rpms/keylime-agent-rust
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Update to upstream version 0.2.9

Browse Source 
Resolves: RHEL-117122
Resolves: RHEL-131913
Resolves: RHEL-140897
Resolves: RHEL-145711
Resolves: RHEL-149743

Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
This commit is contained in:
Anderson Toshiyuki Sasaki 2026-02-12 21:55:49 +01:00
parent c35112e60f
commit 8999889054
No known key found for this signature in database
11 changed files with 229 additions and 4653 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored
View File

@ -17,3 +17,5 @@
/rust-keylime-0.2.7-vendor.tar.xz
/v0.2.7.tar.gz
/rust-keylime-0.2.7-vendor.tar.zstd
/v0.2.9.tar.gz
/rust-keylime-0.2.9-vendor.tar.zstd

53
rust-keylime-metadata.patch → 0001-rust-keylime-metadata.patch
View File

@ -1,33 +1,32 @@
--- a/keylime/Cargo.toml 2025-01-20 11:19:20.276090741 +0100
+++ b/keylime/Cargo.toml 2025-01-20 11:20:47.574791185 +0100
@@ -24,10 +24,6 @@
picky-asn1-der.workspace = true
picky-asn1-x509.workspace = true
--- a/keylime/Cargo.toml 2026-02-13 09:29:02.000000000 +0100
+++ b/keylime/Cargo.toml 2026-02-13 09:48:22.122618066 +0100
@@ -40,7 +40,6 @@
tokio.workspace = true
-# wiremock was moved to be a regular dependency because optional
-# dev-dependencies are not supported
-# see: https://github.com/rust-lang/cargo/issues/1596
-wiremock = {version = "0.6", optional = true}
uuid.workspace = true
zip.workspace = true
-zmq = {version = "0.9.2", optional = true}
[dev-dependencies]
tempfile.workspace = true
@@ -37,4 +33,4 @@
# This feature enables tests that require a TPM and the TCTI environment
# variable properly configured
# This should change to dev-dependencies when we have integration testing
-testing = ["wiremock"]
+testing = []
--- a/keylime-agent/Cargo.toml 2025-01-20 11:19:40.095022736 +0100
+++ b/keylime-agent/Cargo.toml 2025-01-20 11:21:15.678694751 +0100
@@ -32,7 +32,6 @@
@@ -48,6 +47,5 @@
wiremock = {version = "0.6"}
[features]
+default = []
testing = []
-# This feature is deprecated and will be removed on next major release
-with-zmq = ["zmq"]
--- a/keylime-agent/Cargo.toml 2026-02-13 09:29:02.000000000 +0100
+++ b/keylime-agent/Cargo.toml 2026-02-13 09:48:27.988361994 +0100
@@ -28,7 +28,6 @@
thiserror.workspace = true
uuid.workspace = true
zip.workspace = true
-zmq = {version = "0.9.2", optional = true}
[dev-dependencies]
actix-rt.workspace = true
@@ -41,18 +40,6 @@
@@ -37,18 +36,6 @@
# The features enabled by default
default = []
testing = []
@ -43,6 +42,16 @@
-#
-# This feature is deprecated and will be removed on next major release
-legacy-python-actions = []
[package.metadata.deb]
section = "net"
--- a/keylime-push-model-agent/Cargo.toml 2026-02-13 09:29:02.000000000 +0100
+++ b/keylime-push-model-agent/Cargo.toml 2026-02-13 09:48:36.030812674 +0100
@@ -34,7 +34,6 @@
# The features enabled by default
default = []
testing = ["keylime/testing"]
-legacy-python-actions = []
[package.metadata.deb]
section = "net"

73
0002-rust-keylime-do-not-require-usr-libexec.patch Normal file
View File

@ -0,0 +1,73 @@
diff --git a/keylime/src/config/base.rs b/keylime/src/config/base.rs
index c171c85..d2e889a 100644
--- a/keylime/src/config/base.rs
+++ b/keylime/src/config/base.rs
@@ -625,27 +625,15 @@ pub(crate) fn config_translate_keywords(
});
}
- let actions_dir = match config.revocation_actions_dir.as_ref() {
- "" => {
- error!("The option 'enable_revocation_notifications' is set as 'true' but the revocation actions directory was set as empty in 'revocation_actions_dir'");
- return Err(KeylimeConfigError::IncompatibleOptions {
- option_a: "enable_revocation_notifications".into(),
- value_a: "true".into(),
- option_b: "revocation_actions_dir".into(),
- value_b: "empty".into(),
- });
- }
- dir => Path::new(dir),
+ if config.revocation_actions_dir.is_empty() {
+ error!("The option 'enable_revocation_notifications' is set as 'true' but the revocation actions directory was set as empty in 'revocation_actions_dir'");
+ return Err(KeylimeConfigError::IncompatibleOptions {
+ option_a: "enable_revocation_notifications".into(),
+ value_a: "true".into(),
+ option_b: "revocation_actions_dir".into(),
+ value_b: "empty".into(),
+ });
};
-
- // Validate that the revocation actions directory exists
- let _revocation_actions_dir =
- &actions_dir.canonicalize().map_err(|e| {
- KeylimeConfigError::MissingActionsDir {
- path: keylime_dir.display().to_string(),
- source: e,
- }
- })?;
}
let revocation_cert = config_get_file_path(
@@ -938,32 +926,6 @@ mod tests {
assert!(result.is_ok());
}
- #[test]
- fn test_invalid_revocation_actions_dir() {
- let tempdir = tempfile::tempdir()
- .expect("failed to create temporary directory");
-
- let test_config = AgentConfig {
- keylime_dir: tempdir.path().display().to_string(),
- enable_revocation_notifications: true,
- revocation_actions_dir: "/invalid".to_string(),
- ..Default::default()
- };
- let result = config_translate_keywords(&test_config);
- // Expect error due to the inexistent directory
- assert!(result.is_err());
- let test_config = AgentConfig {
- keylime_dir: tempdir.path().display().to_string(),
- enable_revocation_notifications: false,
- revocation_actions_dir: "/invalid".to_string(),
- ..Default::default()
- };
-
- // Now unset enable_revocation_notifications and check that is allowed
- let result = config_translate_keywords(&test_config);
- assert!(result.is_ok());
- }
-
#[test]
fn test_keylime_dir_option() {
let dir = tempfile::tempdir()

3609
0003-Enable-non-standard-key-sizes-and-curves-for-EK-and-.patch
View File

File diff suppressed because it is too large Load Diff

557
0004-Clippy-fixes.patch
View File

@ -1,557 +0,0 @@
From dc36c72e75c9b3ab36693b59252e3246ef53d5fb Mon Sep 17 00:00:00 2001
From: Sergio Correia <scorreia@redhat.com>
Date: Mon, 29 Sep 2025 22:45:55 +0000
Subject: [PATCH 4/6] Clippy fixes
Signed-off-by: Sergio Correia <scorreia@redhat.com>
---
keylime-agent/src/config.rs | 13 ++++++-------
keylime-agent/src/keys_handler.rs | 4 ++--
keylime-agent/src/main.rs | 10 +++++-----
keylime-agent/src/payloads.rs | 12 ++++++------
keylime-agent/src/permissions.rs | 14 +++++++-------
keylime-agent/src/quotes_handler.rs | 16 ++++++++--------
keylime-agent/src/revocation.rs | 15 +++++++--------
keylime-agent/src/secure_mount.rs | 6 +++---
keylime/src/crypto.rs | 12 ++++++------
keylime/src/ima/entry.rs | 7 +++----
keylime/src/registrar_client.rs | 2 +-
keylime/src/tpm.rs | 14 +++++---------
12 files changed, 59 insertions(+), 66 deletions(-)
diff --git a/keylime-agent/src/config.rs b/keylime-agent/src/config.rs
index 21c0516..f1fe7d1 100644
--- a/keylime-agent/src/config.rs
+++ b/keylime-agent/src/config.rs
@@ -614,8 +614,10 @@ fn config_translate_keywords(
.collect::<Vec<String>>()
.join(", "),
"latest" => {
- if let Some(version) =
- SUPPORTED_API_VERSIONS.iter().map(|&s| s.to_string()).last()
+ if let Some(version) = SUPPORTED_API_VERSIONS
+ .iter()
+ .map(|&s| s.to_string())
+ .next_back()
{
version
} else {
@@ -980,7 +982,7 @@ mod tests {
let expected = SUPPORTED_API_VERSIONS
.iter()
.map(|e| e.to_string())
- .last()
+ .next_back()
.unwrap(); //#[allow_ci]
assert_eq!(version, expected);
}
@@ -1273,10 +1275,7 @@ mod tests {
let j = obtained.get(i).unwrap(); //#[allow_ci]
assert!(
e.to_string() == j.to_string(),
- "Option {} mismatch: expected == '{}', obtained == '{}'",
- i,
- e,
- j
+ "Option {i} mismatch: expected == '{e}', obtained == '{j}'"
);
}
}
diff --git a/keylime-agent/src/keys_handler.rs b/keylime-agent/src/keys_handler.rs
index 447f0d1..a4c9f21 100644
--- a/keylime-agent/src/keys_handler.rs
+++ b/keylime-agent/src/keys_handler.rs
@@ -327,7 +327,7 @@ async fn pubkey(
HttpResponse::Ok().json(response)
}
Err(e) => {
- debug!("Unable to retrieve public key: {:?}", e);
+ debug!("Unable to retrieve public key: {e:?}");
HttpResponse::InternalServerError().json(JsonWrapper::error(
500,
"Unable to retrieve public key".to_string(),
@@ -411,7 +411,7 @@ async fn verify(
HttpResponse::Ok().json(response)
}
Err(e) => {
- warn!("GET key challenge failed: {:?}", e);
+ warn!("GET key challenge failed: {e:?}");
HttpResponse::InternalServerError().json(JsonWrapper::error(
500,
"GET key challenge failed".to_string(),
diff --git a/keylime-agent/src/main.rs b/keylime-agent/src/main.rs
index 9e3d727..be51a21 100644
--- a/keylime-agent/src/main.rs
+++ b/keylime-agent/src/main.rs
@@ -269,7 +269,7 @@ async fn main() -> Result<()> {
config::KeylimeConfigError::Generic(message),
));
}
- info!("Running the service as {}...", user_group);
+ info!("Running the service as {user_group}...");
}
// Parse the configured API versions
@@ -403,7 +403,7 @@ async fn main() -> Result<()> {
}
}
Err(e) => {
- warn!("Could not load agent data: {}", e);
+ warn!("Could not load agent data: {e}");
None
}
}
@@ -442,7 +442,7 @@ async fn main() -> Result<()> {
path => agent_data_new.store(Path::new(&path))?,
}
- info!("Agent UUID: {}", agent_uuid);
+ info!("Agent UUID: {agent_uuid}");
// If using IAK/IDevID is enabled, obtain IAK/IDevID and respective certificates
let mut device_id = if config.agent.enable_iak_idevid {
@@ -595,7 +595,7 @@ async fn main() -> Result<()> {
) {
Ok(t) => Ok(t),
Err(e) => {
- error!("Failed to load trusted CA certificates: {}", e);
+ error!("Failed to load trusted CA certificates: {e}");
Err(e)
}
}?;
@@ -833,7 +833,7 @@ async fn main() -> Result<()> {
Ok(ip_addr) => {
// Add bracket if IPv6, otherwise use as it is
if ip_addr.is_ipv6() {
- format!("[{}]", ip_addr)
+ format!("[{ip_addr}]")
} else {
ip_addr.to_string()
}
diff --git a/keylime-agent/src/payloads.rs b/keylime-agent/src/payloads.rs
index 3b8873d..8996a5e 100644
--- a/keylime-agent/src/payloads.rs
+++ b/keylime-agent/src/payloads.rs
@@ -109,14 +109,14 @@ fn write_out_key_and_payload(
if bytes != key.as_ref().len() {
return Err(Error::Other(format!("Error writing symm key to {:?}: key len is {}, but {bytes} bytes were written", key_path, key.as_ref().len())));
}
- info!("Wrote payload decryption key to {:?}", key_path);
+ info!("Wrote payload decryption key to {key_path:?}");
let mut dec_payload_file = fs::File::create(dec_payload_path)?;
let bytes = dec_payload_file.write(dec_payload)?;
if bytes != dec_payload.len() {
return Err(Error::Other(format!("Error writing decrypted payload to {:?}: payload len is {}, but {bytes} bytes were written", dec_payload_path, dec_payload.len())));
}
- info!("Wrote decrypted payload to {:?}", dec_payload_path);
+ info!("Wrote decrypted payload to {dec_payload_path:?}");
Ok(())
}
@@ -124,7 +124,7 @@ fn write_out_key_and_payload(
// run a script (such as the init script, if any) and check the status
fn run(dir: &Path, script: &str) -> Result<()> {
let script_path = dir.join(script);
- info!("Running script: {:?}", script_path);
+ info!("Running script: {script_path:?}");
if !script_path.exists() {
info!("No payload script {script} found in {}", dir.display());
@@ -176,7 +176,7 @@ fn optional_unzip_payload(
dec_file => {
let zipped_payload_path = unzipped.join(dec_file);
- info!("Unzipping payload {} to {:?}", dec_file, unzipped);
+ info!("Unzipping payload {dec_file} to {unzipped:?}");
let mut source = fs::File::open(zipped_payload_path)?;
let mut zip = ZipArchive::new(source)?;
@@ -215,7 +215,7 @@ async fn run_encrypted_payload(
info!("No payload script specified, skipping");
}
script => {
- info!("Payload init script indicated: {}", script);
+ info!("Payload init script indicated: {script}");
run(&unzipped, script)?;
}
}
@@ -304,7 +304,7 @@ pub(crate) async fn worker(
info!("Successfully executed encrypted payload");
}
Err(e) => {
- warn!("Failed to run encrypted payload: {}", e);
+ warn!("Failed to run encrypted payload: {e}");
}
}
}
diff --git a/keylime-agent/src/permissions.rs b/keylime-agent/src/permissions.rs
index aa240d9..4b8ac9a 100644
--- a/keylime-agent/src/permissions.rs
+++ b/keylime-agent/src/permissions.rs
@@ -38,7 +38,7 @@ impl TryFrom<&str> for UserIds {
if parts.len() != 2 {
let e = format!("Invalid parameter format: {value} cannot be parsed as 'user:group'");
- error!("{}", e);
+ error!("{e}");
return Err(Error::Conversion(e));
}
@@ -50,7 +50,7 @@ impl TryFrom<&str> for UserIds {
let p = unsafe { libc::getgrnam(g_cstr.as_ptr()) };
if p.is_null() {
let e = io::Error::last_os_error();
- error!("Could not get group {}: {}", group, e);
+ error!("Could not get group {group}: {e}");
return Err(Error::Conversion(e.to_string()));
}
unsafe { (*p) }
@@ -65,7 +65,7 @@ impl TryFrom<&str> for UserIds {
let p = unsafe { libc::getpwnam(u_cstr.as_ptr()) };
if p.is_null() {
let e = io::Error::last_os_error();
- error!("Could not get user {}: {}", user, e);
+ error!("Could not get user {user}: {e}");
return Err(Error::Conversion(e.to_string()));
}
unsafe { (*p) }
@@ -91,7 +91,7 @@ pub(crate) fn run_as(user_group: &str) -> Result<()> {
// Set gid
if unsafe { libc::setgid(ids.group.gr_gid) } != 0 {
let e = io::Error::last_os_error();
- error!("Could not set group id: {}", e);
+ error!("Could not set group id: {e}");
return Err(Error::Permission);
}
@@ -127,18 +127,18 @@ pub(crate) fn run_as(user_group: &str) -> Result<()> {
if unsafe { libc::setgroups(ngroups as usize, sup_groups.as_ptr()) } != 0
{
let e = io::Error::last_os_error();
- error!("Could not set supplementary groups: {}", e);
+ error!("Could not set supplementary groups: {e}");
return Err(Error::Permission);
}
// Set uid
if unsafe { libc::setuid(ids.passwd.pw_uid) } != 0 {
let e = io::Error::last_os_error();
- error!("Could not set user id: {}", e);
+ error!("Could not set user id: {e}");
return Err(Error::Permission);
}
- info!("Dropped privileges to run as {}", user_group);
+ info!("Dropped privileges to run as {user_group}");
Ok(())
}
diff --git a/keylime-agent/src/quotes_handler.rs b/keylime-agent/src/quotes_handler.rs
index a49dcc4..d61adf2 100644
--- a/keylime-agent/src/quotes_handler.rs
+++ b/keylime-agent/src/quotes_handler.rs
@@ -95,7 +95,7 @@ async fn identity(
) {
Ok(quote) => quote,
Err(e) => {
- debug!("Unable to retrieve quote: {:?}", e);
+ debug!("Unable to retrieve quote: {e:?}");
return HttpResponse::InternalServerError().json(
JsonWrapper::error(
500,
@@ -116,7 +116,7 @@ async fn identity(
match crypto::pkey_pub_to_pem(&data.pub_key) {
Ok(pubkey) => quote.pubkey = Some(pubkey),
Err(e) => {
- debug!("Unable to retrieve public key for quote: {:?}", e);
+ debug!("Unable to retrieve public key for quote: {e:?}");
return HttpResponse::InternalServerError().json(
JsonWrapper::error(
500,
@@ -193,7 +193,7 @@ async fn integrity(
let pubkey = match crypto::pkey_pub_to_pem(&data.pub_key) {
Ok(pubkey) => pubkey,
Err(e) => {
- debug!("Unable to retrieve public key: {:?}", e);
+ debug!("Unable to retrieve public key: {e:?}");
return HttpResponse::InternalServerError().json(
JsonWrapper::error(
500,
@@ -242,7 +242,7 @@ async fn integrity(
) {
Ok(tpm_quote) => tpm_quote,
Err(e) => {
- debug!("Unable to retrieve quote: {:?}", e);
+ debug!("Unable to retrieve quote: {e:?}");
return HttpResponse::InternalServerError().json(
JsonWrapper::error(
500,
@@ -268,7 +268,7 @@ async fn integrity(
let mut ml = Vec::<u8>::new();
let mut f = measuredboot_ml_file.lock().unwrap(); //#[allow_ci]
if let Err(e) = f.rewind() {
- debug!("Failed to rewind measured boot file: {}", e);
+ debug!("Failed to rewind measured boot file: {e}");
return HttpResponse::InternalServerError().json(
JsonWrapper::error(
500,
@@ -279,14 +279,14 @@ async fn integrity(
mb_measurement_list = match f.read_to_end(&mut ml) {
Ok(_) => Some(general_purpose::STANDARD.encode(ml)),
Err(e) => {
- warn!("Could not read TPM2 event log: {}", e);
+ warn!("Could not read TPM2 event log: {e}");
None
}
};
}
}
Err(e) => {
- debug!("Unable to check PCR mask: {:?}", e);
+ debug!("Unable to check PCR mask: {e:?}");
return HttpResponse::InternalServerError().json(
JsonWrapper::error(
500,
@@ -309,7 +309,7 @@ async fn integrity(
(Some(result.0), Some(result.1), Some(result.2))
}
Err(e) => {
- debug!("Unable to read measurement list: {:?}", e);
+ debug!("Unable to read measurement list: {e:?}");
return HttpResponse::InternalServerError().json(
JsonWrapper::error(
500,
diff --git a/keylime-agent/src/revocation.rs b/keylime-agent/src/revocation.rs
index fae5a9c..738c12a 100644
--- a/keylime-agent/src/revocation.rs
+++ b/keylime-agent/src/revocation.rs
@@ -124,7 +124,7 @@ pub(crate) fn run_action(
allow_payload_actions,
)?;
- info!("Executing revocation action {}", action);
+ info!("Executing revocation action {action}");
// Write JSON argument to a temporary file
let raw_json = serde_json::value::to_raw_value(&json)?;
@@ -171,7 +171,7 @@ pub(crate) fn run_action(
return Err(output.try_into()?);
}
- info!("INFO: revocation action {} successful", action);
+ info!("INFO: revocation action {action} successful");
Ok(output)
}
@@ -233,7 +233,7 @@ fn run_revocation_actions(
let msg = format!(
"error executing revocation script {action}: {e:?}"
);
- error!("{}", msg);
+ error!("{msg}");
return Err(Error::Script(
action.to_string(),
e.exe_code()?,
@@ -273,8 +273,7 @@ fn process_revocation(
let msg_payload: Value = serde_json::from_str(msg)?;
debug!(
- "Revocation signature validated for revocation: {}",
- msg_payload
+ "Revocation signature validated for revocation: {msg_payload}"
);
let outputs = run_revocation_actions(
@@ -289,11 +288,11 @@ fn process_revocation(
for output in outputs {
if !output.stdout.is_empty() {
let out = String::from_utf8(output.stdout)?;
- info!("Action stdout: {}", out);
+ info!("Action stdout: {out}");
}
if !output.stderr.is_empty() {
let out = String::from_utf8(output.stderr)?;
- warn!("Action stderr: {}", out);
+ warn!("Action stderr: {out}");
}
}
Ok(())
@@ -476,7 +475,7 @@ pub(crate) async fn worker(
info!("Revocation processed successfully");
}
Err(e) => {
- error!("Failed to process revocation: {}", e);
+ error!("Failed to process revocation: {e}");
}
}
}
diff --git a/keylime-agent/src/secure_mount.rs b/keylime-agent/src/secure_mount.rs
index 573d0c9..435fdfc 100644
--- a/keylime-agent/src/secure_mount.rs
+++ b/keylime-agent/src/secure_mount.rs
@@ -47,7 +47,7 @@ fn check_mount(secure_dir: &Path) -> Result<bool> {
return Ok(true);
} else {
let message = format!("Secure storage location {} already mounted on wrong file system type: {}. Unmount to continue.", secure_dir.display(), fs_type);
- error!("Secure mount error: {}", message);
+ error!("Secure mount error: {message}");
return Err(Error::SecureMount(message));
}
} else {
@@ -65,7 +65,7 @@ fn check_mount(secure_dir: &Path) -> Result<bool> {
let message =
"Mount information parsing error: not enough elements"
.to_string();
- error!("Secure mount error: {}", message);
+ error!("Secure mount error: {message}");
return Err(Error::SecureMount(message));
}
}
@@ -96,7 +96,7 @@ pub(crate) fn mount(work_dir: &Path, secure_size: &str) -> Result<PathBuf> {
))
})?;
- info!("Directory {:?} created.", secure_dir_path);
+ info!("Directory {secure_dir_path:?} created.");
let metadata = fs::metadata(&secure_dir_path).map_err(|e| {
Error::SecureMount(format!(
"unable to get metadata for secure dir path: {e:?}"
diff --git a/keylime/src/crypto.rs b/keylime/src/crypto.rs
index 5c951b1..19e651f 100644
--- a/keylime/src/crypto.rs
+++ b/keylime/src/crypto.rs
@@ -399,14 +399,14 @@ pub fn check_x509_key(
.map_err(CryptoError::RSAGetPublicKeyError)?
.n()
.to_vec();
- let mut cert_n_str = format!("{:?}", cert_n);
+ let mut cert_n_str = format!("{cert_n:?}");
_ = cert_n_str.pop();
_ = cert_n_str.remove(0);
let key = SubjectPublicKeyInfo::try_from(tpm_key.clone())
.map_err(CryptoError::SubjectPublicKeyInfoFromRSAError)?;
let key_der = picky_asn1_der::to_vec(&key)
.map_err(CryptoError::SubjectPublicKeyInfoToDERError)?;
- let key_der_str = format!("{:?}", key_der);
+ let key_der_str = format!("{key_der:?}");
Ok(key_der_str.contains(&cert_n_str))
}
@@ -418,14 +418,14 @@ pub fn check_x509_key(
.map_err(CryptoError::RSAGetPublicKeyError)?
.n()
.to_vec();
- let mut cert_n_str = format!("{:?}", cert_n);
+ let mut cert_n_str = format!("{cert_n:?}");
_ = cert_n_str.pop();
_ = cert_n_str.remove(0);
let key = SubjectPublicKeyInfo::try_from(tpm_key.clone())
.map_err(CryptoError::SubjectPublicKeyInfoFromRSAError)?;
let key_der = picky_asn1_der::to_vec(&key)
.map_err(CryptoError::SubjectPublicKeyInfoToDERError)?;
- let key_der_str = format!("{:?}", key_der);
+ let key_der_str = format!("{key_der:?}");
Ok(key_der_str.contains(&cert_n_str))
}
@@ -437,14 +437,14 @@ pub fn check_x509_key(
.map_err(CryptoError::PublicKeyGetECCError)?
.public_key_to_der()
.map_err(CryptoError::PublicKeyToDERError)?;
- let mut cert_n_str = format!("{:?}", cert_n);
+ let mut cert_n_str = format!("{cert_n:?}");
_ = cert_n_str.pop();
_ = cert_n_str.remove(0);
let key = SubjectPublicKeyInfo::try_from(tpm_key.clone())
.map_err(CryptoError::SubjectPublicKeyInfoFromECCError)?;
let key_der = picky_asn1_der::to_vec(&key)
.map_err(CryptoError::SubjectPublicKeyInfoToDERError)?;
- let key_der_str = format!("{:?}", key_der);
+ let key_der_str = format!("{key_der:?}");
Ok(key_der_str.contains(&cert_n_str))
}
diff --git a/keylime/src/ima/entry.rs b/keylime/src/ima/entry.rs
index 1168b3c..982afa7 100644
--- a/keylime/src/ima/entry.rs
+++ b/keylime/src/ima/entry.rs
@@ -431,10 +431,9 @@ impl TryFrom<&str> for Entry {
template_hash,
event_data: Box::new(ImaBuf::try_from(event)?),
}),
- template => Err(Error::new(
- ErrorKind::Other,
- format!("unrecognized template \"{template}\"",),
- )),
+ template => Err(Error::other(format!(
+ "unrecognized template \"{template}\"",
+ ))),
}
}
}
diff --git a/keylime/src/registrar_client.rs b/keylime/src/registrar_client.rs
index dcfcd22..e036845 100644
--- a/keylime/src/registrar_client.rs
+++ b/keylime/src/registrar_client.rs
@@ -320,7 +320,7 @@ impl<'a> RegistrarClientBuilder<'a> {
// Try to reach the registrar
let addr = format!("http://{registrar_ip}:{registrar_port}/version");
- info!("Requesting registrar API version to {}", addr);
+ info!("Requesting registrar API version to {addr}");
let resp = reqwest::Client::new()
.get(&addr)
diff --git a/keylime/src/tpm.rs b/keylime/src/tpm.rs
index 8a8c85a..ac23720 100644
--- a/keylime/src/tpm.rs
+++ b/keylime/src/tpm.rs
@@ -1344,7 +1344,7 @@ impl Context<'_> {
let mut pcrs = read_mask(mask)?;
// add pcr16 if it isn't in the vec already
- if !pcrs.iter().any(|&pcr| pcr == PcrSlot::Slot16) {
+ if !pcrs.contains(&PcrSlot::Slot16) {
let mut slot16 = vec![PcrSlot::Slot16];
pcrs.append(&mut slot16);
}
@@ -1838,9 +1838,7 @@ fn check_if_pcr_data_and_attestation_match(
.map_err(|source| TpmError::OpenSSLHasherFinish { source })?;
log::trace!(
- "Attested to PCR digest: {:?}, read PCR digest: {:?}",
- attested_pcr,
- pcr_digest,
+ "Attested to PCR digest: {attested_pcr:?}, read PCR digest: {pcr_digest:?}",
);
Ok(memcmp::eq(attested_pcr, &pcr_digest))
@@ -1884,12 +1882,11 @@ fn perform_quote_and_pcr_read(
}
log::info!(
- "PCR data and attestation data mismatched on attempt {}",
- attempt
+ "PCR data and attestation data mismatched on attempt {attempt}"
);
}
- log::error!("PCR data and attestation data mismatched on all {} attempts, giving up", NUM_ATTESTATION_ATTEMPTS);
+ log::error!("PCR data and attestation data mismatched on all {NUM_ATTESTATION_ATTEMPTS} attempts, giving up");
Err(TpmError::TooManyAttestationMismatches {
attempts: NUM_ATTESTATION_ATTEMPTS,
})
@@ -2128,8 +2125,7 @@ pub mod testing {
// Always 1 PCR digest should follow
if count != 1 {
return Err(TpmError::InvalidRequest(format!(
- "Expected 1 PCR digest, got {}",
- count
+ "Expected 1 PCR digest, got {count}"
)));
}
--
2.47.3

225
0005-tpm-add-policy-auth-for-EK-to-activate-crendential.patch
View File

@ -1,225 +0,0 @@
From d55b898c645d6beeda2952cd798ebfd7f14090a4 Mon Sep 17 00:00:00 2001
From: Sergio Correia <scorreia@redhat.com>
Date: Wed, 17 Sep 2025 11:43:21 +0000
Subject: [PATCH 5/6] tpm: add policy auth for EK to activate crendential
Backport of upstream commit https://github.com/keylime/rust-keylime/commit/88884a5
Signed-off-by: Sergio Correia <scorreia@redhat.com>
---
keylime/src/tpm.rs | 151 +++++++++++++++++++++++++++++++++++----------
1 file changed, 118 insertions(+), 33 deletions(-)
diff --git a/keylime/src/tpm.rs b/keylime/src/tpm.rs
index ac23720..5e27f3a 100644
--- a/keylime/src/tpm.rs
+++ b/keylime/src/tpm.rs
@@ -16,6 +16,9 @@ use std::{
sync::{Arc, Mutex, OnceLock},
};
use thiserror::Error;
+use tss_esapi::handles::SessionHandle;
+use tss_esapi::interface_types::session_handles::PolicySession;
+use tss_esapi::structures::{DigestList, SymmetricDefinition};
use openssl::{
hash::{Hasher, MessageDigest},
@@ -26,9 +29,7 @@ use openssl::{
use tss_esapi::{
abstraction::{
- ak,
- cipher::Cipher,
- ek,
+ ak, ek,
pcr::{read_all, PcrData},
DefaultKey,
},
@@ -40,7 +41,7 @@ use tss_esapi::{
},
handles::{
AuthHandle, KeyHandle, ObjectHandle, PcrHandle, PersistentTpmHandle,
- SessionHandle, TpmHandle,
+ TpmHandle,
},
interface_types::{
algorithm::{AsymmetricAlgorithm, HashingAlgorithm, PublicAlgorithm},
@@ -116,6 +117,47 @@ const IAK_AUTH_POLICY_SHA256: [u8; 32] = [
];
const UNIQUE_IAK: [u8; 3] = [0x49, 0x41, 0x4b];
+// Source: TCG EK Credential Profile for TPM Family 2.0; Level 0 Version 2.5 Revision 2
+// Section B.6
+const POLICY_A_SHA384: [u8; 48] = [
+ 0x8b, 0xbf, 0x22, 0x66, 0x53, 0x7c, 0x17, 0x1c, 0xb5, 0x6e, 0x40, 0x3c,
+ 0x4d, 0xc1, 0xd4, 0xb6, 0x4f, 0x43, 0x26, 0x11, 0xdc, 0x38, 0x6e, 0x6f,
+ 0x53, 0x20, 0x50, 0xc3, 0x27, 0x8c, 0x93, 0x0e, 0x14, 0x3e, 0x8b, 0xb1,
+ 0x13, 0x38, 0x24, 0xcc, 0xb4, 0x31, 0x05, 0x38, 0x71, 0xc6, 0xdb, 0x53,
+];
+const POLICY_A_SHA512: [u8; 64] = [
+ 0x1e, 0x3b, 0x76, 0x50, 0x2c, 0x8a, 0x14, 0x25, 0xaa, 0x0b, 0x7b, 0x3f,
+ 0xc6, 0x46, 0xa1, 0xb0, 0xfa, 0xe0, 0x63, 0xb0, 0x3b, 0x53, 0x68, 0xf9,
+ 0xc4, 0xcd, 0xde, 0xca, 0xff, 0x08, 0x91, 0xdd, 0x68, 0x2b, 0xac, 0x1a,
+ 0x85, 0xd4, 0xd8, 0x32, 0xb7, 0x81, 0xea, 0x45, 0x19, 0x15, 0xde, 0x5f,
+ 0xc5, 0xbf, 0x0d, 0xc4, 0xa1, 0x91, 0x7c, 0xd4, 0x2f, 0xa0, 0x41, 0xe3,
+ 0xf9, 0x98, 0xe0, 0xee,
+];
+const POLICY_A_SM3_256: [u8; 32] = [
+ 0xc6, 0x7f, 0x7d, 0x35, 0xf6, 0x6f, 0x3b, 0xec, 0x13, 0xc8, 0x9f, 0xe8,
+ 0x98, 0x92, 0x1c, 0x65, 0x1b, 0x0c, 0xb5, 0xa3, 0x8a, 0x92, 0x69, 0x0a,
+ 0x62, 0xa4, 0x3c, 0x00, 0x12, 0xe4, 0xfb, 0x8b,
+];
+const POLICY_C_SHA384: [u8; 48] = [
+ 0xd6, 0x03, 0x2c, 0xe6, 0x1f, 0x2f, 0xb3, 0xc2, 0x40, 0xeb, 0x3c, 0xf6,
+ 0xa3, 0x32, 0x37, 0xef, 0x2b, 0x6a, 0x16, 0xf4, 0x29, 0x3c, 0x22, 0xb4,
+ 0x55, 0xe2, 0x61, 0xcf, 0xfd, 0x21, 0x7a, 0xd5, 0xb4, 0x94, 0x7c, 0x2d,
+ 0x73, 0xe6, 0x30, 0x05, 0xee, 0xd2, 0xdc, 0x2b, 0x35, 0x93, 0xd1, 0x65,
+];
+const POLICY_C_SHA512: [u8; 64] = [
+ 0x58, 0x9e, 0xe1, 0xe1, 0x46, 0x54, 0x47, 0x16, 0xe8, 0xde, 0xaf, 0xe6,
+ 0xdb, 0x24, 0x7b, 0x01, 0xb8, 0x1e, 0x9f, 0x9c, 0x7d, 0xd1, 0x6b, 0x81,
+ 0x4a, 0xa1, 0x59, 0x13, 0x87, 0x49, 0x10, 0x5f, 0xba, 0x53, 0x88, 0xdd,
+ 0x1d, 0xea, 0x70, 0x2f, 0x35, 0x24, 0x0c, 0x18, 0x49, 0x33, 0x12, 0x1e,
+ 0x2c, 0x61, 0xb8, 0xf5, 0x0d, 0x3e, 0xf9, 0x13, 0x93, 0xa4, 0x9a, 0x38,
+ 0xc3, 0xf7, 0x3f, 0xc8,
+];
+const POLICY_C_SM3_256: [u8; 32] = [
+ 0x2d, 0x4e, 0x81, 0x57, 0x8c, 0x35, 0x31, 0xd9, 0xbd, 0x1c, 0xdd, 0x7d,
+ 0x02, 0xba, 0x29, 0x8d, 0x56, 0x99, 0xa3, 0xe3, 0x9f, 0xc3, 0x55, 0x1b,
+ 0xfe, 0xff, 0xcf, 0x13, 0x2b, 0x49, 0xe1, 0x1d,
+];
+
/// TpmError wraps all possible errors raised in tpm.rs
#[derive(Error, Debug)]
pub enum TpmError {
@@ -1215,19 +1257,14 @@ impl Context<'_> {
/// Creates an empty authentication session
fn create_empty_session(
&mut self,
+ ctx: &mut tss_esapi::Context,
ses_type: SessionType,
+ symmetric: SymmetricDefinition,
+ hash_alg: HashingAlgorithm,
) -> Result<AuthSession> {
- let mut ctx = self.inner.lock().unwrap(); //#[allow_ci]
let Some(session) = ctx
.start_auth_session(
- None,
- None,
- None,
- ses_type,
- Cipher::aes_128_cfb().try_into().map_err(|source| {
- TpmError::TSSSymmetricDefinitionFromCipher { source }
- })?,
- HashingAlgorithm::Sha256,
+ None, None, None, ses_type, symmetric, hash_alg,
)
.map_err(|source| {
TpmError::TSSStartAuthenticationSessionError { source }
@@ -1255,35 +1292,83 @@ impl Context<'_> {
ak: KeyHandle,
ek: KeyHandle,
) -> Result<Digest> {
- let (credential, secret) = parse_cred_and_secret(keyblob)?;
-
- let ek_auth = self.create_empty_session(SessionType::Policy)?;
-
let mut ctx = self.inner.lock().unwrap(); //#[allow_ci]
- // We authorize ses2 with PolicySecret(ENDORSEMENT) as per PolicyA
- let _ = ctx.execute_with_nullauth_session(|context| {
- context.policy_secret(
- ek_auth.try_into()?,
- AuthHandle::Endorsement,
- Default::default(),
- Default::default(),
- Default::default(),
- None,
- )
- })?;
+ let (credential, secret) = parse_cred_and_secret(keyblob)?;
+ let mut policy_digests = DigestList::new();
+ let (parent_public, _, _) = ctx.read_public(ek)?;
+ let ek_hash_alg = parent_public.name_hashing_algorithm();
+ let ek_symmetric =
+ parent_public.symmetric_algorithm().ok_or_else(|| {
+ TpmError::TSSReadPublicError {
+ source: tss_esapi::Error::WrapperError(
+ tss_esapi::WrapperErrorKind::InvalidParam,
+ ),
+ }
+ })?;
+ match ek_hash_alg {
+ HashingAlgorithm::Sha384 => {
+ policy_digests
+ .add(Digest::try_from(POLICY_A_SHA384.as_slice())?)?;
+ policy_digests
+ .add(Digest::try_from(POLICY_C_SHA384.as_slice())?)?;
+ }
+ HashingAlgorithm::Sha512 => {
+ policy_digests
+ .add(Digest::try_from(POLICY_A_SHA512.as_slice())?)?;
+ policy_digests
+ .add(Digest::try_from(POLICY_C_SHA512.as_slice())?)?;
+ }
+ HashingAlgorithm::Sm3_256 => {
+ policy_digests
+ .add(Digest::try_from(POLICY_A_SM3_256.as_slice())?)?;
+ policy_digests
+ .add(Digest::try_from(POLICY_C_SM3_256.as_slice())?)?;
+ }
+ _ => (),
+ };
+
+ let ek_auth = self.create_empty_session(
+ &mut ctx,
+ SessionType::Policy,
+ ek_symmetric.into(),
+ ek_hash_alg,
+ )?;
+ // We authorize session according to the EK profile spec
let result = ctx
- .execute_with_sessions(
- (Some(AuthSession::Password), Some(ek_auth), None),
- |context| {
- context.activate_credential(ak, ek, credential, secret)
+ .execute_with_temporary_object(
+ SessionHandle::from(ek_auth).into(),
+ |ctx, _| {
+ let _ = ctx.execute_with_nullauth_session(|ctx| {
+ ctx.policy_secret(
+ PolicySession::try_from(ek_auth)?,
+ AuthHandle::Endorsement,
+ Default::default(),
+ Default::default(),
+ Default::default(),
+ None,
+ )
+ })?;
+ if !policy_digests.is_empty() {
+ ctx.policy_or(
+ PolicySession::try_from(ek_auth)?,
+ policy_digests,
+ )?
+ }
+ ctx.execute_with_sessions(
+ (Some(AuthSession::Password), Some(ek_auth), None),
+ |ctx| {
+ ctx.activate_credential(
+ ak, ek, credential, secret,
+ )
+ },
+ )
},
)
.map_err(TpmError::from);
// Clear sessions after use
- ctx.flush_context(SessionHandle::from(ek_auth).into())?;
ctx.clear_sessions();
result
--
2.47.3

28
0006-keylime-agent.conf-add-all-accepted-TPM-encryption-a.patch
View File

@ -1,28 +0,0 @@
From 2542812cf92ef35c71734694599dfb3aab9fdabd Mon Sep 17 00:00:00 2001
From: Sergio Correia <scorreia@redhat.com>
Date: Wed, 17 Sep 2025 12:45:54 +0100
Subject: [PATCH 6/6] keylime-agent.conf: add all accepted TPM encryption algs
Backported from upstream commit https://github.com/keylime/rust-keylime/commit/a99bb40
Signed-off-by: Sergio Correia <scorreia@redhat.com>
---
keylime-agent.conf | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/keylime-agent.conf b/keylime-agent.conf
index 71f6096..7669604 100644
--- a/keylime-agent.conf
+++ b/keylime-agent.conf
@@ -217,7 +217,7 @@ allow_payload_revocation_actions = true
#
# Currently accepted values include:
# - hashing: sha512, sha384, sha256 or sha1
-# - encryption: ecc or rsa
+# - encryption: rsa (alias for rsa2048), rsa1024, rsa2048, rsa3072, rsa4096, ecc (alias for ecc256), ecc192, ecc224, ecc256, ecc384, ecc521 or ecc_sm2.
# - signing: rsassa, rsapss, ecdsa, ecdaa or ecschnorr
#
# To override tpm_hash_alg, set KEYLIME_AGENT_TPM_HASH_ALG environment variable.
--
2.47.3

106
0007-Fix-ECC-RSA-algorithm-selection-and-reporting-for-ke.patch
View File

@ -1,106 +0,0 @@
From 9b90f051cddce7c62b7b2fb6f6349f8db9bcabb5 Mon Sep 17 00:00:00 2001
From: Sergio Correia <scorreia@redhat.com>
Date: Mon, 6 Oct 2025 14:37:29 +0000
Subject: [PATCH 7/7] Fix ECC/RSA algorithm selection and reporting for keylime
agent
Backport of upstream PRs:
- https://github.com/keylime/rust-keylime/pull/1132
- https://github.com/keylime/rust-keylime/pull/1134
Signed-off-by: Sergio Correia <scorreia@redhat.com>
---
keylime-agent/src/agent_handler.rs | 2 +-
keylime-agent/src/quotes_handler.rs | 6 +++---
keylime/src/algorithms.rs | 4 ++--
keylime/src/tpm.rs | 4 ++--
4 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/keylime-agent/src/agent_handler.rs b/keylime-agent/src/agent_handler.rs
index 13bcc37..ec7f8ed 100644
--- a/keylime-agent/src/agent_handler.rs
+++ b/keylime-agent/src/agent_handler.rs
@@ -109,7 +109,7 @@ mod tests {
let result: JsonWrapper<AgentInfo> = test::read_body_json(resp).await;
assert_eq!(result.results.agent_uuid.as_str(), "DEADBEEF");
assert_eq!(result.results.tpm_hash_alg.as_str(), "sha256");
- assert_eq!(result.results.tpm_enc_alg.as_str(), "rsa");
+ assert_eq!(result.results.tpm_enc_alg.as_str(), "rsa2048");
assert_eq!(result.results.tpm_sign_alg.as_str(), "rsassa");
// Explicitly drop QuoteData to cleanup keys
diff --git a/keylime-agent/src/quotes_handler.rs b/keylime-agent/src/quotes_handler.rs
index d61adf2..bc0ddaa 100644
--- a/keylime-agent/src/quotes_handler.rs
+++ b/keylime-agent/src/quotes_handler.rs
@@ -405,7 +405,7 @@ mod tests {
let result: JsonWrapper<KeylimeQuote> =
test::read_body_json(resp).await;
assert_eq!(result.results.hash_alg.as_str(), "sha256");
- assert_eq!(result.results.enc_alg.as_str(), "rsa");
+ assert_eq!(result.results.enc_alg.as_str(), "rsa2048");
assert_eq!(result.results.sign_alg.as_str(), "rsassa");
assert!(
pkey_pub_from_pem(&result.results.pubkey.unwrap()) //#[allow_ci]
@@ -451,7 +451,7 @@ mod tests {
let result: JsonWrapper<KeylimeQuote> =
test::read_body_json(resp).await;
assert_eq!(result.results.hash_alg.as_str(), "sha256");
- assert_eq!(result.results.enc_alg.as_str(), "rsa");
+ assert_eq!(result.results.enc_alg.as_str(), "rsa2048");
assert_eq!(result.results.sign_alg.as_str(), "rsassa");
assert!(
pkey_pub_from_pem(&result.results.pubkey.unwrap()) //#[allow_ci]
@@ -513,7 +513,7 @@ mod tests {
let result: JsonWrapper<KeylimeQuote> =
test::read_body_json(resp).await;
assert_eq!(result.results.hash_alg.as_str(), "sha256");
- assert_eq!(result.results.enc_alg.as_str(), "rsa");
+ assert_eq!(result.results.enc_alg.as_str(), "rsa2048");
assert_eq!(result.results.sign_alg.as_str(), "rsassa");
if let Some(ima_mutex) = &quotedata.ima_ml_file {
diff --git a/keylime/src/algorithms.rs b/keylime/src/algorithms.rs
index cda8966..4b4205a 100644
--- a/keylime/src/algorithms.rs
+++ b/keylime/src/algorithms.rs
@@ -195,12 +195,12 @@ impl fmt::Display for EncryptionAlgorithm {
fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
let value = match self {
EncryptionAlgorithm::Rsa1024 => "rsa1024",
- EncryptionAlgorithm::Rsa2048 => "rsa", /* for backwards compatibility */
+ EncryptionAlgorithm::Rsa2048 => "rsa2048",
EncryptionAlgorithm::Rsa3072 => "rsa3072",
EncryptionAlgorithm::Rsa4096 => "rsa4096",
EncryptionAlgorithm::Ecc192 => "ecc192",
EncryptionAlgorithm::Ecc224 => "ecc224",
- EncryptionAlgorithm::Ecc256 => "ecc", /* for backwards compatibility */
+ EncryptionAlgorithm::Ecc256 => "ecc256",
EncryptionAlgorithm::Ecc384 => "ecc384",
EncryptionAlgorithm::Ecc521 => "ecc521",
EncryptionAlgorithm::EccSm2 => "ecc_sm2",
diff --git a/keylime/src/tpm.rs b/keylime/src/tpm.rs
index 5e27f3a..f907aca 100644
--- a/keylime/src/tpm.rs
+++ b/keylime/src/tpm.rs
@@ -31,7 +31,7 @@ use tss_esapi::{
abstraction::{
ak, ek,
pcr::{read_all, PcrData},
- DefaultKey,
+ AsymmetricAlgorithmSelection, DefaultKey,
},
attributes::{
object::ObjectAttributesBuilder, session::SessionAttributesBuilder,
@@ -682,7 +682,7 @@ impl Context<'_> {
&mut self.inner.lock().unwrap(), //#[allow_ci]
handle,
hash_alg.into(),
- key_alg.into(),
+ Into::<AsymmetricAlgorithmSelection>::into(key_alg),
sign_alg.into(),
None,
DefaultKey,
--
2.47.3

163
keylime-agent-rust.spec
View File

@ -15,9 +15,9 @@
%endif
Name: keylime-agent-rust
Version: 0.2.7
Version: 0.2.9
Release: %{?autorelease}%{!?autorelease:1%{?dist}}
Summary: Rust agent for Keylime
Summary: The Keylime agent
# Upstream license specification: Apache-2.0
#
@ -55,27 +55,27 @@ Source0: %{url}/archive/refs/tags/v%{version}.tar.gz
# Rename the vendor.tar.zstd tarball to rust-keylime-%%{version}-vendor.tar.zstd
Source1: rust-keylime-%{version}-vendor.tar.zstd
## (0-99) General patches
# Enable logging for the keylime library
# Patch from https://github.com/keylime/rust-keylime/pull/922
Patch0: rust-keylime-enable-logging-keylime-lib.patch
# Drop completely the legacy-python-actions feature
Patch1: rust-keylime-metadata.patch
# Update to openssl 0.10.70 to fix CVE-2025-24898
# Patch from https://github.com/keylime/rust-keylime/pull/926
Patch2: rust-keylime-openssl-0.10.70.patch
# Backport of https://github.com/keylime/rust-keylime/pull/846
# to enable different key sizes and curves for EK and AK.
Patch3: 0003-Enable-non-standard-key-sizes-and-curves-for-EK-and-.patch
Patch4: 0004-Clippy-fixes.patch
Patch5: 0005-tpm-add-policy-auth-for-EK-to-activate-crendential.patch
Patch6: 0006-keylime-agent.conf-add-all-accepted-TPM-encryption-a.patch
Patch7: 0007-Fix-ECC-RSA-algorithm-selection-and-reporting-for-ke.patch
Patch1: 0001-rust-keylime-metadata.patch
# Do not require /usr/libexec/keylime to be present
Patch2: 0002-rust-keylime-do-not-require-usr-libexec.patch
## (100-199) Patches for building from system Rust libraries (Fedora)
## (200+) Patches for building from vendored Rust libraries (RHEL)
ExclusiveArch: %{rust_arches}
BuildRequires: clang
BuildRequires: git-core
BuildRequires: openssl-devel
BuildRequires: systemd
BuildRequires: tpm2-tss-devel
%if 0%{?bundled_rust_deps}
BuildRequires: rust-toolset
%else
BuildRequires: rust-packaging >= 21-2
%endif
Requires: tpm2-tss
Requires: util-linux-core
@ -85,24 +85,78 @@ Requires: util-linux-core
Requires: keylime-base
%endif
BuildRequires: git-core
BuildRequires: systemd
BuildRequires: openssl-devel
BuildRequires: libarchive-devel
BuildRequires: tpm2-tss-devel
BuildRequires: clang
%if 0%{?bundled_rust_deps}
BuildRequires: rust-toolset
%else
BuildRequires: rust-packaging >= 21-2
%endif
# Requires common files from exact same release
Requires: keylime-agent-rust-common = %{version}-%{release}
# Require the IMA emulator
Requires: keylime-agent-rust-ima-emulator%{?_isa} = %{version}-%{release}
# Virtual Provides to support swapping between Python and Rust implementation
Provides: keylime-agent
Conflicts: keylime-agent
# Virtual Provides to support swapping between pull and push model agents
Provides: keylime-agent = %{version}-%{release}
%description
Rust agent for Keylime
The Keylime agent
#===============================================================================
%package common
Summary: Common files for Keylime agent
License: (Apache-2.0 OR MIT) AND BSD-3-Clause AND (MIT OR Apache-2.0) AND Unicode-DFS-2016 AND (Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT) AND (Apache-2.0 OR BSL-1.0) AND (Apache-2.0 OR MIT) AND (Apache-2.0 OR MIT OR Zlib) AND Apache-2.0 WITH LLVM-exception AND ISC AND MIT AND (MIT OR Unlicense)
BuildArch: noarch
# This is necessary to provide a clean upgrade path from the previous
# keylime-agent-rust which shipped the IMA emulator
Obsoletes: keylime-agent-rust < %{version}-%{release}
%description common
Common files for the Keylime agent in both push and pull models
#===============================================================================
%package push
Summary: The Keylime agent for push model deployment
License: (Apache-2.0 OR MIT) AND BSD-3-Clause AND (MIT OR Apache-2.0) AND Unicode-DFS-2016 AND (Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT) AND (Apache-2.0 OR BSL-1.0) AND (Apache-2.0 OR MIT) AND (Apache-2.0 OR MIT OR Zlib) AND Apache-2.0 WITH LLVM-exception AND ISC AND MIT AND (MIT OR Unlicense)
Requires: tpm2-tss
Requires: util-linux-core
# Requires common files from exact same release
Requires: keylime-agent-rust-common = %{version}-%{release}
# Require the IMA emulator
Requires: keylime-agent-rust-ima-emulator%{?_isa} = %{version}-%{release}
# The keylime-base package provides the keylime user creation. It is available
# from Fedora 36
%if 0%{?fedora} >= 36 || 0%{?rhel} >= 9
Requires: keylime-base
%endif
# Virtual Provides to support swapping between pull and push model agents
Provides: keylime-agent = %{version}-%{release}
%description push
The Keylime agent for push model deployment
#===============================================================================
%package ima-emulator
Summary: The Keylime IMA emulator
License: (Apache-2.0 OR MIT) AND BSD-3-Clause AND (MIT OR Apache-2.0) AND Unicode-DFS-2016 AND (Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT) AND (Apache-2.0 OR BSL-1.0) AND (Apache-2.0 OR MIT) AND (Apache-2.0 OR MIT OR Zlib) AND Apache-2.0 WITH LLVM-exception AND ISC AND MIT AND (MIT OR Unlicense)
Requires: tpm2-tss
# Requires common files from exact same release
Requires: keylime-agent-rust-common = %{version}-%{release}
# The keylime-base package provides the keylime user creation. It is available
# from Fedora 36
%if 0%{?fedora} >= 36 || 0%{?rhel} >= 9
Requires: keylime-base
%endif
Provides: keylime-ima-emulator = %{version}-%{release}
%description ima-emulator
The Keylime IMA emulator for testing with emulated TPM
#===============================================================================
%prep
%autosetup -S git -n rust-keylime-%{version} -N %{?bundled_rust_deps:-a1}
@ -110,9 +164,11 @@ Rust agent for Keylime
%if 0%{?bundled_rust_deps}
# Source1 is vendored dependencies
%cargo_prep -v vendor
%autopatch -m 200 -p1
# Add back the line below if patches are added (do not forget the '%')
# autopatch -m 200 -p1
%else
%autopatch -m 100 -M 199 -p1
# Add back the line below if patches are added (do not forget the '%')
# autopatch -m 100 -M 199 -p1
%cargo_prep
%generate_buildrequires
%cargo_generate_buildrequires
@ -130,7 +186,6 @@ Rust agent for Keylime
mkdir -p %{buildroot}/%{_sharedstatedir}/keylime
mkdir -p --mode=0700 %{buildroot}/%{_rundir}/keylime
mkdir -p --mode=0700 %{buildroot}/%{_libexecdir}/keylime
mkdir -p --mode=0700 %{buildroot}/%{_sysconfdir}/keylime
mkdir -p --mode=0700 %{buildroot}/%{_sysconfdir}/keylime/agent.conf.d
@ -143,6 +198,9 @@ install -Dpm 644 ./dist/systemd/system/keylime_agent.service \
install -Dpm 644 ./dist/systemd/system/var-lib-keylime-secure.mount \
%{buildroot}%{_unitdir}/var-lib-keylime-secure.mount
install -Dpm 644 ./dist/systemd/system/keylime_push_model_agent.service \
%{buildroot}%{_unitdir}/keylime_push_model_agent.service
# Setting up the agent to use keylime:keylime user/group after dropping privileges.
cat > %{buildroot}/%{_sysconfdir}/keylime/agent.conf.d/001-run_as.conf << EOF
[agent]
@ -155,6 +213,9 @@ install -Dpm 0755 \
install -Dpm 0755 \
-t %{buildroot}%{_bindir} \
./target/release/keylime_ima_emulator
install -Dpm 0755 \
-t %{buildroot}%{_bindir} \
./target/release/keylime_push_model_agent
%posttrans
chmod 500 %{_sysconfdir}/keylime/agent.conf.d
@ -163,30 +224,48 @@ chmod 500 %{_sysconfdir}/keylime
chown -R keylime:keylime %{_sysconfdir}/keylime
%preun
%systemd_preun keylime_push_model_agent.service
%systemd_preun keylime_agent.service
%systemd_preun var-lib-keylime-secure.mount
%postun
%systemd_postun_with_restart keylime_push_model_agent.service
%systemd_postun_with_restart keylime_agent.service
%systemd_postun_with_restart var-lib-keylime-secure.mount
%files
%files common
%license LICENSE
%license LICENSE.dependencies
%if 0%{?bundled_rust_deps}
%license cargo-vendor.txt
%endif
%doc README.md
%attr(500,keylime,keylime) %dir %{_sysconfdir}/keylime
%attr(500,keylime,keylime) %dir %{_sysconfdir}/keylime/agent.conf.d
%config(noreplace) %attr(400,keylime,keylime) %{_sysconfdir}/keylime/agent.conf.d/001-run_as.conf
%config(noreplace) %attr(400,keylime,keylime) %{_sysconfdir}/keylime/agent.conf
%{_unitdir}/keylime_agent.service
%{_unitdir}/var-lib-keylime-secure.mount
%attr(700,keylime,keylime) %dir %{_rundir}/keylime
%attr(700,keylime,keylime) %{_sharedstatedir}/keylime
%attr(700,keylime,keylime) %{_libexecdir}/keylime
%files
%license LICENSE.dependencies
%if 0%{?bundled_rust_deps}
%license cargo-vendor.txt
%endif
%config(noreplace) %attr(400,keylime,keylime) %{_sysconfdir}/keylime/agent.conf
%{_unitdir}/keylime_agent.service
%{_unitdir}/var-lib-keylime-secure.mount
%{_bindir}/keylime_agent
%files push
%license LICENSE.dependencies
%if 0%{?bundled_rust_deps}
%license cargo-vendor.txt
%endif
%{_unitdir}/keylime_push_model_agent.service
%{_bindir}/keylime_push_model_agent
%files ima-emulator
%license LICENSE.dependencies
%if 0%{?bundled_rust_deps}
%license cargo-vendor.txt
%endif
%{_bindir}/keylime_ima_emulator
%if %{with check}

62
rust-keylime-openssl-0.10.70.patch
View File

@ -1,62 +0,0 @@
From 6087804c15b16a1456a191ccea25acec7a3f7fc0 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 4 Feb 2025 09:55:03 +0000
Subject: [PATCH] build(deps): bump openssl from 0.10.68 to 0.10.70
Bumps [openssl](https://github.com/sfackler/rust-openssl) from 0.10.68 to 0.10.70.
- [Release notes](https://github.com/sfackler/rust-openssl/releases)
- [Commits](https://github.com/sfackler/rust-openssl/compare/openssl-v0.10.68...openssl-v0.10.70)
---
updated-dependencies:
- dependency-name: openssl
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
---
Cargo.lock | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/Cargo.lock b/Cargo.lock
index 6cf79ea7..4c0ac1e6 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1387,9 +1387,9 @@ checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
[[package]]
name = "openssl"
-version = "0.10.68"
+version = "0.10.70"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6174bc48f102d208783c2c84bf931bb75927a617866870de8a4ea85597f871f5"
+checksum = "61cfb4e166a8bb8c9b55c500bc2308550148ece889be90f609377e58140f42c6"
dependencies = [
"bitflags 2.4.0",
"cfg-if",
@@ -1402,20 +1402,20 @@ dependencies = [
[[package]]
name = "openssl-macros"
-version = "0.1.0"
+version = "0.1.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b501e44f11665960c7e7fcf062c7d96a14ade4aa98116c004b2e37b5be7d736c"
+checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
dependencies = [
"proc-macro2",
"quote",
- "syn 1.0.100",
+ "syn 2.0.90",
]
[[package]]
name = "openssl-sys"
-version = "0.9.104"
+version = "0.9.105"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "45abf306cbf99debc8195b66b7346498d7b10c210de50418b5ccd7ceba08c741"
+checksum = "8b22d5b84be05a8d6947c7cb71f7c849aa0f112acd4bf51c2a7c1c988ac0a9dc"
dependencies = [
"cc",
"libc",

4
sources
View File

@ -1,2 +1,2 @@
SHA512 (rust-keylime-0.2.7-vendor.tar.zstd) = cac2cbe6b1831e5f8c1c7981df54b94dfab38e3784b672fe4a5ef85f22af7cb1accb3f726951579a10abb11205d50e58977e7146eba386195b1d6d126043e906
SHA512 (v0.2.7.tar.gz) = 6a9f4e581aa49c8be1599d235a54c6a65d0f45340ef37c3d08124b75c4c5ca2b8467dc00cac8dfae5402b5690bb90fe69a994770fe2715de6e9d4070dabebb7d
SHA512 (v0.2.9.tar.gz) = f51ce187462278328a96a05dfb6315167bd3be154cb1c9ad933de33d246e696b25bb487071a824ed552456016bb64154e89f5f8a0dc76b94eb896be0f4787e9f
SHA512 (rust-keylime-0.2.9-vendor.tar.zstd) = 86899e58a2ba7a26c29ba15b6c7bca51dd4500ade8468a2f1697e6b23feb2e2be2e5323b8fc351e3c04aa970dfb07b909c07349f822358b33d439a40f4ab596b