Just some whitespace fixups.

Signed-off-by: Peter Jones <pjones@redhat.com>
Close insigfd only once.

Noticed this in valgrind.

Signed-off-by: Peter Jones <pjones@redhat.com>
Tear down digests when we _fini() cms.

Signed-off-by: Peter Jones <pjones@redhat.com>
Free all signature data.

Turns out some of it was coming from PORT_ZAlloc() and some wasn't, so
make it so cms->signatures[] is uniformly from calloc(), and free it
where we think we should.

Handle cms->newsig much the same way.

Thanks, valgrind.

Signed-off-by: Peter Jones <pjones@redhat.com>
Make check_signature_space() more thorough.

Check and make sure that there's enough space for either a) the exact right
amount, or b) at least enough to round up 8 bytes.

Signed-off-by: Peter Jones <pjones@redhat.com>
Add some helper functions for our space calculations on addign sigs.

Signed-off-by: Peter Jones <pjones@redhat.com>
Use the helper functions we've added.

Signed-off-by: Peter Jones <pjones@redhat.com>
Use better helpers for the arithmetic to figure out how much space to add.

Signed-off-by: Peter Jones <pjones@redhat.com>
Zero the pad space between our signature and the next WIN_CERTIFICATE.

Signed-off-by: Peter Jones <pjones@redhat.com>
Generate "correct" cert padding between cert list entries and at the end.

The spec seems to accidentally say to do this.

Signed-off-by: Peter Jones <pjones@redhat.com>
Make next_cert() handle win_certificate.length not including padding.

The spec says that technically win_certificate.length should /not/
include any padding at the end of a signature (though the DD entry must
include any present padding's size).

This still allows us to show old signed binaries correctly.

Signed-off-by: Peter Jones <pjones@redhat.com>
Don't include the certificate list padding offsets in wincere->dwLength.

PE 8.3 says:

| Notice that certificates always start on an octaword boundary. If a
| certificate is not an even number of octawords long, it is zero padded
| to the next octaword boundary. However, the length of the certificate
| does not include this padding and so any certificate navigation software
| must be sure to round up to the next octaword to locate another
| certificate.

In this case "a certificate" means a WIN_CERTIFICATE structure.  So
don't put the padding in its length field.

Unfortunately, this will mean pesign produces binaries that old versions
of pesign won't be able to read correctly.

Signed-off-by: Peter Jones <pjones@redhat.com>
Remove a memory leak in --list.

Yeah, not really that important.

Signed-off-by: Peter Jones <pjones@redhat.com>
Build as PIE+RELRO binaries.

Resolves: rhbz#1092542

Signed-off-by: Peter Jones <pjones@redhat.com>