--- a/common/binverify.c	Thu Jul 10 19:16:21 2014 +0200
+++ b/common/binverify.c	Fri Jul 11 16:20:27 2014 +0200
@@ -10,7 +10,6 @@
 
 #include "strhelp.h"
 #include "logging.h"
-
 #ifdef RELEASE_BUILD
 #include "pubkey-release.h"
 #else
@@ -232,6 +231,8 @@
 #include <polarssl/pk.h>
 #include <polarssl/base64.h>
 #include <polarssl/sha256.h>
+#include <polarssl/error.h>
+#include <polarssl/x509_crt.h>
 #pragma GCC diagnostic pop
 
 bin_verify_result
@@ -247,7 +248,7 @@
                 hash[32];
 
   bin_verify_result retval = VerifyUnknownError;
-  pk_context pub_key_ctx;
+  x509_crt codesign_cert;
 
   if (strnlen(filename, name_len + 1) != name_len || name_len == 0)
     {
@@ -264,24 +265,24 @@
     }
 
   /* Fetch the signature from the end of data */
-  if (data_size < sig_b64_size + 4)
+  if (data_size < sig_b64_size + 5)
     {
       ERRORPRINTF ("File to small to contain a signature.\n");
       retval = VerifyInvalidSignature;
       goto done;
     }
 
-  if (data[data_size - sig_b64_size - 1] != ':' ||
-      data[data_size - sig_b64_size - 2] != 'S' ||
-      data[data_size - sig_b64_size - 3] != '\n'||
-      data[data_size - sig_b64_size - 4] != '\r')
+  if (data[data_size - sig_b64_size - 2] != ':' ||
+      data[data_size - sig_b64_size - 3] != 'S' ||
+      data[data_size - sig_b64_size - 4] != '\n'||
+      data[data_size - sig_b64_size - 5] != '\r')
     {
       ERRORPRINTF ("Failed to find valid signature line.\n");
       retval = VerifyInvalidSignature;
       goto done;
     }
 
-  strncpy(signature_b64, data - sig_b64_size, sig_b64_size);
+  strncpy(signature_b64, data + (data_size - sig_b64_size - 1), sig_b64_size);
   signature_b64[sig_b64_size] = '\0';
 
   ret = base64_decode(signature, &sig_size,
@@ -289,33 +290,45 @@
 
   if (ret != 0 || sig_size != TRUSTBRIDGE_RSA_KEY_SIZE / 8)
     {
+      ERRORPRINTF ("Base 64 decode failed with error: %i\n", ret);
       goto done;
     }
 
   /* Hash is calculated over the data without the signature at the end. */
-  sha256((unsigned char *)data, data_size - sig_b64_size - 4, hash, 0);
+  sha256((unsigned char *)data, data_size - sig_b64_size - 5, hash, 0);
 
-  pk_init(&pub_key_ctx);
+  x509_crt_init(&codesign_cert);
 
-  ret = pk_parse_public_key(&pub_key_ctx, public_key_codesign_pem,
-                            public_key_codesign_pem_size);
+  /* Parse the pinned certificate */
+  ret = x509_crt_parse(&codesign_cert,
+                       public_key_codesign_pem,
+                       public_key_codesign_pem_size);
   if (ret != 0)
     {
-      ERRORPRINTF ("pk_parse_public_key failed with -0x%04x\n\n", -ret);
-      pk_free(&pub_key_ctx);
+      char errbuf[1020];
+      polarssl_strerror(ret, errbuf, 1020);
+      errbuf[1019] = '\0'; /* Just to be sure */
+      ERRORPRINTF ("x509_crt_parse failed with -0x%04x\n%s\n", -ret, errbuf);
+      x509_crt_free(&codesign_cert);
       return VerifyUnknownError;
     }
 
-  ret = pk_verify(&pub_key_ctx, POLARSSL_MD_SHA256, hash, 0,
+  ret = pk_verify(&codesign_cert.pk, POLARSSL_MD_SHA256, hash, 0,
                   signature, sig_size);
 
   if (ret != 0)
     {
-      ERRORPRINTF ("pk_verify failed with -0x%04x\n\n", -ret);
+      char errbuf[1020];
+      polarssl_strerror(ret, errbuf, 1020);
+      errbuf[1019] = '\0'; /* Just to be sure */
+      ERRORPRINTF ("pk_verify failed with -0x%04x\n %s\n", -ret, errbuf);
+      x509_crt_free(&codesign_cert);
+      retval = VerifyInvalidSignature;
+      goto done;
     }
-  pk_free(&pub_key_ctx);
+  x509_crt_free(&codesign_cert);
 
-  return VerifyValid;
+  retval = VerifyValid;
 
 done:
   xfree (data);