feature: parse all certificates from multi-signed files #95
Conversation
Multiple certificates are not, like the current code assumes, appended; instead, a specific (unsigned) attribute is nested inside the PKCS7 struct that contains the next PKCS7 struct. Also improve the returned certificates to include structs for all parsed, PKCS7 structs.
The signature algorithm listed in the signing certificate is not necessarily the signature algorithm used for the file signature. Extract the algorithm for the file signature from the authemticode instead.
|
That's great work @secDre4mer . I need to review this carefully, it's also a breaking change. I will have a look later today ! |
Yeah, I know. I didn't really see a way to add multiple certificates to the output without any breaking changes, unfortunately. |
| @@ -4,6 +4,6 @@ go 1.15 | |||
|
|
|||
| require ( | |||
| github.com/edsrzf/mmap-go v1.1.0 | |||
| go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352 | |||
| github.com/secDre4mer/pkcs7 v0.0.0-20240322103146-665324a4461d | |||
There was a problem hiding this comment.
I was hoping we apply the patches you made over: https://github.com/smallstep/pkcs7
Because @smallstep took a couple of PRs from the mozilla fork and applied them to his fork. If it makes sense, you can submit a PR on his repo.
If you think it is not relevant for people to benefit from the commits you did, then we can keep it this way.
There was a problem hiding this comment.
This sounds good. I noticed that the mozilla repo was archived and no longer maintained and therefore created my own branch, but if there's a supported successor, I'll gladly create a PR there.
There was a problem hiding this comment.
The smallstep/pkcs7 maintainer hasn't responded to the PR for some weeks now... How should we proceed here?
There was a problem hiding this comment.
Thank for your efforts @secDre4mer, let's merge this one then.
Add support for parsing (and returning) additional nested signatures.
Also fixes an issue where the signature algorithm of the file was detected incorrectly.