Dmitry Kasatkin <[email protected]> wrote: > > (2) Makes use of the PKCS#7 facility to provide module signatures. > > > > sign-file is replaced with a program that generates a PKCS#7 message > > that has no X.509 certs embedded and that has detached data (the > > module content) and adds it onto the message with magic string and > > descriptor. > > Why do you highlight that X509 is not embedded? > Current module signing does not embed X509 also.
A PKCS#7 message can have X.509 certs embedded within it - but it's optional within the spec. Given that we expect to have the appropriate cert available to verify the signature on the PKCS#7 message directly, there's no need to actually embed the X.509 cert therein. Unfortunately, it doesn't appear that you can do this with the openssl command line utility - hence why I moved to C. David -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
