Nirik is seeing a failure that looks like: [root@bkernel01 ~][PROD]# journalctl -b -l -u pesign | cat -- Logs begin at Tue 2017-08-08 18:10:41 UTC, end at Tue 2017-08-08 18:27:17 UTC. -- Aug 08 18:22:25 bkernel01.phx2.fedoraproject.org systemd[1]: Starting Pesign signing daemon... Aug 08 18:22:25 bkernel01.phx2.fedoraproject.org pesign[11226]: pesignd starting (pid 11227) Aug 08 18:22:25 bkernel01.phx2.fedoraproject.org pesignd[11227]: pesignd starting (pid 11227) Aug 08 18:22:25 bkernel01.phx2.fedoraproject.org pesign[11226]: Could not initialize nss: The certificate/key database is in an old, unsupported format. Aug 08 18:22:27 bkernel01.phx2.fedoraproject.org systemd[1]: pesign.service: PID 11227 read from file /var/run/pesign.pid does not exist or is a zombie. Aug 08 18:22:27 bkernel01.phx2.fedoraproject.org systemd[1]: Failed to start Pesign signing daemon. Aug 08 18:22:27 bkernel01.phx2.fedoraproject.org systemd[1]: pesign.service: Unit entered failed state. Aug 08 18:22:27 bkernel01.phx2.fedoraproject.org systemd[1]: pesign.service: Failed with result 'protocol'. Signed-off-by: Peter Jones <pjones@redhat.com>
48 lines
1.4 KiB
Diff
48 lines
1.4 KiB
Diff
From e0238e2363f9668aee07b2e44a8f358e694551c0 Mon Sep 17 00:00:00 2001
|
|
From: Peter Jones <pjones@redhat.com>
|
|
Date: Mon, 24 Apr 2017 15:18:10 -0400
|
|
Subject: [PATCH 09/24] pesigcheck: make --certfile actually work
|
|
|
|
Signed-off-by: Peter Jones <pjones@redhat.com>
|
|
---
|
|
src/pesigcheck.c | 9 +++++++--
|
|
1 file changed, 7 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/src/pesigcheck.c b/src/pesigcheck.c
|
|
index 0d49c1a..d7be542 100644
|
|
--- a/src/pesigcheck.c
|
|
+++ b/src/pesigcheck.c
|
|
@@ -130,7 +130,7 @@ check_signature(pesigcheck_context *ctx)
|
|
cert_iter iter;
|
|
|
|
generate_digest(ctx->cms_ctx, ctx->inpe, 1);
|
|
-
|
|
+
|
|
if (check_db_hash(DBX, ctx) == FOUND)
|
|
return -1;
|
|
|
|
@@ -225,6 +225,11 @@ main(int argc, char *argv[])
|
|
.argInfo = POPT_ARG_CALLBACK|POPT_CBFLAG_POST,
|
|
.arg = (void *)callback,
|
|
.descrip = (void *)ctxp },
|
|
+ {.longName = "certfile",
|
|
+ .shortName = 'c',
|
|
+ .argInfo = POPT_ARG_CALLBACK|POPT_CBFLAG_POST,
|
|
+ .arg = (void *)callback,
|
|
+ .descrip = (void *)ctxp },
|
|
{.longName = "in",
|
|
.shortName = 'i',
|
|
.argInfo = POPT_ARG_STRING,
|
|
@@ -258,7 +263,7 @@ main(int argc, char *argv[])
|
|
.shortName = 'c',
|
|
.argInfo = POPT_ARG_STRING,
|
|
.arg = &certfile,
|
|
- .descrip = "the certificate (in DER form) for verification ",
|
|
+ .descrip = "import certfile (in DER encoding) for allowed certificate",
|
|
.argDescrip = "<certfile>" },
|
|
POPT_AUTOALIAS
|
|
POPT_AUTOHELP
|
|
--
|
|
2.13.4
|
|
|