From 60b9e1ff1cb85165756e9d5534252cf446ab3117 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Tue, 12 Nov 2019 13:15:28 -0500 Subject: [PATCH 1/8] Rebuild to fix an NSS API issue. Signed-off-by: Peter Jones --- ...fikeygen-Fix-the-build-with-nss-3.44.patch | 45 +++++++++++++++++++ pesign.spec | 6 ++- 2 files changed, 50 insertions(+), 1 deletion(-) create mode 100644 0030-efikeygen-Fix-the-build-with-nss-3.44.patch diff --git a/0030-efikeygen-Fix-the-build-with-nss-3.44.patch b/0030-efikeygen-Fix-the-build-with-nss-3.44.patch new file mode 100644 index 0000000..e583369 --- /dev/null +++ b/0030-efikeygen-Fix-the-build-with-nss-3.44.patch @@ -0,0 +1,45 @@ +From b535d1ac5cbcdf18a97d97a92581e38080d9e521 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Tue, 14 May 2019 11:28:38 -0400 +Subject: [PATCH] efikeygen: Fix the build with nss 3.44 + +NSS 3.44 adds some certificate types, which changes a type and makes +some encoding stuff weird. As a result, we get: + +gcc8 -I/wrkdirs/usr/ports/sysutils/pesign/work/pesign-0.110/include -O2 -pipe -fstack-protector-strong -Wl,-rpath=/usr/local/lib/gcc8 -isystem /usr/local/include -fno-strict-aliasing -g -O0 -g -O0 -Wall -fshort-wchar -fno-strict-aliasing -fno-merge-constants --std=gnu99 -D_GNU_SOURCE -Wno-unused-result -Wno-unused-function -I../include/ -I/usr/local/include/nss -I/usr/local/include/nss/nss -I/usr/local/include/nspr -Werror -fPIC -isystem /usr/local/include -DCONFIG_amd64 -DCONFIG_amd64 -c efikeygen.c -o efikeygen.o +In file included from /usr/local/include/nss/nss/cert.h:22, + from efikeygen.c:39: +efikeygen.c: In function 'add_cert_type': +/usr/local/include/nss/nss/certt.h:445:5: error: unsigned conversion from 'int' to 'unsigned char' changes value from '496' to '240' [-Werror=overflow] + (NS_CERT_TYPE_SSL_CLIENT | NS_CERT_TYPE_SSL_SERVER | NS_CERT_TYPE_EMAIL | \ + ^ +efikeygen.c:208:23: note: in expansion of macro 'NS_CERT_TYPE_APP' + unsigned char type = NS_CERT_TYPE_APP; + ^~~~~~~~~~~~~~~~ +cc1: all warnings being treated as errors + +This is fixed by just making it an int. + +Fixes github issue #48. + +Signed-off-by: Peter Jones +--- + src/efikeygen.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/efikeygen.c b/src/efikeygen.c +index ede76ef0b48..2cd953e9781 100644 +--- a/src/efikeygen.c ++++ b/src/efikeygen.c +@@ -208,7 +208,7 @@ static int + add_cert_type(cms_context *cms, void *extHandle, int is_ca) + { + SECItem bitStringValue; +- unsigned char type = NS_CERT_TYPE_APP; ++ int type = NS_CERT_TYPE_APP; + + if (is_ca) + type |= NS_CERT_TYPE_SSL_CA | +-- +2.23.0 + diff --git a/pesign.spec b/pesign.spec index 0d6ce00..50420aa 100644 --- a/pesign.spec +++ b/pesign.spec @@ -3,7 +3,7 @@ Name: pesign Summary: Signing utility for UEFI binaries Version: 0.112 -Release: 26%{?dist} +Release: 27%{?dist} License: GPLv2 URL: https://github.com/vathpela/pesign @@ -70,6 +70,7 @@ Patch0026: 0026-Clean-up-gcc-command-lines-a-little.patch Patch0027: 0027-Make-pesign-users-groups-static-in-the-repo.patch Patch0028: 0028-rpm-Make-the-client-signer-use-the-fedora-values-unl.patch Patch0029: 0029-Make-macros.pesign-error-in-kojibuilder-if-we-don-t-.patch +Patch0030: 0030-efikeygen-Fix-the-build-with-nss-3.44.patch %description This package contains the pesign utility for signing UEFI binaries as @@ -177,6 +178,9 @@ exit 0 %{python3_sitelib}/mockbuild/plugins/pesign.* %changelog +* Tue Nov 12 2019 Peter Jones - 0.112-27 +- Rebuild to fix an NSS API issue. + * Fri Jul 26 2019 Fedora Release Engineering - 0.112-26 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild From 8347ce20e47458a0de4be6222521db63ee9715e9 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 30 Jan 2020 06:39:31 +0000 Subject: [PATCH 2/8] - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- pesign.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pesign.spec b/pesign.spec index 50420aa..134921a 100644 --- a/pesign.spec +++ b/pesign.spec @@ -3,7 +3,7 @@ Name: pesign Summary: Signing utility for UEFI binaries Version: 0.112 -Release: 27%{?dist} +Release: 28%{?dist} License: GPLv2 URL: https://github.com/vathpela/pesign @@ -178,6 +178,9 @@ exit 0 %{python3_sitelib}/mockbuild/plugins/pesign.* %changelog +* Thu Jan 30 2020 Fedora Release Engineering - 0.112-28 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + * Tue Nov 12 2019 Peter Jones - 0.112-27 - Rebuild to fix an NSS API issue. From afaf2eaa2ac8aea0f7db8327cf8ea7f5c644250d Mon Sep 17 00:00:00 2001 From: Jeremy Cline Date: Tue, 18 Feb 2020 16:37:53 -0500 Subject: [PATCH 3/8] pesign: Apparently opensc got updated and the token name changed All the kernel builds started failing yesterday because the signing token could not be found. Update the token name in the macro shipped by pesign. --- 0028-rpm-Make-the-client-signer-use-the-fedora-values-unl.patch | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/0028-rpm-Make-the-client-signer-use-the-fedora-values-unl.patch b/0028-rpm-Make-the-client-signer-use-the-fedora-values-unl.patch index 3f0b2e1..793fe6c 100644 --- a/0028-rpm-Make-the-client-signer-use-the-fedora-values-unl.patch +++ b/0028-rpm-Make-the-client-signer-use-the-fedora-values-unl.patch @@ -17,7 +17,7 @@ index 69280e9..22a3ee6 100644 %__pesign_token %{nil}%{?pe_signing_token:-t "%{pe_signing_token}"} %__pesign_cert %{!?pe_signing_cert:"Red Hat Test Certificate"}%{?pe_signing_cert:"%{pe_signing_cert}"} -+%__pesign_client_token %{!?pe_signing_token:"Fedora Signer (OpenSC Card)"}%{?pe_signing_token:"%{pe_signing_token}"} ++%__pesign_client_token %{!?pe_signing_token:"OpenSC Card (Fedora Signer)"}%{?pe_signing_token:"%{pe_signing_token}"} +%__pesign_client_cert %{!?pe_signing_cert:"/CN=Fedora Secure Boot Signer"}%{?pe_signing_cert:"%{pe_signing_cert}"} + %_pesign /usr/bin/pesign From a110727a1d703fe6dd6258bf3aebfb04b213c9dd Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Tue, 18 Feb 2020 17:27:22 -0500 Subject: [PATCH 4/8] Rebuild to match OpenSC's token name mangling change. Signed-off-by: Peter Jones --- pesign.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pesign.spec b/pesign.spec index 134921a..c29c84f 100644 --- a/pesign.spec +++ b/pesign.spec @@ -3,7 +3,7 @@ Name: pesign Summary: Signing utility for UEFI binaries Version: 0.112 -Release: 28%{?dist} +Release: 29%{?dist} License: GPLv2 URL: https://github.com/vathpela/pesign @@ -178,6 +178,9 @@ exit 0 %{python3_sitelib}/mockbuild/plugins/pesign.* %changelog +* Tue Feb 18 2020 Peter Jones - 0.112-29 +- Rebuild to match OpenSC's token name mangling change. + * Thu Jan 30 2020 Fedora Release Engineering - 0.112-28 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild From e087d2f629170f63b9f04582e1f7df6dbbc39f23 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Tue, 18 Feb 2020 17:33:22 -0500 Subject: [PATCH 5/8] Backport a minor fix. Signed-off-by: Peter Jones --- 0031-pesigcheck-Fix-a-wrong-assignment.patch | 49 ++++++++++++++++++++ pesign.spec | 1 + 2 files changed, 50 insertions(+) create mode 100644 0031-pesigcheck-Fix-a-wrong-assignment.patch diff --git a/0031-pesigcheck-Fix-a-wrong-assignment.patch b/0031-pesigcheck-Fix-a-wrong-assignment.patch new file mode 100644 index 0000000..7df5f0b --- /dev/null +++ b/0031-pesigcheck-Fix-a-wrong-assignment.patch @@ -0,0 +1,49 @@ +From c555fd74c009242c3864576bd5f17a1f8f4fdffd Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Tue, 18 Feb 2020 16:28:56 -0500 +Subject: [PATCH] pesigcheck: Fix a wrong assignment + +gcc says: + + pesigcheck.c: In function 'check_signature': + pesigcheck.c:321:17: error: implicit conversion from 'enum ' to 'enum ' [-Werror=enum-conversion] + 321 | reason->type = siBuffer; + | ^ + pesigcheck.c:333:17: error: implicit conversion from 'enum ' to 'enum ' [-Werror=enum-conversion] + 333 | reason->type = siBuffer; + | ^ + cc1: all warnings being treated as errors + +And indeed, that line of code makes no sense at all - it was supposed to +be reason->sig.type. + +Signed-off-by: Peter Jones +--- + src/pesigcheck.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/pesigcheck.c b/src/pesigcheck.c +index 524cce307bf..8fa0f1ad03d 100644 +--- a/src/pesigcheck.c ++++ b/src/pesigcheck.c +@@ -318,7 +318,7 @@ check_signature(pesigcheck_context *ctx, int *nreasons, + reason->type = SIGNATURE; + reason->sig.data = data; + reason->sig.len = datalen; +- reason->type = siBuffer; ++ reason->sig.type = siBuffer; + nreason += 1; + is_invalid = true; + } +@@ -330,7 +330,7 @@ check_signature(pesigcheck_context *ctx, int *nreasons, + reason->type = SIGNATURE; + reason->sig.data = data; + reason->sig.len = datalen; +- reason->type = siBuffer; ++ reason->sig.type = siBuffer; + nreason += 1; + has_valid_cert = true; + } +-- +2.24.1 + diff --git a/pesign.spec b/pesign.spec index c29c84f..4a74aa2 100644 --- a/pesign.spec +++ b/pesign.spec @@ -71,6 +71,7 @@ Patch0027: 0027-Make-pesign-users-groups-static-in-the-repo.patch Patch0028: 0028-rpm-Make-the-client-signer-use-the-fedora-values-unl.patch Patch0029: 0029-Make-macros.pesign-error-in-kojibuilder-if-we-don-t-.patch Patch0030: 0030-efikeygen-Fix-the-build-with-nss-3.44.patch +Patch0031: 0031-pesigcheck-Fix-a-wrong-assignment.patch %description This package contains the pesign utility for signing UEFI binaries as From c81bb3960a7a27641e298979d48d495fe79f3098 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Thu, 16 Jul 2020 16:29:13 -0400 Subject: [PATCH 6/8] Synchronize with master Signed-off-by: Peter Jones --- ...e_integer-it-doesn-t-build-on-i686-a.patch | 72 --- ...fikeygen-Fix-the-build-with-nss-3.44.patch | 0 0002-Fix-command-line-parsing.patch | 73 --- ...02-pesigcheck-Fix-a-wrong-assignment.patch | 0 ...t-and-server-work-with-the-113-proto.patch | 317 +++++++++++++ ...gcc-don-t-error-on-stuff-in-includes.patch | 26 -- 0004-Fix-certficate-argument-name.patch | 39 -- 0004-Rename-var-run-to-run.patch | 46 ++ ...c-got-updated-and-the-token-name-cha.patch | 30 ++ ...ion-of-ascii-armor-option-in-manpage.patch | 26 -- ...ke-ascii-work-since-we-documented-it.patch | 22 - ...-run-and-var-run-for-the-socket-path.patch | 86 ++++ ...ient-to-also-accept-token-cert-macro.patch | 32 -- 0007-client-remove-an-extra-debug-print.patch | 25 ++ ...ros.pesign-to-pesign-rpmbuild-helper.patch | 383 ++++++++++++++++ ...fy-with-the-cert-as-an-object-signer.patch | 25 -- ...sigcheck-make-certfile-actually-work.patch | 47 -- 0009-pesign-authorize-shellcheck.patch | 60 +++ ...ize-don-t-setfacl-etc-pki-pesign-foo.patch | 26 ++ ...-make-sure-err-is-always-initialized.patch | 27 -- 0011-kernel-building-hack.patch | 41 ++ ...make-pesign-h-tell-you-the-file-name.patch | 26 -- 0012-Add-coverity-build-scripts.patch | 104 ----- 0012-Use-run-not-var-run.patch | 105 +++++ 0013-Document-implicit-fallthrough.patch | 25 -- ...cl-each-directory-of-our-key-storage.patch | 50 --- ..._MODULE_SIGNING_ONLY-and-fix-our-arr.patch | 59 --- 0016-efikeygen-add-modsign.patch | 197 -------- ...y-even-harder-to-pick-a-reasonable-v.patch | 121 ----- 0018-show-which-db-we-re-checking.patch | 137 ------ 0019-more-about-the-time.patch | 97 ---- 0020-try-to-say-why-something-fails.patch | 419 ------------------ ...ix-race-condition-in-SEC_GetPassword.patch | 34 -- ...eate-the-socket-directory-at-runtime.patch | 27 -- ...-Better-authorization-scripts.-Again.patch | 217 --------- ...also-try-to-give-better-errors-on-EP.patch | 95 ---- 0025-certdb-fix-PRTime-printfs-for-i686.patch | 31 -- ...-Clean-up-gcc-command-lines-a-little.patch | 41 -- ...sign-users-groups-static-in-the-repo.patch | 54 --- ...ent-signer-use-the-fedora-values-unl.patch | 43 -- ...gn-error-in-kojibuilder-if-we-don-t-.patch | 39 -- pesign.spec | 72 ++- sources | 4 +- 43 files changed, 1152 insertions(+), 2248 deletions(-) delete mode 100644 0001-cms-kill-generate_integer-it-doesn-t-build-on-i686-a.patch rename 0030-efikeygen-Fix-the-build-with-nss-3.44.patch => 0001-efikeygen-Fix-the-build-with-nss-3.44.patch (100%) delete mode 100644 0002-Fix-command-line-parsing.patch rename 0031-pesigcheck-Fix-a-wrong-assignment.patch => 0002-pesigcheck-Fix-a-wrong-assignment.patch (100%) create mode 100644 0003-Make-0.112-client-and-server-work-with-the-113-proto.patch delete mode 100644 0003-gcc-don-t-error-on-stuff-in-includes.patch delete mode 100644 0004-Fix-certficate-argument-name.patch create mode 100644 0004-Rename-var-run-to-run.patch create mode 100644 0005-Apparently-opensc-got-updated-and-the-token-name-cha.patch delete mode 100644 0005-Fix-description-of-ascii-armor-option-in-manpage.patch delete mode 100644 0006-Make-ascii-work-since-we-documented-it.patch create mode 100644 0006-client-try-run-and-var-run-for-the-socket-path.patch delete mode 100644 0007-Switch-pesign-client-to-also-accept-token-cert-macro.patch create mode 100644 0007-client-remove-an-extra-debug-print.patch create mode 100644 0008-Move-most-of-macros.pesign-to-pesign-rpmbuild-helper.patch delete mode 100644 0008-pesigcheck-Verify-with-the-cert-as-an-object-signer.patch delete mode 100644 0009-pesigcheck-make-certfile-actually-work.patch create mode 100644 0009-pesign-authorize-shellcheck.patch create mode 100644 0010-pesign-authorize-don-t-setfacl-etc-pki-pesign-foo.patch delete mode 100644 0010-signerInfos-make-sure-err-is-always-initialized.patch create mode 100644 0011-kernel-building-hack.patch delete mode 100644 0011-pesign-make-pesign-h-tell-you-the-file-name.patch delete mode 100644 0012-Add-coverity-build-scripts.patch create mode 100644 0012-Use-run-not-var-run.patch delete mode 100644 0013-Document-implicit-fallthrough.patch delete mode 100644 0014-Actually-setfacl-each-directory-of-our-key-storage.patch delete mode 100644 0015-oid-add-SHIM_EKU_MODULE_SIGNING_ONLY-and-fix-our-arr.patch delete mode 100644 0016-efikeygen-add-modsign.patch delete mode 100644 0017-check_cert_db-try-even-harder-to-pick-a-reasonable-v.patch delete mode 100644 0018-show-which-db-we-re-checking.patch delete mode 100644 0019-more-about-the-time.patch delete mode 100644 0020-try-to-say-why-something-fails.patch delete mode 100644 0021-Fix-race-condition-in-SEC_GetPassword.patch delete mode 100644 0022-sysvinit-Create-the-socket-directory-at-runtime.patch delete mode 100644 0023-Better-authorization-scripts.-Again.patch delete mode 100644 0024-Make-the-daemon-also-try-to-give-better-errors-on-EP.patch delete mode 100644 0025-certdb-fix-PRTime-printfs-for-i686.patch delete mode 100644 0026-Clean-up-gcc-command-lines-a-little.patch delete mode 100644 0027-Make-pesign-users-groups-static-in-the-repo.patch delete mode 100644 0028-rpm-Make-the-client-signer-use-the-fedora-values-unl.patch delete mode 100644 0029-Make-macros.pesign-error-in-kojibuilder-if-we-don-t-.patch diff --git a/0001-cms-kill-generate_integer-it-doesn-t-build-on-i686-a.patch b/0001-cms-kill-generate_integer-it-doesn-t-build-on-i686-a.patch deleted file mode 100644 index 0c82dcf..0000000 --- a/0001-cms-kill-generate_integer-it-doesn-t-build-on-i686-a.patch +++ /dev/null @@ -1,72 +0,0 @@ -From 33bcca8303cad962606df3bfc6a031a9b0626375 Mon Sep 17 00:00:00 2001 -From: Peter Jones -Date: Thu, 21 Apr 2016 10:47:34 -0400 -Subject: [PATCH 01/29] cms: kill generate_integer(), it doesn't build on i686 - and it's unused. - -Signed-off-by: Peter Jones ---- - src/cms_common.c | 34 ---------------------------------- - src/cms_common.h | 1 - - 2 files changed, 35 deletions(-) - -diff --git a/src/cms_common.c b/src/cms_common.c -index b19bc62..6a4e6a7 100644 ---- a/src/cms_common.c -+++ b/src/cms_common.c -@@ -641,40 +641,6 @@ generate_string(cms_context *cms, SECItem *der, char *str) - return 0; - } - --static SEC_ASN1Template IntegerTemplate[] = { -- {.kind = SEC_ASN1_INTEGER, -- .offset = 0, -- .sub = NULL, -- .size = sizeof(long), -- }, -- { 0 }, --}; -- --int --generate_integer(cms_context *cms, SECItem *der, unsigned long integer) --{ -- void *ret; -- -- uint32_t u32; -- -- SECItem input = { -- .data = (void *)&integer, -- .len = sizeof(integer), -- .type = siUnsignedInteger, -- }; -- -- if (integer < 0x100000000) { -- u32 = integer & 0xffffffffUL; -- input.data = (void *)&u32; -- input.len = sizeof(u32); -- } -- -- ret = SEC_ASN1EncodeItem(cms->arena, der, &input, IntegerTemplate); -- if (ret == NULL) -- cmsreterr(-1, cms, "could not encode data"); -- return 0; --} -- - int - generate_time(cms_context *cms, SECItem *encoded, time_t when) - { -diff --git a/src/cms_common.h b/src/cms_common.h -index 7d77faf..c7d7268 100644 ---- a/src/cms_common.h -+++ b/src/cms_common.h -@@ -117,7 +117,6 @@ extern int generate_object_id(cms_context *ctx, SECItem *encoded, - SECOidTag tag); - extern int generate_empty_sequence(cms_context *ctx, SECItem *encoded); - extern int generate_time(cms_context *ctx, SECItem *encoded, time_t when); --extern int generate_integer(cms_context *cms, SECItem *der, unsigned long integer); - extern int generate_string(cms_context *cms, SECItem *der, char *str); - extern int wrap_in_set(cms_context *cms, SECItem *der, SECItem **items); - extern int wrap_in_seq(cms_context *cms, SECItem *der, --- -2.13.4 - diff --git a/0030-efikeygen-Fix-the-build-with-nss-3.44.patch b/0001-efikeygen-Fix-the-build-with-nss-3.44.patch similarity index 100% rename from 0030-efikeygen-Fix-the-build-with-nss-3.44.patch rename to 0001-efikeygen-Fix-the-build-with-nss-3.44.patch diff --git a/0002-Fix-command-line-parsing.patch b/0002-Fix-command-line-parsing.patch deleted file mode 100644 index 9c03eeb..0000000 --- a/0002-Fix-command-line-parsing.patch +++ /dev/null @@ -1,73 +0,0 @@ -From 5be0515dee24308fd7e270bf2e0fb5e5a7a78f32 Mon Sep 17 00:00:00 2001 -From: Julien Cristau -Date: Thu, 9 Jun 2016 14:30:37 +0200 -Subject: [PATCH 02/29] Fix command line parsing - -The gettext translation domain should be passed as .arg, not .descrip, -otherwise popt won't process any of the command line options (it stops -looping over the struct poptOption array when an entry has unset -longName, shortName and arg). - -Signed-off-by: Julien Cristau ---- - src/client.c | 2 +- - src/efikeygen.c | 2 +- - src/efisiglist.c | 2 +- - src/pesigcheck.c | 2 +- - 4 files changed, 4 insertions(+), 4 deletions(-) - -diff --git a/src/client.c b/src/client.c -index 028419f..575c873 100644 ---- a/src/client.c -+++ b/src/client.c -@@ -555,7 +555,7 @@ main(int argc, char *argv[]) - - struct poptOption options[] = { - {.argInfo = POPT_ARG_INTL_DOMAIN, -- .descrip = "pesign" }, -+ .arg = "pesign" }, - {.longName = "token", - .shortName = 't', - .argInfo = POPT_ARG_STRING|POPT_ARGFLAG_SHOW_DEFAULT, -diff --git a/src/efikeygen.c b/src/efikeygen.c -index 6278849..8a515a5 100644 ---- a/src/efikeygen.c -+++ b/src/efikeygen.c -@@ -486,7 +486,7 @@ int main(int argc, char *argv[]) - poptContext optCon; - struct poptOption options[] = { - {.argInfo = POPT_ARG_INTL_DOMAIN, -- .descrip = "pesign" }, -+ .arg = "pesign" }, - /* global nss-ish things */ - {.longName = "dbdir", - .shortName = 'd', -diff --git a/src/efisiglist.c b/src/efisiglist.c -index cd3f1ae..40d6a93 100644 ---- a/src/efisiglist.c -+++ b/src/efisiglist.c -@@ -126,7 +126,7 @@ main(int argc, char *argv[]) - - struct poptOption options[] = { - {.argInfo = POPT_ARG_INTL_DOMAIN, -- .descrip = "pesign" }, -+ .arg = "pesign" }, - {.longName = "infile", - .shortName = 'i', - .argInfo = POPT_ARG_STRING, -diff --git a/src/pesigcheck.c b/src/pesigcheck.c -index 1328fe9..0d49c1a 100644 ---- a/src/pesigcheck.c -+++ b/src/pesigcheck.c -@@ -214,7 +214,7 @@ main(int argc, char *argv[]) - poptContext optCon; - struct poptOption options[] = { - {.argInfo = POPT_ARG_INTL_DOMAIN, -- .descrip = "pesign" }, -+ .arg = "pesign" }, - {.longName = "dbfile", - .shortName = 'D', - .argInfo = POPT_ARG_CALLBACK|POPT_CBFLAG_POST, --- -2.13.4 - diff --git a/0031-pesigcheck-Fix-a-wrong-assignment.patch b/0002-pesigcheck-Fix-a-wrong-assignment.patch similarity index 100% rename from 0031-pesigcheck-Fix-a-wrong-assignment.patch rename to 0002-pesigcheck-Fix-a-wrong-assignment.patch diff --git a/0003-Make-0.112-client-and-server-work-with-the-113-proto.patch b/0003-Make-0.112-client-and-server-work-with-the-113-proto.patch new file mode 100644 index 0000000..e639675 --- /dev/null +++ b/0003-Make-0.112-client-and-server-work-with-the-113-proto.patch @@ -0,0 +1,317 @@ +From 84547e6b7173e4b10a1931fd25f329ea9a8f68b0 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Thu, 11 Jun 2020 16:23:14 -0400 +Subject: [PATCH] Make 0.112 client and server work with the 113 protocol and + vise versa + +This makes the version of the sign API that takes a file type optional, +and makes the client attempt to negotiate which version it's getting. +It also leaves the server able to still handle the version from before +the file type was added. + +Signed-off-by: Peter Jones +--- + src/client.c | 74 +++++++++++++++++++++++++++++++++++++--------------- + src/daemon.c | 63 +++++++++++++++++++++++++++++--------------- + src/daemon.h | 2 ++ + 3 files changed, 97 insertions(+), 42 deletions(-) + +diff --git a/src/client.c b/src/client.c +index aa373abd981..57bcc09cbe8 100644 +--- a/src/client.c ++++ b/src/client.c +@@ -11,6 +11,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -84,8 +85,8 @@ connect_to_server(void) + static int32_t + check_response(int sd, char **srvmsg); + +-static void +-check_cmd_version(int sd, uint32_t command, char *name, int32_t version) ++static int ++check_cmd_version(int sd, uint32_t command, char *name, int32_t version, bool do_exit) + { + struct msghdr msg; + struct iovec iov[1]; +@@ -104,7 +105,7 @@ check_cmd_version(int sd, uint32_t command, char *name, int32_t version) + ssize_t n; + n = sendmsg(sd, &msg, 0); + if (n < 0) { +- fprintf(stderr, "check-cmd-version: kill daemon failed: %m\n"); ++ fprintf(stderr, "check-cmd-version: sendmsg failed: %m\n"); + exit(1); + } + +@@ -120,11 +121,17 @@ check_cmd_version(int sd, uint32_t command, char *name, int32_t version) + + char *srvmsg = NULL; + int32_t rc = check_response(sd, &srvmsg); +- if (rc < 0) ++ ++ if (do_exit && rc < 0) + errx(1, "command \"%s\" not known by server", name); +- if (rc != version) ++ ++ if (do_exit && rc != version) + errx(1, "command \"%s\": client version %d, server version %d", + name, version, rc); ++ ++ if (rc < 0) ++ return rc; ++ return rc == version; + } + + static void +@@ -134,7 +141,7 @@ send_kill_daemon(int sd) + struct iovec iov; + pesignd_msghdr pm; + +- check_cmd_version(sd, CMD_KILL_DAEMON, "kill-daemon", 0); ++ check_cmd_version(sd, CMD_KILL_DAEMON, "kill-daemon", 0, true); + + pm.version = PESIGND_VERSION; + pm.command = CMD_KILL_DAEMON; +@@ -276,7 +283,7 @@ unlock_token(int sd, char *tokenname, char *pin) + + uint32_t size1 = pesignd_string_size(pin); + +- check_cmd_version(sd, CMD_UNLOCK_TOKEN, "unlock-token", 0); ++ check_cmd_version(sd, CMD_UNLOCK_TOKEN, "unlock-token", 0, true); + + pm.version = PESIGND_VERSION; + pm.command = CMD_UNLOCK_TOKEN; +@@ -353,7 +360,7 @@ is_token_unlocked(int sd, char *tokenname) + + uint32_t size0 = pesignd_string_size(tokenname); + +- check_cmd_version(sd, CMD_IS_TOKEN_UNLOCKED, "is-token-unlocked", 0); ++ check_cmd_version(sd, CMD_IS_TOKEN_UNLOCKED, "is-token-unlocked", 0, true); + + pm.version = PESIGND_VERSION; + pm.command = CMD_IS_TOKEN_UNLOCKED; +@@ -452,6 +459,9 @@ static void + sign(int sd, char *infile, char *outfile, char *tokenname, char *certname, + int attached, uint32_t format) + { ++ int rc; ++ bool add_file_type; ++ + int infd = open(infile, O_RDONLY); + if (infd < 0) { + fprintf(stderr, "pesign-client: could not open input file " +@@ -481,12 +491,28 @@ oom: + exit(1); + } + +- check_cmd_version(sd, attached ? CMD_SIGN_ATTACHED : CMD_SIGN_DETACHED, +- attached ? "sign-attached" : "sign-detached", 0); ++ rc = check_cmd_version(sd, ++ attached ? CMD_SIGN_ATTACHED_WITH_FILE_TYPE ++ : CMD_SIGN_DETACHED_WITH_FILE_TYPE, ++ attached ? "sign-attached" : "sign-detached", ++ 0, format == FORMAT_KERNEL_MODULE); ++ if (rc >= 0) { ++ add_file_type = true; ++ } else { ++ add_file_type = false; ++ check_cmd_version(sd, attached ? CMD_SIGN_ATTACHED ++ : CMD_SIGN_DETACHED, ++ attached ? "sign-attached" : "sign-detached", ++ 0, true); ++ } + ++ printf("add_file_type:%d\n", add_file_type); + pm->version = PESIGND_VERSION; +- pm->command = attached ? CMD_SIGN_ATTACHED : CMD_SIGN_DETACHED; +- pm->size = size0 + size1 + sizeof(format); ++ pm->command = attached ? (add_file_type ? CMD_SIGN_ATTACHED_WITH_FILE_TYPE ++ : CMD_SIGN_ATTACHED) ++ : (add_file_type ? CMD_SIGN_DETACHED_WITH_FILE_TYPE ++ : CMD_SIGN_DETACHED); ++ pm->size = size0 + size1 + (add_file_type ? sizeof(format) : 0); + iov[0].iov_base = pm; + iov[0].iov_len = sizeof (*pm); + +@@ -503,25 +529,31 @@ oom: + } + + char *buffer; +- buffer = malloc(size0 + size1); ++ buffer = malloc(pm->size); + if (!buffer) + goto oom; + +- iov[0].iov_base = &format; +- iov[0].iov_len = sizeof(format); ++ int pos = 0; ++ ++ if (add_file_type) { ++ iov[pos].iov_base = &format; ++ iov[pos].iov_len = sizeof(format); ++ pos++; ++ } + + pesignd_string *tn = (pesignd_string *)buffer; + pesignd_string_set(tn, tokenname); +- iov[1].iov_base = tn; +- iov[1].iov_len = size0; ++ iov[pos].iov_base = tn; ++ iov[pos].iov_len = size0; ++ pos++; + + pesignd_string *cn = pesignd_string_next(tn); + pesignd_string_set(cn, certname); +- iov[2].iov_base = cn; +- iov[2].iov_len = size1; ++ iov[pos].iov_base = cn; ++ iov[pos].iov_len = size1; + + msg.msg_iov = iov; +- msg.msg_iovlen = 3; ++ msg.msg_iovlen = add_file_type ? 3 : 2; + + n = sendmsg(sd, &msg, 0); + if (n < 0) { +@@ -535,7 +567,7 @@ oom: + send_fd(sd, outfd); + + char *srvmsg = NULL; +- int rc = check_response(sd, &srvmsg); ++ rc = check_response(sd, &srvmsg); + if (rc < 0) { + fprintf(stderr, "pesign-client: signing failed: \"%s\"\n", + srvmsg); +diff --git a/src/daemon.c b/src/daemon.c +index 9374d59be30..494beb9af72 100644 +--- a/src/daemon.c ++++ b/src/daemon.c +@@ -12,6 +12,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -561,7 +562,7 @@ out: + + static void + handle_signing(context *ctx, struct pollfd *pollfd, socklen_t size, +- int attached) ++ int attached, bool with_file_type) + { + struct msghdr msg; + struct iovec iov; +@@ -585,8 +586,12 @@ oom: + + n = recvmsg(pollfd->fd, &msg, MSG_WAITALL); + +- file_format = *((uint32_t *) buffer); +- n -= sizeof(uint32_t); ++ if (with_file_type) { ++ file_format = *((uint32_t *) buffer); ++ n -= sizeof(uint32_t); ++ } else { ++ file_format = FORMAT_PE_BINARY; ++ } + + pesignd_string *tn = (pesignd_string *)(buffer + sizeof(uint32_t)); + if (n < (long long)sizeof(tn->size)) { +@@ -666,34 +671,44 @@ finish: + teardown_digests(ctx->cms); + } + ++static inline void ++handle_sign_helper(context *ctx, struct pollfd *pollfd, socklen_t size, ++ int attached, bool with_file_type) ++{ ++ int rc = cms_context_alloc(&ctx->cms); ++ if (rc < 0) ++ return; ++ ++ steal_from_cms(ctx->backup_cms, ctx->cms); ++ ++ handle_signing(ctx, pollfd, size, attached, with_file_type); ++ ++ hide_stolen_goods_from_cms(ctx->cms, ctx->backup_cms); ++ cms_context_fini(ctx->cms); ++} ++ + static void + handle_sign_attached(context *ctx, struct pollfd *pollfd, socklen_t size) + { +- int rc = cms_context_alloc(&ctx->cms); +- if (rc < 0) +- return; ++ handle_sign_helper(ctx, pollfd, size, 1, false); ++} + +- steal_from_cms(ctx->backup_cms, ctx->cms); +- +- handle_signing(ctx, pollfd, size, 1); +- +- hide_stolen_goods_from_cms(ctx->cms, ctx->backup_cms); +- cms_context_fini(ctx->cms); ++static void ++handle_sign_attached_with_file_type(context *ctx, struct pollfd *pollfd, socklen_t size) ++{ ++ handle_sign_helper(ctx, pollfd, size, 1, true); + } + + static void + handle_sign_detached(context *ctx, struct pollfd *pollfd, socklen_t size) + { +- int rc = cms_context_alloc(&ctx->cms); +- if (rc < 0) +- return; ++ handle_sign_helper(ctx, pollfd, size, 0, false); ++} + +- steal_from_cms(ctx->backup_cms, ctx->cms); +- +- handle_signing(ctx, pollfd, size, 0); +- +- hide_stolen_goods_from_cms(ctx->cms, ctx->backup_cms); +- cms_context_fini(ctx->cms); ++static void ++handle_sign_detached_with_file_type(context *ctx, struct pollfd *pollfd, socklen_t size) ++{ ++ handle_sign_helper(ctx, pollfd, size, 0, true); + } + + static void +@@ -725,6 +740,12 @@ cmd_table_t cmd_table[] = { + { CMD_UNLOCK_TOKEN, handle_unlock_token, "unlock-token", 0 }, + { CMD_SIGN_ATTACHED, handle_sign_attached, "sign-attached", 0 }, + { CMD_SIGN_DETACHED, handle_sign_detached, "sign-detached", 0 }, ++ { CMD_SIGN_ATTACHED_WITH_FILE_TYPE, ++ handle_sign_attached_with_file_type, ++ "sign-attached-with-file-type", 0 }, ++ { CMD_SIGN_DETACHED_WITH_FILE_TYPE, ++ handle_sign_detached_with_file_type, ++ "sign-detached-with-file-type", 0 }, + { CMD_RESPONSE, NULL, "response", 0 }, + { CMD_IS_TOKEN_UNLOCKED, handle_is_token_unlocked, + "is-token-unlocked", 0 }, +diff --git a/src/daemon.h b/src/daemon.h +index dd430512f1a..834d62c72d0 100644 +--- a/src/daemon.h ++++ b/src/daemon.h +@@ -33,6 +33,8 @@ typedef enum { + CMD_RESPONSE, + CMD_IS_TOKEN_UNLOCKED, + CMD_GET_CMD_VERSION, ++ CMD_SIGN_ATTACHED_WITH_FILE_TYPE, ++ CMD_SIGN_DETACHED_WITH_FILE_TYPE, + CMD_LIST_END + } pesignd_cmd; + +-- +2.26.2 + diff --git a/0003-gcc-don-t-error-on-stuff-in-includes.patch b/0003-gcc-don-t-error-on-stuff-in-includes.patch deleted file mode 100644 index cf4e61d..0000000 --- a/0003-gcc-don-t-error-on-stuff-in-includes.patch +++ /dev/null @@ -1,26 +0,0 @@ -From 6de291458cbab99bcc317e282c16e1523d6de9b8 Mon Sep 17 00:00:00 2001 -From: Peter Jones -Date: Wed, 10 Aug 2016 17:12:39 -0400 -Subject: [PATCH 03/29] gcc: don't error on stuff in includes. - -Signed-off-by: Peter Jones ---- - Make.defaults | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/Make.defaults b/Make.defaults -index c97b452..3511080 100644 ---- a/Make.defaults -+++ b/Make.defaults -@@ -19,7 +19,7 @@ PKG_CONFIG = $(CROSS_COMPILE)pkg-config - CC := $(if $(filter default,$(origin CC)),$(CROSS_COMPILE)gcc,$(CC)) - CCLD := $(if $(filter undefined,$(origin CCLD)),$(CC),$(CCLD)) - CFLAGS ?= -O0 -g3 -fvar-tracking -fvar-tracking-assignments \ -- -Wall -Werror -Wextra -+ -Wall -Werror -Wextra -Wno-error=cpp - AS := $(CROSS_COMPILE)as - AR := $(CROSS_COMPILE)gcc-ar - RANLIB := $(CROSS_COMPILE)gcc-ranlib --- -2.13.4 - diff --git a/0004-Fix-certficate-argument-name.patch b/0004-Fix-certficate-argument-name.patch deleted file mode 100644 index 08509ff..0000000 --- a/0004-Fix-certficate-argument-name.patch +++ /dev/null @@ -1,39 +0,0 @@ -From b20fc54c08e8afe1365e56cacade3ec39984da8d Mon Sep 17 00:00:00 2001 -From: Peter Jones -Date: Tue, 18 Apr 2017 19:00:34 -0400 -Subject: [PATCH 04/29] Fix "certficate" argument name. - -This fixes our typoed argument name by making the incorrectly spelled -version be a popt alias, and fixing the real implementation to be -spelled right in pesign.c . - -Signed-off-by: Peter Jones ---- - src/pesign.c | 2 +- - src/pesign.popt | 1 + - 2 files changed, 2 insertions(+), 1 deletion(-) - -diff --git a/src/pesign.c b/src/pesign.c -index af374b6..279a17a 100644 ---- a/src/pesign.c -+++ b/src/pesign.c -@@ -438,7 +438,7 @@ main(int argc, char *argv[]) - .arg = &ctxp->outfile, - .descrip = "specify output file", - .argDescrip = "" }, -- {.longName = "certficate", -+ {.longName = "certificate", - .shortName = 'c', - .argInfo = POPT_ARG_STRING, - .arg = &certname, -diff --git a/src/pesign.popt b/src/pesign.popt -index 7b3385d..5a97748 100644 ---- a/src/pesign.popt -+++ b/src/pesign.popt -@@ -1,2 +1,3 @@ - pesign alias --cert --certificate -+pesign alias --certficate --certificate - pesign alias --daemon --daemonize --- -2.13.4 - diff --git a/0004-Rename-var-run-to-run.patch b/0004-Rename-var-run-to-run.patch new file mode 100644 index 0000000..593761b --- /dev/null +++ b/0004-Rename-var-run-to-run.patch @@ -0,0 +1,46 @@ +From f886b7088dfea224e28c03b097c85c9bc20f5441 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Fri, 12 Jun 2020 11:49:44 -0400 +Subject: [PATCH] Rename /var/run/ to /run/ + +Signed-off-by: Peter Jones +--- + src/macros.pesign | 12 ++++++------ + src/tmpfiles.conf | 2 +- + 2 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/src/macros.pesign b/src/macros.pesign +index 56f75cafbc4..5a6da1c6809 100644 +--- a/src/macros.pesign ++++ b/src/macros.pesign +@@ -45,14 +45,14 @@ + rm -rf ${sattrs} ${sattrs}.sig ${nss} \ + elif [ "$(id -un)" == "kojibuilder" -a \\\ + grep -q ID=fedora /etc/os-release -a \\\ +- ! -S /var/run/pesign/socket ]; then \ ++ ! -S /run/pesign/socket ]; then \ + echo "No socket even though this is kojibuilder" 1>&2 \ +- ls -ld /var/run/pesign 1>&2 \ +- ls -l /var/run/pesign/socket 1>&2 \ +- getfacl /var/run/pesign 1>&2 \ +- getfacl /var/run/pesign/socket 1>&2 \ ++ ls -ld /run/pesign 1>&2 \ ++ ls -l /run/pesign/socket 1>&2 \ ++ getfacl /run/pesign 1>&2 \ ++ getfacl /run/pesign/socket 1>&2 \ + exit 1 \ +- elif [ -S /var/run/pesign/socket ]; then \ ++ elif [ -S /run/pesign/socket ]; then \ + %{_pesign_client} -t %{__pesign_client_token} \\\ + -c %{__pesign_client_cert} \\\ + %{-i} %{-o} %{-e} %{-s} %{-C} \ +diff --git a/src/tmpfiles.conf b/src/tmpfiles.conf +index c1cf35597d8..3375ad52a44 100644 +--- a/src/tmpfiles.conf ++++ b/src/tmpfiles.conf +@@ -1 +1 @@ +-D /var/run/pesign 0770 pesign pesign - ++D /run/pesign 0770 pesign pesign - +-- +2.26.2 + diff --git a/0005-Apparently-opensc-got-updated-and-the-token-name-cha.patch b/0005-Apparently-opensc-got-updated-and-the-token-name-cha.patch new file mode 100644 index 0000000..2b47880 --- /dev/null +++ b/0005-Apparently-opensc-got-updated-and-the-token-name-cha.patch @@ -0,0 +1,30 @@ +From 56eaa15e986d808c670381ca375216eb3abd1588 Mon Sep 17 00:00:00 2001 +From: Jeremy Cline +Date: Tue, 18 Feb 2020 16:37:53 -0500 +Subject: [PATCH] Apparently opensc got updated and the token name changed + +All the kernel builds started failing yesterday because the signing +token could not be found. Update the token name in the macro shipped by +pesign. + +Signed-off-by: Peter Jones +--- + src/macros.pesign | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/macros.pesign b/src/macros.pesign +index 7c5cba170e9..56f75cafbc4 100644 +--- a/src/macros.pesign ++++ b/src/macros.pesign +@@ -9,7 +9,7 @@ + %__pesign_token %{nil}%{?pe_signing_token:-t "%{pe_signing_token}"} + %__pesign_cert %{!?pe_signing_cert:"Red Hat Test Certificate"}%{?pe_signing_cert:"%{pe_signing_cert}"} + +-%__pesign_client_token %{!?pe_signing_token:"Fedora Signer (OpenSC Card)"}%{?pe_signing_token:"%{pe_signing_token}"} ++%__pesign_client_token %{!?pe_signing_token:"OpenSC Card (Fedora Signer)"}%{?pe_signing_token:"%{pe_signing_token}"} + %__pesign_client_cert %{!?pe_signing_cert:"/CN=Fedora Secure Boot Signer"}%{?pe_signing_cert:"%{pe_signing_cert}"} + + %_pesign /usr/bin/pesign +-- +2.26.2 + diff --git a/0005-Fix-description-of-ascii-armor-option-in-manpage.patch b/0005-Fix-description-of-ascii-armor-option-in-manpage.patch deleted file mode 100644 index 6a5b02d..0000000 --- a/0005-Fix-description-of-ascii-armor-option-in-manpage.patch +++ /dev/null @@ -1,26 +0,0 @@ -From 7bc8e8b04c74be5c4e0ebf211affc37cf9f5db37 Mon Sep 17 00:00:00 2001 -From: Julien Cristau -Date: Mon, 27 Jun 2016 15:38:38 +0200 -Subject: [PATCH 05/29] Fix description of --ascii-armor option in manpage - -The --ascii option does not exist. ---- - src/pesign.1 | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/pesign.1 b/src/pesign.1 -index 47d1aec..29ae060 100644 ---- a/src/pesign.1 -+++ b/src/pesign.1 -@@ -81,7 +81,7 @@ Export the public key specified by \-\-certificate to \fIoutkey\fR - Export the certificate specified by \-\-certificate to \fIoutcert\fR - - .TP --\fB-\-ascii\fR -+\fB-\-ascii\-armor\fR - Use ascii armoring on exported certificates. - - .TP --- -2.13.4 - diff --git a/0006-Make-ascii-work-since-we-documented-it.patch b/0006-Make-ascii-work-since-we-documented-it.patch deleted file mode 100644 index d0165f9..0000000 --- a/0006-Make-ascii-work-since-we-documented-it.patch +++ /dev/null @@ -1,22 +0,0 @@ -From 9f411f4e797e983d2e8cb51dc5b9ab8db250c2e3 Mon Sep 17 00:00:00 2001 -From: Peter Jones -Date: Tue, 18 Apr 2017 19:05:40 -0400 -Subject: [PATCH 06/29] Make --ascii work, since we documented it. - -Signed-off-by: Peter Jones ---- - src/pesign.popt | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/src/pesign.popt b/src/pesign.popt -index 5a97748..5ae0c5c 100644 ---- a/src/pesign.popt -+++ b/src/pesign.popt -@@ -1,3 +1,4 @@ - pesign alias --cert --certificate - pesign alias --certficate --certificate - pesign alias --daemon --daemonize -+pesign alias --ascii --ascii-armor --- -2.13.4 - diff --git a/0006-client-try-run-and-var-run-for-the-socket-path.patch b/0006-client-try-run-and-var-run-for-the-socket-path.patch new file mode 100644 index 0000000..337faab --- /dev/null +++ b/0006-client-try-run-and-var-run-for-the-socket-path.patch @@ -0,0 +1,86 @@ +From c662ad097eaa0d8c3691a22254f5d0e9622b26b7 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Mon, 6 Jul 2020 16:13:09 -0400 +Subject: [PATCH 6/7] client: try /run and /var/run for the socket path. + +Signed-off-by: Peter Jones +--- + src/client.c | 40 +++++++++++++++++++++++++++++----------- + 1 file changed, 29 insertions(+), 11 deletions(-) + +diff --git a/src/client.c b/src/client.c +index 2119ef33bf8..a38383415d5 100644 +--- a/src/client.c ++++ b/src/client.c +@@ -49,24 +49,24 @@ print_flag_name(FILE *f, int flag) + } + + static int +-connect_to_server(void) ++connect_to_server_helper(const char * const sockpath) + { +- int rc = access(SOCKPATH, R_OK); ++ int rc = access(sockpath, R_OK); + if (rc != 0) { +- fprintf(stderr, "pesign-client: could not connect to server: " +- "%m\n"); +- exit(1); ++ warn("could not access socket \"%s\"", sockpath); ++ return rc; + } + + struct sockaddr_un addr_un = { + .sun_family = AF_UNIX, +- .sun_path = SOCKPATH, + }; ++ strncpy(addr_un.sun_path, sockpath, sizeof(addr_un.sun_path)); ++ addr_un.sun_path[sizeof(addr_un.sun_path)-1] = '\0'; + + int sd = socket(AF_UNIX, SOCK_STREAM, 0); + if (sd < 0) { +- fprintf(stderr, "pesign-client: could not open socket: %m\n"); +- exit(1); ++ warn("could not open socket \"%s\"", sockpath); ++ return sd; + } + + socklen_t len = strlen(addr_un.sun_path) + +@@ -74,14 +74,32 @@ connect_to_server(void) + + rc = connect(sd, (struct sockaddr *)&addr_un, len); + if (rc < 0) { +- fprintf(stderr, "pesign-client: could not connect to daemon: " +- "%m\n"); +- exit(1); ++ warn("could not connect to daemon"); ++ return sd; + } + + return sd; + } + ++static int ++connect_to_server(void) ++{ ++ int rc, i; ++ const char * const sockets[] = { ++ "/run/pesign/socket", ++ "/var/run/pesign/socket", ++ NULL ++ }; ++ ++ for (i = 0; sockets[i] != NULL; i++) { ++ rc = connect_to_server_helper(sockets[i]); ++ if (rc >= 0) ++ return rc; ++ } ++ ++ exit(1); ++} ++ + static int32_t + check_response(int sd, char **srvmsg); + +-- +2.26.2 + diff --git a/0007-Switch-pesign-client-to-also-accept-token-cert-macro.patch b/0007-Switch-pesign-client-to-also-accept-token-cert-macro.patch deleted file mode 100644 index faa78ec..0000000 --- a/0007-Switch-pesign-client-to-also-accept-token-cert-macro.patch +++ /dev/null @@ -1,32 +0,0 @@ -From d618de733865eab359890b4e677c368a133dad99 Mon Sep 17 00:00:00 2001 -From: Pat Riehecky -Date: Mon, 7 Nov 2016 11:37:08 -0600 -Subject: [PATCH 07/29] Switch pesign client to also accept token/cert macros - rather than use hard coded values - ---- - src/macros.pesign | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/src/macros.pesign b/src/macros.pesign -index 18e5b5e..69280e9 100644 ---- a/src/macros.pesign -+++ b/src/macros.pesign -@@ -41,11 +41,11 @@ - --certdir ${nss} -c signer %{-o} \ - rm -rf ${sattrs} ${sattrs}.sig ${nss} \ - elif [ -S /var/run/pesign/socket ]; then \ -- %{_pesign_client} -t "OpenSC Card (Fedora Signer)" \\\ -- -c "/CN=Fedora Secure Boot Signer" \\\ -+ %{_pesign_client} -t %{__pesign_token} \\\ -+ -c %{__pesign_cert} \\\ - %{-i} %{-o} %{-e} %{-s} %{-C} \ - else \ -- %{_pesign} %{__pesign_token} -c %{__pesign_cert} \\\ -+ %{_pesign} -t %{__pesign_token} -c %{__pesign_cert} \\\ - --certdir ${_pesign_nssdir} \\\ - %{-i} %{-o} %{-e} %{-s} %{-C} \ - fi \ --- -2.13.4 - diff --git a/0007-client-remove-an-extra-debug-print.patch b/0007-client-remove-an-extra-debug-print.patch new file mode 100644 index 0000000..b094ea5 --- /dev/null +++ b/0007-client-remove-an-extra-debug-print.patch @@ -0,0 +1,25 @@ +From ea81cec14d31cd0b0dbde5b42414bfae9daec9b8 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Tue, 14 Jul 2020 16:44:09 -0400 +Subject: [PATCH 07/11] client: remove an extra debug print + +Signed-off-by: Peter Jones +--- + src/client.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/src/client.c b/src/client.c +index 0082be1f597..c9966295e5f 100644 +--- a/src/client.c ++++ b/src/client.c +@@ -536,7 +536,6 @@ oom: + 0, true); + } + +- printf("add_file_type:%d\n", add_file_type); + pm->version = PESIGND_VERSION; + pm->command = attached ? (add_file_type ? CMD_SIGN_ATTACHED_WITH_FILE_TYPE + : CMD_SIGN_ATTACHED) +-- +2.26.2 + diff --git a/0008-Move-most-of-macros.pesign-to-pesign-rpmbuild-helper.patch b/0008-Move-most-of-macros.pesign-to-pesign-rpmbuild-helper.patch new file mode 100644 index 0000000..0a96bdb --- /dev/null +++ b/0008-Move-most-of-macros.pesign-to-pesign-rpmbuild-helper.patch @@ -0,0 +1,383 @@ +From e05840efa8dc9d0a9ff3104b9fa6e5736e0ec549 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Mon, 6 Jul 2020 13:54:35 -0400 +Subject: [PATCH 08/11] Move most of macros.pesign to pesign-rpmbuild-helper + +Signed-off-by: Peter Jones +--- + Make.defaults | 1 + + src/Makefile | 8 +- + src/macros.pesign | 76 ++++-------- + src/pesign-rpmbuild-helper.in | 222 ++++++++++++++++++++++++++++++++++ + 4 files changed, 253 insertions(+), 54 deletions(-) + create mode 100644 src/pesign-rpmbuild-helper.in + +diff --git a/Make.defaults b/Make.defaults +index 0bacafe0d01..d4cd626c11e 100644 +--- a/Make.defaults ++++ b/Make.defaults +@@ -16,6 +16,7 @@ INSTALLROOT = $(DESTDIR) + + INSTALL ?= install + CROSS_COMPILE ?= ++EFI_ARCHES ?= aa64 ia32 x64 + + PKG_CONFIG = $(CROSS_COMPILE)pkg-config + CC := $(if $(filter default,$(origin CC)),$(CROSS_COMPILE)gcc,$(CC)) +diff --git a/src/Makefile b/src/Makefile +index 74327ba13f3..a7ca89159c6 100644 +--- a/src/Makefile ++++ b/src/Makefile +@@ -5,7 +5,7 @@ include $(TOPDIR)/Make.version + include $(TOPDIR)/Make.rules + include $(TOPDIR)/Make.defaults + +-BINTARGETS=authvar client efikeygen efisiglist pesigcheck pesign ++BINTARGETS=authvar client efikeygen efisiglist pesigcheck pesign pesign-rpmbuild-helper + SVCTARGETS=pesign.sysvinit pesign.service + TARGETS=$(BINTARGETS) $(SVCTARGETS) + +@@ -49,6 +49,11 @@ pesign : $(call objects-of,$(PESIGN_SOURCES) $(COMMON_SOURCES) $(COMMON_PE_SOURC + pesign : LDLIBS+=$(TOPDIR)/libdpe/libdpe.a + pesign : PKGS=efivar nss nspr popt + ++pesign-rpmbuild-helper: pesign-rpmbuild-helper.in ++ sed \ ++ -e "s/@@EFI_ARCHES@@/$(EFI_ARCHES)/g" \ ++ $^ > $@ ++ + deps : PKGS=efivar nss nspr popt uuid + deps : $(ALL_SOURCES) + $(MAKE) -f $(TOPDIR)/Make.deps \ +@@ -94,6 +99,7 @@ install : + $(INSTALL) -m 644 macros.pesign $(INSTALLROOT)/etc/rpm/ + $(INSTALL) -d -m 755 $(INSTALLROOT)$(libexecdir)/pesign/ + $(INSTALL) -m 750 pesign-authorize $(INSTALLROOT)$(libexecdir)/pesign/ ++ $(INSTALL) -m 755 pesign-rpmbuild-helper $(INSTALLROOT)$(libexecdir)/pesign/ + $(INSTALL) -d -m 700 $(INSTALLROOT)/etc/pesign + $(INSTALL) -m 600 pesign-users $(INSTALLROOT)/etc/pesign/users + $(INSTALL) -m 600 pesign-groups $(INSTALLROOT)/etc/pesign/groups +diff --git a/src/macros.pesign b/src/macros.pesign +index 5a6da1c6809..cb066b35f4a 100644 +--- a/src/macros.pesign ++++ b/src/macros.pesign +@@ -6,11 +6,11 @@ + # %pesign -s -i shim.orig -o shim.efi + # And magically get the right thing. + +-%__pesign_token %{nil}%{?pe_signing_token:-t "%{pe_signing_token}"} ++%__pesign_token %{nil}%{?pe_signing_token:--token "%{pe_signing_token}"} + %__pesign_cert %{!?pe_signing_cert:"Red Hat Test Certificate"}%{?pe_signing_cert:"%{pe_signing_cert}"} + + %__pesign_client_token %{!?pe_signing_token:"OpenSC Card (Fedora Signer)"}%{?pe_signing_token:"%{pe_signing_token}"} + %__pesign_client_cert %{!?pe_signing_cert:"/CN=Fedora Secure Boot Signer"}%{?pe_signing_cert:"%{pe_signing_cert}"} + + %_pesign /usr/bin/pesign + %_pesign_client /usr/bin/pesign-client +@@ -24,54 +24,24 @@ + # -a # rhel only + # -s # perform signing + %pesign(i:o:C:e:c:n:a:s) \ +- _pesign_nssdir=/etc/pki/pesign \ +- if [ %{__pesign_cert} = "Red Hat Test Certificate" ]; then \ +- _pesign_nssdir=/etc/pki/pesign-rh-test \ +- fi \ +- if [ -x %{_pesign} ] && \\\ +- [ "%{_target_cpu}" == "x86_64" -o \\\ +- "%{_target_cpu}" == "aarch64" ]; then \ +- if [ "0%{?rhel}" -ge "7" -a -f /usr/bin/rpm-sign ]; then \ +- nss=$(mktemp -p $PWD -d) \ +- echo > ${nss}/pwfile \ +- certutil -N -d ${nss} -f ${nss}/pwfile \ +- certutil -A -n "ca" -t "CT,C," -i %{-a*} -d ${nss} \ +- certutil -A -n "signer" -t ",c," -i %{-c*} -d ${nss} \ +- sattrs=$(mktemp -p $PWD --suffix=.der) \ +- %{_pesign} %{-i} -E ${sattrs} --certdir ${nss} --force \ +- rpm-sign --key "%{-n*}" --rsadgstsign ${sattrs} \ +- %{_pesign} -R ${sattrs}.sig -I ${sattrs} %{-i} \\\ +- --certdir ${nss} -c signer %{-o} \ +- rm -rf ${sattrs} ${sattrs}.sig ${nss} \ +- elif [ "$(id -un)" == "kojibuilder" -a \\\ +- grep -q ID=fedora /etc/os-release -a \\\ +- ! -S /run/pesign/socket ]; then \ +- echo "No socket even though this is kojibuilder" 1>&2 \ +- ls -ld /run/pesign 1>&2 \ +- ls -l /run/pesign/socket 1>&2 \ +- getfacl /run/pesign 1>&2 \ +- getfacl /run/pesign/socket 1>&2 \ +- exit 1 \ +- elif [ -S /run/pesign/socket ]; then \ +- %{_pesign_client} -t %{__pesign_client_token} \\\ +- -c %{__pesign_client_cert} \\\ +- %{-i} %{-o} %{-e} %{-s} %{-C} \ +- else \ +- %{_pesign} %{__pesign_token} -c %{__pesign_cert} \\\ +- --certdir ${_pesign_nssdir} \\\ +- %{-i} %{-o} %{-e} %{-s} %{-C} \ +- fi \ +- else \ +- if [ -n "%{-i*}" -a -n "%{-o*}" ]; then \ +- mv %{-i*} %{-o*} \ +- elif [ -n "%{-i*}" -a -n "%{-e*}" ]; then \ +- touch %{-e*} \ +- fi \ +- fi \ +- if [ ! -s %{-o} ]; then \ +- if [ -e "%{-o*}" ]; then \ +- rm -f %{-o*} \ +- fi \ +- exit 1 \ +- fi ; +- ++ %{_libexecdir}/pesign/pesign-rpmbuild-helper \\\ ++ "%{_target_cpu}" \\\ ++ "%{_pesign}" \\\ ++ "%{_pesign_client}" \\\ ++ %{?__pesign_client_token:--client-token %{__pesign_client_token}} \\\ ++ %{?__pesign_client_cert:--client-cert %{__pesign_client_cert}} \\\ ++ %{?__pesign_token:%{__pesign_token}} \\\ ++ %{?__pesign_cert:--cert %{__pesign_cert}} \\\ ++ %{?_buildhost:--hostname "%{_buildhost}"} \\\ ++ %{?vendor:--vendor "%{vendor}"} \\\ ++ %{?_rhel:--rhelver "%{_rhel}"} \\\ ++ %{?-n:--rhelcert "%{-n*}"}%{?!-n:--rhelcert "%{__pesign_cert}"} \\\ ++ %{?-a:--rhelcafile "%{-a*}"} \\\ ++ %{?-c:--rhelcertfile "%{-c*}"} \\\ ++ %{?-C:--certout "%{-C*}"} \\\ ++ %{?-e:--sattrout "%{-e*}"} \\\ ++ %{?-i:--in "%{-i*}"} \\\ ++ %{?-o:--out "%{-o*}"} \\\ ++ %{?-s:--sign} \\\ ++ ; \ ++%{nil} +diff --git a/src/pesign-rpmbuild-helper.in b/src/pesign-rpmbuild-helper.in +new file mode 100644 +index 00000000000..c5287c27e0c +--- /dev/null ++++ b/src/pesign-rpmbuild-helper.in +@@ -0,0 +1,222 @@ ++#!/bin/bash ++# shellcheck shell=bash ++ ++set -eu ++set -x ++ ++usage() { ++ local status="${1}" && shift ++ local out ++ if [[ "${status}" -eq 0 ]] ; then ++ out=/dev/stdout ++ else ++ out=/dev/stderr ++ fi ++ ++ if [[ $# -gt 0 ]] ; then ++ echo "${0}: error: $*" >>"${out}" ++ fi ++ echo "usage: ${0} TARGET_CPU PESIGN_BINARY PESIGN_CLIENT_BINARY [OPTIONS]" >>"${out}" ++ exit "${status}" ++} ++ ++is_efi_arch() { ++ local arch="${1}" ++ local arches=(@@EFI_ARCHES@@) ++ local x ++ for x in "${arches[@]}" ; do ++ if [[ "${arch}" = "${x}" ]] ; then ++ return 0 ++ fi ++ done ++ return 1 ++} ++ ++error_on_empty() { ++ local f="${1}" ++ if [[ ! -s "${f}" ]] ; then ++ if [[ -e "${f}" ]] ; then ++ rm -f "${f}" ++ fi ++ echo "${0}: error: empty result file \"${f}\"">>/dev/stderr ++ exit 1 ++ fi ++} ++ ++main() { ++ if [[ $# -lt 3 ]] ; then ++ usage 1 not enough arguments ++ fi ++ local target_cpu="${1}" && shift ++ local bin="${1}" && shift ++ local client="${1}" && shift ++ ++ local rhelcafile="" || : ++ local rhelcertfile="" || : ++ ++ local certout=() || : ++ local sattrout=() || : ++ local input=() || : ++ local output=() || : ++ local client_token=() || : ++ local client_cert=() || : ++ local token=() || : ++ local cert=() || : ++ local rhelcert=() || : ++ local rhelver=0 || : ++ local sign="" || : ++ local arch="" || : ++ local vendor="" || : ++ local HOSTNAME="" || : ++ ++ while [[ $# -ge 2 ]] ; do ++ case " ${1} " in ++ " --rhelcafile ") ++ rhelcafile="${2}" ++ ;; ++ " --rhelcertfile ") ++ rhelcertfile="${2}" ++ ;; ++ " --hostname ") ++ HOSTNAME="${2}" ++ ;; ++ " --certout ") ++ certout[0]=-C ++ certout[1]="${2}" ++ ;; ++ " --sattrout ") ++ sattrout[0]=-e ++ sattrout[1]="${2}" ++ ;; ++ " --client-token ") ++ client_token[0]=-t ++ client_token[1]="${2}" ++ ;; ++ " --client-cert ") ++ client_cert[0]=-c ++ client_cert[1]="${2}" ++ ;; ++ " --token ") ++ token[0]=-t ++ token[1]="${2}" ++ ;; ++ " --cert ") ++ cert[0]=-c ++ cert[1]="${2}" ++ ;; ++ " --rhelcert ") ++ rhelcert[0]=-c ++ rhelcert[1]="${2}" ++ ;; ++ " --in ") ++ input[0]=-i ++ input[1]="${2}" ++ ;; ++ " --out ") ++ output[0]=-o ++ output[1]="${2}" ++ ;; ++ " --rhelver ") ++ rhelver="${2}" ++ ;; ++ " --vendor ") ++ vendor="${2}" ++ ;; ++ *) ++ break ++ ;; ++ esac ++ shift ++ shift ++ done ++ if [[ $# -ge 1 ]] && [[ "${1}" = --sign ]] ; then ++ sign=-s ++ shift ++ fi ++ ++ if [[ -z "${target_cpu}" ]] ; then ++ target_cpu="$(uname -m)" ++ fi ++ ++ target_cpu="${target_cpu/i?86/ia32}" ++ target_cpu="${target_cpu/x86_64/x64}" ++ target_cpu="${target_cpu/aarch64/aa64}" ++ target_cpu="${target_cpu/arm*/arm/}" ++ ++ local nssdir=/etc/pki/pesign ++ if [[ "${#cert[@]}" -eq 2 ]] && ++ [[ "${cert[1]}" == "Red Hat Test Certificate" ]] ; then ++ nssdir=/etc/pki/pesign-rh-test ++ fi ++ ++ # is_efi_arch is ultimately returning "is pesign configured to sign these ++ # using the rpm macro", so if it isn't, we're just copying the input to ++ # the output ++ if [[ -x "${bin}" ]] && ! is_efi_arch "${target_cpu}" ; then ++ if [[ -n "${input[*]}" ]] && [[ -n "${output[*]}" ]] ; then ++ cp -v "${input[1]}" "${output[1]}" ++ elif [[ -n "${input[*]}" ]] && [[ -n "${sattrout[*]}" ]] ; then ++ touch "${sattrout[1]}" ++ fi ++ ++ # if there's a 0-sized output file, delete it and error out ++ error_on_empty "${output[1]}" ++ return 0 ++ fi ++ ++ USERNAME="${USERNAME:-$(id -un)}" ++ ++ local socket="" || : ++ if grep -q ID=fedora /etc/os-release \ ++ && [[ "${rhelver}" -lt 7 ]] \ ++ && [[ "${USERNAME}" = "mockbuild" ]] \ ++ && [[ "${vendor}" = "Fedora Project" ]] \ ++ && [[ "${HOSTNAME}" =~ bkernel.* ]] ++ then ++ if [[ -S /run/pesign/socket ]] ; then ++ socket=/run/pesign/socket ++ elif [[ -S /var/run/pesign/socket ]]; then ++ socket=/var/run/pesign/socket ++ else ++ echo "Warning: no pesign socket even though user is ${USERNAME}" 1>&2 ++ echo "Warning: if this is a non-scratch koji build, this is wrong" 1>&2 ++ ls -ld /run/pesign /var/run/pesign 1>&2 ||: ++ ls -l /run/pesign/socket /var/run/pesign/socket 1>&2 ||: ++ getfacl /run/pesign /run/pesign/socket /var/run/pesign /var/run/pesign/socket 1>&2 ||: ++ getfacl -n /run/pesign /run/pesign/socket /var/run/pesign /var/run/pesign/socket 1>&2 ||: ++ fi ++ fi ++ ++ if [[ "${rhelver}" -ge 7 ]] ; then ++ nssdir="$(mktemp -p "${PWD}" -d)" ++ echo > "${nssdir}/pwfile" ++ certutil -N -d "${nssdir}" -f "${nssdir}/pwfile" ++ certutil -A -n "ca" -t "CTu,CTu,CTu" -i "${rhelcafile}" -d "${nssdir}" ++ certutil -A -n "signer" -t "CTu,CTu,CTu" -i "${rhelcertfile}" -d "${nssdir}" ++ sattrs="$(mktemp -p "${PWD}" --suffix=.der)" ++ "${bin}" -E "${sattrs}" --certdir "${nssdir}" \ ++ "${input[@]}" --force ++ rpm-sign --key "${rhelcert[1]}" --rsadgstsign "${sattrs}" ++ "${bin}" -R "${sattrs}.sig" -I "${sattrs}" \ ++ --certdir "${nssdir}" -c signer \ ++ "${input[@]}" "${output[@]}" ++ rm -rf "${sattrs}" "${sattrs}.sig" "${nssdir}" ++ elif [[ -n "${socket}" ]] ; then ++ "${client}" "${client_token[@]}" "${client_cert[@]}" \ ++ "${sattrout[@]}" "${certout[@]}" \ ++ ${sign} "${input[@]}" "${output[@]}" ++ else ++ "${bin}" --certdir "${nssdir}" "${token[@]}" \ ++ "${cert[@]}" ${sign} "${sattrout[@]}" \ ++ "${certout[@]}" "${input[@]}" "${output[@]}" ++ fi ++ ++ # if there's a 0-sized output file, delete it and error out ++ if [[ "${#output[@]}" -eq 2 ]] ; then ++ error_on_empty "${output[1]}" ++ fi ++} ++ ++main "${@}" ++ ++# vim:filetype=sh:fenc=utf-8:tw=78:sts=4:sw=4 +-- +2.26.2 + diff --git a/0008-pesigcheck-Verify-with-the-cert-as-an-object-signer.patch b/0008-pesigcheck-Verify-with-the-cert-as-an-object-signer.patch deleted file mode 100644 index 2226498..0000000 --- a/0008-pesigcheck-Verify-with-the-cert-as-an-object-signer.patch +++ /dev/null @@ -1,25 +0,0 @@ -From 2cd211bcc612ad8cb99c778461ca02a9f3e5e44b Mon Sep 17 00:00:00 2001 -From: David Michael -Date: Thu, 16 Feb 2017 15:08:30 -0800 -Subject: [PATCH 08/29] pesigcheck: Verify with the cert as an object signer - ---- - src/certdb.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/certdb.c b/src/certdb.c -index 2a08042..b7c99bb 100644 ---- a/src/certdb.c -+++ b/src/certdb.c -@@ -339,7 +339,7 @@ check_cert(pesigcheck_context *ctx, SECItem *sig, efi_guid_t *sigtype, - } - /* Verify the signature */ - result = SEC_PKCS7VerifyDetachedSignatureAtTime(cinfo, -- certUsageSSLServer, -+ certUsageObjectSigner, - digest, HASH_AlgSHA256, - PR_FALSE, atTime); - if (!result) { --- -2.13.4 - diff --git a/0009-pesigcheck-make-certfile-actually-work.patch b/0009-pesigcheck-make-certfile-actually-work.patch deleted file mode 100644 index 8b77417..0000000 --- a/0009-pesigcheck-make-certfile-actually-work.patch +++ /dev/null @@ -1,47 +0,0 @@ -From e0238e2363f9668aee07b2e44a8f358e694551c0 Mon Sep 17 00:00:00 2001 -From: Peter Jones -Date: Mon, 24 Apr 2017 15:18:10 -0400 -Subject: [PATCH 09/29] pesigcheck: make --certfile actually work - -Signed-off-by: Peter Jones ---- - src/pesigcheck.c | 9 +++++++-- - 1 file changed, 7 insertions(+), 2 deletions(-) - -diff --git a/src/pesigcheck.c b/src/pesigcheck.c -index 0d49c1a..d7be542 100644 ---- a/src/pesigcheck.c -+++ b/src/pesigcheck.c -@@ -130,7 +130,7 @@ check_signature(pesigcheck_context *ctx) - cert_iter iter; - - generate_digest(ctx->cms_ctx, ctx->inpe, 1); -- -+ - if (check_db_hash(DBX, ctx) == FOUND) - return -1; - -@@ -225,6 +225,11 @@ main(int argc, char *argv[]) - .argInfo = POPT_ARG_CALLBACK|POPT_CBFLAG_POST, - .arg = (void *)callback, - .descrip = (void *)ctxp }, -+ {.longName = "certfile", -+ .shortName = 'c', -+ .argInfo = POPT_ARG_CALLBACK|POPT_CBFLAG_POST, -+ .arg = (void *)callback, -+ .descrip = (void *)ctxp }, - {.longName = "in", - .shortName = 'i', - .argInfo = POPT_ARG_STRING, -@@ -258,7 +263,7 @@ main(int argc, char *argv[]) - .shortName = 'c', - .argInfo = POPT_ARG_STRING, - .arg = &certfile, -- .descrip = "the certificate (in DER form) for verification ", -+ .descrip = "import certfile (in DER encoding) for allowed certificate", - .argDescrip = "" }, - POPT_AUTOALIAS - POPT_AUTOHELP --- -2.13.4 - diff --git a/0009-pesign-authorize-shellcheck.patch b/0009-pesign-authorize-shellcheck.patch new file mode 100644 index 0000000..3597f5f --- /dev/null +++ b/0009-pesign-authorize-shellcheck.patch @@ -0,0 +1,60 @@ +From 3107894285164a3d25ca215a76593ebb6d4bc84c Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Tue, 14 Jul 2020 15:07:32 -0400 +Subject: [PATCH 09/11] pesign-authorize: shellcheck + +Signed-off-by: Peter Jones +--- + src/pesign-authorize | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/src/pesign-authorize b/src/pesign-authorize +index a496f601ab4..55cd5c4e55b 100755 +--- a/src/pesign-authorize ++++ b/src/pesign-authorize +@@ -12,21 +12,21 @@ set -u + # License: GPLv2 + declare -a fileusers=() + declare -a dirusers=() +-for user in $(cat /etc/pesign/users); do ++while read -r user ; do + dirusers[${#dirusers[@]}]=-m + dirusers[${#dirusers[@]}]="u:$user:rwx" + fileusers[${#fileusers[@]}]=-m + fileusers[${#fileusers[@]}]="u:$user:rw" +-done ++done +Date: Tue, 14 Jul 2020 15:08:15 -0400 +Subject: [PATCH 10/11] pesign-authorize: don't setfacl /etc/pki/pesign-foo/ + +Signed-off-by: Peter Jones +--- + src/pesign-authorize | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/pesign-authorize b/src/pesign-authorize +index 55cd5c4e55b..c5448329c2c 100755 +--- a/src/pesign-authorize ++++ b/src/pesign-authorize +@@ -47,7 +47,7 @@ update_subdir() { + done + } + +-for x in /var/run/pesign/ /etc/pki/pesign*/ ; do ++for x in /var/run/pesign/ /etc/pki/pesign/ ; do + if [ -d "${x}" ]; then + update_subdir "${x}" + else +-- +2.26.2 + diff --git a/0010-signerInfos-make-sure-err-is-always-initialized.patch b/0010-signerInfos-make-sure-err-is-always-initialized.patch deleted file mode 100644 index 08d1da7..0000000 --- a/0010-signerInfos-make-sure-err-is-always-initialized.patch +++ /dev/null @@ -1,27 +0,0 @@ -From 799808b265ac6f82fa1268fd696d70357acce69c Mon Sep 17 00:00:00 2001 -From: Peter Jones -Date: Tue, 25 Apr 2017 16:15:07 -0400 -Subject: [PATCH 10/29] signerInfos: make sure err is always initialized - -Signed-off-by: Peter Jones ---- - src/signed_data.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/src/signed_data.c b/src/signed_data.c -index 721db90..9e0af23 100644 ---- a/src/signed_data.c -+++ b/src/signed_data.c -@@ -132,7 +132,8 @@ int - generate_signerInfo_list(cms_context *cms, SpcSignerInfo ***signerInfo_list_p, SignerInfoType type) - { - SpcSignerInfo **signerInfo_list; -- int err, rc; -+ int err = 0; -+ int rc; - - if (!signerInfo_list_p) - return -1; --- -2.13.4 - diff --git a/0011-kernel-building-hack.patch b/0011-kernel-building-hack.patch new file mode 100644 index 0000000..69ffc56 --- /dev/null +++ b/0011-kernel-building-hack.patch @@ -0,0 +1,41 @@ +From 0b9048cbcc1cfc2afd9cbf781732882736cbe965 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Tue, 14 Jul 2020 16:42:39 -0400 +Subject: [PATCH 11/11] kernel building hack + +Signed-off-by: Peter Jones +--- + src/pesign-rpmbuild-helper.in | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/src/pesign-rpmbuild-helper.in b/src/pesign-rpmbuild-helper.in +index c5287c27e0c..27b8261bc17 100644 +--- a/src/pesign-rpmbuild-helper.in ++++ b/src/pesign-rpmbuild-helper.in +@@ -202,6 +202,23 @@ main() { + "${input[@]}" "${output[@]}" + rm -rf "${sattrs}" "${sattrs}.sig" "${nssdir}" + elif [[ -n "${socket}" ]] ; then ++ ### welcome haaaaack city ++ if [[ "${client_token[1]}" = "OpenSC Card (Fedora Signer)" ]] ; then ++ if [[ "${input[1]}" =~ (/|^)vmlinuz($|[_.-]) ]] \ ++ || [[ "${input[1]}" =~ (/|^)bzImage($|[_.-]) ]] ; then ++ if [[ "${rhelcertfile}" =~ redhatsecureboot501.* ]] \ ++ || [[ "${rhelcertfile}" =~ redhatsecureboot401.* ]] \ ++ || [[ "${rhelcertfile}" =~ centossecureboot201.* ]] ; then ++ client_cert[1]=kernel-signer ++ elif [[ "${rhelcertfile}" =~ redhatsecureboot502.* ]] \ ++ || [[ "${rhelcertfile}" =~ centossecureboot202.* ]] ; then ++ client_cert[1]=grub2-signer ++ elif [[ "${rhelcertfile}" =~ redhatsecureboot503.* ]] \ ++ || [[ "${rhelcertfile}" =~ centossecureboot203.* ]] ; then ++ client_cert[1]=fwupd-signer ++ fi ++ fi ++ fi + "${client}" "${client_token[@]}" "${client_cert[@]}" \ + "${sattrout[@]}" "${certout[@]}" \ + ${sign} "${input[@]}" "${output[@]}" +-- +2.26.2 + diff --git a/0011-pesign-make-pesign-h-tell-you-the-file-name.patch b/0011-pesign-make-pesign-h-tell-you-the-file-name.patch deleted file mode 100644 index 3e15617..0000000 --- a/0011-pesign-make-pesign-h-tell-you-the-file-name.patch +++ /dev/null @@ -1,26 +0,0 @@ -From 868b42b338d919917ea31cfbf0f96e9586947eaf Mon Sep 17 00:00:00 2001 -From: Peter Jones -Date: Tue, 25 Apr 2017 16:23:36 -0400 -Subject: [PATCH 11/29] pesign: make "pesign -h" tell you the file name. - -Signed-off-by: Peter Jones ---- - src/pesign.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/pesign.c b/src/pesign.c -index 279a17a..5879cfc 100644 ---- a/src/pesign.c -+++ b/src/pesign.c -@@ -387,7 +387,7 @@ print_digest(pesign_context *pctx) - if (!ctx) - return; - -- printf("hash: "); -+ printf("%s ", pctx->infile); - int j = ctx->selected_digest; - for (unsigned int i = 0; i < ctx->digests[j].pe_digest->len; i++) - printf("%02x", --- -2.13.4 - diff --git a/0012-Add-coverity-build-scripts.patch b/0012-Add-coverity-build-scripts.patch deleted file mode 100644 index f3f0a89..0000000 --- a/0012-Add-coverity-build-scripts.patch +++ /dev/null @@ -1,104 +0,0 @@ -From 95327e6d9bd4f70980acd8fd6c9524265990dc4d Mon Sep 17 00:00:00 2001 -From: Peter Jones -Date: Wed, 10 May 2017 10:49:57 -0400 -Subject: [PATCH 12/29] Add coverity build scripts - -Signed-off-by: Peter Jones ---- - .gitignore | 1 + - Make.coverity | 37 +++++++++++++++++++++++++++++++++++++ - Make.defaults | 2 ++ - Make.rules | 4 ++++ - Makefile | 1 + - 5 files changed, 45 insertions(+) - create mode 100644 Make.coverity - -diff --git a/.gitignore b/.gitignore -index 1635ba2..847e172 100644 ---- a/.gitignore -+++ b/.gitignore -@@ -12,3 +12,4 @@ - *.tar.* - *.rpm - core.* -+cov-int -diff --git a/Make.coverity b/Make.coverity -new file mode 100644 -index 0000000..b80b091 ---- /dev/null -+++ b/Make.coverity -@@ -0,0 +1,37 @@ -+include $(TOPDIR)/Make.version -+include $(TOPDIR)/Make.rules -+include $(TOPDIR)/Make.defaults -+ -+COV_EMAIL=$(call get-config,coverity.email) -+COV_TOKEN=$(call get-config,coverity.token) -+COV_URL=$(call get-config,coverity.url) -+COV_FILE=$(NAME)-coverity-$(VERSION)-$(COMMIT_ID).tar.bz2 -+ -+cov-int : clean -+ cov-build --dir cov-int make all -+ -+cov-clean : -+ @rm -vf $(NAME)-coverity-*.tar.* -+ @if [[ -d cov-int ]]; then rm -rf cov-int && echo "removed 'cov-int'"; fi -+ -+cov-file : | $(COV_FILE) -+ -+$(COV_FILE) : cov-int -+ tar caf $@ cov-int -+ -+cov-upload : -+ @if [[ -n "$(COV_URL)" ]] && \ -+ [[ -n "$(COV_TOKEN)" ]] && \ -+ [[ -n "$(COV_EMAIL)" ]] ; \ -+ then \ -+ echo curl --form token=$(COV_TOKEN) --form email="$(COV_EMAIL)" --form file=@"$(COV_FILE)" --form version=$(VERSION).1 --form description="$(COMMIT_ID)" "$(COV_URL)" ; \ -+ curl --form token=$(COV_TOKEN) --form email="$(COV_EMAIL)" --form file=@"$(COV_FILE)" --form version=$(VERSION).1 --form description="$(COMMIT_ID)" "$(COV_URL)" ; \ -+ else \ -+ echo Coverity output is in $(COV_FILE) ; \ -+ fi -+ -+coverity : cov-file cov-upload -+ -+clean : | cov-clean -+ -+.PHONY : coverity cov-upload cov-clean cov-file -diff --git a/Make.defaults b/Make.defaults -index 3511080..39b78f0 100644 ---- a/Make.defaults -+++ b/Make.defaults -@@ -1,3 +1,5 @@ -+NAME = pesign -+COMMIT_ID ?= $(shell git log -1 --pretty=%H 2>/dev/null || echo master) - prefix ?= /usr/ - prefix := $(abspath $(prefix))/ - libdir ?= $(prefix)lib64/ -diff --git a/Make.rules b/Make.rules -index af5ecfe..5e3c83d 100644 ---- a/Make.rules -+++ b/Make.rules -@@ -79,3 +79,7 @@ endef - - $(TOPDIR)/libdpe/%.a $(TOPDIR)/libdpe/% : - $(MAKE) -C $(TOPDIR)/libdpe $(notdir $@) -+ -+define get-config = -+$(shell git config --local --get "$(NAME).$(1)") -+endef -diff --git a/Makefile b/Makefile -index db8eb7e..ca1a359 100644 ---- a/Makefile -+++ b/Makefile -@@ -4,6 +4,7 @@ TOPDIR = $(realpath .) - include $(TOPDIR)/Make.version - include $(TOPDIR)/Make.rules - include $(TOPDIR)/Make.defaults -+include $(TOPDIR)/Make.coverity - - SUBDIRS := include libdpe src - --- -2.13.4 - diff --git a/0012-Use-run-not-var-run.patch b/0012-Use-run-not-var-run.patch new file mode 100644 index 0000000..1b4e0c6 --- /dev/null +++ b/0012-Use-run-not-var-run.patch @@ -0,0 +1,105 @@ +From db4c6e8cc57271dce6d204a3144982e544e55025 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Thu, 16 Jul 2020 16:28:26 -0400 +Subject: [PATCH] Use /run not /var/run + +Signed-off-by: Peter Jones +--- + src/daemon.h | 4 ++-- + src/Makefile | 2 +- + src/pesign-authorize | 2 +- + src/pesign.service.in | 2 +- + src/pesign.sysvinit.in | 10 +++++----- + 5 files changed, 10 insertions(+), 10 deletions(-) + +diff --git a/src/daemon.h b/src/daemon.h +index 0368dc9256c..5fcd97ea717 100644 +--- a/src/daemon.h ++++ b/src/daemon.h +@@ -51,8 +51,8 @@ typedef enum { + } pesignd_cmd; + + #define PESIGND_VERSION 0x2a9edaf0 +-#define SOCKPATH "/var/run/pesign/socket" +-#define PIDFILE "/var/run/pesign.pid" ++#define SOCKPATH "/run/pesign/socket" ++#define PIDFILE "/run/pesign.pid" + + static inline uint32_t UNUSED + pesignd_string_size(char *buffer) +diff --git a/src/Makefile b/src/Makefile +index a7ca89159c6..f7fb5fc9ee5 100644 +--- a/src/Makefile ++++ b/src/Makefile +@@ -78,7 +78,7 @@ install_sysvinit: pesign.sysvinit + install : + $(INSTALL) -d -m 700 $(INSTALLROOT)/etc/pki/pesign/ + $(INSTALL) -d -m 700 $(INSTALLROOT)/etc/pki/pesign-rh-test/ +- $(INSTALL) -d -m 770 $(INSTALLROOT)/var/run/pesign/ ++ $(INSTALL) -d -m 770 $(INSTALLROOT)/run/pesign/ + $(INSTALL) -d -m 755 $(INSTALLROOT)$(bindir) + $(INSTALL) -m 755 authvar $(INSTALLROOT)$(bindir) + $(INSTALL) -m 755 pesign $(INSTALLROOT)$(bindir) +diff --git a/src/pesign-authorize b/src/pesign-authorize +index c5448329c2c..2381302440c 100755 +--- a/src/pesign-authorize ++++ b/src/pesign-authorize +@@ -47,7 +47,7 @@ update_subdir() { + done + } + +-for x in /var/run/pesign/ /etc/pki/pesign/ ; do ++for x in /run/pesign/ /var/run/pesign/ /etc/pki/pesign/ ; do + if [ -d "${x}" ]; then + update_subdir "${x}" + else +diff --git a/src/pesign.service.in b/src/pesign.service.in +index c75a000892a..4ac2199bce2 100644 +--- a/src/pesign.service.in ++++ b/src/pesign.service.in +@@ -4,6 +4,6 @@ Description=Pesign signing daemon + [Service] + PrivateTmp=true + Type=forking +-PIDFile=/var/run/pesign.pid ++PIDFile=/run/pesign.pid + ExecStart=/usr/bin/pesign --daemonize + ExecStartPost=@@LIBEXECDIR@@/pesign/pesign-authorize +diff --git a/src/pesign.sysvinit.in b/src/pesign.sysvinit.in +index b0e0f84ff0b..bf8edec8ff3 100644 +--- a/src/pesign.sysvinit.in ++++ b/src/pesign.sysvinit.in +@@ -4,7 +4,7 @@ + # + # chkconfig: - 50 50 + # processname: /usr/bin/pesign +-# pidfile: /var/run/pesign.pid ++# pidfile: /run/pesign.pid + ### BEGIN INIT INFO + # Provides: pesign + # Default-Start: +@@ -20,9 +20,9 @@ RETVAL=0 + + start(){ + echo -n "Starting pesign: " +- mkdir /var/run/pesign 2>/dev/null && +- chown pesign:pesign /var/run/pesign && +- chmod 0770 /var/run/pesign ++ mkdir /run/pesign 2>/dev/null && ++ chown pesign:pesign /run/pesign && ++ chmod 0770 /run/pesign + daemon /usr/bin/pesign --daemonize + RETVAL=$? + echo +@@ -32,7 +32,7 @@ start(){ + + stop(){ + echo -n "Stopping pesign: " +- killproc -p /var/run/pesign.pid pesignd ++ killproc -p /run/pesign.pid pesignd + RETVAL=$? + echo + rm -f /var/lock/subsys/pesign +-- +2.26.2 + diff --git a/0013-Document-implicit-fallthrough.patch b/0013-Document-implicit-fallthrough.patch deleted file mode 100644 index 3731a3f..0000000 --- a/0013-Document-implicit-fallthrough.patch +++ /dev/null @@ -1,25 +0,0 @@ -From 4b9e7cf3e869de36daf2ea705b9efef55ae87ef8 Mon Sep 17 00:00:00 2001 -From: Peter Jones -Date: Sat, 8 Jul 2017 16:31:18 -0400 -Subject: [PATCH 13/29] Document implicit fallthrough. - -Signed-off-by: Peter Jones ---- - src/authvar.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/src/authvar.c b/src/authvar.c -index ad659ca..03e0c47 100644 ---- a/src/authvar.c -+++ b/src/authvar.c -@@ -511,6 +511,7 @@ main(int argc, char *argv[]) - case IMPORT|SET: - case IMPORT|SIGN|SET: - fprintf(stderr, "authvar: not implemented\n"); -+ /* fallthrough. */ - case IMPORT|SIGN|EXPORT: - default: - fprintf(stderr, "authvar: invalid flags: "); --- -2.13.4 - diff --git a/0014-Actually-setfacl-each-directory-of-our-key-storage.patch b/0014-Actually-setfacl-each-directory-of-our-key-storage.patch deleted file mode 100644 index 4b62cb3..0000000 --- a/0014-Actually-setfacl-each-directory-of-our-key-storage.patch +++ /dev/null @@ -1,50 +0,0 @@ -From a95e28e5cb10d417c81c8720e8521eb63793da37 Mon Sep 17 00:00:00 2001 -From: Peter Jones -Date: Mon, 16 May 2016 15:25:53 -0400 -Subject: [PATCH 14/29] Actually setfacl /each/ directory of our key storage. - -Signed-off-by: Peter Jones ---- - src/pesign-authorize-groups | 6 +++--- - src/pesign-authorize-users | 6 +++--- - 2 files changed, 6 insertions(+), 6 deletions(-) - -diff --git a/src/pesign-authorize-groups b/src/pesign-authorize-groups -index a4f895e..cf51fb6 100644 ---- a/src/pesign-authorize-groups -+++ b/src/pesign-authorize-groups -@@ -18,10 +18,10 @@ if [ -r /etc/pesign/groups ]; then - setfacl -m g:${group}:rw /var/run/pesign/socket - fi - fi -- for x in /etc/pki/pesign* ; do -+ for x in /etc/pki/pesign*/ ; do - if [ -d ${x} ]; then -- setfacl -m g:${group}:rx /etc/pki/pesign -- for y in ${x}/{cert8,key3,secmod}.db ; do -+ setfacl -m g:${group}:rx ${x} -+ for y in ${x}{cert8,key3,secmod}.db ; do - setfacl -m g:${group}:rw ${y} - done - fi -diff --git a/src/pesign-authorize-users b/src/pesign-authorize-users -index 8b9a885..940138e 100644 ---- a/src/pesign-authorize-users -+++ b/src/pesign-authorize-users -@@ -18,10 +18,10 @@ if [ -r /etc/pesign/users ]; then - setfacl -m g:${username}:rw /var/run/pesign/socket - fi - fi -- for x in /etc/pki/pesign* ; do -+ for x in /etc/pki/pesign*/ ; do - if [ -d ${x} ]; then -- setfacl -m g:${username}:rx /etc/pki/pesign -- for y in ${x}/{cert8,key3,secmod}.db ; do -+ setfacl -m g:${username}:rx ${x} -+ for y in ${x}{cert8,key3,secmod}.db ; do - setfacl -m g:${username}:rw ${y} - done - fi --- -2.13.4 - diff --git a/0015-oid-add-SHIM_EKU_MODULE_SIGNING_ONLY-and-fix-our-arr.patch b/0015-oid-add-SHIM_EKU_MODULE_SIGNING_ONLY-and-fix-our-arr.patch deleted file mode 100644 index d5428b5..0000000 --- a/0015-oid-add-SHIM_EKU_MODULE_SIGNING_ONLY-and-fix-our-arr.patch +++ /dev/null @@ -1,59 +0,0 @@ -From a3cc2ad5d49ed61187527281da351e80d8f76a89 Mon Sep 17 00:00:00 2001 -From: Peter Jones -Date: Mon, 22 Aug 2016 13:31:38 -0400 -Subject: [PATCH 15/29] oid: add SHIM_EKU_MODULE_SIGNING_ONLY and fix our array - indices. - -That was all kinds of wrong. - -Signed-off-by: Peter Jones ---- - src/oid.c | 10 +++++++--- - src/oid.h | 1 + - 2 files changed, 8 insertions(+), 3 deletions(-) - -diff --git a/src/oid.c b/src/oid.c -index 9d8154f..7037e1e 100644 ---- a/src/oid.c -+++ b/src/oid.c -@@ -33,6 +33,7 @@ static uint8_t oiddata[] = { - 0x2b, 0x06, 0x01, 0x04, 0x01, 0x82, 0x37, 0x02, 0x01, 0x0f, - 0x2b, 0x06, 0x01, 0x04, 0x01, 0x82, 0x37, 0x02, 0x01, 0x15, - 0x2b, 0x06, 0x01, 0x04, 0x01, 0x82, 0x37, 0x15, 0x01, -+ 0x2b, 0x06, 0x01, 0x04, 0x01, 0x92, 0x08, 0x10, 0x01, 0x02, - }; - - #define OID(num, desc_s, oidtype, length, value) \ -@@ -53,11 +54,14 @@ static struct { - OID(SPC_STATEMENT_TYPE_OBJID, "Statement Type", siDEROID, 10, - &oiddata[10]), - OID(SPC_PE_IMAGE_DATA_OBJID, "PE Image Data", siDEROID, 10, -- &oiddata[30]), -+ &oiddata[20]), - OID(SPC_INDIVIDUAL_SP_KEY_PURPOSE_OBJID, "Individual Key", siDEROID, -- 10, &oiddata[40]), -+ 10, &oiddata[30]), - OID(szOID_CERTSRV_CA_VERSION, "Certification server CA version", -- siAsciiString, 9, &oiddata[50]), -+ siAsciiString, 9, &oiddata[40]), -+ OID(SHIM_EKU_MODULE_SIGNING_ONLY, -+ "Certificate is used for kernel modules only", siDEROID, 10, -+ &oiddata[49]), - { .oid = END_OID_LIST } - }; - -diff --git a/src/oid.h b/src/oid.h -index 599f49d..0e00781 100644 ---- a/src/oid.h -+++ b/src/oid.h -@@ -25,6 +25,7 @@ typedef enum { - SPC_PE_IMAGE_DATA_OBJID, /* 1.3.6.1.4.1.311.2.1.15 */ - SPC_INDIVIDUAL_SP_KEY_PURPOSE_OBJID, /* 1.3.6.1.4.1.311.2.1.21 */ - szOID_CERTSRV_CA_VERSION, /* 1.3.6.1.4.1.311.21.1 */ -+ SHIM_EKU_MODULE_SIGNING_ONLY, /* 1.3.6.1.4.1.2312.16.1.2 */ - END_OID_LIST - } ms_oid_t; - --- -2.13.4 - diff --git a/0016-efikeygen-add-modsign.patch b/0016-efikeygen-add-modsign.patch deleted file mode 100644 index 8324334..0000000 --- a/0016-efikeygen-add-modsign.patch +++ /dev/null @@ -1,197 +0,0 @@ -From 9b4b12928c0450ac69d83293e179eec439465c03 Mon Sep 17 00:00:00 2001 -From: Peter Jones -Date: Mon, 22 Aug 2016 13:43:56 -0400 -Subject: [PATCH 16/29] efikeygen: add --modsign - ---- - src/cms_common.c | 29 ++++++++++++++++++++++++++++ - src/cms_common.h | 1 + - src/efikeygen.c | 59 ++++++++++++++++++++++++++++++++++++++++++++------------ - 3 files changed, 77 insertions(+), 12 deletions(-) - -diff --git a/src/cms_common.c b/src/cms_common.c -index 6a4e6a7..2df2cfe 100644 ---- a/src/cms_common.c -+++ b/src/cms_common.c -@@ -715,6 +715,35 @@ make_context_specific(cms_context *cms, int ctxt, SECItem *encoded, - return 0; - } - -+static SEC_ASN1Template EKUOidSequence[] = { -+ { -+ .kind = SEC_ASN1_OBJECT_ID, -+ .offset = 0, -+ .sub = &SEC_AnyTemplate, -+ .size = sizeof (SECItem), -+ }, -+ { 0 } -+}; -+ -+int -+make_eku_oid(cms_context *cms, SECItem *encoded, SECOidTag oid_tag) -+{ -+ void *rv; -+ SECOidData *oid_data; -+ -+ oid_data = SECOID_FindOIDByTag(oid_tag); -+ if (!oid_data) -+ cmsreterr(-1, cms, "could not encode eku oid data"); -+ -+ rv = SEC_ASN1EncodeItem(cms->arena, encoded, &oid_data->oid, -+ EKUOidSequence); -+ if (rv == NULL) -+ cmsreterr(-1, cms, "could not encode eku oid data"); -+ -+ encoded->type = siBuffer; -+ return 0; -+} -+ - int - generate_octet_string(cms_context *cms, SECItem *encoded, SECItem *original) - { -diff --git a/src/cms_common.h b/src/cms_common.h -index c7d7268..7a31273 100644 ---- a/src/cms_common.h -+++ b/src/cms_common.h -@@ -123,6 +123,7 @@ extern int wrap_in_seq(cms_context *cms, SECItem *der, - SECItem *items, int num_items); - extern int make_context_specific(cms_context *cms, int ctxt, SECItem *encoded, - SECItem *original); -+extern int make_eku_oid(cms_context *cms, SECItem *encoded, SECOidTag oid_tag); - extern int generate_validity(cms_context *cms, SECItem *der, time_t start, - time_t end); - extern int generate_common_name(cms_context *cms, SECItem *der, char *cn); -diff --git a/src/efikeygen.c b/src/efikeygen.c -index 8a515a5..9390578 100644 ---- a/src/efikeygen.c -+++ b/src/efikeygen.c -@@ -49,6 +49,7 @@ - #include - - #include "cms_common.h" -+#include "oid.h" - #include "util.h" - - typedef struct { -@@ -249,20 +250,34 @@ add_basic_constraints(cms_context *cms, void *extHandle) - } - - static int --add_extended_key_usage(cms_context *cms, void *extHandle) -+add_extended_key_usage(cms_context *cms, int modsign_only, void *extHandle) - { -- SECItem value = { -- .data = (unsigned char *)"\x30\x0a\x06\x08\x2b\x06\x01" -- "\x05\x05\x07\x03\x03", -- .len = 12, -- .type = siBuffer -- }; -+ SECItem values[2]; -+ SECItem wrapped = { 0 }; -+ SECStatus status; -+ SECOidTag tag; -+ int rc; -+ -+ if (modsign_only < 1 || modsign_only > 2) -+ cmsreterr(-1, cms, "could not encode extended key usage"); - -+ rc = make_eku_oid(cms, &values[0], SEC_OID_EXT_KEY_USAGE_CODE_SIGN); -+ if (rc < 0) -+ cmsreterr(-1, cms, "could not encode extended key usage"); -+ -+ tag = find_ms_oid_tag(SHIM_EKU_MODULE_SIGNING_ONLY); -+ printf("tag: %d\n", tag); -+ rc = make_eku_oid(cms, &values[1], tag); -+ if (rc < 0) -+ cmsreterr(-1, cms, "could not encode extended key usage"); -+ -+ rc = wrap_in_seq(cms, &wrapped, values, modsign_only); -+ if (rc < 0) -+ cmsreterr(-1, cms, "could not encode extended key usage"); - -- SECStatus status; - - status = CERT_AddExtension(extHandle, SEC_OID_X509_EXT_KEY_USAGE, -- &value, PR_FALSE, PR_TRUE); -+ &wrapped, PR_FALSE, PR_TRUE); - if (status != SECSuccess) - cmsreterr(-1, cms, "could not encode extended key usage"); - -@@ -294,7 +309,7 @@ static int - add_extensions_to_crq(cms_context *cms, CERTCertificateRequest *crq, - int is_ca, int is_self_signed, SECKEYPublicKey *pubkey, - SECKEYPublicKey *spubkey, -- char *url) -+ char *url, int modsign_only) - { - void *mark = PORT_ArenaMark(cms->arena); - -@@ -319,7 +334,7 @@ add_extensions_to_crq(cms_context *cms, CERTCertificateRequest *crq, - if (rc < 0) - cmsreterr(-1, cms, "could not generate certificate extensions"); - -- rc = add_extended_key_usage(cms, extHandle); -+ rc = add_extended_key_usage(cms, modsign_only, extHandle); - if (rc < 0) - cmsreterr(-1, cms, "could not generate certificate extensions"); - -@@ -469,6 +484,7 @@ int main(int argc, char *argv[]) - { - int is_ca = 0; - int is_self_signed = -1; -+ int modsign_only = 0; - char *tokenname = "NSS Certificate DB"; - char *signer = NULL; - char *nickname = NULL; -@@ -522,6 +538,18 @@ int main(int argc, char *argv[]) - .descrip = "Generate a self-signed certificate" }, - - /* stuff about the generated key */ -+ {.longName = "kernel", -+ .shortName = 'k', -+ .argInfo = POPT_ARG_VAL|POPT_ARGFLAG_OR, -+ .arg = &modsign_only, -+ .val = 1, -+ .descrip = "Generate a kernel-signing certificate" }, -+ {.longName = "module", -+ .shortName = 'm', -+ .argInfo = POPT_ARG_VAL|POPT_ARGFLAG_OR, -+ .arg = &modsign_only, -+ .val = 2, -+ .descrip = "Generate a module-signing certificate" }, - {.longName = "nickname", - .shortName = 'n', - .argInfo = POPT_ARG_STRING, -@@ -628,6 +656,9 @@ int main(int argc, char *argv[]) - liberr(1, "could not allocate cms context"); - } - -+ if (modsign_only < 1 || modsign_only > 2) -+ errx(1, "either --kernel or --module must be used"); -+ - SECStatus status = NSS_InitReadWrite(dbdir); - if (status != SECSuccess) - nsserr(1, "could not initialize NSS"); -@@ -639,6 +670,10 @@ int main(int argc, char *argv[]) - SECKEYPublicKey *pubkey = NULL; - SECKEYPrivateKey *privkey = NULL; - -+ status = register_oids(cms); -+ if (status != SECSuccess) -+ nsserr(1, "Could not register OIDs"); -+ - PK11SlotInfo *slot = NULL; - if (pubfile) { - rc = get_pubkey_from_file(pubfile, &pubkey); -@@ -713,7 +748,7 @@ int main(int argc, char *argv[]) - crq = CERT_CreateCertificateRequest(name, spki, &attributes); - - rc = add_extensions_to_crq(cms, crq, is_ca, is_self_signed, pubkey, -- spubkey, url); -+ spubkey, url, modsign_only); - if (rc < 0) - exit(1); - --- -2.13.4 - diff --git a/0017-check_cert_db-try-even-harder-to-pick-a-reasonable-v.patch b/0017-check_cert_db-try-even-harder-to-pick-a-reasonable-v.patch deleted file mode 100644 index acebc3a..0000000 --- a/0017-check_cert_db-try-even-harder-to-pick-a-reasonable-v.patch +++ /dev/null @@ -1,121 +0,0 @@ -From 0456758e0c0873d1251bdf77d27f0f6175cbf289 Mon Sep 17 00:00:00 2001 -From: Peter Jones -Date: Tue, 25 Apr 2017 16:25:02 -0400 -Subject: [PATCH 17/29] check_cert_db(): try even harder to pick a reasonable - validation time. - -Signed-off-by: Peter Jones ---- - src/certdb.c | 75 ++++++++++++++++++++++++++++++++++++++++++++++++++++-------- - 1 file changed, 66 insertions(+), 9 deletions(-) - -diff --git a/src/certdb.c b/src/certdb.c -index b7c99bb..1a4baf1 100644 ---- a/src/certdb.c -+++ b/src/certdb.c -@@ -250,12 +250,53 @@ check_db_hash(db_specifier which, pesigcheck_context *ctx) - return check_db(which, ctx, check_hash, NULL, 0); - } - --static PRTime --determine_reasonable_time(CERTCertificate *cert) -+static void -+find_cert_times(SEC_PKCS7ContentInfo *cinfo, -+ PRTime *notBefore, PRTime *notAfter) - { -- PRTime notBefore, notAfter; -- CERT_GetCertTimes(cert, ¬Before, ¬After); -- return notBefore; -+ CERTCertDBHandle *defaultdb, *certdb; -+ SEC_PKCS7SignedData *sdp; -+ CERTCertificate **certs = NULL; -+ SECItem **rawcerts; -+ int i, certcount; -+ SECStatus rv; -+ -+ if (cinfo->contentTypeTag->offset != SEC_OID_PKCS7_SIGNED_DATA) { -+err: -+ *notBefore = 0; -+ *notAfter = 0x7fffffffffffffff; -+ return; -+ } -+ -+ sdp = cinfo->content.signedData; -+ rawcerts = sdp->rawCerts; -+ -+ defaultdb = CERT_GetDefaultCertDB(); -+ -+ certdb = defaultdb; -+ if (certdb == NULL) -+ goto err; -+ -+ certcount = 0; -+ if (rawcerts != NULL) { -+ for (; rawcerts[certcount] != NULL; certcount++) -+ ; -+ } -+ rv = CERT_ImportCerts(certdb, certUsageObjectSigner, certcount, -+ rawcerts, &certs, PR_FALSE, PR_FALSE, NULL); -+ if (rv != SECSuccess) -+ goto err; -+ -+ for (i = 0; i < certcount; i++) { -+ PRTime nb = 0, na = 0x7fffffffffff; -+ CERT_GetCertTimes(certs[i], &nb, &na); -+ if (*notBefore < nb) -+ *notBefore = nb; -+ if (*notAfter > na) -+ *notAfter = na; -+ } -+ -+ CERT_DestroyCertArray(certs, certcount); - } - - static db_status -@@ -271,6 +312,8 @@ check_cert(pesigcheck_context *ctx, SECItem *sig, efi_guid_t *sigtype, - PRBool result; - SECStatus rv; - db_status status = NOT_FOUND; -+ PRTime earlyNow = 0, lateNow = 0x7fffffffffffffff; -+ PRTime notBefore = 0, notAfter = 0x7fffffffffffffff; - - efi_guid_t efi_x509 = efi_guid_x509_cert; - -@@ -327,16 +370,30 @@ check_cert(pesigcheck_context *ctx, SECItem *sig, efi_guid_t *sigtype, - } - cert->timeOK = PR_TRUE; - -+ find_cert_times(cinfo, ¬Before, ¬After); -+ if (earlyNow < notBefore) -+ earlyNow = notBefore; -+ if (lateNow > notAfter) -+ lateNow = notAfter; -+ - SECItem *eTime; - PRTime atTime; - // atTime = determine_reasonable_time(cert); - eTime = SEC_PKCS7GetSigningTime(cinfo); - if (eTime != NULL) { -- if (DER_DecodeTimeChoice (&atTime, eTime) != SECSuccess) -- atTime = determine_reasonable_time(cert); -- } else { -- atTime = determine_reasonable_time(cert); -+ if (DER_DecodeTimeChoice (&atTime, eTime) == SECSuccess) { -+ if (earlyNow < atTime) -+ earlyNow = atTime; -+ if (lateNow > atTime) -+ lateNow = atTime; -+ } - } -+ -+ if (lateNow < earlyNow) -+ printf("Impossible time constraints: %ld <= %ld\n", -+ earlyNow / 1000000, lateNow / 1000000); -+ atTime = earlyNow / 2 + lateNow / 2; -+ - /* Verify the signature */ - result = SEC_PKCS7VerifyDetachedSignatureAtTime(cinfo, - certUsageObjectSigner, --- -2.13.4 - diff --git a/0018-show-which-db-we-re-checking.patch b/0018-show-which-db-we-re-checking.patch deleted file mode 100644 index 2b92f83..0000000 --- a/0018-show-which-db-we-re-checking.patch +++ /dev/null @@ -1,137 +0,0 @@ -From 01b89fb7a191f4639a93c5a7c47a80752118ba95 Mon Sep 17 00:00:00 2001 -From: Peter Jones -Date: Tue, 25 Apr 2017 16:58:50 -0400 -Subject: [PATCH 18/29] show which db we're checking - ---- - src/certdb.c | 35 ++++++++++++++++++++++++++++++++++- - src/pesigcheck_context.c | 2 ++ - src/pesigcheck_context.h | 1 + - 3 files changed, 37 insertions(+), 1 deletion(-) - -diff --git a/src/certdb.c b/src/certdb.c -index 1a4baf1..673e074 100644 ---- a/src/certdb.c -+++ b/src/certdb.c -@@ -18,6 +18,7 @@ - */ - - #include -+#include - #include - #include - #include -@@ -42,17 +43,33 @@ add_db_file(pesigcheck_context *ctx, db_specifier which, const char *dbfile, - return -1; - - db->type = type; -- - db->fd = open(dbfile, O_RDONLY); - if (db->fd < 0) { - save_errno(free(db)); - return -1; - } - -+ char *path = strdup(dbfile); -+ if (!path) { -+ save_errno(close(db->fd); -+ free(db)); -+ return -1; -+ } -+ -+ db->path = basename(path); -+ db->path = strdup(db->path); -+ free(path); -+ if (!db->path) { -+ save_errno(close(db->fd); -+ free(db)); -+ return -1; -+ } -+ - struct stat sb; - int rc = fstat(db->fd, &sb); - if (rc < 0) { - save_errno(close(db->fd); -+ free(db->path); - free(db)); - return -1; - } -@@ -65,6 +82,7 @@ add_db_file(pesigcheck_context *ctx, db_specifier which, const char *dbfile, - rc = read_file(db->fd, (char **)&db->map, &sz); - if (rc < 0) { - save_errno(close(db->fd); -+ free(db->path); - free(db)); - return -1; - } -@@ -133,6 +151,7 @@ add_cert_file(pesigcheck_context *ctx, const char *filename) - #define DB_PATH "/sys/firmware/efi/efivars/db-d719b2cb-3d3a-4596-a3bc-dad00e67656f" - #define MOK_PATH "/sys/firmware/efi/efivars/MokListRT-605dab50-e046-4300-abb6-3dd810dd8b23" - #define DBX_PATH "/sys/firmware/efi/efivars/dbx-d719b2cb-3d3a-4596-a3bc-dad00e67656f" -+#define MOKX_PATH "/sys/firmware/efi/efivars/MokListXRT-605dab50-e046-4300-abb6-3dd810dd8b23" - - void - init_cert_db(pesigcheck_context *ctx, int use_system_dbs) -@@ -167,6 +186,18 @@ init_cert_db(pesigcheck_context *ctx, int use_system_dbs) - "database \"%s\": %m\n", DBX_PATH); - exit(1); - } -+ -+ rc = add_db_file(ctx, DBX, MOKX_PATH, DB_EFIVAR); -+ if (rc < 0 && errno != ENOENT) { -+ fprintf(stderr, "pesigcheck: Could not add key database " -+ "\"%s\": %m\n", MOKX_PATH); -+ exit(1); -+ } -+ -+ if (ctx->dbx == NULL) { -+ fprintf(stderr, "pesigcheck: warning: " -+ "No key recovation database available\n"); -+ } - } - - typedef db_status (*checkfn)(pesigcheck_context *ctx, SECItem *sig, -@@ -187,6 +218,8 @@ check_db(db_specifier which, pesigcheck_context *ctx, checkfn check, - sig.type = siBuffer; - - while (dbl) { -+ printf("Searching %s %s\n", which == DB ? "db" : "dbx", -+ dbl->path); - EFI_SIGNATURE_LIST *certlist; - EFI_SIGNATURE_DATA *cert; - size_t dbsize = dbl->datalen; -diff --git a/src/pesigcheck_context.c b/src/pesigcheck_context.c -index b934cbe..5a355b1 100644 ---- a/src/pesigcheck_context.c -+++ b/src/pesigcheck_context.c -@@ -87,6 +87,7 @@ pesigcheck_context_fini(pesigcheck_context *ctx) - munmap(db->map, db->size); - close(db->fd); - ctx->db = db->next; -+ free(db->path); - free(db); - } - while (ctx->dbx) { -@@ -95,6 +96,7 @@ pesigcheck_context_fini(pesigcheck_context *ctx) - if (db->type == DB_CERT) - free(db->data); - munmap(db->map, db->size); -+ free(db->path); - close(db->fd); - ctx->dbx = db->next; - free(db); -diff --git a/src/pesigcheck_context.h b/src/pesigcheck_context.h -index 1b916e3..7b5cc89 100644 ---- a/src/pesigcheck_context.h -+++ b/src/pesigcheck_context.h -@@ -34,6 +34,7 @@ typedef enum { - - struct dblist { - db_f_type type; -+ char *path; - int fd; - struct dblist *next; - size_t size; --- -2.13.4 - diff --git a/0019-more-about-the-time.patch b/0019-more-about-the-time.patch deleted file mode 100644 index 2570bf8..0000000 --- a/0019-more-about-the-time.patch +++ /dev/null @@ -1,97 +0,0 @@ -From 713e61448a6ffa3e6029a7c89fad61b8cb08c9ff Mon Sep 17 00:00:00 2001 -From: Peter Jones -Date: Tue, 25 Apr 2017 17:00:46 -0400 -Subject: [PATCH 19/29] more about the time - ---- - src/certdb.c | 59 +++++++++++++++++++++++++++++++++-------------------------- - 1 file changed, 33 insertions(+), 26 deletions(-) - -diff --git a/src/certdb.c b/src/certdb.c -index 673e074..1078a8a 100644 ---- a/src/certdb.c -+++ b/src/certdb.c -@@ -345,8 +345,10 @@ check_cert(pesigcheck_context *ctx, SECItem *sig, efi_guid_t *sigtype, - PRBool result; - SECStatus rv; - db_status status = NOT_FOUND; -+ PRTime atTime = PR_Now(); -+ SECItem *eTime; - PRTime earlyNow = 0, lateNow = 0x7fffffffffffffff; -- PRTime notBefore = 0, notAfter = 0x7fffffffffffffff; -+ PRTime notBefore, notAfter; - - efi_guid_t efi_x509 = efi_guid_x509_cert; - -@@ -358,6 +360,36 @@ check_cert(pesigcheck_context *ctx, SECItem *sig, efi_guid_t *sigtype, - if (!cinfo) - goto out; - -+ notBefore = earlyNow; -+ notAfter = lateNow; -+ find_cert_times(cinfo, ¬Before, ¬After); -+ if (earlyNow < notBefore) -+ earlyNow = notBefore; -+ if (lateNow > notAfter) -+ lateNow = notAfter; -+ -+ // atTime = determine_reasonable_time(cert); -+ eTime = SEC_PKCS7GetSigningTime(cinfo); -+ if (eTime != NULL) { -+ if (DER_DecodeTimeChoice (&atTime, eTime) == SECSuccess) { -+ if (earlyNow < atTime) -+ earlyNow = atTime; -+ if (lateNow > atTime) -+ lateNow = atTime; -+ } -+ } -+ -+ if (lateNow < earlyNow) -+ printf("Signature has impossible time constraint: %ld <= %ld\n", -+ earlyNow / 1000000, lateNow / 1000000); -+ atTime = earlyNow / 2 + lateNow / 2; -+ -+ -+ cinfo = SEC_PKCS7DecodeItem(pkcs7sig, NULL, NULL, NULL, NULL, NULL, -+ NULL, NULL); -+ if (!cinfo) -+ goto out; -+ - /* Generate the digest of contentInfo */ - /* XXX support only sha256 for now */ - digest = SECITEM_AllocItem(NULL, NULL, 32); -@@ -401,31 +433,6 @@ check_cert(pesigcheck_context *ctx, SECItem *sig, efi_guid_t *sigtype, - PORT_ErrorToString(PORT_GetError())); - goto out; - } -- cert->timeOK = PR_TRUE; -- -- find_cert_times(cinfo, ¬Before, ¬After); -- if (earlyNow < notBefore) -- earlyNow = notBefore; -- if (lateNow > notAfter) -- lateNow = notAfter; -- -- SECItem *eTime; -- PRTime atTime; -- // atTime = determine_reasonable_time(cert); -- eTime = SEC_PKCS7GetSigningTime(cinfo); -- if (eTime != NULL) { -- if (DER_DecodeTimeChoice (&atTime, eTime) == SECSuccess) { -- if (earlyNow < atTime) -- earlyNow = atTime; -- if (lateNow > atTime) -- lateNow = atTime; -- } -- } -- -- if (lateNow < earlyNow) -- printf("Impossible time constraints: %ld <= %ld\n", -- earlyNow / 1000000, lateNow / 1000000); -- atTime = earlyNow / 2 + lateNow / 2; - - /* Verify the signature */ - result = SEC_PKCS7VerifyDetachedSignatureAtTime(cinfo, --- -2.13.4 - diff --git a/0020-try-to-say-why-something-fails.patch b/0020-try-to-say-why-something-fails.patch deleted file mode 100644 index 96bdd60..0000000 --- a/0020-try-to-say-why-something-fails.patch +++ /dev/null @@ -1,419 +0,0 @@ -From 81583146602bba96728fa7544c8e856b32c22ee4 Mon Sep 17 00:00:00 2001 -From: Peter Jones -Date: Tue, 25 Apr 2017 17:01:13 -0400 -Subject: [PATCH 20/29] try to say why something fails - -Signed-off-by: Peter Jones ---- - src/certdb.c | 15 ++- - src/certdb.h | 2 +- - src/pesigcheck.c | 244 ++++++++++++++++++++++++++++++++++++++++++----- - src/pesigcheck_context.h | 1 + - 4 files changed, 233 insertions(+), 29 deletions(-) - -diff --git a/src/certdb.c b/src/certdb.c -index 1078a8a..fae80af 100644 ---- a/src/certdb.c -+++ b/src/certdb.c -@@ -205,7 +205,7 @@ typedef db_status (*checkfn)(pesigcheck_context *ctx, SECItem *sig, - - static db_status - check_db(db_specifier which, pesigcheck_context *ctx, checkfn check, -- void *data, ssize_t datalen) -+ void *data, ssize_t datalen, SECItem *match) - { - SECItem pkcs7sig, sig; - dblist *dbl = which == DB ? ctx->db : ctx->dbx; -@@ -241,8 +241,12 @@ check_db(db_specifier which, pesigcheck_context *ctx, checkfn check, - found = check(ctx, &sig, - &certlist->SignatureType, - &pkcs7sig); -- if (found == FOUND) -+ if (found == FOUND) { -+ if (match) -+ memcpy(match, &sig, -+ sizeof(sig)); - return FOUND; -+ } - cert = (EFI_SIGNATURE_DATA *)((uint8_t *)cert + - certlist->SignatureSize); - } -@@ -280,7 +284,7 @@ check_hash(pesigcheck_context *ctx, SECItem *sig, efi_guid_t *sigtype, - db_status - check_db_hash(db_specifier which, pesigcheck_context *ctx) - { -- return check_db(which, ctx, check_hash, NULL, 0); -+ return check_db(which, ctx, check_hash, NULL, 0, NULL); - } - - static void -@@ -459,7 +463,8 @@ out: - } - - db_status --check_db_cert(db_specifier which, pesigcheck_context *ctx, void *data, ssize_t datalen) -+check_db_cert(db_specifier which, pesigcheck_context *ctx, -+ void *data, ssize_t datalen, SECItem *match) - { -- return check_db(which, ctx, check_cert, data, datalen); -+ return check_db(which, ctx, check_cert, data, datalen, match); - } -diff --git a/src/certdb.h b/src/certdb.h -index ccf3c87..8402299 100644 ---- a/src/certdb.h -+++ b/src/certdb.h -@@ -43,7 +43,7 @@ typedef struct { - - extern db_status check_db_hash(db_specifier which, pesigcheck_context *ctx); - extern db_status check_db_cert(db_specifier which, pesigcheck_context *ctx, -- void *data, ssize_t datalen); -+ void *data, ssize_t datalen, SECItem *match); - - extern void init_cert_db(pesigcheck_context *ctx, int use_system_dbs); - extern int add_cert_db(pesigcheck_context *ctx, const char *filename); -diff --git a/src/pesigcheck.c b/src/pesigcheck.c -index d7be542..c8e1086 100644 ---- a/src/pesigcheck.c -+++ b/src/pesigcheck.c -@@ -17,7 +17,9 @@ - * Author(s): Peter Jones - */ - -+#include - #include -+#include - #include - #include - #include -@@ -88,7 +90,8 @@ check_inputs(pesigcheck_context *ctx) - } - - static int --cert_matches_digest(pesigcheck_context *ctx, void *data, ssize_t datalen) -+cert_matches_digest(pesigcheck_context *ctx, void *data, ssize_t datalen, -+ SECItem *digest_out) - { - SECItem sig, *pe_digest, *content; - uint8_t *digest; -@@ -109,6 +112,12 @@ cert_matches_digest(pesigcheck_context *ctx, void *data, ssize_t datalen) - pe_digest = ctx->cms_ctx->digests[0].pe_digest; - content = cinfo->content.signedData->contentInfo.content.data; - digest = content->data + content->len - pe_digest->len; -+ if (digest_out) { -+ digest_out->data = malloc(pe_digest->len); -+ digest_out->len = pe_digest->len; -+ digest_out->type = pe_digest->type; -+ memcpy(digest_out->data, digest, pe_digest->len); -+ } - if (memcmp(pe_digest->data, digest, pe_digest->len) != 0) - goto out; - -@@ -120,22 +129,149 @@ out: - return ret; - } - -+struct reason { -+ enum { -+ WHITELISTED = 0, -+ INVALID = 1, -+ BLACKLISTED = 2, -+ NO_WHITELIST = 3, -+ } reason; -+ enum { -+ NONE = 0, -+ DIGEST = 1, -+ SIGNATURE = 2, -+ } type; -+ union { -+ struct { -+ SECItem digest; -+ }; -+ struct { -+ SECItem sig; -+ SECItem db_cert; -+ }; -+ }; -+}; -+ -+static void -+print_digest(SECItem *digest) -+{ -+ char buf[digest->len * 2 + 2]; -+ -+ for (unsigned int i = 0; i < digest->len; i++) -+ snprintf(buf + i * 2, digest->len * 2, "%02x", -+ digest->data[i]); -+ buf[digest->len * 2] = '\0'; -+ printf("%s\n", buf); -+} -+ -+static void -+print_certificate(SECItem *cert) -+{ -+ printf("put a breakpoint at %s:%d\n", __FILE__, __LINE__); -+ printf("cert: %p\n", cert); -+} -+ -+static void -+print_signatures(SECItem *database_cert, SECItem *signature) -+{ -+ printf("put a breakpoint at %s:%d\n", __FILE__, __LINE__); -+ print_certificate(database_cert); -+ print_certificate(signature); -+} -+ -+static void -+print_reason(struct reason *reason) -+{ -+ switch (reason->reason) { -+ case WHITELISTED: -+ printf("Whitelist entry: "); -+ if (reason->type == DIGEST) -+ print_digest(&reason->digest); -+ else if (reason->type == SIGNATURE) -+ print_signatures(&reason->sig, &reason->db_cert); -+ else -+ errx(1, "Unknown data type %d\n", reason->type); -+ break; -+ case INVALID: -+ if (reason->type == DIGEST) { -+ printf("Invalid digest: "); -+ print_digest(&reason->digest); -+ } else if (reason->type == SIGNATURE) { -+ printf("Invalid signature: "); -+ print_signatures(&reason->sig, &reason->db_cert); -+ } else { -+ errx(1, "Unknown data type %d\n", reason->type); -+ } -+ break; -+ case BLACKLISTED: -+ if (reason->type == DIGEST) { -+ printf("Invalid digest: "); -+ print_digest(&reason->digest); -+ } else if (reason->type == SIGNATURE) { -+ printf("Invalid signature: "); -+ print_signatures(&reason->sig, &reason->db_cert); -+ } else { -+ errx(1, "Unknown data type %d\n", reason->type); -+ } -+ break; -+ case NO_WHITELIST: -+ if (reason->type == NONE) -+ printf("No matching whitelist entry.\n"); -+ else -+ errx(1, "Invalid data type %d\n", reason->type); -+ break; -+ default: -+ errx(1, "Unknown reason type %d\n", reason->reason); -+ break; -+ } -+} -+ -+static void -+get_digest(pesigcheck_context *ctx, SECItem *digest) -+{ -+ struct cms_context *cms = ctx->cms_ctx; -+ struct digest *cms_digest = &cms->digests[cms->selected_digest]; -+ -+ memcpy(digest, cms_digest->pe_digest, sizeof (*digest)); -+} -+ - static int --check_signature(pesigcheck_context *ctx) -+check_signature(pesigcheck_context *ctx, int *nreasons, -+ struct reason **reasons) - { -- int has_valid_cert = 0; -- int has_invalid_cert = 0; -+ bool has_valid_cert = false; -+ bool is_invalid = false; -+ struct reason *reasonps = NULL, *reason; -+ int num_reasons = 16; -+ int nreason = 0; - int rc = 0; -+ int ret = -1; - - cert_iter iter; - -+ reasonps = calloc(sizeof(struct reason), 512); -+ if (!reasonps) -+ err(1, "check_signature"); -+ - generate_digest(ctx->cms_ctx, ctx->inpe, 1); - -- if (check_db_hash(DBX, ctx) == FOUND) -- return -1; -+ if (check_db_hash(DBX, ctx) == FOUND) { -+ reason = &reasonps[nreason]; -+ reason->reason = BLACKLISTED; -+ reason->type = DIGEST; -+ get_digest(ctx, &reason->digest); -+ reason += 1; -+ is_invalid = true; -+ } - -- if (check_db_hash(DB, ctx) == FOUND) -- has_valid_cert = 1; -+ if (check_db_hash(DB, ctx) == FOUND) { -+ reason = &reasonps[nreason]; -+ reason->reason = WHITELISTED; -+ reason->type = DIGEST; -+ get_digest(ctx, &reason->digest); -+ nreason += 1; -+ has_valid_cert = true; -+ } - - rc = cert_iter_init(&iter, ctx->inpe); - if (rc < 0) -@@ -145,32 +281,81 @@ check_signature(pesigcheck_context *ctx) - ssize_t datalen; - - while (1) { -+ /* -+ * Make sure we always have enough for this iteration of the -+ * loop, plus one "NO_WHITELIST" entry at the end. -+ */ -+ if (nreason >= num_reasons - 4) { -+ struct reason *new_reasons; -+ -+ num_reasons += 16; -+ -+ new_reasons = calloc(sizeof(struct reason), num_reasons); -+ if (!new_reasons) -+ err(1, "check_signature"); -+ reasonps = new_reasons; -+ } -+ - rc = next_cert(&iter, &data, &datalen); - if (rc <= 0) - break; - -- if (cert_matches_digest(ctx, data, datalen) < 0) { -- has_invalid_cert = 1; -- break; -+ reason = &reasonps[nreason]; -+ if (cert_matches_digest(ctx, data, datalen, -+ &reason->digest) < 0) { -+ reason->reason = INVALID; -+ reason->type = DIGEST; -+ nreason += 1; -+ is_invalid = true; - } - -- if (check_db_cert(DBX, ctx, data, datalen) == FOUND) { -- has_invalid_cert = 1; -- break; -+ reason = &reasonps[nreason]; -+ if (check_db_cert(DBX, ctx, data, datalen, -+ &reason->db_cert) == FOUND) { -+ reason->reason = INVALID; -+ reason->type = SIGNATURE; -+ reason->sig.data = data; -+ reason->sig.len = datalen; -+ reason->type = siBuffer; -+ nreason += 1; -+ is_invalid = true; - } - -- if (check_db_cert(DB, ctx, data, datalen) == FOUND) -- has_valid_cert = 1; -+ reason = &reasonps[nreason]; -+ if (check_db_cert(DB, ctx, data, datalen, -+ &reason->db_cert) == FOUND) { -+ reason->reason = WHITELISTED; -+ reason->type = SIGNATURE; -+ reason->sig.data = data; -+ reason->sig.len = datalen; -+ reason->type = siBuffer; -+ nreason += 1; -+ has_valid_cert = true; -+ } - } - - err: -- if (has_invalid_cert) -- return -1; -+ if (has_valid_cert != true) { -+ if (is_invalid != true) { -+ reason = &reasonps[nreason]; -+ reason->reason = NO_WHITELIST; -+ reason->type = NONE; -+ nreason += 1; -+ } -+ is_invalid = true; -+ } - -- if (has_valid_cert) -- return 0; -+ if (is_invalid == false) -+ ret = 0; - -- return -1; -+ if (nreasons && reasons) { -+ *nreasons = nreason; -+ *reasons = reasonps; -+ } else { -+ free(reasonps); -+ } -+ -+ return ret; - } - - void -@@ -204,6 +389,9 @@ main(int argc, char *argv[]) - - pesigcheck_context ctx, *ctxp = &ctx; - -+ struct reason *reasons = NULL; -+ int nreasons = 0; -+ - char *dbfile = NULL; - char *dbxfile = NULL; - char *certfile = NULL; -@@ -242,6 +430,12 @@ main(int argc, char *argv[]) - .arg = &ctx.quiet, - .val = 1, - .descrip = "return only; no text output." }, -+ {.longName = "verbose", -+ .shortName = 'v', -+ .argInfo = POPT_BIT_SET, -+ .arg = &ctx.verbose, -+ .val = 1, -+ .descrip = "print reasons for success and failure." }, - {.longName = "no-system-db", - .shortName = 'n', - .argInfo = POPT_ARG_INT, -@@ -308,12 +502,16 @@ main(int argc, char *argv[]) - exit(1); - } - -- rc = check_signature(ctxp); -+ rc = check_signature(ctxp, &nreasons, &reasons); - -- close_input(ctxp); -+ if (!ctx.quiet && ctx.verbose) { -+ for (int i = 0; i < nreasons; i++) -+ print_reason(&reasons[i]); -+ } - if (!ctx.quiet) - printf("pesigcheck: \"%s\" is %s.\n", ctx.infile, - rc >= 0 ? "valid" : "invalid"); -+ close_input(ctxp); - pesigcheck_context_fini(&ctx); - - NSS_Shutdown(); -diff --git a/src/pesigcheck_context.h b/src/pesigcheck_context.h -index 7b5cc89..aec415e 100644 ---- a/src/pesigcheck_context.h -+++ b/src/pesigcheck_context.h -@@ -61,6 +61,7 @@ typedef struct pesigcheck_context { - Pe *inpe; - - int quiet; -+ int verbose; - - hashlist *hashes; - --- -2.13.4 - diff --git a/0021-Fix-race-condition-in-SEC_GetPassword.patch b/0021-Fix-race-condition-in-SEC_GetPassword.patch deleted file mode 100644 index 3088923..0000000 --- a/0021-Fix-race-condition-in-SEC_GetPassword.patch +++ /dev/null @@ -1,34 +0,0 @@ -From a40c584691ae071e93e8adf4e5c05bcd90c68159 Mon Sep 17 00:00:00 2001 -From: Julien Cristau -Date: Sat, 6 May 2017 22:45:34 +0200 -Subject: [PATCH 21/29] Fix race condition in SEC_GetPassword - -A side effect of echoOff is to discard unread input, so if we print the -prompt before echoOff, the user (or process) at the other end might -react to it by writing the password in between those steps, which is -then discarded. This bit me when trying to drive pesign with an expect -script. - -Signed-off-by: Julien Cristau ---- - src/password.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/password.c b/src/password.c -index cd1c07e..d4eae0d 100644 ---- a/src/password.c -+++ b/src/password.c -@@ -71,9 +71,9 @@ static char *SEC_GetPassword(FILE *input, FILE *output, char *prompt, - for (;;) { - /* Prompt for password */ - if (isTTY) { -+ echoOff(infd); - fprintf(output, "%s", prompt); - fflush (output); -- echoOff(infd); - } - - fgets ( phrase, sizeof(phrase), input); --- -2.13.4 - diff --git a/0022-sysvinit-Create-the-socket-directory-at-runtime.patch b/0022-sysvinit-Create-the-socket-directory-at-runtime.patch deleted file mode 100644 index 06980ee..0000000 --- a/0022-sysvinit-Create-the-socket-directory-at-runtime.patch +++ /dev/null @@ -1,27 +0,0 @@ -From 27afa5a4ea8de1679603f5871935096280d0b12e Mon Sep 17 00:00:00 2001 -From: David Michael -Date: Tue, 13 Jun 2017 13:20:16 -0700 -Subject: [PATCH 22/29] sysvinit: Create the socket directory at runtime - -This better supports non-systemd configurations with tmpfs on /run. ---- - src/pesign.sysvinit.in | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/src/pesign.sysvinit.in b/src/pesign.sysvinit.in -index d8fffca..dc508d8 100644 ---- a/src/pesign.sysvinit.in -+++ b/src/pesign.sysvinit.in -@@ -20,6 +20,9 @@ RETVAL=0 - - start(){ - echo -n "Starting pesign: " -+ mkdir /var/run/pesign 2>/dev/null && -+ chown pesign:pesign /var/run/pesign && -+ chmod 0770 /var/run/pesign - daemon /usr/bin/pesign --daemonize - RETVAL=$? - echo --- -2.13.4 - diff --git a/0023-Better-authorization-scripts.-Again.patch b/0023-Better-authorization-scripts.-Again.patch deleted file mode 100644 index c778c94..0000000 --- a/0023-Better-authorization-scripts.-Again.patch +++ /dev/null @@ -1,217 +0,0 @@ -From 31560e2784722b986b8a73cc28e3510870180b07 Mon Sep 17 00:00:00 2001 -From: Peter Jones -Date: Tue, 8 Aug 2017 15:44:44 -0400 -Subject: [PATCH 23/29] Better authorization scripts. Again. - -Signed-off-by: Peter Jones ---- - src/Makefile | 12 ++++++---- - src/pesign-authorize | 56 +++++++++++++++++++++++++++++++++++++++++++++ - src/pesign-authorize-groups | 30 ------------------------ - src/pesign-authorize-users | 30 ------------------------ - src/pesign.service.in | 3 +-- - src/pesign.sysvinit.in | 3 +-- - 6 files changed, 65 insertions(+), 69 deletions(-) - create mode 100755 src/pesign-authorize - delete mode 100644 src/pesign-authorize-groups - delete mode 100644 src/pesign-authorize-users - -diff --git a/src/Makefile b/src/Makefile -index 654b792..84ad130 100644 ---- a/src/Makefile -+++ b/src/Makefile -@@ -7,7 +7,7 @@ include $(TOPDIR)/Make.defaults - - BINTARGETS=authvar client efikeygen efisiglist pesigcheck pesign - SVCTARGETS=pesign.sysvinit pesign.service --TARGETS=$(BINTARGETS) $(SVCTARGETS) -+TARGETS=$(BINTARGETS) $(SVCTARGETS) pesign-users pesign-groups - - all : deps $(TARGETS) - -@@ -65,6 +65,9 @@ install_sysvinit: pesign.sysvinit - $(INSTALL) -d -m 755 $(INSTALLROOT)/etc/rc.d/init.d/ - $(INSTALL) -m 755 pesign.sysvinit $(INSTALLROOT)/etc/rc.d/init.d/pesign - -+pesign-users pesign-groups : -+ echo pesign > $@ -+ - install : - $(INSTALL) -d -m 700 $(INSTALLROOT)/etc/pki/pesign/ - $(INSTALL) -d -m 700 $(INSTALLROOT)/etc/pki/pesign-rh-test/ -@@ -88,10 +91,9 @@ install : - $(INSTALL) -d -m 755 $(INSTALLROOT)/etc/rpm/ - $(INSTALL) -m 644 macros.pesign $(INSTALLROOT)/etc/rpm/ - $(INSTALL) -d -m 755 $(INSTALLROOT)$(libexecdir)/pesign/ -- $(INSTALL) -m 750 pesign-authorize-users $(INSTALLROOT)$(libexecdir)/pesign/ -- $(INSTALL) -m 750 pesign-authorize-groups $(INSTALLROOT)$(libexecdir)/pesign/ -+ $(INSTALL) -m 750 pesign-authorize $(INSTALLROOT)$(libexecdir)/pesign/ - $(INSTALL) -d -m 700 $(INSTALLROOT)/etc/pesign -- $(INSTALL) -m 600 /dev/null $(INSTALLROOT)/etc/pesign/users -- $(INSTALL) -m 600 /dev/null $(INSTALLROOT)/etc/pesign/groups -+ $(INSTALL) -m 600 pesign-users $(INSTALLROOT)/etc/pesign/users -+ $(INSTALL) -m 600 pesign-groups $(INSTALLROOT)/etc/pesign/groups - - .PHONY: all deps clean install -diff --git a/src/pesign-authorize b/src/pesign-authorize -new file mode 100755 -index 0000000..a496f60 ---- /dev/null -+++ b/src/pesign-authorize -@@ -0,0 +1,56 @@ -+#!/bin/bash -+set -e -+set -u -+ -+# -+# With /run/pesign/socket on tmpfs, a simple way of restoring the -+# acls for specific users is useful -+# -+# Compare to: http://infrastructure.fedoraproject.org/cgit/ansible.git/tree/roles/bkernel/tasks/main.yml?id=17198dadebf59d8090b7ed621bc8ab22152d2eb6 -+# -+ -+# License: GPLv2 -+declare -a fileusers=() -+declare -a dirusers=() -+for user in $(cat /etc/pesign/users); do -+ dirusers[${#dirusers[@]}]=-m -+ dirusers[${#dirusers[@]}]="u:$user:rwx" -+ fileusers[${#fileusers[@]}]=-m -+ fileusers[${#fileusers[@]}]="u:$user:rw" -+done -+ -+declare -a filegroups=() -+declare -a dirgroups=() -+for group in $(cat /etc/pesign/groups); do -+ dirgroups[${#dirgroups[@]}]=-m -+ dirgroups[${#dirgroups[@]}]="g:$group:rwx" -+ filegroups[${#filegroups[@]}]=-m -+ filegroups[${#filegroups[@]}]="g:$group:rw" -+done -+ -+update_subdir() { -+ subdir=$1 && shift -+ -+ setfacl -bk "${subdir}" -+ setfacl "${dirusers[@]}" "${dirgroups[@]}" "${subdir}" -+ for x in "${subdir}"* ; do -+ if [ -d "${x}" ]; then -+ setfacl -bk ${x} -+ setfacl "${dirusers[@]}" "${dirgroups[@]}" ${x} -+ update_subdir "${x}/" -+ elif [ -e "${x}" ]; then -+ setfacl -bk ${x} -+ setfacl "${fileusers[@]}" "${filegroups[@]}" ${x} -+ else -+ :; -+ fi -+ done -+} -+ -+for x in /var/run/pesign/ /etc/pki/pesign*/ ; do -+ if [ -d "${x}" ]; then -+ update_subdir "${x}" -+ else -+ :; -+ fi -+done -diff --git a/src/pesign-authorize-groups b/src/pesign-authorize-groups -deleted file mode 100644 -index cf51fb6..0000000 ---- a/src/pesign-authorize-groups -+++ /dev/null -@@ -1,30 +0,0 @@ --#!/bin/bash --set -e -- --# --# With /run/pesign/socket on tmpfs, a simple way of restoring the --# acls for specific groups is useful --# --# Compare to: http://infrastructure.fedoraproject.org/cgit/ansible.git/tree/roles/bkernel/tasks/main.yml?id=17198dadebf59d8090b7ed621bc8ab22152d2eb6 --# -- --# License: GPLv2 -- --if [ -r /etc/pesign/groups ]; then -- for group in $(cat /etc/pesign/groups); do -- if [ -d /var/run/pesign ]; then -- setfacl -m g:${group}:rx /var/run/pesign -- if [ -e /var/run/pesign/socket ]; then -- setfacl -m g:${group}:rw /var/run/pesign/socket -- fi -- fi -- for x in /etc/pki/pesign*/ ; do -- if [ -d ${x} ]; then -- setfacl -m g:${group}:rx ${x} -- for y in ${x}{cert8,key3,secmod}.db ; do -- setfacl -m g:${group}:rw ${y} -- done -- fi -- done -- done --fi -diff --git a/src/pesign-authorize-users b/src/pesign-authorize-users -deleted file mode 100644 -index 940138e..0000000 ---- a/src/pesign-authorize-users -+++ /dev/null -@@ -1,30 +0,0 @@ --#!/bin/bash --set -e -- --# --# With /run/pesign/socket on tmpfs, a simple way of restoring the --# acls for specific users is useful --# --# Compare to: http://infrastructure.fedoraproject.org/cgit/ansible.git/tree/roles/bkernel/tasks/main.yml?id=17198dadebf59d8090b7ed621bc8ab22152d2eb6 --# -- --# License: GPLv2 -- --if [ -r /etc/pesign/users ]; then -- for username in $(cat /etc/pesign/users); do -- if [ -d /var/run/pesign ]; then -- setfacl -m g:${username}:rx /var/run/pesign -- if [ -e /var/run/pesign/socket ]; then -- setfacl -m g:${username}:rw /var/run/pesign/socket -- fi -- fi -- for x in /etc/pki/pesign*/ ; do -- if [ -d ${x} ]; then -- setfacl -m g:${username}:rx ${x} -- for y in ${x}{cert8,key3,secmod}.db ; do -- setfacl -m g:${username}:rw ${y} -- done -- fi -- done -- done --fi -diff --git a/src/pesign.service.in b/src/pesign.service.in -index aaa408e..c75a000 100644 ---- a/src/pesign.service.in -+++ b/src/pesign.service.in -@@ -6,5 +6,4 @@ PrivateTmp=true - Type=forking - PIDFile=/var/run/pesign.pid - ExecStart=/usr/bin/pesign --daemonize --ExecStartPost=@@LIBEXECDIR@@/pesign/pesign-authorize-users --ExecStartPost=@@LIBEXECDIR@@/pesign/pesign-authorize-groups -+ExecStartPost=@@LIBEXECDIR@@/pesign/pesign-authorize -diff --git a/src/pesign.sysvinit.in b/src/pesign.sysvinit.in -index dc508d8..b0e0f84 100644 ---- a/src/pesign.sysvinit.in -+++ b/src/pesign.sysvinit.in -@@ -27,8 +27,7 @@ start(){ - RETVAL=$? - echo - touch /var/lock/subsys/pesign -- @@LIBEXECDIR@@/pesign/pesign-authorize-users -- @@LIBEXECDIR@@/pesign/pesign-authorize-groups -+ @@LIBEXECDIR@@/pesign/pesign-authorize - } - - stop(){ --- -2.13.4 - diff --git a/0024-Make-the-daemon-also-try-to-give-better-errors-on-EP.patch b/0024-Make-the-daemon-also-try-to-give-better-errors-on-EP.patch deleted file mode 100644 index 8f4a380..0000000 --- a/0024-Make-the-daemon-also-try-to-give-better-errors-on-EP.patch +++ /dev/null @@ -1,95 +0,0 @@ -From a7b0f7e1ce2de1acea9a8c286a0ff3dd9bc245cb Mon Sep 17 00:00:00 2001 -From: Peter Jones -Date: Tue, 8 Aug 2017 17:28:19 -0400 -Subject: [PATCH 24/29] Make the daemon also try to give better errors on - -EPERM etc. - -Basically 6796e5f but also for the daemon. This also tries to fix them -up to save errno better, for more accurate reporting. - -Signed-off-by: Peter Jones ---- - src/daemon.c | 27 +++++++++++++++++++++++++-- - src/pesign.c | 8 ++++++-- - 2 files changed, 31 insertions(+), 4 deletions(-) - -diff --git a/src/daemon.c b/src/daemon.c -index 7f694b2..942d576 100644 ---- a/src/daemon.c -+++ b/src/daemon.c -@@ -19,6 +19,7 @@ - - #include - #include -+#include - #include - #include - #include -@@ -1104,10 +1105,32 @@ daemonize(cms_context *cms_ctx, char *certdir, int do_fork) - "pesignd starting (pid %d)", ctx.pid); - - SECStatus status = NSS_Init(certdir); -+ int error = errno; - if (status != SECSuccess) { -+ char *globpattern = NULL; -+ rc = asprintf(&globpattern, "%s/cert*.db", -+ certdir); -+ if (rc > 0) { -+ glob_t globbuf; -+ memset(&globbuf, 0, sizeof(globbuf)); -+ rc = glob(globpattern, GLOB_ERR, NULL, -+ &globbuf); -+ if (rc != 0) { -+ errno = error; -+ ctx.backup_cms->log(ctx.backup_cms, -+ ctx.priority|LOG_NOTICE, -+ "Could not open NSS database (\"%s\"): %m", -+ PORT_ErrorToString(PORT_GetError())); -+ exit(1); -+ } -+ } -+ } -+ if (status != SECSuccess) { -+ errno = error; - ctx.backup_cms->log(ctx.backup_cms, ctx.priority|LOG_NOTICE, -- "Could not initialize nss: %s\n", -- PORT_ErrorToString(PORT_GetError())); -+ "Could not initialize nss.\n" -+ "NSS says \"%s\" errno says \"%m\"\n", -+ PORT_ErrorToString(PORT_GetError())); - exit(1); - } - -diff --git a/src/pesign.c b/src/pesign.c -index 5879cfc..6ceda34 100644 ---- a/src/pesign.c -+++ b/src/pesign.c -@@ -660,10 +660,12 @@ main(int argc, char *argv[]) - - if (!daemon) { - SECStatus status; -+ int error; - if (need_db) { - status = NSS_Init(certdir); - if (status != SECSuccess) { - char *globpattern = NULL; -+ error = errno; - rc = asprintf(&globpattern, "%s/cert*.db", - certdir); - if (rc > 0) { -@@ -680,8 +682,10 @@ main(int argc, char *argv[]) - } else - status = NSS_NoDB_Init(NULL); - if (status != SECSuccess) { -- errx(1, "Could not initialize nss. NSS says \"%s\" errno says \"%m\"\n", -- PORT_ErrorToString(PORT_GetError())); -+ errno = error; -+ errx(1, "Could not initialize nss.\n" -+ "NSS says \"%s\" errno says \"%m\"\n", -+ PORT_ErrorToString(PORT_GetError())); - } - - status = register_oids(ctxp->cms_ctx); --- -2.13.4 - diff --git a/0025-certdb-fix-PRTime-printfs-for-i686.patch b/0025-certdb-fix-PRTime-printfs-for-i686.patch deleted file mode 100644 index 0fc2ad8..0000000 --- a/0025-certdb-fix-PRTime-printfs-for-i686.patch +++ /dev/null @@ -1,31 +0,0 @@ -From bc1043bf2b428971e29a61a341da9a57595bada5 Mon Sep 17 00:00:00 2001 -From: Peter Jones -Date: Wed, 9 Aug 2017 17:40:33 -0400 -Subject: [PATCH 25/29] certdb: fix PRTime printfs for i686 - -Signed-off-by: Peter Jones ---- - src/certdb.c | 5 ++--- - 1 file changed, 2 insertions(+), 3 deletions(-) - -diff --git a/src/certdb.c b/src/certdb.c -index fae80af..29c9502 100644 ---- a/src/certdb.c -+++ b/src/certdb.c -@@ -384,11 +384,10 @@ check_cert(pesigcheck_context *ctx, SECItem *sig, efi_guid_t *sigtype, - } - - if (lateNow < earlyNow) -- printf("Signature has impossible time constraint: %ld <= %ld\n", -- earlyNow / 1000000, lateNow / 1000000); -+ printf("Signature has impossible time constraint: %lld <= %lld\n", -+ earlyNow / 1000000LL, lateNow / 1000000LL); - atTime = earlyNow / 2 + lateNow / 2; - -- - cinfo = SEC_PKCS7DecodeItem(pkcs7sig, NULL, NULL, NULL, NULL, NULL, - NULL, NULL); - if (!cinfo) --- -2.13.4 - diff --git a/0026-Clean-up-gcc-command-lines-a-little.patch b/0026-Clean-up-gcc-command-lines-a-little.patch deleted file mode 100644 index 928d62d..0000000 --- a/0026-Clean-up-gcc-command-lines-a-little.patch +++ /dev/null @@ -1,41 +0,0 @@ -From a44115c9b4f43a1a7219f897bd33555e653d2e20 Mon Sep 17 00:00:00 2001 -From: Peter Jones -Date: Thu, 10 Aug 2017 10:02:38 -0400 -Subject: [PATCH 26/29] Clean up gcc command lines a little - -Signed-off-by: Peter Jones ---- - Make.defaults | 9 ++++----- - 1 file changed, 4 insertions(+), 5 deletions(-) - -diff --git a/Make.defaults b/Make.defaults -index 39b78f0..b6c0381 100644 ---- a/Make.defaults -+++ b/Make.defaults -@@ -20,8 +20,7 @@ CROSS_COMPILE ?= $(bindir) - PKG_CONFIG = $(CROSS_COMPILE)pkg-config - CC := $(if $(filter default,$(origin CC)),$(CROSS_COMPILE)gcc,$(CC)) - CCLD := $(if $(filter undefined,$(origin CCLD)),$(CC),$(CCLD)) --CFLAGS ?= -O0 -g3 -fvar-tracking -fvar-tracking-assignments \ -- -Wall -Werror -Wextra -Wno-error=cpp -+CFLAGS ?= -O0 -g3 -fvar-tracking -fvar-tracking-assignments -Wno-error=cpp - AS := $(CROSS_COMPILE)as - AR := $(CROSS_COMPILE)gcc-ar - RANLIB := $(CROSS_COMPILE)gcc-ranlib -@@ -36,10 +35,10 @@ ARCH := $(shell uname -m | sed s,i[3456789]86,ia32,) - - SOFLAGS = -shared - clang_cflags = --gcc_cflags = -Wmaybe-uninitialized -+gcc_cflags = -Wmaybe-uninitialized -grecord-gcc-switches - cflags = $(CFLAGS) $(ARCH3264) \ -- -Wall -Werror -Wno-cpp -Wsign-compare -Wno-unused-result \ -- -Wno-unused-function\ -+ -Wall -Werror -Wextra -Wsign-compare -Wno-unused-result \ -+ -Wno-unused-function -Wsign-compare \ - -std=gnu11 -fshort-wchar -fPIC -flto -fno-strict-aliasing \ - -fno-merge-constants -fkeep-inline-functions \ - -D_GNU_SOURCE -DCONFIG_$(ARCH) -I${TOPDIR}/include \ --- -2.13.4 - diff --git a/0027-Make-pesign-users-groups-static-in-the-repo.patch b/0027-Make-pesign-users-groups-static-in-the-repo.patch deleted file mode 100644 index 4131de3..0000000 --- a/0027-Make-pesign-users-groups-static-in-the-repo.patch +++ /dev/null @@ -1,54 +0,0 @@ -From a133d051c3f8acf3e058e92711eb528c3c0f41f9 Mon Sep 17 00:00:00 2001 -From: Peter Jones -Date: Thu, 10 Aug 2017 10:03:37 -0400 -Subject: [PATCH 27/29] Make pesign-{users,groups} static in the repo. - -Signed-off-by: Peter Jones ---- - src/Makefile | 5 +---- - src/pesign-groups | 1 + - src/pesign-users | 1 + - 3 files changed, 3 insertions(+), 4 deletions(-) - create mode 100644 src/pesign-groups - create mode 100644 src/pesign-users - -diff --git a/src/Makefile b/src/Makefile -index 84ad130..7d68fa1 100644 ---- a/src/Makefile -+++ b/src/Makefile -@@ -7,7 +7,7 @@ include $(TOPDIR)/Make.defaults - - BINTARGETS=authvar client efikeygen efisiglist pesigcheck pesign - SVCTARGETS=pesign.sysvinit pesign.service --TARGETS=$(BINTARGETS) $(SVCTARGETS) pesign-users pesign-groups -+TARGETS=$(BINTARGETS) $(SVCTARGETS) - - all : deps $(TARGETS) - -@@ -65,9 +65,6 @@ install_sysvinit: pesign.sysvinit - $(INSTALL) -d -m 755 $(INSTALLROOT)/etc/rc.d/init.d/ - $(INSTALL) -m 755 pesign.sysvinit $(INSTALLROOT)/etc/rc.d/init.d/pesign - --pesign-users pesign-groups : -- echo pesign > $@ -- - install : - $(INSTALL) -d -m 700 $(INSTALLROOT)/etc/pki/pesign/ - $(INSTALL) -d -m 700 $(INSTALLROOT)/etc/pki/pesign-rh-test/ -diff --git a/src/pesign-groups b/src/pesign-groups -new file mode 100644 -index 0000000..7f57cc5 ---- /dev/null -+++ b/src/pesign-groups -@@ -0,0 +1 @@ -+pesign -diff --git a/src/pesign-users b/src/pesign-users -new file mode 100644 -index 0000000..7f57cc5 ---- /dev/null -+++ b/src/pesign-users -@@ -0,0 +1 @@ -+pesign --- -2.13.4 - diff --git a/0028-rpm-Make-the-client-signer-use-the-fedora-values-unl.patch b/0028-rpm-Make-the-client-signer-use-the-fedora-values-unl.patch deleted file mode 100644 index 793fe6c..0000000 --- a/0028-rpm-Make-the-client-signer-use-the-fedora-values-unl.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 025eb8aea94761fdc45507b6192aafdef80d4842 Mon Sep 17 00:00:00 2001 -From: Peter Jones -Date: Wed, 9 Aug 2017 17:31:31 -0400 -Subject: [PATCH 28/29] rpm: Make the client signer use the fedora values - unless overridden - -Signed-off-by: Peter Jones ---- - src/macros.pesign | 9 ++++++--- - 1 file changed, 6 insertions(+), 3 deletions(-) - -diff --git a/src/macros.pesign b/src/macros.pesign -index 69280e9..22a3ee6 100644 ---- a/src/macros.pesign -+++ b/src/macros.pesign -@@ -9,6 +9,9 @@ - %__pesign_token %{nil}%{?pe_signing_token:-t "%{pe_signing_token}"} - %__pesign_cert %{!?pe_signing_cert:"Red Hat Test Certificate"}%{?pe_signing_cert:"%{pe_signing_cert}"} - -+%__pesign_client_token %{!?pe_signing_token:"OpenSC Card (Fedora Signer)"}%{?pe_signing_token:"%{pe_signing_token}"} -+%__pesign_client_cert %{!?pe_signing_cert:"/CN=Fedora Secure Boot Signer"}%{?pe_signing_cert:"%{pe_signing_cert}"} -+ - %_pesign /usr/bin/pesign - %_pesign_client /usr/bin/pesign-client - -@@ -41,11 +44,11 @@ - --certdir ${nss} -c signer %{-o} \ - rm -rf ${sattrs} ${sattrs}.sig ${nss} \ - elif [ -S /var/run/pesign/socket ]; then \ -- %{_pesign_client} -t %{__pesign_token} \\\ -- -c %{__pesign_cert} \\\ -+ %{_pesign_client} -t %{__pesign_client_token} \\\ -+ -c %{__pesign_client_cert} \\\ - %{-i} %{-o} %{-e} %{-s} %{-C} \ - else \ -- %{_pesign} -t %{__pesign_token} -c %{__pesign_cert} \\\ -+ %{_pesign} %{__pesign_token} -c %{__pesign_cert} \\\ - --certdir ${_pesign_nssdir} \\\ - %{-i} %{-o} %{-e} %{-s} %{-C} \ - fi \ --- -2.13.4 - diff --git a/0029-Make-macros.pesign-error-in-kojibuilder-if-we-don-t-.patch b/0029-Make-macros.pesign-error-in-kojibuilder-if-we-don-t-.patch deleted file mode 100644 index 753afe8..0000000 --- a/0029-Make-macros.pesign-error-in-kojibuilder-if-we-don-t-.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 86a6b02e4b95ab3629446e71895cc5e57ad4482f Mon Sep 17 00:00:00 2001 -From: Peter Jones -Date: Mon, 14 Aug 2017 11:37:43 -0400 -Subject: [PATCH 29/29] Make macros.pesign error in kojibuilder if we don't - have perms on the socket - ---- - src/macros.pesign | 9 +++++++++ - 1 file changed, 9 insertions(+) - -diff --git a/src/macros.pesign b/src/macros.pesign -index 22a3ee6..1665b4c 100644 ---- a/src/macros.pesign -+++ b/src/macros.pesign -@@ -43,6 +43,21 @@ - %{_pesign} -R ${sattrs}.sig -I ${sattrs} %{-i} \\\ - --certdir ${nss} -c signer %{-o} \ - rm -rf ${sattrs} ${sattrs}.sig ${nss} \ -+ elif [ "%{vendor}" == "Fedora Project" -a \\\ -+ "$(id -un)" == "mockbuild" -a \\\ -+ "$(uname -m)" == "x86_64" ] && \\\ -+ grep -q ID=fedora /etc/os-release && \\\ -+ [[ "%{_buildhost}" =~ ^bkernel.* ]] && \\\ -+ ! [ -S /var/run/pesign/socket ]; then \ -+ echo "No socket even though this is %{_buildhost}" \ -+ ls -ld /var/run/pesign || : \ -+ getfacl /var/run/pesign || : \ -+ ls -l /var/run/pesign/socket || : \ -+ getfacl /var/run/pesign/socket || : \ -+ echo =========== env ============== \ -+ set \ -+ echo =========== env ============== \ -+ exit 1 \ - elif [ -S /var/run/pesign/socket ]; then \ - %{_pesign_client} -t %{__pesign_client_token} \\\ - -c %{__pesign_client_cert} \\\ --- -2.13.4 - diff --git a/pesign.spec b/pesign.spec index 4a74aa2..6e94898 100644 --- a/pesign.spec +++ b/pesign.spec @@ -2,8 +2,8 @@ Name: pesign Summary: Signing utility for UEFI binaries -Version: 0.112 -Release: 29%{?dist} +Version: 113 +Release: 10%{?dist} License: GPLv2 URL: https://github.com/vathpela/pesign @@ -28,6 +28,7 @@ BuildRequires: systemd-rpm-macros %endif Requires: nspr Requires: nss +Requires: nss-tools >= 3.53 Requires: nss-util Requires: popt Requires: rpm @@ -37,41 +38,22 @@ ExclusiveArch: %{ix86} x86_64 ia64 aarch64 %{arm} BuildRequires: rh-signing-tools >= 1.20-2 %endif -Source0: https://github.com/vathpela/pesign/releases/download/%{version}/pesign-%{version}.tar.bz2 +Source0: https://github.com/rhboot/pesign/releases/download/%{version}/pesign-%{version}.tar.bz2 Source1: certs.tar.xz Source2: pesign.py -Patch0001: 0001-cms-kill-generate_integer-it-doesn-t-build-on-i686-a.patch -Patch0002: 0002-Fix-command-line-parsing.patch -Patch0003: 0003-gcc-don-t-error-on-stuff-in-includes.patch -Patch0004: 0004-Fix-certficate-argument-name.patch -Patch0005: 0005-Fix-description-of-ascii-armor-option-in-manpage.patch -Patch0006: 0006-Make-ascii-work-since-we-documented-it.patch -Patch0007: 0007-Switch-pesign-client-to-also-accept-token-cert-macro.patch -Patch0008: 0008-pesigcheck-Verify-with-the-cert-as-an-object-signer.patch -Patch0009: 0009-pesigcheck-make-certfile-actually-work.patch -Patch0010: 0010-signerInfos-make-sure-err-is-always-initialized.patch -Patch0011: 0011-pesign-make-pesign-h-tell-you-the-file-name.patch -Patch0012: 0012-Add-coverity-build-scripts.patch -Patch0013: 0013-Document-implicit-fallthrough.patch -Patch0014: 0014-Actually-setfacl-each-directory-of-our-key-storage.patch -Patch0015: 0015-oid-add-SHIM_EKU_MODULE_SIGNING_ONLY-and-fix-our-arr.patch -Patch0016: 0016-efikeygen-add-modsign.patch -Patch0017: 0017-check_cert_db-try-even-harder-to-pick-a-reasonable-v.patch -Patch0018: 0018-show-which-db-we-re-checking.patch -Patch0019: 0019-more-about-the-time.patch -Patch0020: 0020-try-to-say-why-something-fails.patch -Patch0021: 0021-Fix-race-condition-in-SEC_GetPassword.patch -Patch0022: 0022-sysvinit-Create-the-socket-directory-at-runtime.patch -Patch0023: 0023-Better-authorization-scripts.-Again.patch -Patch0024: 0024-Make-the-daemon-also-try-to-give-better-errors-on-EP.patch -Patch0025: 0025-certdb-fix-PRTime-printfs-for-i686.patch -Patch0026: 0026-Clean-up-gcc-command-lines-a-little.patch -Patch0027: 0027-Make-pesign-users-groups-static-in-the-repo.patch -Patch0028: 0028-rpm-Make-the-client-signer-use-the-fedora-values-unl.patch -Patch0029: 0029-Make-macros.pesign-error-in-kojibuilder-if-we-don-t-.patch -Patch0030: 0030-efikeygen-Fix-the-build-with-nss-3.44.patch -Patch0031: 0031-pesigcheck-Fix-a-wrong-assignment.patch +Patch0001: 0001-efikeygen-Fix-the-build-with-nss-3.44.patch +Patch0002: 0002-pesigcheck-Fix-a-wrong-assignment.patch +Patch0003: 0003-Make-0.112-client-and-server-work-with-the-113-proto.patch +Patch0004: 0004-Rename-var-run-to-run.patch +Patch0005: 0005-Apparently-opensc-got-updated-and-the-token-name-cha.patch +Patch0006: 0006-client-try-run-and-var-run-for-the-socket-path.patch +Patch0007: 0007-client-remove-an-extra-debug-print.patch +Patch0008: 0008-Move-most-of-macros.pesign-to-pesign-rpmbuild-helper.patch +Patch0009: 0009-pesign-authorize-shellcheck.patch +Patch0010: 0010-pesign-authorize-don-t-setfacl-etc-pki-pesign-foo.patch +Patch0011: 0011-kernel-building-hack.patch +Patch0012: 0012-Use-run-not-var-run.patch %description This package contains the pesign utility for signing UEFI binaries as @@ -89,9 +71,6 @@ git am %{patches} /dev/null || groupadd -r pesign getent passwd pesign >/dev/null || \ - useradd -r -g pesign -d /var/run/pesign -s /sbin/nologin \ + useradd -r -g pesign -d /run/pesign -s /sbin/nologin \ -c "Group for the pesign signing daemon" pesign exit 0 @@ -137,14 +116,21 @@ exit 0 %post %systemd_post pesign.service -#%%posttrans -#%%{_libexecdir}/pesign/pesign-authorize - %preun %systemd_preun pesign.service %postun %systemd_postun_with_restart pesign.service + +%posttrans +certutil -d %{_sysconfdir}/pki/pesign/ -X -L > /dev/null + +# this is disabled currently because it breaks the fedora kernel build root +# generation - because we don't currently have a good way of populating +# /etc/pesign/{users,groups} before the buildroot is installed, or +# populating them and re-running pesign-authorize afterwards but before the +# package build of e.g. kernel +#%%{_libexecdir}/pesign/pesign-authorize %endif %files @@ -163,6 +149,7 @@ exit 0 %dir %attr(0775,pesign,pesign) %{_sysconfdir}/pki/pesign-rh-test/ %config(noreplace) %attr(0664,pesign,pesign) %{_sysconfdir}/pki/pesign-rh-test/* %{_libexecdir}/pesign/pesign-authorize +%{_libexecdir}/pesign/pesign-rpmbuild-helper %config(noreplace)/%{_sysconfdir}/pesign/users %config(noreplace)/%{_sysconfdir}/pesign/groups %{_sysconfdir}/popt.d/pesign.popt @@ -179,6 +166,9 @@ exit 0 %{python3_sitelib}/mockbuild/plugins/pesign.* %changelog +* Thu Jul 16 2020 Peter Jones - 113-10 +- Synchronize with master + * Tue Feb 18 2020 Peter Jones - 0.112-29 - Rebuild to match OpenSC's token name mangling change. diff --git a/sources b/sources index c2671ea..d0199f7 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -e377e0bc924287ee09356a239c5f51a8 certs.tar.xz -eae1d66e160be744ff310ad7592ae31e pesign-0.112.tar.bz2 +SHA512 (certs.tar.xz) = ddac535c786d1a23074534323c4ce89f907d4f82b19c5d3a9c814b145fbac1599cd2386cf20c28d22aee7d5c4db441f052bab9ee655de756117a0a0bc99b525f +SHA512 (pesign-113.tar.bz2) = 89c5e33bf6ac8f8dc4b65192e5fd4bf1fea285106d1de2a6ea02a8c5090f2ec5976b1d80c60e57f74fa56dc25b174a4dd5682292db44ab9aeab69ea992dfef36 From 9438e254863963796c3377b57eff3028ebe55d90 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Thu, 16 Jul 2020 19:26:02 -0400 Subject: [PATCH 7/8] fix rundir in files Signed-off-by: Peter Jones --- pesign.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pesign.spec b/pesign.spec index 6e94898..5cd2b91 100644 --- a/pesign.spec +++ b/pesign.spec @@ -155,9 +155,9 @@ certutil -d %{_sysconfdir}/pki/pesign/ -X -L > /dev/null %{_sysconfdir}/popt.d/pesign.popt %{macrosdir}/macros.pesign %{_mandir}/man*/* -%dir %attr(0770, pesign, pesign) %{_localstatedir}/run/%{name} -%ghost %attr(0660, -, -) %{_localstatedir}/run/%{name}/socket -%ghost %attr(0660, -, -) %{_localstatedir}/run/%{name}/pesign.pid +%dir %attr(0770, pesign, pesign) %{_rundir}/%{name} +%ghost %attr(0660, -, -) %{_rundir}/%{name}/socket +%ghost %attr(0660, -, -) %{_rundir}/%{name}/pesign.pid %if 0%{?rhel} >= 7 || 0%{?fedora} >= 17 %{_tmpfilesdir}/pesign.conf %{_unitdir}/pesign.service From ce7756bd8d101ae9896d3de10c9979e3285e1ec2 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Mon, 3 Aug 2020 16:45:41 -0400 Subject: [PATCH 8/8] syncrhonize with f32/master Signed-off-by: Peter Jones --- ...cros.pesign-to-pesign-rpmbuild-helper.patch | 18 +++++++----------- pesign.spec | 8 +++++++- 2 files changed, 14 insertions(+), 12 deletions(-) diff --git a/0008-Move-most-of-macros.pesign-to-pesign-rpmbuild-helper.patch b/0008-Move-most-of-macros.pesign-to-pesign-rpmbuild-helper.patch index 0a96bdb..3a62cf6 100644 --- a/0008-Move-most-of-macros.pesign-to-pesign-rpmbuild-helper.patch +++ b/0008-Move-most-of-macros.pesign-to-pesign-rpmbuild-helper.patch @@ -1,15 +1,15 @@ -From e05840efa8dc9d0a9ff3104b9fa6e5736e0ec549 Mon Sep 17 00:00:00 2001 +From 6c16b978fd33f3611e9f7aaf4f9c44bce1679485 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Mon, 6 Jul 2020 13:54:35 -0400 -Subject: [PATCH 08/11] Move most of macros.pesign to pesign-rpmbuild-helper +Subject: [PATCH] Move most of macros.pesign to pesign-rpmbuild-helper Signed-off-by: Peter Jones --- Make.defaults | 1 + src/Makefile | 8 +- - src/macros.pesign | 76 ++++-------- + src/macros.pesign | 74 ++++-------- src/pesign-rpmbuild-helper.in | 222 ++++++++++++++++++++++++++++++++++ - 4 files changed, 253 insertions(+), 54 deletions(-) + 4 files changed, 252 insertions(+), 53 deletions(-) create mode 100644 src/pesign-rpmbuild-helper.in diff --git a/Make.defaults b/Make.defaults @@ -58,10 +58,10 @@ index 74327ba13f3..a7ca89159c6 100644 $(INSTALL) -m 600 pesign-users $(INSTALLROOT)/etc/pesign/users $(INSTALL) -m 600 pesign-groups $(INSTALLROOT)/etc/pesign/groups diff --git a/src/macros.pesign b/src/macros.pesign -index 5a6da1c6809..cb066b35f4a 100644 +index 5a6da1c6809..2e984b4eeb3 100644 --- a/src/macros.pesign +++ b/src/macros.pesign -@@ -6,11 +6,11 @@ +@@ -6,7 +6,7 @@ # %pesign -s -i shim.orig -o shim.efi # And magically get the right thing. @@ -70,10 +70,6 @@ index 5a6da1c6809..cb066b35f4a 100644 %__pesign_cert %{!?pe_signing_cert:"Red Hat Test Certificate"}%{?pe_signing_cert:"%{pe_signing_cert}"} %__pesign_client_token %{!?pe_signing_token:"OpenSC Card (Fedora Signer)"}%{?pe_signing_token:"%{pe_signing_token}"} - %__pesign_client_cert %{!?pe_signing_cert:"/CN=Fedora Secure Boot Signer"}%{?pe_signing_cert:"%{pe_signing_cert}"} - - %_pesign /usr/bin/pesign - %_pesign_client /usr/bin/pesign-client @@ -24,54 +24,24 @@ # -a # rhel only # -s # perform signing @@ -140,7 +136,7 @@ index 5a6da1c6809..cb066b35f4a 100644 + %{?_buildhost:--hostname "%{_buildhost}"} \\\ + %{?vendor:--vendor "%{vendor}"} \\\ + %{?_rhel:--rhelver "%{_rhel}"} \\\ -+ %{?-n:--rhelcert "%{-n*}"}%{?!-n:--rhelcert "%{__pesign_cert}"} \\\ ++ %{?-n:--rhelcert %{-n*}}%{?!-n:--rhelcert %{__pesign_cert}} \\\ + %{?-a:--rhelcafile "%{-a*}"} \\\ + %{?-c:--rhelcertfile "%{-c*}"} \\\ + %{?-C:--certout "%{-C*}"} \\\ diff --git a/pesign.spec b/pesign.spec index 5cd2b91..b7be57e 100644 --- a/pesign.spec +++ b/pesign.spec @@ -3,7 +3,7 @@ Name: pesign Summary: Signing utility for UEFI binaries Version: 113 -Release: 10%{?dist} +Release: 12%{?dist} License: GPLv2 URL: https://github.com/vathpela/pesign @@ -166,6 +166,12 @@ certutil -d %{_sysconfdir}/pki/pesign/ -X -L > /dev/null %{python3_sitelib}/mockbuild/plugins/pesign.* %changelog +* Mon Aug 03 2020 Peter Jones - 113-12 +- Try to make kernel and fwupd both work at the same time. + +* Tue Jul 28 2020 Fedora Release Engineering - 113-11 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + * Thu Jul 16 2020 Peter Jones - 113-10 - Synchronize with master