[PATCH RFC] crypto: keytoc: Split env-provided full keyspec on spaces

[PATCH RFC] crypto: keytoc: Split env-provided full keyspec on spaces

[Jonas Rebmann]

keytoc/CONFIG_CRYPTO_PUBLIC_KEYS can work with a complete keyspec
provided by an environment variable as opposed to providing single URIs.
This would be a very useful feature if it could also provide any number
of keys. Kconfig however provides keytoc with regular keyspecs already
split at spaces so without furhter measures, the env variable can only
be expanded into a single key.

Work around this by, in the special case of keytoc provided with a
single environment variable, splitting that single argument at any space
character that is not escaped with a backslash in front of it.

Unescaped space characters following an unescaped space character are
ignored, trailing unescaped space characters are not ignored, leading to
an additional, empty key argument, which is invalid.

Signed-off-by: Jonas Rebmann <jre@pengutronix.de>
---
 scripts/keytoc.c | 43 ++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 42 insertions(+), 1 deletion(-)

diff --git a/scripts/keytoc.c b/scripts/keytoc.c
index 77ada3af45..de882fe9fe 100644
--- a/scripts/keytoc.c
+++ b/scripts/keytoc.c
@@ -818,6 +818,7 @@ int main(int argc, char *argv[])
 	char *outfile = NULL;
 	int keycount;
 	struct keyinfo *keylist;
+	char **keyspecs;
 
 	outfilep = stdout;
 
@@ -853,10 +854,50 @@ int main(int argc, char *argv[])
 	}
 
 	keycount = argc - optind;
+	keyspecs = argv + optind;
+
+	if (keycount == 1 && !strncmp(argv[optind], "__ENV__", 7)) {
+		char *singlespec = try_resolve_env(keyspecs[0]);
+		/* include '\0' in length */
+		int len = strlen(singlespec) + 1;
+		char *p;
+
+		for (p = singlespec; *p; p++) {
+			if (*(p + 1) == ' ') {
+				if (*p == '\\') {
+					memmove(p, p + 1, len - 1);
+					len--;
+					p++;
+				} else {
+					keycount += 1;
+					*(p + 1) = '\0';
+					p += 2;
+					/* ignore subsequent spaces */
+					while (*p == ' ') {
+						memmove(p, p + 1, len - 1);
+						len--;
+						p++;
+					}
+				}
+			}
+		}
+
+		keyspecs = calloc(sizeof(char *), keycount + 1);
+		keyspecs[0] = singlespec;
+		p = singlespec;
+
+		for (int i = 1; i < keycount; i++) {
+			while (*p)
+				p++;
+			p++;
+			keyspecs[i] = p;
+		}
+	}
+
 	keylist = calloc(sizeof(struct keyinfo), keycount);
 
 	for (i = 0; i < keycount; i++) {
-		const char *keyspec = try_resolve_env(argv[optind + i]);
+		const char *keyspec = try_resolve_env(keyspecs[i]);
 		struct keyinfo *info = &keylist[i];
 
 		if (!keyspec)

---
base-commit: 89ed19d5c673ad0ab1851ed62ece38d30e96b412
change-id: 20260206-keytoc-multi-env-4a3300292e4a

Best regards,
--  
Jonas Rebmann <jre@pengutronix.de>

Re: [PATCH RFC] crypto: keytoc: Split env-provided full keyspec on spaces

[Ahmad Fatoum]

Hi,

On 2/6/26 1:28 PM, Jonas Rebmann wrote:
> keytoc/CONFIG_CRYPTO_PUBLIC_KEYS can work with a complete keyspec
> provided by an environment variable as opposed to providing single URIs.
> This would be a very useful feature if it could also provide any number
> of keys. Kconfig however provides keytoc with regular keyspecs already
> split at spaces so without furhter measures, the env variable can only
> be expanded into a single key.
> 
> Work around this by, in the special case of keytoc provided with a
> single environment variable, splitting that single argument at any space
> character that is not escaped with a backslash in front of it.

I think that's sensible. Do we see breakage potential for existing
users? If so, we should have a migration entry about the change in
interpretation of space.

>  	keycount = argc - optind;
> +	keyspecs = argv + optind;
> +
> +	if (keycount == 1 && !strncmp(argv[optind], "__ENV__", 7)) {
> +		char *singlespec = try_resolve_env(keyspecs[0]);
> +		/* include '\0' in length */
> +		int len = strlen(singlespec) + 1;
> +		char *p;
> +
> +		for (p = singlespec; *p; p++) {

Can you copy strsep_unescaped to scripts/ and use that instead?

> +			if (*(p + 1) == ' ') {
> +				if (*p == '\\') {
> +					memmove(p, p + 1, len - 1);
> +					len--;
> +					p++;
> +				} else {
> +					keycount += 1;
> +					*(p + 1) = '\0';
> +					p += 2;
> +					/* ignore subsequent spaces */
> +					while (*p == ' ') {
> +						memmove(p, p + 1, len - 1);
> +						len--;
> +						p++;
> +					}
> +				}
> +			}
> +		}
> +
> +		keyspecs = calloc(sizeof(char *), keycount + 1);
> +		keyspecs[0] = singlespec;
> +		p = singlespec;
> +
> +		for (int i = 1; i < keycount; i++) {
> +			while (*p)
> +				p++;
> +			p++;
> +			keyspecs[i] = p;
> +		}
> +	}
> +
>  	keylist = calloc(sizeof(struct keyinfo), keycount);
>  
>  	for (i = 0; i < keycount; i++) {
> -		const char *keyspec = try_resolve_env(argv[optind + i]);
> +		const char *keyspec = try_resolve_env(keyspecs[i]);
>  		struct keyinfo *info = &keylist[i];
>  
>  		if (!keyspec)
> 
> ---
> base-commit: 89ed19d5c673ad0ab1851ed62ece38d30e96b412
> change-id: 20260206-keytoc-multi-env-4a3300292e4a
> 
> Best regards,
> --  
> Jonas Rebmann <jre@pengutronix.de>
> 
> 
> 

-- 
Pengutronix e.K.                  |                             |
Steuerwalder Str. 21              | http://www.pengutronix.de/  |
31137 Hildesheim, Germany         | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686  | Fax:   +49-5121-206917-5555 |

Re: [PATCH RFC] crypto: keytoc: Split env-provided full keyspec on spaces

[Jonas Rebmann]

Hi Ahmad,

On 2026-02-10 10:35, Ahmad Fatoum wrote:
> On 2/6/26 1:28 PM, Jonas Rebmann wrote:
>> keytoc/CONFIG_CRYPTO_PUBLIC_KEYS can work with a complete keyspec
>> provided by an environment variable as opposed to providing single URIs.
>> This would be a very useful feature if it could also provide any number
>> of keys. Kconfig however provides keytoc with regular keyspecs already
>> split at spaces so without furhter measures, the env variable can only
>> be expanded into a single key.
>>
>> Work around this by, in the special case of keytoc provided with a
>> single environment variable, splitting that single argument at any space
>> character that is not escaped with a backslash in front of it.
> 
> I think that's sensible. Do we see breakage potential for existing
> users? If so, we should have a migration entry about the change in
> interpretation of space.

It does break for users of the single-env-variable format if they'd been
relying on paths containing spaces or backslashes, which they'd need to
start escaping now. But I don't suppose many, if any, users are really
affected by that.

I'll add a migration entry, suppose it can't hurt.

I'll update this patch to treat multiple variables the same way as
single variables.

Right now, given a single __ENV__var1 argument, that is split but once
given a second __ENV__var2 argument, neither are split, which is
inconsistent.

I will keep not modifying plain URIs provided by env e.g.
keyring:__ENV__uri

>>   	keycount = argc - optind;
>> +	keyspecs = argv + optind;
>> +
>> +	if (keycount == 1 && !strncmp(argv[optind], "__ENV__", 7)) {
>> +		char *singlespec = try_resolve_env(keyspecs[0]);
>> +		/* include '\0' in length */
>> +		int len = strlen(singlespec) + 1;
>> +		char *p;
>> +
>> +		for (p = singlespec; *p; p++) {
> 
> Can you copy strsep_unescaped to scripts/ and use that instead?

Oh yes that will make things easier.

Regards,
Jonas

-- 
Pengutronix e.K.                           | Jonas Rebmann               |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-9    |