Index: head/usr.sbin/uefisign/pe.c
===================================================================
--- head/usr.sbin/uefisign/pe.c
+++ head/usr.sbin/uefisign/pe.c
@@ -56,6 +56,8 @@
 #define __CTASSERT(x, y)	typedef char __assert_ ## y [(x) ? 1 : -1]
 #endif
 
+#define PE_ALIGMENT_SIZE	8
+
 struct mz_header {
 	uint8_t			mz_signature[2];
 	uint8_t			mz_dont_care[58];
@@ -498,19 +500,17 @@
 }
 
 static off_t
-append(struct executable *x, void *ptr, size_t len)
+append(struct executable *x, void *ptr, size_t len, size_t aligment)
 {
 	off_t off;
 
-	/*
-	 * XXX: Alignment.
-	 */
 	off = x->x_len;
-	x->x_buf = realloc(x->x_buf, x->x_len + len);
+	x->x_buf = realloc(x->x_buf, x->x_len + len + aligment);
 	if (x->x_buf == NULL)
 		err(1, "realloc");
 	memcpy(x->x_buf + x->x_len, ptr, len);
-	x->x_len += len;
+	memset(x->x_buf + x->x_len + len, 0, aligment);
+	x->x_len += len + aligment;
 
 	return (off);
 }
@@ -522,6 +522,7 @@
 	struct pe_certificate *pc;
 	struct pe_directory_entry pde;
 	size_t pc_len;
+	size_t pc_aligment;
 	off_t pc_off;
 
 	pc_len = sizeof(*pc) + x->x_signature_len;
@@ -529,6 +530,11 @@
 	if (pc == NULL)
 		err(1, "calloc");
 
+	if (pc_len % PE_ALIGMENT_SIZE > 0)
+		pc_aligment = PE_ALIGMENT_SIZE - (pc_len % PE_ALIGMENT_SIZE);
+	else
+		pc_aligment = 0;
+
 #if 0
 	/*
 	 * Note that pc_len is the length of pc_certificate,
@@ -545,7 +551,7 @@
 	pc->pc_type = PE_CERTIFICATE_TYPE;
 	memcpy(&pc->pc_signature, x->x_signature, x->x_signature_len);
 
-	pc_off = append(x, pc, pc_len);
+	pc_off = append(x, pc, pc_len, pc_aligment);
 #if 0
 	printf("added signature chunk at offset %zd, len %zd\n",
 	    pc_off, pc_len);
@@ -554,7 +560,7 @@
 	free(pc);
 
 	pde.pde_rva = pc_off;
-	pde.pde_size = pc_len;
+	pde.pde_size = pc_len + pc_aligment;
 	memcpy(x->x_buf + x->x_certificate_entry_off, &pde, sizeof(pde));
 
 	checksum = compute_checksum(x);