From 634e8088934852b8fbf2f421f1c077807f71bcad Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Fri, 2 Feb 2024 13:28:25 -0500 Subject: [PATCH 01/10] Fix incorrect calloc() invocations caught by -Wcalloc-transposed-args Signed-off-by: Peter Jones --- 0002-Fix-reversed-calloc-arguments.patch | 41 ++++++++++++++++++++++++ pesign.patches | 1 + pesign.spec | 5 ++- 3 files changed, 46 insertions(+), 1 deletion(-) create mode 100644 0002-Fix-reversed-calloc-arguments.patch diff --git a/0002-Fix-reversed-calloc-arguments.patch b/0002-Fix-reversed-calloc-arguments.patch new file mode 100644 index 0000000..861993c --- /dev/null +++ b/0002-Fix-reversed-calloc-arguments.patch @@ -0,0 +1,41 @@ +From 1f9e2fa0b4d872fdd01ca3ba81b04dfb1211a187 Mon Sep 17 00:00:00 2001 +From: Stephen Gallagher +Date: Fri, 2 Feb 2024 09:32:48 -0500 +Subject: [PATCH] Fix reversed calloc() arguments + +The prototype is "void *calloc(size_t nelem, size_t elsize);" + +These two instances had them reversed, almost certainly leading to +buffer overflow issues. This was detected by +-Werror=calloc-transposed-args on gcc. + +Signed-off-by: Stephen Gallagher +--- + src/pesigcheck.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/pesigcheck.c b/src/pesigcheck.c +index 6dc67f76a81..8119cf10a7b 100644 +--- a/src/pesigcheck.c ++++ b/src/pesigcheck.c +@@ -240,7 +240,7 @@ check_signature(pesigcheck_context *ctx, int *nreasons, + + cert_iter iter; + +- reasonps = calloc(sizeof(struct reason), 512); ++ reasonps = calloc(512, sizeof(struct reason)); + if (!reasonps) + err(1, "check_signature"); + +@@ -281,7 +281,7 @@ check_signature(pesigcheck_context *ctx, int *nreasons, + + num_reasons += 16; + +- new_reasons = calloc(sizeof(struct reason), num_reasons); ++ new_reasons = calloc(num_reasons, sizeof(struct reason)); + if (!new_reasons) + err(1, "check_signature"); + reasonps = new_reasons; +-- +2.41.0 + diff --git a/pesign.patches b/pesign.patches index 2ca4433..fa7478f 100644 --- a/pesign.patches +++ b/pesign.patches @@ -1 +1,2 @@ Patch0001: 0001-cms_common-Fixed-Segmentation-fault.patch +Patch0002: 0002-Fix-reversed-calloc-arguments.patch diff --git a/pesign.spec b/pesign.spec index 6d73398..de9c1ce 100644 --- a/pesign.spec +++ b/pesign.spec @@ -6,7 +6,7 @@ Name: pesign Summary: Signing utility for UEFI binaries Version: 116 -Release: 2%{?dist} +Release: 3%{?dist} License: GPL-2.0-only URL: https://github.com/rhboot/pesign @@ -162,6 +162,9 @@ certutil -d %{_sysconfdir}/pki/pesign/ -X -L > /dev/null %{python3_sitelib}/mockbuild/plugins/pesign.* %changelog +* Fri Feb 02 2024 Peter Jones - 116-3 +- Fix incorrect calloc() invocations caught by -Wcalloc-transposed-args + * Mon Feb 20 2023 Nicolas Frayer - 116-2 - cms_common: Fixed Segmentation fault From 74685e918a559dcd0c40d28ba96d7a2ecba89f85 Mon Sep 17 00:00:00 2001 From: JasenChao Date: Tue, 5 Mar 2024 20:44:59 +0800 Subject: [PATCH 02/10] Add riscv64 support. --- pesign.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/pesign.spec b/pesign.spec index de9c1ce..0bccb2f 100644 --- a/pesign.spec +++ b/pesign.spec @@ -6,7 +6,7 @@ Name: pesign Summary: Signing utility for UEFI binaries Version: 116 -Release: 3%{?dist} +Release: 4%{?dist} License: GPL-2.0-only URL: https://github.com/rhboot/pesign @@ -38,7 +38,7 @@ Requires: nss-util Requires: popt Requires: rpm Requires(pre): shadow-utils -ExclusiveArch: %{ix86} x86_64 ia64 aarch64 %{arm} +ExclusiveArch: %{ix86} x86_64 ia64 aarch64 %{arm} riscv64 %if 0%{?rhel} == 7 BuildRequires: rh-signing-tools >= 1.20-2 %endif @@ -162,6 +162,9 @@ certutil -d %{_sysconfdir}/pki/pesign/ -X -L > /dev/null %{python3_sitelib}/mockbuild/plugins/pesign.* %changelog +* Tue Mar 05 2024 Liu Yang - 116-4 +- Add riscv64. + * Fri Feb 02 2024 Peter Jones - 116-3 - Fix incorrect calloc() invocations caught by -Wcalloc-transposed-args From 58d5697b85b8a09a7560c916b36eed6ee8eafa42 Mon Sep 17 00:00:00 2001 From: Stephen Gallagher Date: Wed, 10 Jul 2024 10:07:44 -0400 Subject: [PATCH 03/10] Add package.cfg for ELN Starting with fedpkg 1.45, we can now have `fedpkg build` automatically trigger both the Rawhide and ELN build of this package, since it cannot be rebuilt by the normal ELN auto-rebuild service due to the restricted nature of this package. By adding this file, the maintainer does not need to remember to build it for both releases manually. Signed-off-by: Stephen Gallagher --- package.cfg | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 package.cfg diff --git a/package.cfg b/package.cfg new file mode 100644 index 0000000..0cf8855 --- /dev/null +++ b/package.cfg @@ -0,0 +1,3 @@ +[koji] +targets = rawhide eln + From df4c12aec8bbcd45f1e82eb67ca0d968820578c2 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Tue, 12 Nov 2024 14:05:21 -0800 Subject: [PATCH 04/10] Rebuild to pick up riscv64 change --- pesign.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pesign.spec b/pesign.spec index 0bccb2f..6c5e788 100644 --- a/pesign.spec +++ b/pesign.spec @@ -6,7 +6,7 @@ Name: pesign Summary: Signing utility for UEFI binaries Version: 116 -Release: 4%{?dist} +Release: 5%{?dist} License: GPL-2.0-only URL: https://github.com/rhboot/pesign @@ -162,6 +162,9 @@ certutil -d %{_sysconfdir}/pki/pesign/ -X -L > /dev/null %{python3_sitelib}/mockbuild/plugins/pesign.* %changelog +* Tue Nov 12 2024 Kevin Fenzi - 116-5 +- Rebuild to pick up riscv64 change + * Tue Mar 05 2024 Liu Yang - 116-4 - Add riscv64. From c938656c1214c9eb5edfecbc33febe543c96754a Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Thu, 21 Nov 2024 14:02:44 -0500 Subject: [PATCH 05/10] Work around OpenSC token name changes Signed-off-by: Peter Jones --- pesign.patches | 1 + pesign.spec | 5 ++++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/pesign.patches b/pesign.patches index fa7478f..50d9486 100644 --- a/pesign.patches +++ b/pesign.patches @@ -1,2 +1,3 @@ Patch0001: 0001-cms_common-Fixed-Segmentation-fault.patch Patch0002: 0002-Fix-reversed-calloc-arguments.patch +Patch0003: 0003-Work-around-OpenSC-changing-token-names-on-fedora-bu.patch diff --git a/pesign.spec b/pesign.spec index 6c5e788..723bab8 100644 --- a/pesign.spec +++ b/pesign.spec @@ -6,7 +6,7 @@ Name: pesign Summary: Signing utility for UEFI binaries Version: 116 -Release: 5%{?dist} +Release: 6%{?dist} License: GPL-2.0-only URL: https://github.com/rhboot/pesign @@ -162,6 +162,9 @@ certutil -d %{_sysconfdir}/pki/pesign/ -X -L > /dev/null %{python3_sitelib}/mockbuild/plugins/pesign.* %changelog +* Thu Nov 21 2024 Peter Jones - 116-6 +- Work around OpenSC token name changes + * Tue Nov 12 2024 Kevin Fenzi - 116-5 - Rebuild to pick up riscv64 change From 8b1bcf2332ace11c2c4afc264fe44a2ec7b2044d Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Thu, 21 Nov 2024 14:02:44 -0500 Subject: [PATCH 06/10] Work around OpenSC token name changes Signed-off-by: Peter Jones --- ...SC-changing-token-names-on-fedora-bu.patch | 61 +++++++++++++++++++ 1 file changed, 61 insertions(+) create mode 100644 0003-Work-around-OpenSC-changing-token-names-on-fedora-bu.patch diff --git a/0003-Work-around-OpenSC-changing-token-names-on-fedora-bu.patch b/0003-Work-around-OpenSC-changing-token-names-on-fedora-bu.patch new file mode 100644 index 0000000..663f4c4 --- /dev/null +++ b/0003-Work-around-OpenSC-changing-token-names-on-fedora-bu.patch @@ -0,0 +1,61 @@ +From dc17b1d248c705073a5160e7c871a52aa9ce6e99 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Thu, 21 Nov 2024 13:58:05 -0500 +Subject: [PATCH] Work around OpenSC changing token names on fedora builders + *again*. + +Once again OpenSC has changed how token names work in an incompatible +way, and we need to work around it even harder on the Fedora kernel +builders. + +Reviewed-by: Kevin Fenzi +Reviewed-by: Justin Forbes +Signed-off-by: Peter Jones +--- + src/macros.pesign | 3 ++- + src/pesign-rpmbuild-helper.in | 15 ++++++++++++++- + 2 files changed, 16 insertions(+), 2 deletions(-) + +diff --git a/src/macros.pesign b/src/macros.pesign +index b7d6af1f6f5..47e3f19f8ed 100644 +--- a/src/macros.pesign ++++ b/src/macros.pesign +@@ -9,7 +9,8 @@ + %__pesign_token %{nil}%{?pe_signing_token:--token "%{pe_signing_token}"} + %__pesign_cert %{!?pe_signing_cert:"Red Hat Test Certificate"}%{?pe_signing_cert:"%{pe_signing_cert}"} + +-%__pesign_client_token %{!?pe_signing_token:"OpenSC Card (Fedora Signer)"}%{?pe_signing_token:"%{pe_signing_token}"} ++# See the comment in pesign-rpmbuild-helper.in about the token name here. ++%__pesign_client_token %{!?pe_signing_token:"OpenSC Card"}%{?pe_signing_token:"%{pe_signing_token}"} + %__pesign_client_cert %{!?pe_signing_cert:"/CN=Fedora Secure Boot Signer"}%{?pe_signing_cert:"%{pe_signing_cert}"} + + %_pesign /usr/bin/pesign +diff --git a/src/pesign-rpmbuild-helper.in b/src/pesign-rpmbuild-helper.in +index 30d5441207b..42de1a1e002 100644 +--- a/src/pesign-rpmbuild-helper.in ++++ b/src/pesign-rpmbuild-helper.in +@@ -214,7 +214,20 @@ main() { + rm -rf "${sattrs}" "${sattrs}.sig" "${nssdir}" + elif [[ -n "${socket}" ]] ; then + ### welcome haaaaack city +- if [[ "${client_token[1]}" = "OpenSC Card (Fedora Signer)" ]] ; then ++ ### different versions of the opensc library name the token different ++ ### things, and as of this commit: ++ ### https://github.com/OpenSC/OpenSC/commit/259decf656a77a6d1bd3e944d6f198ed70832ff5 ++ ### that includes just not including the token label unless there's ++ ### more than one token. Unfortunately this is both for the displayed ++ ### info and for the token name you specify to /use/ the token, so we ++ ### have to handle all of those options here, and change the name to ++ ### match whatever the current version of opensc is using in the rpm ++ ### macro where we're setting it. Thankfully this is just a "is this ++ ### Fedora" check for us, and if it's RHEL we're not using OpenSC at ++ ### all. ++ if [[ "${client_token[1]}" = "OpenSC Card (Fedora Signer)" ]] \ ++ || [[ "${client_token[1]}" = "Fedora Signer" ]] \ ++ || [[ "${client_token[1]}" = "OpenSC Card" ]] ; then + if [[ "${input[1]}" =~ (/|^)vmlinuz($|[_.-]) ]] \ + || [[ "${input[1]}" =~ (/|^)bzImage($|[_.-]) ]] ; then + if [[ "${rhelcertfile}" =~ redhatsecureboot501.* ]] \ +-- +2.47.0 + From 93c64f2a0d041912609f8660c9eb09ec2e5b5d5b Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Fri, 10 Jan 2025 20:40:35 +0000 Subject: [PATCH 07/10] Backport patch to skip auth on friendly slot Allow attaching a signature to a binary, needed for signing RPM packages in the SUSE Open Build Service. Upstream PR: https://github.com/rhboot/pesign/pull/101 Signed-off-by: Luca Boccassi --- ...-authentication-on-the-Friendly-slot.patch | 41 +++++++++++++++++++ pesign.patches | 1 + pesign.spec | 5 ++- 3 files changed, 46 insertions(+), 1 deletion(-) create mode 100644 0004-cms_common-skip-authentication-on-the-Friendly-slot.patch diff --git a/0004-cms_common-skip-authentication-on-the-Friendly-slot.patch b/0004-cms_common-skip-authentication-on-the-Friendly-slot.patch new file mode 100644 index 0000000..d13e454 --- /dev/null +++ b/0004-cms_common-skip-authentication-on-the-Friendly-slot.patch @@ -0,0 +1,41 @@ +From 616ec5f25adbde1a4bd78cdcacd6dcd7ecfa5a5c Mon Sep 17 00:00:00 2001 +From: Gary Lin +Date: Thu, 22 Dec 2022 13:49:34 +0800 +Subject: [PATCH] cms_common: skip authentication on the 'Friendly' slot + +When finding a certificate in a 'Friendly' slot without the need of the +private key, it is not necessary to authenticate the slot. + +For example, when the signed attributes and the raw signature are +created in a server and the user has the certificate, signkey.x509, and +tries to import them into myapp.efi: + + $ certutil -N -d nssdb -f passwd + $ certutil -A -d nssdb -f passwd -n signkey -t CT,CT,CT \ + -i signkey.x509 + $ pesign -n nssdb -c signkey -i myapp.efi -o myapp.efi.signed \ + -d sha256 -I myapp.sattr -R myapp.sig + +Since the "signkey" is 'Friendly', i.e. publicly readable, and the +private key is not needed, we can just skip the authentication and find +"signkey" in the slot. + +Signed-off-by: Gary Lin +--- + src/cms_common.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/src/cms_common.c b/src/cms_common.c +index cf572ca..44e5cca 100644 +--- a/src/cms_common.c ++++ b/src/cms_common.c +@@ -628,7 +628,8 @@ find_certificate(cms_context *cms, int needs_private_key) + + int errnum; + SECStatus status; +- if (PK11_NeedLogin(psle->slot) && !PK11_IsLoggedIn(psle->slot, cms)) { ++ if ((needs_private_key || !PK11_IsFriendly(psle->slot)) && ++ (PK11_NeedLogin(psle->slot) && !PK11_IsLoggedIn(psle->slot, cms))) { + status = PK11_Authenticate(psle->slot, PR_TRUE, cms); + if (status != SECSuccess) { + save_port_err() { diff --git a/pesign.patches b/pesign.patches index 50d9486..d5f5f82 100644 --- a/pesign.patches +++ b/pesign.patches @@ -1,3 +1,4 @@ Patch0001: 0001-cms_common-Fixed-Segmentation-fault.patch Patch0002: 0002-Fix-reversed-calloc-arguments.patch Patch0003: 0003-Work-around-OpenSC-changing-token-names-on-fedora-bu.patch +Patch0004: 0004-cms_common-skip-authentication-on-the-Friendly-slot.patch diff --git a/pesign.spec b/pesign.spec index 723bab8..eaef8eb 100644 --- a/pesign.spec +++ b/pesign.spec @@ -6,7 +6,7 @@ Name: pesign Summary: Signing utility for UEFI binaries Version: 116 -Release: 6%{?dist} +Release: 7%{?dist} License: GPL-2.0-only URL: https://github.com/rhboot/pesign @@ -162,6 +162,9 @@ certutil -d %{_sysconfdir}/pki/pesign/ -X -L > /dev/null %{python3_sitelib}/mockbuild/plugins/pesign.* %changelog +* Wed Jan 29 2025 Nicolas Frayer - 116-7 +- Backport patch to skip auth on friendly slot + * Thu Nov 21 2024 Peter Jones - 116-6 - Work around OpenSC token name changes From d06a6e72e4d5bcd168f77540735124e0d79518c0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 11 Feb 2025 15:53:30 +0100 Subject: [PATCH 08/10] Add sysusers.d config file to allow rpm to create users/groups automatically See https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers. --- pesign.spec | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/pesign.spec b/pesign.spec index eaef8eb..9daa276 100644 --- a/pesign.spec +++ b/pesign.spec @@ -6,7 +6,7 @@ Name: pesign Summary: Signing utility for UEFI binaries Version: 116 -Release: 7%{?dist} +Release: 8%{?dist} License: GPL-2.0-only URL: https://github.com/rhboot/pesign @@ -37,7 +37,6 @@ Requires: nss-tools >= 3.53 Requires: nss-util Requires: popt Requires: rpm -Requires(pre): shadow-utils ExclusiveArch: %{ix86} x86_64 ia64 aarch64 %{arm} riscv64 %if 0%{?rhel} == 7 BuildRequires: rh-signing-tools >= 1.20-2 @@ -67,6 +66,11 @@ git am %{patches} pesign.sysusers.conf </dev/null || groupadd -r pesign -getent passwd pesign >/dev/null || \ - useradd -r -g pesign -d /run/pesign -s /sbin/nologin \ - -c "Group for the pesign signing daemon" pesign -exit 0 +install -m0644 -D pesign.sysusers.conf %{buildroot}%{_sysusersdir}/pesign.conf + %if 0%{?rhel} >= 7 || 0%{?fedora} >= 17 %post @@ -160,8 +160,12 @@ certutil -d %{_sysconfdir}/pki/pesign/ -X -L > /dev/null %endif %{python3_sitelib}/mockbuild/plugins/*/pesign.* %{python3_sitelib}/mockbuild/plugins/pesign.* +%{_sysusersdir}/pesign.conf %changelog +* Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek +- Add sysusers.d config file to allow rpm to create users/groups automatically + * Wed Jan 29 2025 Nicolas Frayer - 116-7 - Backport patch to skip auth on friendly slot From 0fec26534d262708d3132b88f37d9e1e9b62f5c7 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Fri, 20 Jun 2025 16:13:03 -0400 Subject: [PATCH 09/10] Remove package.cfg This did not consistently work as intended, and the ELN automation can now build this properly. --- package.cfg | 3 --- 1 file changed, 3 deletions(-) delete mode 100644 package.cfg diff --git a/package.cfg b/package.cfg deleted file mode 100644 index 0cf8855..0000000 --- a/package.cfg +++ /dev/null @@ -1,3 +0,0 @@ -[koji] -targets = rawhide eln - From cd8477a2ebae2f3fdc82adffdd217d0da0aade6e Mon Sep 17 00:00:00 2001 From: Nicolas Frayer Date: Mon, 22 Jun 2026 21:04:52 +0200 Subject: [PATCH 10/10] Fix a FTBFS issue caused by a missing const qualifier Resolves: #2491392 Signed-off-by: Nicolas Frayer --- 0005-Add-const-qualifier-to-variable.patch | 25 ++++++++++++++++++++++ pesign.patches | 1 + pesign.spec | 6 +++++- 3 files changed, 31 insertions(+), 1 deletion(-) create mode 100644 0005-Add-const-qualifier-to-variable.patch diff --git a/0005-Add-const-qualifier-to-variable.patch b/0005-Add-const-qualifier-to-variable.patch new file mode 100644 index 0000000..20669f0 --- /dev/null +++ b/0005-Add-const-qualifier-to-variable.patch @@ -0,0 +1,25 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Nicolas Frayer +Date: Mon, 22 Jun 2026 20:58:03 +0200 +Subject: [PATCH] Add const qualifier to variable + +Add const to a variable initialized with using strrchr. + +Signed-off-by: Nicolas Frayer +--- + src/pesum.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/pesum.c b/src/pesum.c +index e4ddaf86d7fa..5d7dcb929eec 100644 +--- a/src/pesum.c ++++ b/src/pesum.c +@@ -141,7 +141,7 @@ main(int argc, char *argv[]) + while ((infile = poptGetArg(optCon)) != NULL) { + pesign_context *ctxp = NULL; + +- char *ext = strrchr(infile, '.'); ++ const char *ext = strrchr(infile, '.'); + if (ext && strcmp(ext, ".ko") == 0) + fmt = FORMAT_KERNEL_MODULE; + diff --git a/pesign.patches b/pesign.patches index d5f5f82..9981c26 100644 --- a/pesign.patches +++ b/pesign.patches @@ -2,3 +2,4 @@ Patch0001: 0001-cms_common-Fixed-Segmentation-fault.patch Patch0002: 0002-Fix-reversed-calloc-arguments.patch Patch0003: 0003-Work-around-OpenSC-changing-token-names-on-fedora-bu.patch Patch0004: 0004-cms_common-skip-authentication-on-the-Friendly-slot.patch +Patch0005: 0005-Add-const-qualifier-to-variable.patch diff --git a/pesign.spec b/pesign.spec index 9daa276..9785b6b 100644 --- a/pesign.spec +++ b/pesign.spec @@ -6,7 +6,7 @@ Name: pesign Summary: Signing utility for UEFI binaries Version: 116 -Release: 8%{?dist} +Release: 9%{?dist} License: GPL-2.0-only URL: https://github.com/rhboot/pesign @@ -163,6 +163,10 @@ certutil -d %{_sysconfdir}/pki/pesign/ -X -L > /dev/null %{_sysusersdir}/pesign.conf %changelog +* Mon Jun 22 2026 Nicolas Frayer - 116-9 +- Fix a FTBFS issue caused by a missing const qualifier +- Resolves: #2491392 + * Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek - Add sysusers.d config file to allow rpm to create users/groups automatically