From de69c90ee787dd829d2367b8ea48d8980951141e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADt=20Ondruch?= Date: Wed, 12 Nov 2025 10:44:40 +0100 Subject: [PATCH 01/25] Rebuild for nodejs-packaging Recently, Node.js changed the way node modules are installed to allow for better parallel functionality and easier unbundling of certain parts of Node.js. Previously, Node.js was using a symlink, %{_libdir}/node_modules, which pointed to a versioned path, e.g., %{_libdir}/node_modules_22. This has changed to using a global %{_libdir}/node_modules static shared folder for generic modules and %{_libdir}/node_modules_XX for version-specific modules. This change is better described in the Fedora change proposal wiki: https://fedoraproject.org/wiki/Changes/NodejsNodeModulesPath. This also needed to be reflected in nodejs-packaging macros, which forces a rebuild of dependent packages. From 4dc76823463454d44989e28436e4f4f0a8effb59 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADt=20Ondruch?= Date: Wed, 12 Nov 2025 10:44:40 +0100 Subject: [PATCH 02/25] Rebuild for nodejs-packaging Recently, Node.js changed the way node modules are installed to allow for better parallel functionality and easier unbundling of certain parts of Node.js. Previously, Node.js was using a symlink, %{_libdir}/node_modules, which pointed to a versioned path, e.g., %{_libdir}/node_modules_22. This has changed to using a global %{_libdir}/node_modules static shared folder for generic modules and %{_libdir}/node_modules_XX for version-specific modules. This change is better described in the Fedora change proposal wiki: https://fedoraproject.org/wiki/Changes/NodejsNodeModulesPath. This also needed to be reflected in nodejs-packaging macros, which forces a rebuild of dependent packages. From 466def6232b92771d410cfc1fb84a876fd18e4b2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 13 Nov 2025 17:35:57 +0000 Subject: [PATCH 03/25] Add newline in pccs.service MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Daniel P. Berrangé --- pccs.service | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pccs.service b/pccs.service index 9fa35ed..a183226 100644 --- a/pccs.service +++ b/pccs.service @@ -20,4 +20,4 @@ DeviceAllow=/dev/sgx_enclave rw DeviceAllow=/dev/sgx_provision rw [Install] -WantedBy=multi-user.target \ No newline at end of file +WantedBy=multi-user.target From 342304b8143188507472a8bd59e84dbd985dfd21 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 13 Nov 2025 17:34:57 +0000 Subject: [PATCH 04/25] Stop using _sbindir for services MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The .service files have to be hardcoded to a path, which must now be the same as _bindir, so there's no point using _sbindir. Signed-off-by: Daniel P. Berrangé --- linux-sgx.spec | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/linux-sgx.spec b/linux-sgx.spec index 71c7bbe..88618a4 100644 --- a/linux-sgx.spec +++ b/linux-sgx.spec @@ -994,7 +994,6 @@ done # Dirs for host OS software %__install -d %{buildroot}%{_bindir} -%__install -d %{buildroot}%{_sbindir} %__install -d %{buildroot}%{_libdir}/pkgconfig %__install -d %{buildroot}%{_libexecdir} %__install -d %{buildroot}%{_datadir} @@ -1125,13 +1124,13 @@ ln -s ../../..%{_datadir}/aesmd/white_list_cert_to_be_verify.bin \ # XXX it looks for files relative to its binary, so we # need this wrapper. Patch the source and kill this -cat >> %{buildroot}%{_sbindir}/aesmd <> %{buildroot}%{_bindir}/aesmd < Date: Thu, 13 Nov 2025 17:44:49 +0000 Subject: [PATCH 05/25] Wildcard ignore more tarballs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Daniel P. Berrangé --- .gitignore | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 45105a6..0d87412 100644 --- a/.gitignore +++ b/.gitignore @@ -12,6 +12,6 @@ /wasm-micro-runtime-*.tar.gz /DCAP_*.tar.gz *~ -/dcap-1.23-pccs-node-modules.tar.xz -/node-ffi-rs-1.2.6-vendor.tar.gz -/node-ffi-rs-1.2.6.tar.gz +/dcap-*-pccs-node-modules.tar.xz +/node-ffi-rs-*-vendor.tar.gz +/node-ffi-rs-*.tar.gz From 7a1b3853deb202205854478b9cd3ebc0e8931b58 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 14 Nov 2025 09:17:34 +0000 Subject: [PATCH 06/25] Re-add tinyxml2 bundling to be used in RHEL rebuilds MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Daniel P. Berrangé --- linux-sgx.spec | 16 +++++++++++++++- sources | 1 + 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/linux-sgx.spec b/linux-sgx.spec index 88618a4..18033c2 100644 --- a/linux-sgx.spec +++ b/linux-sgx.spec @@ -102,7 +102,7 @@ # From DCAP git submodule %global wamr_version 1.0.0 # From SGX external/tinyxml2 -%global tinyxml2_version 7.0.0 +%global tinyxml2_version 10.0.0 # From SGX external/epid-sdk/CHANGELOG.md %global epid_version 6.0.0 @@ -280,6 +280,11 @@ Provides: bundled(jwt-cpp) = %{jwt_cpp_version} Source13: https://github.com/bytecodealliance/wasm-micro-runtime/archive/refs/tags/WAMR-%{wamr_version}.tar.gz#/wasm-micro-runtime-%{wamr_version}.tar.gz Provides: bundled(wasm-micro-runtime} = %{wamr_version} +Source14: https://github.com/leethomason/tinyxml2/archive/refs/tags/%{tinyxml2_version}.tar.gz#/tinyxml2-%{tinyxml2_version}.tar.gz +%if ! %{with_host_tinyxml2} +Provides: bundled(tinyxml2) = %{tinyxml2_version} +%endif + ############################################################ # Misc distro integration files SourceN in (40..59) @@ -728,6 +733,15 @@ rm -rf external/{dnnl,openmp,protobuf} sdk/sample_libcrypto ) +############################################################ +# tinyxml2 +%if ! %{with_host_tinyxml2} +( + cd external/tinyxml2 + tar zxf %{SOURCE14} --strip 1 +) +%endif + ############################################################ # prebuilt enclaves diff --git a/sources b/sources index b3dbe7e..3c50c7a 100644 --- a/sources +++ b/sources @@ -13,3 +13,4 @@ SHA512 (wasm-micro-runtime-1.0.0.tar.gz) = fb16a992b54f5c006be386b72ff65c680eded SHA512 (dcap-1.23-pccs-node-modules.tar.xz) = 7f311e72b3bd66009574cd77b5398cc6081626de2394dfb567308172f1ae325e4720e596f9badc0084a5750dc990c774b025816f509b4e1e73be9af7784c2065 SHA512 (node-ffi-rs-1.2.6-vendor.tar.gz) = 76d59d69a842ce207dce21f12a8ada3b3b1b81a93ccd3a0b68838cea4aad1cbdba0a314ff7208b43caf6435e820a226ab1e8f8477bedcdb323eec80976ab96be SHA512 (node-ffi-rs-1.2.6.tar.gz) = 37f95562e5a61b60949c59d024bea2e2d02c6bf1b21a3bc07d558538d05082a03d1ba2eb8e4500fd4ccd7e556aae0c60fc875d487b2d2d54c8302757f69dc003 +SHA512 (tinyxml2-10.0.0.tar.gz) = a359d33bc12fad455b53d81011dbe12727cae0aabfaa5704f1a25807ca216dd854a571291029886c0beedeca5c3b6393dd49c4718773e18a0e008abbdb3de36a From 8b750f618f3ea2632ab67b721b57f23c6f17a349 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 14 Nov 2025 09:17:50 +0000 Subject: [PATCH 07/25] Drop obsolete perl mangling cmd that is failing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Daniel P. Berrangé --- linux-sgx.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/linux-sgx.spec b/linux-sgx.spec index 18033c2..06a3850 100644 --- a/linux-sgx.spec +++ b/linux-sgx.spec @@ -948,7 +948,6 @@ LDFLAGS="%{build_ldflags}" \ done # Keep brp-mangle-shebangs happy - perl -i -p -e 's,/usr/bin/env python,/usr/bin/env python3,' node_modules/ffi-napi/deps/libffi/generate-darwin-source-and-headers.py find node_modules -type f -exec chmod -x {} \; tar zxvf %{SOURCE55} From 82fced15bc614606468ece31ea937755bc218bac Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Tue, 18 Nov 2025 16:16:19 +0000 Subject: [PATCH 08/25] Purge nodejs sqlite3 rpath instead of disabling rpath checks MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Daniel P. Berrangé --- linux-sgx.spec | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) diff --git a/linux-sgx.spec b/linux-sgx.spec index 06a3850..4c34d76 100644 --- a/linux-sgx.spec +++ b/linux-sgx.spec @@ -13,16 +13,6 @@ # /usr/bin/ld: /tmp/ccWKJhwL.ltrans0.ltrans.o: relocation R_X86_64_PC32 against symbol `_Z16aesm_thread_procPv' can not be used when making a shared object; recompile with -fPIC %global _lto_cflags %nil -# The nodejs sqlite3 module will trigger a warning -# -# ERROR 0001: file '/usr/lib/node_modules_22/pccs/node_modules/sqlite3/build/Release/node_sqlite3.node' contains a standard runpath '/usr/lib64' in [/usr/lib64] -# ERROR 0001: file '/usr/lib/node_modules_22/pccs/node_modules/sqlite3/build/Release/obj.target/node_sqlite3.node' contains a standard runpath '/usr/lib64' in [/usr/lib64] -# -# since these are harmless just disable the check for now -# rather than trying to figure out how to remove them - -%global __brp_check_rpaths %{nil} - ############################################################ # # Note about the approach to bundling... @@ -950,6 +940,8 @@ LDFLAGS="%{build_ldflags}" \ # Keep brp-mangle-shebangs happy find node_modules -type f -exec chmod -x {} \; + patchelf --remove-rpath node_modules/sqlite3/build/Release/node_sqlite3.node + tar zxvf %{SOURCE55} ( cd node-ffi-rs-%{node_ffi_rs_version} From 63edf1d2da31cd9796e665ca4c2ede3e67a6426f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Tue, 18 Nov 2025 16:39:52 +0000 Subject: [PATCH 09/25] Add patchelf as a build dep MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Daniel P. Berrangé --- linux-sgx.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/linux-sgx.spec b/linux-sgx.spec index 4c34d76..482cee6 100644 --- a/linux-sgx.spec +++ b/linux-sgx.spec @@ -394,6 +394,7 @@ BuildRequires: ocaml-ocamlbuild BuildRequires: openssl BuildRequires: openssl-devel BuildRequires: libcurl-devel +BuildRequires: patchelf BuildRequires: python3-devel BuildRequires: perl-generators BuildRequires: perl-interpreter From 1ca515068de0f38148b9fdc4b5a599ea2e892e86 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Tue, 18 Nov 2025 17:27:01 +0000 Subject: [PATCH 10/25] Set execute on node_sqlite3.node for debuginfo MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The debuginfo extraction script only processes executable files Signed-off-by: Daniel P. Berrangé --- linux-sgx.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/linux-sgx.spec b/linux-sgx.spec index 482cee6..2c984ef 100644 --- a/linux-sgx.spec +++ b/linux-sgx.spec @@ -1176,6 +1176,9 @@ rmdir %{buildroot}/root/opt/intel/sgx-dcap-pccs cd external/dcap_source/QuoteGeneration/pccs rm -f install.sh README.md + # So find-debuginfo processes it + chmod +x node_modules/sqlite3/build/Release/node_sqlite3.node + cp -a node_modules %{buildroot}%{nodejs_sitearch}/pccs/node_modules ) From 059577a9d2940b2a5c640d8768df2a323c05db8d Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Tue, 2 Dec 2025 12:44:31 -0500 Subject: [PATCH 11/25] Use chrpath to remove RPATH chrpath is included in RHEL, patchelf is not. --- linux-sgx.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/linux-sgx.spec b/linux-sgx.spec index 2c984ef..015b1a1 100644 --- a/linux-sgx.spec +++ b/linux-sgx.spec @@ -384,6 +384,7 @@ BuildRequires: sgx-rpm-macros BuildRequires: autoconf BuildRequires: automake BuildRequires: binutils +BuildRequires: chrpath BuildRequires: libtool BuildRequires: gcc BuildRequires: gcc-c++ @@ -394,7 +395,6 @@ BuildRequires: ocaml-ocamlbuild BuildRequires: openssl BuildRequires: openssl-devel BuildRequires: libcurl-devel -BuildRequires: patchelf BuildRequires: python3-devel BuildRequires: perl-generators BuildRequires: perl-interpreter @@ -941,7 +941,7 @@ LDFLAGS="%{build_ldflags}" \ # Keep brp-mangle-shebangs happy find node_modules -type f -exec chmod -x {} \; - patchelf --remove-rpath node_modules/sqlite3/build/Release/node_sqlite3.node + chrpath --delete node_modules/sqlite3/build/Release/node_sqlite3.node tar zxvf %{SOURCE55} ( From 22edf3607deb293c50c6fff6ca43e734317c6339 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Wed, 26 Nov 2025 11:26:18 +0000 Subject: [PATCH 12/25] Enable pccsadmin everywhere MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Since pccs was reintroduced the pccsadmin tool is now relevant on both RHEL and Fedora Signed-off-by: Daniel P. Berrangé --- linux-sgx.spec | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/linux-sgx.spec b/linux-sgx.spec index 015b1a1..68bff0c 100644 --- a/linux-sgx.spec +++ b/linux-sgx.spec @@ -47,11 +47,10 @@ %global with_aesm 0 %global with_host_tinyxml2 0 -%global with_pccsadmin 0 +%global with_pccsadmin 1 %if 0%{?fedora} %global with_aesm 1 %global with_host_tinyxml2 1 -%global with_pccsadmin 1 %endif %global with_sysusers_scripts 0 From b5fba5c2f92e813b44e9c7c3b0d2e63ebd3b51c2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Mon, 1 Dec 2025 14:50:53 +0000 Subject: [PATCH 13/25] Add systemd & sysusers scriptlets for PCCS MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Daniel P. Berrangé --- linux-sgx.spec | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/linux-sgx.spec b/linux-sgx.spec index 68bff0c..bd944fb 100644 --- a/linux-sgx.spec +++ b/linux-sgx.spec @@ -1396,6 +1396,21 @@ fi %systemd_postun_with_restart mpa_registration.service +%if %{with_sysusers_scripts} +%pre -n sgx-pccs +%sysusers_create_compat %{SOURCE50} +%endif + +%post -n sgx-pccs +%systemd_post pccs.service + +%preun -n sgx-pccs +%systemd_preun pccs.service + +%postun -n sgx-pccs +%systemd_postun_with_restart pccs.service + + %if %{with_sysusers_scripts} %pre -n tdx-qgs %sysusers_create_compat %{SOURCE44} From 12f522964781ef01b30d382e9ca6f9e971e99894 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 4 Dec 2025 15:41:21 +0000 Subject: [PATCH 14/25] Port to pycryptography and pyasn1 and make keyring optional MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit pyOpenSSL 24.0.0 removed several APIs required by pccsadmin, so porting to pycryptography is required. Using pyasn1 instead of asn1 gives stronger validation during parsing and brings compatibility with RHEL that lacks python3-asn1 The keyring package needs to be optional on RHEL which lacks this module (currently). Signed-off-by: Daniel P. Berrangé --- ...rop-use-of-bundled-pre-built-openssl.patch | 4 +- ...mprove-debuggability-of-build-system.patch | 4 +- ...me-setting-of-enclave-load-directory.patch | 4 +- ...ed-sgx_urts-library-in-PCKRetrievalT.patch | 4 +- ...-only-import-pypac-module-on-Windows.patch | 26 +- ...-PCKRetrievalTool-config-file-in-etc.patch | 6 +- ...XFLAGS-LDFLAGS-for-various-tools-and.patch | 6 +- ...tween-program-name-first-arg-in-usag.patch | 6 +- ...nst-format-strings-in-QL-log-message.patch | 6 +- ...d-debug-parameter-to-control-logging.patch | 6 +- ...-leftover-debugging-print-args-state.patch | 6 +- ...sion-for-libsgx_qe3_logic.so-library.patch | 6 +- 0112-Workaround-broken-GCC-15.patch | 6 +- ...-Don-t-disable-cf-protection-for-qgs.patch | 6 +- ...ecks-for-GCC-version-that-break-fsta.patch | 6 +- ...se-distro-provided-rapidjson-package.patch | 6 +- 0116-Don-t-stomp-on-VERBOSE-variable.patch | 6 +- ...-MODE-parameter-for-UNIX-socket-mode.patch | 6 +- ...-PCCS-port-number-from-8081-to-10801.patch | 6 +- ...aths-to-all-resources-in-PCCS-server.patch | 6 +- 0120-pccs-only-pass-ApiKey-if-it-is-set.patch | 6 +- ...csadmin-make-keyring-module-optional.patch | 104 ++++++ ...rt-from-asn1-to-pyasn1-python-module.patch | 341 ++++++++++++++++++ ...csadmin-fully-port-to-pycryptography.patch | 248 +++++++++++++ linux-sgx.spec | 11 +- 25 files changed, 771 insertions(+), 71 deletions(-) rename 0104-Don-t-import-pypac-in-pccsadmin.patch => 0104-pccsadmin-only-import-pypac-module-on-Windows.patch (52%) create mode 100644 0121-pccsadmin-make-keyring-module-optional.patch create mode 100644 0122-pccsadmin-convert-from-asn1-to-pyasn1-python-module.patch create mode 100644 0123-pccsadmin-fully-port-to-pycryptography.patch diff --git a/0100-Drop-use-of-bundled-pre-built-openssl.patch b/0100-Drop-use-of-bundled-pre-built-openssl.patch index 9312740..337429b 100644 --- a/0100-Drop-use-of-bundled-pre-built-openssl.patch +++ b/0100-Drop-use-of-bundled-pre-built-openssl.patch @@ -1,7 +1,7 @@ From 9746d1048b23a3431d898f2375a8d849127ebde7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Mon, 26 Feb 2024 12:19:51 +0000 -Subject: [PATCH 100/120] Drop use of bundled pre-built openssl +Subject: [PATCH 100/123] Drop use of bundled pre-built openssl MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -188,5 +188,5 @@ index a20a3cd..c8e1d01 100644 debug: $(PCKCERTSEL_VERBOSE)$(MAKE) DEBUG=1 all -- -2.49.0 +2.51.1 diff --git a/0101-Improve-debuggability-of-build-system.patch b/0101-Improve-debuggability-of-build-system.patch index 4c3f469..b2af464 100644 --- a/0101-Improve-debuggability-of-build-system.patch +++ b/0101-Improve-debuggability-of-build-system.patch @@ -1,7 +1,7 @@ From 50bbd267076608a9b0a3b5e23bcbc8bfadfb09d7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 1 Mar 2024 12:05:01 +0000 -Subject: [PATCH 101/120] Improve debuggability of build system +Subject: [PATCH 101/123] Improve debuggability of build system MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -128,5 +128,5 @@ index 894e616..7962d10 100644 .PHONY: qal qal: -- -2.49.0 +2.51.1 diff --git a/0102-Support-build-time-setting-of-enclave-load-directory.patch b/0102-Support-build-time-setting-of-enclave-load-directory.patch index eb37253..1fe0379 100644 --- a/0102-Support-build-time-setting-of-enclave-load-directory.patch +++ b/0102-Support-build-time-setting-of-enclave-load-directory.patch @@ -1,7 +1,7 @@ From 2f0e63c015f83aa2248b8afa04c1928b6aa8b0fb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Mon, 26 Feb 2024 12:19:51 +0000 -Subject: [PATCH 102/120] Support build time setting of enclave load directory +Subject: [PATCH 102/123] Support build time setting of enclave load directory MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -259,5 +259,5 @@ index d9c2bac..1065949 100644 App_Link_Flags += -lcurl -ldl -lpthread ifeq ($(STANDALONE), 1) -- -2.49.0 +2.51.1 diff --git a/0103-Look-for-versioned-sgx_urts-library-in-PCKRetrievalT.patch b/0103-Look-for-versioned-sgx_urts-library-in-PCKRetrievalT.patch index 7557473..fc6320e 100644 --- a/0103-Look-for-versioned-sgx_urts-library-in-PCKRetrievalT.patch +++ b/0103-Look-for-versioned-sgx_urts-library-in-PCKRetrievalT.patch @@ -1,7 +1,7 @@ From 5fddd2225147e4372a6ff09350bdd495c3fdd4f8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Tue, 27 Feb 2024 15:46:41 +0000 -Subject: [PATCH 103/120] Look for versioned sgx_urts library in +Subject: [PATCH 103/123] Look for versioned sgx_urts library in PCKRetrievalTool MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 @@ -40,5 +40,5 @@ index d77a6eb..d195717 100644 } #endif -- -2.49.0 +2.51.1 diff --git a/0104-Don-t-import-pypac-in-pccsadmin.patch b/0104-pccsadmin-only-import-pypac-module-on-Windows.patch similarity index 52% rename from 0104-Don-t-import-pypac-in-pccsadmin.patch rename to 0104-pccsadmin-only-import-pypac-module-on-Windows.patch index 067dd19..062a15d 100644 --- a/0104-Don-t-import-pypac-in-pccsadmin.patch +++ b/0104-pccsadmin-only-import-pypac-module-on-Windows.patch @@ -1,33 +1,35 @@ -From d758e815930fe6ca3d19ab880c8cb839001746ce Mon Sep 17 00:00:00 2001 +From 728aaf92031a6691265f6ad98df3b18183049d26 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= -Date: Tue, 27 Feb 2024 20:28:24 +0000 -Subject: [PATCH 104/120] Don't import pypac in pccsadmin +Date: Fri, 4 Oct 2024 17:41:37 +0100 +Subject: [PATCH 104/123] pccsadmin: only import 'pypac' module on Windows MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit -The code only uses the pypac module when executing on Windows -hosts. It should not be imported when packaged for Linux -environments to avoid a redundant python dependency. +The PACSession object is only used in a code path that runs on +Windows, so don't try to import this on Linux, to avoid the +redundant dependency. Signed-off-by: Daniel P. Berrangé --- - tools/PccsAdminTool/lib/intelsgx/pcs.py | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) + tools/PccsAdminTool/lib/intelsgx/pcs.py | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tools/PccsAdminTool/lib/intelsgx/pcs.py b/tools/PccsAdminTool/lib/intelsgx/pcs.py -index 9f1d224..af1e78e 100644 +index 9f1d224..046c781 100644 --- a/tools/PccsAdminTool/lib/intelsgx/pcs.py +++ b/tools/PccsAdminTool/lib/intelsgx/pcs.py -@@ -5,7 +5,7 @@ import json +@@ -5,8 +5,9 @@ import json import binascii from urllib import parse from OpenSSL import crypto -from pypac import PACSession -+#from pypac import PACSession from platform import system ++if system() == 'Windows': ++ from pypac import PACSession from lib.intelsgx.credential import Credentials from requests.adapters import HTTPAdapter + from urllib3.util import Retry -- -2.49.0 +2.51.1 diff --git a/0105-Look-for-PCKRetrievalTool-config-file-in-etc.patch b/0105-Look-for-PCKRetrievalTool-config-file-in-etc.patch index 9e08f62..9e50ac7 100644 --- a/0105-Look-for-PCKRetrievalTool-config-file-in-etc.patch +++ b/0105-Look-for-PCKRetrievalTool-config-file-in-etc.patch @@ -1,7 +1,7 @@ -From 1d85ecfb88b08772efdaeb241b09502383e1123c Mon Sep 17 00:00:00 2001 +From 370fd9a5e6c06e47d394343aefe39610a60f4263 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 29 Feb 2024 14:21:36 +0000 -Subject: [PATCH 105/120] Look for PCKRetrievalTool config file in /etc/ +Subject: [PATCH 105/123] Look for PCKRetrievalTool config file in /etc/ MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -39,5 +39,5 @@ index e423f38..36f219b 100644 if(strnlen(local_configuration_file_path ,MAX_PATH)+strnlen(LOCAL_NETWORK_SETTING,MAX_PATH)+sizeof(char) > MAX_PATH) { return false; -- -2.49.0 +2.51.1 diff --git a/0106-Honour-CFLAGS-CXXFLAGS-LDFLAGS-for-various-tools-and.patch b/0106-Honour-CFLAGS-CXXFLAGS-LDFLAGS-for-various-tools-and.patch index 5538fb9..c4c76f7 100644 --- a/0106-Honour-CFLAGS-CXXFLAGS-LDFLAGS-for-various-tools-and.patch +++ b/0106-Honour-CFLAGS-CXXFLAGS-LDFLAGS-for-various-tools-and.patch @@ -1,7 +1,7 @@ -From ac4041d449135696b66c9d147d29f0967e2df1c3 Mon Sep 17 00:00:00 2001 +From 8cc9b7264cec48f7fb011b099e3c41080a9395aa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 28 Mar 2025 16:00:27 +0000 -Subject: [PATCH 106/120] Honour CFLAGS/CXXFLAGS/LDFLAGS for various tools and +Subject: [PATCH 106/123] Honour CFLAGS/CXXFLAGS/LDFLAGS for various tools and libraries MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 @@ -205,5 +205,5 @@ index 4937fe9..83aefee 100644 LDFLAGS += '-Wl,-rpath,$$ORIGIN' CXXFLAGS += '-DSTANDALONE' -- -2.49.0 +2.51.1 diff --git a/0107-qgs-add-space-between-program-name-first-arg-in-usag.patch b/0107-qgs-add-space-between-program-name-first-arg-in-usag.patch index 738678f..9274a0f 100644 --- a/0107-qgs-add-space-between-program-name-first-arg-in-usag.patch +++ b/0107-qgs-add-space-between-program-name-first-arg-in-usag.patch @@ -1,7 +1,7 @@ -From 95b111ae4a42f872e467a58058cfc87d5a5d089d Mon Sep 17 00:00:00 2001 +From 5ae9e5eef28ef318fc31adac5cfb19af1d45ad7a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 3 Oct 2024 14:42:29 +0100 -Subject: [PATCH 107/120] qgs: add space between program name & first arg in +Subject: [PATCH 107/123] qgs: add space between program name & first arg in usage MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 @@ -35,5 +35,5 @@ index 478dbfe..3618b5a 100644 exit(1); } -- -2.49.0 +2.51.1 diff --git a/0108-qgs-protect-against-format-strings-in-QL-log-message.patch b/0108-qgs-protect-against-format-strings-in-QL-log-message.patch index ebe3af5..24d7ee5 100644 --- a/0108-qgs-protect-against-format-strings-in-QL-log-message.patch +++ b/0108-qgs-protect-against-format-strings-in-QL-log-message.patch @@ -1,7 +1,7 @@ -From 0df9bd861d54722365e891911c18924af16cd732 Mon Sep 17 00:00:00 2001 +From 6589bfa27e59d2331a69ddcef0ec1ac06a083704 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 4 Oct 2024 09:43:17 +0100 -Subject: [PATCH 108/120] qgs: protect against format strings in QL log +Subject: [PATCH 108/123] qgs: protect against format strings in QL log messages MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 @@ -35,5 +35,5 @@ index 77838c3..1e97b58 100644 } -- -2.49.0 +2.51.1 diff --git a/0109-qgs-add-debug-parameter-to-control-logging.patch b/0109-qgs-add-debug-parameter-to-control-logging.patch index 0d9a2f9..0406fe2 100644 --- a/0109-qgs-add-debug-parameter-to-control-logging.patch +++ b/0109-qgs-add-debug-parameter-to-control-logging.patch @@ -1,7 +1,7 @@ -From 480ac4becb93a54184c024fa1945c1a2890488fb Mon Sep 17 00:00:00 2001 +From d882234222791a8debfa04fbb284e00c36d69854 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 3 Oct 2024 16:57:35 +0100 -Subject: [PATCH 109/120] qgs: add --debug parameter to control logging +Subject: [PATCH 109/123] qgs: add --debug parameter to control logging MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -125,5 +125,5 @@ index 3618b5a..47f6c26 100644 exit(1); } -- -2.49.0 +2.51.1 diff --git a/0110-pccsadmin-remove-leftover-debugging-print-args-state.patch b/0110-pccsadmin-remove-leftover-debugging-print-args-state.patch index b10409c..0043f89 100644 --- a/0110-pccsadmin-remove-leftover-debugging-print-args-state.patch +++ b/0110-pccsadmin-remove-leftover-debugging-print-args-state.patch @@ -1,7 +1,7 @@ -From e559fba635b7736a54a446e25afc268b2a27513c Mon Sep 17 00:00:00 2001 +From 5adba978fa3d75cc1dbada716fb7423111d7f5b6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Tue, 8 Oct 2024 10:13:02 +0100 -Subject: [PATCH 110/120] pccsadmin: remove leftover debugging 'print(args)' +Subject: [PATCH 110/123] pccsadmin: remove leftover debugging 'print(args)' statement MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 @@ -29,5 +29,5 @@ index ffee326..8e447c5 100755 if args.command == 'put' and args.url and args.url.endswith("/appraisalpolicy"): if not args.fmspc or not args.input_file: -- -2.49.0 +2.51.1 diff --git a/0111-Fix-soname-version-for-libsgx_qe3_logic.so-library.patch b/0111-Fix-soname-version-for-libsgx_qe3_logic.so-library.patch index 7900087..8a94de7 100644 --- a/0111-Fix-soname-version-for-libsgx_qe3_logic.so-library.patch +++ b/0111-Fix-soname-version-for-libsgx_qe3_logic.so-library.patch @@ -1,7 +1,7 @@ -From 6a2d951d6a1d21a1c45256c81eaf1acd6f010d46 Mon Sep 17 00:00:00 2001 +From 88ea0b616e118e673ec4b6f2d14117daee260514 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 17 Jan 2025 15:39:39 +0000 -Subject: [PATCH 111/120] Fix soname version for libsgx_qe3_logic.so library +Subject: [PATCH 111/123] Fix soname version for libsgx_qe3_logic.so library MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -51,5 +51,5 @@ index 9b8c936..c92d782 100644 $(BUILD_DIR): -- -2.49.0 +2.51.1 diff --git a/0112-Workaround-broken-GCC-15.patch b/0112-Workaround-broken-GCC-15.patch index 6df7556..00c6b16 100644 --- a/0112-Workaround-broken-GCC-15.patch +++ b/0112-Workaround-broken-GCC-15.patch @@ -1,7 +1,7 @@ -From 63e5a14cbae060060ee1de4eae177cc2f7b1f851 Mon Sep 17 00:00:00 2001 +From c5dc85fdef5a558738b0b5b1125dfee612f3d812 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 6 Feb 2025 20:08:59 +0000 -Subject: [PATCH 112/120] Workaround broken GCC 15 +Subject: [PATCH 112/123] Workaround broken GCC 15 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -36,5 +36,5 @@ index 15fbdd4..4400544 100644 private: struct alignas(A)_T_instantiator_ -- -2.49.0 +2.51.1 diff --git a/0113-Don-t-disable-cf-protection-for-qgs.patch b/0113-Don-t-disable-cf-protection-for-qgs.patch index b115c34..5b3e506 100644 --- a/0113-Don-t-disable-cf-protection-for-qgs.patch +++ b/0113-Don-t-disable-cf-protection-for-qgs.patch @@ -1,7 +1,7 @@ -From 3cb471cfd9309a61c6cacf99ef8959c8d6c3079c Mon Sep 17 00:00:00 2001 +From a9e7f2a4ec859e8846089af81f541b6cc1d436b9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Wed, 2 Apr 2025 18:39:31 +0100 -Subject: [PATCH 113/120] Don't disable cf-protection for qgs +Subject: [PATCH 113/123] Don't disable cf-protection for qgs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -27,5 +27,5 @@ index 8228bdf..5116d85 100644 DEPENDS = ${QGS_OBJS test_client.o:.o=.d} -- -2.49.0 +2.51.1 diff --git a/0114-Delete-broken-checks-for-GCC-version-that-break-fsta.patch b/0114-Delete-broken-checks-for-GCC-version-that-break-fsta.patch index c3aa197..c3a6231 100644 --- a/0114-Delete-broken-checks-for-GCC-version-that-break-fsta.patch +++ b/0114-Delete-broken-checks-for-GCC-version-that-break-fsta.patch @@ -1,7 +1,7 @@ -From 218ff444583b58dc122ac69507b50c6e9f711581 Mon Sep 17 00:00:00 2001 +From 58afc007ef674ad50027783642845f95f37ec198 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 3 Apr 2025 17:44:48 +0100 -Subject: [PATCH 114/120] Delete broken checks for GCC version that break +Subject: [PATCH 114/123] Delete broken checks for GCC version that break -fstack-protector-strong MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 @@ -201,5 +201,5 @@ index b6968c6..1d2106b 100644 ifdef DEBUG COMMON_FLAGS += -O0 -ggdb -DDEBUG -UNDEBUG -- -2.49.0 +2.51.1 diff --git a/0115-Use-distro-provided-rapidjson-package.patch b/0115-Use-distro-provided-rapidjson-package.patch index b367037..40b4a16 100644 --- a/0115-Use-distro-provided-rapidjson-package.patch +++ b/0115-Use-distro-provided-rapidjson-package.patch @@ -1,7 +1,7 @@ -From 8c70d52e120ff2f2e878975db2ac7253b28319cf Mon Sep 17 00:00:00 2001 +From 082009b9e9fbbe715743104eafc182959b51dd22 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Mon, 26 Feb 2024 12:19:51 +0000 -Subject: [PATCH 115/120] Use distro provided rapidjson package +Subject: [PATCH 115/123] Use distro provided rapidjson package MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -170,5 +170,5 @@ index c8e1d01..6f1440a 100644 # the library shared object name LIB_NAME := libPCKCertSelection.a -- -2.49.0 +2.51.1 diff --git a/0116-Don-t-stomp-on-VERBOSE-variable.patch b/0116-Don-t-stomp-on-VERBOSE-variable.patch index 205d410..8ecd0c3 100644 --- a/0116-Don-t-stomp-on-VERBOSE-variable.patch +++ b/0116-Don-t-stomp-on-VERBOSE-variable.patch @@ -1,7 +1,7 @@ -From 9313ac72fda37a90096979cabae7d4294ef7ba42 Mon Sep 17 00:00:00 2001 +From 569bd6150f38405efb1a27cd8827164560b431d6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Wed, 16 Apr 2025 11:48:52 +0100 -Subject: [PATCH 116/120] Don't stomp on "VERBOSE" variable +Subject: [PATCH 116/123] Don't stomp on "VERBOSE" variable MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -97,5 +97,5 @@ index 3d474bb..0f593f5 100644 - $(VERBOSE) rm -vrf $(TARGET) $(SIGNING_MATERIAL) + $(CMD_VERBOSE) rm -vrf $(TARGET) $(SIGNING_MATERIAL) -- -2.49.0 +2.51.1 diff --git a/0117-qgs-add-m-MODE-parameter-for-UNIX-socket-mode.patch b/0117-qgs-add-m-MODE-parameter-for-UNIX-socket-mode.patch index a175203..7af593e 100644 --- a/0117-qgs-add-m-MODE-parameter-for-UNIX-socket-mode.patch +++ b/0117-qgs-add-m-MODE-parameter-for-UNIX-socket-mode.patch @@ -1,7 +1,7 @@ -From 22171373ad5c818b5a57339ba607ff9876e34939 Mon Sep 17 00:00:00 2001 +From 85f4916b578bb1a210c76f78a392d66efc2c704c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 2 May 2025 14:48:24 +0100 -Subject: [PATCH 117/120] qgs: add -m=MODE parameter for UNIX socket mode +Subject: [PATCH 117/123] qgs: add -m=MODE parameter for UNIX socket mode MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -99,5 +99,5 @@ index 47f6c26..4628b18 100644 io_service.run(); QGS_LOG_INFO("Quit main loop\n"); -- -2.49.0 +2.51.1 diff --git a/0118-Switch-default-PCCS-port-number-from-8081-to-10801.patch b/0118-Switch-default-PCCS-port-number-from-8081-to-10801.patch index a87e3bd..a1577b2 100644 --- a/0118-Switch-default-PCCS-port-number-from-8081-to-10801.patch +++ b/0118-Switch-default-PCCS-port-number-from-8081-to-10801.patch @@ -1,7 +1,7 @@ -From 2f42f8333820bb555778df38aaf27d02a5533ef6 Mon Sep 17 00:00:00 2001 +From b31c83c905094edee5c21240129467a31b7b11c4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Tue, 27 Feb 2024 15:46:41 +0000 -Subject: [PATCH 118/120] Switch default PCCS port number from 8081 to 10801 +Subject: [PATCH 118/123] Switch default PCCS port number from 8081 to 10801 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -170,5 +170,5 @@ index 8e447c5..f286827 100755 parser_refresh.set_defaults(func=pccs_refresh) -- -2.49.0 +2.51.1 diff --git a/0119-Sanitize-paths-to-all-resources-in-PCCS-server.patch b/0119-Sanitize-paths-to-all-resources-in-PCCS-server.patch index 8134d1b..c2b25a4 100644 --- a/0119-Sanitize-paths-to-all-resources-in-PCCS-server.patch +++ b/0119-Sanitize-paths-to-all-resources-in-PCCS-server.patch @@ -1,7 +1,7 @@ -From 308e939ffc44c4720833aa518b0d19be1e01a186 Mon Sep 17 00:00:00 2001 +From a74b9efa563f98c302e556ca098f9b25d3213987 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Tue, 27 Feb 2024 13:38:49 +0000 -Subject: [PATCH 119/120] Sanitize paths to all resources in PCCS server +Subject: [PATCH 119/123] Sanitize paths to all resources in PCCS server MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -104,5 +104,5 @@ index 6f910ee..6eb9d15 100644 const migration = migrations.find(migration => migration.name === name); logger.debug(`Resolving migration: ${name}, found: ${migration ? migration.name : 'none'}`); -- -2.49.0 +2.51.1 diff --git a/0120-pccs-only-pass-ApiKey-if-it-is-set.patch b/0120-pccs-only-pass-ApiKey-if-it-is-set.patch index 9e97d21..d77a784 100644 --- a/0120-pccs-only-pass-ApiKey-if-it-is-set.patch +++ b/0120-pccs-only-pass-ApiKey-if-it-is-set.patch @@ -1,7 +1,7 @@ -From 512591ff394d7b04925893480519ebc1d29aefc7 Mon Sep 17 00:00:00 2001 +From 524c7d16514f1fe3a28816e9c2c4fcc838e55ad5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Wed, 9 Jul 2025 16:41:59 +0100 -Subject: [PATCH 120/120] pccs: only pass ApiKey if it is set +Subject: [PATCH 120/123] pccs: only pass ApiKey if it is set MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -67,5 +67,5 @@ index 99ccea6..4f6c903 100644 } -- -2.49.0 +2.51.1 diff --git a/0121-pccsadmin-make-keyring-module-optional.patch b/0121-pccsadmin-make-keyring-module-optional.patch new file mode 100644 index 0000000..a8c91ee --- /dev/null +++ b/0121-pccsadmin-make-keyring-module-optional.patch @@ -0,0 +1,104 @@ +From eadb596271a2e99578c5e4088058dceccdb24420 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= +Date: Thu, 4 Dec 2025 13:31:54 +0000 +Subject: [PATCH 121/123] pccsadmin: make 'keyring' module optional +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This is not available in some distros, and since it is merely a +convenience to avoid repeated password entry, it can be made +optional. + +Signed-off-by: Daniel P. Berrangé +--- + .../PccsAdminTool/lib/intelsgx/credential.py | 53 +++++++++++-------- + 1 file changed, 30 insertions(+), 23 deletions(-) + +diff --git a/tools/PccsAdminTool/lib/intelsgx/credential.py b/tools/PccsAdminTool/lib/intelsgx/credential.py +index 638cd88..cebecad 100644 +--- a/tools/PccsAdminTool/lib/intelsgx/credential.py ++++ b/tools/PccsAdminTool/lib/intelsgx/credential.py +@@ -1,4 +1,7 @@ +-import keyring ++try: ++ import keyring ++except: ++ keyring = None + import getpass + + class Credentials: +@@ -8,11 +11,12 @@ class Credentials: + + def get_admin_token(self): + admin_token = "" +- try: +- print("Please note: A prompt may appear asking for your keyring password to access stored credentials.") +- admin_token = keyring.get_password(self.APPNAME, self.KEY_ADMINTOKEN) +- except keyring.errors.KeyringError as ke: +- admin_token = "" ++ if keyring is not None: ++ try: ++ print("Please note: A prompt may appear asking for your keyring password to access stored credentials.") ++ admin_token = keyring.get_password(self.APPNAME, self.KEY_ADMINTOKEN) ++ except keyring.errors.KeyringError as ke: ++ admin_token = "" + + while admin_token is None or admin_token == '': + admin_token = getpass.getpass(prompt="Please input your administrator password for PCCS service:") +@@ -25,21 +29,23 @@ class Credentials: + return admin_token + + def set_admin_token(self, token): +- try: +- print("Please note: A prompt may appear asking for your keyring password to access stored credentials.") +- keyring.set_password(self.APPNAME, self.KEY_ADMINTOKEN, token) +- except keyring.errors.PasswordSetError as ke: +- print("Failed to store admin token.") +- return False ++ if keyring is not None: ++ try: ++ print("Please note: A prompt may appear asking for your keyring password to access stored credentials.") ++ keyring.set_password(self.APPNAME, self.KEY_ADMINTOKEN, token) ++ except keyring.errors.PasswordSetError as ke: ++ print("Failed to store admin token.") ++ return False + return True + + def get_pcs_api_key(self): + pcs_api_key = "" +- try: +- print("Please note: A prompt may appear asking for your keyring password to access stored credentials.") +- pcs_api_key = keyring.get_password(self.APPNAME, self.KEY_PCS_APIKEY) +- except keyring.errors.KeyringError as ke: +- pcs_api_key = "" ++ if keyring is not None: ++ try: ++ print("Please note: A prompt may appear asking for your keyring password to access stored credentials.") ++ pcs_api_key = keyring.get_password(self.APPNAME, self.KEY_PCS_APIKEY) ++ except keyring.errors.KeyringError as ke: ++ pcs_api_key = "" + + while pcs_api_key is None or pcs_api_key == '': + pcs_api_key = getpass.getpass(prompt="Please input ApiKey for Intel PCS:") +@@ -52,10 +58,11 @@ class Credentials: + return pcs_api_key + + def set_pcs_api_key(self, apikey): +- try: +- print("Please note: A prompt may appear asking for your keyring password to access stored credentials.") +- keyring.set_password(self.APPNAME, self.KEY_PCS_APIKEY, apikey) +- except keyring.errors.PasswordSetError as ke: +- print("Failed to store PCS API key.") +- return False ++ if keyring is not None: ++ try: ++ print("Please note: A prompt may appear asking for your keyring password to access stored credentials.") ++ keyring.set_password(self.APPNAME, self.KEY_PCS_APIKEY, apikey) ++ except keyring.errors.PasswordSetError as ke: ++ print("Failed to store PCS API key.") ++ return False + return True +-- +2.51.1 + diff --git a/0122-pccsadmin-convert-from-asn1-to-pyasn1-python-module.patch b/0122-pccsadmin-convert-from-asn1-to-pyasn1-python-module.patch new file mode 100644 index 0000000..5b7492d --- /dev/null +++ b/0122-pccsadmin-convert-from-asn1-to-pyasn1-python-module.patch @@ -0,0 +1,341 @@ +From edf194f2d523fe765cb7534b020c85158d278d74 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= +Date: Thu, 4 Dec 2025 13:54:19 +0000 +Subject: [PATCH 122/123] pccsadmin: convert from asn1 to pyasn1 python module +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The pyasn1 module decodes using a formal object model so is more robust, +as well as being more widely available in distros. + +Signed-off-by: Daniel P. Berrangé +--- + tools/PccsAdminTool/lib/intelsgx/pckcert.py | 267 +++++++++++++------- + 1 file changed, 177 insertions(+), 90 deletions(-) + +diff --git a/tools/PccsAdminTool/lib/intelsgx/pckcert.py b/tools/PccsAdminTool/lib/intelsgx/pckcert.py +index 97aa278..eaed331 100644 +--- a/tools/PccsAdminTool/lib/intelsgx/pckcert.py ++++ b/tools/PccsAdminTool/lib/intelsgx/pckcert.py +@@ -1,76 +1,171 @@ + from cryptography import x509 + from cryptography.x509.oid import ObjectIdentifier + from cryptography.hazmat.backends import default_backend +-import asn1 +-import struct ++import pyasn1 ++from pyasn1.codec.der.decoder import decode as der_decoder ++from pyasn1.type import namedtype ++from pyasn1.type import namedval ++from pyasn1.type import opentype ++from pyasn1.type import univ ++ ++ ++id_cdp_extensionStr = '2.5.29.31' ++id_ce_sGXExtensionsStr = '1.2.840.113741.1.13.1' ++ ++id_ce_sGXExtensions = univ.ObjectIdentifier(id_ce_sGXExtensionsStr) ++ ++id_ce_sGXExtensions_pPID = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".1") ++id_ce_sGXExtensions_tCB = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".2") ++id_ce_sGXExtensions_pCE_ID = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".3") ++id_ce_sGXExtensions_fMSPC = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".4") ++id_ce_sGXExtensions_sGXType = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".5") ++id_ce_sGXExtensions_platformInstanceID = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".6") ++id_ce_sGXExtensions_configuration = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".7") ++ ++id_ce_tCB_sGXTCBComp01SVN = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".2.1") ++id_ce_tCB_sGXTCBComp02SVN = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".2.2") ++id_ce_tCB_sGXTCBComp03SVN = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".2.3") ++id_ce_tCB_sGXTCBComp04SVN = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".2.4") ++id_ce_tCB_sGXTCBComp05SVN = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".2.5") ++id_ce_tCB_sGXTCBComp06SVN = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".2.6") ++id_ce_tCB_sGXTCBComp07SVN = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".2.7") ++id_ce_tCB_sGXTCBComp08SVN = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".2.8") ++id_ce_tCB_sGXTCBComp09SVN = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".2.9") ++id_ce_tCB_sGXTCBComp10SVN = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".2.10") ++id_ce_tCB_sGXTCBComp11SVN = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".2.11") ++id_ce_tCB_sGXTCBComp12SVN = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".2.12") ++id_ce_tCB_sGXTCBComp13SVN = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".2.13") ++id_ce_tCB_sGXTCBComp14SVN = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".2.14") ++id_ce_tCB_sGXTCBComp15SVN = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".2.15") ++id_ce_tCB_sGXTCBComp16SVN = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".2.16") ++id_ce_tCB_pCESVN = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".2.17") ++id_ce_tCB_cPUSVN = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".2.18") ++ ++id_ce_configuration_dynamicPlatform = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".7.1") ++id_ce_configuration_cachedKeys = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".7.2") ++id_ce_configuration_sMTEnabled = univ.ObjectIdentifier(id_ce_sGXExtensionsStr + ".7.3") ++ ++ ++class SgxExtensionPPID(univ.OctetString): ++ pass ++ ++ ++class SgxCPUSVN(univ.OctetString): ++ pass ++ ++ ++tcbAttributeMap = { ++ id_ce_tCB_sGXTCBComp01SVN: univ.Integer(), ++ id_ce_tCB_sGXTCBComp02SVN: univ.Integer(), ++ id_ce_tCB_sGXTCBComp03SVN: univ.Integer(), ++ id_ce_tCB_sGXTCBComp04SVN: univ.Integer(), ++ id_ce_tCB_sGXTCBComp05SVN: univ.Integer(), ++ id_ce_tCB_sGXTCBComp06SVN: univ.Integer(), ++ id_ce_tCB_sGXTCBComp07SVN: univ.Integer(), ++ id_ce_tCB_sGXTCBComp08SVN: univ.Integer(), ++ id_ce_tCB_sGXTCBComp09SVN: univ.Integer(), ++ id_ce_tCB_sGXTCBComp10SVN: univ.Integer(), ++ id_ce_tCB_sGXTCBComp11SVN: univ.Integer(), ++ id_ce_tCB_sGXTCBComp12SVN: univ.Integer(), ++ id_ce_tCB_sGXTCBComp13SVN: univ.Integer(), ++ id_ce_tCB_sGXTCBComp14SVN: univ.Integer(), ++ id_ce_tCB_sGXTCBComp15SVN: univ.Integer(), ++ id_ce_tCB_sGXTCBComp16SVN: univ.Integer(), ++ id_ce_tCB_pCESVN: univ.Integer(), ++ id_ce_tCB_cPUSVN: SgxCPUSVN(), ++} ++ ++ ++class SgxExtensionTCBEntry(univ.Sequence): ++ componentType = namedtype.NamedTypes( ++ namedtype.NamedType('tCBId', univ.ObjectIdentifier()), ++ namedtype.NamedType('tCBValue', univ.Any(), ++ openType=opentype.OpenType('tCBId', ++ tcbAttributeMap)) ++ ) ++ ++ ++class SgxExtensionTCB(univ.SequenceOf): ++ componentType = SgxExtensionTCBEntry() ++ ++ ++class SgxExtensionPCEID(univ.OctetString): ++ pass ++ ++ ++class SgxExtensionFMSPC(univ.OctetString): ++ pass ++ ++ ++class SgxExtensionSGXType(univ.Enumerated): ++ namedValues = namedval.NamedValues( ++ ('standard', 0), ++ ('scalable', 1), ++ ('scalableWithIntegrity', 2) ++ ) ++ ++ ++class SgxExtensionPlatformInstanceID(univ.OctetString): ++ pass ++ ++ ++configurationAttributeMap = { ++ id_ce_configuration_dynamicPlatform: univ.Boolean(), ++ id_ce_configuration_cachedKeys: univ.Boolean(), ++ id_ce_configuration_sMTEnabled: univ.Boolean(), ++} ++ ++ ++class SgxExtensionConfigurationEntry(univ.Sequence): ++ componentType = namedtype.NamedTypes( ++ namedtype.NamedType('configurationId', univ.ObjectIdentifier()), ++ namedtype.NamedType('configurationValue', univ.Any(), ++ openType=opentype.OpenType('configurationId', ++ configurationAttributeMap)) ++ ) ++ ++ ++class SgxExtensionConfiguration(univ.SequenceOf): ++ componentType = SgxExtensionConfigurationEntry() ++ ++ ++extensionAttributeMap = { ++ id_ce_sGXExtensions_pPID: SgxExtensionPPID(), ++ id_ce_sGXExtensions_tCB: SgxExtensionTCB(), ++ id_ce_sGXExtensions_pCE_ID: SgxExtensionPCEID(), ++ id_ce_sGXExtensions_fMSPC: SgxExtensionFMSPC(), ++ id_ce_sGXExtensions_sGXType: SgxExtensionSGXType(), ++ id_ce_sGXExtensions_platformInstanceID: SgxExtensionPlatformInstanceID(), ++ id_ce_sGXExtensions_configuration: SgxExtensionConfiguration(), ++} ++ ++ ++class SgxExtensionEntry(univ.Sequence): ++ componentType = namedtype.NamedTypes( ++ namedtype.NamedType('sGXExtensionId', univ.ObjectIdentifier()), ++ namedtype.NamedType('sGXExtensionValue', univ.Any(), ++ openType=opentype.OpenType('sGXExtensionId', ++ extensionAttributeMap)) ++ ) ++ ++ ++class SgxExtension(univ.SequenceOf): ++ componentType = SgxExtensionEntry() + +-# This is a very simplistic ASN1 parser. Production code should use +-# something like ans1c to build a parser from the ASN1 spec file so +-# that it can check and enforce data validity. + + class SgxPckCertificateExtensions: +- id_ce_sGXExtensions = '1.2.840.113741.1.13.1' +- id_ce_sGXExtensions_tCB= id_ce_sGXExtensions+".2" +- id_ce_sGXExtensions_configuration= id_ce_sGXExtensions+".7" +- id_cdp_extension = '2.5.29.31' +- decoder= asn1.Decoder() +- _data= {} +- ca= '' +- oids= { +- id_ce_sGXExtensions: 'sGXExtensions', +- id_ce_sGXExtensions+".1": 'pPID', +- id_ce_sGXExtensions_tCB: 'tCB', +- id_ce_sGXExtensions_tCB+".1": 'tCB-sGXTCBComp01SVN', +- id_ce_sGXExtensions_tCB+".2": 'tCB-sGXTCBComp02SVN', +- id_ce_sGXExtensions_tCB+".3": 'tCB-sGXTCBComp03SVN', +- id_ce_sGXExtensions_tCB+".4": 'tCB-sGXTCBComp04SVN', +- id_ce_sGXExtensions_tCB+".5": 'tCB-sGXTCBComp05SVN', +- id_ce_sGXExtensions_tCB+".6": 'tCB-sGXTCBComp06SVN', +- id_ce_sGXExtensions_tCB+".7": 'tCB-sGXTCBComp07SVN', +- id_ce_sGXExtensions_tCB+".8": 'tCB-sGXTCBComp08SVN', +- id_ce_sGXExtensions_tCB+".9": 'tCB-sGXTCBComp09SVN', +- id_ce_sGXExtensions_tCB+".10": 'tCB-sGXTCBComp10SVN', +- id_ce_sGXExtensions_tCB+".11": 'tCB-sGXTCBComp11SVN', +- id_ce_sGXExtensions_tCB+".12": 'tCB-sGXTCBComp12SVN', +- id_ce_sGXExtensions_tCB+".13": 'tCB-sGXTCBComp13SVN', +- id_ce_sGXExtensions_tCB+".14": 'tCB-sGXTCBComp14SVN', +- id_ce_sGXExtensions_tCB+".15": 'tCB-sGXTCBComp15SVN', +- id_ce_sGXExtensions_tCB+".16": 'tCB-sGXTCBComp16SVN', +- id_ce_sGXExtensions_tCB+".17": 'tCB-pCESVN', +- id_ce_sGXExtensions_tCB+".18": 'tCB-cPUSVN', +- id_ce_sGXExtensions+".3": 'pCE-ID', +- id_ce_sGXExtensions+".4": 'fMSPC', +- id_ce_sGXExtensions+".5": 'sGXType', +- id_ce_sGXExtensions+".6": 'platformInstanceID', +- id_ce_sGXExtensions_configuration: 'configuration', +- id_ce_sGXExtensions_configuration+".1": 'dynamicPlatform', +- id_ce_sGXExtensions_configuration+".2": 'cachedKeys', +- id_ce_sGXExtensions_configuration+".3": 'sMTEnabled' +- } +- +- def _parse_asn1(self, d, oid, lnr=asn1.Numbers.ObjectIdentifier): +- tag= self.decoder.peek() +- while tag: +- if tag.typ == asn1.Types.Constructed: +- self.decoder.enter() +- if ( lnr == asn1.Numbers.ObjectIdentifier ): +- d[self.oids[oid]]= {} +- self._parse_asn1(d[self.oids[oid]], oid, tag.nr) +- else: +- self._parse_asn1(d, oid, tag.nr) +- self.decoder.leave() +- elif tag.typ == asn1.Types.Primitive: +- tag, value= self.decoder.read() +- if ( tag.nr == asn1.Numbers.ObjectIdentifier ): +- oid= value +- else: +- d[self.oids[oid]]= value +- lnr= tag.nr +- tag= self.decoder.peek() +- return ++ ++ def __init__(self): ++ self.ca= '' ++ self._data= None ++ ++ def _parse_asn1(self, extensionData): ++ parsed, extra= der_decoder(extensionData, ++ asn1Spec=SgxExtension(), ++ decodeOpenTypes=True) ++ return parsed + + def parse_pem_certificate(self, pem): +- self._data= {} + cert= x509.load_pem_x509_certificate(pem, default_backend()) + issuerCN = cert.issuer.rfc4514_string() + if (issuerCN.find('Processor') != -1) : +@@ -81,63 +176,55 @@ class SgxPckCertificateExtensions: + self.ca = None + + sgxext= cert.extensions.get_extension_for_oid( +- ObjectIdentifier(self.id_ce_sGXExtensions) ++ ObjectIdentifier(id_ce_sGXExtensionsStr) + ) + +- self.decoder.start(sgxext.value.value) +- self._parse_asn1(self._data, self.id_ce_sGXExtensions) ++ self._data= self._parse_asn1(sgxext.value.value) + + def get_root_ca_crl(self, pem): +- self._data= {} + cert= x509.load_pem_x509_certificate(pem, default_backend()) + cdpext= cert.extensions.get_extension_for_oid( +- ObjectIdentifier(self.id_cdp_extension) ++ ObjectIdentifier(id_cdp_extensionStr) + ) + + return getattr(getattr(cdpext.value[0], "_full_name")[0], "value") + +- def data(self, field=None): +- if 'sGXExtensions' not in self._data: +- return None +- +- d= self._data['sGXExtensions'] +- +- if field: +- if field in d: +- return d[field] ++ def data(self, field): ++ if self._data is None: + return None + +- return d ++ ent = list(filter(lambda e: e['sGXExtensionId'] == field, self._data))[0] ++ return ent['sGXExtensionValue'] + + def _hex_data(self, field): + val= self.data(field) + if val is None: + return None +- return val.hex() ++ return bytes(val).hex() + + # Commonly-needed data fields + #------------------------------ + + def get_fmspc(self): +- return self._hex_data('fMSPC') ++ return self._hex_data(id_ce_sGXExtensions_fMSPC) + + def get_ca(self): + return self.ca + + def get_tcbm(self): +- tcb= self.data('tCB') ++ tcb= self.data(id_ce_sGXExtensions_tCB) + if tcb is None: + return None +- return tcb['tCB-cPUSVN'].hex() + self.get_pcesvn() ++ ent= list(filter(lambda e: e['tCBId'] == id_ce_tCB_cPUSVN, tcb))[0] ++ return bytes(ent["tCBValue"]).hex() + self.get_pcesvn() + + def get_pceid(self): +- return self._hex_data('pCE-ID') ++ return self._hex_data(id_ce_sGXExtensions_pCE_ID) + + def get_ppid(self): +- return self._hex_data('pPID') ++ return self._hex_data(id_ce_sGXExtensions_pPID) + + def get_pcesvn(self): +- tcb= self.data('tCB') +- # pCESVN should be packed little-endian +- pcesvn= struct.pack(' +Date: Wed, 3 Dec 2025 17:59:09 +0000 +Subject: [PATCH 123/123] pccsadmin: fully port to pycryptography +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +pyOpenSSL 24.3.0 removed many APIs informing users to switch to the +pycryptography APIs, and as a result pccsadmin is broken on modern +Linux distros. + +The pycryptography APIs were already used for a few operations, so +switch the remainder of the file away from pyOpenSSL APIs. + +The caveat is that pycryptography only introduced certificate +verification APIs in 42.0.0, which is newer than what's available +in RHEL-9. Detect this and fallback to creating tempfiles and +calling openssl via its command line 'verify' function, to avoid +a needless dep on pyOpenSSL for this single function. + +Signed-off-by: Daniel P. Berrangé +--- + tools/PccsAdminTool/lib/intelsgx/pcs.py | 108 ++++++++++++++---------- + 1 file changed, 64 insertions(+), 44 deletions(-) + +diff --git a/tools/PccsAdminTool/lib/intelsgx/pcs.py b/tools/PccsAdminTool/lib/intelsgx/pcs.py +index 046c781..cfcc809 100644 +--- a/tools/PccsAdminTool/lib/intelsgx/pcs.py ++++ b/tools/PccsAdminTool/lib/intelsgx/pcs.py +@@ -3,8 +3,19 @@ import urllib3 + import requests + import json + import binascii ++import tempfile ++import subprocess + from urllib import parse +-from OpenSSL import crypto ++from cryptography import x509 ++try: ++ # Only available from >= 42.0.0 ++ from cryptography.x509 import verification ++except ImportError: ++ # Fallback to invoking 'openssl verify' command line ++ verification = None ++from cryptography.exceptions import InvalidSignature ++from cryptography.hazmat.primitives import hashes, serialization ++from cryptography.hazmat.primitives.asymmetric import ec + from platform import system + if system() == 'Windows': + from pypac import PACSession +@@ -89,23 +100,10 @@ class PCS: + # Certificate verification + #---------------------------------------------------------------------------- + +- def init_cert_store(self, pychain): +- store= crypto.X509Store() +- +- for tcert in pychain: +- store.add_cert(tcert) +- +- return store +- + def verify_crl_trust(self, pychain_in, pycrl): + # Copy our list so we don't modify the original + pychain= pychain_in[:] + +- # PyOpenSSL doesn't have methods for verifying a CRL issuer, +- # so we need to translate from it to cryptography. +- +- crl= pycrl.to_cryptography() +- + # The chain_pem is our CRL issuer and the CA for the issuer. + # Verify that first. + +@@ -116,31 +114,54 @@ class PCS: + + # Now verify the CRL signature + +- signer_key= pycert.get_pubkey().to_cryptography_key() ++ signer_key= pycert.public_key() + +- if not crl.is_signature_valid(signer_key): ++ if not pycrl.is_signature_valid(signer_key): + self.error("Could not verify CRL signature") + return False + + # Check the crl issuer + +- if pycrl.get_issuer() != pycert.get_subject(): ++ if pycrl.issuer != pycert.subject: + self.error("CRL issuer doesn't match issuer chain") + return False + + return True + + def verify_cert_trust(self, pychain, pycerts): +- store= self.init_cert_store(pychain) +- +- for pycert in pycerts: +- store_ctx= crypto.X509StoreContext(store, pycert) +- try: +- store_ctx.verify_certificate() +- except crypto.X509StoreContextError as e: +- # Printing or logging the error details +- print(e) +- return False ++ if verification is not None: ++ store = verification.Store(pychain) ++ ++ builder = verification.PolicyBuilder().store(store) ++ builder = builder.extension_policies( ++ ee_policy=verification.ExtensionPolicy.permit_all(), ++ ca_policy=verification.ExtensionPolicy.webpki_defaults_ca()) ++ ++ verifier = builder.build_client_verifier() ++ for pycert in pycerts: ++ try: ++ verifier.verify(pycert,[]) ++ except verification.VerificationError as e: ++ # Printing or logging the error details ++ print(e) ++ return False ++ else: ++ with tempfile.NamedTemporaryFile("wb") as chainfile: ++ for cert in pychain: ++ chainfile.write(cert.public_bytes(serialization.Encoding.PEM)) ++ chainfile.flush() ++ ++ for cert in pycerts: ++ with tempfile.NamedTemporaryFile("wb") as certfile: ++ certfile.write(cert.public_bytes(serialization.Encoding.PEM)) ++ certfile.flush() ++ ++ try: ++ subprocess.check_call(["openssl", "verify", ++ "-CAfile", chainfile.name, certfile.name], ++ stdout=subprocess.DEVNULL) ++ except subprocess.CalledProcessError as e: ++ return False + + return True + +@@ -166,22 +187,21 @@ class PCS: + sig= bytes([0x30,len(r)+len(s)+4,2,len(r)]) + r + bytes([2,len(s)]) + s + + try: +- crypto.verify(pycert, sig, msg, "sha256") +- except crypto.Error as e: ++ pycert.public_key().verify( ++ sig, msg, ec.ECDSA(hashes.SHA256())) ++ except InvalidSignature as e: + self.error('Signature verification failed: {:s}'.format(str(e))) + return False + + return True + + def pem_to_pycert(self, cert_pem): +- return crypto.load_certificate(crypto.FILETYPE_PEM, cert_pem) ++ return x509.load_pem_x509_certificate(cert_pem.encode("utf-8")) + + def pems_to_pycerts(self, certs_pem): + pycerts= [] + for cert_pem in certs_pem: +- pycerts.append( +- crypto.load_certificate(crypto.FILETYPE_PEM, cert_pem) +- ) ++ pycerts.append(self.pem_to_pycert(cert_pem)) + return pycerts + + def parse_chain_pem(self, chain_pem): +@@ -214,9 +234,9 @@ class PCS: + cert0= chain_in[0] + cert1= chain_in[1] + +- if cert0.get_subject() == cert1.get_issuer(): ++ if cert0.subject == cert1.issuer: + return chain_in +- elif cert1.get_subject() == cert0.get_issuer(): ++ elif cert1.subject == cert0.issuer: + chain_in.reverse() + return chain_in + else: +@@ -229,7 +249,7 @@ class PCS: + for i in range(1, len(chain_in)): + cert= chain_in[i] + pcert= chain_in[i-1] +- if cert.get_issuer() != pcert.get_subject(): ++ if cert.issuer != pcert.subject: + sorted= False + break + +@@ -245,8 +265,8 @@ class PCS: + rootidx= -1 + for i in range(0, len(chain)): + cert= chain[i] +- subject= cert.get_subject() +- issuer= cert.get_issuer() ++ subject= cert.subject ++ issuer= cert.issuer + cert_subjects[subject.CN]= cert + print("cert: {:s} <- {:s}" . format(subject.CN, issuer.CN)) + +@@ -267,8 +287,8 @@ class PCS: + issuer_to= {} + + for cert in chain: +- issuer= cert.get_issuer().CN +- subject= cert.get_subject().CN ++ issuer= cert.issuer.CN ++ subject= cert.subject.CN + + if issuer in issued_by: + self.error('multiple certs issued by same cert in chain') +@@ -285,7 +305,7 @@ class PCS: + + if len(sorted_chain) > 0: + for cert in chain: +- issuer= cert.get_issuer().CN ++ issuer= cert.issuer.CN + if issuer not in issued_by: + if len(sorted_chain) > 0: + self.error('multiple certs with no issuer') +@@ -301,7 +321,7 @@ class PCS: + cert= sorted_chain[0] + + while len(sorted_chain) < lchain: +- issuer_subject= cert.get_subject().der() ++ issuer_subject= cert.subject.CN + + if issuer_subject not in issuer_to: + self.error('cert in chain with no issuer') +@@ -516,10 +536,10 @@ class PCS: + crl= response.content + if self.ApiVersion<3: + crl_str= str(crl, dec) +- pycrl= crypto.load_crl(crypto.FILETYPE_PEM, crl) ++ pycrl= x509.load_pem_x509_crl(crl) + else: + crl_str= binascii.hexlify(crl).decode(dec) +- pycrl= crypto.load_crl(crypto.FILETYPE_ASN1, crl) ++ pycrl= x509.load_der_x509_crl(crl) + + if not self.verify_crl_trust(pychain, pycrl): + self.error("Could not validate certificate using trust chain") +-- +2.51.1 + diff --git a/linux-sgx.spec b/linux-sgx.spec index bd944fb..2b16db8 100644 --- a/linux-sgx.spec +++ b/linux-sgx.spec @@ -350,7 +350,7 @@ Patch0102: 0102-Support-build-time-setting-of-enclave-load-directory.patch # https://github.com/intel/SGXDataCenterAttestationPrimitives/pull/434 Patch0103: 0103-Look-for-versioned-sgx_urts-library-in-PCKRetrievalT.patch # https://github.com/intel/SGXDataCenterAttestationPrimitives/pull/429 -Patch0104: 0104-Don-t-import-pypac-in-pccsadmin.patch +Patch0104: 0104-pccsadmin-only-import-pypac-module-on-Windows.patch Patch0105: 0105-Look-for-PCKRetrievalTool-config-file-in-etc.patch Patch0106: 0106-Honour-CFLAGS-CXXFLAGS-LDFLAGS-for-various-tools-and.patch # https://github.com/intel/SGXDataCenterAttestationPrimitives/pull/428 @@ -368,6 +368,9 @@ Patch0117: 0117-qgs-add-m-MODE-parameter-for-UNIX-socket-mode.patch Patch0118: 0118-Switch-default-PCCS-port-number-from-8081-to-10801.patch Patch0119: 0119-Sanitize-paths-to-all-resources-in-PCCS-server.patch Patch0120: 0120-pccs-only-pass-ApiKey-if-it-is-set.patch +Patch0121: 0121-pccsadmin-make-keyring-module-optional.patch +Patch0122: 0122-pccsadmin-convert-from-asn1-to-pyasn1-python-module.patch +Patch0123: 0123-pccsadmin-fully-port-to-pycryptography.patch # 0200-0299 -> against intel-sgx-ssl.git Patch0200: 0200-Enable-pointing-sgxssl-build-to-alternative-glibc-he.patch @@ -524,12 +527,14 @@ SGX Provisioning Certificate Caching Service %package -n sgx-pccs-admin Summary: SGX Provisioning Certificate Caching Service Admin Tool -Requires: python3-asn1 -Requires: python3-pyOpenSSL +Requires: python3-pyasn1 Requires: python3-cryptography +%if 0%{?fedora} Requires: python3-keyring +%endif Requires: python3-requests Requires: python3-urllib3 +Requires: python3-setuptools Requires: sgx-libs = %{version}-%{release} # pccs admin tool can be used against a remote pccs # so don't force a hard dep From 68827ae2eff876e12fdc683d371cea826604de4f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 4 Dec 2025 15:43:27 +0000 Subject: [PATCH 15/25] Drop sgx-mpa dep from sgx-pccs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit While pccs can be run node-local, a typical deployment would have pccs on the LAN to cache certs across many hosts. As such a dep on sgx-mpa is inappropriate, and tdx-qgs already has a weak dep for this. Signed-off-by: Daniel P. Berrangé --- linux-sgx.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/linux-sgx.spec b/linux-sgx.spec index 2b16db8..df9e102 100644 --- a/linux-sgx.spec +++ b/linux-sgx.spec @@ -519,7 +519,6 @@ This package contains the Architectural Enclave Service Manager %package -n sgx-pccs Summary: SGX Provisioning Certificate Caching Service Requires: nodejs -Requires: sgx-mpa = %{version}-%{release} %description -n sgx-pccs SGX Provisioning Certificate Caching Service From 6615983b8357e8745f1e693a83a045f80194a045 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 4 Dec 2025 18:09:23 +0000 Subject: [PATCH 16/25] Fix traceback when clearing keyring if none exists MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Daniel P. Berrangé --- ...rop-use-of-bundled-pre-built-openssl.patch | 2 +- ...mprove-debuggability-of-build-system.patch | 2 +- ...me-setting-of-enclave-load-directory.patch | 2 +- ...ed-sgx_urts-library-in-PCKRetrievalT.patch | 2 +- ...-only-import-pypac-module-on-Windows.patch | 2 +- ...-PCKRetrievalTool-config-file-in-etc.patch | 2 +- ...XFLAGS-LDFLAGS-for-various-tools-and.patch | 2 +- ...tween-program-name-first-arg-in-usag.patch | 2 +- ...nst-format-strings-in-QL-log-message.patch | 2 +- ...d-debug-parameter-to-control-logging.patch | 2 +- ...-leftover-debugging-print-args-state.patch | 2 +- ...sion-for-libsgx_qe3_logic.so-library.patch | 2 +- 0112-Workaround-broken-GCC-15.patch | 2 +- ...-Don-t-disable-cf-protection-for-qgs.patch | 2 +- ...ecks-for-GCC-version-that-break-fsta.patch | 2 +- ...se-distro-provided-rapidjson-package.patch | 2 +- 0116-Don-t-stomp-on-VERBOSE-variable.patch | 2 +- ...-MODE-parameter-for-UNIX-socket-mode.patch | 2 +- ...-PCCS-port-number-from-8081-to-10801.patch | 2 +- ...aths-to-all-resources-in-PCCS-server.patch | 2 +- 0120-pccs-only-pass-ApiKey-if-it-is-set.patch | 2 +- ...csadmin-make-keyring-module-optional.patch | 2 +- ...rt-from-asn1-to-pyasn1-python-module.patch | 2 +- ...csadmin-fully-port-to-pycryptography.patch | 2 +- ...e-errors-trying-to-clear-the-keyring.patch | 55 +++++++++++++++++++ linux-sgx.spec | 1 + 26 files changed, 80 insertions(+), 24 deletions(-) create mode 100644 0124-pccsadmin-ignore-errors-trying-to-clear-the-keyring.patch diff --git a/0100-Drop-use-of-bundled-pre-built-openssl.patch b/0100-Drop-use-of-bundled-pre-built-openssl.patch index 337429b..6007ee2 100644 --- a/0100-Drop-use-of-bundled-pre-built-openssl.patch +++ b/0100-Drop-use-of-bundled-pre-built-openssl.patch @@ -1,7 +1,7 @@ From 9746d1048b23a3431d898f2375a8d849127ebde7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Mon, 26 Feb 2024 12:19:51 +0000 -Subject: [PATCH 100/123] Drop use of bundled pre-built openssl +Subject: [PATCH 100/124] Drop use of bundled pre-built openssl MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0101-Improve-debuggability-of-build-system.patch b/0101-Improve-debuggability-of-build-system.patch index b2af464..96c1f53 100644 --- a/0101-Improve-debuggability-of-build-system.patch +++ b/0101-Improve-debuggability-of-build-system.patch @@ -1,7 +1,7 @@ From 50bbd267076608a9b0a3b5e23bcbc8bfadfb09d7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 1 Mar 2024 12:05:01 +0000 -Subject: [PATCH 101/123] Improve debuggability of build system +Subject: [PATCH 101/124] Improve debuggability of build system MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0102-Support-build-time-setting-of-enclave-load-directory.patch b/0102-Support-build-time-setting-of-enclave-load-directory.patch index 1fe0379..d586a96 100644 --- a/0102-Support-build-time-setting-of-enclave-load-directory.patch +++ b/0102-Support-build-time-setting-of-enclave-load-directory.patch @@ -1,7 +1,7 @@ From 2f0e63c015f83aa2248b8afa04c1928b6aa8b0fb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Mon, 26 Feb 2024 12:19:51 +0000 -Subject: [PATCH 102/123] Support build time setting of enclave load directory +Subject: [PATCH 102/124] Support build time setting of enclave load directory MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0103-Look-for-versioned-sgx_urts-library-in-PCKRetrievalT.patch b/0103-Look-for-versioned-sgx_urts-library-in-PCKRetrievalT.patch index fc6320e..7ca4149 100644 --- a/0103-Look-for-versioned-sgx_urts-library-in-PCKRetrievalT.patch +++ b/0103-Look-for-versioned-sgx_urts-library-in-PCKRetrievalT.patch @@ -1,7 +1,7 @@ From 5fddd2225147e4372a6ff09350bdd495c3fdd4f8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Tue, 27 Feb 2024 15:46:41 +0000 -Subject: [PATCH 103/123] Look for versioned sgx_urts library in +Subject: [PATCH 103/124] Look for versioned sgx_urts library in PCKRetrievalTool MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 diff --git a/0104-pccsadmin-only-import-pypac-module-on-Windows.patch b/0104-pccsadmin-only-import-pypac-module-on-Windows.patch index 062a15d..58eed44 100644 --- a/0104-pccsadmin-only-import-pypac-module-on-Windows.patch +++ b/0104-pccsadmin-only-import-pypac-module-on-Windows.patch @@ -1,7 +1,7 @@ From 728aaf92031a6691265f6ad98df3b18183049d26 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 4 Oct 2024 17:41:37 +0100 -Subject: [PATCH 104/123] pccsadmin: only import 'pypac' module on Windows +Subject: [PATCH 104/124] pccsadmin: only import 'pypac' module on Windows MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0105-Look-for-PCKRetrievalTool-config-file-in-etc.patch b/0105-Look-for-PCKRetrievalTool-config-file-in-etc.patch index 9e50ac7..3b7e380 100644 --- a/0105-Look-for-PCKRetrievalTool-config-file-in-etc.patch +++ b/0105-Look-for-PCKRetrievalTool-config-file-in-etc.patch @@ -1,7 +1,7 @@ From 370fd9a5e6c06e47d394343aefe39610a60f4263 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 29 Feb 2024 14:21:36 +0000 -Subject: [PATCH 105/123] Look for PCKRetrievalTool config file in /etc/ +Subject: [PATCH 105/124] Look for PCKRetrievalTool config file in /etc/ MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0106-Honour-CFLAGS-CXXFLAGS-LDFLAGS-for-various-tools-and.patch b/0106-Honour-CFLAGS-CXXFLAGS-LDFLAGS-for-various-tools-and.patch index c4c76f7..320ed70 100644 --- a/0106-Honour-CFLAGS-CXXFLAGS-LDFLAGS-for-various-tools-and.patch +++ b/0106-Honour-CFLAGS-CXXFLAGS-LDFLAGS-for-various-tools-and.patch @@ -1,7 +1,7 @@ From 8cc9b7264cec48f7fb011b099e3c41080a9395aa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 28 Mar 2025 16:00:27 +0000 -Subject: [PATCH 106/123] Honour CFLAGS/CXXFLAGS/LDFLAGS for various tools and +Subject: [PATCH 106/124] Honour CFLAGS/CXXFLAGS/LDFLAGS for various tools and libraries MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 diff --git a/0107-qgs-add-space-between-program-name-first-arg-in-usag.patch b/0107-qgs-add-space-between-program-name-first-arg-in-usag.patch index 9274a0f..7246664 100644 --- a/0107-qgs-add-space-between-program-name-first-arg-in-usag.patch +++ b/0107-qgs-add-space-between-program-name-first-arg-in-usag.patch @@ -1,7 +1,7 @@ From 5ae9e5eef28ef318fc31adac5cfb19af1d45ad7a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 3 Oct 2024 14:42:29 +0100 -Subject: [PATCH 107/123] qgs: add space between program name & first arg in +Subject: [PATCH 107/124] qgs: add space between program name & first arg in usage MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 diff --git a/0108-qgs-protect-against-format-strings-in-QL-log-message.patch b/0108-qgs-protect-against-format-strings-in-QL-log-message.patch index 24d7ee5..050c416 100644 --- a/0108-qgs-protect-against-format-strings-in-QL-log-message.patch +++ b/0108-qgs-protect-against-format-strings-in-QL-log-message.patch @@ -1,7 +1,7 @@ From 6589bfa27e59d2331a69ddcef0ec1ac06a083704 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 4 Oct 2024 09:43:17 +0100 -Subject: [PATCH 108/123] qgs: protect against format strings in QL log +Subject: [PATCH 108/124] qgs: protect against format strings in QL log messages MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 diff --git a/0109-qgs-add-debug-parameter-to-control-logging.patch b/0109-qgs-add-debug-parameter-to-control-logging.patch index 0406fe2..63c593a 100644 --- a/0109-qgs-add-debug-parameter-to-control-logging.patch +++ b/0109-qgs-add-debug-parameter-to-control-logging.patch @@ -1,7 +1,7 @@ From d882234222791a8debfa04fbb284e00c36d69854 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 3 Oct 2024 16:57:35 +0100 -Subject: [PATCH 109/123] qgs: add --debug parameter to control logging +Subject: [PATCH 109/124] qgs: add --debug parameter to control logging MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0110-pccsadmin-remove-leftover-debugging-print-args-state.patch b/0110-pccsadmin-remove-leftover-debugging-print-args-state.patch index 0043f89..af17ab0 100644 --- a/0110-pccsadmin-remove-leftover-debugging-print-args-state.patch +++ b/0110-pccsadmin-remove-leftover-debugging-print-args-state.patch @@ -1,7 +1,7 @@ From 5adba978fa3d75cc1dbada716fb7423111d7f5b6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Tue, 8 Oct 2024 10:13:02 +0100 -Subject: [PATCH 110/123] pccsadmin: remove leftover debugging 'print(args)' +Subject: [PATCH 110/124] pccsadmin: remove leftover debugging 'print(args)' statement MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 diff --git a/0111-Fix-soname-version-for-libsgx_qe3_logic.so-library.patch b/0111-Fix-soname-version-for-libsgx_qe3_logic.so-library.patch index 8a94de7..6e4f3a0 100644 --- a/0111-Fix-soname-version-for-libsgx_qe3_logic.so-library.patch +++ b/0111-Fix-soname-version-for-libsgx_qe3_logic.so-library.patch @@ -1,7 +1,7 @@ From 88ea0b616e118e673ec4b6f2d14117daee260514 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 17 Jan 2025 15:39:39 +0000 -Subject: [PATCH 111/123] Fix soname version for libsgx_qe3_logic.so library +Subject: [PATCH 111/124] Fix soname version for libsgx_qe3_logic.so library MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0112-Workaround-broken-GCC-15.patch b/0112-Workaround-broken-GCC-15.patch index 00c6b16..4201f19 100644 --- a/0112-Workaround-broken-GCC-15.patch +++ b/0112-Workaround-broken-GCC-15.patch @@ -1,7 +1,7 @@ From c5dc85fdef5a558738b0b5b1125dfee612f3d812 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 6 Feb 2025 20:08:59 +0000 -Subject: [PATCH 112/123] Workaround broken GCC 15 +Subject: [PATCH 112/124] Workaround broken GCC 15 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0113-Don-t-disable-cf-protection-for-qgs.patch b/0113-Don-t-disable-cf-protection-for-qgs.patch index 5b3e506..446bba0 100644 --- a/0113-Don-t-disable-cf-protection-for-qgs.patch +++ b/0113-Don-t-disable-cf-protection-for-qgs.patch @@ -1,7 +1,7 @@ From a9e7f2a4ec859e8846089af81f541b6cc1d436b9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Wed, 2 Apr 2025 18:39:31 +0100 -Subject: [PATCH 113/123] Don't disable cf-protection for qgs +Subject: [PATCH 113/124] Don't disable cf-protection for qgs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0114-Delete-broken-checks-for-GCC-version-that-break-fsta.patch b/0114-Delete-broken-checks-for-GCC-version-that-break-fsta.patch index c3a6231..13c1039 100644 --- a/0114-Delete-broken-checks-for-GCC-version-that-break-fsta.patch +++ b/0114-Delete-broken-checks-for-GCC-version-that-break-fsta.patch @@ -1,7 +1,7 @@ From 58afc007ef674ad50027783642845f95f37ec198 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 3 Apr 2025 17:44:48 +0100 -Subject: [PATCH 114/123] Delete broken checks for GCC version that break +Subject: [PATCH 114/124] Delete broken checks for GCC version that break -fstack-protector-strong MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 diff --git a/0115-Use-distro-provided-rapidjson-package.patch b/0115-Use-distro-provided-rapidjson-package.patch index 40b4a16..c550286 100644 --- a/0115-Use-distro-provided-rapidjson-package.patch +++ b/0115-Use-distro-provided-rapidjson-package.patch @@ -1,7 +1,7 @@ From 082009b9e9fbbe715743104eafc182959b51dd22 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Mon, 26 Feb 2024 12:19:51 +0000 -Subject: [PATCH 115/123] Use distro provided rapidjson package +Subject: [PATCH 115/124] Use distro provided rapidjson package MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0116-Don-t-stomp-on-VERBOSE-variable.patch b/0116-Don-t-stomp-on-VERBOSE-variable.patch index 8ecd0c3..f68d622 100644 --- a/0116-Don-t-stomp-on-VERBOSE-variable.patch +++ b/0116-Don-t-stomp-on-VERBOSE-variable.patch @@ -1,7 +1,7 @@ From 569bd6150f38405efb1a27cd8827164560b431d6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Wed, 16 Apr 2025 11:48:52 +0100 -Subject: [PATCH 116/123] Don't stomp on "VERBOSE" variable +Subject: [PATCH 116/124] Don't stomp on "VERBOSE" variable MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0117-qgs-add-m-MODE-parameter-for-UNIX-socket-mode.patch b/0117-qgs-add-m-MODE-parameter-for-UNIX-socket-mode.patch index 7af593e..7230bc7 100644 --- a/0117-qgs-add-m-MODE-parameter-for-UNIX-socket-mode.patch +++ b/0117-qgs-add-m-MODE-parameter-for-UNIX-socket-mode.patch @@ -1,7 +1,7 @@ From 85f4916b578bb1a210c76f78a392d66efc2c704c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 2 May 2025 14:48:24 +0100 -Subject: [PATCH 117/123] qgs: add -m=MODE parameter for UNIX socket mode +Subject: [PATCH 117/124] qgs: add -m=MODE parameter for UNIX socket mode MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0118-Switch-default-PCCS-port-number-from-8081-to-10801.patch b/0118-Switch-default-PCCS-port-number-from-8081-to-10801.patch index a1577b2..92f4b4d 100644 --- a/0118-Switch-default-PCCS-port-number-from-8081-to-10801.patch +++ b/0118-Switch-default-PCCS-port-number-from-8081-to-10801.patch @@ -1,7 +1,7 @@ From b31c83c905094edee5c21240129467a31b7b11c4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Tue, 27 Feb 2024 15:46:41 +0000 -Subject: [PATCH 118/123] Switch default PCCS port number from 8081 to 10801 +Subject: [PATCH 118/124] Switch default PCCS port number from 8081 to 10801 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0119-Sanitize-paths-to-all-resources-in-PCCS-server.patch b/0119-Sanitize-paths-to-all-resources-in-PCCS-server.patch index c2b25a4..44522f4 100644 --- a/0119-Sanitize-paths-to-all-resources-in-PCCS-server.patch +++ b/0119-Sanitize-paths-to-all-resources-in-PCCS-server.patch @@ -1,7 +1,7 @@ From a74b9efa563f98c302e556ca098f9b25d3213987 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Tue, 27 Feb 2024 13:38:49 +0000 -Subject: [PATCH 119/123] Sanitize paths to all resources in PCCS server +Subject: [PATCH 119/124] Sanitize paths to all resources in PCCS server MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0120-pccs-only-pass-ApiKey-if-it-is-set.patch b/0120-pccs-only-pass-ApiKey-if-it-is-set.patch index d77a784..3045cf7 100644 --- a/0120-pccs-only-pass-ApiKey-if-it-is-set.patch +++ b/0120-pccs-only-pass-ApiKey-if-it-is-set.patch @@ -1,7 +1,7 @@ From 524c7d16514f1fe3a28816e9c2c4fcc838e55ad5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Wed, 9 Jul 2025 16:41:59 +0100 -Subject: [PATCH 120/123] pccs: only pass ApiKey if it is set +Subject: [PATCH 120/124] pccs: only pass ApiKey if it is set MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0121-pccsadmin-make-keyring-module-optional.patch b/0121-pccsadmin-make-keyring-module-optional.patch index a8c91ee..d928b70 100644 --- a/0121-pccsadmin-make-keyring-module-optional.patch +++ b/0121-pccsadmin-make-keyring-module-optional.patch @@ -1,7 +1,7 @@ From eadb596271a2e99578c5e4088058dceccdb24420 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 4 Dec 2025 13:31:54 +0000 -Subject: [PATCH 121/123] pccsadmin: make 'keyring' module optional +Subject: [PATCH 121/124] pccsadmin: make 'keyring' module optional MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0122-pccsadmin-convert-from-asn1-to-pyasn1-python-module.patch b/0122-pccsadmin-convert-from-asn1-to-pyasn1-python-module.patch index 5b7492d..1b97242 100644 --- a/0122-pccsadmin-convert-from-asn1-to-pyasn1-python-module.patch +++ b/0122-pccsadmin-convert-from-asn1-to-pyasn1-python-module.patch @@ -1,7 +1,7 @@ From edf194f2d523fe765cb7534b020c85158d278d74 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 4 Dec 2025 13:54:19 +0000 -Subject: [PATCH 122/123] pccsadmin: convert from asn1 to pyasn1 python module +Subject: [PATCH 122/124] pccsadmin: convert from asn1 to pyasn1 python module MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0123-pccsadmin-fully-port-to-pycryptography.patch b/0123-pccsadmin-fully-port-to-pycryptography.patch index 57d2b5f..ddaf902 100644 --- a/0123-pccsadmin-fully-port-to-pycryptography.patch +++ b/0123-pccsadmin-fully-port-to-pycryptography.patch @@ -1,7 +1,7 @@ From 957e710cdcf7eadc6b6e1cc2456b4f3a1b54272e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Wed, 3 Dec 2025 17:59:09 +0000 -Subject: [PATCH 123/123] pccsadmin: fully port to pycryptography +Subject: [PATCH 123/124] pccsadmin: fully port to pycryptography MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0124-pccsadmin-ignore-errors-trying-to-clear-the-keyring.patch b/0124-pccsadmin-ignore-errors-trying-to-clear-the-keyring.patch new file mode 100644 index 0000000..d019b72 --- /dev/null +++ b/0124-pccsadmin-ignore-errors-trying-to-clear-the-keyring.patch @@ -0,0 +1,55 @@ +From 4be74ca6cc6868bee375b7820412da7fe586c40b Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= +Date: Thu, 4 Dec 2025 18:05:14 +0000 +Subject: [PATCH 124/124] pccsadmin: ignore errors trying to clear the keyring +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +On authentication errors with PCS, an attempt is made to clear the +keyring. This may fail if the user's login environment has no keyring +configured. The user would have declined to store the key when first +prompted, so there would be nothing to clear either in this case. + +Signed-off-by: Daniel P. Berrangé +--- + tools/PccsAdminTool/lib/intelsgx/pcs.py | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +diff --git a/tools/PccsAdminTool/lib/intelsgx/pcs.py b/tools/PccsAdminTool/lib/intelsgx/pcs.py +index cfcc809..fecb05f 100644 +--- a/tools/PccsAdminTool/lib/intelsgx/pcs.py ++++ b/tools/PccsAdminTool/lib/intelsgx/pcs.py +@@ -364,7 +364,13 @@ class PCS: + if response.status_code != 200: + print(str(response.content, 'utf-8')) + if response.status_code == 401: +- Credentials().set_pcs_api_key('') #reset ApiKey ++ try: ++ Credentials().set_pcs_api_key('') #reset ApiKey ++ except: ++ # If keyring is unavailable, we don't want to trigger ++ # traceback, as the user may have declined to save ++ # the key in the keyring earlier ++ pass + return None + + # Verify expected headers +@@ -439,7 +445,13 @@ class PCS: + if response.status_code != 200: + print(str(response.content, 'utf-8')) + if response.status_code == 401: +- Credentials().set_pcs_api_key('') #reset ApiKey ++ try: ++ Credentials().set_pcs_api_key('') #reset ApiKey ++ except: ++ # If keyring is unavailable, we don't want to trigger ++ # traceback, as the user may have declined to save ++ # the key in the keyring earlier ++ pass + return None + + # Verify expected headers +-- +2.51.1 + diff --git a/linux-sgx.spec b/linux-sgx.spec index df9e102..bafe1cd 100644 --- a/linux-sgx.spec +++ b/linux-sgx.spec @@ -371,6 +371,7 @@ Patch0120: 0120-pccs-only-pass-ApiKey-if-it-is-set.patch Patch0121: 0121-pccsadmin-make-keyring-module-optional.patch Patch0122: 0122-pccsadmin-convert-from-asn1-to-pyasn1-python-module.patch Patch0123: 0123-pccsadmin-fully-port-to-pycryptography.patch +Patch0124: 0124-pccsadmin-ignore-errors-trying-to-clear-the-keyring.patch # 0200-0299 -> against intel-sgx-ssl.git Patch0200: 0200-Enable-pointing-sgxssl-build-to-alternative-glibc-he.patch From 2ea9580681eb8c0ac120f1f143046cc2e47ec91a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Mon, 8 Dec 2025 15:11:23 +0000 Subject: [PATCH 17/25] Make npm dep conditional for RHEL-9 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Daniel P. Berrangé --- linux-sgx.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/linux-sgx.spec b/linux-sgx.spec index bafe1cd..b96e922 100644 --- a/linux-sgx.spec +++ b/linux-sgx.spec @@ -408,7 +408,11 @@ BuildRequires: perl(IPC::Cmd) BuildRequires: nasm BuildRequires: nodejs BuildRequires: nodejs-devel +%if 0%{?rhel} == 9 +BuildRequires: npm +%else BuildRequires: nodejs-npm +%endif BuildRequires: nodejs-packaging BuildRequires: python-unversioned-command BuildRequires: sqlite-devel From 22a892466ea1976fbd7207fb8af04d3c04e6f19e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Mon, 8 Dec 2025 16:53:09 +0000 Subject: [PATCH 18/25] Add sgx-common dep from pccs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This is needed to pull in license file text Signed-off-by: Daniel P. Berrangé --- linux-sgx.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/linux-sgx.spec b/linux-sgx.spec index b96e922..404ea63 100644 --- a/linux-sgx.spec +++ b/linux-sgx.spec @@ -524,6 +524,7 @@ This package contains the Architectural Enclave Service Manager %package -n sgx-pccs Summary: SGX Provisioning Certificate Caching Service Requires: nodejs +Requires: sgx-common = %{version}-%{release} %description -n sgx-pccs SGX Provisioning Certificate Caching Service From d4b730c917757c3b61475edf20ae1a0115625eba Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Wed, 10 Dec 2025 11:10:45 +0000 Subject: [PATCH 19/25] Improve pycryptography port & drop pccs port number change MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Daniel P. Berrangé --- ...rop-use-of-bundled-pre-built-openssl.patch | 4 +- ...mprove-debuggability-of-build-system.patch | 4 +- ...me-setting-of-enclave-load-directory.patch | 4 +- ...ed-sgx_urts-library-in-PCKRetrievalT.patch | 4 +- ...-only-import-pypac-module-on-Windows.patch | 4 +- ...-PCKRetrievalTool-config-file-in-etc.patch | 4 +- ...XFLAGS-LDFLAGS-for-various-tools-and.patch | 4 +- ...tween-program-name-first-arg-in-usag.patch | 4 +- ...nst-format-strings-in-QL-log-message.patch | 4 +- ...d-debug-parameter-to-control-logging.patch | 4 +- ...-leftover-debugging-print-args-state.patch | 4 +- ...sion-for-libsgx_qe3_logic.so-library.patch | 4 +- 0112-Workaround-broken-GCC-15.patch | 4 +- ...-Don-t-disable-cf-protection-for-qgs.patch | 4 +- ...ecks-for-GCC-version-that-break-fsta.patch | 4 +- ...se-distro-provided-rapidjson-package.patch | 4 +- 0116-Don-t-stomp-on-VERBOSE-variable.patch | 4 +- ...-MODE-parameter-for-UNIX-socket-mode.patch | 4 +- ...-PCCS-port-number-from-8081-to-10801.patch | 174 ------------ ...pccs-sanitize-paths-to-all-resources.patch | 4 +- ...9-pccs-only-pass-ApiKey-if-it-is-set.patch | 4 +- ...csadmin-make-keyring-module-optional.patch | 4 +- ...rt-from-asn1-to-pyasn1-python-module.patch | 4 +- ...switch-to-pycryptography-for-CRL-ver.patch | 67 +++++ ...csadmin-fully-port-to-pycryptography.patch | 248 ------------------ ...re-of-pycryptography-instead-of-pyop.patch | 178 +++++++++++++ ...prefer-pycryptography-over-pyopenssl.patch | 104 ++++++++ ...llback-for-when-pyopenssl-is-not-ava.patch | 75 ++++++ ...e-errors-trying-to-clear-the-keyring.patch | 10 +- linux-sgx.spec | 19 +- 30 files changed, 485 insertions(+), 478 deletions(-) delete mode 100644 0118-Switch-default-PCCS-port-number-from-8081-to-10801.patch rename 0119-Sanitize-paths-to-all-resources-in-PCCS-server.patch => 0118-pccs-sanitize-paths-to-all-resources.patch (96%) rename 0120-pccs-only-pass-ApiKey-if-it-is-set.patch => 0119-pccs-only-pass-ApiKey-if-it-is-set.patch (94%) rename 0121-pccsadmin-make-keyring-module-optional.patch => 0120-pccsadmin-make-keyring-module-optional.patch (97%) rename 0122-pccsadmin-convert-from-asn1-to-pyasn1-python-module.patch => 0121-pccsadmin-convert-from-asn1-to-pyasn1-python-module.patch (98%) create mode 100644 0122-pccsadmin-fully-switch-to-pycryptography-for-CRL-ver.patch delete mode 100644 0123-pccsadmin-fully-port-to-pycryptography.patch create mode 100644 0123-pccsadmin-use-more-of-pycryptography-instead-of-pyop.patch create mode 100644 0124-pccsadmin-prefer-pycryptography-over-pyopenssl.patch create mode 100644 0125-pccsadmin-add-fallback-for-when-pyopenssl-is-not-ava.patch rename 0124-pccsadmin-ignore-errors-trying-to-clear-the-keyring.patch => 0126-pccsadmin-ignore-errors-trying-to-clear-the-keyring.patch (90%) diff --git a/0100-Drop-use-of-bundled-pre-built-openssl.patch b/0100-Drop-use-of-bundled-pre-built-openssl.patch index 6007ee2..c255488 100644 --- a/0100-Drop-use-of-bundled-pre-built-openssl.patch +++ b/0100-Drop-use-of-bundled-pre-built-openssl.patch @@ -1,7 +1,7 @@ -From 9746d1048b23a3431d898f2375a8d849127ebde7 Mon Sep 17 00:00:00 2001 +From cf39f86bcca57579013cee5967d39cdaca15cbc4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Mon, 26 Feb 2024 12:19:51 +0000 -Subject: [PATCH 100/124] Drop use of bundled pre-built openssl +Subject: [PATCH 100/126] Drop use of bundled pre-built openssl MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0101-Improve-debuggability-of-build-system.patch b/0101-Improve-debuggability-of-build-system.patch index 96c1f53..7194b9f 100644 --- a/0101-Improve-debuggability-of-build-system.patch +++ b/0101-Improve-debuggability-of-build-system.patch @@ -1,7 +1,7 @@ -From 50bbd267076608a9b0a3b5e23bcbc8bfadfb09d7 Mon Sep 17 00:00:00 2001 +From b36d8f61a5a18dc5edfbd632e5f2373bcf365b3e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 1 Mar 2024 12:05:01 +0000 -Subject: [PATCH 101/124] Improve debuggability of build system +Subject: [PATCH 101/126] Improve debuggability of build system MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0102-Support-build-time-setting-of-enclave-load-directory.patch b/0102-Support-build-time-setting-of-enclave-load-directory.patch index d586a96..cc70f8c 100644 --- a/0102-Support-build-time-setting-of-enclave-load-directory.patch +++ b/0102-Support-build-time-setting-of-enclave-load-directory.patch @@ -1,7 +1,7 @@ -From 2f0e63c015f83aa2248b8afa04c1928b6aa8b0fb Mon Sep 17 00:00:00 2001 +From 9a185a6103e9637b785e498d4c4e4c990e7a3478 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Mon, 26 Feb 2024 12:19:51 +0000 -Subject: [PATCH 102/124] Support build time setting of enclave load directory +Subject: [PATCH 102/126] Support build time setting of enclave load directory MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0103-Look-for-versioned-sgx_urts-library-in-PCKRetrievalT.patch b/0103-Look-for-versioned-sgx_urts-library-in-PCKRetrievalT.patch index 7ca4149..fd8a18b 100644 --- a/0103-Look-for-versioned-sgx_urts-library-in-PCKRetrievalT.patch +++ b/0103-Look-for-versioned-sgx_urts-library-in-PCKRetrievalT.patch @@ -1,7 +1,7 @@ -From 5fddd2225147e4372a6ff09350bdd495c3fdd4f8 Mon Sep 17 00:00:00 2001 +From b92d97f6037cb2e56d343cb979767d51655b097f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Tue, 27 Feb 2024 15:46:41 +0000 -Subject: [PATCH 103/124] Look for versioned sgx_urts library in +Subject: [PATCH 103/126] Look for versioned sgx_urts library in PCKRetrievalTool MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 diff --git a/0104-pccsadmin-only-import-pypac-module-on-Windows.patch b/0104-pccsadmin-only-import-pypac-module-on-Windows.patch index 58eed44..601a663 100644 --- a/0104-pccsadmin-only-import-pypac-module-on-Windows.patch +++ b/0104-pccsadmin-only-import-pypac-module-on-Windows.patch @@ -1,7 +1,7 @@ -From 728aaf92031a6691265f6ad98df3b18183049d26 Mon Sep 17 00:00:00 2001 +From eca1c479b23dd8e8c87e90988204c08b5e0c3edc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 4 Oct 2024 17:41:37 +0100 -Subject: [PATCH 104/124] pccsadmin: only import 'pypac' module on Windows +Subject: [PATCH 104/126] pccsadmin: only import 'pypac' module on Windows MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0105-Look-for-PCKRetrievalTool-config-file-in-etc.patch b/0105-Look-for-PCKRetrievalTool-config-file-in-etc.patch index 3b7e380..ad4eed1 100644 --- a/0105-Look-for-PCKRetrievalTool-config-file-in-etc.patch +++ b/0105-Look-for-PCKRetrievalTool-config-file-in-etc.patch @@ -1,7 +1,7 @@ -From 370fd9a5e6c06e47d394343aefe39610a60f4263 Mon Sep 17 00:00:00 2001 +From c8820c38a16ba9c572a6eafefd010b60ba037dde Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 29 Feb 2024 14:21:36 +0000 -Subject: [PATCH 105/124] Look for PCKRetrievalTool config file in /etc/ +Subject: [PATCH 105/126] Look for PCKRetrievalTool config file in /etc/ MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0106-Honour-CFLAGS-CXXFLAGS-LDFLAGS-for-various-tools-and.patch b/0106-Honour-CFLAGS-CXXFLAGS-LDFLAGS-for-various-tools-and.patch index 320ed70..353b690 100644 --- a/0106-Honour-CFLAGS-CXXFLAGS-LDFLAGS-for-various-tools-and.patch +++ b/0106-Honour-CFLAGS-CXXFLAGS-LDFLAGS-for-various-tools-and.patch @@ -1,7 +1,7 @@ -From 8cc9b7264cec48f7fb011b099e3c41080a9395aa Mon Sep 17 00:00:00 2001 +From 06874f59bd6693f0f42a999dcfbdc0233d9a4bd2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 28 Mar 2025 16:00:27 +0000 -Subject: [PATCH 106/124] Honour CFLAGS/CXXFLAGS/LDFLAGS for various tools and +Subject: [PATCH 106/126] Honour CFLAGS/CXXFLAGS/LDFLAGS for various tools and libraries MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 diff --git a/0107-qgs-add-space-between-program-name-first-arg-in-usag.patch b/0107-qgs-add-space-between-program-name-first-arg-in-usag.patch index 7246664..e624100 100644 --- a/0107-qgs-add-space-between-program-name-first-arg-in-usag.patch +++ b/0107-qgs-add-space-between-program-name-first-arg-in-usag.patch @@ -1,7 +1,7 @@ -From 5ae9e5eef28ef318fc31adac5cfb19af1d45ad7a Mon Sep 17 00:00:00 2001 +From 44eefb7f574b33cb0cf5239948e7d633f1d71dd5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 3 Oct 2024 14:42:29 +0100 -Subject: [PATCH 107/124] qgs: add space between program name & first arg in +Subject: [PATCH 107/126] qgs: add space between program name & first arg in usage MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 diff --git a/0108-qgs-protect-against-format-strings-in-QL-log-message.patch b/0108-qgs-protect-against-format-strings-in-QL-log-message.patch index 050c416..d368b81 100644 --- a/0108-qgs-protect-against-format-strings-in-QL-log-message.patch +++ b/0108-qgs-protect-against-format-strings-in-QL-log-message.patch @@ -1,7 +1,7 @@ -From 6589bfa27e59d2331a69ddcef0ec1ac06a083704 Mon Sep 17 00:00:00 2001 +From 6c38e13fbee555045aec98f6e159531a385bce53 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 4 Oct 2024 09:43:17 +0100 -Subject: [PATCH 108/124] qgs: protect against format strings in QL log +Subject: [PATCH 108/126] qgs: protect against format strings in QL log messages MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 diff --git a/0109-qgs-add-debug-parameter-to-control-logging.patch b/0109-qgs-add-debug-parameter-to-control-logging.patch index 63c593a..a5f845b 100644 --- a/0109-qgs-add-debug-parameter-to-control-logging.patch +++ b/0109-qgs-add-debug-parameter-to-control-logging.patch @@ -1,7 +1,7 @@ -From d882234222791a8debfa04fbb284e00c36d69854 Mon Sep 17 00:00:00 2001 +From d1cbef970b8ee800a313b818927449a7dcf1a685 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 3 Oct 2024 16:57:35 +0100 -Subject: [PATCH 109/124] qgs: add --debug parameter to control logging +Subject: [PATCH 109/126] qgs: add --debug parameter to control logging MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0110-pccsadmin-remove-leftover-debugging-print-args-state.patch b/0110-pccsadmin-remove-leftover-debugging-print-args-state.patch index af17ab0..f56c48e 100644 --- a/0110-pccsadmin-remove-leftover-debugging-print-args-state.patch +++ b/0110-pccsadmin-remove-leftover-debugging-print-args-state.patch @@ -1,7 +1,7 @@ -From 5adba978fa3d75cc1dbada716fb7423111d7f5b6 Mon Sep 17 00:00:00 2001 +From 64c49b04e7e22358f3afee834a434a6cfdff4a9b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Tue, 8 Oct 2024 10:13:02 +0100 -Subject: [PATCH 110/124] pccsadmin: remove leftover debugging 'print(args)' +Subject: [PATCH 110/126] pccsadmin: remove leftover debugging 'print(args)' statement MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 diff --git a/0111-Fix-soname-version-for-libsgx_qe3_logic.so-library.patch b/0111-Fix-soname-version-for-libsgx_qe3_logic.so-library.patch index 6e4f3a0..1fb849c 100644 --- a/0111-Fix-soname-version-for-libsgx_qe3_logic.so-library.patch +++ b/0111-Fix-soname-version-for-libsgx_qe3_logic.so-library.patch @@ -1,7 +1,7 @@ -From 88ea0b616e118e673ec4b6f2d14117daee260514 Mon Sep 17 00:00:00 2001 +From 32ac12f933e813b80348840821e1deaedf797a00 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 17 Jan 2025 15:39:39 +0000 -Subject: [PATCH 111/124] Fix soname version for libsgx_qe3_logic.so library +Subject: [PATCH 111/126] Fix soname version for libsgx_qe3_logic.so library MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0112-Workaround-broken-GCC-15.patch b/0112-Workaround-broken-GCC-15.patch index 4201f19..24538f4 100644 --- a/0112-Workaround-broken-GCC-15.patch +++ b/0112-Workaround-broken-GCC-15.patch @@ -1,7 +1,7 @@ -From c5dc85fdef5a558738b0b5b1125dfee612f3d812 Mon Sep 17 00:00:00 2001 +From ac446d8943858e6dccec924451b8a8a3be4d9c4a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 6 Feb 2025 20:08:59 +0000 -Subject: [PATCH 112/124] Workaround broken GCC 15 +Subject: [PATCH 112/126] Workaround broken GCC 15 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0113-Don-t-disable-cf-protection-for-qgs.patch b/0113-Don-t-disable-cf-protection-for-qgs.patch index 446bba0..4b5628d 100644 --- a/0113-Don-t-disable-cf-protection-for-qgs.patch +++ b/0113-Don-t-disable-cf-protection-for-qgs.patch @@ -1,7 +1,7 @@ -From a9e7f2a4ec859e8846089af81f541b6cc1d436b9 Mon Sep 17 00:00:00 2001 +From fa8c4f150fe32dafd875c5f45a9e588775235e35 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Wed, 2 Apr 2025 18:39:31 +0100 -Subject: [PATCH 113/124] Don't disable cf-protection for qgs +Subject: [PATCH 113/126] Don't disable cf-protection for qgs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0114-Delete-broken-checks-for-GCC-version-that-break-fsta.patch b/0114-Delete-broken-checks-for-GCC-version-that-break-fsta.patch index 13c1039..9cb4dca 100644 --- a/0114-Delete-broken-checks-for-GCC-version-that-break-fsta.patch +++ b/0114-Delete-broken-checks-for-GCC-version-that-break-fsta.patch @@ -1,7 +1,7 @@ -From 58afc007ef674ad50027783642845f95f37ec198 Mon Sep 17 00:00:00 2001 +From 2d83da9d5f5fb7399b0d7ec6ac410a6bf52b2add Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 3 Apr 2025 17:44:48 +0100 -Subject: [PATCH 114/124] Delete broken checks for GCC version that break +Subject: [PATCH 114/126] Delete broken checks for GCC version that break -fstack-protector-strong MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 diff --git a/0115-Use-distro-provided-rapidjson-package.patch b/0115-Use-distro-provided-rapidjson-package.patch index c550286..802658f 100644 --- a/0115-Use-distro-provided-rapidjson-package.patch +++ b/0115-Use-distro-provided-rapidjson-package.patch @@ -1,7 +1,7 @@ -From 082009b9e9fbbe715743104eafc182959b51dd22 Mon Sep 17 00:00:00 2001 +From 40d434d75ff4978cd968b4d140af5aa8c8f602c2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Mon, 26 Feb 2024 12:19:51 +0000 -Subject: [PATCH 115/124] Use distro provided rapidjson package +Subject: [PATCH 115/126] Use distro provided rapidjson package MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0116-Don-t-stomp-on-VERBOSE-variable.patch b/0116-Don-t-stomp-on-VERBOSE-variable.patch index f68d622..629715a 100644 --- a/0116-Don-t-stomp-on-VERBOSE-variable.patch +++ b/0116-Don-t-stomp-on-VERBOSE-variable.patch @@ -1,7 +1,7 @@ -From 569bd6150f38405efb1a27cd8827164560b431d6 Mon Sep 17 00:00:00 2001 +From 605d9bcc0003c869e785376bbc3dbecc670c934d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Wed, 16 Apr 2025 11:48:52 +0100 -Subject: [PATCH 116/124] Don't stomp on "VERBOSE" variable +Subject: [PATCH 116/126] Don't stomp on "VERBOSE" variable MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0117-qgs-add-m-MODE-parameter-for-UNIX-socket-mode.patch b/0117-qgs-add-m-MODE-parameter-for-UNIX-socket-mode.patch index 7230bc7..2521be9 100644 --- a/0117-qgs-add-m-MODE-parameter-for-UNIX-socket-mode.patch +++ b/0117-qgs-add-m-MODE-parameter-for-UNIX-socket-mode.patch @@ -1,7 +1,7 @@ -From 85f4916b578bb1a210c76f78a392d66efc2c704c Mon Sep 17 00:00:00 2001 +From d7299915f42cd068744ce02e358865085f2f12bf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 2 May 2025 14:48:24 +0100 -Subject: [PATCH 117/124] qgs: add -m=MODE parameter for UNIX socket mode +Subject: [PATCH 117/126] qgs: add -m=MODE parameter for UNIX socket mode MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0118-Switch-default-PCCS-port-number-from-8081-to-10801.patch b/0118-Switch-default-PCCS-port-number-from-8081-to-10801.patch deleted file mode 100644 index 92f4b4d..0000000 --- a/0118-Switch-default-PCCS-port-number-from-8081-to-10801.patch +++ /dev/null @@ -1,174 +0,0 @@ -From b31c83c905094edee5c21240129467a31b7b11c4 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= -Date: Tue, 27 Feb 2024 15:46:41 +0000 -Subject: [PATCH 118/124] Switch default PCCS port number from 8081 to 10801 -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Port 8081 is a very poor choice of port number, since it is -both assigned to existing softrware in /etc/services, and -a fairly common "alternative" HTTP port that application -developers use for ad-hoc services. - -Move it to 10801 which is not assigned in /etc/services and -thus unlikely to clash with other software. - -Signed-off-by: Daniel P. Berrangé ---- - QuoteGeneration/pccs/config/default.json | 2 +- - QuoteGeneration/qcnl/inc/qcnl_config.h | 2 +- - QuoteGeneration/qcnl/linux/sgx_default_qcnl.conf | 4 ++-- - QuoteGeneration/qcnl/linux/sgx_default_qcnl_dev.conf | 2 +- - tools/PCKRetrievalTool/App/App.cpp | 4 ++-- - tools/PCKRetrievalTool/network_setting.conf | 4 ++-- - tools/PccsAdminTool/pccsadmin.py | 12 ++++++------ - 7 files changed, 15 insertions(+), 15 deletions(-) - -diff --git a/QuoteGeneration/pccs/config/default.json b/QuoteGeneration/pccs/config/default.json -index 13e00e2..7be5c6e 100644 ---- a/QuoteGeneration/pccs/config/default.json -+++ b/QuoteGeneration/pccs/config/default.json -@@ -1,5 +1,5 @@ - { -- "HTTPS_PORT" : 8081, -+ "HTTPS_PORT" : 10801, - "hosts" : "127.0.0.1", - "uri": "https://api.trustedservices.intel.com/sgx/certification/v4/", - "ApiKey": "", -diff --git a/QuoteGeneration/qcnl/inc/qcnl_config.h b/QuoteGeneration/qcnl/inc/qcnl_config.h -index 71b9a99..b9f2262 100644 ---- a/QuoteGeneration/qcnl/inc/qcnl_config.h -+++ b/QuoteGeneration/qcnl/inc/qcnl_config.h -@@ -82,7 +82,7 @@ protected: - // TCB update type, "early" or "standard" - string tcb_update_type_; - -- QcnlConfig() : server_url_("https://localhost:8081/sgx/certification/v4/"), -+ QcnlConfig() : server_url_("https://localhost:10801/sgx/certification/v4/"), - use_secure_cert_(true), - collateral_service_url_(server_url_), - collateral_version_("3.0"), -diff --git a/QuoteGeneration/qcnl/linux/sgx_default_qcnl.conf b/QuoteGeneration/qcnl/linux/sgx_default_qcnl.conf -index 7df3995..af26a7e 100644 ---- a/QuoteGeneration/qcnl/linux/sgx_default_qcnl.conf -+++ b/QuoteGeneration/qcnl/linux/sgx_default_qcnl.conf -@@ -2,7 +2,7 @@ - // *** ATTENTION : This file is in JSON format so the keys are case sensitive. Don't change them. - - //PCCS server address -- "pccs_url": "https://localhost:8081/sgx/certification/v4/" -+ "pccs_url": "https://localhost:10801/sgx/certification/v4/" - - // To accept insecure HTTPS certificate, set this option to false - ,"use_secure_cert": true -@@ -37,7 +37,7 @@ - - // If local_pck_url is defined, the QCNL will try to retrieve PCK cert chain from local_pck_url first, - // and failover to pccs_url as in legacy mode. -- //,"local_pck_url": "http://localhost:8081/sgx/certification/v4/" -+ //,"local_pck_url": "http://localhost:10801/sgx/certification/v4/" - - // If local_pck_url is not defined, set pck_cache_expire_hours to a none-zero value will enable local cache. - // The PCK certificates will be cached in memory and then to the disk drive. -diff --git a/QuoteGeneration/qcnl/linux/sgx_default_qcnl_dev.conf b/QuoteGeneration/qcnl/linux/sgx_default_qcnl_dev.conf -index 08ee41c..f398b7d 100644 ---- a/QuoteGeneration/qcnl/linux/sgx_default_qcnl_dev.conf -+++ b/QuoteGeneration/qcnl/linux/sgx_default_qcnl_dev.conf -@@ -8,7 +8,7 @@ - // It is recommended to use "3.1" for DCAP 1.12 release and later - - //PCCS server address -- "pccs_url": "https://localhost:8081/sgx/certification/v4/", -+ "pccs_url": "https://localhost:10801/sgx/certification/v4/", - - // To accept insecure HTTPS certificate, set this option to false - "use_secure_cert": false, -diff --git a/tools/PCKRetrievalTool/App/App.cpp b/tools/PCKRetrievalTool/App/App.cpp -index a34710d..17196e2 100644 ---- a/tools/PCKRetrievalTool/App/App.cpp -+++ b/tools/PCKRetrievalTool/App/App.cpp -@@ -67,7 +67,7 @@ uint32_t COMM_API sgx_tool_get_launch_token( - - void PrintHelp() { - printf("Usage: %s [OPTION] \n", VER_PRODUCTNAME_STR); -- printf("Example: %s -f pck_retrieval_result.csv -url https://localhost:8081 -user_token 123456 -use_secure_cert true -platform_id\n", VER_PRODUCTNAME_STR); -+ printf("Example: %s -f pck_retrieval_result.csv -url https://localhost:10801 -user_token 123456 -use_secure_cert true -platform_id\n", VER_PRODUCTNAME_STR); - printf( "\nOptions:\n"); - printf( " -f filename - output the retrieval result to the \"filename\"\n"); - printf( " -url cache_server_address - cache server's address \n"); -@@ -171,7 +171,7 @@ int parse_arg(int argc, const char *argv[]) - } - } - else if (strncmp(argv[i], "-defaulturl", 11) == 0) { -- server_url_string = "https://localhost:8081"; -+ server_url_string = "https://localhost:10801"; - continue; - } - else if (strncmp(argv[i], "-proxy_type",11) == 0) { -diff --git a/tools/PCKRetrievalTool/network_setting.conf b/tools/PCKRetrievalTool/network_setting.conf -index 7aa5d71..3600191 100644 ---- a/tools/PCKRetrievalTool/network_setting.conf -+++ b/tools/PCKRetrievalTool/network_setting.conf -@@ -1,9 +1,9 @@ - # ############################################################# - # PCCS server address - # support V3 version PCCS --#PCCS_URL=https://localhost:8081/sgx/certification/v3/platforms -+#PCCS_URL=https://localhost:10801/sgx/certification/v3/platforms - # support V4 version PCCS --#PCCS_URL=https://localhost:8081/sgx/certification/v4/platforms -+#PCCS_URL=https://localhost:10801/sgx/certification/v4/platforms - # To accept insecure HTTPS cert, set this option to FALSE - #USE_SECURE_CERT=TRUE - # When PCCS running in REQ mode, set "tcb update type": STANDARD, EARLY or ALL -diff --git a/tools/PccsAdminTool/pccsadmin.py b/tools/PccsAdminTool/pccsadmin.py -index 8e447c5..f286827 100755 ---- a/tools/PccsAdminTool/pccsadmin.py -+++ b/tools/PccsAdminTool/pccsadmin.py -@@ -16,7 +16,7 @@ from urllib.parse import unquote - import traceback - - PCS_SERVICE_URL = 'https://api.trustedservices.intel.com/sgx/certification/v4/' --PCCS_SERVICE_URL = 'https://localhost:8081/sgx/certification/v4' -+PCCS_SERVICE_URL = 'https://localhost:10801/sgx/certification/v4' - - def main(): - parser = argparse.ArgumentParser(description="Administrator tool for PCCS") -@@ -26,7 +26,7 @@ def main(): - # subparser for get - parser_get = subparsers.add_parser('get', formatter_class=argparse.RawTextHelpFormatter) - # add optional arguments for get -- parser_get.add_argument("-u", "--url", help="The URL of the PCCS's GET platforms API; default: https://localhost:8081/sgx/certification/v4/platforms") -+ parser_get.add_argument("-u", "--url", help="The URL of the PCCS's GET platforms API; default: https://localhost:10801/sgx/certification/v4/platforms") - parser_get.add_argument("-o", "--output_file", help="The output file name for platform list; default: platform_list.json") - parser_get.add_argument("-s", "--source", help= - "reg - Get platforms from registration table.(default)\n" -@@ -37,12 +37,12 @@ def main(): - # subparser for put - description_put = ( - "This put command supports the following formats([] means optional):\n" -- "1. pccsadmin put [-u https://localhost:8081/sgx/certification/v4/platformcollateral] [-i collateral_file(*.json)]\n" -- "2. pccsamdin put -u https://localhost:8081/sgx/certification/v4/appraisalpolicy [-d] -f fmspc -i policy_file(*.jwt)" -+ "1. pccsadmin put [-u https://localhost:10801/sgx/certification/v4/platformcollateral] [-i collateral_file(*.json)]\n" -+ "2. pccsamdin put -u https://localhost:10801/sgx/certification/v4/appraisalpolicy [-d] -f fmspc -i policy_file(*.jwt)" - ) - parser_put = subparsers.add_parser('put', description=description_put, formatter_class=argparse.RawTextHelpFormatter) - # add optional arguments for put -- parser_put.add_argument("-u", "--url", help="The URL of the PCCS's API; default: https://localhost:8081/sgx/certification/v4/platformcollateral") -+ parser_put.add_argument("-u", "--url", help="The URL of the PCCS's API; default: https://localhost:10801/sgx/certification/v4/platformcollateral") - parser_put.add_argument("-i", "--input_file", help="The input file name for platform collaterals or appraisal policy;\ - \nFor /platformcollateral API, default is platform_collaterals.json;\ - \nFor /appraisalpolicy API, the filename of the jwt file must be provided explicitly.") -@@ -71,7 +71,7 @@ def main(): - # subparser for refresh - parser_refresh = subparsers.add_parser('refresh') - # add optional arguments for refresh -- parser_refresh.add_argument("-u", "--url", help="The URL of the PCCS's refresh API; default: https://localhost:8081/sgx/certification/v4/refresh") -+ parser_refresh.add_argument("-u", "--url", help="The URL of the PCCS's refresh API; default: https://localhost:10801/sgx/certification/v4/refresh") - parser_refresh.add_argument("-f", "--fmspc", help="Only refresh certificates for specified FMSPCs. Format: [FMSPC1, FMSPC2, ..., FMSPCn]") - parser_refresh.set_defaults(func=pccs_refresh) - --- -2.51.1 - diff --git a/0119-Sanitize-paths-to-all-resources-in-PCCS-server.patch b/0118-pccs-sanitize-paths-to-all-resources.patch similarity index 96% rename from 0119-Sanitize-paths-to-all-resources-in-PCCS-server.patch rename to 0118-pccs-sanitize-paths-to-all-resources.patch index 44522f4..71d621f 100644 --- a/0119-Sanitize-paths-to-all-resources-in-PCCS-server.patch +++ b/0118-pccs-sanitize-paths-to-all-resources.patch @@ -1,7 +1,7 @@ -From a74b9efa563f98c302e556ca098f9b25d3213987 Mon Sep 17 00:00:00 2001 +From b108e8c9a0c9143e8fd930186c21d34d9cddaea7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Tue, 27 Feb 2024 13:38:49 +0000 -Subject: [PATCH 119/124] Sanitize paths to all resources in PCCS server +Subject: [PATCH 118/126] pccs: sanitize paths to all resources MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0120-pccs-only-pass-ApiKey-if-it-is-set.patch b/0119-pccs-only-pass-ApiKey-if-it-is-set.patch similarity index 94% rename from 0120-pccs-only-pass-ApiKey-if-it-is-set.patch rename to 0119-pccs-only-pass-ApiKey-if-it-is-set.patch index 3045cf7..d405074 100644 --- a/0120-pccs-only-pass-ApiKey-if-it-is-set.patch +++ b/0119-pccs-only-pass-ApiKey-if-it-is-set.patch @@ -1,7 +1,7 @@ -From 524c7d16514f1fe3a28816e9c2c4fcc838e55ad5 Mon Sep 17 00:00:00 2001 +From 6c6e7427cf14455a56828db5c39f26ca8658a18d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Wed, 9 Jul 2025 16:41:59 +0100 -Subject: [PATCH 120/124] pccs: only pass ApiKey if it is set +Subject: [PATCH 119/126] pccs: only pass ApiKey if it is set MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0121-pccsadmin-make-keyring-module-optional.patch b/0120-pccsadmin-make-keyring-module-optional.patch similarity index 97% rename from 0121-pccsadmin-make-keyring-module-optional.patch rename to 0120-pccsadmin-make-keyring-module-optional.patch index d928b70..73bc6a5 100644 --- a/0121-pccsadmin-make-keyring-module-optional.patch +++ b/0120-pccsadmin-make-keyring-module-optional.patch @@ -1,7 +1,7 @@ -From eadb596271a2e99578c5e4088058dceccdb24420 Mon Sep 17 00:00:00 2001 +From 2b540452538b12a47340b03d6118d3df281a6638 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 4 Dec 2025 13:31:54 +0000 -Subject: [PATCH 121/124] pccsadmin: make 'keyring' module optional +Subject: [PATCH 120/126] pccsadmin: make 'keyring' module optional MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0122-pccsadmin-convert-from-asn1-to-pyasn1-python-module.patch b/0121-pccsadmin-convert-from-asn1-to-pyasn1-python-module.patch similarity index 98% rename from 0122-pccsadmin-convert-from-asn1-to-pyasn1-python-module.patch rename to 0121-pccsadmin-convert-from-asn1-to-pyasn1-python-module.patch index 1b97242..004b8ef 100644 --- a/0122-pccsadmin-convert-from-asn1-to-pyasn1-python-module.patch +++ b/0121-pccsadmin-convert-from-asn1-to-pyasn1-python-module.patch @@ -1,7 +1,7 @@ -From edf194f2d523fe765cb7534b020c85158d278d74 Mon Sep 17 00:00:00 2001 +From b9954581944446455876728bdab816090d773715 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 4 Dec 2025 13:54:19 +0000 -Subject: [PATCH 122/124] pccsadmin: convert from asn1 to pyasn1 python module +Subject: [PATCH 121/126] pccsadmin: convert from asn1 to pyasn1 python module MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0122-pccsadmin-fully-switch-to-pycryptography-for-CRL-ver.patch b/0122-pccsadmin-fully-switch-to-pycryptography-for-CRL-ver.patch new file mode 100644 index 0000000..ed1ec4f --- /dev/null +++ b/0122-pccsadmin-fully-switch-to-pycryptography-for-CRL-ver.patch @@ -0,0 +1,67 @@ +From d44b9ac3e89e17452678758634e6dbca6c5a099a Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= +Date: Mon, 8 Dec 2025 17:47:01 +0000 +Subject: [PATCH 122/126] pccsadmin: fully switch to pycryptography for CRL + verification +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The pyopenssl 24.3.0 removed the CRL object and its related +methods. pccsadmin was already using the pycryptography CRL +object for the verification task, so fully switch to use it +for loading the CRL to begin with. + +Signed-off-by: Daniel P. Berrangé +--- + tools/PccsAdminTool/lib/intelsgx/pcs.py | 13 ++++--------- + 1 file changed, 4 insertions(+), 9 deletions(-) + +diff --git a/tools/PccsAdminTool/lib/intelsgx/pcs.py b/tools/PccsAdminTool/lib/intelsgx/pcs.py +index 046c781..e68864d 100644 +--- a/tools/PccsAdminTool/lib/intelsgx/pcs.py ++++ b/tools/PccsAdminTool/lib/intelsgx/pcs.py +@@ -101,11 +101,6 @@ class PCS: + # Copy our list so we don't modify the original + pychain= pychain_in[:] + +- # PyOpenSSL doesn't have methods for verifying a CRL issuer, +- # so we need to translate from it to cryptography. +- +- crl= pycrl.to_cryptography() +- + # The chain_pem is our CRL issuer and the CA for the issuer. + # Verify that first. + +@@ -118,13 +113,13 @@ class PCS: + + signer_key= pycert.get_pubkey().to_cryptography_key() + +- if not crl.is_signature_valid(signer_key): ++ if not pycrl.is_signature_valid(signer_key): + self.error("Could not verify CRL signature") + return False + + # Check the crl issuer + +- if pycrl.get_issuer() != pycert.get_subject(): ++ if pycrl.issuer != pycert.get_subject(): + self.error("CRL issuer doesn't match issuer chain") + return False + +@@ -516,10 +511,10 @@ class PCS: + crl= response.content + if self.ApiVersion<3: + crl_str= str(crl, dec) +- pycrl= crypto.load_crl(crypto.FILETYPE_PEM, crl) ++ pycrl= x509.load_pem_x509_crl(crl) + else: + crl_str= binascii.hexlify(crl).decode(dec) +- pycrl= crypto.load_crl(crypto.FILETYPE_ASN1, crl) ++ pycrl= x509.load_der_x509_crl(crl) + + if not self.verify_crl_trust(pychain, pycrl): + self.error("Could not validate certificate using trust chain") +-- +2.51.1 + diff --git a/0123-pccsadmin-fully-port-to-pycryptography.patch b/0123-pccsadmin-fully-port-to-pycryptography.patch deleted file mode 100644 index ddaf902..0000000 --- a/0123-pccsadmin-fully-port-to-pycryptography.patch +++ /dev/null @@ -1,248 +0,0 @@ -From 957e710cdcf7eadc6b6e1cc2456b4f3a1b54272e Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= -Date: Wed, 3 Dec 2025 17:59:09 +0000 -Subject: [PATCH 123/124] pccsadmin: fully port to pycryptography -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -pyOpenSSL 24.3.0 removed many APIs informing users to switch to the -pycryptography APIs, and as a result pccsadmin is broken on modern -Linux distros. - -The pycryptography APIs were already used for a few operations, so -switch the remainder of the file away from pyOpenSSL APIs. - -The caveat is that pycryptography only introduced certificate -verification APIs in 42.0.0, which is newer than what's available -in RHEL-9. Detect this and fallback to creating tempfiles and -calling openssl via its command line 'verify' function, to avoid -a needless dep on pyOpenSSL for this single function. - -Signed-off-by: Daniel P. Berrangé ---- - tools/PccsAdminTool/lib/intelsgx/pcs.py | 108 ++++++++++++++---------- - 1 file changed, 64 insertions(+), 44 deletions(-) - -diff --git a/tools/PccsAdminTool/lib/intelsgx/pcs.py b/tools/PccsAdminTool/lib/intelsgx/pcs.py -index 046c781..cfcc809 100644 ---- a/tools/PccsAdminTool/lib/intelsgx/pcs.py -+++ b/tools/PccsAdminTool/lib/intelsgx/pcs.py -@@ -3,8 +3,19 @@ import urllib3 - import requests - import json - import binascii -+import tempfile -+import subprocess - from urllib import parse --from OpenSSL import crypto -+from cryptography import x509 -+try: -+ # Only available from >= 42.0.0 -+ from cryptography.x509 import verification -+except ImportError: -+ # Fallback to invoking 'openssl verify' command line -+ verification = None -+from cryptography.exceptions import InvalidSignature -+from cryptography.hazmat.primitives import hashes, serialization -+from cryptography.hazmat.primitives.asymmetric import ec - from platform import system - if system() == 'Windows': - from pypac import PACSession -@@ -89,23 +100,10 @@ class PCS: - # Certificate verification - #---------------------------------------------------------------------------- - -- def init_cert_store(self, pychain): -- store= crypto.X509Store() -- -- for tcert in pychain: -- store.add_cert(tcert) -- -- return store -- - def verify_crl_trust(self, pychain_in, pycrl): - # Copy our list so we don't modify the original - pychain= pychain_in[:] - -- # PyOpenSSL doesn't have methods for verifying a CRL issuer, -- # so we need to translate from it to cryptography. -- -- crl= pycrl.to_cryptography() -- - # The chain_pem is our CRL issuer and the CA for the issuer. - # Verify that first. - -@@ -116,31 +114,54 @@ class PCS: - - # Now verify the CRL signature - -- signer_key= pycert.get_pubkey().to_cryptography_key() -+ signer_key= pycert.public_key() - -- if not crl.is_signature_valid(signer_key): -+ if not pycrl.is_signature_valid(signer_key): - self.error("Could not verify CRL signature") - return False - - # Check the crl issuer - -- if pycrl.get_issuer() != pycert.get_subject(): -+ if pycrl.issuer != pycert.subject: - self.error("CRL issuer doesn't match issuer chain") - return False - - return True - - def verify_cert_trust(self, pychain, pycerts): -- store= self.init_cert_store(pychain) -- -- for pycert in pycerts: -- store_ctx= crypto.X509StoreContext(store, pycert) -- try: -- store_ctx.verify_certificate() -- except crypto.X509StoreContextError as e: -- # Printing or logging the error details -- print(e) -- return False -+ if verification is not None: -+ store = verification.Store(pychain) -+ -+ builder = verification.PolicyBuilder().store(store) -+ builder = builder.extension_policies( -+ ee_policy=verification.ExtensionPolicy.permit_all(), -+ ca_policy=verification.ExtensionPolicy.webpki_defaults_ca()) -+ -+ verifier = builder.build_client_verifier() -+ for pycert in pycerts: -+ try: -+ verifier.verify(pycert,[]) -+ except verification.VerificationError as e: -+ # Printing or logging the error details -+ print(e) -+ return False -+ else: -+ with tempfile.NamedTemporaryFile("wb") as chainfile: -+ for cert in pychain: -+ chainfile.write(cert.public_bytes(serialization.Encoding.PEM)) -+ chainfile.flush() -+ -+ for cert in pycerts: -+ with tempfile.NamedTemporaryFile("wb") as certfile: -+ certfile.write(cert.public_bytes(serialization.Encoding.PEM)) -+ certfile.flush() -+ -+ try: -+ subprocess.check_call(["openssl", "verify", -+ "-CAfile", chainfile.name, certfile.name], -+ stdout=subprocess.DEVNULL) -+ except subprocess.CalledProcessError as e: -+ return False - - return True - -@@ -166,22 +187,21 @@ class PCS: - sig= bytes([0x30,len(r)+len(s)+4,2,len(r)]) + r + bytes([2,len(s)]) + s - - try: -- crypto.verify(pycert, sig, msg, "sha256") -- except crypto.Error as e: -+ pycert.public_key().verify( -+ sig, msg, ec.ECDSA(hashes.SHA256())) -+ except InvalidSignature as e: - self.error('Signature verification failed: {:s}'.format(str(e))) - return False - - return True - - def pem_to_pycert(self, cert_pem): -- return crypto.load_certificate(crypto.FILETYPE_PEM, cert_pem) -+ return x509.load_pem_x509_certificate(cert_pem.encode("utf-8")) - - def pems_to_pycerts(self, certs_pem): - pycerts= [] - for cert_pem in certs_pem: -- pycerts.append( -- crypto.load_certificate(crypto.FILETYPE_PEM, cert_pem) -- ) -+ pycerts.append(self.pem_to_pycert(cert_pem)) - return pycerts - - def parse_chain_pem(self, chain_pem): -@@ -214,9 +234,9 @@ class PCS: - cert0= chain_in[0] - cert1= chain_in[1] - -- if cert0.get_subject() == cert1.get_issuer(): -+ if cert0.subject == cert1.issuer: - return chain_in -- elif cert1.get_subject() == cert0.get_issuer(): -+ elif cert1.subject == cert0.issuer: - chain_in.reverse() - return chain_in - else: -@@ -229,7 +249,7 @@ class PCS: - for i in range(1, len(chain_in)): - cert= chain_in[i] - pcert= chain_in[i-1] -- if cert.get_issuer() != pcert.get_subject(): -+ if cert.issuer != pcert.subject: - sorted= False - break - -@@ -245,8 +265,8 @@ class PCS: - rootidx= -1 - for i in range(0, len(chain)): - cert= chain[i] -- subject= cert.get_subject() -- issuer= cert.get_issuer() -+ subject= cert.subject -+ issuer= cert.issuer - cert_subjects[subject.CN]= cert - print("cert: {:s} <- {:s}" . format(subject.CN, issuer.CN)) - -@@ -267,8 +287,8 @@ class PCS: - issuer_to= {} - - for cert in chain: -- issuer= cert.get_issuer().CN -- subject= cert.get_subject().CN -+ issuer= cert.issuer.CN -+ subject= cert.subject.CN - - if issuer in issued_by: - self.error('multiple certs issued by same cert in chain') -@@ -285,7 +305,7 @@ class PCS: - - if len(sorted_chain) > 0: - for cert in chain: -- issuer= cert.get_issuer().CN -+ issuer= cert.issuer.CN - if issuer not in issued_by: - if len(sorted_chain) > 0: - self.error('multiple certs with no issuer') -@@ -301,7 +321,7 @@ class PCS: - cert= sorted_chain[0] - - while len(sorted_chain) < lchain: -- issuer_subject= cert.get_subject().der() -+ issuer_subject= cert.subject.CN - - if issuer_subject not in issuer_to: - self.error('cert in chain with no issuer') -@@ -516,10 +536,10 @@ class PCS: - crl= response.content - if self.ApiVersion<3: - crl_str= str(crl, dec) -- pycrl= crypto.load_crl(crypto.FILETYPE_PEM, crl) -+ pycrl= x509.load_pem_x509_crl(crl) - else: - crl_str= binascii.hexlify(crl).decode(dec) -- pycrl= crypto.load_crl(crypto.FILETYPE_ASN1, crl) -+ pycrl= x509.load_der_x509_crl(crl) - - if not self.verify_crl_trust(pychain, pycrl): - self.error("Could not validate certificate using trust chain") --- -2.51.1 - diff --git a/0123-pccsadmin-use-more-of-pycryptography-instead-of-pyop.patch b/0123-pccsadmin-use-more-of-pycryptography-instead-of-pyop.patch new file mode 100644 index 0000000..64ff5bd --- /dev/null +++ b/0123-pccsadmin-use-more-of-pycryptography-instead-of-pyop.patch @@ -0,0 +1,178 @@ +From d14f914ea644d7c1b2312780688d55fbb13892bc Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= +Date: Mon, 8 Dec 2025 17:48:11 +0000 +Subject: [PATCH 123/126] pccsadmin: use more of pycryptography instead of + pyopenssl +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +pyopenssl docs are indicating that the 'crypto' module is liable to +see further deprecation, suggesting use of pycryptography instead. +pccsadmin code already uses pycryptography for CRLs, so extend this +to use it for loading certificates too. They are converted back to +pyopenssl objects for verification. + +Signed-off-by: Daniel P. Berrangé +--- + tools/PccsAdminTool/lib/intelsgx/pcs.py | 49 ++++++++++++++----------- + 1 file changed, 28 insertions(+), 21 deletions(-) + +diff --git a/tools/PccsAdminTool/lib/intelsgx/pcs.py b/tools/PccsAdminTool/lib/intelsgx/pcs.py +index e68864d..f6b58a6 100644 +--- a/tools/PccsAdminTool/lib/intelsgx/pcs.py ++++ b/tools/PccsAdminTool/lib/intelsgx/pcs.py +@@ -5,6 +5,10 @@ import json + import binascii + from urllib import parse + from OpenSSL import crypto ++from cryptography import x509 ++from cryptography.exceptions import InvalidSignature ++from cryptography.hazmat.primitives import hashes ++from cryptography.hazmat.primitives.asymmetric import ec + from platform import system + if system() == 'Windows': + from pypac import PACSession +@@ -17,6 +21,9 @@ certBegin= '-----BEGIN CERTIFICATE-----' + certEnd= '-----END CERTIFICATE-----' + certEndOffset= len(certEnd) + ++def CN(name): ++ return name.get_attributes_for_oid(x509.NameOID.COMON_NAME)[0].value ++ + class PCS: + BaseUrl= '' + ApiVersion= 3 +@@ -93,7 +100,7 @@ class PCS: + store= crypto.X509Store() + + for tcert in pychain: +- store.add_cert(tcert) ++ store.add_cert(crypto.X509.from_cryptography(tcert)) + + return store + +@@ -111,7 +118,7 @@ class PCS: + + # Now verify the CRL signature + +- signer_key= pycert.get_pubkey().to_cryptography_key() ++ signer_key= pycert.public_key() + + if not pycrl.is_signature_valid(signer_key): + self.error("Could not verify CRL signature") +@@ -119,7 +126,7 @@ class PCS: + + # Check the crl issuer + +- if pycrl.issuer != pycert.get_subject(): ++ if pycrl.issuer != pycert.subject: + self.error("CRL issuer doesn't match issuer chain") + return False + +@@ -129,7 +136,8 @@ class PCS: + store= self.init_cert_store(pychain) + + for pycert in pycerts: +- store_ctx= crypto.X509StoreContext(store, pycert) ++ store_ctx= crypto.X509StoreContext( ++ store, crypto.X509.from_cryptography(pycert)) + try: + store_ctx.verify_certificate() + except crypto.X509StoreContextError as e: +@@ -161,22 +169,21 @@ class PCS: + sig= bytes([0x30,len(r)+len(s)+4,2,len(r)]) + r + bytes([2,len(s)]) + s + + try: +- crypto.verify(pycert, sig, msg, "sha256") +- except crypto.Error as e: ++ pycert.public_key().verify( ++ sig, msg, ec.ECDSA(hashes.SHA256())) ++ except InvalidSignature as e: + self.error('Signature verification failed: {:s}'.format(str(e))) + return False + + return True + + def pem_to_pycert(self, cert_pem): +- return crypto.load_certificate(crypto.FILETYPE_PEM, cert_pem) ++ return x509.load_pem_x509_certificate(cert_pem.encode("utf-8")) + + def pems_to_pycerts(self, certs_pem): + pycerts= [] + for cert_pem in certs_pem: +- pycerts.append( +- crypto.load_certificate(crypto.FILETYPE_PEM, cert_pem) +- ) ++ pycerts.append(self.pem_to_pycert(cert_pem)) + return pycerts + + def parse_chain_pem(self, chain_pem): +@@ -209,9 +216,9 @@ class PCS: + cert0= chain_in[0] + cert1= chain_in[1] + +- if cert0.get_subject() == cert1.get_issuer(): ++ if cert0.subject == cert1.issuer: + return chain_in +- elif cert1.get_subject() == cert0.get_issuer(): ++ elif cert1.subject == cert0.issuer: + chain_in.reverse() + return chain_in + else: +@@ -224,7 +231,7 @@ class PCS: + for i in range(1, len(chain_in)): + cert= chain_in[i] + pcert= chain_in[i-1] +- if cert.get_issuer() != pcert.get_subject(): ++ if cert.issuer != pcert.subject: + sorted= False + break + +@@ -240,10 +247,10 @@ class PCS: + rootidx= -1 + for i in range(0, len(chain)): + cert= chain[i] +- subject= cert.get_subject() +- issuer= cert.get_issuer() +- cert_subjects[subject.CN]= cert +- print("cert: {:s} <- {:s}" . format(subject.CN, issuer.CN)) ++ subject= cert.subject ++ issuer= cert.issuer ++ cert_subjects[CN(subject)]= cert ++ print("cert: {:s} <- {:s}" . format(CN(subject), CN(issuer))) + + if subject == issuer: + if len(sorted_chain) > 0: +@@ -262,8 +269,8 @@ class PCS: + issuer_to= {} + + for cert in chain: +- issuer= cert.get_issuer().CN +- subject= cert.get_subject().CN ++ issuer= CN(cert.issuer) ++ subject= CN(cert.subject) + + if issuer in issued_by: + self.error('multiple certs issued by same cert in chain') +@@ -280,7 +287,7 @@ class PCS: + + if len(sorted_chain) > 0: + for cert in chain: +- issuer= cert.get_issuer().CN ++ issuer= CN(cert.issuer) + if issuer not in issued_by: + if len(sorted_chain) > 0: + self.error('multiple certs with no issuer') +@@ -296,7 +303,7 @@ class PCS: + cert= sorted_chain[0] + + while len(sorted_chain) < lchain: +- issuer_subject= cert.get_subject().der() ++ issuer_subject= CN(cert.subject) + + if issuer_subject not in issuer_to: + self.error('cert in chain with no issuer') +-- +2.51.1 + diff --git a/0124-pccsadmin-prefer-pycryptography-over-pyopenssl.patch b/0124-pccsadmin-prefer-pycryptography-over-pyopenssl.patch new file mode 100644 index 0000000..eeb6a83 --- /dev/null +++ b/0124-pccsadmin-prefer-pycryptography-over-pyopenssl.patch @@ -0,0 +1,104 @@ +From 9d3da2fd99ba2832fcaa4067dd5db3f7f349c306 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= +Date: Wed, 3 Dec 2025 17:59:09 +0000 +Subject: [PATCH 124/126] pccsadmin: prefer pycryptography over pyopenssl +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The only part of pccsadmin that still needs pyopenssl is certificate +verification. As of pycryptography 45.0.0, there are sufficient APIs +available to replace the remaining usage of pyopenssl. + +Since new pycryptography is still not widely available in distros, +keep pyopenssl code as a fallback. + +Signed-off-by: Daniel P. Berrangé +--- + tools/PccsAdminTool/lib/intelsgx/pcs.py | 60 +++++++++++++++++++------ + 1 file changed, 47 insertions(+), 13 deletions(-) + +diff --git a/tools/PccsAdminTool/lib/intelsgx/pcs.py b/tools/PccsAdminTool/lib/intelsgx/pcs.py +index f6b58a6..eeb2969 100644 +--- a/tools/PccsAdminTool/lib/intelsgx/pcs.py ++++ b/tools/PccsAdminTool/lib/intelsgx/pcs.py +@@ -4,11 +4,28 @@ import requests + import json + import binascii + from urllib import parse +-from OpenSSL import crypto ++ + from cryptography import x509 + from cryptography.exceptions import InvalidSignature +-from cryptography.hazmat.primitives import hashes ++from cryptography.hazmat.primitives import hashes, serialization + from cryptography.hazmat.primitives.asymmetric import ec ++ ++# Prefer pycryptography for cert verification if new ++# enough, but fallback to pyopenssl ++try: ++ # 'verification' module available from >= 42.0.0, but ++ # the required 'ExtensionPolicy' API is from >= 45.0.0 ++ from cryptography.x509 import verification ++ if not hasattr(verification, 'ExtensionPolicy'): ++ verification = None ++ else: ++ crypto = None ++except ImportError: ++ verification = None ++ ++if verification is None: ++ from OpenSSL import crypto ++ + from platform import system + if system() == 'Windows': + from pypac import PACSession +@@ -133,17 +150,34 @@ class PCS: + return True + + def verify_cert_trust(self, pychain, pycerts): +- store= self.init_cert_store(pychain) +- +- for pycert in pycerts: +- store_ctx= crypto.X509StoreContext( +- store, crypto.X509.from_cryptography(pycert)) +- try: +- store_ctx.verify_certificate() +- except crypto.X509StoreContextError as e: +- # Printing or logging the error details +- print(e) +- return False ++ if verification is not None: ++ store= verification.Store(pychain) ++ ++ builder= verification.PolicyBuilder().store(store) ++ builder= builder.extension_policies( ++ ee_policy=verification.ExtensionPolicy.permit_all(), ++ ca_policy=verification.ExtensionPolicy.webpki_defaults_ca()) ++ ++ verifier= builder.build_client_verifier() ++ for pycert in pycerts: ++ try: ++ verifier.verify(pycert,[]) ++ except verification.VerificationError as e: ++ # Printing or logging the error details ++ print(e) ++ return False ++ else: ++ store= self.init_cert_store(pychain) ++ ++ for pycert in pycerts: ++ store_ctx= crypto.X509StoreContext( ++ store, crypto.X509.from_cryptography(pycert)) ++ try: ++ store_ctx.verify_certificate() ++ except crypto.X509StoreContextError as e: ++ # Printing or logging the error details ++ print(e) ++ return False + + return True + +-- +2.51.1 + diff --git a/0125-pccsadmin-add-fallback-for-when-pyopenssl-is-not-ava.patch b/0125-pccsadmin-add-fallback-for-when-pyopenssl-is-not-ava.patch new file mode 100644 index 0000000..f102412 --- /dev/null +++ b/0125-pccsadmin-add-fallback-for-when-pyopenssl-is-not-ava.patch @@ -0,0 +1,75 @@ +From 262c1cb978d31130d3558d2a29690b1eace52c64 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= +Date: Mon, 8 Dec 2025 17:56:59 +0000 +Subject: [PATCH 125/126] pccsadmin: add fallback for when pyopenssl is not + available +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +RHEL does not ship pyopenssl, however, the pycryptography that is +included is also too old to support certificate verification. Add +a further fallback that can invoke the 'openssl' command line tool +to verify certificates. + +Signed-off-by: Daniel P. Berrangé +--- + tools/PccsAdminTool/lib/intelsgx/pcs.py | 28 +++++++++++++++++++++++-- + 1 file changed, 26 insertions(+), 2 deletions(-) + +diff --git a/tools/PccsAdminTool/lib/intelsgx/pcs.py b/tools/PccsAdminTool/lib/intelsgx/pcs.py +index eeb2969..1368b57 100644 +--- a/tools/PccsAdminTool/lib/intelsgx/pcs.py ++++ b/tools/PccsAdminTool/lib/intelsgx/pcs.py +@@ -24,7 +24,14 @@ except ImportError: + verification = None + + if verification is None: +- from OpenSSL import crypto ++ try: ++ from OpenSSL import crypto ++ except ModuleNotFoundError: ++ # Fallback to spawning 'openssl' binary if ++ # pyopenssl is not available ++ crypto = None ++ import tempfile ++ import subprocess + + from platform import system + if system() == 'Windows': +@@ -166,7 +173,7 @@ class PCS: + # Printing or logging the error details + print(e) + return False +- else: ++ elif crypto is not None: + store= self.init_cert_store(pychain) + + for pycert in pycerts: +@@ -178,6 +185,23 @@ class PCS: + # Printing or logging the error details + print(e) + return False ++ else: ++ with tempfile.NamedTemporaryFile("wb") as chainfile: ++ for cert in pychain: ++ chainfile.write(cert.public_bytes(serialization.Encoding.PEM)) ++ chainfile.flush() ++ ++ for cert in pycerts: ++ with tempfile.NamedTemporaryFile("wb") as certfile: ++ certfile.write(cert.public_bytes(serialization.Encoding.PEM)) ++ certfile.flush() ++ ++ try: ++ subprocess.check_call(["openssl", "verify", ++ "-CAfile", chainfile.name, certfile.name], ++ stdout=subprocess.DEVNULL) ++ except subprocess.CalledProcessError as e: ++ return False + + return True + +-- +2.51.1 + diff --git a/0124-pccsadmin-ignore-errors-trying-to-clear-the-keyring.patch b/0126-pccsadmin-ignore-errors-trying-to-clear-the-keyring.patch similarity index 90% rename from 0124-pccsadmin-ignore-errors-trying-to-clear-the-keyring.patch rename to 0126-pccsadmin-ignore-errors-trying-to-clear-the-keyring.patch index d019b72..dfcbd1c 100644 --- a/0124-pccsadmin-ignore-errors-trying-to-clear-the-keyring.patch +++ b/0126-pccsadmin-ignore-errors-trying-to-clear-the-keyring.patch @@ -1,7 +1,7 @@ -From 4be74ca6cc6868bee375b7820412da7fe586c40b Mon Sep 17 00:00:00 2001 +From 8081c78698b7a1e5ec183eca3318f98396680545 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 4 Dec 2025 18:05:14 +0000 -Subject: [PATCH 124/124] pccsadmin: ignore errors trying to clear the keyring +Subject: [PATCH 126/126] pccsadmin: ignore errors trying to clear the keyring MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -17,10 +17,10 @@ Signed-off-by: Daniel P. Berrangé 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/tools/PccsAdminTool/lib/intelsgx/pcs.py b/tools/PccsAdminTool/lib/intelsgx/pcs.py -index cfcc809..fecb05f 100644 +index 1368b57..dd4eba4 100644 --- a/tools/PccsAdminTool/lib/intelsgx/pcs.py +++ b/tools/PccsAdminTool/lib/intelsgx/pcs.py -@@ -364,7 +364,13 @@ class PCS: +@@ -404,7 +404,13 @@ class PCS: if response.status_code != 200: print(str(response.content, 'utf-8')) if response.status_code == 401: @@ -35,7 +35,7 @@ index cfcc809..fecb05f 100644 return None # Verify expected headers -@@ -439,7 +445,13 @@ class PCS: +@@ -479,7 +485,13 @@ class PCS: if response.status_code != 200: print(str(response.content, 'utf-8')) if response.status_code == 401: diff --git a/linux-sgx.spec b/linux-sgx.spec index 404ea63..11bca04 100644 --- a/linux-sgx.spec +++ b/linux-sgx.spec @@ -365,13 +365,15 @@ Patch0114: 0114-Delete-broken-checks-for-GCC-version-that-break-fsta.patch #Patch0115: 0115-Use-distro-provided-rapidjson-package.patch Patch0116: 0116-Don-t-stomp-on-VERBOSE-variable.patch Patch0117: 0117-qgs-add-m-MODE-parameter-for-UNIX-socket-mode.patch -Patch0118: 0118-Switch-default-PCCS-port-number-from-8081-to-10801.patch -Patch0119: 0119-Sanitize-paths-to-all-resources-in-PCCS-server.patch -Patch0120: 0120-pccs-only-pass-ApiKey-if-it-is-set.patch -Patch0121: 0121-pccsadmin-make-keyring-module-optional.patch -Patch0122: 0122-pccsadmin-convert-from-asn1-to-pyasn1-python-module.patch -Patch0123: 0123-pccsadmin-fully-port-to-pycryptography.patch -Patch0124: 0124-pccsadmin-ignore-errors-trying-to-clear-the-keyring.patch +Patch0118: 0118-pccs-sanitize-paths-to-all-resources.patch +Patch0119: 0119-pccs-only-pass-ApiKey-if-it-is-set.patch +Patch0120: 0120-pccsadmin-make-keyring-module-optional.patch +Patch0121: 0121-pccsadmin-convert-from-asn1-to-pyasn1-python-module.patch +Patch0122: 0122-pccsadmin-fully-switch-to-pycryptography-for-CRL-ver.patch +Patch0123: 0123-pccsadmin-use-more-of-pycryptography-instead-of-pyop.patch +Patch0124: 0124-pccsadmin-prefer-pycryptography-over-pyopenssl.patch +Patch0125: 0125-pccsadmin-add-fallback-for-when-pyopenssl-is-not-ava.patch +Patch0126: 0126-pccsadmin-ignore-errors-trying-to-clear-the-keyring.patch # 0200-0299 -> against intel-sgx-ssl.git Patch0200: 0200-Enable-pointing-sgxssl-build-to-alternative-glibc-he.patch @@ -540,6 +542,9 @@ Requires: python3-keyring Requires: python3-requests Requires: python3-urllib3 Requires: python3-setuptools +%if 0%{?rhel} +Requires: openssl +%endif Requires: sgx-libs = %{version}-%{release} # pccs admin tool can be used against a remote pccs # so don't force a hard dep From 77222ebd3af14d567e9122d595ec6f11480d76ca Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Tue, 6 Jan 2026 17:18:54 +0000 Subject: [PATCH 20/25] Drop dep from pccs to mpa_registration MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit pccs.service would normally run on a separate host from the compute host and has no functional dep on mpa_registration. Signed-off-by: Daniel P. Berrangé --- pccs.service | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/pccs.service b/pccs.service index a183226..f94950a 100644 --- a/pccs.service +++ b/pccs.service @@ -1,9 +1,8 @@ [Unit] Description=Provisioning Certificate Caching Service (PCCS) Documentation=https://github.com/intel/SGXDataCenterAttestationPrimitives/blob/master/QuoteGeneration/pccs/README.md -After=syslog.target network.target auditd.service mpa_registration.service +After=syslog.target network.target auditd.service ConditionPathExists=/dev/sgx_enclave -Requires=mpa_registration.service [Service] Type=simple From 4c8f4904257797d68f52d05f9259c59f3ac96389 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Tue, 6 Jan 2026 18:15:05 +0100 Subject: [PATCH 21/25] sgx-pccs-admin: Migrate from deprecated pkg_resources to packaging --- ...rop-use-of-bundled-pre-built-openssl.patch | 4 +- ...mprove-debuggability-of-build-system.patch | 4 +- ...me-setting-of-enclave-load-directory.patch | 4 +- ...ed-sgx_urts-library-in-PCKRetrievalT.patch | 4 +- ...-only-import-pypac-module-on-Windows.patch | 4 +- ...-PCKRetrievalTool-config-file-in-etc.patch | 4 +- ...XFLAGS-LDFLAGS-for-various-tools-and.patch | 4 +- ...tween-program-name-first-arg-in-usag.patch | 4 +- ...nst-format-strings-in-QL-log-message.patch | 4 +- ...d-debug-parameter-to-control-logging.patch | 4 +- ...-leftover-debugging-print-args-state.patch | 4 +- ...sion-for-libsgx_qe3_logic.so-library.patch | 4 +- 0112-Workaround-broken-GCC-15.patch | 4 +- ...-Don-t-disable-cf-protection-for-qgs.patch | 4 +- ...ecks-for-GCC-version-that-break-fsta.patch | 4 +- ...se-distro-provided-rapidjson-package.patch | 4 +- 0116-Don-t-stomp-on-VERBOSE-variable.patch | 4 +- ...-MODE-parameter-for-UNIX-socket-mode.patch | 4 +- ...pccs-sanitize-paths-to-all-resources.patch | 4 +- 0119-pccs-only-pass-ApiKey-if-it-is-set.patch | 4 +- ...csadmin-make-keyring-module-optional.patch | 4 +- ...rt-from-asn1-to-pyasn1-python-module.patch | 4 +- ...switch-to-pycryptography-for-CRL-ver.patch | 4 +- ...re-of-pycryptography-instead-of-pyop.patch | 4 +- ...prefer-pycryptography-over-pyopenssl.patch | 4 +- ...llback-for-when-pyopenssl-is-not-ava.patch | 4 +- ...e-errors-trying-to-clear-the-keyring.patch | 75 +++++++++++++++++-- ...Migrate-from-deprecated-pkg_resource.patch | 51 +++++++++++++ linux-sgx.spec | 4 +- 29 files changed, 176 insertions(+), 58 deletions(-) create mode 100644 0127-PCS-Client-Tool-Migrate-from-deprecated-pkg_resource.patch diff --git a/0100-Drop-use-of-bundled-pre-built-openssl.patch b/0100-Drop-use-of-bundled-pre-built-openssl.patch index c255488..ca21c1e 100644 --- a/0100-Drop-use-of-bundled-pre-built-openssl.patch +++ b/0100-Drop-use-of-bundled-pre-built-openssl.patch @@ -1,7 +1,7 @@ From cf39f86bcca57579013cee5967d39cdaca15cbc4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Mon, 26 Feb 2024 12:19:51 +0000 -Subject: [PATCH 100/126] Drop use of bundled pre-built openssl +Subject: [PATCH 100/127] Drop use of bundled pre-built openssl MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -188,5 +188,5 @@ index a20a3cd..c8e1d01 100644 debug: $(PCKCERTSEL_VERBOSE)$(MAKE) DEBUG=1 all -- -2.51.1 +2.52.0 diff --git a/0101-Improve-debuggability-of-build-system.patch b/0101-Improve-debuggability-of-build-system.patch index 7194b9f..03b8ebd 100644 --- a/0101-Improve-debuggability-of-build-system.patch +++ b/0101-Improve-debuggability-of-build-system.patch @@ -1,7 +1,7 @@ From b36d8f61a5a18dc5edfbd632e5f2373bcf365b3e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 1 Mar 2024 12:05:01 +0000 -Subject: [PATCH 101/126] Improve debuggability of build system +Subject: [PATCH 101/127] Improve debuggability of build system MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -128,5 +128,5 @@ index 894e616..7962d10 100644 .PHONY: qal qal: -- -2.51.1 +2.52.0 diff --git a/0102-Support-build-time-setting-of-enclave-load-directory.patch b/0102-Support-build-time-setting-of-enclave-load-directory.patch index cc70f8c..3bbee13 100644 --- a/0102-Support-build-time-setting-of-enclave-load-directory.patch +++ b/0102-Support-build-time-setting-of-enclave-load-directory.patch @@ -1,7 +1,7 @@ From 9a185a6103e9637b785e498d4c4e4c990e7a3478 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Mon, 26 Feb 2024 12:19:51 +0000 -Subject: [PATCH 102/126] Support build time setting of enclave load directory +Subject: [PATCH 102/127] Support build time setting of enclave load directory MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -259,5 +259,5 @@ index d9c2bac..1065949 100644 App_Link_Flags += -lcurl -ldl -lpthread ifeq ($(STANDALONE), 1) -- -2.51.1 +2.52.0 diff --git a/0103-Look-for-versioned-sgx_urts-library-in-PCKRetrievalT.patch b/0103-Look-for-versioned-sgx_urts-library-in-PCKRetrievalT.patch index fd8a18b..c3c678c 100644 --- a/0103-Look-for-versioned-sgx_urts-library-in-PCKRetrievalT.patch +++ b/0103-Look-for-versioned-sgx_urts-library-in-PCKRetrievalT.patch @@ -1,7 +1,7 @@ From b92d97f6037cb2e56d343cb979767d51655b097f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Tue, 27 Feb 2024 15:46:41 +0000 -Subject: [PATCH 103/126] Look for versioned sgx_urts library in +Subject: [PATCH 103/127] Look for versioned sgx_urts library in PCKRetrievalTool MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 @@ -40,5 +40,5 @@ index d77a6eb..d195717 100644 } #endif -- -2.51.1 +2.52.0 diff --git a/0104-pccsadmin-only-import-pypac-module-on-Windows.patch b/0104-pccsadmin-only-import-pypac-module-on-Windows.patch index 601a663..164076d 100644 --- a/0104-pccsadmin-only-import-pypac-module-on-Windows.patch +++ b/0104-pccsadmin-only-import-pypac-module-on-Windows.patch @@ -1,7 +1,7 @@ From eca1c479b23dd8e8c87e90988204c08b5e0c3edc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 4 Oct 2024 17:41:37 +0100 -Subject: [PATCH 104/126] pccsadmin: only import 'pypac' module on Windows +Subject: [PATCH 104/127] pccsadmin: only import 'pypac' module on Windows MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -31,5 +31,5 @@ index 9f1d224..046c781 100644 from requests.adapters import HTTPAdapter from urllib3.util import Retry -- -2.51.1 +2.52.0 diff --git a/0105-Look-for-PCKRetrievalTool-config-file-in-etc.patch b/0105-Look-for-PCKRetrievalTool-config-file-in-etc.patch index ad4eed1..a31ed50 100644 --- a/0105-Look-for-PCKRetrievalTool-config-file-in-etc.patch +++ b/0105-Look-for-PCKRetrievalTool-config-file-in-etc.patch @@ -1,7 +1,7 @@ From c8820c38a16ba9c572a6eafefd010b60ba037dde Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 29 Feb 2024 14:21:36 +0000 -Subject: [PATCH 105/126] Look for PCKRetrievalTool config file in /etc/ +Subject: [PATCH 105/127] Look for PCKRetrievalTool config file in /etc/ MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -39,5 +39,5 @@ index e423f38..36f219b 100644 if(strnlen(local_configuration_file_path ,MAX_PATH)+strnlen(LOCAL_NETWORK_SETTING,MAX_PATH)+sizeof(char) > MAX_PATH) { return false; -- -2.51.1 +2.52.0 diff --git a/0106-Honour-CFLAGS-CXXFLAGS-LDFLAGS-for-various-tools-and.patch b/0106-Honour-CFLAGS-CXXFLAGS-LDFLAGS-for-various-tools-and.patch index 353b690..2aae71f 100644 --- a/0106-Honour-CFLAGS-CXXFLAGS-LDFLAGS-for-various-tools-and.patch +++ b/0106-Honour-CFLAGS-CXXFLAGS-LDFLAGS-for-various-tools-and.patch @@ -1,7 +1,7 @@ From 06874f59bd6693f0f42a999dcfbdc0233d9a4bd2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 28 Mar 2025 16:00:27 +0000 -Subject: [PATCH 106/126] Honour CFLAGS/CXXFLAGS/LDFLAGS for various tools and +Subject: [PATCH 106/127] Honour CFLAGS/CXXFLAGS/LDFLAGS for various tools and libraries MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 @@ -205,5 +205,5 @@ index 4937fe9..83aefee 100644 LDFLAGS += '-Wl,-rpath,$$ORIGIN' CXXFLAGS += '-DSTANDALONE' -- -2.51.1 +2.52.0 diff --git a/0107-qgs-add-space-between-program-name-first-arg-in-usag.patch b/0107-qgs-add-space-between-program-name-first-arg-in-usag.patch index e624100..c05c414 100644 --- a/0107-qgs-add-space-between-program-name-first-arg-in-usag.patch +++ b/0107-qgs-add-space-between-program-name-first-arg-in-usag.patch @@ -1,7 +1,7 @@ From 44eefb7f574b33cb0cf5239948e7d633f1d71dd5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 3 Oct 2024 14:42:29 +0100 -Subject: [PATCH 107/126] qgs: add space between program name & first arg in +Subject: [PATCH 107/127] qgs: add space between program name & first arg in usage MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 @@ -35,5 +35,5 @@ index 478dbfe..3618b5a 100644 exit(1); } -- -2.51.1 +2.52.0 diff --git a/0108-qgs-protect-against-format-strings-in-QL-log-message.patch b/0108-qgs-protect-against-format-strings-in-QL-log-message.patch index d368b81..692ead3 100644 --- a/0108-qgs-protect-against-format-strings-in-QL-log-message.patch +++ b/0108-qgs-protect-against-format-strings-in-QL-log-message.patch @@ -1,7 +1,7 @@ From 6c38e13fbee555045aec98f6e159531a385bce53 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 4 Oct 2024 09:43:17 +0100 -Subject: [PATCH 108/126] qgs: protect against format strings in QL log +Subject: [PATCH 108/127] qgs: protect against format strings in QL log messages MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 @@ -35,5 +35,5 @@ index 77838c3..1e97b58 100644 } -- -2.51.1 +2.52.0 diff --git a/0109-qgs-add-debug-parameter-to-control-logging.patch b/0109-qgs-add-debug-parameter-to-control-logging.patch index a5f845b..dcb2fd9 100644 --- a/0109-qgs-add-debug-parameter-to-control-logging.patch +++ b/0109-qgs-add-debug-parameter-to-control-logging.patch @@ -1,7 +1,7 @@ From d1cbef970b8ee800a313b818927449a7dcf1a685 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 3 Oct 2024 16:57:35 +0100 -Subject: [PATCH 109/126] qgs: add --debug parameter to control logging +Subject: [PATCH 109/127] qgs: add --debug parameter to control logging MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -125,5 +125,5 @@ index 3618b5a..47f6c26 100644 exit(1); } -- -2.51.1 +2.52.0 diff --git a/0110-pccsadmin-remove-leftover-debugging-print-args-state.patch b/0110-pccsadmin-remove-leftover-debugging-print-args-state.patch index f56c48e..49836fd 100644 --- a/0110-pccsadmin-remove-leftover-debugging-print-args-state.patch +++ b/0110-pccsadmin-remove-leftover-debugging-print-args-state.patch @@ -1,7 +1,7 @@ From 64c49b04e7e22358f3afee834a434a6cfdff4a9b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Tue, 8 Oct 2024 10:13:02 +0100 -Subject: [PATCH 110/126] pccsadmin: remove leftover debugging 'print(args)' +Subject: [PATCH 110/127] pccsadmin: remove leftover debugging 'print(args)' statement MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 @@ -29,5 +29,5 @@ index ffee326..8e447c5 100755 if args.command == 'put' and args.url and args.url.endswith("/appraisalpolicy"): if not args.fmspc or not args.input_file: -- -2.51.1 +2.52.0 diff --git a/0111-Fix-soname-version-for-libsgx_qe3_logic.so-library.patch b/0111-Fix-soname-version-for-libsgx_qe3_logic.so-library.patch index 1fb849c..6324353 100644 --- a/0111-Fix-soname-version-for-libsgx_qe3_logic.so-library.patch +++ b/0111-Fix-soname-version-for-libsgx_qe3_logic.so-library.patch @@ -1,7 +1,7 @@ From 32ac12f933e813b80348840821e1deaedf797a00 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 17 Jan 2025 15:39:39 +0000 -Subject: [PATCH 111/126] Fix soname version for libsgx_qe3_logic.so library +Subject: [PATCH 111/127] Fix soname version for libsgx_qe3_logic.so library MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -51,5 +51,5 @@ index 9b8c936..c92d782 100644 $(BUILD_DIR): -- -2.51.1 +2.52.0 diff --git a/0112-Workaround-broken-GCC-15.patch b/0112-Workaround-broken-GCC-15.patch index 24538f4..7828421 100644 --- a/0112-Workaround-broken-GCC-15.patch +++ b/0112-Workaround-broken-GCC-15.patch @@ -1,7 +1,7 @@ From ac446d8943858e6dccec924451b8a8a3be4d9c4a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 6 Feb 2025 20:08:59 +0000 -Subject: [PATCH 112/126] Workaround broken GCC 15 +Subject: [PATCH 112/127] Workaround broken GCC 15 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -36,5 +36,5 @@ index 15fbdd4..4400544 100644 private: struct alignas(A)_T_instantiator_ -- -2.51.1 +2.52.0 diff --git a/0113-Don-t-disable-cf-protection-for-qgs.patch b/0113-Don-t-disable-cf-protection-for-qgs.patch index 4b5628d..68dd345 100644 --- a/0113-Don-t-disable-cf-protection-for-qgs.patch +++ b/0113-Don-t-disable-cf-protection-for-qgs.patch @@ -1,7 +1,7 @@ From fa8c4f150fe32dafd875c5f45a9e588775235e35 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Wed, 2 Apr 2025 18:39:31 +0100 -Subject: [PATCH 113/126] Don't disable cf-protection for qgs +Subject: [PATCH 113/127] Don't disable cf-protection for qgs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -27,5 +27,5 @@ index 8228bdf..5116d85 100644 DEPENDS = ${QGS_OBJS test_client.o:.o=.d} -- -2.51.1 +2.52.0 diff --git a/0114-Delete-broken-checks-for-GCC-version-that-break-fsta.patch b/0114-Delete-broken-checks-for-GCC-version-that-break-fsta.patch index 9cb4dca..462009e 100644 --- a/0114-Delete-broken-checks-for-GCC-version-that-break-fsta.patch +++ b/0114-Delete-broken-checks-for-GCC-version-that-break-fsta.patch @@ -1,7 +1,7 @@ From 2d83da9d5f5fb7399b0d7ec6ac410a6bf52b2add Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 3 Apr 2025 17:44:48 +0100 -Subject: [PATCH 114/126] Delete broken checks for GCC version that break +Subject: [PATCH 114/127] Delete broken checks for GCC version that break -fstack-protector-strong MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 @@ -201,5 +201,5 @@ index b6968c6..1d2106b 100644 ifdef DEBUG COMMON_FLAGS += -O0 -ggdb -DDEBUG -UNDEBUG -- -2.51.1 +2.52.0 diff --git a/0115-Use-distro-provided-rapidjson-package.patch b/0115-Use-distro-provided-rapidjson-package.patch index 802658f..0c6a8e4 100644 --- a/0115-Use-distro-provided-rapidjson-package.patch +++ b/0115-Use-distro-provided-rapidjson-package.patch @@ -1,7 +1,7 @@ From 40d434d75ff4978cd968b4d140af5aa8c8f602c2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Mon, 26 Feb 2024 12:19:51 +0000 -Subject: [PATCH 115/126] Use distro provided rapidjson package +Subject: [PATCH 115/127] Use distro provided rapidjson package MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -170,5 +170,5 @@ index c8e1d01..6f1440a 100644 # the library shared object name LIB_NAME := libPCKCertSelection.a -- -2.51.1 +2.52.0 diff --git a/0116-Don-t-stomp-on-VERBOSE-variable.patch b/0116-Don-t-stomp-on-VERBOSE-variable.patch index 629715a..85294ea 100644 --- a/0116-Don-t-stomp-on-VERBOSE-variable.patch +++ b/0116-Don-t-stomp-on-VERBOSE-variable.patch @@ -1,7 +1,7 @@ From 605d9bcc0003c869e785376bbc3dbecc670c934d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Wed, 16 Apr 2025 11:48:52 +0100 -Subject: [PATCH 116/126] Don't stomp on "VERBOSE" variable +Subject: [PATCH 116/127] Don't stomp on "VERBOSE" variable MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -97,5 +97,5 @@ index 3d474bb..0f593f5 100644 - $(VERBOSE) rm -vrf $(TARGET) $(SIGNING_MATERIAL) + $(CMD_VERBOSE) rm -vrf $(TARGET) $(SIGNING_MATERIAL) -- -2.51.1 +2.52.0 diff --git a/0117-qgs-add-m-MODE-parameter-for-UNIX-socket-mode.patch b/0117-qgs-add-m-MODE-parameter-for-UNIX-socket-mode.patch index 2521be9..47e7db5 100644 --- a/0117-qgs-add-m-MODE-parameter-for-UNIX-socket-mode.patch +++ b/0117-qgs-add-m-MODE-parameter-for-UNIX-socket-mode.patch @@ -1,7 +1,7 @@ From d7299915f42cd068744ce02e358865085f2f12bf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 2 May 2025 14:48:24 +0100 -Subject: [PATCH 117/126] qgs: add -m=MODE parameter for UNIX socket mode +Subject: [PATCH 117/127] qgs: add -m=MODE parameter for UNIX socket mode MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -99,5 +99,5 @@ index 47f6c26..4628b18 100644 io_service.run(); QGS_LOG_INFO("Quit main loop\n"); -- -2.51.1 +2.52.0 diff --git a/0118-pccs-sanitize-paths-to-all-resources.patch b/0118-pccs-sanitize-paths-to-all-resources.patch index 71d621f..2f9cb2e 100644 --- a/0118-pccs-sanitize-paths-to-all-resources.patch +++ b/0118-pccs-sanitize-paths-to-all-resources.patch @@ -1,7 +1,7 @@ From b108e8c9a0c9143e8fd930186c21d34d9cddaea7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Tue, 27 Feb 2024 13:38:49 +0000 -Subject: [PATCH 118/126] pccs: sanitize paths to all resources +Subject: [PATCH 118/127] pccs: sanitize paths to all resources MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -104,5 +104,5 @@ index 6f910ee..6eb9d15 100644 const migration = migrations.find(migration => migration.name === name); logger.debug(`Resolving migration: ${name}, found: ${migration ? migration.name : 'none'}`); -- -2.51.1 +2.52.0 diff --git a/0119-pccs-only-pass-ApiKey-if-it-is-set.patch b/0119-pccs-only-pass-ApiKey-if-it-is-set.patch index d405074..84dca13 100644 --- a/0119-pccs-only-pass-ApiKey-if-it-is-set.patch +++ b/0119-pccs-only-pass-ApiKey-if-it-is-set.patch @@ -1,7 +1,7 @@ From 6c6e7427cf14455a56828db5c39f26ca8658a18d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Wed, 9 Jul 2025 16:41:59 +0100 -Subject: [PATCH 119/126] pccs: only pass ApiKey if it is set +Subject: [PATCH 119/127] pccs: only pass ApiKey if it is set MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -67,5 +67,5 @@ index 99ccea6..4f6c903 100644 } -- -2.51.1 +2.52.0 diff --git a/0120-pccsadmin-make-keyring-module-optional.patch b/0120-pccsadmin-make-keyring-module-optional.patch index 73bc6a5..5bc3615 100644 --- a/0120-pccsadmin-make-keyring-module-optional.patch +++ b/0120-pccsadmin-make-keyring-module-optional.patch @@ -1,7 +1,7 @@ From 2b540452538b12a47340b03d6118d3df281a6638 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 4 Dec 2025 13:31:54 +0000 -Subject: [PATCH 120/126] pccsadmin: make 'keyring' module optional +Subject: [PATCH 120/127] pccsadmin: make 'keyring' module optional MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -100,5 +100,5 @@ index 638cd88..cebecad 100644 + return False return True -- -2.51.1 +2.52.0 diff --git a/0121-pccsadmin-convert-from-asn1-to-pyasn1-python-module.patch b/0121-pccsadmin-convert-from-asn1-to-pyasn1-python-module.patch index 004b8ef..9114f2a 100644 --- a/0121-pccsadmin-convert-from-asn1-to-pyasn1-python-module.patch +++ b/0121-pccsadmin-convert-from-asn1-to-pyasn1-python-module.patch @@ -1,7 +1,7 @@ From b9954581944446455876728bdab816090d773715 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 4 Dec 2025 13:54:19 +0000 -Subject: [PATCH 121/126] pccsadmin: convert from asn1 to pyasn1 python module +Subject: [PATCH 121/127] pccsadmin: convert from asn1 to pyasn1 python module MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -337,5 +337,5 @@ index 97aa278..eaed331 100644 + ent= list(filter(lambda e: e['tCBId'] == id_ce_tCB_pCESVN, tcb))[0] + return int(ent["tCBValue"]).to_bytes(2, byteorder='little').hex() -- -2.51.1 +2.52.0 diff --git a/0122-pccsadmin-fully-switch-to-pycryptography-for-CRL-ver.patch b/0122-pccsadmin-fully-switch-to-pycryptography-for-CRL-ver.patch index ed1ec4f..f2fc034 100644 --- a/0122-pccsadmin-fully-switch-to-pycryptography-for-CRL-ver.patch +++ b/0122-pccsadmin-fully-switch-to-pycryptography-for-CRL-ver.patch @@ -1,7 +1,7 @@ From d44b9ac3e89e17452678758634e6dbca6c5a099a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Mon, 8 Dec 2025 17:47:01 +0000 -Subject: [PATCH 122/126] pccsadmin: fully switch to pycryptography for CRL +Subject: [PATCH 122/127] pccsadmin: fully switch to pycryptography for CRL verification MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 @@ -63,5 +63,5 @@ index 046c781..e68864d 100644 if not self.verify_crl_trust(pychain, pycrl): self.error("Could not validate certificate using trust chain") -- -2.51.1 +2.52.0 diff --git a/0123-pccsadmin-use-more-of-pycryptography-instead-of-pyop.patch b/0123-pccsadmin-use-more-of-pycryptography-instead-of-pyop.patch index 64ff5bd..3d2f6da 100644 --- a/0123-pccsadmin-use-more-of-pycryptography-instead-of-pyop.patch +++ b/0123-pccsadmin-use-more-of-pycryptography-instead-of-pyop.patch @@ -1,7 +1,7 @@ From d14f914ea644d7c1b2312780688d55fbb13892bc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Mon, 8 Dec 2025 17:48:11 +0000 -Subject: [PATCH 123/126] pccsadmin: use more of pycryptography instead of +Subject: [PATCH 123/127] pccsadmin: use more of pycryptography instead of pyopenssl MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 @@ -174,5 +174,5 @@ index e68864d..f6b58a6 100644 if issuer_subject not in issuer_to: self.error('cert in chain with no issuer') -- -2.51.1 +2.52.0 diff --git a/0124-pccsadmin-prefer-pycryptography-over-pyopenssl.patch b/0124-pccsadmin-prefer-pycryptography-over-pyopenssl.patch index eeb6a83..84b7d27 100644 --- a/0124-pccsadmin-prefer-pycryptography-over-pyopenssl.patch +++ b/0124-pccsadmin-prefer-pycryptography-over-pyopenssl.patch @@ -1,7 +1,7 @@ From 9d3da2fd99ba2832fcaa4067dd5db3f7f349c306 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Wed, 3 Dec 2025 17:59:09 +0000 -Subject: [PATCH 124/126] pccsadmin: prefer pycryptography over pyopenssl +Subject: [PATCH 124/127] pccsadmin: prefer pycryptography over pyopenssl MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -100,5 +100,5 @@ index f6b58a6..eeb2969 100644 return True -- -2.51.1 +2.52.0 diff --git a/0125-pccsadmin-add-fallback-for-when-pyopenssl-is-not-ava.patch b/0125-pccsadmin-add-fallback-for-when-pyopenssl-is-not-ava.patch index f102412..9076f19 100644 --- a/0125-pccsadmin-add-fallback-for-when-pyopenssl-is-not-ava.patch +++ b/0125-pccsadmin-add-fallback-for-when-pyopenssl-is-not-ava.patch @@ -1,7 +1,7 @@ From 262c1cb978d31130d3558d2a29690b1eace52c64 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Mon, 8 Dec 2025 17:56:59 +0000 -Subject: [PATCH 125/126] pccsadmin: add fallback for when pyopenssl is not +Subject: [PATCH 125/127] pccsadmin: add fallback for when pyopenssl is not available MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 @@ -71,5 +71,5 @@ index eeb2969..1368b57 100644 return True -- -2.51.1 +2.52.0 diff --git a/0126-pccsadmin-ignore-errors-trying-to-clear-the-keyring.patch b/0126-pccsadmin-ignore-errors-trying-to-clear-the-keyring.patch index dfcbd1c..f1a8ecf 100644 --- a/0126-pccsadmin-ignore-errors-trying-to-clear-the-keyring.patch +++ b/0126-pccsadmin-ignore-errors-trying-to-clear-the-keyring.patch @@ -1,7 +1,7 @@ -From 8081c78698b7a1e5ec183eca3318f98396680545 Mon Sep 17 00:00:00 2001 +From 48f3dc21602f2f11f054c740c5efd4c34d5efae6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 4 Dec 2025 18:05:14 +0000 -Subject: [PATCH 126/126] pccsadmin: ignore errors trying to clear the keyring +Subject: [PATCH 126/127] pccsadmin: ignore errors trying to clear the keyring MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -13,8 +13,9 @@ prompted, so there would be nothing to clear either in this case. Signed-off-by: Daniel P. Berrangé --- - tools/PccsAdminTool/lib/intelsgx/pcs.py | 16 ++++++++++++++-- - 1 file changed, 14 insertions(+), 2 deletions(-) + tools/PccsAdminTool/lib/intelsgx/pcs.py | 16 +++++++++++-- + tools/PccsAdminTool/pccsadmin.py | 32 +++++++++++++++++++++---- + 2 files changed, 42 insertions(+), 6 deletions(-) diff --git a/tools/PccsAdminTool/lib/intelsgx/pcs.py b/tools/PccsAdminTool/lib/intelsgx/pcs.py index 1368b57..dd4eba4 100644 @@ -50,6 +51,70 @@ index 1368b57..dd4eba4 100644 return None # Verify expected headers +diff --git a/tools/PccsAdminTool/pccsadmin.py b/tools/PccsAdminTool/pccsadmin.py +index 8e447c5..dc5253b 100755 +--- a/tools/PccsAdminTool/pccsadmin.py ++++ b/tools/PccsAdminTool/pccsadmin.py +@@ -166,7 +166,13 @@ class PccsClient: + if response.status_code == 200: + self._write_output_file(output_file, response) + elif response.status_code == 401: # Authentication error +- self.credentials.set_admin_token('') ++ try: ++ self.credentials.set_admin_token('') ++ except: ++ # If keyring is unavailable, we don't want to trigger ++ # traceback, as the user may have declined to save ++ # the key in the keyring earlier ++ pass + print("Authentication failed.") + else: + self._handle_error(response) +@@ -196,7 +202,13 @@ class PccsClient: + if response.status_code == 200: + print("Collaterals uploaded successfully.") + elif response.status_code == 401: # Authentication error +- self.credentials.set_admin_token('') ++ try: ++ self.credentials.set_admin_token('') ++ except: ++ # If keyring is unavailable, we don't want to trigger ++ # traceback, as the user may have declined to save ++ # the key in the keyring earlier ++ pass + print("Authentication failed.") + else: + self._handle_error(response) +@@ -212,7 +224,13 @@ class PccsClient: + if response.status_code == 200: + print("Policy uploaded successfully with policy ID :" + response.text) + elif response.status_code == 401: # Authentication error +- self.credentials.set_admin_token('') ++ try: ++ self.credentials.set_admin_token('') ++ except: ++ # If keyring is unavailable, we don't want to trigger ++ # traceback, as the user may have declined to save ++ # the key in the keyring earlier ++ pass + print("Authentication failed.") + else: + self._handle_error(response) +@@ -245,7 +263,13 @@ class PccsClient: + if response.status_code == 200: + print("The cache database was refreshed successfully.") + elif response.status_code == 401: # Authentication error +- self.credentials.set_admin_token('') ++ try: ++ self.credentials.set_admin_token('') ++ except: ++ # If keyring is unavailable, we don't want to trigger ++ # traceback, as the user may have declined to save ++ # the key in the keyring earlier ++ pass + print("Authentication failed.") + else: + self._handle_error(response) -- -2.51.1 +2.52.0 diff --git a/0127-PCS-Client-Tool-Migrate-from-deprecated-pkg_resource.patch b/0127-PCS-Client-Tool-Migrate-from-deprecated-pkg_resource.patch new file mode 100644 index 0000000..e453b97 --- /dev/null +++ b/0127-PCS-Client-Tool-Migrate-from-deprecated-pkg_resource.patch @@ -0,0 +1,51 @@ +From f0222324f5896d08457ed0ffb3951081d66e0cf0 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= +Date: Tue, 6 Jan 2026 18:03:36 +0100 +Subject: [PATCH 127/127] [PCS Client Tool] Migrate from deprecated + pkg_resources to packaging +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Miro Hrončok + +Version 14.0 is the first version that had the Version class. + +Ref: https://setuptools.pypa.io/en/latest/pkg_resources.html + +Signed-off-by: Miro Hrončok +--- + tools/PccsAdminTool/lib/intelsgx/pcs.py | 2 +- + tools/PccsAdminTool/requirements.txt | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/PccsAdminTool/lib/intelsgx/pcs.py b/tools/PccsAdminTool/lib/intelsgx/pcs.py +index dd4eba4..7596708 100644 +--- a/tools/PccsAdminTool/lib/intelsgx/pcs.py ++++ b/tools/PccsAdminTool/lib/intelsgx/pcs.py +@@ -39,7 +39,7 @@ if system() == 'Windows': + from lib.intelsgx.credential import Credentials + from requests.adapters import HTTPAdapter + from urllib3.util import Retry +-from pkg_resources import parse_version ++from packaging.version import Version as parse_version + + certBegin= '-----BEGIN CERTIFICATE-----' + certEnd= '-----END CERTIFICATE-----' +diff --git a/tools/PccsAdminTool/requirements.txt b/tools/PccsAdminTool/requirements.txt +index 8a73667..65f6bf5 100644 +--- a/tools/PccsAdminTool/requirements.txt ++++ b/tools/PccsAdminTool/requirements.txt +@@ -1,8 +1,8 @@ + asn1>=2.4.1 + cryptography>=41.0.7 + keyring>=23.0.0 ++packaging>=14.0 + pyOpenSSL>=23.2.0,<24.3.0 + pypac>=0.14.0 + Requests>=2.31.0 +-setuptools>=65.5.1 + urllib3>=1.26.18 +-- +2.52.0 + diff --git a/linux-sgx.spec b/linux-sgx.spec index 11bca04..902112f 100644 --- a/linux-sgx.spec +++ b/linux-sgx.spec @@ -374,6 +374,8 @@ Patch0123: 0123-pccsadmin-use-more-of-pycryptography-instead-of-pyop.patch Patch0124: 0124-pccsadmin-prefer-pycryptography-over-pyopenssl.patch Patch0125: 0125-pccsadmin-add-fallback-for-when-pyopenssl-is-not-ava.patch Patch0126: 0126-pccsadmin-ignore-errors-trying-to-clear-the-keyring.patch +# https://github.com/intel/confidential-computing.tee.dcap/pull/485 +Patch0127: 0127-pccsadmin-migrate-from-deprecated-pkg_resources.patch # 0200-0299 -> against intel-sgx-ssl.git Patch0200: 0200-Enable-pointing-sgxssl-build-to-alternative-glibc-he.patch @@ -541,7 +543,7 @@ Requires: python3-keyring %endif Requires: python3-requests Requires: python3-urllib3 -Requires: python3-setuptools +Requires: python3-packaging %if 0%{?rhel} Requires: openssl %endif From 64d658466d956d3abacacffd08dec303d732d734 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Tue, 6 Jan 2026 17:45:38 +0000 Subject: [PATCH 22/25] Fix name of patch 0127 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit [skip changelog] Signed-off-by: Daniel P. Berrangé --- linux-sgx.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/linux-sgx.spec b/linux-sgx.spec index 902112f..7fc660e 100644 --- a/linux-sgx.spec +++ b/linux-sgx.spec @@ -375,7 +375,7 @@ Patch0124: 0124-pccsadmin-prefer-pycryptography-over-pyopenssl.patch Patch0125: 0125-pccsadmin-add-fallback-for-when-pyopenssl-is-not-ava.patch Patch0126: 0126-pccsadmin-ignore-errors-trying-to-clear-the-keyring.patch # https://github.com/intel/confidential-computing.tee.dcap/pull/485 -Patch0127: 0127-pccsadmin-migrate-from-deprecated-pkg_resources.patch +Patch0127: 0127-PCS-Client-Tool-Migrate-from-deprecated-pkg_resource.patch # 0200-0299 -> against intel-sgx-ssl.git Patch0200: 0200-Enable-pointing-sgxssl-build-to-alternative-glibc-he.patch From 00a038c816797b790d6c752c84848d70d37395a2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Wed, 7 Jan 2026 09:25:51 +0000 Subject: [PATCH 23/25] Fixes for GCC 16 build failures MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Daniel P. Berrangé --- ...building-against-host-openssl-crypto.patch | 4 +- ...r-building-against-host-tinyxml2-lib.patch | 4 +- ...building-against-host-CppMicroServic.patch | 4 +- 0003-Improve-make-debuggability.patch | 4 +- ...-disabling-use-of-git-for-ippcp-code.patch | 4 +- ...openmp-protobuf-sample_crypto-builds.patch | 4 +- 0006-Fix-compat-with-gcc-14.patch | 4 +- ...ix-escaping-of-regexes-in-sgx-asm-pp.patch | 4 +- ...er-dev-sgx_provision-dev-sgx_enclave.patch | 4 +- ...soname-for-libuae_service.so-library.patch | 4 +- ...cl-remove-redundant-use-of-bool-type.patch | 4 +- ...-CFLAGS-LDFLAGS-set-from-environment.patch | 4 +- ...-psw-make-aesm_service-build-verbose.patch | 4 +- ...dern-C-function-prototype-compliance.patch | 4 +- ...wrapper-for-nasm-to-fix-cmake-compat.patch | 4 +- 0015-fix-BOM-for-pccs-with-DCAP-1.23.patch | 4 +- ...e-due-to-attribute-regparam-with-GCC.patch | 83 +++++++++++++++++++ linux-sgx.spec | 1 + 18 files changed, 116 insertions(+), 32 deletions(-) create mode 100644 0016-sdk-avoid-failure-due-to-attribute-regparam-with-GCC.patch diff --git a/0000-Add-support-for-building-against-host-openssl-crypto.patch b/0000-Add-support-for-building-against-host-openssl-crypto.patch index 381ce62..dd01792 100644 --- a/0000-Add-support-for-building-against-host-openssl-crypto.patch +++ b/0000-Add-support-for-building-against-host-openssl-crypto.patch @@ -1,7 +1,7 @@ From d4f132e1363779aef2c4209789ca364e27f45bb2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 13 Feb 2025 14:12:38 +0000 -Subject: [PATCH 00/15] Add support for building against host openssl crypto +Subject: [PATCH 00/16] Add support for building against host openssl crypto lib MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 @@ -212,5 +212,5 @@ index e756d468..ea8ca78c 100644 .PHONY: all -- -2.49.0 +2.52.0 diff --git a/0001-Add-support-for-building-against-host-tinyxml2-lib.patch b/0001-Add-support-for-building-against-host-tinyxml2-lib.patch index 3bc516f..64d17e8 100644 --- a/0001-Add-support-for-building-against-host-tinyxml2-lib.patch +++ b/0001-Add-support-for-building-against-host-tinyxml2-lib.patch @@ -1,7 +1,7 @@ From e372a1a009f1de14ea5ee01ec022633d88f6d234 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 13 Feb 2025 14:01:10 +0000 -Subject: [PATCH 01/15] Add support for building against host tinyxml2 lib +Subject: [PATCH 01/16] Add support for building against host tinyxml2 lib MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -80,5 +80,5 @@ index ed177c86..1dcb6f51 100644 sgx_sign: $(OBJS) enclaveparser -- -2.49.0 +2.52.0 diff --git a/0002-Add-support-for-building-against-host-CppMicroServic.patch b/0002-Add-support-for-building-against-host-CppMicroServic.patch index b7eff37..742b79e 100644 --- a/0002-Add-support-for-building-against-host-CppMicroServic.patch +++ b/0002-Add-support-for-building-against-host-CppMicroServic.patch @@ -1,7 +1,7 @@ From 02f4535633d317894629f30daf0583fddcdf3f1c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 13 Feb 2025 14:01:10 +0000 -Subject: [PATCH 02/15] Add support for building against host CppMicroServices +Subject: [PATCH 02/16] Add support for building against host CppMicroServices lib MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 @@ -138,5 +138,5 @@ index da3e0b77..89b3e3ae 100644 cmake_minimum_required(VERSION ${US_CMAKE_MINIMUM_REQUIRED_VERSION}) cmake_policy(VERSION ${US_CMAKE_MINIMUM_REQUIRED_VERSION}) -- -2.49.0 +2.52.0 diff --git a/0003-Improve-make-debuggability.patch b/0003-Improve-make-debuggability.patch index 13afe6d..2f49bbd 100644 --- a/0003-Improve-make-debuggability.patch +++ b/0003-Improve-make-debuggability.patch @@ -1,7 +1,7 @@ From e607f7279049d2db090a2bef9c7943cdb55d9de6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 1 Mar 2024 12:53:26 +0000 -Subject: [PATCH 03/15] Improve make debuggability +Subject: [PATCH 03/16] Improve make debuggability MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -70,5 +70,5 @@ index d1ac38a1..5fb90c21 100644 .PHONY: clean -- -2.49.0 +2.52.0 diff --git a/0004-Support-disabling-use-of-git-for-ippcp-code.patch b/0004-Support-disabling-use-of-git-for-ippcp-code.patch index 63b8cc1..154b484 100644 --- a/0004-Support-disabling-use-of-git-for-ippcp-code.patch +++ b/0004-Support-disabling-use-of-git-for-ippcp-code.patch @@ -1,7 +1,7 @@ From 8d858334aeade0a0063456fa03cdbc3f6a55d51f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 13 Feb 2025 14:37:24 +0000 -Subject: [PATCH 04/15] Support disabling use of git for ippcp code +Subject: [PATCH 04/16] Support disabling use of git for ippcp code MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -45,5 +45,5 @@ index a57c22a9..d78ba90e 100644 .PHONY: clean -- -2.49.0 +2.52.0 diff --git a/0005-disable-openmp-protobuf-sample_crypto-builds.patch b/0005-disable-openmp-protobuf-sample_crypto-builds.patch index 94b2deb..48f5b80 100644 --- a/0005-disable-openmp-protobuf-sample_crypto-builds.patch +++ b/0005-disable-openmp-protobuf-sample_crypto-builds.patch @@ -1,7 +1,7 @@ From e10242ea154af19d527377c9ff885fa0c7e7ce41 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Tue, 18 Jun 2024 15:57:22 +0100 -Subject: [PATCH 05/15] disable openmp, protobuf & sample_crypto builds +Subject: [PATCH 05/16] disable openmp, protobuf & sample_crypto builds MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -463,5 +463,5 @@ index dfbca6d4..3bd08d5c 100644 $(MAKE) -C utls clean @$(RM) $(LIBTLIBC) $(LIBTCXX) $(LIBTSE) -- -2.49.0 +2.52.0 diff --git a/0006-Fix-compat-with-gcc-14.patch b/0006-Fix-compat-with-gcc-14.patch index 3775e97..7c4e01f 100644 --- a/0006-Fix-compat-with-gcc-14.patch +++ b/0006-Fix-compat-with-gcc-14.patch @@ -1,7 +1,7 @@ From f257662821800cfe5cdb38639a35361aac0802a3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Mon, 24 Jun 2024 17:36:13 +0100 -Subject: [PATCH 06/15] Fix compat with gcc 14 +Subject: [PATCH 06/16] Fix compat with gcc 14 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -30,5 +30,5 @@ index 9a335c81..399d63b2 100644 #include "sgx_urts.h" #include "arch.h" -- -2.49.0 +2.52.0 diff --git a/0007-Fix-escaping-of-regexes-in-sgx-asm-pp.patch b/0007-Fix-escaping-of-regexes-in-sgx-asm-pp.patch index 5e85e52..6997078 100644 --- a/0007-Fix-escaping-of-regexes-in-sgx-asm-pp.patch +++ b/0007-Fix-escaping-of-regexes-in-sgx-asm-pp.patch @@ -1,7 +1,7 @@ From 089dddf45cda329896d5d94202780209567fed9d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Mon, 2 Sep 2024 16:49:18 +0100 -Subject: [PATCH 07/15] Fix escaping of regexes in sgx-asm-pp +Subject: [PATCH 07/16] Fix escaping of regexes in sgx-asm-pp MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -278,5 +278,5 @@ index 2b02396b..0df3fc47 100644 # # File Operations - read/write -- -2.49.0 +2.52.0 diff --git a/0008-psw-prefer-dev-sgx_provision-dev-sgx_enclave.patch b/0008-psw-prefer-dev-sgx_provision-dev-sgx_enclave.patch index d60b019..4d1aa2f 100644 --- a/0008-psw-prefer-dev-sgx_provision-dev-sgx_enclave.patch +++ b/0008-psw-prefer-dev-sgx_provision-dev-sgx_enclave.patch @@ -1,7 +1,7 @@ From 8967386d8e9eb0f7a11a7e6ce7f97b6b1daf39ef Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 4 Oct 2024 16:33:20 +0100 -Subject: [PATCH 08/15] psw: prefer /dev/sgx_provision & /dev/sgx_enclave +Subject: [PATCH 08/16] psw: prefer /dev/sgx_provision & /dev/sgx_enclave MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -74,5 +74,5 @@ index 49f2b9aa..fc537a84 100644 } else if (driver_type == SGX_DRIVER_DCAP) -- -2.49.0 +2.52.0 diff --git a/0009-psw-fix-soname-for-libuae_service.so-library.patch b/0009-psw-fix-soname-for-libuae_service.so-library.patch index c2f5807..e18b688 100644 --- a/0009-psw-fix-soname-for-libuae_service.so-library.patch +++ b/0009-psw-fix-soname-for-libuae_service.so-library.patch @@ -1,7 +1,7 @@ From 6d0fee06ee6c87f8f89aac9947bb8b3df9930238 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 17 Jan 2025 15:38:56 +0000 -Subject: [PATCH 09/15] psw: fix soname for libuae_service.so library +Subject: [PATCH 09/16] psw: fix soname for libuae_service.so library MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -25,5 +25,5 @@ index bffbdc5b..81f5c4b7 100644 $(IPC_SRC:.cpp=.o) : $(IPC_COMMON_PROTO_DIR)/messages.pb.cc AEServicesImpl.o : $(IPC_COMMON_PROTO_DIR)/messages.pb.cc -- -2.49.0 +2.52.0 diff --git a/0010-pcl-remove-redundant-use-of-bool-type.patch b/0010-pcl-remove-redundant-use-of-bool-type.patch index f774ad9..9643cff 100644 --- a/0010-pcl-remove-redundant-use-of-bool-type.patch +++ b/0010-pcl-remove-redundant-use-of-bool-type.patch @@ -1,7 +1,7 @@ From 26f9569bf1ea44bc2e937b8ccbb1141bb1f88274 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 6 Feb 2025 09:54:33 +0000 -Subject: [PATCH 10/15] pcl: remove redundant use of 'bool' type +Subject: [PATCH 10/16] pcl: remove redundant use of 'bool' type MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -45,5 +45,5 @@ index 5ad6efde..b78ca907 100644 #endif // #ifdef SE_SIM -- -2.49.0 +2.52.0 diff --git a/0011-sdk-honour-CFLAGS-LDFLAGS-set-from-environment.patch b/0011-sdk-honour-CFLAGS-LDFLAGS-set-from-environment.patch index 9bf9229..547254b 100644 --- a/0011-sdk-honour-CFLAGS-LDFLAGS-set-from-environment.patch +++ b/0011-sdk-honour-CFLAGS-LDFLAGS-set-from-environment.patch @@ -1,7 +1,7 @@ From 5e43013eff1a6d558f1bad189cae185b383c49f6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 27 Mar 2025 14:17:01 +0000 -Subject: [PATCH 11/15] sdk: honour CFLAGS/LDFLAGS set from environment +Subject: [PATCH 11/16] sdk: honour CFLAGS/LDFLAGS set from environment MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -122,5 +122,5 @@ index ea8ca78c..dd716f2b 100644 $(BUILD_DIR): @$(MKDIR) $@ -- -2.49.0 +2.52.0 diff --git a/0012-psw-make-aesm_service-build-verbose.patch b/0012-psw-make-aesm_service-build-verbose.patch index 6203c03..7a1f225 100644 --- a/0012-psw-make-aesm_service-build-verbose.patch +++ b/0012-psw-make-aesm_service-build-verbose.patch @@ -1,7 +1,7 @@ From e9ca38a6045c2ad5d5277cb52bc175eb56ee7466 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 27 Mar 2025 16:07:10 +0000 -Subject: [PATCH 12/15] psw: make aesm_service build verbose. +Subject: [PATCH 12/16] psw: make aesm_service build verbose. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -25,5 +25,5 @@ index 89a15875..dbfa3fb6 100644 $(CP) $(CPPMICROSERVICES) source/build/bin/ endif -- -2.49.0 +2.52.0 diff --git a/0013-Fix-modern-C-function-prototype-compliance.patch b/0013-Fix-modern-C-function-prototype-compliance.patch index 81a760f..298f3de 100644 --- a/0013-Fix-modern-C-function-prototype-compliance.patch +++ b/0013-Fix-modern-C-function-prototype-compliance.patch @@ -1,7 +1,7 @@ From 0ef77c5de1ae80a8a1df4280af1dbd1fba6ebe46 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Mon, 31 Mar 2025 10:55:25 +0100 -Subject: [PATCH 13/15] Fix modern C function prototype compliance +Subject: [PATCH 13/16] Fix modern C function prototype compliance MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -39,5 +39,5 @@ index 8e4e7600..8c38bb68 100644 g_sys_ptrace = (ptrace_t)dlsym(RTLD_NEXT, "ptrace"); g_sys_waitpid = (waitpid_t)dlsym(RTLD_NEXT, "waitpid"); -- -2.49.0 +2.52.0 diff --git a/0014-Add-wrapper-for-nasm-to-fix-cmake-compat.patch b/0014-Add-wrapper-for-nasm-to-fix-cmake-compat.patch index b1a5bd0..31e5eea 100644 --- a/0014-Add-wrapper-for-nasm-to-fix-cmake-compat.patch +++ b/0014-Add-wrapper-for-nasm-to-fix-cmake-compat.patch @@ -1,7 +1,7 @@ From 77f998c285d15d31ec9104d413b380f90fa91970 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Wed, 2 Apr 2025 17:11:25 +0100 -Subject: [PATCH 14/15] Add wrapper for nasm to fix cmake compat +Subject: [PATCH 14/16] Add wrapper for nasm to fix cmake compat MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -65,5 +65,5 @@ index d78ba90e..71a40247 100644 $(IPP_SOURCE)/build: ifeq ($(IPP_USE_GIT), 1) -- -2.49.0 +2.52.0 diff --git a/0015-fix-BOM-for-pccs-with-DCAP-1.23.patch b/0015-fix-BOM-for-pccs-with-DCAP-1.23.patch index aa52f20..52cca01 100644 --- a/0015-fix-BOM-for-pccs-with-DCAP-1.23.patch +++ b/0015-fix-BOM-for-pccs-with-DCAP-1.23.patch @@ -1,7 +1,7 @@ From 595343c8d79a45760a30b30e1bd66f4079c61f52 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 27 Jun 2025 11:37:26 +0100 -Subject: [PATCH 15/15] fix BOM for pccs with DCAP 1.23 +Subject: [PATCH 15/16] fix BOM for pccs with DCAP 1.23 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -68,5 +68,5 @@ index d70745c9..73c687b3 100644 /external/dcap_source/QuoteGeneration/pccs/README.md /README.md 0 main STP +/external/dcap_source/QuoteGeneration/pccs/nodejs.cnf /nodejs.cnf 0 main STP -- -2.49.0 +2.52.0 diff --git a/0016-sdk-avoid-failure-due-to-attribute-regparam-with-GCC.patch b/0016-sdk-avoid-failure-due-to-attribute-regparam-with-GCC.patch new file mode 100644 index 0000000..8d81167 --- /dev/null +++ b/0016-sdk-avoid-failure-due-to-attribute-regparam-with-GCC.patch @@ -0,0 +1,83 @@ +From d03ce44f87441bcd42e4c20afcf038677accbcfc Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= +Date: Tue, 6 Jan 2026 18:31:32 +0000 +Subject: [PATCH 16/16] sdk: avoid failure due to attribute(regparam) with GCC + 16 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +GCC >= 16 now warns about use of attribute(regparam) on x86_64 targets. +The attribute was always ignored on x86_64, so only had effect on i686 +and thus the warning can be safely ignored. + +Signed-off-by: Daniel P. Berrangé +--- + psw/urts/linux/Makefile | 4 ++-- + sdk/simulation/trtssim/linux/Makefile | 4 ++-- + sdk/simulation/urtssim/linux/Makefile | 4 ++-- + sdk/trts/Makefile | 1 + + 4 files changed, 7 insertions(+), 6 deletions(-) + +diff --git a/psw/urts/linux/Makefile b/psw/urts/linux/Makefile +index 3d08ee5c..1e76d8d5 100644 +--- a/psw/urts/linux/Makefile ++++ b/psw/urts/linux/Makefile +@@ -36,10 +36,10 @@ CXXFLAGS += -DDISABLE_TRACE + CFLAGS += -DDISABLE_TRACE + endif + +-CXXFLAGS += -fPIC -Werror -g ++CXXFLAGS += -fPIC -Werror -Wno-attributes -g + CXXFLAGS += $(ADDED_INC) + +-CFLAGS += -fPIC -Werror -g ++CFLAGS += -fPIC -Werror -Wno-attributes -g + CFLAGS += $(ADDED_INC) + + VTUNE_DIR = $(LINUX_EXTERNAL_DIR)/vtune/linux +diff --git a/sdk/simulation/trtssim/linux/Makefile b/sdk/simulation/trtssim/linux/Makefile +index 16e2a96d..7e545c1a 100644 +--- a/sdk/simulation/trtssim/linux/Makefile ++++ b/sdk/simulation/trtssim/linux/Makefile +@@ -41,8 +41,8 @@ CPPFLAGS += -I$(COMMON_DIR)/inc/ \ + + CFLAGS += $(ENCLAVE_CFLAGS) + ASFLAGS := -DSE_SIM -Werror $(CFLAGS) +-CFLAGS += -DSE_SIM -Werror -fasynchronous-unwind-tables +-CXXFLAGS += -DSE_SIM -Werror $(ENCLAVE_CXXFLAGS)\ ++CFLAGS += -DSE_SIM -Werror -Wno-attributes -fasynchronous-unwind-tables ++CXXFLAGS += -DSE_SIM -Werror -Wno-attributes $(ENCLAVE_CXXFLAGS)\ + -fno-exceptions -fno-rtti + + SIM_DIR := $(CUR_DIR)/../.. +diff --git a/sdk/simulation/urtssim/linux/Makefile b/sdk/simulation/urtssim/linux/Makefile +index dd716f2b..5d64c8ac 100644 +--- a/sdk/simulation/urtssim/linux/Makefile ++++ b/sdk/simulation/urtssim/linux/Makefile +@@ -39,8 +39,8 @@ CXXFLAGS += -DDISABLE_TRACE + CFLAGS += -DDISABLE_TRACE + endif + +-CXXFLAGS += -fPIC -DSE_SIM -Werror -g $(CET_FLAGS) +-CFLAGS += -fPIC -DSE_SIM -Werror -g $(CET_FLAGS) ++CXXFLAGS += -fPIC -DSE_SIM -Werror -Wno-attributes -g $(CET_FLAGS) ++CFLAGS += -fPIC -DSE_SIM -Werror -Wno-attributes -g $(CET_FLAGS) + + CPPFLAGS += $(ADDED_INC) #for ubuntu 11 and later version + CPPFLAGS += -I$(COMMON_DIR)/inc \ +diff --git a/sdk/trts/Makefile b/sdk/trts/Makefile +index 5750aece..4766ef51 100644 +--- a/sdk/trts/Makefile ++++ b/sdk/trts/Makefile +@@ -39,6 +39,7 @@ CPPFLAGS += -I$(COMMON_DIR)/inc \ + + CXXFLAGS += $(ENCLAVE_CXXFLAGS) \ + -Werror \ ++ -Wno-attributes \ + -fno-exceptions \ + -fno-rtti + +-- +2.52.0 + diff --git a/linux-sgx.spec b/linux-sgx.spec index 7fc660e..56c859c 100644 --- a/linux-sgx.spec +++ b/linux-sgx.spec @@ -339,6 +339,7 @@ Patch0012: 0012-psw-make-aesm_service-build-verbose.patch Patch0013: 0013-Fix-modern-C-function-prototype-compliance.patch Patch0014: 0014-Add-wrapper-for-nasm-to-fix-cmake-compat.patch Patch0015: 0015-fix-BOM-for-pccs-with-DCAP-1.23.patch +Patch0016: 0016-sdk-avoid-failure-due-to-attribute-regparam-with-GCC.patch # Optional patches Patch0050: 0050-Disable-inclusion-of-AESM-in-installer.patch From 8cfefca1b82b7a6603b94e456c25939b01ee8a69 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 15 Jan 2026 11:53:42 +0000 Subject: [PATCH 24/25] Add links to src-git repo branches MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit [skip changelog] Signed-off-by: Daniel P. Berrangé --- linux-sgx.spec | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/linux-sgx.spec b/linux-sgx.spec index 56c859c..c57fd64 100644 --- a/linux-sgx.spec +++ b/linux-sgx.spec @@ -319,6 +319,9 @@ Provides: bundled(vtune) = 2018 # Distro integration patches # 0000-0099 -> against linux-sgx.git +# +# Maintained in: https://github.com/berrange/linux-sgx/tree/dist-git-%{linux_sgx_version}-hostsw +# Patch0000: 0000-Add-support-for-building-against-host-openssl-crypto.patch Patch0001: 0001-Add-support-for-building-against-host-tinyxml2-lib.patch Patch0002: 0002-Add-support-for-building-against-host-CppMicroServic.patch @@ -343,7 +346,11 @@ Patch0016: 0016-sdk-avoid-failure-due-to-attribute-regparam-with-GCC.patch # Optional patches Patch0050: 0050-Disable-inclusion-of-AESM-in-installer.patch + # 0100-0199 -> against SGXDataCenterAttestationPrimitives.git +# +# Maintained in https://github.com/berrange/SGXDataCenterAttestationPrimitives/tree/dist-git-%{dcap_version}-hostsw +# Patch0100: 0100-Drop-use-of-bundled-pre-built-openssl.patch Patch0101: 0101-Improve-debuggability-of-build-system.patch # https://github.com/intel/SGXDataCenterAttestationPrimitives/pull/437 @@ -378,13 +385,21 @@ Patch0126: 0126-pccsadmin-ignore-errors-trying-to-clear-the-keyring.patch # https://github.com/intel/confidential-computing.tee.dcap/pull/485 Patch0127: 0127-PCS-Client-Tool-Migrate-from-deprecated-pkg_resource.patch + # 0200-0299 -> against intel-sgx-ssl.git +# +# Maintained in https://github.com/berrange/intel-sgx-ssl/tree/dist-git-%{sgx_ssl_version} +# Patch0200: 0200-Enable-pointing-sgxssl-build-to-alternative-glibc-he.patch Patch0201: 0201-Workaround-missing-output-directory.patch Patch0202: 0202-Disable-various-EC-crypto-features.patch Patch0203: 0203-Disable-sm2-and-sm4-crypto-algorithms.patch + # 0300-0399 -> against ipp-crypto.git +# +# Maintained in https://github.com/berrange/ipp-crypto/tree/dist-git-%{ipp_crypto_version} +# Patch0300: 0300-Drop-min-openssl-from-3.0.8-to-3.0.7.patch Patch0301: 0301-Drop-Werror-from-build-flags.patch From cf189041527745df988b8249524d65df45824dea Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 15 Jan 2026 09:44:43 +0000 Subject: [PATCH 25/25] fix build for boost 1.90 update api breakage MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Daniel P. Berrangé --- ...rop-use-of-bundled-pre-built-openssl.patch | 2 +- ...mprove-debuggability-of-build-system.patch | 2 +- ...me-setting-of-enclave-load-directory.patch | 2 +- ...ed-sgx_urts-library-in-PCKRetrievalT.patch | 2 +- ...-only-import-pypac-module-on-Windows.patch | 2 +- ...-PCKRetrievalTool-config-file-in-etc.patch | 2 +- ...XFLAGS-LDFLAGS-for-various-tools-and.patch | 2 +- ...tween-program-name-first-arg-in-usag.patch | 2 +- ...nst-format-strings-in-QL-log-message.patch | 2 +- ...d-debug-parameter-to-control-logging.patch | 2 +- ...-leftover-debugging-print-args-state.patch | 2 +- ...sion-for-libsgx_qe3_logic.so-library.patch | 2 +- 0112-Workaround-broken-GCC-15.patch | 2 +- ...-Don-t-disable-cf-protection-for-qgs.patch | 2 +- ...ecks-for-GCC-version-that-break-fsta.patch | 2 +- ...se-distro-provided-rapidjson-package.patch | 2 +- 0116-Don-t-stomp-on-VERBOSE-variable.patch | 2 +- ...-MODE-parameter-for-UNIX-socket-mode.patch | 2 +- ...pccs-sanitize-paths-to-all-resources.patch | 2 +- 0119-pccs-only-pass-ApiKey-if-it-is-set.patch | 2 +- ...csadmin-make-keyring-module-optional.patch | 2 +- ...rt-from-asn1-to-pyasn1-python-module.patch | 2 +- ...switch-to-pycryptography-for-CRL-ver.patch | 2 +- ...re-of-pycryptography-instead-of-pyop.patch | 2 +- ...prefer-pycryptography-over-pyopenssl.patch | 2 +- ...llback-for-when-pyopenssl-is-not-ava.patch | 2 +- ...e-errors-trying-to-clear-the-keyring.patch | 2 +- ...Migrate-from-deprecated-pkg_resource.patch | 2 +- ...or-boost-1.87-which-drops-asio-io_se.patch | 44 +++++++++++++++++++ ...or-boost-1.89-which-deprecated-deadl.patch | 36 +++++++++++++++ linux-sgx.spec | 3 ++ 31 files changed, 111 insertions(+), 28 deletions(-) create mode 100644 0128-qgs-add-compat-for-boost-1.87-which-drops-asio-io_se.patch create mode 100644 0129-qgs-add-compat-for-boost-1.89-which-deprecated-deadl.patch diff --git a/0100-Drop-use-of-bundled-pre-built-openssl.patch b/0100-Drop-use-of-bundled-pre-built-openssl.patch index ca21c1e..09c9d3b 100644 --- a/0100-Drop-use-of-bundled-pre-built-openssl.patch +++ b/0100-Drop-use-of-bundled-pre-built-openssl.patch @@ -1,7 +1,7 @@ From cf39f86bcca57579013cee5967d39cdaca15cbc4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Mon, 26 Feb 2024 12:19:51 +0000 -Subject: [PATCH 100/127] Drop use of bundled pre-built openssl +Subject: [PATCH 100/129] Drop use of bundled pre-built openssl MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0101-Improve-debuggability-of-build-system.patch b/0101-Improve-debuggability-of-build-system.patch index 03b8ebd..39f5497 100644 --- a/0101-Improve-debuggability-of-build-system.patch +++ b/0101-Improve-debuggability-of-build-system.patch @@ -1,7 +1,7 @@ From b36d8f61a5a18dc5edfbd632e5f2373bcf365b3e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 1 Mar 2024 12:05:01 +0000 -Subject: [PATCH 101/127] Improve debuggability of build system +Subject: [PATCH 101/129] Improve debuggability of build system MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0102-Support-build-time-setting-of-enclave-load-directory.patch b/0102-Support-build-time-setting-of-enclave-load-directory.patch index 3bbee13..a61c99e 100644 --- a/0102-Support-build-time-setting-of-enclave-load-directory.patch +++ b/0102-Support-build-time-setting-of-enclave-load-directory.patch @@ -1,7 +1,7 @@ From 9a185a6103e9637b785e498d4c4e4c990e7a3478 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Mon, 26 Feb 2024 12:19:51 +0000 -Subject: [PATCH 102/127] Support build time setting of enclave load directory +Subject: [PATCH 102/129] Support build time setting of enclave load directory MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0103-Look-for-versioned-sgx_urts-library-in-PCKRetrievalT.patch b/0103-Look-for-versioned-sgx_urts-library-in-PCKRetrievalT.patch index c3c678c..7d1b234 100644 --- a/0103-Look-for-versioned-sgx_urts-library-in-PCKRetrievalT.patch +++ b/0103-Look-for-versioned-sgx_urts-library-in-PCKRetrievalT.patch @@ -1,7 +1,7 @@ From b92d97f6037cb2e56d343cb979767d51655b097f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Tue, 27 Feb 2024 15:46:41 +0000 -Subject: [PATCH 103/127] Look for versioned sgx_urts library in +Subject: [PATCH 103/129] Look for versioned sgx_urts library in PCKRetrievalTool MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 diff --git a/0104-pccsadmin-only-import-pypac-module-on-Windows.patch b/0104-pccsadmin-only-import-pypac-module-on-Windows.patch index 164076d..57cb5d6 100644 --- a/0104-pccsadmin-only-import-pypac-module-on-Windows.patch +++ b/0104-pccsadmin-only-import-pypac-module-on-Windows.patch @@ -1,7 +1,7 @@ From eca1c479b23dd8e8c87e90988204c08b5e0c3edc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 4 Oct 2024 17:41:37 +0100 -Subject: [PATCH 104/127] pccsadmin: only import 'pypac' module on Windows +Subject: [PATCH 104/129] pccsadmin: only import 'pypac' module on Windows MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0105-Look-for-PCKRetrievalTool-config-file-in-etc.patch b/0105-Look-for-PCKRetrievalTool-config-file-in-etc.patch index a31ed50..060f39a 100644 --- a/0105-Look-for-PCKRetrievalTool-config-file-in-etc.patch +++ b/0105-Look-for-PCKRetrievalTool-config-file-in-etc.patch @@ -1,7 +1,7 @@ From c8820c38a16ba9c572a6eafefd010b60ba037dde Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 29 Feb 2024 14:21:36 +0000 -Subject: [PATCH 105/127] Look for PCKRetrievalTool config file in /etc/ +Subject: [PATCH 105/129] Look for PCKRetrievalTool config file in /etc/ MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0106-Honour-CFLAGS-CXXFLAGS-LDFLAGS-for-various-tools-and.patch b/0106-Honour-CFLAGS-CXXFLAGS-LDFLAGS-for-various-tools-and.patch index 2aae71f..64f5bb3 100644 --- a/0106-Honour-CFLAGS-CXXFLAGS-LDFLAGS-for-various-tools-and.patch +++ b/0106-Honour-CFLAGS-CXXFLAGS-LDFLAGS-for-various-tools-and.patch @@ -1,7 +1,7 @@ From 06874f59bd6693f0f42a999dcfbdc0233d9a4bd2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 28 Mar 2025 16:00:27 +0000 -Subject: [PATCH 106/127] Honour CFLAGS/CXXFLAGS/LDFLAGS for various tools and +Subject: [PATCH 106/129] Honour CFLAGS/CXXFLAGS/LDFLAGS for various tools and libraries MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 diff --git a/0107-qgs-add-space-between-program-name-first-arg-in-usag.patch b/0107-qgs-add-space-between-program-name-first-arg-in-usag.patch index c05c414..6fd1e51 100644 --- a/0107-qgs-add-space-between-program-name-first-arg-in-usag.patch +++ b/0107-qgs-add-space-between-program-name-first-arg-in-usag.patch @@ -1,7 +1,7 @@ From 44eefb7f574b33cb0cf5239948e7d633f1d71dd5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 3 Oct 2024 14:42:29 +0100 -Subject: [PATCH 107/127] qgs: add space between program name & first arg in +Subject: [PATCH 107/129] qgs: add space between program name & first arg in usage MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 diff --git a/0108-qgs-protect-against-format-strings-in-QL-log-message.patch b/0108-qgs-protect-against-format-strings-in-QL-log-message.patch index 692ead3..590648a 100644 --- a/0108-qgs-protect-against-format-strings-in-QL-log-message.patch +++ b/0108-qgs-protect-against-format-strings-in-QL-log-message.patch @@ -1,7 +1,7 @@ From 6c38e13fbee555045aec98f6e159531a385bce53 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 4 Oct 2024 09:43:17 +0100 -Subject: [PATCH 108/127] qgs: protect against format strings in QL log +Subject: [PATCH 108/129] qgs: protect against format strings in QL log messages MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 diff --git a/0109-qgs-add-debug-parameter-to-control-logging.patch b/0109-qgs-add-debug-parameter-to-control-logging.patch index dcb2fd9..eed8f9c 100644 --- a/0109-qgs-add-debug-parameter-to-control-logging.patch +++ b/0109-qgs-add-debug-parameter-to-control-logging.patch @@ -1,7 +1,7 @@ From d1cbef970b8ee800a313b818927449a7dcf1a685 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 3 Oct 2024 16:57:35 +0100 -Subject: [PATCH 109/127] qgs: add --debug parameter to control logging +Subject: [PATCH 109/129] qgs: add --debug parameter to control logging MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0110-pccsadmin-remove-leftover-debugging-print-args-state.patch b/0110-pccsadmin-remove-leftover-debugging-print-args-state.patch index 49836fd..1f30b24 100644 --- a/0110-pccsadmin-remove-leftover-debugging-print-args-state.patch +++ b/0110-pccsadmin-remove-leftover-debugging-print-args-state.patch @@ -1,7 +1,7 @@ From 64c49b04e7e22358f3afee834a434a6cfdff4a9b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Tue, 8 Oct 2024 10:13:02 +0100 -Subject: [PATCH 110/127] pccsadmin: remove leftover debugging 'print(args)' +Subject: [PATCH 110/129] pccsadmin: remove leftover debugging 'print(args)' statement MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 diff --git a/0111-Fix-soname-version-for-libsgx_qe3_logic.so-library.patch b/0111-Fix-soname-version-for-libsgx_qe3_logic.so-library.patch index 6324353..ff010b6 100644 --- a/0111-Fix-soname-version-for-libsgx_qe3_logic.so-library.patch +++ b/0111-Fix-soname-version-for-libsgx_qe3_logic.so-library.patch @@ -1,7 +1,7 @@ From 32ac12f933e813b80348840821e1deaedf797a00 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 17 Jan 2025 15:39:39 +0000 -Subject: [PATCH 111/127] Fix soname version for libsgx_qe3_logic.so library +Subject: [PATCH 111/129] Fix soname version for libsgx_qe3_logic.so library MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0112-Workaround-broken-GCC-15.patch b/0112-Workaround-broken-GCC-15.patch index 7828421..e1d734b 100644 --- a/0112-Workaround-broken-GCC-15.patch +++ b/0112-Workaround-broken-GCC-15.patch @@ -1,7 +1,7 @@ From ac446d8943858e6dccec924451b8a8a3be4d9c4a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 6 Feb 2025 20:08:59 +0000 -Subject: [PATCH 112/127] Workaround broken GCC 15 +Subject: [PATCH 112/129] Workaround broken GCC 15 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0113-Don-t-disable-cf-protection-for-qgs.patch b/0113-Don-t-disable-cf-protection-for-qgs.patch index 68dd345..4c04f79 100644 --- a/0113-Don-t-disable-cf-protection-for-qgs.patch +++ b/0113-Don-t-disable-cf-protection-for-qgs.patch @@ -1,7 +1,7 @@ From fa8c4f150fe32dafd875c5f45a9e588775235e35 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Wed, 2 Apr 2025 18:39:31 +0100 -Subject: [PATCH 113/127] Don't disable cf-protection for qgs +Subject: [PATCH 113/129] Don't disable cf-protection for qgs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0114-Delete-broken-checks-for-GCC-version-that-break-fsta.patch b/0114-Delete-broken-checks-for-GCC-version-that-break-fsta.patch index 462009e..3059afe 100644 --- a/0114-Delete-broken-checks-for-GCC-version-that-break-fsta.patch +++ b/0114-Delete-broken-checks-for-GCC-version-that-break-fsta.patch @@ -1,7 +1,7 @@ From 2d83da9d5f5fb7399b0d7ec6ac410a6bf52b2add Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 3 Apr 2025 17:44:48 +0100 -Subject: [PATCH 114/127] Delete broken checks for GCC version that break +Subject: [PATCH 114/129] Delete broken checks for GCC version that break -fstack-protector-strong MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 diff --git a/0115-Use-distro-provided-rapidjson-package.patch b/0115-Use-distro-provided-rapidjson-package.patch index 0c6a8e4..a3d14af 100644 --- a/0115-Use-distro-provided-rapidjson-package.patch +++ b/0115-Use-distro-provided-rapidjson-package.patch @@ -1,7 +1,7 @@ From 40d434d75ff4978cd968b4d140af5aa8c8f602c2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Mon, 26 Feb 2024 12:19:51 +0000 -Subject: [PATCH 115/127] Use distro provided rapidjson package +Subject: [PATCH 115/129] Use distro provided rapidjson package MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0116-Don-t-stomp-on-VERBOSE-variable.patch b/0116-Don-t-stomp-on-VERBOSE-variable.patch index 85294ea..be5bf22 100644 --- a/0116-Don-t-stomp-on-VERBOSE-variable.patch +++ b/0116-Don-t-stomp-on-VERBOSE-variable.patch @@ -1,7 +1,7 @@ From 605d9bcc0003c869e785376bbc3dbecc670c934d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Wed, 16 Apr 2025 11:48:52 +0100 -Subject: [PATCH 116/127] Don't stomp on "VERBOSE" variable +Subject: [PATCH 116/129] Don't stomp on "VERBOSE" variable MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0117-qgs-add-m-MODE-parameter-for-UNIX-socket-mode.patch b/0117-qgs-add-m-MODE-parameter-for-UNIX-socket-mode.patch index 47e7db5..f399aa5 100644 --- a/0117-qgs-add-m-MODE-parameter-for-UNIX-socket-mode.patch +++ b/0117-qgs-add-m-MODE-parameter-for-UNIX-socket-mode.patch @@ -1,7 +1,7 @@ From d7299915f42cd068744ce02e358865085f2f12bf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Fri, 2 May 2025 14:48:24 +0100 -Subject: [PATCH 117/127] qgs: add -m=MODE parameter for UNIX socket mode +Subject: [PATCH 117/129] qgs: add -m=MODE parameter for UNIX socket mode MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0118-pccs-sanitize-paths-to-all-resources.patch b/0118-pccs-sanitize-paths-to-all-resources.patch index 2f9cb2e..bd97e93 100644 --- a/0118-pccs-sanitize-paths-to-all-resources.patch +++ b/0118-pccs-sanitize-paths-to-all-resources.patch @@ -1,7 +1,7 @@ From b108e8c9a0c9143e8fd930186c21d34d9cddaea7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Tue, 27 Feb 2024 13:38:49 +0000 -Subject: [PATCH 118/127] pccs: sanitize paths to all resources +Subject: [PATCH 118/129] pccs: sanitize paths to all resources MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0119-pccs-only-pass-ApiKey-if-it-is-set.patch b/0119-pccs-only-pass-ApiKey-if-it-is-set.patch index 84dca13..d76e24b 100644 --- a/0119-pccs-only-pass-ApiKey-if-it-is-set.patch +++ b/0119-pccs-only-pass-ApiKey-if-it-is-set.patch @@ -1,7 +1,7 @@ From 6c6e7427cf14455a56828db5c39f26ca8658a18d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Wed, 9 Jul 2025 16:41:59 +0100 -Subject: [PATCH 119/127] pccs: only pass ApiKey if it is set +Subject: [PATCH 119/129] pccs: only pass ApiKey if it is set MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0120-pccsadmin-make-keyring-module-optional.patch b/0120-pccsadmin-make-keyring-module-optional.patch index 5bc3615..a1fbfaf 100644 --- a/0120-pccsadmin-make-keyring-module-optional.patch +++ b/0120-pccsadmin-make-keyring-module-optional.patch @@ -1,7 +1,7 @@ From 2b540452538b12a47340b03d6118d3df281a6638 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 4 Dec 2025 13:31:54 +0000 -Subject: [PATCH 120/127] pccsadmin: make 'keyring' module optional +Subject: [PATCH 120/129] pccsadmin: make 'keyring' module optional MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0121-pccsadmin-convert-from-asn1-to-pyasn1-python-module.patch b/0121-pccsadmin-convert-from-asn1-to-pyasn1-python-module.patch index 9114f2a..0d8276a 100644 --- a/0121-pccsadmin-convert-from-asn1-to-pyasn1-python-module.patch +++ b/0121-pccsadmin-convert-from-asn1-to-pyasn1-python-module.patch @@ -1,7 +1,7 @@ From b9954581944446455876728bdab816090d773715 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 4 Dec 2025 13:54:19 +0000 -Subject: [PATCH 121/127] pccsadmin: convert from asn1 to pyasn1 python module +Subject: [PATCH 121/129] pccsadmin: convert from asn1 to pyasn1 python module MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0122-pccsadmin-fully-switch-to-pycryptography-for-CRL-ver.patch b/0122-pccsadmin-fully-switch-to-pycryptography-for-CRL-ver.patch index f2fc034..3523dd7 100644 --- a/0122-pccsadmin-fully-switch-to-pycryptography-for-CRL-ver.patch +++ b/0122-pccsadmin-fully-switch-to-pycryptography-for-CRL-ver.patch @@ -1,7 +1,7 @@ From d44b9ac3e89e17452678758634e6dbca6c5a099a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Mon, 8 Dec 2025 17:47:01 +0000 -Subject: [PATCH 122/127] pccsadmin: fully switch to pycryptography for CRL +Subject: [PATCH 122/129] pccsadmin: fully switch to pycryptography for CRL verification MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 diff --git a/0123-pccsadmin-use-more-of-pycryptography-instead-of-pyop.patch b/0123-pccsadmin-use-more-of-pycryptography-instead-of-pyop.patch index 3d2f6da..4e066a2 100644 --- a/0123-pccsadmin-use-more-of-pycryptography-instead-of-pyop.patch +++ b/0123-pccsadmin-use-more-of-pycryptography-instead-of-pyop.patch @@ -1,7 +1,7 @@ From d14f914ea644d7c1b2312780688d55fbb13892bc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Mon, 8 Dec 2025 17:48:11 +0000 -Subject: [PATCH 123/127] pccsadmin: use more of pycryptography instead of +Subject: [PATCH 123/129] pccsadmin: use more of pycryptography instead of pyopenssl MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 diff --git a/0124-pccsadmin-prefer-pycryptography-over-pyopenssl.patch b/0124-pccsadmin-prefer-pycryptography-over-pyopenssl.patch index 84b7d27..5795c2b 100644 --- a/0124-pccsadmin-prefer-pycryptography-over-pyopenssl.patch +++ b/0124-pccsadmin-prefer-pycryptography-over-pyopenssl.patch @@ -1,7 +1,7 @@ From 9d3da2fd99ba2832fcaa4067dd5db3f7f349c306 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Wed, 3 Dec 2025 17:59:09 +0000 -Subject: [PATCH 124/127] pccsadmin: prefer pycryptography over pyopenssl +Subject: [PATCH 124/129] pccsadmin: prefer pycryptography over pyopenssl MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0125-pccsadmin-add-fallback-for-when-pyopenssl-is-not-ava.patch b/0125-pccsadmin-add-fallback-for-when-pyopenssl-is-not-ava.patch index 9076f19..f8069ed 100644 --- a/0125-pccsadmin-add-fallback-for-when-pyopenssl-is-not-ava.patch +++ b/0125-pccsadmin-add-fallback-for-when-pyopenssl-is-not-ava.patch @@ -1,7 +1,7 @@ From 262c1cb978d31130d3558d2a29690b1eace52c64 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Mon, 8 Dec 2025 17:56:59 +0000 -Subject: [PATCH 125/127] pccsadmin: add fallback for when pyopenssl is not +Subject: [PATCH 125/129] pccsadmin: add fallback for when pyopenssl is not available MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 diff --git a/0126-pccsadmin-ignore-errors-trying-to-clear-the-keyring.patch b/0126-pccsadmin-ignore-errors-trying-to-clear-the-keyring.patch index f1a8ecf..373af79 100644 --- a/0126-pccsadmin-ignore-errors-trying-to-clear-the-keyring.patch +++ b/0126-pccsadmin-ignore-errors-trying-to-clear-the-keyring.patch @@ -1,7 +1,7 @@ From 48f3dc21602f2f11f054c740c5efd4c34d5efae6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 4 Dec 2025 18:05:14 +0000 -Subject: [PATCH 126/127] pccsadmin: ignore errors trying to clear the keyring +Subject: [PATCH 126/129] pccsadmin: ignore errors trying to clear the keyring MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit diff --git a/0127-PCS-Client-Tool-Migrate-from-deprecated-pkg_resource.patch b/0127-PCS-Client-Tool-Migrate-from-deprecated-pkg_resource.patch index e453b97..8495d94 100644 --- a/0127-PCS-Client-Tool-Migrate-from-deprecated-pkg_resource.patch +++ b/0127-PCS-Client-Tool-Migrate-from-deprecated-pkg_resource.patch @@ -1,7 +1,7 @@ From f0222324f5896d08457ed0ffb3951081d66e0cf0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Tue, 6 Jan 2026 18:03:36 +0100 -Subject: [PATCH 127/127] [PCS Client Tool] Migrate from deprecated +Subject: [PATCH 127/129] [PCS Client Tool] Migrate from deprecated pkg_resources to packaging MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 diff --git a/0128-qgs-add-compat-for-boost-1.87-which-drops-asio-io_se.patch b/0128-qgs-add-compat-for-boost-1.87-which-drops-asio-io_se.patch new file mode 100644 index 0000000..9475d10 --- /dev/null +++ b/0128-qgs-add-compat-for-boost-1.87-which-drops-asio-io_se.patch @@ -0,0 +1,44 @@ +From a3633a45f16aa80e9be8542ea8702ec32dbf93cd Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= +Date: Thu, 15 Jan 2026 11:23:35 +0000 +Subject: [PATCH 128/129] qgs: add compat for boost 1.87 which drops + asio::io_service +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jonathan Wakely + +The asio::io_service type was deprecated since 1.66 in 2017, +with asio::io_context being its drop-in replacement. + +Release 1.87 finally dropped the back-compat support for +asio::io_service entirely. + +To retain compat with old boost this change conditionally +re-adds the compat definition for asio::io_service. + +Signed-off-by: Daniel P. Berrangé +--- + QuoteGeneration/quote_wrapper/qgs/qgs_server.h | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/QuoteGeneration/quote_wrapper/qgs/qgs_server.h b/QuoteGeneration/quote_wrapper/qgs/qgs_server.h +index f3f5b9f..91eb41a 100644 +--- a/QuoteGeneration/quote_wrapper/qgs/qgs_server.h ++++ b/QuoteGeneration/quote_wrapper/qgs/qgs_server.h +@@ -36,6 +36,11 @@ + #include + #include + ++#if BOOST_VERSION >= 108700 ++// Asio no longer defines the deprecated io_service alias. ++namespace boost { namespace asio { using io_service = io_context; } } ++#endif ++ + namespace intel { namespace sgx { namespace dcap { namespace qgs { + + namespace asio = boost::asio; +-- +2.52.0 + diff --git a/0129-qgs-add-compat-for-boost-1.89-which-deprecated-deadl.patch b/0129-qgs-add-compat-for-boost-1.89-which-deprecated-deadl.patch new file mode 100644 index 0000000..5a1f02c --- /dev/null +++ b/0129-qgs-add-compat-for-boost-1.89-which-deprecated-deadl.patch @@ -0,0 +1,36 @@ +From 3c73dad4bdab6d3c29f58ca5ca34628c7ef952b0 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= +Date: Thu, 15 Jan 2026 12:48:19 +0000 +Subject: [PATCH 129/129] qgs: add compat for boost 1.89 which deprecated + deadline_timer.hpp +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The asio::deadline_timer was deprecated in 1.89 and as a result +the deadline_timer.hpp file is no longer implicitly included by +asio.hpp. + +To retain compat with old and new boost the code must explicitly +include the deadline_timer.hpp + +Signed-off-by: Daniel P. Berrangé +--- + QuoteGeneration/quote_wrapper/qgs/qgs_server.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/QuoteGeneration/quote_wrapper/qgs/qgs_server.h b/QuoteGeneration/quote_wrapper/qgs/qgs_server.h +index 91eb41a..b56b263 100644 +--- a/QuoteGeneration/quote_wrapper/qgs/qgs_server.h ++++ b/QuoteGeneration/quote_wrapper/qgs/qgs_server.h +@@ -34,6 +34,7 @@ + + #include + #include ++#include + #include + + #if BOOST_VERSION >= 108700 +-- +2.52.0 + diff --git a/linux-sgx.spec b/linux-sgx.spec index c57fd64..a62e6f0 100644 --- a/linux-sgx.spec +++ b/linux-sgx.spec @@ -384,6 +384,9 @@ Patch0125: 0125-pccsadmin-add-fallback-for-when-pyopenssl-is-not-ava.patch Patch0126: 0126-pccsadmin-ignore-errors-trying-to-clear-the-keyring.patch # https://github.com/intel/confidential-computing.tee.dcap/pull/485 Patch0127: 0127-PCS-Client-Tool-Migrate-from-deprecated-pkg_resource.patch +# https://github.com/intel/confidential-computing.tee.dcap/pull/487 +Patch0128: 0128-qgs-add-compat-for-boost-1.87-which-drops-asio-io_se.patch +Patch0129: 0129-qgs-add-compat-for-boost-1.89-which-deprecated-deadl.patch # 0200-0299 -> against intel-sgx-ssl.git