| commit | 099a7eab0e517e7d804d64e51a5677e88e94161a | [log] [tgz] |
|---|---|---|
| author | pigweed-roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com> | Sun Feb 02 16:48:37 2025 -0800 |
| committer | CQ Bot Account <pigweed-scoped@luci-project-accounts.iam.gserviceaccount.com> | Sun Feb 02 16:48:37 2025 -0800 |
| tree | 8bc2386fba88ded3796648ef1405eef8387f654d | |
| parent | 4bfd9d49c1c39e3417bb6934ae98c2031f7b05ae [diff] |
roll: third_party/pigweed/src 94476c3..854f542 (82 commits) 854f542:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/264372 roll: cmake 6797ea6:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/264312 roll: gn 98649f3:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/264274 roll: qemu 43bcece:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263876 roll: bazelisk-as-bazel 96fed24:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/264193 roll: ninja d2f7a36:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263836 pw_toolchain: Add support for Zephyr toolchain 7d11a8b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/264192 roll: fuchsia-infra-bazel-rules 124a9b9..56f08fc (44 commits) ce0f03c:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263835 zephyr: Expose sys_io.cc 9f0f4f8:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/260276 pw_allocator: Add overloads to customize allocated array alignment 05504be:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263834 zephyr: Fix sys_io.cc to respect Kconfig 471eba4:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263833 pw_build: Make run_action_on_executable public 4863c26:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/264013 pw_compilation_testing: Mark as testonly df2de54:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263839 docs: Quiet the Doxygen build fa34f28:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/262852 pw_bluetooth_sapphire: Set BR/EDR SM fixed channel support bit 5f46628:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263832 zephyr: Add Zephyr toolchain CIPD repo e01237e:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263874 bazel: Mark Fuchsia SDK as a dev dependency 93d9fac:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/261292 pw_bluetooth_sapphire: Add CTKD to SecureSimplePairingState 7cc06d3:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263613 pw_bluetooth_sapphire: Implement fragmenter for ISO 55d10c7:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263873 pw_build: Run tests under exec configuration d40145b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263933 pw_status: Fix broken link adf44be:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/260217 pw_bluetooth: Redefine Emboss packet filter UUID commands with sizes 0276228:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263612 pw_bluetooth_sapphire: Fix assert in IsoDataStreamImpl be2a1ae:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/249913 pw_allocator: Add block-related metrics 55309be:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/262453 pw_bluetooth_sapphire: Provide IsoDataStream to IsoStream d5a7cea:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263792 bazel: Layering check fixes f02e20d:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263716 pw_hdlc: Layering check fixes 5508852:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/255873 bazel: Get googletest from BCR 9512986:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263533 pw_presubmit: Fully qualify path to black 993747c:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263534 pw_thread_stl: Add thread creation headers to Android.bp 67d484d:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/262929 pw_bluetooth_sapphire: Return BR/EDR fixed channels async 1ef011c:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263495 targets/rp2040: Use link_extra_libs 2469327:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263573 pw_bluetooth_proxy: Add missing return to size report a2db99a:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263654 docs: Remove unused script abba322:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263652 pw_protobuf: Correct sfixed64 property f7c1d90:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263472 pw_protobuf: Set default values in generated message structs 012d00a:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/252854 pw_presubmit: New formatter cli be49916:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263374 pw_thread_stl: Remove includes attribute 1fec695:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263515 pw_uart: clang-tidy fix c332380:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263097 build: Roll rust toolchain 4379803:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263552 pw_transfer: clang-tidy fixes f1cc327:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263494 clang-tidy: Config updates 23840c1:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263514 pw_software_update: clang-tidy fix a42890d:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263154 pw_bluetooth_proxy: Replace kMaxDirections with kNumDirections b7c6f45:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263152 pw_bluetooth_proxy: Minor MultiBufWriter enhancements 7bec911:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/226611 pw_bluetooth: Add snoop log 0fa3d64:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263333 pw_json: Merge builder_impl.h header into builder.h c650ea7:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263096 build: Use -Oz for Rust toolchains with prebuilt targets 702dd6b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263252 pw_thread: Remove bad defaults 9446328:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/260413 build: Specify rustc_srcs_subdir for rust_analyzer_toolchains 51a7b5c:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/262873 pw_toolchain: Document clang-tidy + Bazel a2b8aec:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/262752 fuchsia_sdk: Check against accidental downloads cc8ce41:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/262875 pw_result: clang-tidy fix af41ce5:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/262874 pw_build: Add bazel flags to be set by LUCI 9e777b4:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263272 pw_build_android: Add warning about cc_defaults 58712f7:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/260392 pw_multibuf: Add GetBackingCapacity API 8f46035:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263193 build: Add more thumb triples to rules_rust 119d820:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/262923 build: Update rules_rust to 0.56.0 dff9ccc:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263132 docs: Treat warnings as errors in the Bazel build 2b29b9b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/262924 pw_cli: Move file_summary 46c7ea9:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/260092 pw_toolchain: Support building Rust libcore from source 1b93cc9:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263094 docs: Use the same Doxygen version on all platforms 91effbe:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/259715 pw_bluetooth_proxy: Make AclConnection neither movable nor copyable ebdd500:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/258675 pw_bluetooth_proxy: Add MultiBufWriter 85eab8f:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263032 docs: Temporarily disable size reports e9cf927:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/263093 bazel: Expose clang-tidy wrapper a0ed42f:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/262922 pw_bluetooth: Format AVDTP c7bda96:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/262921 pw_bluetooth: Fix AVDTP ServiceCapability declaration 7c7ff86:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/262755 pw_bluetooth_proxy: Remove old span rx API's dbb0903:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/262952 pw_transfer: Add max_window_size parameter to py client read() 5bd9fb4:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/252412 pw_uart_mcuxpresso: Non-blocking UART driver 7122c04:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/262756 bazel: Do not use exec_tools_toolchain for Python 987a1ce:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/262415 boringssl: 16-byte align data access in build test 5a1e177:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/262712 pw_bluetooth_proxy: Add rx multibuf allocator to Rfcomm and BasicL2cap 91cef99:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/261892 pw_sensor: Allow attributes on device/trigger 3bb9e25:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/261852 pw_sensor: Code generation support for unscoped parts f0e43d9:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/262812 bazel: Add clang-tidy to CQ 4e84475:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/262754 bazel: Add noclangtidy tag 3bf5412:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/262972 pw_bluetooth_sapphire: Update inspect hierarchy for pairing state a1eb87b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/231913 pw_crypto: Add Aes::Cmac ad4815c:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/262713 pw_metric: Fix stringizing of global names 01ff2e5:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/262813 docs: Provide Google Analytics ID to the Bazel build ff08518:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/262854 roll: fuchsia-infra-bazel-rules 8717179..124a9b9 (37 commits) Rolled-Repo: https://pigweed.googlesource.com/pigweed/pigweed Rolled-Commits: 94476c3105ee5a..854f542a59c1c6 Roll-Count: 1 Roller-URL: https://cr-buildbucket.appspot.com/build/8723999096350914513 GitWatcher: ignore CQ-Do-Not-Cancel-Tryjobs: true Change-Id: I32d9019bec409bd3e58c1d359d0b2c3f19d1325d Reviewed-on: https://pigweed-review.googlesource.com/c/open-dice/+/264259 Commit-Queue: Pigweed Roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com> Lint: Lint 🤖 <android-build-ayeaye@system.gserviceaccount.com> Bot-Commit: Pigweed Roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com>
This repository contains the specification for the Open Profile for DICE along with production-quality code. This profile is a specialization of the Hardware Requirements for a Device Identifier Composition Engine and DICE Layering Architecture specifications published by the Trusted Computing Group (TCG). For readers already familiar with those specs, notable distinctives of this profile include:
You can find us (and join us!) at https://groups.google.com/g/open-profile-for-dice. We're happy to answer questions and discuss proposed changes or features.
The specification can be found here. It is versioned using a major.minor scheme. Compatibility is maintained across minor versions but not necessarily across major versions.
Production quality, portable C code is included. The main code is in dice.h and dice.c. Cryptographic and certificate generation operations are injected via a set of callbacks. Multiple implementations of these operations are provided, all equally acceptable. Integrators should choose just one of these, or write their own.
Tests are included for all code and the build files in this repository can be used to build and run these tests.
Disclaimer: This is not an officially supported Google product.
Different implementations use different third party libraries. The third_party directory contains build files and git submodules for each of these. The submodules must be initialized once after cloning the repo, using git submodule update --init, and updated after pulling commits that roll the submodules using git submodule update.
To setup the build environment the first time:
$ git submodule update --init --recursive $ source bootstrap.sh $ gn gen out
To build and run tests:
$ ninja -C out
The easiest way, and currently the only supported way, to build and run tests is from a Pigweed environment on Linux. Pigweed does support other host platforms so it shouldn't be too hard to get this running on Windows for example, but we use Linux.
There are two scripts to help set this up:
bootstrap.sh will initialize submodules, bootstrap a Pigweed environment, and generate build files. This can take some time and may download on the order of 1GB of dependencies so the normal workflow is to just do this once.
activate.sh quickly reactivates an environment that has been previously bootstrapped.
These scripts must be sourced into the current session: source activate.sh.
In the environment, from the base directory of the dice-profile checkout, run ninja -C out to build everything and run all tests. You can also run pw watch which will build, run tests, and continue to watch for changes.
This will build and run tests on the host using the clang toolchain. Pigweed makes it easy to configure other targets and toolchains. See toolchains/BUILD.gn and the Pigweed documentation.
The code is designed to be portable and should work with a variety of modern toolchains and in a variety of environments. The main code in dice.h and dice.c is C99; it uses uint8_t, size_t, and memcpy from the C standard library. The various ops implementations are as portable as their dependencies (often not C99 but still very portable). Notably, this code uses designated initializers for readability. This is a feature available in C since C99 but missing from C++ until C++20 where it appears in a stricter form.
The Google C++ Style Guide is used. A .clang-format file is provided for convenience.
To incorporate the code into another project, there are a few options:
Copy only the necessary code. For example:
Take the main code as is: include/dice/dice.h, src/dice.c
Choose an implementation for crypto and certificate generation or choose to write your own. If you choose the boringssl implementation, for example, take include/dice/utils.h, include/dice/boringssl_ops.h, src/utils.c, and src/boringssl_ops.c. Taking a look at the library targets in BUILD.gn may be helpful.
Add this repository as a git submodule and integrate into the project build, optionally using the gn library targets provided.
Integrate into a project already using Pigweed using the gn build files provided.
The build reports code size using Bloaty McBloatface via the pw_bloat Pigweed module. There are two reports generated:
Library sizes - This report includes just the library code in this repository. It shows the baseline DICE code with no ops selected, and it shows the delta introduced by choosing various ops implementations. This report does not include the size of the third party dependencies.
Executable sizes - This report includes sizes for the library code in this repository plus all dependencies linked into a simple main function which makes a single DICE call with all-zero input. It shows the baseline DICE code with no ops (and therefore no dependencies other than libc), and it shows the delta introduced by choosing various ops implementations. This report does include the size of the third party dependencies. Note that rows specialized from ‘Boringssl Ops’ use that as a baseline for sizing.
The reports will be in the build output, but you can also find the reports in .txt files in the build output. For example, cat out/host_optimized/gen/*.txt | less will display all reports.
This code does not itself use mutable global variables, or any other type of shared data structure so there is no thread-safety concerns. However, additional care is needed to ensure dependencies are configured to be thread-safe. For example, the current boringssl configuration defines OPENSSL_NO_THREADS_CORRUPT_MEMORY_AND_LEAK_SECRETS_IF_THREADED, and that would need to be changed before running in a threaded environment.
This code makes a reasonable effort to clear memory holding sensitive data. This may help with a broader strategy to clear sensitive data but it is not sufficient on its own. Here are a few things to consider.