Claude
3bd81097e1
The header scan (Captain Bob, 2026-11-10): 788 source files -- 351 with the
SL-1.0 header, 12 with the old name (docs/working/experiments, kept by
ruling), 31 under someone else's licence (tools/kconfig, Linux's, GPL-2.0:
kept), and 394 with none. Ruled: the SPDX form; capsules (.4th, .f18) and
proofs (.thy) left for a ruling of their own (mkcapsule's 64x16 block format,
content-addressed capsules).
253 files now begin
SPDX-License-Identifier: LicenseRef-Starship-1.0
Copyright (c) 2023-2026 Robert A. James
as a /* */ block (C, headers, assembly, linker scripts) or # lines (scripts,
Makefiles, Kconfig; below a shebang or a coding line); tools/mkcapsule.c,
which had the copyright line, gets the SPDX line only.
Not touched: docs/working/ (archive and old campaign material, as the
ruling kept the experiments); v4/system/post_cases.c (generated by
v4/tools/mkpost.py, "do not edit" -- the generator has the header).
Comments only: the kernel builds on amd64, aarch64, riscv64; make -C v4
test-32: 39 programs, 0 failures; every changed script parses.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2
62 lines
2.8 KiB
C
62 lines
2.8 KiB
C
/* SPDX-License-Identifier: LicenseRef-Starship-1.0
|
|
* Copyright (c) 2023-2026 Robert A. James
|
|
*/
|
|
/*
|
|
* capsule_sig.h -- per-capsule Ed25519 signature verification
|
|
* (Milestone 6, Phase 8). Deliberately kept separate from
|
|
* capsule_validate.c: that function is already tested and its
|
|
* signature/behavior stays untouched; this is a new, additive check
|
|
* called alongside it, not folded into it.
|
|
*
|
|
* Enforced ONLY on CAPSULE_SIG_INVALID (2026-08-26, after landing
|
|
* WARN-only and proving correct on all three architectures against both
|
|
* a valid and a deliberately-corrupted capsule -- see FABRIC-2.md's
|
|
* Milestone 6 writeup). CAPSULE_SIG_MISSING and CAPSULE_SIG_NO_ROOT_KEY
|
|
* stay WARN-only, deliberately: MISSING is the normal state on every
|
|
* machine without access to the offline signing key (CI, any other
|
|
* checkout) -- refusing on it would brick boot everywhere but the one
|
|
* machine that minted the key, not catch anything real. Only INVALID
|
|
* (a signature that IS present but does not verify) is unambiguous
|
|
* tampering/corruption evidence, safe to refuse on regardless of who's
|
|
* building.
|
|
*/
|
|
#ifndef STARKERNEL_CAPSULE_SIG_H
|
|
#define STARKERNEL_CAPSULE_SIG_H
|
|
|
|
#include "starkernel/capsule.h"
|
|
|
|
/* The certificate whose key the capsules are signed with: "StarshipOS
|
|
* Capsule Signing", issued by the StarshipOS Root CA (ci/pki/make-ca.sh;
|
|
* FABRIC-3.md XLVI), replacing the snakeoil intermediate of Milestone 6.
|
|
* mkcapsule refuses to sign with a key that is not this certificate's. */
|
|
#define CAPSULE_SIGNING_CERT_NAME "pki:starshipos-intermediate.der"
|
|
|
|
typedef enum {
|
|
CAPSULE_SIG_OK = 0, /* has_sig=1, and it verifies */
|
|
CAPSULE_SIG_MISSING, /* has_sig=0 -- not signed at all */
|
|
CAPSULE_SIG_INVALID, /* has_sig=1 but verification failed */
|
|
CAPSULE_SIG_NO_ROOT_KEY, /* couldn't find/parse the embedded intermediate cert */
|
|
} CapsuleSigResult;
|
|
|
|
/*
|
|
* Verify capsule descs[index]'s Ed25519 signature against the embedded
|
|
* capsule-signing certificate's public key (CAPSULE_SIGNING_CERT_NAME,
|
|
* found and parsed once, cached for every later call this boot -- the
|
|
* cert doesn't change mid-boot).
|
|
*
|
|
* descs/names/sigs must be the same three parallel arrays
|
|
* (capsule_get_descriptors()/capsule_get_names()/capsule_get_signatures()),
|
|
* desc_count their shared length, arena_base the payload arena
|
|
* (capsule_get_arena()). index must be < desc_count.
|
|
*/
|
|
CapsuleSigResult capsule_verify_signature(
|
|
const CapsuleDesc *descs, const CapsuleNameEntry *names,
|
|
const CapsuleSigEntry *sigs, const uint8_t *arena_base,
|
|
uint32_t desc_count, int index);
|
|
|
|
/* Human-readable string for logging, mirroring
|
|
* capsule_validate_result_str()'s existing shape. */
|
|
const char *capsule_sig_result_str(CapsuleSigResult result);
|
|
|
|
#endif /* STARKERNEL_CAPSULE_SIG_H */
|