richardphibel / rpms / rpm

Forked from rpms/rpm 2 years ago
Clone
45e748
From 4d243b7e692e3803a764343dfed23feb1c656f0b Mon Sep 17 00:00:00 2001
45e748
From: Jes Sorensen <jsorensen@fb.com>
45e748
Date: Tue, 12 May 2020 13:42:34 -0400
45e748
Subject: [PATCH 31/33] Update man page for rpmsign
45e748
45e748
This documents the new arguments --signverity and --certpath required
45e748
to sign a package with fsverity signatures.
45e748
45e748
Signed-off-by: Jes Sorensen <jsorensen@fb.com>
45e748
---
45e748
 doc/rpmsign.8 | 20 ++++++++++++++++++++
45e748
 1 file changed, 20 insertions(+)
45e748
45e748
diff --git a/doc/rpmsign.8 b/doc/rpmsign.8
45e748
index f7ceae89b..a212746fe 100644
45e748
--- a/doc/rpmsign.8
45e748
+++ b/doc/rpmsign.8
45e748
@@ -9,6 +9,8 @@ rpmsign \- RPM Package Signing
45e748
 
45e748
 \fBrpm\fR \fB--delsign\fR \fB\fIPACKAGE_FILE\fB\fR\fI ...\fR
45e748
 
45e748
+\fBrpm\fR \fB--delfilesign\fR \fB\fIPACKAGE_FILE\fB\fR\fI ...\fR
45e748
+
45e748
 .SS "rpmsign-options"
45e748
 .PP
45e748
 [\fb--rpmv3\fR]
45e748
@@ -30,6 +32,12 @@ packages with a MD5/SHA1 checksums cannot be signed in FIPS mode.
45e748
 .PP
45e748
 Delete all signatures from each package \fIPACKAGE_FILE\fR given.
45e748
 
45e748
+\fBrpm\fR \fB--delfilesign\fR \fB\fIPACKAGE_FILE\fB\fR\fI ...\fR
45e748
+
45e748
+.PP
45e748
+Delete all IMA and fsverity file signatures from each package
45e748
+\fIPACKAGE_FILE\fR given.
45e748
+
45e748
 .SS "SIGN OPTIONS"
45e748
 .PP
45e748
 .TP
45e748
@@ -44,12 +52,23 @@ signature verifiable with rpm < 4.14 or other interoperability reasons.
45e748
 \fB--fskpath \fIKEY\fB\fR
45e748
 Used with \fB--signfiles\fR, use file signing key \fIKey\fR.
45e748
 .TP
45e748
+\fB--certpath \fICERT\fB\fR
45e748
+Used with \fB--signverity\fR, use file signing certificate \fICert\fR.
45e748
+.TP
45e748
 \fB--signfiles\fR
45e748
 Sign package files. The macro \fB%_binary_filedigest_algorithm\fR must
45e748
 be set to a supported algorithm before building the package. The
45e748
 supported algorithms are SHA1, SHA256, SHA384, and SHA512, which are
45e748
 represented as 2, 8, 9, and 10 respectively.  The file signing key (RSA
45e748
 private key) must be set before signing the package, it can be configured on the command line with \fB--fskpath\fR or the macro %_file_signing_key.
45e748
+.TP
45e748
+\fB--signverity\fR
45e748
+Sign package files with fsverity signatures. The file signing key (RSA
45e748
+private key) and the signing certificate must be set before signing
45e748
+the package. The key can be configured on the command line with
45e748
+\fB--fskpath\fR or the macro %_file_signing_key, and the cert can be
45e748
+configured on the command line with \fB--certpath\fR or the macro
45e748
+%_file_signing_cert.
45e748
 
45e748
 .SS "USING GPG TO SIGN PACKAGES"
45e748
 .PP
45e748
@@ -110,4 +129,5 @@ Jeff Johnson <jbj@redhat.com>
45e748
 Erik Troan <ewt@redhat.com>
45e748
 Panu Matilainen <pmatilai@redhat.com>
45e748
 Fionnuala Gunter <fin@linux.vnet.ibm.com>
45e748
+Jes Sorensen <jsorensen@fb.com>
45e748
 .fi
45e748
-- 
45e748
2.27.0
45e748