swupdate_class: Add support for custom signing tool

Add support for using a custom signing tool defined by the
SWUPDATE_SIGN_TOOL environment variable.

When SWUPDATE_SIGN_TOOL is set, SWUPDATE_PRIVATE_KEY is ignored and
the string contained in SWUPDATE_SIGN_TOOL is execute. This allows
signing to be performed with any external tool, such as one that
performs hardware signing.

Signed-off-by: George McCollister <george.mccollister@gmail.com>

README

@@ -31,6 +31,9 @@ sw-description.sig which is included in the SWU file.
 Encrypted private keys are not currently supported since a secure 
 mechanism must exist to provide the passphrase.
 
+If SWUPDATE_SIGN_TOOL is set, SWUPDATE_PRIVATE_KEY is ignored and the string
+contained in SWUPDATE_SIGN_TOOL is executed to perform the signing.
+
 Maintainer
 ----------
 

classes/swupdate.bbclass

@@ -141,23 +141,28 @@ python do_swuimage () {
             swupdate_write_sha256(s, file, hash)
 
     if d.getVar('SWUPDATE_SIGNING', True) == '1':
-        privkey = d.getVar('SWUPDATE_PRIVATE_KEY', True)
-        if not privkey:
-            bb.fatal("SWUPDATE_PRIVATE_KEY isn't set")
-        if not os.path.exists(privkey):
-            bb.fatal("SWUPDATE_PRIVATE_KEY %s doesn't exist" % (privkey))
-        passout = d.getVar('SWUPDATE_PASSWORD_FILE', True)
-        if passout:
-            passout = "-passin file:'%s' " % (passout)
+        sign_tool = d.getVar('SWUPDATE_SIGN_TOOL', True)
+        if sign_tool:
+            if os.system(sign_tool) != 0:
+                bb.fatal("Failed to sign with %s" % (sign_tool))
         else:
-            passout = ""
-        signcmd = "openssl dgst -sha256 -sign '%s' %s -out '%s' '%s'" % (
-            privkey,
-            passout,
-            os.path.join(s, 'sw-description.sig'),
-            os.path.join(s, 'sw-description'))
-        if os.system(signcmd) != 0:
-            bb.fatal("Failed to sign sw-description with %s" % (privkey))
+            privkey = d.getVar('SWUPDATE_PRIVATE_KEY', True)
+            if not privkey:
+                bb.fatal("SWUPDATE_PRIVATE_KEY isn't set")
+            if not os.path.exists(privkey):
+                bb.fatal("SWUPDATE_PRIVATE_KEY %s doesn't exist" % (privkey))
+            passout = d.getVar('SWUPDATE_PASSWORD_FILE', True)
+            if passout:
+                passout = "-passin file:'%s' " % (passout)
+            else:
+                passout = ""
+            signcmd = "openssl dgst -sha256 -sign '%s' %s -out '%s' '%s'" % (
+                privkey,
+                passout,
+                os.path.join(s, 'sw-description.sig'),
+                os.path.join(s, 'sw-description'))
+            if os.system(signcmd) != 0:
+                bb.fatal("Failed to sign sw-description with %s" % (privkey))
 
     line = 'for i in ' + ' '.join(list_for_cpio) + '; do echo $i;done | cpio -ov -H crc >' + os.path.join(deploydir,d.getVar('IMAGE_NAME', True) + '.swu')
     os.system("cd " + s + ";" + line)