diff --git a/.gitignore b/.gitignore index 87f14b3..0fb156b 100644 --- a/.gitignore +++ b/.gitignore @@ -19,3 +19,5 @@ /rust-keylime-0.2.7-vendor.tar.zstd /v0.2.9.tar.gz /rust-keylime-0.2.9-vendor.tar.zstd +/v0.2.10.tar.gz +/rust-keylime-0.2.10-vendor.tar.zstd diff --git a/0003-rust-keylime-registrar-tls-port.patch b/0003-rust-keylime-registrar-tls-port.patch deleted file mode 100644 index 9f46b09..0000000 --- a/0003-rust-keylime-registrar-tls-port.patch +++ /dev/null @@ -1,514 +0,0 @@ -From 3cbb5cddc5e149619ea11c797d2963e68b50b280 Mon Sep 17 00:00:00 2001 -From: Anderson Toshiyuki Sasaki -Date: Tue, 10 Mar 2026 10:47:01 +0100 -Subject: [PATCH 1/2] push-attestation: Use registrar TLS port when TLS is - enabled - -The push-attestation agent was using the plaintext registrar port (8890) -even when TLS was enabled, but the registrar listens on a separate port -for TLS connections (8891). Add a registrar_tls_port config option and -use it when TLS is active. - -The decision on whether using TLS or not is consolidated in -create_registrar_tls_config(), which now sets the registrar_tls_port in -RegistrarTlsConfig. Downstream code (register_agent) simply uses the -port from the TLS config when present, or falls back to the plaintext -port. - -Port constants (DEFAULT_REGISTRAR_PORT, DEFAULT_REGISTRAR_TLS_PORT) are -used instead of hardcoded values. - -Co-Authored-By: Claude Opus 4.6 -Signed-off-by: Anderson Toshiyuki Sasaki ---- - keylime-agent.conf | 8 ++ - keylime-push-model-agent/src/main.rs | 11 +++ - keylime-push-model-agent/src/registration.rs | 85 +++++++++++++++----- - keylime/src/config/base.rs | 3 + - keylime/src/config/push_model.rs | 2 + - keylime/src/config/testing.rs | 6 +- - 6 files changed, 95 insertions(+), 20 deletions(-) - -diff --git a/keylime-agent.conf b/keylime-agent.conf -index 4ed60ccf5..a9d822070 100644 ---- a/keylime-agent.conf -+++ b/keylime-agent.conf -@@ -61,6 +61,14 @@ contact_port = 9002 - registrar_ip = "127.0.0.1" - registrar_port = 8890 - -+# The TLS port of the registrar server which agent communicates with when -+# registrar_tls_enabled is set to true. -+# This is the port the registrar listens on for TLS connections. -+# -+# To override registrar_tls_port, set KEYLIME_AGENT_REGISTRAR_TLS_PORT -+# environment variable. -+registrar_tls_port = 8891 -+ - # Enable TLS communication between agent and registrar. - # When enabled, the agent will use TLS (server verification only) when - # communicating with the registrar. The registrar_tls_ca_cert option must be -diff --git a/keylime-push-model-agent/src/main.rs b/keylime-push-model-agent/src/main.rs -index bd0656d97..a9753bf8a 100644 ---- a/keylime-push-model-agent/src/main.rs -+++ b/keylime-push-model-agent/src/main.rs -@@ -117,6 +117,7 @@ fn create_registrar_tls_config( - ca_cert: Some(ca_cert.to_string()), - disable_tls: None, - timeout: Some(timeout), -+ registrar_tls_port: config.registrar_tls_port(), - }); - } - -@@ -346,10 +347,12 @@ async fn main() -> Result<()> { - #[cfg(test)] - mod tests { - use super::*; -+ use keylime::config::DEFAULT_REGISTRAR_TLS_PORT; - - // Mock config for testing - struct MockConfig { - tls_enabled: bool, -+ tls_port: u32, - ca_cert: String, - backoff_max_delay: Option, - backoff_max_retries: Option, -@@ -421,6 +424,9 @@ mod tests { - fn registrar_port(&self) -> u32 { - 0 - } -+ fn registrar_tls_port(&self) -> u32 { -+ self.tls_port -+ } - fn tpm_encryption_alg(&self) -> &str { - "" - } -@@ -446,6 +452,7 @@ mod tests { - // Test when TLS is disabled - let config = MockConfig { - tls_enabled: false, -+ tls_port: DEFAULT_REGISTRAR_TLS_PORT, - ca_cert: "".to_string(), - backoff_max_delay: None, - backoff_max_retries: None, -@@ -461,6 +468,7 @@ mod tests { - // Test when TLS is enabled with CA certificate (push model doesn't use client certs) - let config = MockConfig { - tls_enabled: true, -+ tls_port: DEFAULT_REGISTRAR_TLS_PORT, - ca_cert: "/path/to/ca.crt".to_string(), - backoff_max_delay: None, - backoff_max_retries: None, -@@ -474,6 +482,7 @@ mod tests { - assert_eq!(tls_config.ca_cert, Some("/path/to/ca.crt".to_string())); - assert_eq!(tls_config.timeout, Some(5000)); - assert_eq!(tls_config.disable_tls, None); -+ assert_eq!(tls_config.registrar_tls_port, DEFAULT_REGISTRAR_TLS_PORT); - } - - #[test] -@@ -481,6 +490,7 @@ mod tests { - // Test when TLS is enabled but no CA certificate path is provided - let config = MockConfig { - tls_enabled: true, -+ tls_port: DEFAULT_REGISTRAR_TLS_PORT, - ca_cert: "".to_string(), - backoff_max_delay: None, - backoff_max_retries: None, -@@ -496,6 +506,7 @@ mod tests { - // Test that custom timeout is properly set - let config = MockConfig { - tls_enabled: true, -+ tls_port: DEFAULT_REGISTRAR_TLS_PORT, - ca_cert: "/path/to/ca.crt".to_string(), - backoff_max_delay: None, - backoff_max_retries: None, -diff --git a/keylime-push-model-agent/src/registration.rs b/keylime-push-model-agent/src/registration.rs -index bc5e3b283..0189cb15b 100644 ---- a/keylime-push-model-agent/src/registration.rs -+++ b/keylime-push-model-agent/src/registration.rs -@@ -9,10 +9,15 @@ use keylime::{ - - /// TLS configuration for registrar communication in push model. - /// Push model uses server-only TLS verification (no client certificates/mTLS). -+/// -+/// When this struct is `Some`, TLS is considered active: the registrar client -+/// will use HTTPS, and `registrar_tls_port` will be used instead of the -+/// plaintext port. - pub struct RegistrarTlsConfig { - pub ca_cert: Option, - pub disable_tls: Option, - pub timeout: Option, -+ pub registrar_tls_port: u32, - } - - pub async fn check_registration( -@@ -55,18 +60,26 @@ pub async fn register_agent( - // Resolve agent UUID using the centralized helper - let agent_uuid = context_info.resolve_agent_id(config.uuid()); - -- // Extract TLS config values; push model doesn't use client certs (no mTLS) -- let (ca_cert, disable_tls, timeout) = if let Some(tls) = tls_config { -- (tls.ca_cert, tls.disable_tls, tls.timeout) -- } else { -- (None, None, None) -- }; -+ // Extract TLS config values; push model doesn't use client certs (no mTLS). -+ // When tls_config is Some, TLS is active: use the TLS port and CA cert. -+ // When None, TLS is not active: use the plaintext port. -+ let (ca_cert, disable_tls, timeout, registrar_port) = -+ if let Some(tls) = tls_config { -+ ( -+ tls.ca_cert, -+ tls.disable_tls, -+ tls.timeout, -+ tls.registrar_tls_port, -+ ) -+ } else { -+ (None, None, None, config.registrar_port()) -+ }; - - let ac = AgentRegistrationConfig { - contact_ip: config.contact_ip().to_string(), - contact_port: config.contact_port(), - registrar_ip: config.registrar_ip().to_string(), -- registrar_port: config.registrar_port(), -+ registrar_port, - enable_iak_idevid: config.enable_iak_idevid(), - ek_handle: config - .ek_handle() -@@ -114,7 +127,10 @@ mod tests { - use super::*; - - use keylime::{ -- config::get_testing_config, -+ config::{ -+ get_testing_config, DEFAULT_REGISTRAR_PORT, -+ DEFAULT_REGISTRAR_TLS_PORT, -+ }, - context_info::{AlgorithmConfigurationString, ContextInfo}, - tpm::testing, - }; -@@ -164,6 +180,7 @@ mod tests { - ca_cert: Some("/path/to/ca.pem".to_string()), - disable_tls: Some(false), - timeout: Some(5000), -+ registrar_tls_port: DEFAULT_REGISTRAR_TLS_PORT, - }; - - assert_eq!(tls_config.ca_cert, Some("/path/to/ca.pem".to_string())); -@@ -177,6 +194,7 @@ mod tests { - ca_cert: None, - disable_tls: None, - timeout: None, -+ registrar_tls_port: DEFAULT_REGISTRAR_TLS_PORT, - }; - - assert_eq!(tls_config.ca_cert, None); -@@ -190,6 +208,7 @@ mod tests { - ca_cert: Some("/path/to/ca.pem".to_string()), - disable_tls: Some(true), - timeout: Some(10000), -+ registrar_tls_port: DEFAULT_REGISTRAR_TLS_PORT, - }; - - assert_eq!(tls_config.ca_cert, Some("/path/to/ca.pem".to_string())); -@@ -203,6 +222,7 @@ mod tests { - ca_cert: Some("".to_string()), - disable_tls: Some(false), - timeout: Some(0), -+ registrar_tls_port: DEFAULT_REGISTRAR_TLS_PORT, - }; - - assert_eq!(tls_config.ca_cert, Some("".to_string())); -@@ -233,6 +253,7 @@ mod tests { - ca_cert: Some("/path/to/ca.pem".to_string()), - disable_tls: Some(false), - timeout: Some(5000), -+ registrar_tls_port: DEFAULT_REGISTRAR_TLS_PORT, - }; - - // Test with None context_info but Some tls_config (should not register) -@@ -268,6 +289,7 @@ mod tests { - ca_cert: Some("/path/to/ca.pem".to_string()), - disable_tls: Some(false), - timeout: Some(5000), -+ registrar_tls_port: DEFAULT_REGISTRAR_TLS_PORT, - }; - - let result = -@@ -305,6 +327,7 @@ mod tests { - ca_cert: Some("/path/to/ca.pem".to_string()), - disable_tls: None, - timeout: Some(5000), -+ registrar_tls_port: DEFAULT_REGISTRAR_TLS_PORT, - }; - - let result = -@@ -342,6 +365,7 @@ mod tests { - ca_cert: Some("/path/to/ca.pem".to_string()), - disable_tls: Some(true), - timeout: Some(5000), -+ registrar_tls_port: DEFAULT_REGISTRAR_TLS_PORT, - }; - - let result = -@@ -413,6 +437,7 @@ mod tests { - ca_cert: Some("/path/to/ca.pem".to_string()), - disable_tls: None, - timeout: Some(0), -+ registrar_tls_port: DEFAULT_REGISTRAR_TLS_PORT, - }; - assert_eq!(tls_config_zero.timeout, Some(0)); - -@@ -421,6 +446,7 @@ mod tests { - ca_cert: Some("/path/to/ca.pem".to_string()), - disable_tls: None, - timeout: Some(300000), -+ registrar_tls_port: DEFAULT_REGISTRAR_TLS_PORT, - }; - assert_eq!(tls_config_large.timeout, Some(300000)); - -@@ -429,6 +455,7 @@ mod tests { - ca_cert: Some("/path/to/ca.pem".to_string()), - disable_tls: None, - timeout: None, -+ registrar_tls_port: DEFAULT_REGISTRAR_TLS_PORT, - }; - assert_eq!(tls_config_none.timeout, None); - } -@@ -439,32 +466,47 @@ mod tests { - ca_cert: Some("/ca.pem".to_string()), - disable_tls: Some(false), - timeout: Some(5000), -+ registrar_tls_port: DEFAULT_REGISTRAR_TLS_PORT, - }); - -- let (ca_cert, disable_tls, timeout) = if let Some(tls) = tls_config { -- (tls.ca_cert, tls.disable_tls, tls.timeout) -- } else { -- (None, None, None) -- }; -+ let (ca_cert, disable_tls, timeout, registrar_port) = -+ if let Some(tls) = tls_config { -+ ( -+ tls.ca_cert, -+ tls.disable_tls, -+ tls.timeout, -+ tls.registrar_tls_port, -+ ) -+ } else { -+ (None, None, None, DEFAULT_REGISTRAR_PORT) -+ }; - - assert_eq!(ca_cert, Some("/ca.pem".to_string())); - assert_eq!(disable_tls, Some(false)); - assert_eq!(timeout, Some(5000)); -+ assert_eq!(registrar_port, DEFAULT_REGISTRAR_TLS_PORT); - } - - #[actix_rt::test] - async fn test_tls_config_extraction_none() { - let tls_config: Option = None; - -- let (ca_cert, disable_tls, timeout) = if let Some(tls) = tls_config { -- (tls.ca_cert, tls.disable_tls, tls.timeout) -- } else { -- (None, None, None) -- }; -+ let (ca_cert, disable_tls, timeout, registrar_port) = -+ if let Some(tls) = tls_config { -+ ( -+ tls.ca_cert, -+ tls.disable_tls, -+ tls.timeout, -+ tls.registrar_tls_port, -+ ) -+ } else { -+ (None, None, None, DEFAULT_REGISTRAR_PORT) -+ }; - - assert_eq!(ca_cert, None); - assert_eq!(disable_tls, None); - assert_eq!(timeout, None); -+ assert_eq!(registrar_port, DEFAULT_REGISTRAR_PORT); - } - - #[tokio::test] -@@ -503,6 +545,7 @@ mod tests { - ca_cert: Some(ca_path.to_string_lossy().to_string()), - disable_tls: Some(false), - timeout: Some(5000), -+ registrar_tls_port: DEFAULT_REGISTRAR_TLS_PORT, - }; - - // Should fail due to invalid port, but TLS config should be processed -@@ -529,7 +572,7 @@ mod tests { - config.exponential_backoff_max_retries = None; - config.exponential_backoff_max_delay = None; - config.registrar_ip = "127.0.0.1".to_string(); -- config.registrar_port = 8891; -+ config.registrar_port = DEFAULT_REGISTRAR_TLS_PORT; - - let _guard = keylime::config::TestConfigGuard::new(config); - -@@ -541,6 +584,7 @@ mod tests { - ca_cert: Some("/nonexistent/ca.pem".to_string()), - disable_tls: Some(false), - timeout: Some(5000), -+ registrar_tls_port: DEFAULT_REGISTRAR_TLS_PORT, - }; - - // Should fail due to missing certificate files -@@ -562,6 +606,7 @@ mod tests { - ca_cert: Some(ca_path.to_string_lossy().to_string()), - disable_tls: Some(false), - timeout: Some(10000), -+ registrar_tls_port: DEFAULT_REGISTRAR_TLS_PORT, - }; - - // Verify all fields are set correctly -@@ -571,6 +616,7 @@ mod tests { - ); - assert_eq!(tls_config.disable_tls, Some(false)); - assert_eq!(tls_config.timeout, Some(10000)); -+ assert_eq!(tls_config.registrar_tls_port, DEFAULT_REGISTRAR_TLS_PORT); - } - - #[tokio::test] -@@ -602,6 +648,7 @@ mod tests { - ca_cert: Some("".to_string()), - disable_tls: Some(false), - timeout: Some(5000), -+ registrar_tls_port: DEFAULT_REGISTRAR_TLS_PORT, - }; - - let result = -diff --git a/keylime/src/config/base.rs b/keylime/src/config/base.rs -index c171c8592..31fdc44ef 100644 ---- a/keylime/src/config/base.rs -+++ b/keylime/src/config/base.rs -@@ -36,6 +36,7 @@ pub static DEFAULT_IP: &str = "127.0.0.1"; - pub static DEFAULT_PORT: u32 = 9002; - pub static DEFAULT_REGISTRAR_IP: &str = "127.0.0.1"; - pub static DEFAULT_REGISTRAR_PORT: u32 = 8890; -+pub static DEFAULT_REGISTRAR_TLS_PORT: u32 = 8891; - pub static DEFAULT_REGISTRAR_TLS_ENABLED: bool = false; - pub static DEFAULT_REGISTRAR_TLS_CA_CERT: &str = "cv_ca/cacert.crt"; - pub static DEFAULT_KEYLIME_DIR: &str = "/var/lib/keylime"; -@@ -140,6 +141,7 @@ pub struct AgentConfig { - pub port: u32, - pub registrar_ip: String, - pub registrar_port: u32, -+ pub registrar_tls_port: u32, - pub registrar_tls_enabled: bool, - pub registrar_tls_ca_cert: String, - pub run_as: String, -@@ -318,6 +320,7 @@ impl Default for AgentConfig { - port: DEFAULT_PORT, - registrar_ip: DEFAULT_REGISTRAR_IP.to_string(), - registrar_port: DEFAULT_REGISTRAR_PORT, -+ registrar_tls_port: DEFAULT_REGISTRAR_TLS_PORT, - registrar_tls_enabled: DEFAULT_REGISTRAR_TLS_ENABLED, - registrar_tls_ca_cert: "default".to_string(), - revocation_actions: DEFAULT_REVOCATION_ACTIONS.to_string(), -diff --git a/keylime/src/config/push_model.rs b/keylime/src/config/push_model.rs -index 644051196..0e461c381 100644 ---- a/keylime/src/config/push_model.rs -+++ b/keylime/src/config/push_model.rs -@@ -70,6 +70,7 @@ pub struct PushModelConfig { - registrar_api_versions: Vec<&str>, - registrar_ip: String, - registrar_port: u32, -+ registrar_tls_port: u32, - registrar_tls_enabled: bool, - registrar_tls_ca_cert: String, - tpm_encryption_alg: String, -@@ -113,6 +114,7 @@ mod tests { - assert_eq!(config.enable_iak_idevid(), DEFAULT_ENABLE_IAK_IDEVID); - assert_eq!(config.registrar_ip(), DEFAULT_REGISTRAR_IP); - assert_eq!(config.registrar_port(), DEFAULT_REGISTRAR_PORT); -+ assert_eq!(config.registrar_tls_port(), DEFAULT_REGISTRAR_TLS_PORT); - assert_eq!( - config.uefi_logs_evidence_version(), - DEFAULT_UEFI_LOGS_EVIDENCE_VERSION -diff --git a/keylime/src/config/testing.rs b/keylime/src/config/testing.rs -index 94b52f978..4f666fb33 100644 ---- a/keylime/src/config/testing.rs -+++ b/keylime/src/config/testing.rs -@@ -58,7 +58,7 @@ fn apply_config_overrides( - ) { - use crate::config::{ - DEFAULT_CONTACT_PORT, DEFAULT_PORT, DEFAULT_REGISTRAR_PORT, -- DEFAULT_REVOCATION_NOTIFICATION_PORT, -+ DEFAULT_REGISTRAR_TLS_PORT, DEFAULT_REVOCATION_NOTIFICATION_PORT, - }; - - for (key, value) in overrides { -@@ -100,6 +100,10 @@ fn apply_config_overrides( - config.registrar_port = - value.parse().unwrap_or(DEFAULT_REGISTRAR_PORT); - } -+ "registrar_tls_port" => { -+ config.registrar_tls_port = -+ value.parse().unwrap_or(DEFAULT_REGISTRAR_TLS_PORT); -+ } - "run_as" => config.run_as = value, - "tpm_encryption_alg" => config.tpm_encryption_alg = value, - "tpm_hash_alg" => config.tpm_hash_alg = value, - -From 734a87c458bd644828805eaffa994cb4b7e0bd98 Mon Sep 17 00:00:00 2001 -From: Anderson Toshiyuki Sasaki -Date: Tue, 10 Mar 2026 10:48:24 +0100 -Subject: [PATCH 2/2] Use port constants instead of hardcoded values in tests - -Replace hardcoded port numbers (8891) with DEFAULT_REGISTRAR_TLS_PORT in -registrar client tests for consistency. - -Co-Authored-By: Claude Opus 4.6 -Signed-off-by: Anderson Toshiyuki Sasaki ---- - keylime/src/registrar_client.rs | 11 +++++++---- - 1 file changed, 7 insertions(+), 4 deletions(-) - -diff --git a/keylime/src/registrar_client.rs b/keylime/src/registrar_client.rs -index 3fb2f9686..7750a381e 100644 ---- a/keylime/src/registrar_client.rs -+++ b/keylime/src/registrar_client.rs -@@ -700,7 +700,10 @@ impl RegistrarClient { - #[cfg(test)] - mod tests { - use super::*; -- use crate::{agent_identity::AgentIdentityBuilder, crypto}; -+ use crate::{ -+ agent_identity::AgentIdentityBuilder, -+ config::DEFAULT_REGISTRAR_TLS_PORT, crypto, -+ }; - use wiremock::matchers::{method, path}; - use wiremock::{Mock, MockServer, ResponseTemplate}; - -@@ -1407,7 +1410,7 @@ mod tests { - } - - if to_add.contains(&"registrar_port") { -- builder = builder.registrar_port(8891); -+ builder = builder.registrar_port(DEFAULT_REGISTRAR_TLS_PORT); - } - - let result = builder.build().await; -@@ -1475,13 +1478,13 @@ mod tests { - async fn test_builder_chaining_with_tls() { - let builder = RegistrarClientBuilder::new() - .registrar_address("127.0.0.1".to_string()) -- .registrar_port(8891) -+ .registrar_port(DEFAULT_REGISTRAR_TLS_PORT) - .ca_certificate("/path/to/ca.pem".to_string()) - .disable_tls(false) - .timeout(5000); - - assert_eq!(builder.registrar_address, Some("127.0.0.1".to_string())); -- assert_eq!(builder.registrar_port, Some(8891)); -+ assert_eq!(builder.registrar_port, Some(DEFAULT_REGISTRAR_TLS_PORT)); - assert_eq!( - builder.ca_certificate, - Some("/path/to/ca.pem".to_string()) diff --git a/0004-rust-keylime-hash-before-certify.patch b/0004-rust-keylime-hash-before-certify.patch deleted file mode 100644 index f6abdf5..0000000 --- a/0004-rust-keylime-hash-before-certify.patch +++ /dev/null @@ -1,340 +0,0 @@ -From 6a6b1046a2fb5bd0a84982c7777268f4f9c14f25 Mon Sep 17 00:00:00 2001 -From: Anderson Toshiyuki Sasaki -Date: Mon, 11 May 2026 19:01:25 +0200 -Subject: [PATCH] agent: Hash agent ID before TPM2_Certify qualifying data - -SHA-256 hash the agent ID before passing it as qualifyingData to -TPM2_Certify when certifying the AK with the IAK. This produces a fixed -32-byte value that fits within TPM2B_DATA on all TPMs, including those -that only support SHA-256 (where the limit is 34 bytes). - -Without this fix, UUID strings (36 bytes) and other agent IDs exceed the -TPM2B_DATA capacity on SHA-256-only TPMs, causing TPM_RC_SIZE errors -during registration. - -Bumps the pull-mode API version to 2.6. - -Fixes: https://github.com/keylime/rust-keylime/issues/1226 - -Co-Authored-By: Claude Opus 4.6 -Signed-off-by: Anderson Toshiyuki Sasaki ---- - keylime-agent/src/api.rs | 21 +++++ - keylime-agent/src/main.rs | 22 +---- - keylime-push-model-agent/src/registration.rs | 2 - - keylime/src/agent_registration.rs | 88 +++++++++++++------- - keylime/src/config/base.rs | 2 +- - keylime/src/registrar_client.rs | 10 +++ - keylime/src/tpm.rs | 23 +++-- - 7 files changed, 108 insertions(+), 60 deletions(-) - -diff --git a/keylime-agent/src/api.rs b/keylime-agent/src/api.rs -index e9f4562dd..4d135a9b3 100644 ---- a/keylime-agent/src/api.rs -+++ b/keylime-agent/src/api.rs -@@ -188,6 +188,25 @@ fn configure_api_v2_5(cfg: &mut web::ServiceConfig) { - ) - } - -+/// Configure the endpoints supported by API version 2.6 -+/// -+/// Version 2.6 has the same agent-side endpoints as 2.5. The version bump -+/// reflects a protocol change: the agent now SHA-256 hashes the agent ID -+/// before using it as qualifying data in TPM2_Certify (IAK-based AK -+/// certification). This ensures the qualifying data fits within the -+/// TPM2B_DATA size limit on SHA-256-only TPMs (34 bytes). The certify -+/// operation is deferred until after API version negotiation so the agent -+/// can fall back to raw UUID bytes when the registrar only supports 2.5. -+fn configure_api_v2_6(cfg: &mut web::ServiceConfig) { -+ let version = Version::from_str("2.6").expect("Invalid API version"); -+ _ = cfg.app_data(web::Data::new(version)); -+ configure_base_endpoints(cfg); -+ _ = cfg.service( -+ web::scope("/agent") -+ .configure(agent_handler::configure_agent_endpoints), -+ ) -+} -+ - /// Get a scope configured for the given API version - pub(crate) fn get_api_scope(version: &str) -> Result { - match version { -@@ -201,6 +220,8 @@ pub(crate) fn get_api_scope(version: &str) -> Result { - .configure(configure_api_v2_4)), - "2.5" => Ok(web::scope(format!("v{version}").as_ref()) - .configure(configure_api_v2_5)), -+ "2.6" => Ok(web::scope(format!("v{version}").as_ref()) -+ .configure(configure_api_v2_6)), - _ => Err(APIError::UnsupportedVersion(version.into())), - } - } -diff --git a/keylime-agent/src/main.rs b/keylime-agent/src/main.rs -index b05eed214..280a1ac88 100644 ---- a/keylime-agent/src/main.rs -+++ b/keylime-agent/src/main.rs -@@ -87,7 +87,7 @@ use tss_esapi::{ - handles::KeyHandle, - interface_types::algorithm::{AsymmetricAlgorithm, HashingAlgorithm}, - interface_types::resource_handles::Hierarchy, -- structures::{Auth, Data, Digest, MaxBuffer, PublicBuffer}, -+ structures::{Auth, Digest, MaxBuffer, PublicBuffer}, - traits::Marshall, - Context, - }; -@@ -494,24 +494,6 @@ async fn main() -> Result<()> { - None - }; - -- let (attest, signature) = if let Some(dev_id) = &mut device_id { -- let qualifying_data = Data::try_from(agent_uuid.as_bytes())?; -- let (attest, signature) = -- dev_id.certify(qualifying_data, ak_handle, &mut ctx)?; -- -- info!("AK certified with IAK."); -- -- // // For debugging certify(), the following checks the generated signature -- // let max_b = MaxBuffer::try_from(attest.clone().marshall()?)?; -- // let (hashed_attest, _) = ctx.inner.hash(max_b, HashingAlgorithm::Sha256, Hierarchy::Endorsement,)?; -- // println!("{:?}", hashed_attest); -- // println!("{:?}", signature); -- // println!("{:?}", ctx.inner.verify_signature(iak.as_ref().unwrap().handle, hashed_attest, signature.clone())?); //#[allow_ci] -- (Some(attest), Some(signature)) -- } else { -- (None, None) -- }; -- - // Load or generate RSA key pair for secure transmission of u, v keys. - // The u, v keys are two halves of the key used to decrypt the workload after - // the Identity and Integrity Quotes sent by the agent are validated -@@ -645,8 +627,6 @@ async fn main() -> Result<()> { - agent_uuid: agent_uuid.clone(), - mtls_cert, - device_id, -- attest, -- signature, - ak_handle, - retry_config: Some(get_retry_config(&config)), - }; -diff --git a/keylime-push-model-agent/src/registration.rs b/keylime-push-model-agent/src/registration.rs -index 0189cb15b..0cca01c17 100644 ---- a/keylime-push-model-agent/src/registration.rs -+++ b/keylime-push-model-agent/src/registration.rs -@@ -109,8 +109,6 @@ pub async fn register_agent( - agent_uuid, - mtls_cert: None, - device_id: None, // TODO: Check how to proceed with device ID -- attest: None, // TODO: Check how to proceed with attestation, normally, no device ID means no attest -- signature: None, // TODO: Normally, no device ID means no signature - ak_handle: context_info.ak_handle, - retry_config, - }; -diff --git a/keylime/src/agent_registration.rs b/keylime/src/agent_registration.rs -index 8a4fe0c3a..9e60f8cf2 100644 ---- a/keylime/src/agent_registration.rs -+++ b/keylime/src/agent_registration.rs -@@ -9,10 +9,12 @@ use crate::{ - tpm::{self}, - }; - use base64::{engine::general_purpose, Engine as _}; --use log::{error, info}; -+use log::{error, info, warn}; - use openssl::x509::X509; - use tss_esapi::{ -- handles::KeyHandle, structures::PublicBuffer, traits::Marshall, -+ handles::KeyHandle, -+ structures::{Data, PublicBuffer}, -+ traits::Marshall, - }; - - #[derive(Debug)] -@@ -44,14 +46,12 @@ pub struct AgentRegistration { - pub agent_uuid: String, - pub mtls_cert: Option, - pub device_id: Option, -- pub attest: Option, -- pub signature: Option, - pub ak_handle: KeyHandle, - pub retry_config: Option, - } - - pub async fn register_agent( -- aa: AgentRegistration, -+ mut aa: AgentRegistration, - ctx: &mut tpm::Context<'_>, - ) -> Result<()> { - let iak_pub; -@@ -60,6 +60,28 @@ pub async fn register_agent( - let ek_pub = - &PublicBuffer::try_from(aa.ek_result.public.clone())?.marshall()?; - -+ let ac = &aa.agent_registration_config; -+ -+ // Build the registrar client first so we can query its supported API -+ // versions before performing TPM operations that depend on that version. -+ // Uses HTTPS if CA certificate is provided, otherwise plain HTTP. -+ let mut builder = RegistrarClientBuilder::new() -+ .registrar_address(ac.registrar_ip.clone()) -+ .registrar_port(ac.registrar_port) -+ .retry_config(aa.retry_config.clone()); -+ -+ if let Some(ca_cert) = &ac.registrar_ca_cert { -+ builder = builder.ca_certificate(ca_cert.clone()); -+ } -+ if let Some(disable_tls) = ac.registrar_disable_tls { -+ builder = builder.disable_tls(disable_tls); -+ } -+ if let Some(timeout) = ac.registrar_timeout { -+ builder = builder.timeout(timeout); -+ } -+ -+ let mut registrar_client = builder.build().await?; -+ - let mut ai_builder = AgentIdentityBuilder::new() - .ak_pub(ak_pub) - .ek_pub(ek_pub) -@@ -81,9 +103,7 @@ pub async fn register_agent( - - // Set the IAK/IDevID related fields, if enabled - if aa.agent_registration_config.enable_iak_idevid { -- let (Some(dev_id), Some(attest), Some(signature)) = -- (&aa.device_id, aa.attest, aa.signature) -- else { -+ let Some(dev_id) = aa.device_id.as_mut() else { - error!("IDevID and IAK are enabled but could not be generated"); - return Err(Error::ConfigurationGenericError( - "IDevID and IAK are enabled but could not be generated" -@@ -91,6 +111,36 @@ pub async fn register_agent( - )); - }; - -+ // Hash the agent UUID (SHA-256) when the registrar supports API 2.6+. -+ // This keeps qualifying data within the TPM2B_DATA size limit on -+ // SHA-256-only TPMs (34 bytes). For registrars that only support 2.5 -+ // or earlier, fall back to the raw UUID bytes for backward compat. -+ let qualifying_data = if registrar_client.supports_api_version("2.6") -+ { -+ let hash = crypto::hash( -+ aa.agent_uuid.as_bytes(), -+ openssl::hash::MessageDigest::sha256(), -+ )?; -+ Data::try_from(hash.as_slice())? -+ } else { -+ let uuid_bytes = aa.agent_uuid.as_bytes(); -+ if uuid_bytes.len() > 34 { -+ // TPM2B_DATA limit on SHA-256-only TPMs is 34 bytes. -+ // Raw UUID won't fit; the registrar must support 2.6+. -+ warn!( -+ "Agent UUID is {} bytes (max 34 for pre-2.6 registrar); \ -+ registration will likely fail. Update the registrar to 2.6+.", -+ uuid_bytes.len() -+ ); -+ } -+ Data::try_from(uuid_bytes)? -+ }; -+ -+ let (attest, signature) = -+ dev_id.certify(qualifying_data, aa.ak_handle, ctx)?; -+ -+ info!("AK certified with IAK."); -+ - iak_pub = - PublicBuffer::try_from(dev_id.iak_pubkey.clone())?.marshall()?; - idevid_pub = PublicBuffer::try_from(dev_id.idevid_pubkey.clone())? -@@ -115,28 +165,6 @@ pub async fn register_agent( - // Build the Agent Identity - let ai = ai_builder.build().await?; - -- let ac = &aa.agent_registration_config; -- -- // Build the registrar client -- // Uses HTTPS if CA certificate is provided, otherwise plain HTTP -- let mut builder = RegistrarClientBuilder::new() -- .registrar_address(ac.registrar_ip.clone()) -- .registrar_port(ac.registrar_port) -- .retry_config(aa.retry_config.clone()); -- -- // Add TLS configuration if CA certificate is provided -- if let Some(ca_cert) = &ac.registrar_ca_cert { -- builder = builder.ca_certificate(ca_cert.clone()); -- } -- if let Some(disable_tls) = ac.registrar_disable_tls { -- builder = builder.disable_tls(disable_tls); -- } -- if let Some(timeout) = ac.registrar_timeout { -- builder = builder.timeout(timeout); -- } -- -- let mut registrar_client = builder.build().await?; -- - // Request keyblob material - let keyblob = registrar_client.register_agent(&ai).await?; - -diff --git a/keylime/src/config/base.rs b/keylime/src/config/base.rs -index 31fdc44ef..eb6cee993 100644 ---- a/keylime/src/config/base.rs -+++ b/keylime/src/config/base.rs -@@ -20,7 +20,7 @@ use uuid::Uuid; - - pub static CONFIG_VERSION: &str = "2.0"; - pub static SUPPORTED_API_VERSIONS: &[&str] = -- &["2.1", "2.2", "2.3", "2.4", "2.5"]; -+ &["2.1", "2.2", "2.3", "2.4", "2.5", "2.6"]; - pub static DEFAULT_REGISTRAR_API_VERSIONS: &str = "default"; - - pub static DEFAULT_CONFIG: &str = "/etc/keylime/agent.conf"; -diff --git a/keylime/src/registrar_client.rs b/keylime/src/registrar_client.rs -index 7750a381e..04523d1a0 100644 ---- a/keylime/src/registrar_client.rs -+++ b/keylime/src/registrar_client.rs -@@ -400,6 +400,16 @@ struct Register<'a> { - } - - impl RegistrarClient { -+ /// Check if the registrar supports the given API version. -+ /// -+ /// Returns `false` if the registrar did not advertise supported versions -+ /// (e.g., it does not expose a `/version` endpoint). -+ pub fn supports_api_version(&self, version: &str) -> bool { -+ self.supported_api_versions -+ .as_ref() -+ .is_some_and(|versions| versions.iter().any(|v| v == version)) -+ } -+ - async fn try_register_agent( - &self, - ai: &AgentIdentity<'_>, -diff --git a/keylime/src/tpm.rs b/keylime/src/tpm.rs -index fb5d843ec..50c94cf5f 100644 ---- a/keylime/src/tpm.rs -+++ b/keylime/src/tpm.rs -@@ -3291,14 +3291,25 @@ pub mod tests { - .expect("failed to create IAK") - .handle; - -- let qualifying_data = "some_uuid".as_bytes(); -+ // Use a realistic UUID string (36 bytes) — the exact input size that -+ // triggers TPM_RC_SIZE on SHA-256-only TPMs without the hash fix. -+ let agent_uuid = "d432fbb3-d2f1-4a97-9ef7-75bd81c00000"; -+ let qualifying_data = crate::crypto::hash( -+ agent_uuid.as_bytes(), -+ openssl::hash::MessageDigest::sha256(), -+ ) -+ .unwrap(); //#[allow_ci] -+ -+ let data = Data::try_from(qualifying_data.as_slice()).unwrap(); //#[allow_ci] -+ let (attest, _signature) = ctx -+ .certify_credential_with_iak(data, ak_handle, iak_handle) -+ .expect("certify_credential_with_iak failed"); - -- let r = ctx.certify_credential_with_iak( -- Data::try_from(qualifying_data).unwrap(), //#[allow_ci] -- ak_handle, -- iak_handle, -+ assert_eq!( -+ attest.extra_data().value(), -+ qualifying_data.as_slice(), -+ "extra_data in Attest must equal the SHA-256 hash of the agent UUID" - ); -- assert!(r.is_ok(), "Result: {r:?}"); - - // Flush context to free TPM memory - let r = ctx.flush_context(ek_handle.into()); diff --git a/0200-rust-keylime-bump-tss-esapi.patch b/0200-rust-keylime-bump-tss-esapi.patch deleted file mode 100644 index 1b96545..0000000 --- a/0200-rust-keylime-bump-tss-esapi.patch +++ /dev/null @@ -1,713 +0,0 @@ -diff --git a/Cargo.toml b/Cargo.toml -index e52ad57..ab39a8e 100644 ---- a/Cargo.toml -+++ b/Cargo.toml -@@ -39,8 +39,8 @@ once_cell = "1.19.0" - openssl = "0.10.15" - pest = "2" - pest_derive = "2" --picky-asn1-der = "0.4" --picky-asn1-x509 = "0.12" -+picky-asn1-der = "0.5" -+picky-asn1-x509 = "0.15" - predicates = { version = "3.1.3" } - pretty_env_logger = "0.5" - rand = "0.9.2" -@@ -56,7 +56,7 @@ static_assertions = "1" - tempfile = "3.4.0" - thiserror = "2.0" - tokio = {version = "1", features = ["rt", "sync", "macros"]} --tss-esapi = {version = "7.6.0", features = ["generate-bindings"]} -+tss-esapi = {version = "7.7.0", features = ["generate-bindings"]} - url = "2.5.4" - uuid = {version = "1.3", features = ["v4"]} - zip = {version = "0.6", default-features = false, features= ["deflate"]} -diff --git a/Cargo.lock b/Cargo.lock -index 516097c..d466f3f 100644 ---- a/Cargo.lock -+++ b/Cargo.lock -@@ -30,7 +30,7 @@ dependencies = [ - "actix-service", - "actix-tls", - "actix-utils", -- "bitflags 2.4.0", -+ "bitflags 2.11.1", - "bytes", - "bytestring", - "derive_more", -@@ -343,12 +343,6 @@ dependencies = [ - "windows-targets 0.52.6", - ] - --[[package]] --name = "base64" --version = "0.21.7" --source = "registry+https://github.com/rust-lang/crates.io-index" --checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567" -- - [[package]] - name = "base64" - version = "0.22.1" -@@ -357,17 +351,15 @@ checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6" - - [[package]] - name = "bindgen" --version = "0.66.1" -+version = "0.72.1" - source = "registry+https://github.com/rust-lang/crates.io-index" --checksum = "f2b84e06fc203107bfbad243f4aba2af864eb7db3b1cf46ea0a023b0b433d2a7" -+checksum = "993776b509cfb49c750f11b8f07a46fa23e0a1386ffc01fb1e7d343efc387895" - dependencies = [ -- "bitflags 2.4.0", -+ "bitflags 2.11.1", - "cexpr", - "clang-sys", -- "lazy_static", -- "lazycell", -+ "itertools", - "log", -- "peeking_take_while", - "prettyplease", - "proc-macro2", - "quote", -@@ -375,14 +367,27 @@ dependencies = [ - "rustc-hash", - "shlex", - "syn 2.0.106", -- "which", - ] - - [[package]] - name = "bitfield" --version = "0.14.0" -+version = "0.19.4" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "21ba6517c6b0f2bf08be60e187ab64b038438f22dd755614d8fe4d4098c46419" -+dependencies = [ -+ "bitfield-macros", -+] -+ -+[[package]] -+name = "bitfield-macros" -+version = "0.19.4" - source = "registry+https://github.com/rust-lang/crates.io-index" --checksum = "2d7e60934ceec538daadb9d8432424ed043a904d8e0243f3c6446bce549a46ac" -+checksum = "f48d6ace212fdf1b45fd6b566bb40808415344642b76c3224c07c8df9da81e97" -+dependencies = [ -+ "proc-macro2", -+ "quote", -+ "syn 2.0.106", -+] - - [[package]] - name = "bitflags" -@@ -392,9 +397,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a" - - [[package]] - name = "bitflags" --version = "2.4.0" -+version = "2.11.1" - source = "registry+https://github.com/rust-lang/crates.io-index" --checksum = "b4682ae6287fcf752ecaabbfcc7b6f9b72aa33933dc23a554d853aea8eea8635" -+checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3" - - [[package]] - name = "block-buffer" -@@ -721,15 +726,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index" - checksum = "cea14ef9355e3beab063703aa9dab15afd25f0667c341310c1e5274bb1d0da18" - dependencies = [ - "libc", -- "windows-sys 0.52.0", -+ "windows-sys 0.59.0", - ] - --[[package]] --name = "error-chain" --version = "0.10.0" --source = "registry+https://github.com/rust-lang/crates.io-index" --checksum = "d9435d864e017c3c6afeac1654189b06cdb491cf2ff73dbf0d73b0f292f42ff8" -- - [[package]] - name = "fastrand" - version = "2.2.0" -@@ -902,10 +901,23 @@ checksum = "73fea8450eea4bac3940448fb7ae50d91f034f941199fcd9d909a5a07aa455f0" - dependencies = [ - "cfg-if", - "libc", -- "r-efi", -+ "r-efi 5.2.0", - "wasi 0.14.2+wasi-0.2.4", - ] - -+[[package]] -+name = "getrandom" -+version = "0.4.2" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555" -+dependencies = [ -+ "cfg-if", -+ "libc", -+ "r-efi 6.0.0", -+ "wasip2", -+ "wasip3", -+] -+ - [[package]] - name = "gimli" - version = "0.31.1" -@@ -961,6 +973,9 @@ name = "hashbrown" - version = "0.15.5" - source = "registry+https://github.com/rust-lang/crates.io-index" - checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1" -+dependencies = [ -+ "foldhash", -+] - - [[package]] - name = "heck" -@@ -1102,7 +1117,7 @@ version = "0.1.20" - source = "registry+https://github.com/rust-lang/crates.io-index" - checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0" - dependencies = [ -- "base64 0.22.1", -+ "base64", - "bytes", - "futures-channel", - "futures-util", -@@ -1261,6 +1276,12 @@ dependencies = [ - "syn 2.0.106", - ] - -+[[package]] -+name = "id-arena" -+version = "2.3.0" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954" -+ - [[package]] - name = "idna" - version = "1.0.3" -@@ -1296,6 +1317,7 @@ checksum = "f2481980430f9f78649238835720ddccc57e52df14ffce1c6f37391d61b563e9" - dependencies = [ - "equivalent", - "hashbrown", -+ "serde", - ] - - [[package]] -@@ -1331,6 +1353,15 @@ version = "1.70.1" - source = "registry+https://github.com/rust-lang/crates.io-index" - checksum = "7943c866cc5cd64cbc25b2e01621d07fa8eb2a1a23160ee81ce38704e97b8ecf" - -+[[package]] -+name = "itertools" -+version = "0.13.0" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "413ee7dfc52ee1a4949ceeb7dbc8a33f2d6c088194d9f922fb8318faf1f01186" -+dependencies = [ -+ "either", -+] -+ - [[package]] - name = "itoa" - version = "1.0.3" -@@ -1355,7 +1386,7 @@ dependencies = [ - "actix-web", - "anyhow", - "async-trait", -- "base64 0.22.1", -+ "base64", - "byteorder", - "chrono", - "config", -@@ -1385,7 +1416,6 @@ dependencies = [ - "uuid", - "wiremock", - "zip", -- "zmq", - ] - - [[package]] -@@ -1404,7 +1434,7 @@ version = "0.2.9" - dependencies = [ - "actix-rt", - "actix-web", -- "base64 0.22.1", -+ "base64", - "cfg-if", - "clap", - "config", -@@ -1423,7 +1453,6 @@ dependencies = [ - "tss-esapi", - "uuid", - "zip", -- "zmq", - ] - - [[package]] -@@ -1476,10 +1505,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" - checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe" - - [[package]] --name = "lazycell" --version = "1.3.0" -+name = "leb128fmt" -+version = "0.1.0" - source = "registry+https://github.com/rust-lang/crates.io-index" --checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55" -+checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2" - - [[package]] - name = "libc" -@@ -1547,17 +1576,6 @@ version = "2.5.0" - source = "registry+https://github.com/rust-lang/crates.io-index" - checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d" - --[[package]] --name = "metadeps" --version = "1.1.2" --source = "registry+https://github.com/rust-lang/crates.io-index" --checksum = "73b122901b3a675fac8cecf68dcb2f0d3036193bc861d1ac0e1c337f7d5254c2" --dependencies = [ -- "error-chain", -- "pkg-config", -- "toml 0.2.1", --] -- - [[package]] - name = "mime" - version = "0.3.16" -@@ -1633,7 +1651,7 @@ version = "0.50.3" - source = "registry+https://github.com/rust-lang/crates.io-index" - checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5" - dependencies = [ -- "windows-sys 0.59.0", -+ "windows-sys 0.61.2", - ] - - [[package]] -@@ -1702,7 +1720,7 @@ version = "0.10.73" - source = "registry+https://github.com/rust-lang/crates.io-index" - checksum = "8505734d46c8ab1e19a1dce3aef597ad87dcb4c37e7188231769bd6bd51cebf8" - dependencies = [ -- "bitflags 2.4.0", -+ "bitflags 2.11.1", - "cfg-if", - "foreign-types", - "libc", -@@ -1775,12 +1793,6 @@ version = "0.2.1" - source = "registry+https://github.com/rust-lang/crates.io-index" - checksum = "8835116a5c179084a830efb3adc117ab007512b535bc1a21c991d3b32a6b44dd" - --[[package]] --name = "peeking_take_while" --version = "0.1.2" --source = "registry+https://github.com/rust-lang/crates.io-index" --checksum = "19b17cddbe7ec3f8bc800887bab5e717348c95ea2ca0b1bf0837fb964dc67099" -- - [[package]] - name = "percent-encoding" - version = "2.3.1" -@@ -1833,9 +1845,9 @@ dependencies = [ - - [[package]] - name = "picky-asn1" --version = "0.8.0" -+version = "0.10.1" - source = "registry+https://github.com/rust-lang/crates.io-index" --checksum = "295eea0f33c16be21e2a98b908fdd4d73c04dd48c8480991b76dbcf0cb58b212" -+checksum = "2ff038f9360b934342fb3c0a1d6e82c438a2624b51c3c6e3e6d7cf252b6f3ee3" - dependencies = [ - "oid", - "serde", -@@ -1844,9 +1856,9 @@ dependencies = [ - - [[package]] - name = "picky-asn1-der" --version = "0.4.1" -+version = "0.5.6" - source = "registry+https://github.com/rust-lang/crates.io-index" --checksum = "5df7873a9e36d42dadb393bea5e211fe83d793c172afad5fb4ec846ec582793f" -+checksum = "d413165e4bf7f808b9a27cbaba657657a2921f0965db833f488c4d4be96dcd2e" - dependencies = [ - "picky-asn1", - "serde", -@@ -1855,11 +1867,11 @@ dependencies = [ - - [[package]] - name = "picky-asn1-x509" --version = "0.12.0" -+version = "0.15.4" - source = "registry+https://github.com/rust-lang/crates.io-index" --checksum = "2c5f20f71a68499ff32310f418a6fad8816eac1a2859ed3f0c5c741389dd6208" -+checksum = "859d4117bd1b1dc5646359ee7243c50c5000c0920ea2d1fb120335a2f4c684b8" - dependencies = [ -- "base64 0.21.7", -+ "base64", - "oid", - "picky-asn1", - "picky-asn1-der", -@@ -1908,9 +1920,9 @@ dependencies = [ - - [[package]] - name = "prettyplease" --version = "0.2.16" -+version = "0.2.37" - source = "registry+https://github.com/rust-lang/crates.io-index" --checksum = "a41cf62165e97c7f814d2221421dbb9afcbcdb0a88068e5ea206e19951c2cbb5" -+checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b" - dependencies = [ - "proc-macro2", - "syn 2.0.106", -@@ -1918,9 +1930,9 @@ dependencies = [ - - [[package]] - name = "proc-macro2" --version = "1.0.92" -+version = "1.0.106" - source = "registry+https://github.com/rust-lang/crates.io-index" --checksum = "37d3544b3f2748c54e147655edb5025752e2303145b5aefb3c3ea2c78b973bb0" -+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934" - dependencies = [ - "unicode-ident", - ] -@@ -1940,6 +1952,12 @@ version = "5.2.0" - source = "registry+https://github.com/rust-lang/crates.io-index" - checksum = "74765f6d916ee2faa39bc8e68e4f3ed8949b48cccdac59983d287a7cb71ce9c5" - -+[[package]] -+name = "r-efi" -+version = "6.0.0" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf" -+ - [[package]] - name = "rand" - version = "0.9.2" -@@ -2007,7 +2025,7 @@ version = "0.13.2" - source = "registry+https://github.com/rust-lang/crates.io-index" - checksum = "ab3f43e3283ab1488b624b44b0e988d0acea0b3214e694730a055cb6b2efa801" - dependencies = [ -- "base64 0.22.1", -+ "base64", - "bytes", - "futures-core", - "http 1.4.0", -@@ -2088,9 +2106,9 @@ checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f" - - [[package]] - name = "rustc-hash" --version = "1.1.0" -+version = "2.1.2" - source = "registry+https://github.com/rust-lang/crates.io-index" --checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2" -+checksum = "94300abf3f1ae2e2b8ffb7b58043de3d399c73fa6f4b73826402a5c457614dbe" - - [[package]] - name = "rustix" -@@ -2098,11 +2116,11 @@ version = "1.0.7" - source = "registry+https://github.com/rust-lang/crates.io-index" - checksum = "c71e83d6afe7ff64890ec6b71d6a69bb8a610ab78ce364b3352876bb4c801266" - dependencies = [ -- "bitflags 2.4.0", -+ "bitflags 2.11.1", - "errno", - "libc", - "linux-raw-sys", -- "windows-sys 0.52.0", -+ "windows-sys 0.59.0", - ] - - [[package]] -@@ -2161,6 +2179,12 @@ dependencies = [ - "libc", - ] - -+[[package]] -+name = "semver" -+version = "1.0.28" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd" -+ - [[package]] - name = "serde" - version = "1.0.228" -@@ -2553,12 +2577,6 @@ dependencies = [ - "tracing", - ] - --[[package]] --name = "toml" --version = "0.2.1" --source = "registry+https://github.com/rust-lang/crates.io-index" --checksum = "736b60249cb25337bc196faa43ee12c705e426f3d55c214d73a4e7be06f92cb4" -- - [[package]] - name = "toml" - version = "0.5.9" -@@ -2628,7 +2646,7 @@ version = "0.6.8" - source = "registry+https://github.com/rust-lang/crates.io-index" - checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8" - dependencies = [ -- "bitflags 2.4.0", -+ "bitflags 2.11.1", - "bytes", - "futures-util", - "http 1.4.0", -@@ -2734,13 +2752,13 @@ dependencies = [ - - [[package]] - name = "tss-esapi" --version = "7.6.0" -+version = "7.7.0" - source = "registry+https://github.com/rust-lang/crates.io-index" --checksum = "78ea9ccde878b029392ac97b5be1f470173d06ea41d18ad0bb3c92794c16a0f2" -+checksum = "3f10b25a84912b894d0e6d68f4a3771c923e9c44ddaaed7920cde92ed28aa84e" - dependencies = [ - "bitfield", - "enumflags2", -- "getrandom 0.2.16", -+ "getrandom 0.4.2", - "hostname-validator", - "log", - "mbox", -@@ -2757,9 +2775,9 @@ dependencies = [ - - [[package]] - name = "tss-esapi-sys" --version = "0.5.0" -+version = "0.6.0" - source = "registry+https://github.com/rust-lang/crates.io-index" --checksum = "535cd192581c2ec4d5f82e670b1d3fbba6a23ccce8c85de387642051d7cad5b5" -+checksum = "a7f972672926a3d3d18ecc04524720e4d20b7d1664a3fb73dbf7d4274196dbd9" - dependencies = [ - "bindgen", - "pkg-config", -@@ -2873,6 +2891,24 @@ dependencies = [ - "wit-bindgen-rt", - ] - -+[[package]] -+name = "wasip2" -+version = "1.0.3+wasi-0.2.9" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "20064672db26d7cdc89c7798c48a0fdfac8213434a1186e5ef29fd560ae223d6" -+dependencies = [ -+ "wit-bindgen 0.57.1", -+] -+ -+[[package]] -+name = "wasip3" -+version = "0.4.0+wasi-0.3.0-rc-2026-01-06" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5" -+dependencies = [ -+ "wit-bindgen 0.51.0", -+] -+ - [[package]] - name = "wasm-bindgen" - version = "0.2.100" -@@ -2943,6 +2979,40 @@ dependencies = [ - "unicode-ident", - ] - -+[[package]] -+name = "wasm-encoder" -+version = "0.244.0" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319" -+dependencies = [ -+ "leb128fmt", -+ "wasmparser", -+] -+ -+[[package]] -+name = "wasm-metadata" -+version = "0.244.0" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909" -+dependencies = [ -+ "anyhow", -+ "indexmap", -+ "wasm-encoder", -+ "wasmparser", -+] -+ -+[[package]] -+name = "wasmparser" -+version = "0.244.0" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe" -+dependencies = [ -+ "bitflags 2.11.1", -+ "hashbrown", -+ "indexmap", -+ "semver", -+] -+ - [[package]] - name = "wasmtimer" - version = "0.4.3" -@@ -2967,17 +3037,6 @@ dependencies = [ - "wasm-bindgen", - ] - --[[package]] --name = "which" --version = "4.3.0" --source = "registry+https://github.com/rust-lang/crates.io-index" --checksum = "1c831fbbee9e129a8cf93e7747a82da9d95ba8e16621cae60ec2cdc849bacb7b" --dependencies = [ -- "either", -- "libc", -- "once_cell", --] -- - [[package]] - name = "winapi" - version = "0.3.9" -@@ -3361,7 +3420,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" - checksum = "08db1edfb05d9b3c1542e521aea074442088292f00b5f28e435c714a98f85031" - dependencies = [ - "assert-json-diff", -- "base64 0.22.1", -+ "base64", - "deadpool", - "futures", - "http 1.4.0", -@@ -3377,13 +3436,107 @@ dependencies = [ - "url", - ] - -+[[package]] -+name = "wit-bindgen" -+version = "0.51.0" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5" -+dependencies = [ -+ "wit-bindgen-rust-macro", -+] -+ -+[[package]] -+name = "wit-bindgen" -+version = "0.57.1" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e" -+ -+[[package]] -+name = "wit-bindgen-core" -+version = "0.51.0" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc" -+dependencies = [ -+ "anyhow", -+ "heck", -+ "wit-parser", -+] -+ - [[package]] - name = "wit-bindgen-rt" - version = "0.39.0" - source = "registry+https://github.com/rust-lang/crates.io-index" - checksum = "6f42320e61fe2cfd34354ecb597f86f413484a798ba44a8ca1165c58d42da6c1" - dependencies = [ -- "bitflags 2.4.0", -+ "bitflags 2.11.1", -+] -+ -+[[package]] -+name = "wit-bindgen-rust" -+version = "0.51.0" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21" -+dependencies = [ -+ "anyhow", -+ "heck", -+ "indexmap", -+ "prettyplease", -+ "syn 2.0.106", -+ "wasm-metadata", -+ "wit-bindgen-core", -+ "wit-component", -+] -+ -+[[package]] -+name = "wit-bindgen-rust-macro" -+version = "0.51.0" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a" -+dependencies = [ -+ "anyhow", -+ "prettyplease", -+ "proc-macro2", -+ "quote", -+ "syn 2.0.106", -+ "wit-bindgen-core", -+ "wit-bindgen-rust", -+] -+ -+[[package]] -+name = "wit-component" -+version = "0.244.0" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2" -+dependencies = [ -+ "anyhow", -+ "bitflags 2.11.1", -+ "indexmap", -+ "log", -+ "serde", -+ "serde_derive", -+ "serde_json", -+ "wasm-encoder", -+ "wasm-metadata", -+ "wasmparser", -+ "wit-parser", -+] -+ -+[[package]] -+name = "wit-parser" -+version = "0.244.0" -+source = "registry+https://github.com/rust-lang/crates.io-index" -+checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736" -+dependencies = [ -+ "anyhow", -+ "id-arena", -+ "indexmap", -+ "log", -+ "semver", -+ "serde", -+ "serde_derive", -+ "serde_json", -+ "unicode-xid", -+ "wasmparser", - ] - - [[package]] -@@ -3497,25 +3650,3 @@ dependencies = [ - "crossbeam-utils", - "flate2", - ] -- --[[package]] --name = "zmq" --version = "0.9.2" --source = "registry+https://github.com/rust-lang/crates.io-index" --checksum = "aad98a7a617d608cd9e1127147f630d24af07c7cd95ba1533246d96cbdd76c66" --dependencies = [ -- "bitflags 1.3.2", -- "libc", -- "log", -- "zmq-sys", --] -- --[[package]] --name = "zmq-sys" --version = "0.11.0" --source = "registry+https://github.com/rust-lang/crates.io-index" --checksum = "d33a2c51dde24d5b451a2ed4b488266df221a5eaee2ee519933dc46b9a9b3648" --dependencies = [ -- "libc", -- "metadeps", --] diff --git a/keylime-agent-rust.spec b/keylime-agent-rust.spec index 941dae1..bb41e14 100644 --- a/keylime-agent-rust.spec +++ b/keylime-agent-rust.spec @@ -15,7 +15,7 @@ %endif Name: keylime-agent-rust -Version: 0.2.9 +Version: 0.2.10 Release: %{?autorelease}%{!?autorelease:1%{?dist}} Summary: The Keylime agent @@ -55,22 +55,13 @@ Source0: %{url}/archive/refs/tags/v%{version}.tar.gz # Rename the vendor.tar.zstd tarball to rust-keylime-%%{version}-vendor.tar.zstd Source1: rust-keylime-%{version}-vendor.tar.zstd ## (0-99) General patches -# Drop completely the legacy-python-actions feature +# Downstream-only: Drop completely the legacy-python-actions feature Patch1: 0001-rust-keylime-metadata.patch -# Do not require /usr/libexec/keylime to be present +# Downstream-only: Do not require /usr/libexec/keylime to be present Patch2: 0002-rust-keylime-do-not-require-usr-libexec.patch -# Use the correct registrar port when TLS is enabled -# Backported from https://github.com/keylime/rust-keylime/pull/1204 -Patch3: 0003-rust-keylime-registrar-tls-port.patch -# Hash UUID before using as qualifying data for IAK-based AK certification -# Backported from https://github.com/keylime/rust-keylime/pull/1239 -Patch4: 0004-rust-keylime-hash-before-certify.patch ## (100-199) Patches for building from system Rust libraries (Fedora) ## (200+) Patches for building from vendored Rust libraries (RHEL) -# Bump tss-esapi to version 7.7.0 to fix build with clang 22 -# Backported from https://github.com/keylime/rust-keylime/pull/1236 -Patch200: 0200-rust-keylime-bump-tss-esapi.patch ExclusiveArch: %{rust_arches} @@ -179,7 +170,8 @@ The Keylime IMA emulator for testing with emulated TPM %if 0%{?bundled_rust_deps} # Source1 is vendored dependencies %cargo_prep -v vendor -%autopatch -m 200 -p1 +# Add back the line below if patches are added (do not forget the '%') +# autopatch -m 200 -p1 %else # Add back the line below if patches are added (do not forget the '%') # autopatch -m 100 -M 199 -p1 diff --git a/rust-keylime-enable-logging-keylime-lib.patch b/rust-keylime-enable-logging-keylime-lib.patch deleted file mode 100644 index bccd0a0..0000000 --- a/rust-keylime-enable-logging-keylime-lib.patch +++ /dev/null @@ -1,29 +0,0 @@ -From 43db7bdf66a11658614be63f06d74e379a18e0d8 Mon Sep 17 00:00:00 2001 -From: Anderson Toshiyuki Sasaki -Date: Tue, 21 Jan 2025 15:31:00 +0100 -Subject: [PATCH] dist: Enable logging for keylime library in the service - -Set the logging level as INFO for the keylime library in the systemd -service file. - -Some of the messages were moved from main to the library and would not -be logged without this setting. - -Signed-off-by: Anderson Toshiyuki Sasaki ---- - dist/systemd/system/keylime_agent.service | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/dist/systemd/system/keylime_agent.service b/dist/systemd/system/keylime_agent.service -index c5df621d..7ec1a7a1 100644 ---- a/dist/systemd/system/keylime_agent.service -+++ b/dist/systemd/system/keylime_agent.service -@@ -17,7 +17,7 @@ ExecStart=/usr/bin/keylime_agent - TimeoutSec=60s - Restart=on-failure - RestartSec=120s --Environment="RUST_LOG=keylime_agent=info" -+Environment="RUST_LOG=keylime_agent=info,keylime=info" - # If using swtpm with tpm2-abrmd service, uncomment the line below to set TCTI - # variable on the service environment - #Environment="TCTI=tabrmd:" diff --git a/sources b/sources index f784b3b..e19e711 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (v0.2.9.tar.gz) = f51ce187462278328a96a05dfb6315167bd3be154cb1c9ad933de33d246e696b25bb487071a824ed552456016bb64154e89f5f8a0dc76b94eb896be0f4787e9f -SHA512 (rust-keylime-0.2.9-vendor.tar.zstd) = 6bd6b38697cde0a5220d21620efb459b04a40f04ef60dc0520fac52971c5ffc3665e7d75f303e63979896b43012087b7be3e4a5149d4bedf7c6167321e2b4e3d +SHA512 (v0.2.10.tar.gz) = c61c7276330fb039cb2b161b9888af9112436039b7884e73828de586ffa31d587b0e069faa45e59f9954e724d5f8e606e1c0f8ddf2fce975e89fef0120f5ddca +SHA512 (rust-keylime-0.2.10-vendor.tar.zstd) = 5bd657091bd5b0cbe7a936b74e53c049ea8262ee1b34f94fae2045fc3ac2b9e1312c3d571ab31f2fc71786dbb70989ce0c0b3a3dba4efb9c754a3c6ec68dd941