Make key generation generic

Let's put generated keys in mkosi.key and mkosi.crt, and remove the
secure boot nomenclature from the key generation options. This allows
us to reuse the keys for other signing operations as well.

diff --git a/.gitignore b/.gitignore
index 9824131b077b56838578c5e9db5022eb0c99e1bd..c6983c40e9ffa89a9e14d9b0b8dc266fc8469e35 100644 (file)
--- a/.gitignore
+++ b/.gitignore
@@ -16,6 +16,6 @@
 /mkosi.nspawn
 /mkosi.rootpw
 /mkosi.conf
-/mkosi.secure-boot.key
-/mkosi.secure-boot.crt
+/mkosi.key
+/mkosi.crt
 __pycache__

diff --git a/mkosi.md b/mkosi.md
index 919d1f399fa6082a52dcb3a719f2bc06743f8eff..520276ca62a0297c2b5e268a553ac3f75837e60f 100644 (file)
--- a/mkosi.md
+++ b/mkosi.md
@@ -990,16 +990,15 @@ Those settings cannot be configured in the configuration files.
 
 : Show brief usage information.
 
-`--secure-boot-common-name=`
+`--genkey-common-name=`
 
-: Common name to be used when generating SecureBoot keys via mkosi's `genkey`
-  command. Defaults to `mkosi of %u`, where `%u` expands to the username of the
-  user invoking mkosi.
+: Common name to be used when generating keys via mkosi's `genkey` command. Defaults to `mkosi of %u`, where
+  `%u` expands to the username of the user invoking mkosi.
 
-`--secure-boot-valid-days=`
+`--genkey-valid-days=`
 
-: Number of days that the keys should remain valid when generating SecureBoot
-  keys via mkosi's `genkey` command. Defaults to two years (730 days).
+: Number of days that the keys should remain valid when generating keys via mkosi's `genkey` command.
+  Defaults to two years (730 days).
 
 `--auto-bump=`, `-B`
 
@@ -1169,11 +1168,8 @@ local directory:
   file does not exist and encryption is requested, the user is queried
   instead.
 
-* The **`mkosi.secure-boot.crt`** and **`mkosi.secure-boot.key`**
-  files contain an X.509 certificate and PEM private key to use when
-  UEFI SecureBoot support is enabled. All EFI binaries included in the
-  image's ESP are signed with this key, as a late step in the build
-  process.
+* The **`mkosi.crt`** and **`mkosi.key`** files contain an X.509 certificate and PEM private key to use when
+  signing is required (UEFI SecureBoot, verity, ...).
 
 * The **`mkosi.output/`** directory will be used for all build
   artifacts, if the image output path is not configured (i.e. no

diff --git a/mkosi/__init__.py b/mkosi/__init__.py
index 2a8b640c2da76c7305f0599f70734cf568971f6f..032ca105448c91f37ffc22cadbd8ffc1f82d92e2 100644 (file)
--- a/mkosi/__init__.py
+++ b/mkosi/__init__.py
@@ -2122,24 +2122,23 @@ def run_serve(config: MkosiConfig) -> None:
         httpd.serve_forever()
 
 
-def generate_secure_boot_key(args: MkosiArgs) -> None:
-    """Generate secure boot keys using openssl"""
+def generate_key_cert_pair(args: MkosiArgs) -> None:
+    """Generate a private key and accompanying X509 certificate using openssl"""
 
     keylength = 2048
-    expiration_date = datetime.date.today() + datetime.timedelta(int(args.secure_boot_valid_days))
-    cn = expand_specifier(args.secure_boot_common_name)
+    expiration_date = datetime.date.today() + datetime.timedelta(int(args.genkey_valid_days))
+    cn = expand_specifier(args.genkey_common_name)
 
-    for f in ("mkosi.secure-boot.key", "mkosi.secure-boot.crt"):
+    for f in ("mkosi.key", "mkosi.crt"):
         if Path(f).exists() and not args.force:
             die(f"{f} already exists",
-                hint=("To generate new secure boot keys, "
-                      "first remove mkosi.secure-boot.key and mkosi.secure-boot.crt"))
+                hint=("To generate new keys, first remove mkosi.key and mkosi.crt"))
 
-    log_step(f"Generating secure boot keys rsa:{keylength} for CN {cn!r}.")
+    log_step(f"Generating keys rsa:{keylength} for CN {cn!r}.")
     logging.info(
         dedent(
             f"""
-            The keys will expire in {args.secure_boot_valid_days} days ({expiration_date:%A %d. %B %Y}).
+            The keys will expire in {args.genkey_valid_days} days ({expiration_date:%A %d. %B %Y}).
             Remember to roll them over to new ones before then.
             """
         )
@@ -2150,9 +2149,9 @@ def generate_secure_boot_key(args: MkosiArgs) -> None:
         "-new",
         "-x509",
         "-newkey", f"rsa:{keylength}",
-        "-keyout", "mkosi.secure-boot.key",
-        "-out", "mkosi.secure-boot.crt",
-        "-days", str(args.secure_boot_valid_days),
+        "-keyout", "mkosi.key",
+        "-out", "mkosi.crt",
+        "-days", str(args.genkey_valid_days),
         "-subj", f"/CN={cn}/",
         "-nodes",
     ]
@@ -2195,7 +2194,7 @@ def run_verb(args: MkosiArgs, presets: Sequence[MkosiConfig]) -> None:
         check_root()
 
     if args.verb == Verb.genkey:
-        return generate_secure_boot_key(args)
+        return generate_key_cert_pair(args)
 
     if args.verb == Verb.bump:
         return bump_image_version()

diff --git a/mkosi/config.py b/mkosi/config.py
index 5fa4cb8af3d4d6109145d4b327f19fd25915cbb5..a4549e7fff69510f8e5dc00e9b47b1357c0d6b94 100644 (file)
--- a/mkosi/config.py
+++ b/mkosi/config.py
@@ -536,8 +536,8 @@ class MkosiArgs:
     debug: bool
     debug_shell: bool
     pager: bool
-    secure_boot_valid_days: str
-    secure_boot_common_name: str
+    genkey_valid_days: str
+    genkey_common_name: str
     auto_bump: bool
     presets: list[str]
 
@@ -830,13 +830,13 @@ class MkosiConfigParser:
             dest="secure_boot_key",
             section="Output",
             parse=config_make_path_parser(required=False),
-            paths=("mkosi.secure-boot.key",),
+            paths=("mkosi.key",),
         ),
         MkosiConfigSetting(
             dest="secure_boot_certificate",
             section="Output",
             parse=config_make_path_parser(required=False),
-            paths=("mkosi.secure-boot.crt",),
+            paths=("mkosi.crt",),
         ),
         MkosiConfigSetting(
             dest="sign_expected_pcr",
@@ -1319,16 +1319,16 @@ class MkosiConfigParser:
             help="Enable paging for long output",
         )
         parser.add_argument(
-            "--secure-boot-valid-days",
+            "--genkey-valid-days",
             metavar="DAYS",
-            help="Number of days UEFI SecureBoot keys should be valid when generating keys",
+            help="Number of days keys should be valid when generating keys",
             action=action,
             default="730",
         )
         parser.add_argument(
-            "--secure-boot-common-name",
+            "--genkey-common-name",
             metavar="CN",
-            help="Template for the UEFI SecureBoot CN when generating keys",
+            help="Template for the CN when generating keys",
             action=action,
             default="mkosi of %u",
         )
@@ -2129,11 +2129,11 @@ def load_config(args: argparse.Namespace) -> MkosiConfig:
     if args.secure_boot and args.verb != Verb.genkey:
         if args.secure_boot_key is None:
             die("UEFI SecureBoot enabled, but couldn't find private key.",
-                hint="Consider placing it in mkosi.secure-boot.key")
+                hint="Consider placing it in mkosi.key")
 
         if args.secure_boot_certificate is None:
             die("UEFI SecureBoot enabled, but couldn't find certificate.",
-                hint="Consider placing it in mkosi.secure-boot.crt")
+                hint="Consider placing it in mkosi.crt")
 
     if args.sign_expected_pcr is True and not shutil.which("systemd-measure"):
         die("Couldn't find systemd-measure needed for the --sign-expected-pcr option.")