libsecureboot: add support for more signaturesHEADmain

For 2027 we need to support new, stronger signatures and hashes.

Re-work Makefile.inc and local.trust.mk to define
VE_SIGN_URL_LIST or VE_SIGNATURE_LIST (can be derrived from
VE_SIGN_URL_LIST) containing tuples of sig/method/hash/flags and
for VE_SIGN_URL_LIST the same plus /url.

From VE_SIGNATURE_LIST we derrive VE_SIGNATURE_EXT_LIST used to populate
signature_ext_list which defines the order in which we look for
signatures for a manifest.

We also populate signature_info_list which maps a signature ext to the
needed hash and flags to indicate whether that hash needs to be repeated.

verify_sig will lookup signature_info_list, no match means not
supported.  For asc we just call verify_asc() otherwise we call
verify_ec() or verify_rsa() depending on the key type found in the
certificate chain, we pass the signature_info entry to these so they
know which hash to use and whether to repeat it.

The need to repeat the hash is a consequence of sending a hash to a
server using signature methods that insiste on hashing their input.
To-date only our original ECDSA signatures use this.
A FakeHash class added in 2012 avoids that wrinkle.

This is a much more flexible arrangement and should be more
readily usable by others.

Sponsored by:	Hewlett Packard Enterprise Development LP.

Reviewed by:	imp
Differential Revision:	https://reviews.freebsd.org/D61007

0 files changed, 0 insertions, 0 deletions