| commit | 66ac1432f3d058dc7db051d6e5d9243680da98ec | [log] [tgz] |
|---|---|---|
| author | pigweed-roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com> | Mon Aug 14 00:45:12 2023 +0000 |
| committer | CQ Bot Account <pigweed-scoped@luci-project-accounts.iam.gserviceaccount.com> | Mon Aug 14 00:45:12 2023 +0000 |
| tree | 9e7cc70d6991a8a17f77893393666296772cf80c | |
| parent | 432d294c51aa92c986d91c9161501c3511bd0369 [diff] |
[third_party/pigweed/src] Roll 51 commits c02cc30dc10b225 roll: host_tools f0ca7f0500c6a21 roll: gn f5761b607aa6661 roll: qemu 728d8d84814e0c8 roll: absolute_uploader, incremental_uploader 812d8ca06b2a064 roll: cmake f577c0e56be4527 roll: bazel 171a9a7e624b0a4 pw_system: Make pw_system.device.Device a context ef86211b53a7475 pw_web: Log viewer toolbar button toggle style 39af5c9dbab0e5b pw_hdlc: Mitigate errors on Python background thre 663489878b701a7 pw_perf_test: Add test metadata c024bd0ab7a6ff1 pw_toolchain: Add cmake helpers for getting clang 9aae4c335bbe103 pw_web: Log-viewer line wrap toggle f59b8be8ba9bc0f pw_presubmit: Apply TypeScript formatting 81a1612a580c082 pw_presubmit: Use prettier for JS and TS files 63746a714b7ee28 pw_build: Add integration test metadata c60df17b2c184ea pw_stream_uart_linux: Add support for baud rates o 58cdc95b7fee541 pw_sync: Templatize Borrowable tests 8e93cfeeada27b5 pw_env_setup: Improve cipd_repository error handli 8199a9802aa593c pw_trace_tokenized: Add missing dependency 664996f6681dba5 pw_toolchain: Windows path prefix fix dd720d9b9f56aaf SEED: Add Discord announcement to SEED process 7e29d542808ecc9 pw_transfer: Extend timeout for transfer_thread te 4b625de6edf728d pw_rpc: Minor Java client cleanup bedb7a3b2a86b92 pw_toolchain: Windows path prefix fix 8122b8dbb931502 pw_build: Add python_action_test eaaf71dedd50cbf pw_stream: Add mpsc_stream a2151554e943ec3 pw_trace_tokenized: Build-related fixes e4e22563ee240f5 pw_rpc: Java client backwards compatibility a0117c64e4fed4a pw_tokenizer: Separate API reference and how-to gu 13da8c012a5e82b pw_web: Fix TypeScript warnings in web_serial_tran 19c1ff4a13b3049 pw_python: setup.sh requirements arg fix path 611277cb7a8a0c5 pw_stream: Add infalible methods to Rust Cursor 8228249ec9925e1 pw_tokenizer: Polish the sales pitch 9361d8abd4dab70 pw_transfer: Fix use-after-destroy in integration 3545ad301dc711b pw_env_setup: Add clang_next.json f96fd31675d136b pw_toolchain_bazel: LLVM toolchain for macOS Bazel b6fc715a09aa6dd pw_ide: Restore stable clangd settings link c04a08ede6e88cf pw_log_zephyr: Fix null termination of Base64 mess e6ffe7742b67fbd pw_tokenizer: Support unaligned databases 0410d7978ba174c pw_build: Handle ProcessLookupError exceptions 02f2811d2c47ad6 pw_toolchain: Optionally depend on pw_env_setup_CI 212145181448f45 pw_web: Add state for view number, search string, 3a6af0b91250be3 pw_random: Doxygenify random.h 61f65aae1104131 pw_boot_cortex_m: Allow explict target name 8b90ce173173117 pw_python: setup.sh arg spaces bug 5ef57cf3fc87ec7 pw_presubmit: Fix overeager format_code matches 3cb318148e77d56 docs: Add call-to-action buttons 65b4108157561e4 pw_tokenizer: Move the basic overview into getting 5b918c6c28c42a9 pw_stream_shmem_mcuxpresso: Add shared memory stre e82eb94a64dc989 pw_tokenizer: Move the case study to guides.rst 276b0648b8ab177 roll: go https://pigweed.googlesource.com/pigweed/pigweed third_party/pigweed/src Rolled-Commits: 34cff3b4e635b2c..c02cc30dc10b225 Roller-URL: https://ci.chromium.org/b/8772830860762514561 GitWatcher: ignore CQ-Do-Not-Cancel-Tryjobs: true Change-Id: I62b2606b0ce63a54590feea0dbd56da8886eda55 Reviewed-on: https://pigweed-review.googlesource.com/c/open-dice/+/165683 Bot-Commit: Pigweed Roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com> Commit-Queue: Pigweed Roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com>
This repository contains the specification for the Open Profile for DICE along with production-quality code. This profile is a specialization of the Hardware Requirements for a Device Identifier Composition Engine and DICE Layering Architecture specifications published by the Trusted Computing Group (TCG). For readers already familiar with those specs, notable distinctives of this profile include:
You can find us (and join us!) at https://groups.google.com/g/open-profile-for-dice. We're happy to answer questions and discuss proposed changes or features.
The specification can be found here. It is versioned using a major.minor scheme. Compatibility is maintained across minor versions but not necessarily across major versions.
Production quality, portable C code is included. The main code is in dice.h and dice.c. Cryptographic and certificate generation operations are injected via a set of callbacks. Multiple implementations of these operations are provided, all equally acceptable. Integrators should choose just one of these, or write their own.
Tests are included for all code and the build files in this repository can be used to build and run these tests.
Disclaimer: This is not an officially supported Google product.
Different implementations use different third party libraries. The third_party directory contains build files and git submodules for each of these. The bootstrap script will automatically initialize all submodules.
$ source bootstrap.sh $ ninja -C out
The easiest way, and currently the only supported way, to build and run tests is from a Pigweed environment on Linux. Pigweed does support other host platforms so it shouldn't be too hard to get this running on Windows for example, but we use Linux.
There are two scripts to help set this up:
bootstrap.sh will initialize submodules, bootstrap a Pigweed environment, and generate build files. This can take some time and may download on the order of 1GB of dependencies so the normal workflow is to just do this once.
activate.sh quickly reactivates an environment that has been previously bootstrapped.
These scripts must be sourced into the current session: source activate.sh.
In the environment, from the base directory of the dice-profile checkout, run ninja -C out to build everything and run all tests. You can also run pw watch which will build, run tests, and continue to watch for changes.
This will build and run tests on the host using the clang toolchain. Pigweed makes it easy to configure other targets and toolchains. See toolchains/BUILD.gn and the Pigweed documentation.
The code is designed to be portable and should work with a variety of modern toolchains and in a variety of environments. The main code in dice.h and dice.c is C99; it uses uint8_t, size_t, and memcpy from the C standard library. The various ops implementations are as portable as their dependencies (often not C99 but still very portable). Notably, this code uses designated initializers for readability. This is a feature available in C since C99 but missing from C++ until C++20 where it appears in a stricter form.
The Google C++ Style Guide is used. A .clang-format file is provided for convenience.
To incorporate the code into another project, there are a few options:
Copy only the necessary code. For example:
Take the main code as is: include/dice/dice.h, src/dice.c
Choose an implementation for crypto and certificate generation or choose to write your own. If you choose the boringssl implementation, for example, take include/dice/utils.h, include/dice/boringssl_ops.h, src/utils.c, and src/boringssl_ops.c. Taking a look at the library targets in BUILD.gn may be helpful.
Add this repository as a git submodule and integrate into the project build, optionally using the gn library targets provided.
Integrate into a project already using Pigweed using the gn build files provided.
The build reports code size using Bloaty McBloatface via the pw_bloat Pigweed module. There are two reports generated:
Library sizes - This report includes just the library code in this repository. It shows the baseline DICE code with no ops selected, and it shows the delta introduced by choosing various ops implementations. This report does not include the size of the third party dependencies.
Executable sizes - This report includes sizes for the library code in this repository plus all dependencies linked into a simple main function which makes a single DICE call with all-zero input. It shows the baseline DICE code with no ops (and therefore no dependencies other than libc), and it shows the delta introduced by choosing various ops implementations. This report does include the size of the third party dependencies. Note that rows specialized from ‘Boringssl Ops’ use that as a baseline for sizing.
The reports will be in the build output, but you can also find the reports in .txt files in the build output. For example, cat out/host_optimized/gen/*.txt | less will display all reports.
This code does not itself use mutable global variables, or any other type of shared data structure so there is no thread-safety concerns. However, additional care is needed to ensure dependencies are configured to be thread-safe. For example, the current boringssl configuration defines OPENSSL_NO_THREADS_CORRUPT_MEMORY_AND_LEAK_SECRETS_IF_THREADED, and that would need to be changed before running in a threaded environment.
This code makes a reasonable effort to clear memory holding sensitive data. This may help with a broader strategy to clear sensitive data but it is not sufficient on its own. Here are a few things to consider.