More fixes to build/fipsld to handle detached fips_premain.c detached sig.

diff --git a/fips-1.0/Makefile b/fips-1.0/Makefile
index 0510581b7a08c37206c317ea2b9b0efa1d5fcdfe..d92652b0312b63c31179ef1bd03743653279f4e4 100644 (file)
--- a/fips-1.0/Makefile
+++ b/fips-1.0/Makefile
@@ -174,9 +174,8 @@ install:
                mv -f $(INSTALL_PREFIX)$(INSTALLTOP)/bin/$$i.new $(INSTALL_PREFIX)$(INSTALLTOP)/bin/$$i; \
        done
        @cp -p -f fipscanister.o fipscanister.o.sha1 fips_premain.c \
+               fips_premain.c.sha1 \
                $(INSTALL_PREFIX)$(INSTALLTOP)/lib/; \
-       strings fipscanister.o | grep "HMAC-SHA1(fips_premain\\.c)" > \
-               $(INSTALL_PREFIX)$(INSTALLTOP)/lib/fips_premain.c.sha1; \
        chmod 0444 $(INSTALL_PREFIX)$(INSTALLTOP)/lib/fips*
 
 lint:

diff --git a/fips-1.0/fipsld b/fips-1.0/fipsld
index 9ee9da103d9a8832e59a429f6a602ea5f53477b7..237910de879b7ee1faee259e862e05685a6b4f2b 100755 (executable)
--- a/fips-1.0/fipsld
+++ b/fips-1.0/fipsld
@@ -75,13 +75,6 @@ echo Canister: $CANISTER_O
                diff -w "${PREMAIN_C}.sha1" - || \
        { echo "${PREMAIN_C} fingerprint mismatch"; exit 1; }
 
-       # verify fips_premain.c against its signature embedded into
-       # fipscanister.o...
-       #SIG=`${FINGERTYPE} "${PREMAIN_C}" | sed -n "s/(.*\//(/;/^./p"`
-       #REF=`strings "${CANISTER_O}" | grep "HMAC-SHA1(fips_premain\\.c)"`
-       #[ "${SIG}" = "${REF}" ] || \
-       #{ echo "${PREMAIN_C} fingerprint mismatch"; exit 1; }
-
        # Temporarily remove fipscanister.o from libcrypto.a!
        # We are required to use the standalone copy...
        trap    'ar r "${THERE}/libcrypto.a" "${CANISTER_O}";
@@ -127,11 +120,9 @@ echo Canister: $CANISTER_O
                diff -w "${CANISTER_O}.sha1" - || \
        { echo "${CANISTER_O} fingerprint mismatch"; exit 1; }
 
-       # verify fips_premain.c against its signature embedded into
-       # fipscanister.o...
-       SIG=`${FINGERTYPE} "${PREMAIN_C}" | sed -n "s/(.*\//(/;/^./p"`
-       REF=`strings "${CANISTER_O}" | grep "HMAC-SHA1(fips_premain\\.c)"`
-       [ "${SIG}" = "${REF}" ] || \
+       # verify fips_premain.c against its detached signature...
+       ${FINGERTYPE} "${PREMAIN_C}" | sed "s/(.*\//(/" | \
+               diff -w "${PREMAIN_C}.sha1" - || \
        { echo "${PREMAIN_C} fingerprint mismatch"; exit 1; }
 
        ${CC}   "${CANISTER_O}" \