| commit | a3102802ec00f805ad04ca09019d6e0fa5aa351e | [log] [tgz] |
|---|---|---|
| author | pigweed-roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com> | Sun May 04 17:46:37 2025 -0700 |
| committer | CQ Bot Account <pigweed-scoped@luci-project-accounts.iam.gserviceaccount.com> | Sun May 04 17:46:37 2025 -0700 |
| tree | f0ce31b89560b1c7bc71bad2efe362298222b419 | |
| parent | 32f3274ce515394198548ca299fde0dbfe8f9cbf [diff] |
roll: third_party/pigweed/src f36b192..947b968 (47 commits) 947b968:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/288653 roll: gn d0b2600:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/288612 roll: luci 925aac6:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/287717 roll: ninja e8edb40:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/288512 roll: fuchsia-infra-bazel-rules d5b63c1..726a944 (37 commits) 8201494:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/287712 various: Fix -Wsign-conversion issues b8cc704:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/287552 gn: Migrate remaining dir_pw_third_party/* references 133b8d6:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/284852 pw_kernel: Initial support for user stacks bd95b52:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/286849 zephyr: Add coverage reports to presubmit a33ac31:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/286845 pw_digital_io_zephyr: Zephyr wrappers for Digital* 46cfdcf:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/287513 pw_kernel: Remove entry crate 9c35494:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/288152 pw_env_setup: Upgrade to NodeJS 20.19.1 86ca49b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/287892 pw_presubmit: Fix some bucket processing 441e18b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/287432 docs: Move pigweed.dev-specific extensions 3ddd016:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/286433 pw_rpc: Migrate size reports to Bazel cb0cdb4:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/286952 pw_kernel: Call EBREAK on RISC-V panic ce8bfdf:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/287672 pw_presubmit: Read buildbucket info from json 050cd22:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/282937 pw_toolchain: Fix and enable internal_strict_warnings in Bazel 7a7eaa8:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/287732 pw_bluetooth_proxy: Fix trivial warning aac8b0e:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/287673 pw_bluetooth: Fix trivial warning 5800f3c:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/284686 pw_protobuf_compiler: Fix nanopb regen in CMake and GN 287cb91:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/287234 pw_rpc: Fix MinEncodedSizeBytes for pw rpc packet c75066e:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/286412 pw_async_basic: Migrate size reports to Bazel d42b678:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/287297 pw_package: Update docs aa79994:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/285857 third_party/fuchsia: Use pw_external_fuchsia in gn 6ddd267:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/189420 third_party: Remove re2 87bd99f:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/287294 pw_bluetooth_sapphire: Fix gtest_filter option in docs bea4938:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/287292 pw_function: Migrate size reports to Bazel 1504ec4:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/286972 pw_bluetooth_sapphire: Implement ConnectionReceiver2 f8a67a2:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/278512 pw_ide: Update .gitignore per new VS Code ext a0f4099:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/286838 pw_async2: Use IntrusiveList to store tasks 2055a56:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/287173 pw_kernel: Use more verbose variable names 93e949d:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/286421 pw_sync_zephyr: Counting semaphore and semaphore fixes 861004c:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/287232 docs: Update console link a1e323b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/286502 pw_bluetooth_sapphire: Fix fuchsia emu docs a589e90:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/287233 roll: fuchsia-infra-bazel-rules [roll] Roll fuchsia-infra-bazel-rules-bazel_sdk-cipd packages to version:27.20250429.4.1 448fef4:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/286252 pw_bluetooth_sapphire: Use inspect in ActivityGovernorLeaseProvider 9b86116:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/286134 pw_bluetooth_sapphire: Use ActivityGovernorLeaseProvider 2b9282f:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/287152 roll: fuchsia-infra-bazel-rules cb9e321..47af2cf (25 commits) 687d21a:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/284396 pw_bluetooth_sapphire: Use SuspendBlocker in LeaseProvider d094133:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/286852 pw_bluetooth: Add sniff-related HCI definitions ddf5154:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/286532 pw_bluetooth_proxy: Migrate size reports to Bazel 91fc8c4:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/286837 pw_containers: Prohibit InlineDeque::resize() exceeding max_size() 49eaa58:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/282938 pw_thread: Introduce ThreadChecker 78f9a92:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/286853 pw_bluetooth_sapphire: Add sniff definitions 13e8d3f:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/282913 pw_tokenizer: Nested Base64 detokenization updates 80b2432:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/286504 pw_grpc: Create module enable constraint b25f844:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/286452 pw_rpc: Depend on mutex only if enabling PW_RPC_USE_GLOBAL_MUTEX Rolled-Repo: https://pigweed.googlesource.com/pigweed/pigweed Rolled-Commits: f36b192d1ad8c6..947b9681400b8b Roll-Count: 1 Roller-URL: https://cr-buildbucket.appspot.com/build/8715754772391063953 GitWatcher: ignore CQ-Do-Not-Cancel-Tryjobs: true Change-Id: I3d8aa62ac29b91644b8d7128de167cd8bfc29bcf Reviewed-on: https://pigweed-review.googlesource.com/c/open-dice/+/288597 Lint: Lint 🤖 <android-build-ayeaye@system.gserviceaccount.com> Bot-Commit: Pigweed Roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com> Commit-Queue: Pigweed Roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com>
This repository contains the specification for the Open Profile for DICE along with production-quality code. This profile is a specialization of the Hardware Requirements for a Device Identifier Composition Engine and DICE Layering Architecture specifications published by the Trusted Computing Group (TCG). For readers already familiar with those specs, notable distinctives of this profile include:
You can find us (and join us!) at https://groups.google.com/g/open-profile-for-dice. We're happy to answer questions and discuss proposed changes or features.
The specification can be found here. It is versioned using a major.minor scheme. Compatibility is maintained across minor versions but not necessarily across major versions.
Production quality, portable C code is included. The main code is in dice.h and dice.c. Cryptographic and certificate generation operations are injected via a set of callbacks. Multiple implementations of these operations are provided, all equally acceptable. Integrators should choose just one of these, or write their own.
Tests are included for all code and the build files in this repository can be used to build and run these tests.
Disclaimer: This is not an officially supported Google product.
Different implementations use different third party libraries. The third_party directory contains build files and git submodules for each of these. The submodules must be initialized once after cloning the repo, using git submodule update --init, and updated after pulling commits that roll the submodules using git submodule update.
To setup the build environment the first time:
$ git submodule update --init --recursive $ source bootstrap.sh $ gn gen out
To build and run tests:
$ ninja -C out
The easiest way, and currently the only supported way, to build and run tests is from a Pigweed environment on Linux. Pigweed does support other host platforms so it shouldn't be too hard to get this running on Windows for example, but we use Linux.
There are two scripts to help set this up:
bootstrap.sh will initialize submodules, bootstrap a Pigweed environment, and generate build files. This can take some time and may download on the order of 1GB of dependencies so the normal workflow is to just do this once.
activate.sh quickly reactivates an environment that has been previously bootstrapped.
These scripts must be sourced into the current session: source activate.sh.
In the environment, from the base directory of the dice-profile checkout, run ninja -C out to build everything and run all tests. You can also run pw watch which will build, run tests, and continue to watch for changes.
This will build and run tests on the host using the clang toolchain. Pigweed makes it easy to configure other targets and toolchains. See toolchains/BUILD.gn and the Pigweed documentation.
The code is designed to be portable and should work with a variety of modern toolchains and in a variety of environments. The main code in dice.h and dice.c is C99; it uses uint8_t, size_t, and memcpy from the C standard library. The various ops implementations are as portable as their dependencies (often not C99 but still very portable). Notably, this code uses designated initializers for readability. This is a feature available in C since C99 but missing from C++ until C++20 where it appears in a stricter form.
The Google C++ Style Guide is used. A .clang-format file is provided for convenience.
To incorporate the code into another project, there are a few options:
Copy only the necessary code. For example:
Take the main code as is: include/dice/dice.h, src/dice.c
Choose an implementation for crypto and certificate generation or choose to write your own. If you choose the boringssl implementation, for example, take include/dice/utils.h, include/dice/boringssl_ops.h, src/utils.c, and src/boringssl_ops.c. Taking a look at the library targets in BUILD.gn may be helpful.
Add this repository as a git submodule and integrate into the project build, optionally using the gn library targets provided.
Integrate into a project already using Pigweed using the gn build files provided.
The build reports code size using Bloaty McBloatface via the pw_bloat Pigweed module. There are two reports generated:
Library sizes - This report includes just the library code in this repository. It shows the baseline DICE code with no ops selected, and it shows the delta introduced by choosing various ops implementations. This report does not include the size of the third party dependencies.
Executable sizes - This report includes sizes for the library code in this repository plus all dependencies linked into a simple main function which makes a single DICE call with all-zero input. It shows the baseline DICE code with no ops (and therefore no dependencies other than libc), and it shows the delta introduced by choosing various ops implementations. This report does include the size of the third party dependencies. Note that rows specialized from ‘Boringssl Ops’ use that as a baseline for sizing.
The reports will be in the build output, but you can also find the reports in .txt files in the build output. For example, cat out/host_optimized/gen/*.txt | less will display all reports.
This code does not itself use mutable global variables, or any other type of shared data structure so there is no thread-safety concerns. However, additional care is needed to ensure dependencies are configured to be thread-safe. For example, the current boringssl configuration defines OPENSSL_NO_THREADS_CORRUPT_MEMORY_AND_LEAK_SECRETS_IF_THREADED, and that would need to be changed before running in a threaded environment.
This code makes a reasonable effort to clear memory holding sensitive data. This may help with a broader strategy to clear sensitive data but it is not sufficient on its own. Here are a few things to consider.