Rewrite key management & signing
Extend compos_helper to support signing, use it from CompOS.
Expose the public key from the VM. Rename compos_verify_key to
compos_verify and get it to verify the signature against the current
instance's public key.
Also move DICE access to compos_key_main. There's no use having it in
the library - neither the tests nor compos_verify can use it - and it
complicates the build rules.
There's a lot more that can be deleted, but I'll do that in a
follow-up; this is big enough already.
Bug: 218494522
Test: atest CompOsSigningHostTest CompOsDenialHostTest
Change-Id: I2d71f68a595d5ddadb2e7b16937fa6855f5db0ab
diff --git a/compos/src/compos_key.rs b/compos/src/compos_key.rs
new file mode 100644
index 0000000..eb6248f
--- /dev/null
+++ b/compos/src/compos_key.rs
@@ -0,0 +1,64 @@
+/*
+ * Copyright 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+use anyhow::{bail, Context, Result};
+use std::io::Write;
+use std::process::{Command, Stdio};
+
+const COMPOS_KEY_HELPER_PATH: &str = "/apex/com.android.compos/bin/compos_key_helper";
+
+pub fn get_public_key() -> Result<Vec<u8>> {
+ let child = Command::new(COMPOS_KEY_HELPER_PATH)
+ .arg("public_key")
+ .stdin(Stdio::null())
+ .stdout(Stdio::piped())
+ .stderr(Stdio::piped())
+ .spawn()?;
+ let result = child.wait_with_output()?;
+ if !result.status.success() {
+ bail!("Helper failed: {:?}", result);
+ }
+ Ok(result.stdout)
+}
+
+pub fn sign(data: &[u8]) -> Result<Vec<u8>> {
+ let mut child = Command::new(COMPOS_KEY_HELPER_PATH)
+ .arg("sign")
+ .stdin(Stdio::piped())
+ .stdout(Stdio::piped())
+ .stderr(Stdio::piped())
+ .spawn()?;
+
+ // No output is written until the entire input is consumed, so this shouldn't deadlock.
+ let result =
+ child.stdin.take().unwrap().write_all(data).context("Failed to write data to be signed");
+ if result.is_ok() {
+ let result = child.wait_with_output()?;
+ if !result.status.success() {
+ bail!("Helper failed: {}", result.status);
+ }
+ return Ok(result.stdout);
+ }
+
+ // The child may have exited already, but if it hasn't then we need to make sure it does.
+ let _ignored = child.kill();
+
+ let result = result.with_context(|| match child.wait() {
+ Ok(exit_status) => format!("Child exited: {}", exit_status),
+ Err(wait_err) => format!("Wait for child failed: {:?}", wait_err),
+ });
+ Err(result.unwrap_err())
+}