pefile: Validate PKCS#7 trust chain



Validate the PKCS#7 trust chain against the contents of the system keyring.

Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Vivek Goyal <vgoyal@redhat.com>

parent af316fc4

crypto/asymmetric_keys/verify_pefile.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -449,7 +449,7 @@ int verify_pefile_signature(const void *pebuf, unsigned pelen,
		if (ret < 0)
		goto error;

		ret = -ENOANO; // Not yet complete
		ret = pkcs7_validate_trust(pkcs7, trusted_keyring, _trusted);

		error:
		pkcs7_free_message(ctx.pkcs7);