From 5e74846046e06f5a3401c4d2eb4ccfadacd4ab53 Mon Sep 17 00:00:00 2001 From: Jes Sorensen Date: Fri, 3 Apr 2020 16:26:06 -0400 Subject: [PATCH 18/33] rpmsign: Handle --certpath for signing certificate fsverirty needs a certificate for signing, in addition to the signing key. Signed-off-by: Jes Sorensen --- rpmsign.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/rpmsign.c b/rpmsign.c index 94cbf1d1a..074dd8b13 100644 --- a/rpmsign.c +++ b/rpmsign.c @@ -22,6 +22,9 @@ static int mode = MODE_NONE; static int fskpass = 0; static char * fileSigningKey = NULL; #endif +#ifdef WITH_FSVERITY +static char * fileSigningCert = NULL; +#endif static struct rpmSignArgs sargs = {NULL, 0, 0}; @@ -44,6 +47,9 @@ static struct poptOption signOptsTable[] = { { "signverity", '\0', (POPT_ARG_VAL|POPT_ARGFLAG_OR), &sargs.signflags, RPMSIGN_FLAG_FSVERITY, N_("generate fsverity signatures for package(s) files"), NULL}, + { "certpath", '\0', POPT_ARG_STRING, &fileSigningCert, 0, + N_("use file signing cert "), + N_("") }, #endif #if defined(WITH_IMAEVM) || defined(WITH_FSVERITY) { "fskpath", '\0', POPT_ARG_STRING, &fileSigningKey, 0, @@ -123,6 +129,12 @@ static int doSign(poptContext optCon, struct rpmSignArgs *sargs) rpmPushMacro(NULL, "_file_signing_key", NULL, fileSigningKey, RMIL_GLOBAL); } +#ifdef WITH_FSVERITY + if (fileSigningCert) { + rpmPushMacro(NULL, "_file_signing_cert", NULL, fileSigningCert, RMIL_GLOBAL); + } +#endif + if (flags_sign_files(sargs->signflags)) { char *fileSigningKeyPassword = NULL; char *key = rpmExpand("%{?_file_signing_key}", NULL); -- 2.27.0