On Fri, 2021-07-16 at 18:15 +0300, Vitaly Chikunov wrote: > Allow user to set signature's keyid using `--keyid' option. Keyid should > correspond to SKID in certificate. When keyid is calculated using SHA-1 > in libimaevm it may mismatch keyid extracted by the kernel from SKID of > certificate (the way public key is presented to the kernel), thus making > signatures not verifiable. This may happen when certificate is using non > SHA-1 SKID (see rfc7093) or just 'unique number' (see rfc5280 4.2.1.2). > As a last resort user may specify arbitrary keyid using the new option. > Certificate filename could be used instead of the hex number with > `--keyid-from-cert' option. And, third option is to read keyid from the > cert appended to the key file. Thanks, applied to next-integrity. Mimi
