summaryrefslogtreecommitdiff
path: root/board/compulab/cl-som-imx7/Makefile
diff options
context:
space:
mode:
authorAKASHI Takahiro <takahiro.akashi@linaro.org>2020-07-08 14:01:56 +0900
committerHeinrich Schuchardt <xypron.glpk@gmx.de>2020-07-11 23:14:15 +0200
commit11bafb259648dea054e07dc5c8003eb8c736f36c (patch)
tree4e66b928a431a4643041e53126d9a64cd61aff39 /board/compulab/cl-som-imx7/Makefile
parent1e64d0b5a4ca8de67e79f332dd4d51a243f51eb8 (diff)
efi_loader: image_loader: verification for all signatures should pass
A signed image may have multiple signatures in - each WIN_CERTIFICATE in authenticode, and/or - each SignerInfo in pkcs7 SignedData (of WIN_CERTIFICATE) In the initial implementation of efi_image_authenticate(), the criteria of verification check for multiple signatures case is a bit ambiguous and it may cause inconsistent result. With this patch, we will make sure that verification check in efi_image_authenticate() should pass against all the signatures. The only exception would be - the case where a digest algorithm used in signature is not supported by U-Boot, or - the case where parsing some portion of authenticode has failed In those cases, we don't know how the signature be handled and should just ignore them. Please note that, due to this change, efi_signature_verify_with_sigdb()'s function prototype will be modified, taking "dbx" as well as "db" instead of outputing a "certificate." If "dbx" is null, the behavior would be the exact same as before. The function's name will be changed to efi_signature_verify() once current efi_signature_verify() has gone due to further improvement in intermediate certificates support. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Diffstat (limited to 'board/compulab/cl-som-imx7/Makefile')
0 files changed, 0 insertions, 0 deletions