Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1200777
| From | David Howells <dhowells@redhat.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 08/27] sign-file: Add option to only create signature file [ver #7] |
| Date | 2015-08-05 15:50 +0200 |
| Message-ID | <pU7eZ-2WR-69@gated-at.bofh.it> (permalink) |
| References | <pU7eV-2WR-7@gated-at.bofh.it> |
| Organization | Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903 |
From: Luis R. Rodriguez <mcgrof@suse.com>
Make the -d option (which currently isn't actually wired to anything) write
out the PKCS#7 message as per the -p option and then exit without either
modifying the source or writing out a compound file of the source, signature
and metadata.
This will be useful when firmware signature support is added
upstream as firmware will be left intact, and we'll only require
the signature file. The descriptor is implicit by file extension
and the file's own size.
Signed-off-by: Luis R. Rodriguez <mcgrof@suse.com>
Signed-off-by: David Howells <dhowells@redhat.com>
---
scripts/sign-file.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/scripts/sign-file.c b/scripts/sign-file.c
index 5b8a6dda3235..39aaabe89388 100755
--- a/scripts/sign-file.c
+++ b/scripts/sign-file.c
@@ -86,13 +86,14 @@ int main(int argc, char **argv)
char *hash_algo = NULL;
char *private_key_name, *x509_name, *module_name, *dest_name;
bool save_pkcs7 = false, replace_orig;
+ bool sign_only = false;
unsigned char buf[4096];
unsigned long module_size, pkcs7_size;
const EVP_MD *digest_algo;
EVP_PKEY *private_key;
PKCS7 *pkcs7;
X509 *x509;
- BIO *b, *bd, *bm;
+ BIO *b, *bd = NULL, *bm;
int opt, n;
ERR_load_crypto_strings();
@@ -102,6 +103,7 @@ int main(int argc, char **argv)
opt = getopt(argc, argv, "dp");
switch (opt) {
case 'p': save_pkcs7 = true; break;
+ case 'd': sign_only = true; save_pkcs7 = true; break;
case -1: break;
default: format();
}
@@ -148,8 +150,10 @@ int main(int argc, char **argv)
/* Open the destination file now so that we can shovel the module data
* across as we read it.
*/
- bd = BIO_new_file(dest_name, "wb");
- ERR(!bd, "%s", dest_name);
+ if (!sign_only) {
+ bd = BIO_new_file(dest_name, "wb");
+ ERR(!bd, "%s", dest_name);
+ }
/* Digest the module data. */
OpenSSL_add_all_digests();
@@ -180,6 +184,9 @@ int main(int argc, char **argv)
BIO_free(b);
}
+ if (sign_only)
+ return 0;
+
/* Append the marker and the PKCS#7 message to the destination file */
ERR(BIO_reset(bm) < 0, "%s", module_name);
while ((n = BIO_read(bm, buf, sizeof(buf))),
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 00/27] MODSIGN: Use PKCS#7 for module signatures [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
[PATCH 10/27] MODSIGN: Extract the blob PKCS#7 signature verifier from module signing [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
[PATCH 22/27] extract-cert: Cope with multiple X.509 certificates in a single file [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
[PATCH 16/27] modsign: Use single PEM file for autogenerated key [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
[PATCH 21/27] sign-file: Generate CMS message as signature instead of PKCS#7 [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
[PATCH 01/27] ASN.1: Add an ASN.1 compiler option to dump the element tree [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
[PATCH 18/27] PKCS#7: Check content type and versions [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
[PATCH 11/27] modsign: Abort modules_install when signing fails [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
[PATCH 04/27] X.509: Support X.509 lookup by Issuer+Serial form AuthorityKeyIdentifier [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
[PATCH 19/27] X.509: Change recorded SKID & AKID to not include Subject or Issuer [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
[PATCH 26/27] KEYS: Add a name for PKEY_ID_PKCS7 [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
[PATCH 06/27] MODSIGN: Provide a utility to append a PKCS#7 signature to a module [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
[PATCH 24/27] PKCS#7: Improve and export the X.509 ASN.1 time object decoder [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
[PATCH 08/27] sign-file: Add option to only create signature file [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
[PATCH 14/27] modsign: Allow external signing key to be specified [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
[PATCH 17/27] modsign: Add explicit CONFIG_SYSTEM_TRUSTED_KEYS option [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
[PATCH 23/27] modsign: Use extract-cert to process CONFIG_SYSTEM_TRUSTED_KEYS [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
[PATCH 05/27] PKCS#7: Allow detached data to be supplied for signature checking purposes [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
[PATCH 15/27] modsign: Extract signing cert from CONFIG_MODULE_SIG_KEY if needed [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
[PATCH 07/27] MODSIGN: Use PKCS#7 messages as module signatures [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
[PATCH 27/27] PKCS#7: Restrict content type and authenticated attributes by purpose [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
[PATCH 02/27] ASN.1: Copy string names to tokens in ASN.1 compiler [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
Re: [PATCH 02/27] ASN.1: Copy string names to tokens in ASN.1 compiler [ver #7] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2015-08-05 20:20 +0200
Re: [PATCH 02/27] ASN.1: Copy string names to tokens in ASN.1 compiler [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 20:30 +0200
Re: [PATCH 02/27] ASN.1: Copy string names to tokens in ASN.1 compiler [ver #7] Mimi Zohar <zohar@linux.vnet.ibm.com> - 2015-08-05 21:00 +0200
[PATCH 25/27] PKCS#7: Appropriately require or forbid authenticated attributes [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
Re: [PATCH 25/27] PKCS#7: Appropriately require or forbid authenticated attributes [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 16:30 +0200
[PATCH 20/27] PKCS#7: Support CMS messages also [RFC5652] [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 15:50 +0200
[PATCH 13/27] modsign: Allow signing key to be PKCS#11 [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 16:00 +0200
[PATCH 09/27] system_keyring.c doesn't need to #include module-internal.h [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 16:00 +0200
[PATCH 03/27] X.509: Extract both parts of the AuthorityKeyIdentifier [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 16:00 +0200
[PATCH 12/27] modsign: Allow password to be specified for signing key [ver #7] David Howells <dhowells@redhat.com> - 2015-08-05 16:00 +0200
csiph-web