| commit | 157d81ae20b4b1197752960e74faa51983ee5b22 | [log] [tgz] |
|---|---|---|
| author | pigweed-roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com> | Sun Jul 13 17:47:54 2025 -0700 |
| committer | CQ Bot Account <pigweed-scoped@luci-project-accounts.iam.gserviceaccount.com> | Sun Jul 13 17:47:54 2025 -0700 |
| tree | cb00cca067db0e97d4fed63dc7b3dab3f8c59577 | |
| parent | 263adeef65e6d0ff31863b7bbb524748682f4d42 [diff] |
roll: third_party/pigweed/src b51ab5d..6bc0bc6 (70 commits) 6bc0bc6:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/304793 roll: luci 52caf76:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/304773 roll: fuchsia-infra-bazel-rules 4da15df..82e6cdc (54 commits) f083a67:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/304772 roll: ninja c0b82e0:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/304573 docs: Fix search-as-you-type ecc3303:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/301954 workflows: Add pw shortcut at root 74ea960:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/303472 pw_bluetooth_proxy: Initial proxy sketch using PacketTask/Proxy f770f67:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/301892 pw_bluetooth_sapphire: Update driver to dynamic routing fabfb75:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/304612 pw_async2: Mark waker macros as nodiscard afe5e94:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/304572 pw_toolchain: Fix rustc_srcs_path 00a7ab2:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/303956 pw_containers: Size reports for pw::DynamicDeque and std::deque cd17fc4:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/304313 pw_rpc: Expose server_reader_writer only once 349c4ce:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/303952 gemini: Configure Gemini to respect gitignore 53c06ca:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/304312 pw_rpc: Split up internal_test_utils 044a590:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/304460 pw_build: Add filter for python transitive test deps e8c49ac:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/293993 pw_bluetooth_proxy: Additional comments around locking fe369a2:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/301953 workflows: Add Pigweed workflows.json 8471ff5:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/304392 pw_kernel: Simplify kernel traits 493b3a0:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/304432 docs: Add serve alias a014a4c:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/293514 pw_channel: Introduce PacketTask and PacketProxy 9adb198:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/301455 pw_kernel: Add cloneable signaler interface to Events 8f705b4:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/300534 pw_stream_uart_linux: Fix bazel layering check c91fc7c:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/303394 pw_ide: Release v1.9.5 cb5e7a3:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/300496 pw_spi_linux: Fix bazel layering check 04aeff8:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/302619 pw_kernel: Add configurable Risc-V timers 60a4cc5:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/280098 pw_trace_tokenized: rm most includes 31964ac:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/280093 pw_unit_test: rm includes, tidy up config_setting 664d0fc:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/296713 bazel: Use @bazel_tools//tools:host_platform for host ad79a90:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/301175 pw_build: Launch tools/builds from workflows launcher 58b23ca:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/303692 pw_system: Fix doc headings 81786df:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/300533 pw_rpc_transport: Fix bazel layering check 2b0ac39:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/303832 pw_system: benchmark_runner: Remove unused --config-file arg 9e1d364:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/304132 docs: Set favicon on Doxygen site 6317475:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/303955 docs: Init Doxygen customizations 1b6f00c:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/303972 pw_kernel: Update vscode docs to allow extra error output bcf321e:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/304093 pw_build: Remove obsolete incompatible_use_toolchain_transition 1b91b8b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/295552 pw_rpc: Log ChannelOutput::Send() errors at the ERROR level fecaf14:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/304012 docs: Update //docs paths ec97141:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/304092 docs: Remove test string b19c2b0:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/301312 pw_uart_mcuxpresso: Add non-dma variant of non-blocking driver 7ab9a27:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/302332 pw_bluetooth_sapphire: Queue new advertisements when needed f0a2542:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/302658 pw_build: Move rust_docs rule to pw_build and rename afe3e32:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/302672 pw_kernel: Upgrade rules_rust to 0.62.0 989be4e:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/303954 docs: Reorganize the //docs directory 1475344:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/303332 docs: Remove obsolete URL prefix 169a4f9:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/289232 pw_transfer: Add Android.bp for Soong build 0a79ba0:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/303652 pw_{build, presubmit}: Invert dependency direction 421d853:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/303733 pw_async2: Split out tasks and wakers to separate cc files 5fa8004:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/303712 docs: Fix broken link b94252d:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/300495 pw_grpc: Fix bazel layering check 855e873:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/300494 pw_clock_tree: Fix bazel layering check c8d7e4b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/302618 pw_kernel: Use armv8-m cpu constraint consistently c2055fc:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/302617 pw_kernel: Remove unused dependency 60e1037:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/302616 pw_build: Move @rust_crates//:std and :no_std to pw_build 3b7865b:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/302615 pw_kernel: Use fully qualified labels in flags.bzl 57d2afc:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/303532 pw_build: Minor Workflows manager cleanups 10a055a:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/303372 pw_kernel: Store stacks in .bss to save space 86a6be4:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/302614 pw_kernel: Add risc-v mtvec configuration option 815a734:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/303217 pw_multibuf: Move internal iterator headers to internal/ 632e84a:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/297252 pw_kernel: Explicily set direct mode for mtvec 27ef855:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/301132 pw_kernel: Add //pw_kernel/tooling:code_size ecc6dfb:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/303352 pw_multibuf: Rename multibuf::Property to MultiBufProperty bbc8139:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/303216 pw_multibuf: Replace multibuf::Instance with MultiBuf::Instance a31efba:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/303215 pw_multibuf: Move multibuf::MultiBuf into the pw namespace 8d66cd9:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/299092 pw_trace_tokenized: Fix timestamp for first event 75b6559:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/301134 pw_snaphot: Fix processor argparse types 81fe863:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/302452 pw_bluetooth_sapphire: Add status callback to StopAdvertising edcb2a3:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/303173 pw_stream_uart_mcuxpresso: Ignore empty data 7fb50a5:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/302534 pw_presubmit: Catch more submission-blocking phrases; add tests 1478990:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/301952 pw_build: Add library to convert workflows to recipes 4d727db:https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/301076 pw_async2: Add design.rst Rolled-Repo: https://pigweed.googlesource.com/pigweed/pigweed Rolled-Commits: b51ab5d2632df0..6bc0bc64b03333 Roll-Count: 1 Roller-URL: https://cr-buildbucket.appspot.com/build/8709412984731439841 GitWatcher: ignore CQ-Do-Not-Cancel-Tryjobs: true Change-Id: I52647ff860bec91b4fe4e778989cb07fa009287d Reviewed-on: https://pigweed-review.googlesource.com/c/open-dice/+/304854 Bot-Commit: Pigweed Roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com> Commit-Queue: Pigweed Roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com> Lint: Lint 🤖 <android-build-ayeaye@system.gserviceaccount.com>
This repository contains the specification for the Open Profile for DICE along with production-quality code. This profile is a specialization of the Hardware Requirements for a Device Identifier Composition Engine and DICE Layering Architecture specifications published by the Trusted Computing Group (TCG). For readers already familiar with those specs, notable distinctives of this profile include:
You can find us (and join us!) at https://groups.google.com/g/open-profile-for-dice. We're happy to answer questions and discuss proposed changes or features.
The specification can be found here. It is versioned using a major.minor scheme. Compatibility is maintained across minor versions but not necessarily across major versions.
Production quality, portable C code is included. The main code is in dice.h and dice.c. Cryptographic and certificate generation operations are injected via a set of callbacks. Multiple implementations of these operations are provided, all equally acceptable. Integrators should choose just one of these, or write their own.
Tests are included for all code and the build files in this repository can be used to build and run these tests.
Disclaimer: This is not an officially supported Google product.
Different implementations use different third party libraries. The third_party directory contains build files and git submodules for each of these. The submodules must be initialized once after cloning the repo, using git submodule update --init, and updated after pulling commits that roll the submodules using git submodule update.
To setup the build environment the first time:
$ git submodule update --init --recursive $ source bootstrap.sh $ gn gen out
To build and run tests:
$ ninja -C out
The easiest way, and currently the only supported way, to build and run tests is from a Pigweed environment on Linux. Pigweed does support other host platforms so it shouldn't be too hard to get this running on Windows for example, but we use Linux.
There are two scripts to help set this up:
bootstrap.sh will initialize submodules, bootstrap a Pigweed environment, and generate build files. This can take some time and may download on the order of 1GB of dependencies so the normal workflow is to just do this once.
activate.sh quickly reactivates an environment that has been previously bootstrapped.
These scripts must be sourced into the current session: source activate.sh.
In the environment, from the base directory of the dice-profile checkout, run ninja -C out to build everything and run all tests. You can also run pw watch which will build, run tests, and continue to watch for changes.
This will build and run tests on the host using the clang toolchain. Pigweed makes it easy to configure other targets and toolchains. See toolchains/BUILD.gn and the Pigweed documentation.
The code is designed to be portable and should work with a variety of modern toolchains and in a variety of environments. The main code in dice.h and dice.c is C99; it uses uint8_t, size_t, and memcpy from the C standard library. The various ops implementations are as portable as their dependencies (often not C99 but still very portable). Notably, this code uses designated initializers for readability. This is a feature available in C since C99 but missing from C++ until C++20 where it appears in a stricter form.
The Google C++ Style Guide is used. A .clang-format file is provided for convenience.
To incorporate the code into another project, there are a few options:
Copy only the necessary code. For example:
Take the main code as is: include/dice/dice.h, src/dice.c
Choose an implementation for crypto and certificate generation or choose to write your own. If you choose the boringssl implementation, for example, take include/dice/utils.h, include/dice/boringssl_ops.h, src/utils.c, and src/boringssl_ops.c. Taking a look at the library targets in BUILD.gn may be helpful.
Add this repository as a git submodule and integrate into the project build, optionally using the gn library targets provided.
Integrate into a project already using Pigweed using the gn build files provided.
The build reports code size using Bloaty McBloatface via the pw_bloat Pigweed module. There are two reports generated:
Library sizes - This report includes just the library code in this repository. It shows the baseline DICE code with no ops selected, and it shows the delta introduced by choosing various ops implementations. This report does not include the size of the third party dependencies.
Executable sizes - This report includes sizes for the library code in this repository plus all dependencies linked into a simple main function which makes a single DICE call with all-zero input. It shows the baseline DICE code with no ops (and therefore no dependencies other than libc), and it shows the delta introduced by choosing various ops implementations. This report does include the size of the third party dependencies. Note that rows specialized from ‘Boringssl Ops’ use that as a baseline for sizing.
The reports will be in the build output, but you can also find the reports in .txt files in the build output. For example, cat out/host_optimized/gen/*.txt | less will display all reports.
This code does not itself use mutable global variables, or any other type of shared data structure so there is no thread-safety concerns. However, additional care is needed to ensure dependencies are configured to be thread-safe. For example, the current boringssl configuration defines OPENSSL_NO_THREADS_CORRUPT_MEMORY_AND_LEAK_SECRETS_IF_THREADED, and that would need to be changed before running in a threaded environment.
This code makes a reasonable effort to clear memory holding sensitive data. This may help with a broader strategy to clear sensitive data but it is not sufficient on its own. Here are a few things to consider.