mirror of
https://github.com/clearlinux/clearlinux.github.io.git
synced 2026-04-28 11:13:42 +00:00
482 lines
28 KiB
HTML
482 lines
28 KiB
HTML
|
||
|
||
<!-- THEME DEBUG -->
|
||
<!-- THEME HOOK: 'html' -->
|
||
<!-- FILE NAME SUGGESTIONS:
|
||
* html--node--687.html.twig
|
||
* html--node--%.html.twig
|
||
* html--node.html.twig
|
||
x html.html.twig
|
||
-->
|
||
<!-- BEGIN OUTPUT from 'modules/custom/clearlinux.org/themes/clearlinux_theme/templates/layout/html.html.twig' -->
|
||
<!DOCTYPE html>
|
||
<html lang="en" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/ dc: http://purl.org/dc/terms/ foaf: http://xmlns.com/foaf/0.1/ og: http://ogp.me/ns# rdfs: http://www.w3.org/2000/01/rdf-schema# schema: http://schema.org/ sioc: http://rdfs.org/sioc/ns# sioct: http://rdfs.org/sioc/types# skos: http://www.w3.org/2004/02/skos/core# xsd: http://www.w3.org/2001/XMLSchema# ">
|
||
<head>
|
||
<meta charset="utf-8" />
|
||
|
||
|
||
<meta name="description" content="Client updates: verification of the signed MoM Before we can begin to determine whether content is secure and verifiable, we must consider an important first step: starting from a known point of trust." />
|
||
<meta property="og:site_name" content="Clear Linux* Project" />
|
||
<meta property="og:type" content="Blog" />
|
||
<meta property="og:url" content="https://clearlinux.org/news-blogs/openssl-content-verification-clear-linux-os" />
|
||
<meta property="og:title" content="OpenSSL content verification in Clear Linux* OS" />
|
||
<meta property="og:description" content="Client updates: verification of the signed MoM Before we can begin to determine whether content is secure and verifiable, we must consider an important first step: starting from a known point of trust." />
|
||
<meta name="Generator" content="Drupal 9 (https://www.drupal.org)" />
|
||
<meta name="MobileOptimized" content="width" />
|
||
<meta name="HandheldFriendly" content="true" />
|
||
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
|
||
<style>div#sliding-popup, div#sliding-popup .eu-cookie-withdraw-banner, .eu-cookie-withdraw-tab {background: #0779BF} div#sliding-popup.eu-cookie-withdraw-wrapper { background: transparent; } #sliding-popup h1, #sliding-popup h2, #sliding-popup h3, #sliding-popup p, #sliding-popup label, #sliding-popup div, .eu-cookie-compliance-more-button, .eu-cookie-compliance-secondary-button, .eu-cookie-withdraw-tab { color: #ffffff;} .eu-cookie-withdraw-tab { border-color: #ffffff;}</style>
|
||
<link rel="icon" href="https://clearlinux.org/modules/custom/clearlinux.org/themes/clearlinux_theme/favicon.ico" type="image/vnd.microsoft.icon" />
|
||
<link rel="canonical" href="687.html" />
|
||
<link rel="shortlink" href="687.html" />
|
||
<script src="https://clearlinux.org/sites/default/files/eu_cookie_compliance/eu_cookie_compliance.script.js" defer></script>
|
||
|
||
<title>OpenSSL content verification in Clear Linux* OS | Clear Linux* Project</title>
|
||
<link rel="stylesheet" media="all" href="https://clearlinux.org/core/themes/stable/css/system/components/ajax-progress.module.css" />
|
||
<link rel="stylesheet" media="all" href="https://clearlinux.org/core/themes/stable/css/system/components/align.module.css" />
|
||
<link rel="stylesheet" media="all" href="https://clearlinux.org/core/themes/stable/css/system/components/autocomplete-loading.module.css" />
|
||
<link rel="stylesheet" media="all" href="https://clearlinux.org/core/themes/stable/css/system/components/fieldgroup.module.css" />
|
||
<link rel="stylesheet" media="all" href="https://clearlinux.org/core/themes/stable/css/system/components/container-inline.module.css" />
|
||
<link rel="stylesheet" media="all" href="https://clearlinux.org/core/themes/stable/css/system/components/clearfix.module.css" />
|
||
<link rel="stylesheet" media="all" href="https://clearlinux.org/core/themes/stable/css/system/components/details.module.css" />
|
||
<link rel="stylesheet" media="all" href="https://clearlinux.org/core/themes/stable/css/system/components/hidden.module.css" />
|
||
<link rel="stylesheet" media="all" href="https://clearlinux.org/core/themes/stable/css/system/components/item-list.module.css" />
|
||
<link rel="stylesheet" media="all" href="https://clearlinux.org/core/themes/stable/css/system/components/js.module.css" />
|
||
<link rel="stylesheet" media="all" href="https://clearlinux.org/core/themes/stable/css/system/components/nowrap.module.css" />
|
||
<link rel="stylesheet" media="all" href="https://clearlinux.org/core/themes/stable/css/system/components/position-container.module.css" />
|
||
<link rel="stylesheet" media="all" href="https://clearlinux.org/core/themes/stable/css/system/components/progress.module.css" />
|
||
<link rel="stylesheet" media="all" href="https://clearlinux.org/core/themes/stable/css/system/components/reset-appearance.module.css" />
|
||
<link rel="stylesheet" media="all" href="https://clearlinux.org/core/themes/stable/css/system/components/resize.module.css" />
|
||
<link rel="stylesheet" media="all" href="https://clearlinux.org/core/themes/stable/css/system/components/sticky-header.module.css" />
|
||
<link rel="stylesheet" media="all" href="https://clearlinux.org/core/themes/stable/css/system/components/system-status-counter.css" />
|
||
<link rel="stylesheet" media="all" href="https://clearlinux.org/core/themes/stable/css/system/components/system-status-report-counters.css" />
|
||
<link rel="stylesheet" media="all" href="https://clearlinux.org/core/themes/stable/css/system/components/system-status-report-general-info.css" />
|
||
<link rel="stylesheet" media="all" href="https://clearlinux.org/core/themes/stable/css/system/components/tabledrag.module.css" />
|
||
<link rel="stylesheet" media="all" href="https://clearlinux.org/core/themes/stable/css/system/components/tablesort.module.css" />
|
||
<link rel="stylesheet" media="all" href="https://clearlinux.org/core/themes/stable/css/system/components/tree-child.module.css" />
|
||
<link rel="stylesheet" media="all" href="https://clearlinux.org/modules/contrib/eu_cookie_compliance/css/eu_cookie_compliance.css" />
|
||
<link rel="stylesheet" media="all" href="https://clearlinux.org/modules/contrib/extlink/extlink.css" />
|
||
<link rel="stylesheet" media="all" href="https://use.fontawesome.com/releases/v6.1.0/css/all.css" />
|
||
<link rel="stylesheet" media="all" href="https://use.fontawesome.com/releases/v6.1.0/css/v4-shims.css" />
|
||
<link rel="stylesheet" media="all" href="https://clearlinux.org/libraries/codesnippet/lib/highlight/styles/monokai_sublime.css" />
|
||
<link rel="stylesheet" media="all" href="https://clearlinux.org/modules/custom/clearlinux.org/themes/clearlinux_theme/css/styles.css" />
|
||
<link rel="stylesheet" media="all" href="https://cdnjs.cloudflare.com/ajax/libs/OwlCarousel2/2.2.1/assets/owl.carousel.min.css" integrity="sha256-AWqwvQ3kg5aA5KcXpX25sYKowsX97sTCTbeo33Yfyk0=" crossorigin="anonymous" />
|
||
|
||
<script src="https://clearlinux.org/core/assets/vendor/modernizr/modernizr.min.js?v=3.11.7"></script>
|
||
<script src="https://clearlinux.org/core/misc/modernizr-additional-tests.js?v=3.11.7"></script>
|
||
|
||
</head>
|
||
<body class="alias--news-blogs-openssl-content-verification-clear-linux-os nodetype--blog logged-out">
|
||
<div id="skip">
|
||
<a class="visually-hidden focusable skip-link" href="687.html#main-menu">
|
||
Skip to main navigation
|
||
</a>
|
||
</div>
|
||
|
||
|
||
|
||
<!-- THEME DEBUG -->
|
||
<!-- THEME HOOK: 'off_canvas_page_wrapper' -->
|
||
<!-- BEGIN OUTPUT from 'core/themes/stable/templates/content/off-canvas-page-wrapper.html.twig' -->
|
||
<div class="dialog-off-canvas-main-canvas" data-off-canvas-main-canvas>
|
||
|
||
|
||
<!-- THEME DEBUG -->
|
||
<!-- THEME HOOK: 'page' -->
|
||
<!-- FILE NAME SUGGESTIONS:
|
||
* page--node--blog.html.twig
|
||
* page--node--687.html.twig
|
||
* page--node--%.html.twig
|
||
* page--node.html.twig
|
||
x page.html.twig
|
||
-->
|
||
<!-- BEGIN OUTPUT from 'modules/custom/clearlinux.org/themes/clearlinux_theme/templates/layout/page.html.twig' -->
|
||
<!-- ______________________ HEADER _______________________ -->
|
||
|
||
|
||
|
||
<header id="header">
|
||
<div class="container padding-md--left-right">
|
||
<div class="header__menu_mobile">
|
||
<i class="fa fa-bars header__menu_mobile__control" aria-hidden="true"></i>
|
||
</div>
|
||
|
||
<div id="header__site_info">
|
||
<div class="header__site_img_wrapper">
|
||
<a href ="https://clearlinux.org/">
|
||
<img class="header__site_img_object" src="https://clearlinux.org/modules/custom/clearlinux.org/themes/clearlinux_theme/clear_linux_logo.svg" alt="Logo Clear Linux* Project"/>
|
||
<img class="header__site_txt_object" src="https://clearlinux.org/modules/custom/clearlinux.org/themes/clearlinux_theme/sass/components/layout/header/assets/clear-linux-text.svg" />
|
||
</a>
|
||
</div>
|
||
</div>
|
||
|
||
<nav class="header__menu">
|
||
<ul class="header__menu_list">
|
||
<li class="header__menu_list_item ">
|
||
<a tabindex='1' href="31099.html">About</a>
|
||
</li>
|
||
<li class="header__menu_list_item ">
|
||
<a tabindex='1' href="31103.html">Developer</a>
|
||
</li>
|
||
<li class="header__menu_list_item ">
|
||
<a tabindex='1' href="https://clearlinux.org/software/software.html">Software</a>
|
||
</li>
|
||
</ul>
|
||
</nav>
|
||
|
||
<div class="header__search">
|
||
|
||
|
||
<div class="header__search_form__wrapper">
|
||
</div>
|
||
</div>
|
||
</div>
|
||
|
||
</div>
|
||
</header>
|
||
<!-- /header -->
|
||
<div class="header__menu-submenu green">
|
||
<div class="toolbar__container">
|
||
<div class="container padding-md--left-right">
|
||
<ul class='Header__main'>
|
||
</ul>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
|
||
|
||
|
||
<div class="wrapper banner blog" >
|
||
<div class="banner__gradient "></div>
|
||
<div class="container banner__container ">
|
||
<div class="banner__content">
|
||
<h1 class="banner__title">Blogs & News</h1>
|
||
|
||
|
||
|
||
</div>
|
||
|
||
</div>
|
||
</div>
|
||
|
||
<!-- Page Header -->
|
||
<div class="page_header">
|
||
<div class="page_header__main">
|
||
|
||
<!-- tabs -->
|
||
|
||
</div>
|
||
</div>
|
||
<!-- End Page Header -->
|
||
|
||
<!-- ______________________ MAIN _______________________ -->
|
||
<main class="page-standard padding-md--top padding-lg--bottom padding-md--left-right container-xl">
|
||
|
||
|
||
|
||
|
||
<!-- THEME DEBUG -->
|
||
<!-- THEME HOOK: 'region' -->
|
||
<!-- FILE NAME SUGGESTIONS:
|
||
x region--content.html.twig
|
||
* region.html.twig
|
||
-->
|
||
<!-- BEGIN OUTPUT from 'modules/custom/clearlinux.org/themes/clearlinux_theme/templates/layout/region--content.html.twig' -->
|
||
|
||
|
||
<!-- THEME DEBUG -->
|
||
<!-- THEME HOOK: 'block' -->
|
||
<!-- FILE NAME SUGGESTIONS:
|
||
* block--clearlinux-theme-messages.html.twig
|
||
x block--system-messages-block.html.twig
|
||
* block--system.html.twig
|
||
* block.html.twig
|
||
-->
|
||
<!-- BEGIN OUTPUT from 'core/themes/stable/templates/block/block--system-messages-block.html.twig' -->
|
||
<div data-drupal-messages-fallback class="hidden"></div>
|
||
|
||
<!-- END OUTPUT from 'core/themes/stable/templates/block/block--system-messages-block.html.twig' -->
|
||
|
||
|
||
|
||
<!-- THEME DEBUG -->
|
||
<!-- THEME HOOK: 'block' -->
|
||
<!-- FILE NAME SUGGESTIONS:
|
||
x block--sharethis.html.twig
|
||
* block--sharethis-block.html.twig
|
||
x block--sharethis.html.twig
|
||
* block.html.twig
|
||
-->
|
||
<!-- BEGIN OUTPUT from 'modules/custom/clearlinux.org/themes/clearlinux_theme/templates/block/block--sharethis.html.twig' -->
|
||
<div id="block-sharethis" data-block-plugin-id="sharethis_block" class="block block-sharethis block-sharethis-block social_share">
|
||
<div class="sharethis-wrapper">
|
||
<a target="_blank" href="https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fclearlinux.org%2Fnews-blogs%2Fwhere-etcfstab-clear-linux&%3Bsrc=sdkpreparse" class="st_facebook_custom"></a>
|
||
<a target="_blank" href="https://twitter.com/intent/tweet?text=Clear%20Linux*%20Project&url=https%3A%2F%2Fclearlinux.org%2Fnews-blogs%2Fwhere-etcfstab-clear-linux" class="st_twitter_custom"></a>
|
||
<a target="_blank" href="https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fclearlinux.org%2Fnews-blogs%2Fwhere-etcfstab-clear-linux&title=Clear%20Linux*%20Project" class="st_linkedin_custom"></a>
|
||
</div>
|
||
</div>
|
||
<!-- END OUTPUT from 'modules/custom/clearlinux.org/themes/clearlinux_theme/templates/block/block--sharethis.html.twig' -->
|
||
|
||
|
||
|
||
<!-- THEME DEBUG -->
|
||
<!-- THEME HOOK: 'block' -->
|
||
<!-- FILE NAME SUGGESTIONS:
|
||
x block--clearlinux-theme-content.html.twig
|
||
* block--system-main-block.html.twig
|
||
* block--system.html.twig
|
||
* block.html.twig
|
||
-->
|
||
<!-- BEGIN OUTPUT from 'modules/custom/clearlinux.org/themes/clearlinux_theme/templates/block/block--clearlinux-theme-content.html.twig' -->
|
||
|
||
|
||
<!-- THEME DEBUG -->
|
||
<!-- THEME HOOK: 'node' -->
|
||
<!-- FILE NAME SUGGESTIONS:
|
||
* node--687--full.html.twig
|
||
* node--687.html.twig
|
||
x node--blog--full.html.twig
|
||
* node--blog.html.twig
|
||
* node--full.html.twig
|
||
* node.html.twig
|
||
-->
|
||
<!-- BEGIN OUTPUT from 'modules/custom/clearlinux.org/themes/clearlinux_theme/templates/content/node--blog--full.html.twig' -->
|
||
<div class="blog_detail">
|
||
|
||
<div class="blog_detail__categories">
|
||
<a tabindex='2' href='../blogs_category_5.html' title='Maintenance'>Maintenance</a>
|
||
</div>
|
||
|
||
<h1 class="blog_detail__title">
|
||
|
||
<!-- THEME DEBUG -->
|
||
<!-- THEME HOOK: 'field' -->
|
||
<!-- FILE NAME SUGGESTIONS:
|
||
* field--node--title--blog.html.twig
|
||
x field--node--title.html.twig
|
||
* field--node--blog.html.twig
|
||
* field--title.html.twig
|
||
* field--string.html.twig
|
||
* field.html.twig
|
||
-->
|
||
<!-- BEGIN OUTPUT from 'core/themes/stable/templates/field/field--node--title.html.twig' -->
|
||
<span>OpenSSL content verification in Clear Linux* OS</span>
|
||
|
||
<!-- END OUTPUT from 'core/themes/stable/templates/field/field--node--title.html.twig' -->
|
||
|
||
</h1>
|
||
|
||
|
||
<p class="blog_detail__date">11 Aug, 2016</p>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<!-- THEME DEBUG -->
|
||
<!-- THEME HOOK: 'links__node' -->
|
||
<!-- FILE NAME SUGGESTIONS:
|
||
* links--node.html.twig
|
||
x links.html.twig
|
||
-->
|
||
<!-- BEGIN OUTPUT from 'themes/contrib/cog/templates/navigation/links.html.twig' -->
|
||
|
||
<!-- END OUTPUT from 'themes/contrib/cog/templates/navigation/links.html.twig' -->
|
||
|
||
|
||
|
||
<!-- THEME DEBUG -->
|
||
<!-- THEME HOOK: 'field' -->
|
||
<!-- FILE NAME SUGGESTIONS:
|
||
* field--node--body--blog.html.twig
|
||
x field--node--body.html.twig
|
||
* field--node--blog.html.twig
|
||
* field--body.html.twig
|
||
* field--text-with-summary.html.twig
|
||
* field.html.twig
|
||
-->
|
||
<!-- BEGIN OUTPUT from 'modules/custom/clearlinux.org/themes/clearlinux_theme/templates/field/field--node--body.html.twig' -->
|
||
|
||
|
||
<div class="Text__description">
|
||
<h2>Client updates: verification of the signed MoM</h2>
|
||
|
||
<p>Before we can begin to determine whether content is secure and verifiable, we must consider an important first step: starting from a known point of trust.</p>
|
||
|
||
<p>A client running Clear Linux boots into a system that has established trust before it ever reaches out to the web. This is accomplished by including the public certificate with each image we release during image creation. The certificate cannot be modified by anyone other than root, and this ensures that all future content is trusted before installing it on the file system.</p>
|
||
|
||
<p>The client implements OpenSSL verification as explained above; however, the process is much more complex than verifying via command line. The client-updater code follows this general process:</p>
|
||
|
||
<ul><li>
|
||
<p>Initializes OpenSSL and certificate</p>
|
||
</li>
|
||
<li>
|
||
<p>Extracts the public key from the certificate file</p>
|
||
</li>
|
||
<li>
|
||
<p>Validates the certificate before it can be used</p>
|
||
</li>
|
||
<li>
|
||
<p>Sets up the proper certificate stores</p>
|
||
</li>
|
||
<li>
|
||
<p>Verifies content signature</p>
|
||
|
||
<ul><li>First checks the local file system for the signature and the manifest to verify</li>
|
||
<li>Downloads the signature and manifest if they fail verification or if they do not exist</li>
|
||
</ul></li>
|
||
<li>
|
||
<p>Returns result & terminates signatures (cleanup)</p>
|
||
</li>
|
||
</ul><h2>Initializing OpenSSL</h2>
|
||
|
||
<p>The OpenSSL context must be set up correctly for any verification to work; thus, the very first lines called are:</p>
|
||
|
||
<p><code>ERR_load_crypto_strings(); ERR_load_PKCS7_strings(); EVP_add_digest(EVP_sha256()); </code></p>
|
||
|
||
<p>The first two lines are fairly self-explanatory: they load the error strings for all of the libcrypto and PKCS7 functions that we may call. The important call here is <code class="inline">EVP_add_digest()</code> because it defines exactly what hashing algorithm we want the verification to use (<strong>SHA256</strong>), as opposed to loading all the digests and cipher algorithms. It provides added security by only supporting certificates and signatures that use that specific algorithm, while ignoring weaker cipher suites such as SHA1.</p>
|
||
|
||
<p>From there we open the certificate as read only and then read it in to an X509 struct with the following:</p>
|
||
|
||
<p><code>fp_pubkey = fopen(CERTNAME, "r"); cert = PEM_read_X509(fp_pubkey, NULL, NULL, NULL); </code></p>
|
||
|
||
<h3>Creating a certificate store</h3>
|
||
|
||
<p>The <strong>cert</strong> is added to the certificate store and is used as part of the certificate validation (as well as the signature verification) since the store is passed into the verify function.</p>
|
||
|
||
<p>At this point, we have a loaded certificate, but the certificate store must be set up so we can pass it to verify and to validate the certificate chain (if there is one). The relevant portions to do this are:</p>
|
||
|
||
<p><code>/* create the cert store and set the verify callback */ if (!(store = X509_STORE_new())) { fprintf(stderr, "Failed X509_STORE_new() for %s\n", CERTNAME); goto error; } /* Add the certificates to be verified to the store */ if (!(lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file()))) { fprintf(stderr, "Failed X509_STORE_add_lookup() for %s\n", CERTNAME); goto error; } /* Load our Root cert, which can be in either DER or PEM format */ if (!X509_load_cert_file(lookup, CERTNAME, X509_FILETYPE_PEM)) { fprintf(stderr, "Failed X509_load_cert_file() for %s\n", CERTNAME); goto error; } /* create a verification context and initialize it */ if (!(verify_ctx = X509_STORE_CTX_new())) { fprintf(stderr, "Failed X509_STORE_CTX_new() for %s\n", CERTNAME); goto error; } /* Initialize the verification context withthe store and certificate */ if (X509_STORE_CTX_init(verify_ctx, store, cert, NULL) != 1) { fprintf(stderr, "Failed X509_STORE_CTX_init() for %s\n", CERTNAME); goto error; } /* Specify which cert to validate in the verify context. * This is required because we may add multiple certs to the X509 store, * but we want to validate a specific one out of the group/chain. */ X509_STORE_CTX_set_cert(verify_ctx, cert); /* verify the certificate */ if (X509_verify_cert(verify_ctx) != 1) { fprintf(stderr, "Failed X509_verify_cert() for %s\n", CERTNAME); goto error; } </code></p>
|
||
|
||
<p>A self-signed certificate should always verify as "valid"; however, if a chain and CRL are provided, then that chain will be validated if passed into the verify context. The certificate store acts as a container for the entire chain, and we choose which cert out of them needs to be verified. Later in the signature verification, the store is also used by the PKCS7 verify function.</p>
|
||
|
||
<h3>Verifying the signature</h3>
|
||
|
||
<p>With the certificate loaded and the store initialized, the <code class="inline">Manifest.MoM</code> is finally able to be verified against the signature. The following code shows the proper way to intialize all the required data structures for performing signature verification, as well as the call to <code class="inline">PKCS7_verify()</code>.</p>
|
||
|
||
<p><code>/* get the signature */ sig_fd = open(sig_filename, O_RDONLY); if (sig_fd == -1) { string_or_die(&errorstr, "Failed open %s: %s\n", sig_filename, strerror(errno)); goto error; } if (fstat(sig_fd, &st) != 0) { string_or_die(&errorstr, "Failed to stat %s file\n", sig_filename); goto error; } sig_len = st.st_size; sig = mmap(NULL, sig_len, PROT_READ, MAP_PRIVATE, sig_fd, 0); if (sig == MAP_FAILED) { string_or_die(&errorstr, "Failed to mmap %s signature\n", sig_filename); goto error; } sig_BIO = BIO_new_mem_buf(sig, sig_len); if (!sig_BIO) { string_or_die(&errorstr, "Failed to read %s signature into BIO\n", sig_filename); goto error; } /* the signature is in DER format, so d2i it into verification pkcs7 form */ p7 = d2i_PKCS7_bio(sig_BIO, NULL); if (p7 == NULL) { string_or_die(&errorstr, "NULL PKCS7 File\n"); goto error; } /* get the data to be verified */ data_fd = open(data_filename, O_RDONLY); if (data_fd == -1) { string_or_die(&errorstr, "Failed open %s\n", data_filename); goto error; } if (fstat(data_fd, &st) != 0) { string_or_die(&errorstr, "Failed to stat %s\n", data_filename); goto error; } data_len = st.st_size; data = mmap(NULL, data_len, PROT_READ, MAP_PRIVATE, data_fd, 0); if (data == MAP_FAILED) { string_or_die(&errorstr, "Failed to mmap %s\n", data_filename); goto error; } data_BIO = BIO_new_mem_buf(data, data_len); if (!data_BIO) { string_or_die(&errorstr, "Failed to read %s into BIO\n", data_filename); goto error; } /* munge the signature and data into a verifiable format */ verify_BIO = PKCS7_dataInit(p7, data_BIO); if (!verify_BIO) { string_or_die(&errorstr, "Failed PKCS7_dataInit()\n"); goto error; } /* Verify the signature, outdata can be NULL because we don't use it */ ret = PKCS7_verify(p7, x509_stack, store, verify_BIO, NULL, 0); </code></p>
|
||
|
||
<p>The <code class="inline">Manifest.MoM</code> (the data to be verified), and the <code class="inline">Manifest.MoM.sig</code> (the provided signature file) are both loaded into memory and are then used to initialize some <strong>BIO</strong> memory buffers; the data must be added into these BIO structs for the PKCS7 functions to be able to use them.</p>
|
||
|
||
<p>An important call to note is:</p>
|
||
|
||
<p><code>p7 = d2i_PKCS7_bio(sig_BIO, NULL); </code></p>
|
||
|
||
<p>This reads the signature from the BIO into a PKCS7 object, specifically in DER format - which can be confirmed using the OpenSSL command line. If the signature is opened with the wrong format, the verification will fail. Once we have the PKCS7 object, we create a verification BIO that contains it and the data BIO (Manifest.MoM), and pass it into PKCS7_verify(), which handles all of the verification behind the scenes. The verification function does all the hashing and checking of the data and signature, returning <em>one</em> if it successfully verifies the signature.</p>
|
||
|
||
<p>If the signature verifies correctly, the Manifest.MoM is confirmed to be legitimate, and the rest of the software update process continues. The manifest and signature are first verified on disk if they exist. If that check fails, they are removed, and a new manifest and signature file are downloaded and verified again. Should the verification fail, no content can be trusted, and the system's trust is said to be broken. Because of all the content branching from the Manifest.MoM, it is the only file we need to verify to ensure all other content is also trusted, keeping verification very minimal.</p>
|
||
</div>
|
||
|
||
<!-- END OUTPUT from 'modules/custom/clearlinux.org/themes/clearlinux_theme/templates/field/field--node--body.html.twig' -->
|
||
|
||
|
||
|
||
</div>
|
||
|
||
|
||
|
||
<a class="back_to_top" href="687.html#">
|
||
<i class="fa fa-angle-up"> </i>
|
||
</a>
|
||
|
||
<!-- END OUTPUT from 'modules/custom/clearlinux.org/themes/clearlinux_theme/templates/content/node--blog--full.html.twig' -->
|
||
|
||
|
||
|
||
<!-- END OUTPUT from 'modules/custom/clearlinux.org/themes/clearlinux_theme/templates/block/block--clearlinux-theme-content.html.twig' -->
|
||
|
||
|
||
|
||
<!-- END OUTPUT from 'modules/custom/clearlinux.org/themes/clearlinux_theme/templates/layout/region--content.html.twig' -->
|
||
|
||
|
||
</main>
|
||
|
||
<!-- /main -->
|
||
|
||
|
||
<footer class="footer">
|
||
<div class="container padding-md--top-bottom padding-md--left-right">
|
||
<div class="footer__logo">
|
||
<div class="footer__logo__wrapper">
|
||
<img class="footer__site_img_object" src="https://clearlinux.org/modules/custom/clearlinux.org/themes/clearlinux_theme/clear_linux_logo.svg" alt="Logo Clear Linux* Project"/>
|
||
<img class="footer__site_txt_object" src="https://clearlinux.org/modules/custom/clearlinux.org/themes/clearlinux_theme/sass/components/layout/footer/assets/clear-linux-text-white.svg" />
|
||
</div>
|
||
</div>
|
||
<div class="footer__details">
|
||
<div class="footer__top">
|
||
<div class="footer__social_media">
|
||
<ul class="footer__social_media__list">
|
||
<li class="footer__social_media__list_item">
|
||
<a target="_blank" tabindex='1' href="https://github.com/clearlinux" title="Github"><i class="fa "></i></a>
|
||
</li>
|
||
<li class="footer__social_media__list_item">
|
||
<a target="_blank" tabindex='1' href="https://www.youtube.com/channel/UChpmukwyvvdSmTA9gxKL_Fg" title="YouTube"><i class="fa "></i></a>
|
||
</li>
|
||
<li class="footer__social_media__list_item">
|
||
<a target="_blank" tabindex='1' href="http://twitter.com/clearlinux" title="Twitter"><i class="fa "></i></a>
|
||
</li>
|
||
<li class="footer__social_media__list_item">
|
||
<a target="_blank" tabindex='1' href="https://community.clearlinux.org/" title="Discourse"><i class="fa "></i></a>
|
||
</li>
|
||
</ul>
|
||
</div>
|
||
<hr>
|
||
<div class="footer__menu">
|
||
<ul class="footer__menu__list">
|
||
<li class="footer__menu__list_item">
|
||
<a tabindex='1' href="http://www.intel.com/content/www/us/en/legal/trademarks.html">*Trademarks</a>
|
||
</li>
|
||
<li class="footer__menu__list_item">
|
||
<a tabindex='1' href="http://www.intel.com/content/www/us/en/privacy/intel-cookie-notice.html">Cookies</a>
|
||
</li>
|
||
<li class="footer__menu__list_item">
|
||
<a tabindex='1' href="https://www.intel.com/content/www/us/en/privacy/intel-privacy-notice.html">Privacy terms</a>
|
||
</li>
|
||
</ul>
|
||
</div>
|
||
</div>
|
||
<div class="footer__bottom">
|
||
<p class="footer__copyright">© 2022 Intel Corporation. All Rights Reserved.<br>*Other names and brands may be claimed as the property of others.</p>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
<div class="footer_bottom">
|
||
<div class="container padding-md--left-right">
|
||
<div class="footer_bottom__copyright">
|
||
<i class="fa fa-copyright"></i> This project belongs to 01.org, Intel's opensource platform. </div>
|
||
</div>
|
||
</div>
|
||
</footer>
|
||
|
||
<!-- END OUTPUT from 'modules/custom/clearlinux.org/themes/clearlinux_theme/templates/layout/page.html.twig' -->
|
||
|
||
|
||
</div>
|
||
|
||
<!-- END OUTPUT from 'core/themes/stable/templates/content/off-canvas-page-wrapper.html.twig' -->
|
||
|
||
|
||
|
||
<script src="https://clearlinux.org/core/assets/vendor/jquery/jquery.min.js?v=3.6.0"></script>
|
||
<script src="https://clearlinux.org/core/misc/polyfills/element.matches.js?v=9.4.8"></script>
|
||
<script src="https://clearlinux.org/core/assets/vendor/once/once.min.js?v=1.0.1"></script>
|
||
<script src="https://clearlinux.org/modules/contrib/extlink/extlink.js?v=9.4.8"></script>
|
||
|
||
<script src="https://cdnjs.cloudflare.com/ajax/libs/OwlCarousel2/2.2.1/owl.carousel.min.js" integrity="sha256-s5TTOyp+xlSmsDfr/aZhg0Gz+JejYr5iTJI8JxG1SkM=" crossorigin="anonymous"></script>
|
||
<script src="https://clearlinux.org/modules/custom/clearlinux.org/themes/clearlinux_theme/js/src/jquery.colorbox.min.js?v=9.4.8"></script>
|
||
<script src="https://clearlinux.org/modules/custom/clearlinux.org/themes/clearlinux_theme/js/src/clearlinux_theme.js?v=9.4.8"></script>
|
||
<script src="https://clearlinux.org/modules/custom/clearlinux.org/themes/clearlinux_theme/bower_components/clipboard/dist/clipboard.min.js?v=9.4.8"></script>
|
||
<script src="https://clearlinux.org/core/assets/vendor/js-cookie/js.cookie.min.js?v=3.0.1"></script>
|
||
<script src="https://clearlinux.org/modules/contrib/eu_cookie_compliance/js/eu_cookie_compliance.min.js?v=9.4.8" defer></script>
|
||
<script src="https://clearlinux.org/modules/custom/clearlinux.org/themes/clearlinux_theme/js/dist/layout/header/header.js"></script>
|
||
<script src="https://clearlinux.org/libraries/codesnippet/lib/highlight/highlight.pack.js?v=9.4.8"></script>
|
||
<script src="https://clearlinux.org/modules/contrib/codesnippet/js/codesnippet.js?v=9.4.8"></script>
|
||
|
||
</body>
|
||
</html>
|
||
|
||
<!-- END OUTPUT from 'modules/custom/clearlinux.org/themes/clearlinux_theme/templates/layout/html.html.twig' -->
|
||
|