From 0016a571a5ea1ab65817973f179800947e1aa8de Mon Sep 17 00:00:00 2001
From: Lans Zhang <jia.zhang@windriver.com>
Date: Fri, 15 Jan 2016 09:40:56 +0800
Subject: [PATCH] sbsign: add -x option to avoid overwrite existing signature

Upstream-Status: Pending

Signed-off-by: Lans Zhang <jia.zhang@windriver.com>
---
 src/sbsign.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/src/sbsign.c b/src/sbsign.c
index dcf6eed..7dc101f 100644
--- a/src/sbsign.c
+++ b/src/sbsign.c
@@ -66,6 +66,7 @@ struct sign_context {
 };
 
 static struct option options[] = {
+	{ "noresign", no_argument, NULL, 'x' },
 	{ "output", required_argument, NULL, 'o' },
 	{ "cert", required_argument, NULL, 'c' },
 	{ "key", required_argument, NULL, 'k' },
@@ -87,6 +88,7 @@ static void usage(void)
 		"\t--cert <certfile>  certificate (x509 certificate)\n"
 		"\t--detached         write a detached signature, instead of\n"
 		"\t                    a signed binary\n"
+		"\t--noresign         don't re-sign the binary if signed\n"
 		"\t--output <file>    write signed data to <file>\n"
 		"\t                    (default <efi-boot-image>.signed,\n"
 		"\t                    or <efi-boot-image>.pk7 for detached\n"
@@ -114,7 +116,7 @@ int main(int argc, char **argv)
 	const char *keyfilename, *certfilename;
 	struct sign_context *ctx;
 	uint8_t *buf, *tmp;
-	int rc, c, sigsize;
+	int rc, c, sigsize, no_resign = 0;
 
 	ctx = talloc_zero(NULL, struct sign_context);
 
@@ -123,11 +125,14 @@ int main(int argc, char **argv)
 
 	for (;;) {
 		int idx;
-		c = getopt_long(argc, argv, "o:c:k:dvVh", options, &idx);
+		c = getopt_long(argc, argv, "xo:c:k:dvVh", options, &idx);
 		if (c == -1)
 			break;
 
 		switch (c) {
+		case 'x':
+			no_resign = 1;
+			break;
 		case 'o':
 			ctx->outfilename = talloc_strdup(ctx, optarg);
 			break;
@@ -178,6 +183,14 @@ int main(int argc, char **argv)
 	if (!ctx->image)
 		return EXIT_FAILURE;
 
+	if (ctx->image->cert_table) {
+		if (no_resign) {
+			fprintf(stderr,
+				"Don't overwrite existing signature\n");
+			return EXIT_SUCCESS;
+		}
+	}
+
 	talloc_steal(ctx, ctx->image);
 
 	ERR_load_crypto_strings();
-- 
1.9.1

