Add another critical extension bypass.

Signed-off-by: Timotej Ecimovic <t1@digitalgeyser.com>
anchore · Oct 13, 2024 · e863ee3 · e863ee3
1 parent 4cd2cbc
commit e863ee3
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 3 deletions.
diff --git a/.gitignore b/.gitignore
@@ -23,6 +23,7 @@ CHANGELOG.md
 .tmp/
 coverage.txt
 bin/
+cmd/quill/quill
 
 # Binaries for programs and plugins
 *.exe
@@ -40,4 +41,4 @@ bin/
 # macOS Finder metadata
 .DS_STORE
 
-*.profile
+*.profile
diff --git a/quill/pki/certchain/verify.go b/quill/pki/certchain/verify.go
@@ -54,11 +54,13 @@ func VerifyForCodeSigning(certs []*x509.Certificate, failWithoutFullChain bool)
 		},
 	}
 
-	// ignore "devid_execute" critical extension
+	// ignore "devid_execute" and "devid_kernel" critical extensions
 	temp := leaf.UnhandledCriticalExtensions[:0]
 	for _, ex := range leaf.UnhandledCriticalExtensions {
 		switch ex.String() {
-		case "1.2.840.113635.100.6.1.13":
+		case "1.2.840.113635.100.6.1.13": // devid_execute
+			continue
+		case "1.2.840.113635.100.6.1.18": // devid_kernel
 			continue
 		default:
 			temp = append(temp, ex)