pool/pesign
SHA256
2
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

- Update to 115

Browse Source 
+ macros: drop %{_pesign_args}
  + Fix two bugs from package building
  + Fix bad free of cms data (DoS only)
  + Send pesign stdout/err to systemd journal
  + Add missing Install section
  + Add default packages for pkg-config
  + Short delay to ensure /run/pesign/socket exists
  + Resolve crash when signature that is removed is not the end of
    the list
  + Enhance error diagnostics about version mismatch
  + Upstream all Fedora changes
  + Add some hardening options to build
  + Add code of conduct
  + Fix build on gcc 12 and non-Fedora
- Refresh patches
  + harden_pesign.service.patch
  + pesign-boo1143063-remove-var-tracking.patch
  + pesign-boo1185663-set-rpmmacrodir.patch
  + pesign-fix-authvar-write-loop.patch
  + pesign-suse-build.patch
- Remove upstreamed/unnecessary patches
  + pesign-boo1158197-fix-pesigncheck-gcc10.patch
  + pesign-efikeygen-Fix-the-build-with-nss-3.44.patch
  + pesign-privkey_unneeded.diff
  + pesign-run.patch
  + Fix wrong oid offsets (bsc#1205323)

OBS-URL: https://build.opensuse.org/package/show/Base:System/pesign?expand=0&rev=66
This commit is contained in:
Gary Ching-Pang Lin 2022-12-02 08:28:13 +00:00 committed by Git OBS Bridge
parent b82dff3fc0
commit 2a0da6d5f1
13 changed files with 98 additions and 371 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
harden_pesign.service.patch
View File

@ -1,7 +1,7 @@
Index: pesign-113/src/pesign.service.in
Index: pesign-115/src/pesign.service.in
===================================================================
--- pesign-113.orig/src/pesign.service.in
+++ pesign-113/src/pesign.service.in
--- pesign-115.orig/src/pesign.service.in
+++ pesign-115/src/pesign.service.in
@@ -3,6 +3,19 @@ Description=Pesign signing daemon
[Service]
@ -19,6 +19,6 @@ Index: pesign-113/src/pesign.service.in
+ProtectControlGroups=true
+RestrictRealtime=true
+# end of automatic additions
Type=forking
PIDFile=/run/pesign.pid
ExecStart=/usr/bin/pesign --daemonize
PIDFile=@@RUNDIR@@/pesign.pid
ExecStart=/usr/bin/pesign --daemonize --nofork
ExecStartPost=@@LIBEXECDIR@@/pesign/pesign-authorize

3
pesign-113.tar.bz2
View File

@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:0dfb14e6f79288b7983344b88b14f83b0267c002f563e38171f935af107d0132
size 103471

3
pesign-115.tar.bz2 Normal file
View File

@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:ac1ef561b82de175f2a876944d3a806384b34d3e6c58a037cf7a611f41ccf07e
size 119564

12
pesign-boo1143063-remove-var-tracking.patch
View File

@ -1,8 +1,8 @@
diff --git a/Make.defaults b/Make.defaults
index 7892d73..2d18005 100644
--- a/Make.defaults
+++ b/Make.defaults
@@ -47,7 +47,7 @@ cflags = $(CFLAGS) $(ARCH3264) \
Index: pesign-115/Make.defaults
===================================================================
--- pesign-115.orig/Make.defaults
+++ pesign-115/Make.defaults
@@ -69,7 +69,7 @@ cflags = $(CFLAGS) $(ARCH3264) \
$(call pkg-config-cflags)
clang_ccldflags =
gcc_ccldflags = -fno-merge-constants \
@ -10,4 +10,4 @@ index 7892d73..2d18005 100644
+ -fvar-tracking-assignments -fkeep-inline-functions \
-Wl,--fatal-warnings,--no-allow-shlib-undefined,--default-symver \
-Wl,-O2 -Wl,--no-undefined-version -Wl,-z,relro,-z,now \
-Wl,--no-add-needed,--no-copy-dt-needed-entries,--as-needed
-Wl,--no-add-needed,--no-copy-dt-needed-entries,--as-needed -pie

39
pesign-boo1158197-fix-pesigncheck-gcc10.patch
View File

@ -1,39 +0,0 @@
From b0b740f38da6d4584417d65a7c97fd4faf982cf6 Mon Sep 17 00:00:00 2001
From: Gary Lin <glin@suse.com>
Date: Wed, 4 Dec 2019 10:28:28 +0800
Subject: [PATCH] pesigcheck: remove superfluous type settings
When setting the type of reason in check_signature(), the type was
accidentally set as "siBuffer". Since the type is already set as
"SIGNATURE", we only need to remove those two lines of code.
Fixes: https://github.com/rhboot/pesign/issues/55
Signed-off-by: Gary Lin <glin@suse.com>
---
src/pesigcheck.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/src/pesigcheck.c b/src/pesigcheck.c
index 524cce3..d197c30 100644
--- a/src/pesigcheck.c
+++ b/src/pesigcheck.c
@@ -318,7 +318,6 @@ check_signature(pesigcheck_context *ctx, int *nreasons,
reason->type = SIGNATURE;
reason->sig.data = data;
reason->sig.len = datalen;
- reason->type = siBuffer;
nreason += 1;
is_invalid = true;
}
@@ -330,7 +329,6 @@ check_signature(pesigcheck_context *ctx, int *nreasons,
reason->type = SIGNATURE;
reason->sig.data = data;
reason->sig.len = datalen;
- reason->type = siBuffer;
nreason += 1;
has_valid_cert = true;
}
--
2.24.0

30
pesign-boo1185663-set-rpmmacrodir.patch
View File

@ -1,27 +1,27 @@
diff --git a/Make.defaults b/Make.defaults
index 2d18005..7ecba00 100644
--- a/Make.defaults
+++ b/Make.defaults
@@ -11,6 +11,7 @@ includedir ?= $(prefix)include/
bindir ?= $(prefix)bin/
Index: pesign-115/Make.defaults
===================================================================
--- pesign-115.orig/Make.defaults
+++ pesign-115/Make.defaults
@@ -13,6 +13,7 @@ rundir ?= /run/
rundir := $(abspath $(rundir))/
pcdir ?= $(libdir)pkgconfig/
docdir ?= $(prefix)share/doc/
+rpmmacrodir ?= /etc/rpm/
DESTDIR ?=
INSTALLROOT = $(DESTDIR)
diff --git a/src/Makefile b/src/Makefile
index 5fb2841..ca546a3 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -90,8 +90,8 @@ install :
$(INSTALL) -m 644 pesigcheck.1 $(INSTALLROOT)$(mandir)man1/
$(INSTALL) -m 644 authvar.1 $(INSTALLROOT)$(mandir)man1/
$(INSTALL) -m 644 efisiglist.1 $(INSTALLROOT)$(mandir)man1/
Index: pesign-115/src/Makefile
===================================================================
--- pesign-115.orig/src/Makefile
+++ pesign-115/src/Makefile
@@ -88,8 +88,8 @@ install :
$(INSTALL) -m 644 pesign.popt $(INSTALLROOT)/etc/popt.d/
$(INSTALL) -d -m 755 $(INSTALLROOT)$(mandir)man1/
$(INSTALL) -m 644 $(MAN1TARGETS) $(INSTALLROOT)$(mandir)man1/
- $(INSTALL) -d -m 755 $(INSTALLROOT)/etc/rpm/
- $(INSTALL) -m 644 macros.pesign $(INSTALLROOT)/etc/rpm/
+ $(INSTALL) -d -m 755 $(INSTALLROOT)$(rpmmacrodir)
+ $(INSTALL) -m 644 macros.pesign $(INSTALLROOT)$(rpmmacrodir)
$(INSTALL) -d -m 755 $(INSTALLROOT)$(libexecdir)/pesign/
$(INSTALL) -m 750 pesign-authorize $(INSTALLROOT)$(libexecdir)/pesign/
$(INSTALL) -d -m 700 $(INSTALLROOT)/etc/pesign
$(INSTALL) -m 755 pesign-rpmbuild-helper $(INSTALLROOT)$(libexecdir)/pesign/

45
pesign-efikeygen-Fix-the-build-with-nss-3.44.patch
View File

@ -1,45 +0,0 @@
From b535d1ac5cbcdf18a97d97a92581e38080d9e521 Mon Sep 17 00:00:00 2001
From: Peter Jones <pjones@redhat.com>
Date: Tue, 14 May 2019 11:28:38 -0400
Subject: [PATCH] efikeygen: Fix the build with nss 3.44
NSS 3.44 adds some certificate types, which changes a type and makes
some encoding stuff weird. As a result, we get:
gcc8 -I/wrkdirs/usr/ports/sysutils/pesign/work/pesign-0.110/include -O2 -pipe -fstack-protector-strong -Wl,-rpath=/usr/local/lib/gcc8 -isystem /usr/local/include -fno-strict-aliasing -g -O0 -g -O0 -Wall -fshort-wchar -fno-strict-aliasing -fno-merge-constants --std=gnu99 -D_GNU_SOURCE -Wno-unused-result -Wno-unused-function -I../include/ -I/usr/local/include/nss -I/usr/local/include/nss/nss -I/usr/local/include/nspr -Werror -fPIC -isystem /usr/local/include -DCONFIG_amd64 -DCONFIG_amd64 -c efikeygen.c -o efikeygen.o
In file included from /usr/local/include/nss/nss/cert.h:22,
from efikeygen.c:39:
efikeygen.c: In function 'add_cert_type':
/usr/local/include/nss/nss/certt.h:445:5: error: unsigned conversion from 'int' to 'unsigned char' changes value from '496' to '240' [-Werror=overflow]
(NS_CERT_TYPE_SSL_CLIENT | NS_CERT_TYPE_SSL_SERVER | NS_CERT_TYPE_EMAIL | \
^
efikeygen.c:208:23: note: in expansion of macro 'NS_CERT_TYPE_APP'
unsigned char type = NS_CERT_TYPE_APP;
^~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
This is fixed by just making it an int.
Fixes github issue #48.
Signed-off-by: Peter Jones <pjones@redhat.com>
---
src/efikeygen.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/efikeygen.c b/src/efikeygen.c
index ede76ef..2cd953e 100644
--- a/src/efikeygen.c
+++ b/src/efikeygen.c
@@ -208,7 +208,7 @@ static int
add_cert_type(cms_context *cms, void *extHandle, int is_ca)
{
SECItem bitStringValue;
- unsigned char type = NS_CERT_TYPE_APP;
+ int type = NS_CERT_TYPE_APP;
if (is_ca)
type |= NS_CERT_TYPE_SSL_CA |
--
2.22.0

36
pesign-fix-authvar-write-loop.patch
View File

@ -12,32 +12,11 @@ Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
src/authvar_context.c | 16 +++++++---------
1 file changed, 7 insertions(+), 9 deletions(-)
diff --git a/src/authvar_context.c b/src/authvar_context.c
index 7a753fc..c51c666 100644
--- a/src/authvar_context.c
+++ b/src/authvar_context.c
@@ -20,6 +20,7 @@
#include "fix_coverity.h"
#include <unistd.h>
+#include <stddef.h>
#include <sys/mman.h>
#include <prerror.h>
@@ -135,11 +136,7 @@ generate_descriptor(authvar_context *ctx)
if (rc < 0)
cmsreterr(-1, ctx->cms_ctx, "could not create signed data");
-#if __WORDSIZE == 64
- offset = (uint64_t) &((win_cert_uefi_guid_t *)0)->data;
-#else
- offset = (uint32_t) &((win_cert_uefi_guid_t *)0)->data;
-#endif
+ offset = offsetof(win_cert_uefi_guid_t, data);
authinfo = calloc(offset + sd_der.len, 1);
if (!authinfo)
cmsreterr(-1, ctx->cms_ctx, "could not allocate authinfo");
@@ -162,6 +159,7 @@ write_authvar(authvar_context *ctx)
Index: pesign-115/src/authvar_context.c
===================================================================
--- pesign-115.orig/src/authvar_context.c
+++ pesign-115/src/authvar_context.c
@@ -151,6 +151,7 @@ write_authvar(authvar_context *ctx)
void *buffer, *ptr;
size_t buf_len, des_len, remain;
ssize_t wlen;
@ -45,7 +24,7 @@ index 7a753fc..c51c666 100644
if (!ctx->authinfo)
cmsreterr(-1, ctx->cms_ctx, "Not a valid authvar");
@@ -189,19 +187,19 @@ write_authvar(authvar_context *ctx)
@@ -179,19 +180,19 @@ write_authvar(authvar_context *ctx)
if (ctx->value_size > 0)
memcpy(ptr, ctx->value, ctx->value_size);
@ -69,6 +48,3 @@ index 7a753fc..c51c666 100644
} while (remain > 0);
free(buffer);
--
2.21.0

81
pesign-privkey_unneeded.diff
View File

@ -1,81 +0,0 @@
---
src/cms_common.c | 12 ++++++++++--
src/cms_common.h | 1 +
src/pesign.c | 1 +
3 files changed, 12 insertions(+), 2 deletions(-)
Index: pesign-113/src/cms_common.c
===================================================================
--- pesign-113.orig/src/cms_common.c
+++ pesign-113/src/cms_common.c
@@ -282,6 +282,7 @@ struct cbdata {
CERTCertificate *cert;
PK11SlotListElement *psle;
secuPWData *pwdata;
+ int privkey_unneeded;
};
static SECStatus
@@ -293,6 +294,12 @@ is_valid_cert(CERTCertificate *cert, voi
void *pwdata = cbdata->pwdata;
SECKEYPrivateKey *privkey = NULL;
+
+ if (cbdata->privkey_unneeded) {
+ cbdata->cert = cert;
+ return SECSuccess;
+ }
+
privkey = PK11_FindPrivateKeyFromCert(slot, cert, pwdata);
if (privkey != NULL) {
cbdata->cert = cert;
@@ -423,7 +430,7 @@ find_certificate(cms_context *cms, int n
}
SECStatus status;
- if (PK11_NeedLogin(psle->slot) && !PK11_IsLoggedIn(psle->slot, pwdata)) {
+ if (!cms->privkey_unneeded && PK11_NeedLogin(psle->slot) && !PK11_IsLoggedIn(psle->slot, pwdata)) {
status = PK11_Authenticate(psle->slot, PR_TRUE, pwdata);
if (status != SECSuccess) {
PK11_DestroySlotListElement(slots, &psle);
@@ -452,6 +459,7 @@ find_certificate(cms_context *cms, int n
.cert = NULL,
.psle = psle,
.pwdata = pwdata,
+ .privkey_unneeded = cms->privkey_unneeded,
};
if (needs_private_key) {
@@ -572,7 +580,7 @@ find_named_certificate(cms_context *cms,
}
SECStatus status;
- if (PK11_NeedLogin(psle->slot) && !PK11_IsLoggedIn(psle->slot, pwdata)) {
+ if (!cms->privkey_unneeded && PK11_NeedLogin(psle->slot) && !PK11_IsLoggedIn(psle->slot, pwdata)) {
status = PK11_Authenticate(psle->slot, PR_TRUE, pwdata);
if (status != SECSuccess) {
PK11_DestroySlotListElement(slots, &psle);
Index: pesign-113/src/cms_common.h
===================================================================
--- pesign-113.orig/src/cms_common.h
+++ pesign-113/src/cms_common.h
@@ -62,6 +62,7 @@ typedef int (*cms_common_logger)(struct
typedef struct cms_context {
PRArenaPool *arena;
void *privkey;
+ int privkey_unneeded;
char *tokenname;
char *certname;
Index: pesign-113/src/file_pe.c
===================================================================
--- pesign-113.orig/src/file_pe.c
+++ pesign-113/src/file_pe.c
@@ -354,6 +354,7 @@ pe_handle_action(pesign_context *ctxp, i
*/
case IMPORT_RAW_SIGNATURE|IMPORT_SATTRS:
check_inputs(ctxp);
+ ctxp->cms_ctx->privkey_unneeded = 1;
rc = find_certificate(ctxp->cms_ctx, 0);
if (rc < 0) {
fprintf(stderr, "pesign: Could not find "

94
pesign-run.patch
View File

@ -1,94 +0,0 @@
---
src/Makefile | 2 +-
src/daemon.h | 4 ++--
src/macros.pesign | 2 +-
src/pesign.sysvinit | 14 +++++++-------
src/tmpfiles.conf | 2 +-
5 files changed, 12 insertions(+), 12 deletions(-)
Index: pesign-113/src/Makefile
===================================================================
--- pesign-113.orig/src/Makefile
+++ pesign-113/src/Makefile
@@ -73,7 +73,7 @@ install_sysvinit: pesign.sysvinit
install :
$(INSTALL) -d -m 700 $(INSTALLROOT)/etc/pki/pesign/
$(INSTALL) -d -m 700 $(INSTALLROOT)/etc/pki/pesign-rh-test/
- $(INSTALL) -d -m 770 $(INSTALLROOT)/var/run/pesign/
+ $(INSTALL) -d -m 770 $(INSTALLROOT)/run/pesign/
$(INSTALL) -d -m 755 $(INSTALLROOT)$(bindir)
$(INSTALL) -m 755 authvar $(INSTALLROOT)$(bindir)
$(INSTALL) -m 755 pesign $(INSTALLROOT)$(bindir)
Index: pesign-113/src/daemon.h
===================================================================
--- pesign-113.orig/src/daemon.h
+++ pesign-113/src/daemon.h
@@ -49,8 +49,8 @@ typedef enum {
} pesignd_cmd;
#define PESIGND_VERSION 0x2a9edaf0
-#define SOCKPATH "/var/run/pesign/socket"
-#define PIDFILE "/var/run/pesign.pid"
+#define SOCKPATH "/run/pesign/socket"
+#define PIDFILE "/run/pesign.pid"
static inline uint32_t UNUSED
pesignd_string_size(char *buffer)
Index: pesign-113/src/macros.pesign
===================================================================
--- pesign-113.orig/src/macros.pesign
+++ pesign-113/src/macros.pesign
@@ -52,7 +52,7 @@
getfacl /var/run/pesign 1>&2 \
getfacl /var/run/pesign/socket 1>&2 \
exit 1 \
- elif [ -S /var/run/pesign/socket ]; then \
+ elif [ -S /run/pesign/socket ]; then \
%{_pesign_client} -t %{__pesign_client_token} \\\
-c %{__pesign_client_cert} \\\
%{-i} %{-o} %{-e} %{-s} %{-C} \
Index: pesign-113/src/tmpfiles.conf
===================================================================
--- pesign-113.orig/src/tmpfiles.conf
+++ pesign-113/src/tmpfiles.conf
@@ -1 +1 @@
-D /var/run/pesign 0770 pesign pesign -
+D /run/pesign 0770 pesign pesign -
Index: pesign-113/src/pesign.sysvinit.in
===================================================================
--- pesign-113.orig/src/pesign.sysvinit.in
+++ pesign-113/src/pesign.sysvinit.in
@@ -4,7 +4,7 @@
#
# chkconfig: - 50 50
# processname: /usr/bin/pesign
-# pidfile: /var/run/pesign.pid
+# pidfile: /run/pesign.pid
### BEGIN INIT INFO
# Provides: pesign
# Should-Start: $remote_fs
Index: pesign-113/src/pesign.service.in
===================================================================
--- pesign-113.orig/src/pesign.service.in
+++ pesign-113/src/pesign.service.in
@@ -4,6 +4,6 @@ Description=Pesign signing daemon
[Service]
PrivateTmp=true
Type=forking
-PIDFile=/var/run/pesign.pid
+PIDFile=/run/pesign.pid
ExecStart=/usr/bin/pesign --daemonize
ExecStartPost=@@LIBEXECDIR@@/pesign/pesign-authorize
Index: pesign-113/src/pesign-authorize
===================================================================
--- pesign-113.orig/src/pesign-authorize
+++ pesign-113/src/pesign-authorize
@@ -47,7 +47,7 @@ update_subdir() {
done
}
-for x in /var/run/pesign/ /etc/pki/pesign*/ ; do
+for x in /run/pesign/ /etc/pki/pesign*/ ; do
if [ -d "${x}" ]; then
update_subdir "${x}"
else

59
pesign-suse-build.patch
View File

@ -1,7 +1,7 @@
Index: pesign-113/util/Makefile
Index: pesign-115/util/Makefile
===================================================================
--- pesign-113.orig/util/Makefile
+++ pesign-113/util/Makefile
--- pesign-115.orig/util/Makefile
+++ pesign-115/util/Makefile
@@ -7,7 +7,7 @@ include $(TOPDIR)/Make.efirules
include $(TOPDIR)/Make.defaults
@ -17,18 +17,18 @@ Index: pesign-113/util/Makefile
install :
- $(INSTALL) -d -m 755 $(INSTALLROOT)/boot/efi/EFI/redhat/
- $(INSTALL) -m 755 *.efi $(INSTALLROOT)/boot/efi/EFI/redhat/
+ $(INSTALL) -d -m 755 $(INSTALLROOT)/boot/efi/EFI/SuSE/
+ $(INSTALL) -m 755 *.efi $(INSTALLROOT)/boot/efi/EFI/SuSE/
+ $(INSTALL) -d -m 755 $(INSTALLROOT)/boot/efi/EFI/sles/
+ $(INSTALL) -m 755 *.efi $(INSTALLROOT)/boot/efi/EFI/sles/
install_systemd:
Index: pesign-113/src/pesign.sysvinit.in
Index: pesign-115/src/pesign.sysvinit.in
===================================================================
--- pesign-113.orig/src/pesign.sysvinit.in
+++ pesign-113/src/pesign.sysvinit.in
--- pesign-115.orig/src/pesign.sysvinit.in
+++ pesign-115/src/pesign.sysvinit.in
@@ -6,16 +6,19 @@
# processname: /usr/bin/pesign
# pidfile: /var/run/pesign.pid
# pidfile: @@RUNDIR@@pesign.pid
### BEGIN INIT INFO
-# Provides: pesign
-# Default-Start:
@ -46,50 +46,41 @@ Index: pesign-113/src/pesign.sysvinit.in
-. /etc/init.d/functions
[ -f /usr/bin/pesign ] || exit 1
+PESIGN_PIDFILE=/var/run/pesign.pid
+PESIGN_PIDFILE=@@RUNDIR@@pesign.pid
RETVAL=0
start(){
@@ -23,7 +26,7 @@ start(){
mkdir /var/run/pesign 2>/dev/null &&
chown pesign:pesign /var/run/pesign &&
chmod 0770 /var/run/pesign
mkdir @@RUNDIR@@pesign 2>/dev/null &&
chown pesign:pesign @@RUNDIR@@pesign &&
chmod 0770 @@RUNDIR@@pesign
- daemon /usr/bin/pesign --daemonize
+ startproc -f -p "$PESIGN_PIDFILE" /usr/bin/pesign --daemonize
RETVAL=$?
echo
touch /var/lock/subsys/pesign
@@ -32,7 +35,7 @@ start(){
stop(){
echo -n "Stopping pesign: "
- killproc -p /var/run/pesign.pid pesignd
+ killproc -p /run/pesign.pid pesignd
RETVAL=$?
echo
rm -f /var/lock/subsys/pesign
Index: pesign-113/Make.defaults
Index: pesign-115/Make.defaults
===================================================================
--- pesign-113.orig/Make.defaults
+++ pesign-113/Make.defaults
@@ -61,7 +61,7 @@ CPPFLAGS ?=
RANLIBFLAGS := $(if $(filter $(CC),gcc),-D)
ARFLAGS := $(if $(filter $(CC),gcc),-Dcvqs)$(if $(filter $(CC),clang),-cqvs)
--- pesign-115.orig/Make.defaults
+++ pesign-115/Make.defaults
@@ -83,7 +83,7 @@ CPPFLAGS ?= -D_FORTIFY_SOURCE=2
RANLIBFLAGS ?= $(if $(filter $(CC),gcc),-D)
ARFLAGS ?= $(if $(filter $(CC),gcc),-Dcvqs)$(if $(filter $(CC),clang),-cqvs)
-LDLIBS = $(foreach lib,$(LIBS),-l$(lib)) $(call pkg-config-ldlibs)
+LDLIBS = -lpthread $(foreach lib,$(LIBS),-l$(lib)) $(call pkg-config-ldlibs)
ifeq ($(ARCH),ia64)
efi_cflags += -mfixed-range=f32-f127
Index: pesign-113/Makefile
Index: pesign-115/Makefile
===================================================================
--- pesign-113.orig/Makefile
+++ pesign-113/Makefile
--- pesign-115.orig/Makefile
+++ pesign-115/Makefile
@@ -11,7 +11,6 @@ SUBDIRS := include libdpe src
install :
$(INSTALL) -d -m 755 $(INSTALLROOT)$(docdir)/pesign-$(VERSION)/
- $(INSTALL) -pm 644 COPYING $(INSTALLROOT)$(docdir)/pesign-$(VERSION)/
@set -e ; for x in $(SUBDIRS) ; do \
$(MAKE) -C $$x $@ ; \
done
@$(call descend)
install_systemd install_sysvinit : install

31
pesign.changes
View File

@ -1,3 +1,33 @@
-------------------------------------------------------------------
Fri Dec 2 08:20:44 UTC 2022 - Gary Ching-Pang Lin <glin@suse.com>
- Update to 115
+ macros: drop %{_pesign_args}
+ Fix two bugs from package building
+ Fix bad free of cms data (DoS only)
+ Send pesign stdout/err to systemd journal
+ Add missing Install section
+ Add default packages for pkg-config
+ Short delay to ensure /run/pesign/socket exists
+ Resolve crash when signature that is removed is not the end of
the list
+ Enhance error diagnostics about version mismatch
+ Upstream all Fedora changes
+ Add some hardening options to build
+ Add code of conduct
+ Fix build on gcc 12 and non-Fedora
- Refresh patches
+ harden_pesign.service.patch
+ pesign-boo1143063-remove-var-tracking.patch
+ pesign-boo1185663-set-rpmmacrodir.patch
+ pesign-fix-authvar-write-loop.patch
+ pesign-suse-build.patch
- Remove upstreamed/unnecessary patches
+ pesign-boo1158197-fix-pesigncheck-gcc10.patch
+ pesign-efikeygen-Fix-the-build-with-nss-3.44.patch
+ pesign-privkey_unneeded.diff
+ pesign-run.patch
-------------------------------------------------------------------
Sun Nov 11 10:54:08 UTC 2021 - Andreas Schwab <schwab@suse.de>
@ -77,6 +107,7 @@ Mon May 13 03:57:30 UTC 2019 - Gary Ching-Pang Lin <glin@suse.com>
+ Various documentation improvements.
+ Improve /etc/pki/pesign authorization scripts
+ Various pesigcheck improvements
+ Fix wrong oid offsets (bsc#1205323)
- Refresh patches
+ pesign-suse-build.patch
+ pesign-privkey_unneeded.diff

24
pesign.spec
View File

@ -1,7 +1,7 @@
#
# spec file for package pesign
#
# Copyright (c) 2021 SUSE LLC
# Copyright (c) 2022 SUSE LLC
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@ -17,7 +17,7 @@
Name: pesign
Version: 113
Version: 115
Release: 0
Summary: Signing tool for PE-COFF binaries
License: GPL-3.0-or-later
@ -27,21 +27,13 @@ Source: https://github.com/rhinstaller/pesign/releases/download/%{versio
Source1: pesign.sysusers
# PATCH-FIX-SUSE pesign-suse-build.patch glin@suse.com -- Adjust Makefile for the build service
Patch1: pesign-suse-build.patch
# PATCH-FIX-UPSTREAM pesign-privkey_unneeded.diff glin@suse.com -- Don't check the private key when importing the raw signature
Patch2: pesign-privkey_unneeded.diff
# PATCH-FIX-SUSE pesign-run.patch aj@suse.com - Use /run instead of /var/run
Patch3: pesign-run.patch
# PATCH-FIX-UPSTREAM pesign-fix-authvar-write-loop.patch glin@suse.com -- Fix the write loop in authvar
Patch4: pesign-fix-authvar-write-loop.patch
# PATCH-FIX-UPSTREAM pesign-efikeygen-Fix-the-build-with-nss-3.44.patch glin@suse.com -- Fix the NSS 3.44 compilation error
Patch5: pesign-efikeygen-Fix-the-build-with-nss-3.44.patch
Patch2: pesign-fix-authvar-write-loop.patch
# PATCH-FIX-SUSE pesign-boo1143063-remove-var-tracking.patch -- boo#1143063 Remove var-tracking from default CFLAGS
Patch6: pesign-boo1143063-remove-var-tracking.patch
# PATCH-FIX-UPSTREAM pesign-boo1158197-fix-pesigncheck-gcc10.patch glin@suse.com -- boo#1158197 Fix the gcc10 errors
Patch7: pesign-boo1158197-fix-pesigncheck-gcc10.patch
Patch3: pesign-boo1143063-remove-var-tracking.patch
# PATCH-FIX-UPSTREAM pesign-boo1185663-set-rpmmacrodir.patch boo#1185663 glin@suse.com -- Set the rpm macro directory at build time
Patch8: pesign-boo1185663-set-rpmmacrodir.patch
Patch9: harden_pesign.service.patch
Patch4: pesign-boo1185663-set-rpmmacrodir.patch
Patch5: harden_pesign.service.patch
BuildRequires: efivar-devel
BuildRequires: libuuid-devel
BuildRequires: mozilla-nss-devel
@ -64,10 +56,6 @@ with the PE and Authenticode specifications.
%patch3 -p1
%patch4 -p1
%patch5 -p1
%patch6 -p1
%patch7 -p1
%patch8 -p1
%patch9 -p1
%build
%sysusers_generate_pre %{SOURCE1} %{name} %{name}.conf