146 lines
4.5 KiB
Bash
Executable File
146 lines
4.5 KiB
Bash
Executable File
#!/bin/bash
|
|
#
|
|
# generate-fips-conf.sh - Generate wolfssl-fips-ready.conf from a FIPS Ready .zip bundle
|
|
#
|
|
# Usage: ./generate-fips-conf.sh /path/to/wolfssl-x.x.x-gplv3-fips-ready.zip
|
|
#
|
|
|
|
set -e
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
CONF_FILE="${SCRIPT_DIR}/conf/wolfssl-fips-ready.conf"
|
|
|
|
ZIP_PATH="$1"
|
|
|
|
if [ -z "${ZIP_PATH}" ]; then
|
|
echo "Usage: $0 /path/to/wolfssl-x.x.x-gplv3-fips-ready.zip"
|
|
exit 1
|
|
fi
|
|
|
|
if [ ! -f "${ZIP_PATH}" ]; then
|
|
echo "Error: File not found: ${ZIP_PATH}"
|
|
exit 1
|
|
fi
|
|
|
|
ZIP_NAME="$(basename "${ZIP_PATH}")"
|
|
|
|
# --------------------------------------------------------------------------
|
|
# Extract version from filename
|
|
# Expected format: wolfssl-X.X.X-gplv3-fips-ready.zip
|
|
# --------------------------------------------------------------------------
|
|
|
|
VERSION="$(echo "${ZIP_NAME}" | sed -n 's/wolfssl-\([0-9]*\.[0-9]*\.[0-9]*\).*/\1/p')"
|
|
|
|
if [ -z "${VERSION}" ]; then
|
|
echo "Error: Could not extract version from filename: ${ZIP_NAME}"
|
|
echo "Expected format: wolfssl-X.X.X-gplv3-fips-ready.zip"
|
|
exit 1
|
|
fi
|
|
|
|
echo "=== Generating FIPS Ready Configuration ==="
|
|
echo ""
|
|
echo "Bundle: ${ZIP_NAME}"
|
|
echo "Version: ${VERSION}"
|
|
|
|
# --------------------------------------------------------------------------
|
|
# Compute SHA256 of the bundle
|
|
# --------------------------------------------------------------------------
|
|
|
|
echo ""
|
|
echo "[HASH] Computing SHA256..."
|
|
BUNDLE_SHA="$(sha256sum "${ZIP_PATH}" | awk '{print $1}')"
|
|
echo " SHA256: ${BUNDLE_SHA}"
|
|
|
|
# --------------------------------------------------------------------------
|
|
# Extract COPYING file and compute MD5
|
|
# --------------------------------------------------------------------------
|
|
|
|
echo "[HASH] Extracting license MD5..."
|
|
TMPDIR="$(mktemp -d)"
|
|
trap "rm -rf ${TMPDIR}" EXIT
|
|
|
|
# Try to find COPYING in the zip — it may be at the root or in a subdirectory
|
|
COPYING_PATH="$(unzip -l "${ZIP_PATH}" | grep -m1 'COPYING$' | awk '{print $NF}')"
|
|
|
|
if [ -z "${COPYING_PATH}" ]; then
|
|
echo "Warning: COPYING file not found in zip. You'll need to set WOLFSSL_LICENSE_MD5 manually."
|
|
LICENSE_MD5=""
|
|
else
|
|
unzip -q -o "${ZIP_PATH}" "${COPYING_PATH}" -d "${TMPDIR}"
|
|
LICENSE_MD5="$(md5sum "${TMPDIR}/${COPYING_PATH}" | awk '{print $1}')"
|
|
echo " License MD5: ${LICENSE_MD5}"
|
|
fi
|
|
|
|
# --------------------------------------------------------------------------
|
|
# Derive bundle name
|
|
# --------------------------------------------------------------------------
|
|
|
|
SRC_NAME="${ZIP_NAME%.zip}"
|
|
|
|
# --------------------------------------------------------------------------
|
|
# Resolve bundle directory (absolute path)
|
|
# --------------------------------------------------------------------------
|
|
|
|
BUNDLE_DIR="$(cd "$(dirname "${ZIP_PATH}")" && pwd)"
|
|
|
|
# --------------------------------------------------------------------------
|
|
# Generate conf file
|
|
# --------------------------------------------------------------------------
|
|
|
|
echo "[CONFIG] Writing conf/wolfssl-fips-ready.conf..."
|
|
mkdir -p "$(dirname "${CONF_FILE}")"
|
|
|
|
cat > "${CONF_FILE}" <<EOF
|
|
# wolfSSL FIPS Ready Configuration
|
|
#
|
|
# Auto-generated by generate-fips-conf.sh from:
|
|
# ${ZIP_NAME}
|
|
#
|
|
# To regenerate: make generate-fips-conf BUNDLE=/path/to/bundle.zip
|
|
|
|
# Use wolfSSL FIPS Ready as the wolfSSL provider
|
|
PREFERRED_PROVIDER_virtual/wolfssl = "wolfssl-fips-ready"
|
|
PREFERRED_PROVIDER_wolfssl = "wolfssl-fips-ready"
|
|
|
|
# FIPS hash mode: "auto" (QEMU-based extraction) or "manual" (use static FIPS_HASH)
|
|
WOLFSSL_FIPS_HASH_MODE ?= "auto"
|
|
WOLFSSL_FIPS_HASH_MODE_LINUXKM ?= "auto"
|
|
|
|
# wolfSSL FIPS kernel module provider
|
|
PREFERRED_PROVIDER_virtual/wolfssl-linuxkm ?= "wolfssl-linuxkm-fips-ready"
|
|
PREFERRED_PROVIDER_wolfssl-linuxkm ?= "wolfssl-linuxkm-fips-ready"
|
|
|
|
# Bundle version
|
|
WOLFSSL_VERSION = "${VERSION}"
|
|
|
|
# SHA256 checksum of the bundle .zip
|
|
WOLFSSL_SRC_SHA = "${BUNDLE_SHA}"
|
|
|
|
# MD5 of the COPYING license file in the bundle
|
|
WOLFSSL_LICENSE_MD5 = "${LICENSE_MD5}"
|
|
|
|
# Bundle name (directory name inside the zip, without extension)
|
|
WOLFSSL_SRC = "${SRC_NAME}"
|
|
|
|
# Bundle archive filename
|
|
WOLFSSL_BUNDLE_FILE = "${ZIP_NAME}"
|
|
|
|
# Directory containing the .zip bundle (absolute path to where bundle lives)
|
|
WOLFSSL_SRC_DIR = "${BUNDLE_DIR}"
|
|
|
|
# FIPS hash (set after first build if using manual mode)
|
|
# Leave as-is for auto mode — it will be extracted automatically
|
|
FIPS_HASH = "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
|
|
EOF
|
|
|
|
echo ""
|
|
echo "=== Done ==="
|
|
echo ""
|
|
echo "Generated: conf/wolfssl-fips-ready.conf"
|
|
echo "Bundle: ${BUNDLE_DIR}/${ZIP_NAME}"
|
|
echo ""
|
|
echo "Next steps:"
|
|
echo " make fips-on"
|
|
echo " make clean"
|
|
echo " make build"
|