From ddcfbdc8d22df426dde8bc0829ea684e6c8918c9 Mon Sep 17 00:00:00 2001
From: Marc Hartmayer <mhartmay@linux.ibm.com>
Date: Fri, 15 Mar 2024 15:39:02 +0000
Subject: [PATCH] genprotimg/samples/check_hostkeydoc: support `Armonk` in IBM
 signing key subject

Newer IBM signing keys use `Armonk` in their subject therefore add
support for it.

Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Christoph Schlameuss <schlameuss@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
---
 genprotimg/samples/check_hostkeydoc | 32 ++++++++++++++++++-----------
 1 file changed, 20 insertions(+), 12 deletions(-)

diff --git a/genprotimg/samples/check_hostkeydoc b/genprotimg/samples/check_hostkeydoc
index ad728e88..82965315 100755
--- a/genprotimg/samples/check_hostkeydoc
+++ b/genprotimg/samples/check_hostkeydoc
@@ -22,7 +22,8 @@ SIGNATURE_FILE=$(mktemp)
 BODY_FILE=$(mktemp)
 ISSUER_DN_FILE=$(mktemp)
 SUBJECT_DN_FILE=$(mktemp)
-DEF_ISSUER_DN_FILE=$(mktemp)
+DEF_ISSUER_ARMONK_DN_FILE=$(mktemp)
+DEF_ISSUER_POUGHKEEPSIE_DN_FILE=$(mktemp)
 CANONICAL_ISSUER_DN_FILE=$(mktemp)
 CRL_SERIAL_FILE=$(mktemp)
 
@@ -30,7 +31,7 @@ CRL_SERIAL_FILE=$(mktemp)
 cleanup()
 {
     rm -f $ISSUER_PUBKEY_FILE $SIGNATURE_FILE $BODY_FILE \
-        $ISSUER_DN_FILE $SUBJECT_DN_FILE $DEF_ISSUER_DN_FILE \
+        $ISSUER_DN_FILE $SUBJECT_DN_FILE $DEF_ISSUER_ARMONK_DN_FILE $DEF_ISSUER_POUGHKEEPSIE_DN_FILE \
         $CANONICAL_ISSUER_DN_FILE $CRL_SERIAL_FILE
 }
 trap cleanup EXIT
@@ -124,7 +125,19 @@ canonical_dn()
         | LC_ALL=C sort | grep -v $DNTYPE= > $OUTPUT
 }
 
-default_issuer()
+default_issuer_armonk()
+{
+    cat <<-EOF
+    commonName                = International Business Machines Corporation
+    countryName               = US
+    localityName              = Armonk
+    organizationName          = International Business Machines Corporation
+    organizationalUnitName    = Key Signing Service
+    stateOrProvinceName       = New York
+EOF
+}
+
+default_issuer_pougkeepsie()
 {
     cat <<-EOF
     commonName                = International Business Machines Corporation
@@ -141,12 +154,14 @@ EOF
 # stripping off the prefix
 verify_default_issuer()
 {
-    default_issuer > $DEF_ISSUER_DN_FILE
+    default_issuer_pougkeepsie > $DEF_ISSUER_POUGHKEEPSIE_DN_FILE
+    default_issuer_armonk > $DEF_ISSUER_ARMONK_DN_FILE
 
     sed "s/\(^[ ]*organizationalUnitName[ ]*=[ ]*\).*\(Key Signing Service$\)/\1\2/" \
 	$ISSUER_DN_FILE > $CANONICAL_ISSUER_DN_FILE
 
-    if ! diff $CANONICAL_ISSUER_DN_FILE $DEF_ISSUER_DN_FILE
+    if ! { diff $CANONICAL_ISSUER_DN_FILE $DEF_ISSUER_POUGHKEEPSIE_DN_FILE ||
+           diff $CANONICAL_ISSUER_DN_FILE $DEF_ISSUER_ARMONK_DN_FILE; } >/dev/null 2>&1
     then
         echo Incorrect default issuer >&2 && exit 1
     fi
@@ -158,13 +173,6 @@ verify_issuer_files()
     then
        verify_default_issuer
     fi
-
-    if diff $ISSUER_DN_FILE $SUBJECT_DN_FILE
-    then
-        echo Issuer verification OK
-    else
-        echo Issuer verification failed >&2 && exit 1
-    fi
 }
 
 cert_time()