From 1857c4978f482e2043c9b046724ebe16e7baee42 Mon Sep 17 00:00:00 2001 From: Brian Sipos Date: Fri, 17 Jul 2026 10:42:42 -0400 Subject: [PATCH 01/13] Be more strict about public header files to install --- CMakeLists.txt | 2 +- src/CMakeLists.txt | 235 +++++++++++++++++++++++++-------------------- 2 files changed, 133 insertions(+), 104 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 4bae99fe..2c57e121 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -19,7 +19,7 @@ Institute of Technology, sponsored by the United States Government under the prime contract 80NM0018D0004 between the Caltech and NASA under subcontract 1700763. ]] -cmake_minimum_required(VERSION 3.10) +cmake_minimum_required(VERSION 3.23) message(STATUS "Build mode ${CMAKE_BUILD_TYPE}") option(BUILD_LIB "Build the library itself" ON) diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt index cd3b0472..28363e2b 100644 --- a/src/CMakeLists.txt +++ b/src/CMakeLists.txt @@ -25,18 +25,24 @@ configure_file(bsl/BSLConfig.c.in bsl/BSLConfig.c @ONLY) # Frontend library add_library(bsl_front) -target_sources(bsl_front PUBLIC - ${CMAKE_CURRENT_BINARY_DIR}/bsl/BSLConfig.h - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/BPSecLib_Private.h - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/BPSecLib_Public.h - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/front/Data.h - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/front/SeqReader.h - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/front/SeqWriter.h - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/front/TextUtil.h -) -target_sources(bsl_front PRIVATE - ${CMAKE_CURRENT_BINARY_DIR}/bsl/BSLConfig.c - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/front/Data.c +target_sources(bsl_front + PUBLIC + FILE_SET public_headers + TYPE HEADERS + BASE_DIRS + ${CMAKE_CURRENT_BINARY_DIR} + ${CMAKE_CURRENT_SOURCE_DIR} + FILES + ${CMAKE_CURRENT_BINARY_DIR}/bsl/BSLConfig.h + bsl/BPSecLib_Private.h + bsl/BPSecLib_Public.h + bsl/front/Data.h + bsl/front/SeqReader.h + bsl/front/SeqWriter.h + bsl/front/TextUtil.h + PRIVATE + bsl/BSLConfig.c + bsl/front/Data.c ) set_target_properties(bsl_front @@ -52,11 +58,14 @@ target_include_directories(bsl_front PUBLIC # Crypto and Keystore library add_library(bsl_crypto) -target_sources(bsl_crypto PUBLIC - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/crypto/CryptoInterface.h -) -target_sources(bsl_crypto PRIVATE - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/crypto/CryptoInterface.c +target_sources(bsl_crypto + PUBLIC + FILE_SET public_headers + TYPE HEADERS + FILES + bsl/crypto/CryptoInterface.h + PRIVATE + bsl/crypto/CryptoInterface.c ) set_target_properties(bsl_crypto PROPERTIES @@ -65,6 +74,7 @@ set_target_properties(bsl_crypto ) target_link_libraries(bsl_crypto PUBLIC bsl_front bsl_dynamic) target_link_libraries(bsl_crypto PRIVATE MLIB::mlib) +target_link_libraries(bsl_crypto PRIVATE qcbor::qcbor) target_link_libraries(bsl_crypto PRIVATE OpenSSL::Crypto) if(TARGET valgrind::valgrind) find_path(VALGRIND_INCLUDE_DIR NAMES valgrind/memcheck.h) @@ -76,14 +86,21 @@ endif(TARGET valgrind::valgrind) # Default Security Context library add_library(bsl_default_sc) -target_sources(bsl_default_sc PUBLIC - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/default_sc/DefaultSecContext.h - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/default_sc/DefaultSecContext_Private.h -) -target_sources(bsl_default_sc PRIVATE - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/default_sc/DefaultSecContext.c - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/default_sc/BCB_AES_GCM.c - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/default_sc/BIB_HMAC_SHA2.c +target_sources(bsl_default_sc + PUBLIC + FILE_SET public_headers + TYPE HEADERS + FILES + bsl/default_sc/DefaultSecContext.h + PRIVATE + FILE_SET private_headers + TYPE HEADERS + FILES + bsl/default_sc/DefaultSecContext_Private.h + PRIVATE + bsl/default_sc/DefaultSecContext.c + bsl/default_sc/BCB_AES_GCM.c + bsl/default_sc/BIB_HMAC_SHA2.c ) set_target_properties(bsl_default_sc PROPERTIES @@ -95,13 +112,20 @@ target_link_libraries(bsl_default_sc PRIVATE bsl_crypto) # COSE Security Context library add_library(bsl_cose_sc) -target_sources(bsl_cose_sc PUBLIC - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/cose_sc/CoseContext.h - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/cose_sc/CoseMsg.h -) -target_sources(bsl_cose_sc PRIVATE - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/cose_sc/CoseContext.c - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/cose_sc/CoseMsg.c +target_sources(bsl_cose_sc + PUBLIC + FILE_SET public_headers + TYPE HEADERS + FILES + bsl/cose_sc/CoseContext.h + PRIVATE + FILE_SET private_headers + TYPE HEADERS + FILES + bsl/cose_sc/CoseMsg.h + PRIVATE + bsl/cose_sc/CoseContext.c + bsl/cose_sc/CoseMsg.c ) set_target_properties(bsl_cose_sc PROPERTIES @@ -111,17 +135,25 @@ set_target_properties(bsl_cose_sc target_link_libraries(bsl_cose_sc PUBLIC bsl_front) target_link_libraries(bsl_cose_sc PUBLIC bsl_dynamic) # for CBOR API target_link_libraries(bsl_cose_sc PRIVATE bsl_crypto) -target_link_libraries(bsl_cose_sc PUBLIC MLIB::mlib) +target_link_libraries(bsl_cose_sc PRIVATE MLIB::mlib) +target_link_libraries(bsl_cose_sc PRIVATE qcbor::qcbor) # Example Policy Provider library add_library(bsl_sample_pp) -target_sources(bsl_sample_pp PUBLIC - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/sample_pp/SamplePolicyProvider.h - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/sample_pp/PolicyParser.h -) -target_sources(bsl_sample_pp PRIVATE - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/sample_pp/SamplePolicyProvider.c - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/sample_pp/PolicyParser.c +target_sources(bsl_sample_pp + PUBLIC + FILE_SET public_headers + TYPE HEADERS + FILES + bsl/sample_pp/SamplePolicyProvider.h + PRIVATE + FILE_SET private_headers + TYPE HEADERS + FILES + bsl/sample_pp/PolicyParser.h + PRIVATE + bsl/sample_pp/SamplePolicyProvider.c + bsl/sample_pp/PolicyParser.c ) set_target_properties(bsl_sample_pp PROPERTIES @@ -137,27 +169,34 @@ target_link_libraries(bsl_sample_pp PRIVATE Jansson::Jansson) # Dynamic backend library add_library(bsl_dynamic) -target_sources(bsl_dynamic PUBLIC - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/dynamic/AbsSecBlock.h - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/dynamic/CBOR.h - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/dynamic/IdValPair.h - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/dynamic/PublicInterfaceImpl.h - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/dynamic/SeqReadWrite.h -) -target_sources(bsl_dynamic PRIVATE - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/dynamic/AbsSecBlock.c - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/dynamic/CBOR.c - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/dynamic/HostInterface.c - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/dynamic/IdValPair.c - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/dynamic/PublicInterfaceImpl.c - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/dynamic/PolicyProvider.c - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/dynamic/SecOperation.c - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/dynamic/SecurityAction.c - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/dynamic/SecurityActionSet.c - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/dynamic/SecurityContext.c - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/dynamic/TelemetryCounters.c - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/dynamic/TextUtil.c - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/dynamic/SeqReadWrite.c +target_sources(bsl_dynamic + PUBLIC + FILE_SET public_headers + TYPE HEADERS + FILES + bsl/dynamic/AbsSecBlock.h + bsl/dynamic/CBOR.h + bsl/dynamic/IdValPair.h + bsl/dynamic/SeqReadWrite.h + PRIVATE + FILE_SET private_headers + TYPE HEADERS + FILES + bsl/dynamic/PublicInterfaceImpl.h + PRIVATE + bsl/dynamic/AbsSecBlock.c + bsl/dynamic/CBOR.c + bsl/dynamic/HostInterface.c + bsl/dynamic/IdValPair.c + bsl/dynamic/PublicInterfaceImpl.c + bsl/dynamic/PolicyProvider.c + bsl/dynamic/SecOperation.c + bsl/dynamic/SecurityAction.c + bsl/dynamic/SecurityActionSet.c + bsl/dynamic/SecurityContext.c + bsl/dynamic/TelemetryCounters.c + bsl/dynamic/TextUtil.c + bsl/dynamic/SeqReadWrite.c ) set_target_properties(bsl_dynamic PROPERTIES @@ -165,53 +204,54 @@ set_target_properties(bsl_dynamic SOVERSION ${CMAKE_PROJECT_VERSION_MAJOR} ) target_link_libraries(bsl_dynamic PUBLIC bsl_front) +# remaining libraries for internal BSL use, not BPA use target_link_libraries(bsl_dynamic PUBLIC MLIB::mlib) target_link_libraries(bsl_dynamic PUBLIC qcbor::qcbor) add_library(bsl_mock_bpa) -#target_compile_options(bsl_mock_bpa PRIVATE -Wshadow -Wpointer-arith -Wstrict-prototypes -Wmissing-prototypes -Wredundant-decls) -target_sources( - bsl_mock_bpa PUBLIC - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/mock_bpa/log.h - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/mock_bpa/agent.h - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/mock_bpa/bundle.h - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/mock_bpa/crc.h - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/mock_bpa/eid.h - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/mock_bpa/eidpat.h - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/mock_bpa/encode.h - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/mock_bpa/decode.h - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/mock_bpa/key_registry.h - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/mock_bpa/ctr.h - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/mock_bpa/MockBPA.h -) -target_sources( - bsl_mock_bpa PRIVATE - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/mock_bpa/log.c - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/mock_bpa/agent.c - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/mock_bpa/bundle.c - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/mock_bpa/crc.c - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/mock_bpa/eid.c - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/mock_bpa/eidpat.c - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/mock_bpa/encode.c - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/mock_bpa/decode.c - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/mock_bpa/key_registry.c - ${CMAKE_CURRENT_SOURCE_DIR}/bsl/mock_bpa/ctr.c +target_sources(bsl_mock_bpa + PUBLIC + FILE_SET public_headers + TYPE HEADERS + FILES + bsl/mock_bpa/log.h + bsl/mock_bpa/agent.h + bsl/mock_bpa/bundle.h + bsl/mock_bpa/crc.h + bsl/mock_bpa/eid.h + bsl/mock_bpa/eidpat.h + bsl/mock_bpa/encode.h + bsl/mock_bpa/decode.h + bsl/mock_bpa/key_registry.h + bsl/mock_bpa/ctr.h + bsl/mock_bpa/MockBPA.h + PRIVATE + bsl/mock_bpa/log.c + bsl/mock_bpa/agent.c + bsl/mock_bpa/bundle.c + bsl/mock_bpa/crc.c + bsl/mock_bpa/eid.c + bsl/mock_bpa/eidpat.c + bsl/mock_bpa/encode.c + bsl/mock_bpa/decode.c + bsl/mock_bpa/key_registry.c + bsl/mock_bpa/ctr.c ) set_target_properties(bsl_mock_bpa PROPERTIES VERSION ${CMAKE_PROJECT_VERSION} SOVERSION ${CMAKE_PROJECT_VERSION_MAJOR} ) +target_link_libraries(bsl_mock_bpa PUBLIC bsl_sample_pp bsl_default_sc bsl_cose_sc) target_link_libraries(bsl_mock_bpa PUBLIC MLIB::mlib) target_link_libraries(bsl_mock_bpa PUBLIC qcbor::qcbor) target_link_libraries(bsl_mock_bpa PRIVATE Jansson::Jansson) -target_link_libraries(bsl_mock_bpa PUBLIC bsl_front bsl_dynamic bsl_default_sc bsl_cose_sc bsl_sample_pp) +target_link_libraries(bsl_mock_bpa PUBLIC Threads::Threads) if(BUILD_MOCK_BPA AND NOT BUILD_FUZZING) add_executable(bsl-mock-bpa) target_sources(bsl-mock-bpa PRIVATE bsl/mock_bpa/mock_bpa.c) target_link_libraries(bsl-mock-bpa PUBLIC bsl_mock_bpa bsl_crypto) - target_link_libraries(bsl-mock-bpa PUBLIC Threads::Threads) # Installation config install( @@ -250,17 +290,6 @@ install( NAMELINK_COMPONENT devel ARCHIVE COMPONENT devel -) -install( - DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}/bsl/" - DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/bsl" - COMPONENT devel - FILE_PERMISSIONS OWNER_READ GROUP_READ WORLD_READ - FILES_MATCHING PATTERN "*.h" -) -install( - FILES "${CMAKE_CURRENT_BINARY_DIR}/bsl/BSLConfig.h" - DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/bsl" - COMPONENT devel - PERMISSIONS OWNER_READ GROUP_READ WORLD_READ + FILE_SET public_headers + COMPONENT devel ) From 7fd7367be529116fde0fa019d45e1d6b8dba0f85 Mon Sep 17 00:00:00 2001 From: Brian Sipos Date: Fri, 17 Jul 2026 10:51:47 -0400 Subject: [PATCH 02/13] Fix public header file lists. Move jansson use out of header. --- src/CMakeLists.txt | 18 +++++++++--------- src/bsl/sample_pp/PolicyParser.c | 2 ++ src/bsl/sample_pp/PolicyParser.h | 2 -- 3 files changed, 11 insertions(+), 11 deletions(-) diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt index 28363e2b..45ed53e5 100644 --- a/src/CMakeLists.txt +++ b/src/CMakeLists.txt @@ -36,6 +36,7 @@ target_sources(bsl_front ${CMAKE_CURRENT_BINARY_DIR}/bsl/BSLConfig.h bsl/BPSecLib_Private.h bsl/BPSecLib_Public.h + bsl/front/BSLMemory.h bsl/front/Data.h bsl/front/SeqReader.h bsl/front/SeqWriter.h @@ -143,17 +144,13 @@ add_library(bsl_sample_pp) target_sources(bsl_sample_pp PUBLIC FILE_SET public_headers - TYPE HEADERS - FILES - bsl/sample_pp/SamplePolicyProvider.h - PRIVATE - FILE_SET private_headers TYPE HEADERS FILES bsl/sample_pp/PolicyParser.h + bsl/sample_pp/SamplePolicyProvider.h PRIVATE - bsl/sample_pp/SamplePolicyProvider.c bsl/sample_pp/PolicyParser.c + bsl/sample_pp/SamplePolicyProvider.c ) set_target_properties(bsl_sample_pp PROPERTIES @@ -177,6 +174,9 @@ target_sources(bsl_dynamic bsl/dynamic/AbsSecBlock.h bsl/dynamic/CBOR.h bsl/dynamic/IdValPair.h + bsl/dynamic/SecOperation.h + bsl/dynamic/SecurityAction.h + bsl/dynamic/SecurityActionSet.h bsl/dynamic/SeqReadWrite.h PRIVATE FILE_SET private_headers @@ -214,16 +214,16 @@ target_sources(bsl_mock_bpa FILE_SET public_headers TYPE HEADERS FILES - bsl/mock_bpa/log.h bsl/mock_bpa/agent.h bsl/mock_bpa/bundle.h bsl/mock_bpa/crc.h + bsl/mock_bpa/ctr.h + bsl/mock_bpa/decode.h bsl/mock_bpa/eid.h bsl/mock_bpa/eidpat.h bsl/mock_bpa/encode.h - bsl/mock_bpa/decode.h bsl/mock_bpa/key_registry.h - bsl/mock_bpa/ctr.h + bsl/mock_bpa/log.h bsl/mock_bpa/MockBPA.h PRIVATE bsl/mock_bpa/log.c diff --git a/src/bsl/sample_pp/PolicyParser.c b/src/bsl/sample_pp/PolicyParser.c index b2542bd2..ea1e5012 100644 --- a/src/bsl/sample_pp/PolicyParser.c +++ b/src/bsl/sample_pp/PolicyParser.c @@ -25,6 +25,8 @@ #include "bsl/cose_sc/CoseContext.h" #include "bsl/default_sc/DefaultSecContext.h" +#include + #include #include diff --git a/src/bsl/sample_pp/PolicyParser.h b/src/bsl/sample_pp/PolicyParser.h index 030c45b1..e863c471 100644 --- a/src/bsl/sample_pp/PolicyParser.h +++ b/src/bsl/sample_pp/PolicyParser.h @@ -34,8 +34,6 @@ #include "bsl/BPSecLib_Private.h" #include "bsl/default_sc/rfc9173.h" -#include - #include #include From b4569c23eb0380ce0dca0e69930fb3bb6c48e66a Mon Sep 17 00:00:00 2001 From: Brian Sipos Date: Fri, 17 Jul 2026 11:37:05 -0400 Subject: [PATCH 03/13] Move common check-install into build.sh --- .github/workflows/packages.yaml | 20 +------------------ build.sh | 34 +++++++++++++++++++++++++++++++-- lib-user-test/main.c | 4 ++++ src/CMakeLists.txt | 1 + 4 files changed, 38 insertions(+), 21 deletions(-) diff --git a/.github/workflows/packages.yaml b/.github/workflows/packages.yaml index 7d7b899c..529ede77 100644 --- a/.github/workflows/packages.yaml +++ b/.github/workflows/packages.yaml @@ -112,26 +112,8 @@ jobs: sparse-checkout: | mock-bpa-test lib-user-test - - name: Show pkg-config - env: - PKGS: bsl bsl-sample-pp - run: | - echo "Provides:" - pkg-config --print-provides ${PKGS} - echo "Requires:" - pkg-config --print-requires ${PKGS} - echo -n "CFlags: " - pkg-config --cflags ${PKGS} - echo -n "Libs: " - pkg-config --libs ${PKGS} - name: Trial build - env: - PKGS: bsl bsl-sample-pp - run: | - mkdir build - gcc -c $(pkg-config --cflags ${PKGS}) -o build/example.o lib-user-test/main.c - gcc $(pkg-config --libs ${PKGS}) -o build/example build/example.o - ./build/example + run: ./build.sh check-install - name: Mock BPA tests run: | pip3 install -r mock-bpa-test/requirements.txt diff --git a/build.sh b/build.sh index 3f1f1ee1..a16ef3ac 100755 --- a/build.sh +++ b/build.sh @@ -39,6 +39,7 @@ function usage { echo " apply-format - Apply format to all source code" echo " apply-license - Apply/update license preamble to files" echo " check - Run unit tests" + echo " check-install - Build a test executable linked to BSL" echo " clean - Clean build artifacts" echo " deps - Build dependend libraries" echo " docs - Build HTML and/or PDF doxygen" @@ -56,7 +57,8 @@ function cmd_check_format { } function cmd_apply_format { - exec ./resources/apply_format.sh + shift + exec ./resources/apply_format. "$@" } function cmd_apply_license { @@ -68,6 +70,31 @@ function cmd_check { ctest --test-dir ${BUILDDIR} --output-on-failure "$@" } +function cmd_check_install { + cd "${SELFDIR}" + if [[ -d testroot ]] + then + export PKG_CONFIG_PATH=$(find testroot/ -type d -name pkgconfig | tr '\n' ':') + PREFIX="--define-variable=prefix=testroot/usr" + echo "Using prefix: ${PREFIX}" + fi + PKGS="bsl bsl-sample-pp" + + echo "Provides:" + pkg-config --print-provides ${PKGS} + echo "Requires:" + pkg-config --print-requires ${PKGS} + echo -n "CFlags: " + pkg-config --cflags ${PKGS} ${PREFIX} + echo -n "Libs: " + pkg-config --libs ${PKGS} ${PREFIX} + + mkdir -p build + gcc -c -o build/example.o lib-user-test/main.c $(pkg-config --cflags ${PKGS} ${PREFIX}) + gcc -o build/example build/example.o $(pkg-config --libs ${PKGS} ${PREFIX}) + ./build/example +} + function cmd_clean { rm -rf build testroot deps/build } @@ -184,7 +211,7 @@ case "$1" in cmd_check_format ;; apply-format) - cmd_apply_format + cmd_apply_format "$@" ;; apply-license) cmd_apply_license @@ -192,6 +219,9 @@ case "$1" in check) cmd_check "$@" ;; + check-install) + cmd_check_install + ;; clean) cmd_clean ;; diff --git a/lib-user-test/main.c b/lib-user-test/main.c index fe23752a..eb8b8725 100644 --- a/lib-user-test/main.c +++ b/lib-user-test/main.c @@ -4,6 +4,10 @@ #include #include +#include +#include +#include +#include int main(int argc, char *argv[]) { diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt index 45ed53e5..4e028d6e 100644 --- a/src/CMakeLists.txt +++ b/src/CMakeLists.txt @@ -93,6 +93,7 @@ target_sources(bsl_default_sc TYPE HEADERS FILES bsl/default_sc/DefaultSecContext.h + bsl/default_sc/rfc9173.h PRIVATE FILE_SET private_headers TYPE HEADERS From b41f561dab7cca623aefd66224a8e8f342b66c11 Mon Sep 17 00:00:00 2001 From: Brian Sipos Date: Fri, 17 Jul 2026 11:41:08 -0400 Subject: [PATCH 04/13] Check symbols on bsl_cose_sc --- .github/workflows/build-test.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build-test.yaml b/.github/workflows/build-test.yaml index 68fdec3d..df964b0f 100644 --- a/.github/workflows/build-test.yaml +++ b/.github/workflows/build-test.yaml @@ -96,9 +96,11 @@ jobs: run: | ./check_symbols.py bsl_front bsl_dynamic --prefix bsl_ ./check_symbols.py bsl_crypto --prefix bsl_ bslb_ - ./check_symbols.py bsl_default_sc --prefix bslx_ + ./check_symbols.py bsl_default_sc bsl_cose_sc --prefix bslx_ ./check_symbols.py bsl_sample_pp --prefix bslp_ ./check_symbols.py bsl_mock_bpa --prefix MockBPA_ bsl_eidpat_ bsl_mock_ mock_bpa_ + - name: Trial build + run: ./build.sh check-install - name: Test run: ./build.sh check - name: Collect coverage From 3bfa87c697e36efd7e0b0c59f4c46058ed056cc0 Mon Sep 17 00:00:00 2001 From: Brian Sipos Date: Fri, 17 Jul 2026 11:44:27 -0400 Subject: [PATCH 05/13] Do not clobber existing variable --- build.sh | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/build.sh b/build.sh index a16ef3ac..d121e76a 100755 --- a/build.sh +++ b/build.sh @@ -75,8 +75,10 @@ function cmd_check_install { if [[ -d testroot ]] then export PKG_CONFIG_PATH=$(find testroot/ -type d -name pkgconfig | tr '\n' ':') - PREFIX="--define-variable=prefix=testroot/usr" - echo "Using prefix: ${PREFIX}" + PKG_PREFIX="--define-variable=prefix=testroot/usr" + echo "Using prefix: ${PKG_PREFIX}" + else + PKG_PREFIX="" fi PKGS="bsl bsl-sample-pp" @@ -85,13 +87,13 @@ function cmd_check_install { echo "Requires:" pkg-config --print-requires ${PKGS} echo -n "CFlags: " - pkg-config --cflags ${PKGS} ${PREFIX} + pkg-config ${PKG_PREFIX} --cflags ${PKGS} echo -n "Libs: " - pkg-config --libs ${PKGS} ${PREFIX} + pkg-config ${PKG_PREFIX} --libs ${PKGS} mkdir -p build - gcc -c -o build/example.o lib-user-test/main.c $(pkg-config --cflags ${PKGS} ${PREFIX}) - gcc -o build/example build/example.o $(pkg-config --libs ${PKGS} ${PREFIX}) + gcc -c -o build/example.o lib-user-test/main.c $(pkg-config ${PKG_PREFIX} --cflags ${PKGS}) + gcc -o build/example build/example.o $(pkg-config ${PKG_PREFIX} --libs ${PKGS}) ./build/example } From 713545538e3de00ed7813bb858a4aaa7f6bc2a15 Mon Sep 17 00:00:00 2001 From: Brian Sipos Date: Fri, 17 Jul 2026 12:10:31 -0400 Subject: [PATCH 06/13] Clean up README for new structures --- README.md | 77 ++++++++++++++++++++++++++++++++++++------------------- 1 file changed, 51 insertions(+), 26 deletions(-) diff --git a/README.md b/README.md index 2a07cf33..cba0b7cd 100644 --- a/README.md +++ b/README.md @@ -32,29 +32,32 @@ The BSL exposes an interface via C header files (under `src`), and contains an e The following are the major parts of this project. -**Note.** The BSL API (both Public and Private) lives at the top level `src` directory. -Example concrete modules implementations are found in subdirectories of it. - -``` +```sh BSL/ ├── build.sh # Top-level build utility script ├── cmake/ # Additional CMake files ├── deps/ # Third-party dependencies ├── docs/ # Doxygen pages and templates -├── mock-bpa-test/ # Full BSL test/example using Mock BPA -├── pkg/ # Material for building RPMs +├── pkg/ # Material for building RPMs and pkg-config ├── resources/ # Additional helper util scripts ├── src/ # Source code, top level is header-only API -├── src/backend # Implementation of example dynamic backend +├── src/front # Implementation of BSL frontend +├── src/dynamic # Implementation of dynamic backend +├── src/sample_pp # Implementation of the example policy provider +├── src/default_sc # Implementation of Default Security Contexts (RFC 9173) +├── src/cose_sc # Implementation of COSE Context +├── src/crypto # Implementation of BSL crypto library and key store interface ├── src/mock_bpa # Implementation of example Mock BPA -├── src/policy_provider # Implementation of the example policy provider -├── src/security_context # Implementation of RFC 9173 (Default Sec Context) -└── test/ # Unit tests +├── test/ # Unit tests +├── mock-bpa-test/ # Full BSL test/example using Mock BPA +└── lib-user-test/ # Test an installation of the BSL for building ``` ## Development Requirements -_Note!_ BSL uses **Red Hat Enterprise Linux (RHEL 9)** as the target build environment. Ubuntu is frequently used by developers, but not supported as an official target. +> [!NOTE] +> BSL uses **Red Hat Enterprise Linux (RHEL 9)** as the target build environment. +> Ubuntu is frequently used by developers, and for CI jobs, but not supported as an official target. The following should be installable by the system package manager: @@ -66,15 +69,17 @@ _Optional: To Construct Docs, etc..._ ## Building BSL -**Note.** `build.sh` is the BSL general build script, that mostly serves as a wrapper for CMake commands. Most actions to configure, build, and deploy BSL work through this script. -``` -# To view available subcommands +The top `build.sh` is the BSL general build script, that mostly serves as a wrapper for CMake commands. +Most actions to configure, build, and deploy BSL work through this script. + +To view available subcommands of the script: +```sh ./build.sh help ``` To clone submodules, build, and run the unit tests: -``` +```sh # Clone dependencies git submodule update --init --recursive @@ -93,14 +98,17 @@ git submodule update --init --recursive This will take about a minute to build and run the unit tests, there should be 100% success. -Note: On earlier versions of CMake (<3.20), `./build.sh check` target may not run correctly. +> [!NOTE] +> On earlier versions of CMake (<3.20), `./build.sh check` target may not run correctly. #### Optional Additional Build Targets Code Coverage -``` + +```sh ./build.sh coverage ``` + > [!NOTE] > The coverage target requires that the build prepare stage was run with the CLI flag `-DBUILD_COVERAGE=ON`: > ``` @@ -109,26 +117,43 @@ Code Coverage > For a full list of optional build flags, see [section 3.4.1 of the BSL product guide](https://nasa-ammos.github.io/BSL-docs/product-guide/html/index.html#sec-proc-build-devel-cmake). The output HTML can be opened in a browser using: -``` +```sh xdg-open build/default/coverage-html/index.html ``` Doxygen Documentation -``` +```sh ./build.sh prep -DBUILD_DOCS_API=ON ./build.sh docs ``` The output HTML can be opened in a browser using: -``` +```sh xdg-open build/default/docs/api/html/index.html ``` To check for misspelling in the Doxygen output use the following, substituting the word/phrase you are looking for in the grep command -``` +```sh xmlstarlet tr build/default/docs/api/xml/combine.xslt build/default/docs/api/xml/index.xml | xmlstarlet tr docs/api/spellcheck.xsl | cat -n | grep -E 'bsl' ``` +## Installing BSL + +After building, the BSL libraries, headers, and build support files (CMake and pkg-config) can be installed using: +```sh +./build.sh install +``` + +> [!NOTE] +> The default install script uses environment `DESTDIR=testroot` and `PREFIX=/usr` which installs files under `./testroot/usr/...` paths. +> This allows installing without special permissions on the host. +> Alternatively, the install can be used with different environment such as `DESTDIR=/` to install to system paths. + +After install, a trial executable which simply links against the installed BSL using pkg-config discovery can be tested using: +```sh +./build.sh check-install +``` + ## Testing with the Mock BPA The Mock BPA demonstrates how a BPA may interact with the BSL, it is found in `src/mock_bpa`. @@ -138,32 +163,32 @@ Details of the Mock BPA are found in the Doxygen documentation. #### Mock BPA System Test To execute the Mock BPA tests of the BSL libraries as-built, first prepare a Pythong virtualenv using: -``` +```sh python3 -m venv venv source venv/bin/activate pip install -r mock-bpa-test/requirements.txt ``` Then execute the test suite using: -``` +```sh python3 -m pytest mock-bpa-test --log-cli-level=info ``` ### Running with Wireshark and Local Sockets -``` +```sh wireshark -i lo -f 'port 4556 or port 24556' -k ``` Start the mock BPA with local sockets: -``` +```sh ./build.sh ./build.sh install ./build.sh run bsl-mock-bpa -u localhost:4556 -r localhost:14556 -o localhost:24556 -a localhost:34556 ``` Send a trial bundle from the underlayer, which is taken from Appendix A.1.4 of RFC 9173. -``` +```sh echo 9f88070000820282010282028202018202820201820018281a000f4240850b0200005856810101018202820201828201078203008181820158403bdc69b3a34a2b5d3a8554368bd1e808f606219d2a10a846eae3886ae4ecc83c4ee550fdfb1cc636b904e2f1a73e303dcd4b6ccece003e95e8164dcc89a156e185010100005823526561647920746f2067656e657261746520612033322d62797465207061796c6f6164ff | xxd -r -p | socat stdio udp-sendto:localhost:4556,pf=ip6,sourceport=14556 | xxd -p ``` Alternatively for the overlayer app socket use `socat stdio unix-sendto:/tmp/foo.sock` instead. From f37b13ef629c8469e90d0dc6cf7c40b2941830f6 Mon Sep 17 00:00:00 2001 From: Brian Sipos Date: Fri, 17 Jul 2026 12:17:04 -0400 Subject: [PATCH 07/13] More README touchup --- README.md | 19 ++++++++++++------- mock-bpa-test/README.md | 8 -------- 2 files changed, 12 insertions(+), 15 deletions(-) diff --git a/README.md b/README.md index cba0b7cd..0ab14804 100644 --- a/README.md +++ b/README.md @@ -22,8 +22,6 @@ subcontract 1700763. # The NASA AMMOS BPSec Library (BSL) -![example workflow](https://github.com/github/docs/actions/workflows/build-test.yml/badge.svg) - The BPSec Library (BSL) is an implementation of *Bundle Protocol Security* as specified in [RFC 9172](https://datatracker.ietf.org/doc/rfc9172/) and [RFC 9173](https://datatracker.ietf.org/doc/rfc9173/), with a flexible architecture enabling ready adaptability to flight or ground systems. The BSL exposes an interface via C header files (under `src`), and contains an example backend implementing this interface in `src/backend`. The BSL also contains an implementation of the Default Security Context (RFC 9173) under `src/security_context` and a sample policy provider under `src/policy_provider`. Together these form a complete the set of functionality required to execute Bundle Protocol Security. @@ -174,22 +172,29 @@ Then execute the test suite using: python3 -m pytest mock-bpa-test --log-cli-level=info ``` -### Running with Wireshark and Local Sockets +### Running with Wireshark and Local UDP transport + +The Mock BPA uses local UDP datagram transport. +This relies on the fact the the loopback device will have a large MTU to avoid the need for BP PDU segmentation. +The UDP ports can be monitored using stock Wireshark with the following command line: ```sh -wireshark -i lo -f 'port 4556 or port 24556' -k +wireshark -i lo -k \ + -f 'udp port 4556 or udp port 14556 or udp port 24556 or udp port 34556' \ + -d 'udp.port==14556,bundle' -d 'udp.port==24556,bundle' -d 'udp.port==34556,bundle' \ + -Y bpv7 ``` Start the mock BPA with local sockets: ```sh ./build.sh ./build.sh install -./build.sh run bsl-mock-bpa -u localhost:4556 -r localhost:14556 -o localhost:24556 -a localhost:34556 +./build.sh run \ + bsl-mock-bpa -u localhost:4556 -r localhost:14556 -o localhost:24556 -a localhost:34556 ``` Send a trial bundle from the underlayer, which is taken from Appendix A.1.4 of RFC 9173. ```sh echo 9f88070000820282010282028202018202820201820018281a000f4240850b0200005856810101018202820201828201078203008181820158403bdc69b3a34a2b5d3a8554368bd1e808f606219d2a10a846eae3886ae4ecc83c4ee550fdfb1cc636b904e2f1a73e303dcd4b6ccece003e95e8164dcc89a156e185010100005823526561647920746f2067656e657261746520612033322d62797465207061796c6f6164ff | xxd -r -p | socat stdio udp-sendto:localhost:4556,pf=ip6,sourceport=14556 | xxd -p ``` -Alternatively for the overlayer app socket use `socat stdio unix-sendto:/tmp/foo.sock` instead. - +Alternatively for the overlayer app socket use `socat stdio udp-sendto:localhost:24556,pf=ip6,sourceport=34556` instead. diff --git a/mock-bpa-test/README.md b/mock-bpa-test/README.md index b83bb00f..8742b8bf 100644 --- a/mock-bpa-test/README.md +++ b/mock-bpa-test/README.md @@ -23,11 +23,3 @@ subcontract 1700763. This directory contains a set of pytest-compatible test fixtures to exercise the Mock BPA. It will run using `./build.sh run` which will execute with a PATH environment preferring `./testroot/usr/bin` followed by system paths. This means it can test a local build as well as test the installed RPM packages. - -Tests can be logged using Wireshark similar to -```sh -wireshark -i lo -k \ - -f 'udp port 4556 or udp port 14556 or udp port 24556 or udp port 34556' \ - -d 'udp.port==14556,bundle' -d 'udp.port==24556,bundle' -d 'udp.port==34556,bundle' \ - -Y bpv7 -``` \ No newline at end of file From bdd7002686c85b8e70e1d5d8369218e00cdadf93 Mon Sep 17 00:00:00 2001 From: Brian Sipos Date: Fri, 17 Jul 2026 13:48:17 -0400 Subject: [PATCH 08/13] More README touchup --- README.md | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 0ab14804..6e7ade1e 100644 --- a/README.md +++ b/README.md @@ -195,6 +195,15 @@ Start the mock BPA with local sockets: Send a trial bundle from the underlayer, which is taken from Appendix A.1.4 of RFC 9173. ```sh -echo 9f88070000820282010282028202018202820201820018281a000f4240850b0200005856810101018202820201828201078203008181820158403bdc69b3a34a2b5d3a8554368bd1e808f606219d2a10a846eae3886ae4ecc83c4ee550fdfb1cc636b904e2f1a73e303dcd4b6ccece003e95e8164dcc89a156e185010100005823526561647920746f2067656e657261746520612033322d62797465207061796c6f6164ff | xxd -r -p | socat stdio udp-sendto:localhost:4556,pf=ip6,sourceport=14556 | xxd -p +echo 9f88070000820282010282028202018202820201820018281a000f4240850b0200005856810101018202820201828201078203008181820158403bdc69b3a34a2b5d3a8554368bd1e808f606219d2a10a846eae3886ae4ecc83c4ee550fdfb1cc636b904e2f1a73e303dcd4b6ccece003e95e8164dcc89a156e185010100005823526561647920746f2067656e657261746520612033322d62797465207061796c6f6164ff | \ + xxd -r -p | \ + socat stdio udp-sendto:localhost:4556,pf=ip6,sourceport=14556 | \ + xxd -p ``` +This example assumes that the `bsl-mock-bpa` resolves "localhost" to an IPv6 address (which is the default on RHEL-9), if not the socat can replace `pf=ip6` with `pf=ip4` to force IPv4 use. + Alternatively for the overlayer app socket use `socat stdio udp-sendto:localhost:24556,pf=ip6,sourceport=34556` instead. + +> [!NOTE] +> The output can be observed as CBOR extended diagnostic notation (EDN) using a CLI tool such as [cbor-diag](https://github.com/cabo/cbor-diag) by replacing `xxd -p` with `cbor2diag.rb`. +> Similarly, the input can be provided in EDN by piping through `diag2cbor.rb` instead of hex piped through `xxd -r -p`. From 9dbb154500cc49205b19ed9eeed9e668741c6233 Mon Sep 17 00:00:00 2001 From: Brian Sipos Date: Sat, 18 Jul 2026 15:08:30 -0400 Subject: [PATCH 09/13] m-lib is included in cose_sc header --- src/CMakeLists.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt index 4e028d6e..56deaeab 100644 --- a/src/CMakeLists.txt +++ b/src/CMakeLists.txt @@ -137,7 +137,7 @@ set_target_properties(bsl_cose_sc target_link_libraries(bsl_cose_sc PUBLIC bsl_front) target_link_libraries(bsl_cose_sc PUBLIC bsl_dynamic) # for CBOR API target_link_libraries(bsl_cose_sc PRIVATE bsl_crypto) -target_link_libraries(bsl_cose_sc PRIVATE MLIB::mlib) +target_link_libraries(bsl_cose_sc PUBLIC MLIB::mlib) target_link_libraries(bsl_cose_sc PRIVATE qcbor::qcbor) # Example Policy Provider library From 80d06d15ebb35b683e57a4fb17cc50edc9581f57 Mon Sep 17 00:00:00 2001 From: Brian Sipos Date: Sat, 18 Jul 2026 15:08:59 -0400 Subject: [PATCH 10/13] m-lib is included in cose_sc header --- pkg/bsl-cose-sc.pc.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/bsl-cose-sc.pc.in b/pkg/bsl-cose-sc.pc.in index e03e432c..5e91db74 100644 --- a/pkg/bsl-cose-sc.pc.in +++ b/pkg/bsl-cose-sc.pc.in @@ -5,6 +5,6 @@ libdir=${prefix}/@CMAKE_INSTALL_LIBDIR@ Name: bsl-cose-sc Description: BSL COSE Context provider Version: @PROJECT_VERSION@ -Requires: bsl +Requires: bsl, m-lib Cflags: -I${includedir} Libs: -L${libdir} -lbsl_cose_sc From d0ea30aa2e56c30901c3d9a5750a29adf9f80bc4 Mon Sep 17 00:00:00 2001 From: Brian Sipos Date: Mon, 20 Jul 2026 20:21:09 -0400 Subject: [PATCH 11/13] Fixing typo Also passing options to apply-license --- build.sh | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/build.sh b/build.sh index d121e76a..e2701784 100755 --- a/build.sh +++ b/build.sh @@ -58,11 +58,12 @@ function cmd_check_format { function cmd_apply_format { shift - exec ./resources/apply_format. "$@" + exec ./resources/apply_format.sh "$@" } function cmd_apply_license { - exec ./resources/apply_license.sh + shift + exec ./resources/apply_license.sh "$@" } function cmd_check { @@ -216,7 +217,7 @@ case "$1" in cmd_apply_format "$@" ;; apply-license) - cmd_apply_license + cmd_apply_license "$@" ;; check) cmd_check "$@" From 4c6dbfc4ea27b42e092db214230a72941dd2cf3e Mon Sep 17 00:00:00 2001 From: Brian Sipos Date: Mon, 20 Jul 2026 20:22:21 -0400 Subject: [PATCH 12/13] Remove outdated note --- README.md | 3 --- 1 file changed, 3 deletions(-) diff --git a/README.md b/README.md index 6e7ade1e..86aa9f01 100644 --- a/README.md +++ b/README.md @@ -96,9 +96,6 @@ git submodule update --init --recursive This will take about a minute to build and run the unit tests, there should be 100% success. -> [!NOTE] -> On earlier versions of CMake (<3.20), `./build.sh check` target may not run correctly. - #### Optional Additional Build Targets Code Coverage From 0a1a9ffa6aac98698c076b35d45118c91a2a73ce Mon Sep 17 00:00:00 2001 From: Brian Sipos Date: Mon, 20 Jul 2026 20:24:06 -0400 Subject: [PATCH 13/13] Update README.md for dependency corrections --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 86aa9f01..7dc5c292 100644 --- a/README.md +++ b/README.md @@ -60,10 +60,10 @@ BSL/ The following should be installable by the system package manager: _Required: Build and Run Unit Tests_ - * CMake, GCC or Clang, OpenSSL (Development), Ninja Build, Valgrind, Memcheck, Ruby, jansson-devel. + * CMake, GCC or Clang, OpenSSL (development), Ninja Build, Valgrind, Memcheck, Ruby, Jansson (development). _Optional: To Construct Docs, etc..._ - * Doxygen, gcovr (as Python package), graphviz, plantuml, texlive-bibtex, asciidoctor. + * Doxygen, gcovr (as Python package), pkg-config tool, graphviz, plantuml, texlive-bibtex, asciidoctor. ## Building BSL