AU: Add support for signing of update payloads after they're generated.

payload_signer.h

Index: payload_signer.h
diff --git a/payload_signer.h b/payload_signer.h
index 59affd3d438babbaf91ca20e1a635d3b5fa9cb9d..5ebba19a7c7e4cae1210e76e7f4e72053df45e1c 100644
--- a/payload_signer.h
+++ b/payload_signer.h
@@ -7,11 +7,11 @@
 
 #include <string>
 #include <vector>
-#include "base/basictypes.h"
 
-// This function signs a payload with the OS vendor's private key.
-// It takes an update up to the signature blob and returns the signature
-// blob, which should be appended. See update_metadata.proto for more info.
+#include <base/basictypes.h>
+
+// This class encapsulates methods used for payload signing and signature
+// verification. See update_metadata.proto for more info.
 
 namespace chromeos_update_engine {
 
@@ -19,6 +19,17 @@ extern const uint32_t kSignatureMessageVersion;
 
 class PayloadSigner {
  public:
+  // Given a raw |hash| and a private key in |private_key_path| calculates the
+  // raw signature in |out_signature|. Returns true on success, false otherwise.
+  static bool SignHash(const std::vector<char>& hash,
+                       const std::string& private_key_path,
+                       std::vector<char>* out_signature);
+
+  // Given an unsigned payload in |unsigned_payload_path| and a private key in
+  // |private_key_path|, calculates the signature blob into
+  // |out_signature_blob|. Note that the payload must already have an updated
+  // manifest that includes the dummy signature op. Returns true on success,
+  // false otherwise.
   static bool SignPayload(const std::string& unsigned_payload_path,
                           const std::string& private_key_path,
                           std::vector<char>* out_signature_blob);
@@ -34,6 +45,23 @@ class PayloadSigner {
                               const std::string& public_key_path,
                               std::vector<char>* out_hash_data);
 
+
+  // Given an unsigned payload in |payload_path| (with no dummy signature op)
+  // and the raw |signature_size| calculates the raw hash that needs to be
+  // signed in |out_hash_data|. Returns true on success, false otherwise.
+  static bool HashPayloadForSigning(const std::string& payload_path,
+                                    int signature_size,
+                                    std::vector<char>* out_hash_data);
+
+  // Given an unsigned payload in |payload_path| (with no dummy signature op)
+  // and the raw |signature| updates the payload to include the signature thus
+  // turning it into a signed payload. The new payload is stored in
+  // |signed_payload_path|. |payload_path| and |signed_payload_path| can point
+  // to the same file. Returns true on success, false otherwise.
+  static bool AddSignatureToPayload(const std::string& payload_path,
+                                    const std::vector<char>& signature,
+                                    const std::string& signed_payload_path);
+
  private:
   // This should never be constructed
   DISALLOW_IMPLICIT_CONSTRUCTORS(PayloadSigner);