diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..7763f8fe --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,8 @@ +version: 2 +updates: + - package-ecosystem: "gitsubmodule" + directory: "/" + schedule: + interval: "daily" + commit-message: + prefix: "[ci]" diff --git a/.github/semgrep-rules.yml b/.github/semgrep-rules.yml index 8c63992d..8810e924 100644 --- a/.github/semgrep-rules.yml +++ b/.github/semgrep-rules.yml @@ -6,9 +6,10 @@ # # Style/maintainability is intentionally out of scope (owned by codespell, # Coverity, and the CodeQL security suite). These rules only enforce security -# invariants. The vendored lib/wolfSPDM/, src/spdm/ and src/fwtpm/ trees, the HAL platform -# drivers, and the swtpm socket transport carry their own platform libc usage -# and are excluded where noted. +# invariants. The lib/wolfssl/ and lib/wolfSPDM/ submodules are excluded from +# all rules. The src/spdm/ and src/fwtpm/ trees, HAL platform drivers, and swtpm +# socket transport carry their own platform libc usage and are excluded where +# noted. rules: - id: wolftpm-no-unbounded-libc @@ -24,7 +25,9 @@ rules: - src/ - hal/ - wolftpm/ - - lib/wolfSPDM/src/ + exclude: + - lib/wolfssl/ + - lib/wolfSPDM/ pattern-either: - pattern: gets(...) - pattern: strcpy(...) @@ -44,7 +47,9 @@ rules: - src/ - hal/ - wolftpm/ - - lib/wolfSPDM/src/ + exclude: + - lib/wolfssl/ + - lib/wolfSPDM/ pattern-either: - pattern: system(...) - pattern: popen(...) @@ -74,6 +79,7 @@ rules: - src/ exclude: - src/spdm/ + - lib/wolfssl/ - lib/wolfSPDM/ - src/fwtpm/ - src/tpm2_swtpm.c diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml index e0888b50..b36309b4 100644 --- a/.github/workflows/codespell.yml +++ b/.github/workflows/codespell.yml @@ -33,5 +33,5 @@ jobs: - name: Run codespell run: | codespell --count \ - --skip '.git,./IDE,./certs,./m4,*.der,*.pem,*prebuilt_bindings.rs' \ + --skip '.git,./lib,./IDE,./certs,./m4,*.der,*.pem,*prebuilt_bindings.rs' \ --ignore-words-list 'inh,inout,keypair,nd,parm,rcv,ser,loadIn,importIn,certifyIn,bu,fo,daa,pris,hsi,fram,hart,cna,challener' diff --git a/.github/workflows/wolfssl-submodule.yml b/.github/workflows/wolfssl-submodule.yml new file mode 100644 index 00000000..aae79b78 --- /dev/null +++ b/.github/workflows/wolfssl-submodule.yml @@ -0,0 +1,67 @@ +name: wolfSSL submodule build + +# Builds the pinned lib/wolfssl submodule with the documented flags and builds +# plus tests wolfTPM (plain and full SPDM) against it, so Dependabot pin bumps +# are gated on CI. The _resolve-wolfssl matrix still covers latest-stable and +# master. + +on: + push: + branches: [ master ] + pull_request: + branches: [ master ] + +permissions: + contents: read + +jobs: + pinned-build: + name: Build against the pinned wolfSSL submodule + runs-on: ubuntu-latest + timeout-minutes: 25 + steps: + - name: Harden Runner + uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df + with: + egress-policy: audit + + - name: Checkout wolfTPM with submodules + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 + with: + submodules: recursive + persist-credentials: false + + - name: Build and test the pinned submodule in Docker + env: + CI_IMAGE: ghcr.io/wolfssl/wolftpm-ci:v1.1 + run: | + docker run --rm --user "$(id -u):$(id -g)" \ + --env GIT_CONFIG_GLOBAL=/tmp/wolftpm-ci.gitconfig \ + --mount "type=bind,source=$GITHUB_WORKSPACE,target=/workspace" \ + --workdir /workspace "$CI_IMAGE" bash -euo pipefail -c ' + git config --global --add safe.directory /workspace + git config --global --add safe.directory /workspace/lib/wolfssl + prefix="$PWD/wolfssl-install" + ( + cd lib/wolfssl + ./autogen.sh + ./configure --enable-wolftpm --enable-pkcallbacks --enable-keygen \ + --enable-aescfb CFLAGS="-DWC_RSA_NO_PADDING" --prefix="$prefix" + make -j"$(nproc)" + make install + ) + export LD_LIBRARY_PATH="$prefix/lib" + export WOLFSSL_PATH="$PWD/lib/wolfssl" + ./autogen.sh + ./configure --with-wolfcrypt="$prefix" + make -j"$(nproc)" + make distclean + ./autogen.sh + ./configure --with-wolfcrypt="$prefix" \ + --enable-spdm --enable-fwtpm --enable-tcg --enable-psk \ + --enable-nuvoton --enable-nations --enable-debug --enable-swtpm + make -j"$(nproc)" + make check + ./examples/spdm/spdm_test.sh ./examples/spdm/spdm_ctrl fwtpm-tcg + ./examples/spdm/spdm_test.sh ./examples/spdm/spdm_ctrl fwtpm-psk + ' diff --git a/.gitmodules b/.gitmodules index c546ee1e..07cf2a61 100644 --- a/.gitmodules +++ b/.gitmodules @@ -3,3 +3,8 @@ url = https://github.com/wolfSSL/wolfSPDM.git branch = main ignore = dirty +[submodule "lib/wolfssl"] + path = lib/wolfssl + url = https://github.com/wolfSSL/wolfssl.git + branch = master + ignore = dirty diff --git a/README.md b/README.md index 008eab9b..0725bfd5 100644 --- a/README.md +++ b/README.md @@ -89,18 +89,28 @@ for build instructions, responder modes, and the end-to-end test scripts. ### wolfSSL +wolfTPM links against wolfSSL/wolfCrypt. wolfSSL is bundled as the `lib/wolfssl` +submodule at a known-good commit, so clone wolfTPM with `--recursive` (or run +`git submodule update --init lib/wolfssl`) and build it from there. **Build +wolfSSL with `--enable-wolftpm`**; it turns on the RSA, ECC, and crypto-callback +support wolfTPM relies on. wolfTPM's `configure` only link-checks +`wolfCrypt_Init`, so it will not flag a wolfSSL built without it, but the +runtime integration needs it. + +`autogen.sh` requires automake and libtool: `sudo apt-get install automake libtool`. + +#### Default build + ```bash -git clone https://github.com/wolfSSL/wolfssl.git -cd wolfssl +cd lib/wolfssl ./autogen.sh ./configure --enable-wolftpm make sudo make install sudo ldconfig +cd ../.. ``` -`autogen.sh` requires automake and libtool: `sudo apt-get install automake libtool`. - ### wolfTPM ```bash diff --git a/docs/README.md b/docs/README.md index 402494c7..20a64f64 100644 --- a/docs/README.md +++ b/docs/README.md @@ -53,25 +53,26 @@ The firmware TPM (fwTPM) server also implements v1.85 PQC — see [FWTPM.md](FWT ## Building wolfTPM -To build the wolfTPM library, it's required to first build and install the wolfSSL library. This can be downloaded from the download page, or through a "git clone" command, shown below: +To build the wolfTPM library, it's required to first build and install the wolfSSL library. wolfSSL is bundled as the `lib/wolfssl` submodule; clone wolfTPM with `--recursive` (or run `git submodule update --init lib/wolfssl`) and build it from there. ```sh -git clone https://github.com/wolfssl/wolfssl +git clone --recursive https://github.com/wolfSSL/wolfTPM.git +cd wolfTPM/lib/wolfssl ``` -Once the wolfSSL library has been downloaded, it needs to be built with the following options being passed to the configure script: +The wolfSSL library needs to be built with the following options being passed to the configure script: ```sh +./autogen.sh ./configure --enable-wolftpm && make && sudo make install +cd ../.. ``` Then the wolfSSL library just needs to be built and installed however the user prefers. -The next step is to download and install the wolfTPM library. At the time this documentation was written, the wolfTPM library does not have a stable release yet and needs to be cloned from GitHub. The following commands show how to clone and install wolfTPM: +The next step is to build the wolfTPM library from the same checkout (back at the wolfTPM root): ```sh -git clone https://github.com/wolfssl/wolftpm -cd wolftpm ./autogen.sh ./configure make diff --git a/docs/building.md b/docs/building.md index 3853795e..e1488b1f 100644 --- a/docs/building.md +++ b/docs/building.md @@ -4,16 +4,17 @@ wolfTPM is built on top of wolfSSL (wolfCrypt) and can be built with autotools, ## Building wolfSSL -wolfSSL must be built and installed first. It can be downloaded from the [downloads page](https://wolfssl.com/download/) or cloned from GitHub: +wolfSSL must be built and installed first. wolfSSL is bundled as the `lib/wolfssl` submodule at a known-good commit, so clone wolfTPM with `--recursive` (or run `git submodule update --init lib/wolfssl` in an existing checkout) and build wolfSSL from there: ```bash -git clone https://github.com/wolfSSL/wolfssl.git -cd wolfssl +git clone --recursive https://github.com/wolfSSL/wolfTPM.git +cd wolfTPM/lib/wolfssl ./autogen.sh ./configure --enable-wolftpm --enable-pkcallbacks --enable-keygen CFLAGS="-DWC_RSA_NO_PADDING" make sudo make install sudo ldconfig +cd ../.. ``` `autogen.sh` requires automake and libtool: `sudo apt-get install automake libtool`. @@ -27,7 +28,7 @@ The `--enable-wolftpm` option is equivalent to passing these options: ## Using an alternate wolfSSL directory -To build wolfTPM against a wolfSSL installed in a non-default location, install wolfSSL to a prefix and point wolfTPM at it with `--with-wolfcrypt`: +The bundled `lib/wolfssl` submodule is the default wolfSSL source. To build wolfTPM against a different wolfSSL, such as one from the [downloads page](https://wolfssl.com/download/) installed in a non-default location, install wolfSSL to a prefix and point wolfTPM at it with `--with-wolfcrypt`: ```bash # cd /your-wolfssl-repo @@ -43,11 +44,9 @@ make install ## Building with autotools -Once wolfSSL is installed, download wolfTPM from the [downloads page](https://wolfssl.com/download/) or clone it from GitHub, then build it: +Once wolfSSL is installed, build wolfTPM from the repository root: ```bash -git clone https://github.com/wolfSSL/wolfTPM.git -cd wolfTPM ./autogen.sh ./configure make diff --git a/docs/fwtpm/building.md b/docs/fwtpm/building.md index 1591b59d..ee2cefe5 100644 --- a/docs/fwtpm/building.md +++ b/docs/fwtpm/building.md @@ -4,13 +4,15 @@ This page covers how to build the fwTPM server, the configure options and compil ## Prerequisites -wolfSSL must be built with TPM support, keygen, and `WC_RSA_NO_PADDING`: +wolfSSL must be built with TPM support, keygen, and `WC_RSA_NO_PADDING`. wolfSSL is bundled as the `lib/wolfssl` submodule; clone wolfTPM with `--recursive` (or run `git submodule update --init lib/wolfssl`) and build it from there: ```sh -cd wolfssl +cd lib/wolfssl +./autogen.sh ./configure --enable-wolftpm --enable-pkcallbacks --enable-keygen CFLAGS="-DWC_RSA_NO_PADDING" make sudo make install +cd ../.. ``` ## Build the fwTPM Server @@ -18,7 +20,7 @@ sudo make install **Socket transport (SWTPM protocol, default for development):** ```sh -cd wolftpm +./autogen.sh ./configure --enable-fwtpm --enable-swtpm make ``` diff --git a/docs/getting-started.md b/docs/getting-started.md index 814ce639..40896a10 100644 --- a/docs/getting-started.md +++ b/docs/getting-started.md @@ -4,16 +4,17 @@ wolfTPM is a portable TPM 2.0 library with a native API, a wrapper API, and a se ## Prerequisites and building wolfSSL -wolfTPM needs wolfSSL (wolfCrypt) built with the wolfTPM options. Build and install wolfSSL first: +wolfTPM needs wolfSSL (wolfCrypt) built with the wolfTPM options. wolfSSL is bundled as the `lib/wolfssl` submodule, so clone wolfTPM with `--recursive` and build and install wolfSSL from there first: ```bash -git clone https://github.com/wolfSSL/wolfssl.git -cd wolfssl +git clone --recursive https://github.com/wolfSSL/wolfTPM.git +cd wolfTPM/lib/wolfssl ./autogen.sh ./configure --enable-wolftpm --enable-pkcallbacks --enable-keygen CFLAGS="-DWC_RSA_NO_PADDING" make sudo make install sudo ldconfig +cd ../.. ``` `autogen.sh` requires automake and libtool: `sudo apt-get install automake libtool`. @@ -23,8 +24,6 @@ See [Building wolfTPM](building.md) for using a wolfSSL installed in a different ## Build wolfTPM ```bash -git clone https://github.com/wolfSSL/wolfTPM.git -cd wolfTPM ./autogen.sh ./configure make diff --git a/docs/ja/building.md b/docs/ja/building.md index 12fa3862..abd079a9 100644 --- a/docs/ja/building.md +++ b/docs/ja/building.md @@ -4,16 +4,17 @@ wolfTPM は wolfSSL (wolfCrypt) の上に構築されており、autotools、CMa ## wolfSSL のビルド -最初に wolfSSL をビルドしてインストールする必要があります。wolfSSL は[ダウンロードページ](https://wolfssl.com/download/)から入手するか、GitHub からクローンできます。 +最初に wolfSSL をビルドしてインストールする必要があります。wolfSSL は動作確認済みのコミットで `lib/wolfssl` サブモジュールとして同梱されているため、wolfTPM を `--recursive` 付きでクローンし (既存のチェックアウトでは `git submodule update --init lib/wolfssl` を実行し)、そこから wolfSSL をビルドします。 ```bash -git clone https://github.com/wolfSSL/wolfssl.git -cd wolfssl +git clone --recursive https://github.com/wolfSSL/wolfTPM.git +cd wolfTPM/lib/wolfssl ./autogen.sh ./configure --enable-wolftpm --enable-pkcallbacks --enable-keygen CFLAGS="-DWC_RSA_NO_PADDING" make sudo make install sudo ldconfig +cd ../.. ``` `autogen.sh` には automake と libtool が必要です: `sudo apt-get install automake libtool`。 @@ -27,7 +28,7 @@ sudo ldconfig ## 別の wolfSSL ディレクトリを使用する -既定以外の場所にインストールした wolfSSL に対して wolfTPM をビルドするには、wolfSSL を任意のプレフィックスにインストールし、`--with-wolfcrypt` で wolfTPM にその場所を指定します。 +同梱の `lib/wolfssl` サブモジュールが既定の wolfSSL ソースです。[ダウンロードページ](https://wolfssl.com/download/)から入手した wolfSSL など、既定以外の場所にインストールした別の wolfSSL に対して wolfTPM をビルドするには、wolfSSL を任意のプレフィックスにインストールし、`--with-wolfcrypt` で wolfTPM にその場所を指定します。 ```bash # cd /your-wolfssl-repo @@ -43,11 +44,9 @@ make install ## autotools でのビルド -wolfSSL をインストールしたら、[ダウンロードページ](https://wolfssl.com/download/)から wolfTPM を入手するか GitHub からクローンして、ビルドします。 +wolfSSL をインストールしたら、リポジトリのルートで wolfTPM をビルドします。 ```bash -git clone https://github.com/wolfSSL/wolfTPM.git -cd wolfTPM ./autogen.sh ./configure make diff --git a/docs/ja/fwtpm/building.md b/docs/ja/fwtpm/building.md index 148f2274..db8d7cb1 100644 --- a/docs/ja/fwtpm/building.md +++ b/docs/ja/fwtpm/building.md @@ -4,13 +4,15 @@ ## 前提条件 -wolfSSL は、TPM サポート、keygen、および `WC_RSA_NO_PADDING` を有効にしてビルドする必要があります。 +wolfSSL は、TPM サポート、keygen、および `WC_RSA_NO_PADDING` を有効にしてビルドする必要があります。wolfSSL は `lib/wolfssl` サブモジュールとして同梱されています。wolfTPM を `--recursive` 付きでクローンし (または `git submodule update --init lib/wolfssl` を実行し)、そこからビルドします。 ```sh -cd wolfssl +cd lib/wolfssl +./autogen.sh ./configure --enable-wolftpm --enable-pkcallbacks --enable-keygen CFLAGS="-DWC_RSA_NO_PADDING" make sudo make install +cd ../.. ``` ## fwTPM サーバーのビルド @@ -18,7 +20,7 @@ sudo make install **ソケットトランスポート (SWTPM プロトコル、開発向けの既定):** ```sh -cd wolftpm +./autogen.sh ./configure --enable-fwtpm --enable-swtpm make ``` diff --git a/docs/ja/getting-started.md b/docs/ja/getting-started.md index 86238740..edbfde63 100644 --- a/docs/ja/getting-started.md +++ b/docs/ja/getting-started.md @@ -4,16 +4,17 @@ wolfTPM は、ネイティブ API、ラッパー API、およびビルド成功 ## 前提条件と wolfSSL のビルド -wolfTPM には、wolfTPM 用オプションを有効にしてビルドした wolfSSL (wolfCrypt) が必要です。最初に wolfSSL をビルドしてインストールします。 +wolfTPM には、wolfTPM 用オプションを有効にしてビルドした wolfSSL (wolfCrypt) が必要です。wolfSSL は `lib/wolfssl` サブモジュールとして同梱されているため、wolfTPM を `--recursive` 付きでクローンし、最初にそこから wolfSSL をビルドしてインストールします。 ```bash -git clone https://github.com/wolfSSL/wolfssl.git -cd wolfssl +git clone --recursive https://github.com/wolfSSL/wolfTPM.git +cd wolfTPM/lib/wolfssl ./autogen.sh ./configure --enable-wolftpm --enable-pkcallbacks --enable-keygen CFLAGS="-DWC_RSA_NO_PADDING" make sudo make install sudo ldconfig +cd ../.. ``` `autogen.sh` には automake と libtool が必要です: `sudo apt-get install automake libtool`。 @@ -23,8 +24,6 @@ sudo ldconfig ## wolfTPM のビルド ```bash -git clone https://github.com/wolfSSL/wolfTPM.git -cd wolfTPM ./autogen.sh ./configure make diff --git a/docs/ja/system-interfaces.md b/docs/ja/system-interfaces.md index 8b806bd6..1c8ad94a 100644 --- a/docs/ja/system-interfaces.md +++ b/docs/ja/system-interfaces.md @@ -225,17 +225,18 @@ QEMU のターミナルで、wolfTPM をチェックアウトしてビルドし ```sh sudo apt install automake libtool gcc git make -# get and build wolfSSL -git clone https://github.com/wolfssl/wolfssl.git -pushd wolfssl +# get wolfTPM (wolfSSL is bundled as the lib/wolfssl submodule) +git clone --recursive https://github.com/wolfSSL/wolfTPM.git +pushd wolfTPM + +# build wolfSSL from the submodule +pushd lib/wolfssl ./autogen.sh && \ - ./configure --enable-wolftpm --disable-examples --prefix=$PWD/../inst && \ + ./configure --enable-wolftpm --disable-examples --prefix=$PWD/../../../inst && \ make install popd -# get and build wolfTPM -git clone https://github.com/wolfssl/wolftpm.git -pushd wolftpm +# build wolfTPM ./autogen.sh && \ ./configure --enable-devtpm --prefix=$PWD/../inst --enable-debug && \ make install @@ -452,18 +453,18 @@ Unknown SecurityDevices Trusted Platform Module 2.0 ### MSYS2 でのビルド -MSYS2 を使用してテストしました。 +MSYS2 を使用してテストしました。wolfSSL は `lib/wolfssl` サブモジュールとして同梱されています。wolfTPM を `--recursive` 付きでクローンし (または `git submodule update --init lib/wolfssl` を実行し)、そこからビルドします。 ```bash export PREFIX=$PWD/tmp_install -cd wolfssl +cd lib/wolfssl ./autogen.sh ./configure --prefix="$PREFIX" --enable-wolftpm make make install -cd wolftpm/ +cd ../.. ./autogen.sh ./configure --prefix="$PREFIX" --enable-winapi make @@ -493,17 +494,16 @@ export PREFIX=$PWD/tmp_install export CFLAGS="-DWIN32 -DMINGW -D_WIN32_WINNT=0x0600 -DUSE_WOLF_STRTOK" export LIBS="-lws2_32" -cd wolfssl +cd lib/wolfssl ./autogen.sh ./configure --host=i686 CC=i686-w64-mingw32-gcc --prefix="$PREFIX" --enable-wolftpm make make install -cd ../wolftpm/ +cd ../.. ./autogen.sh ./configure --host=i686 CC=i686-w64-mingw32-gcc --prefix="$PREFIX" --enable-winapi make -cd .. ``` ### Windows での実行 diff --git a/docs/system-interfaces.md b/docs/system-interfaces.md index 1b1a78fe..b1f5e566 100644 --- a/docs/system-interfaces.md +++ b/docs/system-interfaces.md @@ -225,17 +225,18 @@ In the QEMU terminal, check out and build wolfTPM: ```sh sudo apt install automake libtool gcc git make -# get and build wolfSSL -git clone https://github.com/wolfssl/wolfssl.git -pushd wolfssl +# get wolfTPM (wolfSSL is bundled as the lib/wolfssl submodule) +git clone --recursive https://github.com/wolfSSL/wolfTPM.git +pushd wolfTPM + +# build wolfSSL from the submodule +pushd lib/wolfssl ./autogen.sh && \ - ./configure --enable-wolftpm --disable-examples --prefix=$PWD/../inst && \ + ./configure --enable-wolftpm --disable-examples --prefix=$PWD/../../../inst && \ make install popd -# get and build wolfTPM -git clone https://github.com/wolfssl/wolftpm.git -pushd wolftpm +# build wolfTPM ./autogen.sh && \ ./configure --enable-devtpm --prefix=$PWD/../inst --enable-debug && \ make install @@ -452,18 +453,18 @@ Unknown SecurityDevices Trusted Platform Module 2.0 ### Building in MSYS2 -Tested using MSYS2: +Tested using MSYS2. wolfSSL is bundled as the `lib/wolfssl` submodule; clone wolfTPM with `--recursive` (or run `git submodule update --init lib/wolfssl`) and build it from there: ```bash export PREFIX=$PWD/tmp_install -cd wolfssl +cd lib/wolfssl ./autogen.sh ./configure --prefix="$PREFIX" --enable-wolftpm make make install -cd wolftpm/ +cd ../.. ./autogen.sh ./configure --prefix="$PREFIX" --enable-winapi make @@ -493,17 +494,16 @@ export PREFIX=$PWD/tmp_install export CFLAGS="-DWIN32 -DMINGW -D_WIN32_WINNT=0x0600 -DUSE_WOLF_STRTOK" export LIBS="-lws2_32" -cd wolfssl +cd lib/wolfssl ./autogen.sh ./configure --host=i686 CC=i686-w64-mingw32-gcc --prefix="$PREFIX" --enable-wolftpm make make install -cd ../wolftpm/ +cd ../.. ./autogen.sh ./configure --host=i686 CC=i686-w64-mingw32-gcc --prefix="$PREFIX" --enable-winapi make -cd .. ``` ### Running on Windows diff --git a/examples/pqc/README.md b/examples/pqc/README.md index 77381452..a276ac76 100644 --- a/examples/pqc/README.md +++ b/examples/pqc/README.md @@ -12,14 +12,21 @@ fwTPM PQC reference. ## Building -**wolfSSL** (ML-DSA and ML-KEM in wolfCrypt): +**wolfSSL** (ML-DSA and ML-KEM in wolfCrypt). wolfSSL is bundled as the +`lib/wolfssl` submodule; clone wolfTPM with `--recursive` (or run `git submodule +update --init lib/wolfssl`) and build it from there. ML-DSA and ML-KEM require +**wolfSSL >= v5.9.2-stable** (the release with the `wc_MlDsaKey` and +`wc_MlKemKey` context APIs): ``` +cd lib/wolfssl +./autogen.sh ./configure --enable-wolftpm --enable-mldsa --enable-mlkem \ --enable-tls-mlkem-standalone \ --enable-harden --enable-keygen --enable-certgen make sudo make install +cd ../.. ``` `--enable-tls-mlkem-standalone` is required for the standalone `ML_KEM_*` TLS diff --git a/examples/spdm/README.md b/examples/spdm/README.md index 36915a34..d924cce7 100644 --- a/examples/spdm/README.md +++ b/examples/spdm/README.md @@ -25,19 +25,19 @@ see the [wolfSPDM](https://github.com/aidangarske/wolfSPDM) standalone library. ### Prerequisites -wolfSSL with crypto algorithms required for SPDM Algorithm Set B: +wolfSSL with crypto algorithms required for SPDM Algorithm Set B. wolfSSL is bundled as the `lib/wolfssl` submodule; clone wolfTPM with `--recursive` (or run `git submodule update --init lib/wolfssl`) and build it from there. ```bash -cd wolfssl +cd lib/wolfssl ./autogen.sh ./configure --enable-wolftpm --enable-ecc --enable-sha384 --enable-aesgcm --enable-hkdf --enable-sp make && sudo make install && sudo ldconfig +cd ../.. ``` ### wolfTPM with Nuvoton SPDM ```bash -cd wolfTPM ./autogen.sh ./configure --enable-spdm --enable-nuvoton make @@ -46,7 +46,6 @@ make ### wolfTPM with Nations SPDM ```bash -cd wolfTPM ./autogen.sh ./configure --enable-spdm --enable-nations make diff --git a/lib/wolfssl b/lib/wolfssl new file mode 160000 index 00000000..fce5e879 --- /dev/null +++ b/lib/wolfssl @@ -0,0 +1 @@ +Subproject commit fce5e879d5a0d589d5bba6e6140d13cc2e10ccf6 diff --git a/src/spdm/README.md b/src/spdm/README.md index e83d4a96..6361eeaa 100644 --- a/src/spdm/README.md +++ b/src/spdm/README.md @@ -28,22 +28,21 @@ and full MCTP for spdm-emu testing. ### Get the source ```bash -# SPDM lives in the lib/wolfSPDM submodule, so clone wolfTPM recursively +# SPDM and wolfSSL live in the lib/ submodules, so clone wolfTPM recursively git clone --recursive https://github.com/wolfSSL/wolfTPM.git -git clone https://github.com/wolfSSL/wolfssl.git # sibling checkout cd wolfTPM ``` Already cloned without `--recursive`? Run `git submodule update --init -lib/wolfSPDM` once inside the checkout. +lib/wolfSPDM lib/wolfssl` once inside the checkout. ### Nuvoton NPCT75x ```bash -# Build wolfSSL (in the sibling checkout, then return here) -cd ../wolfssl && ./autogen.sh && \ +# Build wolfSSL (bundled lib/wolfssl submodule, then return here) +cd lib/wolfssl && ./autogen.sh && \ ./configure --enable-wolftpm --enable-ecc --enable-sha384 --enable-aesgcm --enable-hkdf --enable-sp && \ -make && sudo make install && sudo ldconfig && cd - +make && sudo make install && sudo ldconfig && cd ../.. # Build wolfTPM (submodule already present from the recursive clone) ./autogen.sh && ./configure --enable-spdm --enable-nuvoton && make @@ -60,10 +59,10 @@ full instructions. ### Nations NS350 ```bash -# Build wolfSSL (in the sibling checkout, then return here) -cd ../wolfssl && ./autogen.sh && \ +# Build wolfSSL (bundled lib/wolfssl submodule, then return here) +cd lib/wolfssl && ./autogen.sh && \ ./configure --enable-wolftpm --enable-ecc --enable-sha384 --enable-aesgcm --enable-hkdf --enable-sp && \ -make && sudo make install && sudo ldconfig && cd - +make && sudo make install && sudo ldconfig && cd ../.. # Build wolfTPM (submodule already present from the recursive clone) ./autogen.sh && ./configure --enable-spdm --enable-nations && make @@ -182,26 +181,27 @@ SPDM is built from the `lib/wolfSPDM` submodule, so clone wolfTPM recursively: ```bash git clone --recursive https://github.com/wolfSSL/wolfTPM.git -git clone https://github.com/wolfSSL/wolfssl.git # sibling checkout for wolfSSL cd wolfTPM ``` -Already cloned wolfTPM without `--recursive`? Pull the submodule in: +Already cloned wolfTPM without `--recursive`? Pull the submodules in: ```bash -git submodule update --init lib/wolfSPDM +git submodule update --init lib/wolfSPDM lib/wolfssl ``` ### 2. wolfSSL +wolfSSL is bundled as the `lib/wolfssl` submodule; clone wolfTPM with `--recursive` (or run `git submodule update --init lib/wolfssl`) and build it from there. + ```bash -cd ../wolfssl +cd lib/wolfssl ./autogen.sh ./configure --enable-wolftpm --enable-ecc --enable-sha384 \ --enable-aesgcm --enable-hkdf --enable-sp make sudo make install && sudo ldconfig -cd - # back to the wolfTPM checkout +cd ../.. # back to the wolfTPM checkout ``` Both Nuvoton and Nations use the same wolfSSL flags above.