From patchwork Fri Jul 14 21:30:50 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dimitri John Ledkov X-Patchwork-Id: 1808040 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Authentication-Results: legolas.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=canonical.com header.i=@canonical.com header.a=rsa-sha256 header.s=20210705 header.b=UiQz4+F4; dkim-atps=neutral Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4R2l5t3xkCz20cq for ; Sat, 15 Jul 2023 07:31:13 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1qKQNR-0000hP-L9; Fri, 14 Jul 2023 21:31:01 +0000 Received: from smtp-relay-internal-1.internal ([10.131.114.114] helo=smtp-relay-internal-1.canonical.com) by huckleberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1qKQNP-0000gP-Rz for kernel-team@lists.ubuntu.com; Fri, 14 Jul 2023 21:30:59 +0000 Received: from mail-wr1-f70.google.com (mail-wr1-f70.google.com [209.85.221.70]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id 9E3D43F0C3 for ; Fri, 14 Jul 2023 21:30:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1689370259; bh=/Oini+zNalumQqNMDQTlpOhLnXhrJoa78VwN9HtbzPU=; h=From:To:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=UiQz4+F43/xwx7OcoEnKE40H6ZX3896dvdsokwIQmHv2inDOx9VvVhuheU3mAh20X ImmfJ67MQtYp0dM9n27TeCqDyizdHRgAue5vPL76UAZpwfO6PK/nd76XY3RJWjeH9V 7N9yvOxDWVSdTTA8QD5O3d/rEiSZKZrEUH4ib8eXO/v0Op4+FPTjkKKgOECvMcWbK+ BmmQmqaPx6/ONDsVO4btFudCWXL8/lT19PopIjlr87dI9whGotas6bToA5Ngw7Fe8V Oddf29z/qzuoOzrwQ6oBfcCutLzWkH2mxDLN/YFH3DHotQ5pt01Rvof+Olo2DOvvqp jhDE3JwityrHg== Received: by mail-wr1-f70.google.com with SMTP id ffacd0b85a97d-3142665f122so1346853f8f.0 for ; Fri, 14 Jul 2023 14:30:59 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1689370259; x=1691962259; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=/Oini+zNalumQqNMDQTlpOhLnXhrJoa78VwN9HtbzPU=; b=WCClXVgAFJYS/U0S9UagaBpntpfF8IFUQZRnuMcTvPWGC820Nb4jZdV4sBMH0dpElY cCOIQWofa/yNpySYa5GNuGd7460lbl4WpfI4yQbgApzhP1VlfAJXPQB1PS0ZoPPVSamj yGEUdmDblg93Csvlrrbw+yG+WH/07Cu0YoYGOku52JyJeoz38AAgPKz+TnnL9UUahvUp FVacBEA/9V1c8NGVs6Gg/AEqCdeV6uh6cl5rifehHCHmK8wLZjC/o81Oz1DpzM/xd/9f 0IofKqxsHZo3SRBFYwgl70AOFKipa8+b5X9GnHrZ/iok9W2x1x0qU8tCnQ3bXzZq5A2+ 3jXg== X-Gm-Message-State: ABy/qLZ1kRDIw6MGih24sJVm60UKFnqYpnTlloMgTFUZv0LXaqXUraTX IBwFfoLEu0PJUf01hdg+lY6MN0YmYVIuTK1njtKXE2bRs4GnG5AeRbKghfEFfuMSKFaxxv+zDCh IYBGfacQ+AnRUrQqlZnwd/gJ0Nx7WbAUiqCMXa+HwOtBqk9dWxQ+c X-Received: by 2002:a5d:440d:0:b0:314:13e2:2f6c with SMTP id z13-20020a5d440d000000b0031413e22f6cmr5139259wrq.58.1689370258859; Fri, 14 Jul 2023 14:30:58 -0700 (PDT) X-Google-Smtp-Source: APBJJlHA/M+fGeD2kYbHzQJm/nPAbdk3OhirPVRX2xJoFECAo4Xu6ILHdcqLzEDQrogLQBnXnrSeUQ== X-Received: by 2002:a5d:440d:0:b0:314:13e2:2f6c with SMTP id z13-20020a5d440d000000b0031413e22f6cmr5139253wrq.58.1689370258627; Fri, 14 Jul 2023 14:30:58 -0700 (PDT) Received: from localhost ([137.220.91.195]) by smtp.gmail.com with ESMTPSA id d17-20020adfe891000000b003143cdc5949sm12129121wrm.9.2023.07.14.14.30.57 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 14 Jul 2023 14:30:58 -0700 (PDT) From: Dimitri John Ledkov To: kernel-team@lists.ubuntu.com Subject: [mantic:linux-signed][PATCH 2/5] UBUNTU: Use openssl for HMAC calculation Date: Fri, 14 Jul 2023 22:30:50 +0100 Message-Id: <20230714213053.496349-3-dimitri.ledkov@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230714213053.496349-1-dimitri.ledkov@canonical.com> References: <20230714213053.496349-1-dimitri.ledkov@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" kcapi-tools applications are not available in all suites, in the same path, with the same name, instead use openssl which is universally available. kcapi-tools itself also uses openssl to calculate its hmac. BugLink: https://bugs.launchpad.net/bugs/2027818 Signed-off-by: Dimitri John Ledkov --- debian/rules | 2 +- debian/scripts/generate-control | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/debian/rules b/debian/rules index c78ca3dde8..06651f2f5f 100755 --- a/debian/rules +++ b/debian/rules @@ -109,7 +109,7 @@ override_dh_auto_install: if grep -q "^Package: *$$hmac_pkg\$$" debian/control; then \ unsigned_hmac_pkg="linux-image-unsigned-hmac-$$verflav";\ hmac="$$(dirname "$$signed")/.$$(basename "$$signed").hmac"; \ - sha512hmac "$$signed" | \ + openssl sha512 -r -hmac FIPS-FTW-RHT2009 "$$signed" | \ awk -vpkg="/boot/$$(basename "$$signed")" \ '{ printf("%s %s\n", $$1, pkg) }' \ > "$$hmac"; \ diff --git a/debian/scripts/generate-control b/debian/scripts/generate-control index 4a778d9d9e..65a3841b7e 100755 --- a/debian/scripts/generate-control +++ b/debian/scripts/generate-control @@ -31,6 +31,8 @@ with open("debian/control.stub") as tfd, open("debian/control", "w") as cfd: efi_archs.update([arch]) if efi_archs: print(f' sbsigntool [{" ".join(efi_archs)}],', file=cfd) + # For HMACs + print(f" openssl,", file=cfd) else: print(line, end='', file=cfd)