| commit | 6c1352eb58ec78ddc87f555166b660ac3497ab89 | [log] [tgz] |
|---|---|---|
| author | pigweed-roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com> | Mon Jul 15 00:44:13 2024 +0000 |
| committer | CQ Bot Account <pigweed-scoped@luci-project-accounts.iam.gserviceaccount.com> | Mon Jul 15 00:44:13 2024 +0000 |
| tree | 6e88d0ff02471c526a8852e34f1d0ee7d59546cd | |
| parent | 00eb2175b1e469f7836e426373fec7b7da461772 [diff] |
roll: third_party/pigweed/src 94 commits f81694520583467 roll: 310, 311 8bb5fb62c3b4ced pw_bluetooth_sapphire: Fix all available lint erro d20ce7ca399f68e pw_bluetooth_sapphire: Move LinkKey simple constru 0d077d76e35744a pw_bluetooth_sapphire: Add operator!= for LinkKey b75a73c8dac6843 pw_bluetooth_sapphire: Add extra diagnostics e54ffe5e5124ad4 pw_bluetooth_sapphire: Improve management of adver d9547e6a1b97d8e pw_bluetooth_sapphire: Add Bazel rules for socket a12f93925d8d184 pw_bluetooth_sapphire: Update LowEnergyAdvertiser f150ac17e8fde07 pw_bluetooth_sapphire: Add more values to LEEventM b216eb7fb3a472d pw_bluetooth_sapphire: Pass hci::AdvertisingInterv 505638596e1ea63 pw_bluetooth_sapphire: Shorten pw::bluetooth::embo 071670f2a8e7309 pw_bluetooth_sapphire: Pass extended_pdu booleans 351c9a45b2099b6 pw_bluetooth_sapphire: Update AdvertisingHandleMap 443ea9303c2f1d0 pw_bluetooth_sapphire: Update missing header de05f2bf9d0c5e9 pw_bluetooth_sapphire: Add the credit-based flow c c0649cb6ff1798a pw_bluetooth_sapphire: Prevent protected member ac aab0781bccb8d26 pw_bluetooth_sapphire: Add Bazel tests 97bdfeb645a92f7 pw_bluetooth_sapphire: Fix conversions from iterat 2a5f339c40c1236 pw_bluetooth_sapphire: Add bt-host Bazel tests fb0067fff348563 pw_bluetooth_sapphire: Low energy advertiser gener d55ec9627e60afd pw_bluetooth_sapphire: Use using aliases for Embos dea5d4d8115fcd6 pw_bluetooth_sapphire: Add Bazel build files 8e469505d647384 pw_system: Add synchronization to pw::System alloc a27a7371c69cb58 docs: Update changelog 990ed9bb2f16bec pw_unit_test: Introduce googtest_platform e15bd2067e7a244 pw_sync: Document that CV should not be used 707473a3602a6ab bazel: Run tests with asan in CQ 115be90c532836b pw_toolchain: Add ubsan support for host builds 833b2d5514dc453 pw_env_setup: Add luci-cv to environment b71abe8012cb8ce pw_target_runner: Increase maximum message size fo bf88de9f5c04467 pw_system: Reusable DeviceConnection functionality ada3a6bb4f662b4 pw_web: Add filter field buttons and placeholder db01bc93c1a3857 pw_web: Include core .proto files in the npm bundl a047c412171136c pw_toolchain_bazel: Add native binary for clang-ti f2e580ecbc81acb pw_bluetooth_sapphire: Remove modulo operator from cca41e3e720679b third_party/freertos: Add missing CM33_NTZ header 8abeae9d31fcdbe pw_web: Add newlines, separators, and clear for ou 88dbbf23b2f7c6c bazel: Run all tests with googletest backend in CI b9de0f451197083 pw_env_setup: Use full paths for proj action impor 41a0140c8ece3f4 third_party/googletest: Fix the docs b041517545b70d1 bazel: Add missing dependencies 9b979cb0cbec695 pw_bluetooth_sapphire: Add Bazel build files to li 932c44e8e5c240e pw_system: Add web console option 7eb32bb61f56148 pw_web: Set min width for message b4987e47aef3696 pw_stream_uart_mcuxpresso: Clean up dma stream com 1d8d68b37b99966 third_party/icu: Update Bazel rules for dependent a10dc77e7bf9af0 pw_system: Add missing work queue thread dbda0e98bd7b9b7 pw_system: Clean up pw_system/threads.cc cd7e34bbe9e8dcb pw_function: Dynamic allocation for upstream host 61c6b9a2ed03145 pw_web: Implement console-level split panels 27aedcf1158eb97 pw_cpu_exception_cortex_m: Add armv6-m support e6ad28bbb6ac1c6 pw_web: Update REPL styles 2f86c6dfec93ea9 pw_web: Repl kernel interface and litjs component 97aecb2d19d2df0 pw_build: Add flags_from_dict 73ef002b92f1710 docs: Fix shortlink URL 45fd25bd3ef49ea pw_console: Headless mode with web/ws server runni fa6e930113bd0e6 pw_presubmit: Narrow copyright notice exclusions c16a0a5640a7649 dotfiles: Add copyright notice 1e211349047f0ad pw_log_string: Require backend_impl to be set expl 9c624cddf114a93 pw_presubmit: Add copyright notice to some test da eaebb102be62e06 docs: Add shortlink to pw_enviro draft 205872022755bb3 pw_system: Configurable thread stack sizes 911590baa5a54e9 pw_bluetooth_sapphire: Use pwemb namespace alias i b403402a8a6ac9c pw_presubmit: Exclude test_data from bazel_lint ceeae0cc9df8910 .github: Add copyright notice c89c0361d2438b6 pw_bluetooth_sapphire: Unmask LE Connection Comple fea8942141d1d72 pw_bluetooth_sapphire: Implement ExtendedLowEnergy 6901feb705154f7 pw_bluetooth_sapphire: Enable bt-host component 4e95e9dc76dda66 pw_bluetooth_sapphire: Support ISO Channel FIDL Pr 1fc96205b72d872 bazel: Don't propagate flags to exec config 1d190f27e281304 pw_presubmit: Exclude files from copyright afe76e45d26332d pw_bluetooth_sapphire: Add ISO support to controll 73623f58298ca29 pw_malloc_freertos: Fix typo 1154e3a6281e5ce pw_bluetooth_sapphire: Tag integration test 500cb93ede4eb89 pw_bluetooth_sapphire: Implement ExtendedLowEnergy 011d6ca73ef6992 pw_cli: Interactive user index prompt 7c60abf8f32f5cb pw_assert: Split up Bazel assert backend, part 2 211982ec49e2c55 pw_bluetooth_proxy: Delete "sendGattNotify" 418b923b27fbdc2 roll: Update Bazel to 8.0 rolling release ebb087cf8898715 pw_bluetooth_sapphire: Add packet filtering consts a4580add7631db4 targets/rp2040: Fix FreeRTOS tick rate d310201c65256e8 pw_bluetooth_sapphire: Update LEAdvertisers to use 68186af7cb61ccc pw_bluetooth_sapphire: Use Emboss for android vend 71fe6b57143dac8 rp2040: Log on successful flash a4a547c51f98ea5 pw_bluetooth_sapphire: Use Emboss versions of a2dp 858b5b2a275d57f pw_bluetooth_proxy: Include <optional> in proxy_ho a4f432177a7e2cf pw_bluetooth_proxy: ProxyHost supports multiple se 6f7b53311728507 roll: Update Bazel to 7.2 c434a087580547b pw_allocator: Remove unnecessary template 6a928e54c51c63c pw_toolchain: Disable PIE for Golang 3178503b13226d7 pw_rpc: Expand comment for internal::ClientServerT 40ced78e4ae4490 pw_presubmit: Don't automatically use exclusions 0a4a217f91f65fb pw_async2: Add missing thread_stl dependency a5f72ef6f5e0e78 roll: go https://pigweed.googlesource.com/pigweed/pigweed third_party/pigweed/src Rolled-Commits: 434ae75c94cbd00..f81694520583467 Roller-URL: https://ci.chromium.org/b/8742390281804578529 GitWatcher: ignore CQ-Do-Not-Cancel-Tryjobs: true Change-Id: I1aa8c095097f3a92e4023c3b3f9ef599eb5d88fb Reviewed-on: https://pigweed-review.googlesource.com/c/open-dice/+/222992 Lint: Lint 🤖 <android-build-ayeaye@system.gserviceaccount.com> Bot-Commit: Pigweed Roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com> Commit-Queue: Pigweed Roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com>
This repository contains the specification for the Open Profile for DICE along with production-quality code. This profile is a specialization of the Hardware Requirements for a Device Identifier Composition Engine and DICE Layering Architecture specifications published by the Trusted Computing Group (TCG). For readers already familiar with those specs, notable distinctives of this profile include:
You can find us (and join us!) at https://groups.google.com/g/open-profile-for-dice. We're happy to answer questions and discuss proposed changes or features.
The specification can be found here. It is versioned using a major.minor scheme. Compatibility is maintained across minor versions but not necessarily across major versions.
Production quality, portable C code is included. The main code is in dice.h and dice.c. Cryptographic and certificate generation operations are injected via a set of callbacks. Multiple implementations of these operations are provided, all equally acceptable. Integrators should choose just one of these, or write their own.
Tests are included for all code and the build files in this repository can be used to build and run these tests.
Disclaimer: This is not an officially supported Google product.
Different implementations use different third party libraries. The third_party directory contains build files and git submodules for each of these. The submodules must be initialized once after cloning the repo, using git submodule update --init, and updated after pulling commits that roll the submodules using git submodule update.
To setup the build environment the first time:
$ git submodule update --init $ source bootstrap.sh $ gn gen out
To build and run tests:
$ ninja -C out
The easiest way, and currently the only supported way, to build and run tests is from a Pigweed environment on Linux. Pigweed does support other host platforms so it shouldn't be too hard to get this running on Windows for example, but we use Linux.
There are two scripts to help set this up:
bootstrap.sh will initialize submodules, bootstrap a Pigweed environment, and generate build files. This can take some time and may download on the order of 1GB of dependencies so the normal workflow is to just do this once.
activate.sh quickly reactivates an environment that has been previously bootstrapped.
These scripts must be sourced into the current session: source activate.sh.
In the environment, from the base directory of the dice-profile checkout, run ninja -C out to build everything and run all tests. You can also run pw watch which will build, run tests, and continue to watch for changes.
This will build and run tests on the host using the clang toolchain. Pigweed makes it easy to configure other targets and toolchains. See toolchains/BUILD.gn and the Pigweed documentation.
The code is designed to be portable and should work with a variety of modern toolchains and in a variety of environments. The main code in dice.h and dice.c is C99; it uses uint8_t, size_t, and memcpy from the C standard library. The various ops implementations are as portable as their dependencies (often not C99 but still very portable). Notably, this code uses designated initializers for readability. This is a feature available in C since C99 but missing from C++ until C++20 where it appears in a stricter form.
The Google C++ Style Guide is used. A .clang-format file is provided for convenience.
To incorporate the code into another project, there are a few options:
Copy only the necessary code. For example:
Take the main code as is: include/dice/dice.h, src/dice.c
Choose an implementation for crypto and certificate generation or choose to write your own. If you choose the boringssl implementation, for example, take include/dice/utils.h, include/dice/boringssl_ops.h, src/utils.c, and src/boringssl_ops.c. Taking a look at the library targets in BUILD.gn may be helpful.
Add this repository as a git submodule and integrate into the project build, optionally using the gn library targets provided.
Integrate into a project already using Pigweed using the gn build files provided.
The build reports code size using Bloaty McBloatface via the pw_bloat Pigweed module. There are two reports generated:
Library sizes - This report includes just the library code in this repository. It shows the baseline DICE code with no ops selected, and it shows the delta introduced by choosing various ops implementations. This report does not include the size of the third party dependencies.
Executable sizes - This report includes sizes for the library code in this repository plus all dependencies linked into a simple main function which makes a single DICE call with all-zero input. It shows the baseline DICE code with no ops (and therefore no dependencies other than libc), and it shows the delta introduced by choosing various ops implementations. This report does include the size of the third party dependencies. Note that rows specialized from ‘Boringssl Ops’ use that as a baseline for sizing.
The reports will be in the build output, but you can also find the reports in .txt files in the build output. For example, cat out/host_optimized/gen/*.txt | less will display all reports.
This code does not itself use mutable global variables, or any other type of shared data structure so there is no thread-safety concerns. However, additional care is needed to ensure dependencies are configured to be thread-safe. For example, the current boringssl configuration defines OPENSSL_NO_THREADS_CORRUPT_MEMORY_AND_LEAK_SECRETS_IF_THREADED, and that would need to be changed before running in a threaded environment.
This code makes a reasonable effort to clear memory holding sensitive data. This may help with a broader strategy to clear sensitive data but it is not sufficient on its own. Here are a few things to consider.