 +1633,7 @@ menu "Crypto" source "package/tpm2-openssl/Config.in" source "package/tpm2-pkcs11/Config.in" source "package/tpm2-tss/Config.in" + source "package/tpm2-tss-engine/Config.in" source "package/trousers/Config.in" source "package/ustream-ssl/Config.in" source "package/wolfssl/Config.in" diff --git a/package/tpm2-tss-engine/0001-Allow-disabling-of-digest-sign-operations.patch b/package/tpm2-tss-engine/0001-Allow-disabling-of-digest-sign-operations.patch new file mode 100644 index 0000000000..7ce717df4a --- /dev/null +++ b/package/tpm2-tss-engine/0001-Allow-disabling-of-digest-sign-operations.patch @@ -0,0 +1,46 @@ +From af8b26e7ffe69837197fb841e9a31230ae01c9cc Mon Sep 17 00:00:00 2001 +From: Andreas Fuchs <andreas.fuchs@infineon.com> +Date: Mon, 22 May 2023 14:06:41 +0200 +Subject: [PATCH] Configure: Allow disabling of digest-sign operations + +Since the digest-sign operations perform the hash on the TPM and +TPMs in general do not support SHA512, this can lead to errors. +Depending on the use case, it might be preferable to not support +restricted keys (via digest+sign) but to rely on ordinary keys +only. + +Upstream: https://github.com/tpm2-software/tpm2-tss-engine/commit/af8b26e7ffe69837197fb841e9a31230ae01c9cc +Signed-off-by: Andreas Fuchs <andreas.fuchs@infineon.com> +--- + configure.ac | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/configure.ac b/configure.ac +index d4a9356..b379042 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -116,13 +116,19 @@ PKG_CHECK_MODULES([CRYPTO], [libcrypto >= 1.0.2g], + PKG_CHECK_MODULES([TSS2_ESYS], [tss2-esys >= 2.3]) + PKG_CHECK_MODULES([TSS2_MU], [tss2-mu]) + PKG_CHECK_MODULES([TSS2_TCTILDR], [tss2-tctildr]) ++ + AC_CHECK_LIB([crypto], EC_KEY_METHOD_set_compute_key, + [AM_CONDITIONAL([HAVE_OPENSSL_ECDH], true)], + [AM_CONDITIONAL([HAVE_OPENSSL_ECDH], false)]) ++ ++AC_ARG_ENABLE([digestsign], ++ [AS_HELP_STRING([--disable-digestsign], ++ [Disable support for digest and sign methods, helps with TPM unsupported hash algorithms.])],, ++ [enable_digestsign=yes]) + AC_CHECK_LIB([crypto], EVP_PKEY_meth_set_digest_custom, +- [AM_CONDITIONAL([HAVE_OPENSSL_DIGEST_SIGN], true)], ++ [AM_CONDITIONAL([HAVE_OPENSSL_DIGEST_SIGN], [test "x$enable_digestsign" != "xno"])], + [AM_CONDITIONAL([HAVE_OPENSSL_DIGEST_SIGN], false)]) +-AS_IF([test "x$ac_cv_lib_crypto_EVP_PKEY_meth_set_digest_custom" = xyes], ++AS_IF([test "x$ac_cv_lib_crypto_EVP_PKEY_meth_set_digest_custom" = xyes && test "x$enable_digestsign" = "xyes"], + [AC_DEFINE([HAVE_OPENSSL_DIGEST_SIGN], [1], + Have required functionality from OpenSSL to support digest and sign)]) + +-- +2.47.0 + diff --git a/package/tpm2-tss-engine/Config.in b/package/tpm2-tss-engine/Config.in new file mode 100644 index 0000000000..00f8ac7632 --- /dev/null +++ b/package/tpm2-tss-engine/Config.in @@ -0,0 +1,21 @@ +config BR2_PACKAGE_TPM2_TSS_ENGINE + bool "tpm2-tss-engine" + select BR2_PACKAGE_TPM2_TSS + select BR2_PACKAGE_LIBOPENSSL_ENGINES + help + The tpm2-tss-engine project implements a cryptographic engine + for OpenSSL for Trusted Platform Module (TPM 2.0) using the + tpm2-tss software stack that follows the Trusted Computing + Groups (TCG) TPM Software Stack (TSS 2.0). It uses the + Enhanced System API (ESAPI) interface of the TSS 2.0 for + downwards communication. It supports RSA decryption and + signatures as well as ECDSA signatures. + +if BR2_PACKAGE_TPM2_TSS_ENGINE + +config BR2_PACKAGE_TPM2_TSS_ENGINE_DIGEST_SIGN + bool "enable digest and sign support" + help + Enable digest-sign hash operations on the TPM. + +endif diff --git a/package/tpm2-tss-engine/tpm2-tss-engine.hash b/package/tpm2-tss-engine/tpm2-tss-engine.hash new file mode 100644 index 0000000000..294847d5f8 --- /dev/null +++ b/package/tpm2-tss-engine/tpm2-tss-engine.hash @@ -0,0 +1,3 @@ +# Locally computed: +sha256 3c94fef110dd3630b3c28c5875febba76b7d5ba2fcc04a14c4a30f5d2157c265 tpm2-tss-engine-1.2.0.tar.gz +sha256 7a77915f34caf18d47bc31750dae47dbd7f7895e95bbb8370f477c25009388f6 LICENSE diff --git a/package/tpm2-tss-engine/tpm2-tss-engine.mk b/package/tpm2-tss-engine/tpm2-tss-engine.mk new file mode 100644 index 0000000000..66c5584505 --- /dev/null +++ b/package/tpm2-tss-engine/tpm2-tss-engine.mk @@ -0,0 +1,33 @@ +################################################################################ +# +# tpm2-tss-engine +# +################################################################################ + +TPM2_TSS_ENGINE_VERSION = 1.2.0 +TPM2_TSS_ENGINE_SITE = https://github.com/tpm2-software/tpm2-tss-engine/releases/download/$(TPM2_TSS_ENGINE_VERSION) +TPM2_TSS_ENGINE_LICENSE = BSD-3-Clause +TPM2_TSS_ENGINE_LICENSE_FILES = LICENSE +TPM2_TSS_ENGINE_INSTALL_STAGING = YES +TPM2_TSS_ENGINE_DEPENDENCIES = host-pkgconf tpm2-tss +TPM2_TSS_ENGINE_AUTORECONF = YES + +# Since the OpenSSL 3.0 Engine APIs are deprecated, suppress the warnings. +TPM2_TSS_ENGINE_CFLAGS = $(TARGET_CFLAGS) -Wno-deprecated-declarations +TPM2_TSS_ENGINE_CONF_ENV += CFLAGS="$(TPM2_TSS_ENGINE_CFLAGS)" + +define TPM2_TSS_ENGINE_ENGINESDIR + $(PKG_CONFIG_HOST_BINARY) --variable=enginesdir libcrypto \ + | xargs readlink -f \ + | sed 's%^$(STAGING_DIR)%%' +endef + +TPM2_TSS_ENGINE_CONF_OPTS = \ + --disable-defaultflags \ + --with-enginesdir=`$(TPM2_TSS_ENGINE_ENGINESDIR)` + +ifneq ($(BR2_PACKAGE_TPM2_TSS_ENGINE_DIGEST_SIGN),y) +TPM2_TSS_ENGINE_CONF_OPTS += --disable-digestsign +endif + +$(eval $(autotools-package)) -- 2.47.0 _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply related [flat|nested] 14+ messages in thread
* Re: [Buildroot] [PATCH v3 2/2] package/tpm2-tss-engine: add version 1.2.0 2024-11-29 22:13 ` [Buildroot] [PATCH v3 " Abelino Romo @ 2025-12-23 21:23 ` Thomas Petazzoni via buildroot 2025-12-23 21:25 ` Thomas Petazzoni via buildroot 0 siblings, 1 reply; 14+ messages in thread From: Thomas Petazzoni via buildroot @ 2025-12-23 21:23 UTC (permalink / raw) To: Abelino Romo; +Cc: buildroot Hello Abelino, Sorry for the very very long delay in getting back to you. I wanted to apply this, but unfortunately, it causes a build failure when BR2_PACKAGE_TPM2_TSS_ENGINE_DIGEST_SIGN is enabled: src/tpm2-tss-engine-ecc.c: In function ‘init_ecc’: src/tpm2-tss-engine-ecc.c:864:46: error: passing argument 2 of ‘EVP_PKEY_meth_get_copy’ from incompatible pointer type [-Wincompatible-pointer-types] 864 | EVP_PKEY_meth_get_copy(pkey_ecc_methods, &ecdsa_pkey_orig_copy); | ^~~~~~~~~~~~~~~~~~~~~ | | | int (**)(EVP_PKEY_CTX *, EVP_PKEY_CTX *) {aka int (**)(struct evp_pkey_ctx_st *, struct evp_pkey_ctx_st *)} src/tpm2-tss-engine-ecc.c:867:46: error: passing argument 2 of ‘EVP_PKEY_meth_set_copy’ from incompatible pointer type [-Wincompatible-pointer-types] 867 | EVP_PKEY_meth_set_copy(pkey_ecc_methods, ecdsa_pkey_copy); | ^~~~~~~~~~~~~~~ | | | int (*)(EVP_PKEY_CTX *, EVP_PKEY_CTX *) {aka int (*)(struct evp_pkey_ctx_st *, struct evp_pkey_ctx_st *)} etc. Please see some more small comments below that I had fixed locally, but that would be needed for your v4. First, the commit title should be just: package/tpm2-tss-engine: new package On Fri, 29 Nov 2024 14:13:24 -0800 Abelino Romo <abelino.romo@gmail.com> wrote: > Introduce the TPM2-TSS OpenSSL Engine to enable TPM2 device support in > ecosystems that do not yet support OpenSSL Providers. This is > particularly useful in the Erlang space, where OpenSSL 3 Providers are > still under development [1]. > > [1] https://erlangforums.com/t/openssl-3-support-for-provider-deprecated-engine-replacement/2954/2 > > Signed-off-by: Abelino Romo <abelino.romo@gmail.com> > --- > Changes v2 -> v3: > - Use manually uploaded tarball - the artifact from releases/download URL - > and not the archive tarball. > (suggested by Thomas Petazzoni in tpm2-tss patch thread) > > - Updated Signed-Off formatting. > (suggested by Thomas Petazzoni in tpm2-tss patch thread) > > package/Config.in | 1 + > ...-disabling-of-digest-sign-operations.patch | 46 +++++++++++++++++++ > package/tpm2-tss-engine/Config.in | 21 +++++++++ > package/tpm2-tss-engine/tpm2-tss-engine.hash | 3 ++ > package/tpm2-tss-engine/tpm2-tss-engine.mk | 33 +++++++++++++ > 5 files changed, 104 insertions(+) Please add an entry in the DEVELOPERS file. > diff --git a/package/tpm2-tss-engine/Config.in b/package/tpm2-tss-engine/Config.in > new file mode 100644 > index 0000000000..00f8ac7632 > --- /dev/null > +++ b/package/tpm2-tss-engine/Config.in > @@ -0,0 +1,21 @@ > +config BR2_PACKAGE_TPM2_TSS_ENGINE > + bool "tpm2-tss-engine" > + select BR2_PACKAGE_TPM2_TSS > + select BR2_PACKAGE_LIBOPENSSL_ENGINES > + help > + The tpm2-tss-engine project implements a cryptographic engine > + for OpenSSL for Trusted Platform Module (TPM 2.0) using the > + tpm2-tss software stack that follows the Trusted Computing > + Groups (TCG) TPM Software Stack (TSS 2.0). It uses the > + Enhanced System API (ESAPI) interface of the TSS 2.0 for > + downwards communication. It supports RSA decryption and > + signatures as well as ECDSA signatures. Please add: + https://github.com/tpm2-software/tpm2-tss-engine/ > +# Since the OpenSSL 3.0 Engine APIs are deprecated, suppress the warnings. > +TPM2_TSS_ENGINE_CFLAGS = $(TARGET_CFLAGS) -Wno-deprecated-declarations > +TPM2_TSS_ENGINE_CONF_ENV += CFLAGS="$(TPM2_TSS_ENGINE_CFLAGS)" Change this to: +# Since the OpenSSL 3.0 Engine APIs are deprecated, suppress the warnings. +TPM2_TSS_ENGINE_CONF_ENV = \ + CFLAGS="$(TARGET_CFLAGS) -Wno-deprecated-declarations" > +define TPM2_TSS_ENGINE_ENGINESDIR > + $(PKG_CONFIG_HOST_BINARY) --variable=enginesdir libcrypto \ > + | xargs readlink -f \ > + | sed 's%^$(STAGING_DIR)%%' > +endef > + > +TPM2_TSS_ENGINE_CONF_OPTS = \ > + --disable-defaultflags \ > + --with-enginesdir=`$(TPM2_TSS_ENGINE_ENGINESDIR)` This to: +# pkg-config returns a libcrypto enginesdir prefixed with the sysroot, +# so let's rip it out. +TPM2_TSS_ENGINE_CONF_OPTS = \ + --disable-defaultflags \ + --with-enginesdir=`$(PKG_CONFIG_HOST_BINARY) --variable enginesdir libcrypto | xargs readlink -f | sed 's%^$(STAGING_DIR)%%'` > +ifneq ($(BR2_PACKAGE_TPM2_TSS_ENGINE_DIGEST_SIGN),y) > +TPM2_TSS_ENGINE_CONF_OPTS += --disable-digestsign > +endif And this to: +ifeq ($(BR2_PACKAGE_TPM2_TSS_ENGINE_DIGEST_SIGN),y) +TPM2_TSS_ENGINE_CONF_OPTS += --enable-digestsign +else +TPM2_TSS_ENGINE_CONF_OPTS += --disable-digestsign +endif Thanks a lot! Thomas -- Thomas Petazzoni, co-owner and CEO, Bootlin Embedded Linux and Kernel engineering and training https://bootlin.com _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [Buildroot] [PATCH v3 2/2] package/tpm2-tss-engine: add version 1.2.0 2025-12-23 21:23 ` Thomas Petazzoni via buildroot @ 2025-12-23 21:25 ` Thomas Petazzoni via buildroot 0 siblings, 0 replies; 14+ messages in thread From: Thomas Petazzoni via buildroot @ 2025-12-23 21:25 UTC (permalink / raw) To: Abelino Romo; +Cc: buildroot Hello, On Tue, 23 Dec 2025 22:23:58 +0100 Thomas Petazzoni <thomas.petazzoni@bootlin.com> wrote: > Sorry for the very very long delay in getting back to you. I wanted to > apply this, but unfortunately, it causes a build failure when > BR2_PACKAGE_TPM2_TSS_ENGINE_DIGEST_SIGN is enabled: BTW, here is the defconfig that was used to produce this build failure: BR2_aarch64=y BR2_TOOLCHAIN_EXTERNAL=y BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_AARCH64_GLIBC_STABLE=y BR2_INIT_NONE=y BR2_SYSTEM_BIN_SH_NONE=y # BR2_PACKAGE_BUSYBOX is not set # BR2_PACKAGE_LIBOPENSSL_ENABLE_CHACHA is not set # BR2_PACKAGE_LIBOPENSSL_ENABLE_RC2 is not set # BR2_PACKAGE_LIBOPENSSL_ENABLE_RC4 is not set # BR2_PACKAGE_LIBOPENSSL_ENABLE_MD2 is not set # BR2_PACKAGE_LIBOPENSSL_ENABLE_MD4 is not set # BR2_PACKAGE_LIBOPENSSL_ENABLE_MDC2 is not set # BR2_PACKAGE_LIBOPENSSL_ENABLE_BLAKE2 is not set # BR2_PACKAGE_LIBOPENSSL_ENABLE_IDEA is not set # BR2_PACKAGE_LIBOPENSSL_ENABLE_SEED is not set # BR2_PACKAGE_LIBOPENSSL_ENABLE_DES is not set # BR2_PACKAGE_LIBOPENSSL_ENABLE_RMD160 is not set # BR2_PACKAGE_LIBOPENSSL_ENABLE_WHIRLPOOL is not set # BR2_PACKAGE_LIBOPENSSL_ENABLE_BLOWFISH is not set # BR2_PACKAGE_LIBOPENSSL_ENABLE_SSL is not set # BR2_PACKAGE_LIBOPENSSL_ENABLE_SSL3 is not set # BR2_PACKAGE_LIBOPENSSL_ENABLE_WEAK_SSL is not set # BR2_PACKAGE_LIBOPENSSL_ENABLE_PSK is not set # BR2_PACKAGE_LIBOPENSSL_ENABLE_CAST is not set # BR2_PACKAGE_LIBOPENSSL_UNSECURE is not set # BR2_PACKAGE_LIBOPENSSL_DYNAMIC_ENGINE is not set # BR2_PACKAGE_LIBOPENSSL_ENABLE_COMP is not set # BR2_PACKAGE_LIBOPENSSL_ENABLE_ARGON2 is not set # BR2_PACKAGE_LIBOPENSSL_ENABLE_CACHED_FETCH is not set # BR2_PACKAGE_LIBOPENSSL_ENABLE_CMP is not set # BR2_PACKAGE_LIBOPENSSL_ENABLE_THREAD_POOL is not set # BR2_PACKAGE_LIBOPENSSL_ENABLE_ECX is not set # BR2_PACKAGE_LIBOPENSSL_ENABLE_PADLOCK_ENGINE is not set # BR2_PACKAGE_LIBOPENSSL_ENABLE_MODULE is not set # BR2_PACKAGE_LIBOPENSSL_ENABLE_QUIC is not set # BR2_PACKAGE_LIBOPENSSL_SECURE_MEMORY is not set # BR2_PACKAGE_LIBOPENSSL_ENABLE_SIV is not set # BR2_PACKAGE_LIBOPENSSL_ENABLE_SM2_PRECOMP_TABLE is not set # BR2_PACKAGE_LIBOPENSSL_ENABLE_SSL_TRACE is not set BR2_PACKAGE_TPM2_TSS_ENGINE=y BR2_PACKAGE_TPM2_TSS_ENGINE_DIGEST_SIGN=y # BR2_TARGET_ROOTFS_TAR is not set Thomas -- Thomas Petazzoni, co-owner and CEO, Bootlin Embedded Linux and Kernel engineering and training https://bootlin.com _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply [flat|nested] 14+ messages in thread
end of thread, other threads:[~2025-12-23 21:25 UTC | newest] Thread overview: 14+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2024-11-25 0:02 [Buildroot] [PATCH 0/2] Add support for tpm2-tss v4.1.3 and tpm2-tss-engine v1.2.0 abelino 2024-11-25 0:02 ` [Buildroot] [PATCH 1/2] package/tpm2-tss: bump version to 4.1.3 abelino 2024-11-25 17:18 ` Vincent Jardin 2024-11-28 10:46 ` Fiona Klute via buildroot 2024-11-27 5:25 ` [Buildroot] [PATCH v2 " abelino 2024-11-28 20:25 ` Thomas Petazzoni via buildroot 2024-11-29 22:10 ` [Buildroot] [PATCH v3 " Abelino Romo 2025-07-07 15:18 ` Fiona Klute via buildroot 2024-11-25 0:02 ` [Buildroot] [PATCH 2/2] package/tpm2-tss-engine: add version 1.2.0 abelino 2024-11-25 17:11 ` Vincent Jardin 2024-11-27 5:27 ` [Buildroot] [PATCH v2 " abelino 2024-11-29 22:13 ` [Buildroot] [PATCH v3 " Abelino Romo 2025-12-23 21:23 ` Thomas Petazzoni via buildroot 2025-12-23 21:25 ` Thomas Petazzoni via buildroot
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox