SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

measure-tool: always sign with SHA256

Browse Source 
We should not use the bank algorithm for the signing, as we only support
validating via SHA256. Fix that.

Fixes: #40245
This commit is contained in:
Lennart Poettering
2026-03-11 18:40:57 +00:00
committed by Luca Boccassi
parent af62b9c5b0
commit 4b551035b4
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/measure/measure-tool.c
+4 -1
View File
@@ -935,7 +935,10 @@ static int build_policy_digest(bool sign) {
_cleanup_free_ void *sig = NULL;
size_t ss = 0;
if (privkey) {
r = digest_and_sign(p->md, privkey, pcr_policy_digest.buffer, pcr_policy_digest.size, &sig, &ss);
/* We always use SHA256 for signing currently. Regardless of the bank. */
const EVP_MD *sha256 = ASSERT_PTR(EVP_get_digestbyname("sha256"));
r = digest_and_sign(sha256, privkey, pcr_policy_digest.buffer, pcr_policy_digest.size, &sig, &ss);
if (r == -EADDRNOTAVAIL)
return log_error_errno(r, "Hash algorithm '%s' not available while signing. (Maybe OS security policy disables this algorithm?)", EVP_MD_name(p->md));
if (r < 0)