diff options
Diffstat (limited to 'scripts')
| -rw-r--r-- | scripts/sign-file.c | 39 |
1 files changed, 30 insertions, 9 deletions
diff --git a/scripts/sign-file.c b/scripts/sign-file.c index 7070245edfc1..78276b15ab23 100644 --- a/scripts/sign-file.c +++ b/scripts/sign-file.c @@ -27,7 +27,7 @@ #include <openssl/evp.h> #include <openssl/pem.h> #include <openssl/err.h> -#if OPENSSL_VERSION_MAJOR >= 3 +#if OPENSSL_VERSION_NUMBER >= 0x30000000L # define USE_PKCS11_PROVIDER # include <openssl/provider.h> # include <openssl/store.h> @@ -315,18 +315,39 @@ int main(int argc, char **argv) ERR(!digest_algo, "EVP_get_digestbyname"); #ifndef USE_PKCS7 + + unsigned int flags = + CMS_NOCERTS | + CMS_PARTIAL | + CMS_BINARY | + CMS_DETACHED | + CMS_STREAM | + CMS_NOSMIMECAP | +#ifdef CMS_NO_SIGNING_TIME + CMS_NO_SIGNING_TIME | +#endif + use_keyid; + +#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_VERSION_NUMBER < 0x40000000L + if (EVP_PKEY_is_a(private_key, "ML-DSA-44") || + EVP_PKEY_is_a(private_key, "ML-DSA-65") || + EVP_PKEY_is_a(private_key, "ML-DSA-87")) { + /* ML-DSA + CMS_NOATTR is not supported in openssl-3.5 + * and before. + */ + use_signed_attrs = 0; + } +#endif + + flags |= use_signed_attrs; + /* Load the signature message from the digest buffer. */ - cms = CMS_sign(NULL, NULL, NULL, NULL, - CMS_NOCERTS | CMS_PARTIAL | CMS_BINARY | - CMS_DETACHED | CMS_STREAM); + cms = CMS_sign(NULL, NULL, NULL, NULL, flags); ERR(!cms, "CMS_sign"); - ERR(!CMS_add1_signer(cms, x509, private_key, digest_algo, - CMS_NOCERTS | CMS_BINARY | - CMS_NOSMIMECAP | use_keyid | - use_signed_attrs), + ERR(!CMS_add1_signer(cms, x509, private_key, digest_algo, flags), "CMS_add1_signer"); - ERR(CMS_final(cms, bm, NULL, CMS_NOCERTS | CMS_BINARY) != 1, + ERR(CMS_final(cms, bm, NULL, flags) != 1, "CMS_final"); #else |