commit 89b2d05780e08e386ff47db8c944f654c76d94b6
author Liming Gao <liming.gao@intel.com> Tue Mar 27 10:29:48 2018 +0800
committer Liming Gao <liming.gao@intel.com> Wed Mar 28 14:39:16 2018 +0800
tree 28cf971db5db6c39d49cfdeb03f819ce3566e2e3
parent bc9cea5c29455386b8e5f1c5e97f2a2760e1f271

BaseTools: Update Rsa2048Sha256Sign to use openssl standard options

sha256 is not the standard option. It should be replaced by sha -sha256.
Otherwise, it doesn't work in MAC OS.

In V2, update the option to sha1 -sha256.
In late openssl version >= 1.1, there is no sha option, but has sha1,sha256.
In previous openssl version < 1.1, there is no sha256, but has sha,sha1.
To work with all openssl version, use sha1 -sha256 for it.

Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Liao Jui-peng <jui-pengx.liao@intel.com>
Signed-off-by: Liming Gao <liming.gao@intel.com>
Cc: Michael Kinney <michael.d.kinney@intel.com>
Cc: Yonghong Zhu <yonghong.zhu@intel.com>
Reviewed-by: Yonghong Zhu <yonghong.zhu@intel.com>
(cherry picked from commit 1d574dfc15e4495a4063ce4faf3c2e9191677d8d)

BaseTools/Source/Python/Rsa2048Sha256Sign/Rsa2048Sha256Sign.py

diff --git a/BaseTools/Source/Python/Rsa2048Sha256Sign/Rsa2048Sha256Sign.py b/BaseTools/Source/Python/Rsa2048Sha256Sign/Rsa2048Sha256Sign.py
index 1ae6ebb..4188f8e 100644
--- a/BaseTools/Source/Python/Rsa2048Sha256Sign/Rsa2048Sha256Sign.py
+++ b/BaseTools/Source/Python/Rsa2048Sha256Sign/Rsa2048Sha256Sign.py
@@ -176,7 +176,7 @@
     # 

     # Sign the input file using the specified private key and capture signature from STDOUT

     #

-    Process = subprocess.Popen('%s sha256 -sign "%s"' % (OpenSslCommand, args.PrivateKeyFileName), stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)

+    Process = subprocess.Popen('%s sha1 -sha256 -sign "%s"' % (OpenSslCommand, args.PrivateKeyFileName), stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)

     Signature = Process.communicate(input=FullInputFileBuffer)[0]

     if Process.returncode <> 0:

       sys.exit(Process.returncode)

@@ -225,7 +225,7 @@
     #

     # Verify signature

     #    

-    Process = subprocess.Popen('%s sha256 -prverify "%s" -signature %s' % (OpenSslCommand, args.PrivateKeyFileName, args.OutputFileName), stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)

+    Process = subprocess.Popen('%s sha1 -sha256 -prverify "%s" -signature %s' % (OpenSslCommand, args.PrivateKeyFileName, args.OutputFileName), stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)

     Process.communicate(input=FullInputFileBuffer)

     if Process.returncode <> 0:

       print 'ERROR: Verification failed'