Some work on swtpm_cert

[stefanberger]

This series of patches allows passing of passwords to swtpm_cert using environment variables, converts the parsing of command line options to use getopt_long_only and allow certificate serial numbers with larger values (up to 64bit).

[coveralls]

Pull Request Test Coverage Report for Build 1761

• 80 of 105 (76.19%) changed or added relevant lines in 1 file are covered.
• 1 unchanged line in 1 file lost coverage.
• Overall coverage increased (+0.02%) to 72.869%

---

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
src/swtpm_cert/ek-cert.c	80	105	76.19%

Files with Coverage Reduction	New Missed Lines	%
src/swtpm_cert/ek-cert.c	1	74.77%

Totals
Change from base Build 1742:	0.02%
Covered Lines:	3497
Relevant Lines:	4799

---

💛 - Coveralls

[elmarco]

Passing secrets via environment variable isn't ideal. We should use fd, like existing pwdfd

[stefanberger]

Passing secrets via environment variable isn't ideal. We should use fd, like existing pwdfd

I primarily did this to accommodate the invocation via shell scripts , but I agree, we should have this as well. Another option to try for the shell script would be to pass it via file and then use this construct here:

function test() { echo $@; }
test <(echo -n "test")

Output: /dev/fd/63 (NetBSD, Linux, Cygwin, Apple, OpenBSD
Output: /tmp//sh-np.CVMkwU (named pipe): Dragonfly, FreeBSD, 

Besides this, I think it may be good to avoid introducing too many new command line options. So passing it via something like this here may be good too:

--signkey-password: <password>
--signkey-password: fd:<fd>
--signkey-password: file:<filename>
--signkey-password: password:<password>

[elmarco]

--signkey-password: <password>
--signkey-password: fd:<fd>
--signkey-password: file:<filename>
--signkey-password: password:<password>

Looks ok, although not consistent with swtpm command line options. Although unlikely, this may also break existing users, perhaps add --signkey-pass/pwd ?

[stefanberger]

@elmarco Thanks for the suggestion. Pushed an updated.

[stefanberger]

Also added support for --print-capabilities to swtpm_cert.

[elmarco]

looks ok to me