[PATCH RFC] crypto: keytoc: Split env-provided full keyspec on spaces

[Jonas Rebmann <jre@pengutronix.de>]

keytoc/CONFIG_CRYPTO_PUBLIC_KEYS can work with a complete keyspec
provided by an environment variable as opposed to providing single URIs.
This would be a very useful feature if it could also provide any number
of keys. Kconfig however provides keytoc with regular keyspecs already
split at spaces so without furhter measures, the env variable can only
be expanded into a single key.

Work around this by, in the special case of keytoc provided with a
single environment variable, splitting that single argument at any space
character that is not escaped with a backslash in front of it.

Unescaped space characters following an unescaped space character are
ignored, trailing unescaped space characters are not ignored, leading to
an additional, empty key argument, which is invalid.

Signed-off-by: Jonas Rebmann <jre@pengutronix.de>
---
 scripts/keytoc.c | 43 ++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 42 insertions(+), 1 deletion(-)

diff --git a/scripts/keytoc.c b/scripts/keytoc.c
index 77ada3af45..de882fe9fe 100644
--- a/scripts/keytoc.c
+++ b/scripts/keytoc.c
@@ -818,6 +818,7 @@ int main(int argc, char *argv[])
 	char *outfile = NULL;
 	int keycount;
 	struct keyinfo *keylist;
+	char **keyspecs;
 
 	outfilep = stdout;
 
@@ -853,10 +854,50 @@ int main(int argc, char *argv[])
 	}
 
 	keycount = argc - optind;
+	keyspecs = argv + optind;
+
+	if (keycount == 1 && !strncmp(argv[optind], "__ENV__", 7)) {
+		char *singlespec = try_resolve_env(keyspecs[0]);
+		/* include '\0' in length */
+		int len = strlen(singlespec) + 1;
+		char *p;
+
+		for (p = singlespec; *p; p++) {
+			if (*(p + 1) == ' ') {
+				if (*p == '\\') {
+					memmove(p, p + 1, len - 1);
+					len--;
+					p++;
+				} else {
+					keycount += 1;
+					*(p + 1) = '\0';
+					p += 2;
+					/* ignore subsequent spaces */
+					while (*p == ' ') {
+						memmove(p, p + 1, len - 1);
+						len--;
+						p++;
+					}
+				}
+			}
+		}
+
+		keyspecs = calloc(sizeof(char *), keycount + 1);
+		keyspecs[0] = singlespec;
+		p = singlespec;
+
+		for (int i = 1; i < keycount; i++) {
+			while (*p)
+				p++;
+			p++;
+			keyspecs[i] = p;
+		}
+	}
+
 	keylist = calloc(sizeof(struct keyinfo), keycount);
 
 	for (i = 0; i < keycount; i++) {
-		const char *keyspec = try_resolve_env(argv[optind + i]);
+		const char *keyspec = try_resolve_env(keyspecs[i]);
 		struct keyinfo *info = &keylist[i];
 
 		if (!keyspec)

---
base-commit: 89ed19d5c673ad0ab1851ed62ece38d30e96b412
change-id: 20260206-keytoc-multi-env-4a3300292e4a

Best regards,
--  
Jonas Rebmann <jre@pengutronix.de>