Re: [PATCH v6 3/3] ima-evm-utils: Read keyid from the cert appended to the key file

[Vitaly Chikunov <vt@altlinux.org>]

Mimi,

On Wed, Jun 30, 2021 at 10:10:55PM +0300, Vitaly Chikunov wrote:
> On Wed, Jun 30, 2021 at 01:38:02PM -0400, Mimi Zohar wrote:
> > On Tue, 2021-05-11 at 14:56 +0300, Vitaly Chikunov wrote:
> > > 
> > > diff --git a/src/libimaevm.c b/src/libimaevm.c
> > > index 1c03768..bfce7ef 100644
> > > --- a/src/libimaevm.c
> > > +++ b/src/libimaevm.c
> > > @@ -1021,10 +1021,12 @@ static int sign_hash_v2(const char *algo, const unsigned char *hash,
> > >  		return -1;
> > >  	}
> > > 
> > > -	if (imaevm_params.keyid)
> > > +	if (imaevm_params.keyid) {
> > >  		hdr->keyid = htonl(imaevm_params.keyid);
> > > -	else
> > > -		calc_keyid_v2(&hdr->keyid, name, pkey);
> > > +	} else {
> > > +		if (__read_keyid(&hdr->keyid, keyfile, KEYID_FILE_PEM_KEY))
> > > +			calc_keyid_v2(&hdr->keyid, name, pkey);
> > > +	}
> > 
> > If the call to  __read_keyid() was independent of the test and call to
> > calc_keyid_v2(), it would make reading code the easier to understand.
> > 
> > result = __read_keyid(...);
> > if (result  < 0)
> >     calc_keyid_v2(...);
> 
> No problem to add additional variable and check __read_keyid indirectly.
> But, how is this independent? Call to calc_keyid_v2 is dependent to
> __read_keyid result.

I think I understood what you meant.

Thanks,

> 
> Thanks,
> 
> > 
> > thanks,
> > 
> > Mimi
> > 
> > > 
> > >  	st = "EVP_PKEY_CTX_new";
> > >  	if (!(ctx = EVP_PKEY_CTX_new(pkey, NULL)))
> >