forked from pool/tpm2.0-tools
Accepting request 1041885 from security
OBS-URL: https://build.opensuse.org/request/show/1041885 OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/tpm2.0-tools?expand=0&rev=36
This commit is contained in:
Dominique Leuenberger
Git OBS Bridge
commit
0fadaea8ed
@ -1,23 +0,0 @@
|
|||||||
From a10fd03a8d62226e798b8338c6caf73195e64557 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Alberto Planas <aplanas@suse.com>
|
|
||||||
Date: Fri, 8 Jul 2022 10:09:24 +0200
|
|
||||||
Subject: [PATCH 1/1] tests/getekcertificate.sh: Skip the test if curl is not
|
|
||||||
present
|
|
||||||
|
|
||||||
Signed-off-by: Alberto Planas <aplanas@suse.com>
|
|
||||||
---
|
|
||||||
test/integration/tests/getekcertificate.sh | 1 +
|
|
||||||
1 file changed, 1 insertion(+)
|
|
||||||
|
|
||||||
Index: tpm2-tools-5.2/test/integration/tests/getekcertificate.sh
|
|
||||||
===================================================================
|
|
||||||
--- tpm2-tools-5.2.orig/test/integration/tests/getekcertificate.sh
|
|
||||||
+++ tpm2-tools-5.2/test/integration/tests/getekcertificate.sh
|
|
||||||
@@ -19,6 +19,7 @@ start_up
|
|
||||||
# Check connectivity
|
|
||||||
if [ -z "$(curl -V 2>/dev/null)" ]; then
|
|
||||||
echo "curl is not not installed. Skipping connection check."
|
|
||||||
+ exit 077
|
|
||||||
else
|
|
||||||
if [ "$(curl --silent --output /dev/null --write-out %{http_code} \
|
|
||||||
'https://ekop.intel.com/')" != '200' ]; then
|
|
||||||
@ -1,70 +0,0 @@
|
|||||||
From db6aa7ac5094a04168e60256e154786c0c7e7c1c Mon Sep 17 00:00:00 2001
|
|
||||||
From: Alberto Planas <aplanas@suse.com>
|
|
||||||
Date: Wed, 13 Jul 2022 13:35:19 +0200
|
|
||||||
Subject: [PATCH] test: add missing shut_down call on cleanup
|
|
||||||
|
|
||||||
The tests "gettime", "readclock" and "symlink" are not calling
|
|
||||||
"shut_down" during the "cleanup" stage, making the TPM simulator to keep
|
|
||||||
their process during the "make check". Somehow this produces problems
|
|
||||||
when the tests are executed in parallel under certain conditions, with
|
|
||||||
the effect of "make" not ending and waiting to those process to die.
|
|
||||||
|
|
||||||
This commit and the mising call in the "cleanup" stage.
|
|
||||||
|
|
||||||
Fix #3042
|
|
||||||
|
|
||||||
Signed-off-by: Alberto Planas <aplanas@suse.com>
|
|
||||||
---
|
|
||||||
test/integration/tests/gettime.sh | 5 ++++-
|
|
||||||
test/integration/tests/readclock.sh | 5 ++++-
|
|
||||||
test/integration/tests/symlink.sh | 5 ++++-
|
|
||||||
3 files changed, 12 insertions(+), 3 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/test/integration/tests/gettime.sh b/test/integration/tests/gettime.sh
|
|
||||||
index 5a91210a7..054bef864 100644
|
|
||||||
--- a/test/integration/tests/gettime.sh
|
|
||||||
+++ b/test/integration/tests/gettime.sh
|
|
||||||
@@ -3,7 +3,10 @@
|
|
||||||
source helpers.sh
|
|
||||||
|
|
||||||
cleanup() {
|
|
||||||
- rm -f attest.sig attest.data
|
|
||||||
+ rm -f attest.sig attest.data
|
|
||||||
+ if [ "$1" != "no-shut-down" ]; then
|
|
||||||
+ shut_down
|
|
||||||
+ fi
|
|
||||||
}
|
|
||||||
trap cleanup EXIT
|
|
||||||
|
|
||||||
diff --git a/test/integration/tests/readclock.sh b/test/integration/tests/readclock.sh
|
|
||||||
index 56a4c8622..2c59dad09 100644
|
|
||||||
--- a/test/integration/tests/readclock.sh
|
|
||||||
+++ b/test/integration/tests/readclock.sh
|
|
||||||
@@ -3,7 +3,10 @@
|
|
||||||
source helpers.sh
|
|
||||||
|
|
||||||
cleanup() {
|
|
||||||
- rm -f clock.yaml
|
|
||||||
+ rm -f clock.yaml
|
|
||||||
+ if [ "$1" != "no-shut-down" ]; then
|
|
||||||
+ shut_down
|
|
||||||
+ fi
|
|
||||||
}
|
|
||||||
trap cleanup EXIT
|
|
||||||
|
|
||||||
diff --git a/test/integration/tests/symlink.sh b/test/integration/tests/symlink.sh
|
|
||||||
index d1c800ad0..b61349eef 100644
|
|
||||||
--- a/test/integration/tests/symlink.sh
|
|
||||||
+++ b/test/integration/tests/symlink.sh
|
|
||||||
@@ -4,7 +4,10 @@ source helpers.sh
|
|
||||||
|
|
||||||
TMP="$(mktemp -d)"
|
|
||||||
cleanup() {
|
|
||||||
- rm -rf "$TMP"
|
|
||||||
+ rm -rf "$TMP"
|
|
||||||
+ if [ "$1" != "no-shut-down" ]; then
|
|
||||||
+ shut_down
|
|
||||||
+ fi
|
|
||||||
}
|
|
||||||
trap cleanup EXIT
|
|
||||||
|
|
||||||
23
echo_tcti_call_python3_binary.patch
Normal file
23
echo_tcti_call_python3_binary.patch
Normal file
@ -0,0 +1,23 @@
|
|||||||
|
From d191b1f3cd66e9334d000c622bc6cc4bdc63304e Mon Sep 17 00:00:00 2001
|
||||||
|
From: Alberto Planas <aplanas@suse.com>
|
||||||
|
Date: Thu, 8 Dec 2022 15:23:50 +0100
|
||||||
|
Subject: [PATCH] echo_tcti: call python3 binary
|
||||||
|
|
||||||
|
Most distributions are now in Python3. The binary for Python3 is still
|
||||||
|
called `python3`.
|
||||||
|
|
||||||
|
Signed-off-by: Alberto Planas <aplanas@suse.com>
|
||||||
|
---
|
||||||
|
test/scripts/echo_tcti.py | 2 +-
|
||||||
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/test/scripts/echo_tcti.py b/test/scripts/echo_tcti.py
|
||||||
|
index 3e4c1f462..325e35315 100755
|
||||||
|
--- a/test/scripts/echo_tcti.py
|
||||||
|
+++ b/test/scripts/echo_tcti.py
|
||||||
|
@@ -1,4 +1,4 @@
|
||||||
|
-#!/usr/bin/env python
|
||||||
|
+#!/usr/bin/env python3
|
||||||
|
|
||||||
|
#
|
||||||
|
# This TCTI is designed to use with the subprocess TCTI and echo the contents
|
||||||
@ -1,167 +0,0 @@
|
|||||||
From 3b1f00301350848e9454c7adf0487c1a14738236 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Juergen Repp <juergen.repp@sit.fraunhofer.de>
|
|
||||||
Date: Sat, 8 Jan 2022 13:43:00 +0100
|
|
||||||
Subject: [PATCH] test/fapi/fapi-quote-verify.sh Fix check of qualifying data.
|
|
||||||
|
|
||||||
Because of a bug in Fapi_VerifyQuote the qualifying data was not checked correctly.
|
|
||||||
Errors that were not recognized before occur now.
|
|
||||||
The order of the tests was cleaned up and for every quote and verify quote now
|
|
||||||
the correct combination of the qualifying data and quote info containing the nonce
|
|
||||||
is used.
|
|
||||||
|
|
||||||
Signed-off-by: Juergen Repp <juergen.repp@sit.fraunhofer.de>
|
|
||||||
---
|
|
||||||
test/integration/fapi/fapi-quote-verify.sh | 38 ++++++++++++----------
|
|
||||||
1 file changed, 20 insertions(+), 18 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/test/integration/fapi/fapi-quote-verify.sh b/test/integration/fapi/fapi-quote-verify.sh
|
|
||||||
index ad4ade3a1..497d4337f 100644
|
|
||||||
--- a/test/integration/fapi/fapi-quote-verify.sh
|
|
||||||
+++ b/test/integration/fapi/fapi-quote-verify.sh
|
|
||||||
@@ -18,6 +18,7 @@ KEY_PATH=HS/SRK/quotekey
|
|
||||||
NONCE_FILE=$TEMP_DIR/nonce.file
|
|
||||||
PUBLIC_QUOTE_KEY=$TEMP_DIR/public_quote.key
|
|
||||||
QUOTE_INFO=$TEMP_DIR/quote.info
|
|
||||||
+QUOTE_EMPTY_INFO=$TEMP_DIR/quote_empty.info
|
|
||||||
SIGNATURE_FILE=$TEMP_DIR/signature.file
|
|
||||||
CERTIFICATE_FILE=$TEMP_DIR/certificate.file
|
|
||||||
PCR_LOG=$TEMP_DIR/pcr.log
|
|
||||||
@@ -35,14 +36,32 @@ tss2 provision
|
|
||||||
|
|
||||||
tss2 createkey --path=$KEY_PATH --type="noDa, restricted, sign" --authValue=""
|
|
||||||
|
|
||||||
+tss2 exportkey --pathOfKeyToDuplicate=$KEY_PATH --exportedData=$PUBLIC_QUOTE_KEY --force
|
|
||||||
+tss2 import --path="ext/myNewParent" --importData=$PUBLIC_QUOTE_KEY
|
|
||||||
+
|
|
||||||
+
|
|
||||||
tss2 quote --keyPath=$KEY_PATH --pcrList="11, 12, 13, 14, 15, 16" --qualifyingData=$NONCE_FILE \
|
|
||||||
--signature=$SIGNATURE_FILE --pcrLog=$PCR_LOG \
|
|
||||||
--certificate=$CERTIFICATE_FILE --quoteInfo=$QUOTE_INFO --force
|
|
||||||
|
|
||||||
+tss2 verifyquote --publicKeyPath="ext/myNewParent" \
|
|
||||||
+ --qualifyingData=$NONCE_FILE --quoteInfo=$QUOTE_INFO \
|
|
||||||
+ --signature=$SIGNATURE_FILE --pcrLog=$PCR_LOG
|
|
||||||
+
|
|
||||||
echo "tss2 quote with EMPTY_FILE" # Expected to succeed
|
|
||||||
tss2 quote --keyPath=$KEY_PATH --pcrList="11, 12, 13, 14, 15, 16" \
|
|
||||||
--qualifyingData=$EMPTY_FILE --signature=$SIGNATURE_FILE --pcrLog=$PCR_LOG \
|
|
||||||
- --certificate=$CERTIFICATE_FILE --quoteInfo=$QUOTE_INFO --force
|
|
||||||
+ --certificate=$CERTIFICATE_FILE --quoteInfo=$QUOTE_EMPTY_INFO --force
|
|
||||||
+
|
|
||||||
+echo "tss2 verifyquote with EMPTY_FILE qualifyingData" # Expected to succeed
|
|
||||||
+tss2 verifyquote --publicKeyPath="ext/myNewParent" \
|
|
||||||
+ --qualifyingData=$EMPTY_FILE --quoteInfo=$QUOTE_EMPTY_INFO \
|
|
||||||
+ --signature=$SIGNATURE_FILE --pcrLog=$PCR_LOG
|
|
||||||
+
|
|
||||||
+# Try with missing qualifyingData
|
|
||||||
+tss2 verifyquote --publicKeyPath="ext/myNewParent" \
|
|
||||||
+ --quoteInfo=$QUOTE_EMPTY_INFO \
|
|
||||||
+ --signature=$SIGNATURE_FILE
|
|
||||||
|
|
||||||
echo "tss2 quote with BIG_FILE" # Expected to fail
|
|
||||||
expect <<EOF
|
|
||||||
@@ -65,18 +84,6 @@ if [[ "`cat $LOG_FILE`" == $SANITIZER_FILTER ]]; then
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
-tss2 exportkey --pathOfKeyToDuplicate=$KEY_PATH --exportedData=$PUBLIC_QUOTE_KEY --force
|
|
||||||
-tss2 import --path="ext/myNewParent" --importData=$PUBLIC_QUOTE_KEY
|
|
||||||
-
|
|
||||||
-tss2 verifyquote --publicKeyPath="ext/myNewParent" \
|
|
||||||
- --qualifyingData=$NONCE_FILE --quoteInfo=$QUOTE_INFO \
|
|
||||||
- --signature=$SIGNATURE_FILE --pcrLog=$PCR_LOG
|
|
||||||
-
|
|
||||||
-echo "tss2 verifyquote with EMPTY_FILE qualifyingData" # Expected to succeed
|
|
||||||
-tss2 verifyquote --publicKeyPath="ext/myNewParent" \
|
|
||||||
- --qualifyingData=$EMPTY_FILE --quoteInfo=$QUOTE_INFO \
|
|
||||||
- --signature=$SIGNATURE_FILE --pcrLog=$PCR_LOG
|
|
||||||
-
|
|
||||||
echo "tss2 verifyquote with BIG_FILE qualifyingData" # Expected to fail
|
|
||||||
expect <<EOF
|
|
||||||
spawn sh -c "tss2 verifyquote --publicKeyPath=\"ext/myNewParent\" \
|
|
||||||
@@ -537,9 +544,4 @@ if {[lindex \$ret 2] || [lindex \$ret 3] != 1} {
|
|
||||||
}
|
|
||||||
EOF
|
|
||||||
|
|
||||||
-# Try with missing qualifyingData
|
|
||||||
-tss2 verifyquote --publicKeyPath="ext/myNewParent" \
|
|
||||||
- --quoteInfo=$QUOTE_INFO \
|
|
||||||
- --signature=$SIGNATURE_FILE
|
|
||||||
-
|
|
||||||
exit 0
|
|
||||||
|
|
||||||
diff --git a/test/integration/fapi/fapi-quote-verify.sh b/test/integration/fapi/fapi-quote-verify_ecc.sh
|
|
||||||
index ad4ade3a1..497d4337f 100644
|
|
||||||
--- a/test/integration/fapi/fapi-quote-verify_ecc.sh
|
|
||||||
+++ b/test/integration/fapi/fapi-quote-verify_ecc.sh
|
|
||||||
@@ -18,6 +18,7 @@ KEY_PATH=HS/SRK/quotekey
|
|
||||||
NONCE_FILE=$TEMP_DIR/nonce.file
|
|
||||||
PUBLIC_QUOTE_KEY=$TEMP_DIR/public_quote.key
|
|
||||||
QUOTE_INFO=$TEMP_DIR/quote.info
|
|
||||||
+QUOTE_EMPTY_INFO=$TEMP_DIR/quote_empty.info
|
|
||||||
SIGNATURE_FILE=$TEMP_DIR/signature.file
|
|
||||||
CERTIFICATE_FILE=$TEMP_DIR/certificate.file
|
|
||||||
PCR_LOG=$TEMP_DIR/pcr.log
|
|
||||||
@@ -35,14 +36,32 @@ tss2 provision
|
|
||||||
|
|
||||||
tss2 createkey --path=$KEY_PATH --type="noDa, restricted, sign" --authValue=""
|
|
||||||
|
|
||||||
+tss2 exportkey --pathOfKeyToDuplicate=$KEY_PATH --exportedData=$PUBLIC_QUOTE_KEY --force
|
|
||||||
+tss2 import --path="ext/myNewParent" --importData=$PUBLIC_QUOTE_KEY
|
|
||||||
+
|
|
||||||
+
|
|
||||||
tss2 quote --keyPath=$KEY_PATH --pcrList="11, 12, 13, 14, 15, 16" --qualifyingData=$NONCE_FILE \
|
|
||||||
--signature=$SIGNATURE_FILE --pcrLog=$PCR_LOG \
|
|
||||||
--certificate=$CERTIFICATE_FILE --quoteInfo=$QUOTE_INFO --force
|
|
||||||
|
|
||||||
+tss2 verifyquote --publicKeyPath="ext/myNewParent" \
|
|
||||||
+ --qualifyingData=$NONCE_FILE --quoteInfo=$QUOTE_INFO \
|
|
||||||
+ --signature=$SIGNATURE_FILE --pcrLog=$PCR_LOG
|
|
||||||
+
|
|
||||||
echo "tss2 quote with EMPTY_FILE" # Expected to succeed
|
|
||||||
tss2 quote --keyPath=$KEY_PATH --pcrList="11, 12, 13, 14, 15, 16" \
|
|
||||||
--qualifyingData=$EMPTY_FILE --signature=$SIGNATURE_FILE --pcrLog=$PCR_LOG \
|
|
||||||
- --certificate=$CERTIFICATE_FILE --quoteInfo=$QUOTE_INFO --force
|
|
||||||
+ --certificate=$CERTIFICATE_FILE --quoteInfo=$QUOTE_EMPTY_INFO --force
|
|
||||||
+
|
|
||||||
+echo "tss2 verifyquote with EMPTY_FILE qualifyingData" # Expected to succeed
|
|
||||||
+tss2 verifyquote --publicKeyPath="ext/myNewParent" \
|
|
||||||
+ --qualifyingData=$EMPTY_FILE --quoteInfo=$QUOTE_EMPTY_INFO \
|
|
||||||
+ --signature=$SIGNATURE_FILE --pcrLog=$PCR_LOG
|
|
||||||
+
|
|
||||||
+# Try with missing qualifyingData
|
|
||||||
+tss2 verifyquote --publicKeyPath="ext/myNewParent" \
|
|
||||||
+ --quoteInfo=$QUOTE_EMPTY_INFO \
|
|
||||||
+ --signature=$SIGNATURE_FILE
|
|
||||||
|
|
||||||
echo "tss2 quote with BIG_FILE" # Expected to fail
|
|
||||||
expect <<EOF
|
|
||||||
@@ -65,18 +84,6 @@ if [[ "`cat $LOG_FILE`" == $SANITIZER_FILTER ]]; then
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
-tss2 exportkey --pathOfKeyToDuplicate=$KEY_PATH --exportedData=$PUBLIC_QUOTE_KEY --force
|
|
||||||
-tss2 import --path="ext/myNewParent" --importData=$PUBLIC_QUOTE_KEY
|
|
||||||
-
|
|
||||||
-tss2 verifyquote --publicKeyPath="ext/myNewParent" \
|
|
||||||
- --qualifyingData=$NONCE_FILE --quoteInfo=$QUOTE_INFO \
|
|
||||||
- --signature=$SIGNATURE_FILE --pcrLog=$PCR_LOG
|
|
||||||
-
|
|
||||||
-echo "tss2 verifyquote with EMPTY_FILE qualifyingData" # Expected to succeed
|
|
||||||
-tss2 verifyquote --publicKeyPath="ext/myNewParent" \
|
|
||||||
- --qualifyingData=$EMPTY_FILE --quoteInfo=$QUOTE_INFO \
|
|
||||||
- --signature=$SIGNATURE_FILE --pcrLog=$PCR_LOG
|
|
||||||
-
|
|
||||||
echo "tss2 verifyquote with BIG_FILE qualifyingData" # Expected to fail
|
|
||||||
expect <<EOF
|
|
||||||
spawn sh -c "tss2 verifyquote --publicKeyPath=\"ext/myNewParent\" \
|
|
||||||
@@ -537,9 +544,4 @@ if {[lindex \$ret 2] || [lindex \$ret 3] != 1} {
|
|
||||||
}
|
|
||||||
EOF
|
|
||||||
|
|
||||||
-# Try with missing qualifyingData
|
|
||||||
-tss2 verifyquote --publicKeyPath="ext/myNewParent" \
|
|
||||||
- --quoteInfo=$QUOTE_INFO \
|
|
||||||
- --signature=$SIGNATURE_FILE
|
|
||||||
-
|
|
||||||
exit 0
|
|
||||||
@ -1,3 +0,0 @@
|
|||||||
version https://git-lfs.github.com/spec/v1
|
|
||||||
oid sha256:c0b402f6a7b3456e8eb2445211e2d41c46c7e769e05fe4d8909ff64119f7a630
|
|
||||||
size 1072078
|
|
||||||
@ -1,16 +0,0 @@
|
|||||||
-----BEGIN PGP SIGNATURE-----
|
|
||||||
|
|
||||||
iQIzBAABCgAdFiEEYxPm3EGq/DFah2CkFJhvaUSx9ysFAmFTUS4ACgkQFJhvaUSx
|
|
||||||
9ysklQ/+JOGFQ3gNPcOsBRhXf/3FYDf3codr1LnmXGdosWL7VzP33zePGf7xr3rc
|
|
||||||
c8qqbDHO9JHsFd2920oPawqlIBC22kT3fuX6g4pu+mcLeCzSFo5qr2A66mryRQpd
|
|
||||||
xYeufu6mDlYmjs18xt2qtRu/uWxx6E0RH8cLVstfhHMfOUlG2xtWO70eXcS/R0z7
|
|
||||||
6E/U5ezBTcw/7nErlR8YIaLKUnlOYPObeL2oF+1tJVCEzP5ZS+0RcRKQGB9tMYui
|
|
||||||
WSXVGU8G4OslRnebG99OS45tQZgz3cdj371N9/b0DTrgrv+YLEVdAfCxfwdxC54q
|
|
||||||
DDmB0e/KpVpQ04A/zeUaNTBZxIXrR0XzSSoF9c/bdjCGB/qCw/psHvGOgKLkTJGw
|
|
||||||
8TlvaBftPSbR08aiKY0eSJPivQWMqOh6a1XLlGaMj9UbMYtbzKQTo9mkEZsNTq5q
|
|
||||||
NJ06pEfRdjCSKeflLzJt9jLunksKnSviIYLhHPZGT7eqq3yVF/XAqNf28I3614aW
|
|
||||||
bZmkJ35VxieIBy2h2oyg93Jqejjvx2+zEwOIQL6+HbqNmxhjeot7fFxVHNLQFfZS
|
|
||||||
mQ3mUqkLMVo08tcDkTbd36i7mQExpspXXnC4wOm8mNW8idV+ElepskiL9zSdkt1K
|
|
||||||
elTe2AvtVrS4XqTJmJyz6bShC1LBzJXeCxcimAMdYc0DyY5lWDM=
|
|
||||||
=M5xM
|
|
||||||
-----END PGP SIGNATURE-----
|
|
||||||
3
tpm2-tools-5.4.tar.gz
Normal file
3
tpm2-tools-5.4.tar.gz
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
version https://git-lfs.github.com/spec/v1
|
||||||
|
oid sha256:f63571d23edd96d024a2245326bcb9a36fac2cf89aef5a6c05a3b0852d292c99
|
||||||
|
size 1241132
|
||||||
16
tpm2-tools-5.4.tar.gz.asc
Normal file
16
tpm2-tools-5.4.tar.gz.asc
Normal file
@ -0,0 +1,16 @@
|
|||||||
|
-----BEGIN PGP SIGNATURE-----
|
||||||
|
|
||||||
|
iQIzBAABCgAdFiEEW0grjj4Z2nyXjh0BbeLpB44fUMEFAmOOFpAACgkQbeLpB44f
|
||||||
|
UMF1NA/+PCDoLvrwPb2nkN/CvF8yCA8Q0AWqK9oKvStctLGRNRV1FI+S7IXwK77W
|
||||||
|
IADbb8QXgahIGHwE4vLGn2ayy8KSRWjsfAKG7eZ43ZbZFQpc33uG47OG8oKTyqAk
|
||||||
|
2mLFdzeFz8O+ZZ3/3D4DAZKtJCn8C3UOfHYjl5Tn3dWyaRHs6QHJZgc77GxRqDuk
|
||||||
|
jypbF6b5gP83nl63iFTBRhQttOMT1auP/zp9Gen2sy8tR0IIgHFkt9JO8riTLer1
|
||||||
|
/Cgg71sRTxxjpPPEV1gWAgb7gHBGbFlsZLzFVvczqe2IB+rwxeXSzUS6nuYRangn
|
||||||
|
/wiYxBCzHySvGYINLVQI0bSyc9pFIPNF16sovyCCtRFDCXvJSyUZGGds0Ckcv5zy
|
||||||
|
DT6Cgpp3gkAq1kLMd0FHGPZUwdtYVSQuBMp3EP3lQpDJVG0sgITFe83+K06ySo8d
|
||||||
|
3knJclrpyiDZYMNywLkeFfAeBeVCfDX5FR9RMsdcQNo/WlpIlafgphOnKUE7p6wV
|
||||||
|
bWH2c0fQwnk3E3Dfuf3hUeBvVInQW4jhFMhRzuFeeTUX8PH1WKdBvCVBS18z8UTU
|
||||||
|
Jup4Q/Ybqn4aWayjGSRvpi5hfxzEqiF+vqddgbnt13xvKeOzkZP2SQsX+ccjKwSW
|
||||||
|
k+0Rku48PN3wKlrov8kxOqyBrhEJWLLAgERl9thIoTwu1hkZy5w=
|
||||||
|
=7O/x
|
||||||
|
-----END PGP SIGNATURE-----
|
||||||
@ -1,3 +1,192 @@
|
|||||||
|
-------------------------------------------------------------------
|
||||||
|
Thu Dec 8 12:51:17 UTC 2022 - Alberto Planas Dominguez <aplanas@suse.com>
|
||||||
|
|
||||||
|
- Update to version 5.4
|
||||||
|
+ Added:
|
||||||
|
* tpm2_policyrestart: Added option --cphash to output the cpHash
|
||||||
|
for the command PM2_CC_PolicyRestart.
|
||||||
|
* tpm2_policynvwritten: Added option --cphash to output the cpHash
|
||||||
|
for the command TPM2_CC_PolicyNvWritten.
|
||||||
|
* tpm2_policylocality: Added option --cphash to output the cpHash
|
||||||
|
for the command TPM2_CC_PolicyLocality.
|
||||||
|
* tpm2_policycountertimer: Added option --cphash to output the
|
||||||
|
cpHash for the command TPM2_CC_PolicyCounterTimer.
|
||||||
|
* tpm2_policycommandcode: Added option --cphash to output the
|
||||||
|
cpHash for the command TPM2_CC_PolicyCommandCode.
|
||||||
|
* tpm2_policypassword: Added option --cphash to output the cpHash
|
||||||
|
for the command TPM2_CC_PolicyPassword.
|
||||||
|
* tpm2_policyauthvalue: Added option --cphash to output the cpHash
|
||||||
|
for the command TPM2_CC_PolicyAuthValue.
|
||||||
|
* tpm2_policyauthorize: Added option --cphash to output the cpHash
|
||||||
|
for the command TPM2_CC_PolicyAuthorize.
|
||||||
|
* tpm2_print: Support printing serialized ESYS_TR's
|
||||||
|
* tpm2_create: Add a clarifying message to usage of -c when
|
||||||
|
TPM2_CreateLoaded is not supported.
|
||||||
|
* tpm2_getcap: Add support for vendor agnostic
|
||||||
|
capabilites. Requires tpm2-tss version 4.0 and higher to enable.
|
||||||
|
* Add a script, check_endorsement_cert.sh, to validate the
|
||||||
|
endorsement certificate chain. It takes two inputs - A
|
||||||
|
TPM2B_PUBLIC format EKpublic and a PEM format EKcertificate
|
||||||
|
specified in that order as arguments.
|
||||||
|
|
||||||
|
- Update to version 5.3
|
||||||
|
+ Features:
|
||||||
|
* lib/tpm2_tool.c: add --help=no-man for tpm2 option. Prior to
|
||||||
|
this change the tool parsed no-man as an unrecognized option and
|
||||||
|
errored out. Now it lists all the available tool options.
|
||||||
|
* tpm2_encodeobject: New tool to encode TPM2 object. It takes
|
||||||
|
public and private portions of an object and encode them in a
|
||||||
|
combined PEM form called tssprivkey used by tpm2-tss-engine and
|
||||||
|
other applications.
|
||||||
|
* Support alternative ECC curves for which default EK templates
|
||||||
|
exist (NIST_P256, NIST_P384, NIST_P521, and SM2_P256).
|
||||||
|
* tools/misc/tpm2_checkquote: add sm2 verification of signature.
|
||||||
|
* crypto: support the TPM2_ECC_SM2_P256 curveID.
|
||||||
|
* fapi: add new command to enable the use of fapi objects for tpm2
|
||||||
|
tools. The new command tss2_gettpm2object was added. With this
|
||||||
|
command context files which can be used for tpm2 tool commands
|
||||||
|
can be created.
|
||||||
|
* Support for sign and verify with sm2 algorithms.
|
||||||
|
* tools/tpm2_startauthsession: add sym-algorithm argument for
|
||||||
|
supported symmetric algorithm.
|
||||||
|
* Attestation (certify, command audit, sessionaudit and quote):
|
||||||
|
add scheme argument for supported signature schemes. This also
|
||||||
|
enable support for SM signing.
|
||||||
|
* tpm2_flushcontext: support all options at a time. Support the
|
||||||
|
-t/-l/-s options all at once so folks don't have to call it
|
||||||
|
multiple times.
|
||||||
|
* tools/tpm2_nvread: add human readable output for NV content
|
||||||
|
Enable parsing and YAML-style output for the different NV index
|
||||||
|
types.
|
||||||
|
* New event types in tpm2_eventlog:
|
||||||
|
EV_EFI_PLATFORM_FIRMWARE_BLOB2, EV_EFI_HANDOFF_TABLES2,
|
||||||
|
EV_EFI_VARIABLE_BOOT2
|
||||||
|
* VERSION: add version file - Generate the version file with
|
||||||
|
bootstrap and include in the DIST tarball so endusers can call
|
||||||
|
autoreconf on a dist tarball which doesn't have git. This
|
||||||
|
alleviates git describe errors on release tarballs in the
|
||||||
|
autoreconf case.
|
||||||
|
* import: support restricted parents - Support a restricted parent
|
||||||
|
with an aes128cfb symmetric parameter.
|
||||||
|
* tpm2_load - Added capability to load pem files in
|
||||||
|
TSS2-Private-Key format for interoperability with
|
||||||
|
tpm2-tss-engine, tpm2-openssl provider tpm2-pkcs11, and
|
||||||
|
tpm2-pytss.
|
||||||
|
* tpm2_print - Added capability to parse out and print the public
|
||||||
|
portion of a TSS Private Key in the PEM format with the arg
|
||||||
|
option TSSPRIVKEY_OBJ.
|
||||||
|
* tpm2_loadexternal: Added support to tpm2_loadexternal for
|
||||||
|
parsing and loading the public portion of a TSS2 Privkey PEM
|
||||||
|
file. The path to the PEM file must be specified using the -r
|
||||||
|
option while skipping the -G option for key type.
|
||||||
|
* Support added for calculating cpHash, rpHash, sessions for
|
||||||
|
parameter encryption and auditing in: tpm2_nvwrite,
|
||||||
|
tpm2_nvcertify, tpm2_nvincrement, tpm2_nvwritelock,
|
||||||
|
tpm2_nvreadlock, tpm2_nvundefine and tpm2_nvreadpublic.
|
||||||
|
* Support added for calculating cpHash in: tpm2_clear,
|
||||||
|
tpm2_dictionarylockout, tpm2_clearcontrol, tpm2_sign,
|
||||||
|
tpm2_setprimarypolicy, tpm2_setclock, tpm2_rsadecrypt,
|
||||||
|
tpm2_duplicate, tpm2_clockrateadjust, tpm2_createprimary,
|
||||||
|
tpm2_quote, tpm2_policysecret, tpm2_policynv,
|
||||||
|
tpm2_policyauthorizenv, tpm2_import, tpm2_hmac,
|
||||||
|
tpm2_hierarchycontrol, tpm2_load, tpm2_gettime,
|
||||||
|
tpm2_evictcontrol, tpm2_encryptdecrypt, tpm2_getpolicydigest,
|
||||||
|
tpm2_loadexternal, tpm2_commit, tpm2_ecdhkeygen, tpm2_ecdhzgen,
|
||||||
|
tpm2_ecephemeral, tpm2_geteccparameters, tpm2_flushcontext,
|
||||||
|
tpm2_pcrallocate, tpm2_pcrevent, tpm2_pcrreset, tpm2_pcrread.
|
||||||
|
* Support for using tcti=none for cpHash calculations to avoid
|
||||||
|
invoking checks for active TPM in: tpm2_nvreadpublic,
|
||||||
|
tpm2_nvundefine, tpm2_nvreadlock, tpm2_nvwritelock,
|
||||||
|
tpm2_nvincrement, tpm2_nvcertify, tpm2_nvdefine, tpm2_nvwrite.
|
||||||
|
+ Known issue:
|
||||||
|
* FAPI tools will not work on 32bit user-static qemu on 64bit host
|
||||||
|
because readdir returns NULL. Follow the issue on
|
||||||
|
https://gitlab.com/qemu-project/qemu/-/issues/263
|
||||||
|
+ Bug fixes:
|
||||||
|
* tools/tpm2_pcrreset.c: fix build errors in 32bit systems.
|
||||||
|
* Fix tssprivkey formatted PEM generation and load errors on 32
|
||||||
|
bit systems.
|
||||||
|
* CI: Add testing of 32bit systems with multiarch/qemu-user-static
|
||||||
|
containers.
|
||||||
|
* tools/tpm2_evictcontrol: fix for calls to Esys_TR_Close on bad
|
||||||
|
handles.
|
||||||
|
* tools/tpm2_nvextend: fix for ESYS_TR handle not being used in
|
||||||
|
calculating the object name.
|
||||||
|
* tools/tpm2_nvwrite, tools/tpm2_nvread: Policy authorization must
|
||||||
|
be re-instantiated on each iteration of the read/ write when
|
||||||
|
size exceeds the allowed operating size
|
||||||
|
(TPM2_PT_NV_BUFFER_MAX). However, information on the compounded
|
||||||
|
policies cannot be retrieved from the only policy digest read
|
||||||
|
from the session and hence the session cannot be
|
||||||
|
re-instantiated. To avoid this scenario only a single iteration
|
||||||
|
is allowed when policy authorization is in use.
|
||||||
|
* Fix argument parsing in tpm2_policylocality to fix an issue
|
||||||
|
causing almost always to generate PolicyLocality(0). There was a
|
||||||
|
logical inversion that caused almost any argument (including
|
||||||
|
invalid ones) to be interpreted as zero, except “zero" would be
|
||||||
|
interpreted as one.
|
||||||
|
* test/fapi/fapi-quote-verify.sh Fix check of qualifying
|
||||||
|
data. Because of a bug in Fapi_VerifyQuote the qualifying data
|
||||||
|
was not checked correctly. Errors that were not recognized
|
||||||
|
before occur now. The order of the tests was cleaned up and for
|
||||||
|
every quote and verify quote now the correct combination of the
|
||||||
|
qualifying data and quote info containing the nonce is used.
|
||||||
|
* tpm2_nvdefine: set TPMA_NV_PLATFORMCREATE when authenticating
|
||||||
|
with the platform hierarchy.
|
||||||
|
* tools/tpm2_getekcertificate: fixed the url link to
|
||||||
|
ekop.intel.com. There were two places where the fix was needed:
|
||||||
|
o In the tool source code where a forward slash was always
|
||||||
|
appended irrespective of it already being part of the link
|
||||||
|
specified by the user and
|
||||||
|
o In the integration test where curl tests the link to the
|
||||||
|
ekop.intel.com backend. It now requires the full link to
|
||||||
|
include the base64 encoded ek pub hash.
|
||||||
|
* tools/tpm2_tool.c: Fix an issue where LOG_WARN is always
|
||||||
|
displayed Despite setting the 'quiet' flag with -Q.
|
||||||
|
* fapi: fix usage of parameter pcrLog for tss2_quote. pcrLog is an
|
||||||
|
optional parameter. If pcrLog is not used as parameter currently
|
||||||
|
the pcr log is still calculated in Fapi_Quote. To avoid this
|
||||||
|
calculation a NULL pointer will be passed to Fapi_Quote if the
|
||||||
|
parameter pcrLog is not passed. So tss2_quote can be executed
|
||||||
|
for a user which has no access rights to the files with the
|
||||||
|
system measurements.
|
||||||
|
* import: fix bug on using scheme wherein if scheme is specified
|
||||||
|
in the template, the openssl load functions clobber the scheme
|
||||||
|
value and set it to TPM2_ALG_NULL.
|
||||||
|
* tools/tpm2_sign and tpm2_verifysignature: fix sm2 sign and
|
||||||
|
verifysignature bugs : (1.) sm2 sign could not get output
|
||||||
|
signature. (2.) sm2 verify tss format signature failed.
|
||||||
|
* lib/tpm2.c: added workaround for a system api bug where in the
|
||||||
|
flush handle is erroneously placed in the handle area instead of
|
||||||
|
the parameter area.
|
||||||
|
* nvreadpublic: drop ntoh on attributes The attributes get
|
||||||
|
marshalled to correct endianess by libmu and don’t need to be
|
||||||
|
changed again.
|
||||||
|
* Removing unused '-i' option from tpm2_print
|
||||||
|
* tpm2_policyor: fix unallocated policy list The TPML_DIGEST
|
||||||
|
policy list was calloc'd for some reason, however it could just
|
||||||
|
be statically allocated in the context. The side effect is that
|
||||||
|
when no options or arguments were given a NPD occured when
|
||||||
|
checking the count of the policy list.
|
||||||
|
* tools/tpm2_certify: fix man page for short options and add tests
|
||||||
|
The short options for the signing-key-auth and
|
||||||
|
certified-key-auth were swapped. The case fix in the man page
|
||||||
|
makes it less intuitive but have to go through with the change
|
||||||
|
so that we don't break any existing scripts. This change does
|
||||||
|
not affect the long options. Tests have been added to ensure the
|
||||||
|
functionality.
|
||||||
|
+ CI:
|
||||||
|
* ci: add ubuntu-22.04. This also requires the min tpm2-tss
|
||||||
|
version to be at 3.2.0 to support the openSSL major version 3.
|
||||||
|
* cirrus.yml: update freebsd version to 13.1
|
||||||
|
* .ci/download-deps.sh: update tpm2-abrmd dependency version to
|
||||||
|
2.4.1
|
||||||
|
- Drop 0001-tests-getekcertificate.sh-Skip-the-test-if-curl-is-n.patch
|
||||||
|
(merged)
|
||||||
|
- Drop add_missing_shut_down_call_on_cleanup.patch (merged)
|
||||||
|
- Drop fix_check_of_qualifying_data.patch (merged)
|
||||||
|
- Add echo_tcti_call_python3_binary.patch (upstreamed)
|
||||||
|
|
||||||
-------------------------------------------------------------------
|
-------------------------------------------------------------------
|
||||||
Thu Jul 14 09:49:39 UTC 2022 - Alberto Planas Dominguez <aplanas@suse.com>
|
Thu Jul 14 09:49:39 UTC 2022 - Alberto Planas Dominguez <aplanas@suse.com>
|
||||||
|
|
||||||
|
|||||||
@ -17,14 +17,9 @@
|
|||||||
|
|
||||||
|
|
||||||
%define _lto_cflags %{nil}
|
%define _lto_cflags %{nil}
|
||||||
%ifarch %{ix86} x86_64 aarch64 %{arm} ppc64le
|
|
||||||
%bcond_without test
|
%bcond_without test
|
||||||
%else
|
|
||||||
# ppc ppc64 s390x
|
|
||||||
%bcond_with test
|
|
||||||
%endif
|
|
||||||
Name: tpm2.0-tools
|
Name: tpm2.0-tools
|
||||||
Version: 5.2
|
Version: 5.4
|
||||||
Release: 0
|
Release: 0
|
||||||
Summary: Trusted Platform Module (TPM) 2.0 administration tools
|
Summary: Trusted Platform Module (TPM) 2.0 administration tools
|
||||||
License: BSD-3-Clause
|
License: BSD-3-Clause
|
||||||
@ -35,12 +30,8 @@ Source1: https://github.com/tpm2-software/tpm2-tools/releases/download/%{
|
|||||||
# git show william-roberts-pub javier-martinez-pub joshua-lock-pub idesai-pub > tpm2-tools.keyring
|
# git show william-roberts-pub javier-martinez-pub joshua-lock-pub idesai-pub > tpm2-tools.keyring
|
||||||
Source2: tpm2-tools.keyring
|
Source2: tpm2-tools.keyring
|
||||||
Patch0: fix_bogus_warning.patch
|
Patch0: fix_bogus_warning.patch
|
||||||
# PATCH-FIX-UPSTREAM 0001-tests-getekcertificate.sh-Skip-the-test-if-curl-is-n.patch -- based on PR#3041
|
# PATCH-FIX-UPSTREAM add_missing_shut_down_call_on_cleanup.patch -- based on PR#3176
|
||||||
Patch1: 0001-tests-getekcertificate.sh-Skip-the-test-if-curl-is-n.patch
|
Patch1: echo_tcti_call_python3_binary.patch
|
||||||
# PATCH-FIX-UPSTREAM add_missing_shut_down_call_on_cleanup.patch -- based on PR#3047
|
|
||||||
Patch2: add_missing_shut_down_call_on_cleanup.patch
|
|
||||||
# PATCH-FIX-UPSTREAM fix_check_of_qualifying_data.patch -- already merged
|
|
||||||
Patch3: fix_check_of_qualifying_data.patch
|
|
||||||
BuildRequires: gcc-c++
|
BuildRequires: gcc-c++
|
||||||
BuildRequires: libcurl-devel
|
BuildRequires: libcurl-devel
|
||||||
BuildRequires: libopenssl-devel
|
BuildRequires: libopenssl-devel
|
||||||
@ -97,8 +88,8 @@ export PATH=$PATH:/usr/sbin:/usr/libexec/ibmtss
|
|||||||
find %{buildroot} -type f -name "*.la" -delete -print
|
find %{buildroot} -type f -name "*.la" -delete -print
|
||||||
|
|
||||||
%files
|
%files
|
||||||
%doc doc/README.md doc/CHANGELOG.md
|
%doc docs/README.md docs/CHANGELOG.md
|
||||||
%license doc/LICENSE
|
%license docs/LICENSE
|
||||||
%{_bindir}/tpm2*
|
%{_bindir}/tpm2*
|
||||||
%{_bindir}/tss2*
|
%{_bindir}/tss2*
|
||||||
%{_mandir}/man1/tpm2*
|
%{_mandir}/man1/tpm2*
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user