Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

pyopenssl_signer: Use cryptography #918

Merged
merged 1 commit into from
Jan 6, 2025
Merged

pyopenssl_signer: Use cryptography #918

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 15 additions & 7 deletions edk2toolext/capsule/pyopenssl_signer.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,8 +17,9 @@
import logging
import warnings

from cryptography.hazmat.primitives.serialization.pkcs12 import load_pkcs12
from OpenSSL import crypto
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import padding
from cryptography.hazmat.primitives.serialization import pkcs12


def sign(data: bytes, signature_options: dict, signer_options: dict) -> bytes:
Expand Down Expand Up @@ -57,11 +58,15 @@
raise ValueError("Signature type options not supported")
if signature_options["encoding"] != "binary":
raise ValueError(f"Unsupported signature encoding: {signature_options['encoding']}")
if signature_options["hash_alg"] != "sha256":
raise ValueError(f"Unsupported hashing algorithm: {signature_options['hash_alg']}")
if signer_options["key_file_format"] != "pkcs12":
raise ValueError(f"Unsupported signer key file format: {signer_options['key_file_format']}")

match signature_options["hash_alg"]:
case "sha256":
algorithm = hashes.SHA256()
case hash_alg:
raise ValueError(f"Unsupported hashing algorithm: {hash_alg}")

Check warning on line 68 in edk2toolext/capsule/pyopenssl_signer.py

View check run for this annotation

Codecov / codecov/patch

edk2toolext/capsule/pyopenssl_signer.py#L67-L68 

Added lines #L67 - L68 were not covered by tests

logging.debug("Executing PKCS1 Signing")

# If a key file is provided, use it for signing.
Expand All @@ -78,9 +83,12 @@
if not isinstance(password, bytes):
password = password.encode()

private_key, _, _ = pkcs12.load_key_and_certificates(signer_options["key_data"], password)

if not private_key:
raise ValueError("Failed to load private key from PKCS12 data")

Check warning on line 89 in edk2toolext/capsule/pyopenssl_signer.py

View check run for this annotation

Codecov / codecov/patch

edk2toolext/capsule/pyopenssl_signer.py#L89 

Added line #L89 was not covered by tests

# TODO: Figure out OIDs.
# TODO: Figure out EKU.

pkcs12 = load_pkcs12(signer_options["key_data"], password)
pkey = crypto.PKey.from_cryptography_key(pkcs12.key)
return crypto.sign(pkey, data, signature_options["hash_alg"])
return private_key.sign(data, padding.PKCS1v15(), algorithm)
Loading