import CS linux-sgx-2.26-7.el9

.gitignore

@@ -1,17 +1,16 @@
-/dcap-qvl-*.tar.gz
-/dcap-qvs-*.tar.gz
-/intel-sgx-ssl-*.tar.gz
-/ippcp_*.tar.gz
-/jwt-cpp-*.tar.gz
-/libcbor-*.tar.gz
-/linux-sgx-*.tar.gz
-/openssl-*.tar.gz
-/prebuilt_dcap_*.tar.gz
-/sgx-emm-*.tar.gz
-/tinyxml2-*.tar.gz
-/wasm-micro-runtime-*.tar.gz
-/DCAP_*.tar.gz
-*~
-/dcap-*-pccs-node-modules.tar.xz
-/node-ffi-rs-*-vendor.tar.gz
-/node-ffi-rs-*.tar.gz
+SOURCES/DCAP_1.23.tar.gz
+SOURCES/dcap-1.23-20260204-pccs-node-modules.tar.xz
+SOURCES/dcap-qvl-1.21.tar.gz
+SOURCES/dcap-qvs-1.1.0-2885.tar.gz
+SOURCES/intel-sgx-ssl-3.1.6_Rev1.tar.gz
+SOURCES/ippcp_2021.12.1.tar.gz
+SOURCES/jwt-cpp-0.6.0.tar.gz
+SOURCES/libcbor-0.10.2.tar.gz
+SOURCES/linux-sgx-2.26.tar.gz
+SOURCES/node-ffi-rs-1.2.6-vendor.tar.gz
+SOURCES/node-ffi-rs-1.2.6.tar.gz
+SOURCES/openssl-3.1.6.tar.gz
+SOURCES/prebuilt_dcap_1.23-repacked.tar.gz
+SOURCES/sgx-emm-1.0.3.tar.gz
+SOURCES/tinyxml2-10.0.0.tar.gz
+SOURCES/wasm-micro-runtime-1.0.0.tar.gz

.linux-sgx.metadata

@@ -0,0 +1,16 @@
+0f02abd418ab9ef91a0a82c621d5efdfeb62cced SOURCES/DCAP_1.23.tar.gz
+29ff22018490f7ea1f5d7b157313bb6d3e101247 SOURCES/dcap-1.23-20260204-pccs-node-modules.tar.xz
+ae0bef56634efa2e7ab1b3ebb80144227166d5b3 SOURCES/dcap-qvl-1.21.tar.gz
+7babe0b9801502798cd46b19e5bffdc73310fb5f SOURCES/dcap-qvs-1.1.0-2885.tar.gz
+c57669dbba811553d624924aec70d6836027a11a SOURCES/intel-sgx-ssl-3.1.6_Rev1.tar.gz
+2a2b1aa1e1c12b6caefa29be32e2dec3b9b4a269 SOURCES/ippcp_2021.12.1.tar.gz
+099ce276013fbb934a03581ca799e690e7e82ed8 SOURCES/jwt-cpp-0.6.0.tar.gz
+926051e0ad493c19b7e19b4ff0c360e3b1afa70c SOURCES/libcbor-0.10.2.tar.gz
+da97d22450cf282156e3833f8f767502eaeb2e6a SOURCES/linux-sgx-2.26.tar.gz
+fd19d26fd057e51ca4212738051ba57060fc840d SOURCES/node-ffi-rs-1.2.6-vendor.tar.gz
+c06dfac5992809f860069e07282d5c6a35efa53d SOURCES/node-ffi-rs-1.2.6.tar.gz
+2ab959fbc11283a0bc7a39e33b8f6862372cfc9a SOURCES/openssl-3.1.6.tar.gz
+df5ea1a6bfb7ba0372eb0660331ea6ababfe4685 SOURCES/prebuilt_dcap_1.23-repacked.tar.gz
+8fd7f0aa93654ecf2efaf36d9f3dbef386bf9893 SOURCES/sgx-emm-1.0.3.tar.gz
+c9030c4bfa0f7cd5ea3a6669f8bf038a2ffcdfed SOURCES/tinyxml2-10.0.0.tar.gz
+a2dda9426ce3ed4a59585e08bc6d19339cde4626 SOURCES/wasm-micro-runtime-1.0.0.tar.gz

0115-Use-distro-provided-rapidjson-package.patch

@@ -1,174 +0,0 @@
-From 40d434d75ff4978cd968b4d140af5aa8c8f602c2 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Mon, 26 Feb 2024 12:19:51 +0000
-Subject: [PATCH 115/136] Use distro provided rapidjson package
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
----
- QuoteGeneration/qcnl/certification_provider.cpp             | 2 +-
- QuoteGeneration/qcnl/inc/pccs_response_object.h             | 4 ++--
- QuoteGeneration/qcnl/inc/qcnl_config.h                      | 2 +-
- QuoteGeneration/qcnl/linux/Makefile                         | 2 +-
- QuoteGeneration/qcnl/linux/qcnl_config_impl.cpp             | 2 +-
- QuoteGeneration/qcnl/qcnl_config.cpp                        | 6 +++---
- QuoteVerification/buildenv.mk                               | 4 ++--
- tools/PCKCertSelection/PCKCertSelectionLib/Makefile         | 4 ++--
- .../PCKCertSelectionLib/Makefile.static_lib                 | 4 ++--
- 9 files changed, 15 insertions(+), 15 deletions(-)
-
-diff --git a/QuoteGeneration/qcnl/certification_provider.cpp b/QuoteGeneration/qcnl/certification_provider.cpp
-index a08ea7e7..41e5b9d0 100644
---- a/QuoteGeneration/qcnl/certification_provider.cpp
-+++ b/QuoteGeneration/qcnl/certification_provider.cpp
-@@ -36,7 +36,7 @@
-  */
- #include "certification_provider.h"
- #include "certification_service.h"
--#include "document.h"
-+#include <rapidjson/document.h>
- #include "local_cache.h"
- #include "pck_cert_selection.h"
- #include "qcnl_util.h"
-diff --git a/QuoteGeneration/qcnl/inc/pccs_response_object.h b/QuoteGeneration/qcnl/inc/pccs_response_object.h
-index f1f545f0..2153b6fa 100644
---- a/QuoteGeneration/qcnl/inc/pccs_response_object.h
-+++ b/QuoteGeneration/qcnl/inc/pccs_response_object.h
-@@ -37,7 +37,7 @@
- #define PCCSRESPONSEOBJECT_H_
- #pragma once
- 
--#include "document.h"
-+#include <rapidjson/document.h>
- #include "qcnl_def.h"
- #include <sstream>
- #include <string>
-@@ -148,4 +148,4 @@ public:
-     }
- };
- 
--#endif
-\ No newline at end of file
-+#endif
-diff --git a/QuoteGeneration/qcnl/inc/qcnl_config.h b/QuoteGeneration/qcnl/inc/qcnl_config.h
-index ff3c744d..71b9a996 100644
---- a/QuoteGeneration/qcnl/inc/qcnl_config.h
-+++ b/QuoteGeneration/qcnl/inc/qcnl_config.h
-@@ -38,7 +38,7 @@
- #pragma once
- 
- #include "sgx_default_qcnl_wrapper.h"
--#include "document.h"
-+#include <rapidjson/document.h>
- #include <memory>
- #include <string>
- 
-diff --git a/QuoteGeneration/qcnl/linux/Makefile b/QuoteGeneration/qcnl/linux/Makefile
-index 531f40b8..5c569515 100644
---- a/QuoteGeneration/qcnl/linux/Makefile
-+++ b/QuoteGeneration/qcnl/linux/Makefile
-@@ -43,7 +43,7 @@ CNL_Lib_Include_Paths := -I../../quote_wrapper/common/inc       \
-                          -I../inc -I$(SGX_SDK)/include          \
-                          -I../../common/inc/internal            \
-                          -I../../pce_wrapper/inc                \
--                         -I../../../QuoteVerification/QVL/Src/ThirdParty/rapidjson/include/rapidjson	\
-+                         $(pkg-config --cflags RapidJSON) \
-                          -I../../../tools/PCKCertSelection/include
- 
- CNL_Lib_Common_Flags := $(COMMON_FLAGS) -g -fPIC -Wno-attributes $(CNL_Lib_Include_Paths) $(pkg-config --cflags libcrypto)
-diff --git a/QuoteGeneration/qcnl/linux/qcnl_config_impl.cpp b/QuoteGeneration/qcnl/linux/qcnl_config_impl.cpp
-index 7b74eae0..5f20a1e3 100644
---- a/QuoteGeneration/qcnl/linux/qcnl_config_impl.cpp
-+++ b/QuoteGeneration/qcnl/linux/qcnl_config_impl.cpp
-@@ -35,7 +35,7 @@
-  *
-  */
- 
--#include "istreamwrapper.h"
-+#include <rapidjson/istreamwrapper.h>
- #include "qcnl_config.h"
- #include <algorithm>
- #include <curl/curl.h>
-diff --git a/QuoteGeneration/qcnl/qcnl_config.cpp b/QuoteGeneration/qcnl/qcnl_config.cpp
-index 42388a08..9be8feec 100644
---- a/QuoteGeneration/qcnl/qcnl_config.cpp
-+++ b/QuoteGeneration/qcnl/qcnl_config.cpp
-@@ -36,10 +36,10 @@
-  */
- 
- #include "qcnl_config.h"
--#include "error/en.h"
--#include "error/error.h"
-+#include <rapidjson/error/en.h>
-+#include <rapidjson/error/error.h>
- #include <fstream>
--#include <istreamwrapper.h>
-+#include <rapidjson/istreamwrapper.h>
- #include <mutex>
- #include <algorithm>
- 
-diff --git a/QuoteVerification/buildenv.mk b/QuoteVerification/buildenv.mk
-index 982c7d56..854b70ac 100644
---- a/QuoteVerification/buildenv.mk
-+++ b/QuoteVerification/buildenv.mk
-@@ -72,9 +72,9 @@ else
- COMMON_INCLUDE := -I$(SGX_SDK)/include -I$(SGX_SDK)/include/tlibc -I$(SGX_SDK)/include/libcxx -I$(SGXSSL_PACKAGE_PATH)/include
- endif
- 
--QVL_LIB_INC := -I$(QVL_COMMON_PATH)/include -I$(QVL_COMMON_PATH)/include/Utils -I$(QVL_LIB_PATH)/include -I$(QVL_LIB_PATH)/src -I$(QVL_PARSER_PATH)/include -I$(QVL_SRC_PATH)/ThirdParty/rapidjson/include  -I$(DCAP_EXTERNAL_DIR)/jwt-cpp/include
-+QVL_LIB_INC := -I$(QVL_COMMON_PATH)/include -I$(QVL_COMMON_PATH)/include/Utils -I$(QVL_LIB_PATH)/include -I$(QVL_LIB_PATH)/src -I$(QVL_PARSER_PATH)/include $(pkg-config --cflags RapidJSON)  -I$(DCAP_EXTERNAL_DIR)/jwt-cpp/include
- 
--QVL_PARSER_INC := -I$(QVL_COMMON_PATH)/include -I$(QVL_COMMON_PATH)/include/Utils -I$(QVL_SRC_PATH) -I$(QVL_PARSER_PATH)/include -I$(QVL_PARSER_PATH)/src -I$(QVL_LIB_PATH)/include -I$(QVL_SRC_PATH)/ThirdParty/rapidjson/include
-+QVL_PARSER_INC := -I$(QVL_COMMON_PATH)/include -I$(QVL_COMMON_PATH)/include/Utils -I$(QVL_SRC_PATH) -I$(QVL_PARSER_PATH)/include -I$(QVL_PARSER_PATH)/src -I$(QVL_LIB_PATH)/include $(pkg-config --cflags RapidJSON)
- 
- QVL_LIB_FILES := $(sort $(wildcard $(QVL_LIB_PATH)/src/*.cpp) $(wildcard $(QVL_LIB_PATH)/src/*/*.cpp) $(wildcard $(QVL_LIB_PATH)/src/*/*/*.cpp) $(wildcard $(QVL_COMMON_PATH)/src/Utils/*.cpp))
- QVL_PARSER_FILES := $(sort $(wildcard $(QVL_PARSER_PATH)/src/*.cpp) $(wildcard $(QVL_PARSER_PATH)/src/*/*.cpp))
-diff --git a/tools/PCKCertSelection/PCKCertSelectionLib/Makefile b/tools/PCKCertSelection/PCKCertSelectionLib/Makefile
-index c106ab4f..117f88fd 100644
---- a/tools/PCKCertSelection/PCKCertSelectionLib/Makefile
-+++ b/tools/PCKCertSelection/PCKCertSelectionLib/Makefile
-@@ -66,7 +66,7 @@ endif
- OPENSSL_INC 		:= $(pkg-config --cflags libcrypto)
- 
- # JSON parser include dir
--JSON_INC		:= $(QVL_DIR)/ThirdParty/rapidjson/include
-+JSON_INC		:= $(pkg-config --cflags RapidJSON)
- 
- # QVL Attestation Parsers include directory
- PARSERS_INC 		:= $(QVL_DIR)/AttestationParsers/include
-@@ -113,7 +113,7 @@ LIB_CPP_OBJECTS 	:= \
- 	$(UTILS_CPP_FILES:.cpp=.o)
- 
- # include paths, local, parser and openssl
--LIB_INCLUDE_PATHS	:= -I. -I$(PROJ_ROOT_DIR)/include $(OPENSSL_INC) -I$(JSON_INC) -I$(PARSERS_INC) -I$(PARSERS_COMM_INC) -I$(PARSERS_DIR) -I$(VER_DIR) -I$(PARSERS_UTIL_INC)
-+LIB_INCLUDE_PATHS	:= -I. -I$(PROJ_ROOT_DIR)/include $(OPENSSL_INC) $(JSON_INC) -I$(PARSERS_INC) -I$(PARSERS_COMM_INC) -I$(PARSERS_DIR) -I$(VER_DIR) -I$(PARSERS_UTIL_INC)
- 
- # the library shared object name
- LIB_NAME		:= libPCKCertSelection.so
-diff --git a/tools/PCKCertSelection/PCKCertSelectionLib/Makefile.static_lib b/tools/PCKCertSelection/PCKCertSelectionLib/Makefile.static_lib
-index c8e1d01e..6f1440a6 100644
---- a/tools/PCKCertSelection/PCKCertSelectionLib/Makefile.static_lib
-+++ b/tools/PCKCertSelection/PCKCertSelectionLib/Makefile.static_lib
-@@ -69,7 +69,7 @@ OPENSSL_INC 		:= $(PROJ_ROOT_DIR)/../../prebuilt/openssl/inc
- OPENSSL_LIB 		:= $(PROJ_ROOT_DIR)/../../prebuilt/openssl/lib/linux64
- 
- # JSON parser include dir
--JSON_INC		:= $(QVL_DIR)/ThirdParty/rapidjson/include
-+JSON_INC		:= $(pkg-config --cflags RapidJSON)
- 
- # QVL Attestation Parsers include directory
- PARSERS_INC 		:= $(QVL_DIR)/AttestationParsers/include
-@@ -118,7 +118,7 @@ LIB_CPP_OBJECTS 	:= \
- LIB_CPP_OBJECTS := $(addprefix $(BIN_DIR)/, $(LIB_CPP_OBJECTS))
- 
- # include paths, local, parser and openssl
--LIB_INCLUDE_PATHS	:= -I. -I$(PROJ_ROOT_DIR)/include $(pkg-config --cflags libcrypto) -I$(JSON_INC) -I$(PARSERS_INC) -I$(PARSERS_COMM_INC) -I$(PARSERS_DIR) -I$(VER_DIR) -I$(PARSERS_UTIL_INC)
-+LIB_INCLUDE_PATHS	:= -I. -I$(PROJ_ROOT_DIR)/include $(pkg-config --cflags libcrypto) $(JSON_INC) -I$(PARSERS_INC) -I$(PARSERS_COMM_INC) -I$(PARSERS_DIR) -I$(VER_DIR) -I$(PARSERS_UTIL_INC)
- 
- # the library shared object name
- LIB_NAME		:= libPCKCertSelection.a
--- 
-2.52.0
-

SPECS/linux-sgx.spec

@@ -1,3 +1,13 @@
+## START: Set by rpmautospec
+## (rpmautospec version 0.6.5)
+## RPMAUTOSPEC: autorelease, autochangelog
+%define autorelease(e:s:pb:n) %{?-p:0.}%{lua:
+    release_number = 7;
+    base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}"));
+    print(release_number + base_release_number - 1);
+}%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}}
+## END: Set by rpmautospec
+
 
 # The enclave code must be built with very specific build
 # flags, that are different from what is used to build
@@ -1776,4 +1786,46 @@ fi
 
 
 %changelog
-%autochangelog
+## START: Generated by rpmautospec
+* Thu Feb 05 2026 Daniel P. Berrangé <berrange@redhat.com> - 2.26-7
+- Fix pccs npm security flaws
+
+* Wed Dec 10 2025 Daniel P. Berrangé <berrange@redhat.com> - 2.26-6
+- Port to pycryptography and pyasn1 and make keyring optional
+
+* Wed Dec 10 2025 Daniel P. Berrangé <berrange@redhat.com> - 2.26-5
+- Sync specfile changes from Fedora
+
+* Wed Dec 10 2025 Daniel P. Berrangé <berrange@redhat.com> - 2.26-4
+- Drop sgx-mpa dep from sgx-pccs
+
+* Wed Dec 10 2025 Daniel P. Berrangé <berrange@redhat.com> - 2.26-3
+- Add scriptlets for PCCS
+
+* Wed Dec 10 2025 Daniel P. Berrangé <berrange@redhat.com> - 2.26-2
+- Enable pccsadmin everywhere
+
+* Tue Nov 18 2025 Daniel P. Berrangé <berrange@redhat.com> - 2.26-1
+- Update to SGX 2.26 / DCAP 1.23, adding PCCS service
+
+* Mon Nov 17 2025 Daniel P. Berrangé <berrange@redhat.com> - 2.25-7
+- Trigger udev to set perms on /dev/sgx_provision
+
+* Mon Jun 16 2025 Daniel P. Berrangé <berrange@redhat.com> - 2.25-6
+- Temporarily disable automatic tier1 gating
+
+* Mon Jun 09 2025 Daniel P. Berrangé <berrange@redhat.com> - 2.25-5
+- Adapt qgs.service for SELinux policy and sock perms
+
+* Wed Apr 16 2025 Daniel P. Berrangé <berrange@redhat.com> - 2.25-4
+- Honour CFLAGS/CXXFLAGS/LDFLAGS for host software
+
+* Tue Apr 01 2025 Daniel P. Berrangé <berrange@redhat.com> - 2.25-3
+- Fix paths to binaries in service files
+
+* Wed Mar 19 2025 Daniel P. Berrangé <berrange@redhat.com> - 2.25-2
+- Add basic gating config
+
+* Wed Mar 19 2025 Daniel P. Berrangé <berrange@redhat.com> - 2.25-1
+- Initial import
+## END: Generated by rpmautospec

download.sh

@@ -1,15 +0,0 @@
-#!/bin/sh
-
-set -e
-
-spec=linux-sgx.spec
-
-for url in $(rpmspec -P ${spec} 2>/dev/null | grep Source | grep http | awk '{print $2}')
-do
-    tarball=$(basename ${url})
-    echo "Check $url -> $tarball"
-    if ! test -f ${tarball}
-    then
-        wget -O $tarball ${url}
-    fi
-done

gating.yaml

@@ -1,5 +0,0 @@
---- !Policy
-product_versions:
-  - rhel-10
-decision_context: osci_compose_gate
-rules: []

sources

@@ -1,16 +0,0 @@
-SHA512 (DCAP_1.23.tar.gz) = 02fe956c176362079094c5009ce48d6dc4d17233217a9d6d779707893231e68b065ca02a458d5b06e518b99185f00e3d0e5f6c4165bbde1fe22b87d52f952e29
-SHA512 (dcap-qvl-1.21.tar.gz) = 62ab0d9f48c9a8d975cb861ac5161770b990af3bbc8ff67a8b9ca48af86565b6d445cfe87786d332a65efee22114de2e2a4589722625cbc4fc6b58647599626d
-SHA512 (dcap-qvs-1.1.0-2885.tar.gz) = 811663f713902f263e3d8ad7cc7d62e92f76f1618c5ac8b5366dc880d79509a0d349328ac2d8f9dc2170e09d80ac00ec934f7cbf3594bec9cb69b6b544ca30e6
-SHA512 (intel-sgx-ssl-3.1.6_Rev1.tar.gz) = cbcae2df7a2518fa00e05dacb708b39ba0d1f1aa23f12a97c403dbbd02a81965b3f682257302e20fe837fe6abc00848e955b9e02e12eafb6973a358c24c4a6d5
-SHA512 (ippcp_2021.12.1.tar.gz) = cdde7eed0f27b80663bf6a131abd8e6afcf16f0b9897ae12e251dc6bd3a9cc15c7666e4276eb4ba4b3b66fa93b5115c29537e176a6a2fb0de1b17cfcc1b7c426
-SHA512 (jwt-cpp-0.6.0.tar.gz) = b6d5ebb3a7eeb6fef9a1d41c707251d1ab05bf47920c280d5203f1b9ee5bf6f8e914cd2ffaed66550cfa6d78c34465d4cf86517a759d5f8739b429faf1c2c0ef
-SHA512 (libcbor-0.10.2.tar.gz) = 23c6177443778d4b4833ec7ed0d0e639a0d4863372e3a38d772fdce2673eae6d5cb2a31a2a021d1a699082ea53494977c907fd0e94149b97cb23a4b6d039228a
-SHA512 (linux-sgx-2.26.tar.gz) = 129ee9d6f2d33157f0d96adef1a6c44a801a1064c1c0c75f8bf61f7085408e1de34f59d7acab26f7db32618b1f3ba2c08e2ffa8879f43450c14f085d902ab687
-SHA512 (node-ffi-rs-1.2.6.tar.gz) = 37f95562e5a61b60949c59d024bea2e2d02c6bf1b21a3bc07d558538d05082a03d1ba2eb8e4500fd4ccd7e556aae0c60fc875d487b2d2d54c8302757f69dc003
-SHA512 (node-ffi-rs-1.2.6-vendor.tar.gz) = 76d59d69a842ce207dce21f12a8ada3b3b1b81a93ccd3a0b68838cea4aad1cbdba0a314ff7208b43caf6435e820a226ab1e8f8477bedcdb323eec80976ab96be
-SHA512 (openssl-3.1.6.tar.gz) = 18ca07ee6a98d5fe46accfa0156e0354ad770d78bbbbe8e4bb92b316a0e4404f17a34eb700f17ed355d826a4b2166894aa46d8dd81fedbcb16aa1aad0926a390
-SHA512 (prebuilt_dcap_1.23-repacked.tar.gz) = a253b7ea5a9a0c73a31259bb852ad5942d9c11c98ea23616bec3cef028ed135090a5837895a1a5771bc8507caec1c1a6c845bd12e01864bfd79fb1827867ce66
-SHA512 (sgx-emm-1.0.3.tar.gz) = 0ec9f0133b3a32409c8af61568a47128a1860407170b9b274647140ac36069851638d7282649e23590131d44ca93f839fd2ffe4b9b39821631d279c1384874bf
-SHA512 (wasm-micro-runtime-1.0.0.tar.gz) = fb16a992b54f5c006be386b72ff65c680ededaafe7f2010db163b6e4365d198cc96f06ae60ac42986aaf45609803ffc1722308277474c341673e391f9bc4846e
-SHA512 (dcap-1.23-20260204-pccs-node-modules.tar.xz) = c075a7f84e8dfcbfc1e4fdf57221f7914394a06b70c2abe5ccf63bc95a3e3228b92931ef0966fbdb85ac6ab5d436a45389e6eed3fa5af49a6b420714593b4f22
-SHA512 (tinyxml2-10.0.0.tar.gz) = a359d33bc12fad455b53d81011dbe12727cae0aabfaa5704f1a25807ca216dd854a571291029886c0beedeca5c3b6393dd49c4718773e18a0e008abbdb3de36a