Re: [PATCH RFC] crypto: keytoc: Split env-provided full keyspec on spaces

[Ahmad Fatoum <a.fatoum@pengutronix.de>]

Hi,

On 2/6/26 1:28 PM, Jonas Rebmann wrote:
> keytoc/CONFIG_CRYPTO_PUBLIC_KEYS can work with a complete keyspec
> provided by an environment variable as opposed to providing single URIs.
> This would be a very useful feature if it could also provide any number
> of keys. Kconfig however provides keytoc with regular keyspecs already
> split at spaces so without furhter measures, the env variable can only
> be expanded into a single key.
> 
> Work around this by, in the special case of keytoc provided with a
> single environment variable, splitting that single argument at any space
> character that is not escaped with a backslash in front of it.

I think that's sensible. Do we see breakage potential for existing
users? If so, we should have a migration entry about the change in
interpretation of space.

>  	keycount = argc - optind;
> +	keyspecs = argv + optind;
> +
> +	if (keycount == 1 && !strncmp(argv[optind], "__ENV__", 7)) {
> +		char *singlespec = try_resolve_env(keyspecs[0]);
> +		/* include '\0' in length */
> +		int len = strlen(singlespec) + 1;
> +		char *p;
> +
> +		for (p = singlespec; *p; p++) {

Can you copy strsep_unescaped to scripts/ and use that instead?

> +			if (*(p + 1) == ' ') {
> +				if (*p == '\\') {
> +					memmove(p, p + 1, len - 1);
> +					len--;
> +					p++;
> +				} else {
> +					keycount += 1;
> +					*(p + 1) = '\0';
> +					p += 2;
> +					/* ignore subsequent spaces */
> +					while (*p == ' ') {
> +						memmove(p, p + 1, len - 1);
> +						len--;
> +						p++;
> +					}
> +				}
> +			}
> +		}
> +
> +		keyspecs = calloc(sizeof(char *), keycount + 1);
> +		keyspecs[0] = singlespec;
> +		p = singlespec;
> +
> +		for (int i = 1; i < keycount; i++) {
> +			while (*p)
> +				p++;
> +			p++;
> +			keyspecs[i] = p;
> +		}
> +	}
> +
>  	keylist = calloc(sizeof(struct keyinfo), keycount);
>  
>  	for (i = 0; i < keycount; i++) {
> -		const char *keyspec = try_resolve_env(argv[optind + i]);
> +		const char *keyspec = try_resolve_env(keyspecs[i]);
>  		struct keyinfo *info = &keylist[i];
>  
>  		if (!keyspec)
> 
> ---
> base-commit: 89ed19d5c673ad0ab1851ed62ece38d30e96b412
> change-id: 20260206-keytoc-multi-env-4a3300292e4a
> 
> Best regards,
> --  
> Jonas Rebmann <jre@pengutronix.de>
> 
> 
> 

-- 
Pengutronix e.K.                  |                             |
Steuerwalder Str. 21              | http://www.pengutronix.de/  |
31137 Hildesheim, Germany         | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686  | Fax:   +49-5121-206917-5555 |