Fix a FTBFS issue caused by a missing const qualifier

Resolves: #2491392
Signed-off-by: Nicolas Frayer <nfrayer@redhat.com>

0001-cms-kill-generate_integer-it-doesn-t-build-on-i686-a.patch

@@ -1,72 +0,0 @@
-From 33bcca8303cad962606df3bfc6a031a9b0626375 Mon Sep 17 00:00:00 2001
-From: Peter Jones <pjones@redhat.com>
-Date: Thu, 21 Apr 2016 10:47:34 -0400
-Subject: [PATCH] cms: kill generate_integer(), it doesn't build on i686 and
- it's unused.
-
-Signed-off-by: Peter Jones <pjones@redhat.com>
----
- src/cms_common.c | 34 ----------------------------------
- src/cms_common.h |  1 -
- 2 files changed, 35 deletions(-)
-
-diff --git a/src/cms_common.c b/src/cms_common.c
-index b19bc62..6a4e6a7 100644
---- a/src/cms_common.c
-+++ b/src/cms_common.c
-@@ -641,40 +641,6 @@ generate_string(cms_context *cms, SECItem *der, char *str)
- 	return 0;
- }
- 
--static SEC_ASN1Template IntegerTemplate[] = {
--	{.kind = SEC_ASN1_INTEGER,
--	 .offset = 0,
--	 .sub = NULL,
--	 .size = sizeof(long),
--	},
--	{ 0 },
--};
--
--int
--generate_integer(cms_context *cms, SECItem *der, unsigned long integer)
--{
--	void *ret;
--
--	uint32_t u32;
--
--	SECItem input = {
--		.data = (void *)&integer,
--		.len = sizeof(integer),
--		.type = siUnsignedInteger,
--	};
--
--	if (integer < 0x100000000) {
--		u32 = integer & 0xffffffffUL;
--		input.data = (void *)&u32;
--		input.len = sizeof(u32);
--	}
--
--	ret = SEC_ASN1EncodeItem(cms->arena, der, &input, IntegerTemplate);
--	if (ret == NULL)
--		cmsreterr(-1, cms, "could not encode data");
--	return 0;
--}
--
- int
- generate_time(cms_context *cms, SECItem *encoded, time_t when)
- {
-diff --git a/src/cms_common.h b/src/cms_common.h
-index 7d77faf..c7d7268 100644
---- a/src/cms_common.h
-+++ b/src/cms_common.h
-@@ -117,7 +117,6 @@ extern int generate_object_id(cms_context *ctx, SECItem *encoded,
- 				SECOidTag tag);
- extern int generate_empty_sequence(cms_context *ctx, SECItem *encoded);
- extern int generate_time(cms_context *ctx, SECItem *encoded, time_t when);
--extern int generate_integer(cms_context *cms, SECItem *der, unsigned long integer);
- extern int generate_string(cms_context *cms, SECItem *der, char *str);
- extern int wrap_in_set(cms_context *cms, SECItem *der, SECItem **items);
- extern int wrap_in_seq(cms_context *cms, SECItem *der,
--- 
-2.5.5
-

0001-cms_common-Fixed-Segmentation-fault.patch

@@ -0,0 +1,27 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Nicolas Frayer <nfrayer@redhat.com>
+Date: Mon, 20 Feb 2023 15:26:20 +0100
+Subject: [PATCH] cms_common: Fixed Segmentation fault
+
+When running efikeygen, the binary crashes with a segfault due
+to dereferencing a **ptr instead of a *ptr.
+
+Signed-off-by: Nicolas Frayer <nfrayer@redhat.com>
+(cherry picked from commit 227435af461f38fc4abeafe02884675ad4b1feb4)
+---
+ src/cms_common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/cms_common.c b/src/cms_common.c
+index 24576f2..89d946a 100644
+--- a/src/cms_common.c
++++ b/src/cms_common.c
+@@ -956,7 +956,7 @@ find_certificate_by_issuer_and_sn(cms_context *cms,
+ 	if (!ias)
+ 		cnreterr(-1, cms, "invalid issuer and serial number");
+ 
+-	return find_certificate_by_callback(cms, match_issuer_and_serial, &ias, cert);
++	return find_certificate_by_callback(cms, match_issuer_and_serial, ias, cert);
+ }
+ 
+ int

0002-Fix-command-line-parsing.patch

@@ -1,73 +0,0 @@
-From 5be0515dee24308fd7e270bf2e0fb5e5a7a78f32 Mon Sep 17 00:00:00 2001
-From: Julien Cristau <jcristau@debian.org>
-Date: Thu, 9 Jun 2016 14:30:37 +0200
-Subject: [PATCH 2/2] Fix command line parsing
-
-The gettext translation domain should be passed as .arg, not .descrip,
-otherwise popt won't process any of the command line options (it stops
-looping over the struct poptOption array when an entry has unset
-longName, shortName and arg).
-
-Signed-off-by: Julien Cristau <jcristau@debian.org>
----
- src/client.c     | 2 +-
- src/efikeygen.c  | 2 +-
- src/efisiglist.c | 2 +-
- src/pesigcheck.c | 2 +-
- 4 files changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/src/client.c b/src/client.c
-index 028419f..575c873 100644
---- a/src/client.c
-+++ b/src/client.c
-@@ -555,7 +555,7 @@ main(int argc, char *argv[])
- 
- 	struct poptOption options[] = {
- 		{.argInfo = POPT_ARG_INTL_DOMAIN,
--		 .descrip = "pesign" },
-+		 .arg = "pesign" },
- 		{.longName = "token",
- 		 .shortName = 't',
- 		 .argInfo = POPT_ARG_STRING|POPT_ARGFLAG_SHOW_DEFAULT,
-diff --git a/src/efikeygen.c b/src/efikeygen.c
-index 6278849..8a515a5 100644
---- a/src/efikeygen.c
-+++ b/src/efikeygen.c
-@@ -486,7 +486,7 @@ int main(int argc, char *argv[])
- 	poptContext optCon;
- 	struct poptOption options[] = {
- 		{.argInfo = POPT_ARG_INTL_DOMAIN,
--		 .descrip = "pesign" },
-+		 .arg = "pesign" },
- 		/* global nss-ish things */
- 		{.longName = "dbdir",
- 		 .shortName = 'd',
-diff --git a/src/efisiglist.c b/src/efisiglist.c
-index cd3f1ae..40d6a93 100644
---- a/src/efisiglist.c
-+++ b/src/efisiglist.c
-@@ -126,7 +126,7 @@ main(int argc, char *argv[])
- 
- 	struct poptOption options[] = {
- 		{.argInfo = POPT_ARG_INTL_DOMAIN,
--		 .descrip = "pesign" },
-+		 .arg = "pesign" },
- 		{.longName = "infile",
- 		 .shortName = 'i',
- 		 .argInfo = POPT_ARG_STRING,
-diff --git a/src/pesigcheck.c b/src/pesigcheck.c
-index 1328fe9..0d49c1a 100644
---- a/src/pesigcheck.c
-+++ b/src/pesigcheck.c
-@@ -214,7 +214,7 @@ main(int argc, char *argv[])
- 	poptContext optCon;
- 	struct poptOption options[] = {
- 		{.argInfo = POPT_ARG_INTL_DOMAIN,
--		 .descrip = "pesign" },
-+		 .arg = "pesign" },
- 		{.longName = "dbfile",
- 		 .shortName = 'D',
- 		 .argInfo = POPT_ARG_CALLBACK|POPT_CBFLAG_POST,
--- 
-2.9.2
-

0002-Fix-reversed-calloc-arguments.patch

@@ -0,0 +1,41 @@
+From 1f9e2fa0b4d872fdd01ca3ba81b04dfb1211a187 Mon Sep 17 00:00:00 2001
+From: Stephen Gallagher <sgallagh@redhat.com>
+Date: Fri, 2 Feb 2024 09:32:48 -0500
+Subject: [PATCH] Fix reversed calloc() arguments
+
+The prototype is "void *calloc(size_t nelem, size_t elsize);"
+
+These two instances had them reversed, almost certainly leading to
+buffer overflow issues. This was detected by
+-Werror=calloc-transposed-args on gcc.
+
+Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
+---
+ src/pesigcheck.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/pesigcheck.c b/src/pesigcheck.c
+index 6dc67f76a81..8119cf10a7b 100644
+--- a/src/pesigcheck.c
++++ b/src/pesigcheck.c
+@@ -240,7 +240,7 @@ check_signature(pesigcheck_context *ctx, int *nreasons,
+ 
+ 	cert_iter iter;
+ 
+-	reasonps = calloc(sizeof(struct reason), 512);
++	reasonps = calloc(512, sizeof(struct reason));
+ 	if (!reasonps)
+ 		err(1, "check_signature");
+ 
+@@ -281,7 +281,7 @@ check_signature(pesigcheck_context *ctx, int *nreasons,
+ 
+ 			num_reasons += 16;
+ 
+-			new_reasons = calloc(sizeof(struct reason), num_reasons);
++			new_reasons = calloc(num_reasons, sizeof(struct reason));
+ 			if (!new_reasons)
+ 				err(1, "check_signature");
+ 			reasonps = new_reasons;
+-- 
+2.41.0
+

0003-Work-around-OpenSC-changing-token-names-on-fedora-bu.patch

@@ -0,0 +1,61 @@
+From dc17b1d248c705073a5160e7c871a52aa9ce6e99 Mon Sep 17 00:00:00 2001
+From: Peter Jones <pjones@redhat.com>
+Date: Thu, 21 Nov 2024 13:58:05 -0500
+Subject: [PATCH] Work around OpenSC changing token names on fedora builders
+ *again*.
+
+Once again OpenSC has changed how token names work in an incompatible
+way, and we need to work around it even harder on the Fedora kernel
+builders.
+
+Reviewed-by: Kevin Fenzi <kevin@fedoraproject.org>
+Reviewed-by: Justin Forbes <jforbes@fedoraproject.org>
+Signed-off-by: Peter Jones <pjones@redhat.com>
+---
+ src/macros.pesign             |  3 ++-
+ src/pesign-rpmbuild-helper.in | 15 ++++++++++++++-
+ 2 files changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/src/macros.pesign b/src/macros.pesign
+index b7d6af1f6f5..47e3f19f8ed 100644
+--- a/src/macros.pesign
++++ b/src/macros.pesign
+@@ -9,7 +9,8 @@
+ %__pesign_token %{nil}%{?pe_signing_token:--token "%{pe_signing_token}"}
+ %__pesign_cert %{!?pe_signing_cert:"Red Hat Test Certificate"}%{?pe_signing_cert:"%{pe_signing_cert}"}
+ 
+-%__pesign_client_token %{!?pe_signing_token:"OpenSC Card (Fedora Signer)"}%{?pe_signing_token:"%{pe_signing_token}"}
++# See the comment in pesign-rpmbuild-helper.in about the token name here.
++%__pesign_client_token %{!?pe_signing_token:"OpenSC Card"}%{?pe_signing_token:"%{pe_signing_token}"}
+ %__pesign_client_cert %{!?pe_signing_cert:"/CN=Fedora Secure Boot Signer"}%{?pe_signing_cert:"%{pe_signing_cert}"}
+ 
+ %_pesign /usr/bin/pesign
+diff --git a/src/pesign-rpmbuild-helper.in b/src/pesign-rpmbuild-helper.in
+index 30d5441207b..42de1a1e002 100644
+--- a/src/pesign-rpmbuild-helper.in
++++ b/src/pesign-rpmbuild-helper.in
+@@ -214,7 +214,20 @@ main() {
+ 	rm -rf "${sattrs}" "${sattrs}.sig" "${nssdir}"
+     elif [[ -n "${socket}" ]] ; then
+ 	### welcome haaaaack city
+-	if [[ "${client_token[1]}" = "OpenSC Card (Fedora Signer)" ]] ; then
++	### different versions of the opensc library name the token different
++	### things, and as of this commit:
++	###   https://github.com/OpenSC/OpenSC/commit/259decf656a77a6d1bd3e944d6f198ed70832ff5
++	### that includes just not including the token label unless there's
++	### more than one token.  Unfortunately this is both for the displayed
++	### info and for the token name you specify to /use/ the token, so we
++	### have to handle all of those options here, and change the name to
++	### match whatever the current version of opensc is using in the rpm
++	### macro where we're setting it.  Thankfully this is just a "is this
++	### Fedora" check for us, and if it's RHEL we're not using OpenSC at
++	### all.
++	if [[ "${client_token[1]}" = "OpenSC Card (Fedora Signer)" ]] \
++	    || [[ "${client_token[1]}" = "Fedora Signer" ]] \
++	    || [[ "${client_token[1]}" = "OpenSC Card" ]] ; then
+ 	    if [[ "${input[1]}" =~ (/|^)vmlinuz($|[_.-]) ]] \
+ 	       || [[ "${input[1]}" =~ (/|^)bzImage($|[_.-]) ]] ; then
+ 		if [[ "${rhelcertfile}" =~ redhatsecureboot501.* ]] \
+-- 
+2.47.0
+

0004-cms_common-skip-authentication-on-the-Friendly-slot.patch

@@ -0,0 +1,41 @@
+From 616ec5f25adbde1a4bd78cdcacd6dcd7ecfa5a5c Mon Sep 17 00:00:00 2001
+From: Gary Lin <glin@suse.com>
+Date: Thu, 22 Dec 2022 13:49:34 +0800
+Subject: [PATCH] cms_common: skip authentication on the 'Friendly' slot
+
+When finding a certificate in a 'Friendly' slot without the need of the
+private key, it is not necessary to authenticate the slot.
+
+For example, when the signed attributes and the raw signature are
+created in a server and the user has the certificate, signkey.x509, and
+tries to import them into myapp.efi:
+
+  $ certutil -N -d nssdb -f passwd
+  $ certutil -A -d nssdb -f passwd -n signkey -t CT,CT,CT \
+      -i signkey.x509
+  $ pesign -n nssdb -c signkey -i myapp.efi -o myapp.efi.signed \
+      -d sha256 -I myapp.sattr -R myapp.sig
+
+Since the "signkey" is 'Friendly', i.e. publicly readable, and the
+private key is not needed, we can just skip the authentication and find
+"signkey" in the slot.
+
+Signed-off-by: Gary Lin <glin@suse.com>
+---
+ src/cms_common.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/cms_common.c b/src/cms_common.c
+index cf572ca..44e5cca 100644
+--- a/src/cms_common.c
++++ b/src/cms_common.c
+@@ -628,7 +628,8 @@ find_certificate(cms_context *cms, int needs_private_key)
+ 
+ 	int errnum;
+ 	SECStatus status;
+-	if (PK11_NeedLogin(psle->slot) && !PK11_IsLoggedIn(psle->slot, cms)) {
++	if ((needs_private_key || !PK11_IsFriendly(psle->slot)) &&
++	    (PK11_NeedLogin(psle->slot) && !PK11_IsLoggedIn(psle->slot, cms))) {
+ 		status = PK11_Authenticate(psle->slot, PR_TRUE, cms);
+ 		if (status != SECSuccess) {
+ 			save_port_err() {

0005-Add-const-qualifier-to-variable.patch

@@ -0,0 +1,25 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Nicolas Frayer <nfrayer@redhat.com>
+Date: Mon, 22 Jun 2026 20:58:03 +0200
+Subject: [PATCH] Add const qualifier to variable
+
+Add const to a variable initialized with using strrchr.
+
+Signed-off-by: Nicolas Frayer <nfrayer@redhat.com>
+---
+ src/pesum.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/pesum.c b/src/pesum.c
+index e4ddaf86d7fa..5d7dcb929eec 100644
+--- a/src/pesum.c
++++ b/src/pesum.c
+@@ -141,7 +141,7 @@ main(int argc, char *argv[])
+ 	while ((infile = poptGetArg(optCon)) != NULL) {
+ 		pesign_context *ctxp = NULL;
+ 
+-		char *ext = strrchr(infile, '.');
++		const char *ext = strrchr(infile, '.');
+ 		if (ext && strcmp(ext, ".ko") == 0)
+ 			fmt = FORMAT_KERNEL_MODULE;
+ 

pesign.patches

@@ -0,0 +1,5 @@
+Patch0001: 0001-cms_common-Fixed-Segmentation-fault.patch
+Patch0002: 0002-Fix-reversed-calloc-arguments.patch
+Patch0003: 0003-Work-around-OpenSC-changing-token-names-on-fedora-bu.patch
+Patch0004: 0004-cms_common-skip-authentication-on-the-Friendly-slot.patch
+Patch0005: 0005-Add-const-qualifier-to-variable.patch

pesign.py

@@ -0,0 +1,91 @@
+#!/usr/bin/python3
+#
+# Copyright 2017 Peter Jones <Peter Jones@random>
+#
+# Distributed under terms of the GPLv3 license.
+
+"""
+mock plugin to make sure pesign and mockbuild users have the right uid and
+gid.
+"""
+
+from mockbuild.trace_decorator import getLog, traceLog
+import mockbuild.util
+
+requires_api_version = "1.1"
+
+@traceLog()
+def init(plugins, conf, buildroot):
+    """ hello """
+    Pesign(plugins, conf, buildroot)
+
+def getuid(name):
+    """ get a uid for a user name """
+    output = mockbuild.util.do(["getent", "passwd", "%s" % (name,)],
+                               returnOutput=1, printOutput=True)
+    output = output.split(':')
+    return output[2], output[3]
+
+def getgid(name):
+    """ get a gid for a group name """
+    output = mockbuild.util.do(["getent", "group", "%s" % (name,)],
+                               returnOutput=1, printOutput=True)
+    return output.split(':')[2]
+
+def newgroup(name, gid, rootdir):
+    """ create a group with a gid """
+    getLog().info("creating group %s with gid %s" % (name, gid))
+    mockbuild.util.do(["groupadd",
+                       "-g", "%s" % (gid,),
+                       "-R", "%s" % (rootdir,),
+                       "%s" % (name,),
+                      ])
+
+def newuser(name, uid, gid, rootdir):
+    """ create a user with a uid """
+    getLog().info("creating user %s with uid %s" % (name, uid))
+    mockbuild.util.do(["useradd",
+                       "-u", "%s" % (uid,),
+                       "-g", "%s" % (gid,),
+                       "-R", "%s" % (rootdir,),
+                       "%s" % (name,)])
+
+class Pesign(object):
+    """ Creates some stuff in our mock root """
+    # pylint: disable=too-few-public-methods
+    @traceLog()
+    def __init__(self, plugins, conf, buildroot):
+        """ Effectively we're doing:
+            getent group pesign >/dev/null || groupadd -r pesign
+            getent passwd pesign >/dev/null || \
+                    useradd -r -g pesign -d /var/run/pesign -s /sbin/nologin \
+                    -c "Group for the pesign signing daemon" pesign
+        """
+
+        self.buildroot = buildroot
+        self.pesign_opts = conf
+        self.config = buildroot.config
+        self.state = buildroot.state
+        self.users = {}
+        self.groups = {}
+        plugins.add_hook("postinit", self._pesignPostInitHook)
+
+    @traceLog()
+    def _pesignPostInitHook(self):
+        """ find our uid and gid lists """
+        for user in self.pesign_opts['users']:
+            uid, gid = getuid(user)
+            self.users[user] = [user, uid, gid]
+        for group in self.pesign_opts['groups']:
+            gid = getgid(group)
+            self.groups[group] = [group, gid]
+
+        # create our users
+        rootdir = self.buildroot.make_chroot_path()
+        for name, gid in self.groups.values():
+            newgroup(name, gid, rootdir)
+        for name, uid, gid in self.users.values():
+            newuser(name, uid, gid, rootdir)
+
+# -*- coding: utf-8 -*-
+# vim:fenc=utf-8:tw=75

pesign.spec

@@ -1,32 +1,54 @@
 %global macrosdir %(d=%{_rpmconfigdir}/macros.d; [ -d $d ] || d=%{_sysconfdir}/rpm; echo $d)
 
+# No.  I have enough trouble already.
+%undefine _auto_set_build_flags
+
+Name:    pesign
 Summary: Signing utility for UEFI binaries
-Name: pesign
-Version: 0.112
-Release: 3%{?dist}
-Group: Development/System
-License: GPLv2
-URL: https://github.com/vathpela/pesign
+Version: 116
+Release: 9%{?dist}
+License: GPL-2.0-only
+URL:     https://github.com/rhboot/pesign
+
 Obsoletes: pesign-rh-test-certs <= 0.111-7
-BuildRequires: git nspr nss nss-util popt-devel
-BuildRequires: coolkey opensc nss-tools
-BuildRequires: nspr-devel >= 4.9.2-1
-BuildRequires: nss-devel >= 3.13.6-1
-BuildRequires: efivar-devel >= 26-1
+BuildRequires: efivar-devel >= 38-1
+BuildRequires: gcc
+BuildRequires: git
 BuildRequires: libuuid-devel
-BuildRequires: tar xz
-Requires: nspr nss nss-util popt rpm coolkey opensc
-Requires(pre): shadow-utils
-ExclusiveArch: %{ix86} x86_64 ia64 aarch64 arm
-%if 0%{?rhel} >= 7
+BuildRequires: make
+BuildRequires: mandoc
+BuildRequires: nspr
+BuildRequires: nspr-devel >= 4.9.2-1
+BuildRequires: nss
+BuildRequires: nss-devel >= 3.13.6-1
+BuildRequires: nss-tools
+BuildRequires: nss-util
+BuildRequires: popt-devel
+BuildRequires: python3
+BuildRequires: python3-rpm-macros
+BuildRequires: tar
+BuildRequires: xz
+%if 0%{?rhel} >= 7 || 0%{?fedora} >= 17
+BuildRequires: systemd-rpm-macros
+%endif
+Requires:      nspr
+Requires:      nss
+Requires:      nss-tools >= 3.53
+Requires:      nss-util
+Requires:      popt
+Requires:      rpm
+ExclusiveArch: %{ix86} x86_64 ia64 aarch64 %{arm} riscv64
+%if 0%{?rhel} == 7
 BuildRequires: rh-signing-tools >= 1.20-2
 %endif
 
-Source0: https://github.com/vathpela/pesign/releases/download/%{version}/pesign-%{version}.tar.bz2
+Source0: https://github.com/rhboot/pesign/releases/download/%{version}/pesign-%{version}.tar.bz2
 Source1: certs.tar.xz
+Source2: pesign.py
+Source3: pesign.patches
 
-Patch0001: 0001-cms-kill-generate_integer-it-doesn-t-build-on-i686-a.patch
-Patch0002: 0002-Fix-command-line-parsing.patch
+# generate with tool
+%include %{SOURCE3}
 
 %description
 This package contains the pesign utility for signing UEFI binaries as
@@ -44,11 +66,15 @@ git am %{patches} </dev/null
 git config --unset user.email
 git config --unset user.name
 
+# Create a sysusers.d config file
+cat >pesign.sysusers.conf <<EOF
+u pesign - 'Group for the pesign signing daemon' /run/pesign -
+EOF
+
 %build
 make PREFIX=%{_prefix} LIBDIR=%{_libdir}
 
 %install
-rm -rf %{buildroot}
 mkdir -p %{buildroot}/%{_libdir}
 make PREFIX=%{_prefix} LIBDIR=%{_libdir} INSTALLROOT=%{buildroot} \
 	install
@@ -76,65 +102,266 @@ rm -vf %{buildroot}/usr/share/doc/pesign-%{version}/COPYING
 # and find-debuginfo.sh has some pretty awful deficencies too...
 cp -av libdpe/*.[ch] src/
 
-%pre
-getent group pesign >/dev/null || groupadd -r pesign
-getent passwd pesign >/dev/null || \
-	useradd -r -g pesign -d /var/run/pesign -s /sbin/nologin \
-		-c "Group for the pesign signing daemon" pesign
-exit 0
+install -d -m 0755 %{buildroot}%{python3_sitelib}/mockbuild/plugins/
+install -m 0755 %{SOURCE2} %{buildroot}%{python3_sitelib}/mockbuild/plugins/
+
+install -m0644 -D pesign.sysusers.conf %{buildroot}%{_sysusersdir}/pesign.conf
+
 
 %if 0%{?rhel} >= 7 || 0%{?fedora} >= 17
 %post
 %systemd_post pesign.service
-modutil -force -dbdir %{_sysconfdir}/pki/pesign -add opensc \
-	-libfile %{_libdir}/pkcs11/opensc-pkcs11.so >/dev/null
-#modutil -force -dbdir %{_sysconfdir}/pki/pesign -add coolkey \
-#	-libfile %%{_libdir}/pkcs11/libcoolkeypk11.so
+
 %preun
 %systemd_preun pesign.service
 
 %postun
 %systemd_postun_with_restart pesign.service
-%else
-%post
-modutil -force -dbdir %{_sysconfdir}/pki/pesign -add opensc \
-	-libfile %{_libdir}/pkcs11/opensc-pkcs11.so >/dev/null
+
+%posttrans
+certutil -d %{_sysconfdir}/pki/pesign/ -X -L > /dev/null
+
+# this is disabled currently because it breaks the fedora kernel build root
+# generation - because we don't currently have a good way of populating
+# /etc/pesign/{users,groups} before the buildroot is installed, or
+# populating them and re-running pesign-authorize afterwards but before the
+# package build of e.g. kernel
+#%%{_libexecdir}/pesign/pesign-authorize
 %endif
 
 %files
-%defattr(-,root,root,-)
 %{!?_licensedir:%global license %%doc}
 %license COPYING
-%doc README TODO
+%doc README.md TODO
 %{_bindir}/authvar
 %{_bindir}/efikeygen
-%{_bindir}/efisiglist
 %{_bindir}/pesigcheck
 %{_bindir}/pesign
 %{_bindir}/pesign-client
+%{_bindir}/pesum
 %dir %{_libexecdir}/pesign/
 %dir %attr(0770,pesign,pesign) %{_sysconfdir}/pki/pesign/
-%attr(0660,pesign,pesign) %{_sysconfdir}/pki/pesign/*
+%config(noreplace) %attr(0660,pesign,pesign) %{_sysconfdir}/pki/pesign/*
 %dir %attr(0775,pesign,pesign) %{_sysconfdir}/pki/pesign-rh-test/
-%attr(0664,pesign,pesign) %{_sysconfdir}/pki/pesign-rh-test/*
-%{_libexecdir}/pesign/pesign-authorize-users
-%{_libexecdir}/pesign/pesign-authorize-groups
+%config(noreplace) %attr(0664,pesign,pesign) %{_sysconfdir}/pki/pesign-rh-test/*
+%{_libexecdir}/pesign/pesign-authorize
+%{_libexecdir}/pesign/pesign-rpmbuild-helper
 %config(noreplace)/%{_sysconfdir}/pesign/users
 %config(noreplace)/%{_sysconfdir}/pesign/groups
 %{_sysconfdir}/popt.d/pesign.popt
 %{macrosdir}/macros.pesign
 %{_mandir}/man*/*
-%dir %attr(0770,pesign,pesign) %{_sysconfdir}/pki/pesign
-%attr(0660,pesign,pesign) %{_sysconfdir}/pki/pesign/*
-%dir %attr(0770, pesign, pesign) %{_localstatedir}/run/%{name}
-%ghost %attr(0660, -, -) %{_localstatedir}/run/%{name}/socket
-%ghost %attr(0660, -, -) %{_localstatedir}/run/%{name}/pesign.pid
+%dir %attr(0770, pesign, pesign) %{_rundir}/%{name}
+%ghost %attr(0660, -, -) %{_rundir}/%{name}/socket
+%ghost %attr(0660, -, -) %{_rundir}/%{name}/pesign.pid
 %if 0%{?rhel} >= 7 || 0%{?fedora} >= 17
 %{_tmpfilesdir}/pesign.conf
 %{_unitdir}/pesign.service
 %endif
+%{python3_sitelib}/mockbuild/plugins/*/pesign.*
+%{python3_sitelib}/mockbuild/plugins/pesign.*
+%{_sysusersdir}/pesign.conf
 
 %changelog
+* Mon Jun 22 2026 Nicolas Frayer <nfrayer@redhat.com> - 116-9
+- Fix a FTBFS issue caused by a missing const qualifier
+- Resolves: #2491392
+
+* Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
+- Add sysusers.d config file to allow rpm to create users/groups automatically
+
+* Wed Jan 29 2025 Nicolas Frayer <nfrayer@redhat.com> - 116-7
+- Backport patch to skip auth on friendly slot
+
+* Thu Nov 21 2024 Peter Jones <pjones@redhat.com> - 116-6
+- Work around OpenSC token name changes
+
+* Tue Nov 12 2024 Kevin Fenzi <kevin@scrye.com> - 116-5
+- Rebuild to pick up riscv64 change
+
+* Tue Mar 05 2024 Liu Yang <Yang.Liu.sn@gmail.com> - 116-4
+- Add riscv64.
+
+* Fri Feb 02 2024 Peter Jones <pjones@redhat.com> - 116-3
+- Fix incorrect calloc() invocations caught by -Wcalloc-transposed-args
+
+* Mon Feb 20 2023 Nicolas Frayer <nfrayer@redhat.com> - 116-2
+- cms_common: Fixed Segmentation fault
+
+* Tue Jan 31 2023 Robbie Harwood <rharwood@redhat.com> - 116-1
+- New upstream release (116)
+- Resolves: CVE-2022-3560
+
+* Wed Aug 31 2022 Robbie Harwood <rharwood@redhat.com> - 115-9
+- Roll up to pjones's smartcard/cms fixes
+
+* Tue Aug 02 2022 Robbie Harwood <rharwood@redhat.com> - 115-8
+- Rebuild for python bytecode change
+- See-also: #2107826
+
+* Thu Jul 07 2022 Robbie Harwood <rharwood@redhat.com> - 115-6
+- Fix formatting of man pages
+- Resolves: #2104778
+
+* Mon Apr 04 2022 Robbie Harwood <rharwood@redhat.com> - 115-5
+- Detect presence of rpm-sign when checking for rhel-ness
+
+* Fri Apr 01 2022 Robbie Harwood <rharwood@redhat.com> - 115-4
+- Correctly handle rhel and centos macros
+
+* Fri Mar 25 2022 Robbie Harwood <rharwood@redhat.com> - 115-3
+- Add -D_GLIBCXX_ASSERTIONS to CPPFLAGS
+
+* Thu Mar 24 2022 Robbie Harwood <rharwood@redhat.com> - 115-2
+- Add support for non-koji signing in macros
+- Resolves: #1880858
+
+* Tue Mar 08 2022 Robbie Harwood <rharwood@redhat.com> - 115-1
+- New upstream version (115)
+
+* Mon Feb 14 2022 Robbie Harwood <rharwood@redhat.com> - 114-4
+- Disable -fanalyzer since it's broken and pragmas don't work
+- See-also: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104370
+
+* Mon Feb 14 2022 Robbie Harwood <rharwood@redhat.com> - 114-3
+- Fix explicit NULL deref when daemonizing
+
+* Wed Feb 02 2022 Robbie Harwood <rharwood@redhat.com> - 114-2
+- Attempt to fix signing parsing by dropping pesign_args
+
+* Tue Feb 01 2022 Robbie Harwood <rharwood@redhat.com> - 114-1
+- New upstream version (114)
+
+* Fri Jan 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 113-18
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 113-17
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 113-16
+- Rebuilt for updated systemd-rpm-macros
+  See https://pagure.io/fesco/issue/2583.
+
+* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 113-15
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Mon Nov 16 2020 Jeff Law <law@redhat.com> - 113-14
+- Turn off -Wfree-nonheap-object
+
+* Mon Aug 03 2020 Peter Jones <pjones@redhat.com> - 113-13
+- Add the rundir related stuff that was staged on my f32 checkout.
+
+* Mon Aug 03 2020 Peter Jones <pjones@redhat.com> - 113-12
+- Try to make kernel and fwupd both work at the same time.
+
+* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 113-11
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Thu Jul 16 2020 Peter Jones <pjones@redhat.com> - 113-10
+- I really cannot figure out why bkernel01 thinks the certificate nickname
+  starts with /CN=, but it does, so I'm gonna stop fighting with the sand.
+
+* Thu Jul 16 2020 Peter Jones <pjones@redhat.com> - 113-9
+- Even more kernel build debugging...
+
+* Tue Jul 07 2020 Peter Jones <pjones@redhat.com> - 113-8
+- More kernel build debugging...
+
+* Tue Jul 07 2020 Peter Jones <pjones@redhat.com> - 113-6
+- Disable the pesign-authorize call in posttrans, until we can figure out a
+  better way to deal with that in the fedora kernel builder chroot setup
+
+* Tue Jul 07 2020 Peter Jones <pjones@redhat.com> - 113-5
+- Make pesign require nss-tools for the posttrans scriptlet
+- Move most of macros.pesign to /usr/libexec/pesign/pesign-rpmbuild-helper
+
+* Mon Jul 06 2020 Peter Jones <pjones@redhat.com> - 113-4
+- Attempt to fix kernel signing failures caused by -3...
+
+* Fri Jun 12 2020 Peter Jones <pjones@redhat.com> - 113-3
+- Fix the signer name for fedora and some other minor nits
+  Related: rhbz#1708773
+  Related: rhbz#1678146
+
+* Thu Jun 11 2020 Peter Jones <pjones@redhat.com> - 113-2
+- Fix a signing protocol bug we introduced in 113 that makes the fedora
+  kernel builders fail.
+  Related: rhbz#1708773
+
+* Thu Jun 11 2020 Javier Martinez Canillas <javierm@redhat.com> - 113-1
+- Update to 113 release
+  Resolves: rhbz#1708773
+
+* Mon Jun 08 2020 Javier Martinez Canillas <javierm@redhat.com> - 0.112-31
+- Switch default NSS database to SQLite format (pjones)
+  Resolves: rhbz#1827902
+
+* Mon Feb 24 2020 Peter Jones <pjones@redhat.com> - 0.112-30
+- Make sure the patch for -29 is actually in the build in f32, and
+  synchronize with master.
+
+* Tue Feb 18 2020 Peter Jones <pjones@redhat.com> - 0.112-29
+- Rebuild to match OpenSC's token name mangling change.
+
+* Thu Jan 30 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.112-28
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Tue Nov 12 2019 Peter Jones <pjones@redhat.com> - 0.112-27
+- Rebuild to fix an NSS API issue.	
+
+* Fri Jul 26 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.112-26
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Wed Mar  6 2019 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.112-25
+- Fix build (#1675653)
+- Add missing closing quote in macro (#1651020)
+- Update obsolete /var/run/ path (#1678146)
+
+* Sat Feb 02 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.112-25
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 0.112-24
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
+* Fri Feb 09 2018 Fedora Release Engineering <releng@fedoraproject.org> - 0.112-23
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
+
+* Mon Jan 22 2018 Peter Robinson <pbrobinson@fedoraproject.org> 0.112-22
+- Minor spec cleanups, fix arm conditional
+
+* Fri Oct 06 2017 Troy Dawson <tdawson@redhat.com> - 0.112-21
+- Cleanup spec file conditionals
+
+* Tue Aug 15 2017 Peter Jones <pjones@redhat.com> - 0.112-20
+- Maybe fewer typoes would be better.
+
+* Tue Aug 15 2017 Peter Jones <pjones@redhat.com> - 0.112-19
+- Update to match f26's build so new kernel builds will work.
+
+* Thu Aug 10 2017 Peter Jones <pjones@redhat.com> - 0.112-10
+- Try to fix the db problem nirik is seeing trying to upgrade the builders.
+
+* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.112-9
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
+
+* Thu Jul 27 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.112-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
+
+* Sat Jul 08 2017 Peter Jones <pjones@redhat.com> - 0.112-7
+- Rebuild for efivar-31-1.fc26
+  Related: rhbz#1468841
+
+* Sat Feb 11 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.112-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
+
+* Fri Jan 06 2017 Peter Jones <pjones@redhat.com> - 0.112-5
+- Don't Req: or BuildReq: coolkey or opensc; those belong in system deploy
+  scripts.
+  Related: rhbz#1349073
+
+* Wed Aug 17 2016 Peter Jones <pjones@redhat.com> - 0.112-4
+- Build as -4 to make bodhi happy.
+
 * Fri Aug 12 2016 Adam Williamson <awilliam@redhat.com> - 0.112-3
 - backport fix for command line parsing from upstream master
 

rpminspect.yaml

@@ -0,0 +1,13 @@
+---
+inspections:
+  # Not a Java package
+  javabytecode: off
+
+  # These just flag when things change "too much"
+  changedfiles: off
+  filesize: off
+  patches: off
+  upstream: off
+
+  # https://bugzilla.redhat.com/show_bug.cgi?id=2010936
+  annocheck: off

sources

@@ -1,2 +1,2 @@
-e377e0bc924287ee09356a239c5f51a8  certs.tar.xz
-eae1d66e160be744ff310ad7592ae31e  pesign-0.112.tar.bz2
+SHA512 (certs.tar.xz) = ddac535c786d1a23074534323c4ce89f907d4f82b19c5d3a9c814b145fbac1599cd2386cf20c28d22aee7d5c4db441f052bab9ee655de756117a0a0bc99b525f
+SHA512 (pesign-116.tar.bz2) = be3e1083f5e9f889cb8f7c50a8ebe723542fb2f6d1de8de9b04a9f21526ebaa8ab1efc7d4be11bcb0bc9862fa4bc6f78ee35e4d3496dd3b8927170b97795d25c