| commit | bb939ea45d53b2dbb7ab6b03856f023f82beecd5 | [log] [tgz] |
|---|---|---|
| author | Patrick Williams <patrick@stwcx.xyz> | Fri Dec 03 15:41:02 2021 -0600 |
| committer | Patrick Williams <patrick@stwcx.xyz> | Fri Dec 10 09:02:55 2021 -0600 |
| tree | 0cb7649b647563ddad93213f02be70c3bb229ead | |
| parent | 63540131ac2c2e9fa97f948c1d7a11de589e268b [diff] |
build: add meson support Port the existing autotools build system to meson, add meson wrap files for all openbmc dependencies, and add appropriate meson rules to gitignore. Tested: Verified executables all build, test cases pass, and executables install. Checked configuration files are all installed into the same locations as a Yocto-built autotools version of the package. Manually checked the symlinks for the systemd service files. ``` $ DESTDIR=/tmp/certificate_test ninja install $ find /tmp/certificate_test/lib /tmp/certificate_test/usr/local/share/phosphor-certificate-manager/ /tmp/certificate_test/lib /tmp/certificate_test/lib/systemd /tmp/certificate_test/lib/systemd/system /tmp/certificate_test/lib/systemd/system/multi-user.target.wants /tmp/certificate_test/lib/systemd/system/multi-user.target.wants/phosphor-certificate-manager@authority.service /tmp/certificate_test/lib/systemd/system/multi-user.target.wants/phosphor-certificate-manager@bmcweb.service /tmp/certificate_test/lib/systemd/system/bmc-vmi-ca-manager.service /tmp/certificate_test/lib/systemd/system/phosphor-certificate-manager@.service /tmp/certificate_test/usr/local/share/phosphor-certificate-manager/ /tmp/certificate_test/usr/local/share/phosphor-certificate-manager/authority /tmp/certificate_test/usr/local/share/phosphor-certificate-manager/bmcweb $ ls -n /tmp/certificate_test/lib/systemd/system/multi-user.target.wants total 0 lrwxrwxrwx 1 1000 1000 40 Dec 3 15:37 phosphor-certificate-manager@authority.service -> ../phosphor-certificate-manager@.service lrwxrwxrwx 1 1000 1000 40 Dec 3 15:37 phosphor-certificate-manager@bmcweb.service -> ../phosphor-certificate-manager@.service ``` Signed-off-by: Patrick Williams <patrick@stwcx.xyz> Change-Id: Ib9700b5a3bb437ccc157a2d060067b8e2b777981
Certificate management allows to replace the existing certificate and private key file with another (possibly CA signed) Certificate key file. Certificate management allows the user to install both the server and client certificates.
To build this package, do the following steps:
1. ./bootstrap.sh
2. ./configure ${CONFIGURE_FLAGS}
3. make
To clean the repository run `./bootstrap.sh clean`.
Multiple instances of phosphor-certificate-manager are usually run on the bmc to support management of different types of certificates.
Usage: ./phosphor-certificate-manager [options]
Options:
--help Print this menu
--type certificate type
Valid types: client,server,authority
--endpoint d-bus endpoint
--path certificate file path
--unit=<name> Optional systemd unit need to reload
Purpose: Server https certificate
./phosphor-certificate-manager --type=server --endpoint=https \ --path=/etc/ssl/certs/https/server.pem --unit=bmcweb.service
Purpose: Client certificate validation
./phosphor-certificate-manager --type=authority --endpoint=ldap \ --path=/etc/ssl/certs/authority --unit=bmcweb.service
Purpose: LDAP client certificate validation
./phosphor-certificate-manager --type=client --endpoint=ldap \ --path=/etc/nslcd/certs/cert.pem
phosphor-certificate-manager is an implementation of the D-Bus interface defined in this document.
D-Bus service name is constructed by "xyz.openbmc_project.Certs.Manager.{Type}.{Endpoint}" and D-Bus object path is constructed by "/xyz/openbmc_project/certs/{type}/{endpoint}".
Take https certificate management as an example.
./phosphor-certificate-manager --type=server --endpoint=https \ --path=/etc/ssl/certs/https/server.pem --unit=bmcweb.service
D-Bus service name is "xyz.openbmc_project.Certs.Manager.Server.Https" and D-Bus object path is "/xyz/openbmc_project/certs/server/https".
OpenBMC bmcweb exposes various REST APIs for certificate management on the BMC, which leverages functionalities of phosphor-certificate-manager via D-Bus.