From 62ea0bff67b69d126f5f9e973bb16854026232fa Mon Sep 17 00:00:00 2001 From: Gerd Hoffmann Date: Wed, 26 Aug 2026 21:03:20 +0200 Subject: [PATCH 1/4] go back to x509-cert 0.2.x --- downgrade-x509.patch | 59 +++++++++++++++++++++++++++++++++++++++++++ virt-firmware-rs.spec | 1 + 2 files changed, 60 insertions(+) create mode 100644 downgrade-x509.patch diff --git a/downgrade-x509.patch b/downgrade-x509.patch new file mode 100644 index 0000000..3d666ce --- /dev/null +++ b/downgrade-x509.patch @@ -0,0 +1,59 @@ +commit 3649197e09d9718d051911cc091c77372301160d +Author: Gerd Hoffmann +Date: Wed Aug 26 14:50:57 2026 +0200 + + update x509-cert and der crates + +diff --git b/Cargo.toml a/Cargo.toml +index a305c979c154..ad669ce1f4d6 100644 +--- b/Cargo.toml ++++ a/Cargo.toml +@@ -24,7 +24,7 @@ byteorder = { version = "1", default-features = false } + clap = { version = "4.5.4", features = [ "derive", "wrap_help" ] } + clap_mangen = { version = ">= 0.2.30, < 0.4" } + env_logger = { version = "0.11" } +-der = { version = "0.8" } ++der = { version = "0.7.10" } + fdt = { version = "0.1" } + igvm = { version = "0.4" } + igvm_defs = { version = "0.4" } +@@ -38,7 +38,7 @@ spin = { version = ">= 0.10, < 0.13" } + uefi = { version = "0.39" } + uefi-raw = { version = "0.15.1" } + uguid = { version = "2" } +-x509-cert = { version = "0.3", default-features = false } ++x509-cert = { version = "0.2.5", default-features = false } + zerocopy = { version = "0.8", features = [ "derive" ] } + + virtfw-libhw = { path = "libhw", version = "0.5.1" } +diff --git b/libefi/src/sb/certs/info.rs a/libefi/src/sb/certs/info.rs +index f7d570acc904..0cd31bc376cc 100644 +--- b/libefi/src/sb/certs/info.rs ++++ a/libefi/src/sb/certs/info.rs +@@ -20,8 +20,8 @@ pub struct CertInfo { + + impl CertInfo { + fn attr(name: &Name, oid: &ObjectIdentifier) -> Option { +- for attr in name.iter_rdn() { +- if attr.iter().any(|x| x.oid == *oid) { ++ for attr in name.0.iter() { ++ if attr.0.iter().any(|x| x.oid == *oid) { + return Some(attr.to_string()); + } + } +@@ -30,11 +30,10 @@ impl CertInfo { + + pub fn new_from_der(der: &[u8]) -> Option { + let cert = Certificate::from_der(der).ok()?; +- let tbs = cert.tbs_certificate(); +- let subject = tbs.subject(); +- let issuer = tbs.issuer(); +- let not_before = tbs.validity().not_before.to_date_time(); +- let not_after = tbs.validity().not_after.to_date_time(); ++ let subject = cert.tbs_certificate.subject; ++ let issuer = cert.tbs_certificate.issuer; ++ let not_before = cert.tbs_certificate.validity.not_before.to_date_time(); ++ let not_after = cert.tbs_certificate.validity.not_after.to_date_time(); + let info = Self { + subject: subject.to_string(), + subject_cn: Self::attr(&subject, &OID_CN), diff --git a/virt-firmware-rs.spec b/virt-firmware-rs.spec index a1f241f..ba8db1f 100644 --- a/virt-firmware-rs.spec +++ b/virt-firmware-rs.spec @@ -40,6 +40,7 @@ License: %{shrink: URL: https://gitlab.com/kraxel/virt-firmware-rs Source: https://gitlab.com/kraxel/%{name}/-/archive/v%{version}/%{name}-v%{version}.tar.gz +Patch1: downgrade-x509.patch ExclusiveArch: x86_64 aarch64 riscv64 BuildRequires: cargo-rpm-macros >= 24 From 4dfdd12778299b3fa7a8faf390490a0c8ddaf669 Mon Sep 17 00:00:00 2001 From: Gerd Hoffmann Date: Wed, 26 Aug 2026 23:34:52 +0200 Subject: [PATCH 2/4] update downgrade patch --- downgrade-x509.patch | 28 +++++++++++++++------------- 1 file changed, 15 insertions(+), 13 deletions(-) diff --git a/downgrade-x509.patch b/downgrade-x509.patch index 3d666ce..77c6beb 100644 --- a/downgrade-x509.patch +++ b/downgrade-x509.patch @@ -1,13 +1,15 @@ -commit 3649197e09d9718d051911cc091c77372301160d +commit 285a14d811c4baf71543cc3f6b7147b36ad97d52 Author: Gerd Hoffmann -Date: Wed Aug 26 14:50:57 2026 +0200 +Date: Wed Aug 26 23:33:54 2026 +0200 - update x509-cert and der crates + Revert "update x509-cert and der crates" + + This reverts commit 3649197e09d9718d051911cc091c77372301160d. -diff --git b/Cargo.toml a/Cargo.toml -index a305c979c154..ad669ce1f4d6 100644 ---- b/Cargo.toml -+++ a/Cargo.toml +diff --git a/Cargo.toml b/Cargo.toml +index 2a38a77d0a32..ed0d5a2f7314 100644 +--- a/Cargo.toml ++++ b/Cargo.toml @@ -24,7 +24,7 @@ byteorder = { version = "1", default-features = false } clap = { version = "4.5.4", features = [ "derive", "wrap_help" ] } clap_mangen = { version = ">= 0.2.30, < 0.4" } @@ -25,11 +27,11 @@ index a305c979c154..ad669ce1f4d6 100644 +x509-cert = { version = "0.2.5", default-features = false } zerocopy = { version = "0.8", features = [ "derive" ] } - virtfw-libhw = { path = "libhw", version = "0.5.1" } -diff --git b/libefi/src/sb/certs/info.rs a/libefi/src/sb/certs/info.rs -index f7d570acc904..0cd31bc376cc 100644 ---- b/libefi/src/sb/certs/info.rs -+++ a/libefi/src/sb/certs/info.rs + virtfw-libhw = { path = "libhw", version = "0.5.2" } +diff --git a/libefi/src/sb/certs/info.rs b/libefi/src/sb/certs/info.rs +index 5926898c0e9d..e61341094c1c 100644 +--- a/libefi/src/sb/certs/info.rs ++++ b/libefi/src/sb/certs/info.rs @@ -20,8 +20,8 @@ pub struct CertInfo { impl CertInfo { @@ -56,4 +58,4 @@ index f7d570acc904..0cd31bc376cc 100644 + let not_after = cert.tbs_certificate.validity.not_after.to_date_time(); let info = Self { subject: subject.to_string(), - subject_cn: Self::attr(&subject, &OID_CN), + subject_cn: Self::attr(subject, &OID_CN), From 7ea0207b32a7ba1ede65cfd687f195343f870dc9 Mon Sep 17 00:00:00 2001 From: Gerd Hoffmann Date: Thu, 27 Aug 2026 07:37:37 +0200 Subject: [PATCH 3/4] update downgrade patch #2 --- downgrade-x509.patch | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) diff --git a/downgrade-x509.patch b/downgrade-x509.patch index 77c6beb..76a94bf 100644 --- a/downgrade-x509.patch +++ b/downgrade-x509.patch @@ -1,11 +1,3 @@ -commit 285a14d811c4baf71543cc3f6b7147b36ad97d52 -Author: Gerd Hoffmann -Date: Wed Aug 26 23:33:54 2026 +0200 - - Revert "update x509-cert and der crates" - - This reverts commit 3649197e09d9718d051911cc091c77372301160d. - diff --git a/Cargo.toml b/Cargo.toml index 2a38a77d0a32..ed0d5a2f7314 100644 --- a/Cargo.toml @@ -29,7 +21,7 @@ index 2a38a77d0a32..ed0d5a2f7314 100644 virtfw-libhw = { path = "libhw", version = "0.5.2" } diff --git a/libefi/src/sb/certs/info.rs b/libefi/src/sb/certs/info.rs -index 5926898c0e9d..e61341094c1c 100644 +index 5926898c0e9d..0cd31bc376cc 100644 --- a/libefi/src/sb/certs/info.rs +++ b/libefi/src/sb/certs/info.rs @@ -20,8 +20,8 @@ pub struct CertInfo { @@ -43,7 +35,7 @@ index 5926898c0e9d..e61341094c1c 100644 return Some(attr.to_string()); } } -@@ -30,11 +30,10 @@ impl CertInfo { +@@ -30,16 +30,15 @@ impl CertInfo { pub fn new_from_der(der: &[u8]) -> Option { let cert = Certificate::from_der(der).ok()?; @@ -58,4 +50,11 @@ index 5926898c0e9d..e61341094c1c 100644 + let not_after = cert.tbs_certificate.validity.not_after.to_date_time(); let info = Self { subject: subject.to_string(), - subject_cn: Self::attr(subject, &OID_CN), +- subject_cn: Self::attr(subject, &OID_CN), ++ subject_cn: Self::attr(&subject, &OID_CN), + issuer: issuer.to_string(), +- issuer_cn: Self::attr(issuer, &OID_CN), ++ issuer_cn: Self::attr(&issuer, &OID_CN), + not_before: EfiTime::from(¬_before), + not_after: EfiTime::from(¬_after), + }; From bf64cc0da9e8804d00b545d0eeab4204d2227bf8 Mon Sep 17 00:00:00 2001 From: Gerd Hoffmann Date: Wed, 26 Aug 2026 21:03:20 +0200 Subject: [PATCH 4/4] go back to x509-cert 0.2.x --- downgrade-x509.patch | 60 +++++++++++++++++++++++++++++++++++++++++++ virt-firmware-rs.spec | 1 + 2 files changed, 61 insertions(+) create mode 100644 downgrade-x509.patch diff --git a/downgrade-x509.patch b/downgrade-x509.patch new file mode 100644 index 0000000..76a94bf --- /dev/null +++ b/downgrade-x509.patch @@ -0,0 +1,60 @@ +diff --git a/Cargo.toml b/Cargo.toml +index 2a38a77d0a32..ed0d5a2f7314 100644 +--- a/Cargo.toml ++++ b/Cargo.toml +@@ -24,7 +24,7 @@ byteorder = { version = "1", default-features = false } + clap = { version = "4.5.4", features = [ "derive", "wrap_help" ] } + clap_mangen = { version = ">= 0.2.30, < 0.4" } + env_logger = { version = "0.11" } +-der = { version = "0.8" } ++der = { version = "0.7.10" } + fdt = { version = "0.1" } + igvm = { version = "0.4" } + igvm_defs = { version = "0.4" } +@@ -38,7 +38,7 @@ spin = { version = ">= 0.10, < 0.13" } + uefi = { version = "0.39" } + uefi-raw = { version = "0.15.1" } + uguid = { version = "2" } +-x509-cert = { version = "0.3", default-features = false } ++x509-cert = { version = "0.2.5", default-features = false } + zerocopy = { version = "0.8", features = [ "derive" ] } + + virtfw-libhw = { path = "libhw", version = "0.5.2" } +diff --git a/libefi/src/sb/certs/info.rs b/libefi/src/sb/certs/info.rs +index 5926898c0e9d..0cd31bc376cc 100644 +--- a/libefi/src/sb/certs/info.rs ++++ b/libefi/src/sb/certs/info.rs +@@ -20,8 +20,8 @@ pub struct CertInfo { + + impl CertInfo { + fn attr(name: &Name, oid: &ObjectIdentifier) -> Option { +- for attr in name.iter_rdn() { +- if attr.iter().any(|x| x.oid == *oid) { ++ for attr in name.0.iter() { ++ if attr.0.iter().any(|x| x.oid == *oid) { + return Some(attr.to_string()); + } + } +@@ -30,16 +30,15 @@ impl CertInfo { + + pub fn new_from_der(der: &[u8]) -> Option { + let cert = Certificate::from_der(der).ok()?; +- let tbs = cert.tbs_certificate(); +- let subject = tbs.subject(); +- let issuer = tbs.issuer(); +- let not_before = tbs.validity().not_before.to_date_time(); +- let not_after = tbs.validity().not_after.to_date_time(); ++ let subject = cert.tbs_certificate.subject; ++ let issuer = cert.tbs_certificate.issuer; ++ let not_before = cert.tbs_certificate.validity.not_before.to_date_time(); ++ let not_after = cert.tbs_certificate.validity.not_after.to_date_time(); + let info = Self { + subject: subject.to_string(), +- subject_cn: Self::attr(subject, &OID_CN), ++ subject_cn: Self::attr(&subject, &OID_CN), + issuer: issuer.to_string(), +- issuer_cn: Self::attr(issuer, &OID_CN), ++ issuer_cn: Self::attr(&issuer, &OID_CN), + not_before: EfiTime::from(¬_before), + not_after: EfiTime::from(¬_after), + }; diff --git a/virt-firmware-rs.spec b/virt-firmware-rs.spec index a1f241f..ba8db1f 100644 --- a/virt-firmware-rs.spec +++ b/virt-firmware-rs.spec @@ -40,6 +40,7 @@ License: %{shrink: URL: https://gitlab.com/kraxel/virt-firmware-rs Source: https://gitlab.com/kraxel/%{name}/-/archive/v%{version}/%{name}-v%{version}.tar.gz +Patch1: downgrade-x509.patch ExclusiveArch: x86_64 aarch64 riscv64 BuildRequires: cargo-rpm-macros >= 24