Fixes for F28 switch to sqlite as the default NSS database type
- Patch to fix NSS handling of keys in sqlite databases - Patches to fix tests now that sqlite is the NSS default. Also fix building in rawhide due to packaging changes - Remove BR on mktemp. It is now provided by coreutils.
This commit is contained in:
Rob Crittenden
parent
3987281325
commit
6155daa274
@ -0,0 +1,63 @@
|
|||||||
|
From 3cb710fbea245476a49af77d670fedb35bba16de Mon Sep 17 00:00:00 2001
|
||||||
|
From: Rob Crittenden <rcritten@redhat.com>
|
||||||
|
Date: Tue, 9 Jan 2018 22:07:17 -0500
|
||||||
|
Subject: [PATCH 1/6] Perm issues in sqlite databases show up in slightly
|
||||||
|
different ways
|
||||||
|
|
||||||
|
SQLite databases may return SEC_ERROR_READ_ONLY instead of
|
||||||
|
SEC_ERROR_BAD_DATABASE.
|
||||||
|
|
||||||
|
If a database is opened as read-write but it fails (e.g. in a
|
||||||
|
read-only directory) it will try again to open it as read-only
|
||||||
|
and potentially fail because it doesn't exist at all. This sets
|
||||||
|
errno as ENOENT rather than the expected EACCES so treat that
|
||||||
|
as a read failure as well.
|
||||||
|
|
||||||
|
Related: https://pagure.io/certmonger/issue/88
|
||||||
|
---
|
||||||
|
src/certsave-n.c | 5 ++++-
|
||||||
|
src/keygen-n.c | 6 +++++-
|
||||||
|
2 files changed, 9 insertions(+), 2 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/src/certsave-n.c b/src/certsave-n.c
|
||||||
|
index 67deb88b..a2c97000 100644
|
||||||
|
--- a/src/certsave-n.c
|
||||||
|
+++ b/src/certsave-n.c
|
||||||
|
@@ -128,10 +128,13 @@ cm_certsave_n_main(int fd, struct cm_store_ca *ca, struct cm_store_entry *entry,
|
||||||
|
NSS_INIT_NOMODDB);
|
||||||
|
ec = PORT_GetError();
|
||||||
|
if (ctx == NULL) {
|
||||||
|
- if ((ec == SEC_ERROR_BAD_DATABASE) && readwrite) {
|
||||||
|
+ if ((ec == SEC_ERROR_READ_ONLY) && readwrite) {
|
||||||
|
+ ec = PR_NO_ACCESS_RIGHTS_ERROR;
|
||||||
|
+ } else if ((ec == SEC_ERROR_BAD_DATABASE) && readwrite) {
|
||||||
|
switch (errno) {
|
||||||
|
case EACCES:
|
||||||
|
case EPERM:
|
||||||
|
+ case ENOENT:
|
||||||
|
ec = PR_NO_ACCESS_RIGHTS_ERROR;
|
||||||
|
break;
|
||||||
|
default:
|
||||||
|
diff --git a/src/keygen-n.c b/src/keygen-n.c
|
||||||
|
index 08f00496..8078a520 100644
|
||||||
|
--- a/src/keygen-n.c
|
||||||
|
+++ b/src/keygen-n.c
|
||||||
|
@@ -169,10 +169,14 @@ cm_keygen_n_main(int fd, struct cm_store_ca *ca, struct cm_store_entry *entry,
|
||||||
|
NSS_INIT_NOMODDB);
|
||||||
|
ec = PORT_GetError();
|
||||||
|
if (ctx == NULL) {
|
||||||
|
- if ((ec == SEC_ERROR_BAD_DATABASE) && readwrite) {
|
||||||
|
+ if ((ec == SEC_ERROR_READ_ONLY) && readwrite) {
|
||||||
|
+ ec = PR_NO_ACCESS_RIGHTS_ERROR;
|
||||||
|
+ }
|
||||||
|
+ else if ((ec == SEC_ERROR_BAD_DATABASE) && readwrite) {
|
||||||
|
switch (errno) {
|
||||||
|
case EACCES:
|
||||||
|
case EPERM:
|
||||||
|
+ case ENOENT:
|
||||||
|
ec = PR_NO_ACCESS_RIGHTS_ERROR;
|
||||||
|
break;
|
||||||
|
default:
|
||||||
|
--
|
||||||
|
2.15.1
|
||||||
|
|
||||||
@ -0,0 +1,52 @@
|
|||||||
|
From f1b7eeceef117606c060f61542754f5556739469 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Rob Crittenden <rcritten@redhat.com>
|
||||||
|
Date: Tue, 9 Jan 2018 22:13:49 -0500
|
||||||
|
Subject: [PATCH 2/6] SQLite databases require a password to modify trust and
|
||||||
|
to sign
|
||||||
|
|
||||||
|
This affects certutil -M and cmsutil -S. Need to add -f pinfile.
|
||||||
|
|
||||||
|
https://pagure.io/certmonger/issue/88
|
||||||
|
---
|
||||||
|
tests/030-rekey/run.sh | 16 ++++++++--------
|
||||||
|
1 file changed, 8 insertions(+), 8 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/tests/030-rekey/run.sh b/tests/030-rekey/run.sh
|
||||||
|
index 9b50da4a..07fea683 100755
|
||||||
|
--- a/tests/030-rekey/run.sh
|
||||||
|
+++ b/tests/030-rekey/run.sh
|
||||||
|
@@ -140,11 +140,11 @@ for preserve in 1 0 ; do
|
||||||
|
|
||||||
|
echo "This is the plaintext." > plain.txt
|
||||||
|
echo "NSS Signing:"
|
||||||
|
- certutil -M -d $tmpdir -n i$size -t P,P,P
|
||||||
|
- cmsutil -S -d $tmpdir -f pinfile -N i$size -i plain.txt -o signed
|
||||||
|
+ certutil -M -d $tmpdir -n i$size -t P,P,P -f pinfile
|
||||||
|
+ cmsutil -S -d $tmpdir -f pinfile -N i$size -i plain.txt -o signed -f pinfile
|
||||||
|
echo "NSS Verify:"
|
||||||
|
- cmsutil -D -d $tmpdir -f pinfile -i signed
|
||||||
|
- certutil -M -d $tmpdir -n i$size -t ,,
|
||||||
|
+ cmsutil -D -d $tmpdir -f pinfile -i signed -f pinfile
|
||||||
|
+ certutil -M -d $tmpdir -n i$size -t ,, -f pinfile
|
||||||
|
|
||||||
|
# Go and save the new certs and keys (NSS).
|
||||||
|
echo '(saving)'
|
||||||
|
@@ -163,11 +163,11 @@ for preserve in 1 0 ; do
|
||||||
|
|
||||||
|
echo "This is the plaintext." > plain.txt
|
||||||
|
echo "NSS Signing:"
|
||||||
|
- certutil -M -d $tmpdir -n i$size -t P,P,P
|
||||||
|
- cmsutil -S -d $tmpdir -f pinfile -N i$size -i plain.txt -o signed
|
||||||
|
+ certutil -M -d $tmpdir -n i$size -t P,P,P -f pinfile
|
||||||
|
+ cmsutil -S -d $tmpdir -f pinfile -N i$size -i plain.txt -o signed -f pinfile
|
||||||
|
echo "NSS Verify:"
|
||||||
|
- cmsutil -D -d $tmpdir -f pinfile -i signed
|
||||||
|
- certutil -M -d $tmpdir -n i$size -t ,,
|
||||||
|
+ cmsutil -D -d $tmpdir -f pinfile -i signed -f pinfile
|
||||||
|
+ certutil -M -d $tmpdir -n i$size -t ,, -f pinfile
|
||||||
|
|
||||||
|
# Now generate new keys, CSRs, and certificates (OpenSSL).
|
||||||
|
echo "PEM keys before re-keygen (preserve=$preserve,pin=\"$pin\"):"
|
||||||
|
--
|
||||||
|
2.15.1
|
||||||
|
|
||||||
405
0003-NSS-in-rawhide-F28-was-switched-to-sqlite-fix-assump.patch
Normal file
405
0003-NSS-in-rawhide-F28-was-switched-to-sqlite-fix-assump.patch
Normal file
@ -0,0 +1,405 @@
|
|||||||
|
From 0cfefe50373cd5f7da5b49f1a1380ba8b5baf825 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Rob Crittenden <rcritten@redhat.com>
|
||||||
|
Date: Tue, 9 Jan 2018 22:14:53 -0500
|
||||||
|
Subject: [PATCH 3/6] NSS in rawhide (F28) was switched to sqlite, fix
|
||||||
|
assumptions
|
||||||
|
|
||||||
|
Previous releases of NSS had dbm as the default storage type.
|
||||||
|
Certain assumptions were built into the tests. Make the default
|
||||||
|
scheme more explicit, leaving it as dbm for now.
|
||||||
|
|
||||||
|
https://pagure.io/certmonger/issue/88
|
||||||
|
---
|
||||||
|
tests/007-certsave-dbm/expected.out | 4 ++--
|
||||||
|
tests/007-certsave/expected.out | 4 ++--
|
||||||
|
tests/007-certsave/run.sh | 47 +++++++++++++++++++------------------
|
||||||
|
tests/025-casave/run.sh | 36 ++++++++++++++--------------
|
||||||
|
tests/034-perms/expected.out | 36 ++++++++++++++--------------
|
||||||
|
tests/034-perms/run.sh | 2 ++
|
||||||
|
6 files changed, 66 insertions(+), 63 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/tests/007-certsave-dbm/expected.out b/tests/007-certsave-dbm/expected.out
|
||||||
|
index e0978c66..ed6b4ede 100644
|
||||||
|
--- a/tests/007-certsave-dbm/expected.out
|
||||||
|
+++ b/tests/007-certsave-dbm/expected.out
|
||||||
|
@@ -37,7 +37,7 @@ Testing setting trust to C,c,p:
|
||||||
|
wrong nickname, right subject: cert ,,
|
||||||
|
wrong subject, right nickname: cert ,,
|
||||||
|
[nss:rosubdir]
|
||||||
|
-Failed to save (NSS:${tmpdir}/rosubdir), filesystem permissions error.
|
||||||
|
+Failed to save (NSS:dbm:${tmpdir}/rosubdir), filesystem permissions error.
|
||||||
|
[nss:rwsubdir]
|
||||||
|
-Failed to save (NSS:${tmpdir}/rwsubdir), filesystem permissions error.
|
||||||
|
+Failed to save (NSS:dbm:${tmpdir}/rwsubdir), filesystem permissions error.
|
||||||
|
Test complete.
|
||||||
|
diff --git a/tests/007-certsave/expected.out b/tests/007-certsave/expected.out
|
||||||
|
index e0978c66..ed6b4ede 100644
|
||||||
|
--- a/tests/007-certsave/expected.out
|
||||||
|
+++ b/tests/007-certsave/expected.out
|
||||||
|
@@ -37,7 +37,7 @@ Testing setting trust to C,c,p:
|
||||||
|
wrong nickname, right subject: cert ,,
|
||||||
|
wrong subject, right nickname: cert ,,
|
||||||
|
[nss:rosubdir]
|
||||||
|
-Failed to save (NSS:${tmpdir}/rosubdir), filesystem permissions error.
|
||||||
|
+Failed to save (NSS:dbm:${tmpdir}/rosubdir), filesystem permissions error.
|
||||||
|
[nss:rwsubdir]
|
||||||
|
-Failed to save (NSS:${tmpdir}/rwsubdir), filesystem permissions error.
|
||||||
|
+Failed to save (NSS:dbm:${tmpdir}/rwsubdir), filesystem permissions error.
|
||||||
|
Test complete.
|
||||||
|
diff --git a/tests/007-certsave/run.sh b/tests/007-certsave/run.sh
|
||||||
|
index bea8341a..29b02152 100755
|
||||||
|
--- a/tests/007-certsave/run.sh
|
||||||
|
+++ b/tests/007-certsave/run.sh
|
||||||
|
@@ -2,8 +2,9 @@
|
||||||
|
|
||||||
|
cd "$tmpdir"
|
||||||
|
|
||||||
|
+scheme="${scheme:-dbm}"
|
||||||
|
source "$srcdir"/functions
|
||||||
|
-initnssdb ${scheme:+${scheme}:}$tmpdir
|
||||||
|
+initnssdb $scheme:$tmpdir
|
||||||
|
|
||||||
|
wrongcert='-----BEGIN CERTIFICATE-----
|
||||||
|
MIIDQTCCAimgAwIBAgIBBTANBgkqhkiG9w0BAQsFADASMRAwDgYDVQQDEwdwaWxs
|
||||||
|
@@ -50,7 +51,7 @@ echo "$wrongcert" | sed -e 's,^$,,g' -e 's,^ ,,g' > cert.wrong
|
||||||
|
echo "[nss:wrongnick]"
|
||||||
|
cat > entry.nss << EOF
|
||||||
|
cert_storage_type=NSSDB
|
||||||
|
-cert_storage_location=${scheme:+${scheme}:}$tmpdir
|
||||||
|
+cert_storage_location=$scheme:$tmpdir
|
||||||
|
cert_nickname=wrongnick
|
||||||
|
cert=$cert
|
||||||
|
EOF
|
||||||
|
@@ -59,7 +60,7 @@ $toolsdir/certsave entry.nss
|
||||||
|
echo "[nss:wrongcert]"
|
||||||
|
cat > entry.nss << EOF
|
||||||
|
cert_storage_type=NSSDB
|
||||||
|
-cert_storage_location=${scheme:+${scheme}:}$tmpdir
|
||||||
|
+cert_storage_location=$scheme:$tmpdir
|
||||||
|
cert_nickname=cert
|
||||||
|
cert=$wrongcert
|
||||||
|
EOF
|
||||||
|
@@ -68,13 +69,13 @@ $toolsdir/certsave entry.nss
|
||||||
|
echo "[nss:right]"
|
||||||
|
cat > entry.nss << EOF
|
||||||
|
cert_storage_type=NSSDB
|
||||||
|
-cert_storage_location=${scheme:+${scheme}:}$tmpdir
|
||||||
|
+cert_storage_location=$scheme:$tmpdir
|
||||||
|
cert_nickname=cert
|
||||||
|
cert=$cert
|
||||||
|
EOF
|
||||||
|
$toolsdir/certsave entry.nss
|
||||||
|
$toolsdir/listnicks entry.nss
|
||||||
|
-certutil -d ${scheme:+${scheme}:}$tmpdir -L -n cert -a > cert.nss
|
||||||
|
+certutil -d $scheme:$tmpdir -L -n cert -a > cert.nss
|
||||||
|
# Save the wrong certificate to the PEM file.
|
||||||
|
echo "[openssl:wrong]"
|
||||||
|
cat > entry.openssl << EOF
|
||||||
|
@@ -96,7 +97,7 @@ run_dos2unix cert.original
|
||||||
|
run_dos2unix cert.nss
|
||||||
|
run_dos2unix cert.openssl
|
||||||
|
if ! cmp cert.original cert.nss ; then
|
||||||
|
- echo Original and NSS disagree "(${scheme:+${scheme}:}$tmpdir)".
|
||||||
|
+ echo Original and NSS disagree "($scheme:$tmpdir)".
|
||||||
|
cat cert.original cert.nss
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
@@ -137,62 +138,62 @@ $toolsdir/certsave entry.openssl || true
|
||||||
|
for trust in ,, P,, ,P, CT,C, C,c,p ; do
|
||||||
|
echo Testing setting trust to "$trust":
|
||||||
|
# Save the right certificate to NSS's database and read it back.
|
||||||
|
- initnssdb ${scheme:+${scheme}:}$tmpdir
|
||||||
|
+ initnssdb $scheme:$tmpdir
|
||||||
|
cat > entry.nss <<- EOF
|
||||||
|
cert_storage_type=NSSDB
|
||||||
|
- cert_storage_location=${scheme:+${scheme}:}$tmpdir
|
||||||
|
+ cert_storage_location=$scheme:$tmpdir
|
||||||
|
cert_nickname=cert
|
||||||
|
cert=$cert
|
||||||
|
EOF
|
||||||
|
$toolsdir/certsave entry.nss
|
||||||
|
- certutil -d ${scheme:+${scheme}:}$tmpdir -M -n cert -t $trust
|
||||||
|
+ certutil -d $scheme:$tmpdir -M -n cert -t $trust
|
||||||
|
echo -n " baseline: "
|
||||||
|
- certutil -d ${scheme:+${scheme}:}$tmpdir -L | grep cert | sed -r 's,[ \t]+, ,g'
|
||||||
|
+ certutil -d $scheme:$tmpdir -L | grep cert | sed -r 's,[ \t]+, ,g'
|
||||||
|
$toolsdir/certsave entry.nss
|
||||||
|
echo -n " right nickname, right subject: "
|
||||||
|
- certutil -d ${scheme:+${scheme}:}$tmpdir -L | grep cert | sed -r 's,[ \t]+, ,g'
|
||||||
|
+ certutil -d $scheme:$tmpdir -L | grep cert | sed -r 's,[ \t]+, ,g'
|
||||||
|
# Save the right certificate to NSS's database with the wrong nickname.
|
||||||
|
- initnssdb ${scheme:+${scheme}:}$tmpdir
|
||||||
|
+ initnssdb $scheme:$tmpdir
|
||||||
|
$toolsdir/certsave entry.nss
|
||||||
|
cat > entry.nss <<- EOF
|
||||||
|
cert_storage_type=NSSDB
|
||||||
|
- cert_storage_location=${scheme:+${scheme}:}$tmpdir
|
||||||
|
+ cert_storage_location=$scheme:$tmpdir
|
||||||
|
cert_nickname=wrongnick
|
||||||
|
cert=$cert
|
||||||
|
EOF
|
||||||
|
$toolsdir/certsave entry.nss
|
||||||
|
- certutil -d ${scheme:+${scheme}:}$tmpdir -M -n wrongnick -t $trust
|
||||||
|
+ certutil -d $scheme:$tmpdir -M -n wrongnick -t $trust
|
||||||
|
# Save the right certificate to NSS's database and read it back.
|
||||||
|
cat > entry.nss <<- EOF
|
||||||
|
cert_storage_type=NSSDB
|
||||||
|
- cert_storage_location=${scheme:+${scheme}:}$tmpdir
|
||||||
|
+ cert_storage_location=$scheme:$tmpdir
|
||||||
|
cert_nickname=cert
|
||||||
|
cert=$cert
|
||||||
|
EOF
|
||||||
|
$toolsdir/certsave entry.nss
|
||||||
|
echo -n " wrong nickname, right subject: "
|
||||||
|
- certutil -d ${scheme:+${scheme}:}$tmpdir -L | grep cert | sed -r 's,[ \t]+, ,g'
|
||||||
|
+ certutil -d $scheme:$tmpdir -L | grep cert | sed -r 's,[ \t]+, ,g'
|
||||||
|
# Save the wrong certificate to NSS's database with the right nickname.
|
||||||
|
- initnssdb ${scheme:+${scheme}:}$tmpdir
|
||||||
|
+ initnssdb $scheme:$tmpdir
|
||||||
|
$toolsdir/certsave entry.nss
|
||||||
|
cat > entry.nss <<- EOF
|
||||||
|
cert_storage_type=NSSDB
|
||||||
|
- cert_storage_location=${scheme:+${scheme}:}$tmpdir
|
||||||
|
+ cert_storage_location=$scheme:$tmpdir
|
||||||
|
cert_nickname=cert
|
||||||
|
cert=$wrongcert
|
||||||
|
EOF
|
||||||
|
$toolsdir/certsave entry.nss
|
||||||
|
- certutil -d ${scheme:+${scheme}:}$tmpdir -M -n cert -t $trust
|
||||||
|
+ certutil -d $scheme:$tmpdir -M -n cert -t $trust
|
||||||
|
# Save the right certificate to NSS's database and read it back.
|
||||||
|
cat > entry.nss <<- EOF
|
||||||
|
cert_storage_type=NSSDB
|
||||||
|
- cert_storage_location=${scheme:+${scheme}:}$tmpdir
|
||||||
|
+ cert_storage_location=$scheme:$tmpdir
|
||||||
|
cert_nickname=cert
|
||||||
|
cert=$cert
|
||||||
|
EOF
|
||||||
|
$toolsdir/certsave entry.nss
|
||||||
|
echo -n " wrong subject, right nickname: "
|
||||||
|
- certutil -d ${scheme:+${scheme}:}$tmpdir -L | grep cert | sed -r 's,[ \t]+, ,g'
|
||||||
|
+ certutil -d $scheme:$tmpdir -L | grep cert | sed -r 's,[ \t]+, ,g'
|
||||||
|
done
|
||||||
|
|
||||||
|
if test "$scheme" = sql ; then
|
||||||
|
@@ -202,7 +203,7 @@ else
|
||||||
|
echo "[nss:rosubdir]"
|
||||||
|
cat > entry.nss <<- EOF
|
||||||
|
cert_storage_type=NSSDB
|
||||||
|
- cert_storage_location=$tmpdir/rosubdir
|
||||||
|
+ cert_storage_location=$scheme:$tmpdir/rosubdir
|
||||||
|
cert_nickname=cert
|
||||||
|
cert=$cert
|
||||||
|
EOF
|
||||||
|
@@ -216,7 +217,7 @@ else
|
||||||
|
echo "[nss:rwsubdir]"
|
||||||
|
cat > entry.nss <<- EOF
|
||||||
|
cert_storage_type=NSSDB
|
||||||
|
- cert_storage_location=$tmpdir/rwsubdir
|
||||||
|
+ cert_storage_location=$scheme:$tmpdir/rwsubdir
|
||||||
|
cert_nickname=cert
|
||||||
|
cert=$cert
|
||||||
|
EOF
|
||||||
|
diff --git a/tests/025-casave/run.sh b/tests/025-casave/run.sh
|
||||||
|
index 44a08b06..aff1e6d9 100755
|
||||||
|
--- a/tests/025-casave/run.sh
|
||||||
|
+++ b/tests/025-casave/run.sh
|
||||||
|
@@ -196,7 +196,7 @@ id=EntryD1
|
||||||
|
root_cert_files=
|
||||||
|
other_root_cert_files=
|
||||||
|
other_cert_files=
|
||||||
|
-root_cert_dbs=$tmpdir/db1,$tmpdir/dba
|
||||||
|
+root_cert_dbs=dbm:$tmpdir/db1,dbm:$tmpdir/dba
|
||||||
|
other_root_cert_dbs=
|
||||||
|
other_cert_dbs=
|
||||||
|
cert_roots=Per-certificate Signing Authority D1
|
||||||
|
@@ -229,7 +229,7 @@ root_cert_files=
|
||||||
|
other_root_cert_files=
|
||||||
|
other_cert_files=
|
||||||
|
root_cert_dbs=
|
||||||
|
-other_root_cert_dbs=$tmpdir/db2,$tmpdir/dba
|
||||||
|
+other_root_cert_dbs=dbm:$tmpdir/db2,dbm:$tmpdir/dba
|
||||||
|
other_cert_dbs=
|
||||||
|
EOF
|
||||||
|
cat > $tmpdir/entryd3 <<- EOF
|
||||||
|
@@ -239,7 +239,7 @@ other_root_cert_files=
|
||||||
|
other_cert_files=
|
||||||
|
root_cert_dbs=
|
||||||
|
other_root_cert_dbs=
|
||||||
|
-other_cert_dbs=$tmpdir/db3,$tmpdir/dba
|
||||||
|
+other_cert_dbs=dbm:$tmpdir/db3,dbm:$tmpdir/dba
|
||||||
|
cert_chain=Per-certificate Signing Authority D3
|
||||||
|
-----BEGIN CERTIFICATE-----
|
||||||
|
MIIDjjCCAnagAwIBAgIRALuVK2FuXklPuMP4qtRyQjUwDQYJKoZIhvcNAQELBQAw
|
||||||
|
@@ -300,7 +300,7 @@ ca_name=CAD1
|
||||||
|
root_cert_files=
|
||||||
|
other_root_cert_files=
|
||||||
|
other_cert_files=
|
||||||
|
-root_cert_dbs=$tmpdir/db1,$tmpdir/dba
|
||||||
|
+root_cert_dbs=dbm:$tmpdir/db1,dbm:$tmpdir/dba
|
||||||
|
other_root_cert_dbs=
|
||||||
|
other_cert_dbs=
|
||||||
|
EOF
|
||||||
|
@@ -311,7 +311,7 @@ root_cert_files=
|
||||||
|
other_root_cert_files=
|
||||||
|
other_cert_files=
|
||||||
|
root_cert_dbs=
|
||||||
|
-other_root_cert_dbs=$tmpdir/db2,$tmpdir/dba
|
||||||
|
+other_root_cert_dbs=dbm:$tmpdir/db2,dbm:$tmpdir/dba
|
||||||
|
other_cert_dbs=
|
||||||
|
EOF
|
||||||
|
cat > $tmpdir/entrycad3 <<- EOF
|
||||||
|
@@ -322,7 +322,7 @@ other_root_cert_files=
|
||||||
|
other_cert_files=
|
||||||
|
root_cert_dbs=
|
||||||
|
other_root_cert_dbs=
|
||||||
|
-other_cert_dbs=$tmpdir/db3,$tmpdir/dba
|
||||||
|
+other_cert_dbs=dbm:$tmpdir/db3,dbm:$tmpdir/dba
|
||||||
|
EOF
|
||||||
|
|
||||||
|
cat > $tmpdir/cab1 <<- EOF
|
||||||
|
@@ -564,9 +564,9 @@ ca_external_helper=$tmpdir/no-such-helper.sh
|
||||||
|
ca_root_cert_files=
|
||||||
|
ca_other_root_cert_files=
|
||||||
|
ca_other_cert_files=
|
||||||
|
-ca_root_cert_dbs=$tmpdir/db1,$tmpdir/dba
|
||||||
|
-ca_other_root_cert_dbs=$tmpdir/dba
|
||||||
|
-ca_other_cert_dbs=$tmpdir/dba
|
||||||
|
+ca_root_cert_dbs=dbm:$tmpdir/db1,dbm:$tmpdir/dba
|
||||||
|
+ca_other_root_cert_dbs=dbm:$tmpdir/dba
|
||||||
|
+ca_other_cert_dbs=dbm:$tmpdir/dba
|
||||||
|
ca_root_certs=Root Certificate D1
|
||||||
|
-----BEGIN CERTIFICATE-----
|
||||||
|
MIIDdzCCAl+gAwIBAgIEAgAAuTANBgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJJ
|
||||||
|
@@ -639,9 +639,9 @@ ca_external_helper=$tmpdir/no-such-helper.sh
|
||||||
|
ca_root_cert_files=
|
||||||
|
ca_other_root_cert_files=
|
||||||
|
ca_other_cert_files=
|
||||||
|
-ca_root_cert_dbs=$tmpdir/dba
|
||||||
|
-ca_other_root_cert_dbs=$tmpdir/db2,$tmpdir/dba
|
||||||
|
-ca_other_cert_dbs=$tmpdir/dba
|
||||||
|
+ca_root_cert_dbs=dbm:$tmpdir/dba
|
||||||
|
+ca_other_root_cert_dbs=dbm:$tmpdir/db2,dbm:$tmpdir/dba
|
||||||
|
+ca_other_cert_dbs=dbm:$tmpdir/dba
|
||||||
|
ca_root_certs=Root Certificate D2
|
||||||
|
-----BEGIN CERTIFICATE-----
|
||||||
|
MIIEDzCCAvegAwIBAgIBATANBgkqhkiG9w0BAQUFADBKMQswCQYDVQQGEwJTSzET
|
||||||
|
@@ -722,9 +722,9 @@ ca_external_helper=$tmpdir/no-such-helper.sh
|
||||||
|
ca_root_cert_files=
|
||||||
|
ca_other_root_cert_files=
|
||||||
|
ca_other_cert_files=
|
||||||
|
-ca_root_cert_dbs=,$tmpdir/dba
|
||||||
|
-ca_other_root_cert_dbs=,$tmpdir/dba,
|
||||||
|
-ca_other_cert_dbs=$tmpdir/db3,$tmpdir/dba
|
||||||
|
+ca_root_cert_dbs=,dbm:$tmpdir/dba
|
||||||
|
+ca_other_root_cert_dbs=,dbm:$tmpdir/dba,
|
||||||
|
+ca_other_cert_dbs=dbm:$tmpdir/db3,dbm:$tmpdir/dba
|
||||||
|
ca_root_certs=Root Certificate D3
|
||||||
|
-----BEGIN CERTIFICATE-----
|
||||||
|
MIICiTCCAg+gAwIBAgIQH0evqmIAcFBUTAGem2OZKjAKBggqhkjOPQQDAzCBhTEL
|
||||||
|
@@ -796,9 +796,9 @@ ca_external_helper=$tmpdir/no-such-helper.sh
|
||||||
|
ca_root_cert_files=$tmpdir/bundle-all
|
||||||
|
ca_other_root_cert_files=
|
||||||
|
ca_other_cert_files=
|
||||||
|
-ca_root_cert_dbs=$tmpdir/dba
|
||||||
|
-ca_other_root_cert_dbs=,$tmpdir/dba
|
||||||
|
-ca_other_cert_dbs=,$tmpdir/dba
|
||||||
|
+ca_root_cert_dbs=dbm:$tmpdir/dba
|
||||||
|
+ca_other_root_cert_dbs=,dbm:$tmpdir/dba
|
||||||
|
+ca_other_cert_dbs=,dbm:$tmpdir/dba
|
||||||
|
ca_root_certs=Root Certificate DA
|
||||||
|
-----BEGIN CERTIFICATE-----
|
||||||
|
MIICiDCCAg2gAwIBAgIQNfwmXNmET8k9Jj1Xm67XVjAKBggqhkjOPQQDAzCBhDEL
|
||||||
|
diff --git a/tests/034-perms/expected.out b/tests/034-perms/expected.out
|
||||||
|
index 4e2fbd71..c062d409 100644
|
||||||
|
--- a/tests/034-perms/expected.out
|
||||||
|
+++ b/tests/034-perms/expected.out
|
||||||
|
@@ -41,54 +41,54 @@ $owner:$group|0755|ee.key.MARKER.key
|
||||||
|
$owner:$group|0662|ee.crt
|
||||||
|
$owner:$group|0620|ee.key
|
||||||
|
|
||||||
|
-[start]
|
||||||
|
-[keygen]
|
||||||
|
+[dbm:start]
|
||||||
|
+[dbm:keygen]
|
||||||
|
$owner:$group|0600|cert8.db
|
||||||
|
$owner:$group|0620|key3.db
|
||||||
|
-[reset]
|
||||||
|
+[dbm:reset]
|
||||||
|
$owner:$group|0755|cert8.db
|
||||||
|
$owner:$group|0755|key3.db
|
||||||
|
-[csrgen]
|
||||||
|
+[dbm:csrgen]
|
||||||
|
$owner:$group|0755|cert8.db
|
||||||
|
$owner:$group|0620|key3.db
|
||||||
|
-[reset]
|
||||||
|
+[dbm:reset]
|
||||||
|
$owner:$group|0755|cert8.db
|
||||||
|
$owner:$group|0755|key3.db
|
||||||
|
-[submit]
|
||||||
|
+[dbm:submit]
|
||||||
|
$owner:$group|0755|cert8.db
|
||||||
|
$owner:$group|0755|key3.db
|
||||||
|
-[reset]
|
||||||
|
+[dbm:reset]
|
||||||
|
$owner:$group|0755|cert8.db
|
||||||
|
$owner:$group|0755|key3.db
|
||||||
|
-[save]
|
||||||
|
+[dbm:save]
|
||||||
|
$owner:$group|0662|cert8.db
|
||||||
|
$owner:$group|0620|key3.db
|
||||||
|
-[rekey:start]
|
||||||
|
-[rekey:keygen]
|
||||||
|
+[rekey:dbm:start]
|
||||||
|
+[rekey:dbm:keygen]
|
||||||
|
$owner:$group|0600|cert8.db
|
||||||
|
$owner:$group|0620|key3.db
|
||||||
|
-[rekey:reset]
|
||||||
|
+[rekey:dbm:reset]
|
||||||
|
$owner:$group|0755|cert8.db
|
||||||
|
$owner:$group|0755|key3.db
|
||||||
|
-[rekey:keygen]
|
||||||
|
+[rekey:dbm:keygen]
|
||||||
|
$owner:$group|0755|cert8.db
|
||||||
|
$owner:$group|0620|key3.db
|
||||||
|
-[rekey:reset]
|
||||||
|
+[rekey:dbm:reset]
|
||||||
|
$owner:$group|0755|cert8.db
|
||||||
|
$owner:$group|0755|key3.db
|
||||||
|
-[rekey:csrgen]
|
||||||
|
+[rekey:dbm:csrgen]
|
||||||
|
$owner:$group|0755|cert8.db
|
||||||
|
$owner:$group|0620|key3.db
|
||||||
|
-[rekey:reset]
|
||||||
|
+[rekey:dbm:reset]
|
||||||
|
$owner:$group|0755|cert8.db
|
||||||
|
$owner:$group|0755|key3.db
|
||||||
|
-[rekey:submit]
|
||||||
|
+[rekey:dbm:submit]
|
||||||
|
$owner:$group|0755|cert8.db
|
||||||
|
$owner:$group|0755|key3.db
|
||||||
|
-[rekey:reset]
|
||||||
|
+[rekey:dbm:reset]
|
||||||
|
$owner:$group|0755|cert8.db
|
||||||
|
$owner:$group|0755|key3.db
|
||||||
|
-[rekey:save]
|
||||||
|
+[rekey:dbm:save]
|
||||||
|
$owner:$group|0662|cert8.db
|
||||||
|
$owner:$group|0620|key3.db
|
||||||
|
OK
|
||||||
|
diff --git a/tests/034-perms/run.sh b/tests/034-perms/run.sh
|
||||||
|
index 7f349d3b..88eae19f 100755
|
||||||
|
--- a/tests/034-perms/run.sh
|
||||||
|
+++ b/tests/034-perms/run.sh
|
||||||
|
@@ -1,6 +1,8 @@
|
||||||
|
#!/bin/bash
|
||||||
|
cd "$tmpdir"
|
||||||
|
|
||||||
|
+scheme="${scheme:-dbm:}"
|
||||||
|
+
|
||||||
|
function list() {
|
||||||
|
$toolsdir/ls *.* | sed -e "s~^$owner:$group|~\$owner:\$group|~g"
|
||||||
|
}
|
||||||
|
--
|
||||||
|
2.15.1
|
||||||
|
|
||||||
@ -0,0 +1,48 @@
|
|||||||
|
From 19d70d9817a5d22d05ff990f354ddadb77cc05a6 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Rob Crittenden <rcritten@redhat.com>
|
||||||
|
Date: Tue, 9 Jan 2018 22:18:58 -0500
|
||||||
|
Subject: [PATCH 4/6] Workaround NSS bug in associating private key to
|
||||||
|
certificate
|
||||||
|
|
||||||
|
If NSS uses SQL DB storage, CERT_ImportCerts creates incomplete
|
||||||
|
internal state (the cert isn't associated with the private key,
|
||||||
|
and calling PK11_FindKeyByAnyCert returns no result).
|
||||||
|
|
||||||
|
As a workaround, we import the cert again using PK11_ImportCert
|
||||||
|
which magically fixes the issue.
|
||||||
|
|
||||||
|
See rhbz#1532188
|
||||||
|
|
||||||
|
Related: https://pagure.io/certmonger/issue/88
|
||||||
|
---
|
||||||
|
src/certsave-n.c | 14 ++++++++++++++
|
||||||
|
1 file changed, 14 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/src/certsave-n.c b/src/certsave-n.c
|
||||||
|
index a2c97000..8e15a18a 100644
|
||||||
|
--- a/src/certsave-n.c
|
||||||
|
+++ b/src/certsave-n.c
|
||||||
|
@@ -474,6 +474,20 @@ cm_certsave_n_main(int fd, struct cm_store_ca *ca, struct cm_store_entry *entry,
|
||||||
|
PR_FALSE,
|
||||||
|
entry->cm_cert_nickname);
|
||||||
|
ec = PORT_GetError();
|
||||||
|
+ if (error == SECSuccess) {
|
||||||
|
+ /* If NSS uses SQL DB storage, CERT_ImportCerts creates
|
||||||
|
+ * an incomplete internal state (the cert isn't
|
||||||
|
+ * associated with the private key, and calling
|
||||||
|
+ * PK11_FindKeyByAnyCert returns no result).
|
||||||
|
+ * As a workaround, we import the cert again using
|
||||||
|
+ * PK11_ImportCert, which magically fixes the issue.
|
||||||
|
+ * See rhbz#1532188 */
|
||||||
|
+ error = PK11_ImportCert(PK11_GetInternalKeySlot(),
|
||||||
|
+ returned[0],
|
||||||
|
+ CK_INVALID_HANDLE,
|
||||||
|
+ returned[0]->nickname,
|
||||||
|
+ PR_FALSE);
|
||||||
|
+ }
|
||||||
|
if (error == SECSuccess) {
|
||||||
|
cm_log(1, "Imported certificate \"%s\", got "
|
||||||
|
"nickname \"%s\".\n",
|
||||||
|
--
|
||||||
|
2.15.1
|
||||||
|
|
||||||
314
0005-Run-key-generation-tests-against-both-dbm-and-sqlite.patch
Normal file
314
0005-Run-key-generation-tests-against-both-dbm-and-sqlite.patch
Normal file
@ -0,0 +1,314 @@
|
|||||||
|
From 920572235f82eb3a88a3b8dd274f809baee31c67 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Rob Crittenden <rcritten@redhat.com>
|
||||||
|
Date: Tue, 9 Jan 2018 22:54:06 -0500
|
||||||
|
Subject: [PATCH 5/6] Run key generation tests against both dbm and sqlite
|
||||||
|
databases
|
||||||
|
|
||||||
|
Related: https://pagure.io/certmonger/issue/88
|
||||||
|
---
|
||||||
|
tests/002-keygen-dbm/expected.out | 99 +++++++++++++++++++++++++++++++++++++++
|
||||||
|
tests/002-keygen-dbm/run.sh | 2 +
|
||||||
|
tests/002-keygen-sql/expected.out | 99 +++++++++++++++++++++++++++++++++++++++
|
||||||
|
tests/002-keygen-sql/run.sh | 2 +
|
||||||
|
tests/002-keygen/expected.out | 4 +-
|
||||||
|
tests/002-keygen/run.sh | 12 +++--
|
||||||
|
6 files changed, 211 insertions(+), 7 deletions(-)
|
||||||
|
create mode 100644 tests/002-keygen-dbm/expected.out
|
||||||
|
create mode 100755 tests/002-keygen-dbm/run.sh
|
||||||
|
create mode 100644 tests/002-keygen-sql/expected.out
|
||||||
|
create mode 100755 tests/002-keygen-sql/run.sh
|
||||||
|
|
||||||
|
diff --git a/tests/002-keygen-dbm/expected.out b/tests/002-keygen-dbm/expected.out
|
||||||
|
new file mode 100644
|
||||||
|
index 00000000..dcd1af06
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/tests/002-keygen-dbm/expected.out
|
||||||
|
@@ -0,0 +1,99 @@
|
||||||
|
+[nss:1024]
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:1024).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:1024 after RSA:1024).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:1024 after RSA:1024).
|
||||||
|
+keyi1024
|
||||||
|
+keyi1024 (candidate (next))
|
||||||
|
+[nss:1536]
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:1536).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:1536 after RSA:1536).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:1536 after RSA:1536).
|
||||||
|
+keyi1536
|
||||||
|
+keyi1536 (candidate (next))
|
||||||
|
+[nss:2048]
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:2048).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:2048 after RSA:2048).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:2048 after RSA:2048).
|
||||||
|
+keyi2048
|
||||||
|
+keyi2048 (candidate (next))
|
||||||
|
+[nss:3072]
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:3072).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:3072 after RSA:3072).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:3072 after RSA:3072).
|
||||||
|
+keyi3072
|
||||||
|
+keyi3072 (candidate (next))
|
||||||
|
+[nss:4096]
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:4096).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:4096 after RSA:4096).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:4096 after RSA:4096).
|
||||||
|
+keyi4096
|
||||||
|
+keyi4096 (candidate (next))
|
||||||
|
+[nss:rosubdir]
|
||||||
|
+Failed to save NSS:dbm:${tmpdir}/rosubdir: need fs permissions.
|
||||||
|
+[nss:rwsubdir]
|
||||||
|
+Failed to save NSS:dbm:${tmpdir}/rwsubdir: need fs permissions.
|
||||||
|
+[openssl:1024]
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:1024).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:1024 after RSA:1024).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:1024 after RSA:1024).
|
||||||
|
+${tmpdir}/sample.1024
|
||||||
|
+${tmpdir}/sample.1024.(next).key
|
||||||
|
+[openssl:1536]
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:1536).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:1536 after RSA:1536).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:1536 after RSA:1536).
|
||||||
|
+${tmpdir}/sample.1536
|
||||||
|
+${tmpdir}/sample.1536.(next).key
|
||||||
|
+[openssl:2048]
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:2048).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:2048 after RSA:2048).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:2048 after RSA:2048).
|
||||||
|
+${tmpdir}/sample.2048
|
||||||
|
+${tmpdir}/sample.2048.(next).key
|
||||||
|
+[openssl:3072]
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:3072).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:3072 after RSA:3072).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:3072 after RSA:3072).
|
||||||
|
+${tmpdir}/sample.3072
|
||||||
|
+${tmpdir}/sample.3072.(next).key
|
||||||
|
+[openssl:4096]
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:4096).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:4096 after RSA:4096).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:4096 after RSA:4096).
|
||||||
|
+${tmpdir}/sample.4096
|
||||||
|
+${tmpdir}/sample.4096.(next).key
|
||||||
|
+[openssl:rosubdir]
|
||||||
|
+Failed to save FILE:${tmpdir}/rosubdir/sample.4096: need fs permissions.
|
||||||
|
+[openssl:rwsubdir]
|
||||||
|
+Failed to save FILE:${tmpdir}/rwsubdir/sample.4096: need fs permissions.
|
||||||
|
+Test complete.
|
||||||
|
diff --git a/tests/002-keygen-dbm/run.sh b/tests/002-keygen-dbm/run.sh
|
||||||
|
new file mode 100755
|
||||||
|
index 00000000..36323947
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/tests/002-keygen-dbm/run.sh
|
||||||
|
@@ -0,0 +1,2 @@
|
||||||
|
+#!/bin/bash -e
|
||||||
|
+exec env scheme=dbm: ../002-keygen/run.sh
|
||||||
|
diff --git a/tests/002-keygen-sql/expected.out b/tests/002-keygen-sql/expected.out
|
||||||
|
new file mode 100644
|
||||||
|
index 00000000..178f1b3a
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/tests/002-keygen-sql/expected.out
|
||||||
|
@@ -0,0 +1,99 @@
|
||||||
|
+[nss:1024]
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:1024).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:1024 after RSA:1024).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:1024 after RSA:1024).
|
||||||
|
+keyi1024
|
||||||
|
+keyi1024 (candidate (next))
|
||||||
|
+[nss:1536]
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:1536).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:1536 after RSA:1536).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:1536 after RSA:1536).
|
||||||
|
+keyi1536
|
||||||
|
+keyi1536 (candidate (next))
|
||||||
|
+[nss:2048]
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:2048).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:2048 after RSA:2048).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:2048 after RSA:2048).
|
||||||
|
+keyi2048
|
||||||
|
+keyi2048 (candidate (next))
|
||||||
|
+[nss:3072]
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:3072).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:3072 after RSA:3072).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:3072 after RSA:3072).
|
||||||
|
+keyi3072
|
||||||
|
+keyi3072 (candidate (next))
|
||||||
|
+[nss:4096]
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:4096).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:4096 after RSA:4096).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:4096 after RSA:4096).
|
||||||
|
+keyi4096
|
||||||
|
+keyi4096 (candidate (next))
|
||||||
|
+[nss:rosubdir]
|
||||||
|
+Failed to save NSS:sql:${tmpdir}/rosubdir: need fs permissions.
|
||||||
|
+[nss:rwsubdir]
|
||||||
|
+Failed to save NSS:sql:${tmpdir}/rwsubdir: need fs permissions.
|
||||||
|
+[openssl:1024]
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:1024).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:1024 after RSA:1024).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:1024 after RSA:1024).
|
||||||
|
+${tmpdir}/sample.1024
|
||||||
|
+${tmpdir}/sample.1024.(next).key
|
||||||
|
+[openssl:1536]
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:1536).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:1536 after RSA:1536).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:1536 after RSA:1536).
|
||||||
|
+${tmpdir}/sample.1536
|
||||||
|
+${tmpdir}/sample.1536.(next).key
|
||||||
|
+[openssl:2048]
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:2048).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:2048 after RSA:2048).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:2048 after RSA:2048).
|
||||||
|
+${tmpdir}/sample.2048
|
||||||
|
+${tmpdir}/sample.2048.(next).key
|
||||||
|
+[openssl:3072]
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:3072).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:3072 after RSA:3072).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:3072 after RSA:3072).
|
||||||
|
+${tmpdir}/sample.3072
|
||||||
|
+${tmpdir}/sample.3072.(next).key
|
||||||
|
+[openssl:4096]
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:4096).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:4096 after RSA:4096).
|
||||||
|
+OK.
|
||||||
|
+OK (RSA:4096 after RSA:4096).
|
||||||
|
+${tmpdir}/sample.4096
|
||||||
|
+${tmpdir}/sample.4096.(next).key
|
||||||
|
+[openssl:rosubdir]
|
||||||
|
+Failed to save FILE:${tmpdir}/rosubdir/sample.4096: need fs permissions.
|
||||||
|
+[openssl:rwsubdir]
|
||||||
|
+Failed to save FILE:${tmpdir}/rwsubdir/sample.4096: need fs permissions.
|
||||||
|
+Test complete.
|
||||||
|
diff --git a/tests/002-keygen-sql/run.sh b/tests/002-keygen-sql/run.sh
|
||||||
|
new file mode 100755
|
||||||
|
index 00000000..cd5bc978
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/tests/002-keygen-sql/run.sh
|
||||||
|
@@ -0,0 +1,2 @@
|
||||||
|
+#!/bin/bash -e
|
||||||
|
+exec env scheme=sql: ../002-keygen/run.sh
|
||||||
|
diff --git a/tests/002-keygen/expected.out b/tests/002-keygen/expected.out
|
||||||
|
index ff56372a..dcd1af06 100644
|
||||||
|
--- a/tests/002-keygen/expected.out
|
||||||
|
+++ b/tests/002-keygen/expected.out
|
||||||
|
@@ -44,9 +44,9 @@ OK (RSA:4096 after RSA:4096).
|
||||||
|
keyi4096
|
||||||
|
keyi4096 (candidate (next))
|
||||||
|
[nss:rosubdir]
|
||||||
|
-Failed to save NSS:${tmpdir}/rosubdir: need fs permissions.
|
||||||
|
+Failed to save NSS:dbm:${tmpdir}/rosubdir: need fs permissions.
|
||||||
|
[nss:rwsubdir]
|
||||||
|
-Failed to save NSS:${tmpdir}/rwsubdir: need fs permissions.
|
||||||
|
+Failed to save NSS:dbm:${tmpdir}/rwsubdir: need fs permissions.
|
||||||
|
[openssl:1024]
|
||||||
|
OK.
|
||||||
|
OK (RSA:1024).
|
||||||
|
diff --git a/tests/002-keygen/run.sh b/tests/002-keygen/run.sh
|
||||||
|
index f550feeb..08af1523 100755
|
||||||
|
--- a/tests/002-keygen/run.sh
|
||||||
|
+++ b/tests/002-keygen/run.sh
|
||||||
|
@@ -2,15 +2,17 @@
|
||||||
|
|
||||||
|
cd "$tmpdir"
|
||||||
|
|
||||||
|
+scheme="${scheme:-dbm:}"
|
||||||
|
+
|
||||||
|
source "$srcdir"/functions
|
||||||
|
-initnssdb "$tmpdir"
|
||||||
|
+initnssdb "$scheme$tmpdir"
|
||||||
|
|
||||||
|
for size in 1024 1536 2048 3072 4096 ; do
|
||||||
|
echo "[nss:$size]"
|
||||||
|
# Generate a key.
|
||||||
|
cat > entry.$size <<- EOF
|
||||||
|
key_storage_type=NSSDB
|
||||||
|
- key_storage_location=$tmpdir
|
||||||
|
+ key_storage_location=$scheme$tmpdir
|
||||||
|
key_nickname=keyi$size
|
||||||
|
key_gen_size=$size
|
||||||
|
EOF
|
||||||
|
@@ -28,13 +30,13 @@ for size in 1024 1536 2048 3072 4096 ; do
|
||||||
|
# Extract the marker.
|
||||||
|
marker=`grep ^key_next_marker= entry.$size | cut -f2- -d=`
|
||||||
|
# Make sure we're clean.
|
||||||
|
- run_certutil -K -d "$tmpdir" | grep keyi$size | sed -e 's,.*keyi,keyi,' -e s,"${marker:-////////}","(next)",g | env LANG=C sort
|
||||||
|
+ run_certutil -K -d "$scheme$tmpdir" | grep keyi$size | sed -e 's,.*keyi,keyi,' -e s,"${marker:-////////}","(next)",g | env LANG=C sort
|
||||||
|
done
|
||||||
|
|
||||||
|
echo "[nss:rosubdir]"
|
||||||
|
cat > entry.$size <<- EOF
|
||||||
|
key_storage_type=NSSDB
|
||||||
|
-key_storage_location=$tmpdir/rosubdir
|
||||||
|
+key_storage_location=$scheme$tmpdir/rosubdir
|
||||||
|
key_nickname=keyi$size
|
||||||
|
key_gen_size=$size
|
||||||
|
EOF
|
||||||
|
@@ -43,7 +45,7 @@ $toolsdir/keygen entry.$size || true
|
||||||
|
echo "[nss:rwsubdir]"
|
||||||
|
cat > entry.$size <<- EOF
|
||||||
|
key_storage_type=NSSDB
|
||||||
|
-key_storage_location=$tmpdir/rwsubdir
|
||||||
|
+key_storage_location=$scheme$tmpdir/rwsubdir
|
||||||
|
key_nickname=keyi$size
|
||||||
|
key_gen_size=$size
|
||||||
|
EOF
|
||||||
|
--
|
||||||
|
2.15.1
|
||||||
|
|
||||||
@ -26,7 +26,7 @@
|
|||||||
|
|
||||||
Name: certmonger
|
Name: certmonger
|
||||||
Version: 0.79.5
|
Version: 0.79.5
|
||||||
Release: 2%{?dist}
|
Release: 3%{?dist}
|
||||||
Summary: Certificate status monitor and PKI enrollment client
|
Summary: Certificate status monitor and PKI enrollment client
|
||||||
|
|
||||||
Group: System Environment/Daemons
|
Group: System Environment/Daemons
|
||||||
@ -51,16 +51,15 @@ BuildRequires: libcurl-devel
|
|||||||
BuildRequires: curl-devel
|
BuildRequires: curl-devel
|
||||||
%endif
|
%endif
|
||||||
BuildRequires: libxml2-devel, xmlrpc-c-devel
|
BuildRequires: libxml2-devel, xmlrpc-c-devel
|
||||||
%if 0%{?rhel} < 6
|
%if 0%{?rhel} && 0%{?rhel} < 6
|
||||||
BuildRequires: bind-libbind-devel
|
BuildRequires: bind-libbind-devel
|
||||||
|
BuildRequires: mktemp
|
||||||
%endif
|
%endif
|
||||||
# Required for 'make check':
|
# Required for 'make check':
|
||||||
# for diff and cmp
|
# for diff and cmp
|
||||||
BuildRequires: diffutils
|
BuildRequires: diffutils
|
||||||
# for expect
|
# for expect
|
||||||
BuildRequires: expect
|
BuildRequires: expect
|
||||||
# for mktemp, which was absorbed into coreutils at some point
|
|
||||||
BuildRequires: mktemp
|
|
||||||
# for certutil and pk12util
|
# for certutil and pk12util
|
||||||
BuildRequires: nss-tools
|
BuildRequires: nss-tools
|
||||||
# for openssl
|
# for openssl
|
||||||
@ -108,12 +107,24 @@ Requires(preun): /sbin/chkconfig, /sbin/service, dbus, sed
|
|||||||
Conflicts: libtevent < 0.9.13
|
Conflicts: libtevent < 0.9.13
|
||||||
%endif
|
%endif
|
||||||
|
|
||||||
|
Patch1: 0001-Perm-issues-in-sqlite-databases-show-up-in-slightly-.patch
|
||||||
|
Patch2: 0002-SQLite-databases-require-a-password-to-modify-trust-.patch
|
||||||
|
Patch3: 0003-NSS-in-rawhide-F28-was-switched-to-sqlite-fix-assump.patch
|
||||||
|
Patch4: 0004-Workaround-NSS-bug-in-associating-private-key-to-cer.patch
|
||||||
|
Patch5: 0005-Run-key-generation-tests-against-both-dbm-and-sqlite.patch
|
||||||
|
|
||||||
%description
|
%description
|
||||||
Certmonger is a service which is primarily concerned with getting your
|
Certmonger is a service which is primarily concerned with getting your
|
||||||
system enrolled with a certificate authority (CA) and keeping it enrolled.
|
system enrolled with a certificate authority (CA) and keeping it enrolled.
|
||||||
|
|
||||||
%prep
|
%prep
|
||||||
%setup -q
|
%setup -q
|
||||||
|
%patch1 -p1
|
||||||
|
%patch2 -p1
|
||||||
|
%patch3 -p1
|
||||||
|
%patch4 -p1
|
||||||
|
%patch5 -p1
|
||||||
|
|
||||||
%if 0%{?rhel} > 0
|
%if 0%{?rhel} > 0
|
||||||
# Enabled by default for RHEL for bug #765600, still disabled by default for
|
# Enabled by default for RHEL for bug #765600, still disabled by default for
|
||||||
# Fedora pending a similar bug report there.
|
# Fedora pending a similar bug report there.
|
||||||
@ -243,6 +254,11 @@ exit 0
|
|||||||
%endif
|
%endif
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Wed Jan 10 2018 Rob Crittenden <rcritten@redhat.com> 0.79.5-3
|
||||||
|
- Remove BR on mktemp. It is now provided by coreutils.
|
||||||
|
- Patch to fix NSS handling of keys in sqlite databases
|
||||||
|
- Patches to fix tests now that sqlite is the NSS default.
|
||||||
|
|
||||||
* Wed Oct 4 2017 Rob Crittenden <rcritten@redhat.com> 0.79.5-2
|
* Wed Oct 4 2017 Rob Crittenden <rcritten@redhat.com> 0.79.5-2
|
||||||
- Switch BR from /usr/include/popt.h to popt-devel
|
- Switch BR from /usr/include/popt.h to popt-devel
|
||||||
|
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user