Commit 23dfbbab authored by Luis R. Rodriguez's avatar Luis R. Rodriguez Committed by David Howells

sign-file: Add option to only create signature file

Make the -d option (which currently isn't actually wired to anything) write
out the PKCS#7 message as per the -p option and then exit without either
modifying the source or writing out a compound file of the source, signature
and metadata.

This will be useful when firmware signature support is added
upstream as firmware will be left intact, and we'll only require
the signature file. The descriptor is implicit by file extension
and the file's own size.
Signed-off-by: default avatarLuis R. Rodriguez <mcgrof@suse.com>
Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
parent 3f1e1bea
...@@ -86,13 +86,14 @@ int main(int argc, char **argv) ...@@ -86,13 +86,14 @@ int main(int argc, char **argv)
char *hash_algo = NULL; char *hash_algo = NULL;
char *private_key_name, *x509_name, *module_name, *dest_name; char *private_key_name, *x509_name, *module_name, *dest_name;
bool save_pkcs7 = false, replace_orig; bool save_pkcs7 = false, replace_orig;
bool sign_only = false;
unsigned char buf[4096]; unsigned char buf[4096];
unsigned long module_size, pkcs7_size; unsigned long module_size, pkcs7_size;
const EVP_MD *digest_algo; const EVP_MD *digest_algo;
EVP_PKEY *private_key; EVP_PKEY *private_key;
PKCS7 *pkcs7; PKCS7 *pkcs7;
X509 *x509; X509 *x509;
BIO *b, *bd, *bm; BIO *b, *bd = NULL, *bm;
int opt, n; int opt, n;
ERR_load_crypto_strings(); ERR_load_crypto_strings();
...@@ -102,6 +103,7 @@ int main(int argc, char **argv) ...@@ -102,6 +103,7 @@ int main(int argc, char **argv)
opt = getopt(argc, argv, "dp"); opt = getopt(argc, argv, "dp");
switch (opt) { switch (opt) {
case 'p': save_pkcs7 = true; break; case 'p': save_pkcs7 = true; break;
case 'd': sign_only = true; save_pkcs7 = true; break;
case -1: break; case -1: break;
default: format(); default: format();
} }
...@@ -148,8 +150,10 @@ int main(int argc, char **argv) ...@@ -148,8 +150,10 @@ int main(int argc, char **argv)
/* Open the destination file now so that we can shovel the module data /* Open the destination file now so that we can shovel the module data
* across as we read it. * across as we read it.
*/ */
if (!sign_only) {
bd = BIO_new_file(dest_name, "wb"); bd = BIO_new_file(dest_name, "wb");
ERR(!bd, "%s", dest_name); ERR(!bd, "%s", dest_name);
}
/* Digest the module data. */ /* Digest the module data. */
OpenSSL_add_all_digests(); OpenSSL_add_all_digests();
...@@ -180,6 +184,9 @@ int main(int argc, char **argv) ...@@ -180,6 +184,9 @@ int main(int argc, char **argv)
BIO_free(b); BIO_free(b);
} }
if (sign_only)
return 0;
/* Append the marker and the PKCS#7 message to the destination file */ /* Append the marker and the PKCS#7 message to the destination file */
ERR(BIO_reset(bm) < 0, "%s", module_name); ERR(BIO_reset(bm) < 0, "%s", module_name);
while ((n = BIO_read(bm, buf, sizeof(buf))), while ((n = BIO_read(bm, buf, sizeof(buf))),
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment