efi-boot-shim.git/Cryptlib/Pk/CryptPkcs7VerifyEku.c, branch rolling (mirror of https://github.com/vyos/efi-boot-shim.git)
https://git.amelek.net/vyos/efi-boot-shim.git/atom?h=rolling2025-02-05T14:18:45+00:00Implement the CodeSign EKU check to fulfill the requirements of NIAP OS_PP.2025-02-05T14:18:45+00:00Gary Linglin@suse.com2024-06-05T07:31:04+00:00urn:sha1:15c1a9a310645ceb958587fe000d5f60ed3bc4bd
Also modify the ModSign EKU check to use VerifyEKUsInPkcs7Signature() to
check the signer certificate instead of the certificate directly from the
key database.
This commit supersedes the PR#232 and PR#661 (Apply the EKU checks) so
that author's original codes can be quite independent of other modification.
To answer the question in PR#232, author also changed the conditional
statement to EFI_Status != EFI_SUCCESS right after VerifyEKUsInPkcs7Signature()
in Cryptlib/Pk/CryptPkcs7Verify.c
Signed-off-by: Dennis Tseng <dennis.tseng@suse.com>
Signed-off-by: Gary Lin <glin@suse.com>