74 lines
4.0 KiB
Bash
Executable File
74 lines
4.0 KiB
Bash
Executable File
#!/bin/bash
|
||
# mbedtls 3.6.2 — Mbed TLS（Apache-2.0）。裁剪配置 + 静态编 mipsel。
|
||
# 产物体积：libmbedcrypto.a（AES/MD5/RSA/Base64/Ec），libmbedx509.a（证书解析），libmbedtls.a（TLS1.2 client）。
|
||
# 裁剪策略：保留 TLS1.2 client + AES-GCM/CBC + RSA/ECDH + MD5 + base64 + X509 解析；
|
||
# 去掉 TLS1.3/DTLS/PSA/多余密码套件(PKCS5/7/12)/PEM_WRITE/CTR_DRBG(用自定义 rng)。
|
||
# 保留 PEM_PARSE(加载 CA bundle 需要)。
|
||
# 说明：脚本会把裁剪后的 config 复制到 include/mbedtls/mbedtls_config.h（原默认卷保留在 vendor git 里，
|
||
# 可用 `git -C vendor/mbedtls checkout -- include/mbedtls/mbedtls_config.h` 恢复）。
|
||
. ./libs_common.sh
|
||
|
||
MB="$VENDOR/mbedtls"
|
||
CFG_TMP="$MB/config/mbedtls_config_ncm.h" # 裁剪后的 config 落盘于此（交付物）
|
||
mkdir -p "$MB/config"
|
||
cp "$MB/include/mbedtls/mbedtls_config.h" "$CFG_TMP"
|
||
|
||
# 逐个 unset（config.py 一次只能 unset 一个符号）
|
||
unsets=(
|
||
MBEDTLS_SSL_PROTO_TLS1_3 MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
|
||
MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED
|
||
MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
|
||
MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
|
||
MBEDTLS_SSL_PROTO_DTLS MBEDTLS_SSL_DTLS_CONNECTION_ID
|
||
MBEDTLS_SSL_DTLS_ANTI_REPLAY MBEDTLS_SSL_DTLS_HELLO_VERIFY
|
||
MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE MBEDTLS_SSL_CONTEXT_SERIALIZATION
|
||
MBEDTLS_SSL_SESSION_TICKETS MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
|
||
MBEDTLS_SSL_ALPN MBEDTLS_SSL_RENEGOTIATION MBEDTLS_SSL_CBC_RECORD_SPLITTING
|
||
MBEDTLS_SSL_ASYNC_PRIVATE MBEDTLS_SSL_TRUNCATED_HMAC MBEDTLS_SSL_KEEP_PEER_CERTIFICATE
|
||
MBEDTLS_SSL_RECORD_SIZE_LIMIT MBEDTLS_SSL_DTLS_SRTP MBEDTLS_SSL_COOKIE_C
|
||
MBEDTLS_CAMELLIA_C MBEDTLS_ARIA_C MBEDTLS_DES_C MBEDTLS_CHACHA20_C
|
||
MBEDTLS_CHACHAPOLY_C MBEDTLS_CCM_C MBEDTLS_NIST_KW_C MBEDTLS_ECJPAKE_C
|
||
MBEDTLS_HKDF_C MBEDTLS_PSA_CRYPTO_C MBEDTLS_CTR_DRBG_C MBEDTLS_ENTROPY_C
|
||
MBEDTLS_PEM_WRITE_C MBEDTLS_PKCS5_C MBEDTLS_PKCS7_C
|
||
MBEDTLS_PKCS12_C MBEDTLS_MD4_C MBEDTLS_X509_CRL_PARSE_C MBEDTLS_X509_CSR_PARSE_C
|
||
MBEDTLS_SSL_ECP_RESTARTABLE MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH
|
||
# PSA 关联项：去掉全部 PSA/LMS/ITS（我们用 legacy API，不用 PSA）
|
||
MBEDTLS_PSA_CRYPTO_STORAGE_C MBEDTLS_PSA_ITS_FILE_C MBEDTLS_PSA_KEY_STORE_DYNAMIC
|
||
MBEDTLS_LMS_C MBEDTLS_PSA_CRYPTO_CLIENT
|
||
)
|
||
CFGF="$MB/include/mbedtls/mbedtls_config.h"
|
||
for s in "${unsets[@]}"; do
|
||
python3 "$MB/scripts/config.py" --file "$CFG_TMP" unset "$s" >/dev/null 2>&1 || true
|
||
done
|
||
echo "trimmed config enabled-count: $(grep -c '^#define MBEDTLS_' "$CFG_TMP") (default: 141)"
|
||
|
||
# 应用裁剪 config 到默认位置（build 默认读 include/mbedtls/mbedtls_config.h）
|
||
cp "$CFG_TMP" "$CFGF"
|
||
# 我们不用 PSA，且不希望 build 因缺 python-jsonschema 重新生成 PSA 驱动包装文件：
|
||
# 把框架生成文件 touch 成“比 config 新”，让 make 跳过重新生成。
|
||
touch "$MB/library/error.c" "$MB/library/version_features.c" \
|
||
"$MB/library/ssl_debug_helpers_generated.c" \
|
||
"$MB/library/psa_crypto_driver_wrappers.h" \
|
||
"$MB/library/psa_crypto_driver_wrappers_no_static.c"
|
||
# 关键：config 变更不会自动触发 .c 重编，务必清掉旧对象/库再重编，否则 PEM 等新启用模块不会进库。
|
||
rm -f "$MB/library"/*.o "$MB/library"/*.a
|
||
|
||
BM="$OUT/mbedtls/mipsel"; rm -rf "$BM"; mkdir -p "$BM"
|
||
# 在 vendor 源码内建，输出到本 app 的 out 目录
|
||
make -C "$MB" lib \
|
||
BUILD="$BM" \
|
||
CC="$CC_MIPS" \
|
||
AR="$AR_MIPS" \
|
||
CFLAGS="-Os -Wno-unused-parameter -fno-stack-protector -ffunction-sections -fdata-sections" \
|
||
LD="$CC_MIPS" 2>&1 | tail -6
|
||
echo "make exit=${PIPESTATUS[0]}"
|
||
# 把产物从 vendor/library 拷到本 app 的 out/mbedtls/mipsel（make 的 BUILD 变量在本版 Makefile 不生效）
|
||
mkdir -p "$BM"
|
||
for a in libmbedcrypto.a libmbedx509.a libmbedtls.a; do
|
||
[ -s "$MB/library/$a" ] && cp "$MB/library/$a" "$BM/$a"
|
||
done
|
||
echo "=== mbedtls (mipsel) ==="
|
||
for a in libmbedcrypto.a libmbedx509.a libmbedtls.a; do
|
||
[ -s "$BM/$a" ] && { echo "-- $a --"; measure_archive "$BM/$a"; }
|
||
done
|