alexk / rpms / rpm

Forked from rpms/rpm 2 years ago
Clone
45afda
From 5e74846046e06f5a3401c4d2eb4ccfadacd4ab53 Mon Sep 17 00:00:00 2001
45afda
From: Jes Sorensen <jsorensen@fb.com>
45afda
Date: Fri, 3 Apr 2020 16:26:06 -0400
45afda
Subject: [PATCH 18/33] rpmsign: Handle --certpath for signing certificate
45afda
45afda
fsverirty needs a certificate for signing, in addition to the signing key.
45afda
45afda
Signed-off-by: Jes Sorensen <jsorensen@fb.com>
45afda
---
45afda
 rpmsign.c | 12 ++++++++++++
45afda
 1 file changed, 12 insertions(+)
45afda
45afda
diff --git a/rpmsign.c b/rpmsign.c
45afda
index 94cbf1d1a..074dd8b13 100644
45afda
--- a/rpmsign.c
45afda
+++ b/rpmsign.c
45afda
@@ -22,6 +22,9 @@ static int mode = MODE_NONE;
45afda
 static int fskpass = 0;
45afda
 static char * fileSigningKey = NULL;
45afda
 #endif
45afda
+#ifdef WITH_FSVERITY
45afda
+static char * fileSigningCert = NULL;
45afda
+#endif
45afda
 
45afda
 static struct rpmSignArgs sargs = {NULL, 0, 0};
45afda
 
45afda
@@ -44,6 +47,9 @@ static struct poptOption signOptsTable[] = {
45afda
     { "signverity", '\0', (POPT_ARG_VAL|POPT_ARGFLAG_OR),
45afda
 	&sargs.signflags, RPMSIGN_FLAG_FSVERITY,
45afda
 	N_("generate fsverity signatures for package(s) files"), NULL},
45afda
+    { "certpath", '\0', POPT_ARG_STRING, &fileSigningCert, 0,
45afda
+	N_("use file signing cert <cert>"),
45afda
+	N_("<cert>") },
45afda
 #endif
45afda
 #if defined(WITH_IMAEVM) || defined(WITH_FSVERITY)
45afda
     { "fskpath", '\0', POPT_ARG_STRING, &fileSigningKey, 0,
45afda
@@ -123,6 +129,12 @@ static int doSign(poptContext optCon, struct rpmSignArgs *sargs)
45afda
 	rpmPushMacro(NULL, "_file_signing_key", NULL, fileSigningKey, RMIL_GLOBAL);
45afda
     }
45afda
 
45afda
+#ifdef WITH_FSVERITY
45afda
+    if (fileSigningCert) {
45afda
+	rpmPushMacro(NULL, "_file_signing_cert", NULL, fileSigningCert, RMIL_GLOBAL);
45afda
+    }
45afda
+#endif
45afda
+
45afda
     if (flags_sign_files(sargs->signflags)) {
45afda
 	char *fileSigningKeyPassword = NULL;
45afda
 	char *key = rpmExpand("%{?_file_signing_key}", NULL);
45afda
-- 
45afda
2.27.0
45afda