signing.bbclass: remove signing_import_cert_chain_from_pem

With the now available set|get|has_ca functions to establish a CA link
between roles during their import, the
signing_import_cert_chain_from_pem can now be removed.  As it had the
shortcoming of dynamically creating roles, which are harder to handle
then the manually/specifically setup CA roles.

This effectively reverts:
a825b85363 signing.bbclass: add certificate ca-chain handling

Reviewed-by: Jan Luebbe <jlu@pengutronix.de>
Signed-off-by: Johannes Schneider <johannes.schneider@leica-geosystems.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This commit is contained in:
Johannes Schneider 2025-06-27 14:18:22 +02:00 committed by Khem Raj
parent d1b6f528a5
commit a1dd190604
No known key found for this signature in database
GPG Key ID: BB053355919D3314

View File

@ -231,35 +231,6 @@ signing_get_root_cert() {
echo "${cert_name}"
}
# signing_import_cert_chain_from_pem <role> <pem>
#
# Import a certificate *chain* from a PEM file to a role.
# (e.g. multiple ones concatenated in one file)
#
# Due to limitations in the toolchain:
# signing class -> softhsm -> 'extract-cert'
# the input certificate is split into a sequentially numbered list of roles,
# starting at <role>_1
#
# (The limitations are the conversion step from x509 to a plain .der, and
# extract-cert expecting a x509 and then producing only plain .der again)
signing_import_cert_chain_from_pem() {
local role="${1}"
local pem="${2}"
local i=1
cat "${pem}" | \
while openssl x509 -inform pem -outform der -out ${B}/temp_${i}.der; do
signing_import_define_role "${role}_${i}"
signing_pkcs11_tool --type cert \
--write-object ${B}/temp_${i}.der \
--label "${role}_${i}"
rm ${B}/temp_${i}.der
echo "imported ${pem} under role: ${role}_${i}"
i=$(awk "BEGIN {print $i+1}")
done
}
# signing_import_cert_from_pem <cert_name> <pem>
#
# Import a certificate from PEM file to a cert_name.