Update mbedtls-prepare-build for Mbed TLS 3.4+ #108
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Gilles Peskine <[email protected]>
Signed-off-by: Gilles Peskine <[email protected]>
Make a config file that only sets the options given explicitly, without copying or including a base file. Signed-off-by: Gilles Peskine <[email protected]>
Signed-off-by: Gilles Peskine <[email protected]>
Similar to scripts/ecc-heap.sh. Signed-off-by: Gilles Peskine <[email protected]>
Fix the build with Everest enabled. Signed-off-by: Gilles Peskine <[email protected]>
Signed-off-by: Gilles Peskine <[email protected]>
Signed-off-by: Gilles Peskine <[email protected]>
Signed-off-by: Gilles Peskine <[email protected]>
Clang finds more things than GCC Signed-off-by: Gilles Peskine <[email protected]>
Signed-off-by: Gilles Peskine <[email protected]> Signed-off-by: Gilles Peskine <[email protected]>
Signed-off-by: Gilles Peskine <[email protected]>
Signed-off-by: Gilles Peskine <[email protected]>
Signed-off-by: Gilles Peskine <[email protected]>
Signed-off-by: Gilles Peskine <[email protected]>
Signed-off-by: Gilles Peskine <[email protected]>
gilles-peskine-arm
added
enhancement
* pk: dh_genprime, gen_key, key_app, key_app_writer. * ssl: ssl_client2, ssl_mail_client, ssl_server2. * x509: pem2der, cert_app, cert_req, cert_write, crl_app, req_app. Signed-off-by: Gilles Peskine <[email protected]>
Recognize -f/--file option. Recognize PSA_xxx symbols as well as MBEDTLS_xxx. Signed-off-by: Gilles Peskine <[email protected]>
Signed-off-by: Gilles Peskine <[email protected]>
Signed-off-by: Gilles Peskine <[email protected]>
Signed-off-by: Gilles Peskine <[email protected]>
Signed-off-by: Gilles Peskine <[email protected]>
Support mbedtls after Mbed-TLS/mbedtls#9200 Signed-off-by: Gilles Peskine <[email protected]>
The point of that preset is for code size measurements, so baremetal_size is the configuration to use, now that it exists. Signed-off-by: Gilles Peskine <[email protected]>
Support mbedtls after Mbed-TLS/mbedtls#9247 Signed-off-by: Gilles Peskine <[email protected]> Signed-off-by: Gilles Peskine <[email protected]>
Add shell quoting to the "generated by" line so that it can be copy-pasted into a shell, even if some arguments contain spaces and other special characters. Add a new target `prepare`, alias `dep`: `make prepare` or `make dep` regenerates the makefile. This might not yet work in all arrangements of the build directory relative to the source directory; it works at least when `mbedtls-prepare-build` is invoked inside the source directory. Signed-off-by: Gilles Peskine <[email protected]>
The build works on development as of cb854d5d19e05339448afb03839bee7f7e3ecd23. Signed-off-by: Gilles Peskine <[email protected]>
gilles-peskine-arm
added
size-m
Fix build failures on Everest files that can happen even when Everst is disabled (observed in development after Everest moved to tf-psa-crypto, but that might occur in <=3.6 as well in some configurations). The build failures are genuine, but our official build system skips those files because they get the code from Hacl_Curve25519_joined.c instead. Signed-off-by: Gilles Peskine <[email protected]>
Tested on mbedtls-3.6.1. Signed-off-by: Gilles Peskine <[email protected]>
Needed for mbedtls during repo split work between 3.6 and 4.0. Signed-off-by: Gilles Peskine <[email protected]>
Signed-off-by: Gilles Peskine <[email protected]>
Needed after Mbed-TLS/mbedtls#9638, no big deal before. Signed-off-by: Gilles Peskine <[email protected]>
Signed-off-by: Gilles Peskine <[email protected]>
Initial commit to support builds with libtestdriver1.
The following command results in a configuration that should be the same as
`component_test_psa_crypto_config_accel_ecdsa`:
```
mbedtls-prepare-build -d build-accel-ecdsa-sha1-debug -p debug --config-set=MBEDTLS_PSA_CRYPTO_CONFIG --config-unset=MBEDTLS_PSA_CRYPTO_SE_C --accel-list={ALG_ECDSA,ALG_DETERMINISTIC_ECDSA,KEY_TYPE_ECC_PUBLIC_KEY,KEY_TYPE_ECC_KEY_PAIR_{BASIC,IMPORT,EXPORT,GENERATE,DERIVE},ECC_{SECP_R1_{192,224,256,384,521},SECP_K1_{192,224,256},BRAINPOOL_P_R1_{256,384,512},MONTGOMERY_{255,448}}} --config-unset=MBEDTLS_ECDSA_C,MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED,MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED --libtestdriver1-extra-list=ALG_SHA{_1,{,3}_{224,256,384,512}}
```
Known limitations:
* Barely tested.
* Only tested with a commit that's close to
de4d5b78558666d2e258d95e6c5875f9c72687ed (development soon after the 3.6.1
release).
* Only static library builds are supported.
* Only configurations based on the default configuration are supported.
In particular, a configuration with threading (e.g. derived from `full`)
requires setting `MBEDTLS_THREADING_C` and `MBEDTLS_THREADING_PTHREAD`
manually in `--libtestdriver1-extra-cflags`.
Signed-off-by: Gilles Peskine <[email protected]>
Signed-off-by: Gilles Peskine <[email protected]>
More generally, refuse to overwrite an existing file unless it has "Generated by" in the first line. Make an exception for the config header, which we commonly expect to be modified by test scripts. Signed-off-by: Gilles Peskine <[email protected]>
Signed-off-by: Gilles Peskine <[email protected]>
Signed-off-by: Gilles Peskine <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is a collection of updates to
mbedtls-prepare-buildto add more presets and support some changes in mbedtls from the last couple of years. Has changes needed for 3.4, for 3.6, for the post-3.6 framework moves and fortf-psa-cryptoas of 2024-07-17.