| commit | ad65210d577fb8d5505d5101a69d9834fdd9a8d0 | [log] [tgz] |
|---|---|---|
| author | pigweed-roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com> | Sun Dec 15 16:45:38 2024 -0800 |
| committer | CQ Bot Account <pigweed-scoped@luci-project-accounts.iam.gserviceaccount.com> | Sun Dec 15 16:45:38 2024 -0800 |
| tree | a49e90b2f1cf2423fc71978fcd8020f9b7e02d4e | |
| parent | a147a30673573635f0ff1b476d8e49838b292269 [diff] |
roll: third_party/pigweed/src ffb5324..4bf11f1 (62 commits) 4bf11f1:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/254633 pw_bluetooth_proxy: Move AcquireL2capCoc calls to use test util 4183fe8:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/254653 roll: fuchsia-infra-bazel-rules 77dd35e..5c63ca8 (10 commits) bb58b65:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/254372 pw_rust: Enable GN pw_rust targets for linux host d8ad5c6:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/254114 pw_bluetooth: Avdtp emboss fix StreamEndPointDiscoveryResponse 1925db8:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/252892 pw_bluetooth_proxy: Remove deprecated HasSendLeAclCapability 54cb716:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/252894 pw_bluetooth_proxy: Make proxy constructor args explicit 303810b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/254414 pw_multisink: Scope disabling unsigned-integer-overflow b3e2d8c:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/249452 pw_bluetooth_sapphire: Implement Central start scan 0ea7157:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/254473 pw_bluetooth: Add frame_type and poll_final definitions for rfcomm 0944913:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/254134 bazel: Add explicit rules_java dependency 475ef28:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253192 gn: Fix error reported by GN linter ce0aa60:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/254214 pw_grpc: Handle large ignored frames a2f2425:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/254213 pw_grpc: Fix a few deadlocks in error handling 96f941b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253594 pw_bluetooth_proxy: Move AcquireAdditionalRxCredits to L2capCoc 9cda022:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/254212 pw_bluetooth_proxy: Remove state from RfcommChannel aa9a4e8:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253556 pw_bluetooth_proxy: Remove deprecated event_fn from L2capCoc 5fc8302:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253520 pw_bluetooth_proxy: Close channels on disconnections in both directions 2592257:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253856 pw_bluetooth_sapphire: Save advertising data buffer after parsing 3e46575:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/254112 pw_bluetooth: Add AVDTP_GET_ALL_CAPABILITIES 046c562:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253519 pw_bluetooth_proxy: Close channels on ACL & L2CAP disconnections f58927a:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253518 pw_bluetooth_proxy: Close AclConnection instead of erase df92f9f:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/254020 fuchsia: Introduce @rules_fuchsia 737e613:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253517 pw_bluetooth_proxy: Add running/stopped state to L2capChannel 5d83553:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/252692 pw_bluetooth_sapphire: Refactor LowEnergyDiscoverySession 5f0b44d:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253712 pw_build: Add libclang_path to GN pw_rust_bindgen ae004ee:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/250576 roll: nanopb, protobuf f41ccf3:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253914 pw_bluetooth: Cleanup avdtp parser 719e987:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253434 pw_bluetooth_sapphire: Distribute public headers 97a16b0:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/254113 bazel: Remove the unused attribute _cc_toolchains 7e8ef36:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/254115 docs: Update changelog c80d2e1:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253953 pw_presubmit: Add diff_upstream_python_constraints 0e6dc34:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253516 pw_bluetooth_proxy: Wrap PopulateTxL2capPacket over PopulateL2capPacket e760271:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253858 docs: Improve Bazel lockfile docs 2d273f8:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253513 docs: Add rustdocs to Bazel build 739cd50:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253553 pw_bluetooth_proxy: Rename GetTxH4Packet to GetAclH4Packet ce7b2d9:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253595 pw_grpc: Allocate contiguous multibufs only 8b5abe6:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253612 pw_bluetooth_proxy: Fix missing notify of queue space available 9720483:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253554 pw_presubmit: Bazel lockfile check 5a62fe4:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253332 blog: Shaping a better future for Bazel C/C++ toolchains 9e4c976:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253264 pw_thread: Move ThreadCore logic out of pw::Thread 019e35f:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253555 pw_bluetooth_proxy: Include l2cap_channel_event.h where it is used f138221:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253552 pw_thread_freertos: Remove variable when it is not used a957859:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253514 pw_thread: Adding missing ThreadCore deps or migrate to pw::Function 07d2258:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253512 Revert "docs: Add rustdocs to Bazel build" 9aceb7c:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/231912 pw_crypto: Implement Mbed-TLS backend for AES 19bb20e:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/252633 pw_protobuf_compiler: Options for Python deps and type hints 2ce8bc2:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253253 pw_build: Allow for empty Python build venvs e10d9bb:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253259 pw_bluetooth_proxy: Account for ACL and H4 headers in max packet size 2830bb2:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253052 pw_assert: Separate declaration and definition for C compatibility 1f98f21:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/251413 pw_bluetooth_sapphire: Handle FIDL incoming ISO data 6bccf42:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/252632 docs: Add rustdocs to Bazel build dc3c6c6:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253012 pw_bluetooth_proxy: Introduce L2capChannelEvent 567a1bb:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253273 roll: rules_rust d6ed40a:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253257 pw_bluetooth_proxy: Increase max packet size to handle 3-DH5 packets 73b5fbf:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/252293 pw_cli: Move exclude_paths c15953e:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/251812 Reland "docs: Build module docs with Bazel" 36e5cc3:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/252813 pw_tokenizer: Check _pool before using it bb6bcba:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253234 pw_bluetooth: Add AVDTP psm d3fddeb:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253232 target: Add missing pw_boot/backend.gni includes b3d4f6e:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253233 pw_allocator: Fix first-fit with threshold c9c4af6:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/253212 pw_protobuf_compiler: Update OWNERS b8d1cd0:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/252052 pw_build: Document pw_cc_binary Rolled-Repo: https://pigweed.googlesource.com/pigweed/pigweed Rolled-Commits: ffb53244780463..4bf11f142443b7 Roll-Count: 1 Roller-URL: https://cr-buildbucket.appspot.com/build/8728438347750183953 GitWatcher: ignore CQ-Do-Not-Cancel-Tryjobs: true Change-Id: I4bf1d1210e1a4d94d5017e793ea40429fac2d716 Reviewed-on: https://pigweed-review.googlesource.com/c/open-dice/+/254752 Bot-Commit: Pigweed Roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com> Commit-Queue: Pigweed Roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com> Lint: Lint 🤖 <android-build-ayeaye@system.gserviceaccount.com>
This repository contains the specification for the Open Profile for DICE along with production-quality code. This profile is a specialization of the Hardware Requirements for a Device Identifier Composition Engine and DICE Layering Architecture specifications published by the Trusted Computing Group (TCG). For readers already familiar with those specs, notable distinctives of this profile include:
You can find us (and join us!) at https://groups.google.com/g/open-profile-for-dice. We're happy to answer questions and discuss proposed changes or features.
The specification can be found here. It is versioned using a major.minor scheme. Compatibility is maintained across minor versions but not necessarily across major versions.
Production quality, portable C code is included. The main code is in dice.h and dice.c. Cryptographic and certificate generation operations are injected via a set of callbacks. Multiple implementations of these operations are provided, all equally acceptable. Integrators should choose just one of these, or write their own.
Tests are included for all code and the build files in this repository can be used to build and run these tests.
Disclaimer: This is not an officially supported Google product.
Different implementations use different third party libraries. The third_party directory contains build files and git submodules for each of these. The submodules must be initialized once after cloning the repo, using git submodule update --init, and updated after pulling commits that roll the submodules using git submodule update.
To setup the build environment the first time:
$ git submodule update --init $ source bootstrap.sh $ gn gen out
To build and run tests:
$ ninja -C out
The easiest way, and currently the only supported way, to build and run tests is from a Pigweed environment on Linux. Pigweed does support other host platforms so it shouldn't be too hard to get this running on Windows for example, but we use Linux.
There are two scripts to help set this up:
bootstrap.sh will initialize submodules, bootstrap a Pigweed environment, and generate build files. This can take some time and may download on the order of 1GB of dependencies so the normal workflow is to just do this once.
activate.sh quickly reactivates an environment that has been previously bootstrapped.
These scripts must be sourced into the current session: source activate.sh.
In the environment, from the base directory of the dice-profile checkout, run ninja -C out to build everything and run all tests. You can also run pw watch which will build, run tests, and continue to watch for changes.
This will build and run tests on the host using the clang toolchain. Pigweed makes it easy to configure other targets and toolchains. See toolchains/BUILD.gn and the Pigweed documentation.
The code is designed to be portable and should work with a variety of modern toolchains and in a variety of environments. The main code in dice.h and dice.c is C99; it uses uint8_t, size_t, and memcpy from the C standard library. The various ops implementations are as portable as their dependencies (often not C99 but still very portable). Notably, this code uses designated initializers for readability. This is a feature available in C since C99 but missing from C++ until C++20 where it appears in a stricter form.
The Google C++ Style Guide is used. A .clang-format file is provided for convenience.
To incorporate the code into another project, there are a few options:
Copy only the necessary code. For example:
Take the main code as is: include/dice/dice.h, src/dice.c
Choose an implementation for crypto and certificate generation or choose to write your own. If you choose the boringssl implementation, for example, take include/dice/utils.h, include/dice/boringssl_ops.h, src/utils.c, and src/boringssl_ops.c. Taking a look at the library targets in BUILD.gn may be helpful.
Add this repository as a git submodule and integrate into the project build, optionally using the gn library targets provided.
Integrate into a project already using Pigweed using the gn build files provided.
The build reports code size using Bloaty McBloatface via the pw_bloat Pigweed module. There are two reports generated:
Library sizes - This report includes just the library code in this repository. It shows the baseline DICE code with no ops selected, and it shows the delta introduced by choosing various ops implementations. This report does not include the size of the third party dependencies.
Executable sizes - This report includes sizes for the library code in this repository plus all dependencies linked into a simple main function which makes a single DICE call with all-zero input. It shows the baseline DICE code with no ops (and therefore no dependencies other than libc), and it shows the delta introduced by choosing various ops implementations. This report does include the size of the third party dependencies. Note that rows specialized from ‘Boringssl Ops’ use that as a baseline for sizing.
The reports will be in the build output, but you can also find the reports in .txt files in the build output. For example, cat out/host_optimized/gen/*.txt | less will display all reports.
This code does not itself use mutable global variables, or any other type of shared data structure so there is no thread-safety concerns. However, additional care is needed to ensure dependencies are configured to be thread-safe. For example, the current boringssl configuration defines OPENSSL_NO_THREADS_CORRUPT_MEMORY_AND_LEAK_SECRETS_IF_THREADED, and that would need to be changed before running in a threaded environment.
This code makes a reasonable effort to clear memory holding sensitive data. This may help with a broader strategy to clear sensitive data but it is not sufficient on its own. Here are a few things to consider.