plugin — a runtime plugin loader for C++

Signing an add-on

The driver calls DSOLoader::load and trusts whatever is on disk. This page hardens it: sign the plugins, trust the key, and switch to loadVerified so an unsigned add-on is refused.

Requires the plugin-sign build (OpenSSL present) — dsold then has the signed overloads and the three dso-* tools are built.

1. Make a key

dso-keygen --name "Example Dev" --email dev@example.com \
           --key-id example --separate --out-dir keys/
#   keys/private/example.key
#   keys/private/example.fingerprint
#   keys/public/example.pub

2. Sign two of the three plugins

cd build/example/plugin
dso-sign libCircle.so  --key ../../../keys/private/example.key --name circle  --version 1.0.0
dso-sign libEllipse.so --key ../../../keys/private/example.key --name ellipse --version 1.0.0
# leave libSquare.so unsigned on purpose

Each command strips any old sections, hashes the file, builds and Ed25519-signs a manifest, and embeds .dso_manifest + .dso_sig. Check one:

dso-verify libCircle.so --keys /dev/null       # UNKNOWN (exit 1) — key not trusted yet
readelf -p .dso_manifest libCircle.so

3. Trust the key

mkdir -p trusted-keys.d
cp ../../../keys/public/example.pub trusted-keys.d/

dso-verify libCircle.so  --keys trusted-keys.d/   # TRUSTED  (exit 0)
dso-verify libSquare.so  --keys trusted-keys.d/   # UNSIGNED (exit 2)

4. Change the host

Replace the three load calls in testShape.cpp with loadVerified:

#include <sign/TrustLevel.hh>
using fedem::sign::TrustLevel;

const std::vector<std::string> here { "." };
const std::string keys = "trusted-keys.d";

for( auto* so : { "libCircle.so", "libEllipse.so", "libSquare.so" } )
{
    try {
        DSOLoader::loadVerified( so, here, keys, TrustLevel::TRUSTED );
        std::cout << "loaded (trusted): " << so << '\n';
    }
    catch( fedem::exception::SignatureRejected const& e ) {
        std::cerr << "refused: " << e.soPath() << " — " << e.reason() << '\n';
    }
    catch( fedem::exception::FileNotFound const& e ) {
        std::cerr << "missing: " << e.missingFilename() << '\n';
    }
}

Run it:

loaded (trusted): libCircle.so
loaded (trusted): libEllipse.so
refused: ./libSquare.so — trust level UNSIGNED is below required TRUSTED

Shape::create("Square") now returns nullptr — its REGISTER never ran, because the DSO was never loaded.

Softer policy with loadSigned

For "warn but continue":

auto r = DSOLoader::loadSigned( so, here, keys );
if( r.loaded && r.trust != TrustLevel::TRUSTED )
    std::clog << "warning: " << so << " is " << fedem::sign::trustLevelName( r.trust )
              << " (" << r.detail << ")\n";

loadSigned always loads (even REJECTED) and hands you the verdict — you decide.

In a real build