diff --git a/0001-cms_common-Fixed-Segmentation-fault.patch b/0001-cms_common-Fixed-Segmentation-fault.patch deleted file mode 100644 index 4464ed0..0000000 --- a/0001-cms_common-Fixed-Segmentation-fault.patch +++ /dev/null @@ -1,27 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Nicolas Frayer -Date: Mon, 20 Feb 2023 15:26:20 +0100 -Subject: [PATCH] cms_common: Fixed Segmentation fault - -When running efikeygen, the binary crashes with a segfault due -to dereferencing a **ptr instead of a *ptr. - -Signed-off-by: Nicolas Frayer -(cherry picked from commit 227435af461f38fc4abeafe02884675ad4b1feb4) ---- - src/cms_common.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/cms_common.c b/src/cms_common.c -index 24576f2..89d946a 100644 ---- a/src/cms_common.c -+++ b/src/cms_common.c -@@ -956,7 +956,7 @@ find_certificate_by_issuer_and_sn(cms_context *cms, - if (!ias) - cnreterr(-1, cms, "invalid issuer and serial number"); - -- return find_certificate_by_callback(cms, match_issuer_and_serial, &ias, cert); -+ return find_certificate_by_callback(cms, match_issuer_and_serial, ias, cert); - } - - int diff --git a/0001-efikeygen-Fix-the-build-with-nss-3.44.patch b/0001-efikeygen-Fix-the-build-with-nss-3.44.patch new file mode 100644 index 0000000..d9dd6d8 --- /dev/null +++ b/0001-efikeygen-Fix-the-build-with-nss-3.44.patch @@ -0,0 +1,42 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Tue, 14 May 2019 11:28:38 -0400 +Subject: [PATCH] efikeygen: Fix the build with nss 3.44 + +NSS 3.44 adds some certificate types, which changes a type and makes +some encoding stuff weird. As a result, we get: + +gcc8 -I/wrkdirs/usr/ports/sysutils/pesign/work/pesign-0.110/include -O2 -pipe -fstack-protector-strong -Wl,-rpath=/usr/local/lib/gcc8 -isystem /usr/local/include -fno-strict-aliasing -g -O0 -g -O0 -Wall -fshort-wchar -fno-strict-aliasing -fno-merge-constants --std=gnu99 -D_GNU_SOURCE -Wno-unused-result -Wno-unused-function -I../include/ -I/usr/local/include/nss -I/usr/local/include/nss/nss -I/usr/local/include/nspr -Werror -fPIC -isystem /usr/local/include -DCONFIG_amd64 -DCONFIG_amd64 -c efikeygen.c -o efikeygen.o +In file included from /usr/local/include/nss/nss/cert.h:22, + from efikeygen.c:39: +efikeygen.c: In function 'add_cert_type': +/usr/local/include/nss/nss/certt.h:445:5: error: unsigned conversion from 'int' to 'unsigned char' changes value from '496' to '240' [-Werror=overflow] + (NS_CERT_TYPE_SSL_CLIENT | NS_CERT_TYPE_SSL_SERVER | NS_CERT_TYPE_EMAIL | \ + ^ +efikeygen.c:208:23: note: in expansion of macro 'NS_CERT_TYPE_APP' + unsigned char type = NS_CERT_TYPE_APP; + ^~~~~~~~~~~~~~~~ +cc1: all warnings being treated as errors + +This is fixed by just making it an int. + +Fixes github issue #48. + +Signed-off-by: Peter Jones +--- + src/efikeygen.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/efikeygen.c b/src/efikeygen.c +index 121a238..848480a 100644 +--- a/src/efikeygen.c ++++ b/src/efikeygen.c +@@ -208,7 +208,7 @@ static int + add_cert_type(cms_context *cms, void *extHandle, int is_ca) + { + SECItem bitStringValue; +- unsigned char type = NS_CERT_TYPE_APP; ++ int type = NS_CERT_TYPE_APP; + + if (is_ca) + type |= NS_CERT_TYPE_SSL_CA | diff --git a/0002-Fix-reversed-calloc-arguments.patch b/0002-Fix-reversed-calloc-arguments.patch deleted file mode 100644 index 861993c..0000000 --- a/0002-Fix-reversed-calloc-arguments.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 1f9e2fa0b4d872fdd01ca3ba81b04dfb1211a187 Mon Sep 17 00:00:00 2001 -From: Stephen Gallagher -Date: Fri, 2 Feb 2024 09:32:48 -0500 -Subject: [PATCH] Fix reversed calloc() arguments - -The prototype is "void *calloc(size_t nelem, size_t elsize);" - -These two instances had them reversed, almost certainly leading to -buffer overflow issues. This was detected by --Werror=calloc-transposed-args on gcc. - -Signed-off-by: Stephen Gallagher ---- - src/pesigcheck.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/src/pesigcheck.c b/src/pesigcheck.c -index 6dc67f76a81..8119cf10a7b 100644 ---- a/src/pesigcheck.c -+++ b/src/pesigcheck.c -@@ -240,7 +240,7 @@ check_signature(pesigcheck_context *ctx, int *nreasons, - - cert_iter iter; - -- reasonps = calloc(sizeof(struct reason), 512); -+ reasonps = calloc(512, sizeof(struct reason)); - if (!reasonps) - err(1, "check_signature"); - -@@ -281,7 +281,7 @@ check_signature(pesigcheck_context *ctx, int *nreasons, - - num_reasons += 16; - -- new_reasons = calloc(sizeof(struct reason), num_reasons); -+ new_reasons = calloc(num_reasons, sizeof(struct reason)); - if (!new_reasons) - err(1, "check_signature"); - reasonps = new_reasons; --- -2.41.0 - diff --git a/0002-pesigcheck-Fix-a-wrong-assignment.patch b/0002-pesigcheck-Fix-a-wrong-assignment.patch new file mode 100644 index 0000000..d51a6d8 --- /dev/null +++ b/0002-pesigcheck-Fix-a-wrong-assignment.patch @@ -0,0 +1,46 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Tue, 18 Feb 2020 16:28:56 -0500 +Subject: [PATCH] pesigcheck: Fix a wrong assignment + +gcc says: + + pesigcheck.c: In function 'check_signature': + pesigcheck.c:321:17: error: implicit conversion from 'enum ' to 'enum ' [-Werror=enum-conversion] + 321 | reason->type = siBuffer; + | ^ + pesigcheck.c:333:17: error: implicit conversion from 'enum ' to 'enum ' [-Werror=enum-conversion] + 333 | reason->type = siBuffer; + | ^ + cc1: all warnings being treated as errors + +And indeed, that line of code makes no sense at all - it was supposed to +be reason->sig.type. + +Signed-off-by: Peter Jones +--- + src/pesigcheck.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/pesigcheck.c b/src/pesigcheck.c +index 524cce3..8fa0f1a 100644 +--- a/src/pesigcheck.c ++++ b/src/pesigcheck.c +@@ -318,7 +318,7 @@ check_signature(pesigcheck_context *ctx, int *nreasons, + reason->type = SIGNATURE; + reason->sig.data = data; + reason->sig.len = datalen; +- reason->type = siBuffer; ++ reason->sig.type = siBuffer; + nreason += 1; + is_invalid = true; + } +@@ -330,7 +330,7 @@ check_signature(pesigcheck_context *ctx, int *nreasons, + reason->type = SIGNATURE; + reason->sig.data = data; + reason->sig.len = datalen; +- reason->type = siBuffer; ++ reason->sig.type = siBuffer; + nreason += 1; + has_valid_cert = true; + } diff --git a/0003-Make-0.112-client-and-server-work-with-the-113-proto.patch b/0003-Make-0.112-client-and-server-work-with-the-113-proto.patch new file mode 100644 index 0000000..cb5dd57 --- /dev/null +++ b/0003-Make-0.112-client-and-server-work-with-the-113-proto.patch @@ -0,0 +1,314 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Thu, 11 Jun 2020 16:23:14 -0400 +Subject: [PATCH] Make 0.112 client and server work with the 113 protocol and + vise versa + +This makes the version of the sign API that takes a file type optional, +and makes the client attempt to negotiate which version it's getting. +It also leaves the server able to still handle the version from before +the file type was added. + +Signed-off-by: Peter Jones +--- + src/client.c | 74 +++++++++++++++++++++++++++++++++++++++++++----------------- + src/daemon.c | 63 ++++++++++++++++++++++++++++++++++----------------- + src/daemon.h | 2 ++ + 3 files changed, 97 insertions(+), 42 deletions(-) + +diff --git a/src/client.c b/src/client.c +index 4a9a44e..a4f1d1d 100644 +--- a/src/client.c ++++ b/src/client.c +@@ -23,6 +23,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -96,8 +97,8 @@ connect_to_server(void) + static int32_t + check_response(int sd, char **srvmsg); + +-static void +-check_cmd_version(int sd, uint32_t command, char *name, int32_t version) ++static int ++check_cmd_version(int sd, uint32_t command, char *name, int32_t version, bool do_exit) + { + struct msghdr msg; + struct iovec iov[1]; +@@ -116,7 +117,7 @@ check_cmd_version(int sd, uint32_t command, char *name, int32_t version) + ssize_t n; + n = sendmsg(sd, &msg, 0); + if (n < 0) { +- fprintf(stderr, "check-cmd-version: kill daemon failed: %m\n"); ++ fprintf(stderr, "check-cmd-version: sendmsg failed: %m\n"); + exit(1); + } + +@@ -132,11 +133,17 @@ check_cmd_version(int sd, uint32_t command, char *name, int32_t version) + + char *srvmsg = NULL; + int32_t rc = check_response(sd, &srvmsg); +- if (rc < 0) ++ ++ if (do_exit && rc < 0) + errx(1, "command \"%s\" not known by server", name); +- if (rc != version) ++ ++ if (do_exit && rc != version) + errx(1, "command \"%s\": client version %d, server version %d", + name, version, rc); ++ ++ if (rc < 0) ++ return rc; ++ return rc == version; + } + + static void +@@ -146,7 +153,7 @@ send_kill_daemon(int sd) + struct iovec iov; + pesignd_msghdr pm; + +- check_cmd_version(sd, CMD_KILL_DAEMON, "kill-daemon", 0); ++ check_cmd_version(sd, CMD_KILL_DAEMON, "kill-daemon", 0, true); + + pm.version = PESIGND_VERSION; + pm.command = CMD_KILL_DAEMON; +@@ -288,7 +295,7 @@ unlock_token(int sd, char *tokenname, char *pin) + + uint32_t size1 = pesignd_string_size(pin); + +- check_cmd_version(sd, CMD_UNLOCK_TOKEN, "unlock-token", 0); ++ check_cmd_version(sd, CMD_UNLOCK_TOKEN, "unlock-token", 0, true); + + pm.version = PESIGND_VERSION; + pm.command = CMD_UNLOCK_TOKEN; +@@ -365,7 +372,7 @@ is_token_unlocked(int sd, char *tokenname) + + uint32_t size0 = pesignd_string_size(tokenname); + +- check_cmd_version(sd, CMD_IS_TOKEN_UNLOCKED, "is-token-unlocked", 0); ++ check_cmd_version(sd, CMD_IS_TOKEN_UNLOCKED, "is-token-unlocked", 0, true); + + pm.version = PESIGND_VERSION; + pm.command = CMD_IS_TOKEN_UNLOCKED; +@@ -464,6 +471,9 @@ static void + sign(int sd, char *infile, char *outfile, char *tokenname, char *certname, + int attached, uint32_t format) + { ++ int rc; ++ bool add_file_type; ++ + int infd = open(infile, O_RDONLY); + if (infd < 0) { + fprintf(stderr, "pesign-client: could not open input file " +@@ -493,12 +503,28 @@ oom: + exit(1); + } + +- check_cmd_version(sd, attached ? CMD_SIGN_ATTACHED : CMD_SIGN_DETACHED, +- attached ? "sign-attached" : "sign-detached", 0); ++ rc = check_cmd_version(sd, ++ attached ? CMD_SIGN_ATTACHED_WITH_FILE_TYPE ++ : CMD_SIGN_DETACHED_WITH_FILE_TYPE, ++ attached ? "sign-attached" : "sign-detached", ++ 0, format == FORMAT_KERNEL_MODULE); ++ if (rc >= 0) { ++ add_file_type = true; ++ } else { ++ add_file_type = false; ++ check_cmd_version(sd, attached ? CMD_SIGN_ATTACHED ++ : CMD_SIGN_DETACHED, ++ attached ? "sign-attached" : "sign-detached", ++ 0, true); ++ } + ++ printf("add_file_type:%d\n", add_file_type); + pm->version = PESIGND_VERSION; +- pm->command = attached ? CMD_SIGN_ATTACHED : CMD_SIGN_DETACHED; +- pm->size = size0 + size1 + sizeof(format); ++ pm->command = attached ? (add_file_type ? CMD_SIGN_ATTACHED_WITH_FILE_TYPE ++ : CMD_SIGN_ATTACHED) ++ : (add_file_type ? CMD_SIGN_DETACHED_WITH_FILE_TYPE ++ : CMD_SIGN_DETACHED); ++ pm->size = size0 + size1 + (add_file_type ? sizeof(format) : 0); + iov[0].iov_base = pm; + iov[0].iov_len = sizeof (*pm); + +@@ -515,25 +541,31 @@ oom: + } + + char *buffer; +- buffer = malloc(size0 + size1); ++ buffer = malloc(pm->size); + if (!buffer) + goto oom; + +- iov[0].iov_base = &format; +- iov[0].iov_len = sizeof(format); ++ int pos = 0; ++ ++ if (add_file_type) { ++ iov[pos].iov_base = &format; ++ iov[pos].iov_len = sizeof(format); ++ pos++; ++ } + + pesignd_string *tn = (pesignd_string *)buffer; + pesignd_string_set(tn, tokenname); +- iov[1].iov_base = tn; +- iov[1].iov_len = size0; ++ iov[pos].iov_base = tn; ++ iov[pos].iov_len = size0; ++ pos++; + + pesignd_string *cn = pesignd_string_next(tn); + pesignd_string_set(cn, certname); +- iov[2].iov_base = cn; +- iov[2].iov_len = size1; ++ iov[pos].iov_base = cn; ++ iov[pos].iov_len = size1; + + msg.msg_iov = iov; +- msg.msg_iovlen = 3; ++ msg.msg_iovlen = add_file_type ? 3 : 2; + + n = sendmsg(sd, &msg, 0); + if (n < 0) { +@@ -547,7 +579,7 @@ oom: + send_fd(sd, outfd); + + char *srvmsg = NULL; +- int rc = check_response(sd, &srvmsg); ++ rc = check_response(sd, &srvmsg); + if (rc < 0) { + fprintf(stderr, "pesign-client: signing failed: \"%s\"\n", + srvmsg); +diff --git a/src/daemon.c b/src/daemon.c +index 84b9ebc..8522250 100644 +--- a/src/daemon.c ++++ b/src/daemon.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -569,7 +570,7 @@ out: + + static void + handle_signing(context *ctx, struct pollfd *pollfd, socklen_t size, +- int attached) ++ int attached, bool with_file_type) + { + struct msghdr msg; + struct iovec iov; +@@ -593,8 +594,12 @@ oom: + + n = recvmsg(pollfd->fd, &msg, MSG_WAITALL); + +- file_format = *((uint32_t *) buffer); +- n -= sizeof(uint32_t); ++ if (with_file_type) { ++ file_format = *((uint32_t *) buffer); ++ n -= sizeof(uint32_t); ++ } else { ++ file_format = FORMAT_PE_BINARY; ++ } + + pesignd_string *tn = (pesignd_string *)(buffer + sizeof(uint32_t)); + if (n < (long long)sizeof(tn->size)) { +@@ -674,34 +679,44 @@ finish: + teardown_digests(ctx->cms); + } + ++static inline void ++handle_sign_helper(context *ctx, struct pollfd *pollfd, socklen_t size, ++ int attached, bool with_file_type) ++{ ++ int rc = cms_context_alloc(&ctx->cms); ++ if (rc < 0) ++ return; ++ ++ steal_from_cms(ctx->backup_cms, ctx->cms); ++ ++ handle_signing(ctx, pollfd, size, attached, with_file_type); ++ ++ hide_stolen_goods_from_cms(ctx->cms, ctx->backup_cms); ++ cms_context_fini(ctx->cms); ++} ++ + static void + handle_sign_attached(context *ctx, struct pollfd *pollfd, socklen_t size) + { +- int rc = cms_context_alloc(&ctx->cms); +- if (rc < 0) +- return; ++ handle_sign_helper(ctx, pollfd, size, 1, false); ++} + +- steal_from_cms(ctx->backup_cms, ctx->cms); +- +- handle_signing(ctx, pollfd, size, 1); +- +- hide_stolen_goods_from_cms(ctx->cms, ctx->backup_cms); +- cms_context_fini(ctx->cms); ++static void ++handle_sign_attached_with_file_type(context *ctx, struct pollfd *pollfd, socklen_t size) ++{ ++ handle_sign_helper(ctx, pollfd, size, 1, true); + } + + static void + handle_sign_detached(context *ctx, struct pollfd *pollfd, socklen_t size) + { +- int rc = cms_context_alloc(&ctx->cms); +- if (rc < 0) +- return; ++ handle_sign_helper(ctx, pollfd, size, 0, false); ++} + +- steal_from_cms(ctx->backup_cms, ctx->cms); +- +- handle_signing(ctx, pollfd, size, 0); +- +- hide_stolen_goods_from_cms(ctx->cms, ctx->backup_cms); +- cms_context_fini(ctx->cms); ++static void ++handle_sign_detached_with_file_type(context *ctx, struct pollfd *pollfd, socklen_t size) ++{ ++ handle_sign_helper(ctx, pollfd, size, 0, true); + } + + static void +@@ -733,6 +748,12 @@ cmd_table_t cmd_table[] = { + { CMD_UNLOCK_TOKEN, handle_unlock_token, "unlock-token", 0 }, + { CMD_SIGN_ATTACHED, handle_sign_attached, "sign-attached", 0 }, + { CMD_SIGN_DETACHED, handle_sign_detached, "sign-detached", 0 }, ++ { CMD_SIGN_ATTACHED_WITH_FILE_TYPE, ++ handle_sign_attached_with_file_type, ++ "sign-attached-with-file-type", 0 }, ++ { CMD_SIGN_DETACHED_WITH_FILE_TYPE, ++ handle_sign_detached_with_file_type, ++ "sign-detached-with-file-type", 0 }, + { CMD_RESPONSE, NULL, "response", 0 }, + { CMD_IS_TOKEN_UNLOCKED, handle_is_token_unlocked, + "is-token-unlocked", 0 }, +diff --git a/src/daemon.h b/src/daemon.h +index 69384ce..0368dc9 100644 +--- a/src/daemon.h ++++ b/src/daemon.h +@@ -45,6 +45,8 @@ typedef enum { + CMD_RESPONSE, + CMD_IS_TOKEN_UNLOCKED, + CMD_GET_CMD_VERSION, ++ CMD_SIGN_ATTACHED_WITH_FILE_TYPE, ++ CMD_SIGN_DETACHED_WITH_FILE_TYPE, + CMD_LIST_END + } pesignd_cmd; + diff --git a/0003-Work-around-OpenSC-changing-token-names-on-fedora-bu.patch b/0003-Work-around-OpenSC-changing-token-names-on-fedora-bu.patch deleted file mode 100644 index 663f4c4..0000000 --- a/0003-Work-around-OpenSC-changing-token-names-on-fedora-bu.patch +++ /dev/null @@ -1,61 +0,0 @@ -From dc17b1d248c705073a5160e7c871a52aa9ce6e99 Mon Sep 17 00:00:00 2001 -From: Peter Jones -Date: Thu, 21 Nov 2024 13:58:05 -0500 -Subject: [PATCH] Work around OpenSC changing token names on fedora builders - *again*. - -Once again OpenSC has changed how token names work in an incompatible -way, and we need to work around it even harder on the Fedora kernel -builders. - -Reviewed-by: Kevin Fenzi -Reviewed-by: Justin Forbes -Signed-off-by: Peter Jones ---- - src/macros.pesign | 3 ++- - src/pesign-rpmbuild-helper.in | 15 ++++++++++++++- - 2 files changed, 16 insertions(+), 2 deletions(-) - -diff --git a/src/macros.pesign b/src/macros.pesign -index b7d6af1f6f5..47e3f19f8ed 100644 ---- a/src/macros.pesign -+++ b/src/macros.pesign -@@ -9,7 +9,8 @@ - %__pesign_token %{nil}%{?pe_signing_token:--token "%{pe_signing_token}"} - %__pesign_cert %{!?pe_signing_cert:"Red Hat Test Certificate"}%{?pe_signing_cert:"%{pe_signing_cert}"} - --%__pesign_client_token %{!?pe_signing_token:"OpenSC Card (Fedora Signer)"}%{?pe_signing_token:"%{pe_signing_token}"} -+# See the comment in pesign-rpmbuild-helper.in about the token name here. -+%__pesign_client_token %{!?pe_signing_token:"OpenSC Card"}%{?pe_signing_token:"%{pe_signing_token}"} - %__pesign_client_cert %{!?pe_signing_cert:"/CN=Fedora Secure Boot Signer"}%{?pe_signing_cert:"%{pe_signing_cert}"} - - %_pesign /usr/bin/pesign -diff --git a/src/pesign-rpmbuild-helper.in b/src/pesign-rpmbuild-helper.in -index 30d5441207b..42de1a1e002 100644 ---- a/src/pesign-rpmbuild-helper.in -+++ b/src/pesign-rpmbuild-helper.in -@@ -214,7 +214,20 @@ main() { - rm -rf "${sattrs}" "${sattrs}.sig" "${nssdir}" - elif [[ -n "${socket}" ]] ; then - ### welcome haaaaack city -- if [[ "${client_token[1]}" = "OpenSC Card (Fedora Signer)" ]] ; then -+ ### different versions of the opensc library name the token different -+ ### things, and as of this commit: -+ ### https://github.com/OpenSC/OpenSC/commit/259decf656a77a6d1bd3e944d6f198ed70832ff5 -+ ### that includes just not including the token label unless there's -+ ### more than one token. Unfortunately this is both for the displayed -+ ### info and for the token name you specify to /use/ the token, so we -+ ### have to handle all of those options here, and change the name to -+ ### match whatever the current version of opensc is using in the rpm -+ ### macro where we're setting it. Thankfully this is just a "is this -+ ### Fedora" check for us, and if it's RHEL we're not using OpenSC at -+ ### all. -+ if [[ "${client_token[1]}" = "OpenSC Card (Fedora Signer)" ]] \ -+ || [[ "${client_token[1]}" = "Fedora Signer" ]] \ -+ || [[ "${client_token[1]}" = "OpenSC Card" ]] ; then - if [[ "${input[1]}" =~ (/|^)vmlinuz($|[_.-]) ]] \ - || [[ "${input[1]}" =~ (/|^)bzImage($|[_.-]) ]] ; then - if [[ "${rhelcertfile}" =~ redhatsecureboot501.* ]] \ --- -2.47.0 - diff --git a/0004-Rename-var-run-to-run.patch b/0004-Rename-var-run-to-run.patch new file mode 100644 index 0000000..70f3203 --- /dev/null +++ b/0004-Rename-var-run-to-run.patch @@ -0,0 +1,43 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Fri, 12 Jun 2020 11:49:44 -0400 +Subject: [PATCH] Rename /var/run/ to /run/ + +Signed-off-by: Peter Jones +--- + src/macros.pesign | 12 ++++++------ + src/tmpfiles.conf | 2 +- + 2 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/src/macros.pesign b/src/macros.pesign +index 7c5cba1..21bf391 100644 +--- a/src/macros.pesign ++++ b/src/macros.pesign +@@ -45,14 +45,14 @@ + rm -rf ${sattrs} ${sattrs}.sig ${nss} \ + elif [ "$(id -un)" == "kojibuilder" -a \\\ + grep -q ID=fedora /etc/os-release -a \\\ +- ! -S /var/run/pesign/socket ]; then \ ++ ! -S /run/pesign/socket ]; then \ + echo "No socket even though this is kojibuilder" 1>&2 \ +- ls -ld /var/run/pesign 1>&2 \ +- ls -l /var/run/pesign/socket 1>&2 \ +- getfacl /var/run/pesign 1>&2 \ +- getfacl /var/run/pesign/socket 1>&2 \ ++ ls -ld /run/pesign 1>&2 \ ++ ls -l /run/pesign/socket 1>&2 \ ++ getfacl /run/pesign 1>&2 \ ++ getfacl /run/pesign/socket 1>&2 \ + exit 1 \ +- elif [ -S /var/run/pesign/socket ]; then \ ++ elif [ -S /run/pesign/socket ]; then \ + %{_pesign_client} -t %{__pesign_client_token} \\\ + -c %{__pesign_client_cert} \\\ + %{-i} %{-o} %{-e} %{-s} %{-C} \ +diff --git a/src/tmpfiles.conf b/src/tmpfiles.conf +index c1cf355..3375ad5 100644 +--- a/src/tmpfiles.conf ++++ b/src/tmpfiles.conf +@@ -1 +1 @@ +-D /var/run/pesign 0770 pesign pesign - ++D /run/pesign 0770 pesign pesign - diff --git a/0004-cms_common-skip-authentication-on-the-Friendly-slot.patch b/0004-cms_common-skip-authentication-on-the-Friendly-slot.patch deleted file mode 100644 index d13e454..0000000 --- a/0004-cms_common-skip-authentication-on-the-Friendly-slot.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 616ec5f25adbde1a4bd78cdcacd6dcd7ecfa5a5c Mon Sep 17 00:00:00 2001 -From: Gary Lin -Date: Thu, 22 Dec 2022 13:49:34 +0800 -Subject: [PATCH] cms_common: skip authentication on the 'Friendly' slot - -When finding a certificate in a 'Friendly' slot without the need of the -private key, it is not necessary to authenticate the slot. - -For example, when the signed attributes and the raw signature are -created in a server and the user has the certificate, signkey.x509, and -tries to import them into myapp.efi: - - $ certutil -N -d nssdb -f passwd - $ certutil -A -d nssdb -f passwd -n signkey -t CT,CT,CT \ - -i signkey.x509 - $ pesign -n nssdb -c signkey -i myapp.efi -o myapp.efi.signed \ - -d sha256 -I myapp.sattr -R myapp.sig - -Since the "signkey" is 'Friendly', i.e. publicly readable, and the -private key is not needed, we can just skip the authentication and find -"signkey" in the slot. - -Signed-off-by: Gary Lin ---- - src/cms_common.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/src/cms_common.c b/src/cms_common.c -index cf572ca..44e5cca 100644 ---- a/src/cms_common.c -+++ b/src/cms_common.c -@@ -628,7 +628,8 @@ find_certificate(cms_context *cms, int needs_private_key) - - int errnum; - SECStatus status; -- if (PK11_NeedLogin(psle->slot) && !PK11_IsLoggedIn(psle->slot, cms)) { -+ if ((needs_private_key || !PK11_IsFriendly(psle->slot)) && -+ (PK11_NeedLogin(psle->slot) && !PK11_IsLoggedIn(psle->slot, cms))) { - status = PK11_Authenticate(psle->slot, PR_TRUE, cms); - if (status != SECSuccess) { - save_port_err() { diff --git a/0005-Add-const-qualifier-to-variable.patch b/0005-Add-const-qualifier-to-variable.patch deleted file mode 100644 index 20669f0..0000000 --- a/0005-Add-const-qualifier-to-variable.patch +++ /dev/null @@ -1,25 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Nicolas Frayer -Date: Mon, 22 Jun 2026 20:58:03 +0200 -Subject: [PATCH] Add const qualifier to variable - -Add const to a variable initialized with using strrchr. - -Signed-off-by: Nicolas Frayer ---- - src/pesum.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/pesum.c b/src/pesum.c -index e4ddaf86d7fa..5d7dcb929eec 100644 ---- a/src/pesum.c -+++ b/src/pesum.c -@@ -141,7 +141,7 @@ main(int argc, char *argv[]) - while ((infile = poptGetArg(optCon)) != NULL) { - pesign_context *ctxp = NULL; - -- char *ext = strrchr(infile, '.'); -+ const char *ext = strrchr(infile, '.'); - if (ext && strcmp(ext, ".ko") == 0) - fmt = FORMAT_KERNEL_MODULE; - diff --git a/0005-Apparently-opensc-got-updated-and-the-token-name-cha.patch b/0005-Apparently-opensc-got-updated-and-the-token-name-cha.patch new file mode 100644 index 0000000..b6c3998 --- /dev/null +++ b/0005-Apparently-opensc-got-updated-and-the-token-name-cha.patch @@ -0,0 +1,27 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Jeremy Cline +Date: Tue, 18 Feb 2020 16:37:53 -0500 +Subject: [PATCH] Apparently opensc got updated and the token name changed + +All the kernel builds started failing yesterday because the signing +token could not be found. Update the token name in the macro shipped by +pesign. + +Signed-off-by: Peter Jones +--- + src/macros.pesign | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/macros.pesign b/src/macros.pesign +index 21bf391..5a6da1c 100644 +--- a/src/macros.pesign ++++ b/src/macros.pesign +@@ -9,7 +9,7 @@ + %__pesign_token %{nil}%{?pe_signing_token:-t "%{pe_signing_token}"} + %__pesign_cert %{!?pe_signing_cert:"Red Hat Test Certificate"}%{?pe_signing_cert:"%{pe_signing_cert}"} + +-%__pesign_client_token %{!?pe_signing_token:"Fedora Signer (OpenSC Card)"}%{?pe_signing_token:"%{pe_signing_token}"} ++%__pesign_client_token %{!?pe_signing_token:"OpenSC Card (Fedora Signer)"}%{?pe_signing_token:"%{pe_signing_token}"} + %__pesign_client_cert %{!?pe_signing_cert:"/CN=Fedora Secure Boot Signer"}%{?pe_signing_cert:"%{pe_signing_cert}"} + + %_pesign /usr/bin/pesign diff --git a/0006-client-try-run-and-var-run-for-the-socket-path.patch b/0006-client-try-run-and-var-run-for-the-socket-path.patch new file mode 100644 index 0000000..f34bb57 --- /dev/null +++ b/0006-client-try-run-and-var-run-for-the-socket-path.patch @@ -0,0 +1,83 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Mon, 6 Jul 2020 16:13:09 -0400 +Subject: [PATCH] client: try /run and /var/run for the socket path. + +Signed-off-by: Peter Jones +--- + src/client.c | 40 +++++++++++++++++++++++++++++----------- + 1 file changed, 29 insertions(+), 11 deletions(-) + +diff --git a/src/client.c b/src/client.c +index a4f1d1d..0082be1 100644 +--- a/src/client.c ++++ b/src/client.c +@@ -61,24 +61,24 @@ print_flag_name(FILE *f, int flag) + } + + static int +-connect_to_server(void) ++connect_to_server_helper(const char * const sockpath) + { +- int rc = access(SOCKPATH, R_OK); ++ int rc = access(sockpath, R_OK); + if (rc != 0) { +- fprintf(stderr, "pesign-client: could not connect to server: " +- "%m\n"); +- exit(1); ++ warn("could not access socket \"%s\"", sockpath); ++ return rc; + } + + struct sockaddr_un addr_un = { + .sun_family = AF_UNIX, +- .sun_path = SOCKPATH, + }; ++ strncpy(addr_un.sun_path, sockpath, sizeof(addr_un.sun_path)); ++ addr_un.sun_path[sizeof(addr_un.sun_path)-1] = '\0'; + + int sd = socket(AF_UNIX, SOCK_STREAM, 0); + if (sd < 0) { +- fprintf(stderr, "pesign-client: could not open socket: %m\n"); +- exit(1); ++ warn("could not open socket \"%s\"", sockpath); ++ return sd; + } + + socklen_t len = strlen(addr_un.sun_path) + +@@ -86,14 +86,32 @@ connect_to_server(void) + + rc = connect(sd, (struct sockaddr *)&addr_un, len); + if (rc < 0) { +- fprintf(stderr, "pesign-client: could not connect to daemon: " +- "%m\n"); +- exit(1); ++ warn("could not connect to daemon"); ++ return sd; + } + + return sd; + } + ++static int ++connect_to_server(void) ++{ ++ int rc, i; ++ const char * const sockets[] = { ++ "/run/pesign/socket", ++ "/var/run/pesign/socket", ++ NULL ++ }; ++ ++ for (i = 0; sockets[i] != NULL; i++) { ++ rc = connect_to_server_helper(sockets[i]); ++ if (rc >= 0) ++ return rc; ++ } ++ ++ exit(1); ++} ++ + static int32_t + check_response(int sd, char **srvmsg); + diff --git a/0007-client-remove-an-extra-debug-print.patch b/0007-client-remove-an-extra-debug-print.patch new file mode 100644 index 0000000..47082c4 --- /dev/null +++ b/0007-client-remove-an-extra-debug-print.patch @@ -0,0 +1,22 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Tue, 14 Jul 2020 16:44:09 -0400 +Subject: [PATCH] client: remove an extra debug print + +Signed-off-by: Peter Jones +--- + src/client.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/src/client.c b/src/client.c +index 0082be1..c996629 100644 +--- a/src/client.c ++++ b/src/client.c +@@ -536,7 +536,6 @@ oom: + 0, true); + } + +- printf("add_file_type:%d\n", add_file_type); + pm->version = PESIGND_VERSION; + pm->command = attached ? (add_file_type ? CMD_SIGN_ATTACHED_WITH_FILE_TYPE + : CMD_SIGN_ATTACHED) diff --git a/0008-Move-most-of-macros.pesign-to-pesign-rpmbuild-helper.patch b/0008-Move-most-of-macros.pesign-to-pesign-rpmbuild-helper.patch new file mode 100644 index 0000000..73c2800 --- /dev/null +++ b/0008-Move-most-of-macros.pesign-to-pesign-rpmbuild-helper.patch @@ -0,0 +1,376 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Mon, 6 Jul 2020 13:54:35 -0400 +Subject: [PATCH] Move most of macros.pesign to pesign-rpmbuild-helper + +Signed-off-by: Peter Jones +--- + Make.defaults | 1 + + src/Makefile | 8 +- + src/macros.pesign | 74 +++++--------- + src/pesign-rpmbuild-helper.in | 222 ++++++++++++++++++++++++++++++++++++++++++ + 4 files changed, 252 insertions(+), 53 deletions(-) + create mode 100644 src/pesign-rpmbuild-helper.in + +diff --git a/Make.defaults b/Make.defaults +index 0bacafe..d4cd626 100644 +--- a/Make.defaults ++++ b/Make.defaults +@@ -16,6 +16,7 @@ INSTALLROOT = $(DESTDIR) + + INSTALL ?= install + CROSS_COMPILE ?= ++EFI_ARCHES ?= aa64 ia32 x64 + + PKG_CONFIG = $(CROSS_COMPILE)pkg-config + CC := $(if $(filter default,$(origin CC)),$(CROSS_COMPILE)gcc,$(CC)) +diff --git a/src/Makefile b/src/Makefile +index 74327ba..a7ca891 100644 +--- a/src/Makefile ++++ b/src/Makefile +@@ -5,7 +5,7 @@ include $(TOPDIR)/Make.version + include $(TOPDIR)/Make.rules + include $(TOPDIR)/Make.defaults + +-BINTARGETS=authvar client efikeygen efisiglist pesigcheck pesign ++BINTARGETS=authvar client efikeygen efisiglist pesigcheck pesign pesign-rpmbuild-helper + SVCTARGETS=pesign.sysvinit pesign.service + TARGETS=$(BINTARGETS) $(SVCTARGETS) + +@@ -49,6 +49,11 @@ pesign : $(call objects-of,$(PESIGN_SOURCES) $(COMMON_SOURCES) $(COMMON_PE_SOURC + pesign : LDLIBS+=$(TOPDIR)/libdpe/libdpe.a + pesign : PKGS=efivar nss nspr popt + ++pesign-rpmbuild-helper: pesign-rpmbuild-helper.in ++ sed \ ++ -e "s/@@EFI_ARCHES@@/$(EFI_ARCHES)/g" \ ++ $^ > $@ ++ + deps : PKGS=efivar nss nspr popt uuid + deps : $(ALL_SOURCES) + $(MAKE) -f $(TOPDIR)/Make.deps \ +@@ -94,6 +99,7 @@ install : + $(INSTALL) -m 644 macros.pesign $(INSTALLROOT)/etc/rpm/ + $(INSTALL) -d -m 755 $(INSTALLROOT)$(libexecdir)/pesign/ + $(INSTALL) -m 750 pesign-authorize $(INSTALLROOT)$(libexecdir)/pesign/ ++ $(INSTALL) -m 755 pesign-rpmbuild-helper $(INSTALLROOT)$(libexecdir)/pesign/ + $(INSTALL) -d -m 700 $(INSTALLROOT)/etc/pesign + $(INSTALL) -m 600 pesign-users $(INSTALLROOT)/etc/pesign/users + $(INSTALL) -m 600 pesign-groups $(INSTALLROOT)/etc/pesign/groups +diff --git a/src/macros.pesign b/src/macros.pesign +index 5a6da1c..34af57c 100644 +--- a/src/macros.pesign ++++ b/src/macros.pesign +@@ -6,7 +6,7 @@ + # %pesign -s -i shim.orig -o shim.efi + # And magically get the right thing. + +-%__pesign_token %{nil}%{?pe_signing_token:-t "%{pe_signing_token}"} ++%__pesign_token %{nil}%{?pe_signing_token:--token "%{pe_signing_token}"} + %__pesign_cert %{!?pe_signing_cert:"Red Hat Test Certificate"}%{?pe_signing_cert:"%{pe_signing_cert}"} + + %__pesign_client_token %{!?pe_signing_token:"OpenSC Card (Fedora Signer)"}%{?pe_signing_token:"%{pe_signing_token}"} +@@ -24,54 +24,24 @@ + # -a # rhel only + # -s # perform signing + %pesign(i:o:C:e:c:n:a:s) \ +- _pesign_nssdir=/etc/pki/pesign \ +- if [ %{__pesign_cert} = "Red Hat Test Certificate" ]; then \ +- _pesign_nssdir=/etc/pki/pesign-rh-test \ +- fi \ +- if [ -x %{_pesign} ] && \\\ +- [ "%{_target_cpu}" == "x86_64" -o \\\ +- "%{_target_cpu}" == "aarch64" ]; then \ +- if [ "0%{?rhel}" -ge "7" -a -f /usr/bin/rpm-sign ]; then \ +- nss=$(mktemp -p $PWD -d) \ +- echo > ${nss}/pwfile \ +- certutil -N -d ${nss} -f ${nss}/pwfile \ +- certutil -A -n "ca" -t "CT,C," -i %{-a*} -d ${nss} \ +- certutil -A -n "signer" -t ",c," -i %{-c*} -d ${nss} \ +- sattrs=$(mktemp -p $PWD --suffix=.der) \ +- %{_pesign} %{-i} -E ${sattrs} --certdir ${nss} --force \ +- rpm-sign --key "%{-n*}" --rsadgstsign ${sattrs} \ +- %{_pesign} -R ${sattrs}.sig -I ${sattrs} %{-i} \\\ +- --certdir ${nss} -c signer %{-o} \ +- rm -rf ${sattrs} ${sattrs}.sig ${nss} \ +- elif [ "$(id -un)" == "kojibuilder" -a \\\ +- grep -q ID=fedora /etc/os-release -a \\\ +- ! -S /run/pesign/socket ]; then \ +- echo "No socket even though this is kojibuilder" 1>&2 \ +- ls -ld /run/pesign 1>&2 \ +- ls -l /run/pesign/socket 1>&2 \ +- getfacl /run/pesign 1>&2 \ +- getfacl /run/pesign/socket 1>&2 \ +- exit 1 \ +- elif [ -S /run/pesign/socket ]; then \ +- %{_pesign_client} -t %{__pesign_client_token} \\\ +- -c %{__pesign_client_cert} \\\ +- %{-i} %{-o} %{-e} %{-s} %{-C} \ +- else \ +- %{_pesign} %{__pesign_token} -c %{__pesign_cert} \\\ +- --certdir ${_pesign_nssdir} \\\ +- %{-i} %{-o} %{-e} %{-s} %{-C} \ +- fi \ +- else \ +- if [ -n "%{-i*}" -a -n "%{-o*}" ]; then \ +- mv %{-i*} %{-o*} \ +- elif [ -n "%{-i*}" -a -n "%{-e*}" ]; then \ +- touch %{-e*} \ +- fi \ +- fi \ +- if [ ! -s %{-o} ]; then \ +- if [ -e "%{-o*}" ]; then \ +- rm -f %{-o*} \ +- fi \ +- exit 1 \ +- fi ; +- ++ %{_libexecdir}/pesign/pesign-rpmbuild-helper \\\ ++ "%{_target_cpu}" \\\ ++ "%{_pesign}" \\\ ++ "%{_pesign_client}" \\\ ++ %{?__pesign_client_token:--client-token %{__pesign_client_token}} \\\ ++ %{?__pesign_client_cert:--client-cert %{__pesign_client_cert}} \\\ ++ %{?__pesign_token:%{__pesign_token}} \\\ ++ %{?__pesign_cert:--cert %{__pesign_cert}} \\\ ++ %{?_buildhost:--hostname "%{_buildhost}"} \\\ ++ %{?vendor:--vendor "%{vendor}"} \\\ ++ %{?_rhel:--rhelver "%{_rhel}"} \\\ ++ %{?-n:--rhelcert %{-n*}}%{?!-n:--rhelcert %{__pesign_cert}} \\\ ++ %{?-a:--rhelcafile "%{-a*}"} \\\ ++ %{?-c:--rhelcertfile "%{-c*}"} \\\ ++ %{?-C:--certout "%{-C*}"} \\\ ++ %{?-e:--sattrout "%{-e*}"} \\\ ++ %{?-i:--in "%{-i*}"} \\\ ++ %{?-o:--out "%{-o*}"} \\\ ++ %{?-s:--sign} \\\ ++ ; \ ++%{nil} +diff --git a/src/pesign-rpmbuild-helper.in b/src/pesign-rpmbuild-helper.in +new file mode 100644 +index 0000000..c5287c2 +--- /dev/null ++++ b/src/pesign-rpmbuild-helper.in +@@ -0,0 +1,222 @@ ++#!/bin/bash ++# shellcheck shell=bash ++ ++set -eu ++set -x ++ ++usage() { ++ local status="${1}" && shift ++ local out ++ if [[ "${status}" -eq 0 ]] ; then ++ out=/dev/stdout ++ else ++ out=/dev/stderr ++ fi ++ ++ if [[ $# -gt 0 ]] ; then ++ echo "${0}: error: $*" >>"${out}" ++ fi ++ echo "usage: ${0} TARGET_CPU PESIGN_BINARY PESIGN_CLIENT_BINARY [OPTIONS]" >>"${out}" ++ exit "${status}" ++} ++ ++is_efi_arch() { ++ local arch="${1}" ++ local arches=(@@EFI_ARCHES@@) ++ local x ++ for x in "${arches[@]}" ; do ++ if [[ "${arch}" = "${x}" ]] ; then ++ return 0 ++ fi ++ done ++ return 1 ++} ++ ++error_on_empty() { ++ local f="${1}" ++ if [[ ! -s "${f}" ]] ; then ++ if [[ -e "${f}" ]] ; then ++ rm -f "${f}" ++ fi ++ echo "${0}: error: empty result file \"${f}\"">>/dev/stderr ++ exit 1 ++ fi ++} ++ ++main() { ++ if [[ $# -lt 3 ]] ; then ++ usage 1 not enough arguments ++ fi ++ local target_cpu="${1}" && shift ++ local bin="${1}" && shift ++ local client="${1}" && shift ++ ++ local rhelcafile="" || : ++ local rhelcertfile="" || : ++ ++ local certout=() || : ++ local sattrout=() || : ++ local input=() || : ++ local output=() || : ++ local client_token=() || : ++ local client_cert=() || : ++ local token=() || : ++ local cert=() || : ++ local rhelcert=() || : ++ local rhelver=0 || : ++ local sign="" || : ++ local arch="" || : ++ local vendor="" || : ++ local HOSTNAME="" || : ++ ++ while [[ $# -ge 2 ]] ; do ++ case " ${1} " in ++ " --rhelcafile ") ++ rhelcafile="${2}" ++ ;; ++ " --rhelcertfile ") ++ rhelcertfile="${2}" ++ ;; ++ " --hostname ") ++ HOSTNAME="${2}" ++ ;; ++ " --certout ") ++ certout[0]=-C ++ certout[1]="${2}" ++ ;; ++ " --sattrout ") ++ sattrout[0]=-e ++ sattrout[1]="${2}" ++ ;; ++ " --client-token ") ++ client_token[0]=-t ++ client_token[1]="${2}" ++ ;; ++ " --client-cert ") ++ client_cert[0]=-c ++ client_cert[1]="${2}" ++ ;; ++ " --token ") ++ token[0]=-t ++ token[1]="${2}" ++ ;; ++ " --cert ") ++ cert[0]=-c ++ cert[1]="${2}" ++ ;; ++ " --rhelcert ") ++ rhelcert[0]=-c ++ rhelcert[1]="${2}" ++ ;; ++ " --in ") ++ input[0]=-i ++ input[1]="${2}" ++ ;; ++ " --out ") ++ output[0]=-o ++ output[1]="${2}" ++ ;; ++ " --rhelver ") ++ rhelver="${2}" ++ ;; ++ " --vendor ") ++ vendor="${2}" ++ ;; ++ *) ++ break ++ ;; ++ esac ++ shift ++ shift ++ done ++ if [[ $# -ge 1 ]] && [[ "${1}" = --sign ]] ; then ++ sign=-s ++ shift ++ fi ++ ++ if [[ -z "${target_cpu}" ]] ; then ++ target_cpu="$(uname -m)" ++ fi ++ ++ target_cpu="${target_cpu/i?86/ia32}" ++ target_cpu="${target_cpu/x86_64/x64}" ++ target_cpu="${target_cpu/aarch64/aa64}" ++ target_cpu="${target_cpu/arm*/arm/}" ++ ++ local nssdir=/etc/pki/pesign ++ if [[ "${#cert[@]}" -eq 2 ]] && ++ [[ "${cert[1]}" == "Red Hat Test Certificate" ]] ; then ++ nssdir=/etc/pki/pesign-rh-test ++ fi ++ ++ # is_efi_arch is ultimately returning "is pesign configured to sign these ++ # using the rpm macro", so if it isn't, we're just copying the input to ++ # the output ++ if [[ -x "${bin}" ]] && ! is_efi_arch "${target_cpu}" ; then ++ if [[ -n "${input[*]}" ]] && [[ -n "${output[*]}" ]] ; then ++ cp -v "${input[1]}" "${output[1]}" ++ elif [[ -n "${input[*]}" ]] && [[ -n "${sattrout[*]}" ]] ; then ++ touch "${sattrout[1]}" ++ fi ++ ++ # if there's a 0-sized output file, delete it and error out ++ error_on_empty "${output[1]}" ++ return 0 ++ fi ++ ++ USERNAME="${USERNAME:-$(id -un)}" ++ ++ local socket="" || : ++ if grep -q ID=fedora /etc/os-release \ ++ && [[ "${rhelver}" -lt 7 ]] \ ++ && [[ "${USERNAME}" = "mockbuild" ]] \ ++ && [[ "${vendor}" = "Fedora Project" ]] \ ++ && [[ "${HOSTNAME}" =~ bkernel.* ]] ++ then ++ if [[ -S /run/pesign/socket ]] ; then ++ socket=/run/pesign/socket ++ elif [[ -S /var/run/pesign/socket ]]; then ++ socket=/var/run/pesign/socket ++ else ++ echo "Warning: no pesign socket even though user is ${USERNAME}" 1>&2 ++ echo "Warning: if this is a non-scratch koji build, this is wrong" 1>&2 ++ ls -ld /run/pesign /var/run/pesign 1>&2 ||: ++ ls -l /run/pesign/socket /var/run/pesign/socket 1>&2 ||: ++ getfacl /run/pesign /run/pesign/socket /var/run/pesign /var/run/pesign/socket 1>&2 ||: ++ getfacl -n /run/pesign /run/pesign/socket /var/run/pesign /var/run/pesign/socket 1>&2 ||: ++ fi ++ fi ++ ++ if [[ "${rhelver}" -ge 7 ]] ; then ++ nssdir="$(mktemp -p "${PWD}" -d)" ++ echo > "${nssdir}/pwfile" ++ certutil -N -d "${nssdir}" -f "${nssdir}/pwfile" ++ certutil -A -n "ca" -t "CTu,CTu,CTu" -i "${rhelcafile}" -d "${nssdir}" ++ certutil -A -n "signer" -t "CTu,CTu,CTu" -i "${rhelcertfile}" -d "${nssdir}" ++ sattrs="$(mktemp -p "${PWD}" --suffix=.der)" ++ "${bin}" -E "${sattrs}" --certdir "${nssdir}" \ ++ "${input[@]}" --force ++ rpm-sign --key "${rhelcert[1]}" --rsadgstsign "${sattrs}" ++ "${bin}" -R "${sattrs}.sig" -I "${sattrs}" \ ++ --certdir "${nssdir}" -c signer \ ++ "${input[@]}" "${output[@]}" ++ rm -rf "${sattrs}" "${sattrs}.sig" "${nssdir}" ++ elif [[ -n "${socket}" ]] ; then ++ "${client}" "${client_token[@]}" "${client_cert[@]}" \ ++ "${sattrout[@]}" "${certout[@]}" \ ++ ${sign} "${input[@]}" "${output[@]}" ++ else ++ "${bin}" --certdir "${nssdir}" "${token[@]}" \ ++ "${cert[@]}" ${sign} "${sattrout[@]}" \ ++ "${certout[@]}" "${input[@]}" "${output[@]}" ++ fi ++ ++ # if there's a 0-sized output file, delete it and error out ++ if [[ "${#output[@]}" -eq 2 ]] ; then ++ error_on_empty "${output[1]}" ++ fi ++} ++ ++main "${@}" ++ ++# vim:filetype=sh:fenc=utf-8:tw=78:sts=4:sw=4 diff --git a/0009-pesign-authorize-shellcheck.patch b/0009-pesign-authorize-shellcheck.patch new file mode 100644 index 0000000..6b674e7 --- /dev/null +++ b/0009-pesign-authorize-shellcheck.patch @@ -0,0 +1,57 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Tue, 14 Jul 2020 15:07:32 -0400 +Subject: [PATCH] pesign-authorize: shellcheck + +Signed-off-by: Peter Jones +--- + src/pesign-authorize | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/src/pesign-authorize b/src/pesign-authorize +index a496f60..55cd5c4 100755 +--- a/src/pesign-authorize ++++ b/src/pesign-authorize +@@ -12,21 +12,21 @@ set -u + # License: GPLv2 + declare -a fileusers=() + declare -a dirusers=() +-for user in $(cat /etc/pesign/users); do ++while read -r user ; do + dirusers[${#dirusers[@]}]=-m + dirusers[${#dirusers[@]}]="u:$user:rwx" + fileusers[${#fileusers[@]}]=-m + fileusers[${#fileusers[@]}]="u:$user:rw" +-done ++done +Date: Tue, 14 Jul 2020 15:08:15 -0400 +Subject: [PATCH] pesign-authorize: don't setfacl /etc/pki/pesign-foo/ + +Signed-off-by: Peter Jones +--- + src/pesign-authorize | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/pesign-authorize b/src/pesign-authorize +index 55cd5c4..c544832 100755 +--- a/src/pesign-authorize ++++ b/src/pesign-authorize +@@ -47,7 +47,7 @@ update_subdir() { + done + } + +-for x in /var/run/pesign/ /etc/pki/pesign*/ ; do ++for x in /var/run/pesign/ /etc/pki/pesign/ ; do + if [ -d "${x}" ]; then + update_subdir "${x}" + else diff --git a/0011-kernel-building-hack.patch b/0011-kernel-building-hack.patch new file mode 100644 index 0000000..ff32b68 --- /dev/null +++ b/0011-kernel-building-hack.patch @@ -0,0 +1,38 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Tue, 14 Jul 2020 16:42:39 -0400 +Subject: [PATCH] kernel building hack + +Signed-off-by: Peter Jones +--- + src/pesign-rpmbuild-helper.in | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/src/pesign-rpmbuild-helper.in b/src/pesign-rpmbuild-helper.in +index c5287c2..27b8261 100644 +--- a/src/pesign-rpmbuild-helper.in ++++ b/src/pesign-rpmbuild-helper.in +@@ -202,6 +202,23 @@ main() { + "${input[@]}" "${output[@]}" + rm -rf "${sattrs}" "${sattrs}.sig" "${nssdir}" + elif [[ -n "${socket}" ]] ; then ++ ### welcome haaaaack city ++ if [[ "${client_token[1]}" = "OpenSC Card (Fedora Signer)" ]] ; then ++ if [[ "${input[1]}" =~ (/|^)vmlinuz($|[_.-]) ]] \ ++ || [[ "${input[1]}" =~ (/|^)bzImage($|[_.-]) ]] ; then ++ if [[ "${rhelcertfile}" =~ redhatsecureboot501.* ]] \ ++ || [[ "${rhelcertfile}" =~ redhatsecureboot401.* ]] \ ++ || [[ "${rhelcertfile}" =~ centossecureboot201.* ]] ; then ++ client_cert[1]=kernel-signer ++ elif [[ "${rhelcertfile}" =~ redhatsecureboot502.* ]] \ ++ || [[ "${rhelcertfile}" =~ centossecureboot202.* ]] ; then ++ client_cert[1]=grub2-signer ++ elif [[ "${rhelcertfile}" =~ redhatsecureboot503.* ]] \ ++ || [[ "${rhelcertfile}" =~ centossecureboot203.* ]] ; then ++ client_cert[1]=fwupd-signer ++ fi ++ fi ++ fi + "${client}" "${client_token[@]}" "${client_cert[@]}" \ + "${sattrout[@]}" "${certout[@]}" \ + ${sign} "${input[@]}" "${output[@]}" diff --git a/0012-Use-run-not-var-run.patch b/0012-Use-run-not-var-run.patch new file mode 100644 index 0000000..5ca5daf --- /dev/null +++ b/0012-Use-run-not-var-run.patch @@ -0,0 +1,102 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Thu, 16 Jul 2020 16:28:26 -0400 +Subject: [PATCH] Use /run not /var/run + +Signed-off-by: Peter Jones +--- + src/Makefile | 2 +- + src/daemon.h | 4 ++-- + src/pesign-authorize | 2 +- + src/pesign.service.in | 2 +- + src/pesign.sysvinit.in | 10 +++++----- + 5 files changed, 10 insertions(+), 10 deletions(-) + +diff --git a/src/Makefile b/src/Makefile +index a7ca891..f7fb5fc 100644 +--- a/src/Makefile ++++ b/src/Makefile +@@ -78,7 +78,7 @@ install_sysvinit: pesign.sysvinit + install : + $(INSTALL) -d -m 700 $(INSTALLROOT)/etc/pki/pesign/ + $(INSTALL) -d -m 700 $(INSTALLROOT)/etc/pki/pesign-rh-test/ +- $(INSTALL) -d -m 770 $(INSTALLROOT)/var/run/pesign/ ++ $(INSTALL) -d -m 770 $(INSTALLROOT)/run/pesign/ + $(INSTALL) -d -m 755 $(INSTALLROOT)$(bindir) + $(INSTALL) -m 755 authvar $(INSTALLROOT)$(bindir) + $(INSTALL) -m 755 pesign $(INSTALLROOT)$(bindir) +diff --git a/src/daemon.h b/src/daemon.h +index 0368dc9..5fcd97e 100644 +--- a/src/daemon.h ++++ b/src/daemon.h +@@ -51,8 +51,8 @@ typedef enum { + } pesignd_cmd; + + #define PESIGND_VERSION 0x2a9edaf0 +-#define SOCKPATH "/var/run/pesign/socket" +-#define PIDFILE "/var/run/pesign.pid" ++#define SOCKPATH "/run/pesign/socket" ++#define PIDFILE "/run/pesign.pid" + + static inline uint32_t UNUSED + pesignd_string_size(char *buffer) +diff --git a/src/pesign-authorize b/src/pesign-authorize +index c544832..2381302 100755 +--- a/src/pesign-authorize ++++ b/src/pesign-authorize +@@ -47,7 +47,7 @@ update_subdir() { + done + } + +-for x in /var/run/pesign/ /etc/pki/pesign/ ; do ++for x in /run/pesign/ /var/run/pesign/ /etc/pki/pesign/ ; do + if [ -d "${x}" ]; then + update_subdir "${x}" + else +diff --git a/src/pesign.service.in b/src/pesign.service.in +index c75a000..4ac2199 100644 +--- a/src/pesign.service.in ++++ b/src/pesign.service.in +@@ -4,6 +4,6 @@ Description=Pesign signing daemon + [Service] + PrivateTmp=true + Type=forking +-PIDFile=/var/run/pesign.pid ++PIDFile=/run/pesign.pid + ExecStart=/usr/bin/pesign --daemonize + ExecStartPost=@@LIBEXECDIR@@/pesign/pesign-authorize +diff --git a/src/pesign.sysvinit.in b/src/pesign.sysvinit.in +index b0e0f84..bf8edec 100644 +--- a/src/pesign.sysvinit.in ++++ b/src/pesign.sysvinit.in +@@ -4,7 +4,7 @@ + # + # chkconfig: - 50 50 + # processname: /usr/bin/pesign +-# pidfile: /var/run/pesign.pid ++# pidfile: /run/pesign.pid + ### BEGIN INIT INFO + # Provides: pesign + # Default-Start: +@@ -20,9 +20,9 @@ RETVAL=0 + + start(){ + echo -n "Starting pesign: " +- mkdir /var/run/pesign 2>/dev/null && +- chown pesign:pesign /var/run/pesign && +- chmod 0770 /var/run/pesign ++ mkdir /run/pesign 2>/dev/null && ++ chown pesign:pesign /run/pesign && ++ chmod 0770 /run/pesign + daemon /usr/bin/pesign --daemonize + RETVAL=$? + echo +@@ -32,7 +32,7 @@ start(){ + + stop(){ + echo -n "Stopping pesign: " +- killproc -p /var/run/pesign.pid pesignd ++ killproc -p /run/pesign.pid pesignd + RETVAL=$? + echo + rm -f /var/lock/subsys/pesign diff --git a/0013-Turn-off-Wfree-nonheap-object.patch b/0013-Turn-off-Wfree-nonheap-object.patch new file mode 100644 index 0000000..f477704 --- /dev/null +++ b/0013-Turn-off-Wfree-nonheap-object.patch @@ -0,0 +1,32 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Jeff Law +Date: Mon, 16 Nov 2020 12:07:59 -0700 +Subject: [PATCH] Turn off -Wfree-nonheap-object + +authvar.c has a call to free (tokenname) where tokenname is set to a string constant +and never changed. That triggers GCC to issue a diagnostic that the value should not +be passed to free. + +This is a false positive from GCC as the call is guarded by a suitable condition that +always happens to be false. But pesign is being built without optimization and thus +the condition and free call are not optimized away. + +This patch just disables the warning. A better solution would be to fix the sources +or build with the optimizer enabled. +--- + Make.defaults | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Make.defaults b/Make.defaults +index d4cd626..705cc3a 100644 +--- a/Make.defaults ++++ b/Make.defaults +@@ -40,7 +40,7 @@ gcc_cflags = -Wmaybe-uninitialized -grecord-gcc-switches -flto + cflags = $(CFLAGS) $(ARCH3264) \ + -Wall -Wextra -Wsign-compare -Wno-unused-result \ + -Wno-unused-function -Wno-missing-field-initializers \ +- -Werror -Wno-error=cpp \ ++ -Werror -Wno-error=cpp -Wno-free-nonheap-object \ + -std=gnu11 -fshort-wchar -fPIC -fno-strict-aliasing \ + -D_GNU_SOURCE -DCONFIG_$(ARCH) -I${TOPDIR}/include \ + $(if $(filter $(CC),clang),$(clang_cflags), ) \ diff --git a/0013-Turn-off-free-nonheap-object.patch b/0013-Turn-off-free-nonheap-object.patch new file mode 100644 index 0000000..3e62bd8 --- /dev/null +++ b/0013-Turn-off-free-nonheap-object.patch @@ -0,0 +1,35 @@ +From 59428daf4863f192419eee4afec15cd099e99c9b Mon Sep 17 00:00:00 2001 +From: Jeff Law +Date: Mon, 16 Nov 2020 12:07:59 -0700 +Subject: [PATCH] Turn off -Wfree-nonheap-object + +authvar.c has a call to free (tokenname) where tokenname is set to a string constant +and never changed. That triggers GCC to issue a diagnostic that the value should not +be passed to free. + +This is a false positive from GCC as the call is guarded by a suitable condition that +always happens to be false. But pesign is being built without optimization and thus +the condition and free call are not optimized away. + +This patch just disables the warning. A better solution would be to fix the sources +or build with the optimizer enabled. +--- + Make.defaults | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Make.defaults b/Make.defaults +index d4cd626..705cc3a 100644 +--- a/Make.defaults ++++ b/Make.defaults +@@ -40,7 +40,7 @@ gcc_cflags = -Wmaybe-uninitialized -grecord-gcc-switches -flto + cflags = $(CFLAGS) $(ARCH3264) \ + -Wall -Wextra -Wsign-compare -Wno-unused-result \ + -Wno-unused-function -Wno-missing-field-initializers \ +- -Werror -Wno-error=cpp \ ++ -Werror -Wno-error=cpp -Wno-free-nonheap-object \ + -std=gnu11 -fshort-wchar -fPIC -fno-strict-aliasing \ + -D_GNU_SOURCE -DCONFIG_$(ARCH) -I${TOPDIR}/include \ + $(if $(filter $(CC),clang),$(clang_cflags), ) \ +-- +2.28.0 + diff --git a/0014-Fix-bad-free-of-cms-data-DoS-only.patch b/0014-Fix-bad-free-of-cms-data-DoS-only.patch new file mode 100644 index 0000000..1dc6c90 --- /dev/null +++ b/0014-Fix-bad-free-of-cms-data-DoS-only.patch @@ -0,0 +1,39 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Robbie Harwood +Date: Thu, 3 Mar 2022 15:37:02 -0500 +Subject: [PATCH] Fix bad free of cms data (DoS only) + +handle_unlock_token() set the CMS data to an offset of an allocated +buffer, rather than something allocated in its own right. +cms_set_pw_data() would then attempt to free this value. Additionally, +should pesignd not take SIGABRT at that point, handle_unlock_token() +would then also free buffer. + +Signed-off-by: Robbie Harwood +(cherry picked from commit 7b78af412dc0ca5db54c426a13550cf35caa9516) +--- + src/daemon.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/src/daemon.c b/src/daemon.c +index 8522250..3ae3c8d 100644 +--- a/src/daemon.c ++++ b/src/daemon.c +@@ -166,6 +166,7 @@ handle_unlock_token(context *ctx, struct pollfd *pollfd, socklen_t size) + struct msghdr msg; + struct iovec iov; + ssize_t n; ++ char *pin = NULL; + + int rc = cms_context_alloc(&ctx->cms); + if (rc < 0) { +@@ -233,7 +234,8 @@ malformed: + if (!ctx->cms->tokenname) + goto oom; + +- char *pin = (char *)tp->value; ++ if (!tp->value) ++ pin = strndup((char *)tp->value, tp->size); + if (!pin) + goto oom; + diff --git a/0015-daemon-remove-always-true-comparison.patch b/0015-daemon-remove-always-true-comparison.patch new file mode 100644 index 0000000..2edf943 --- /dev/null +++ b/0015-daemon-remove-always-true-comparison.patch @@ -0,0 +1,25 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Robbie Harwood +Date: Tue, 8 Mar 2022 12:59:34 -0500 +Subject: [PATCH] daemon: remove always-true comparison + +Signed-off-by: Robbie Harwood +(cherry picked from commit 500ee15d26630066baaa48dea1dbfd614d8ea225) +--- + src/daemon.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/src/daemon.c b/src/daemon.c +index 3ae3c8d..1179cb3 100644 +--- a/src/daemon.c ++++ b/src/daemon.c +@@ -234,8 +234,7 @@ malformed: + if (!ctx->cms->tokenname) + goto oom; + +- if (!tp->value) +- pin = strndup((char *)tp->value, tp->size); ++ pin = strndup((char *)tp->value, tp->size); + if (!pin) + goto oom; + diff --git a/noautobuild b/noautobuild deleted file mode 100644 index e69de29..0000000 diff --git a/pesign.patches b/pesign.patches deleted file mode 100644 index 9981c26..0000000 --- a/pesign.patches +++ /dev/null @@ -1,5 +0,0 @@ -Patch0001: 0001-cms_common-Fixed-Segmentation-fault.patch -Patch0002: 0002-Fix-reversed-calloc-arguments.patch -Patch0003: 0003-Work-around-OpenSC-changing-token-names-on-fedora-bu.patch -Patch0004: 0004-cms_common-skip-authentication-on-the-Friendly-slot.patch -Patch0005: 0005-Add-const-qualifier-to-variable.patch diff --git a/pesign.spec b/pesign.spec index 9785b6b..467b5fe 100644 --- a/pesign.spec +++ b/pesign.spec @@ -1,33 +1,29 @@ %global macrosdir %(d=%{_rpmconfigdir}/macros.d; [ -d $d ] || d=%{_sysconfdir}/rpm; echo $d) -# No. I have enough trouble already. -%undefine _auto_set_build_flags - Name: pesign Summary: Signing utility for UEFI binaries -Version: 116 -Release: 9%{?dist} -License: GPL-2.0-only -URL: https://github.com/rhboot/pesign +Version: 113 +Release: 18%{?dist} +License: GPLv2 +URL: https://github.com/vathpela/pesign Obsoletes: pesign-rh-test-certs <= 0.111-7 -BuildRequires: efivar-devel >= 38-1 +BuildRequires: make BuildRequires: gcc BuildRequires: git -BuildRequires: libuuid-devel -BuildRequires: make -BuildRequires: mandoc BuildRequires: nspr -BuildRequires: nspr-devel >= 4.9.2-1 BuildRequires: nss -BuildRequires: nss-devel >= 3.13.6-1 -BuildRequires: nss-tools BuildRequires: nss-util BuildRequires: popt-devel -BuildRequires: python3 -BuildRequires: python3-rpm-macros +BuildRequires: nss-tools +BuildRequires: nspr-devel >= 4.9.2-1 +BuildRequires: nss-devel >= 3.13.6-1 +BuildRequires: efivar-devel >= 31-1 +BuildRequires: libuuid-devel BuildRequires: tar BuildRequires: xz +BuildRequires: python3-rpm-macros +BuildRequires: python3 %if 0%{?rhel} >= 7 || 0%{?fedora} >= 17 BuildRequires: systemd-rpm-macros %endif @@ -37,7 +33,8 @@ Requires: nss-tools >= 3.53 Requires: nss-util Requires: popt Requires: rpm -ExclusiveArch: %{ix86} x86_64 ia64 aarch64 %{arm} riscv64 +Requires(pre): shadow-utils +ExclusiveArch: %{ix86} x86_64 ia64 aarch64 %{arm} %if 0%{?rhel} == 7 BuildRequires: rh-signing-tools >= 1.20-2 %endif @@ -45,10 +42,22 @@ BuildRequires: rh-signing-tools >= 1.20-2 Source0: https://github.com/rhboot/pesign/releases/download/%{version}/pesign-%{version}.tar.bz2 Source1: certs.tar.xz Source2: pesign.py -Source3: pesign.patches -# generate with tool -%include %{SOURCE3} +Patch0001: 0001-efikeygen-Fix-the-build-with-nss-3.44.patch +Patch0002: 0002-pesigcheck-Fix-a-wrong-assignment.patch +Patch0003: 0003-Make-0.112-client-and-server-work-with-the-113-proto.patch +Patch0004: 0004-Rename-var-run-to-run.patch +Patch0005: 0005-Apparently-opensc-got-updated-and-the-token-name-cha.patch +Patch0006: 0006-client-try-run-and-var-run-for-the-socket-path.patch +Patch0007: 0007-client-remove-an-extra-debug-print.patch +Patch0008: 0008-Move-most-of-macros.pesign-to-pesign-rpmbuild-helper.patch +Patch0009: 0009-pesign-authorize-shellcheck.patch +Patch0010: 0010-pesign-authorize-don-t-setfacl-etc-pki-pesign-foo.patch +Patch0011: 0011-kernel-building-hack.patch +Patch0012: 0012-Use-run-not-var-run.patch +Patch0013: 0013-Turn-off-free-nonheap-object.patch +Patch0014: 0014-Fix-bad-free-of-cms-data-DoS-only.patch +Patch0015: 0015-daemon-remove-always-true-comparison.patch %description This package contains the pesign utility for signing UEFI binaries as @@ -66,11 +75,6 @@ git am %{patches} pesign.sysusers.conf </dev/null || groupadd -r pesign +getent passwd pesign >/dev/null || \ + useradd -r -g pesign -d /run/pesign -s /sbin/nologin \ + -c "Group for the pesign signing daemon" pesign +exit 0 %if 0%{?rhel} >= 7 || 0%{?fedora} >= 17 %post @@ -132,13 +140,13 @@ certutil -d %{_sysconfdir}/pki/pesign/ -X -L > /dev/null %files %{!?_licensedir:%global license %%doc} %license COPYING -%doc README.md TODO +%doc README TODO %{_bindir}/authvar %{_bindir}/efikeygen +%{_bindir}/efisiglist %{_bindir}/pesigcheck %{_bindir}/pesign %{_bindir}/pesign-client -%{_bindir}/pesum %dir %{_libexecdir}/pesign/ %dir %attr(0770,pesign,pesign) %{_sysconfdir}/pki/pesign/ %config(noreplace) %attr(0660,pesign,pesign) %{_sysconfdir}/pki/pesign/* @@ -160,80 +168,10 @@ certutil -d %{_sysconfdir}/pki/pesign/ -X -L > /dev/null %endif %{python3_sitelib}/mockbuild/plugins/*/pesign.* %{python3_sitelib}/mockbuild/plugins/pesign.* -%{_sysusersdir}/pesign.conf %changelog -* Mon Jun 22 2026 Nicolas Frayer - 116-9 -- Fix a FTBFS issue caused by a missing const qualifier -- Resolves: #2491392 - -* Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek -- Add sysusers.d config file to allow rpm to create users/groups automatically - -* Wed Jan 29 2025 Nicolas Frayer - 116-7 -- Backport patch to skip auth on friendly slot - -* Thu Nov 21 2024 Peter Jones - 116-6 -- Work around OpenSC token name changes - -* Tue Nov 12 2024 Kevin Fenzi - 116-5 -- Rebuild to pick up riscv64 change - -* Tue Mar 05 2024 Liu Yang - 116-4 -- Add riscv64. - -* Fri Feb 02 2024 Peter Jones - 116-3 -- Fix incorrect calloc() invocations caught by -Wcalloc-transposed-args - -* Mon Feb 20 2023 Nicolas Frayer - 116-2 -- cms_common: Fixed Segmentation fault - -* Tue Jan 31 2023 Robbie Harwood - 116-1 -- New upstream release (116) -- Resolves: CVE-2022-3560 - -* Wed Aug 31 2022 Robbie Harwood - 115-9 -- Roll up to pjones's smartcard/cms fixes - -* Tue Aug 02 2022 Robbie Harwood - 115-8 -- Rebuild for python bytecode change -- See-also: #2107826 - -* Thu Jul 07 2022 Robbie Harwood - 115-6 -- Fix formatting of man pages -- Resolves: #2104778 - -* Mon Apr 04 2022 Robbie Harwood - 115-5 -- Detect presence of rpm-sign when checking for rhel-ness - -* Fri Apr 01 2022 Robbie Harwood - 115-4 -- Correctly handle rhel and centos macros - -* Fri Mar 25 2022 Robbie Harwood - 115-3 -- Add -D_GLIBCXX_ASSERTIONS to CPPFLAGS - -* Thu Mar 24 2022 Robbie Harwood - 115-2 -- Add support for non-koji signing in macros -- Resolves: #1880858 - -* Tue Mar 08 2022 Robbie Harwood - 115-1 -- New upstream version (115) - -* Mon Feb 14 2022 Robbie Harwood - 114-4 -- Disable -fanalyzer since it's broken and pragmas don't work -- See-also: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104370 - -* Mon Feb 14 2022 Robbie Harwood - 114-3 -- Fix explicit NULL deref when daemonizing - -* Wed Feb 02 2022 Robbie Harwood - 114-2 -- Attempt to fix signing parsing by dropping pesign_args - -* Tue Feb 01 2022 Robbie Harwood - 114-1 -- New upstream version (114) - -* Fri Jan 21 2022 Fedora Release Engineering - 113-18 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild +* Tue Mar 08 2022 Robbie Harwood - 113-18 +- Backport DoS fix from 115 * Fri Jul 23 2021 Fedora Release Engineering - 113-17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild diff --git a/rpminspect.yaml b/rpminspect.yaml deleted file mode 100644 index 4c08189..0000000 --- a/rpminspect.yaml +++ /dev/null @@ -1,13 +0,0 @@ ---- -inspections: - # Not a Java package - javabytecode: off - - # These just flag when things change "too much" - changedfiles: off - filesize: off - patches: off - upstream: off - - # https://bugzilla.redhat.com/show_bug.cgi?id=2010936 - annocheck: off diff --git a/sources b/sources index f7edcc4..d0199f7 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ SHA512 (certs.tar.xz) = ddac535c786d1a23074534323c4ce89f907d4f82b19c5d3a9c814b145fbac1599cd2386cf20c28d22aee7d5c4db441f052bab9ee655de756117a0a0bc99b525f -SHA512 (pesign-116.tar.bz2) = be3e1083f5e9f889cb8f7c50a8ebe723542fb2f6d1de8de9b04a9f21526ebaa8ab1efc7d4be11bcb0bc9862fa4bc6f78ee35e4d3496dd3b8927170b97795d25c +SHA512 (pesign-113.tar.bz2) = 89c5e33bf6ac8f8dc4b65192e5fd4bf1fea285106d1de2a6ea02a8c5090f2ec5976b1d80c60e57f74fa56dc25b174a4dd5682292db44ab9aeab69ea992dfef36