libcamera: Make IPA module signing optional

The IPA module signing mechanism relies on openssl to generate keys and
sign the module. If openssl is not found on the system, the build will
fail. Make the dependency optional by detecting openssl, and skip
generation of signatures if openssl isn't found.

Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>

src/ipa/rkisp1/meson.build

@@ -9,9 +9,11 @@ mod = shared_module(ipa_name,
                     install : true,
                     install_dir : ipa_install_dir)
 
+if ipa_sign_module
     custom_target(ipa_name + '.so.sign',
                   input : mod,
                   output : ipa_name + '.so.sign',
                   command : [ ipa_sign, ipa_priv_key, '@INPUT@', '@OUTPUT@' ],
                   install : true,
                   install_dir : ipa_install_dir)
+endif

src/ipa/vimc/meson.build

@@ -9,9 +9,11 @@ mod = shared_module(ipa_name,
                     install : true,
                     install_dir : ipa_install_dir)
 
+if ipa_sign_module
     custom_target(ipa_name + '.so.sign',
                   input : mod,
                   output : ipa_name + '.so.sign',
                   command : [ ipa_sign, ipa_priv_key, '@INPUT@', '@OUTPUT@' ],
                   install : true,
                   install_dir : ipa_install_dir)
+endif

src/libcamera/include/ipa_manager.h

@@ -40,8 +40,10 @@ private:
 
 	bool isSignatureValid(IPAModule *ipa) const;
 
+#if HAVE_IPA_PUBKEY
 	static const uint8_t publicKeyData_[];
 	static const PubKey pubKey_;
+#endif
 };
 
 } /* namespace libcamera */

src/libcamera/ipa_manager.cpp

@@ -304,6 +304,7 @@ std::unique_ptr<IPAInterface> IPAManager::createIPA(PipelineHandler *pipe,
 
 bool IPAManager::isSignatureValid(IPAModule *ipa) const
 {
+#if HAVE_IPA_PUBKEY
 	File file{ ipa->path() };
 	if (!file.open(File::ReadOnly))
 		return false;
@@ -319,6 +320,9 @@ bool IPAManager::isSignatureValid(IPAModule *ipa) const
 		<< (valid ? "valid" : "not valid");
 
 	return valid;
+#else
+	return false;
+#endif
 }
 
 } /* namespace libcamera */

src/libcamera/ipa_pub_key.cpp.in

@@ -2,7 +2,7 @@
 /*
  * Copyright (C) 2020, Laurent Pinchart <laurent.pinchart@ideasonboard.com>
  *
- * ipa_key.cpp - IPA module signing public key
+ * ipa_pub_key.cpp - IPA module signing public key
  *
  * This file is auto-generated. Do not edit.
  */
@@ -11,10 +11,12 @@
 
 namespace libcamera {
 
+#if HAVE_IPA_PUBKEY
 const uint8_t IPAManager::publicKeyData_[] = {
 	${ipa_key}
 };
 
 const PubKey IPAManager::pubKey_{ { IPAManager::publicKeyData_ } };
+#endif
 
 } /* namespace libcamera */

src/libcamera/meson.build

@@ -101,6 +101,7 @@ version_cpp = vcs_tag(command : [gen_version, meson.build_root()],
 
 libcamera_sources += version_cpp
 
+if ipa_sign_module
     gen_ipa_pub_key = files('gen-ipa-pub-key.py')
     ipa_pub_key_cpp = custom_target('ipa_pub_key_cpp',
                                     input : [ ipa_priv_key, 'ipa_pub_key.cpp.in' ],
@@ -108,6 +109,7 @@ ipa_pub_key_cpp = custom_target('ipa_pub_key_cpp',
                                     command : [ gen_ipa_pub_key, '@INPUT@', '@OUTPUT@' ])
 
     libcamera_sources += ipa_pub_key_cpp
+endif
 
 libcamera_deps = [
     libatomic,

src/meson.build

@@ -2,10 +2,17 @@ if get_option('android')
     subdir('android')
 endif
 
+openssl = find_program('openssl', required : false)
+if openssl.found()
     ipa_gen_priv_key = find_program('ipa/gen-ipa-priv-key.sh')
     ipa_priv_key = custom_target('ipa-priv-key',
                                  output : [ 'ipa-priv-key.pem' ],
                                  command : [ ipa_gen_priv_key, '@OUTPUT@' ])
+    config_h.set('HAVE_IPA_PUBKEY', 1)
+    ipa_sign_module = true
+else
+    ipa_sign_module = false
+endif
 
 subdir('libcamera')
 subdir('ipa')