0004-cms_common-skip-authentication-on-the-Friendly-slot.patch

@@ -1,41 +0,0 @@
-From 616ec5f25adbde1a4bd78cdcacd6dcd7ecfa5a5c Mon Sep 17 00:00:00 2001
-From: Gary Lin <glin@suse.com>
-Date: Thu, 22 Dec 2022 13:49:34 +0800
-Subject: [PATCH] cms_common: skip authentication on the 'Friendly' slot
-
-When finding a certificate in a 'Friendly' slot without the need of the
-private key, it is not necessary to authenticate the slot.
-
-For example, when the signed attributes and the raw signature are
-created in a server and the user has the certificate, signkey.x509, and
-tries to import them into myapp.efi:
-
-  $ certutil -N -d nssdb -f passwd
-  $ certutil -A -d nssdb -f passwd -n signkey -t CT,CT,CT \
-      -i signkey.x509
-  $ pesign -n nssdb -c signkey -i myapp.efi -o myapp.efi.signed \
-      -d sha256 -I myapp.sattr -R myapp.sig
-
-Since the "signkey" is 'Friendly', i.e. publicly readable, and the
-private key is not needed, we can just skip the authentication and find
-"signkey" in the slot.
-
-Signed-off-by: Gary Lin <glin@suse.com>
----
- src/cms_common.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/src/cms_common.c b/src/cms_common.c
-index cf572ca..44e5cca 100644
---- a/src/cms_common.c
-+++ b/src/cms_common.c
-@@ -628,7 +628,8 @@ find_certificate(cms_context *cms, int needs_private_key)
- 
- 	int errnum;
- 	SECStatus status;
--	if (PK11_NeedLogin(psle->slot) && !PK11_IsLoggedIn(psle->slot, cms)) {
-+	if ((needs_private_key || !PK11_IsFriendly(psle->slot)) &&
-+	    (PK11_NeedLogin(psle->slot) && !PK11_IsLoggedIn(psle->slot, cms))) {
- 		status = PK11_Authenticate(psle->slot, PR_TRUE, cms);
- 		if (status != SECSuccess) {
- 			save_port_err() {

0005-Add-const-qualifier-to-variable.patch

@@ -1,25 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Nicolas Frayer <nfrayer@redhat.com>
-Date: Mon, 22 Jun 2026 20:58:03 +0200
-Subject: [PATCH] Add const qualifier to variable
-
-Add const to a variable initialized with using strrchr.
-
-Signed-off-by: Nicolas Frayer <nfrayer@redhat.com>
----
- src/pesum.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/pesum.c b/src/pesum.c
-index e4ddaf86d7fa..5d7dcb929eec 100644
---- a/src/pesum.c
-+++ b/src/pesum.c
-@@ -141,7 +141,7 @@ main(int argc, char *argv[])
- 	while ((infile = poptGetArg(optCon)) != NULL) {
- 		pesign_context *ctxp = NULL;
- 
--		char *ext = strrchr(infile, '.');
-+		const char *ext = strrchr(infile, '.');
- 		if (ext && strcmp(ext, ".ko") == 0)
- 			fmt = FORMAT_KERNEL_MODULE;
- 

package.cfg

@@ -0,0 +1,3 @@
+[koji]
+targets = rawhide eln
+

pesign.patches

@@ -1,5 +1,3 @@
 Patch0001: 0001-cms_common-Fixed-Segmentation-fault.patch
 Patch0002: 0002-Fix-reversed-calloc-arguments.patch
 Patch0003: 0003-Work-around-OpenSC-changing-token-names-on-fedora-bu.patch
-Patch0004: 0004-cms_common-skip-authentication-on-the-Friendly-slot.patch
-Patch0005: 0005-Add-const-qualifier-to-variable.patch

pesign.spec

@@ -6,7 +6,7 @@
 Name:    pesign
 Summary: Signing utility for UEFI binaries
 Version: 116
-Release: 9%{?dist}
+Release: 6%{?dist}
 License: GPL-2.0-only
 URL:     https://github.com/rhboot/pesign
 
@@ -37,6 +37,7 @@ Requires:      nss-tools >= 3.53
 Requires:      nss-util
 Requires:      popt
 Requires:      rpm
+Requires(pre): shadow-utils
 ExclusiveArch: %{ix86} x86_64 ia64 aarch64 %{arm} riscv64
 %if 0%{?rhel} == 7
 BuildRequires: rh-signing-tools >= 1.20-2
@@ -66,11 +67,6 @@ git am %{patches} </dev/null
 git config --unset user.email
 git config --unset user.name
 
-# Create a sysusers.d config file
-cat >pesign.sysusers.conf <<EOF
-u pesign - 'Group for the pesign signing daemon' /run/pesign -
-EOF
-
 %build
 make PREFIX=%{_prefix} LIBDIR=%{_libdir}
 
@@ -105,8 +101,12 @@ cp -av libdpe/*.[ch] src/
 install -d -m 0755 %{buildroot}%{python3_sitelib}/mockbuild/plugins/
 install -m 0755 %{SOURCE2} %{buildroot}%{python3_sitelib}/mockbuild/plugins/
 
-install -m0644 -D pesign.sysusers.conf %{buildroot}%{_sysusersdir}/pesign.conf
-
+%pre
+getent group pesign >/dev/null || groupadd -r pesign
+getent passwd pesign >/dev/null || \
+	useradd -r -g pesign -d /run/pesign -s /sbin/nologin \
+		-c "Group for the pesign signing daemon" pesign
+exit 0
 
 %if 0%{?rhel} >= 7 || 0%{?fedora} >= 17
 %post
@@ -160,19 +160,8 @@ certutil -d %{_sysconfdir}/pki/pesign/ -X -L > /dev/null
 %endif
 %{python3_sitelib}/mockbuild/plugins/*/pesign.*
 %{python3_sitelib}/mockbuild/plugins/pesign.*
-%{_sysusersdir}/pesign.conf
 
 %changelog
-* Mon Jun 22 2026 Nicolas Frayer <nfrayer@redhat.com> - 116-9
-- Fix a FTBFS issue caused by a missing const qualifier
-- Resolves: #2491392
-
-* Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
-- Add sysusers.d config file to allow rpm to create users/groups automatically
-
-* Wed Jan 29 2025 Nicolas Frayer <nfrayer@redhat.com> - 116-7
-- Backport patch to skip auth on friendly slot
-
 * Thu Nov 21 2024 Peter Jones <pjones@redhat.com> - 116-6
 - Work around OpenSC token name changes