Changeset 84212 in vbox for trunk/src/VBox/Frontends/VBoxManage

Timestamp:

May 8, 2020 1:08:21 PM (5 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

137820

Message:

VBoxManage/signova: Added a --digest-type=type option to control the digest that we sign. Makes it easier to test output against tests/api/tdAppliance1-*. bugref:9699

File:

• trunk/src/VBox/Frontends/VBoxManage/VBoxManageAppliance.cpp (modified) (6 diffs)

trunk/src/VBox/Frontends/VBoxManage/VBoxManageAppliance.cpp

@@ -1999 +1999 @@
  * Performs the OVA signing, producing an in-memory cert-file.
  */
-static int doTheOvaSigning(PRTCRX509CERTIFICATE pCertificate, RTCRKEY hPrivateKey,
+static int doTheOvaSigning(PRTCRX509CERTIFICATE pCertificate, RTCRKEY hPrivateKey, RTDIGESTTYPE enmDigestType,
                            const char *pszManifestName, RTVFSFILE hVfsFileManifest,
                            bool fPkcs7, unsigned cIntermediateCerts, const char **papszIntermediateCerts,
@@ -2005 +2005 @@
 {
     /*
-     * We currently hardcode the digest algorithm to SHA-256.
+     * Instantiate the digest algorithm.
      */
-    /** @todo fall back on SHA-1 if the key is too small for SHA-256. */
+    /** @todo fall back on SHA-1 if the key is too small for SHA-256 or SHA-512? */
     PCRTASN1OBJID const pObjId  = &pCertificate->TbsCertificate.SubjectPublicKeyInfo.Algorithm.Algorithm;
     RTCRDIGEST          hDigest = NIL_RTCRDIGEST;
-    int rc = RTCrDigestCreateByType(&hDigest, RTDIGESTTYPE_SHA256);
+    int rc = RTCrDigestCreateByType(&hDigest, enmDigestType);
     if (RT_FAILURE(rc))
         return RTMsgErrorRc(rc, "Failed to create digest for %s: %Rrc", pObjId->szObjId, rc);
 
     /* Figure out the digest type name for the .cert file: */
-    RTDIGESTTYPE const enmDigestType = RTCrDigestGetType(hDigest);
-    const char        *pszDigestType;
+    const char *pszDigestType;
     switch (enmDigestType)
     {
@@ -2135 +2134 @@
         { "--private-key-password",     'p', RTGETOPT_REQ_STRING },
         { "--private-key-password-file",'P', RTGETOPT_REQ_STRING },
+        { "--digest-type",              'd', RTGETOPT_REQ_STRING },
         { "--pkcs7",                    '7', RTGETOPT_REQ_NOTHING },
         { "--no-pkcs7",                 'n', RTGETOPT_REQ_NOTHING },
@@ -2148 +2148 @@
     AssertRCReturn(rc, RTEXITCODE_FAILURE);
 
-    const char *pszOva              = NULL;
-    const char *pszCertificate      = NULL;
-    const char *pszPrivateKey       = NULL;
-    Utf8Str     strPrivateKeyPassword;
-    bool        fPkcs7              = false;
-    unsigned    cIntermediateCerts  = 0;
-    const char *apszIntermediateCerts[32];
-    bool        fReSign             = false;
-    unsigned    iVerbosity          = 1;
-
-    bool        fDryRun             = false;
+    const char     *pszOva              = NULL;
+    const char     *pszCertificate      = NULL;
+    const char     *pszPrivateKey       = NULL;
+    Utf8Str         strPrivateKeyPassword;
+    RTDIGESTTYPE    enmDigestType       = RTDIGESTTYPE_SHA256;
+    bool            fPkcs7              = false;
+    unsigned        cIntermediateCerts  = 0;
+    const char     *apszIntermediateCerts[32];
+    bool            fReSign             = false;
+    unsigned        iVerbosity          = 1;
+    bool            fDryRun             = false;
 
     int c;
@@ -2189 +2189 @@
                 return rcExit;
             }
+
+            case 'd':
+                if (   RTStrICmp(ValueUnion.psz, "sha1") == 0
+                    || RTStrICmp(ValueUnion.psz, "sha-1") == 0)
+                    enmDigestType = RTDIGESTTYPE_SHA1;
+                else if (   RTStrICmp(ValueUnion.psz, "sha256") == 0
+                         || RTStrICmp(ValueUnion.psz, "sha-256") == 0)
+                    enmDigestType = RTDIGESTTYPE_SHA256;
+                else if (   RTStrICmp(ValueUnion.psz, "sha512") == 0
+                         || RTStrICmp(ValueUnion.psz, "sha-512") == 0)
+                    enmDigestType = RTDIGESTTYPE_SHA512;
+                else
+                    return RTMsgErrorExitFailure("Unknown digest type: %s", ValueUnion.psz);
+                break;
 
             case '7':
@@ -2282 +2296 @@
              */
             RTVFSFILE hVfsFileSignature = NIL_RTVFSFILE;
-            rc = doTheOvaSigning(&Certificate, hPrivateKey, strManifestName.c_str(), hVfsFileManifest,
-                                 fPkcs7, cIntermediateCerts, apszIntermediateCerts,
-                                 &ErrInfo, &hVfsFileSignature);
+            rc = doTheOvaSigning(&Certificate, hPrivateKey, enmDigestType, strManifestName.c_str(), hVfsFileManifest,
+                                 fPkcs7, cIntermediateCerts, apszIntermediateCerts, &ErrInfo, &hVfsFileSignature);
 
             /*