[ PATCH v4 3/6] sign-file: add support sign modules in bulk

Shreenidhi Shedi
2023-02-21T17:08:20Z

From: Shreenidhi Shedi <yesshedi@gmail.com>

In the existing system, we need to invoke sign-file binary for every
module we want to sign. This patch adds support to give modules in bulk
and it will sign them all one by one.

Signed-off-by: Shreenidhi Shedi <yesshedi@gmail.com>
---
scripts/sign-file.c | 22 ++++++++++++++++++++--
1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/scripts/sign-file.c b/scripts/sign-file.c
index 3e6d776d126c..97a2aaf8e323 100644
--- a/scripts/sign-file.c
+++ b/scripts/sign-file.c
@@ -224,6 +224,7 @@ struct cmd_opts {
bool replace_orig;
bool raw_sig;
bool sign_only;
+ bool bulk_sign;

#ifndef USE_PKCS7
unsigned int use_keyid;
@@ -237,6 +238,7 @@ static void parse_args(int argc, char **argv, struct cmd_opts *opts)
{"help", no_argument, 0, 'h'},
{"savesig", no_argument, 0, 's'},
{"signonly", no_argument, 0, 'o'},
+ {"bulksign", no_argument, 0, 'b'},
#ifndef USE_PKCS7
{"usekeyid", no_argument, 0, 'k'},
#endif
@@ -305,6 +307,10 @@ static void parse_args(int argc, char **argv, struct cmd_opts *opts)
opts->replace_orig = true;
break;

+ case 'b':
+ opts->bulk_sign = true;
+ break;
+
case -1:
break;

@@ -330,7 +336,7 @@ static int sign_file(int argc, char **argv, struct cmd_opts *opts)
#endif
X509 *x509;
BIO *bd, *bm;
- int n;
+ int i, n;

char *hash_algo = opts->hash_algo;
char *dest_name = opts->dest_name;
@@ -342,12 +348,13 @@ static int sign_file(int argc, char **argv, struct cmd_opts *opts)
bool replace_orig = opts->replace_orig;
bool raw_sig = opts->raw_sig;
bool sign_only = opts->sign_only;
+ bool bulk_sign = opts->bulk_sign;

#ifndef USE_PKCS7
unsigned int use_keyid = opts->use_keyid;
#endif

- if (!argv[0] || argc != 1)
+ if ((bulk_sign && dest_name) || (!bulk_sign && argc != 1))
format();

if (dest_name && strcmp(argv[0], dest_name)) {
@@ -378,6 +385,16 @@ static int sign_file(int argc, char **argv, struct cmd_opts *opts)
use_signed_attrs = PKCS7_NOATTR;
#endif

+ for (i = 0; i < argc; i++) {
+ module_name = argv[i];
+
+ if (bulk_sign) {
+ ERR(asprintf(&dest_name, "%s.~signed~", module_name) < 0,
+ "asprintf");
+ if (!replace_orig)
+ replace_orig = true;
+ }
+
/* Open the module file */
bm = BIO_new_file(module_name, "rb");
ERR(!bm, "%s", module_name);
@@ -486,6 +503,7 @@ static int sign_file(int argc, char **argv, struct cmd_opts *opts)
/* Finally, if we're signing in place, replace the original. */
if (replace_orig)
ERR(rename(dest_name, module_name) < 0, "%s", dest_name);
+ }

return 0;
}
--
2.39.1