From: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
To: grub-devel@gnu.org
Cc: jan.setjeeilers@oracle.com, julian.klode@canonical.com,
mate.kukri@canonical.com, pjones@redhat.com, msuchanek@suse.com,
mlewando@redhat.com, nayna@linux.ibm.com,
ltcgcw@linux.vnet.ibm.com, ssrish@linux.ibm.com,
stefanb@linux.ibm.com, avnish@linux.ibm.com,
Daniel Axtens <dja@axtens.net>,
Sudhakar Kuppusamy <sudhakar@linux.ibm.com>,
Vladimir Serbinenko <phcoder@gmail.com>,
Daniel Kiper <daniel.kiper@oracle.com>
Subject: [PATCH v4 05/23] crypto: Move storage for grub_crypto_pk_* to crypto.c
Date: Wed, 9 Jul 2025 17:15:22 +0530 [thread overview]
Message-ID: <20250709114540.58608-6-sudhakar@linux.ibm.com> (raw)
In-Reply-To: <20250709114540.58608-1-sudhakar@linux.ibm.com>
From: Daniel Axtens <dja@axtens.net>
The way gcry_rsa and friends (the asymmetric ciphers) are loaded for the
pgp module is a bit quirky.
include/grub/crypto.h contains:
extern struct gcry_pk_spec *grub_crypto_pk_rsa;
commands/pgp.c contains the actual storage:
struct gcry_pk_spec *grub_crypto_pk_rsa;
And the module itself saves to the storage in pgp.c:
GRUB_MOD_INIT(gcry_rsa)
{
grub_crypto_pk_rsa = &_gcry_pubkey_spec_rsa;
}
This is annoying: gcry_rsa now has a dependency on pgp!
We want to be able to bring in gcry_rsa without bringing in PGP,
so move the storage to crypto.c.
Previously, gcry_rsa depended on pgp and mpi. Now it depends on
crypto and mpi. As pgp depends on crypto, this doesn't add any new
module dependencies using the PGP verfier.
[FWIW, the story is different for the symmetric ciphers. cryptodisk
and friends (zfs encryption etc) use grub_crypto_lookup_cipher_by_name()
to get a cipher handle. That depends on grub_ciphers being populated
by people calling grub_cipher_register. import_gcry.py ensures that the
symmetric ciphers call it.]
Signed-off-by: Daniel Axtens <dja@axtens.net>
Signed-off-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Vladimir Serbinenko <phcoder@gmail.com>
Reviewed-by: Avnish Chouhan <avnish@linux.ibm.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
---
grub-core/commands/pgp.c | 4 ----
grub-core/lib/crypto.c | 4 ++++
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/grub-core/commands/pgp.c b/grub-core/commands/pgp.c
index c80f6cbad..3be022593 100644
--- a/grub-core/commands/pgp.c
+++ b/grub-core/commands/pgp.c
@@ -147,10 +147,6 @@ const char *hashes[] = {
[0x0b] = "sha224"
};
-struct gcry_pk_spec *grub_crypto_pk_dsa;
-struct gcry_pk_spec *grub_crypto_pk_ecdsa;
-struct gcry_pk_spec *grub_crypto_pk_rsa;
-
static int
dsa_pad (gcry_mpi_t *hmpi, grub_uint8_t *hval,
const gcry_md_spec_t *hash, struct grub_public_subkey *sk);
diff --git a/grub-core/lib/crypto.c b/grub-core/lib/crypto.c
index 396f76410..d53ddbe2c 100644
--- a/grub-core/lib/crypto.c
+++ b/grub-core/lib/crypto.c
@@ -121,6 +121,10 @@ grub_md_unregister (gcry_md_spec_t *cipher)
}
}
+struct gcry_pk_spec *grub_crypto_pk_dsa;
+struct gcry_pk_spec *grub_crypto_pk_ecdsa;
+struct gcry_pk_spec *grub_crypto_pk_rsa;
+
void
grub_crypto_hash (const gcry_md_spec_t *hash, void *out, const void *in,
grub_size_t inlen)
--
2.39.5 (Apple Git-154)
_______________________________________________
Grub-devel mailing list
Grub-devel@gnu.org
https://lists.gnu.org/mailman/listinfo/grub-devel
next prev parent reply other threads:[~2025-07-09 11:49 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-07-09 11:45 [PATCH v4 00/23] Appended Signature Secure Boot Support for PowerPC Sudhakar Kuppusamy
2025-07-09 11:45 ` [PATCH v4 01/23] powerpc-ieee1275: Add support for signing GRUB with an appended signature Sudhakar Kuppusamy
2025-07-09 11:45 ` [PATCH v4 02/23] docs/grub: Document signing GRUB under UEFI Sudhakar Kuppusamy
2025-07-09 11:45 ` [PATCH v4 03/23] docs/grub: Document signing GRUB with an appended signature Sudhakar Kuppusamy
2025-07-09 11:45 ` [PATCH v4 04/23] pgp: Factor out rsa_pad Sudhakar Kuppusamy
2025-07-24 8:55 ` Gary Lin via Grub-devel
2025-07-31 12:01 ` Sudhakar Kuppusamy
2025-08-01 1:24 ` Gary Lin via Grub-devel
2025-07-09 11:45 ` Sudhakar Kuppusamy [this message]
2025-07-09 11:45 ` [PATCH v4 06/23] pgp: Rename OBJ_TYPE_PUBKEY to OBJ_TYPE_GPG_PUBKEY Sudhakar Kuppusamy
2025-07-09 11:45 ` [PATCH v4 07/23] grub-install: Support embedding x509 certificates Sudhakar Kuppusamy
2025-07-09 11:45 ` [PATCH v4 08/23] appended signatures: Import GNUTLS's ASN.1 description files Sudhakar Kuppusamy
2025-07-09 11:45 ` [PATCH v4 09/23] appended signatures: Parse ASN1 node Sudhakar Kuppusamy
2025-07-09 11:45 ` [PATCH v4 10/23] appended signatures: Parse PKCS#7 signedData Sudhakar Kuppusamy
2025-07-09 11:45 ` [PATCH v4 11/23] appended signatures: Parse X.509 certificates Sudhakar Kuppusamy
2025-07-09 11:45 ` [PATCH v4 12/23] appended signatures: Support verifying appended signatures Sudhakar Kuppusamy
2025-07-09 11:45 ` [PATCH v4 13/23] appended signatures: Verification tests Sudhakar Kuppusamy
2025-07-09 11:45 ` [PATCH v4 14/23] appended signatures: Documentation Sudhakar Kuppusamy
2025-07-09 11:45 ` [PATCH v4 15/23] ieee1275: Enter lockdown based on /ibm,secure-boot Sudhakar Kuppusamy
2025-07-09 11:45 ` [PATCH v4 16/23] ieee1275: Read the DB and DBX secure boot variables Sudhakar Kuppusamy
2025-07-09 11:45 ` [PATCH v4 17/23] appendedsig: create db and dbx lists Sudhakar Kuppusamy
2025-07-09 11:45 ` [PATCH v4 18/23] appendedsig: verify the kernel using " Sudhakar Kuppusamy
2025-07-09 11:45 ` [PATCH v4 19/23] powerpc_ieee1275: Introduce use_static_keys flag Sudhakar Kuppusamy
2025-07-09 11:45 ` [PATCH v4 20/23] appendedsig: Read default DB keys from the ELF Note Sudhakar Kuppusamy
2025-07-09 11:45 ` [PATCH v4 21/23] appendedsig: Introduce GRUB commands to access db and dbx Sudhakar Kuppusamy
2025-07-09 11:45 ` [PATCH v4 22/23] appendedsig: Documentation Sudhakar Kuppusamy
2025-07-09 11:45 ` [PATCH v4 23/23] appendedsig test: Replace the certificate number with an x.509 certificate Sudhakar Kuppusamy
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250709114540.58608-6-sudhakar@linux.ibm.com \
--to=sudhakar@linux.ibm.com \
--cc=avnish@linux.ibm.com \
--cc=daniel.kiper@oracle.com \
--cc=dja@axtens.net \
--cc=grub-devel@gnu.org \
--cc=jan.setjeeilers@oracle.com \
--cc=julian.klode@canonical.com \
--cc=ltcgcw@linux.vnet.ibm.com \
--cc=mate.kukri@canonical.com \
--cc=mlewando@redhat.com \
--cc=msuchanek@suse.com \
--cc=nayna@linux.ibm.com \
--cc=phcoder@gmail.com \
--cc=pjones@redhat.com \
--cc=ssrish@linux.ibm.com \
--cc=stefanb@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).