|
 |
657fb1 |
From 2d349e915aa7a26d5d41c3dcdea597195ed26948 Mon Sep 17 00:00:00 2001
|
|
|
657fb1 |
From: Jes Sorensen <jsorensen@fb.com>
|
|
|
657fb1 |
Date: Fri, 3 Apr 2020 16:26:06 -0400
|
|
|
657fb1 |
Subject: [PATCH 19/33] rpmsign: Handle --certpath for signing certificate
|
|
|
657fb1 |
|
|
|
657fb1 |
fsverirty needs a certificate for signing, in addition to the signing key.
|
|
|
657fb1 |
|
|
|
657fb1 |
Signed-off-by: Jes Sorensen <jsorensen@fb.com>
|
|
|
657fb1 |
---
|
|
|
657fb1 |
rpmsign.c | 12 ++++++++++++
|
|
|
657fb1 |
1 file changed, 12 insertions(+)
|
|
|
657fb1 |
|
|
|
657fb1 |
diff --git a/rpmsign.c b/rpmsign.c
|
|
|
657fb1 |
index 94cbf1d1a..074dd8b13 100644
|
|
|
657fb1 |
--- a/rpmsign.c
|
|
|
657fb1 |
+++ b/rpmsign.c
|
|
|
657fb1 |
@@ -22,6 +22,9 @@ static int mode = MODE_NONE;
|
|
|
657fb1 |
static int fskpass = 0;
|
|
|
657fb1 |
static char * fileSigningKey = NULL;
|
|
|
657fb1 |
#endif
|
|
|
657fb1 |
+#ifdef WITH_FSVERITY
|
|
|
657fb1 |
+static char * fileSigningCert = NULL;
|
|
|
657fb1 |
+#endif
|
|
|
657fb1 |
|
|
|
657fb1 |
static struct rpmSignArgs sargs = {NULL, 0, 0};
|
|
|
657fb1 |
|
|
|
657fb1 |
@@ -44,6 +47,9 @@ static struct poptOption signOptsTable[] = {
|
|
|
657fb1 |
{ "signverity", '\0', (POPT_ARG_VAL|POPT_ARGFLAG_OR),
|
|
|
657fb1 |
&sargs.signflags, RPMSIGN_FLAG_FSVERITY,
|
|
|
657fb1 |
N_("generate fsverity signatures for package(s) files"), NULL},
|
|
|
657fb1 |
+ { "certpath", '\0', POPT_ARG_STRING, &fileSigningCert, 0,
|
|
|
657fb1 |
+ N_("use file signing cert <cert>"),
|
|
|
657fb1 |
+ N_("<cert>") },
|
|
|
657fb1 |
#endif
|
|
|
657fb1 |
#if defined(WITH_IMAEVM) || defined(WITH_FSVERITY)
|
|
|
657fb1 |
{ "fskpath", '\0', POPT_ARG_STRING, &fileSigningKey, 0,
|
|
|
657fb1 |
@@ -123,6 +129,12 @@ static int doSign(poptContext optCon, struct rpmSignArgs *sargs)
|
|
|
657fb1 |
rpmPushMacro(NULL, "_file_signing_key", NULL, fileSigningKey, RMIL_GLOBAL);
|
|
|
657fb1 |
}
|
|
|
657fb1 |
|
|
|
657fb1 |
+#ifdef WITH_FSVERITY
|
|
|
657fb1 |
+ if (fileSigningCert) {
|
|
|
657fb1 |
+ rpmPushMacro(NULL, "_file_signing_cert", NULL, fileSigningCert, RMIL_GLOBAL);
|
|
|
657fb1 |
+ }
|
|
|
657fb1 |
+#endif
|
|
|
657fb1 |
+
|
|
|
657fb1 |
if (flags_sign_files(sargs->signflags)) {
|
|
|
657fb1 |
char *fileSigningKeyPassword = NULL;
|
|
|
657fb1 |
char *key = rpmExpand("%{?_file_signing_key}", NULL);
|
|
|
657fb1 |
--
|
|
|
657fb1 |
2.13.5
|
|
|
657fb1 |
|