PasswordCrypt: Fix an ABI issue

Resolves: #RHEL-251898

Signed-off-by: Nicolas Frayer <nfrayer@redhat.com>

0008-PasswordCrypt-Fix-an-ABI-issue.patch

@@ -0,0 +1,75 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Nicolas Frayer <nfrayer@redhat.com>
+Date: Mon, 31 Aug 2026 19:33:32 +0200
+Subject: [PATCH] PasswordCrypt: Fix an ABI issue
+
+By removing MD5/DES and renumbering the crypt methods, we broke
+the ABI between mokutil and MokManager.
+Reintroduced the previous methods with a comment indicating that
+they are unsupported.
+
+Signed-off-by: Nicolas Frayer <nfrayer@redhat.com>
+---
+ src/password-crypt.c | 12 ++++++++++++
+ src/password-crypt.h | 10 +++++++++-
+ 2 files changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/src/password-crypt.c b/src/password-crypt.c
+index f7107d92e57a..8c5a15ad2dc0 100644
+--- a/src/password-crypt.c
++++ b/src/password-crypt.c
+@@ -79,6 +79,10 @@ get_pw_salt_size (const HashMethod method) {
+ 		return gen_salt_size (8, 16);
+ 	case BLOWFISH_BASED:
+ 		return BLOWFISH_SALT_MAX;
++	case TRADITIONAL_DES:
++	case EXTEND_BSDI_DES:
++	case MD5_BASED:
++		return -1;
+ 	}
+ 
+ 	return -1;
+@@ -94,6 +98,10 @@ get_pw_hash_size (const HashMethod method)
+ 		return SHA512_DIGEST_LENGTH;
+ 	case BLOWFISH_BASED:
+ 		return BLOWFISH_HASH_SIZE;
++	case TRADITIONAL_DES:
++	case EXTEND_BSDI_DES:
++	case MD5_BASED:
++		return -1;
+ 	}
+ 
+ 	return -1;
+@@ -109,6 +117,10 @@ get_crypt_prefix (const HashMethod method)
+ 		return "$6$";
+ 	case BLOWFISH_BASED:
+ 		return "$2y$10$"; /* FIXME change the count */
++	case TRADITIONAL_DES:
++	case EXTEND_BSDI_DES:
++	case MD5_BASED:
++		return NULL;
+ 	}
+ 
+ 	return NULL;
+diff --git a/src/password-crypt.h b/src/password-crypt.h
+index 55980e11932e..f70e65c904ec 100644
+--- a/src/password-crypt.h
++++ b/src/password-crypt.h
+@@ -38,8 +38,16 @@
+ #define SHA512_SALT_MAX 16
+ #define BLOWFISH_SALT_MAX 22
+ 
++/*
++ * These numeric values are stored in the MokAuth EFI variable and
++ * consumed by MokManager. These need to be in sync with what's in
++ * MokManager code.
++ */
+ typedef enum {
+-	SHA256_BASED = 0,
++	TRADITIONAL_DES = 0, /* unsupported, kept for ABI compatibility*/
++	EXTEND_BSDI_DES, /* unsupported, kept for ABI compatibility*/
++	MD5_BASED, /* unsupported, kept for ABI compatibility*/
++	SHA256_BASED,
+ 	SHA512_BASED,
+ 	BLOWFISH_BASED
+ } HashMethod;

mokutil.patches

@@ -5,3 +5,4 @@ Patch0004: 0004-mokutil.c-on-test-key-return-non-zero-if-test-key-is.patch
 Patch0005: 0005-mokutil-introduce-is-sb-enabled-parameter.patch
 Patch0006: 0006-return-zero-in-case-test-key-is-enrolled.patch
 Patch0007: 0007-Remove-traditional-des-and-md5-passwords.patch
+Patch0008: 0008-PasswordCrypt-Fix-an-ABI-issue.patch

mokutil.spec

@@ -1,6 +1,6 @@
 Name:           mokutil
 Version:        0.7.2
-Release:        5%{?dist}
+Release:        6%{?dist}
 Epoch:          2
 Summary:        Tool to manage UEFI Secure Boot MoK Keys
 License:        GPL-3.0-or-later
@@ -47,6 +47,10 @@ mokutil provides a tool to manage keys for Secure Boot through the MoK
 %{_datadir}/bash-completion/completions/mokutil
 
 %changelog
+* Tue Sep 01 2026 Nicolas Frayer <nfrayer@redhat.com> - 0.7.2-6
+- Remove MD5 and DES password support
+- Resolves: #RHEL-251898
+
 * Wed Jun 24 2026 Nicolas Frayer <nfrayer@redhat.com> - 0.7.2-5
 - Remove MD5 and DES password support
 - Resolves: #RHEL-176564