Re: [PATCH 0/5] MODSIGN: Use PKCS#7 for module signatures [ver #3]

2015-02-25 Thread Michal Marek
On 2015-02-06 15:58, David Howells wrote: > Note that the revised sign-file program no longer supports the "-s > " > option as I'm not sure what the best way to deal with this is. Do we generate > a PKCS#7 cert from the signature given, or do we get given a PKCS#7 cert? I > lean towards the

Re: [PATCH 0/5] MODSIGN: Use PKCS#7 for module signatures [ver #3]

2015-02-25 Thread Michal Marek
On 2015-02-06 15:58, David Howells wrote: Note that the revised sign-file program no longer supports the -s signature option as I'm not sure what the best way to deal with this is. Do we generate a PKCS#7 cert from the signature given, or do we get given a PKCS#7 cert? I lean towards the

[PATCH 0/5] MODSIGN: Use PKCS#7 for module signatures [ver #3]

2015-02-06 Thread David Howells
Here's a set of patches that does the following: (1) Extracts both parts of an X.509 AuthorityKeyIdentifier (AKID) extension. We already extract the bit that can match the subjectKeyIdentifier (SKID) of the parent X.509 cert, but we currently ignore the bits that can match the

[PATCH 0/5] MODSIGN: Use PKCS#7 for module signatures [ver #3]

2015-02-06 Thread David Howells
Here's a set of patches that does the following: (1) Extracts both parts of an X.509 AuthorityKeyIdentifier (AKID) extension. We already extract the bit that can match the subjectKeyIdentifier (SKID) of the parent X.509 cert, but we currently ignore the bits that can match the