openharmony/tee_tee_dev_kit
1
0
Fork 0
mirror of https://github.com/openharmony/tee_tee_dev_kit.git synced 2026-08-25 09:09:44 -04:00
Code Issues Packages Projects Releases Wiki Activity

merge master into master

Browse Source 
更新readme

Created-by: suwanghw
Commit-by: suwanghw
Merged-by: openharmony_ci
Description: 更新readme

See merge request: openharmony-sig/tee_tee_dev_kit!88
This commit is contained in:
openharmony_ci
2025-03-28 14:41:29 +08:00
parent 1a0514447c a134cb0405
commit 497c8feba6
4 changed files with 237 additions and 210 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+120 -10
View File
@@ -1,15 +1,125 @@
# tee_dev_kit module introduction<a name="EN-US_TOPIC_0000001078530726"></a>
- [Introduction](#section469617221261)
- [tee_dev_kit engineering framework](#section15884114210197)
# tee_tee_dev_kit #
## Introduction<a name="section469617221261"></a>
-[Terminology] (# section11660541592)
-[Introduction] (# section11660541593)
-[Table of Contents] (# section161941989596)
-[Instructions] (# section161941989597)
-[Tool Dependency] (# section11914418405)
-[Using Constraints] (# section1371113476307)
-[Related Dependency Warehouse] (# section1371113476308)
The tee_dev_kit component provides SDK capabilities. The SDK capabilities include: TA compilation dependent scripts, header files, TA's ability to issue certificates and sign perm_config signatures, and sec file signatures.
## Terminology ##
## tee_dev_kit engineering framework<a name="section15884114210197"></a>
| Abbreviations | English | Chinese|
| ------ | ----------------------------- | ------------ |
| TEE | Trusted Execution Environment | Trusted Execution Environment|
| TA | Trusted Application | Trusted Application|
| SDK | Software Development Kit | Software Development Kit|
- README.md：English guidance document.
- README_zh.md：Chinese guidance document.
- sdk：The sdk package capabilities in tee os, the detailed sdk capabilities are introduced in the README.md and README_zh.md files in the sdk directory.
- bundle.json: tee_dev_kit component description file.
## Introduction ##
The TEE SDK development kit supports independent development of TA, including TA dependent header files, compilation frameworks, signature scripts, etc.
##Table of Contents<a name="section161941989596"></a>
The directory structure of TEE SDK is as follows:
```
├── sdk/build
│ ├── ld
│ ├── mk
│ ├── signkey
│ └── tools
├── sysroot
│ └── usr
| └── include
├── sdk/src
│ └── TA
| └── sample
├── thirdparty
│ └── open_source
│ └── import_open_source_header.sh
└── CHANGELOG
```
##Instructions for use<a name="section161941989597"></a>
Developers need to do some preparation work before using the TEE SDK development kit to develop TA.
###Configure the compilation toolchain
The compilation toolchain used by TEE is LLVM, which is consistent with OpenHarmony. Developers need to download the OpenHarmony compilation toolchain first.
First choice to download OpenHarmony [build code repository]（ https://gitee.com/openharmony/build )
```
git clone git@gitee.com : openharmony/build.git
```
Then execute the download script in the repository
```
./build/prebuilts_download.sh
```
After downloading, it is necessary to declare the path of the LLVM compilation toolchain in the current compilation environment. The compilation toolchain path can be declared using the following command:
```
export PATH=openharmony/prebuilts/clang/ohos/linux-x86_64/15.0.4/llvm/bin:$PATH
```
This command is only an example, developers need to specify the correct compilation toolchain path.
###Import third-party header files
TEE integrates the Musl library and security function library, which TA can use. The TEE SDK does not include header files for the musl library and security function library by default, but provides import scripts. Developers need to download the [musl library] first（ https://gitee.com/openharmony/third_party_musl ）And [Security Function Library]（ https://gitee.com/openharmony/third_party_bounds_checking_function ）Source code repository:
```
git clone git@gitee.com : openharmony/third_party_musl.git
git clone git@gitee.com : openharmony/third_party_bounds_checking_function.git
```
Then execute
```
./tee_dev_kit/sdk/thirdparty/open_source/import_open_source_header.sh
```
Import the musl header file and security function library header file from the source code repository into the TEE SDK.
###Replace TA signature and verification key
The TEE SDK has a preset private key for signing TA files, which can only be used for debugging. In the commercial version, developers need to replace this private key themselves. The private key path: tee_dev_kit/sdk/build/signkey/ta_sign_priv_key.pem。 At the same time, it provides the scripts tee_dev-kit/sdk/build/signkey/ta-sign_algonfig.ini, which can be used to configure the signature algorithm. The default signature algorithm is RSA, with a key length of 4096 bits.
If the developer replaces the signature private key in the TEE SDK, they need to correspondingly replace the signature verification public key in the OpenTrustee operating system. The path of the signature verification public key is:/ base/tee/tee_os_framework/lib/syslib/libelf_verify_key/src/common/ta_verify_key.c。
##Tool Dependency<a name="section11914418405"></a>
The TEE SDK uses Python scripts to parse TA's property configuration files, sign TA files, and perform other operations, so Python tools need to be installed in the development environment.
1. Install Python 3 and above versions
2. Install Python related libraries, such as:
```
pip install pycryptodome
pip install defusedxml
```
If there is a prompt during the compilation process that other Python libraries are missing, they need to be installed together.
##Use constraint<a name="section1371113476307"></a>
-Supported development language: C language
-SDK runtime environment: Linux operating system
-No code editor provided
##Related Dependency Warehouse<a name="section1371113476308"></a>
[OpenHarmony/build]( https://gitee.com/openharmony/build )
[OpenHarmony/third_party/musl]( https://gitee.com/openharmony/third_party_musl )
[OpenHarmony/third_party/bounds_checking_function]( https://gitee.com/openharmony/third_party_bounds_checking_function )
README_zh.md
+117 -10
View File
@@ -1,18 +1,125 @@
# TEE开发套件
## 简介
TEE开发套件支持独立开发TA（安全应用），包含了TA依赖的头文件、编译框架、签名脚本等。
# tee_tee_dev_kit仓库说明 <a name="ZH-CN_TOPIC_0000001078026808"></a>
## 目录
- [术语](#section11660541592)
- [简介](#section11660541593)
- [目录](#section161941989596)
- [使用说明](#section161941989597)
- [工具依赖](#section11914418405)
- [使用约束](#section1371113476307)
- [相关依赖仓](#section1371113476308)
## 术语<a name="section11660541592"></a>
| 缩略语 | 英文 | 中文 |
| ------ | ----------------------------- | ------------ |
| TEE | Trusted Execution Environment | 可信执行环境 |
| TA | Trusted Application | 可信应用 |
| SDK | Software Development Kit | 软件开发包 |
## 简介<a name="section11660541593"></a>
tee_tee_dev_kit仓库主要包含TEE SDK开发套件，支持独立开发TA，包含了TA依赖的头文件、编译框架、签名脚本等。
## 目录<a name="section161941989596"></a>
TEE SDK目录结构如下：
```
/base/tee/tee_dev_kit
├── sdk # TA开发套件
├── version # TEE版本号
├── CHANGELOG.md # TEE版本变更记录
├── sdk/build
│ ├── ld # 生成TA ELF文件的链接脚本
│ ├── mk # TA make编译框架
│ ├── signkey # TA签名用的私钥
│ └── tools # 生成TA安装包并对TA签名的脚本
├── sysroot
│ └── usr
| └── include # 给TA提供的TEE头文件
├── sdk/src
│ └── TA # 放置TA源码
| └── sample # TA示例代码
├── thirdparty
│ └── open_source
│ └── import_open_source_header.sh # 导入TA编译依赖的musl头文件和安全函数库头文件
└── CHANGELOG # SDK包版本发布记录
```
## 使用说明
## 使用说明<a name="section161941989597"></a>
详见sdk目录下README文档。
开发者在使用TEE SDK开发套件开发TA之前，需要进行一些准备工作。
### 配置编译工具链
TEE使用的编译工具链为llvm，与OpenHarmony一致，开发者需要先下载OpenHarmony编译工具链。
首选下载OpenHarmony [build代码仓](https://gitee.com/openharmony/build)
```
git clone git@gitee.com:openharmony/build.git
```
然后执行该仓中的下载脚本
```
./build/prebuilts_download.sh
```
下载完成后，需要在当前编译环境中声明llvm编译工具链的路径。可通过如下命令声明编译工具链路径：
```
export PATH=openharmony/prebuilts/clang/ohos/linux-x86_64/15.0.4/llvm/bin:$PATH
```
该命令仅是示例，开发者需要指定正确的编译工具链路径。
### 导入第三方头文件
TEE集成了musl库和安全函数库，TA可以使用这些库。TEE SDK并没有默认包含musl库和安全函数库的头文件，但是提供了导入的脚本。 开发者需要先下载[musl库](https://gitee.com/openharmony/third_party_musl)和[安全函数库](https://gitee.com/openharmony/third_party_bounds_checking_function)源码仓：
```
git clone git@gitee.com:openharmony/third_party_musl.git
git clone git@gitee.com:openharmony/third_party_bounds_checking_function.git
```
然后执行
```
./tee_dev_kit/sdk/thirdparty/open_source/import_open_source_header.sh
```
将musl头文件和安全函数库头文件从源码仓导入到TEE SDK中。
### 替换TA签名和验签密钥
TEE SDK中预置了对TA文件进行签名的私钥，该预置私钥只能用来调试，在商用版本中，开发者需要自行替换该私钥。该私钥路径：tee_dev_kit/sdk/build/signkey/ta_sign_priv_key.pem。同时提供了tee_dev_kit/sdk/build/signkey/ta_sign_algo_config.ini脚本，可以用来对签名算法进行配置。默认的签名算法是RSA，密钥长度4096bit。
如果开发者替换了TEE SDK中的签名私钥，需要对应替换OpenTrustee操作系统中的验签公钥，验签公钥的路径：/base/tee/tee_os_framework/lib/syslib/libelf_verify_key/src/common/ta_verify_key.c。
## 工具依赖<a name="section11914418405"></a>
TEE SDK中用到了python脚本来完成TA的属性配置文件解析、对TA文件进行签名等操作，因此需要在开发环境上安装python工具。
1、安装python3及以上版本
2、安装python相关的库，如：
```
pip install pycryptodome
pip install defusedxml
```
如果在编译过程中提示缺少其他python库，需要一并安装。
## 使用约束<a name="section1371113476307"></a>
- 支持开发语言：C语言
- SDK运行环境：linux操作系统
- 未提供代码编辑器
## 相关依赖仓<a name="section1371113476308"></a>
[OpenHarmony/build](https://gitee.com/openharmony/build)
[OpenHarmony/third_party/musl](https://gitee.com/openharmony/third_party_musl)
[OpenHarmony/third_party/bounds_checking_function](https://gitee.com/openharmony/third_party_bounds_checking_function)
sdk/README.md
-66
View File
@@ -1,66 +0,0 @@
# Introduction to sdk capabilities <a name="EN-US_TOPIC_0000001078026808"></a>
- [Introduction](#section11660541593)
- [Content](#section161941989596)
- [Software Installation](#section11914418405)
- [Relevant dependency warehouse](#section1371113476307)
## Introduction <a name="section11660541593"></a>
The SDK capabilities include: TA compilation dependent scripts and header files, TA's ability to issue certificates and sign perm_config signatures, and TA symbol checker, sec file signatures.
## Content <a name="section161941989596"></a>
The warehouse directory structure is as follows:
```
├── build
│   ├── cmake # cmake compile framework capabilities
│   ├── config_tee_private_sample.ini # sec signed and perm_config signed python ini configuration file
│   ├── keytools # ta certificate issuance, and release type perm_config signature and non-interoperable sec file signature capabilities
│   ├── mk # make compile framework capabilities
│   ├── pack-Config # Signature packaging perm_config capability
│   ├── pack-TA # sec signature capability shell script
│   ├── signtools # sec signature capability python script and check TA undefined symbols.
│   └── tools # ld file (32-bit and 64-bit) linked by sec file, sec file binary check shell script
├── CHANGELOG # Changelog of sdk version.
├── include
│   ├── CA # CA compilation dependent header files
│   └── TA # TA compile dependent header files
├── README.md # English description file of sdk package
├── README_zh.md # Chinese description file of sdk package
├── src
│   └── TA # TA compilation depends on ta_magic.c. When the 32-bit TA includes this definition, you can control the TA to use the tarunner loader to load, otherwise the 32-bit TA uses the taloader loader; 64-bit TA is not involved, and the 64-bit TA uses the tarunner loader.
├── test
│   ├── CA
│   │   ├── aes_demo # CA sample corresponding to TA-aes_demo
│   │   ├── helloworld # CA sample corresponding to TA-helloworld
│   │   ├── mac_demo # CA sample corresponding to TA-mac_demo
│   │   ├── rsa_demo # CA sample corresponding to TA-rsa_demo
│   │   └── secstorage_demo # CA sample corresponding to TA-secstorage_demo
│   └── TA
│   ├── aes_demo # TA uses AES-CBC and AES-GCM algorithms to encrypt and decrypt demo
│   ├── helloworld # Simple CA2TA communication demo
│   ├── mac_demo # TA uses AES-CBC-MAC and AES-CMAC algorithms for message digest calculation demo
│   ├── rsa_demo # TA uses RSA algorithm for encryption and decryption and signature verification demo
│   └── secstorage_demo # TA stores file demo with secure storage capability
├── thirdparty
│   └── open_source
│   ├── libboundscheck # TA compilation depends on the security function library header file archive path
│   └── musl # TA compile dependent libc header files archive path
└── VERSION # SDK package software version number
```
## Software Installation <a name="section11914418405"></a>
Note that this kit can only be used on the linux server and cannot be used on the windows side. And depends on the following software:
1. Install python3 software;
2. Install the pycryptodomex library of python3
3. Export the musl and bounds_checking_function header files, and follow the md instructions under thirdparty\open_source\bounds_checking_function and thirdparty\open_source\musl.
## Relevant dependency warehouse<a name="section1371113476307"></a>
[third_party/bounds_checking_function](https://gitee.com/openharmony/third_party_bounds_checking_function)
[third_party/musl](https://gitee.com/openharmony/third_party_musl)
sdk/README_zh.md
-124
View File
@@ -1,124 +0,0 @@
# TEE SDK开发套件<a name="ZH-CN_TOPIC_0000001078026808"></a>
- [术语](#section11660541592)
- [简介](#section11660541593)
- [目录](#section161941989596)
- [使用说明](#section161941989597)
- [工具依赖](#section11914418405)
- [使用约束](#section1371113476307)
- [相关依赖仓](#section1371113476308)
## 术语<a name="section11660541592"></a>
| 缩略语 | 英文 | 中文 |
| ------ | ----------------------------- | ------------ |
| TEE | Trusted Execution Environment | 可信执行环境 |
| TA | Trusted Application | 可信应用 |
| SDK | Software Development Kit | 软件开发包 |
## 简介<a name="section11660541593"></a>
TEE SDK开发套件支持独立开发TA，包含了TA依赖的头文件、编译框架、签名脚本等。
## 目录<a name="section161941989596"></a>
TEE SDK目录结构如下：
```
├── build
│ ├── ld # 生成TA ELF文件的链接脚本
│ ├── mk # TA make编译框架
│ ├── signkey # TA签名用的私钥
│ └── tools # 生成TA安装包并对TA签名的脚本
├── include
│ └── TA # 给TA提供的TEE头文件
├── src
│ └── TA # 放置TA源码
└── sample # TA示例代码
├── thirdparty
│ └── open_source
│ └── import_open_source_header.sh # 导入TA编译依赖的musl头文件和安全函数库头文件
└── CHANGELOG # SDK包版本发布记录
```
## 使用说明<a name="section161941989597"></a>
开发者在使用TEE SDK开发套件开发TA之前，需要进行一些准备工作。
### 配置编译工具链
TEE使用的编译工具链为llvm，与OpenHarmony一致，开发者需要先下载OpenHarmony编译工具链。
首选下载OpenHarmony [build代码仓](https://gitee.com/openharmony/build)
```
git clone git@gitee.com:openharmony/build.git
```
然后执行该仓中的下载脚本
```
./build/prebuilts_download.sh
```
下载完成后，需要在当前编译环境中声明llvm编译工具链的路径。可通过如下命令声明编译工具链路径：
```
export PATH=openharmony/prebuilts/clang/ohos/linux-x86_64/15.0.4/llvm/bin:$PATH
```
该命令仅是示例，开发者需要指定正确的编译工具链路径。
### 导入第三方头文件
TEE集成了musl库和安全函数库，TA可以使用这些库。TEE SDK并没有默认包含musl库和安全函数库的头文件，但是提供了导入的脚本。 开发者需要先下载[musl库](https://gitee.com/openharmony/third_party_musl)和[安全函数库](https://gitee.com/openharmony/third_party_bounds_checking_function)源码仓：
```
git clone git@gitee.com:openharmony/third_party_musl.git
git clone git@gitee.com:openharmony/third_party_bounds_checking_function.git
```
然后执行
```
./tee_dev_kit/sdk/thirdparty/open_source/import_open_source_header.sh
```
将musl头文件和安全函数库头文件从源码仓导入到TEE SDK中。
### 替换TA签名和验签密钥
TEE SDK中预置了对TA文件进行签名的私钥，该预置私钥只能用来调试，在商用版本中，开发者需要自行替换该私钥。该私钥路径：tee_dev_kit/sdk/build/signkey/ta_sign_priv_key.pem。同时提供了tee_dev_kit/sdk/build/signkey/ta_sign_algo_config.ini脚本，可以用来对签名算法进行配置。默认的签名算法是RSA，密钥长度4096bit。
如果开发者替换了TEE SDK中的签名私钥，需要对应替换OpenTrustee操作系统中的验签公钥，验签公钥的路径：/base/tee/tee_os_framework/lib/syslib/libelf_verify_key/src/common/ta_verify_key.c。
## 工具依赖<a name="section11914418405"></a>
TEE SDK中用到了python脚本来完成TA的属性配置文件解析、对TA文件进行签名等操作，因此需要在开发环境上安装python工具。
1、安装python3及以上版本
2、安装python相关的库，如：
```
pip install pycryptodome
pip install defusedxml
```
如果在编译过程中提示缺少其他python库，需要一并安装。
## 使用约束<a name="section1371113476307"></a>
- 支持开发语言：C语言
- SDK运行环境：linux操作系统
- 未提供代码编辑器
## 相关依赖仓<a name="section1371113476308"></a>
[OpenHarmony/build](https://gitee.com/openharmony/build)
[OpenHarmony/third_party/musl](https://gitee.com/openharmony/third_party_musl)
[OpenHarmony/third_party/bounds_checking_function](https://gitee.com/openharmony/third_party_bounds_checking_function)