makefiles/suit: make use of SUIT_SEC_PASSWORD optional

[benpicco]

Contribution description

Specifying the password of the SUIT private key on the command line and thereby committing it to shell history is a security issue.

Instead ask for the password interactively when an encrypted private key is used.

Testing procedure

if you don't have an encrypted SUIT key, create one first

$ make -C examples/suit_update SUIT_KEY=supersecret 
make: Entering directory '/home/benpicco/dev/RIOT/examples/suit_update'
Building application "suit_update" for "samr21-xpro" with CPU "samd21".

suit: generating key in /home/benpicco/.local/share/RIOT/keys
0) none
1) aes-256-cbc
Choose encryption for key file /home/benpicco/.local/share/RIOT/keys/supersecret.pem: 1
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:

sign a manifest with the new key

$ make -C examples/suit_update SUIT_KEY=supersecret suit/publish
make: Entering directory '/home/benpicco/dev/RIOT/examples/suit_update'
compiling /home/benpicco/dev/RIOT/dist/tools/riotboot_gen_hdr/bin/genhdr...
…
creating /home/benpicco/dev/RIOT/examples/suit_update/bin/samr21-xpro/riotboot_files/slot0.1726218363.bin...
creating /home/benpicco/dev/RIOT/examples/suit_update/bin/samr21-xpro/riotboot_files/slot1.1726218363.bin...

Enter encryption for key file /home/benpicco/.local/share/RIOT/keys/supersecret.pem: testtest

published "/home/benpicco/dev/RIOT/examples/suit_update/bin/samr21-xpro/suit_files/riot.suit.1726218363.bin"
       as "coap://localhost/fw/suit_update/samr21-xpro/riot.suit.1726218363.bin"
published "/home/benpicco/dev/RIOT/examples/suit_update/bin/samr21-xpro/suit_files/riot.suit.latest.bin"
       as "coap://localhost/fw/suit_update/samr21-xpro/riot.suit.latest.bin"
published "/home/benpicco/dev/RIOT/examples/suit_update/bin/samr21-xpro/riotboot_files/slot0.1726218363.bin"
       as "coap://localhost/fw/suit_update/samr21-xpro/slot0.1726218363.bin"
published "/home/benpicco/dev/RIOT/examples/suit_update/bin/samr21-xpro/riotboot_files/slot1.1726218363.bin"
       as "coap://localhost/fw/suit_update/samr21-xpro/slot1.1726218363

Issues/PRs references

[riot-ci]

Murdock results

✔️ PASSED

50e3d61 makefiles/suit: allow to decrypt signing key with SUIT_SEC_PASSWORD

Success	Failures	Total	Runtime
10197	0	10197	17m:27s

Artifacts

• Documentation preview

[kfessel]

How will this work in an CI / automatic build?

[Teufelchen1]

I am with @kfessel / passing through ENV should be possible. It also bothers me that beside the change of behavior / usage, there is no adjustment to the documentation or a tutorial. We have that documented somewhere, do we? 😰😱

[benpicco]

We have that documented somewhere, do we? 😰😱

SUIT_SEC_PASSWORD is neither documented nor used in CI
(If you have an automated build that automatically decrypts the key by storing the password somewhere in cleartext, then what's the point of encrypting the key?)

[kfessel]

Aren't there ci tools that provide a separate storage for password that are used in the build process and ingested through environment - but they probably are all providing a file-storage as well which is as easy to handle

If there is a buildsystem that just supports the first option or you want someone to not just be able to copy the keyfile (keyfiles might be floating around somwhere) with a seperate password ( in a "secure" ci env storage) you at least add a little extra barrier to just copy the file.

of cause no one should put their buildkeypassword int the make command line that would be crazy to do

[benpicco]

I re-added the possibility to use SUIT_SEC_PASSWORD so CI that injects the password into the build environment keeps working.

[maribu]

Code looks good and I trust your testing