Changeset 84264 in vbox for trunk/src/VBox/Frontends/VBoxManage

Timestamp:

May 11, 2020 5:55:26 PM (5 years ago)

Author:

vboxsync

Message:

VBoxManage/ovasign,manual: Made --pkcs7 default. Tweaks. Documentation updates. bugref:9699

File:

• trunk/src/VBox/Frontends/VBoxManage/VBoxManageAppliance.cpp (modified) (13 diffs)

trunk/src/VBox/Frontends/VBoxManage/VBoxManageAppliance.cpp

@@ -1841 +1841 @@
     if (iVerbosity >= 2)
         RTMsgInfo("Scanning OVA '%s' for a manifest and signature...", pszOva);
-    enum { kScanning, kSeenManifest, kSeenSignature } enmState = kScanning;
+    char *pszSignatureName = NULL;
     for (;;)
     {
@@ -1871 +1871 @@
             && (enmType == RTVFSOBJTYPE_IO_STREAM || enmType == RTVFSOBJTYPE_FILE))
         {
-            if (   enmState >= kSeenManifest
-                || *phVfsManifest != NIL_RTVFSFILE /* paranoia */)
+            if (*phVfsManifest != NIL_RTVFSFILE)
                 rc = RTMsgErrorRc(VERR_DUPLICATE, "OVA contains multiple manifests! first: %s  second: %s",
                                   pStrManifestName->c_str(), pszName);
+            else if (pszSignatureName)
+                rc = RTMsgErrorRc(VERR_WRONG_ORDER, "Unsupported OVA file ordering! Signature file ('%s') as succeeded by '%s'.",
+                                  pszSignatureName, pszName);
             else
             {
-                enmState = kSeenManifest;
                 if (iVerbosity >= 2)
                     RTMsgInfo("Found manifest file: %s", pszName);
@@ -1898 +1899 @@
                  && (enmType == RTVFSOBJTYPE_IO_STREAM || enmType == RTVFSOBJTYPE_FILE))
         {
-            if (   enmState >= kSeenSignature
-                || *phVfsOldSignature != NIL_RTVFSOBJ /* paranoia */)
+            if (*phVfsOldSignature != NIL_RTVFSOBJ)
                 rc = RTMsgErrorRc(VERR_WRONG_ORDER, "Multiple signature files! (%s)", pszName);
             else
             {
-                enmState = kSeenSignature;
                 if (iVerbosity >= 2)
                     RTMsgInfo("Found existing signature file: %s", pszName);
+                pszSignatureName   = pszName;
                 *phVfsOldSignature = hVfsObj;
+                pszName = NULL;
                 hVfsObj = NIL_RTVFSOBJ;
             }
         }
-        else if (enmState >= kSeenManifest)
-            rc = RTMsgErrorRc(VERR_WRONG_ORDER, "Invalid OVA file ordering! (%s)", pszName);
+        else if (pszSignatureName)
+            rc = RTMsgErrorRc(VERR_WRONG_ORDER, "Unsupported OVA file ordering! Signature file ('%s') as succeeded by '%s'.",
+                              pszSignatureName, pszName);
 
         /*
@@ -1929 +1931 @@
     else if (RT_SUCCESS(rc) && *phVfsOldSignature != NIL_RTVFSOBJ && !fReSign)
         rc = RTMsgErrorRc(VERR_ALREADY_EXISTS,
-                          "The OVA is already signed! (Use the --force option to force re-signing it.)");
-
+                          "The OVA is already signed ('%s')! (Use the --force option to force re-signing it.)",
+                          pszSignatureName);
+
+    RTStrFree(pszSignatureName);
     return rc;
 }
@@ -1943 +1947 @@
  * following the .cert file in that case.
  */
-static int updateTheOvaSignature(RTVFSFSSTREAM hVfsFssOva, const char *pszOva,
-                                 const char *pszSignatureName, RTVFSFILE hVfsFileSignature, RTVFSOBJ hVfsOldSignature)
+static int updateTheOvaSignature(RTVFSFSSTREAM hVfsFssOva, const char *pszOva, const char *pszSignatureName,
+                                 RTVFSFILE hVfsFileSignature, RTVFSOBJ hVfsOldSignature, unsigned iVerbosity)
 {
+    if (iVerbosity > 1)
+        RTMsgInfo("Writing '%s' to the OVA...", pszSignatureName);
+
     /*
      * Truncate the file at the old signature, if present.
@@ -2129 +2136 @@
                         {
                             if (iVerbosity > 1)
-                                RTMsgInfo("Created PKCS#7/CMS signature: %zu bytes.", cbResult);
+                                RTMsgInfo("Created PKCS#7/CMS signature: %zu bytes, %s.",
+                                          cbResult, RTCrDigestTypeToName(enmDigestType));
 
                             /*
@@ -2176 +2184 @@
     }
 
+    /** @todo Use SHA-3 instead, better diversity. @bugref{9734} */
     RTDIGESTTYPE enmPkcs7DigestType;
     if (   enmDigestType == RTDIGESTTYPE_SHA1
@@ -2244 +2253 @@
                 if (RT_SUCCESS(rc))
                 {
+                    if (iVerbosity > 1)
+                        RTMsgInfo("Created OVA signature: %zu bytes, %s", cbSignature, RTCrDigestTypeToName(enmDigestType));
+
                     /*
                      * Verify the signature using the certificate to make sure we've
@@ -2253 +2265 @@
                     if (RT_SUCCESS(rc))
                     {
-                        if (iVerbosity > 0)
-                            RTMsgInfo("Created OVA signature: %zu bytes, %s", cbSignature, RTCrDigestTypeToName(enmDigestType));
+                        if (iVerbosity > 2)
+                            RTMsgInfo("  Successfully decoded and verified the OVA signature.\n");
 
                         /*
@@ -2331 +2343 @@
         { "--digest-type",              'd', RTGETOPT_REQ_STRING },
         { "--pkcs7",                    '7', RTGETOPT_REQ_NOTHING },
+        { "--cms",                      '7', RTGETOPT_REQ_NOTHING },
         { "--no-pkcs7",                 'n', RTGETOPT_REQ_NOTHING },
+        { "--no-cms",                   'n', RTGETOPT_REQ_NOTHING },
         { "--intermediate-cert-file",   'i', RTGETOPT_REQ_STRING },
         { "--force",                    'f', RTGETOPT_REQ_NOTHING },
@@ -2348 +2362 @@
     Utf8Str         strPrivateKeyPassword;
     RTDIGESTTYPE    enmDigestType       = RTDIGESTTYPE_UNKNOWN;
-    bool            fPkcs7              = false;
+    bool            fPkcs7              = true;
     unsigned        cIntermediateCerts  = 0;
     const char     *apszIntermediateCerts[32];
@@ -2412 +2426 @@
                                                  RT_ELEMENTS(apszIntermediateCerts));
                 apszIntermediateCerts[cIntermediateCerts++] = ValueUnion.psz;
+                fPkcs7 = true;
                 break;
 
@@ -2508 +2523 @@
                      * Update the OVA.
                      */
-                    rc = updateTheOvaSignature(hVfsFssOva, pszOva, strSignatureName.c_str(), hVfsFileSignature, hVfsOldSignature);
+                    rc = updateTheOvaSignature(hVfsFssOva, pszOva, strSignatureName.c_str(),
+                                               hVfsFileSignature, hVfsOldSignature, iVerbosity);
+                    if (RT_SUCCESS(rc) && iVerbosity > 0)
+                        RTMsgInfo("Successfully signed '%s'.", pszOva);
                 }
             }