tree 565578d9cdd43e8a702e5473d707599e3f1b54e9
parent fa07d049ee8b7df74899e10877297b928ec365cb
author Demi Marie Obenour <demiobenour@gmail.com> 1670531038 -0500
committer Demi Marie Obenour <demiobenour@gmail.com> 1672357270 -0500

fix(auth): require at least one extension to be present

X.509 and RFC5280 allow omitting the extensions entirely, but require
that if the extensions field is present at all, it must contain at least
one certificate.  TF-A already requires the extensions to be present,
but allows them to be empty.  However, a certificate with an empty
extensions field will always fail later on, as the extensions contain
the information needed to validate the next stage in the boot chain.
Therefore, it is simpler to require the extension field to be present
and contain at least one extension.  Also add a comment explaining why
the extensions field is required, even though it is OPTIONAL in the
ASN.1 syntax.

Change-Id: Ie26eed8a7924bf50937a6b27ccdf7cc9a390588d
Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>