Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley
	Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United
	Kingdom.
	Registered in England and Wales under Company Registration No. 3798903
From: David Howells <dhowells@redhat.com>
In-Reply-To: <20150518231304.GZ23057@wotan.suse.de>
References: <20150518231304.GZ23057@wotan.suse.de> <20150515123610.16723.61913.stgit@warthog.procyon.org.uk> <20150515123513.16723.96340.stgit@warthog.procyon.org.uk> <21177.1431716875@warthog.procyon.org.uk>
To: "Luis R. Rodriguez" <mcgrof@suse.com>
Cc: dhowells@redhat.com, rusty@rustcorp.com.au, mmarek@suse.cz,
        mjg59@srcf.ucam.org, keyrings@linux-nfs.org, dmitry.kasatkin@gmail.com,
        linux-kernel@vger.kernel.org, seth.forshee@canonical.com,
        linux-security-module@vger.kernel.org, dwmw2@infradead.org
Subject: Re: sign-file and detached PKCS#7 firmware signatures
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <8930.1432027524.1@warthog.procyon.org.uk>
Date: Tue, 19 May 2015 10:25:24 +0100
Message-ID: <8931.1432027524@warthog.procyon.org.uk>
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 731
Lines: 27

Luis R. Rodriguez <mcgrof@suse.com> wrote:

> There's a missing -binary argument here, other than that this works fine.

Good point.

> > 		 >$PKCS7_MESSAGE_FILE_IN_DER_FORM
> 
> I however cannot figure out how to use openssl to verify this signature.

Something like:

	openssl smime -verify \
		-in $PKCS7_MESSAGE_FILE_IN_DER_FORM \
		-inform DER \
		-content $FIRMWARE_BLOB_NAME \
		-inkey $PRIVATE_KEY_FILE_IN_PEM_FORM \
		-signer $X509_CERT_FILE_IN_PEM_FORM

I would guess.

David
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/