[rpms/fedora-repos] f45: Add IMA certs

[rpms/fedora-repos] f45: Add IMA certs

[Coiby Xu]

            A new commit has been pushed.

            Repo   : rpms/fedora-repos
            Branch : f45
            Commit : 75550b9fdae227e98652c037d84e0067cf0fa16c
            Author : Coiby Xu <coxu@redhat.com>
            Date   : 2024-05-14T11:19:22+08:00
            Stats  : +17/-11 in 6 file(s)
            URL    : https://src.fedoraproject.org/rpms/fedora-repos/c/75550b9fdae227e98652c037d84e0067cf0fa16c?branch=f45

            Log:
            Add IMA certs

Add Fedora IMA certs,
 - The code-signing keys /etc/keys/ima/* are supposed to be read by the
   dracut integrity module and other user space tools
 - The CA key /usr/share/ima/ca.der is supposed to be built into the
   kernel

Note the dracut integrity module only reads a DER cert and will error if
given other formats,
    Failed to d2i_X509_fp key file: /sysroot/etc/keys/ima/fedora-39-ima.pem
    openssl: error:068000A8:asn1 encoding routines::wrong tag
    openssl: error:0688010A:asn1 encoding routines::nested asn1 error

Signed-off-by: Coiby Xu <coxu@redhat.com>

---
diff --git a/fedora-39-ima.der b/fedora-39-ima.der
index 0d13baa..7396f87 100644
Binary files a/fedora-39-ima.der and b/fedora-39-ima.der differ

diff --git a/fedora-40-ima.der b/fedora-40-ima.der
new file mode 100644
index 0000000..ae6c111
Binary files /dev/null and b/fedora-40-ima.der differ

diff --git a/fedora-41-ima.der b/fedora-41-ima.der
new file mode 100644
index 0000000..4f8787e
Binary files /dev/null and b/fedora-41-ima.der differ

diff --git a/fedora-42-ima.der b/fedora-42-ima.der
new file mode 100644
index 0000000..11b8cd8
Binary files /dev/null and b/fedora-42-ima.der differ

diff --git a/fedora-ima-ca.der b/fedora-ima-ca.der
new file mode 100644
index 0000000..f75acb6
Binary files /dev/null and b/fedora-ima-ca.der differ

diff --git a/fedora-repos.spec b/fedora-repos.spec
index 669cb28..b02dffd 100644
--- a/fedora-repos.spec
+++ b/fedora-repos.spec
@@ -4,7 +4,7 @@
 Summary:        Fedora package repositories
 Name:           fedora-repos
 Version:        41
-Release:        0.1%{?eln:.eln%{eln}}
+Release:        0.2%{?eln:.eln%{eln}}
 License:        MIT
 URL:            https://fedoraproject.org/
 
@@ -91,13 +91,12 @@ Source150:      RPM-GPG-KEY-fedora-iot-2019
 Source151:      fedora.conf
 Source152:      fedora-compose.conf
 
-# ima certs
-Source500:      fedora-38-ima.cert
-Source501:      fedora-38-ima.der
-Source502:      fedora-38-ima.pem
-Source503:      fedora-39-ima.cert
-Source504:      fedora-39-ima.der
-Source505:      fedora-39-ima.pem
+# IMA certs: dracut integrity module only recognizes DER format
+Source500:      fedora-ima-ca.der
+Source501:      fedora-39-ima.der
+Source502:      fedora-40-ima.der
+Source503:      fedora-41-ima.der
+Source504:      fedora-42-ima.der
 
 %description
 Fedora package repository files for yum and dnf along with gpg public keys.
@@ -127,7 +126,6 @@ Requires:       filesystem >= 3.18-6
 %description -n fedora-gpg-keys
 This package provides the RPM signature keys.
 
-
 %package ostree
 Summary:        OSTree specific files
 
@@ -182,9 +180,11 @@ done
 ln -s RPM-GPG-KEY-fedora-%{version}-primary RPM-GPG-KEY-%{version}-fedora
 popd
 
-# Install the ima keys
+# Install the IMA certs
 install -d -m 755 $RPM_BUILD_ROOT/etc/keys/ima
-install -m 644 %{_sourcedir}/fedora*ima.* $RPM_BUILD_ROOT/etc/keys/ima/
+install -m 644 %{_sourcedir}/fedora*ima.der $RPM_BUILD_ROOT/etc/keys/ima/
+install -d -m 755 $RPM_BUILD_ROOT/usr/share/ima/
+install -m 644 %{_sourcedir}/fedora-ima-ca.der $RPM_BUILD_ROOT/usr/share/ima/ca.der
 
 # Install repo files
 install -d -m 755 $RPM_BUILD_ROOT/etc/yum.repos.d
@@ -385,7 +385,10 @@ rm -f "$TMPRING"
 %files -n fedora-gpg-keys
 %dir /etc/pki/rpm-gpg
 /etc/pki/rpm-gpg/RPM-GPG-KEY-*
+
+# ima-certs
 /etc/keys/ima/fedora*ima*
+/usr/share/ima/ca.der
 
 
 %files ostree
@@ -398,6 +401,9 @@ rm -f "$TMPRING"
 
 
 %changelog
+* Wed May 08 2024 Coiby Xu <coxu@redhat.com> - 41-0.2
+- add/update IMA certs
+
 * Tue Feb 13 2024 Samyak Jain <samyak.jn11@gmail.com> - 41-0.1
 - Setup for rawhide being F41