Accepting request 148393 from home:gary_lin:UEFI
Pesign is a tool to sign PE-COFF binaries which is the format used in UEFI. The UEFI loader, shim, needs pesign for package building. OBS-URL: https://build.opensuse.org/request/show/148393 OBS-URL: https://build.opensuse.org/package/show/Base:System/pesign?expand=0&rev=1
This commit is contained in:
Andreas Jaeger
Git OBS Bridge
commit
0ad967d243
23
.gitattributes
vendored
Normal file
23
.gitattributes
vendored
Normal file
@ -0,0 +1,23 @@
|
||||
## Default LFS
|
||||
*.7z filter=lfs diff=lfs merge=lfs -text
|
||||
*.bsp filter=lfs diff=lfs merge=lfs -text
|
||||
*.bz2 filter=lfs diff=lfs merge=lfs -text
|
||||
*.gem filter=lfs diff=lfs merge=lfs -text
|
||||
*.gz filter=lfs diff=lfs merge=lfs -text
|
||||
*.jar filter=lfs diff=lfs merge=lfs -text
|
||||
*.lz filter=lfs diff=lfs merge=lfs -text
|
||||
*.lzma filter=lfs diff=lfs merge=lfs -text
|
||||
*.obscpio filter=lfs diff=lfs merge=lfs -text
|
||||
*.oxt filter=lfs diff=lfs merge=lfs -text
|
||||
*.pdf filter=lfs diff=lfs merge=lfs -text
|
||||
*.png filter=lfs diff=lfs merge=lfs -text
|
||||
*.rpm filter=lfs diff=lfs merge=lfs -text
|
||||
*.tbz filter=lfs diff=lfs merge=lfs -text
|
||||
*.tbz2 filter=lfs diff=lfs merge=lfs -text
|
||||
*.tgz filter=lfs diff=lfs merge=lfs -text
|
||||
*.ttf filter=lfs diff=lfs merge=lfs -text
|
||||
*.txz filter=lfs diff=lfs merge=lfs -text
|
||||
*.whl filter=lfs diff=lfs merge=lfs -text
|
||||
*.xz filter=lfs diff=lfs merge=lfs -text
|
||||
*.zip filter=lfs diff=lfs merge=lfs -text
|
||||
*.zst filter=lfs diff=lfs merge=lfs -text
|
||||
1
.gitignore
vendored
Normal file
1
.gitignore
vendored
Normal file
@ -0,0 +1 @@
|
||||
.osc
|
||||
3
pesign-0.99.tar.bz2
Normal file
3
pesign-0.99.tar.bz2
Normal file
@ -0,0 +1,3 @@
|
||||
version https://git-lfs.github.com/spec/v1
|
||||
oid sha256:476d2cb79104167fa9147d1fee954e8545fe902931d2e449bf7c410963f2bbb1
|
||||
size 72907
|
||||
26
pesign-client-initialize-action.patch
Normal file
26
pesign-client-initialize-action.patch
Normal file
@ -0,0 +1,26 @@
|
||||
diff --git a/src/client.c b/src/client.c
|
||||
index 1ec582b..dcc5257 100644
|
||||
--- a/src/client.c
|
||||
+++ b/src/client.c
|
||||
@@ -435,7 +435,7 @@ main(int argc, char *argv[])
|
||||
char *certname = NULL;
|
||||
poptContext optCon;
|
||||
int rc;
|
||||
- int action;
|
||||
+ int action = 0;
|
||||
char *infile = NULL;
|
||||
char *outfile = NULL;
|
||||
char *exportfile = NULL;
|
||||
@@ -500,6 +500,12 @@ main(int argc, char *argv[])
|
||||
exit(1);
|
||||
}
|
||||
|
||||
+ if (action == NO_FLAGS) {
|
||||
+ poptPrintUsage(optCon, stdout, 0);
|
||||
+ poptFreeContext(optCon);
|
||||
+ exit(0);
|
||||
+ }
|
||||
+
|
||||
if (action & SIGN_BINARY && (!outfile && !exportfile)) {
|
||||
fprintf(stderr, "pesign-client: neither --outfile nor --export "
|
||||
"specified\n");
|
||||
14
pesign-client-read-pin-file.patch
Normal file
14
pesign-client-read-pin-file.patch
Normal file
@ -0,0 +1,14 @@
|
||||
diff --git a/src/client.c b/src/client.c
|
||||
index dcc5257..9bcaf3e 100644
|
||||
--- a/src/client.c
|
||||
+++ b/src/client.c
|
||||
@@ -201,7 +201,8 @@ get_token_pin(int pinfd, char *pinfile, char *envname)
|
||||
if (!pinf)
|
||||
return NULL;
|
||||
|
||||
- ssize_t n = getline(&pin, 0, pinf);
|
||||
+ size_t pin_n;
|
||||
+ ssize_t n = getline(&pin, &pin_n, pinf);
|
||||
if (n < 0 || !pin) {
|
||||
fclose(pinf);
|
||||
return NULL;
|
||||
106
pesign-fix-build-errors.patch
Normal file
106
pesign-fix-build-errors.patch
Normal file
@ -0,0 +1,106 @@
|
||||
---
|
||||
src/daemon.c | 35 ++++++++++++++++++++++++++++-------
|
||||
src/password.c | 3 ++-
|
||||
src/pesign.c | 10 ++++++++--
|
||||
3 files changed, 38 insertions(+), 10 deletions(-)
|
||||
|
||||
--- a/src/daemon.c
|
||||
+++ b/src/daemon.c
|
||||
@@ -436,7 +436,11 @@ malformed:
|
||||
if (rc < 0) {
|
||||
err_attached:
|
||||
pe_end(outpe);
|
||||
- ftruncate(outfd, 0);
|
||||
+ if (ftruncate(outfd, 0) != 0) {
|
||||
+ ctx->cms->log(ctx->cms, ctx->priority|LOG_ERR,
|
||||
+ "pesignd: could not truncate output "
|
||||
+ "file: %m");
|
||||
+ }
|
||||
goto finish;
|
||||
}
|
||||
ssize_t sigspace = calculate_signature_space(ctx->cms, outpe);
|
||||
@@ -453,21 +457,33 @@ err_attached:
|
||||
finalize_signatures(ctx->cms, outpe);
|
||||
pe_end(outpe);
|
||||
} else {
|
||||
- ftruncate(outfd, 0);
|
||||
+ if (ftruncate(outfd, 0) != 0) {
|
||||
+ ctx->cms->log(ctx->cms, ctx->priority|LOG_ERR,
|
||||
+ "pesignd: could not truncate output file: %m");
|
||||
+ }
|
||||
rc = generate_digest(ctx->cms, inpe);
|
||||
if (rc < 0) {
|
||||
err_detached:
|
||||
- ftruncate(outfd, 0);
|
||||
+ if (ftruncate(outfd, 0) != 0) {
|
||||
+ ctx->cms->log(ctx->cms, ctx->priority|LOG_ERR,
|
||||
+ "pesignd: could not truncate output "
|
||||
+ "file: %m");
|
||||
+ }
|
||||
goto finish;
|
||||
}
|
||||
rc = generate_signature(ctx->cms);
|
||||
if (rc < 0)
|
||||
goto err_detached;
|
||||
rc = export_signature(ctx->cms, outfd, 0);
|
||||
- if (rc >= 0)
|
||||
- ftruncate(outfd, rc);
|
||||
- else if (rc < 0)
|
||||
+ if (rc >= 0) {
|
||||
+ if (ftruncate(outfd, rc) != 0) {
|
||||
+ ctx->cms->log(ctx->cms, ctx->priority|LOG_ERR,
|
||||
+ "pesignd: could not truncate output "
|
||||
+ "file: %m");
|
||||
+ }
|
||||
+ } else if (rc < 0) {
|
||||
goto err_detached;
|
||||
+ }
|
||||
}
|
||||
|
||||
finish:
|
||||
@@ -979,7 +995,12 @@ daemonize(cms_context *cms_ctx, int do_f
|
||||
exit(1);
|
||||
}
|
||||
|
||||
- chdir(homedir ? homedir : "/");
|
||||
+ if (chdir(homedir ? homedir : "/") != 0) {
|
||||
+ ctx.backup_cms->log(ctx.backup_cms, ctx.priority|LOG_ERR,
|
||||
+ "pesignd: could not change working directory "
|
||||
+ "for pesign: %m");
|
||||
+ exit(1);
|
||||
+ }
|
||||
|
||||
if (getuid() == 0) {
|
||||
/* process is running as root, drop privileges */
|
||||
--- a/src/password.c
|
||||
+++ b/src/password.c
|
||||
@@ -76,7 +76,8 @@ static char *SEC_GetPassword(FILE *input
|
||||
echoOff(infd);
|
||||
}
|
||||
|
||||
- fgets ( phrase, sizeof(phrase), input);
|
||||
+ if (fgets(phrase, sizeof(phrase), input) == NULL)
|
||||
+ phrase[0] = '\0';
|
||||
|
||||
if (isTTY) {
|
||||
fprintf(output, "\n");
|
||||
--- a/src/pesign.c
|
||||
+++ b/src/pesign.c
|
||||
@@ -161,9 +161,15 @@ open_output(pesign_context *ctx)
|
||||
|
||||
addr = pe_rawfile(ctx->inpe, &size);
|
||||
|
||||
- ftruncate(ctx->outfd, size);
|
||||
+ if (ftruncate(ctx->outfd, size) != 0) {
|
||||
+ fprintf(stderr, "pesign: could not truncate output file: %m\n");
|
||||
+ exit(1);
|
||||
+ }
|
||||
lseek(ctx->outfd, 0, SEEK_SET);
|
||||
- write(ctx->outfd, addr, size);
|
||||
+ if (write(ctx->outfd, addr, size) != size) {
|
||||
+ fprintf(stderr, "pesign: could not write output file: %m\n");
|
||||
+ exit(1);
|
||||
+ }
|
||||
|
||||
Pe_Cmd cmd = ctx->outfd == STDOUT_FILENO ? PE_C_RDWR : PE_C_RDWR_MMAP;
|
||||
ctx->outpe = pe_begin(ctx->outfd, cmd, NULL);
|
||||
85
pesign-local-database.patch
Normal file
85
pesign-local-database.patch
Normal file
@ -0,0 +1,85 @@
|
||||
commit 21439f502b16cd168950cc2e38bfd6b6353ee428
|
||||
Author: Matthew Garrett <mjg59@srcf.ucam.org>
|
||||
Date: Tue Nov 27 10:11:36 2012 -0500
|
||||
|
||||
Add support for local certificate database directories
|
||||
|
||||
Users may wish to use a certificate database other than the systemwide
|
||||
one. Add an option for that.
|
||||
|
||||
---
|
||||
src/daemon.c | 4 ++--
|
||||
src/daemon.h | 2 +-
|
||||
src/pesign.c | 9 +++++++--
|
||||
3 files changed, 10 insertions(+), 5 deletions(-)
|
||||
|
||||
--- a/src/daemon.c
|
||||
+++ b/src/daemon.c
|
||||
@@ -877,7 +877,7 @@ err:
|
||||
}
|
||||
|
||||
int
|
||||
-daemonize(cms_context *cms_ctx, int do_fork)
|
||||
+daemonize(cms_context *cms_ctx, char *certdir, int do_fork)
|
||||
{
|
||||
int rc = 0;
|
||||
context ctx = {
|
||||
@@ -913,7 +913,7 @@ daemonize(cms_context *cms_ctx, int do_f
|
||||
"pesignd starting (pid %d)", ctx.pid);
|
||||
|
||||
|
||||
- SECStatus status = NSS_Init("/etc/pki/pesign");
|
||||
+ SECStatus status = NSS_Init(certdir);
|
||||
if (status != SECSuccess) {
|
||||
fprintf(stderr, "Could not initialize nss: %s\n",
|
||||
PORT_ErrorToString(PORT_GetError()));
|
||||
--- a/src/daemon.h
|
||||
+++ b/src/daemon.h
|
||||
@@ -19,7 +19,7 @@
|
||||
#ifndef DAEMON_H
|
||||
#define DAEMON_H 1
|
||||
|
||||
-extern int daemonize(cms_context *ctx, int do_fork);
|
||||
+extern int daemonize(cms_context *ctx, char *certdir, int do_fork);
|
||||
|
||||
typedef struct {
|
||||
uint32_t version;
|
||||
--- a/src/pesign.c
|
||||
+++ b/src/pesign.c
|
||||
@@ -443,6 +443,7 @@ main(int argc, char *argv[])
|
||||
char *tokenname = "NSS Certificate DB";
|
||||
char *origtoken = tokenname;
|
||||
char *certname = NULL;
|
||||
+ char *certdir = "/etc/pki/pesign";
|
||||
|
||||
rc = pesign_context_new(&ctxp);
|
||||
if (rc < 0) {
|
||||
@@ -460,6 +461,10 @@ main(int argc, char *argv[])
|
||||
{"certficate", 'c', POPT_ARG_STRING, &certname, 0,
|
||||
"specify certificate nickname",
|
||||
"<certificate nickname>" },
|
||||
+ {"certdir", 'n', POPT_ARG_STRING|POPT_ARGFLAG_SHOW_DEFAULT,
|
||||
+ &certdir, 0,
|
||||
+ "specify nss certificate database directory",
|
||||
+ "<certificate directory path>" },
|
||||
{"privkey", 'p', POPT_ARG_STRING, &ctxp->privkeyfile, 0,
|
||||
"specify private key file", "<privkey>" },
|
||||
{"force", 'f', POPT_ARG_VAL, &ctxp->force, 1,
|
||||
@@ -542,7 +547,7 @@ main(int argc, char *argv[])
|
||||
poptFreeContext(optCon);
|
||||
|
||||
if (!daemon) {
|
||||
- SECStatus status = NSS_Init("/etc/pki/pesign");
|
||||
+ SECStatus status = NSS_Init(certdir);
|
||||
if (status != SECSuccess) {
|
||||
fprintf(stderr, "Could not initialize nss: %s\n",
|
||||
PORT_ErrorToString(PORT_GetError()));
|
||||
@@ -796,7 +801,7 @@ main(int argc, char *argv[])
|
||||
close_output(ctxp);
|
||||
break;
|
||||
case DAEMONIZE:
|
||||
- rc = daemonize(ctxp->cms_ctx, fork);
|
||||
+ rc = daemonize(ctxp->cms_ctx, certdir, fork);
|
||||
break;
|
||||
default:
|
||||
fprintf(stderr, "Incompatible flags (0x%08x): ", action);
|
||||
163
pesign-suse-build.patch
Normal file
163
pesign-suse-build.patch
Normal file
@ -0,0 +1,163 @@
|
||||
---
|
||||
Make.defaults | 5 +++--
|
||||
Make.rules | 4 ++--
|
||||
Makefile | 6 +++---
|
||||
src/Makefile | 10 +++++-----
|
||||
src/pesign.sysvinit | 12 ++++++++----
|
||||
util/Makefile | 6 +++---
|
||||
6 files changed, 24 insertions(+), 19 deletions(-)
|
||||
|
||||
Index: pesign-0.99/Make.defaults
|
||||
===================================================================
|
||||
--- pesign-0.99.orig/Make.defaults
|
||||
+++ pesign-0.99/Make.defaults
|
||||
@@ -5,7 +5,8 @@ HOSTARCH = $(shell uname -m | sed s,i[
|
||||
ARCH := $(shell uname -m | sed s,i[3456789]86,ia32,)
|
||||
INCDIR = -I$(TOPDIR)/include
|
||||
CPPFLAGS = -DCONFIG_$(ARCH)
|
||||
-CFLAGS = $(ARCH3264) -g -O0 -fpic -Wall -fshort-wchar -fno-strict-aliasing -fno-merge-constants --std=gnu99 -D_GNU_SOURCE
|
||||
+OPTFLAGS = -O0 -g
|
||||
+CFLAGS = $(ARCH3264) $(OPTFLAGS) -fpic -Wall -fshort-wchar -fno-strict-aliasing -fno-merge-constants --std=gnu99 -D_GNU_SOURCE
|
||||
ASFLAGS = $(ARCH3264)
|
||||
LDFLAGS = -nostdlib
|
||||
CCLDFLAGS = -shared
|
||||
@@ -22,7 +23,7 @@ OBJCOPY = $(bindir)objcopy
|
||||
|
||||
ifeq ($(ARCH),ia64)
|
||||
CFLAGS += -mfixed-range=f32-f127
|
||||
- LIBDIR = $(PREFIX)/lib64
|
||||
+ LIBDIR = $(PREFIX)/lib
|
||||
endif
|
||||
|
||||
ifeq ($(ARCH), ia32)
|
||||
Index: pesign-0.99/Make.rules
|
||||
===================================================================
|
||||
--- pesign-0.99.orig/Make.rules
|
||||
+++ pesign-0.99/Make.rules
|
||||
@@ -2,10 +2,10 @@
|
||||
$(AR) -cvqs $@ $^
|
||||
|
||||
% : %.o
|
||||
- $(CC) $(CCLDFLAGS) -o $@ $^ $(foreach lib,$(LIBS),-l$(lib))
|
||||
+ $(CC) -o $@ $^ $(foreach lib,$(LIBS),-l$(lib)) $(CCLDFLAGS)
|
||||
|
||||
%.so :
|
||||
- $(CC) $(INCDIR) $(CFLAGS) -Wl,-soname,$(SONAME) $(CCLDFLAGS) $^ -o $@
|
||||
+ $(CC) $(INCDIR) $(CFLAGS) -Wl,-soname,$(SONAME) $^ $(CCLDFLAGS) -o $@
|
||||
|
||||
%.o: %.c
|
||||
$(CC) $(INCDIR) $(CFLAGS) $(CPPFLAGS) -c $< -o $@
|
||||
Index: pesign-0.99/Makefile
|
||||
===================================================================
|
||||
--- pesign-0.99.orig/Makefile
|
||||
+++ pesign-0.99/Makefile
|
||||
@@ -2,7 +2,7 @@ TOPDIR = $(shell echo $$PWD)
|
||||
|
||||
include $(TOPDIR)/Make.defaults
|
||||
|
||||
-SUBDIRS := include libdpe src util
|
||||
+SUBDIRS := include libdpe src
|
||||
DOCDIR := /share/doc/
|
||||
VERSION = 0.99
|
||||
|
||||
@@ -16,8 +16,8 @@ clean :
|
||||
|
||||
install :
|
||||
@for x in $(SUBDIRS) ; do $(MAKE) -C $${x} TOPDIR=$(TOPDIR) SRCDIR=$(TOPDIR)/$@/ ARCH=$(ARCH) $@ ; done
|
||||
- $(INSTALL) -d -m 755 $(INSTALLROOT)$(PREFIX)$(DOCDIR)/pesign-$(VERSION)/
|
||||
- $(INSTALL) -m 644 COPYING $(INSTALLROOT)$(PREFIX)$(DOCDIR)/pesign-$(VERSION)/
|
||||
+ $(INSTALL) -d -m 755 $(INSTALLROOT)$(PREFIX)$(DOCDIR)/pesign/
|
||||
+ $(INSTALL) -m 644 COPYING $(INSTALLROOT)$(PREFIX)$(DOCDIR)/pesign/
|
||||
|
||||
install_systemd:
|
||||
@for x in $(SUBDIRS) ; do $(MAKE) -C $${x} TOPDIR=$(TOPDIR) SRCDIR=$(TOPDIR)/$@/ ARCH=$(ARCH) $@ ; done
|
||||
Index: pesign-0.99/src/Makefile
|
||||
===================================================================
|
||||
--- pesign-0.99.orig/src/Makefile
|
||||
+++ pesign-0.99/src/Makefile
|
||||
@@ -7,8 +7,9 @@ LIBS = popt
|
||||
STATIC_LIBS = $(TOPDIR)/libdpe/libdpe.a
|
||||
PKLIBS = nss
|
||||
LDFLAGS =
|
||||
-CCLDFLAGS = -L../libdpe $(foreach pklib,$(PKLIBS), $(shell pkg-config --cflags --libs $(pklib)))
|
||||
+CCLDFLAGS = -L../libdpe $(foreach pklib,$(PKLIBS), $(shell pkg-config --cflags --libs $(pklib))) -lpthread
|
||||
CFLAGS += -I../include/ $(foreach pklib,$(PKLIBS), $(shell pkg-config --cflags $(pklib))) -Werror
|
||||
+UNITDIR = /lib/systemd/system
|
||||
|
||||
TARGETS = pesign authvar client
|
||||
|
||||
@@ -60,12 +61,12 @@ clean : depclean
|
||||
install_systemd:
|
||||
$(INSTALL) -d -m 755 $(INSTALLROOT)/usr/lib/tmpfiles.d/
|
||||
$(INSTALL) -m 644 tmpfiles.conf $(INSTALLROOT)/usr/lib/tmpfiles.d/pesign.conf
|
||||
- $(INSTALL) -d -m 755 $(INSTALLROOT)/usr/lib/systemd/system/
|
||||
- $(INSTALL) -m 644 pesign.service $(INSTALLROOT)/usr/lib/systemd/system/
|
||||
+ $(INSTALL) -d -m 755 $(INSTALLROOT)/$(UNITDIR)
|
||||
+ $(INSTALL) -m 644 pesign.service $(INSTALLROOT)/$(UNITDIR)
|
||||
|
||||
install_sysvinit:
|
||||
- $(INSTALL) -d -m 755 $(INSTALLROOT)/etc/rc.d/init.d/
|
||||
- $(INSTALL) -m 755 pesign.sysvinit $(INSTALLROOT)/etc/rc.d/init.d/pesign
|
||||
+ $(INSTALL) -d -m 755 $(INSTALLROOT)/etc/init.d/
|
||||
+ $(INSTALL) -m 755 pesign.sysvinit $(INSTALLROOT)/etc/init.d/pesign
|
||||
|
||||
install :
|
||||
$(INSTALL) -d -m 700 $(INSTALLROOT)/etc/pki/pesign/
|
||||
Index: pesign-0.99/util/Makefile
|
||||
===================================================================
|
||||
--- pesign-0.99.orig/util/Makefile
|
||||
+++ pesign-0.99/util/Makefile
|
||||
@@ -4,7 +4,7 @@ TOPDIR = $(SRCDIR)/..
|
||||
include $(TOPDIR)/Make.defaults
|
||||
|
||||
FORMAT=efi-app-$(HOSTARCH)
|
||||
-LDFLAGS = -nostdlib -T $(LIBDIR)/gnuefi/elf_$(HOSTARCH)_efi.lds -shared -Bsymbolic $(LIBDIR)/gnuefi/crt0-efi-$(HOSTARCH).o -L$(LIBDIR)
|
||||
+LDFLAGS = -nostdlib -T $(LIBDIR)/elf_$(HOSTARCH)_efi.lds -shared -Bsymbolic $(LIBDIR)/crt0-efi-$(HOSTARCH).o -L$(LIBDIR)
|
||||
LIBS=-lefi -lgnuefi $(shell $(CC) -print-libgcc-file-name)
|
||||
CCLDFLAGS =
|
||||
CFLAGS = -I/usr/include/efi/ -I/usr/include/efi/$(HOSTARCH)/ -I/usr/include/efi/protocol -fpic -fshort-wchar -fno-reorder-functions -fno-strict-aliasing -fno-merge-constants -mno-red-zone -Wimplicit-function-declaration
|
||||
@@ -17,8 +17,8 @@ clean :
|
||||
@rm -rfv *.o *.a *.so $(TARGETS)
|
||||
|
||||
install :
|
||||
- $(INSTALL) -d -m 755 $(INSTALLROOT)/boot/efi/EFI/redhat/
|
||||
- $(INSTALL) -m 755 *.efi $(INSTALLROOT)/boot/efi/EFI/redhat/
|
||||
+ $(INSTALL) -d -m 755 $(INSTALLROOT)/boot/efi/EFI/SuSE/
|
||||
+ $(INSTALL) -m 755 *.efi $(INSTALLROOT)/boot/efi/EFI/SuSE/
|
||||
|
||||
.PHONY: all clean install
|
||||
|
||||
Index: pesign-0.99/src/pesign.sysvinit
|
||||
===================================================================
|
||||
--- pesign-0.99.orig/src/pesign.sysvinit
|
||||
+++ pesign-0.99/src/pesign.sysvinit
|
||||
@@ -6,21 +6,25 @@
|
||||
# processname: /usr/bin/pesign
|
||||
# pidfile: /var/run/pesign.pid
|
||||
### BEGIN INIT INFO
|
||||
-# Provides: pesign
|
||||
-# Default-Start:
|
||||
+# Provides: pesign
|
||||
+# Should-Start: $remote_fs
|
||||
+# Should-Stop: $remote_fs
|
||||
+# Required-Start:
|
||||
+# Required-Stop:
|
||||
+# Default-Start: 2 3 5
|
||||
# Default-Stop:
|
||||
# Short-Description: The pesign PE signing daemon
|
||||
# Description: The pesign PE signing daemon
|
||||
### END INIT INFO
|
||||
|
||||
-. /etc/init.d/functions
|
||||
[ -f /usr/bin/pesign ] || exit 1
|
||||
|
||||
+PESIGN_PIDFILE=/var/run/pesign.pid
|
||||
RETVAL=0
|
||||
|
||||
start(){
|
||||
echo -n "Starting pesign: "
|
||||
- daemon /usr/bin/pesign --daemonize
|
||||
+ startproc -f -p "$PESIGN_PIDFILE" /usr/bin/pesign --daemonize
|
||||
RETVAL=$?
|
||||
echo
|
||||
touch /var/lock/subsys/pesign
|
||||
2482
pesign-upstream-fixes.patch
Normal file
2482
pesign-upstream-fixes.patch
Normal file
File diff suppressed because it is too large
Load Diff
155
pesign.changes
Normal file
155
pesign.changes
Normal file
@ -0,0 +1,155 @@
|
||||
-------------------------------------------------------------------
|
||||
Wed Dec 12 13:18:40 UTC 2012 - fcrozat@suse.com
|
||||
|
||||
- Don't call sysv RPM post/pre macros when building for systemd
|
||||
- Ship rcpesign for systemd, link to /sbin/service
|
||||
- Update pesign-suse-build.patch to allow change systemd unit
|
||||
install directory.
|
||||
- Don't hardcode systemd unit directory, since it changed in
|
||||
Factory.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Tue Dec 11 07:10:04 UTC 2012 - glin@suse.com
|
||||
|
||||
- Add Requires: pwdutils
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Wed Nov 28 07:42:09 UTC 2012 - glin@suse.com
|
||||
|
||||
- Add pesign-local-database.patch to support the local certificate
|
||||
database
|
||||
- Amend the spec file to build on openSUSE:Factory
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Nov 8 06:32:32 UTC 2012 - glin@suse.com
|
||||
|
||||
- Version bump to 0.99 (FATE#314484)
|
||||
+ Add documentation for --daemonize and --nofork
|
||||
+ Make popt aliases work
|
||||
+ Add documentation for pesign-client
|
||||
+ Add --pinfd and --pinfile to the client
|
||||
- Update pesign-suse-build.patch and pesign-fix-build-errors.patch
|
||||
- Add pesign-upstream-fixes.patch to backport fixes from git head
|
||||
and add sysvinit script
|
||||
- Add pesign-client-initialize-action.patch to initialize client
|
||||
action to avoid undetermined flags.
|
||||
- Add pesign-client-read-pin-file.patch to fix pin file reading
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Mon Oct 15 09:33:19 UTC 2012 - glin@suse.com
|
||||
|
||||
- Version bump to 0.98
|
||||
+ close the socket immediately on invalid input
|
||||
+ Slightly better error messages
|
||||
+ Log an error if digest initialization fails
|
||||
+ Add systemd bits for pesignd
|
||||
+ Add actual signing code to the daemon
|
||||
+ Add input and output setup for sign functionality in the daemon
|
||||
+ Audit allocation of CERTCertificateList/PK11SlotList and
|
||||
friends
|
||||
+ Fix memory leaks
|
||||
- Refresh pesign-suse-build.patch and pesign-fix-build-errors.patch
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Mon Aug 13 06:50:35 UTC 2012 - glin@suse.com
|
||||
|
||||
- Version bump to 0.9
|
||||
+ Add NSS "token" support for smartcards.
|
||||
+ Allocate space for the section header variable
|
||||
- Refresh pesign-fix-build-errors.patch to fix the warning
|
||||
- Drop upstreamed pesign-allocate-shdr.patch
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Fri Aug 10 10:12:53 UTC 2012 - glin@suse.com
|
||||
|
||||
- Add pesign-allocate-shdr.patch to allocate space for the section
|
||||
header variable
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Aug 9 03:53:45 UTC 2012 - glin@suse.com
|
||||
|
||||
- Version bump to 0.8
|
||||
+ Don't open the DB r/w, read-only is fine.
|
||||
+ Attempt to do a better job setting the image size.
|
||||
+ Emit correct OID for encryption type.
|
||||
- Drop pesign-fix-image-size.patch which is already in 0.8
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Tue Aug 7 03:03:17 UTC 2012 - glin@suse.com
|
||||
|
||||
- Add upstream patch pesign-fix-image-size.patch to set the image
|
||||
size correctly.
|
||||
- Drop pesign-elilo-workaround.patch
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Mon Aug 6 08:03:05 UTC 2012 - glin@suse.com
|
||||
|
||||
- Version bump to 0.7
|
||||
+ Fix incorrect initialization error in (undocumented) -e option.
|
||||
+ Use SEC_OID_PKCS1_RSA_ENCRYPTION like MS
|
||||
+ Initialize the index variable of loop
|
||||
+ Adjust the buffer size to avoid overflow
|
||||
+ Make sure pe_populatecert() always returns a value
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Mon Jul 23 08:49:13 UTC 2012 - glin@suse.com
|
||||
|
||||
- Add pesign-elilo-workaround.patch to workaround the section
|
||||
header corruption in some EFI image (elilo for example)
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Mon Jul 23 03:32:18 UTC 2012 - glin@suse.com
|
||||
|
||||
- Add pesign-fix-build-errors.patch to fix build error/warning
|
||||
- Don't install the util efi images
|
||||
- Fix the RPM_OPT_FLAGS warning
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Jul 12 09:37:55 UTC 2012 - glin@suse.com
|
||||
|
||||
- Version bump to 0.5
|
||||
+ Handle and report mremap() failure
|
||||
+ Man page should be in section 1.
|
||||
+ Add some basic signature list management.
|
||||
+ Add some more efi-defined constants, flesh out efi_guid_t.
|
||||
+ authver: Find a guid for 'namespace'.
|
||||
+ Add some basic ucs2 functions :(
|
||||
+ Support multiple signatures correctly.
|
||||
+ Add ascii_to_ucs2()
|
||||
+ Add file formats and some code for variables-on-disk.
|
||||
+ Allow the memory map to move when we're allocating space in the
|
||||
binary.
|
||||
+ Remove extra call to ftruncate()
|
||||
+ Adjust section addresses when we remap the pecoff binary.
|
||||
+ Correctly set win_certificate.length to /include/
|
||||
win_certificate.
|
||||
+ Move certificate space iterator to wincert.c so other stuff can
|
||||
get it.
|
||||
+ Split allocating space for certs and filling it in.
|
||||
+ Put the new signature into the cms ctx instead of keeping it
|
||||
locally.
|
||||
+ Actually calculate space and extend the file before hashing the
|
||||
binary.
|
||||
+ Bounds-check everything we're hashing so we don't segfault on a
|
||||
bad bin.
|
||||
- Add pesign-always-return-value.patch to fix
|
||||
no-return-in-nonvoid-function
|
||||
- Drop upsreamed patch pesign-mem-reallocation.patch
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Fri Jun 29 07:08:11 UTC 2012 - glin@suse.com
|
||||
|
||||
- Add pesign-mem-reallocation.patch to fix crash when writing
|
||||
signature
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Tue Jun 26 07:02:49 UTC 2012 - glin@suse.com
|
||||
|
||||
- Version bump to 0.3
|
||||
+ it seems to generate working signatures
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Jun 21 08:31:42 UTC 2012 - glin@suse.com
|
||||
|
||||
- New package pesign 0.2
|
||||
|
||||
145
pesign.spec
Normal file
145
pesign.spec
Normal file
@ -0,0 +1,145 @@
|
||||
#
|
||||
# spec file for package pesign
|
||||
#
|
||||
# Copyright (c) 2012 SUSE LINUX Products GmbH, Nuernberg, Germany.
|
||||
#
|
||||
# All modifications and additions to the file contributed by third parties
|
||||
# remain the property of their copyright owners, unless otherwise agreed
|
||||
# upon. The license for this file, and modifications and additions to the
|
||||
# file, is the same license as for the pristine package itself (unless the
|
||||
# license for the pristine package is not an Open Source License, in which
|
||||
# case the license is the MIT License). An "Open Source License" is a
|
||||
# license that conforms to the Open Source Definition (Version 1.9)
|
||||
# published by the Open Source Initiative.
|
||||
|
||||
# Please submit bugfixes or comments via http://bugs.opensuse.org/
|
||||
#
|
||||
|
||||
|
||||
|
||||
Name: pesign
|
||||
Version: 0.99
|
||||
Release: 1
|
||||
License: GPL-2.0
|
||||
Summary: Signing tool for PE-COFF binaries
|
||||
Url: https://github.com/vathpela/pesign
|
||||
Group: Productivity/Security
|
||||
Source: %{name}-%{version}.tar.bz2
|
||||
# PATCH-FIX-UPSTREAM pesign-upstream-fixes.patch glin@suse.com -- fixes from upstream
|
||||
Patch0: pesign-upstream-fixes.patch
|
||||
# PATCH-FIX-SUSE pesign-suse-build.patch glin@suse.com -- Adjust Makefile for the build service
|
||||
Patch1: pesign-suse-build.patch
|
||||
# PATCH-FIX-UPSTREAM pesign-fix-build-errors.patch glin@suse.com -- Fix gcc warnings
|
||||
Patch2: pesign-fix-build-errors.patch
|
||||
# PATCH-FIX-UPSTREAM pesign-client-initialize-action.patch glin@suse.com -- Initialize the actions variable
|
||||
Patch3: pesign-client-initialize-action.patch
|
||||
# PATCH-FIX-UPSTREAM pesign-client-read-pin-file.patch glin@suse.com -- Fix pin file reading error
|
||||
Patch4: pesign-client-read-pin-file.patch
|
||||
# PATCH-FIX-UPSTREAM pesign-local-database.patch glin@suse.com -- Support local certificate database
|
||||
Patch5: pesign-local-database.patch
|
||||
BuildRequires: mozilla-nss-devel
|
||||
BuildRequires: popt-devel
|
||||
BuildRequires: pkg-config
|
||||
%if 0%{?suse_version} > 1140
|
||||
BuildRequires: pkgconfig(systemd)
|
||||
%{?systemd_requires}
|
||||
%define has_systemd 1
|
||||
%endif
|
||||
BuildRequires: pwdutils
|
||||
Requires: pwdutils
|
||||
BuildRoot: %{_tmppath}/%{name}-%{version}-build
|
||||
ExclusiveArch: ia64 %ix86 x86_64
|
||||
|
||||
%description
|
||||
Signing tool for PE-COFF binaries, hopefully at least vaguely compliant
|
||||
with the PE and Authenticode specifications.
|
||||
|
||||
|
||||
|
||||
Authors:
|
||||
--------
|
||||
Peter Jones <pjones@redhat.com>
|
||||
|
||||
%prep
|
||||
%setup -q
|
||||
%patch0 -p1
|
||||
%patch1 -p1
|
||||
%patch2 -p1
|
||||
%patch3 -p1
|
||||
%patch4 -p1
|
||||
%patch5 -p1
|
||||
|
||||
%build
|
||||
make OPTFLAGS="$RPM_OPT_FLAGS"
|
||||
|
||||
%install
|
||||
make INSTALLROOT=%{buildroot} PREFIX=/usr DOCDIR=/share/doc/packages install
|
||||
mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/lib/pesign
|
||||
|
||||
mkdir -p $RPM_BUILD_ROOT%{_sbindir}
|
||||
%if 0%{?has_systemd}
|
||||
make INSTALLROOT=%{buildroot} UNITDIR=%{_unitdir} install_systemd
|
||||
ln -sf /sbin/service $RPM_BUILD_ROOT/%{_sbindir}/rcpesign
|
||||
%else
|
||||
make INSTALLROOT=%{buildroot} install_sysvinit
|
||||
ln -sf %{_sysconfdir}/init.d/pesign $RPM_BUILD_ROOT/%{_sbindir}/rcpesign
|
||||
%endif
|
||||
|
||||
# there's some stuff that's not really meant to be shipped yet
|
||||
rm -rf %{buildroot}/boot %{buildroot}/usr/include
|
||||
rm -rf %{buildroot}%{_libdir}/libdpe*
|
||||
|
||||
%clean
|
||||
%{?buildroot:%__rm -rf "%{buildroot}"}
|
||||
|
||||
%pre
|
||||
getent group pesign >/dev/null || groupadd -r pesign
|
||||
getent passwd pesign >/dev/null || useradd -r -g pesign -d /var/lib/pesign -s /bin/false -c "PE-COFF signing daemon" pesign
|
||||
%if 0%{?has_systemd}
|
||||
%service_add_pre pesign.service
|
||||
%endif
|
||||
|
||||
%preun
|
||||
%if 0%{?has_systemd}
|
||||
%service_del_preun pesign.service
|
||||
%else
|
||||
%stop_on_removal pesign
|
||||
%endif
|
||||
|
||||
%post
|
||||
%if 0%{?has_systemd}
|
||||
%service_add_post pesign.service
|
||||
systemd-tmpfiles --create /usr/lib/tmpfiles.d/pesign.conf
|
||||
%endif
|
||||
|
||||
%postun
|
||||
%if 0%{?has_systemd}
|
||||
%service_del_preun pesign.service
|
||||
%else
|
||||
%restart_on_update pesign
|
||||
%insserv_cleanup
|
||||
%endif
|
||||
|
||||
%files
|
||||
%defattr(-,root,root)
|
||||
%doc COPYING
|
||||
%{_bindir}/pesign
|
||||
%{_bindir}/pesign-client
|
||||
%dir %{_sysconfdir}/popt.d
|
||||
%config %{_sysconfdir}/popt.d/pesign.popt
|
||||
%{_sysconfdir}/pki/
|
||||
%config %{_sysconfdir}/rpm/macros.pesign
|
||||
%{_mandir}/man?/*
|
||||
/var/lib/pesign
|
||||
%if 0%{?has_systemd}
|
||||
%{_unitdir}/pesign.service
|
||||
/usr/lib/tmpfiles.d/pesign.conf
|
||||
%else
|
||||
%{_sysconfdir}/init.d/pesign
|
||||
%endif
|
||||
%{_sbindir}/rcpesign
|
||||
%dir %attr(0775,pesign,pesign) %{_sysconfdir}/pki/pesign
|
||||
%dir %attr(0770,pesign,pesign) %{_localstatedir}/run/%{name}
|
||||
%dir %attr(0770,pesign,pesign) %{_localstatedir}/lib/%{name}
|
||||
|
||||
%changelog
|
||||
Loading…
Reference in New Issue
Block a user