[PATCH 0/3] Add option to check all certs in chain for revocation

[wesdm...@gmail.com]

From: Wes Malone <wesdm...@gmail.com>

This adds the --crl-check-all argument/config to toggle on full chain
CRL checking.

I ran into some issues with running tests. It seems to me the existing
CRL tests fail under default settings. I am not familiar with this
style of test so I'm not sure if it was my mistake. I split out my
test fixes into a separate commit so you can decide if they are needed.

I had to force the digest provider selection otherwise RSA was selected
if compiled in. I wasn't sure if I am meant to add a defconfig for my
tests or not since the existing CRL test did not use one.

Wes Malone (3):
Check all certs in chain against CRL
Add CRL chain verification unit tests for CMS verify
Force opensslCMS digest selection for CRL tests

core/swupdate.c | 10 ++++
crypto/swupdate_cms_verify_openssl.c | 13 +++--
doc/source/signed_images.rst | 15 ++++--
include/swupdate.h | 1 +
test/Makefile | 33 ++++++++++--
.../data/cms-test-ca/intermediate-openssl.cnf | 31 +++++++++++
test/data/cms-test-ca/openssl.cnf | 3 ++
test/test_verify.c | 54 +++++++++++++++++++
8 files changed, 151 insertions(+), 9 deletions(-)
create mode 100644 test/data/cms-test-ca/intermediate-openssl.cnf

--
2.43.0