Index: payload_signer.h |
diff --git a/payload_signer.h b/payload_signer.h |
index 59affd3d438babbaf91ca20e1a635d3b5fa9cb9d..5ebba19a7c7e4cae1210e76e7f4e72053df45e1c 100644 |
--- a/payload_signer.h |
+++ b/payload_signer.h |
@@ -7,11 +7,11 @@ |
#include <string> |
#include <vector> |
-#include "base/basictypes.h" |
-// This function signs a payload with the OS vendor's private key. |
-// It takes an update up to the signature blob and returns the signature |
-// blob, which should be appended. See update_metadata.proto for more info. |
+#include <base/basictypes.h> |
+ |
+// This class encapsulates methods used for payload signing and signature |
+// verification. See update_metadata.proto for more info. |
namespace chromeos_update_engine { |
@@ -19,6 +19,17 @@ extern const uint32_t kSignatureMessageVersion; |
class PayloadSigner { |
public: |
+ // Given a raw |hash| and a private key in |private_key_path| calculates the |
+ // raw signature in |out_signature|. Returns true on success, false otherwise. |
+ static bool SignHash(const std::vector<char>& hash, |
+ const std::string& private_key_path, |
+ std::vector<char>* out_signature); |
+ |
+ // Given an unsigned payload in |unsigned_payload_path| and a private key in |
+ // |private_key_path|, calculates the signature blob into |
+ // |out_signature_blob|. Note that the payload must already have an updated |
+ // manifest that includes the dummy signature op. Returns true on success, |
+ // false otherwise. |
static bool SignPayload(const std::string& unsigned_payload_path, |
const std::string& private_key_path, |
std::vector<char>* out_signature_blob); |
@@ -34,6 +45,23 @@ class PayloadSigner { |
const std::string& public_key_path, |
std::vector<char>* out_hash_data); |
+ |
+ // Given an unsigned payload in |payload_path| (with no dummy signature op) |
+ // and the raw |signature_size| calculates the raw hash that needs to be |
+ // signed in |out_hash_data|. Returns true on success, false otherwise. |
+ static bool HashPayloadForSigning(const std::string& payload_path, |
+ int signature_size, |
+ std::vector<char>* out_hash_data); |
+ |
+ // Given an unsigned payload in |payload_path| (with no dummy signature op) |
+ // and the raw |signature| updates the payload to include the signature thus |
+ // turning it into a signed payload. The new payload is stored in |
+ // |signed_payload_path|. |payload_path| and |signed_payload_path| can point |
+ // to the same file. Returns true on success, false otherwise. |
+ static bool AddSignatureToPayload(const std::string& payload_path, |
+ const std::vector<char>& signature, |
+ const std::string& signed_payload_path); |
+ |
private: |
// This should never be constructed |
DISALLOW_IMPLICIT_CONSTRUCTORS(PayloadSigner); |