Handle binaries with multiple signatures.

This adds support for multiple signatures.  It first tries validating
the binary by hash, first against our dbx lists, then against our db
lists.  If it isn't allowed or rejected at that step, it continues to
the normal routine of checking all the signatures.

At this point it does *not* reject a binary just because a signature is
by a cert on a dbx list, though that will override any db list that
certificate is listed on.  If at any point any assertion about the
binary or signature list being well-formed fails, the binary is
immediately rejected, though we do allow skipping over signatures
which have an unsupported sig->Hdr.wCertificateType.

Signed-off-by: Peter Jones <pjones@redhat.com>
Upstream: pr#210

0 files changed, 0 insertions, 0 deletions