tree 724a209c24bfe0ec2c6ce63341d0a699f6fa8c37
parent 1bb6edfa2bd653461a7c0a0b67ad546b9a781f2d
author AKASHI Takahiro <takahiro.akashi@linaro.org> 1595327722 +0900
committer Heinrich Schuchardt <xypron.glpk@gmx.de> 1597351056 +0200

efi_loader: signature: rework for intermediate certificates support

In this commit, efi_signature_verify(with_sigdb) will be re-implemented
using pcks7_verify_one() in order to support certificates chain, where
the signer's certificate will be signed by an intermediate CA (certificate
authority) and the latter's certificate will also be signed by another CA
and so on.

What we need to do here is to search for certificates in a signature,
build up a chain of certificates and verify one by one. pkcs7_verify_one()
handles most of these steps except the last one.

pkcs7_verify_one() returns, if succeeded, the last certificate to verify,
which can be either a self-signed one or one that should be signed by one
of certificates in "db". Re-worked efi_signature_verify() will take care
of this step.

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>