Re: [PATCH v6 3/3] ima-evm-utils: Read keyid from the cert appended to the key file

[Vitaly Chikunov <vt@altlinux.org>]

Mimi,

On Wed, Jun 30, 2021 at 01:38:02PM -0400, Mimi Zohar wrote:
> On Tue, 2021-05-11 at 14:56 +0300, Vitaly Chikunov wrote:
> > 
> > diff --git a/src/libimaevm.c b/src/libimaevm.c
> > index 1c03768..bfce7ef 100644
> > --- a/src/libimaevm.c
> > +++ b/src/libimaevm.c
> > @@ -1021,10 +1021,12 @@ static int sign_hash_v2(const char *algo, const unsigned char *hash,
> >  		return -1;
> >  	}
> > 
> > -	if (imaevm_params.keyid)
> > +	if (imaevm_params.keyid) {
> >  		hdr->keyid = htonl(imaevm_params.keyid);
> > -	else
> > -		calc_keyid_v2(&hdr->keyid, name, pkey);
> > +	} else {
> > +		if (__read_keyid(&hdr->keyid, keyfile, KEYID_FILE_PEM_KEY))
> > +			calc_keyid_v2(&hdr->keyid, name, pkey);
> > +	}
> 
> If the call to  __read_keyid() was independent of the test and call to
> calc_keyid_v2(), it would make reading code the easier to understand.
> 
> result = __read_keyid(...);
> if (result  < 0)
>     calc_keyid_v2(...);

No problem to add additional variable and check __read_keyid indirectly.
But, how is this independent? Call to calc_keyid_v2 is dependent to
__read_keyid result.

Thanks,

> 
> thanks,
> 
> Mimi
> 
> > 
> >  	st = "EVP_PKEY_CTX_new";
> >  	if (!(ctx = EVP_PKEY_CTX_new(pkey, NULL)))
>