osc copypac from project:home:michal-m:modsign package:pesign-obs-integration revision:2
OBS-URL: https://build.opensuse.org/package/show/Base:System/pesign-obs-integration?expand=0&rev=1
This commit is contained in:
Git OBS Bridge
commit
184dbd8a83
23
.gitattributes
vendored
Normal file
23
.gitattributes
vendored
Normal file
@ -0,0 +1,23 @@
|
||||
## Default LFS
|
||||
*.7z filter=lfs diff=lfs merge=lfs -text
|
||||
*.bsp filter=lfs diff=lfs merge=lfs -text
|
||||
*.bz2 filter=lfs diff=lfs merge=lfs -text
|
||||
*.gem filter=lfs diff=lfs merge=lfs -text
|
||||
*.gz filter=lfs diff=lfs merge=lfs -text
|
||||
*.jar filter=lfs diff=lfs merge=lfs -text
|
||||
*.lz filter=lfs diff=lfs merge=lfs -text
|
||||
*.lzma filter=lfs diff=lfs merge=lfs -text
|
||||
*.obscpio filter=lfs diff=lfs merge=lfs -text
|
||||
*.oxt filter=lfs diff=lfs merge=lfs -text
|
||||
*.pdf filter=lfs diff=lfs merge=lfs -text
|
||||
*.png filter=lfs diff=lfs merge=lfs -text
|
||||
*.rpm filter=lfs diff=lfs merge=lfs -text
|
||||
*.tbz filter=lfs diff=lfs merge=lfs -text
|
||||
*.tbz2 filter=lfs diff=lfs merge=lfs -text
|
||||
*.tgz filter=lfs diff=lfs merge=lfs -text
|
||||
*.ttf filter=lfs diff=lfs merge=lfs -text
|
||||
*.txz filter=lfs diff=lfs merge=lfs -text
|
||||
*.whl filter=lfs diff=lfs merge=lfs -text
|
||||
*.xz filter=lfs diff=lfs merge=lfs -text
|
||||
*.zip filter=lfs diff=lfs merge=lfs -text
|
||||
*.zst filter=lfs diff=lfs merge=lfs -text
|
||||
1
.gitignore
vendored
Normal file
1
.gitignore
vendored
Normal file
@ -0,0 +1 @@
|
||||
.osc
|
||||
339
COPYING
Normal file
339
COPYING
Normal file
@ -0,0 +1,339 @@
|
||||
GNU GENERAL PUBLIC LICENSE
|
||||
Version 2, June 1991
|
||||
|
||||
Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
|
||||
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
|
||||
Everyone is permitted to copy and distribute verbatim copies
|
||||
of this license document, but changing it is not allowed.
|
||||
|
||||
Preamble
|
||||
|
||||
The licenses for most software are designed to take away your
|
||||
freedom to share and change it. By contrast, the GNU General Public
|
||||
License is intended to guarantee your freedom to share and change free
|
||||
software--to make sure the software is free for all its users. This
|
||||
General Public License applies to most of the Free Software
|
||||
Foundation's software and to any other program whose authors commit to
|
||||
using it. (Some other Free Software Foundation software is covered by
|
||||
the GNU Lesser General Public License instead.) You can apply it to
|
||||
your programs, too.
|
||||
|
||||
When we speak of free software, we are referring to freedom, not
|
||||
price. Our General Public Licenses are designed to make sure that you
|
||||
have the freedom to distribute copies of free software (and charge for
|
||||
this service if you wish), that you receive source code or can get it
|
||||
if you want it, that you can change the software or use pieces of it
|
||||
in new free programs; and that you know you can do these things.
|
||||
|
||||
To protect your rights, we need to make restrictions that forbid
|
||||
anyone to deny you these rights or to ask you to surrender the rights.
|
||||
These restrictions translate to certain responsibilities for you if you
|
||||
distribute copies of the software, or if you modify it.
|
||||
|
||||
For example, if you distribute copies of such a program, whether
|
||||
gratis or for a fee, you must give the recipients all the rights that
|
||||
you have. You must make sure that they, too, receive or can get the
|
||||
source code. And you must show them these terms so they know their
|
||||
rights.
|
||||
|
||||
We protect your rights with two steps: (1) copyright the software, and
|
||||
(2) offer you this license which gives you legal permission to copy,
|
||||
distribute and/or modify the software.
|
||||
|
||||
Also, for each author's protection and ours, we want to make certain
|
||||
that everyone understands that there is no warranty for this free
|
||||
software. If the software is modified by someone else and passed on, we
|
||||
want its recipients to know that what they have is not the original, so
|
||||
that any problems introduced by others will not reflect on the original
|
||||
authors' reputations.
|
||||
|
||||
Finally, any free program is threatened constantly by software
|
||||
patents. We wish to avoid the danger that redistributors of a free
|
||||
program will individually obtain patent licenses, in effect making the
|
||||
program proprietary. To prevent this, we have made it clear that any
|
||||
patent must be licensed for everyone's free use or not licensed at all.
|
||||
|
||||
The precise terms and conditions for copying, distribution and
|
||||
modification follow.
|
||||
|
||||
GNU GENERAL PUBLIC LICENSE
|
||||
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
|
||||
|
||||
0. This License applies to any program or other work which contains
|
||||
a notice placed by the copyright holder saying it may be distributed
|
||||
under the terms of this General Public License. The "Program", below,
|
||||
refers to any such program or work, and a "work based on the Program"
|
||||
means either the Program or any derivative work under copyright law:
|
||||
that is to say, a work containing the Program or a portion of it,
|
||||
either verbatim or with modifications and/or translated into another
|
||||
language. (Hereinafter, translation is included without limitation in
|
||||
the term "modification".) Each licensee is addressed as "you".
|
||||
|
||||
Activities other than copying, distribution and modification are not
|
||||
covered by this License; they are outside its scope. The act of
|
||||
running the Program is not restricted, and the output from the Program
|
||||
is covered only if its contents constitute a work based on the
|
||||
Program (independent of having been made by running the Program).
|
||||
Whether that is true depends on what the Program does.
|
||||
|
||||
1. You may copy and distribute verbatim copies of the Program's
|
||||
source code as you receive it, in any medium, provided that you
|
||||
conspicuously and appropriately publish on each copy an appropriate
|
||||
copyright notice and disclaimer of warranty; keep intact all the
|
||||
notices that refer to this License and to the absence of any warranty;
|
||||
and give any other recipients of the Program a copy of this License
|
||||
along with the Program.
|
||||
|
||||
You may charge a fee for the physical act of transferring a copy, and
|
||||
you may at your option offer warranty protection in exchange for a fee.
|
||||
|
||||
2. You may modify your copy or copies of the Program or any portion
|
||||
of it, thus forming a work based on the Program, and copy and
|
||||
distribute such modifications or work under the terms of Section 1
|
||||
above, provided that you also meet all of these conditions:
|
||||
|
||||
a) You must cause the modified files to carry prominent notices
|
||||
stating that you changed the files and the date of any change.
|
||||
|
||||
b) You must cause any work that you distribute or publish, that in
|
||||
whole or in part contains or is derived from the Program or any
|
||||
part thereof, to be licensed as a whole at no charge to all third
|
||||
parties under the terms of this License.
|
||||
|
||||
c) If the modified program normally reads commands interactively
|
||||
when run, you must cause it, when started running for such
|
||||
interactive use in the most ordinary way, to print or display an
|
||||
announcement including an appropriate copyright notice and a
|
||||
notice that there is no warranty (or else, saying that you provide
|
||||
a warranty) and that users may redistribute the program under
|
||||
these conditions, and telling the user how to view a copy of this
|
||||
License. (Exception: if the Program itself is interactive but
|
||||
does not normally print such an announcement, your work based on
|
||||
the Program is not required to print an announcement.)
|
||||
|
||||
These requirements apply to the modified work as a whole. If
|
||||
identifiable sections of that work are not derived from the Program,
|
||||
and can be reasonably considered independent and separate works in
|
||||
themselves, then this License, and its terms, do not apply to those
|
||||
sections when you distribute them as separate works. But when you
|
||||
distribute the same sections as part of a whole which is a work based
|
||||
on the Program, the distribution of the whole must be on the terms of
|
||||
this License, whose permissions for other licensees extend to the
|
||||
entire whole, and thus to each and every part regardless of who wrote it.
|
||||
|
||||
Thus, it is not the intent of this section to claim rights or contest
|
||||
your rights to work written entirely by you; rather, the intent is to
|
||||
exercise the right to control the distribution of derivative or
|
||||
collective works based on the Program.
|
||||
|
||||
In addition, mere aggregation of another work not based on the Program
|
||||
with the Program (or with a work based on the Program) on a volume of
|
||||
a storage or distribution medium does not bring the other work under
|
||||
the scope of this License.
|
||||
|
||||
3. You may copy and distribute the Program (or a work based on it,
|
||||
under Section 2) in object code or executable form under the terms of
|
||||
Sections 1 and 2 above provided that you also do one of the following:
|
||||
|
||||
a) Accompany it with the complete corresponding machine-readable
|
||||
source code, which must be distributed under the terms of Sections
|
||||
1 and 2 above on a medium customarily used for software interchange; or,
|
||||
|
||||
b) Accompany it with a written offer, valid for at least three
|
||||
years, to give any third party, for a charge no more than your
|
||||
cost of physically performing source distribution, a complete
|
||||
machine-readable copy of the corresponding source code, to be
|
||||
distributed under the terms of Sections 1 and 2 above on a medium
|
||||
customarily used for software interchange; or,
|
||||
|
||||
c) Accompany it with the information you received as to the offer
|
||||
to distribute corresponding source code. (This alternative is
|
||||
allowed only for noncommercial distribution and only if you
|
||||
received the program in object code or executable form with such
|
||||
an offer, in accord with Subsection b above.)
|
||||
|
||||
The source code for a work means the preferred form of the work for
|
||||
making modifications to it. For an executable work, complete source
|
||||
code means all the source code for all modules it contains, plus any
|
||||
associated interface definition files, plus the scripts used to
|
||||
control compilation and installation of the executable. However, as a
|
||||
special exception, the source code distributed need not include
|
||||
anything that is normally distributed (in either source or binary
|
||||
form) with the major components (compiler, kernel, and so on) of the
|
||||
operating system on which the executable runs, unless that component
|
||||
itself accompanies the executable.
|
||||
|
||||
If distribution of executable or object code is made by offering
|
||||
access to copy from a designated place, then offering equivalent
|
||||
access to copy the source code from the same place counts as
|
||||
distribution of the source code, even though third parties are not
|
||||
compelled to copy the source along with the object code.
|
||||
|
||||
4. You may not copy, modify, sublicense, or distribute the Program
|
||||
except as expressly provided under this License. Any attempt
|
||||
otherwise to copy, modify, sublicense or distribute the Program is
|
||||
void, and will automatically terminate your rights under this License.
|
||||
However, parties who have received copies, or rights, from you under
|
||||
this License will not have their licenses terminated so long as such
|
||||
parties remain in full compliance.
|
||||
|
||||
5. You are not required to accept this License, since you have not
|
||||
signed it. However, nothing else grants you permission to modify or
|
||||
distribute the Program or its derivative works. These actions are
|
||||
prohibited by law if you do not accept this License. Therefore, by
|
||||
modifying or distributing the Program (or any work based on the
|
||||
Program), you indicate your acceptance of this License to do so, and
|
||||
all its terms and conditions for copying, distributing or modifying
|
||||
the Program or works based on it.
|
||||
|
||||
6. Each time you redistribute the Program (or any work based on the
|
||||
Program), the recipient automatically receives a license from the
|
||||
original licensor to copy, distribute or modify the Program subject to
|
||||
these terms and conditions. You may not impose any further
|
||||
restrictions on the recipients' exercise of the rights granted herein.
|
||||
You are not responsible for enforcing compliance by third parties to
|
||||
this License.
|
||||
|
||||
7. If, as a consequence of a court judgment or allegation of patent
|
||||
infringement or for any other reason (not limited to patent issues),
|
||||
conditions are imposed on you (whether by court order, agreement or
|
||||
otherwise) that contradict the conditions of this License, they do not
|
||||
excuse you from the conditions of this License. If you cannot
|
||||
distribute so as to satisfy simultaneously your obligations under this
|
||||
License and any other pertinent obligations, then as a consequence you
|
||||
may not distribute the Program at all. For example, if a patent
|
||||
license would not permit royalty-free redistribution of the Program by
|
||||
all those who receive copies directly or indirectly through you, then
|
||||
the only way you could satisfy both it and this License would be to
|
||||
refrain entirely from distribution of the Program.
|
||||
|
||||
If any portion of this section is held invalid or unenforceable under
|
||||
any particular circumstance, the balance of the section is intended to
|
||||
apply and the section as a whole is intended to apply in other
|
||||
circumstances.
|
||||
|
||||
It is not the purpose of this section to induce you to infringe any
|
||||
patents or other property right claims or to contest validity of any
|
||||
such claims; this section has the sole purpose of protecting the
|
||||
integrity of the free software distribution system, which is
|
||||
implemented by public license practices. Many people have made
|
||||
generous contributions to the wide range of software distributed
|
||||
through that system in reliance on consistent application of that
|
||||
system; it is up to the author/donor to decide if he or she is willing
|
||||
to distribute software through any other system and a licensee cannot
|
||||
impose that choice.
|
||||
|
||||
This section is intended to make thoroughly clear what is believed to
|
||||
be a consequence of the rest of this License.
|
||||
|
||||
8. If the distribution and/or use of the Program is restricted in
|
||||
certain countries either by patents or by copyrighted interfaces, the
|
||||
original copyright holder who places the Program under this License
|
||||
may add an explicit geographical distribution limitation excluding
|
||||
those countries, so that distribution is permitted only in or among
|
||||
countries not thus excluded. In such case, this License incorporates
|
||||
the limitation as if written in the body of this License.
|
||||
|
||||
9. The Free Software Foundation may publish revised and/or new versions
|
||||
of the General Public License from time to time. Such new versions will
|
||||
be similar in spirit to the present version, but may differ in detail to
|
||||
address new problems or concerns.
|
||||
|
||||
Each version is given a distinguishing version number. If the Program
|
||||
specifies a version number of this License which applies to it and "any
|
||||
later version", you have the option of following the terms and conditions
|
||||
either of that version or of any later version published by the Free
|
||||
Software Foundation. If the Program does not specify a version number of
|
||||
this License, you may choose any version ever published by the Free Software
|
||||
Foundation.
|
||||
|
||||
10. If you wish to incorporate parts of the Program into other free
|
||||
programs whose distribution conditions are different, write to the author
|
||||
to ask for permission. For software which is copyrighted by the Free
|
||||
Software Foundation, write to the Free Software Foundation; we sometimes
|
||||
make exceptions for this. Our decision will be guided by the two goals
|
||||
of preserving the free status of all derivatives of our free software and
|
||||
of promoting the sharing and reuse of software generally.
|
||||
|
||||
NO WARRANTY
|
||||
|
||||
11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
|
||||
FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
|
||||
OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
|
||||
PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
|
||||
OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
|
||||
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS
|
||||
TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE
|
||||
PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
|
||||
REPAIR OR CORRECTION.
|
||||
|
||||
12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
|
||||
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
|
||||
REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
|
||||
INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
|
||||
OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
|
||||
TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
|
||||
YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
|
||||
PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
|
||||
POSSIBILITY OF SUCH DAMAGES.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
How to Apply These Terms to Your New Programs
|
||||
|
||||
If you develop a new program, and you want it to be of the greatest
|
||||
possible use to the public, the best way to achieve this is to make it
|
||||
free software which everyone can redistribute and change under these terms.
|
||||
|
||||
To do so, attach the following notices to the program. It is safest
|
||||
to attach them to the start of each source file to most effectively
|
||||
convey the exclusion of warranty; and each file should have at least
|
||||
the "copyright" line and a pointer to where the full notice is found.
|
||||
|
||||
<one line to give the program's name and a brief idea of what it does.>
|
||||
Copyright (C) <year> <name of author>
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation; either version 2 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License along
|
||||
with this program; if not, write to the Free Software Foundation, Inc.,
|
||||
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
|
||||
Also add information on how to contact you by electronic and paper mail.
|
||||
|
||||
If the program is interactive, make it output a short notice like this
|
||||
when it starts in an interactive mode:
|
||||
|
||||
Gnomovision version 69, Copyright (C) year name of author
|
||||
Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
|
||||
This is free software, and you are welcome to redistribute it
|
||||
under certain conditions; type `show c' for details.
|
||||
|
||||
The hypothetical commands `show w' and `show c' should show the appropriate
|
||||
parts of the General Public License. Of course, the commands you use may
|
||||
be called something other than `show w' and `show c'; they could even be
|
||||
mouse-clicks or menu items--whatever suits your program.
|
||||
|
||||
You should also get your employer (if you work as a programmer) or your
|
||||
school, if any, to sign a "copyright disclaimer" for the program, if
|
||||
necessary. Here is a sample; alter the names:
|
||||
|
||||
Yoyodyne, Inc., hereby disclaims all copyright interest in the program
|
||||
`Gnomovision' (which makes passes at compilers) written by James Hacker.
|
||||
|
||||
<signature of Ty Coon>, 1 April 1989
|
||||
Ty Coon, President of Vice
|
||||
|
||||
This General Public License does not permit incorporating your program into
|
||||
proprietary programs. If your program is a subroutine library, you may
|
||||
consider it more useful to permit linking proprietary applications with the
|
||||
library. If this is what you want to do, use the GNU Lesser General
|
||||
Public License instead of this License.
|
||||
27
README
Normal file
27
README
Normal file
@ -0,0 +1,27 @@
|
||||
Signing kernel modules and EFI binaries in the Open Build Service
|
||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
Note: Not everything that is described here is actually implemented. Even
|
||||
those parts that are implemented can change slightly.
|
||||
|
||||
Packages that need to sign files during build should add the following lines
|
||||
to the specfile
|
||||
|
||||
# needssslcertforbuild
|
||||
%define sign_files pattern...
|
||||
BuildRequires: pesign-obs-integration
|
||||
|
||||
The "# needssslcertforbuild" comment tells the buildservice to store the
|
||||
signing certificate in %_sourcedir/_projectcert.crt. At the end of the
|
||||
install phase, the pesign-install-post script computes hashes of all
|
||||
files matching the patterns in %sign_files. The sha256 hashes are stored
|
||||
in %_topdir/OTHER/%name.cpio.rsasign, plus the script places a
|
||||
pesign-repackage.spec file there. When the first rpmbuild finishes, the
|
||||
buildservice sends the cpio archive to the signing server, which returns
|
||||
a rsasigned.cio archive with RSA signatures of the sha256 hashes.
|
||||
|
||||
The pesign-repackage.spec takes the original RPMs, unpacks them and
|
||||
appends the signatures to the files (TODO: only implemented for firmware
|
||||
files). It then uses the pesign-gen-repackage-spec script to generate
|
||||
another specfile, which builds new RPMs with signed files.
|
||||
|
||||
441
kernel-sign-file
Normal file
441
kernel-sign-file
Normal file
@ -0,0 +1,441 @@
|
||||
#!/usr/bin/perl -w
|
||||
#
|
||||
# Sign a module file using the given key.
|
||||
#
|
||||
|
||||
my $USAGE =
|
||||
"Usage: scripts/sign-file [-v] [-f] <hash algo> <key> <x509> <module> [<dest>]\n" .
|
||||
" scripts/sign-file [-v] [-f] -s <raw sig> <hash algo> <x509> <module> [<dest>]\n" .
|
||||
" -v verbose output\n" .
|
||||
" -f create a firmware signature file\n";
|
||||
|
||||
|
||||
use strict;
|
||||
use FileHandle;
|
||||
use IPC::Open2;
|
||||
use Getopt::Std;
|
||||
|
||||
my %opts;
|
||||
getopts('vfs:', \%opts) or die $USAGE;
|
||||
my $verbose = $opts{'v'};
|
||||
my $signature_file = $opts{'s'};
|
||||
my $sign_fw = $opts{'f'};
|
||||
|
||||
die $USAGE if ($#ARGV > 4);
|
||||
die $USAGE if (!$signature_file && $#ARGV < 3 || $signature_file && $#ARGV < 2);
|
||||
|
||||
my $dgst = shift @ARGV;
|
||||
my $private_key;
|
||||
if (!$signature_file) {
|
||||
$private_key = shift @ARGV;
|
||||
}
|
||||
my $x509 = shift @ARGV;
|
||||
my $module = shift @ARGV;
|
||||
my ($dest, $keep_orig);
|
||||
if (@ARGV) {
|
||||
$dest = $ARGV[0];
|
||||
$keep_orig = 1;
|
||||
} elsif ($sign_fw) {
|
||||
$dest = $module . ".sig";
|
||||
$keep_orig = 1;
|
||||
} else {
|
||||
$dest = $module . "~";
|
||||
}
|
||||
my $mode_name = $sign_fw ? "firmware" : "module";
|
||||
|
||||
die "Can't read private key\n" if (!$signature_file && !-r $private_key);
|
||||
die "Can't read signature file\n" if ($signature_file && !-r $signature_file);
|
||||
die "Can't read X.509 certificate\n" unless (-r $x509);
|
||||
die "Can't read $mode_name\n" unless (-r $module);
|
||||
|
||||
#
|
||||
# Function to read the contents of a file into a variable.
|
||||
#
|
||||
sub read_file($)
|
||||
{
|
||||
my ($file) = @_;
|
||||
my $contents;
|
||||
my $len;
|
||||
|
||||
open(FD, "<$file") || die $file;
|
||||
binmode FD;
|
||||
my @st = stat(FD);
|
||||
die $file if (!@st);
|
||||
$len = read(FD, $contents, $st[7]) || die $file;
|
||||
close(FD) || die $file;
|
||||
die "$file: Wanted length ", $st[7], ", got ", $len, "\n"
|
||||
if ($len != $st[7]);
|
||||
return $contents;
|
||||
}
|
||||
|
||||
###############################################################################
|
||||
#
|
||||
# First of all, we have to parse the X.509 certificate to find certain details
|
||||
# about it.
|
||||
#
|
||||
# We read the DER-encoded X509 certificate and parse it to extract the Subject
|
||||
# name and Subject Key Identifier. Theis provides the data we need to build
|
||||
# the certificate identifier.
|
||||
#
|
||||
# The signer's name part of the identifier is fabricated from the commonName,
|
||||
# the organizationName or the emailAddress components of the X.509 subject
|
||||
# name.
|
||||
#
|
||||
# The subject key ID is used to select which of that signer's certificates
|
||||
# we're intending to use to sign the module.
|
||||
#
|
||||
###############################################################################
|
||||
my $x509_certificate = read_file($x509);
|
||||
|
||||
my $UNIV = 0 << 6;
|
||||
my $APPL = 1 << 6;
|
||||
my $CONT = 2 << 6;
|
||||
my $PRIV = 3 << 6;
|
||||
|
||||
my $CONS = 0x20;
|
||||
|
||||
my $BOOLEAN = 0x01;
|
||||
my $INTEGER = 0x02;
|
||||
my $BIT_STRING = 0x03;
|
||||
my $OCTET_STRING = 0x04;
|
||||
my $NULL = 0x05;
|
||||
my $OBJ_ID = 0x06;
|
||||
my $UTF8String = 0x0c;
|
||||
my $SEQUENCE = 0x10;
|
||||
my $SET = 0x11;
|
||||
my $UTCTime = 0x17;
|
||||
my $GeneralizedTime = 0x18;
|
||||
|
||||
my %OIDs = (
|
||||
pack("CCC", 85, 4, 3) => "commonName",
|
||||
pack("CCC", 85, 4, 6) => "countryName",
|
||||
pack("CCC", 85, 4, 10) => "organizationName",
|
||||
pack("CCC", 85, 4, 11) => "organizationUnitName",
|
||||
pack("CCCCCCCCC", 42, 134, 72, 134, 247, 13, 1, 1, 1) => "rsaEncryption",
|
||||
pack("CCCCCCCCC", 42, 134, 72, 134, 247, 13, 1, 1, 5) => "sha1WithRSAEncryption",
|
||||
pack("CCCCCCCCC", 42, 134, 72, 134, 247, 13, 1, 9, 1) => "emailAddress",
|
||||
pack("CCC", 85, 29, 35) => "authorityKeyIdentifier",
|
||||
pack("CCC", 85, 29, 14) => "subjectKeyIdentifier",
|
||||
pack("CCC", 85, 29, 19) => "basicConstraints"
|
||||
);
|
||||
|
||||
###############################################################################
|
||||
#
|
||||
# Extract an ASN.1 element from a string and return information about it.
|
||||
#
|
||||
###############################################################################
|
||||
sub asn1_extract($$@)
|
||||
{
|
||||
my ($cursor, $expected_tag, $optional) = @_;
|
||||
|
||||
return [ -1 ]
|
||||
if ($cursor->[1] == 0 && $optional);
|
||||
|
||||
die $x509, ": ", $cursor->[0], ": ASN.1 data underrun (elem ", $cursor->[1], ")\n"
|
||||
if ($cursor->[1] < 2);
|
||||
|
||||
my ($tag, $len) = unpack("CC", substr(${$cursor->[2]}, $cursor->[0], 2));
|
||||
|
||||
if ($expected_tag != -1 && $tag != $expected_tag) {
|
||||
return [ -1 ]
|
||||
if ($optional);
|
||||
die $x509, ": ", $cursor->[0], ": ASN.1 unexpected tag (", $tag,
|
||||
" not ", $expected_tag, ")\n";
|
||||
}
|
||||
|
||||
$cursor->[0] += 2;
|
||||
$cursor->[1] -= 2;
|
||||
|
||||
die $x509, ": ", $cursor->[0], ": ASN.1 long tag\n"
|
||||
if (($tag & 0x1f) == 0x1f);
|
||||
die $x509, ": ", $cursor->[0], ": ASN.1 indefinite length\n"
|
||||
if ($len == 0x80);
|
||||
|
||||
if ($len > 0x80) {
|
||||
my $l = $len - 0x80;
|
||||
die $x509, ": ", $cursor->[0], ": ASN.1 data underrun (len len $l)\n"
|
||||
if ($cursor->[1] < $l);
|
||||
|
||||
if ($l == 0x1) {
|
||||
$len = unpack("C", substr(${$cursor->[2]}, $cursor->[0], 1));
|
||||
} elsif ($l == 0x2) {
|
||||
$len = unpack("n", substr(${$cursor->[2]}, $cursor->[0], 2));
|
||||
} elsif ($l == 0x3) {
|
||||
$len = unpack("C", substr(${$cursor->[2]}, $cursor->[0], 1)) << 16;
|
||||
$len = unpack("n", substr(${$cursor->[2]}, $cursor->[0] + 1, 2));
|
||||
} elsif ($l == 0x4) {
|
||||
$len = unpack("N", substr(${$cursor->[2]}, $cursor->[0], 4));
|
||||
} else {
|
||||
die $x509, ": ", $cursor->[0], ": ASN.1 element too long (", $l, ")\n";
|
||||
}
|
||||
|
||||
$cursor->[0] += $l;
|
||||
$cursor->[1] -= $l;
|
||||
}
|
||||
|
||||
die $x509, ": ", $cursor->[0], ": ASN.1 data underrun (", $len, ")\n"
|
||||
if ($cursor->[1] < $len);
|
||||
|
||||
my $ret = [ $tag, [ $cursor->[0], $len, $cursor->[2] ] ];
|
||||
$cursor->[0] += $len;
|
||||
$cursor->[1] -= $len;
|
||||
|
||||
return $ret;
|
||||
}
|
||||
|
||||
###############################################################################
|
||||
#
|
||||
# Retrieve the data referred to by a cursor
|
||||
#
|
||||
###############################################################################
|
||||
sub asn1_retrieve($)
|
||||
{
|
||||
my ($cursor) = @_;
|
||||
my ($offset, $len, $data) = @$cursor;
|
||||
return substr($$data, $offset, $len);
|
||||
}
|
||||
|
||||
###############################################################################
|
||||
#
|
||||
# Roughly parse the X.509 certificate
|
||||
#
|
||||
###############################################################################
|
||||
my $cursor = [ 0, length($x509_certificate), \$x509_certificate ];
|
||||
|
||||
my $cert = asn1_extract($cursor, $UNIV | $CONS | $SEQUENCE);
|
||||
my $tbs = asn1_extract($cert->[1], $UNIV | $CONS | $SEQUENCE);
|
||||
my $version = asn1_extract($tbs->[1], $CONT | $CONS | 0, 1);
|
||||
my $serial_number = asn1_extract($tbs->[1], $UNIV | $INTEGER);
|
||||
my $sig_type = asn1_extract($tbs->[1], $UNIV | $CONS | $SEQUENCE);
|
||||
my $issuer = asn1_extract($tbs->[1], $UNIV | $CONS | $SEQUENCE);
|
||||
my $validity = asn1_extract($tbs->[1], $UNIV | $CONS | $SEQUENCE);
|
||||
my $subject = asn1_extract($tbs->[1], $UNIV | $CONS | $SEQUENCE);
|
||||
my $key = asn1_extract($tbs->[1], $UNIV | $CONS | $SEQUENCE);
|
||||
my $issuer_uid = asn1_extract($tbs->[1], $CONT | $CONS | 1, 1);
|
||||
my $subject_uid = asn1_extract($tbs->[1], $CONT | $CONS | 2, 1);
|
||||
my $extension_list = asn1_extract($tbs->[1], $CONT | $CONS | 3, 1);
|
||||
|
||||
my $subject_key_id = ();
|
||||
my $authority_key_id = ();
|
||||
|
||||
#
|
||||
# Parse the extension list
|
||||
#
|
||||
if ($extension_list->[0] != -1) {
|
||||
my $extensions = asn1_extract($extension_list->[1], $UNIV | $CONS | $SEQUENCE);
|
||||
|
||||
while ($extensions->[1]->[1] > 0) {
|
||||
my $ext = asn1_extract($extensions->[1], $UNIV | $CONS | $SEQUENCE);
|
||||
my $x_oid = asn1_extract($ext->[1], $UNIV | $OBJ_ID);
|
||||
my $x_crit = asn1_extract($ext->[1], $UNIV | $BOOLEAN, 1);
|
||||
my $x_val = asn1_extract($ext->[1], $UNIV | $OCTET_STRING);
|
||||
|
||||
my $raw_oid = asn1_retrieve($x_oid->[1]);
|
||||
next if (!exists($OIDs{$raw_oid}));
|
||||
my $x_type = $OIDs{$raw_oid};
|
||||
|
||||
my $raw_value = asn1_retrieve($x_val->[1]);
|
||||
|
||||
if ($x_type eq "subjectKeyIdentifier") {
|
||||
my $vcursor = [ 0, length($raw_value), \$raw_value ];
|
||||
|
||||
$subject_key_id = asn1_extract($vcursor, $UNIV | $OCTET_STRING);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
###############################################################################
|
||||
#
|
||||
# Determine what we're going to use as the signer's name. In order of
|
||||
# preference, take one of: commonName, organizationName or emailAddress.
|
||||
#
|
||||
###############################################################################
|
||||
my $org = "";
|
||||
my $cn = "";
|
||||
my $email = "";
|
||||
|
||||
while ($subject->[1]->[1] > 0) {
|
||||
my $rdn = asn1_extract($subject->[1], $UNIV | $CONS | $SET);
|
||||
my $attr = asn1_extract($rdn->[1], $UNIV | $CONS | $SEQUENCE);
|
||||
my $n_oid = asn1_extract($attr->[1], $UNIV | $OBJ_ID);
|
||||
my $n_val = asn1_extract($attr->[1], -1);
|
||||
|
||||
my $raw_oid = asn1_retrieve($n_oid->[1]);
|
||||
next if (!exists($OIDs{$raw_oid}));
|
||||
my $n_type = $OIDs{$raw_oid};
|
||||
|
||||
my $raw_value = asn1_retrieve($n_val->[1]);
|
||||
|
||||
if ($n_type eq "organizationName") {
|
||||
$org = $raw_value;
|
||||
} elsif ($n_type eq "commonName") {
|
||||
$cn = $raw_value;
|
||||
} elsif ($n_type eq "emailAddress") {
|
||||
$email = $raw_value;
|
||||
}
|
||||
}
|
||||
|
||||
my $signers_name = $email;
|
||||
|
||||
if ($org && $cn) {
|
||||
# Don't use the organizationName if the commonName repeats it
|
||||
if (length($org) <= length($cn) &&
|
||||
substr($cn, 0, length($org)) eq $org) {
|
||||
$signers_name = $cn;
|
||||
goto got_id_name;
|
||||
}
|
||||
|
||||
# Or a signifcant chunk of it
|
||||
if (length($org) >= 7 &&
|
||||
length($cn) >= 7 &&
|
||||
substr($cn, 0, 7) eq substr($org, 0, 7)) {
|
||||
$signers_name = $cn;
|
||||
goto got_id_name;
|
||||
}
|
||||
|
||||
$signers_name = $org . ": " . $cn;
|
||||
} elsif ($org) {
|
||||
$signers_name = $org;
|
||||
} elsif ($cn) {
|
||||
$signers_name = $cn;
|
||||
}
|
||||
|
||||
got_id_name:
|
||||
|
||||
die $x509, ": ", "X.509: Couldn't find the Subject Key Identifier extension\n"
|
||||
if (!$subject_key_id);
|
||||
|
||||
my $key_identifier = asn1_retrieve($subject_key_id->[1]);
|
||||
|
||||
###############################################################################
|
||||
#
|
||||
# Create and attach the module signature
|
||||
#
|
||||
###############################################################################
|
||||
|
||||
#
|
||||
# Signature parameters
|
||||
#
|
||||
my $algo = 1; # Public-key crypto algorithm: RSA
|
||||
my $hash = 0; # Digest algorithm
|
||||
my $id_type = 1; # Identifier type: X.509
|
||||
|
||||
#
|
||||
# Digest the data
|
||||
#
|
||||
my $prologue;
|
||||
if ($dgst eq "sha1") {
|
||||
$prologue = pack("C*",
|
||||
0x30, 0x21, 0x30, 0x09, 0x06, 0x05,
|
||||
0x2B, 0x0E, 0x03, 0x02, 0x1A,
|
||||
0x05, 0x00, 0x04, 0x14);
|
||||
$hash = 2;
|
||||
} elsif ($dgst eq "sha224") {
|
||||
$prologue = pack("C*",
|
||||
0x30, 0x2d, 0x30, 0x0d, 0x06, 0x09,
|
||||
0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x04,
|
||||
0x05, 0x00, 0x04, 0x1C);
|
||||
$hash = 7;
|
||||
} elsif ($dgst eq "sha256") {
|
||||
$prologue = pack("C*",
|
||||
0x30, 0x31, 0x30, 0x0d, 0x06, 0x09,
|
||||
0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01,
|
||||
0x05, 0x00, 0x04, 0x20);
|
||||
$hash = 4;
|
||||
} elsif ($dgst eq "sha384") {
|
||||
$prologue = pack("C*",
|
||||
0x30, 0x41, 0x30, 0x0d, 0x06, 0x09,
|
||||
0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02,
|
||||
0x05, 0x00, 0x04, 0x30);
|
||||
$hash = 5;
|
||||
} elsif ($dgst eq "sha512") {
|
||||
$prologue = pack("C*",
|
||||
0x30, 0x51, 0x30, 0x0d, 0x06, 0x09,
|
||||
0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03,
|
||||
0x05, 0x00, 0x04, 0x40);
|
||||
$hash = 6;
|
||||
} else {
|
||||
die "Unknown hash algorithm: $dgst\n";
|
||||
}
|
||||
|
||||
my $signature;
|
||||
if ($signature_file) {
|
||||
$signature = read_file($signature_file);
|
||||
} else {
|
||||
#
|
||||
# Generate the digest and read from openssl's stdout
|
||||
#
|
||||
my $digest;
|
||||
$digest = readpipe("openssl dgst -$dgst -binary $module") || die "openssl dgst";
|
||||
|
||||
#
|
||||
# Generate the binary signature, which will be just the integer that
|
||||
# comprises the signature with no metadata attached.
|
||||
#
|
||||
my $pid;
|
||||
$pid = open2(*read_from, *write_to,
|
||||
"openssl rsautl -sign -inkey $private_key -keyform PEM") ||
|
||||
die "openssl rsautl";
|
||||
binmode write_to;
|
||||
print write_to $prologue . $digest || die "pipe to openssl rsautl";
|
||||
close(write_to) || die "pipe to openssl rsautl";
|
||||
|
||||
binmode read_from;
|
||||
read(read_from, $signature, 4096) || die "pipe from openssl rsautl";
|
||||
close(read_from) || die "pipe from openssl rsautl";
|
||||
waitpid($pid, 0) || die;
|
||||
die "openssl rsautl died: $?" if ($? >> 8);
|
||||
}
|
||||
$signature = pack("n", length($signature)) . $signature,
|
||||
|
||||
#
|
||||
# Build the signed binary
|
||||
#
|
||||
my $unsigned_module = read_file($module);
|
||||
|
||||
my $magic_number = $sign_fw ?
|
||||
"~Linux firmware signature~\n" :
|
||||
"~Module signature appended~\n";
|
||||
|
||||
my $info = pack("CCCCCxxxN",
|
||||
$algo, $hash, $id_type,
|
||||
length($signers_name),
|
||||
length($key_identifier),
|
||||
length($signature));
|
||||
|
||||
if ($verbose) {
|
||||
print "Size of unsigned $mode_name: ", length($unsigned_module), "\n";
|
||||
print "Size of signer's name : ", length($signers_name), "\n";
|
||||
print "Size of key identifier : ", length($key_identifier), "\n";
|
||||
print "Size of signature : ", length($signature), "\n";
|
||||
print "Size of informaton : ", length($info), "\n";
|
||||
print "Size of magic number : ", length($magic_number), "\n";
|
||||
print "Signer's name : '", $signers_name, "'\n";
|
||||
print "Digest : $dgst\n";
|
||||
}
|
||||
|
||||
open(FD, ">$dest") || die $dest;
|
||||
binmode FD;
|
||||
if ($sign_fw) {
|
||||
print FD
|
||||
$magic_number,
|
||||
$info,
|
||||
$signers_name,
|
||||
$key_identifier,
|
||||
$signature
|
||||
;
|
||||
} else {
|
||||
print FD
|
||||
$unsigned_module,
|
||||
$signers_name,
|
||||
$key_identifier,
|
||||
$signature,
|
||||
$info,
|
||||
$magic_number
|
||||
;
|
||||
}
|
||||
close FD || die $dest;
|
||||
|
||||
if (!$keep_orig) {
|
||||
rename($dest, $module) || die $module;
|
||||
}
|
||||
5
macros.pesign-obs
Normal file
5
macros.pesign-obs
Normal file
@ -0,0 +1,5 @@
|
||||
# Macros for pesign / modsign OBS integration
|
||||
|
||||
# The spec file should define %sign_files to a space-separated list of patterns
|
||||
# of files to be signed, e.g. %define sign_files /lib/firmware *.ko
|
||||
%__os_install_post /usr/lib/rpm/pesign-install-post --files "%{?sign_files}" --output %_topdir/OTHER
|
||||
369
pesign-gen-repackage-spec
Normal file
369
pesign-gen-repackage-spec
Normal file
@ -0,0 +1,369 @@
|
||||
#!/usr/bin/perl
|
||||
# Given a set of rpm packages and directory with their new content,
|
||||
# generate a specfile that generates new packages
|
||||
#
|
||||
# Copyright (c) 2013 SUSE Linux Products GmbH, Nuernberg, Germany.
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
|
||||
|
||||
use strict;
|
||||
use warnings;
|
||||
|
||||
my $USAGE = "Usage: $0 --directory <payload directory> rpm...\n";
|
||||
|
||||
use Getopt::Long;
|
||||
use Fcntl qw(:mode :seek);
|
||||
|
||||
my $directory;
|
||||
my $output = ".";
|
||||
my @rpms;
|
||||
|
||||
$ENV{LC_ALL} = "en_US.UTF-8";
|
||||
|
||||
GetOptions(
|
||||
"help|h" => sub { print $USAGE; exit; },
|
||||
"directory|d=s" => \$directory,
|
||||
"output|o=s" => \$output,
|
||||
) or die $USAGE;
|
||||
@rpms = @ARGV;
|
||||
if (!@rpms) {
|
||||
print STDERR "$0: No packages given\n";
|
||||
die $USAGE;
|
||||
}
|
||||
if (!$directory || substr($directory, 0, 1) ne '/' || ! -d $directory) {
|
||||
print STDERR "$0: --directory must be an absolute path\n";
|
||||
die $USAGE;
|
||||
}
|
||||
|
||||
sub query_array {
|
||||
my ($rpm, @tags) = @_;
|
||||
my @res;
|
||||
|
||||
my $format = "[" . join("|", map { "\%{$_}" } @tags) . "\\n]";
|
||||
open(my $fh, '-|', "rpm", "-qp", "--qf", $format, $rpm)
|
||||
or die "rpm: $!\n";
|
||||
while (<$fh>) {
|
||||
chomp;
|
||||
my @t = split(/\|/, $_, -1);
|
||||
push(@res, \@t);
|
||||
}
|
||||
close($fh);
|
||||
return @res;
|
||||
}
|
||||
|
||||
sub query_single {
|
||||
my ($rpm, $tag) = @_;
|
||||
my $res;
|
||||
|
||||
open(my $fh, '-|', "rpm", "-qp", "--qf", "\%{$tag}\\n", $rpm)
|
||||
or die "rpm: $!\n";
|
||||
{
|
||||
local $/ = undef;
|
||||
$res = <$fh>;
|
||||
}
|
||||
chomp $res;
|
||||
close($fh);
|
||||
return $res;
|
||||
|
||||
}
|
||||
|
||||
# specfile dependency => rpm tag name
|
||||
my %dep2tag = (
|
||||
conflicts => "conflict",
|
||||
obsoletes => "obsolete",
|
||||
provides => "provide",
|
||||
requires => "require",
|
||||
suggests => "suggests",
|
||||
enhances => "enhances",
|
||||
);
|
||||
|
||||
# strong version of suggests and enhances
|
||||
my %dep2strong = (
|
||||
suggests => "recommends",
|
||||
enhances => "supplements",
|
||||
);
|
||||
|
||||
# specfile scriptlet => rpm tag name
|
||||
my %script2tag = (
|
||||
pre => "prein",
|
||||
post => "postin",
|
||||
preun => "preun",
|
||||
postun => "postun",
|
||||
pretrans => "pretrans",
|
||||
posttrans => "posttrans",
|
||||
verifyscript => "verifyscript",
|
||||
# FIXME: triggers
|
||||
);
|
||||
|
||||
# tags which are printed verbatim in the specfile
|
||||
my @simple_tags = qw(version release license group summary packager vendor
|
||||
url distribution);
|
||||
|
||||
sub load_package {
|
||||
my $rpm = shift;
|
||||
my %res;
|
||||
|
||||
for my $tag (qw(name arch sourcerpm description), @simple_tags) {
|
||||
$res{$tag} = query_single($rpm, $tag);
|
||||
}
|
||||
my @files;
|
||||
my @list = query_array($rpm, qw(filenames fileflags filemodes fileusername filegroupname filesizes filemtimes filelinktos));
|
||||
for my $file (@list) {
|
||||
push(@files, {
|
||||
name => $file->[0],
|
||||
flags => $file->[1],
|
||||
mode => $file->[2],
|
||||
owner => $file->[3],
|
||||
group => $file->[4],
|
||||
size => $file->[5],
|
||||
mtime => $file->[6],
|
||||
target => $file->[7],
|
||||
});
|
||||
}
|
||||
$res{files} = \@files;
|
||||
while (my ($dep, $tag) = each(%dep2tag)) {
|
||||
my @deps;
|
||||
my @list = query_array($rpm, "${tag}name", "${tag}flags", "${tag}version");
|
||||
for my $d (@list) {
|
||||
next if $d->[0] eq "(none)";
|
||||
push(@deps, {
|
||||
name => $d->[0],
|
||||
flags => $d->[1],
|
||||
version => $d->[2],
|
||||
});
|
||||
}
|
||||
$res{$dep} = \@deps;
|
||||
}
|
||||
|
||||
while (my ($script, $tag) = each(%script2tag)) {
|
||||
my $s = query_single($rpm, $tag);
|
||||
next unless $s && $s ne "(none)";
|
||||
my $interp = query_single($rpm, "${tag}prog");
|
||||
$res{$script} = {
|
||||
interp => $interp,
|
||||
script => $s,
|
||||
};
|
||||
}
|
||||
open(my $fh, '-|', "rpm", "-qp", "--changelog", $rpm) or die "rpm: $!\n";
|
||||
{
|
||||
local $/ = undef;
|
||||
my $changelog = <$fh>;
|
||||
close($fh);
|
||||
$res{changelog} = $changelog;
|
||||
}
|
||||
|
||||
return \%res;
|
||||
}
|
||||
|
||||
# quote percent signs in text
|
||||
sub quote {
|
||||
my $text = shift;
|
||||
|
||||
$text =~ s/%/%%/g;
|
||||
return $text;
|
||||
}
|
||||
|
||||
sub print_package {
|
||||
my ($p, $is_main) = @_;
|
||||
|
||||
if ($is_main) {
|
||||
print SPEC "Name: $p->{name}\n";
|
||||
print SPEC "Buildroot: $directory\n";
|
||||
print SPEC "\%define _use_internal_dependency_generator 0\n";
|
||||
print SPEC "\%define __find_provides %{nil}\n";
|
||||
print SPEC "\%define __find_requires %{nil}\n";
|
||||
print SPEC "\%define __find_supplements %{nil}\n";
|
||||
if ($p->{nosource}) {
|
||||
# We do not generate any no(src).rpm, but we want the
|
||||
# %{sourcerpm} tag in the binary packages to match.
|
||||
# So we add a dummy source and mark it as nosource.
|
||||
print SPEC "Source0: repackage.spec\n";
|
||||
print SPEC "NoSource: 0\n";
|
||||
}
|
||||
} else {
|
||||
print SPEC "\%package -n $p->{name}\n";
|
||||
}
|
||||
for my $tag (@simple_tags) {
|
||||
print SPEC "$tag: " . quote($p->{$tag}) . "\n";
|
||||
}
|
||||
print SPEC "BuildArch: noarch\n" if $p->{arch} eq "noarch";
|
||||
for my $dep (keys(%dep2tag)) {
|
||||
print_deps($dep, $p->{$dep});
|
||||
}
|
||||
print SPEC "\%description -n $p->{name}\n";
|
||||
print SPEC quote($p->{description}) . "\n\n";
|
||||
|
||||
for my $script (keys(%script2tag)) {
|
||||
next unless $p->{$script};
|
||||
my $file = "$script-$p->{name}";
|
||||
open(my $fh, '>', "$output/$file") or die "$output/$file: $!\n";
|
||||
print SPEC "\%$script -p $p->{$script}{interp} -n $p->{name} -f $file\n";
|
||||
print $fh $p->{$script}{script};
|
||||
close($fh);
|
||||
|
||||
}
|
||||
if ($p->{files}) {
|
||||
print SPEC "\%files -n $p->{name}\n";
|
||||
print_files($p->{files});
|
||||
}
|
||||
print SPEC "\n";
|
||||
}
|
||||
|
||||
# /usr/include/rpm/rpmds.h
|
||||
my %deptypes = (
|
||||
pre => (1 << 9),
|
||||
post => (1 << 10),
|
||||
preun => (1 << 11),
|
||||
postun => (1 << 12),
|
||||
verify => (1 << 13),
|
||||
);
|
||||
my %depflags = (
|
||||
"<" => (1 << 1),
|
||||
">" => (1 << 2),
|
||||
"=" => (1 << 3),
|
||||
rpmlib => (1 << 24),
|
||||
strong => (1 << 27),
|
||||
);
|
||||
|
||||
sub print_deps {
|
||||
my ($depname, $list) = @_;
|
||||
|
||||
foreach my $d (@$list) {
|
||||
next if ($d->{flags} & $depflags{rpmlib});
|
||||
|
||||
if ($d->{flags} & $depflags{strong}) {
|
||||
print SPEC $dep2strong{$depname};
|
||||
} else {
|
||||
print SPEC $depname;
|
||||
}
|
||||
my @deptypes;
|
||||
while (my ($type, $bit) = each(%deptypes)) {
|
||||
push(@deptypes, $type) if $d->{flags} & $bit;
|
||||
}
|
||||
print SPEC "(", join(",", @deptypes), ")" if @deptypes;
|
||||
print SPEC ": ";
|
||||
|
||||
print SPEC quote($d->{name});
|
||||
if ($d->{version}) {
|
||||
print SPEC " ";
|
||||
for my $op (qw(< > =)) {
|
||||
print SPEC $op if $d->{flags} & $depflags{$op};
|
||||
}
|
||||
print SPEC " " . quote($d->{version});
|
||||
}
|
||||
print SPEC "\n";
|
||||
}
|
||||
}
|
||||
|
||||
# /usr/include/rpm/rpmfi.h
|
||||
my %filetypes = (
|
||||
config => (1 << 0),
|
||||
doc => (1 << 1),
|
||||
missingok => (1 << 3),
|
||||
noreplace => (1 << 4),
|
||||
ghost => (1 << 6),
|
||||
);
|
||||
|
||||
sub print_files {
|
||||
my $files = shift;
|
||||
|
||||
for my $f (@$files) {
|
||||
my $path = "$directory/$f->{name}";
|
||||
my $attrs = "";
|
||||
# Fix mtime of directories, which cpio -idm fails to preserve
|
||||
if (S_ISDIR($f->{mode})) {
|
||||
$attrs .= "\%dir ";
|
||||
utime($f->{mtime}, $f->{mtime}, $path);
|
||||
}
|
||||
$attrs .= sprintf('%%attr(%04o, %s, %s) ', ($f->{mode} & 0777),
|
||||
$f->{owner}, $f->{group});
|
||||
if ($f->{flags} & $filetypes{config}) {
|
||||
$attrs .= "%config ";
|
||||
my @cfg_attrs;
|
||||
for my $attr (qw(missingok noreplace)) {
|
||||
next unless $f->{flags} & $filetypes{$attr};
|
||||
push(@cfg_attrs, $attr);
|
||||
}
|
||||
$attrs .= "(" . join(",", @cfg_attrs) . ")" if @cfg_attrs;
|
||||
}
|
||||
$attrs .= "%doc " if $f->{flags} & $filetypes{doc};
|
||||
if ($f->{flags} & $filetypes{ghost}) {
|
||||
$attrs .= "%ghost ";
|
||||
if (S_ISREG($f->{mode})) {
|
||||
open(my $fh, '>', $path) or die "$path: $!\n";
|
||||
if ($f->{size} > 0) {
|
||||
sysseek($fh, $f->{size} - 1, SEEK_SET);
|
||||
syswrite($fh, ' ', 1);
|
||||
}
|
||||
close($fh);
|
||||
utime($f->{mtime}, $f->{mtime}, $path);
|
||||
} elsif (S_ISLNK($f->{mode})) {
|
||||
symlink($f->{target}, $path);
|
||||
}
|
||||
}
|
||||
# mtime of symlinks is also not preserved by cpio
|
||||
if (S_ISLNK($f->{mode})) {
|
||||
# perl core does not provide lutimes()/utimensat()
|
||||
system("touch", "-h", "-d\@$f->{mtime}", $path);
|
||||
}
|
||||
|
||||
print SPEC "$attrs " . quote($f->{name}) . "\n";
|
||||
if (-e "$path.sig") {
|
||||
print SPEC "$attrs " . quote($f->{name}) . ".sig\n";
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
my %packages;
|
||||
for my $rpm (@rpms) {
|
||||
my $p = load_package($rpm);
|
||||
$packages{$p->{name}} = $p;
|
||||
}
|
||||
|
||||
my $sourcerpm;
|
||||
for my $p (values(%packages)) {
|
||||
$sourcerpm = $p->{sourcerpm} unless $sourcerpm;
|
||||
if ($p->{sourcerpm} ne $sourcerpm) {
|
||||
die "Error: packages built from different source rpm: $sourcerpm vs $p->{sourcerpm}\n";
|
||||
}
|
||||
}
|
||||
if ($sourcerpm !~ /^(.+)-([^-]+)-([^-]+)\.(no)?src\.rpm$/) {
|
||||
die "Error: malformed %{sourcerpm} tag: $sourcerpm\n";
|
||||
}
|
||||
my ($main_name, $main_ver, $main_rel, $nosrc) = ($1, $2, $3, $4);
|
||||
if (!exists($packages{$main_name})) {
|
||||
# create an empty main package
|
||||
my $first = (values(%packages))[0];
|
||||
$packages{$main_name} = {
|
||||
name => $main_name,
|
||||
version => $main_ver,
|
||||
release => $main_rel,
|
||||
};
|
||||
for my $tag (qw(description changelog arch), @simple_tags) {
|
||||
next if $packages{$main_name}->{$tag};
|
||||
$packages{$main_name}->{$tag} = $first->{$tag};
|
||||
}
|
||||
}
|
||||
$packages{$main_name}->{nosource} = $nosrc ? 1 : 0;
|
||||
|
||||
open(SPEC, '>', "$output/repackage.spec") or die "$output/repackage.spec: $!\n";
|
||||
print_package($packages{$main_name}, 1);
|
||||
for my $p (values(%packages)) {
|
||||
next if $p->{name} eq $main_name;
|
||||
print_package($p, 0);
|
||||
}
|
||||
print SPEC "\%changelog\n";
|
||||
print SPEC quote($packages{$main_name}->{changelog});
|
||||
close(SPEC);
|
||||
110
pesign-install-post
Normal file
110
pesign-install-post
Normal file
@ -0,0 +1,110 @@
|
||||
#!/bin/bash
|
||||
# This script is run by rpmbuild at the end of install section. It computes
|
||||
# hashes of files listed in the %sign_files macro and stores them in
|
||||
# %_topdir/OTHER/%name.cpio.rsasign. It also puts a specfile there, that
|
||||
# is later used to repackage the RPMs.
|
||||
#
|
||||
# Copyright (c) 2013 SUSE Linux Products GmbH, Nuernberg, Germany.
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
|
||||
|
||||
set -e
|
||||
|
||||
files=
|
||||
output=
|
||||
while test $# -gt 0; do
|
||||
case "$1" in
|
||||
--files)
|
||||
files=$2
|
||||
shift 2
|
||||
;;
|
||||
--output)
|
||||
output=$2
|
||||
shift 2
|
||||
;;
|
||||
*)
|
||||
echo "$0: Unknown option: $1" >&2
|
||||
exit 1
|
||||
esac
|
||||
done
|
||||
if test -z "$files"; then
|
||||
exit 0
|
||||
fi
|
||||
if test -z "$output"; then
|
||||
echo "$0: --output not specified" >&2
|
||||
exit 1
|
||||
fi
|
||||
if test -z "$RPM_BUILD_ROOT"; then
|
||||
echo "$0: warning: \$RPM_BUILD_ROOT not set, using the root directory" >&2
|
||||
RPM_BUILD_ROOT=/
|
||||
fi
|
||||
|
||||
mkdir -p "$output"
|
||||
cert=$RPM_SOURCE_DIR/_projectcert.crt
|
||||
if test -e "$cert"; then
|
||||
echo "Using signing certificate $cert"
|
||||
else
|
||||
echo "No buildservice signing certificate"
|
||||
cert=/dev/null
|
||||
fi
|
||||
sed "
|
||||
s:@NAME@:$RPM_PACKAGE_NAME:g
|
||||
/@CERT@/ {
|
||||
r $cert
|
||||
d
|
||||
}
|
||||
" /usr/lib/rpm/pesign-repackage.spec.in >"$output/pesign-repackage.spec"
|
||||
|
||||
cd "$RPM_BUILD_ROOT"
|
||||
args=()
|
||||
for pattern in $files; do
|
||||
pattern=${pattern#/}
|
||||
if test "${pattern:0:2}" != "./"; then
|
||||
pattern="./$pattern"
|
||||
fi
|
||||
if test -d "$pattern"; then
|
||||
pattern="$pattern/*"
|
||||
fi
|
||||
args=("${args[@]}" -o -path "$pattern")
|
||||
done
|
||||
# delete the leading -o
|
||||
unset args[0]
|
||||
|
||||
archive=$output/$RPM_PACKAGE_NAME.cpio.rsasign
|
||||
archive_dir=$output/$RPM_PACKAGE_NAME
|
||||
mkdir -p "$archive_dir"
|
||||
# create an empty nss database to make pesign happy
|
||||
nss_db=$(mktemp -d)
|
||||
trap 'rm -rf "$nss_db"' EXIT
|
||||
echo >"$nss_db/password"
|
||||
certutil -N -f "$nss_db/password" -d "$nss_db"
|
||||
|
||||
echo "Creating $archive"
|
||||
files=($(find . -type f \( "${args[@]}" \)))
|
||||
for f in "${files[@]}"; do
|
||||
dest="$archive_dir/$f"
|
||||
mkdir -p "${dest%/*}"
|
||||
case "$f" in
|
||||
./boot/* | *.efi)
|
||||
pesign --certdir="$nss_db" -i "$f" --digestdata "$dest"
|
||||
;;
|
||||
*)
|
||||
cp "$f" "$dest"
|
||||
esac
|
||||
done
|
||||
cd "$archive_dir"
|
||||
find . -type f | cpio -H newc -o >"$archive"
|
||||
rm -rf "$archive_dir"
|
||||
|
||||
45
pesign-obs-integration.changes
Normal file
45
pesign-obs-integration.changes
Normal file
@ -0,0 +1,45 @@
|
||||
-------------------------------------------------------------------
|
||||
Wed Jan 30 09:47:25 UTC 2013 - mmarek@suse.cz
|
||||
|
||||
- Version 6
|
||||
- Fix handling packages with NoSource
|
||||
- Fix for multiple patterns in %sign_files
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Tue Jan 29 13:44:43 UTC 2013 - mmarek@suse.cz
|
||||
|
||||
- Version 5
|
||||
- Use newc-style cpio archives, as required by the buildservice.
|
||||
- Use signing certificates provided by the buildservice.
|
||||
- Minor fixes.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Mon Jan 28 15:01:17 UTC 2013 - mmarek@suse.cz
|
||||
|
||||
- Version 4
|
||||
- Support for firmware signatures.
|
||||
- Expect the correct archive with signatures (<name>.cpio.rsasign.sig).
|
||||
- Minor fixes.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Wed Jan 23 22:01:40 UTC 2013 - mmarek@suse.cz
|
||||
|
||||
- Version 3
|
||||
- Switch to storing whole files in the *.cpio.rsasign archive.
|
||||
- Append the signatures to kernel modules.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Fri Jan 18 12:51:17 UTC 2013 - mmarek@suse.cz
|
||||
|
||||
- Version 2
|
||||
- Generates another specfile in pesign-repackage.spec to
|
||||
be able to copy nearly all RPM tags from the original packages.
|
||||
- Changed to only store sha256 hashes in the *.cpio.rsasign file,
|
||||
instead of whole files.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Dec 13 12:06:00 UTC 2012 - mmarek@suse.com
|
||||
|
||||
- Created package with macros and scripts to integrate kernel and
|
||||
bootloader signing into OBS (fate#314552).
|
||||
|
||||
77
pesign-obs-integration.spec
Normal file
77
pesign-obs-integration.spec
Normal file
@ -0,0 +1,77 @@
|
||||
#
|
||||
# spec file for package pesign-obs-integration (Version 1.0)
|
||||
#
|
||||
# Copyright (c) 2013 SUSE LINUX Products GmbH, Nuernberg, Germany.
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
|
||||
#
|
||||
# Please submit bugfixes or comments via http://bugs.opensuse.org/
|
||||
#
|
||||
|
||||
# norootforbuild
|
||||
# needssslcertforbuild
|
||||
|
||||
Name: pesign-obs-integration
|
||||
Summary: Macros and scripts to sign the kernel and bootloader
|
||||
Version: 6.0
|
||||
Release: 1
|
||||
Requires: openssl mozilla-nss-tools
|
||||
%ifarch %ix86 x86_64 ia64
|
||||
Requires: pesign
|
||||
%endif
|
||||
BuildRequires: openssl
|
||||
License: GPL v2 only
|
||||
Group: Development/Tools/Other
|
||||
URL: http://en.opensuse.org/openSUSE:UEFI_Image_File_Sign_Tools
|
||||
Source1: macros.pesign-obs
|
||||
Source2: pesign-repackage.spec.in
|
||||
Source3: pesign-gen-repackage-spec
|
||||
Source4: pesign-install-post
|
||||
Source5: COPYING
|
||||
Source6: README
|
||||
Source7: kernel-sign-file
|
||||
BuildRoot: %{_tmppath}/%{name}-%{version}-build
|
||||
%description
|
||||
This package provides scripts and rpm macros to automate signing of the
|
||||
boot loader, kernel and kernel modules in the openSUSE Buildservice.
|
||||
|
||||
%prep
|
||||
%setup -cT
|
||||
cp %_sourcedir/{COPYING,README} .
|
||||
|
||||
%build
|
||||
|
||||
%install
|
||||
|
||||
mkdir -p %buildroot/usr/lib/rpm %buildroot/etc/rpm
|
||||
cd %_sourcedir
|
||||
install -m644 macros.pesign-obs %buildroot/etc/rpm
|
||||
install pesign-gen-repackage-spec pesign-install-post kernel-sign-file %buildroot/usr/lib/rpm
|
||||
install -m644 pesign-repackage.spec.in %buildroot/usr/lib/rpm
|
||||
if test -e _projectcert.crt; then
|
||||
openssl x509 -inform PEM -in _projectcert.crt \
|
||||
-outform DER -out %buildroot/usr/lib/rpm/pesign-cert.x509
|
||||
else
|
||||
echo "No buildservice project certificate available"
|
||||
fi
|
||||
|
||||
%files
|
||||
%defattr(-,root,root)
|
||||
%doc COPYING README
|
||||
/usr/lib/rpm/*
|
||||
/etc/rpm/*
|
||||
|
||||
%changelog
|
||||
|
||||
109
pesign-repackage.spec.in
Normal file
109
pesign-repackage.spec.in
Normal file
@ -0,0 +1,109 @@
|
||||
#!/bin/bash
|
||||
# This specfile unpacks the original RPMs, runs pesign-gen-repackage-spec
|
||||
# to create a second repackage specfile, and runs another rpmbuild to
|
||||
# actually do the repackaging.
|
||||
#
|
||||
# Copyright (c) 2013 SUSE Linux Products GmbH, Nuernberg, Germany.
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
|
||||
|
||||
# Do not generate any debug packages from the repackage specfile
|
||||
%undefine _build_create_debug
|
||||
|
||||
Name: pesign-repackage
|
||||
Version: 1.0
|
||||
Release: 1
|
||||
BuildRequires: openssl mozilla-nss-tools
|
||||
%ifarch %ix86 x86_64 ia64
|
||||
BuildRequires: pesign
|
||||
%endif
|
||||
License: GPLv
|
||||
Group: Development/Tools/Other
|
||||
Summary: Spec file to rebuild RPMs with signatures
|
||||
BuildRoot: %{_tmppath}/%{name}-%{version}-build
|
||||
%description
|
||||
Rebuilds RPMs with signatures
|
||||
|
||||
%prep
|
||||
%setup -c -T
|
||||
|
||||
%build
|
||||
|
||||
%install
|
||||
|
||||
pushd %buildroot
|
||||
disturl=
|
||||
rpms=()
|
||||
for rpm in %_sourcedir/*.rpm; do
|
||||
case "$rpm" in
|
||||
*.src.rpm | *.nosrc.rpm)
|
||||
cp "$rpm" %_srcrpmdir/
|
||||
continue
|
||||
esac
|
||||
rpm2cpio "$rpm" | cpio -idm
|
||||
d=$(rpm -qp --qf '%%{disturl}' "$rpm")
|
||||
if test -z "$disturl"; then
|
||||
disturl=$d
|
||||
fi
|
||||
if test "$disturl" != "$d"; then
|
||||
echo "Error: packages have different disturl: $d vs $disturl"
|
||||
exit 1
|
||||
fi
|
||||
rpms=("${rpms[@]}" "$rpm")
|
||||
done
|
||||
popd
|
||||
mkdir rsasigned
|
||||
pushd rsasigned
|
||||
cpio -idm <%_sourcedir/@NAME@.cpio.rsasign.sig
|
||||
cat >cert.crt <<EOF
|
||||
@CERT@
|
||||
EOF
|
||||
if test "$(wc -l <cert.crt)" -gt 1; then
|
||||
openssl x509 -inform PEM -in cert.crt -outform DER -out cert.x509
|
||||
cert=cert.x509
|
||||
else
|
||||
echo "warning: No buildservice project certificate found, add"
|
||||
echo "warning: # needssslcertforbuild to the specfile"
|
||||
echo "warning: Using /usr/lib/rpm/pesign-cert.x509 as fallback"
|
||||
cert=/usr/lib/rpm/pesign-cert.x509
|
||||
fi
|
||||
sigs=($(find -type f -name '*.sig'))
|
||||
for sig in "${sigs[@]}"; do
|
||||
f=%buildroot/${sig%.sig}
|
||||
case "$sig" in
|
||||
*.ko.sig)
|
||||
/usr/lib/rpm/kernel-sign-file -s "$sig" sha256 "$cert" "$f"
|
||||
;;
|
||||
./lib/firmware/*.sig)
|
||||
/usr/lib/rpm/kernel-sign-file -f -s "$sig" sha256 "$cert" "$f"
|
||||
;;
|
||||
*)
|
||||
echo "Warning: unhandled signature: $sig" >&2
|
||||
esac
|
||||
done
|
||||
popd
|
||||
/usr/lib/rpm/pesign-gen-repackage-spec --directory=%buildroot "${rpms[@]}"
|
||||
rpmbuild --define "%%buildroot %buildroot" --define "%%disturl $disturl" \
|
||||
--define "%%_builddir $PWD" \
|
||||
--define "%_suse_insert_debug_package %%{nil}" -bb repackage.spec
|
||||
|
||||
# This is needed by the kernel packages. Ideally, we should not run _any_ brp
|
||||
# checks, because the RPMs passed them once already
|
||||
export NO_BRP_STALE_LINK_ERROR=yes
|
||||
|
||||
# Make sure that our rpmbuild does not complain about unpackaged files
|
||||
rm -rf %buildroot
|
||||
mkdir %buildroot
|
||||
|
||||
Loading…
Reference in New Issue
Block a user