Right now if -f option is passed in, we only save the actual signature to
a file and not the full security.ima attribute.
I think it makes more sense to save full security.ima attribute so that
it can act as detached signatures and one can install signature later.
That is signing can take place on build server and detached signatures
can be generated and these signatures can be installed later on target.
One can use following steps.
evmctl ima_sign -f -x -a sha256 /tmp/data.txt
hexdump -v -e '1/1 "%02x"' /tmp/data.txt.sig > /tmp/data.txt.sig.hex
printf "# file: /tmp/data.txt\nsecurity.ima=0x" | cat - /tmp/data.txt.sig.hex | setfattr --restore -
evmctl ima_verify /tmp/data.txt
Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
59ef0a0b99