Compare commits

..

No commits in common. "c8" and "c9-beta" have entirely different histories.
c8 ... c9-beta

8 changed files with 96 additions and 1882 deletions

2
.gitignore vendored
View File

@ -1 +1 @@
SOURCES/tang-7.tar.bz2 SOURCES/tang-14.tar.xz

1
.tang.metadata Normal file
View File

@ -0,0 +1 @@
81a09f024fcb0e8b53bb867b2679ebab14555791 SOURCES/tang-14.tar.xz

File diff suppressed because it is too large Load Diff

View File

@ -1,38 +0,0 @@
From ea43ca02cf52d0455c6949683692a95e38ccdf70 Mon Sep 17 00:00:00 2001
From: Sergio Correia <scorreia@redhat.com>
Date: Fri, 4 Dec 2020 09:05:19 -0300
Subject: [PATCH 2/2] Exit with success unless the issue was with with tangd
itself
When an HTTP parser error happens, tangd is currently exiting with an
error status, which may cause trouble in some scenarios [1].
However, we don't exit with an error in situations where we try requests
that do not exist, for instance. It makes sense to only exit with an
error when the error was with tangd itself, e.g.: when we are unable to
read the directory with the keys, not when the actual HTTP operation
does not succeed for some reason.
Upstream: https://github.com/latchset/tang/pull/55
[1] https://bugzilla.redhat.com/show_bug.cgi?id=1828558
---
src/tangd.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/tangd.c b/src/tangd.c
index b569f38..d40201f 100644
--- a/src/tangd.c
+++ b/src/tangd.c
@@ -225,7 +225,7 @@ main(int argc, char *argv[])
if (parser.http_errno != 0) {
fprintf(stderr, "HTTP Parsing Error: %s\n",
http_errno_description(parser.http_errno));
- return EXIT_FAILURE;
+ return EXIT_SUCCESS;
}
memmove(req, &req[r], rcvd - r);
--
2.27.0

View File

@ -1,31 +0,0 @@
--- tang-7.ori/src/tangd-keygen 2017-06-10 15:29:39.000000000 +0200
+++ tang-7/src/tangd-keygen 2023-06-28 11:40:01.700819479 +0200
@@ -27,6 +27,8 @@
[ $# -eq 3 ] && sig=$2 && exc=$3
+# Set default umask for file creation.
+umask 0337
jwe=`jose jwk gen -i '{"alg":"ES512"}'`
[ -z "$sig" ] && sig=`echo "$jwe" | jose jwk thp -i-`
echo "$jwe" > $1/$sig.jwk
--- tang-7.ori/src/keys.c 2023-06-28 09:57:08.706712410 +0200
+++ tang-7/src/keys.c 2023-06-28 11:43:41.742247417 +0200
@@ -23,6 +23,7 @@
#include <jose/io.h>
#include <jansson.h>
#include <string.h>
+#include <sys/stat.h>
#include "util.h"
#include "keys.h"
@@ -557,6 +558,9 @@
/* At this point, there are no keys, so let's create them. */
const char *alg[] = {"ES512", "ECMR", NULL};
char path[PATH_MAX];
+
+ /* Set default umask for file creation. */
+ umask(0337);
for (int i = 0; alg[i] != NULL; i++) {
struct tang_jwk *jwk __attribute__((cleanup(cleanup_tang_jwk))) = generate_new_tang_jwk(alg[i]);
if (!jwk) {

View File

@ -1,26 +0,0 @@
--- tang-7.ori/src/tangd-keygen 2023-07-21 11:45:39.091100369 +0200
+++ tang-7/src/tangd-keygen 2023-07-21 11:47:58.813612221 +0200
@@ -20,6 +20,13 @@
trap 'exit' ERR
+set_perms() {
+ chmod -- 0440 "${1}"
+ if ! chown -- "tang:tang" "${1}" 2>/dev/null; then
+ echo "Unable to change owner/group for ${1} to tang:tang" >&2
+ fi
+}
+
if [ $# -ne 1 -a $# -ne 3 ] || [ ! -d "$1" ]; then
echo "Usage: $0 <jwkdir> [<sig> <exc>]" >&2
exit 1
@@ -32,7 +39,9 @@
jwe=`jose jwk gen -i '{"alg":"ES512"}'`
[ -z "$sig" ] && sig=`echo "$jwe" | jose jwk thp -i-`
echo "$jwe" > $1/$sig.jwk
+set_perms "$1/$sig.jwk"
jwe=`jose jwk gen -i '{"alg":"ECMR"}'`
[ -z "$exc" ] && exc=`echo "$jwe" | jose jwk thp -i-`
echo "$jwe" > $1/$exc.jwk
+set_perms "$1/$exc.jwk"

1
SOURCES/tang.sysusers Normal file
View File

@ -0,0 +1 @@
u tang - "Tang Network Presence Daemon user" /var/cache/tang -

View File

@ -1,19 +1,16 @@
Name: tang Name: tang
Version: 7 Version: 14
Release: 8%{?dist} Release: 2%{?dist}
Summary: Network Presence Binding Daemon Summary: Network Presence Binding Daemon
License: GPLv3+ License: GPLv3+
URL: https://github.com/latchset/%{name} URL: https://github.com/latchset/%{name}
Source0: https://github.com/latchset/%{name}/releases/download/v%{version}/%{name}-%{version}.tar.bz2 Source0: https://github.com/latchset/%{name}/releases/download/v%{version}/%{name}-%{version}.tar.xz
Patch1: 0001-Move-key-generation-to-tang.patch Source1: tang.sysusers
Patch2: 0002-Exit-with-success-unless-the-issue-was-with-with-tan.patch
Patch3: 0003-Fix-permissions-race-condition.patch
Patch4: 0004-Set-tang-owner-group.patch
BuildRequires: gcc BuildRequires: gcc
BuildRequires: autoconf BuildRequires: meson
BuildRequires: automake BuildRequires: git-core
BuildRequires: jose >= 8 BuildRequires: jose >= 8
BuildRequires: libjose-devel >= 8 BuildRequires: libjose-devel >= 8
BuildRequires: libjose-zlib-devel >= 8 BuildRequires: libjose-zlib-devel >= 8
@ -24,13 +21,15 @@ BuildRequires: systemd-devel
BuildRequires: pkgconfig BuildRequires: pkgconfig
BuildRequires: systemd BuildRequires: systemd
BuildRequires: systemd-rpm-macros
BuildRequires: curl BuildRequires: curl
BuildRequires: asciidoc BuildRequires: asciidoc
BuildRequires: coreutils BuildRequires: coreutils
BuildRequires: grep BuildRequires: grep
BuildRequires: socat
BuildRequires: sed BuildRequires: sed
BuildRequires: git-core BuildRequires: iproute
%{?systemd_requires} %{?systemd_requires}
Requires: coreutils Requires: coreutils
@ -47,32 +46,39 @@ Tang is a small daemon for binding data to the presence of a third party.
%autosetup -S git %autosetup -S git
%build %build
autoreconf -i %meson
%configure %meson_build
make %{?_smp_mflags} V=1
%install %install
rm -rf $RPM_BUILD_ROOT %meson_install
%make_install install -p -D -m 0644 %{SOURCE1} %{buildroot}%{_sysusersdir}/tang.conf
echo "User=%{name}" >> $RPM_BUILD_ROOT/%{_unitdir}/%{name}d@.service grep "User=%{name}" $RPM_BUILD_ROOT/%{_unitdir}/%{name}d@.service || echo "User=%{name}" >> $RPM_BUILD_ROOT/%{_unitdir}/%{name}d@.service
%{__mkdir_p} $RPM_BUILD_ROOT/%{_localstatedir}/db/%{name} %{__mkdir_p} $RPM_BUILD_ROOT/%{_localstatedir}/db/%{name}
%check %check
if ! make %{?_smp_mflags} check; then %meson_test
cat test-suite.log
false
fi
%pre %pre
getent group %{name} >/dev/null || groupadd -r %{name} %sysusers_create_compat %{SOURCE1}
getent passwd %{name} >/dev/null || \
useradd -r -g %{name} -d %{_localstatedir}/cache/%{name} -s /sbin/nologin \
-c "Tang Network Presence Daemon user" %{name}
exit 0 exit 0
%post %post
%systemd_post %{name}d.socket %systemd_post %{name}d.socket
# Let's make sure any existing keys are readable only
# by the owner/group.
if [ -d /var/db/tang ]; then
for k in /var/db/tang/*.jwk; do
test -e "${k}" || continue
chmod 0440 -- "${k}"
done
for k in /var/db/tang/.*.jwk; do
test -e "${k}" || continue
chmod 0440 -- "${k}"
done
chown tang:tang -R /var/db/tang
fi
%preun %preun
%systemd_preun %{name}d.socket %systemd_preun %{name}d.socket
@ -85,38 +91,82 @@ exit 0
%{_unitdir}/%{name}d@.service %{_unitdir}/%{name}d@.service
%{_unitdir}/%{name}d.socket %{_unitdir}/%{name}d.socket
%{_libexecdir}/%{name}d-keygen %{_libexecdir}/%{name}d-keygen
%{_libexecdir}/%{name}d-rotate-keys
%{_libexecdir}/%{name}d %{_libexecdir}/%{name}d
%{_mandir}/man8/tang.8* %{_mandir}/man8/tang.8*
%{_bindir}/%{name}-show-keys %{_bindir}/%{name}-show-keys
%{_mandir}/man1/tang-show-keys.1* %{_mandir}/man1/tang-show-keys.1*
%{_mandir}/man1/tangd-rotate-keys.1.*
%{_sysusersdir}/tang.conf
%changelog %changelog
* Fri Jul 21 2023 Sergio Arroutbi <sarroutb@redhat.com> - 7-8 * Thu Jun 29 2023 Sergio Arroutbi <sarroutb@redhat.com> - 14-2
- Set correct user/group (tang/tang) in tangd-keygen - Fix service start up
Resolves: rhbz#2188743
* Wed Jun 28 2023 Sergio Arroutbi <sarroutb@redhat.com> - 7-7 * Tue Jun 27 2023 Sergio Arroutbi <sarroutb@redhat.com> - 14-1
- Fix race condition when creating/rotating keys - New upstream release - v14.
Resolves: rhbz#2182410 Resolves: rhbz#2182411
Resolves: CVE-2023-1672 Resolves: CVE-2023-1672
* Wed Jan 13 2021 Sergio Correia <scorreia@redhat.com> - 7-6 * Wed Aug 17 2022 Sergio Arroutbi <sarroutb@redhat.com> - 11-2
- Exit with success unless the issue was with with tangd itself - Adopt systemd-sysusers format
Resolves: rhbz#1828558 Resolves: rhbz#2095474
* Sun Dec 01 2019 Sergio Correia <scorreia@redhat.com> - 7-5 * Tue Dec 14 2021 Sergio Correia <scorreia@redhat.com> - 11-1
- Permissions of /var/db/tang set to 0700 - New upstream release - v11.
- Home dir of user tang is /var/cache/tang Resolves: CVE-2021-4076
* Fri Nov 29 2019 Sergio Correia <scorreia@redhat.com> - 7-4 * Tue Aug 10 2021 Mohan Boddu <mboddu@redhat.com> - 10-4
- Fix permissions of /var/db/tang - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
Related: rhbz#1991688
* Tue Oct 15 2019 Sergio Correia <scorreia@redhat.com> - 7-3 * Tue Jun 22 2021 Mohan Boddu <mboddu@redhat.com> - 10-3
- Rebuild to ensure correct dist tag - Rebuilt for RHEL 9 BETA for openssl 3.0
Related: rhbz#1971065
* Sun Sep 29 2019 Sergio Correia <scorreia@redhat.com> - 7-2 * Thu May 20 2021 Sergio Correia <scorreia@redhat.com> - 10-2
- Move key generation to tang - Fix issues reported by static analyzer checks
- Resolves rhbz#1745177, rhbz#1679186 Resolves: rhbz#1956765
* Wed May 05 2021 Sergio Correia <scorreia@redhat.com> - 10-1
- New upstream release - v10.
Resolves: rhbz#1956765
* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 8-3
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
* Tue Feb 09 2021 Sergio Correia <scorreia@redhat.com> - 8-2
- Remove extra patches as they are already included in v8 release
* Mon Feb 08 2021 Sergio Correia <scorreia@redhat.com> - 8-1
- New upstream release - v8.
* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 7-9
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
* Tue Dec 1 2020 Sergio Correia <scorreia@redhat.com> - 7.8
- Move build system to meson
Upstream commits (fed9020, 590de27)
- Move key handling to tang itself
Upstream commits (6090505, c71df1d, 7119454)
* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 7-7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Wed Apr 15 2020 Igor Raits <ignatenkobrain@fedoraproject.org> - 7-6
- Rebuild for http-parser 2.9.4
* Tue Feb 25 2020 Sergio Correia <scorreia@redhat.com> - 7-5
- Rebuilt after http-parser update
* Fri Jan 31 2020 Fedora Release Engineering <releng@fedoraproject.org> - 7-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
* Sat Jul 27 2019 Fedora Release Engineering <releng@fedoraproject.org> - 7-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
* Sun Feb 03 2019 Fedora Release Engineering <releng@fedoraproject.org> - 7-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
* Fri Aug 10 2018 Nathaniel McCallum <npmccallum@redhat.com> - 7-1 * Fri Aug 10 2018 Nathaniel McCallum <npmccallum@redhat.com> - 7-1
- New upstream release - New upstream release