| commit | d79ae1a0b7ffc59b1fe0ce80836278192244a8a1 | [log] [tgz] |
|---|---|---|
| author | pigweed-roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com> | Sun May 25 17:46:41 2025 -0700 |
| committer | CQ Bot Account <pigweed-scoped@luci-project-accounts.iam.gserviceaccount.com> | Sun May 25 17:46:41 2025 -0700 |
| tree | e1335c6ef279388deedfbbb9c8b6ab317b0deae2 | |
| parent | 48940873dc6638f63d8d3c52fe72de5370f13eff [diff] |
roll: third_party/pigweed/src d34b1d1..e329109 (63 commits) 4be0d00:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/294159 roll: gn d34b1d1:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/294155 roll: luci bfdbef9:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/294152 roll: ninja 1688871:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/294133 roll: fuchsia-infra-bazel-rules 723b4d8..50a8a45 (58 commits) b76bcea:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/291877 pw_kernel: Support unit tests after kernel init 1defe8c:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/293936 pw_package: Add roller as packages owner 59a0e8e:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/293234 pw_allocator: Fix -Wdocumentation warnings 9105834:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/150236 pw_console: Standard mouse drag text selection 2807382:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/291261 pw_console: Background command running 355e78e:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/293773 pw_allocator: Add AsyncPool be8c4b5:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/293832 pw_toolchain: Expose host_clang addr2line for downstream 258e151:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/293772 pw_watch: run.py arg for controlling whether to clear the screen 9aaffef:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/284857 pw_crypto: Migrate size reports to Bazel 91c2c9d:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/286416 pw_allocator: Migrate size report to Bazel f3c338c:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/293452 docs: Add note about bisecting rollers d043b7d:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/293353 pw_console: Allow hiding log columns and setting widths f60e5e5:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/293256 docs: Refresh the Sense docs a73be5b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/293552 pw_tokenizer: Refactor to remove panicky code 5f5b251:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/293495 pw_stream: Refactor to remove panicky code 9d68d72:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/293494 pw_base64: Refactor to remove panicky code bafd9d8:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/270094 pw_package: Add rust_crates package 55b0258:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/293479 pw_toolchain: Use -Os for rust dbg and fastbuilds 9abacee:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/293493 pw_kernel: Enable fat lto and change -Oz to -Os 00c7806:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/292933 pw_kernel: Add kernel_no_panics_test target 83785da:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/292265 docs: Update the overview 78d34f8:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/293212 pw_bluetooth_sapphire: Add leases subnode to lease_provider Inspect node 3c290e7:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/293254 targets/stm32f429i*: Update platform name 4ced4a3:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/293473 pw_bluetooth: Ensure proper ordering when generating emboss headers ad3dbb9:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/293233 pw_build_android: Add more target support 654e456:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/289515 zephyr: Migrate to new test framework b09da2b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/292458 pw_bluetooth_proxy: Delete unused includes 15349ff:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/293395 pw_rpc_transport: Correct simple_framing_test std::equal() checks b102538:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/293394 pw_rpc_transport: Use ByteBuffer to access SimpleRpcPacketEncoder header ebc860c:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/293393 pw_rpc_transport: Correct SimpleRpcPacketEncoder kMaxPacketSize check 72ed9eb:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/293392 pw_rpc_transport: Add kMaxEncodedPacketSize to SimpleRpcPacketEncoder 6646eb1:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/292972 pw_rpc_transport: Add BaseRpcEgress d3f422a:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/293492 pw_bluetooth_sapphire: Initialize logger dee4878:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/289514 pw_i2c_zephyr: Add Zephyr backend for i2c bc15bc2:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/292461 pw_bluetooth_proxy: Move event_fn to ChannelProxy bb2347b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/292457 pw_bluetooth_proxy: Introduce ChannelProxy and related classes db5c5ff:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/292833 pw_bluetooth_proxy: Refactor client channel tests into their own file fa9e18c:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/292456 pw_bluetooth_proxy: Group l2cap variable declarations 121a101:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/292796 pw_bluetooth_sapphire: Add queued/pending commands to Inspect 7080af1:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/289513 zephyr: Begin using latest Zephyr testing a9084c8:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/290372 pw_toolchain: Use correct soft-float toolchain prebuilt for riscv32 71b1d58:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/293472 pw_env_setup: Add make from CIPD 55d135f:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/285272 bazel: Switch to stock probe-rs prebuilts e65453e:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/292803 pw_work_queue: Fix initialization order issue 2726f6f:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/293172 pw_tokenizer: Make linker script includable without copying 691e534:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/293255 git: Properly gitignore external/ 5b46ebf:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/291812 pw_build: Fix log line reset color check b9eb356:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/292932 pw_kernel: Add rust panic_detector utility 3c95dd2:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/292276 pw_build_android: Introduce pw_android_common_target_support 51c5ae0:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/293052 pw_chre: Fix time unit conversion 28712f1:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/291636 pw_tokenizer: Allow arbitrary prefixes for ELF database sections eb9dae6:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/284613 pw_tokenizer: Nested Base10 and Base16 detokenization updates b2e0f27:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/286892 pw_trace_tokenized: Fetch tracing data via pw_transfer c161c4c:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/292814 docs: Add "manual" tag to doxygen rules d375fc0:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/291638 pw_ide: Disable failing unit test 2a8bcd7:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/284192 pw_build: Remove remaining instances of dir_pw_third_party 5c59576:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/292257 pw_kernel: Add userspace demo to qemu_virt_riscv32 target 309b306:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/292072 pw_kernel: Add userspace demo to pw-rp2350 target e329109:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/292262 pw_thread_threadx: Allow minimum priority preemption threshold Rolled-Repo: https://pigweed.googlesource.com/pigweed/pigweed Rolled-Commits: d34b1d1996f905..e329109e707af9 Roll-Count: 1 Roller-URL: https://cr-buildbucket.appspot.com/build/8713852234583951745 GitWatcher: ignore CQ-Do-Not-Cancel-Tryjobs: true Change-Id: I1b1efc1e74424d3392bac9b70da3903e22feb46b Reviewed-on: https://pigweed-review.googlesource.com/c/open-dice/+/294162 Bot-Commit: Pigweed Roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com> Commit-Queue: Pigweed Roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com> Lint: Lint 🤖 <android-build-ayeaye@system.gserviceaccount.com>
This repository contains the specification for the Open Profile for DICE along with production-quality code. This profile is a specialization of the Hardware Requirements for a Device Identifier Composition Engine and DICE Layering Architecture specifications published by the Trusted Computing Group (TCG). For readers already familiar with those specs, notable distinctives of this profile include:
You can find us (and join us!) at https://groups.google.com/g/open-profile-for-dice. We're happy to answer questions and discuss proposed changes or features.
The specification can be found here. It is versioned using a major.minor scheme. Compatibility is maintained across minor versions but not necessarily across major versions.
Production quality, portable C code is included. The main code is in dice.h and dice.c. Cryptographic and certificate generation operations are injected via a set of callbacks. Multiple implementations of these operations are provided, all equally acceptable. Integrators should choose just one of these, or write their own.
Tests are included for all code and the build files in this repository can be used to build and run these tests.
Disclaimer: This is not an officially supported Google product.
Different implementations use different third party libraries. The third_party directory contains build files and git submodules for each of these. The submodules must be initialized once after cloning the repo, using git submodule update --init, and updated after pulling commits that roll the submodules using git submodule update.
To setup the build environment the first time:
$ git submodule update --init --recursive $ source bootstrap.sh $ gn gen out
To build and run tests:
$ ninja -C out
The easiest way, and currently the only supported way, to build and run tests is from a Pigweed environment on Linux. Pigweed does support other host platforms so it shouldn't be too hard to get this running on Windows for example, but we use Linux.
There are two scripts to help set this up:
bootstrap.sh will initialize submodules, bootstrap a Pigweed environment, and generate build files. This can take some time and may download on the order of 1GB of dependencies so the normal workflow is to just do this once.
activate.sh quickly reactivates an environment that has been previously bootstrapped.
These scripts must be sourced into the current session: source activate.sh.
In the environment, from the base directory of the dice-profile checkout, run ninja -C out to build everything and run all tests. You can also run pw watch which will build, run tests, and continue to watch for changes.
This will build and run tests on the host using the clang toolchain. Pigweed makes it easy to configure other targets and toolchains. See toolchains/BUILD.gn and the Pigweed documentation.
The code is designed to be portable and should work with a variety of modern toolchains and in a variety of environments. The main code in dice.h and dice.c is C99; it uses uint8_t, size_t, and memcpy from the C standard library. The various ops implementations are as portable as their dependencies (often not C99 but still very portable). Notably, this code uses designated initializers for readability. This is a feature available in C since C99 but missing from C++ until C++20 where it appears in a stricter form.
The Google C++ Style Guide is used. A .clang-format file is provided for convenience.
To incorporate the code into another project, there are a few options:
Copy only the necessary code. For example:
Take the main code as is: include/dice/dice.h, src/dice.c
Choose an implementation for crypto and certificate generation or choose to write your own. If you choose the boringssl implementation, for example, take include/dice/utils.h, include/dice/boringssl_ops.h, src/utils.c, and src/boringssl_ops.c. Taking a look at the library targets in BUILD.gn may be helpful.
Add this repository as a git submodule and integrate into the project build, optionally using the gn library targets provided.
Integrate into a project already using Pigweed using the gn build files provided.
The build reports code size using Bloaty McBloatface via the pw_bloat Pigweed module. There are two reports generated:
Library sizes - This report includes just the library code in this repository. It shows the baseline DICE code with no ops selected, and it shows the delta introduced by choosing various ops implementations. This report does not include the size of the third party dependencies.
Executable sizes - This report includes sizes for the library code in this repository plus all dependencies linked into a simple main function which makes a single DICE call with all-zero input. It shows the baseline DICE code with no ops (and therefore no dependencies other than libc), and it shows the delta introduced by choosing various ops implementations. This report does include the size of the third party dependencies. Note that rows specialized from ‘Boringssl Ops’ use that as a baseline for sizing.
The reports will be in the build output, but you can also find the reports in .txt files in the build output. For example, cat out/host_optimized/gen/*.txt | less will display all reports.
This code does not itself use mutable global variables, or any other type of shared data structure so there is no thread-safety concerns. However, additional care is needed to ensure dependencies are configured to be thread-safe. For example, the current boringssl configuration defines OPENSSL_NO_THREADS_CORRUPT_MEMORY_AND_LEAK_SECRETS_IF_THREADED, and that would need to be changed before running in a threaded environment.
This code makes a reasonable effort to clear memory holding sensitive data. This may help with a broader strategy to clear sensitive data but it is not sufficient on its own. Here are a few things to consider.