Changeset 95657 in vbox
- Timestamp:
- Jul 15, 2022 1:05:33 AM (2 years ago)
- File:
-
- 1 edited
-
trunk/src/VBox/Runtime/tools/RTSignTool.cpp (modified) (22 diffs)
Legend:
- Unmodified
- Added
- Removed
-
trunk/src/VBox/Runtime/tools/RTSignTool.cpp
r95637 r95657 54 54 #include <iprt/crypto/store.h> 55 55 #include <iprt/crypto/spc.h> 56 #include <iprt/crypto/tsp.h> 56 57 #ifdef VBOX 57 58 # include <VBox/sup.h> /* Certificates */ … … 1012 1013 static RTEXITCODE SignToolPkcs7_AuthAttribsAddSpcOpusInfo(PRTCRPKCS7ATTRIBUTES pAuthAttribs, void *pvInfo) 1013 1014 { 1015 /** @todo The OpusInfo is a structure with an optional SpcString and an 1016 * optional SpcLink (url). The two attributes can be set using the /d and /du 1017 * options of MS signtool.exe, I think. We shouldn't be using them atm. */ 1018 1014 1019 PRTCRPKCS7ATTRIBUTE pAttr = SignToolPkcs7_AuthAttribAppend(pAuthAttribs); 1015 1020 if (!pAttr) … … 1065 1070 } 1066 1071 1072 1067 1073 static RTEXITCODE SignToolPkcs7_AuthAttribsAddContentType(PRTCRPKCS7ATTRIBUTES pAuthAttribs, const char *pszContentTypeId) 1068 1074 { … … 1094 1100 { 1095 1101 /* 1096 * Add signing time. 1097 */ 1098 RTEXITCODE rcExit = SignToolPkcs7_AuthAttribsAddSigningTime(pAuthAttribs, SigningTime); 1102 * Add content type. 1103 */ 1104 RTEXITCODE rcExit = SignToolPkcs7_AuthAttribsAddContentType(pAuthAttribs, 1105 fTimestampTypeOld ? RTCR_PKCS7_DATA_OID : RTCRTSPTSTINFO_OID); 1099 1106 if (rcExit != RTEXITCODE_SUCCESS) 1100 1107 return rcExit; 1101 1108 1102 1109 /* 1110 * Add signing time. 1111 */ 1112 rcExit = SignToolPkcs7_AuthAttribsAddSigningTime(pAuthAttribs, SigningTime); 1113 if (rcExit != RTEXITCODE_SUCCESS) 1114 return rcExit; 1115 1116 /* 1103 1117 * More later if we want to support fTimestampTypeOld = false perhaps? 1104 1118 */ … … 1110 1124 1111 1125 1112 static RTEXITCODE SignToolPkcs7_AddAuthAttribsForImageSignature(PRTCRPKCS7ATTRIBUTES pAuthAttribs, RTTIMESPEC SigningTime) 1126 static RTEXITCODE SignToolPkcs7_AddAuthAttribsForImageOrCatSignature(PRTCRPKCS7ATTRIBUTES pAuthAttribs, RTTIMESPEC SigningTime, 1127 const char *pszContentTypeId) 1113 1128 { 1114 1129 /* … … 1131 1146 * ^- Set Of 1132 1147 */ 1133 rcExit = SignToolPkcs7_AuthAttribsAddContentType(pAuthAttribs, RTCRSPCINDIRECTDATACONTENT_OID);1148 rcExit = SignToolPkcs7_AuthAttribsAddContentType(pAuthAttribs, pszContentTypeId); 1134 1149 if (rcExit != RTEXITCODE_SUCCESS) 1135 1150 return rcExit; … … 1181 1196 1182 1197 /* Create the attrib and its sub-set of counter signatures. */ 1183 #if 11184 1198 rc = RTCrPkcs7Attribute_SetCounterSignatures(pAttr, NULL, pAttr->Allocation.pAllocator); 1185 #else1186 rc = RTAsn1ObjId_InitFromString(&pAttr->Type, RTCR_PKCS9_ID_COUNTER_SIGNATURE_OID, pAttr->Allocation.pAllocator);1187 1199 if (RT_FAILURE(rc)) 1188 return RTMsgErrorExitFailure("RTAsn1ObjId_InitFromString failed: %Rrc", rc); 1189 1190 /** @todo Generalize the Type + enmType DYN stuff and generate setters. */ 1191 Assert(pAttr->enmType == RTCRPKCS7ATTRIBUTETYPE_NOT_PRESENT); 1192 Assert(pAttr->uValues.pContentInfos == NULL); 1193 pAttr->enmType = RTCRPKCS7ATTRIBUTETYPE_COUNTER_SIGNATURES; 1194 rc = RTAsn1MemAllocZ(&pAttr->Allocation, (void **)&pAttr->uValues.pCounterSignatures, 1195 sizeof(*pAttr->uValues.pCounterSignatures)); 1196 if (RT_FAILURE(rc)) 1197 return RTMsgErrorExitFailure("RTAsn1MemAllocZ failed: %Rrc", rc); 1198 1199 rc = RTCrPkcs7SignerInfos_Init(pAttr->uValues.pCounterSignatures, pAttr->Allocation.pAllocator); 1200 if (RT_FAILURE(rc)) 1201 return RTMsgErrorExitFailure("RTCrPkcs7SignerInfos_Init failed: %Rrc", rc); 1202 #endif 1200 return RTMsgErrorExitFailure("RTCrPkcs7Attribute_SetCounterSignatures failed: %Rrc", rc); 1203 1201 1204 1202 /* Insert the counter signature. */ … … 1240 1238 1241 1239 1242 static RTEXITCODE Pkcs7SignStuff(const char *pszWhat, const void *pvToDataToSign, size_t cbToDataToSign,1243 PCRTCRPKCS7ATTRIBUTES pAuthAttribs, RTCRSTORE hAdditionalCerts, uint32_t fExtraFlags,1244 RTDIGESTTYPE enmDigestType, SIGNTOOLKEYPAIR *pCertKeyPair,1245 unsigned cVerbosity, void **ppvSigned, size_t *pcbSigned,1246 PRTCRPKCS7CONTENTINFO pContentInfo, PRTCRPKCS7SIGNEDDATA *ppSignedData)1240 static RTEXITCODE SignToolPkcs7_Pkcs7SignStuff(const char *pszWhat, const void *pvToDataToSign, size_t cbToDataToSign, 1241 PCRTCRPKCS7ATTRIBUTES pAuthAttribs, RTCRSTORE hAdditionalCerts, 1242 uint32_t fExtraFlags, RTDIGESTTYPE enmDigestType, SIGNTOOLKEYPAIR *pCertKeyPair, 1243 unsigned cVerbosity, void **ppvSigned, size_t *pcbSigned, 1244 PRTCRPKCS7CONTENTINFO pContentInfo, PRTCRPKCS7SIGNEDDATA *ppSignedData) 1247 1245 { 1248 1246 *ppvSigned = NULL; … … 1253 1251 1254 1252 /* Figure out how large the signature will be. */ 1253 uint32_t const fSignFlags = RTCRPKCS7SIGN_SD_F_USE_V1 | RTCRPKCS7SIGN_SD_F_NO_SMIME_CAP | fExtraFlags; 1254 size_t cbSigned = 1024; 1255 1255 RTERRINFOSTATIC ErrInfo; 1256 size_t cbSigned = 1024; 1257 int rc = RTCrPkcs7SimpleSignSignedData(RTCRPKCS7SIGN_SD_F_NO_SMIME_CAP | fExtraFlags, 1258 pCertKeyPair->pCertificate, pCertKeyPair->hPrivateKey, pvToDataToSign, cbToDataToSign, 1259 enmDigestType, hAdditionalCerts, pAuthAttribs, 1256 int rc = RTCrPkcs7SimpleSignSignedData(fSignFlags, pCertKeyPair->pCertificate, pCertKeyPair->hPrivateKey, 1257 pvToDataToSign, cbToDataToSign,enmDigestType, hAdditionalCerts, pAuthAttribs, 1260 1258 NULL, &cbSigned, RTErrInfoInitStatic(&ErrInfo)); 1261 1259 if (rc != VERR_BUFFER_OVERFLOW) … … 1266 1264 if (!pvSigned) 1267 1265 return RTMsgErrorExitFailure("Failed to allocate %#zx bytes for %s signature", cbSigned, pszWhat); 1268 rc = RTCrPkcs7SimpleSignSignedData(RTCRPKCS7SIGN_SD_F_NO_SMIME_CAP | fExtraFlags, 1269 pCertKeyPair->pCertificate, pCertKeyPair->hPrivateKey, pvToDataToSign, cbToDataToSign, 1270 enmDigestType, hAdditionalCerts, pAuthAttribs, 1266 rc = RTCrPkcs7SimpleSignSignedData(fSignFlags, pCertKeyPair->pCertificate, pCertKeyPair->hPrivateKey, 1267 pvToDataToSign, cbToDataToSign, enmDigestType, hAdditionalCerts, pAuthAttribs, 1271 1268 pvSigned, &cbSigned, RTErrInfoInitStatic(&ErrInfo)); 1272 1269 if (RT_SUCCESS(rc)) … … 1338 1335 PRTCRPKCS7SIGNEDDATA pTsSignedData = NULL; 1339 1336 RTCRPKCS7CONTENTINFO TsContentInfo; 1340 rcExit = Pkcs7SignStuff("timestamp", pSignerInfo->EncryptedDigest.Asn1Core.uData.pv, 1341 pSignerInfo->EncryptedDigest.Asn1Core.cb, &AuthAttribs, NIL_RTCRSTORE /*hAdditionalCerts*/, 1342 RTCRPKCS7SIGN_SD_F_DEATCHED, RTDIGESTTYPE_SHA1, pTimestampPair, cVerbosity, 1343 &pvSigned, NULL /*pcbSigned*/, &TsContentInfo, &pTsSignedData); 1337 rcExit = SignToolPkcs7_Pkcs7SignStuff("timestamp", pSignerInfo->EncryptedDigest.Asn1Core.uData.pv, 1338 pSignerInfo->EncryptedDigest.Asn1Core.cb, &AuthAttribs, 1339 NIL_RTCRSTORE /*hAdditionalCerts*/, RTCRPKCS7SIGN_SD_F_DEATCHED, 1340 RTDIGESTTYPE_SHA1, pTimestampPair, cVerbosity, 1341 &pvSigned, NULL /*pcbSigned*/, &TsContentInfo, &pTsSignedData); 1344 1342 if (rcExit == RTEXITCODE_SUCCESS) 1345 1343 { … … 1409 1407 1410 1408 1411 static RTEXITCODE SignToolPkcs7_Sign SpcIndData(SIGNTOOLPKCS7EXE *pThis, RTCRSPCINDIRECTDATACONTENT *pSpcIndData,1412 unsigned cVerbosity, RTDIGESTTYPE enmSigType, bool fReplaceExisting,1413 1414 1409 static RTEXITCODE SignToolPkcs7_SignData(SIGNTOOLPKCS7 *pThis, PRTASN1CORE pToSignRoot, bool fIsRootsParent, 1410 const char *pszContentTypeId, unsigned cVerbosity, RTDIGESTTYPE enmSigType, 1411 bool fReplaceExisting, SIGNTOOLKEYPAIR *pSigningCertKey, RTCRSTORE hAddCerts, 1412 bool fTimestampTypeOld, RTTIMESPEC SigningTime, SIGNTOOLKEYPAIR *pTimestampCertKey) 1415 1413 { 1416 1414 /* … … 1418 1416 */ 1419 1417 RTERRINFOSTATIC ErrInfo; 1420 PRTASN1CORE pSpcRoot = RTCrSpcIndirectDataContent_GetAsn1Core(pSpcIndData); 1421 uint32_t cbSpcEncoded = 0; 1422 int rc = RTAsn1EncodePrepare(pSpcRoot, RTASN1ENCODE_F_DER, &cbSpcEncoded, RTErrInfoInitStatic(&ErrInfo)); 1418 uint32_t cbEncoded = 0; 1419 int rc = RTAsn1EncodePrepare(pToSignRoot, RTASN1ENCODE_F_DER, &cbEncoded, RTErrInfoInitStatic(&ErrInfo)); 1423 1420 if (RT_FAILURE(rc)) 1424 1421 return RTMsgErrorExitFailure("RTAsn1EncodePrepare failed: %Rrc%RTeim", rc, &ErrInfo.Core); 1425 1422 1426 1423 if (cVerbosity >= 4) 1427 RTAsn1Dump(pSpcRoot, 0, 0, RTStrmDumpPrintfV, g_pStdOut); 1428 1429 void *pvSpcEncoded = (uint8_t *)RTMemTmpAllocZ(cbSpcEncoded); 1430 if (!pvSpcEncoded) 1431 return RTMsgErrorExitFailure("Failed to allocate %#z bytes for SpcIndirectData", cbSpcEncoded); 1424 RTAsn1Dump(pToSignRoot, 0, 0, RTStrmDumpPrintfV, g_pStdOut); 1425 1426 void *pvEncoded = (uint8_t *)RTMemTmpAllocZ(cbEncoded); 1427 if (!pvEncoded) 1428 return RTMsgErrorExitFailure("Failed to allocate %#z bytes for encoding data we're signing (%s)", 1429 cbEncoded, pszContentTypeId); 1432 1430 1433 1431 RTEXITCODE rcExit = RTEXITCODE_FAILURE; 1434 rc = RTAsn1EncodeToBuffer(p SpcRoot, RTASN1ENCODE_F_DER, pvSpcEncoded, cbSpcEncoded, RTErrInfoInitStatic(&ErrInfo));1432 rc = RTAsn1EncodeToBuffer(pToSignRoot, RTASN1ENCODE_F_DER, pvEncoded, cbEncoded, RTErrInfoInitStatic(&ErrInfo)); 1435 1433 if (RT_SUCCESS(rc)) 1436 1434 { 1435 size_t const cbToSign = cbEncoded - (fIsRootsParent ? pToSignRoot->cbHdr : 0); 1436 void const *pvToSign = (uint8_t *)pvEncoded + (fIsRootsParent ? pToSignRoot->cbHdr : 0); 1437 1437 1438 /* 1438 1439 * Create additional authenticated attributes. … … 1442 1443 if (RT_SUCCESS(rc)) 1443 1444 { 1444 rcExit = SignToolPkcs7_AddAuthAttribsForImage Signature(&AuthAttribs, SigningTime);1445 rcExit = SignToolPkcs7_AddAuthAttribsForImageOrCatSignature(&AuthAttribs, SigningTime, pszContentTypeId); 1445 1446 if (rcExit == RTEXITCODE_SUCCESS) 1446 1447 { … … 1462 1463 SIGNTOOLPKCS7 Src = { NULL, 0, NULL }; 1463 1464 PSIGNTOOLPKCS7 pSigDst = !pThis->pSignedData ? pThis : &Src; 1464 rcExit = Pkcs7SignStuff("image", pvSpcEncoded, cbSpcEncoded, &AuthAttribs, hAddCerts, 0 /*fExtraFlags*/, 1465 enmSigType /** @todo ?? */, pSigningCertKey, cVerbosity, 1466 (void **)&pSigDst->pbBuf, &pSigDst->cbBuf, &pSigDst->ContentInfo, &pSigDst->pSignedData); 1465 rcExit = SignToolPkcs7_Pkcs7SignStuff("image", pvToSign, cbToSign, &AuthAttribs, hAddCerts, 1466 RTCRPKCS7SIGN_SD_F_NO_DATA_ENCAP, enmSigType /** @todo ?? */, 1467 pSigningCertKey, cVerbosity, 1468 (void **)&pSigDst->pbBuf, &pSigDst->cbBuf, 1469 &pSigDst->ContentInfo, &pSigDst->pSignedData); 1467 1470 if (rcExit == RTEXITCODE_SUCCESS) 1468 1471 { … … 1486 1489 SignToolPkcs7_Delete(&Src); 1487 1490 } 1491 1488 1492 } 1489 1493 RTCrPkcs7Attributes_Delete(&AuthAttribs); … … 1494 1498 else 1495 1499 RTMsgError("RTAsn1EncodeToBuffer failed: %Rrc", rc); 1496 RTMemTmpFree(pv SpcEncoded);1500 RTMemTmpFree(pvEncoded); 1497 1501 return rcExit; 1498 1502 } … … 1772 1776 */ 1773 1777 if (rcExit == RTEXITCODE_SUCCESS) 1774 rcExit = SignToolPkcs7_SignSpcIndData(pThis, &SpcIndData, cVerbosity, 1775 enmSigType, fReplaceExisting, pSigningCertKey, hAddCerts, 1776 fTimestampTypeOld, SigningTime, pTimestampCertKey); 1778 rcExit = SignToolPkcs7_SignData(pThis, RTCrSpcIndirectDataContent_GetAsn1Core(&SpcIndData), false, 1779 RTCRSPCINDIRECTDATACONTENT_OID, cVerbosity, 1780 enmSigType, fReplaceExisting, pSigningCertKey, hAddCerts, 1781 fTimestampTypeOld, SigningTime, pTimestampCertKey); 1777 1782 } 1778 1783 } … … 1787 1792 1788 1793 RTCrSpcIndirectDataContent_Delete(&SpcIndData); 1794 return rcExit; 1795 } 1796 1797 1798 static RTEXITCODE SignToolPkcs7_AddOrReplaceCatSignature(SIGNTOOLPKCS7 *pThis, unsigned cVerbosity, RTDIGESTTYPE enmSigType, 1799 bool fReplaceExisting, SIGNTOOLKEYPAIR *pSigningCertKey, 1800 RTCRSTORE hAddCerts, bool fTimestampTypeOld, 1801 RTTIMESPEC SigningTime, SIGNTOOLKEYPAIR *pTimestampCertKey) 1802 { 1803 AssertReturn(fTimestampTypeOld || pTimestampCertKey->isNull(), 1804 RTMsgErrorExitFailure("New style signatures not supported yet")); 1805 AssertReturn(pThis->pSignedData, RTMsgErrorExitFailure("pSignedData is NULL!")); 1806 1807 /* 1808 * Figure out what to sign first. 1809 */ 1810 PRTASN1CORE pToSign = &pThis->pSignedData->ContentInfo.Content.Asn1Core; 1811 const char *pszType = pThis->pSignedData->ContentInfo.ContentType.szObjId; 1812 if (!fReplaceExisting) 1813 { 1814 if (pThis->pSignedData->SignerInfos.cItems == 0) 1815 fReplaceExisting = false; 1816 else 1817 { 1818 /** @todo figure out nested catalog signatures... It's marked as 1819 * pkcs7-data and seems to be empty, i.e. it's detached. */ 1820 //pszType = RTCR_PKCS7_SIGNED_DATA_OID; 1821 AssertFailedReturn(RTMsgErrorExitFailure("nested cat signing not implemented")); 1822 } 1823 } 1824 1825 /* 1826 * Do the signing. 1827 */ 1828 RTEXITCODE rcExit = SignToolPkcs7_SignData(pThis, pToSign, true, pszType, cVerbosity, enmSigType, fReplaceExisting, 1829 pSigningCertKey, hAddCerts, fTimestampTypeOld, SigningTime, pTimestampCertKey); 1830 1831 /* probably need to clean up stuff related to nested signatures here later... */ 1789 1832 return rcExit; 1790 1833 } … … 2528 2571 rcExit2 = SignToolPkcs7Exe_WriteSignatureToFile(&Exe, cVerbosity); 2529 2572 SignToolPkcs7Exe_Delete(&Exe); 2573 } 2574 if (rcExit2 != RTEXITCODE_SUCCESS && rcExit == RTEXITCODE_SUCCESS) 2575 rcExit = rcExit2; 2576 rcExit2 = RTEXITCODE_SUCCESS; 2577 } 2578 else 2579 { 2580 if (!TimestampCertKey.pCertificate) 2581 RTMsgError("No signing certificate was specified"); 2582 if (TimestampCertKey.hPrivateKey == NIL_RTCRKEY) 2583 RTMsgError("No signing private key was specified"); 2584 2585 if (!TimestampCertKey.pCertificate && !TimestampCertKey.isNull()) 2586 RTMsgError("No timestamp certificate was specified"); 2587 if (TimestampCertKey.hPrivateKey == NIL_RTCRKEY && !TimestampCertKey.isNull()) 2588 RTMsgError("No timestamp private key was specified"); 2589 rcExit2 = RTEXITCODE_SYNTAX; 2590 } 2591 break; 2592 2593 default: 2594 return RTGetOptPrintError(ch, &ValueUnion); 2595 } 2596 if (rcExit2 != RTEXITCODE_SUCCESS) 2597 { 2598 rcExit = rcExit2; 2599 break; 2600 } 2601 } 2602 2603 if (hAddCerts != NIL_RTCRSTORE) 2604 RTCrStoreRelease(hAddCerts); 2605 return rcExit; 2606 } 2607 2608 #endif /*!IPRT_IN_BUILD_TOOL */ 2609 2610 2611 /********************************************************************************************************************************* 2612 * The 'sign-cat' command. * 2613 *********************************************************************************************************************************/ 2614 #ifndef IPRT_IN_BUILD_TOOL 2615 2616 static RTEXITCODE HelpSignCat(PRTSTREAM pStrm, RTSIGNTOOLHELP enmLevel) 2617 { 2618 RT_NOREF_PV(enmLevel); 2619 2620 RTStrmWrappedPrintf(pStrm, RTSTRMWRAPPED_F_HANGING_INDENT, 2621 "sign-exe [-v|--verbose] " 2622 "[--type sha1|sha256] " 2623 "[--append] " 2624 "[--cert-file <file>] " 2625 "[--cert-key <file>] " 2626 "[--add-cert <file>] " 2627 "[--timestamp-cert-file <file>] " 2628 "[--timestamp-key-file <file>] " 2629 "[--timestamp-type old|new] " 2630 "[--timestamp-date <fake-isots>] " 2631 "[--timestamp-year <fake-year>] " 2632 "[--replace-existing|-r] " 2633 "<exe>\n"); 2634 if (enmLevel == RTSIGNTOOLHELP_FULL) 2635 RTStrmWrappedPrintf(pStrm, 0, 2636 "Sign a catalog file.\n" 2637 "\n" 2638 "The --timestamp-override option can take a partial or full ISO timestamp. It is merged " 2639 "with the current time if partial.\n" 2640 "\n"); 2641 return RTEXITCODE_SUCCESS; 2642 } 2643 2644 2645 static RTEXITCODE HandleSignCat(int cArgs, char **papszArgs) 2646 { 2647 /* 2648 * Parse arguments. 2649 */ 2650 static const RTGETOPTDEF s_aOptions[] = 2651 { 2652 { "--append", 'a', RTGETOPT_REQ_NOTHING }, 2653 { "/as", 'a', RTGETOPT_REQ_NOTHING }, 2654 { "--type", 't', RTGETOPT_REQ_STRING }, 2655 { "/fd", 't', RTGETOPT_REQ_STRING }, 2656 { "--add-cert", OPT_ADD_CERT, RTGETOPT_REQ_STRING }, 2657 { "/ac", OPT_ADD_CERT, RTGETOPT_REQ_STRING }, 2658 { "--cert-file", OPT_CERT_FILE, RTGETOPT_REQ_STRING }, 2659 { "--key-file", OPT_KEY_FILE, RTGETOPT_REQ_STRING }, 2660 { "--timestamp-cert-file", OPT_TIMESTAMP_CERT_FILE, RTGETOPT_REQ_STRING }, 2661 { "--timestamp-key-file", OPT_TIMESTAMP_KEY_FILE, RTGETOPT_REQ_STRING }, 2662 { "--timestamp-type", OPT_TIMESTAMP_TYPE, RTGETOPT_REQ_STRING }, 2663 { "--timestamp-override", OPT_TIMESTAMP_OVERRIDE, RTGETOPT_REQ_STRING }, 2664 { "--verbose", 'v', RTGETOPT_REQ_NOTHING }, 2665 { "/v", 'v', RTGETOPT_REQ_NOTHING }, 2666 { "/debug", 'v', RTGETOPT_REQ_NOTHING }, 2667 }; 2668 2669 unsigned cVerbosity = 0; 2670 RTDIGESTTYPE enmSigType = RTDIGESTTYPE_SHA1; 2671 bool fReplaceExisting = true; 2672 SIGNTOOLKEYPAIR SigningCertKey; 2673 RTCRSTORE hAddCerts = NIL_RTCRSTORE; /* leaked if returning directly (--help, --version) */ 2674 bool fTimestampTypeOld = true; 2675 SIGNTOOLKEYPAIR TimestampCertKey; 2676 RTTIMESPEC SigningTime; 2677 RTTimeNow(&SigningTime); 2678 2679 RTGETOPTSTATE GetState; 2680 int rc = RTGetOptInit(&GetState, cArgs, papszArgs, s_aOptions, RT_ELEMENTS(s_aOptions), 1, RTGETOPTINIT_FLAGS_OPTS_FIRST); 2681 AssertRCReturn(rc, RTEXITCODE_FAILURE); 2682 2683 RTEXITCODE rcExit = RTEXITCODE_SUCCESS; 2684 RTGETOPTUNION ValueUnion; 2685 int ch; 2686 while ((ch = RTGetOpt(&GetState, &ValueUnion))) 2687 { 2688 RTEXITCODE rcExit2 = RTEXITCODE_SUCCESS; 2689 switch (ch) 2690 { 2691 case 't': rcExit2 = HandleOptSignatureType(&enmSigType, ValueUnion.psz); break; 2692 case 'a': fReplaceExisting = false; break; 2693 case OPT_CERT_FILE: rcExit2 = HandleOptCertFile(&SigningCertKey, ValueUnion.psz); break; 2694 case OPT_KEY_FILE: rcExit2 = HandleOptKeyFile(&SigningCertKey, ValueUnion.psz); break; 2695 case OPT_ADD_CERT: rcExit2 = HandleOptAddCert(&hAddCerts, ValueUnion.psz); break; 2696 case OPT_TIMESTAMP_CERT_FILE: rcExit2 = HandleOptCertFile(&TimestampCertKey, ValueUnion.psz); break; 2697 case OPT_TIMESTAMP_KEY_FILE: rcExit2 = HandleOptKeyFile(&TimestampCertKey, ValueUnion.psz); break; 2698 case OPT_TIMESTAMP_TYPE: rcExit2 = HandleOptTimestampType(&fTimestampTypeOld, ValueUnion.psz); break; 2699 case OPT_TIMESTAMP_OVERRIDE: rcExit2 = HandleOptTimestampOverride(&SigningTime, ValueUnion.psz); break; 2700 case 'v': cVerbosity++; break; 2701 case 'V': return HandleVersion(cArgs, papszArgs); 2702 case 'h': return HelpSignExe(g_pStdOut, RTSIGNTOOLHELP_FULL); 2703 2704 case VINF_GETOPT_NOT_OPTION: 2705 /* check that we've got all the info we need: */ 2706 if ( SigningCertKey.isComplete() 2707 && (TimestampCertKey.isNull() || TimestampCertKey.isComplete())) 2708 { 2709 /* Do the work: */ 2710 SIGNTOOLPKCS7 Cat; 2711 rcExit2 = SignToolPkcs7_InitFromFile(&Cat, ValueUnion.psz, cVerbosity); 2712 if (rcExit2 == RTEXITCODE_SUCCESS) 2713 { 2714 rcExit2 = SignToolPkcs7_AddOrReplaceCatSignature(&Cat, cVerbosity, enmSigType, fReplaceExisting, 2715 &SigningCertKey, hAddCerts, 2716 fTimestampTypeOld, SigningTime, &TimestampCertKey); 2717 if (rcExit2 == RTEXITCODE_SUCCESS) 2718 rcExit2 = SignToolPkcs7_Encode(&Cat, cVerbosity); 2719 if (rcExit2 == RTEXITCODE_SUCCESS) 2720 rcExit2 = SignToolPkcs7_WriteSignatureToFile(&Cat, ValueUnion.psz, cVerbosity); 2721 SignToolPkcs7_Delete(&Cat); 2530 2722 } 2531 2723 if (rcExit2 != RTEXITCODE_SUCCESS && rcExit == RTEXITCODE_SUCCESS) … … 3617 3809 } 3618 3810 else 3811 { 3619 3812 HandleShowExeWorkerDisplayObjId(pThis, &pSignedData->ContentInfo.ContentType, " ContentType: ", " - not implemented.\n"); 3813 RTPrintf("%s %u (%#x) bytes\n", pThis->szPrefix, 3814 pSignedData->ContentInfo.Content.Asn1Core.cb, pSignedData->ContentInfo.Content.Asn1Core.cb); 3815 } 3620 3816 3621 3817 /* … … 4123 4319 { "add-timestamp-exe-signature", HandleAddTimestampExeSignature, HelpAddTimestampExeSignature }, 4124 4320 { "sign-exe", HandleSignExe, HelpSignExe }, 4321 { "sign-cat", HandleSignCat, HelpSignCat }, 4125 4322 #endif 4126 4323 #ifndef IPRT_IN_BUILD_TOOL
Note:
See TracChangeset
for help on using the changeset viewer.
