Allocate cms_context for peverify_context

This avoids the crash while freeing cms_context.

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
Calculate the dbsize to avoid the infinite loop

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
Update the pathes of db, MokListRT, and dbx

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
Skip the first 4 bytes in the efi variables

The first 4 bytes store the attributes of the efi variable.

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
Match the hashes in the db list

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
Verify the signature with the certs in the dblist

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
Verify the PE image with a certificate

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
It's peverify, not pesign :)

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
Rename peverify to pesigcheck

Signed-off-by: Peter Jones <pjones@redhat.com>
Add some things to the TODO list.

Signed-off-by: Peter Jones <pjones@redhat.com>
Drop the temporary nss dir in pesigcheck

I thought we need a "physical" database for the certificates but
it's actually not necessary. Drop the nss dir creation/deletion
code to avoid the extra file system access.

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
efisiglist: convert the hex array properly

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
efisiglist: Correct the calulation of SignatureListSize

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
efisiglist: support adding a certificate in DER form

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
Fix incorrect assignation, and fix memleak ( since new_sd is allocated and never used )
Changes to make sure we inherit CFLAGS properly from rpmbuild.

This makes sure we build with -fstack-protector-strong when invoked
correctly with it in CFLAGS="" from make.

Signed-off-by: Peter Jones <pjones@redhat.com>
Preserve timestamp during install

  -p, --preserve-timestamps   apply access/modification times of SOURCE files to corresponding destination files
dumpsb - usage message added.

dumpsb accepts command line option ("-s", "--showguid") to display GUIDs.
dumpsb now checks for missing hash description string. If so, displays GUID.

Conflicts:
	util/dumpsb.c
pesign: Add a signing example to pesign man page

I was building linux kernel and it generated an x509 cert and private key
for signing modules. I wanted to use same x509 cert and key to sign bzImage
using pesign. It was not obivious to me how to do that and spent some time
to figure it out.

I think other might run into similar issue. Hence adding an example to
pesign man page.

Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
Format EXAMPLES a bit better and add references.

Signed-off-by: Peter Jones <pjones@redhat.com>