Module signing and verification using a separate file for the module signature.

1 files changed, 22 insertions, 0 deletions

diff --git a/main.cxx b/main.cxx
index ab568c23..1ac5dd5a 100644
--- a/main.cxx
+++ b/main.cxx
@@ -403,6 +403,14 @@ main (int argc, char * const argv [])
   s.load_only = false;
   s.skip_badvars = false;
 
+  // Location of our signing certificate.
+  // If we're root, use the database in SYSCONFDIR, otherwise
+  // use the one in our $HOME directory.  */
+  if (geteuid() == 0)
+    s.cert_db_path = SYSCONFDIR "/systemtap/ssl/server";
+  else
+    s.cert_db_path = getenv("HOME") + string ("/.systemtap/ssl/server");
+
   const char* s_p = getenv ("SYSTEMTAP_TAPSET");
   if (s_p != NULL)
   {
@@ -1134,6 +1142,20 @@ main (int argc, char * const argv [])
 	  if (copy_file(module_src_path.c_str(), module_dest_path.c_str()) != 0)
 	    cerr << "Copy failed (\"" << module_src_path << "\" to \""
 		 << module_dest_path << "\"): " << strerror(errno) << endl;
+
+#if HAVE_NSS
+	  // Save the signature as well.
+	  assert (! s.cert_db_path.empty());
+	  module_src_path += ".sgn";
+	  module_dest_path += ".sgn";
+
+	  if (s.verbose > 1)
+	    clog << "Copying " << module_src_path << " to "
+		 << module_dest_path << endl;
+	  if (copy_file(module_src_path.c_str(), module_dest_path.c_str()) != 0)
+	    cerr << "Copy failed (\"" << module_src_path << "\" to \""
+		 << module_dest_path << "\"): " << strerror(errno) << endl;
+#endif
 	}
     }