From 8378c0c039bcfa38a2e558921758344090874830 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 23 Jul 2022 08:20:14 +0000 Subject: [PATCH 01/15] Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- secvarctl.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/secvarctl.spec b/secvarctl.spec index d9123c9..f48cece 100644 --- a/secvarctl.spec +++ b/secvarctl.spec @@ -1,6 +1,6 @@ Name: secvarctl Version: 0.3 -Release: 3%{?dist} +Release: 4%{?dist} Summary: A command line tool for managing Secure Boot Variables on POWER License: ASL 2.0 @@ -44,6 +44,9 @@ The sub-commands are: %changelog +* Sat Jul 23 2022 Fedora Release Engineering - 0.3-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + * Sat Jan 22 2022 Morten Stevens - 0.3-3 - Rebuilt for mbedTLS 2.28.0 From 82009af03c41724ddb8219a63389b5c8bf2bab5e Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 21 Jan 2023 02:57:59 +0000 Subject: [PATCH 02/15] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- secvarctl.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/secvarctl.spec b/secvarctl.spec index f48cece..4097942 100644 --- a/secvarctl.spec +++ b/secvarctl.spec @@ -1,6 +1,6 @@ Name: secvarctl Version: 0.3 -Release: 4%{?dist} +Release: 5%{?dist} Summary: A command line tool for managing Secure Boot Variables on POWER License: ASL 2.0 @@ -44,6 +44,9 @@ The sub-commands are: %changelog +* Sat Jan 21 2023 Fedora Release Engineering - 0.3-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Sat Jul 23 2022 Fedora Release Engineering - 0.3-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild From 7c34b70776bafad57d7a356c68e7e47acb1b7b85 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 22 Jul 2023 01:22:18 +0000 Subject: [PATCH 03/15] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- secvarctl.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/secvarctl.spec b/secvarctl.spec index 4097942..6f54056 100644 --- a/secvarctl.spec +++ b/secvarctl.spec @@ -1,6 +1,6 @@ Name: secvarctl Version: 0.3 -Release: 5%{?dist} +Release: 6%{?dist} Summary: A command line tool for managing Secure Boot Variables on POWER License: ASL 2.0 @@ -44,6 +44,9 @@ The sub-commands are: %changelog +* Sat Jul 22 2023 Fedora Release Engineering - 0.3-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Sat Jan 21 2023 Fedora Release Engineering - 0.3-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild From 176cc2b8c3c77a752e16610a6377c2bd9ca2f522 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 27 Jan 2024 02:31:31 +0000 Subject: [PATCH 04/15] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- secvarctl.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/secvarctl.spec b/secvarctl.spec index 6f54056..3ed55ee 100644 --- a/secvarctl.spec +++ b/secvarctl.spec @@ -1,6 +1,6 @@ Name: secvarctl Version: 0.3 -Release: 6%{?dist} +Release: 7%{?dist} Summary: A command line tool for managing Secure Boot Variables on POWER License: ASL 2.0 @@ -44,6 +44,9 @@ The sub-commands are: %changelog +* Sat Jan 27 2024 Fedora Release Engineering - 0.3-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Sat Jul 22 2023 Fedora Release Engineering - 0.3-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild From ba51d239bf6b0c24bfc81d02a163c9fb4bc82eb4 Mon Sep 17 00:00:00 2001 From: topazus Date: Sun, 19 May 2024 23:45:11 +0800 Subject: [PATCH 05/15] Convert to %autorelease and %autochangelog [skip changelog] --- changelog | 31 +++++++++++++++++++++++++++++++ secvarctl.spec | 34 ++-------------------------------- 2 files changed, 33 insertions(+), 32 deletions(-) create mode 100644 changelog diff --git a/changelog b/changelog new file mode 100644 index 0000000..061e8b7 --- /dev/null +++ b/changelog @@ -0,0 +1,31 @@ +* Sat Jan 27 2024 Fedora Release Engineering - 0.3-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Sat Jul 22 2023 Fedora Release Engineering - 0.3-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Sat Jan 21 2023 Fedora Release Engineering - 0.3-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Sat Jul 23 2022 Fedora Release Engineering - 0.3-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Sat Jan 22 2022 Morten Stevens - 0.3-3 +- Rebuilt for mbedTLS 2.28.0 + +* Sat Jan 22 2022 Fedora Release Engineering - 0.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Tue Dec 14 2021 Nick Child - 0.3-1 +- Update to v0.3 + +* Fri Jul 23 2021 Fedora Release Engineering - 0.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Thu Apr 29 2021 Nick Child - 0.2-1 +- Update to v0.2 +- Allow compiling with Openssl + +* Thu Nov 5 2020 Nick Child - 0.1-1 +- Initial package +- diff --git a/secvarctl.spec b/secvarctl.spec index 3ed55ee..294abb5 100644 --- a/secvarctl.spec +++ b/secvarctl.spec @@ -1,6 +1,6 @@ Name: secvarctl Version: 0.3 -Release: 7%{?dist} +Release: %autorelease Summary: A command line tool for managing Secure Boot Variables on POWER License: ASL 2.0 @@ -44,34 +44,4 @@ The sub-commands are: %changelog -* Sat Jan 27 2024 Fedora Release Engineering - 0.3-7 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Sat Jul 22 2023 Fedora Release Engineering - 0.3-6 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - -* Sat Jan 21 2023 Fedora Release Engineering - 0.3-5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - -* Sat Jul 23 2022 Fedora Release Engineering - 0.3-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - -* Sat Jan 22 2022 Morten Stevens - 0.3-3 -- Rebuilt for mbedTLS 2.28.0 - -* Sat Jan 22 2022 Fedora Release Engineering - 0.3-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - -* Tue Dec 14 2021 Nick Child - 0.3-1 -- Update to v0.3 - -* Fri Jul 23 2021 Fedora Release Engineering - 0.2-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - -* Thu Apr 29 2021 Nick Child - 0.2-1 -- Update to v0.2 -- Allow compiling with Openssl - -* Thu Nov 5 2020 Nick Child - 0.1-1 -- Initial package -- +%autochangelog From 160e9844290465596becd570b226e0f82a90a0ad Mon Sep 17 00:00:00 2001 From: topazus Date: Mon, 20 May 2024 08:56:32 +0800 Subject: [PATCH 06/15] update to 1.0.0; SPDX migration --- .gitignore | 2 ++ packit.yaml | 21 +++++++++++++++++++++ secvarctl.spec | 47 ++++++++++++++++++++++++----------------------- sources | 3 ++- 4 files changed, 49 insertions(+), 24 deletions(-) create mode 100644 packit.yaml diff --git a/.gitignore b/.gitignore index d579029..717f127 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,5 @@ /v0.1.tar.gz /v0.2.tar.gz /v0.3.tar.gz +/secvarctl-1.0.0.tar.gz +/ce98be9d15ac2df062726b4451f0ec0c0b27fbf2.tar.gz diff --git a/packit.yaml b/packit.yaml new file mode 100644 index 0000000..d94c3d2 --- /dev/null +++ b/packit.yaml @@ -0,0 +1,21 @@ +upstream_project_url: https://github.com/open-power/secvarctl +upstream_tag_template: v{version} + +jobs: + - job: pull_from_upstream + trigger: release + dist_git_branches: + - fedora-rawhide + + - job: koji_build + trigger: commit + allowed_pr_authors: ["packit", "topazus"] + allowed_committers: ["packit", "topazus"] + dist_git_branches: + - fedora-all + + - job: bodhi_update + trigger: commit + allowed_builders: ["packit", "topazus"] + dist_git_branches: + - fedora-branched diff --git a/secvarctl.spec b/secvarctl.spec index 294abb5..059f6b0 100644 --- a/secvarctl.spec +++ b/secvarctl.spec @@ -1,40 +1,42 @@ -Name: secvarctl -Version: 0.3 -Release: %autorelease -Summary: A command line tool for managing Secure Boot Variables on POWER - -License: ASL 2.0 -URL: https://github.com/open-power/secvarctl -Source0: https://github.com/open-power/secvarctl/archive/v%{version}.tar.gz - +Name: secvarctl +Version: 1.0.0 +Release: %autorelease +Summary: Suite of tools to manipulate and generate Secure Boot variables on POWER +License: Apache-2.0 +URL: https://github.com/open-power/secvarctl +Source0: %{url}/archive/v%{version}/%{name}-%{version}.tar.gz +Source1: https://github.com/ibm/libstb-secvar/archive/ce98be9d15ac2df062726b4451f0ec0c0b27fbf2.tar.gz BuildRequires: gcc BuildRequires: cmake -BuildRequires: mbedtls-devel +BuildRequires: openssl-devel +BuildRequires: libasan +Provides: bundled(libstb-secvar) %description -secvarctl is a collection of sub-commands for reading, writing -and updating secure variables on POWER's Secure Boot. -The sub-commands are: - -read , prints info on secure variables - -write , updates secure variable with new signed authenticated file - -validate , validates format of given file - -verify , determines if new variable updates are correctly signed/formatted - -generate , create relevant files for secure variable management +Suite of tools to manipulate and generate Secure Boot variables on POWER. + +The purpose of this tool is to simplify and automate the process of reading and +writing secure boot keys. secvarctl allows the user to communicate, via terminal +commands, with the keys efficiently. It is supporting automate process of the +both host and guest secure boot keys. %prep -%setup -q - +%autosetup -p1 +tar xf %{SOURCE1} -C external/libstb-secvar --strip-components=1 %build -%cmake -DCMAKE_BUILD_TYPE="Release" +%cmake -DCMAKE_BUILD_TYPE=Release %cmake_build - %install %cmake_install +%check +%ifarch ppc64le +make check +%endif %files %license LICENSE @@ -42,6 +44,5 @@ The sub-commands are: %{_bindir}/%{name} %{_mandir}/man1/%{name}.1* - %changelog %autochangelog diff --git a/sources b/sources index 3f62943..c6a8528 100644 --- a/sources +++ b/sources @@ -1 +1,2 @@ -SHA512 (v0.3.tar.gz) = f960fc8629cc59777ea158f406f8691bce6faf2c0c0efb0d68b5cdd3fc7cc9515b9ddf58aaa952b33abc2b767856a56fe3fbc9237f5db8f1b31430e7fa6ebd36 +SHA512 (secvarctl-1.0.0.tar.gz) = 8bb4db288fe5b4ed1a8e9c61e13dc64db21781af8dddb8ab2119440a9532d96d99b9e7f67b92bd1956f2b350c27805bec66fbf4f0c5c6b1359e28126f4fd167d +SHA512 (ce98be9d15ac2df062726b4451f0ec0c0b27fbf2.tar.gz) = 7cec0b1b6d5829086df380202f28f947824122c83ea76745623809b4dff2430efe6617b3e0b53f325ac67c86ed83a154b66a163c903091eb8b1dd8fc99ad8102 From 006f78a84bd15ae75a917df5d70cdb8255c64bfc Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 20 Jul 2024 05:12:48 +0000 Subject: [PATCH 07/15] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild From c3977833557f146606ef75ca0419728926fbd876 Mon Sep 17 00:00:00 2001 From: Morten Stevens Date: Tue, 3 Sep 2024 17:30:44 +0200 Subject: [PATCH 08/15] Rebuilt for mbedTLS 3.6.1 --- changelog | 3 +++ 1 file changed, 3 insertions(+) diff --git a/changelog b/changelog index 061e8b7..327375d 100644 --- a/changelog +++ b/changelog @@ -1,3 +1,6 @@ +* Tue Sep 03 2024 Morten Stevens - 0.3-8 +- Rebuilt for mbedTLS 3.6.1 + * Sat Jan 27 2024 Fedora Release Engineering - 0.3-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From 32ccac70d97a0030b103d6c994ad9b5748f01328 Mon Sep 17 00:00:00 2001 From: Packit Date: Thu, 10 Oct 2024 19:35:06 +0000 Subject: [PATCH 09/15] Update to 1.1.0 upstream release - Resolves: rhbz#2317890 Upstream tag: v1.1.0 Upstream commit: c863fa41 Commit authored by Packit automation (https://packit.dev/) --- .gitignore | 1 + README.packit | 3 +++ secvarctl.spec | 2 +- sources | 2 +- 4 files changed, 6 insertions(+), 2 deletions(-) create mode 100644 README.packit diff --git a/.gitignore b/.gitignore index 717f127..d7ea19f 100644 --- a/.gitignore +++ b/.gitignore @@ -3,3 +3,4 @@ /v0.3.tar.gz /secvarctl-1.0.0.tar.gz /ce98be9d15ac2df062726b4451f0ec0c0b27fbf2.tar.gz +/secvarctl-1.1.0.tar.gz diff --git a/README.packit b/README.packit new file mode 100644 index 0000000..3f22dbc --- /dev/null +++ b/README.packit @@ -0,0 +1,3 @@ +This repository is maintained by packit. +https://packit.dev/ +The file was generated using packit 0.102.0.post1.dev4+g7e44ad87. diff --git a/secvarctl.spec b/secvarctl.spec index 059f6b0..358ef93 100644 --- a/secvarctl.spec +++ b/secvarctl.spec @@ -1,5 +1,5 @@ Name: secvarctl -Version: 1.0.0 +Version: 1.1.0 Release: %autorelease Summary: Suite of tools to manipulate and generate Secure Boot variables on POWER License: Apache-2.0 diff --git a/sources b/sources index c6a8528..757aebb 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (secvarctl-1.0.0.tar.gz) = 8bb4db288fe5b4ed1a8e9c61e13dc64db21781af8dddb8ab2119440a9532d96d99b9e7f67b92bd1956f2b350c27805bec66fbf4f0c5c6b1359e28126f4fd167d +SHA512 (secvarctl-1.1.0.tar.gz) = eededf0c07391365188a42d9d0e8893767b5fb7689002acdf6d9addbaa7078d616d9a902b6909e7f2e6962a0b6dfedceeb298ae42b69bce291dbf0ee692e7a0c SHA512 (ce98be9d15ac2df062726b4451f0ec0c0b27fbf2.tar.gz) = 7cec0b1b6d5829086df380202f28f947824122c83ea76745623809b4dff2430efe6617b3e0b53f325ac67c86ed83a154b66a163c903091eb8b1dd8fc99ad8102 From 4563180dd7a6f76c618555064f88e3c1e1a2699c Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sun, 19 Jan 2025 10:22:33 +0000 Subject: [PATCH 10/15] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From a88e6881b26e1648bbf9801bed5674b8e57b86be Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 25 Jul 2025 18:07:35 +0000 Subject: [PATCH 11/15] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild From fee12e45eb8b32501d8238f150b3441d86f14031 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 17 Jan 2026 17:52:05 +0000 Subject: [PATCH 12/15] Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild From 928fafa05969c8dbedc239abbf0b32f8203b1803 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavol=20=C5=BD=C3=A1=C4=8Dik?= Date: Mon, 11 May 2026 11:57:29 +0200 Subject: [PATCH 13/15] Add OpenSSL 4.0 compatibility patch --- 0001-Fix-OpenSSL-4.0-compatibility.patch | 55 ++++++++++++++++++++++++ secvarctl.spec | 5 ++- 2 files changed, 59 insertions(+), 1 deletion(-) create mode 100644 0001-Fix-OpenSSL-4.0-compatibility.patch diff --git a/0001-Fix-OpenSSL-4.0-compatibility.patch b/0001-Fix-OpenSSL-4.0-compatibility.patch new file mode 100644 index 0000000..b843ac6 --- /dev/null +++ b/0001-Fix-OpenSSL-4.0-compatibility.patch @@ -0,0 +1,55 @@ +From 7f6aae0cc929818a07ffcdbfbfbcd18b4c8352ee Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Pavol=20=C5=BD=C3=A1=C4=8Dik?= +Date: Mon, 11 May 2026 11:29:28 +0200 +Subject: [PATCH] Fix OpenSSL 4.0 compatibility + +Use const qualifiers and ASN1_STRING accessor functions. +--- + external/libstb-secvar/src/crypto_openssl.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/external/libstb-secvar/src/crypto_openssl.c b/external/libstb-secvar/src/crypto_openssl.c +index e6dd5e5..9fe8303 100644 +--- a/external/libstb-secvar/src/crypto_openssl.c ++++ b/external/libstb-secvar/src/crypto_openssl.c +@@ -124,7 +124,7 @@ err_out: + int crypto_x509_get_sig_len (crypto_x509_t *x509) + { + int rc; +- ASN1_BIT_STRING *sig; ++ const ASN1_BIT_STRING *sig; + + sig = X509_get0_pubkey_bitstr (x509); + if (!sig) +@@ -139,7 +139,7 @@ int crypto_x509_get_sig_len (crypto_x509_t *x509) + return rc; + } + +- return sig->length; ++ return ASN1_STRING_length(sig); + } + + int crypto_x509_oid_is_pkcs1_sha256 (crypto_x509_t *x509) +@@ -262,7 +262,7 @@ int crypto_pkcs7_signed_hash_verify (crypto_pkcs7_t *pkcs7, crypto_x509_t *x509, + unsigned char *hash, int hash_len) + { + int exp_size, md_nid, num_signers, rc = ERR_R_INTERNAL_ERROR; +- unsigned char *exp_sig; ++ const unsigned char *exp_sig; + EVP_PKEY *pk; + EVP_PKEY_CTX *pk_ctx; + X509_ALGOR *alg; +@@ -346,8 +346,8 @@ int crypto_pkcs7_signed_hash_verify (crypto_pkcs7_t *pkcs7, crypto_x509_t *x509, + goto out; + } + +- exp_size = signer_info->enc_digest->length; +- exp_sig = signer_info->enc_digest->data; ++ exp_size = ASN1_STRING_length(signer_info->enc_digest); ++ exp_sig = ASN1_STRING_get0_data(signer_info->enc_digest); + + if (exp_size <= 0 || !exp_sig) + { +-- +2.53.0 + diff --git a/secvarctl.spec b/secvarctl.spec index 358ef93..b4ddcb4 100644 --- a/secvarctl.spec +++ b/secvarctl.spec @@ -7,6 +7,8 @@ URL: https://github.com/open-power/secvarctl Source0: %{url}/archive/v%{version}/%{name}-%{version}.tar.gz Source1: https://github.com/ibm/libstb-secvar/archive/ce98be9d15ac2df062726b4451f0ec0c0b27fbf2.tar.gz +Patch0: 0001-Fix-OpenSSL-4.0-compatibility.patch + BuildRequires: gcc BuildRequires: cmake BuildRequires: openssl-devel @@ -23,8 +25,9 @@ commands, with the keys efficiently. It is supporting automate process of the both host and guest secure boot keys. %prep -%autosetup -p1 +%autosetup -N tar xf %{SOURCE1} -C external/libstb-secvar --strip-components=1 +%autopatch -p1 %build %cmake -DCMAKE_BUILD_TYPE=Release From adbd35f10969fda7febb4e15f2e4ed1dbd5bc1f3 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Fri, 12 Jun 2026 19:45:41 -0400 Subject: [PATCH 14/15] Rebuilt for openssl 4.0 From 6f2c0c2a4fdafd3a3b1805805fbc70f81f1a27dc Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 17 Jul 2026 06:22:33 +0000 Subject: [PATCH 15/15] Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild