SHA256
1
0
forked from pool/tpm2.0-tools
tpm2.0-tools/tpm2.0-tools.spec

116 lines
3.7 KiB
RPMSpec
Raw Normal View History

#
# spec file for package tpm2.0-tools
#
# Copyright (c) 2023 SUSE LLC
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
# upon. The license for this file, and modifications and additions to the
# file, is the same license as for the pristine package itself (unless the
# license for the pristine package is not an Open Source License, in which
# case the license is the MIT License). An "Open Source License" is a
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.
# Please submit bugfixes or comments via https://bugs.opensuse.org/
#
%define _lto_cflags %{nil}
%ifarch %{ix86} x86_64 aarch64 %{arm} ppc64le
%bcond_without test
%else
# ppc ppc64 s390x: some code (tpm2_command_header_from_bytes) depend
# on the endianness of the architecture:
# gh#tpm2-software/tpm2-tools#3055
# gh#tpm2-software/tpm2-tools#3060
# gh#tpm2-software/tpm2-tools#3061
%bcond_with test
%endif
Name: tpm2.0-tools
Version: 5.5
Release: 0
Summary: Trusted Platform Module (TPM) 2.0 administration tools
License: BSD-3-Clause
Group: Productivity/Security
- update to version 4.3: - changes in version 4.3: - tss2_*: Fix double-free errors in commands asking for password authorization - tss2_*: Fix shorthand command -f that was falsely requiring an argument - tss2_*: Update tss2_encrypt to the new FAPI interface - The argument 'policyPath' is removed which was never read anyway - tss2_*: Remove the additional '\n' that was appended when redirecting to stdout - tss2_*: Update mandatory vs optional treatment of arguments according to latest Fapi spec - tss2_*: tss2_getinfo now retrieves the correct FAPI version from Fapi_GetInfo - tss2_*: Fix the error handling in case of multiple inputs and/or outputs from stdin/stdout - tss2_*: Fix syntax errors and update content of man pages according to latest Fapi spec - tss2_*: Add parameter types to all man page - tss2_*: tss2_setappdata now reads from file or stdin allowing to store also binary data - tss2_*: Memory leaks are fixed in cases when a returned empty non-char output value was passed to file output - tss2_pcrextend: fix extending PCR 0 - tss2_quote: fix unused TSS2_RC in LOG_ERR - changes in 4.2.1: - Fix missing handle maps for ESY3 handle breaks. See #1994. - Bump ESYS minimum dependency version from 2.3.0 to 2.4.0. - Fix for loop declarations build error. - changes in 4.2: - Fix various issues reported by static analysis tools. - Add integration test for ECC based getekcertificate. - Fix for issue #1959 where ARM builds were failing. - Add a check in autotools to add "expect" as a package dependency for fapi tools. - tpm2_createek: Drop the unused -p or --ek-auth option - tpm2_policyor: List of policy files should be specified as an argument - instead of -l option. The -l option is still retained for backwards - compatibility. See issue#1894. - tpm2_eventlog: add a tool for parsing and displaying the event log. OBS-URL: https://build.opensuse.org/package/show/security/tpm2.0-tools?expand=0&rev=58
2020-10-22 14:14:07 +02:00
URL: https://github.com/tpm2-software/tpm2-tools/releases
Source0: https://github.com/tpm2-software/tpm2-tools/releases/download/%{version}/tpm2-tools-%{version}.tar.gz
Source1: https://github.com/tpm2-software/tpm2-tools/releases/download/%{version}/tpm2-tools-%{version}.tar.gz.asc
# git show william-roberts-pub javier-martinez-pub joshua-lock-pub idesai-pub > tpm2-tools.keyring
Source2: tpm2-tools.keyring
BuildRequires: gcc-c++
Accepting request 461444 from home:msmeissn:branches:security - Updated to 1.1.0 / 016-11-04 - Added * travis ci support. * Allow for unit tests to be enabled selectively. * tpm2_rc_decode tool: Decode TPM_RC error codes. * Android Make file * tpm2_listpersistent: list all persistent objects * test scripts for tpm2-tools * tpm2_nvreadlock * tpm2_getmanufec: retrieve EC from tpm manufacturer server. * Copy 'common' and 'sample' code from the TPM2.0-TSS repo. - Modified * tpm2_takeownership: update option -c to use lockout password to clear. * tpm2_listpcrs: add options -L and -s, rewrite to increase performance. * tpm2_quote: added -L option to support selection of multiple banks. * tpm2_quote: add -q option to get qualifying data. * configure: Use pkg-config to get info about libcurl and libcrypto. * configure: Use pkg-config to locate SAPI and TCTI headers / libraries. * tpm2_x: Add -X option to enable password input in Hex format. * tpm2_nvdefine: Change -X option to -I. * tpm2-nvwrite: fix for unable to write 1024B+ data. * tpm2_getmanufec: Fix base64 encoding. * tpm2_x: fixed a lot of TPM2B failures caused by wrong initialization. * tpm2_getmanufec: let configure handle libs. * tpm2_getmanufec: Convert from dos to unix format. * build: Check for TSS2 library @ configure time. * build: Detect required TSS2 and TCTI headers. * build: Use libtool to build the common library * build: Install all binaries into sbin. * build: Build common sources into library. OBS-URL: https://build.opensuse.org/request/show/461444 OBS-URL: https://build.opensuse.org/package/show/security/tpm2.0-tools?expand=0&rev=11
2017-03-01 17:18:06 +01:00
BuildRequires: libcurl-devel
BuildRequires: libopenssl-devel
BuildRequires: libtool
BuildRequires: libuuid-devel
BuildRequires: pkgconfig
BuildRequires: tpm2-0-tss-devel
BuildRequires: tpm2.0-abrmd-devel
BuildRequires: pkgconfig(efivar)
Recommends: tpm2.0-abrmd
# Pandoc is used for generating the man pages, but since 3.0.4 prebuilt man
# pages are shipped with the distribution tarball and we don't need to generate
# them any more. Pandoc is only available on openSUSE (not 32-bit x86) and not
# in Ring 1 (no haskell), so can't be used as build dependency here.
%if 0
%if 0%{?is_opensuse}
%ifnarch %{ix86}
BuildRequires: pandoc
%endif
%endif
%endif
%if %{with test}
# requirements for unit test suite (configure --enable-unit)
BuildRequires: dbus-1-daemon
BuildRequires: expect
BuildRequires: ibmswtpm2
BuildRequires: iproute2
BuildRequires: libcmocka-devel
BuildRequires: python3-PyYAML
BuildRequires: tpm2.0-abrmd
# for xxd, which is also required by the tests
BuildRequires: vim
%endif
%description
Trusted Computing is a set of specifications published by the Trusted
Computing Group (TCG). The Trusted Platform Module (TPM) is the
hardware component for Trusted Computing. The tpm2.0-tools package
provides tools for enablement and configuration of the TPM 2.0 and
associated interfaces.
%prep
%autosetup -p1 -n tpm2-tools-%{version}
%build
# help configure find required executables for testing
export PATH=$PATH:/usr/sbin:/usr/libexec/ibmtss
%configure --disable-static \
%{?with_test: --enable-unit}
%make_build
%install
%make_install
find %{buildroot} -type f -name "*.la" -delete -print
%files
Accepting request 1041869 from home:aplanas:branches:security - Update to version 5.4 + Added: * tpm2_policyrestart: Added option --cphash to output the cpHash for the command PM2_CC_PolicyRestart. * tpm2_policynvwritten: Added option --cphash to output the cpHash for the command TPM2_CC_PolicyNvWritten. * tpm2_policylocality: Added option --cphash to output the cpHash for the command TPM2_CC_PolicyLocality. * tpm2_policycountertimer: Added option --cphash to output the cpHash for the command TPM2_CC_PolicyCounterTimer. * tpm2_policycommandcode: Added option --cphash to output the cpHash for the command TPM2_CC_PolicyCommandCode. * tpm2_policypassword: Added option --cphash to output the cpHash for the command TPM2_CC_PolicyPassword. * tpm2_policyauthvalue: Added option --cphash to output the cpHash for the command TPM2_CC_PolicyAuthValue. * tpm2_policyauthorize: Added option --cphash to output the cpHash for the command TPM2_CC_PolicyAuthorize. * tpm2_print: Support printing serialized ESYS_TR's * tpm2_create: Add a clarifying message to usage of -c when TPM2_CreateLoaded is not supported. * tpm2_getcap: Add support for vendor agnostic capabilites. Requires tpm2-tss version 4.0 and higher to enable. * Add a script, check_endorsement_cert.sh, to validate the endorsement certificate chain. It takes two inputs - A TPM2B_PUBLIC format EKpublic and a PEM format EKcertificate specified in that order as arguments. - Update to version 5.3 + Features: * lib/tpm2_tool.c: add --help=no-man for tpm2 option. Prior to this change the tool parsed no-man as an unrecognized option and errored out. Now it lists all the available tool options. * tpm2_encodeobject: New tool to encode TPM2 object. It takes public and private portions of an object and encode them in a combined PEM form called tssprivkey used by tpm2-tss-engine and other applications. * Support alternative ECC curves for which default EK templates exist (NIST_P256, NIST_P384, NIST_P521, and SM2_P256). * tools/misc/tpm2_checkquote: add sm2 verification of signature. * crypto: support the TPM2_ECC_SM2_P256 curveID. * fapi: add new command to enable the use of fapi objects for tpm2 tools. The new command tss2_gettpm2object was added. With this command context files which can be used for tpm2 tool commands can be created. * Support for sign and verify with sm2 algorithms. * tools/tpm2_startauthsession: add sym-algorithm argument for supported symmetric algorithm. * Attestation (certify, command audit, sessionaudit and quote): add scheme argument for supported signature schemes. This also enable support for SM signing. * tpm2_flushcontext: support all options at a time. Support the -t/-l/-s options all at once so folks don't have to call it multiple times. * tools/tpm2_nvread: add human readable output for NV content Enable parsing and YAML-style output for the different NV index types. * New event types in tpm2_eventlog: EV_EFI_PLATFORM_FIRMWARE_BLOB2, EV_EFI_HANDOFF_TABLES2, EV_EFI_VARIABLE_BOOT2 * VERSION: add version file - Generate the version file with bootstrap and include in the DIST tarball so endusers can call autoreconf on a dist tarball which doesn't have git. This alleviates git describe errors on release tarballs in the autoreconf case. * import: support restricted parents - Support a restricted parent with an aes128cfb symmetric parameter. * tpm2_load - Added capability to load pem files in TSS2-Private-Key format for interoperability with tpm2-tss-engine, tpm2-openssl provider tpm2-pkcs11, and tpm2-pytss. * tpm2_print - Added capability to parse out and print the public portion of a TSS Private Key in the PEM format with the arg option TSSPRIVKEY_OBJ. * tpm2_loadexternal: Added support to tpm2_loadexternal for parsing and loading the public portion of a TSS2 Privkey PEM file. The path to the PEM file must be specified using the -r option while skipping the -G option for key type. * Support added for calculating cpHash, rpHash, sessions for parameter encryption and auditing in: tpm2_nvwrite, tpm2_nvcertify, tpm2_nvincrement, tpm2_nvwritelock, tpm2_nvreadlock, tpm2_nvundefine and tpm2_nvreadpublic. * Support added for calculating cpHash in: tpm2_clear, tpm2_dictionarylockout, tpm2_clearcontrol, tpm2_sign, tpm2_setprimarypolicy, tpm2_setclock, tpm2_rsadecrypt, tpm2_duplicate, tpm2_clockrateadjust, tpm2_createprimary, tpm2_quote, tpm2_policysecret, tpm2_policynv, tpm2_policyauthorizenv, tpm2_import, tpm2_hmac, tpm2_hierarchycontrol, tpm2_load, tpm2_gettime, tpm2_evictcontrol, tpm2_encryptdecrypt, tpm2_getpolicydigest, tpm2_loadexternal, tpm2_commit, tpm2_ecdhkeygen, tpm2_ecdhzgen, tpm2_ecephemeral, tpm2_geteccparameters, tpm2_flushcontext, tpm2_pcrallocate, tpm2_pcrevent, tpm2_pcrreset, tpm2_pcrread. * Support for using tcti=none for cpHash calculations to avoid invoking checks for active TPM in: tpm2_nvreadpublic, tpm2_nvundefine, tpm2_nvreadlock, tpm2_nvwritelock, tpm2_nvincrement, tpm2_nvcertify, tpm2_nvdefine, tpm2_nvwrite. + Known issue: * FAPI tools will not work on 32bit user-static qemu on 64bit host because readdir returns NULL. Follow the issue on https://gitlab.com/qemu-project/qemu/-/issues/263 + Bug fixes: * tools/tpm2_pcrreset.c: fix build errors in 32bit systems. * Fix tssprivkey formatted PEM generation and load errors on 32 bit systems. * CI: Add testing of 32bit systems with multiarch/qemu-user-static containers. * tools/tpm2_evictcontrol: fix for calls to Esys_TR_Close on bad handles. * tools/tpm2_nvextend: fix for ESYS_TR handle not being used in calculating the object name. * tools/tpm2_nvwrite, tools/tpm2_nvread: Policy authorization must be re-instantiated on each iteration of the read/ write when size exceeds the allowed operating size (TPM2_PT_NV_BUFFER_MAX). However, information on the compounded policies cannot be retrieved from the only policy digest read from the session and hence the session cannot be re-instantiated. To avoid this scenario only a single iteration is allowed when policy authorization is in use. * Fix argument parsing in tpm2_policylocality to fix an issue causing almost always to generate PolicyLocality(0). There was a logical inversion that caused almost any argument (including invalid ones) to be interpreted as zero, except “zero" would be interpreted as one. * test/fapi/fapi-quote-verify.sh Fix check of qualifying data. Because of a bug in Fapi_VerifyQuote the qualifying data was not checked correctly. Errors that were not recognized before occur now. The order of the tests was cleaned up and for every quote and verify quote now the correct combination of the qualifying data and quote info containing the nonce is used. * tpm2_nvdefine: set TPMA_NV_PLATFORMCREATE when authenticating with the platform hierarchy. * tools/tpm2_getekcertificate: fixed the url link to ekop.intel.com. There were two places where the fix was needed: o In the tool source code where a forward slash was always appended irrespective of it already being part of the link specified by the user and o In the integration test where curl tests the link to the ekop.intel.com backend. It now requires the full link to include the base64 encoded ek pub hash. * tools/tpm2_tool.c: Fix an issue where LOG_WARN is always displayed Despite setting the 'quiet' flag with -Q. * fapi: fix usage of parameter pcrLog for tss2_quote. pcrLog is an optional parameter. If pcrLog is not used as parameter currently the pcr log is still calculated in Fapi_Quote. To avoid this calculation a NULL pointer will be passed to Fapi_Quote if the parameter pcrLog is not passed. So tss2_quote can be executed for a user which has no access rights to the files with the system measurements. * import: fix bug on using scheme wherein if scheme is specified in the template, the openssl load functions clobber the scheme value and set it to TPM2_ALG_NULL. * tools/tpm2_sign and tpm2_verifysignature: fix sm2 sign and verifysignature bugs : (1.) sm2 sign could not get output signature. (2.) sm2 verify tss format signature failed. * lib/tpm2.c: added workaround for a system api bug where in the flush handle is erroneously placed in the handle area instead of the parameter area. * nvreadpublic: drop ntoh on attributes The attributes get marshalled to correct endianess by libmu and don’t need to be changed again. * Removing unused '-i' option from tpm2_print * tpm2_policyor: fix unallocated policy list The TPML_DIGEST policy list was calloc'd for some reason, however it could just be statically allocated in the context. The side effect is that when no options or arguments were given a NPD occured when checking the count of the policy list. * tools/tpm2_certify: fix man page for short options and add tests The short options for the signing-key-auth and certified-key-auth were swapped. The case fix in the man page makes it less intuitive but have to go through with the change so that we don't break any existing scripts. This change does not affect the long options. Tests have been added to ensure the functionality. + CI: * ci: add ubuntu-22.04. This also requires the min tpm2-tss version to be at 3.2.0 to support the openSSL major version 3. * cirrus.yml: update freebsd version to 13.1 * .ci/download-deps.sh: update tpm2-abrmd dependency version to 2.4.1 - Drop 0001-tests-getekcertificate.sh-Skip-the-test-if-curl-is-n.patch (merged) - Drop add_missing_shut_down_call_on_cleanup.patch (merged) - Drop fix_check_of_qualifying_data.patch (merged) OBS-URL: https://build.opensuse.org/request/show/1041869 OBS-URL: https://build.opensuse.org/package/show/security/tpm2.0-tools?expand=0&rev=96
2022-12-09 14:26:20 +01:00
%doc docs/README.md docs/CHANGELOG.md
%license docs/LICENSE
%{_bindir}/tpm2*
%{_bindir}/tss2*
- add fix_warnings.patch: fixes a couple of build errors resulting from LTO linking and -Werror. - update to major version 5.0: - Non Backwards Compatible Changes * Default hash algorithm is now sha256. Prior versions claimed sha1, but were inconsistent in choice. Best practice is to specify the hash algorithm to avoid surprises. * tpm2_tools and tss2_tools are now a busybox style commandlet. Ie tpm2_getrandom becomes tpm2 getrandom. make install will install symlinks to the old tool names and the tpm2 commandlet will interrogate argv[0] for the command to run. This will provide backwards compatibility if they are installed. If you wish to use the old names not installed system wide, set DESTDIR during install to a separate path and set the proper directory on PATH. * tpm2_eventlog's output changed to be YAML compliant. The output before was intended to be YAML compliant but was never properly checked and tested. * umask set to 0117 for all tools. * tpm2_getekcertificate now outputs the INTC EK certificates in PEM format by default. In order to output the URL safe variant of base64 encoded output of the INTC EK certificate use the added option --raw. - Dependency update * Update tpm2-tss dependency version to 3.0.1 * Update tpm2-abrmd dependency version to 2.3.3 - New tools and features * tpm2_zgen2phase: Add new tool to support command TPM2_CC_ZGen_2Phase. * tpm2_ecdhzgen: Add new tool to support command TPM2_CC_ECDH_ZGen. * tpm2_ecdhkeygen: Add new tool to support command TPM2_CC_ECDH_KeyGen. * tpm2_commit: Add new tool to support command TPM2_CC_Commit. * tpm2_ecephemeral: Add new tool to support command TPM2_CC_EC_Ephemeral. OBS-URL: https://build.opensuse.org/package/show/security/tpm2.0-tools?expand=0&rev=63
2021-01-28 11:50:59 +01:00
%{_mandir}/man1/tpm2*
%{_mandir}/man1/tss2*
%dir %{_datadir}/bash-completion
%dir %{_datadir}/bash-completion/completions
%{_datadir}/bash-completion/completions/*
%if %{with test}
%check
# Do the tests sequentially to kill all tpm_server instances
# https://github.com/tpm2-software/tpm2-tools/issues/3042
%make_build check
kk
%endif
%changelog