diff --git a/.gitignore b/.gitignore index d579029..d7ea19f 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,6 @@ /v0.1.tar.gz /v0.2.tar.gz /v0.3.tar.gz +/secvarctl-1.0.0.tar.gz +/ce98be9d15ac2df062726b4451f0ec0c0b27fbf2.tar.gz +/secvarctl-1.1.0.tar.gz diff --git a/0001-Fix-OpenSSL-4.0-compatibility.patch b/0001-Fix-OpenSSL-4.0-compatibility.patch new file mode 100644 index 0000000..b843ac6 --- /dev/null +++ b/0001-Fix-OpenSSL-4.0-compatibility.patch @@ -0,0 +1,55 @@ +From 7f6aae0cc929818a07ffcdbfbfbcd18b4c8352ee Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Pavol=20=C5=BD=C3=A1=C4=8Dik?= +Date: Mon, 11 May 2026 11:29:28 +0200 +Subject: [PATCH] Fix OpenSSL 4.0 compatibility + +Use const qualifiers and ASN1_STRING accessor functions. +--- + external/libstb-secvar/src/crypto_openssl.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/external/libstb-secvar/src/crypto_openssl.c b/external/libstb-secvar/src/crypto_openssl.c +index e6dd5e5..9fe8303 100644 +--- a/external/libstb-secvar/src/crypto_openssl.c ++++ b/external/libstb-secvar/src/crypto_openssl.c +@@ -124,7 +124,7 @@ err_out: + int crypto_x509_get_sig_len (crypto_x509_t *x509) + { + int rc; +- ASN1_BIT_STRING *sig; ++ const ASN1_BIT_STRING *sig; + + sig = X509_get0_pubkey_bitstr (x509); + if (!sig) +@@ -139,7 +139,7 @@ int crypto_x509_get_sig_len (crypto_x509_t *x509) + return rc; + } + +- return sig->length; ++ return ASN1_STRING_length(sig); + } + + int crypto_x509_oid_is_pkcs1_sha256 (crypto_x509_t *x509) +@@ -262,7 +262,7 @@ int crypto_pkcs7_signed_hash_verify (crypto_pkcs7_t *pkcs7, crypto_x509_t *x509, + unsigned char *hash, int hash_len) + { + int exp_size, md_nid, num_signers, rc = ERR_R_INTERNAL_ERROR; +- unsigned char *exp_sig; ++ const unsigned char *exp_sig; + EVP_PKEY *pk; + EVP_PKEY_CTX *pk_ctx; + X509_ALGOR *alg; +@@ -346,8 +346,8 @@ int crypto_pkcs7_signed_hash_verify (crypto_pkcs7_t *pkcs7, crypto_x509_t *x509, + goto out; + } + +- exp_size = signer_info->enc_digest->length; +- exp_sig = signer_info->enc_digest->data; ++ exp_size = ASN1_STRING_length(signer_info->enc_digest); ++ exp_sig = ASN1_STRING_get0_data(signer_info->enc_digest); + + if (exp_size <= 0 || !exp_sig) + { +-- +2.53.0 + diff --git a/README.packit b/README.packit new file mode 100644 index 0000000..3f22dbc --- /dev/null +++ b/README.packit @@ -0,0 +1,3 @@ +This repository is maintained by packit. +https://packit.dev/ +The file was generated using packit 0.102.0.post1.dev4+g7e44ad87. diff --git a/changelog b/changelog new file mode 100644 index 0000000..327375d --- /dev/null +++ b/changelog @@ -0,0 +1,34 @@ +* Tue Sep 03 2024 Morten Stevens - 0.3-8 +- Rebuilt for mbedTLS 3.6.1 + +* Sat Jan 27 2024 Fedora Release Engineering - 0.3-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Sat Jul 22 2023 Fedora Release Engineering - 0.3-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Sat Jan 21 2023 Fedora Release Engineering - 0.3-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Sat Jul 23 2022 Fedora Release Engineering - 0.3-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Sat Jan 22 2022 Morten Stevens - 0.3-3 +- Rebuilt for mbedTLS 2.28.0 + +* Sat Jan 22 2022 Fedora Release Engineering - 0.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Tue Dec 14 2021 Nick Child - 0.3-1 +- Update to v0.3 + +* Fri Jul 23 2021 Fedora Release Engineering - 0.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Thu Apr 29 2021 Nick Child - 0.2-1 +- Update to v0.2 +- Allow compiling with Openssl + +* Thu Nov 5 2020 Nick Child - 0.1-1 +- Initial package +- diff --git a/packit.yaml b/packit.yaml new file mode 100644 index 0000000..d94c3d2 --- /dev/null +++ b/packit.yaml @@ -0,0 +1,21 @@ +upstream_project_url: https://github.com/open-power/secvarctl +upstream_tag_template: v{version} + +jobs: + - job: pull_from_upstream + trigger: release + dist_git_branches: + - fedora-rawhide + + - job: koji_build + trigger: commit + allowed_pr_authors: ["packit", "topazus"] + allowed_committers: ["packit", "topazus"] + dist_git_branches: + - fedora-all + + - job: bodhi_update + trigger: commit + allowed_builders: ["packit", "topazus"] + dist_git_branches: + - fedora-branched diff --git a/secvarctl.spec b/secvarctl.spec index d9123c9..b4ddcb4 100644 --- a/secvarctl.spec +++ b/secvarctl.spec @@ -1,40 +1,45 @@ -Name: secvarctl -Version: 0.3 -Release: 3%{?dist} -Summary: A command line tool for managing Secure Boot Variables on POWER - -License: ASL 2.0 -URL: https://github.com/open-power/secvarctl -Source0: https://github.com/open-power/secvarctl/archive/v%{version}.tar.gz +Name: secvarctl +Version: 1.1.0 +Release: %autorelease +Summary: Suite of tools to manipulate and generate Secure Boot variables on POWER +License: Apache-2.0 +URL: https://github.com/open-power/secvarctl +Source0: %{url}/archive/v%{version}/%{name}-%{version}.tar.gz +Source1: https://github.com/ibm/libstb-secvar/archive/ce98be9d15ac2df062726b4451f0ec0c0b27fbf2.tar.gz +Patch0: 0001-Fix-OpenSSL-4.0-compatibility.patch BuildRequires: gcc BuildRequires: cmake -BuildRequires: mbedtls-devel +BuildRequires: openssl-devel +BuildRequires: libasan +Provides: bundled(libstb-secvar) %description -secvarctl is a collection of sub-commands for reading, writing -and updating secure variables on POWER's Secure Boot. -The sub-commands are: - -read , prints info on secure variables - -write , updates secure variable with new signed authenticated file - -validate , validates format of given file - -verify , determines if new variable updates are correctly signed/formatted - -generate , create relevant files for secure variable management +Suite of tools to manipulate and generate Secure Boot variables on POWER. + +The purpose of this tool is to simplify and automate the process of reading and +writing secure boot keys. secvarctl allows the user to communicate, via terminal +commands, with the keys efficiently. It is supporting automate process of the +both host and guest secure boot keys. %prep -%setup -q - +%autosetup -N +tar xf %{SOURCE1} -C external/libstb-secvar --strip-components=1 +%autopatch -p1 %build -%cmake -DCMAKE_BUILD_TYPE="Release" +%cmake -DCMAKE_BUILD_TYPE=Release %cmake_build - %install %cmake_install +%check +%ifarch ppc64le +make check +%endif %files %license LICENSE @@ -42,24 +47,5 @@ The sub-commands are: %{_bindir}/%{name} %{_mandir}/man1/%{name}.1* - %changelog -* Sat Jan 22 2022 Morten Stevens - 0.3-3 -- Rebuilt for mbedTLS 2.28.0 - -* Sat Jan 22 2022 Fedora Release Engineering - 0.3-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - -* Tue Dec 14 2021 Nick Child - 0.3-1 -- Update to v0.3 - -* Fri Jul 23 2021 Fedora Release Engineering - 0.2-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - -* Thu Apr 29 2021 Nick Child - 0.2-1 -- Update to v0.2 -- Allow compiling with Openssl - -* Thu Nov 5 2020 Nick Child - 0.1-1 -- Initial package -- +%autochangelog diff --git a/sources b/sources index 3f62943..757aebb 100644 --- a/sources +++ b/sources @@ -1 +1,2 @@ -SHA512 (v0.3.tar.gz) = f960fc8629cc59777ea158f406f8691bce6faf2c0c0efb0d68b5cdd3fc7cc9515b9ddf58aaa952b33abc2b767856a56fe3fbc9237f5db8f1b31430e7fa6ebd36 +SHA512 (secvarctl-1.1.0.tar.gz) = eededf0c07391365188a42d9d0e8893767b5fb7689002acdf6d9addbaa7078d616d9a902b6909e7f2e6962a0b6dfedceeb298ae42b69bce291dbf0ee692e7a0c +SHA512 (ce98be9d15ac2df062726b4451f0ec0c0b27fbf2.tar.gz) = 7cec0b1b6d5829086df380202f28f947824122c83ea76745623809b4dff2430efe6617b3e0b53f325ac67c86ed83a154b66a163c903091eb8b1dd8fc99ad8102