diff --git a/.gitignore b/.gitignore index bdef1dd..f2d8374 100644 --- a/.gitignore +++ b/.gitignore @@ -3,3 +3,8 @@ /*.src.rpm /p11-kit-0.*/ /x86_64/ +/trust-extract-compat +/p11-kit-0.23.9.tar.gz +/p11-kit-client.service +/trust-extract-compat +/p11-kit-0.23.9.tar.gz diff --git a/p11-kit-0.23.1-no-finalize.patch b/p11-kit-0.23.1-no-finalize.patch deleted file mode 100644 index e067df5..0000000 --- a/p11-kit-0.23.1-no-finalize.patch +++ /dev/null @@ -1,86 +0,0 @@ -From cacaf8cd0b0a4f2cd61b61b012cd5cbf715fe38f Mon Sep 17 00:00:00 2001 -From: Nikos Mavrogiannopoulos -Date: Wed, 24 Jun 2015 09:43:57 +0200 -Subject: In proxy module don't call C_Finalize on a forked process. - -This corrects a deadlock on the forked process. The deadlock -happened because the proxy called C_Finalize prior to a C_Initialize -which is wrong according to PKCS #11 (2.40). This patch eliminates -the C_Finalize call in that case. - -This resolves #90289 -https://bugs.freedesktop.org/show_bug.cgi?id=90289 - -Reviewed-by: Stef Walter - -diff --git a/p11-kit/proxy.c b/p11-kit/proxy.c -index db2acb8..28fd186 100644 ---- a/p11-kit/proxy.c -+++ b/p11-kit/proxy.c -@@ -98,6 +98,7 @@ static State *all_instances = NULL; - static State global = { { { { -1, -1 }, NULL, }, }, NULL, NULL, FIRST_HANDLE, NULL }; - - #define PROXY_VALID(px) ((px) && (px)->forkid == p11_forkid) -+#define PROXY_FORKED(px) ((px) && (px)->forkid != p11_forkid) - - #define MANUFACTURER_ID "PKCS#11 Kit " - #define LIBRARY_DESCRIPTION "PKCS#11 Kit Proxy Module " -@@ -187,10 +188,11 @@ map_session_to_real (Proxy *px, - } - - static void --proxy_free (Proxy *py) -+proxy_free (Proxy *py, unsigned finalize) - { - if (py) { -- p11_kit_modules_finalize (py->inited); -+ if (finalize) -+ p11_kit_modules_finalize (py->inited); - free (py->inited); - p11_dict_free (py->sessions); - free (py->mappings); -@@ -227,7 +229,7 @@ proxy_C_Finalize (CK_X_FUNCTION_LIST *self, - - p11_unlock (); - -- proxy_free (py); -+ proxy_free (py, 1); - } - - p11_debug ("out: %lu", rv); -@@ -301,7 +303,7 @@ proxy_create (Proxy **res) - } - - if (rv != CKR_OK) { -- proxy_free (py); -+ proxy_free (py, 1); - return rv; - } - -@@ -331,8 +333,13 @@ proxy_C_Initialize (CK_X_FUNCTION_LIST *self, - p11_lock (); - - if (!PROXY_VALID (state->px)) { -+ unsigned call_finalize = 1; -+ - initialize = true; -- proxy_free (state->px); -+ if (PROXY_FORKED(state->px)) -+ call_finalize = 0; -+ proxy_free (state->px, call_finalize); -+ - state->px = NULL; - } else { - state->px->refs++; -@@ -360,7 +367,7 @@ proxy_C_Initialize (CK_X_FUNCTION_LIST *self, - - p11_unlock (); - -- proxy_free (py); -+ proxy_free (py, 1); - p11_debug ("out: 0"); - return rv; - } --- -cgit v0.10.2 - diff --git a/p11-kit-0.23.1-no-libffi-deinit.patch b/p11-kit-0.23.1-no-libffi-deinit.patch deleted file mode 100644 index 0e5395a..0000000 --- a/p11-kit-0.23.1-no-libffi-deinit.patch +++ /dev/null @@ -1,58 +0,0 @@ -From ec8a291efb87f1751a18c7e023a67232c15a4ef2 Mon Sep 17 00:00:00 2001 -From: Nikos Mavrogiannopoulos -Date: Wed, 24 Jun 2015 16:08:42 +0200 -Subject: Do not deinitialize libffi's wrapper functions - -Libffi uses shared memory to store them, and a deallocation -in a child will cause issues for the parent or vice versa. - -Signed-off-by: Stef Walter - * Use #if to comment out code, avoid compiler warnings - -diff --git a/p11-kit/virtual.c b/p11-kit/virtual.c -index 2f4f0ae..bb0d845 100644 ---- a/p11-kit/virtual.c -+++ b/p11-kit/virtual.c -@@ -54,6 +54,13 @@ - * not be defined. This is checked in configure.ac - */ - -+/* -+ * Since libffi uses shared memory to store that, releasing it -+ * will cause issues on any other child or parent process that relies -+ * on that. Don't release it. -+ */ -+#define LIBFFI_FREE_CLOSURES 0 -+ - #include "ffi.h" - #ifndef FFI_CLOSURES - #error "FFI_CLOSURES should be checked in configure.ac" -@@ -2718,6 +2725,7 @@ init_wrapper_funcs (Wrapper *wrapper) - return true; - } - -+#if LIBFFI_FREE_CLOSURES - static void - uninit_wrapper_funcs (Wrapper *wrapper) - { -@@ -2726,6 +2734,7 @@ uninit_wrapper_funcs (Wrapper *wrapper) - for (i = 0; i < wrapper->ffi_used; i++) - ffi_closure_free (wrapper->ffi_closures[i]); - } -+#endif - - CK_FUNCTION_LIST * - p11_virtual_wrap (p11_virtual *virt, -@@ -2792,7 +2801,9 @@ p11_virtual_unwrap (CK_FUNCTION_LIST_PTR module) - if (wrapper->destroyer) - (wrapper->destroyer) (wrapper->virt); - -+#if LIBFFI_FREE_CLOSURES - uninit_wrapper_funcs (wrapper); -+#endif - free (wrapper); - } - --- -cgit v0.10.2 - diff --git a/p11-kit-client.service b/p11-kit-client.service new file mode 100644 index 0000000..c9b8e30 --- /dev/null +++ b/p11-kit-client.service @@ -0,0 +1,11 @@ +[Unit] +Description=p11-kit client + +[Service] +Type=oneshot +RemainAfterExit=true +RuntimeDirectory=p11-kit +ExecStart=/usr/bin/true + +[Install] +WantedBy=default.target diff --git a/p11-kit-server-eval-env.patch b/p11-kit-server-eval-env.patch new file mode 100644 index 0000000..cd2a812 --- /dev/null +++ b/p11-kit-server-eval-env.patch @@ -0,0 +1,52 @@ +From 031912fa844c4f3da327c8b2578d9d9ce2a6473e Mon Sep 17 00:00:00 2001 +From: Daiki Ueno +Date: Thu, 5 Oct 2017 10:59:02 +0200 +Subject: [PATCH] server: Make it possible to eval envvar settings + +Previously, calling "eval $(p11-kit server)" from shell hung because +the program didn't properly close stdout before forking. +--- + p11-kit/server.c | 20 +++++++++++--------- + 1 file changed, 11 insertions(+), 9 deletions(-) + +diff --git a/p11-kit/server.c b/p11-kit/server.c +index 97e18e2..96c77ec 100644 +--- a/p11-kit/server.c ++++ b/p11-kit/server.c +@@ -346,6 +346,17 @@ server_loop (Server *server, + if (server->socket == -1) + return 1; + ++ if (!quiet) { ++ char *path; ++ ++ path = p11_path_encode (server->socket_name); ++ printf ("P11_KIT_SERVER_ADDRESS=unix:path=%s\n", path); ++ free (path); ++ printf ("P11_KIT_SERVER_PID=%d\n", getpid ()); ++ fflush (stdout); ++ close (STDOUT_FILENO); ++ } ++ + /* run as daemon */ + if (!foreground) { + pid = fork (); +@@ -372,15 +383,6 @@ server_loop (Server *server, + + sigprocmask (SIG_BLOCK, &blockset, NULL); + +- if (!quiet) { +- char *path; +- +- path = p11_path_encode (server->socket_name); +- printf ("P11_KIT_SERVER_ADDRESS=unix:path=%s\n", path); +- free (path); +- printf ("P11_KIT_SERVER_PID=%d\n", getpid ()); +- } +- + /* accept connections */ + ret = 0; + for (;;) { +-- +2.13.6 + diff --git a/p11-kit.spec b/p11-kit.spec index 15685f6..c628e25 100644 --- a/p11-kit.spec +++ b/p11-kit.spec @@ -1,17 +1,23 @@ +# This spec file has been automatically updated +Version: 0.23.9 +Release: 2%{?dist} +Patch1: p11-kit-server-eval-env.patch Name: p11-kit -Version: 0.23.2 -Release: 2%{?dist} Summary: Library for loading and sharing PKCS#11 modules License: BSD URL: http://p11-glue.freedesktop.org/p11-kit.html -Source0: http://p11-glue.freedesktop.org/releases/p11-kit-%{version}.tar.gz +Source0: https://github.com/p11-glue/p11-kit/releases/download/%{version}/p11-kit-%{version}.tar.gz Source1: trust-extract-compat +Source2: p11-kit-client.service BuildRequires: libtasn1-devel >= 2.3 -BuildRequires: nss-softokn-freebl BuildRequires: libffi-devel BuildRequires: gtk-doc +BuildRequires: systemd +# Work around for https://bugzilla.redhat.com/show_bug.cgi?id=1497147 +# Remove this once it is fixed +BuildRequires: pkgconfig(glib-2.0) %description p11-kit provides a way to load and enumerate PKCS#11 modules, as well @@ -40,6 +46,16 @@ The %{name}-trust package contains a system trust PKCS#11 module which contains certificate anchors and black lists. +%package server +Summary: Server and client commands for %{name} +Requires: %{name}%{?_isa} = %{version}-%{release} + +%description server +The %{name}-server package contains command line tools that enable to +export PKCS#11 modules through a Unix domain socket. Note that this +feature is still experimental. + + # solution taken from icedtea-web.spec %define multilib_arches ppc64 sparc64 x86_64 ppc64le %ifarch %{multilib_arches} @@ -50,12 +66,12 @@ contains certificate anchors and black lists. %prep -%setup -q +%autosetup -p1 %build # These paths are the source paths that come from the plan here: # https://fedoraproject.org/wiki/Features/SharedSystemCertificates:SubTasks -%configure --disable-static --enable-doc --with-trust-paths=%{_sysconfdir}/pki/ca-trust/source:%{_datadir}/pki/ca-trust-source --with-hash-impl=freebl --disable-silent-rules +%configure --disable-static --enable-doc --with-trust-paths=%{_sysconfdir}/pki/ca-trust/source:%{_datadir}/pki/ca-trust-source --disable-silent-rules make %{?_smp_mflags} V=1 %install @@ -63,9 +79,11 @@ make install DESTDIR=$RPM_BUILD_ROOT mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/pkcs11/modules rm -f $RPM_BUILD_ROOT%{_libdir}/*.la rm -f $RPM_BUILD_ROOT%{_libdir}/pkcs11/*.la -install -p -m 755 %{SOURCE1} $RPM_BUILD_ROOT%{_libdir}/p11-kit/ +install -p -m 755 %{SOURCE1} $RPM_BUILD_ROOT%{_libexecdir}/p11-kit/ # Install the example conf with %%doc instead rm $RPM_BUILD_ROOT%{_sysconfdir}/pkcs11/pkcs11.conf.example +mkdir -p $RPM_BUILD_ROOT%{_userunitdir} +install -p -m 644 %{SOURCE2} $RPM_BUILD_ROOT%{_userunitdir} %check make check @@ -95,11 +113,11 @@ fi %dir %{_sysconfdir}/pkcs11/modules %dir %{_datadir}/p11-kit %dir %{_datadir}/p11-kit/modules -%dir %{_libdir}/p11-kit +%dir %{_libexecdir}/p11-kit %{_bindir}/p11-kit %{_libdir}/libp11-kit.so.* %{_libdir}/p11-kit-proxy.so -%{_libdir}/p11-kit/p11-kit-remote +%{_libexecdir}/p11-kit/p11-kit-remote %{_mandir}/man1/trust.1.gz %{_mandir}/man8/p11-kit.8.gz %{_mandir}/man5/pkcs11.conf.5.gz @@ -113,12 +131,33 @@ fi %files trust %{_bindir}/trust %dir %{_libdir}/pkcs11 +%ghost %{_libdir}/libnssckbi.so %{_libdir}/pkcs11/p11-kit-trust.so %{_datadir}/p11-kit/modules/p11-kit-trust.module -%{_libdir}/p11-kit/trust-extract-compat +%{_libexecdir}/p11-kit/trust-extract-compat + +%files server +%{_libdir}/pkcs11/p11-kit-client.so +%{_userunitdir}/p11-kit-client.service +%{_libexecdir}/p11-kit/p11-kit-server %changelog +* Thu Oct 05 2017 Daiki Ueno - 0.23.9-2 +- server: Make it possible to eval envvar settings + +* Wed Oct 04 2017 Daiki Ueno - 0.23.9-1 +- Update to upstream 0.23.9 release + +* Tue Aug 15 2017 Daiki Ueno - 0.23.8-1 +- Update to 0.23.8 release + +* Tue May 23 2017 Daiki Ueno - 0.23.2-4 +- Make "trust anchor --remove" work again + +* Fri Mar 31 2017 Daiki Ueno - 0.23.2-3 +- Backport patch to recognize CKA_NSS_MOZILLA_CA_POLICY + * Thu Feb 04 2016 Fedora Release Engineering - 0.23.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild diff --git a/sources b/sources index c3741e1..e959f3c 100644 --- a/sources +++ b/sources @@ -1 +1,3 @@ -738af2442331fc22f440df9bee9b062a p11-kit-0.23.2.tar.gz +SHA512 (p11-kit-client.service) = 0f08618851c6eafb35c630957044fc96324be4d3828cdd2aa9b5d6e1245549197ca5b969d6a2f735c893d73c02e885cdc3205bd43e37f6124ebc6cfa61970d3b +SHA512 (trust-extract-compat) = 91210705f9bcf1a13c0de1ca9943e3ac68296bfcb7953fc59241de060247b470b39be6e914dd4d92e38a78d5df0962c83315ad78f8c0eade8e62d884b05fdd42 +SHA512 (p11-kit-0.23.9.tar.gz) = 6a8a569483763d3ffacadf669b8ba9b9be38a77dd8dc366ca0cb91c44753517fa1879d4422e4e8dfbcac594565727839a619566a170c0f94f8e112f18b0086ed