Move trusted root cert configuration to cmake and cleanup #440
Conversation
Signed-off-by: Bruno Vavala <bruno.vavala@intel.com>
| ; | ||
| #ifdef __cplusplus | ||
| } | ||
| #endif |
There was a problem hiding this comment.
i still dont understand why this is necessary.
you can build the file in the cmake completely without using a template.
common/crypto/CMakeLists.txt
Outdated
| ) | ||
| CONFIGURE_FILE( | ||
| ${CMAKE_CURRENT_SOURCE_DIR}/verify_ias_report/ias-certificates.h.in | ||
| ${IAS_CERTIFICATES_H_PATH} |
There was a problem hiding this comment.
i suggest you add a custom command to the clean target to remove these
There was a problem hiding this comment.
one more... it might also be useful to turn on "show progress" for this file
There was a problem hiding this comment.
i suggest you add a custom command to the clean target to remove these
We could, but we would end up in a situation where cmake generates the artifacts and make cleans them up.
In that case, it's probably better to keep the script for fetching/generating these artifacts, which is called by make.
Keeping these artifacts in the build folder may still make sense considering that:
- the certificate is valid until 2049 and
- the header is rebuilt (by cmake!) when the source changes.
There was a problem hiding this comment.
one more... it might also be useful to turn on "show progress" for this file
done
Signed-off-by: Bruno Vavala <bruno.vavala@intel.com>
Signed-off-by: Bruno Vavala <bruno.vavala@intel.com>
bvavala
force-pushed
the
bruno.230505.fix-ias-certs
branch
from
81e5512 to
eb55e08
Compare
common/crypto/CMakeLists.txt
Outdated
| #ifdef __cplusplus | ||
| } | ||
| #endif | ||
| ") |
There was a problem hiding this comment.
why do we need a full on cpp file? just wrap with the string literals. then you don't need a template at all.
|
(stale, will be addressed in a subsequent PR) |
This PR removes the machinery for configuring the IAS root certificate at build time, and moves the task to the crypto cmake.
Two notes.
First, the artifacts -- namely the IAS root certificate and the crypto header which embeds the certificate itself -- are now generated by cmake itself, and they are not cleaned up through make. For this reason, both have been moved within the build folder -- so that they are removed when the build folder itself is removed.
This is fine for the crypto header, since it's only necessary when compiling the crypto libraries -- other sources do not need to include it.
Second, the root certificate is always built into the crypto library by default, thereby simplifying the code.