[rpms/systemtap] f43: Fix bz2515431

[Martin Cermak <mcermak@redhat.com>]

A new commit has been pushed.

Repo   : rpms/systemtap
Branch : f43
Commit : 0c0165b44c22ca58c048793e5e2205d1285a2dec
Author : Martin Cermak <mcermak@redhat.com>
Date   : 2026-08-13T19:13:09+02:00
Stats  : +60/-1 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/systemtap/c/0c0165b44c22ca58c048793e5e2205d1285a2dec?branch=f43

Log:
Fix bz2515431

---
diff --git a/41b6fa819.patch b/41b6fa819.patch
new file mode 100644
index 0000000..6ccf072
--- /dev/null
+++ b/41b6fa819.patch
@@ -0,0 +1,52 @@
+commit 41b6fa81922e2c7ba6a19f769167160b98e42bd1
+Author: Martin Cermak <mcermak@redhat.com>
+Date:   Mon Jun 1 17:40:32 2026 +0200
+
+    Use SHA1 for MOK directory naming and matching
+    
+    Commit a4bd43278 (April 2026) changed SystemTap to use SHA256 instead of
+    SHA1 for certificate fingerprinting, including MOK (Machine Owner Key)
+    directory naming and matching.  Mokutil (the system tool for managing
+    UEFI MOKs) is hardcoded to use SHA1 fingerprints.  That commit rendered
+    SystemTap incompatible with mokutil.
+    
+    Revert only the MOK fingerprint calculation back to SHA1 in
+    read_cert_info_from_file() while keeping SHA256 for the actual module
+    signing operation. This makes SystemTap's MOK directory names match what
+    mokutil displays.
+    
+    Assisted-by: Anthropic Claude
+
+diff --git a/nsscommon.cxx b/nsscommon.cxx
+index 5ab59ed8e..db88f6b8f 100644
+--- a/nsscommon.cxx
++++ b/nsscommon.cxx
+@@ -1962,12 +1962,16 @@ read_cert_info_from_file (const string &certPath, string &fingerprint)
+     }
+ 
+   // Get the fingerprint from the signature.
+-  unsigned char fingerprint_buf[32]; // SHA256_LENGTH
++  // Use SHA1 for MOK fingerprints to match mokutil behavior
++  // MOKutil always uses SHA1 fingerprints regardless of certificate signature algorithm
++  unsigned char fingerprint_buf[SHA1_LENGTH];
+   SECItem fpItem;
+-  rv = PK11_HashBuf(SEC_OID_SHA256, fingerprint_buf, derCert.data, derCert.len);
++  rv = PK11_HashBuf(SEC_OID_SHA1, fingerprint_buf, derCert.data, derCert.len);
+   if (rv)
+     {
+-      nsscommon_error (_F("Could not decode SHA256 fingerprint from file %s",
++      // Note: We use SHA1 for MOK fingerprints because mokutil (the UEFI MOK
++      // enrollment tool) always displays SHA1 fingerprints, not SHA256.
++      nsscommon_error (_F("Could not decode SHA1 fingerprint from file %s",
+ 			  certPath.c_str ()));
+       goto done;
+     }
+@@ -1976,7 +1980,7 @@ read_cert_info_from_file (const string &certPath, string &fingerprint)
+   str = CERT_Hexify(&fpItem, 1);
+   if (! str)
+   {
+-      nsscommon_error (_F("Could not hexify SHA256 fingerprint from file %s",
++      nsscommon_error (_F("Could not hexify SHA1 fingerprint from file %s",
+ 			  certPath.c_str ()));
+       goto done;
+   }

diff --git a/systemtap.spec b/systemtap.spec
index 26cb4a6..1a1b876 100644
--- a/systemtap.spec
+++ b/systemtap.spec
@@ -131,7 +131,7 @@ f /var/log/stap-server/log 0644 stap-server stap-server -
 Name: systemtap
 # PRERELEASE
 Version: 5.5
-Release: 1%{?release_override}%{?dist}
+Release: 2%{?release_override}%{?dist}
 # for version, see also configure.ac
 
 
@@ -169,6 +169,8 @@ License: GPL-2.0-or-later
 URL: https://sourceware.org/systemtap/
 Source: ftp://sourceware.org/pub/systemtap/releases/systemtap-%{version}.tar.gz
 
+Patch0: 41b6fa819.patch
+
 # Build*
 BuildRequires: make
 BuildRequires: gcc-c++
@@ -618,6 +620,7 @@ or within a container.
 
 %prep
 %setup -q
+%autopatch
 
 %build
 
@@ -1375,6 +1378,10 @@ exit 0
 
 # PRERELEASE
 %changelog
+* Thu Aug 13 2026 Martin Cermak <mcermak@redhat.com> - 5.5-2
+- Fix bz2515431 - stap always fails to sign modules with MOK
+  due to mismatched SHA1 vs SHA256 fingerprints
+
 * Fri May 01 2026 Frank Ch. Eigler <fche@redhat.com> - 5.5-1
 - Upstream release, see wiki page below for detailed notes.
   https://sourceware.org/systemtap/wiki/SystemTapReleases