tree ffe94d362c3910bbd688037ae1b02ffc85818935
parent 609437cbf591d77050d4a4e2de4e0c322d71706e
author Demi Marie Obenour <demiobenour@gmail.com> 1670531038 -0500
committer Varun Wadekar <vwadekar@nvidia.com> 1675444200 +0000

fix(auth): require at least one extension to be present

X.509 and RFC5280 allow omitting the extensions entirely, but require
that if the extensions field is present at all, it must contain at least
one certificate.  TF-A already requires the extensions to be present,
but allows them to be empty.  However, a certificate with an empty
extensions field will always fail later on, as the extensions contain
the information needed to validate the next stage in the boot chain.
Therefore, it is simpler to require the extension field to be present
and contain at least one extension.  Also add a comment explaining why
the extensions field is required, even though it is OPTIONAL in the
ASN.1 syntax.

Change-Id: Ie26eed8a7924bf50937a6b27ccdf7cc9a390588d
Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
(cherry picked from commit 72460f50e2437a85ce5229c430931aab8f4a0d5b)