Backport DoS fix from 115

Signed-off-by: Robbie Harwood <rharwood@redhat.com>
2022-03-08 18:13:02 +00:00
26 changed files with 1344 additions and 315 deletions
--- a/0001-cms_common-Fixed-Segmentation-fault.patch
+++ b/0001-cms_common-Fixed-Segmentation-fault.patch
@ -1,27 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Nicolas Frayer <nfrayer@redhat.com>
-Date: Mon, 20 Feb 2023 15:26:20 +0100
-Subject: [PATCH] cms_common: Fixed Segmentation fault
-
-When running efikeygen, the binary crashes with a segfault due
-to dereferencing a **ptr instead of a *ptr.
-
-Signed-off-by: Nicolas Frayer <nfrayer@redhat.com>
-(cherry picked from commit 227435af461f38fc4abeafe02884675ad4b1feb4)
---
- src/cms_common.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/cms_common.c b/src/cms_common.c
-index 24576f2..89d946a 100644
--- a/src/cms_common.c
-+++ b/src/cms_common.c
-@@ -956,7 +956,7 @@ find_certificate_by_issuer_and_sn(cms_context *cms,
- 	if (!ias)
- 		cnreterr(-1, cms, "invalid issuer and serial number");
- 
-	return find_certificate_by_callback(cms, match_issuer_and_serial, &ias, cert);
-+	return find_certificate_by_callback(cms, match_issuer_and_serial, ias, cert);
- }
- 
- int
--- a/0001-efikeygen-Fix-the-build-with-nss-3.44.patch
+++ b/0001-efikeygen-Fix-the-build-with-nss-3.44.patch
@ -0,0 +1,42 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Peter Jones <pjones@redhat.com>
+Date: Tue, 14 May 2019 11:28:38 -0400
+Subject: [PATCH] efikeygen: Fix the build with nss 3.44
+
+NSS 3.44 adds some certificate types, which changes a type and makes
+some encoding stuff weird.  As a result, we get:
+
+gcc8 -I/wrkdirs/usr/ports/sysutils/pesign/work/pesign-0.110/include -O2 -pipe  -fstack-protector-strong -Wl,-rpath=/usr/local/lib/gcc8 -isystem /usr/local/include -fno-strict-aliasing  -g -O0 -g -O0  -Wall -fshort-wchar -fno-strict-aliasing -fno-merge-constants --std=gnu99 -D_GNU_SOURCE -Wno-unused-result -Wno-unused-function -I../include/  -I/usr/local/include/nss -I/usr/local/include/nss/nss -I/usr/local/include/nspr  -Werror -fPIC -isystem /usr/local/include -DCONFIG_amd64 -DCONFIG_amd64 -c efikeygen.c -o efikeygen.o
+In file included from /usr/local/include/nss/nss/cert.h:22,
+                 from efikeygen.c:39:
+efikeygen.c: In function 'add_cert_type':
+/usr/local/include/nss/nss/certt.h:445:5: error: unsigned conversion from 'int' to 'unsigned char' changes value from '496' to '240' [-Werror=overflow]
+     (NS_CERT_TYPE_SSL_CLIENT | NS_CERT_TYPE_SSL_SERVER | NS_CERT_TYPE_EMAIL | \
+     ^
+efikeygen.c:208:23: note: in expansion of macro 'NS_CERT_TYPE_APP'
+  unsigned char type = NS_CERT_TYPE_APP;
+                       ^~~~~~~~~~~~~~~~
+cc1: all warnings being treated as errors
+
+This is fixed by just making it an int.
+
+Fixes github issue #48.
+
+Signed-off-by: Peter Jones <pjones@redhat.com>
+---
+ src/efikeygen.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/efikeygen.c b/src/efikeygen.c
+index 121a238..848480a 100644
+--- a/src/efikeygen.c
+++ b/src/efikeygen.c
+@@ -208,7 +208,7 @@ static int
+ add_cert_type(cms_context *cms, void *extHandle, int is_ca)
+ {
+ 	SECItem bitStringValue;
+-	unsigned char type = NS_CERT_TYPE_APP;
+	int type = NS_CERT_TYPE_APP;
+ 
+ 	if (is_ca)
+ 		type |= NS_CERT_TYPE_SSL_CA |
--- a/0002-Fix-reversed-calloc-arguments.patch
+++ b/0002-Fix-reversed-calloc-arguments.patch
@ -1,41 +0,0 @@
-From 1f9e2fa0b4d872fdd01ca3ba81b04dfb1211a187 Mon Sep 17 00:00:00 2001
-From: Stephen Gallagher <sgallagh@redhat.com>
-Date: Fri, 2 Feb 2024 09:32:48 -0500
-Subject: [PATCH] Fix reversed calloc() arguments
-
-The prototype is "void *calloc(size_t nelem, size_t elsize);"
-
-These two instances had them reversed, almost certainly leading to
-buffer overflow issues. This was detected by
-Werror=calloc-transposed-args on gcc.
-
-Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
---
- src/pesigcheck.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/src/pesigcheck.c b/src/pesigcheck.c
-index 6dc67f76a81..8119cf10a7b 100644
--- a/src/pesigcheck.c
-+++ b/src/pesigcheck.c
-@@ -240,7 +240,7 @@ check_signature(pesigcheck_context *ctx, int *nreasons,
- 
- 	cert_iter iter;
- 
-	reasonps = calloc(sizeof(struct reason), 512);
-+	reasonps = calloc(512, sizeof(struct reason));
- 	if (!reasonps)
- 		err(1, "check_signature");
- 
-@@ -281,7 +281,7 @@ check_signature(pesigcheck_context *ctx, int *nreasons,
- 
- 			num_reasons += 16;
- 
-			new_reasons = calloc(sizeof(struct reason), num_reasons);
-+			new_reasons = calloc(num_reasons, sizeof(struct reason));
- 			if (!new_reasons)
- 				err(1, "check_signature");
- 			reasonps = new_reasons;
-- 
-2.41.0
-
--- a/0002-pesigcheck-Fix-a-wrong-assignment.patch
+++ b/0002-pesigcheck-Fix-a-wrong-assignment.patch
@ -0,0 +1,46 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Peter Jones <pjones@redhat.com>
+Date: Tue, 18 Feb 2020 16:28:56 -0500
+Subject: [PATCH] pesigcheck: Fix a wrong assignment
+
+gcc says:
+
+  pesigcheck.c: In function 'check_signature':
+  pesigcheck.c:321:17: error: implicit conversion from 'enum <anonymous>' to 'enum <anonymous>' [-Werror=enum-conversion]
+  321 |    reason->type = siBuffer;
+      |                 ^
+  pesigcheck.c:333:17: error: implicit conversion from 'enum <anonymous>' to 'enum <anonymous>' [-Werror=enum-conversion]
+  333 |    reason->type = siBuffer;
+      |                 ^
+  cc1: all warnings being treated as errors
+
+And indeed, that line of code makes no sense at all - it was supposed to
+be reason->sig.type.
+
+Signed-off-by: Peter Jones <pjones@redhat.com>
+---
+ src/pesigcheck.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/pesigcheck.c b/src/pesigcheck.c
+index 524cce3..8fa0f1a 100644
+--- a/src/pesigcheck.c
+++ b/src/pesigcheck.c
+@@ -318,7 +318,7 @@ check_signature(pesigcheck_context *ctx, int *nreasons,
+ 			reason->type = SIGNATURE;
+ 			reason->sig.data = data;
+ 			reason->sig.len = datalen;
+-			reason->type = siBuffer;
+			reason->sig.type = siBuffer;
+ 			nreason += 1;
+ 			is_invalid = true;
+ 		}
+@@ -330,7 +330,7 @@ check_signature(pesigcheck_context *ctx, int *nreasons,
+ 			reason->type = SIGNATURE;
+ 			reason->sig.data = data;
+ 			reason->sig.len = datalen;
+-			reason->type = siBuffer;
+			reason->sig.type = siBuffer;
+ 			nreason += 1;
+ 			has_valid_cert = true;
+ 		}
--- a/0003-Make-0.112-client-and-server-work-with-the-113-proto.patch
+++ b/0003-Make-0.112-client-and-server-work-with-the-113-proto.patch
@ -0,0 +1,314 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Peter Jones <pjones@redhat.com>
+Date: Thu, 11 Jun 2020 16:23:14 -0400
+Subject: [PATCH] Make 0.112 client and server work with the 113 protocol and
+ vise versa
+
+This makes the version of the sign API that takes a file type optional,
+and makes the client attempt to negotiate which version it's getting.
+It also leaves the server able to still handle the version from before
+the file type was added.
+
+Signed-off-by: Peter Jones <pjones@redhat.com>
+---
+ src/client.c | 74 +++++++++++++++++++++++++++++++++++++++++++-----------------
+ src/daemon.c | 63 ++++++++++++++++++++++++++++++++++-----------------
+ src/daemon.h |  2 ++
+ 3 files changed, 97 insertions(+), 42 deletions(-)
+
+diff --git a/src/client.c b/src/client.c
+index 4a9a44e..a4f1d1d 100644
+--- a/src/client.c
+++ b/src/client.c
+@@ -23,6 +23,7 @@
+ #include <fcntl.h>
+ #include <popt.h>
+ #include <pwd.h>
+#include <stdbool.h>
+ #include <stddef.h>
+ #include <stdlib.h>
+ #include <sys/socket.h>
+@@ -96,8 +97,8 @@ connect_to_server(void)
+ static int32_t
+ check_response(int sd, char **srvmsg);
+ 
+-static void
+-check_cmd_version(int sd, uint32_t command, char *name, int32_t version)
+static int
+check_cmd_version(int sd, uint32_t command, char *name, int32_t version, bool do_exit)
+ {
+ 	struct msghdr msg;
+ 	struct iovec iov[1];
+@@ -116,7 +117,7 @@ check_cmd_version(int sd, uint32_t command, char *name, int32_t version)
+ 	ssize_t n;
+ 	n = sendmsg(sd, &msg, 0);
+ 	if (n < 0) {
+-		fprintf(stderr, "check-cmd-version: kill daemon failed: %m\n");
+		fprintf(stderr, "check-cmd-version: sendmsg failed: %m\n");
+ 		exit(1);
+ 	}
+ 
+@@ -132,11 +133,17 @@ check_cmd_version(int sd, uint32_t command, char *name, int32_t version)
+ 
+ 	char *srvmsg = NULL;
+ 	int32_t rc = check_response(sd, &srvmsg);
+-	if (rc < 0)
+
+	if (do_exit && rc < 0)
+ 		errx(1, "command \"%s\" not known by server", name);
+-	if (rc != version)
+
+	if (do_exit && rc != version)
+ 		errx(1, "command \"%s\": client version %d, server version %d",
+ 			name, version, rc);
+
+	if (rc < 0)
+		return rc;
+	return rc == version;
+ }
+ 
+ static void
+@@ -146,7 +153,7 @@ send_kill_daemon(int sd)
+ 	struct iovec iov;
+ 	pesignd_msghdr pm;
+ 
+-	check_cmd_version(sd, CMD_KILL_DAEMON, "kill-daemon", 0);
+	check_cmd_version(sd, CMD_KILL_DAEMON, "kill-daemon", 0, true);
+ 
+ 	pm.version = PESIGND_VERSION;
+ 	pm.command = CMD_KILL_DAEMON;
+@@ -288,7 +295,7 @@ unlock_token(int sd, char *tokenname, char *pin)
+ 
+ 	uint32_t size1 = pesignd_string_size(pin);
+ 
+-	check_cmd_version(sd, CMD_UNLOCK_TOKEN, "unlock-token", 0);
+	check_cmd_version(sd, CMD_UNLOCK_TOKEN, "unlock-token", 0, true);
+ 
+ 	pm.version = PESIGND_VERSION;
+ 	pm.command = CMD_UNLOCK_TOKEN;
+@@ -365,7 +372,7 @@ is_token_unlocked(int sd, char *tokenname)
+ 
+ 	uint32_t size0 = pesignd_string_size(tokenname);
+ 
+-	check_cmd_version(sd, CMD_IS_TOKEN_UNLOCKED, "is-token-unlocked", 0);
+	check_cmd_version(sd, CMD_IS_TOKEN_UNLOCKED, "is-token-unlocked", 0, true);
+ 
+ 	pm.version = PESIGND_VERSION;
+ 	pm.command = CMD_IS_TOKEN_UNLOCKED;
+@@ -464,6 +471,9 @@ static void
+ sign(int sd, char *infile, char *outfile, char *tokenname, char *certname,
+ 	int attached, uint32_t format)
+ {
+	int rc;
+	bool add_file_type;
+
+ 	int infd = open(infile, O_RDONLY);
+ 	if (infd < 0) {
+ 		fprintf(stderr, "pesign-client: could not open input file "
+@@ -493,12 +503,28 @@ oom:
+ 		exit(1);
+ 	}
+ 
+-	check_cmd_version(sd, attached ? CMD_SIGN_ATTACHED : CMD_SIGN_DETACHED,
+-			attached ? "sign-attached" : "sign-detached", 0);
+	rc = check_cmd_version(sd,
+			       attached ? CMD_SIGN_ATTACHED_WITH_FILE_TYPE
+					: CMD_SIGN_DETACHED_WITH_FILE_TYPE,
+			       attached ? "sign-attached" : "sign-detached",
+			       0, format == FORMAT_KERNEL_MODULE);
+	if (rc >= 0) {
+		add_file_type = true;
+	} else {
+		add_file_type = false;
+		check_cmd_version(sd, attached ? CMD_SIGN_ATTACHED
+					       : CMD_SIGN_DETACHED,
+				  attached ? "sign-attached" : "sign-detached",
+				  0, true);
+	}
+ 
+	printf("add_file_type:%d\n", add_file_type);
+ 	pm->version = PESIGND_VERSION;
+-	pm->command = attached ? CMD_SIGN_ATTACHED : CMD_SIGN_DETACHED;
+-	pm->size = size0 + size1 + sizeof(format);
+	pm->command = attached ? (add_file_type ? CMD_SIGN_ATTACHED_WITH_FILE_TYPE
+						: CMD_SIGN_ATTACHED)
+			       : (add_file_type ? CMD_SIGN_DETACHED_WITH_FILE_TYPE
+						: CMD_SIGN_DETACHED);
+	pm->size = size0 + size1 + (add_file_type ? sizeof(format) : 0);
+ 	iov[0].iov_base = pm;
+ 	iov[0].iov_len = sizeof (*pm);
+ 
+@@ -515,25 +541,31 @@ oom:
+ 	}
+ 
+ 	char *buffer;
+-	buffer = malloc(size0 + size1);
+	buffer = malloc(pm->size);
+ 	if (!buffer)
+ 		goto oom;
+ 
+-	iov[0].iov_base = &format;
+-	iov[0].iov_len = sizeof(format);
+	int pos = 0;
+
+	if (add_file_type) {
+		iov[pos].iov_base = &format;
+		iov[pos].iov_len = sizeof(format);
+		pos++;
+	}
+ 
+ 	pesignd_string *tn = (pesignd_string *)buffer;
+ 	pesignd_string_set(tn, tokenname);
+-	iov[1].iov_base = tn;
+-	iov[1].iov_len = size0;
+	iov[pos].iov_base = tn;
+	iov[pos].iov_len = size0;
+	pos++;
+ 
+ 	pesignd_string *cn = pesignd_string_next(tn);
+ 	pesignd_string_set(cn, certname);
+-	iov[2].iov_base = cn;
+-	iov[2].iov_len = size1;
+	iov[pos].iov_base = cn;
+	iov[pos].iov_len = size1;
+ 
+ 	msg.msg_iov = iov;
+-	msg.msg_iovlen = 3;
+	msg.msg_iovlen = add_file_type ? 3 : 2;
+ 
+ 	n = sendmsg(sd, &msg, 0);
+ 	if (n < 0) {
+@@ -547,7 +579,7 @@ oom:
+ 	send_fd(sd, outfd);
+ 
+ 	char *srvmsg = NULL;
+-	int rc = check_response(sd, &srvmsg);
+	rc = check_response(sd, &srvmsg);
+ 	if (rc < 0) {
+ 		fprintf(stderr, "pesign-client: signing failed: \"%s\"\n",
+ 			srvmsg);
+diff --git a/src/daemon.c b/src/daemon.c
+index 84b9ebc..8522250 100644
+--- a/src/daemon.c
+++ b/src/daemon.c
+@@ -25,6 +25,7 @@
+ #include <poll.h>
+ #include <pwd.h>
+ #include <signal.h>
+#include <stdbool.h>
+ #include <stdlib.h>
+ #include <stdio.h>
+ #include <string.h>
+@@ -569,7 +570,7 @@ out:
+ 
+ static void
+ handle_signing(context *ctx, struct pollfd *pollfd, socklen_t size,
+-	int attached)
+	       int attached, bool with_file_type)
+ {
+ 	struct msghdr msg;
+ 	struct iovec iov;
+@@ -593,8 +594,12 @@ oom:
+ 
+ 	n = recvmsg(pollfd->fd, &msg, MSG_WAITALL);
+ 
+-	file_format = *((uint32_t *) buffer);
+-	n -= sizeof(uint32_t);
+	if (with_file_type) {
+		file_format = *((uint32_t *) buffer);
+		n -= sizeof(uint32_t);
+	} else {
+		file_format = FORMAT_PE_BINARY;
+	}
+ 
+ 	pesignd_string *tn = (pesignd_string *)(buffer + sizeof(uint32_t));
+ 	if (n < (long long)sizeof(tn->size)) {
+@@ -674,34 +679,44 @@ finish:
+ 	teardown_digests(ctx->cms);
+ }
+ 
+static inline void
+handle_sign_helper(context *ctx, struct pollfd *pollfd, socklen_t size,
+		   int attached, bool with_file_type)
+{
+	int rc = cms_context_alloc(&ctx->cms);
+	if (rc < 0)
+		return;
+
+	steal_from_cms(ctx->backup_cms, ctx->cms);
+
+	handle_signing(ctx, pollfd, size, attached, with_file_type);
+
+	hide_stolen_goods_from_cms(ctx->cms, ctx->backup_cms);
+	cms_context_fini(ctx->cms);
+}
+
+ static void
+ handle_sign_attached(context *ctx, struct pollfd *pollfd, socklen_t size)
+ {
+-	int rc = cms_context_alloc(&ctx->cms);
+-	if (rc < 0)
+-		return;
+	handle_sign_helper(ctx, pollfd, size, 1, false);
+}
+ 
+-	steal_from_cms(ctx->backup_cms, ctx->cms);
+-
+-	handle_signing(ctx, pollfd, size, 1);
+-
+-	hide_stolen_goods_from_cms(ctx->cms, ctx->backup_cms);
+-	cms_context_fini(ctx->cms);
+static void
+handle_sign_attached_with_file_type(context *ctx, struct pollfd *pollfd, socklen_t size)
+{
+	handle_sign_helper(ctx, pollfd, size, 1, true);
+ }
+ 
+ static void
+ handle_sign_detached(context *ctx, struct pollfd *pollfd, socklen_t size)
+ {
+-	int rc = cms_context_alloc(&ctx->cms);
+-	if (rc < 0)
+-		return;
+	handle_sign_helper(ctx, pollfd, size, 0, false);
+}
+ 
+-	steal_from_cms(ctx->backup_cms, ctx->cms);
+-
+-	handle_signing(ctx, pollfd, size, 0);
+-
+-	hide_stolen_goods_from_cms(ctx->cms, ctx->backup_cms);
+-	cms_context_fini(ctx->cms);
+static void
+handle_sign_detached_with_file_type(context *ctx, struct pollfd *pollfd, socklen_t size)
+{
+	handle_sign_helper(ctx, pollfd, size, 0, true);
+ }
+ 
+ static void
+@@ -733,6 +748,12 @@ cmd_table_t cmd_table[] = {
+ 		{ CMD_UNLOCK_TOKEN, handle_unlock_token, "unlock-token", 0 },
+ 		{ CMD_SIGN_ATTACHED, handle_sign_attached, "sign-attached", 0 },
+ 		{ CMD_SIGN_DETACHED, handle_sign_detached, "sign-detached", 0 },
+		{ CMD_SIGN_ATTACHED_WITH_FILE_TYPE,
+		  handle_sign_attached_with_file_type,
+		  "sign-attached-with-file-type", 0 },
+		{ CMD_SIGN_DETACHED_WITH_FILE_TYPE,
+		  handle_sign_detached_with_file_type,
+		  "sign-detached-with-file-type", 0 },
+ 		{ CMD_RESPONSE, NULL, "response",  0 },
+ 		{ CMD_IS_TOKEN_UNLOCKED, handle_is_token_unlocked,
+ 			"is-token-unlocked", 0 },
+diff --git a/src/daemon.h b/src/daemon.h
+index 69384ce..0368dc9 100644
+--- a/src/daemon.h
+++ b/src/daemon.h
+@@ -45,6 +45,8 @@ typedef enum {
+ 	CMD_RESPONSE,
+ 	CMD_IS_TOKEN_UNLOCKED,
+ 	CMD_GET_CMD_VERSION,
+	CMD_SIGN_ATTACHED_WITH_FILE_TYPE,
+	CMD_SIGN_DETACHED_WITH_FILE_TYPE,
+ 	CMD_LIST_END
+ } pesignd_cmd;
+ 
--- a/0003-Work-around-OpenSC-changing-token-names-on-fedora-bu.patch
+++ b/0003-Work-around-OpenSC-changing-token-names-on-fedora-bu.patch
@ -1,61 +0,0 @@
-From dc17b1d248c705073a5160e7c871a52aa9ce6e99 Mon Sep 17 00:00:00 2001
-From: Peter Jones <pjones@redhat.com>
-Date: Thu, 21 Nov 2024 13:58:05 -0500
-Subject: [PATCH] Work around OpenSC changing token names on fedora builders
- *again*.
-
-Once again OpenSC has changed how token names work in an incompatible
-way, and we need to work around it even harder on the Fedora kernel
-builders.
-
-Reviewed-by: Kevin Fenzi <kevin@fedoraproject.org>
-Reviewed-by: Justin Forbes <jforbes@fedoraproject.org>
-Signed-off-by: Peter Jones <pjones@redhat.com>
---
- src/macros.pesign             |  3 ++-
- src/pesign-rpmbuild-helper.in | 15 ++++++++++++++-
- 2 files changed, 16 insertions(+), 2 deletions(-)
-
-diff --git a/src/macros.pesign b/src/macros.pesign
-index b7d6af1f6f5..47e3f19f8ed 100644
--- a/src/macros.pesign
-+++ b/src/macros.pesign
-@@ -9,7 +9,8 @@
- %__pesign_token %{nil}%{?pe_signing_token:--token "%{pe_signing_token}"}
- %__pesign_cert %{!?pe_signing_cert:"Red Hat Test Certificate"}%{?pe_signing_cert:"%{pe_signing_cert}"}
- 
-%__pesign_client_token %{!?pe_signing_token:"OpenSC Card (Fedora Signer)"}%{?pe_signing_token:"%{pe_signing_token}"}
-+# See the comment in pesign-rpmbuild-helper.in about the token name here.
-+%__pesign_client_token %{!?pe_signing_token:"OpenSC Card"}%{?pe_signing_token:"%{pe_signing_token}"}
- %__pesign_client_cert %{!?pe_signing_cert:"/CN=Fedora Secure Boot Signer"}%{?pe_signing_cert:"%{pe_signing_cert}"}
- 
- %_pesign /usr/bin/pesign
-diff --git a/src/pesign-rpmbuild-helper.in b/src/pesign-rpmbuild-helper.in
-index 30d5441207b..42de1a1e002 100644
--- a/src/pesign-rpmbuild-helper.in
-+++ b/src/pesign-rpmbuild-helper.in
-@@ -214,7 +214,20 @@ main() {
- 	rm -rf "${sattrs}" "${sattrs}.sig" "${nssdir}"
-     elif [[ -n "${socket}" ]] ; then
- 	### welcome haaaaack city
-	if [[ "${client_token[1]}" = "OpenSC Card (Fedora Signer)" ]] ; then
-+	### different versions of the opensc library name the token different
-+	### things, and as of this commit:
-+	###   https://github.com/OpenSC/OpenSC/commit/259decf656a77a6d1bd3e944d6f198ed70832ff5
-+	### that includes just not including the token label unless there's
-+	### more than one token.  Unfortunately this is both for the displayed
-+	### info and for the token name you specify to /use/ the token, so we
-+	### have to handle all of those options here, and change the name to
-+	### match whatever the current version of opensc is using in the rpm
-+	### macro where we're setting it.  Thankfully this is just a "is this
-+	### Fedora" check for us, and if it's RHEL we're not using OpenSC at
-+	### all.
-+	if [[ "${client_token[1]}" = "OpenSC Card (Fedora Signer)" ]] \
-+	    || [[ "${client_token[1]}" = "Fedora Signer" ]] \
-+	    || [[ "${client_token[1]}" = "OpenSC Card" ]] ; then
- 	    if [[ "${input[1]}" =~ (/|^)vmlinuz($|[_.-]) ]] \
- 	       || [[ "${input[1]}" =~ (/|^)bzImage($|[_.-]) ]] ; then
- 		if [[ "${rhelcertfile}" =~ redhatsecureboot501.* ]] \
-- 
-2.47.0
-
--- a/0004-Rename-var-run-to-run.patch
+++ b/0004-Rename-var-run-to-run.patch
@ -0,0 +1,43 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Peter Jones <pjones@redhat.com>
+Date: Fri, 12 Jun 2020 11:49:44 -0400
+Subject: [PATCH] Rename /var/run/ to /run/
+
+Signed-off-by: Peter Jones <pjones@redhat.com>
+---
+ src/macros.pesign | 12 ++++++------
+ src/tmpfiles.conf |  2 +-
+ 2 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/src/macros.pesign b/src/macros.pesign
+index 7c5cba1..21bf391 100644
+--- a/src/macros.pesign
+++ b/src/macros.pesign
+@@ -45,14 +45,14 @@
+       rm -rf ${sattrs} ${sattrs}.sig ${nss}				\
+     elif [ "$(id -un)" == "kojibuilder" -a				\\\
+            grep -q ID=fedora /etc/os-release -a				\\\
+-           ! -S /var/run/pesign/socket ]; then				\
+           ! -S /run/pesign/socket ]; then				\
+       echo "No socket even though this is kojibuilder" 1>&2		\
+-      ls -ld /var/run/pesign 1>&2					\
+-      ls -l /var/run/pesign/socket 1>&2					\
+-      getfacl /var/run/pesign 1>&2					\
+-      getfacl /var/run/pesign/socket 1>&2				\
+      ls -ld /run/pesign 1>&2					\
+      ls -l /run/pesign/socket 1>&2					\
+      getfacl /run/pesign 1>&2					\
+      getfacl /run/pesign/socket 1>&2				\
+       exit 1								\
+-    elif [ -S /var/run/pesign/socket ]; then				\
+    elif [ -S /run/pesign/socket ]; then				\
+       %{_pesign_client} -t %{__pesign_client_token}			\\\
+                         -c %{__pesign_client_cert}			\\\
+                         %{-i} %{-o} %{-e} %{-s} %{-C}			\
+diff --git a/src/tmpfiles.conf b/src/tmpfiles.conf
+index c1cf355..3375ad5 100644
+--- a/src/tmpfiles.conf
+++ b/src/tmpfiles.conf
+@@ -1 +1 @@
+-D /var/run/pesign 0770 pesign pesign -
+D /run/pesign 0770 pesign pesign -
--- a/0004-cms_common-skip-authentication-on-the-Friendly-slot.patch
+++ b/0004-cms_common-skip-authentication-on-the-Friendly-slot.patch
@ -1,41 +0,0 @@
-From 616ec5f25adbde1a4bd78cdcacd6dcd7ecfa5a5c Mon Sep 17 00:00:00 2001
-From: Gary Lin <glin@suse.com>
-Date: Thu, 22 Dec 2022 13:49:34 +0800
-Subject: [PATCH] cms_common: skip authentication on the 'Friendly' slot
-
-When finding a certificate in a 'Friendly' slot without the need of the
-private key, it is not necessary to authenticate the slot.
-
-For example, when the signed attributes and the raw signature are
-created in a server and the user has the certificate, signkey.x509, and
-tries to import them into myapp.efi:
-
-  $ certutil -N -d nssdb -f passwd
-  $ certutil -A -d nssdb -f passwd -n signkey -t CT,CT,CT \
-      -i signkey.x509
-  $ pesign -n nssdb -c signkey -i myapp.efi -o myapp.efi.signed \
-      -d sha256 -I myapp.sattr -R myapp.sig
-
-Since the "signkey" is 'Friendly', i.e. publicly readable, and the
-private key is not needed, we can just skip the authentication and find
-"signkey" in the slot.
-
-Signed-off-by: Gary Lin <glin@suse.com>
---
- src/cms_common.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/src/cms_common.c b/src/cms_common.c
-index cf572ca..44e5cca 100644
--- a/src/cms_common.c
-+++ b/src/cms_common.c
-@@ -628,7 +628,8 @@ find_certificate(cms_context *cms, int needs_private_key)
- 
- 	int errnum;
- 	SECStatus status;
-	if (PK11_NeedLogin(psle->slot) && !PK11_IsLoggedIn(psle->slot, cms)) {
-+	if ((needs_private_key || !PK11_IsFriendly(psle->slot)) &&
-+	    (PK11_NeedLogin(psle->slot) && !PK11_IsLoggedIn(psle->slot, cms))) {
- 		status = PK11_Authenticate(psle->slot, PR_TRUE, cms);
- 		if (status != SECSuccess) {
- 			save_port_err() {
--- a/0005-Add-const-qualifier-to-variable.patch
+++ b/0005-Add-const-qualifier-to-variable.patch
@ -1,25 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Nicolas Frayer <nfrayer@redhat.com>
-Date: Mon, 22 Jun 2026 20:58:03 +0200
-Subject: [PATCH] Add const qualifier to variable
-
-Add const to a variable initialized with using strrchr.
-
-Signed-off-by: Nicolas Frayer <nfrayer@redhat.com>
---
- src/pesum.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/pesum.c b/src/pesum.c
-index e4ddaf86d7fa..5d7dcb929eec 100644
--- a/src/pesum.c
-+++ b/src/pesum.c
-@@ -141,7 +141,7 @@ main(int argc, char *argv[])
- 	while ((infile = poptGetArg(optCon)) != NULL) {
- 		pesign_context *ctxp = NULL;
- 
-		char *ext = strrchr(infile, '.');
-+		const char *ext = strrchr(infile, '.');
- 		if (ext && strcmp(ext, ".ko") == 0)
- 			fmt = FORMAT_KERNEL_MODULE;
- 
--- a/0005-Apparently-opensc-got-updated-and-the-token-name-cha.patch
+++ b/0005-Apparently-opensc-got-updated-and-the-token-name-cha.patch
@ -0,0 +1,27 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Jeremy Cline <jcline@redhat.com>
+Date: Tue, 18 Feb 2020 16:37:53 -0500
+Subject: [PATCH] Apparently opensc got updated and the token name changed
+
+All the kernel builds started failing yesterday because the signing
+token could not be found. Update the token name in the macro shipped by
+pesign.
+
+Signed-off-by: Peter Jones <pjones@redhat.com>
+---
+ src/macros.pesign | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/macros.pesign b/src/macros.pesign
+index 21bf391..5a6da1c 100644
+--- a/src/macros.pesign
+++ b/src/macros.pesign
+@@ -9,7 +9,7 @@
+ %__pesign_token %{nil}%{?pe_signing_token:-t "%{pe_signing_token}"}
+ %__pesign_cert %{!?pe_signing_cert:"Red Hat Test Certificate"}%{?pe_signing_cert:"%{pe_signing_cert}"}
+ 
+-%__pesign_client_token %{!?pe_signing_token:"Fedora Signer (OpenSC Card)"}%{?pe_signing_token:"%{pe_signing_token}"}
+%__pesign_client_token %{!?pe_signing_token:"OpenSC Card (Fedora Signer)"}%{?pe_signing_token:"%{pe_signing_token}"}
+ %__pesign_client_cert %{!?pe_signing_cert:"/CN=Fedora Secure Boot Signer"}%{?pe_signing_cert:"%{pe_signing_cert}"}
+ 
+ %_pesign /usr/bin/pesign
--- a/0006-client-try-run-and-var-run-for-the-socket-path.patch
+++ b/0006-client-try-run-and-var-run-for-the-socket-path.patch
@ -0,0 +1,83 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Peter Jones <pjones@redhat.com>
+Date: Mon, 6 Jul 2020 16:13:09 -0400
+Subject: [PATCH] client: try /run and /var/run for the socket path.
+
+Signed-off-by: Peter Jones <pjones@redhat.com>
+---
+ src/client.c | 40 +++++++++++++++++++++++++++++-----------
+ 1 file changed, 29 insertions(+), 11 deletions(-)
+
+diff --git a/src/client.c b/src/client.c
+index a4f1d1d..0082be1 100644
+--- a/src/client.c
+++ b/src/client.c
+@@ -61,24 +61,24 @@ print_flag_name(FILE *f, int flag)
+ }
+ 
+ static int
+-connect_to_server(void)
+connect_to_server_helper(const char * const sockpath)
+ {
+-	int rc = access(SOCKPATH, R_OK);
+	int rc = access(sockpath, R_OK);
+ 	if (rc != 0) {
+-		fprintf(stderr, "pesign-client: could not connect to server: "
+-			"%m\n");
+-		exit(1);
+		warn("could not access socket \"%s\"", sockpath);
+		return rc;
+ 	}
+ 
+ 	struct sockaddr_un addr_un = {
+ 		.sun_family = AF_UNIX,
+-		.sun_path = SOCKPATH,
+ 	};
+	strncpy(addr_un.sun_path, sockpath, sizeof(addr_un.sun_path));
+	addr_un.sun_path[sizeof(addr_un.sun_path)-1] = '\0';
+ 
+ 	int sd = socket(AF_UNIX, SOCK_STREAM, 0);
+ 	if (sd < 0) {
+-		fprintf(stderr, "pesign-client: could not open socket: %m\n");
+-		exit(1);
+		warn("could not open socket \"%s\"", sockpath);
+		return sd;
+ 	}
+ 
+ 	socklen_t len = strlen(addr_un.sun_path) +
+@@ -86,14 +86,32 @@ connect_to_server(void)
+ 
+ 	rc = connect(sd, (struct sockaddr *)&addr_un, len);
+ 	if (rc < 0) {
+-		fprintf(stderr, "pesign-client: could not connect to daemon: "
+-			"%m\n");
+-		exit(1);
+		warn("could not connect to daemon");
+		return sd;
+ 	}
+ 
+ 	return sd;
+ }
+ 
+static int
+connect_to_server(void)
+{
+	int rc, i;
+	const char * const sockets[] = {
+		"/run/pesign/socket",
+		"/var/run/pesign/socket",
+		NULL
+	};
+
+	for (i = 0; sockets[i] != NULL; i++) {
+		rc = connect_to_server_helper(sockets[i]);
+		if (rc >= 0)
+			return rc;
+	}
+
+	exit(1);
+}
+
+ static int32_t
+ check_response(int sd, char **srvmsg);
+ 
--- a/0007-client-remove-an-extra-debug-print.patch
+++ b/0007-client-remove-an-extra-debug-print.patch
@ -0,0 +1,22 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Peter Jones <pjones@redhat.com>
+Date: Tue, 14 Jul 2020 16:44:09 -0400
+Subject: [PATCH] client: remove an extra debug print
+
+Signed-off-by: Peter Jones <pjones@redhat.com>
+---
+ src/client.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/src/client.c b/src/client.c
+index 0082be1..c996629 100644
+--- a/src/client.c
+++ b/src/client.c
+@@ -536,7 +536,6 @@ oom:
+ 				  0, true);
+ 	}
+ 
+-	printf("add_file_type:%d\n", add_file_type);
+ 	pm->version = PESIGND_VERSION;
+ 	pm->command = attached ? (add_file_type ? CMD_SIGN_ATTACHED_WITH_FILE_TYPE
+ 						: CMD_SIGN_ATTACHED)
--- a/0008-Move-most-of-macros.pesign-to-pesign-rpmbuild-helper.patch
+++ b/0008-Move-most-of-macros.pesign-to-pesign-rpmbuild-helper.patch
@ -0,0 +1,376 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Peter Jones <pjones@redhat.com>
+Date: Mon, 6 Jul 2020 13:54:35 -0400
+Subject: [PATCH] Move most of macros.pesign to pesign-rpmbuild-helper
+
+Signed-off-by: Peter Jones <pjones@redhat.com>
+---
+ Make.defaults                 |   1 +
+ src/Makefile                  |   8 +-
+ src/macros.pesign             |  74 +++++---------
+ src/pesign-rpmbuild-helper.in | 222 ++++++++++++++++++++++++++++++++++++++++++
+ 4 files changed, 252 insertions(+), 53 deletions(-)
+ create mode 100644 src/pesign-rpmbuild-helper.in
+
+diff --git a/Make.defaults b/Make.defaults
+index 0bacafe..d4cd626 100644
+--- a/Make.defaults
+++ b/Make.defaults
+@@ -16,6 +16,7 @@ INSTALLROOT = $(DESTDIR)
+ 
+ INSTALL	?= install
+ CROSS_COMPILE	?=
+EFI_ARCHES ?= aa64 ia32 x64
+ 
+ PKG_CONFIG = $(CROSS_COMPILE)pkg-config
+ CC	:= $(if $(filter default,$(origin CC)),$(CROSS_COMPILE)gcc,$(CC))
+diff --git a/src/Makefile b/src/Makefile
+index 74327ba..a7ca891 100644
+--- a/src/Makefile
+++ b/src/Makefile
+@@ -5,7 +5,7 @@ include $(TOPDIR)/Make.version
+ include $(TOPDIR)/Make.rules
+ include $(TOPDIR)/Make.defaults
+ 
+-BINTARGETS=authvar client efikeygen efisiglist pesigcheck pesign
+BINTARGETS=authvar client efikeygen efisiglist pesigcheck pesign pesign-rpmbuild-helper
+ SVCTARGETS=pesign.sysvinit pesign.service
+ TARGETS=$(BINTARGETS) $(SVCTARGETS)
+ 
+@@ -49,6 +49,11 @@ pesign : $(call objects-of,$(PESIGN_SOURCES) $(COMMON_SOURCES) $(COMMON_PE_SOURC
+ pesign : LDLIBS+=$(TOPDIR)/libdpe/libdpe.a
+ pesign : PKGS=efivar nss nspr popt
+ 
+pesign-rpmbuild-helper: pesign-rpmbuild-helper.in
+	sed \
+		-e "s/@@EFI_ARCHES@@/$(EFI_ARCHES)/g" \
+		$^ > $@
+
+ deps : PKGS=efivar nss nspr popt uuid
+ deps : $(ALL_SOURCES)
+ 	$(MAKE) -f $(TOPDIR)/Make.deps \
+@@ -94,6 +99,7 @@ install :
+ 	$(INSTALL) -m 644 macros.pesign $(INSTALLROOT)/etc/rpm/
+ 	$(INSTALL) -d -m 755 $(INSTALLROOT)$(libexecdir)/pesign/
+ 	$(INSTALL) -m 750 pesign-authorize $(INSTALLROOT)$(libexecdir)/pesign/
+	$(INSTALL) -m 755 pesign-rpmbuild-helper $(INSTALLROOT)$(libexecdir)/pesign/
+ 	$(INSTALL) -d -m 700 $(INSTALLROOT)/etc/pesign
+ 	$(INSTALL) -m 600 pesign-users $(INSTALLROOT)/etc/pesign/users
+ 	$(INSTALL) -m 600 pesign-groups $(INSTALLROOT)/etc/pesign/groups
+diff --git a/src/macros.pesign b/src/macros.pesign
+index 5a6da1c..34af57c 100644
+--- a/src/macros.pesign
+++ b/src/macros.pesign
+@@ -6,7 +6,7 @@
+ # %pesign -s -i shim.orig -o shim.efi
+ # And magically get the right thing.
+ 
+-%__pesign_token %{nil}%{?pe_signing_token:-t "%{pe_signing_token}"}
+%__pesign_token %{nil}%{?pe_signing_token:--token "%{pe_signing_token}"}
+ %__pesign_cert %{!?pe_signing_cert:"Red Hat Test Certificate"}%{?pe_signing_cert:"%{pe_signing_cert}"}
+ 
+ %__pesign_client_token %{!?pe_signing_token:"OpenSC Card (Fedora Signer)"}%{?pe_signing_token:"%{pe_signing_token}"}
+@@ -24,54 +24,24 @@
+ # -a <input ca cert filename>		# rhel only
+ # -s 					# perform signing
+ %pesign(i:o:C:e:c:n:a:s)						\
+-  _pesign_nssdir=/etc/pki/pesign					\
+-  if [ %{__pesign_cert} = "Red Hat Test Certificate" ]; then		\
+-    _pesign_nssdir=/etc/pki/pesign-rh-test				\
+-  fi									\
+-  if [ -x %{_pesign} ] &&  						\\\
+-       [ "%{_target_cpu}" == "x86_64" -o 				\\\
+-         "%{_target_cpu}" == "aarch64" ]; then				\
+-    if [ "0%{?rhel}" -ge "7" -a -f /usr/bin/rpm-sign ]; then		\
+-      nss=$(mktemp -p $PWD -d)						\
+-      echo > ${nss}/pwfile						\
+-      certutil -N -d ${nss} -f ${nss}/pwfile				\
+-      certutil -A -n "ca" -t "CT,C," -i %{-a*} -d ${nss}		\
+-      certutil -A -n "signer" -t ",c," -i %{-c*} -d ${nss}		\
+-      sattrs=$(mktemp -p $PWD --suffix=.der)				\
+-      %{_pesign} %{-i} -E ${sattrs} --certdir ${nss} --force		\
+-      rpm-sign --key "%{-n*}" --rsadgstsign ${sattrs}			\
+-      %{_pesign} -R ${sattrs}.sig -I ${sattrs} %{-i}			\\\
+-                 --certdir ${nss} -c signer %{-o}			\
+-      rm -rf ${sattrs} ${sattrs}.sig ${nss}				\
+-    elif [ "$(id -un)" == "kojibuilder" -a				\\\
+-           grep -q ID=fedora /etc/os-release -a				\\\
+-           ! -S /run/pesign/socket ]; then				\
+-      echo "No socket even though this is kojibuilder" 1>&2		\
+-      ls -ld /run/pesign 1>&2					\
+-      ls -l /run/pesign/socket 1>&2					\
+-      getfacl /run/pesign 1>&2					\
+-      getfacl /run/pesign/socket 1>&2				\
+-      exit 1								\
+-    elif [ -S /run/pesign/socket ]; then				\
+-      %{_pesign_client} -t %{__pesign_client_token}			\\\
+-                        -c %{__pesign_client_cert}			\\\
+-                        %{-i} %{-o} %{-e} %{-s} %{-C}			\
+-    else								\
+-      %{_pesign} %{__pesign_token} -c %{__pesign_cert}			\\\
+-                 --certdir ${_pesign_nssdir}				\\\
+-                 %{-i} %{-o} %{-e} %{-s} %{-C}				\
+-    fi									\
+-  else									\
+-    if [ -n "%{-i*}" -a -n "%{-o*}" ]; then				\
+-      mv %{-i*} %{-o*}							\
+-    elif [ -n "%{-i*}" -a -n "%{-e*}" ]; then				\
+-      touch %{-e*}							\
+-    fi									\
+-  fi									\
+-  if [ ! -s %{-o} ]; then						\
+-    if [ -e "%{-o*}" ]; then						\
+-      rm -f %{-o*}							\
+-    fi									\
+-    exit 1								\
+-  fi ;
+-
+  %{_libexecdir}/pesign/pesign-rpmbuild-helper				\\\
+    "%{_target_cpu}"							\\\
+    "%{_pesign}"							\\\
+    "%{_pesign_client}"							\\\
+    %{?__pesign_client_token:--client-token %{__pesign_client_token}}	\\\
+    %{?__pesign_client_cert:--client-cert %{__pesign_client_cert}}	\\\
+    %{?__pesign_token:%{__pesign_token}}				\\\
+    %{?__pesign_cert:--cert %{__pesign_cert}}				\\\
+    %{?_buildhost:--hostname "%{_buildhost}"}				\\\
+    %{?vendor:--vendor "%{vendor}"}					\\\
+    %{?_rhel:--rhelver "%{_rhel}"}					\\\
+    %{?-n:--rhelcert %{-n*}}%{?!-n:--rhelcert %{__pesign_cert}}	\\\
+    %{?-a:--rhelcafile "%{-a*}"}					\\\
+    %{?-c:--rhelcertfile "%{-c*}"}					\\\
+    %{?-C:--certout "%{-C*}"}						\\\
+    %{?-e:--sattrout "%{-e*}"}						\\\
+    %{?-i:--in "%{-i*}"}						\\\
+    %{?-o:--out "%{-o*}"}						\\\
+    %{?-s:--sign}							\\\
+    ;									\
+%{nil}
+diff --git a/src/pesign-rpmbuild-helper.in b/src/pesign-rpmbuild-helper.in
+new file mode 100644
+index 0000000..c5287c2
+--- /dev/null
+++ b/src/pesign-rpmbuild-helper.in
+@@ -0,0 +1,222 @@
+#!/bin/bash
+# shellcheck shell=bash
+
+set -eu
+set -x
+
+usage() {
+    local status="${1}" && shift
+    local out
+    if [[ "${status}" -eq 0 ]] ; then
+	out=/dev/stdout
+    else
+	out=/dev/stderr
+    fi
+
+    if [[ $# -gt 0 ]] ; then
+	echo "${0}: error: $*" >>"${out}"
+    fi
+    echo "usage: ${0} TARGET_CPU PESIGN_BINARY PESIGN_CLIENT_BINARY [OPTIONS]" >>"${out}"
+    exit "${status}"
+}
+
+is_efi_arch() {
+    local arch="${1}"
+    local arches=(@@EFI_ARCHES@@)
+    local x
+    for x in "${arches[@]}" ; do
+	if [[ "${arch}" = "${x}" ]] ; then
+	    return 0
+	fi
+    done
+    return 1
+}
+
+error_on_empty() {
+    local f="${1}"
+    if [[ ! -s "${f}" ]] ; then
+	if [[ -e "${f}" ]] ; then
+	    rm -f "${f}"
+	fi
+	echo "${0}: error: empty result file \"${f}\"">>/dev/stderr
+	exit 1
+    fi
+}
+
+main() {
+    if [[ $# -lt 3 ]] ; then
+	usage 1 not enough arguments
+    fi
+    local target_cpu="${1}" && shift
+    local bin="${1}" && shift
+    local client="${1}" && shift
+
+    local rhelcafile="" || :
+    local rhelcertfile="" || :
+
+    local certout=() || :
+    local sattrout=() || :
+    local input=() || :
+    local output=() || :
+    local client_token=() || :
+    local client_cert=() || :
+    local token=() || :
+    local cert=() || :
+    local rhelcert=() || :
+    local rhelver=0 || :
+    local sign="" || :
+    local arch="" || :
+    local vendor="" || :
+    local HOSTNAME="" || :
+
+    while [[ $# -ge 2 ]] ; do
+	case " ${1} " in
+	" --rhelcafile ")
+	    rhelcafile="${2}"
+	    ;;
+	" --rhelcertfile ")
+	    rhelcertfile="${2}"
+	    ;;
+	" --hostname ")
+	    HOSTNAME="${2}"
+	    ;;
+	" --certout ")
+	    certout[0]=-C
+	    certout[1]="${2}"
+	    ;;
+	" --sattrout ")
+	    sattrout[0]=-e
+	    sattrout[1]="${2}"
+	    ;;
+	" --client-token ")
+	    client_token[0]=-t
+	    client_token[1]="${2}"
+	    ;;
+	" --client-cert ")
+	    client_cert[0]=-c
+	    client_cert[1]="${2}"
+	    ;;
+	" --token ")
+	    token[0]=-t
+	    token[1]="${2}"
+	    ;;
+	" --cert ")
+	    cert[0]=-c
+	    cert[1]="${2}"
+	    ;;
+	" --rhelcert ")
+	    rhelcert[0]=-c
+	    rhelcert[1]="${2}"
+	    ;;
+	" --in ")
+	    input[0]=-i
+	    input[1]="${2}"
+	    ;;
+	" --out ")
+	    output[0]=-o
+	    output[1]="${2}"
+	    ;;
+	" --rhelver ")
+	    rhelver="${2}"
+	    ;;
+	" --vendor ")
+	    vendor="${2}"
+	    ;;
+	*)
+	    break
+	    ;;
+	esac
+	shift
+	shift
+    done
+    if [[ $# -ge 1 ]] && [[ "${1}" = --sign ]] ; then
+	sign=-s
+	shift
+    fi
+
+    if [[ -z "${target_cpu}" ]] ; then
+	target_cpu="$(uname -m)"
+    fi
+
+    target_cpu="${target_cpu/i?86/ia32}"
+    target_cpu="${target_cpu/x86_64/x64}"
+    target_cpu="${target_cpu/aarch64/aa64}"
+    target_cpu="${target_cpu/arm*/arm/}"
+
+    local nssdir=/etc/pki/pesign
+    if [[ "${#cert[@]}" -eq 2 ]] &&
+       [[ "${cert[1]}" == "Red Hat Test Certificate" ]] ; then
+	nssdir=/etc/pki/pesign-rh-test
+    fi
+
+    # is_efi_arch is ultimately returning "is pesign configured to sign these
+    # using the rpm macro", so if it isn't, we're just copying the input to
+    # the output
+    if [[ -x "${bin}" ]] && ! is_efi_arch "${target_cpu}" ; then
+	if [[ -n "${input[*]}" ]] && [[ -n "${output[*]}" ]] ; then
+	    cp -v "${input[1]}" "${output[1]}"
+	elif [[ -n "${input[*]}" ]] && [[ -n "${sattrout[*]}" ]] ; then
+	    touch "${sattrout[1]}"
+	fi
+
+	# if there's a 0-sized output file, delete it and error out
+	error_on_empty "${output[1]}"
+	return 0
+    fi
+
+    USERNAME="${USERNAME:-$(id -un)}"
+
+    local socket="" || :
+    if grep -q ID=fedora /etc/os-release \
+       && [[ "${rhelver}" -lt 7 ]] \
+       && [[ "${USERNAME}" = "mockbuild" ]] \
+       && [[ "${vendor}" = "Fedora Project" ]] \
+       && [[ "${HOSTNAME}" =~ bkernel.* ]]
+    then
+	if [[ -S /run/pesign/socket ]] ; then
+	    socket=/run/pesign/socket
+	elif [[ -S /var/run/pesign/socket ]]; then
+	    socket=/var/run/pesign/socket
+	else
+	    echo "Warning: no pesign socket even though user is ${USERNAME}" 1>&2
+	    echo "Warning: if this is a non-scratch koji build, this is wrong" 1>&2
+	    ls -ld /run/pesign /var/run/pesign 1>&2 ||:
+	    ls -l /run/pesign/socket /var/run/pesign/socket 1>&2 ||:
+	    getfacl /run/pesign /run/pesign/socket /var/run/pesign /var/run/pesign/socket 1>&2 ||:
+	    getfacl -n /run/pesign /run/pesign/socket /var/run/pesign /var/run/pesign/socket 1>&2 ||:
+	fi
+    fi
+
+    if [[ "${rhelver}" -ge 7 ]] ; then
+	nssdir="$(mktemp -p "${PWD}" -d)"
+	echo > "${nssdir}/pwfile"
+	certutil -N -d "${nssdir}" -f "${nssdir}/pwfile"
+	certutil -A -n "ca" -t "CTu,CTu,CTu" -i "${rhelcafile}" -d "${nssdir}"
+	certutil -A -n "signer" -t "CTu,CTu,CTu" -i "${rhelcertfile}" -d "${nssdir}"
+	sattrs="$(mktemp -p "${PWD}" --suffix=.der)"
+	"${bin}" -E "${sattrs}" --certdir "${nssdir}" \
+	    "${input[@]}" --force
+	rpm-sign --key "${rhelcert[1]}" --rsadgstsign "${sattrs}"
+	"${bin}" -R "${sattrs}.sig" -I "${sattrs}" \
+	    --certdir "${nssdir}" -c signer \
+	    "${input[@]}" "${output[@]}"
+	rm -rf "${sattrs}" "${sattrs}.sig" "${nssdir}"
+    elif [[ -n "${socket}" ]] ; then
+	"${client}" "${client_token[@]}" "${client_cert[@]}"    \
+	    "${sattrout[@]}" "${certout[@]}"	\
+	    ${sign} "${input[@]}" "${output[@]}"
+    else
+	"${bin}" --certdir "${nssdir}" "${token[@]}"	\
+	    "${cert[@]}" ${sign} "${sattrout[@]}"	\
+	    "${certout[@]}"    "${input[@]}" "${output[@]}"
+    fi
+
+    # if there's a 0-sized output file, delete it and error out
+    if [[ "${#output[@]}" -eq 2 ]] ; then
+	error_on_empty "${output[1]}"
+    fi
+}
+
+main "${@}"
+
+# vim:filetype=sh:fenc=utf-8:tw=78:sts=4:sw=4
--- a/0009-pesign-authorize-shellcheck.patch
+++ b/0009-pesign-authorize-shellcheck.patch
@ -0,0 +1,57 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Peter Jones <pjones@redhat.com>
+Date: Tue, 14 Jul 2020 15:07:32 -0400
+Subject: [PATCH] pesign-authorize: shellcheck
+
+Signed-off-by: Peter Jones <pjones@redhat.com>
+---
+ src/pesign-authorize | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/src/pesign-authorize b/src/pesign-authorize
+index a496f60..55cd5c4 100755
+--- a/src/pesign-authorize
+++ b/src/pesign-authorize
+@@ -12,21 +12,21 @@ set -u
+ # License: GPLv2
+ declare -a fileusers=()
+ declare -a dirusers=()
+-for user in $(cat /etc/pesign/users); do
+while read -r user ; do
+ 	dirusers[${#dirusers[@]}]=-m
+ 	dirusers[${#dirusers[@]}]="u:$user:rwx"
+ 	fileusers[${#fileusers[@]}]=-m
+ 	fileusers[${#fileusers[@]}]="u:$user:rw"
+-done
+done </etc/pesign/users
+ 
+ declare -a filegroups=()
+ declare -a dirgroups=()
+-for group in $(cat /etc/pesign/groups); do
+while read -r group ; do
+ 	dirgroups[${#dirgroups[@]}]=-m
+ 	dirgroups[${#dirgroups[@]}]="g:$group:rwx"
+ 	filegroups[${#filegroups[@]}]=-m
+ 	filegroups[${#filegroups[@]}]="g:$group:rw"
+-done
+done </etc/pesign/groups
+ 
+ update_subdir() {
+ 	subdir=$1 && shift
+@@ -35,12 +35,12 @@ update_subdir() {
+ 	setfacl "${dirusers[@]}" "${dirgroups[@]}" "${subdir}"
+ 	for x in "${subdir}"* ; do
+ 		if [ -d "${x}" ]; then
+-			setfacl -bk ${x}
+-			setfacl "${dirusers[@]}" "${dirgroups[@]}" ${x}
+			setfacl -bk "${x}"
+			setfacl "${dirusers[@]}" "${dirgroups[@]}" "${x}"
+ 			update_subdir "${x}/"
+ 		elif [ -e "${x}" ]; then
+-			setfacl -bk ${x}
+-			setfacl "${fileusers[@]}" "${filegroups[@]}" ${x}
+			setfacl -bk "${x}"
+			setfacl "${fileusers[@]}" "${filegroups[@]}" "${x}"
+ 		else
+ 			:;
+ 		fi
--- a/0010-pesign-authorize-don-t-setfacl-etc-pki-pesign-foo.patch
+++ b/0010-pesign-authorize-don-t-setfacl-etc-pki-pesign-foo.patch
@ -0,0 +1,23 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Peter Jones <pjones@redhat.com>
+Date: Tue, 14 Jul 2020 15:08:15 -0400
+Subject: [PATCH] pesign-authorize: don't setfacl /etc/pki/pesign-foo/
+
+Signed-off-by: Peter Jones <pjones@redhat.com>
+---
+ src/pesign-authorize | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/pesign-authorize b/src/pesign-authorize
+index 55cd5c4..c544832 100755
+--- a/src/pesign-authorize
+++ b/src/pesign-authorize
+@@ -47,7 +47,7 @@ update_subdir() {
+ 	done
+ }
+ 
+-for x in /var/run/pesign/ /etc/pki/pesign*/ ; do
+for x in /var/run/pesign/ /etc/pki/pesign/ ; do
+ 	if [ -d "${x}" ]; then
+ 		update_subdir "${x}"
+ 	else
--- a/0011-kernel-building-hack.patch
+++ b/0011-kernel-building-hack.patch
@ -0,0 +1,38 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Peter Jones <pjones@redhat.com>
+Date: Tue, 14 Jul 2020 16:42:39 -0400
+Subject: [PATCH] kernel building hack
+
+Signed-off-by: Peter Jones <pjones@redhat.com>
+---
+ src/pesign-rpmbuild-helper.in | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/src/pesign-rpmbuild-helper.in b/src/pesign-rpmbuild-helper.in
+index c5287c2..27b8261 100644
+--- a/src/pesign-rpmbuild-helper.in
+++ b/src/pesign-rpmbuild-helper.in
+@@ -202,6 +202,23 @@ main() {
+ 	    "${input[@]}" "${output[@]}"
+ 	rm -rf "${sattrs}" "${sattrs}.sig" "${nssdir}"
+     elif [[ -n "${socket}" ]] ; then
+	### welcome haaaaack city
+	if [[ "${client_token[1]}" = "OpenSC Card (Fedora Signer)" ]] ; then
+	    if [[ "${input[1]}" =~ (/|^)vmlinuz($|[_.-]) ]] \
+	       || [[ "${input[1]}" =~ (/|^)bzImage($|[_.-]) ]] ; then
+		if [[ "${rhelcertfile}" =~ redhatsecureboot501.* ]] \
+		   || [[ "${rhelcertfile}" =~ redhatsecureboot401.* ]] \
+		   || [[ "${rhelcertfile}" =~ centossecureboot201.* ]] ; then
+		    client_cert[1]=kernel-signer
+		elif [[ "${rhelcertfile}" =~ redhatsecureboot502.* ]] \
+		   || [[ "${rhelcertfile}" =~ centossecureboot202.* ]] ; then
+		    client_cert[1]=grub2-signer
+		elif [[ "${rhelcertfile}" =~ redhatsecureboot503.* ]] \
+		   || [[ "${rhelcertfile}" =~ centossecureboot203.* ]] ; then
+		    client_cert[1]=fwupd-signer
+		fi
+	    fi
+	fi
+ 	"${client}" "${client_token[@]}" "${client_cert[@]}"    \
+ 	    "${sattrout[@]}" "${certout[@]}"	\
+ 	    ${sign} "${input[@]}" "${output[@]}"
--- a/0012-Use-run-not-var-run.patch
+++ b/0012-Use-run-not-var-run.patch
@ -0,0 +1,102 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Peter Jones <pjones@redhat.com>
+Date: Thu, 16 Jul 2020 16:28:26 -0400
+Subject: [PATCH] Use /run not /var/run
+
+Signed-off-by: Peter Jones <pjones@redhat.com>
+---
+ src/Makefile           |  2 +-
+ src/daemon.h           |  4 ++--
+ src/pesign-authorize   |  2 +-
+ src/pesign.service.in  |  2 +-
+ src/pesign.sysvinit.in | 10 +++++-----
+ 5 files changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/src/Makefile b/src/Makefile
+index a7ca891..f7fb5fc 100644
+--- a/src/Makefile
+++ b/src/Makefile
+@@ -78,7 +78,7 @@ install_sysvinit: pesign.sysvinit
+ install :
+ 	$(INSTALL) -d -m 700 $(INSTALLROOT)/etc/pki/pesign/
+ 	$(INSTALL) -d -m 700 $(INSTALLROOT)/etc/pki/pesign-rh-test/
+-	$(INSTALL) -d -m 770 $(INSTALLROOT)/var/run/pesign/
+	$(INSTALL) -d -m 770 $(INSTALLROOT)/run/pesign/
+ 	$(INSTALL) -d -m 755 $(INSTALLROOT)$(bindir)
+ 	$(INSTALL) -m 755 authvar $(INSTALLROOT)$(bindir)
+ 	$(INSTALL) -m 755 pesign $(INSTALLROOT)$(bindir)
+diff --git a/src/daemon.h b/src/daemon.h
+index 0368dc9..5fcd97e 100644
+--- a/src/daemon.h
+++ b/src/daemon.h
+@@ -51,8 +51,8 @@ typedef enum {
+ } pesignd_cmd;
+ 
+ #define PESIGND_VERSION 0x2a9edaf0
+-#define SOCKPATH	"/var/run/pesign/socket"
+-#define PIDFILE		"/var/run/pesign.pid"
+#define SOCKPATH	"/run/pesign/socket"
+#define PIDFILE		"/run/pesign.pid"
+ 
+ static inline uint32_t UNUSED
+ pesignd_string_size(char *buffer)
+diff --git a/src/pesign-authorize b/src/pesign-authorize
+index c544832..2381302 100755
+--- a/src/pesign-authorize
+++ b/src/pesign-authorize
+@@ -47,7 +47,7 @@ update_subdir() {
+ 	done
+ }
+ 
+-for x in /var/run/pesign/ /etc/pki/pesign/ ; do
+for x in /run/pesign/ /var/run/pesign/ /etc/pki/pesign/ ; do
+ 	if [ -d "${x}" ]; then
+ 		update_subdir "${x}"
+ 	else
+diff --git a/src/pesign.service.in b/src/pesign.service.in
+index c75a000..4ac2199 100644
+--- a/src/pesign.service.in
+++ b/src/pesign.service.in
+@@ -4,6 +4,6 @@ Description=Pesign signing daemon
+ [Service]
+ PrivateTmp=true
+ Type=forking
+-PIDFile=/var/run/pesign.pid
+PIDFile=/run/pesign.pid
+ ExecStart=/usr/bin/pesign --daemonize
+ ExecStartPost=@@LIBEXECDIR@@/pesign/pesign-authorize
+diff --git a/src/pesign.sysvinit.in b/src/pesign.sysvinit.in
+index b0e0f84..bf8edec 100644
+--- a/src/pesign.sysvinit.in
+++ b/src/pesign.sysvinit.in
+@@ -4,7 +4,7 @@
+ #
+ # chkconfig: - 50 50
+ # processname: /usr/bin/pesign
+-# pidfile: /var/run/pesign.pid
+# pidfile: /run/pesign.pid
+ ### BEGIN INIT INFO 
+ # Provides: pesign
+ # Default-Start:
+@@ -20,9 +20,9 @@ RETVAL=0
+ 
+ start(){
+     echo -n "Starting pesign: "
+-    mkdir /var/run/pesign 2>/dev/null &&
+-        chown pesign:pesign /var/run/pesign &&
+-        chmod 0770 /var/run/pesign
+    mkdir /run/pesign 2>/dev/null &&
+        chown pesign:pesign /run/pesign &&
+        chmod 0770 /run/pesign
+     daemon /usr/bin/pesign --daemonize
+     RETVAL=$?
+     echo
+@@ -32,7 +32,7 @@ start(){
+ 
+ stop(){
+     echo -n "Stopping pesign: "
+-    killproc -p /var/run/pesign.pid pesignd
+    killproc -p /run/pesign.pid pesignd
+     RETVAL=$?
+     echo
+     rm -f /var/lock/subsys/pesign
--- a/0013-Turn-off-Wfree-nonheap-object.patch
+++ b/0013-Turn-off-Wfree-nonheap-object.patch
@ -0,0 +1,32 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Jeff Law <law@redhat.com>
+Date: Mon, 16 Nov 2020 12:07:59 -0700
+Subject: [PATCH] Turn off -Wfree-nonheap-object
+
+authvar.c has a call to free (tokenname) where tokenname is set to a string constant
+and never changed.  That triggers GCC to issue a diagnostic that the value should not
+be passed to free.
+
+This is a false positive from GCC as the call is guarded by a suitable condition that
+always happens to be false.  But pesign is being built without optimization and thus
+the condition and free call are not optimized away.
+
+This patch just disables the warning.  A better solution would be to fix the sources
+or build with the optimizer enabled.
+---
+ Make.defaults | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Make.defaults b/Make.defaults
+index d4cd626..705cc3a 100644
+--- a/Make.defaults
+++ b/Make.defaults
+@@ -40,7 +40,7 @@ gcc_cflags = -Wmaybe-uninitialized -grecord-gcc-switches -flto
+ cflags	= $(CFLAGS) $(ARCH3264) \
+ 	-Wall -Wextra -Wsign-compare -Wno-unused-result \
+ 	-Wno-unused-function -Wno-missing-field-initializers \
+-	-Werror -Wno-error=cpp \
+	-Werror -Wno-error=cpp -Wno-free-nonheap-object \
+ 	-std=gnu11 -fshort-wchar -fPIC -fno-strict-aliasing \
+ 	-D_GNU_SOURCE -DCONFIG_$(ARCH) -I${TOPDIR}/include \
+ 	$(if $(filter $(CC),clang),$(clang_cflags), ) \
--- a/0013-Turn-off-free-nonheap-object.patch
+++ b/0013-Turn-off-free-nonheap-object.patch
@ -0,0 +1,35 @@
+From 59428daf4863f192419eee4afec15cd099e99c9b Mon Sep 17 00:00:00 2001
+From: Jeff Law <law@redhat.com>
+Date: Mon, 16 Nov 2020 12:07:59 -0700
+Subject: [PATCH] Turn off -Wfree-nonheap-object
+
+authvar.c has a call to free (tokenname) where tokenname is set to a string constant
+and never changed.  That triggers GCC to issue a diagnostic that the value should not
+be passed to free.
+
+This is a false positive from GCC as the call is guarded by a suitable condition that
+always happens to be false.  But pesign is being built without optimization and thus
+the condition and free call are not optimized away.
+
+This patch just disables the warning.  A better solution would be to fix the sources
+or build with the optimizer enabled.
+---
+ Make.defaults | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Make.defaults b/Make.defaults
+index d4cd626..705cc3a 100644
+--- a/Make.defaults
+++ b/Make.defaults
+@@ -40,7 +40,7 @@ gcc_cflags = -Wmaybe-uninitialized -grecord-gcc-switches -flto
+ cflags	= $(CFLAGS) $(ARCH3264) \
+ 	-Wall -Wextra -Wsign-compare -Wno-unused-result \
+ 	-Wno-unused-function -Wno-missing-field-initializers \
+-	-Werror -Wno-error=cpp \
+	-Werror -Wno-error=cpp -Wno-free-nonheap-object \
+ 	-std=gnu11 -fshort-wchar -fPIC -fno-strict-aliasing \
+ 	-D_GNU_SOURCE -DCONFIG_$(ARCH) -I${TOPDIR}/include \
+ 	$(if $(filter $(CC),clang),$(clang_cflags), ) \
+-- 
+2.28.0
+
--- a/0014-Fix-bad-free-of-cms-data-DoS-only.patch
+++ b/0014-Fix-bad-free-of-cms-data-DoS-only.patch
@ -0,0 +1,39 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Robbie Harwood <rharwood@redhat.com>
+Date: Thu, 3 Mar 2022 15:37:02 -0500
+Subject: [PATCH] Fix bad free of cms data (DoS only)
+
+handle_unlock_token() set the CMS data to an offset of an allocated
+buffer, rather than something allocated in its own right.
+cms_set_pw_data() would then attempt to free this value.  Additionally,
+should pesignd not take SIGABRT at that point, handle_unlock_token()
+would then also free buffer.
+
+Signed-off-by: Robbie Harwood <rharwood@redhat.com>
+(cherry picked from commit 7b78af412dc0ca5db54c426a13550cf35caa9516)
+---
+ src/daemon.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/src/daemon.c b/src/daemon.c
+index 8522250..3ae3c8d 100644
+--- a/src/daemon.c
+++ b/src/daemon.c
+@@ -166,6 +166,7 @@ handle_unlock_token(context *ctx, struct pollfd *pollfd, socklen_t size)
+ 	struct msghdr msg;
+ 	struct iovec iov;
+ 	ssize_t n;
+	char *pin = NULL;
+ 
+ 	int rc = cms_context_alloc(&ctx->cms);
+ 	if (rc < 0) {
+@@ -233,7 +234,8 @@ malformed:
+ 	if (!ctx->cms->tokenname)
+ 		goto oom;
+ 
+-	char *pin = (char *)tp->value;
+	if (!tp->value)
+		pin = strndup((char *)tp->value, tp->size);
+ 	if (!pin)
+ 		goto oom;
+ 
--- a/0015-daemon-remove-always-true-comparison.patch
+++ b/0015-daemon-remove-always-true-comparison.patch
@ -0,0 +1,25 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Robbie Harwood <rharwood@redhat.com>
+Date: Tue, 8 Mar 2022 12:59:34 -0500
+Subject: [PATCH] daemon: remove always-true comparison
+
+Signed-off-by: Robbie Harwood <rharwood@redhat.com>
+(cherry picked from commit 500ee15d26630066baaa48dea1dbfd614d8ea225)
+---
+ src/daemon.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/src/daemon.c b/src/daemon.c
+index 3ae3c8d..1179cb3 100644
+--- a/src/daemon.c
+++ b/src/daemon.c
+@@ -234,8 +234,7 @@ malformed:
+ 	if (!ctx->cms->tokenname)
+ 		goto oom;
+ 
+-	if (!tp->value)
+-		pin = strndup((char *)tp->value, tp->size);
+	pin = strndup((char *)tp->value, tp->size);
+ 	if (!pin)
+ 		goto oom;
+ 
--- a/0
+++ b/0
--- a/pesign.patches
+++ b/pesign.patches
@ -1,5 +0,0 @@
-Patch0001: 0001-cms_common-Fixed-Segmentation-fault.patch
-Patch0002: 0002-Fix-reversed-calloc-arguments.patch
-Patch0003: 0003-Work-around-OpenSC-changing-token-names-on-fedora-bu.patch
-Patch0004: 0004-cms_common-skip-authentication-on-the-Friendly-slot.patch
-Patch0005: 0005-Add-const-qualifier-to-variable.patch
--- a/pesign.spec
+++ b/pesign.spec
@ -1,33 +1,29 @@
 %global macrosdir %(d=%{_rpmconfigdir}/macros.d; [ -d $d ] || d=%{_sysconfdir}/rpm; echo $d)

-# No.  I have enough trouble already.
-%undefine _auto_set_build_flags
-
 Name:    pesign
 Summary: Signing utility for UEFI binaries
-Version: 116
-Release: 9%{?dist}
-License: GPL-2.0-only
-URL:     https://github.com/rhboot/pesign
+Version: 113
+Release: 18%{?dist}
+License: GPLv2
+URL:     https://github.com/vathpela/pesign

 Obsoletes: pesign-rh-test-certs <= 0.111-7
-BuildRequires: efivar-devel >= 38-1
+BuildRequires: make
 BuildRequires: gcc
 BuildRequires: git
-BuildRequires: libuuid-devel
-BuildRequires: make
-BuildRequires: mandoc
 BuildRequires: nspr
-BuildRequires: nspr-devel >= 4.9.2-1
 BuildRequires: nss
-BuildRequires: nss-devel >= 3.13.6-1
-BuildRequires: nss-tools
 BuildRequires: nss-util
 BuildRequires: popt-devel
-BuildRequires: python3
-BuildRequires: python3-rpm-macros
+BuildRequires: nss-tools
+BuildRequires: nspr-devel >= 4.9.2-1
+BuildRequires: nss-devel >= 3.13.6-1
+BuildRequires: efivar-devel >= 31-1
+BuildRequires: libuuid-devel
 BuildRequires: tar
 BuildRequires: xz
+BuildRequires: python3-rpm-macros
+BuildRequires: python3
 %if 0%{?rhel} >= 7 || 0%{?fedora} >= 17
 BuildRequires: systemd-rpm-macros
 %endif
@ -37,7 +33,8 @@ Requires:      nss-tools >= 3.53
 Requires:      nss-util
 Requires:      popt
 Requires:      rpm
-ExclusiveArch: %{ix86} x86_64 ia64 aarch64 %{arm} riscv64
+Requires(pre): shadow-utils
+ExclusiveArch: %{ix86} x86_64 ia64 aarch64 %{arm}
 %if 0%{?rhel} == 7
 BuildRequires: rh-signing-tools >= 1.20-2
 %endif
@ -45,10 +42,22 @@ BuildRequires: rh-signing-tools >= 1.20-2
 Source0: https://github.com/rhboot/pesign/releases/download/%{version}/pesign-%{version}.tar.bz2
 Source1: certs.tar.xz
 Source2: pesign.py
-Source3: pesign.patches

-# generate with tool
-%include %{SOURCE3}
+Patch0001: 0001-efikeygen-Fix-the-build-with-nss-3.44.patch
+Patch0002: 0002-pesigcheck-Fix-a-wrong-assignment.patch
+Patch0003: 0003-Make-0.112-client-and-server-work-with-the-113-proto.patch
+Patch0004: 0004-Rename-var-run-to-run.patch
+Patch0005: 0005-Apparently-opensc-got-updated-and-the-token-name-cha.patch
+Patch0006: 0006-client-try-run-and-var-run-for-the-socket-path.patch
+Patch0007: 0007-client-remove-an-extra-debug-print.patch
+Patch0008: 0008-Move-most-of-macros.pesign-to-pesign-rpmbuild-helper.patch
+Patch0009: 0009-pesign-authorize-shellcheck.patch
+Patch0010: 0010-pesign-authorize-don-t-setfacl-etc-pki-pesign-foo.patch
+Patch0011: 0011-kernel-building-hack.patch
+Patch0012: 0012-Use-run-not-var-run.patch
+Patch0013: 0013-Turn-off-free-nonheap-object.patch
+Patch0014: 0014-Fix-bad-free-of-cms-data-DoS-only.patch
+Patch0015: 0015-daemon-remove-always-true-comparison.patch

 %description
 This package contains the pesign utility for signing UEFI binaries as
@ -66,11 +75,6 @@ git am %{patches} </dev/null
 git config --unset user.email
 git config --unset user.name

-# Create a sysusers.d config file
-cat >pesign.sysusers.conf <<EOF
-u pesign - 'Group for the pesign signing daemon' /run/pesign -
-EOF
-
 %build
 make PREFIX=%{_prefix} LIBDIR=%{_libdir}

@ -105,8 +109,12 @@ cp -av libdpe/*.[ch] src/
 install -d -m 0755 %{buildroot}%{python3_sitelib}/mockbuild/plugins/
 install -m 0755 %{SOURCE2} %{buildroot}%{python3_sitelib}/mockbuild/plugins/

-install -m0644 -D pesign.sysusers.conf %{buildroot}%{_sysusersdir}/pesign.conf
-
+%pre
+getent group pesign >/dev/null || groupadd -r pesign
+getent passwd pesign >/dev/null || \
+	useradd -r -g pesign -d /run/pesign -s /sbin/nologin \
+		-c "Group for the pesign signing daemon" pesign
+exit 0

 %if 0%{?rhel} >= 7 || 0%{?fedora} >= 17
 %post
@ -132,13 +140,13 @@ certutil -d %{_sysconfdir}/pki/pesign/ -X -L > /dev/null
 %files
 %{!?_licensedir:%global license %%doc}
 %license COPYING
-%doc README.md TODO
+%doc README TODO
 %{_bindir}/authvar
 %{_bindir}/efikeygen
+%{_bindir}/efisiglist
 %{_bindir}/pesigcheck
 %{_bindir}/pesign
 %{_bindir}/pesign-client
-%{_bindir}/pesum
 %dir %{_libexecdir}/pesign/
 %dir %attr(0770,pesign,pesign) %{_sysconfdir}/pki/pesign/
 %config(noreplace) %attr(0660,pesign,pesign) %{_sysconfdir}/pki/pesign/*
@ -160,80 +168,10 @@ certutil -d %{_sysconfdir}/pki/pesign/ -X -L > /dev/null
 %endif
 %{python3_sitelib}/mockbuild/plugins/*/pesign.*
 %{python3_sitelib}/mockbuild/plugins/pesign.*
-%{_sysusersdir}/pesign.conf

 %changelog
-* Mon Jun 22 2026 Nicolas Frayer <nfrayer@redhat.com> - 116-9
- Fix a FTBFS issue caused by a missing const qualifier
- Resolves: #2491392
-
-* Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
- Add sysusers.d config file to allow rpm to create users/groups automatically
-
-* Wed Jan 29 2025 Nicolas Frayer <nfrayer@redhat.com> - 116-7
- Backport patch to skip auth on friendly slot
-
-* Thu Nov 21 2024 Peter Jones <pjones@redhat.com> - 116-6
- Work around OpenSC token name changes
-
-* Tue Nov 12 2024 Kevin Fenzi <kevin@scrye.com> - 116-5
- Rebuild to pick up riscv64 change
-
-* Tue Mar 05 2024 Liu Yang <Yang.Liu.sn@gmail.com> - 116-4
- Add riscv64.
-
-* Fri Feb 02 2024 Peter Jones <pjones@redhat.com> - 116-3
- Fix incorrect calloc() invocations caught by -Wcalloc-transposed-args
-
-* Mon Feb 20 2023 Nicolas Frayer <nfrayer@redhat.com> - 116-2
- cms_common: Fixed Segmentation fault
-
-* Tue Jan 31 2023 Robbie Harwood <rharwood@redhat.com> - 116-1
- New upstream release (116)
- Resolves: CVE-2022-3560
-
-* Wed Aug 31 2022 Robbie Harwood <rharwood@redhat.com> - 115-9
- Roll up to pjones's smartcard/cms fixes
-
-* Tue Aug 02 2022 Robbie Harwood <rharwood@redhat.com> - 115-8
- Rebuild for python bytecode change
- See-also: #2107826
-
-* Thu Jul 07 2022 Robbie Harwood <rharwood@redhat.com> - 115-6
- Fix formatting of man pages
- Resolves: #2104778
-
-* Mon Apr 04 2022 Robbie Harwood <rharwood@redhat.com> - 115-5
- Detect presence of rpm-sign when checking for rhel-ness
-
-* Fri Apr 01 2022 Robbie Harwood <rharwood@redhat.com> - 115-4
- Correctly handle rhel and centos macros
-
-* Fri Mar 25 2022 Robbie Harwood <rharwood@redhat.com> - 115-3
- Add -D_GLIBCXX_ASSERTIONS to CPPFLAGS
-
-* Thu Mar 24 2022 Robbie Harwood <rharwood@redhat.com> - 115-2
- Add support for non-koji signing in macros
- Resolves: #1880858
-
-* Tue Mar 08 2022 Robbie Harwood <rharwood@redhat.com> - 115-1
- New upstream version (115)
-
-* Mon Feb 14 2022 Robbie Harwood <rharwood@redhat.com> - 114-4
- Disable -fanalyzer since it's broken and pragmas don't work
- See-also: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104370
-
-* Mon Feb 14 2022 Robbie Harwood <rharwood@redhat.com> - 114-3
- Fix explicit NULL deref when daemonizing
-
-* Wed Feb 02 2022 Robbie Harwood <rharwood@redhat.com> - 114-2
- Attempt to fix signing parsing by dropping pesign_args
-
-* Tue Feb 01 2022 Robbie Harwood <rharwood@redhat.com> - 114-1
- New upstream version (114)
-
-* Fri Jan 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 113-18
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+* Tue Mar 08 2022 Robbie Harwood <rharwood@redhat.com> - 113-18
+- Backport DoS fix from 115

 * Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 113-17
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
--- a/rpminspect.yaml
+++ b/rpminspect.yaml
@ -1,13 +0,0 @@
---
-inspections:
-  # Not a Java package
-  javabytecode: off
-
-  # These just flag when things change "too much"
-  changedfiles: off
-  filesize: off
-  patches: off
-  upstream: off
-
-  # https://bugzilla.redhat.com/show_bug.cgi?id=2010936
-  annocheck: off
--- a/2
+++ b/2
@ -1,2 +1,2 @@
 SHA512 (certs.tar.xz) = ddac535c786d1a23074534323c4ce89f907d4f82b19c5d3a9c814b145fbac1599cd2386cf20c28d22aee7d5c4db441f052bab9ee655de756117a0a0bc99b525f
-SHA512 (pesign-116.tar.bz2) = be3e1083f5e9f889cb8f7c50a8ebe723542fb2f6d1de8de9b04a9f21526ebaa8ab1efc7d4be11bcb0bc9862fa4bc6f78ee35e4d3496dd3b8927170b97795d25c
+SHA512 (pesign-113.tar.bz2) = 89c5e33bf6ac8f8dc4b65192e5fd4bf1fea285106d1de2a6ea02a8c5090f2ec5976b1d80c60e57f74fa56dc25b174a4dd5682292db44ab9aeab69ea992dfef36