| commit | e45124e3ab44f7d983dc007c779b8dc4227ddf60 | [log] [tgz] |
|---|---|---|
| author | pigweed-roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com> | Sun Jun 29 17:47:51 2025 -0700 |
| committer | CQ Bot Account <pigweed-scoped@luci-project-accounts.iam.gserviceaccount.com> | Sun Jun 29 17:47:51 2025 -0700 |
| tree | cd501c435ced64dd5480356c08fc1b54436ca8d8 | |
| parent | 99483ac50c97010b7b63e32a50b35ddc9a3208a2 [diff] |
roll: third_party/pigweed/src 705f016..4b9814b (61 commits) 4b9814b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/299720 pw_bluetooth_proxy: Add H4 packet type for proxy 2.5 d0ed968:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/301372 pw_build: Add Workflows config validator 498c606:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/295212 pw_build: Add Bazel build driver aeed7fa:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/301078 Revert "pw_protobuf: Only generate `kMaxEncodedSizeBytes` in constrained structs" e8f5558:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/297213 pw_build: Introduce workflows proto and entry point c66eb85:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/300172 docs: Add code example guidelines 3cc0be9:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/259334 pw_protobuf: Only generate `kMaxEncodedSizeBytes` in constrained structs 94d439f:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/301412 GEMINI.md: Fix GN / Ninja commands 66028e9:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/301292 pw_async2: Don't store multiple wakers for a task in a WakerQueue 287122c:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/298053 pw_containers: Make reserve() match std::vector; add reserve_exact() 228f582:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/295275 pw_ide: Remove interceptor and reset .clangd file on deactivate 551e4f6:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/301174 pw_async2: Size reports for Select and Join 531934c:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/301075 pw_bluetooth_sapphire: Unmask Request Peer SCA event 17c2dc9:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/301074 pw_channel: Check PacketChannel properties 117ea8b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/301173 targets/rp2040: Add current_serial_number() to PicoBoardInfo bcc6a48:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/301133 pw_numeric: Implement add_sat 478e63b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/294732 pw_numeric: Make pw::mul_sat constexpr, like std::mul_sat bb20f05:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/301172 pw_kernel: Fix copyright dates ece4ea6:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/301073 *: Use //pw_numeric's checked arithmetic functions instead of macros c19ea20:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/297276 pw_kernel: Add rustdoc tests and rollup docs generation d50efb6:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/301072 pw_numeric: bool-returning overloads for checked arithmetic f5e6468:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/300734 pw_rpc_transport: Expose metric values as getters 8d4ad61:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/300637 pw_rpc_transport: Create tracking interface for RpcIngress 64c5116:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/299969 pw_assert: Example for avoiding % in PW_CHECK f27cc0c:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/297312 pw_ide: Port compile commands generator to python 0c5e5b5:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/300299 pw_presubmit: Parallelize formatting checks 7a3f73c:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/299772 GEMINI.md: Start AI coding conventions bf3cc9d:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/299972 pw_rpc_transport: Add packet processor threshold metric and log 2c0cea5:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/300773 pw_rpc_transport: Create tracking iface for LocalRpcEgress events 4b63dda:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/300772 pw_bluetooth_sapphire: Drop command wake lease on transaction complete 54f9f27:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/300732 pw_multibuf: Use GetView instead of GetData c45c482:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/300634 roll: gn 7bec4f6:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/300375 pw_bluetooth_proxy: Print channel and PDU info in dropped recombine case 6397fa7:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/298952 pw_toolchain: Add lib/clang/*/share to sandbox 2031c19:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/300532 pw_digital_io_linux: Fix bazel layering check f3d952e:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/300493 pw_elf: Remove conversion_warnings exclusion c09a63c:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/300492 pw_elf: Fix bazel layering check 9387c75:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/300339 pw_uart_mcuxpresso: Add error checks on starting dma transfers d1d7be7:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/300452 pw_uart_mcuxpresso: Harden dma_uart_nonblocking init/deinit logic 4261c53:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/293512 pw_channel: Introduce pw::channel::PacketChannel caa9c9b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/297373 pw_bluetooth_sapphire: Fix LegacyLowEnergyAdvertiser double disable bug 913de24:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/300432 pw_toolchain: Check for pw_env_setup_CIPD_RUST before using 152adfd:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/296373 pw_bluetooth_sapphire: Use AdvertisementId in LowEnergyAdvertiser b66729b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/300272 pw_protobuf_compiler: Create a new includes.txt for each toolchain 9b084b6:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/291412 pw_bluetooth: Migrate bt uuids to pw_uuid caf4417:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/299812 pw_bluetooth_sapphire: Fix advertising issue 6ad38d7:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/299964 pw_multibuf: Add tests for code paths missing coverage 434cf8e:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/297612 pw_kernel: Fix typo 831b160:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/300112 pw_env_setup: Move rust toolchain to separate JSON file 1fd708f:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/300072 pw_multibuf: Add method to retrieve SharedPtrs 65e4fb9:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/300014 docs: Many minor fixes 54684e5:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/299513 pw_i2c: Fix usage of deprecated pw_containers target d6e55a4:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/300013 pw_multibuf: Improve docs for grouped methods 6cf30a0:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/299934 docs: Fix Bazel Style Guide link f498b5e:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/299632 pw_multibuf: Add remaining v2 unit tests 414c1d2:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/299992 pw_system: Don't escape colons in docstrings 3f23c10:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/299954 docs: Reformat Google C++ Style Guide link 7f040a5:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/299973 pw_transfer: Directly depend on pw_thread_stl for tests c655cf6:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/299697 pw_presubmit: Add rustfmt formatter 3de9271:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/299935 pw_env_setup: Download rust toolchain on Windows ad17c7b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/299552 pw_multibuf: Add yet more v2 tests Rolled-Repo: https://pigweed.googlesource.com/pigweed/pigweed Rolled-Commits: 705f016b70d922..4b9814b2fe75be Roll-Count: 1 Roller-URL: https://cr-buildbucket.appspot.com/build/8710681341657217553 GitWatcher: ignore CQ-Do-Not-Cancel-Tryjobs: true Change-Id: If7c937867ee71b5ff954cbb7b5f47a7f2f4f8721 Reviewed-on: https://pigweed-review.googlesource.com/c/open-dice/+/301672 Bot-Commit: Pigweed Roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com> Lint: Lint 🤖 <android-build-ayeaye@system.gserviceaccount.com> Commit-Queue: Pigweed Roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com>
This repository contains the specification for the Open Profile for DICE along with production-quality code. This profile is a specialization of the Hardware Requirements for a Device Identifier Composition Engine and DICE Layering Architecture specifications published by the Trusted Computing Group (TCG). For readers already familiar with those specs, notable distinctives of this profile include:
You can find us (and join us!) at https://groups.google.com/g/open-profile-for-dice. We're happy to answer questions and discuss proposed changes or features.
The specification can be found here. It is versioned using a major.minor scheme. Compatibility is maintained across minor versions but not necessarily across major versions.
Production quality, portable C code is included. The main code is in dice.h and dice.c. Cryptographic and certificate generation operations are injected via a set of callbacks. Multiple implementations of these operations are provided, all equally acceptable. Integrators should choose just one of these, or write their own.
Tests are included for all code and the build files in this repository can be used to build and run these tests.
Disclaimer: This is not an officially supported Google product.
Different implementations use different third party libraries. The third_party directory contains build files and git submodules for each of these. The submodules must be initialized once after cloning the repo, using git submodule update --init, and updated after pulling commits that roll the submodules using git submodule update.
To setup the build environment the first time:
$ git submodule update --init --recursive $ source bootstrap.sh $ gn gen out
To build and run tests:
$ ninja -C out
The easiest way, and currently the only supported way, to build and run tests is from a Pigweed environment on Linux. Pigweed does support other host platforms so it shouldn't be too hard to get this running on Windows for example, but we use Linux.
There are two scripts to help set this up:
bootstrap.sh will initialize submodules, bootstrap a Pigweed environment, and generate build files. This can take some time and may download on the order of 1GB of dependencies so the normal workflow is to just do this once.
activate.sh quickly reactivates an environment that has been previously bootstrapped.
These scripts must be sourced into the current session: source activate.sh.
In the environment, from the base directory of the dice-profile checkout, run ninja -C out to build everything and run all tests. You can also run pw watch which will build, run tests, and continue to watch for changes.
This will build and run tests on the host using the clang toolchain. Pigweed makes it easy to configure other targets and toolchains. See toolchains/BUILD.gn and the Pigweed documentation.
The code is designed to be portable and should work with a variety of modern toolchains and in a variety of environments. The main code in dice.h and dice.c is C99; it uses uint8_t, size_t, and memcpy from the C standard library. The various ops implementations are as portable as their dependencies (often not C99 but still very portable). Notably, this code uses designated initializers for readability. This is a feature available in C since C99 but missing from C++ until C++20 where it appears in a stricter form.
The Google C++ Style Guide is used. A .clang-format file is provided for convenience.
To incorporate the code into another project, there are a few options:
Copy only the necessary code. For example:
Take the main code as is: include/dice/dice.h, src/dice.c
Choose an implementation for crypto and certificate generation or choose to write your own. If you choose the boringssl implementation, for example, take include/dice/utils.h, include/dice/boringssl_ops.h, src/utils.c, and src/boringssl_ops.c. Taking a look at the library targets in BUILD.gn may be helpful.
Add this repository as a git submodule and integrate into the project build, optionally using the gn library targets provided.
Integrate into a project already using Pigweed using the gn build files provided.
The build reports code size using Bloaty McBloatface via the pw_bloat Pigweed module. There are two reports generated:
Library sizes - This report includes just the library code in this repository. It shows the baseline DICE code with no ops selected, and it shows the delta introduced by choosing various ops implementations. This report does not include the size of the third party dependencies.
Executable sizes - This report includes sizes for the library code in this repository plus all dependencies linked into a simple main function which makes a single DICE call with all-zero input. It shows the baseline DICE code with no ops (and therefore no dependencies other than libc), and it shows the delta introduced by choosing various ops implementations. This report does include the size of the third party dependencies. Note that rows specialized from ‘Boringssl Ops’ use that as a baseline for sizing.
The reports will be in the build output, but you can also find the reports in .txt files in the build output. For example, cat out/host_optimized/gen/*.txt | less will display all reports.
This code does not itself use mutable global variables, or any other type of shared data structure so there is no thread-safety concerns. However, additional care is needed to ensure dependencies are configured to be thread-safe. For example, the current boringssl configuration defines OPENSSL_NO_THREADS_CORRUPT_MEMORY_AND_LEAK_SECRETS_IF_THREADED, and that would need to be changed before running in a threaded environment.
This code makes a reasonable effort to clear memory holding sensitive data. This may help with a broader strategy to clear sensitive data but it is not sufficient on its own. Here are a few things to consider.