d6d145b71a
- Power guest secure boot with static keys: GRUB2 signing portion (jsc#SLE-18271) (bsc#1192764) * grub2.spec - Power guest secure boot with static keys: GRUB2 portion (jsc#SLE-18144) (bsc#1192686) * 0001-ieee1275-Drop-HEAP_MAX_ADDR-and-HEAP_MIN_SIZE-consta.patch * 0002-ieee1275-claim-more-memory.patch * 0003-ieee1275-request-memory-with-ibm-client-architecture.patch * 0004-Add-suport-for-signing-grub-with-an-appended-signatu.patch * 0005-docs-grub-Document-signing-grub-under-UEFI.patch * 0006-docs-grub-Document-signing-grub-with-an-appended-sig.patch * 0007-dl-provide-a-fake-grub_dl_set_persistent-for-the-emu.patch * 0008-pgp-factor-out-rsa_pad.patch * 0009-crypto-move-storage-for-grub_crypto_pk_-to-crypto.c.patch * 0010-posix_wrap-tweaks-in-preparation-for-libtasn1.patch * 0011-libtasn1-import-libtasn1-4.18.0.patch * 0012-libtasn1-disable-code-not-needed-in-grub.patch * 0013-libtasn1-changes-for-grub-compatibility.patch * 0014-libtasn1-compile-into-asn1-module.patch * 0015-test_asn1-test-module-for-libtasn1.patch * 0016-grub-install-support-embedding-x509-certificates.patch * 0017-appended-signatures-import-GNUTLS-s-ASN.1-descriptio.patch * 0018-appended-signatures-parse-PKCS-7-signedData-and-X.50.patch * 0019-appended-signatures-support-verifying-appended-signa.patch * 0020-appended-signatures-verification-tests.patch * 0021-appended-signatures-documentation.patch * 0022-ieee1275-enter-lockdown-based-on-ibm-secure-boot.patch * 0023-x509-allow-Digitial-Signature-plus-other-Key-Usages.patch - Fix no menuentry is found if hibernation on btrfs RAID1 (bsc#1193090) OBS-URL: https://build.opensuse.org/request/show/945751 OBS-URL: https://build.opensuse.org/package/show/Base:System/grub2?expand=0&rev=401
75 lines
2.4 KiB
Diff
75 lines
2.4 KiB
Diff
From def9a985bdb1a12db49be42b748b646abc156411 Mon Sep 17 00:00:00 2001
|
|
From: Daniel Axtens <dja@axtens.net>
|
|
Date: Fri, 2 Oct 2020 10:49:26 +1000
|
|
Subject: [PATCH 09/23] crypto: move storage for grub_crypto_pk_* to crypto.c
|
|
|
|
The way gcry_rsa and friends (the asymmetric ciphers) are loaded for the
|
|
pgp module is a bit quirky.
|
|
|
|
include/grub/crypto.h contains:
|
|
extern struct gcry_pk_spec *grub_crypto_pk_rsa;
|
|
|
|
commands/pgp.c contains the actual storage:
|
|
struct gcry_pk_spec *grub_crypto_pk_rsa;
|
|
|
|
And the module itself saves to the storage in pgp.c:
|
|
GRUB_MOD_INIT(gcry_rsa)
|
|
{
|
|
grub_crypto_pk_rsa = &_gcry_pubkey_spec_rsa;
|
|
}
|
|
|
|
This is annoying: gcry_rsa now has a dependency on pgp!
|
|
|
|
We want to be able to bring in gcry_rsa without bringing in PGP,
|
|
so move the storage to crypto.c.
|
|
|
|
Previously, gcry_rsa depended on pgp and mpi. Now it depends on
|
|
crypto and mpi. As pgp depends on crypto, this doesn't add any new
|
|
module dependencies using the PGP verfier.
|
|
|
|
[FWIW, the story is different for the symmetric ciphers. cryptodisk
|
|
and friends (zfs encryption etc) use grub_crypto_lookup_cipher_by_name()
|
|
to get a cipher handle. That depends on grub_ciphers being populated
|
|
by people calling grub_cipher_register. import_gcry.py ensures that the
|
|
symmetric ciphers call it.]
|
|
|
|
Signed-off-by: Daniel Axtens <dja@axtens.net>
|
|
---
|
|
grub-core/commands/pgp.c | 4 ----
|
|
grub-core/lib/crypto.c | 4 ++++
|
|
2 files changed, 4 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/grub-core/commands/pgp.c b/grub-core/commands/pgp.c
|
|
index 2408db499..355a43844 100644
|
|
--- a/grub-core/commands/pgp.c
|
|
+++ b/grub-core/commands/pgp.c
|
|
@@ -147,10 +147,6 @@ const char *hashes[] = {
|
|
[0x0b] = "sha224"
|
|
};
|
|
|
|
-struct gcry_pk_spec *grub_crypto_pk_dsa;
|
|
-struct gcry_pk_spec *grub_crypto_pk_ecdsa;
|
|
-struct gcry_pk_spec *grub_crypto_pk_rsa;
|
|
-
|
|
static int
|
|
dsa_pad (gcry_mpi_t *hmpi, grub_uint8_t *hval,
|
|
const gcry_md_spec_t *hash, struct grub_public_subkey *sk);
|
|
diff --git a/grub-core/lib/crypto.c b/grub-core/lib/crypto.c
|
|
index ca334d5a4..c578128a5 100644
|
|
--- a/grub-core/lib/crypto.c
|
|
+++ b/grub-core/lib/crypto.c
|
|
@@ -121,6 +121,10 @@ grub_md_unregister (gcry_md_spec_t *cipher)
|
|
}
|
|
}
|
|
|
|
+struct gcry_pk_spec *grub_crypto_pk_dsa;
|
|
+struct gcry_pk_spec *grub_crypto_pk_ecdsa;
|
|
+struct gcry_pk_spec *grub_crypto_pk_rsa;
|
|
+
|
|
void
|
|
grub_crypto_hash (const gcry_md_spec_t *hash, void *out, const void *in,
|
|
grub_size_t inlen)
|
|
--
|
|
2.31.1
|
|
|