MSVSphere Packaging Team
2 months ago
parent
91266b648e
commit
d3faa10e6e
GPG Key ID:
B2B0B9F29E528FE8
@ -0,0 +1,96 @@
|
||||
From c0a9076035513521fea11ee1f99eae6b80e49e6d Mon Sep 17 00:00:00 2001
|
||||
From: Adrian Freihofer <adrian.freihofer@gmail.com>
|
||||
Date: Fri, 9 Aug 2024 15:58:01 +0200
|
||||
Subject: [PATCH 1/2] tests: rsa_pki default to sha256
|
||||
|
||||
Some distributions (Fedora 41) are starting to block sha1 hashes. This
|
||||
prevents this test case. Let's use sha256, which is more future-proof
|
||||
and should currently be supported by all distributions.
|
||||
|
||||
Removing the following 2 lines from
|
||||
/etc/crypto-policies/back-ends/opensslcnf.config
|
||||
[evp_properties]
|
||||
rh-allow-sha1-signatures = no
|
||||
allows to run the tests successfully also with sha1.
|
||||
|
||||
Signed-off-by: Adrian Freihofer <adrian.freihofer@gmail.com>
|
||||
---
|
||||
test/rsa_pki/etc/email.conf | 2 +-
|
||||
test/rsa_pki/etc/root-ca.conf | 4 ++--
|
||||
test/rsa_pki/etc/server.conf | 2 +-
|
||||
test/rsa_pki/etc/signing-ca.conf | 4 ++--
|
||||
4 files changed, 6 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/test/rsa_pki/etc/email.conf b/test/rsa_pki/etc/email.conf
|
||||
index 8d59829..7606c38 100644
|
||||
--- a/test/rsa_pki/etc/email.conf
|
||||
+++ b/test/rsa_pki/etc/email.conf
|
||||
@@ -6,7 +6,7 @@
|
||||
[ req ]
|
||||
default_bits = 2048 # RSA key size
|
||||
encrypt_key = no
|
||||
-default_md = sha1 # MD to use
|
||||
+default_md = sha256 # MD to use
|
||||
utf8 = yes # Input is UTF-8
|
||||
string_mask = utf8only # Emit UTF-8 strings
|
||||
prompt = no # Don't prompt for DN
|
||||
diff --git a/test/rsa_pki/etc/root-ca.conf b/test/rsa_pki/etc/root-ca.conf
|
||||
index 69d284e..2f72eb4 100644
|
||||
--- a/test/rsa_pki/etc/root-ca.conf
|
||||
+++ b/test/rsa_pki/etc/root-ca.conf
|
||||
@@ -15,7 +15,7 @@ dir = testdb # Top dir
|
||||
[ req ]
|
||||
default_bits = 2048 # RSA key size
|
||||
encrypt_key = no
|
||||
-default_md = sha1 # MD to use
|
||||
+default_md = sha256 # MD to use
|
||||
utf8 = yes # Input is UTF-8
|
||||
string_mask = utf8only # Emit UTF-8 strings
|
||||
prompt = no # Don't prompt for DN
|
||||
@@ -50,7 +50,7 @@ crlnumber = $dir/ca/$ca/db/$ca.crl.srl # CRL number file
|
||||
database = $dir/ca/$ca/db/$ca.db # Index file
|
||||
unique_subject = no # Require unique subject
|
||||
default_days = 3652 # How long to certify for
|
||||
-default_md = sha1 # MD to use
|
||||
+default_md = sha256 # MD to use
|
||||
policy = match_pol # Default naming policy
|
||||
email_in_dn = no # Add email to cert DN
|
||||
preserve = no # Keep passed DN ordering
|
||||
diff --git a/test/rsa_pki/etc/server.conf b/test/rsa_pki/etc/server.conf
|
||||
index 8f7b620..737fe55 100644
|
||||
--- a/test/rsa_pki/etc/server.conf
|
||||
+++ b/test/rsa_pki/etc/server.conf
|
||||
@@ -9,7 +9,7 @@ SAN = DNS:yourdomain.tld # Default value
|
||||
[ req ]
|
||||
default_bits = 2048 # RSA key size
|
||||
encrypt_key = no
|
||||
-default_md = sha1 # MD to use
|
||||
+default_md = sha256 # MD to use
|
||||
utf8 = yes # Input is UTF-8
|
||||
string_mask = utf8only # Emit UTF-8 strings
|
||||
prompt = no # Don't prompt for DN
|
||||
diff --git a/test/rsa_pki/etc/signing-ca.conf b/test/rsa_pki/etc/signing-ca.conf
|
||||
index 912d7c3..3f9795d 100644
|
||||
--- a/test/rsa_pki/etc/signing-ca.conf
|
||||
+++ b/test/rsa_pki/etc/signing-ca.conf
|
||||
@@ -15,7 +15,7 @@ dir = testdb # Top dir
|
||||
[ req ]
|
||||
default_bits = 2048 # RSA key size
|
||||
encrypt_key = no
|
||||
-default_md = sha1 # MD to use
|
||||
+default_md = sha256 # MD to use
|
||||
utf8 = yes # Input is UTF-8
|
||||
string_mask = utf8only # Emit UTF-8 strings
|
||||
prompt = no # Don't prompt for DN
|
||||
@@ -50,7 +50,7 @@ crlnumber = $dir/ca/$ca/db/$ca.crl.srl # CRL number file
|
||||
database = $dir/ca/$ca/db/$ca.db # Index file
|
||||
unique_subject = no # Require unique subject
|
||||
default_days = 730 # How long to certify for
|
||||
-default_md = sha1 # MD to use
|
||||
+default_md = sha256 # MD to use
|
||||
policy = match_pol # Default naming policy
|
||||
email_in_dn = no # Add email to cert DN
|
||||
preserve = no # Keep passed DN ordering
|
||||
--
|
||||
2.47.0
|
||||
|
||||
@ -1,30 +0,0 @@
|
||||
From d46a3ae2d3f06852388eb8439a9c06d97a8d3ca2 Mon Sep 17 00:00:00 2001
|
||||
From: Adrian Freihofer <adrian.freihofer@gmail.com>
|
||||
Date: Wed, 27 Mar 2024 08:27:37 +0100
|
||||
Subject: [PATCH] tests: workaround for tpm2-tools bug
|
||||
|
||||
The test fails because of a bug in the tpm2-tools:
|
||||
https://github.com/tpm2-software/tpm2-tools/pull/3374
|
||||
---
|
||||
test/ec_createak_x509_index.sh | 5 +++++
|
||||
1 file changed, 5 insertions(+)
|
||||
|
||||
diff --git a/test/ec_createak_x509_index.sh b/test/ec_createak_x509_index.sh
|
||||
index 4323475..7476c23 100755
|
||||
--- a/test/ec_createak_x509_index.sh
|
||||
+++ b/test/ec_createak_x509_index.sh
|
||||
@@ -2,6 +2,11 @@
|
||||
# SPDX-License-Identifier: BSD-3-Clause
|
||||
set -eufx
|
||||
|
||||
+# Temporary workaround for https://github.com/tpm2-software/tpm2-tools/pull/3374
|
||||
+if uname -m | grep s390; then
|
||||
+ exit 77
|
||||
+fi
|
||||
+
|
||||
# create EK
|
||||
tpm2_createek -G ecc -c ek_rsa.ctx
|
||||
|
||||
--
|
||||
2.44.0
|
||||
|
||||
@ -0,0 +1,56 @@
|
||||
From 1839c987c86752602b51981963132234ac7554a2 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Gotthard <petr.gotthard@advantech.cz>
|
||||
Date: Sun, 6 Oct 2024 22:11:15 +0200
|
||||
Subject: [PATCH 2/2] tests: do not test sha1 by default
|
||||
|
||||
Note: Chagnes on files which are not in the release tar are skipped on
|
||||
purpose since the patch is applied against the release tar by the spec
|
||||
file.
|
||||
---
|
||||
test/ecdsa_genpkey_sign_rawin.sh | 2 +-
|
||||
test/rsa_genpkey_sign_rawin.sh | 2 +-
|
||||
test/rsapss_genpkey_sign_rawin.sh | 2 +-
|
||||
3 files changed, 3 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/test/ecdsa_genpkey_sign_rawin.sh b/test/ecdsa_genpkey_sign_rawin.sh
|
||||
index 01403cf..7266049 100755
|
||||
--- a/test/ecdsa_genpkey_sign_rawin.sh
|
||||
+++ b/test/ecdsa_genpkey_sign_rawin.sh
|
||||
@@ -11,7 +11,7 @@ openssl genpkey -provider tpm2 -algorithm EC -pkeyopt group:P-256 -out testkey.p
|
||||
openssl pkey -provider tpm2 -provider base -in testkey.priv -pubout -out testkey.pub
|
||||
|
||||
# check various digests
|
||||
-for HASH in sha1 sha256 sha384 sha512; do
|
||||
+for HASH in ${TPM2_TEST_HASHES:-sha256 sha384 sha512}; do
|
||||
# skip unsupported algorithms
|
||||
tpm2_getcap algorithms | grep $HASH || continue
|
||||
|
||||
diff --git a/test/rsa_genpkey_sign_rawin.sh b/test/rsa_genpkey_sign_rawin.sh
|
||||
index 267cea9..f2b9a94 100755
|
||||
--- a/test/rsa_genpkey_sign_rawin.sh
|
||||
+++ b/test/rsa_genpkey_sign_rawin.sh
|
||||
@@ -11,7 +11,7 @@ openssl genpkey -provider tpm2 -algorithm RSA -pkeyopt bits:1024 -out testkey.pr
|
||||
openssl pkey -provider tpm2 -provider base -in testkey.priv -pubout -out testkey.pub
|
||||
|
||||
# check default scheme with various digests
|
||||
-for HASH in sha1 sha256 sha384 sha512; do
|
||||
+for HASH in ${TPM2_TEST_HASHES:-sha256 sha384 sha512}; do
|
||||
# skip unsupported algorithms
|
||||
tpm2_getcap algorithms | grep $HASH || continue
|
||||
|
||||
diff --git a/test/rsapss_genpkey_sign_rawin.sh b/test/rsapss_genpkey_sign_rawin.sh
|
||||
index 28447b2..99f8d63 100755
|
||||
--- a/test/rsapss_genpkey_sign_rawin.sh
|
||||
+++ b/test/rsapss_genpkey_sign_rawin.sh
|
||||
@@ -5,7 +5,7 @@ set -eufx
|
||||
echo -n "abcde12345abcde12345" > testdata
|
||||
|
||||
# check default scheme with various digests
|
||||
-for HASH in sha1 sha256 sha384 sha512; do
|
||||
+for HASH in ${TPM2_TEST_HASHES:-sha256 sha384 sha512}; do
|
||||
# skip unsupported algorithms
|
||||
tpm2_getcap algorithms | grep $HASH || continue
|
||||
|
||||
--
|
||||
2.47.0
|
||||
|
||||
Loading…
Reference in new issue