diff --git a/.fmf/version b/.fmf/version deleted file mode 100644 index d00491f..0000000 --- a/.fmf/version +++ /dev/null @@ -1 +0,0 @@ -1 diff --git a/.gitignore b/.gitignore index 9d784f4..403cc12 100644 --- a/.gitignore +++ b/.gitignore @@ -25,12 +25,3 @@ /sscg-3.0.0.tar.xz /sscg-3.0.1.tar.gz /sscg-3.0.2.tar.gz -/sscg-3.0.3.tar.gz -/sscg-3.0.5.tar.gz -/sscg-3.0.6.tar.gz -/sscg-3.0.7.tar.gz -/sscg-3.0.8.tar.gz -/sscg-4.0.0.tar.gz -/sscg-4.0.1.tar.gz -/sscg-4.0.2.tar.gz -/sscg-4.0.3.tar.gz diff --git a/.packit.yaml b/.packit.yaml deleted file mode 100644 index ad46396..0000000 --- a/.packit.yaml +++ /dev/null @@ -1,51 +0,0 @@ -# See the documentation for more information: -# https://packit.dev/docs/configuration/ - -specfile_path: .distro/sscg.spec - -files_to_sync: - - src: .distro/sscg.spec - dest: sscg.spec - - src: .packit.yaml - dest: .packit.yaml - - src: get_current_version.sh - dest: get_current_version.sh - -sync_changelog: true - -upstream_package_name: sscg -downstream_package_name: sscg - -upstream_tag_template: sscg-{version} - -archive_root_dir_template: "{upstream_pkg_name}-{upstream_pkg_name}-{version}" - -notifications: - pull_request: - successful_build: true - -srpm_build_deps: - - meson - - jq - -actions: - get-current-version: - - ./get_current_version.sh - -jobs: -- job: copr_build - trigger: pull_request - targets: - - fedora-all - - centos-stream-8 - - centos-stream-9 -- job: tests - trigger: pull_request - targets: - - fedora-all - - centos-stream-8 - - centos-stream-9 -- job: propose_downstream - trigger: release - dist_git_branches: - - fedora-all diff --git a/0001-Avoid-segfault-on-receiving-bad-CLI-arguments.patch b/0001-Avoid-segfault-on-receiving-bad-CLI-arguments.patch deleted file mode 100644 index c80dc87..0000000 --- a/0001-Avoid-segfault-on-receiving-bad-CLI-arguments.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 0c37e7ace585cfb550a0ffd9d5c331d059fd687f Mon Sep 17 00:00:00 2001 -From: Stephen Gallagher -Date: Tue, 2 Dec 2025 12:12:26 -0500 -Subject: [PATCH] Avoid segfault on receiving bad CLI arguments - -Signed-off-by: Stephen Gallagher ---- - src/sscg.c | 7 +++++-- - 1 file changed, 5 insertions(+), 2 deletions(-) - -diff --git a/src/sscg.c b/src/sscg.c -index b9b191f109300f6447262858f57a3a8321a14966..00e2862c2d6be5c44a4a362fc926e1a07d31d7bf 100644 ---- a/src/sscg.c -+++ b/src/sscg.c -@@ -59,7 +59,7 @@ int - main (int argc, const char **argv) - { - int ret, sret; -- struct sscg_options *options; -+ struct sscg_options *options = NULL; - bool build_client_cert = false; - char *dhparams_file = NULL; - -@@ -342,7 +342,10 @@ main (int argc, const char **argv) - done: - if (ret != EOK) - { -- sscg_io_utils_delete_output_files (options->streams); -+ if (options) -+ { -+ sscg_io_utils_delete_output_files (options->streams); -+ } - } - talloc_zfree (main_ctx); - if (getenv ("SSCG_TALLOC_REPORT")) --- -2.52.0 - diff --git a/0001-Protect-against-negative-bitshift.patch b/0001-Protect-against-negative-bitshift.patch new file mode 100644 index 0000000..e64d0bc --- /dev/null +++ b/0001-Protect-against-negative-bitshift.patch @@ -0,0 +1,40 @@ +From e1e473650b45aff0b6a1fc50f4bdd7752dc45c85 Mon Sep 17 00:00:00 2001 +From: Stephen Gallagher +Date: Tue, 1 Mar 2022 16:37:22 -0500 +Subject: [PATCH 1/4] Protect against negative bitshift + +Coverity scan identified that SSCG_FILE_TYPE_UNKNOWN could cause the +bitshifts further down to attempt to shift a negative number, which +results in undefined behavior. Though it should never occur that this +function is called with an invalid type, it's best to be overly +cautious and check for it. + +Signed-off-by: Stephen Gallagher +--- + src/io_utils.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/src/io_utils.c b/src/io_utils.c +index 1b8bc41..0e05ed9 100644 +--- a/src/io_utils.c ++++ b/src/io_utils.c +@@ -99,10 +99,16 @@ struct sscg_stream * + sscg_io_utils_get_stream_by_type (struct sscg_stream **streams, + enum sscg_file_type filetype) + { + struct sscg_stream *stream = NULL; + ++ if (filetype < 0 || filetype > SSCG_NUM_FILE_TYPES) ++ { ++ SSCG_LOG (SSCG_DEFAULT, "Unknown filetype for stream"); ++ return NULL; ++ } ++ + /* First see if this path already exists in the list */ + for (int i = 0; (stream = streams[i]) && i < SSCG_NUM_FILE_TYPES; i++) + { + SSCG_LOG (SSCG_DEBUG, + "Checking for 0x%.4x in 0x%.4x\n", +-- +2.35.1 + diff --git a/0002-Fix-another-negative-bitshift-issue.patch b/0002-Fix-another-negative-bitshift-issue.patch new file mode 100644 index 0000000..93e2c7a --- /dev/null +++ b/0002-Fix-another-negative-bitshift-issue.patch @@ -0,0 +1,34 @@ +From b9f757736f73db8c58bb9e422e018ab84eabd51f Mon Sep 17 00:00:00 2001 +From: Stephen Gallagher +Date: Tue, 1 Mar 2022 16:46:24 -0500 +Subject: [PATCH 2/4] Fix another negative bitshift issue + +Signed-off-by: Stephen Gallagher +--- + src/io_utils.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/src/io_utils.c b/src/io_utils.c +index 0e05ed9..158db07 100644 +--- a/src/io_utils.c ++++ b/src/io_utils.c +@@ -264,10 +264,16 @@ sscg_io_utils_add_output_key (struct sscg_stream **streams, + int ret, i; + TALLOC_CTX *tmp_ctx = NULL; + struct sscg_stream *stream = NULL; + char *normalized_path = NULL; + ++ if (filetype < 0 || filetype > SSCG_NUM_FILE_TYPES) ++ { ++ SSCG_ERROR ("Unknown filetype for stream"); ++ return EINVAL; ++ } ++ + /* If we haven't been passed a path, just return; it's probably an optional + * output file + */ + if (path == NULL) + { +-- +2.35.1 + diff --git a/0003-Fix-incorrect-error-check.patch b/0003-Fix-incorrect-error-check.patch new file mode 100644 index 0000000..d074f45 --- /dev/null +++ b/0003-Fix-incorrect-error-check.patch @@ -0,0 +1,36 @@ +From 3483a978eb1c667760992b012ea7350313b5a15a Mon Sep 17 00:00:00 2001 +From: Stephen Gallagher +Date: Tue, 8 Mar 2022 16:33:35 -0500 +Subject: [PATCH 3/4] Fix incorrect error-check + +Signed-off-by: Stephen Gallagher +--- + src/x509.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/src/x509.c b/src/x509.c +index 7c7e4df..23bb337 100644 +--- a/src/x509.c ++++ b/src/x509.c +@@ -287,11 +287,17 @@ sscg_x509v3_csr_new (TALLOC_CTX *mem_ctx, + alt_name = tmp; + } + } + + ex = X509V3_EXT_conf_nid (NULL, NULL, NID_subject_alt_name, alt_name); +- CHECK_MEM (ex); ++ if (!ex) ++ { ++ ret = EINVAL; ++ fprintf (stderr, "Invalid subjectAlternativeName: %s\n", alt_name); ++ goto done; ++ } ++ + sk_X509_EXTENSION_push (certinfo->extensions, ex); + + /* Set the public key for the certificate */ + sslret = X509_REQ_set_pubkey (csr->x509_req, spkey->evp_pkey); + CHECK_SSL (sslret, X509_REQ_set_pubkey (OU)); +-- +2.35.1 + diff --git a/0004-Truncate-IP-address-in-SAN.patch b/0004-Truncate-IP-address-in-SAN.patch new file mode 100644 index 0000000..39343e8 --- /dev/null +++ b/0004-Truncate-IP-address-in-SAN.patch @@ -0,0 +1,49 @@ +From 2e9889320c76368d31e6c9d579f239fe88002cf9 Mon Sep 17 00:00:00 2001 +From: Stephen Gallagher +Date: Tue, 8 Mar 2022 16:34:09 -0500 +Subject: [PATCH 4/4] Truncate IP address in SAN + +In OpenSSL 1.1, this was done automatically when addind a SAN extension, +but in OpenSSL 3.0 it is rejected as an invalid input. + +Signed-off-by: Stephen Gallagher +--- + src/x509.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/src/x509.c b/src/x509.c +index 23bb337..e828ec7 100644 +--- a/src/x509.c ++++ b/src/x509.c +@@ -131,10 +131,11 @@ sscg_x509v3_csr_new (TALLOC_CTX *mem_ctx, + size_t i; + X509_NAME *subject; + char *alt_name = NULL; + char *tmp = NULL; + char *san = NULL; ++ char *slash = NULL; + TALLOC_CTX *tmp_ctx; + X509_EXTENSION *ex = NULL; + struct sscg_x509_req *csr; + + /* Make sure we have a key available */ +@@ -265,10 +266,16 @@ sscg_x509v3_csr_new (TALLOC_CTX *mem_ctx, + tmp_ctx, "DNS:%s", certinfo->subject_alt_names[i]); + } + else + { + san = talloc_strdup (tmp_ctx, certinfo->subject_alt_names[i]); ++ /* SAN IP addresses cannot include the subnet mask */ ++ if ((slash = strchr (san, '/'))) ++ { ++ /* Truncate at the slash */ ++ *slash = '\0'; ++ } + } + CHECK_MEM (san); + + if (strnlen (san, MAXHOSTNAMELEN + 5) > MAXHOSTNAMELEN + 4) + { +-- +2.35.1 + diff --git a/README.packit b/README.packit deleted file mode 100644 index 01582f6..0000000 --- a/README.packit +++ /dev/null @@ -1,3 +0,0 @@ -This repository is maintained by packit. -https://packit.dev/ -The file was generated using packit 0.76.0. diff --git a/ci.fmf b/ci.fmf deleted file mode 100644 index c5aa0e0..0000000 --- a/ci.fmf +++ /dev/null @@ -1 +0,0 @@ -resultsdb-testcase: separate diff --git a/gating.yaml b/gating.yaml deleted file mode 100644 index fd5be55..0000000 --- a/gating.yaml +++ /dev/null @@ -1,18 +0,0 @@ ---- !Policy -product_versions: - - fedora-* -decision_contexts: [bodhi_update_push_testing] -subject_type: koji_build -rules: - - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional} - - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier2-public.functional} - -#gating rawhide ---- !Policy -product_versions: - - fedora-* -decision_contexts: [bodhi_update_push_stable] -subject_type: koji_build -rules: - - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional} - - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier2-public.functional} diff --git a/get_current_version.sh b/get_current_version.sh deleted file mode 100755 index 6d959fe..0000000 --- a/get_current_version.sh +++ /dev/null @@ -1,46 +0,0 @@ -#!/usr/bin/bash - -# This file is part of sscg. -# -# sscg is free software: you can redistribute it and/or modify -# it under the terms of the GNU General Public License as published by -# the Free Software Foundation, either version 3 of the License, or -# (at your option) any later version. -# -# sscg is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with sscg. If not, see . -# -# In addition, as a special exception, the copyright holders give -# permission to link the code of portions of this program with the -# OpenSSL library under certain conditions as described in each -# individual source file, and distribute linked combinations -# including the two. -# You must obey the GNU General Public License in all respects -# for all of the code used other than OpenSSL. If you modify -# file(s) with this exception, you may extend this exception to your -# version of the file(s), but you are not obligated to do so. If you -# do not wish to do so, delete this exception statement from your -# version. If you delete this exception statement from all source -# files in the program, then also delete it here. -# -# Copyright 2023 by Stephen Gallagher - -set -e - -tmpdir=$(mktemp -d) - -function common_finalize { - exitcode=$? - rm -Rf "$tmpdir" - return $exitcode -} - -trap common_finalize EXIT - -meson setup ${tmpdir}/getcurrentversion 2>&1 > /dev/null -meson introspect ${tmpdir}/getcurrentversion --projectinfo | jq -r .version diff --git a/plans/tier1-public.fmf b/plans/tier1-public.fmf deleted file mode 100644 index 5a48a8f..0000000 --- a/plans/tier1-public.fmf +++ /dev/null @@ -1,7 +0,0 @@ -summary: Public (Fedora) Tier1 beakerlib tests -discover: - how: fmf - url: https://src.fedoraproject.org/tests/sscg.git - filter: 'tier: 1' -execute: - how: tmt diff --git a/plans/tier2-public.fmf b/plans/tier2-public.fmf deleted file mode 100644 index 5507332..0000000 --- a/plans/tier2-public.fmf +++ /dev/null @@ -1,7 +0,0 @@ -summary: Public (Fedora) Tier2 beakerlib tests -discover: - how: fmf - url: https://src.fedoraproject.org/tests/sscg.git - filter: 'tier: 2' -execute: - how: tmt diff --git a/sources b/sources index ebbdfd3..2bf99b1 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sscg-4.0.3.tar.gz) = f629cf7e32d4d4e7c1f58c4a53be925b96980e6fb3106e3a36a72f85c723bd79fba6aecdbf092b50f915a8833297bc7c6c1ccbe04fef488db38bbdc1e3a95b96 +SHA512 (sscg-3.0.2.tar.gz) = c722bc0640d46ed5e8aa1c0b1b238419189501ca36bf37b057874eb91246d024209c19dd522903edddda660b8d4ee772d86362077195c0f1a59aabc1d6866c34 diff --git a/sscg.spec b/sscg.spec index 4a60e76..5432d5a 100644 --- a/sscg.spec +++ b/sscg.spec @@ -9,25 +9,37 @@ %{!?meson_test: %global meson_test %{__meson} test -C %{_vpath_builddir} --num-processes %{_smp_build_ncpus} --print-errorlogs} Name: sscg -Version: 4.0.3 +Version: 3.0.2 Release: %autorelease -Summary: Simple Signed Certificate Generator +Summary: Simple SSL certificate generator -License: GPL-3.0-or-later WITH cryptsetup-OpenSSL-exception +License: GPLv3+ with exceptions URL: https://%{provider_prefix} -Source0: %{URL}/archive/refs/tags/sscg-%{version}.tar.gz +Source0: https://%{provider_prefix}/archive/refs/tags/%{repo}-%{version}.tar.gz BuildRequires: gcc BuildRequires: libtalloc-devel -BuildRequires: openssl BuildRequires: openssl-devel BuildRequires: popt-devel +BuildRequires: libpath_utils-devel BuildRequires: meson BuildRequires: ninja-build BuildRequires: help2man -# Upstream patch to avoid segfaults when receiving bad CLI arguments -# https://github.com/sgallagher/sscg/commit/0c37e7ace585cfb550a0ffd9d5c331d059fd687f -Patch: 0001-Avoid-segfault-on-receiving-bad-CLI-arguments.patch +# Protect against negative bitshift +# Author: Stephen Gallagher +Patch1: 0001-Protect-against-negative-bitshift.patch + +# Fix another negative bitshift issue +# Author: Stephen Gallagher +Patch2: 0002-Fix-another-negative-bitshift-issue.patch + +# Fix incorrect error-check +# Author: Stephen Gallagher +Patch3: 0003-Fix-incorrect-error-check.patch + +# Truncate IP address in SAN +# Author: Stephen Gallagher +Patch4: 0004-Truncate-IP-address-in-SAN.patch %description @@ -39,7 +51,7 @@ up a full PKI environment and without exposing the machine to a risk of false signatures from the service certificate. %prep -%autosetup -p1 -n sscg-sscg-%{version} +%autosetup -p1 -n %{name}-%{name}-%{version} %build