public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [rpms/systemtap] f43: Fix bz2515431
@ 2026-09-18 11:46 Martin Cermak
0 siblings, 0 replies; 2+ messages in thread
From: Martin Cermak @ 2026-09-18 11:46 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : rpms/systemtap
Branch : f43
Commit : 0c0165b44c22ca58c048793e5e2205d1285a2dec
Author : Martin Cermak <mcermak@redhat.com>
Date : 2026-08-13T19:13:09+02:00
Stats : +60/-1 in 2 file(s)
URL : https://src.fedoraproject.org/rpms/systemtap/c/0c0165b44c22ca58c048793e5e2205d1285a2dec?branch=f43
Log:
Fix bz2515431
---
diff --git a/41b6fa819.patch b/41b6fa819.patch
new file mode 100644
index 0000000..6ccf072
--- /dev/null
+++ b/41b6fa819.patch
@@ -0,0 +1,52 @@
+commit 41b6fa81922e2c7ba6a19f769167160b98e42bd1
+Author: Martin Cermak <mcermak@redhat.com>
+Date: Mon Jun 1 17:40:32 2026 +0200
+
+ Use SHA1 for MOK directory naming and matching
+
+ Commit a4bd43278 (April 2026) changed SystemTap to use SHA256 instead of
+ SHA1 for certificate fingerprinting, including MOK (Machine Owner Key)
+ directory naming and matching. Mokutil (the system tool for managing
+ UEFI MOKs) is hardcoded to use SHA1 fingerprints. That commit rendered
+ SystemTap incompatible with mokutil.
+
+ Revert only the MOK fingerprint calculation back to SHA1 in
+ read_cert_info_from_file() while keeping SHA256 for the actual module
+ signing operation. This makes SystemTap's MOK directory names match what
+ mokutil displays.
+
+ Assisted-by: Anthropic Claude
+
+diff --git a/nsscommon.cxx b/nsscommon.cxx
+index 5ab59ed8e..db88f6b8f 100644
+--- a/nsscommon.cxx
++++ b/nsscommon.cxx
+@@ -1962,12 +1962,16 @@ read_cert_info_from_file (const string &certPath, string &fingerprint)
+ }
+
+ // Get the fingerprint from the signature.
+- unsigned char fingerprint_buf[32]; // SHA256_LENGTH
++ // Use SHA1 for MOK fingerprints to match mokutil behavior
++ // MOKutil always uses SHA1 fingerprints regardless of certificate signature algorithm
++ unsigned char fingerprint_buf[SHA1_LENGTH];
+ SECItem fpItem;
+- rv = PK11_HashBuf(SEC_OID_SHA256, fingerprint_buf, derCert.data, derCert.len);
++ rv = PK11_HashBuf(SEC_OID_SHA1, fingerprint_buf, derCert.data, derCert.len);
+ if (rv)
+ {
+- nsscommon_error (_F("Could not decode SHA256 fingerprint from file %s",
++ // Note: We use SHA1 for MOK fingerprints because mokutil (the UEFI MOK
++ // enrollment tool) always displays SHA1 fingerprints, not SHA256.
++ nsscommon_error (_F("Could not decode SHA1 fingerprint from file %s",
+ certPath.c_str ()));
+ goto done;
+ }
+@@ -1976,7 +1980,7 @@ read_cert_info_from_file (const string &certPath, string &fingerprint)
+ str = CERT_Hexify(&fpItem, 1);
+ if (! str)
+ {
+- nsscommon_error (_F("Could not hexify SHA256 fingerprint from file %s",
++ nsscommon_error (_F("Could not hexify SHA1 fingerprint from file %s",
+ certPath.c_str ()));
+ goto done;
+ }
diff --git a/systemtap.spec b/systemtap.spec
index 26cb4a6..1a1b876 100644
--- a/systemtap.spec
+++ b/systemtap.spec
@@ -131,7 +131,7 @@ f /var/log/stap-server/log 0644 stap-server stap-server -
Name: systemtap
# PRERELEASE
Version: 5.5
-Release: 1%{?release_override}%{?dist}
+Release: 2%{?release_override}%{?dist}
# for version, see also configure.ac
@@ -169,6 +169,8 @@ License: GPL-2.0-or-later
URL: https://sourceware.org/systemtap/
Source: ftp://sourceware.org/pub/systemtap/releases/systemtap-%{version}.tar.gz
+Patch0: 41b6fa819.patch
+
# Build*
BuildRequires: make
BuildRequires: gcc-c++
@@ -618,6 +620,7 @@ or within a container.
%prep
%setup -q
+%autopatch
%build
@@ -1375,6 +1378,10 @@ exit 0
# PRERELEASE
%changelog
+* Thu Aug 13 2026 Martin Cermak <mcermak@redhat.com> - 5.5-2
+- Fix bz2515431 - stap always fails to sign modules with MOK
+ due to mismatched SHA1 vs SHA256 fingerprints
+
* Fri May 01 2026 Frank Ch. Eigler <fche@redhat.com> - 5.5-1
- Upstream release, see wiki page below for detailed notes.
https://sourceware.org/systemtap/wiki/SystemTapReleases
^ permalink raw reply related [flat|nested] 2+ messages in thread* [rpms/systemtap] f43: Fix bz2515431
@ 2026-08-13 17:18 Martin Cermak
0 siblings, 0 replies; 2+ messages in thread
From: Martin Cermak @ 2026-08-13 17:18 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : rpms/systemtap
Branch : f43
Commit : cea7a65005ef73d0f65d42d9c80a4d3841f696f1
Author : Martin Cermak <mcermak@redhat.com>
Date : 2026-08-13T19:18:34+02:00
Stats : +60/-1 in 2 file(s)
URL : https://src.fedoraproject.org/rpms/systemtap/c/cea7a65005ef73d0f65d42d9c80a4d3841f696f1?branch=f43
Log:
Fix bz2515431
---
diff --git a/41b6fa819.patch b/41b6fa819.patch
new file mode 100644
index 0000000..6ccf072
--- /dev/null
+++ b/41b6fa819.patch
@@ -0,0 +1,52 @@
+commit 41b6fa81922e2c7ba6a19f769167160b98e42bd1
+Author: Martin Cermak <mcermak@redhat.com>
+Date: Mon Jun 1 17:40:32 2026 +0200
+
+ Use SHA1 for MOK directory naming and matching
+
+ Commit a4bd43278 (April 2026) changed SystemTap to use SHA256 instead of
+ SHA1 for certificate fingerprinting, including MOK (Machine Owner Key)
+ directory naming and matching. Mokutil (the system tool for managing
+ UEFI MOKs) is hardcoded to use SHA1 fingerprints. That commit rendered
+ SystemTap incompatible with mokutil.
+
+ Revert only the MOK fingerprint calculation back to SHA1 in
+ read_cert_info_from_file() while keeping SHA256 for the actual module
+ signing operation. This makes SystemTap's MOK directory names match what
+ mokutil displays.
+
+ Assisted-by: Anthropic Claude
+
+diff --git a/nsscommon.cxx b/nsscommon.cxx
+index 5ab59ed8e..db88f6b8f 100644
+--- a/nsscommon.cxx
++++ b/nsscommon.cxx
+@@ -1962,12 +1962,16 @@ read_cert_info_from_file (const string &certPath, string &fingerprint)
+ }
+
+ // Get the fingerprint from the signature.
+- unsigned char fingerprint_buf[32]; // SHA256_LENGTH
++ // Use SHA1 for MOK fingerprints to match mokutil behavior
++ // MOKutil always uses SHA1 fingerprints regardless of certificate signature algorithm
++ unsigned char fingerprint_buf[SHA1_LENGTH];
+ SECItem fpItem;
+- rv = PK11_HashBuf(SEC_OID_SHA256, fingerprint_buf, derCert.data, derCert.len);
++ rv = PK11_HashBuf(SEC_OID_SHA1, fingerprint_buf, derCert.data, derCert.len);
+ if (rv)
+ {
+- nsscommon_error (_F("Could not decode SHA256 fingerprint from file %s",
++ // Note: We use SHA1 for MOK fingerprints because mokutil (the UEFI MOK
++ // enrollment tool) always displays SHA1 fingerprints, not SHA256.
++ nsscommon_error (_F("Could not decode SHA1 fingerprint from file %s",
+ certPath.c_str ()));
+ goto done;
+ }
+@@ -1976,7 +1980,7 @@ read_cert_info_from_file (const string &certPath, string &fingerprint)
+ str = CERT_Hexify(&fpItem, 1);
+ if (! str)
+ {
+- nsscommon_error (_F("Could not hexify SHA256 fingerprint from file %s",
++ nsscommon_error (_F("Could not hexify SHA1 fingerprint from file %s",
+ certPath.c_str ()));
+ goto done;
+ }
diff --git a/systemtap.spec b/systemtap.spec
index 26cb4a6..1a1b876 100644
--- a/systemtap.spec
+++ b/systemtap.spec
@@ -131,7 +131,7 @@ f /var/log/stap-server/log 0644 stap-server stap-server -
Name: systemtap
# PRERELEASE
Version: 5.5
-Release: 1%{?release_override}%{?dist}
+Release: 2%{?release_override}%{?dist}
# for version, see also configure.ac
@@ -169,6 +169,8 @@ License: GPL-2.0-or-later
URL: https://sourceware.org/systemtap/
Source: ftp://sourceware.org/pub/systemtap/releases/systemtap-%{version}.tar.gz
+Patch0: 41b6fa819.patch
+
# Build*
BuildRequires: make
BuildRequires: gcc-c++
@@ -618,6 +620,7 @@ or within a container.
%prep
%setup -q
+%autopatch
%build
@@ -1375,6 +1378,10 @@ exit 0
# PRERELEASE
%changelog
+* Thu Aug 13 2026 Martin Cermak <mcermak@redhat.com> - 5.5-2
+- Fix bz2515431 - stap always fails to sign modules with MOK
+ due to mismatched SHA1 vs SHA256 fingerprints
+
* Fri May 01 2026 Frank Ch. Eigler <fche@redhat.com> - 5.5-1
- Upstream release, see wiki page below for detailed notes.
https://sourceware.org/systemtap/wiki/SystemTapReleases
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-09-18 11:46 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-18 11:46 [rpms/systemtap] f43: Fix bz2515431 Martin Cermak
-- strict thread matches above, loose matches on Subject: below --
2026-08-13 17:18 Martin Cermak
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox