tree 2e7e3317e17608b7c7c4c003fa15477b52d5b7b4
parent 2e0d94aa042ffc6f9d436e7a8216cec25610984e
author AKASHI Takahiro <takahiro.akashi@linaro.org> 1597383563 +0900
committer Heinrich Schuchardt <xypron.glpk@gmx.de> 1597400905 +0200

efi_loader: signature: correct a behavior against multiple signatures

Under the current implementation, all the signatures, if any, in
a signed image must be verified before loading it.

Meanwhile, UEFI specification v2.8b section 32.5.3.3 says,
    Multiple signatures are allowed to exist in the binary’s certificate
    table (as per PE/COFF Section “Attribute Certificate Table”). Only
    one hash or signature is required to be present in db in order to pass
    validation, so long as neither the SHA-256 hash of the binary nor any
    present signature is reflected in dbx.

This patch makes the semantics of signature verification compliant with
the specification mentioned above.

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Reported-by: Heinrich Schuchardt <xypron.glpk@gmx.de>