Add another critical extension bypass.

Signed-off-by: Timotej Ecimovic <[email protected]> Signed-off-by: Timotej Ecimovic <[email protected]>
anchore · Nov 8, 2024 · b2fd214 · b2fd214
1 parent 305275b
commit b2fd214
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 3 deletions.
diff --git a/.gitignore b/.gitignore
@@ -23,6 +23,7 @@ CHANGELOG.md
 .tmp/
 coverage.txt
 bin/
+cmd/quill/quill
 
 # Binaries for programs and plugins
 *.exe
@@ -40,4 +41,4 @@ bin/
 # macOS Finder metadata
 .DS_STORE
 
-*.profile
+*.profile
diff --git a/quill/pki/certchain/verify.go b/quill/pki/certchain/verify.go
@@ -54,11 +54,13 @@ func VerifyForCodeSigning(certs []*x509.Certificate, failWithoutFullChain bool)
 		},
 	}
 
-	// ignore "devid_execute" critical extension
+	// ignore "devid_execute" and "devid_kernel" critical extensions
 	temp := leaf.UnhandledCriticalExtensions[:0]
 	for _, ex := range leaf.UnhandledCriticalExtensions {
 		switch ex.String() {
-		case "1.2.840.113635.100.6.1.13":
+		case "1.2.840.113635.100.6.1.13": // devid_execute
+			continue
+		case "1.2.840.113635.100.6.1.18": // devid_kernel
 			continue
 		default:
 			temp = append(temp, ex)