xref: /titanic_51/usr/src/tools/codesign/signproto.sh (revision a272125655938e902d5c7d99d182d3b1e35f70eb)
1#!/bin/ksh
2#
3#
4# CDDL HEADER START
5#
6# The contents of this file are subject to the terms of the
7# Common Development and Distribution License (the "License").
8# You may not use this file except in compliance with the License.
9#
10# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
11# or http://www.opensolaris.org/os/licensing.
12# See the License for the specific language governing permissions
13# and limitations under the License.
14#
15# When distributing Covered Code, include this CDDL HEADER in each
16# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
17# If applicable, add the following below this CDDL HEADER, with the
18# fields enclosed by brackets "[]" replaced with your own identifying
19# information: Portions Copyright [yyyy] [name of copyright owner]
20#
21# CDDL HEADER END
22#
23#
24# Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
25# Use is subject to license terms.
26#
27# ident	"%Z%%M%	%I%	%E% SMI"
28
29# signproto cred_file
30#
31# Utility to find cryptographic modules in the proto area and
32# sign them using signit. Since the binaries have already been
33# signed (using development keys) during the build process,
34# we determine the correct signing credential to use based on
35# the existing signature. The cred_file argument contains a
36# list of signing server credentials and the corresponding
37# regular expressions to match against the file signatures.
38
39# Directories in proto area that may contain crypto objects
40DIRS="platform kernel usr/lib/security"
41
42# Get absolute path of current directory; used later to invoke signit
43cd .
44dir=`dirname $0`
45dir=`[[ $dir = /* ]] && print $dir || print $PWD/$dir`
46
47# Read list of credentials and regular expressions
48n=0
49grep -v "^#" $1 | while read c r
50do
51	cred[$n]=$c
52	regex[$n]=$r
53	(( n = n + 1 ))
54done
55
56# Search proto area for crypto modules
57cd $ROOT
58find $DIRS -type f -print | while read f; do
59	s=`elfsign list -f signer -e $f 2>/dev/null`
60	if [[ $? != 0 ]]; then
61		continue
62	fi
63	# Determine credential based on signature
64	i=0
65	while [[ i -lt n ]]
66	do
67		if expr "$s" : ".*${regex[i]}" >/dev/null; then
68			echo "${cred[i]} $f"
69			break
70		fi
71		(( i = i + 1 ))
72	done
73done | $dir/signit -i $ROOT -l ${CODESIGN_USER:-${LOGNAME}}
74
75if [ $? != 0 ]; then
76	echo "ERROR failure in signing operation"
77fi
78