kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

pv: verify_chain: Use error statements instead of debug

Browse Source 
These messages indicate verification failures and are therefore reported
as errors rather than debug output. Unfortunately,
X509StoreContext::init(...) expects the callback to return an OpenSSL
ErrorStack, so it's not possible to propagate these failures through our
own error hierarchy.

Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Marc Hartmayer
2026-07-14 18:29:57 +02:00
committed by Jan Höppner
parent 603a2b1762
commit 6f9f846bc0
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
rust/pv/src/verify/helper.rs
View File

@@ -220,20 +220,22 @@ pub fn verify_chain(
// verify certificate
let res = ctx.verify_cert()?;
if !res {
debug!("Failed to verify the signing key with the chain of trust");
error!("error: Failed to verify the signing key with the chain of trust");
return Ok(res);
}
// verify that the chain is as expected
let chain = match ctx.chain() {
Some(c) => c,
None => {
debug!("No verification chain in verify-context. (openssl BUG)");
error!("error: No verification chain in verify-context. (openssl BUG)");
ctx.set_error(X509VerifyResult::APPLICATION_VERIFICATION);
return Ok(false);
}
};
if chain.len() < SECURITY_CHAIN_MAX_LEN as usize {
debug!("Verification expects one root and at least one intermediate certificate",);
error!(
"error: Verification expects one root and at least one intermediate certificate",
);
ctx.set_error(X509VerifyResult::APPLICATION_VERIFICATION);
return Ok(false);
}