[PATCH scute] Build a second library which uses the signing key.

[Damien Goutte-Gattat]

On 05/20/2018 12:06 AM, Dirk Gottschalk wrote:
> I tried to make the name of the library file conditional, but
> autotools don't like this

Indeed, I don't think there is support for this in Autotools.


> I don't like the idea of renaming the libraries after
> installation [...] Renaming the files could increase the risk
> of mistakes made by user.

Another drawback of asking the user to do the renaming is that
each user may choose a different name, which may complicate
support.

I think I like your original approach better. I refactored the
src/Makefile.am part to avoid code duplication. Now I just want
to do some more testing before applying to master.

-- >8 --
Subject: [PATCH scute] Allow to use the signing key.

* configure.ac: New flag --enable-signing-key.
* src/Makefile.am: Build scutesig, which uses the signing key.
* src/slots.c (slot_init): Use the signing key if building scutesig.
(session_sign): Likewise.
--

This patch allows to build scutesig.so, a version of Scute which
uses the signing key, along with the normal scute.so which uses
the authentication key.

Suggested-by: Dirk Gottschalk <dirk.gottschalk1980 at googlemail.com>
Signed-off-by: Damien Goutte-Gattat <dgouttegattat at incenp.org>
---
 configure.ac    |  5 +++++
 src/Makefile.am |  9 +++++++++
 src/slots.c     | 11 +++++++++++
 3 files changed, 25 insertions(+)

diff --git a/configure.ac b/configure.ac
index 3615a49..8c8f1b1 100644
--- a/configure.ac
+++ b/configure.ac
@@ -313,6 +313,11 @@ else
 fi
 AM_CONDITIONAL(HAVE_GPGSM, test "$GPGSM" != "no")
 
+# Use signing key?
+AC_ARG_ENABLE([signing-key],
+              AS_HELP_STRING([--enable-signing-key],
+                             [Build a version of Scute using the signing key]))
+AM_CONDITIONAL([ENABLE_SCUTESIG], [test "$enable_signing_key" = yes])
 
 dnl Check for GPGSM version requirement.
 GPGSM_VERSION=unknown
diff --git a/src/Makefile.am b/src/Makefile.am
index 9ceef93..8063ab9 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -133,3 +133,12 @@ scute_la_LIBADD = $(scute_libadd) \
 scute_la_CPPFLAGS = -I$(srcdir)/../include \
 	@LIBASSUAN_CFLAGS@ @GPG_ERROR_CFLAGS@
 scute_la_SOURCES = $(sources)
+
+if ENABLE_SCUTESIG
+lib_LTLIBRARIES += scutesig.la
+scutesig_la_LDFLAGS = $(scute_la_LDFLAGS)
+scutesig_la_DEPENDENCIES = $(scute_la_DEPENDENCIES)
+scutesig_la_LIBADD = $(scute_la_LIBADD)
+scutesig_la_CPPFLAGS = $(scute_la_CPPFLAGS) -DENABLE_SIGNING_KEY
+scutesig_la_SOURCES = $(scute_la_SOURCES)
+endif
diff --git a/src/slots.c b/src/slots.c
index fc69d15..f414331 100644
--- a/src/slots.c
+++ b/src/slots.c
@@ -385,7 +385,12 @@ slot_init (slot_iterator_t id)
   gpg_error_t err = 0;
   struct slot *slot = scute_table_data (slots, id);
 
+#if ENABLE_SIGNING_KEY
+  err = scute_gpgsm_get_cert (slot->info.grip1, 1, add_object, slot);
+#else
   err = scute_gpgsm_get_cert (slot->info.grip3, 3, add_object, slot);
+#endif
+
   if (err)
     goto init_out;
 
@@ -1033,8 +1038,14 @@ session_sign (slot_iterator_t id, session_iterator_t sid,
     }
 
   sig_len = *pulSignatureLen;
+#if ENABLE_SIGNING_KEY
+  err = scute_agent_sign (slot->info.grip1, pData, ulDataLen,
+			  pSignature, &sig_len);
+#else
   err = scute_agent_sign (slot->info.grip3, pData, ulDataLen,
 			  pSignature, &sig_len);
+#endif
+
   /* FIXME: Oh well.  */
   if (gpg_err_code (err) == GPG_ERR_INV_ARG)
     return CKR_BUFFER_TOO_SMALL;
-- 
2.14.1


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: not available
URL: <https://lists.gnupg.org/pipermail/gnupg-devel/attachments/20180520/6f7c8c62/attachment.sig>