diff --git a/.gitignore b/.gitignore index bdef1dd..775a045 100644 --- a/.gitignore +++ b/.gitignore @@ -3,3 +3,11 @@ /*.src.rpm /p11-kit-0.*/ /x86_64/ +/trust-extract-compat +/p11-kit-0.23.9.tar.gz +/p11-kit-client.service +/trust-extract-compat +/p11-kit-0.23.9.tar.gz +/p11-kit-client.service +/trust-extract-compat +/p11-kit-0.23.10.tar.gz diff --git a/p11-kit-client.service b/p11-kit-client.service new file mode 100644 index 0000000..c9b8e30 --- /dev/null +++ b/p11-kit-client.service @@ -0,0 +1,11 @@ +[Unit] +Description=p11-kit client + +[Service] +Type=oneshot +RemainAfterExit=true +RuntimeDirectory=p11-kit +ExecStart=/usr/bin/true + +[Install] +WantedBy=default.target diff --git a/p11-kit.spec b/p11-kit.spec index 683b312..2554f1d 100644 --- a/p11-kit.spec +++ b/p11-kit.spec @@ -1,17 +1,22 @@ +# This spec file has been automatically updated +Version: 0.23.10 +Release: 1%{?dist} Name: p11-kit -Version: 0.23.5 -Release: 1%{?dist} Summary: Library for loading and sharing PKCS#11 modules License: BSD URL: http://p11-glue.freedesktop.org/p11-kit.html Source0: https://github.com/p11-glue/p11-kit/releases/download/%{version}/p11-kit-%{version}.tar.gz Source1: trust-extract-compat +Source2: p11-kit-client.service BuildRequires: libtasn1-devel >= 2.3 BuildRequires: libffi-devel BuildRequires: gtk-doc BuildRequires: systemd +# Work around for https://bugzilla.redhat.com/show_bug.cgi?id=1497147 +# Remove this once it is fixed +BuildRequires: pkgconfig(glib-2.0) %description p11-kit provides a way to load and enumerate PKCS#11 modules, as well @@ -60,7 +65,7 @@ feature is still experimental. %prep -%setup -q +%autosetup -p1 %build # These paths are the source paths that come from the plan here: @@ -76,6 +81,8 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/pkcs11/*.la install -p -m 755 %{SOURCE1} $RPM_BUILD_ROOT%{_libexecdir}/p11-kit/ # Install the example conf with %%doc instead rm $RPM_BUILD_ROOT%{_sysconfdir}/pkcs11/pkcs11.conf.example +mkdir -p $RPM_BUILD_ROOT%{_userunitdir} +install -p -m 644 %{SOURCE2} $RPM_BUILD_ROOT%{_userunitdir} %check make check @@ -123,16 +130,36 @@ fi %files trust %{_bindir}/trust %dir %{_libdir}/pkcs11 +%ghost %{_libdir}/libnssckbi.so %{_libdir}/pkcs11/p11-kit-trust.so %{_datadir}/p11-kit/modules/p11-kit-trust.module %{_libexecdir}/p11-kit/trust-extract-compat %files server %{_libdir}/pkcs11/p11-kit-client.so +%{_userunitdir}/p11-kit-client.service %{_libexecdir}/p11-kit/p11-kit-server %changelog +* Wed Feb 28 2018 Daiki Ueno - 0.23.10-1 +- Update to upstream 0.23.10 release + +* Thu Oct 05 2017 Daiki Ueno - 0.23.9-2 +- server: Make it possible to eval envvar settings + +* Wed Oct 04 2017 Daiki Ueno - 0.23.9-1 +- Update to upstream 0.23.9 release + +* Tue Aug 15 2017 Daiki Ueno - 0.23.8-1 +- Update to 0.23.8 release + +* Thu May 18 2017 Daiki Ueno - 0.23.5-3 +- Update p11-kit-modifiable.patch to simplify the logic + +* Thu May 18 2017 Daiki Ueno - 0.23.5-2 +- Make "trust anchor --remove" work again + * Thu Mar 2 2017 Daiki Ueno - 0.23.5-1 - Update to 0.23.5 release - Rename -tools subpackage to -server and remove systemd unit files diff --git a/sources b/sources index 0c0cf6b..3fa1635 100644 --- a/sources +++ b/sources @@ -1 +1,3 @@ -SHA512 (p11-kit-0.23.5.tar.gz) = 5276db3c9bb14d5e0441e7b781033b1684edfc1d4da88a9c9ce501ed1f6121918d3afe6725ceb0e2d65fc253c2f9eebf37c3380741de6c1b09cec06ae86417a7 +SHA512 (p11-kit-client.service) = 0f08618851c6eafb35c630957044fc96324be4d3828cdd2aa9b5d6e1245549197ca5b969d6a2f735c893d73c02e885cdc3205bd43e37f6124ebc6cfa61970d3b +SHA512 (trust-extract-compat) = 91210705f9bcf1a13c0de1ca9943e3ac68296bfcb7953fc59241de060247b470b39be6e914dd4d92e38a78d5df0962c83315ad78f8c0eade8e62d884b05fdd42 +SHA512 (p11-kit-0.23.10.tar.gz) = 42a004613f951e4e18c10cd204bcba348267cc7b3ae0d9f26d69012b086af446947660575d5751539b8d4dd77fa9b684054ad5ac978119e0a2e94fcdf9842178 diff --git a/tests/.gitignore b/tests/.gitignore new file mode 100644 index 0000000..13555f0 --- /dev/null +++ b/tests/.gitignore @@ -0,0 +1,2 @@ +*.retry +artifacts/ diff --git a/tests/tests.yml b/tests/tests.yml new file mode 100644 index 0000000..6188ad8 --- /dev/null +++ b/tests/tests.yml @@ -0,0 +1,14 @@ +--- +# This first play always runs on the local staging system +- hosts: localhost + roles: + - role: standard-test-beakerlib + tags: + - classic + - atomic + - container + tests: + - trust-anchor-complains-about-invalid-attribute-and + required_packages: + - openssl + - p11-kit diff --git a/tests/trust-anchor-complains-about-invalid-attribute-and/PURPOSE b/tests/trust-anchor-complains-about-invalid-attribute-and/PURPOSE new file mode 100644 index 0000000..e7886f9 --- /dev/null +++ b/tests/trust-anchor-complains-about-invalid-attribute-and/PURPOSE @@ -0,0 +1,17 @@ +PURPOSE of /CoreOS/p11-kit/trust-anchor-complains-about-invalid-attribute-and +Description: Test for trust anchor complains about invalid attribute and +Author: Hubert Kario +Bug summary: trust anchor complains about invalid attribute and fails when a new certificate tries to store into trust place + +Steps to Reproduce: +1. /etc/pki/tls/certs/make-dummy-cert mycert-tmp.pem +2. openssl x509 -in mycert-tmp.pem -addtrust clientAuth -addtrust serverAuth -addtrust emailProtection -out mycert.pem +3. trust anchor --store mycert.pem + +Actual results: +p11-kit: the CKA_TRUSTED attribute is not valid for the object +p11-kit: couldn't create object: Certain fields have invalid values + + +Expected results: +Certificate is stored in trust place. diff --git a/tests/trust-anchor-complains-about-invalid-attribute-and/runtest.sh b/tests/trust-anchor-complains-about-invalid-attribute-and/runtest.sh new file mode 100755 index 0000000..3ca17e1 --- /dev/null +++ b/tests/trust-anchor-complains-about-invalid-attribute-and/runtest.sh @@ -0,0 +1,59 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/p11-kit/trust-anchor-complains-about-invalid-attribute-and +# Description: Test for trust anchor complains about invalid attribute and +# Author: Hubert Kario +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2017 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="p11-kit" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlRun "rlFileBackup --clean /etc/pki" + rlPhaseEnd + + rlPhaseStartTest + DUMMY_MAKER_BIN="/etc/pki/tls/certs/make-dummy-cert" + [ -x /usr/bin/make-dummy-cert ] && DUMMY_MAKER_BIN="/usr/bin/make-dummy-cert" + rlRun "$DUMMY_MAKER_BIN mycert-tmp.pem" + rlRun "openssl x509 -in mycert-tmp.pem -addtrust clientAuth -addtrust serverAuth -addtrust emailProtection -out mycert.pem" + rlAssertNotExists "/etc/pki/ca-trust/source/localhost.localdomain.p11-kit" + rlRun -s "trust anchor --store mycert.pem" + rlAssertNotGrep "p11-kit:" $rlRun_LOG + rlAssertExists "/etc/pki/ca-trust/source/localhost.localdomain.p11-kit" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "popd" + rlRun "rlFileRestore" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd