diff --git a/0008-Move-most-of-macros.pesign-to-pesign-rpmbuild-helper.patch b/0008-Move-most-of-macros.pesign-to-pesign-rpmbuild-helper.patch index 4b782ed..d216883 100644 --- a/0008-Move-most-of-macros.pesign-to-pesign-rpmbuild-helper.patch +++ b/0008-Move-most-of-macros.pesign-to-pesign-rpmbuild-helper.patch @@ -1,4 +1,4 @@ -From 25981d57c4d56c53128d561bbe29593a6a20b259 Mon Sep 17 00:00:00 2001 +From 6cab63b9b01533f82067ac15b9cc426937c8e48b Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Mon, 6 Jul 2020 13:54:35 -0400 Subject: [PATCH 08/11] Move most of macros.pesign to pesign-rpmbuild-helper @@ -7,13 +7,13 @@ Signed-off-by: Peter Jones --- Make.defaults | 1 + src/Makefile | 8 +- - src/macros.pesign | 73 ++++-------- - src/pesign-rpmbuild-helper.in | 216 ++++++++++++++++++++++++++++++++++ - 4 files changed, 245 insertions(+), 53 deletions(-) + src/macros.pesign | 74 ++++-------- + src/pesign-rpmbuild-helper.in | 222 ++++++++++++++++++++++++++++++++++ + 4 files changed, 252 insertions(+), 53 deletions(-) create mode 100644 src/pesign-rpmbuild-helper.in diff --git a/Make.defaults b/Make.defaults -index 0bacafe0d01..302da50efb5 100644 +index 0bacafe0d01..d4cd626c11e 100644 --- a/Make.defaults +++ b/Make.defaults @@ -16,6 +16,7 @@ INSTALLROOT = $(DESTDIR) @@ -58,7 +58,7 @@ index 74327ba13f3..a7ca89159c6 100644 $(INSTALL) -m 600 pesign-users $(INSTALLROOT)/etc/pesign/users $(INSTALL) -m 600 pesign-groups $(INSTALLROOT)/etc/pesign/groups diff --git a/src/macros.pesign b/src/macros.pesign -index 5a6da1c6809..730d3bc449c 100644 +index 5a6da1c6809..2e984b4eeb3 100644 --- a/src/macros.pesign +++ b/src/macros.pesign @@ -6,7 +6,7 @@ @@ -70,7 +70,7 @@ index 5a6da1c6809..730d3bc449c 100644 %__pesign_cert %{!?pe_signing_cert:"Red Hat Test Certificate"}%{?pe_signing_cert:"%{pe_signing_cert}"} %__pesign_client_token %{!?pe_signing_token:"OpenSC Card (Fedora Signer)"}%{?pe_signing_token:"%{pe_signing_token}"} -@@ -24,54 +24,23 @@ +@@ -24,54 +24,24 @@ # -a # rhel only # -s # perform signing %pesign(i:o:C:e:c:n:a:s) \ @@ -133,7 +133,8 @@ index 5a6da1c6809..730d3bc449c 100644 + %{?__pesign_client_cert:--client-cert %{__pesign_client_cert}} \\\ + %{?__pesign_token:%{__pesign_token}} \\\ + %{?__pesign_cert:--cert %{__pesign_cert}} \\\ -+ %{?vendor:--vendor %{vendor}} \\\ ++ %{?_buildhost:--hostname "%{_buildhost}"} \\\ ++ %{?vendor:--vendor "%{vendor}"} \\\ + %{?_rhel:--rhelver "%{_rhel}"} \\\ + %{?-n:--rhelcert "%{-n*}"}%{?!-n:--rhelcert "%{__pesign_cert}"} \\\ + %{?-a:--rhelcafile "%{-a*}"} \\\ @@ -147,10 +148,10 @@ index 5a6da1c6809..730d3bc449c 100644 +%{nil} diff --git a/src/pesign-rpmbuild-helper.in b/src/pesign-rpmbuild-helper.in new file mode 100644 -index 00000000000..cb53550121f +index 00000000000..c5287c27e0c --- /dev/null +++ b/src/pesign-rpmbuild-helper.in -@@ -0,0 +1,219 @@ +@@ -0,0 +1,222 @@ +#!/bin/bash +# shellcheck shell=bash + @@ -220,6 +221,7 @@ index 00000000000..cb53550121f + local sign="" || : + local arch="" || : + local vendor="" || : ++ local HOSTNAME="" || : + + while [[ $# -ge 2 ]] ; do + case " ${1} " in @@ -229,6 +231,9 @@ index 00000000000..cb53550121f + " --rhelcertfile ") + rhelcertfile="${2}" + ;; ++ " --hostname ") ++ HOSTNAME="${2}" ++ ;; + " --certout ") + certout[0]=-C + certout[1]="${2}" @@ -314,13 +319,12 @@ index 00000000000..cb53550121f + fi + + USERNAME="${USERNAME:-$(id -un)}" -+ HOSTNAME="${HOSTNAME:-$(hostname)}" + + local socket="" || : + if grep -q ID=fedora /etc/os-release \ + && [[ "${rhelver}" -lt 7 ]] \ + && [[ "${USERNAME}" = "mockbuild" ]] \ -+ && [[ "${vendor}" == "Fedora Project" ]] \ ++ && [[ "${vendor}" = "Fedora Project" ]] \ + && [[ "${HOSTNAME}" =~ bkernel.* ]] + then + if [[ -S /run/pesign/socket ]] ; then diff --git a/0009-pesign-authorize-shellcheck.patch b/0009-pesign-authorize-shellcheck.patch index 8a8f7c9..119b45a 100644 --- a/0009-pesign-authorize-shellcheck.patch +++ b/0009-pesign-authorize-shellcheck.patch @@ -1,4 +1,4 @@ -From 91d45fea14dfce71f79534b0df276cf8175c0565 Mon Sep 17 00:00:00 2001 +From a2c286c5b420b0f398221fb777eab5932c728f02 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Tue, 14 Jul 2020 15:07:32 -0400 Subject: [PATCH 09/11] pesign-authorize: shellcheck diff --git a/0010-pesign-authorize-don-t-setfacl-etc-pki-pesign-foo.patch b/0010-pesign-authorize-don-t-setfacl-etc-pki-pesign-foo.patch index 153f69e..49286fd 100644 --- a/0010-pesign-authorize-don-t-setfacl-etc-pki-pesign-foo.patch +++ b/0010-pesign-authorize-don-t-setfacl-etc-pki-pesign-foo.patch @@ -1,4 +1,4 @@ -From 34efa71e9837bcf2e4c52234bc472e554c24c567 Mon Sep 17 00:00:00 2001 +From 14d8f7c1952f4f707b94e52a2985fe26c7426374 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Tue, 14 Jul 2020 15:08:15 -0400 Subject: [PATCH 10/11] pesign-authorize: don't setfacl /etc/pki/pesign-foo/ diff --git a/0011-kernel-building-hack.patch b/0011-kernel-building-hack.patch index 49f0486..f001c0a 100644 --- a/0011-kernel-building-hack.patch +++ b/0011-kernel-building-hack.patch @@ -1,18 +1,18 @@ -From 43d1c74b391485178da1d38722da0f28ece8b336 Mon Sep 17 00:00:00 2001 +From e1bcbd2040dbf9633771bf4330f7e046e77a2d20 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Tue, 14 Jul 2020 16:42:39 -0400 Subject: [PATCH 11/11] kernel building hack Signed-off-by: Peter Jones --- - src/pesign-rpmbuild-helper.in | 16 ++++++++++++++++ - 1 file changed, 16 insertions(+) + src/pesign-rpmbuild-helper.in | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) diff --git a/src/pesign-rpmbuild-helper.in b/src/pesign-rpmbuild-helper.in -index d9236035928..2666c74a9ba 100644 +index c5287c27e0c..1fd0c2fc117 100644 --- a/src/pesign-rpmbuild-helper.in +++ b/src/pesign-rpmbuild-helper.in -@@ -195,6 +195,23 @@ main() { +@@ -202,6 +202,23 @@ main() { "${input[@]}" "${output[@]}" rm -rf "${sattrs}" "${sattrs}.sig" "${nssdir}" elif [[ -n "${socket}" ]] ; then diff --git a/pesign.spec b/pesign.spec index 804e97e..d2f310c 100644 --- a/pesign.spec +++ b/pesign.spec @@ -26,7 +26,6 @@ BuildRequires: python3 %if 0%{?rhel} >= 7 || 0%{?fedora} >= 17 BuildRequires: systemd-rpm-macros %endif -Requires: hostname Requires: nspr Requires: nss Requires: nss-tools >= 3.53