keytoc/CONFIG_CRYPTO_PUBLIC_KEYS can work with a complete keyspec provided by an environment variable as opposed to providing single URIs. This would be a very useful feature if it could also provide any number of keys. Kconfig however provides keytoc with regular keyspecs already split at spaces so without furhter measures, the env variable can only be expanded into a single key.
Work around this by, in the special case of keytoc provided with a single environment variable, splitting that single argument at any space character that is not escaped with a backslash in front of it. Unescaped space characters following an unescaped space character are ignored, trailing unescaped space characters are not ignored, leading to an additional, empty key argument, which is invalid. Signed-off-by: Jonas Rebmann <[email protected]> --- scripts/keytoc.c | 43 ++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 42 insertions(+), 1 deletion(-) diff --git a/scripts/keytoc.c b/scripts/keytoc.c index 77ada3af45..de882fe9fe 100644 --- a/scripts/keytoc.c +++ b/scripts/keytoc.c @@ -818,6 +818,7 @@ int main(int argc, char *argv[]) char *outfile = NULL; int keycount; struct keyinfo *keylist; + char **keyspecs; outfilep = stdout; @@ -853,10 +854,50 @@ int main(int argc, char *argv[]) } keycount = argc - optind; + keyspecs = argv + optind; + + if (keycount == 1 && !strncmp(argv[optind], "__ENV__", 7)) { + char *singlespec = try_resolve_env(keyspecs[0]); + /* include '\0' in length */ + int len = strlen(singlespec) + 1; + char *p; + + for (p = singlespec; *p; p++) { + if (*(p + 1) == ' ') { + if (*p == '\\') { + memmove(p, p + 1, len - 1); + len--; + p++; + } else { + keycount += 1; + *(p + 1) = '\0'; + p += 2; + /* ignore subsequent spaces */ + while (*p == ' ') { + memmove(p, p + 1, len - 1); + len--; + p++; + } + } + } + } + + keyspecs = calloc(sizeof(char *), keycount + 1); + keyspecs[0] = singlespec; + p = singlespec; + + for (int i = 1; i < keycount; i++) { + while (*p) + p++; + p++; + keyspecs[i] = p; + } + } + keylist = calloc(sizeof(struct keyinfo), keycount); for (i = 0; i < keycount; i++) { - const char *keyspec = try_resolve_env(argv[optind + i]); + const char *keyspec = try_resolve_env(keyspecs[i]); struct keyinfo *info = &keylist[i]; if (!keyspec) --- base-commit: 89ed19d5c673ad0ab1851ed62ece38d30e96b412 change-id: 20260206-keytoc-multi-env-4a3300292e4a Best regards, -- Jonas Rebmann <[email protected]>
