Update to 0.23.9-2

- server: Make it possible to eval envvar settings

.gitignore

@@ -3,3 +3,8 @@
 /*.src.rpm
 /p11-kit-0.*/
 /x86_64/
+/trust-extract-compat
+/p11-kit-0.23.9.tar.gz
+/p11-kit-client.service
+/trust-extract-compat
+/p11-kit-0.23.9.tar.gz

p11-kit-0.23.1-no-finalize.patch

@@ -1,86 +0,0 @@
-From cacaf8cd0b0a4f2cd61b61b012cd5cbf715fe38f Mon Sep 17 00:00:00 2001
-From: Nikos Mavrogiannopoulos <nmav@redhat.com>
-Date: Wed, 24 Jun 2015 09:43:57 +0200
-Subject: In proxy module don't call C_Finalize on a forked process.
-
-This corrects a deadlock on the forked process. The deadlock
-happened because the proxy called C_Finalize prior to a C_Initialize
-which is wrong according to PKCS #11 (2.40). This patch eliminates
-the C_Finalize call in that case.
-
-This resolves #90289
-https://bugs.freedesktop.org/show_bug.cgi?id=90289
-
-Reviewed-by: Stef Walter <stefw@redhat.com>
-
-diff --git a/p11-kit/proxy.c b/p11-kit/proxy.c
-index db2acb8..28fd186 100644
---- a/p11-kit/proxy.c
-+++ b/p11-kit/proxy.c
-@@ -98,6 +98,7 @@ static State *all_instances = NULL;
- static State global = { { { { -1, -1 }, NULL, }, }, NULL, NULL, FIRST_HANDLE, NULL };
- 
- #define PROXY_VALID(px) ((px) && (px)->forkid == p11_forkid)
-+#define PROXY_FORKED(px) ((px) && (px)->forkid != p11_forkid)
- 
- #define MANUFACTURER_ID         "PKCS#11 Kit                     "
- #define LIBRARY_DESCRIPTION     "PKCS#11 Kit Proxy Module        "
-@@ -187,10 +188,11 @@ map_session_to_real (Proxy *px,
- }
- 
- static void
--proxy_free (Proxy *py)
-+proxy_free (Proxy *py, unsigned finalize)
- {
- 	if (py) {
--		p11_kit_modules_finalize (py->inited);
-+		if (finalize)
-+			p11_kit_modules_finalize (py->inited);
- 		free (py->inited);
- 		p11_dict_free (py->sessions);
- 		free (py->mappings);
-@@ -227,7 +229,7 @@ proxy_C_Finalize (CK_X_FUNCTION_LIST *self,
- 
- 		p11_unlock ();
- 
--		proxy_free (py);
-+		proxy_free (py, 1);
- 	}
- 
- 	p11_debug ("out: %lu", rv);
-@@ -301,7 +303,7 @@ proxy_create (Proxy **res)
- 	}
- 
- 	if (rv != CKR_OK) {
--		proxy_free (py);
-+		proxy_free (py, 1);
- 		return rv;
- 	}
- 
-@@ -331,8 +333,13 @@ proxy_C_Initialize (CK_X_FUNCTION_LIST *self,
- 	p11_lock ();
- 
- 		if (!PROXY_VALID (state->px)) {
-+			unsigned call_finalize = 1;
-+
- 			initialize = true;
--			proxy_free (state->px);
-+			if (PROXY_FORKED(state->px))
-+				call_finalize = 0;
-+			proxy_free (state->px, call_finalize);
-+
- 			state->px = NULL;
- 		} else {
- 			state->px->refs++;
-@@ -360,7 +367,7 @@ proxy_C_Initialize (CK_X_FUNCTION_LIST *self,
- 
- 	p11_unlock ();
- 
--	proxy_free (py);
-+	proxy_free (py, 1);
- 	p11_debug ("out: 0");
- 	return rv;
- }
--- 
-cgit v0.10.2
-

p11-kit-0.23.1-no-libffi-deinit.patch

@@ -1,58 +0,0 @@
-From ec8a291efb87f1751a18c7e023a67232c15a4ef2 Mon Sep 17 00:00:00 2001
-From: Nikos Mavrogiannopoulos <nmav@redhat.com>
-Date: Wed, 24 Jun 2015 16:08:42 +0200
-Subject: Do not deinitialize libffi's wrapper functions
-
-Libffi uses shared memory to store them, and a deallocation
-in a child will cause issues for the parent or vice versa.
-
-Signed-off-by: Stef Walter <stefw@redhat.com>
- * Use #if to comment out code, avoid compiler warnings
-
-diff --git a/p11-kit/virtual.c b/p11-kit/virtual.c
-index 2f4f0ae..bb0d845 100644
---- a/p11-kit/virtual.c
-+++ b/p11-kit/virtual.c
-@@ -54,6 +54,13 @@
-  * not be defined. This is checked in configure.ac
-  */
- 
-+/*
-+ * Since libffi uses shared memory to store that, releasing it
-+ * will cause issues on any other child or parent process that relies
-+ * on that. Don't release it.
-+ */
-+#define LIBFFI_FREE_CLOSURES 0
-+
- #include "ffi.h"
- #ifndef FFI_CLOSURES
- #error "FFI_CLOSURES should be checked in configure.ac"
-@@ -2718,6 +2725,7 @@ init_wrapper_funcs (Wrapper *wrapper)
- 	return true;
- }
- 
-+#if LIBFFI_FREE_CLOSURES
- static void
- uninit_wrapper_funcs (Wrapper *wrapper)
- {
-@@ -2726,6 +2734,7 @@ uninit_wrapper_funcs (Wrapper *wrapper)
- 	for (i = 0; i < wrapper->ffi_used; i++)
- 		ffi_closure_free (wrapper->ffi_closures[i]);
- }
-+#endif
- 
- CK_FUNCTION_LIST *
- p11_virtual_wrap (p11_virtual *virt,
-@@ -2792,7 +2801,9 @@ p11_virtual_unwrap (CK_FUNCTION_LIST_PTR module)
- 	if (wrapper->destroyer)
- 		(wrapper->destroyer) (wrapper->virt);
- 
-+#if LIBFFI_FREE_CLOSURES
- 	uninit_wrapper_funcs (wrapper);
-+#endif
- 	free (wrapper);
- }
- 
--- 
-cgit v0.10.2
-

p11-kit-client.service

@@ -0,0 +1,11 @@
+[Unit]
+Description=p11-kit client
+
+[Service]
+Type=oneshot
+RemainAfterExit=true
+RuntimeDirectory=p11-kit
+ExecStart=/usr/bin/true
+
+[Install]
+WantedBy=default.target

p11-kit-server-eval-env.patch

@@ -0,0 +1,52 @@
+From 031912fa844c4f3da327c8b2578d9d9ce2a6473e Mon Sep 17 00:00:00 2001
+From: Daiki Ueno <dueno@redhat.com>
+Date: Thu, 5 Oct 2017 10:59:02 +0200
+Subject: [PATCH] server: Make it possible to eval envvar settings
+
+Previously, calling "eval $(p11-kit server)" from shell hung because
+the program didn't properly close stdout before forking.
+---
+ p11-kit/server.c | 20 +++++++++++---------
+ 1 file changed, 11 insertions(+), 9 deletions(-)
+
+diff --git a/p11-kit/server.c b/p11-kit/server.c
+index 97e18e2..96c77ec 100644
+--- a/p11-kit/server.c
++++ b/p11-kit/server.c
+@@ -346,6 +346,17 @@ server_loop (Server *server,
+ 	if (server->socket == -1)
+ 		return 1;
+ 
++	if (!quiet) {
++		char *path;
++
++		path = p11_path_encode (server->socket_name);
++		printf ("P11_KIT_SERVER_ADDRESS=unix:path=%s\n", path);
++		free (path);
++		printf ("P11_KIT_SERVER_PID=%d\n", getpid ());
++		fflush (stdout);
++		close (STDOUT_FILENO);
++	}
++
+ 	/* run as daemon */
+ 	if (!foreground) {
+ 		pid = fork ();
+@@ -372,15 +383,6 @@ server_loop (Server *server,
+ 
+ 	sigprocmask (SIG_BLOCK, &blockset, NULL);
+ 
+-	if (!quiet) {
+-		char *path;
+-
+-		path = p11_path_encode (server->socket_name);
+-		printf ("P11_KIT_SERVER_ADDRESS=unix:path=%s\n", path);
+-		free (path);
+-		printf ("P11_KIT_SERVER_PID=%d\n", getpid ());
+-	}
+-
+ 	/* accept connections */
+ 	ret = 0;
+ 	for (;;) {
+-- 
+2.13.6
+

p11-kit.spec

@@ -1,17 +1,23 @@
+# This spec file has been automatically updated
+Version:	0.23.9
+Release: 2%{?dist}
+Patch1:	p11-kit-server-eval-env.patch
 Name:           p11-kit
-Version:        0.23.2
-Release:        2%{?dist}
 Summary:        Library for loading and sharing PKCS#11 modules
 
 License:        BSD
 URL:            http://p11-glue.freedesktop.org/p11-kit.html
-Source0:        http://p11-glue.freedesktop.org/releases/p11-kit-%{version}.tar.gz
+Source0:        https://github.com/p11-glue/p11-kit/releases/download/%{version}/p11-kit-%{version}.tar.gz
 Source1:        trust-extract-compat
+Source2:	p11-kit-client.service
 
 BuildRequires:  libtasn1-devel >= 2.3
-BuildRequires:  nss-softokn-freebl
 BuildRequires:  libffi-devel
 BuildRequires:  gtk-doc
+BuildRequires:	systemd
+# Work around for https://bugzilla.redhat.com/show_bug.cgi?id=1497147
+# Remove this once it is fixed
+BuildRequires:  pkgconfig(glib-2.0)
 
 %description
 p11-kit provides a way to load and enumerate PKCS#11 modules, as well
@@ -40,6 +46,16 @@ The %{name}-trust package contains a system trust PKCS#11 module which
 contains certificate anchors and black lists.
 
 
+%package server
+Summary:        Server and client commands for %{name}
+Requires:       %{name}%{?_isa} = %{version}-%{release}
+
+%description server
+The %{name}-server package contains command line tools that enable to
+export PKCS#11 modules through a Unix domain socket.  Note that this
+feature is still experimental.
+
+
 # solution taken from icedtea-web.spec
 %define multilib_arches ppc64 sparc64 x86_64 ppc64le
 %ifarch %{multilib_arches}
@@ -50,12 +66,12 @@ contains certificate anchors and black lists.
 
 
 %prep
-%setup -q
+%autosetup -p1
 
 %build
 # These paths are the source paths that  come from the plan here:
 # https://fedoraproject.org/wiki/Features/SharedSystemCertificates:SubTasks
-%configure --disable-static --enable-doc --with-trust-paths=%{_sysconfdir}/pki/ca-trust/source:%{_datadir}/pki/ca-trust-source --with-hash-impl=freebl --disable-silent-rules
+%configure --disable-static --enable-doc --with-trust-paths=%{_sysconfdir}/pki/ca-trust/source:%{_datadir}/pki/ca-trust-source --disable-silent-rules
 make %{?_smp_mflags} V=1
 
 %install
@@ -63,9 +79,11 @@ make install DESTDIR=$RPM_BUILD_ROOT
 mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/pkcs11/modules
 rm -f $RPM_BUILD_ROOT%{_libdir}/*.la
 rm -f $RPM_BUILD_ROOT%{_libdir}/pkcs11/*.la
-install -p -m 755 %{SOURCE1} $RPM_BUILD_ROOT%{_libdir}/p11-kit/
+install -p -m 755 %{SOURCE1} $RPM_BUILD_ROOT%{_libexecdir}/p11-kit/
 # Install the example conf with %%doc instead
 rm $RPM_BUILD_ROOT%{_sysconfdir}/pkcs11/pkcs11.conf.example
+mkdir -p $RPM_BUILD_ROOT%{_userunitdir}
+install -p -m 644 %{SOURCE2} $RPM_BUILD_ROOT%{_userunitdir}
 
 %check
 make check
@@ -95,11 +113,11 @@ fi
 %dir %{_sysconfdir}/pkcs11/modules
 %dir %{_datadir}/p11-kit
 %dir %{_datadir}/p11-kit/modules
-%dir %{_libdir}/p11-kit
+%dir %{_libexecdir}/p11-kit
 %{_bindir}/p11-kit
 %{_libdir}/libp11-kit.so.*
 %{_libdir}/p11-kit-proxy.so
-%{_libdir}/p11-kit/p11-kit-remote
+%{_libexecdir}/p11-kit/p11-kit-remote
 %{_mandir}/man1/trust.1.gz
 %{_mandir}/man8/p11-kit.8.gz
 %{_mandir}/man5/pkcs11.conf.5.gz
@@ -113,12 +131,33 @@ fi
 %files trust
 %{_bindir}/trust
 %dir %{_libdir}/pkcs11
+%ghost %{_libdir}/libnssckbi.so
 %{_libdir}/pkcs11/p11-kit-trust.so
 %{_datadir}/p11-kit/modules/p11-kit-trust.module
-%{_libdir}/p11-kit/trust-extract-compat
+%{_libexecdir}/p11-kit/trust-extract-compat
+
+%files server
+%{_libdir}/pkcs11/p11-kit-client.so
+%{_userunitdir}/p11-kit-client.service
+%{_libexecdir}/p11-kit/p11-kit-server
 
 
 %changelog
+* Thu Oct 05 2017 Daiki Ueno <dueno@redhat.com> - 0.23.9-2
+- server: Make it possible to eval envvar settings
+
+* Wed Oct 04 2017 Daiki Ueno <dueno@redhat.com> - 0.23.9-1
+- Update to upstream 0.23.9 release
+
+* Tue Aug 15 2017 Daiki Ueno <dueno@redhat.com> - 0.23.8-1
+- Update to 0.23.8 release
+
+* Tue May 23 2017 Daiki Ueno <dueno@redhat.com> - 0.23.2-4
+- Make "trust anchor --remove" work again
+
+* Fri Mar 31 2017 Daiki Ueno <dueno@redhat.com> - 0.23.2-3
+- Backport patch to recognize CKA_NSS_MOZILLA_CA_POLICY
+
 * Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 0.23.2-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
 

sources

@@ -1 +1,3 @@
-738af2442331fc22f440df9bee9b062a  p11-kit-0.23.2.tar.gz
+SHA512 (p11-kit-client.service) = 0f08618851c6eafb35c630957044fc96324be4d3828cdd2aa9b5d6e1245549197ca5b969d6a2f735c893d73c02e885cdc3205bd43e37f6124ebc6cfa61970d3b
+SHA512 (trust-extract-compat) = 91210705f9bcf1a13c0de1ca9943e3ac68296bfcb7953fc59241de060247b470b39be6e914dd4d92e38a78d5df0962c83315ad78f8c0eade8e62d884b05fdd42
+SHA512 (p11-kit-0.23.9.tar.gz) = 6a8a569483763d3ffacadf669b8ba9b9be38a77dd8dc366ca0cb91c44753517fa1879d4422e4e8dfbcac594565727839a619566a170c0f94f8e112f18b0086ed