siemens/libuta

Unified Trust Anchor Library

libuta's Issues

Build fails

If I clone this repo and call "./bootstrap" I get the following error:

libtoolize: putting auxiliary files in '.'.
libtoolize: linking file './ltmain.sh'
libtoolize: Consider adding 'AC_CONFIG_MACRO_DIRS([m4])' to configure.ac,
libtoolize: and rerunning libtoolize and aclocal.
libtoolize: Consider adding '-I m4' to ACLOCAL_AMFLAGS in Makefile.am.
configure.ac:31: installing './ar-lib'
configure.ac:31: installing './compile'
configure.ac:36: installing './config.guess'
configure.ac:36: installing './config.sub'
configure.ac:24: installing './install-sh'
configure.ac:24: installing './missing'
configure.ac:116: error: required file 'src/tools/uta_get_passphrase/Makefile.in' not found
configure.ac:116: error: required file 'src/tools/uta_reg_test/Makefile.in' not found
Makefile.am:13: error: required directory ./src/tools/uta_reg_test does not exist
Makefile.am:13: error: required directory ./src/tools/uta_get_passphrase does not exist
autoreconf: automake failed with exit status: 1

Improve TPM provisioning scripts

Check the availability of the necessary tools and libraries at the beginning of the scripts.

Add tests for TPM_TCG backend to CI pipeline

The TPM_TCG backend currently does not work with the TPM simulator.

Add OpenSSF Scorecard

As suggested by

https://openssf.org/blog/2020/11/06/security-scorecards-for-open-source-projects/

add a scorecard:

https://github.com/ossf/scorecard

We can break this down into several sub-tasks:

• Security-MD | Does the project contain a security policy?
• Contributors | Does the project have contributors from at least two different organizations?
• Frozen-Deps | Does the project declare and freeze dependencies?
• Signed-Releases | Does the project cryptographically sign releases?
• Signed-Tags | Does the project cryptographically sign release tags?
• CI-Tests | Does the project run tests in CI?
• Code-Review | Does the project require code review before code is merged?
• CII-Best-Practices | Does the project have a CII Best Practices Badge?
• Pull-Requests | Does the project use Pull Requests for all code changes?
• Fuzzing | Does the project use OSS-Fuzz?
• SAST | Does the project use static code analysis tools, e.g. CodeQL?
• Active | Did the project get any commits and releases in last 90 days?

Remove hardcoded handle values from TPM provisioning script

The hardcoded handle values should be replaced by the handle value assigned by the TSS during the preceding command.

File: provisioning.sh

Default Siemens security policy

Dear project maintainers,

The default Siemens security policy will be applied to this repository on September 27, 2023.

If you're OK with that, you can close this issue. Otherwise, please create your own security policy.

If you have any further questions leave a comment in the pull request or send us an email.

TOC is not correctly rendered in README.

Setup a CI pipeline

Automate testing with a CI pipline.

Build separate Debian package for libuta provisioning tools

Currently the TPM implementation needs the installation of further tools and helper scripts for key provisioning. After the provisioning step, these tools are not needed anymore. We should consider to implement an option to uninstall the provisioning tools.

To avoid the installation of the Debian package "tss2", we could implement our own provisioning tool based on libtss0 instead of using the shell script.