Re: [PATCH 1/3] X.509: Fix certificate gathering again

[David Woodhouse <dwmw2@infradead.org>]

On Thu, 2015-05-28 at 13:18 +0800, Michal Marek wrote:
> 
> The only issue is that the makefile expressions are a bit hairy. For
> starters, we already have definitions for $(quote) and $(space) in
> kbuild. I'll have a closer look at the config_filename macro and try to
> simplify it somehow. But it's just cosmetics, the patch can be merged as
> is for now.

I've actually changed my mind about the 'awk | base64 -d' bit. The error
handling is too poor. I'd like to do that in C with a variant of the
existing extract_cert tool, and make sure we have proper X.509
certificates and error handling/reporting.

I'll fix that, but probably not this week while I'm ostensibly on
honeymoon and not answering emails like this one...

(If anyone else wants to beat me to it, you probably just need to make
extract_cert.c loop on extracting the certs from the file/BIO, but do
make sure it tolerates only *one* in the existing 'find signer cert'
mode.)

-- 
David Woodhouse                            Open Source Technology Centre
David.Woodhouse@intel.com                              Intel Corporation