[PATCH 3/6] binman: x509: fix CN emitted for basic x509 certificates

[Rasmus Villemoes]

I'm pretty sure it was never the intention to emit the output
filename (cert_fname) as the value of the CN distinguished name.

The cert-ca property was parsed from the dts node, stored in
._cert_ca, passed on as the cn argument to x509_cert(), but then not
used at all.

Now that we always read a distinguished-name subnode if present, use
that method instead.

Signed-off-by: Rasmus Villemoes <ravi at prevas.dk>
---
 tools/binman/btool/openssl.py            | 7 +++----
 tools/binman/etype/x509_cert.py          | 3 +--
 tools/binman/test/security/x509_cert.dts | 5 ++++-
 3 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/tools/binman/btool/openssl.py b/tools/binman/btool/openssl.py
index 370760ccaa5..7ad1d7a1aaa 100644
--- a/tools/binman/btool/openssl.py
+++ b/tools/binman/btool/openssl.py
@@ -44,8 +44,8 @@ class Bintoolopenssl(bintool.Bintool):
             s += f'{field:22s} = {value}\n'
         return s
 
-    def x509_cert(self, cert_fname, input_fname, key_fname, cn, revision,
-                  config_fname):
+    def x509_cert(self, cert_fname, input_fname, key_fname, req_dist_name_dict,
+                  revision, config_fname):
         """Create a certificate
 
         Args:
@@ -68,8 +68,7 @@ x509_extensions        = v3_ca
 prompt                 = no
 dirstring_type         = nobmp
 
-[ req_distinguished_name ]
-CN                     = {cert_fname}
+{self.dict_to_config_section('req_distinguished_name', req_dist_name_dict)}
 
 [ v3_ca ]
 basicConstraints       = CA:true
diff --git a/tools/binman/etype/x509_cert.py b/tools/binman/etype/x509_cert.py
index ee4c74db6f9..e072414a714 100644
--- a/tools/binman/etype/x509_cert.py
+++ b/tools/binman/etype/x509_cert.py
@@ -56,7 +56,6 @@ class Entry_x509_cert(Entry_collection):
 
     def ReadNode(self):
         super().ReadNode()
-        self._cert_ca = fdt_util.GetString(self._node, 'cert-ca')
         self._cert_rev = fdt_util.GetInt(self._node, 'cert-revision-int', 0)
         self.key_fname = self.GetEntryArgsOrProps([
             EntryArg('keyfile', str)], required=True)[0]
@@ -96,7 +95,7 @@ class Entry_x509_cert(Entry_collection):
                 cert_fname=output_fname,
                 input_fname=input_fname,
                 key_fname=self.key_fname,
-                cn=self._cert_ca,
+                req_dist_name_dict=self.req_dist_name,
                 revision=self._cert_rev,
                 config_fname=config_fname)
         elif type == 'sysfw':
diff --git a/tools/binman/test/security/x509_cert.dts b/tools/binman/test/security/x509_cert.dts
index 71238172717..ded0c2013c2 100644
--- a/tools/binman/test/security/x509_cert.dts
+++ b/tools/binman/test/security/x509_cert.dts
@@ -8,9 +8,12 @@
 
 	binman {
 		x509-cert {
-			cert-ca = "IOT2050 Firmware Signature";
 			cert-revision-int = <0>;
 			content = <&u_boot>;
+
+			distinguished-name {
+				CN = "IOT2050 Firmware Signature";
+			};
 		};
 
 		u_boot: u-boot {
-- 
2.55.0