The package rpms/sigul.git has added or updated architecture specific content in its
spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s):
https://src.fedoraproject.org/cgit/rpms/sigul.git/commit/?id=c294461a09c1...
https://src.fedoraproject.org/cgit/rpms/sigul.git/commit/?id=be94d9fc1c6f....
Change:
+ExcludeArch: %{ix86}
-%ifnarch ppc64
Thanks.
Full change:
============
commit c294461a09c13200f2046c0530f834427476c361
Author: Kevin Fenzi <kevin(a)scrye.com>
Date: Tue Feb 27 17:39:22 2024 -0800
exclude i686 as no skopeo on i686
Signed-off-by: Kevin Fenzi <kevin(a)scrye.com>
diff --git a/sigul.spec b/sigul.spec
index 6a3523f..30e6ae7 100644
--- a/sigul.spec
+++ b/sigul.spec
@@ -44,6 +44,8 @@ BuildRequires: skopeo
%if 0%{?rhel}
# There is no ostree package for RHEL other than x86_64, as that's in Atomic Host
ExclusiveArch: x86_64
+%elif 0%{?fedora}
+ExcludeArch: %{ix86}
%endif
%description
commit be94d9fc1c6f40cb33c93bb14153faa398a678e4
Author: Kevin Fenzi <kevin(a)scrye.com>
Date: Tue Feb 27 17:06:54 2024 -0800
Update to v1.2
Add misc upstream patches until the next release.
Fix FTBFS ( rhbz#2226426 )
Signed-off-by: Kevin Fenzi <kevin(a)scrye.com>
diff --git a/.gitignore b/.gitignore
index e2f950b..1cc00e6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -16,3 +16,4 @@ sigul-0.97.tar.bz2
/sigul-1.0a1.tar.gz
/sigul-1.0a1.tar.bz2
/sigul-1.1.tar.bz2
+/sigul-v1.2.tar.gz
diff --git a/23f65929474dce5ff060ec929ed9aa92174f644b.patch
b/23f65929474dce5ff060ec929ed9aa92174f644b.patch
new file mode 100644
index 0000000..e078530
--- /dev/null
+++ b/23f65929474dce5ff060ec929ed9aa92174f644b.patch
@@ -0,0 +1,39 @@
+From 23f65929474dce5ff060ec929ed9aa92174f644b Mon Sep 17 00:00:00 2001
+From: Patrick Uiterwijk <patrick(a)puiterwijk.org>
+Date: Tue, 16 Jan 2024 08:57:14 +0000
+Subject: [PATCH] Always add AuthorityKeyIdentifier on certicates
+
+RFC5280 says AKI MAY be omitted on self-signed certificates,
+but seemingly the Linux kernel contains a bug that makes it
+consider a certificate without it invalid.
+As such, we just always add it.
+
+Signed-off-by: Patrick Uiterwijk <patrick(a)puiterwijk.org>
+---
+ src/server.py | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/src/server.py b/src/server.py
+index c2aabe2..f27a5d0 100644
+--- a/src/server.py
++++ b/src/server.py
+@@ -2308,7 +2308,18 @@ def cmd_sign_certificate(db, conn):
+ x509.SubjectKeyIdentifier.from_public_key(subject_pubkey),
+ critical=False,
+ )
+- if issuer_cert is not None:
++ if issuer_cert is None:
++ # Technically AKI can be omitted with a self-signed cert per RFC5280
++ # (issuer_cert is None), but seemingly the Linux kernel is buggy in
++ # that it requires it. So in order to be compatible, just add it
++ # always.
++ builder = builder.add_extension(
++ x509.AuthorityKeyIdentifier.from_issuer_public_key(
++ subject_pubkey,
++ ),
++ critical=False,
++ )
++ else:
+ issuer_ski = issuer_cert.extensions.get_extension_for_class(
+ x509.SubjectKeyIdentifier
+ )
diff --git a/2b5cc2054417a3deaea8bc2c4fa7cbcad1a27dc7.patch
b/2b5cc2054417a3deaea8bc2c4fa7cbcad1a27dc7.patch
new file mode 100644
index 0000000..091eab0
--- /dev/null
+++ b/2b5cc2054417a3deaea8bc2c4fa7cbcad1a27dc7.patch
@@ -0,0 +1,79 @@
+From 2b5cc2054417a3deaea8bc2c4fa7cbcad1a27dc7 Mon Sep 17 00:00:00 2001
+From: Patrick Uiterwijk <patrick(a)puiterwijk.org>
+Date: Tue, 10 Oct 2023 14:02:07 +0000
+Subject: [PATCH] Implemenent limited x509_name_from_rfc4514_string
+
+Add support for versions of python-cryptography that don't
+have x509.Name.from_rfc4514_string.
+Our implementation is quite limited, and doesn't implement
+some values from RFC4514, but it does the most common ones.
+
+Signed-off-by: Patrick Uiterwijk <patrick(a)puiterwijk.org>
+---
+ src/server.py | 2 +-
+ src/server_common.py | 34 ++++++++++++++++++++++++++++++++++
+ 2 files changed, 35 insertions(+), 1 deletion(-)
+
+diff --git a/src/server.py b/src/server.py
+index 4449012..9f1fdbb 100644
+--- a/src/server.py
++++ b/src/server.py
+@@ -2184,7 +2184,7 @@ def cmd_sign_certificate(db, conn):
+ required=True,
+ identifier=True,
+ )
+- subject_name = x509.Name.from_rfc4514_string(
++ subject_name = server_common.x509_name_from_rfc4514_string(
+ conn.safe_outer_field("subject", required=True)
+ )
+ serial_number = x509.random_serial_number()
+diff --git a/src/server_common.py b/src/server_common.py
+index e93b9d5..1f6ced2 100644
+--- a/src/server_common.py
++++ b/src/server_common.py
+@@ -26,7 +26,9 @@
+ import subprocess
+ import tempfile
+
++from cryptography import x509
+ import cryptography.hazmat.primitives.asymmetric.ec
++from cryptography.x509.oid import NameOID
+
+ import nss.nss
+ import sqlalchemy
+@@ -710,3 +712,35 @@ def gpg_detached_signature(config, signature_file, cleartext_file,
fingerprint,
+ ctx.armor = armor
+ ctx.textmode = False
+ ctx.sign(cleartext_file, signature_file, ourgpg.constants.SIG_MODE_DETACH)
++
++
++def x509_name_from_rfc4514_string(full_string):
++ if hasattr(x509.Name, 'from_rfc4514_string'):
++ return x509.Name.from_rfc4514_string(full_string)
++ # This is too old of a python-cryptography to have this method.
++ # Instead, we parse just a few basic things
++ # If it contains any unsupported (or unparseable) parts,
++ # we just return an error
++ attrs = []
++ if '%' in full_string:
++ raise ValueError("Unsupported RFC4514 value '%s'" % part)
++ for part in full_string.split(','):
++ key, split, value = part.partition("=")
++ if split != '=':
++ raise ValueError("Invalid RFC4514 part '%s'" % part)
++ if key == "CN":
++ oid = NameOID.COMMON_NAME
++ elif key == "L":
++ oid = NameOID.LOCALITY_NAME
++ elif key == "ST":
++ oid = NameOID.STATE_OR_PROVINCE_NAME
++ elif key == "O":
++ oid = NameOID.ORGANIZATION_NAME
++ elif key == "OU":
++ oid = NameOID.ORGANIZATIONAL_UNIT_NAME
++ elif key == "C":
++ oid = NameOID.COUNTRY_NAME
++ else:
++ raise ValueError("Unsupported RFC4514 part '%s'" % part)
++ attrs.append(x509.NameAttribute(oid, value))
++ return x509.Name(attrs)
diff --git a/ff4f3aa2cad9ce9699c44c9a78a82b09ab40e999.patch
b/ff4f3aa2cad9ce9699c44c9a78a82b09ab40e999.patch
new file mode 100644
index 0000000..bcf6fb4
--- /dev/null
+++ b/ff4f3aa2cad9ce9699c44c9a78a82b09ab40e999.patch
@@ -0,0 +1,26 @@
+From ff4f3aa2cad9ce9699c44c9a78a82b09ab40e999 Mon Sep 17 00:00:00 2001
+From: Patrick Uiterwijk <patrick(a)puiterwijk.org>
+Date: Fri, 13 Oct 2023 08:06:11 +0000
+Subject: [PATCH] Disable digital_signature for CA cert
+
+Disable the digitalSignature key usage flag on
+CA certificates.
+
+Signed-off-by: Patrick Uiterwijk <patrick(a)puiterwijk.org>
+---
+ src/server.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/server.py b/src/server.py
+index 9f1fdbb..c2aabe2 100644
+--- a/src/server.py
++++ b/src/server.py
+@@ -2242,7 +2242,7 @@ def cmd_sign_certificate(db, conn):
+ key_usage = None
+ if cert_type == 'ca':
+ key_usage = x509.KeyUsage(
+- digital_signature=True,
++ digital_signature=False,
+ key_cert_sign=True,
+ crl_sign=True,
+ content_commitment=False,
diff --git a/sigul.spec b/sigul.spec
index 8b9f663..6a3523f 100644
--- a/sigul.spec
+++ b/sigul.spec
@@ -1,15 +1,21 @@
Summary: A signing server and related software client
Name: sigul
-Version: 1.1
-Release: 9%{?dist}
+Version: 1.2
+Release: 1%{?dist}
License: GPLv2
URL:
https://pagure.io/sigul/
-Source0:
https://pagure.io/releases/sigul/sigul-%{version}.tar.bz2
+Source0:
https://pagure.io/sigul/archive/v%{version}/sigul-v%{version}.tar.gz
Source1: sigul_bridge.service
Source2: sigul_server.service
Source3: sigul.logrotate
+# Upstream patch to avoid error with older python-cryptography in epel9
+Patch0:
https://github.com/sigul-project/sigul/commit/2b5cc2054417a3deaea8bc2c4fa...
+# Upstream patch to fix the constraints on the ca certs
+Patch1:
https://github.com/sigul-project/sigul/commit/ff4f3aa2cad9ce9699c44c9a78a...
+# Always add AuthorityKeyIdentifier on certicates
+Patch2:
https://github.com/sigul-project/sigul/commit/23f65929474dce5ff060ec929ed...
BuildRequires: make
BuildRequires: nss-tools
@@ -18,6 +24,8 @@ Requires: python3
Requires: python3-nss >= 0.11
BuildRequires: python3-nss, gnupg, koji, python3-pexpect, python3-gpg, python3,
python3-fedora
BuildRequires: rpm-sign python3-urlgrabber python3-sqlalchemy git
+BuildRequires: systemd-rpm-macros autoconf automake
+BuildRequires: python3-cryptography
Requires: logrotate
Requires: koji
@@ -31,10 +39,7 @@ BuildRequires: gnupg
BuildRequires: systemd
BuildRequires: ostree
BuildRequires: ostree-devel
-%ifnarch ppc64
-# Skopeo is not built on ppc64
BuildRequires: skopeo
-%endif
%if 0%{?rhel}
# There is no ostree package for RHEL other than x86_64, as that's in Atomic Host
@@ -50,11 +55,9 @@ that connects the two.
%package server
Summary: Sigul server component
Requires: %{name}%{?_isa} = %{version}-%{release}
-%if 0%{?rhel} && 0%{?rhel} <= 5
-Requires: python-sqlite2
-%endif
Requires: gnupg
+Requires: python3-cryptography
Requires: python3-gpg
Requires: python3-pexpect
Requires: python3-sqlalchemy >= 0.5
@@ -87,16 +90,15 @@ The bridge part of sigul that facilitates connection between the
client and serv
%prep
-%setup -q
+%autosetup -p1 -n sigul-v%{version}
%build
+autoreconf -i
%configure
make %{?_smp_mflags}
%check
exit 0
-%ifnarch ppc64
-# Skopeo is not built on ppc64
%if 0%{?fedora}
if make check; then
echo "Tests passed"
@@ -107,7 +109,6 @@ exit 0
exit 1
fi
%endif
-%endif
%install
make DESTDIR=$RPM_BUILD_ROOT INSTALL='install -p' install
@@ -186,6 +187,13 @@ exit 0
%changelog
+* Tue Feb 27 2024 Kevin Fenzi <kevin(a)scrye.com> - 1.2-1
+- Update to v1.2
+- Fix ftbfs. rhbz#2226426
+- Add patch to always set AuthorityKeyIdentifier
+- Add patch for constraints on ca cert.
+- Add patch for older python-cryptography in rhel9
+
* Sat Jan 27 2024 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.1-9
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
diff --git a/sources b/sources
index 73377d9..9073f9d 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (sigul-1.1.tar.bz2) =
0a9736ebae15dab4216d7b3b56abaf8ad530783c4f8bde430ab4deeee2c06288fd0f76047bba42e3081d3e3c0ea1efca94ed4126ed1d3f5c1795680381b8f0ed
+SHA512 (sigul-v1.2.tar.gz) =
34f4ff22099776c6022be0f75b8f2ab70a19a2129c5ec754dc94b3efbe0a71939edf458a6cfabc0a56043b99e49a861159d41a23ab5940ca9daa1a124f193d7f