From bf64cc0da9e8804d00b545d0eeab4204d2227bf8 Mon Sep 17 00:00:00 2001
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Wed, 26 Aug 2026 21:03:20 +0200
Subject: [PATCH] go back to x509-cert 0.2.x

---
 downgrade-x509.patch  | 60 +++++++++++++++++++++++++++++++++++++++++++
 virt-firmware-rs.spec |  1 +
 2 files changed, 61 insertions(+)
 create mode 100644 downgrade-x509.patch

diff --git a/downgrade-x509.patch b/downgrade-x509.patch
new file mode 100644
index 0000000..76a94bf
--- /dev/null
+++ b/downgrade-x509.patch
@@ -0,0 +1,60 @@
+diff --git a/Cargo.toml b/Cargo.toml
+index 2a38a77d0a32..ed0d5a2f7314 100644
+--- a/Cargo.toml
++++ b/Cargo.toml
+@@ -24,7 +24,7 @@ byteorder = { version = "1", default-features = false }
+ clap = { version = "4.5.4", features = [ "derive", "wrap_help" ] }
+ clap_mangen = { version = ">= 0.2.30, < 0.4" }
+ env_logger = { version = "0.11" }
+-der = { version = "0.8" }
++der = { version = "0.7.10" }
+ fdt = { version = "0.1" }
+ igvm = { version = "0.4" }
+ igvm_defs = { version = "0.4" }
+@@ -38,7 +38,7 @@ spin = { version = ">= 0.10, < 0.13" }
+ uefi = { version = "0.39" }
+ uefi-raw = { version = "0.15.1" }
+ uguid = { version = "2" }
+-x509-cert = { version = "0.3", default-features = false }
++x509-cert = { version = "0.2.5", default-features = false }
+ zerocopy = { version = "0.8", features = [ "derive" ] }
+ 
+ virtfw-libhw = { path = "libhw", version = "0.5.2" }
+diff --git a/libefi/src/sb/certs/info.rs b/libefi/src/sb/certs/info.rs
+index 5926898c0e9d..0cd31bc376cc 100644
+--- a/libefi/src/sb/certs/info.rs
++++ b/libefi/src/sb/certs/info.rs
+@@ -20,8 +20,8 @@ pub struct CertInfo {
+ 
+ impl CertInfo {
+     fn attr(name: &Name, oid: &ObjectIdentifier) -> Option<String> {
+-        for attr in name.iter_rdn() {
+-            if attr.iter().any(|x| x.oid == *oid) {
++        for attr in name.0.iter() {
++            if attr.0.iter().any(|x| x.oid == *oid) {
+                 return Some(attr.to_string());
+             }
+         }
+@@ -30,16 +30,15 @@ impl CertInfo {
+ 
+     pub fn new_from_der(der: &[u8]) -> Option<Self> {
+         let cert = Certificate::from_der(der).ok()?;
+-        let tbs = cert.tbs_certificate();
+-        let subject = tbs.subject();
+-        let issuer = tbs.issuer();
+-        let not_before = tbs.validity().not_before.to_date_time();
+-        let not_after = tbs.validity().not_after.to_date_time();
++        let subject = cert.tbs_certificate.subject;
++        let issuer = cert.tbs_certificate.issuer;
++        let not_before = cert.tbs_certificate.validity.not_before.to_date_time();
++        let not_after = cert.tbs_certificate.validity.not_after.to_date_time();
+         let info = Self {
+             subject: subject.to_string(),
+-            subject_cn: Self::attr(subject, &OID_CN),
++            subject_cn: Self::attr(&subject, &OID_CN),
+             issuer: issuer.to_string(),
+-            issuer_cn: Self::attr(issuer, &OID_CN),
++            issuer_cn: Self::attr(&issuer, &OID_CN),
+             not_before: EfiTime::from(&not_before),
+             not_after: EfiTime::from(&not_after),
+         };
diff --git a/virt-firmware-rs.spec b/virt-firmware-rs.spec
index a1f241f..ba8db1f 100644
--- a/virt-firmware-rs.spec
+++ b/virt-firmware-rs.spec
@@ -40,6 +40,7 @@ License:        %{shrink:
 
 URL:            https://gitlab.com/kraxel/virt-firmware-rs
 Source:         https://gitlab.com/kraxel/%{name}/-/archive/v%{version}/%{name}-v%{version}.tar.gz
+Patch1:         downgrade-x509.patch
 
 ExclusiveArch:  x86_64 aarch64 riscv64
 BuildRequires:  cargo-rpm-macros >= 24