Compare commits

..

No commits in common. "ac32ae8eccdfb2b8f8215f6c2b715fbcbf790779" and "4b15a49dd0df7ab14a63e2a39b41ddbbdcc301eb" have entirely different histories.

9 changed files with 215 additions and 160 deletions

View File

@ -1,58 +0,0 @@
From e74d38bfd3097471fe60dbe843a68c16516a78da Mon Sep 17 00:00:00 2001
From: Richard Hughes <richard@hughsie.com>
Date: Mon, 17 Jan 2022 14:50:47 +0000
Subject: [PATCH] Fix compiling with new versions of efivar
Fixes https://github.com/fwupd/fwupd/issues/4181
---
meson.build | 5 +++++
plugins/uefi-capsule/fu-uefi-common.h | 3 +++
2 files changed, 8 insertions(+)
diff --git a/meson.build b/meson.build
index 86e7057..0c768a2 100644
--- a/meson.build
+++ b/meson.build
@@ -354,6 +354,11 @@ if build_standalone and get_option('plugin_uefi_capsule')
readelf = find_program ('readelf')
genpeimg = find_program ('genpeimg', required: false)
+ efivar = dependency('efivar')
+ if cc.has_header_symbol('efivar/efivar-types.h', 'efi_time_t', dependencies : efivar)
+ conf.set('HAVE_EFI_TIME_T', '1')
+ endif
+
efi_app_location = join_paths(libexecdir, 'fwupd', 'efi')
conf.set_quoted ('EFI_APP_LOCATION', efi_app_location)
diff --git a/plugins/uefi-capsule/fu-uefi-common.h b/plugins/uefi-capsule/fu-uefi-common.h
index c7e3996..91b6c99 100644
--- a/plugins/uefi-capsule/fu-uefi-common.h
+++ b/plugins/uefi-capsule/fu-uefi-common.h
@@ -7,6 +7,7 @@
#pragma once
+#include <efivar/efivar.h>
#include <glib.h>
#include "fwupd-common.h"
@@ -17,6 +18,7 @@
#define EFI_CAPSULE_HEADER_FLAGS_POPULATE_SYSTEM_TABLE 0x00020000
#define EFI_CAPSULE_HEADER_FLAGS_INITIATE_RESET 0x00040000
+#ifndef HAVE_EFI_TIME_T
typedef struct __attribute__((__packed__)) {
guint16 year;
guint8 month;
@@ -30,6 +32,7 @@ typedef struct __attribute__((__packed__)) {
guint8 daylight;
guint8 pad2;
} efi_time_t;
+#endif
typedef struct __attribute__((__packed__)) {
fwupd_guid_t guid;
--
2.33.0

View File

@ -0,0 +1,86 @@
From b4627629cdaadd1a75d7c650b7c5973fcd18dfb0 Mon Sep 17 00:00:00 2001
From: Richard Hughes <richard@hughsie.com>
Date: Thu, 1 Aug 2019 09:45:25 +0100
Subject: [PATCH] Relax the certificate time checks in the self tests for the
legacy certificate
One test verifies a firmware with a signature from the old LVFS which was
hosted on secure-lvfs.rhcloud.com and used the original PKCS-7 key. This key
had a two year validity (expiring today, ohh the naivety...) rather than the
newer fwupd.org key which expires in the year 2058.
For this specific test only, disable the certificate time checks to fix CI.
Fixes https://github.com/hughsie/fwupd/issues/1264
---
src/fu-keyring-pkcs7.c | 10 +++++++++-
src/fu-keyring.h | 6 ++++--
src/fu-self-test.c | 3 ++-
3 files changed, 15 insertions(+), 4 deletions(-)
diff --git a/src/fu-keyring-pkcs7.c b/src/fu-keyring-pkcs7.c
index 6dc944ed..a42feaa7 100644
--- a/src/fu-keyring-pkcs7.c
+++ b/src/fu-keyring-pkcs7.c
@@ -642,6 +642,14 @@ fu_keyring_pkcs7_verify_data (FuKeyring *keyring,
for (gint i = 0; i < count; i++) {
gnutls_pkcs7_signature_info_st info;
gint64 signing_time = 0;
+ gnutls_certificate_verify_flags verify_flags = 0;
+
+ /* use with care */
+ if (flags & FU_KEYRING_VERIFY_FLAG_DISABLE_TIME_CHECKS) {
+ g_debug ("WARNING: disabling time checks");
+ verify_flags |= GNUTLS_VERIFY_DISABLE_TIME_CHECKS;
+ verify_flags |= GNUTLS_VERIFY_DISABLE_TRUSTED_TIME_CHECKS;
+ }
/* verify the data against the detached signature */
if (flags & FU_KEYRING_VERIFY_FLAG_USE_CLIENT_CERT) {
@@ -652,7 +660,7 @@ fu_keyring_pkcs7_verify_data (FuKeyring *keyring,
0, /* vdata_size */
i, /* index */
&datum, /* data */
- 0); /* flags */
+ verify_flags);
}
if (rc < 0) {
g_set_error (error,
diff --git a/src/fu-keyring.h b/src/fu-keyring.h
index 39819ca4..2f20e35e 100644
--- a/src/fu-keyring.h
+++ b/src/fu-keyring.h
@@ -20,12 +20,14 @@ G_DECLARE_DERIVABLE_TYPE (FuKeyring, fu_keyring, FU, KEYRING, GObject)
* FuKeyringVerifyFlags:
* @FU_KEYRING_VERIFY_FLAG_NONE: No flags set
* @FU_KEYRING_VERIFY_FLAG_USE_CLIENT_CERT: Use client certificate to verify
+ * @FU_KEYRING_VERIFY_FLAG_DISABLE_TIME_CHECKS: Disable checking of validity periods
*
* The flags to use when interacting with a keyring
**/
typedef enum {
- FU_KEYRING_VERIFY_FLAG_NONE = 0,
- FU_KEYRING_VERIFY_FLAG_USE_CLIENT_CERT = 1 << 1,
+ FU_KEYRING_VERIFY_FLAG_NONE = 0,
+ FU_KEYRING_VERIFY_FLAG_USE_CLIENT_CERT = 1 << 1,
+ FU_KEYRING_VERIFY_FLAG_DISABLE_TIME_CHECKS = 1 << 2,
/*< private >*/
FU_KEYRING_VERIFY_FLAG_LAST
} FuKeyringVerifyFlags;
diff --git a/src/fu-self-test.c b/src/fu-self-test.c
index 363f644e..24b12110 100644
--- a/src/fu-self-test.c
+++ b/src/fu-self-test.c
@@ -2628,7 +2628,8 @@ fu_keyring_pkcs7_func (void)
g_assert_no_error (error);
g_assert_nonnull (blob_sig);
result_pass = fu_keyring_verify_data (keyring, blob_pass, blob_sig,
- FU_KEYRING_VERIFY_FLAG_NONE, &error);
+ FU_KEYRING_VERIFY_FLAG_DISABLE_TIME_CHECKS,
+ &error);
g_assert_no_error (error);
g_assert_nonnull (result_pass);
g_assert_cmpint (fu_keyring_result_get_timestamp (result_pass), >= , 1502871248);
--
2.19.1

View File

@ -0,0 +1,35 @@
diff -Naru fwupd-1.2.9/src/fu-self-test.c fwupd-1.2.9-new/src/fu-self-test.c
--- fwupd-1.2.9/src/fu-self-test.c 2019-05-20 18:18:00.000000000 +0800
+++ fwupd-1.2.9-new/src/fu-self-test.c 2022-07-25 11:22:05.787729000 +0800
@@ -2823,23 +2823,6 @@
g_assert_cmpint (lines, ==, 6);
}
-static void
-fu_common_spawn_timeout_func (void)
-{
- gboolean ret;
- guint lines = 0;
- g_autoptr(GError) error = NULL;
- g_autofree gchar *fn = NULL;
- const gchar *argv[3] = { "replace", "test", NULL };
-
- fn = fu_test_get_filename (TESTDATADIR, "spawn.sh");
- g_assert (fn != NULL);
- argv[0] = fn;
- ret = fu_common_spawn_sync (argv, fu_test_stdout_cb, &lines, 50, NULL, &error);
- g_assert_error (error, G_IO_ERROR, G_IO_ERROR_CANCELLED);
- g_assert (!ret);
- g_assert_cmpint (lines, ==, 1);
-}
static void
fu_progressbar_func (void)
@@ -3751,7 +3734,6 @@
g_test_add_func ("/fwupd/common{cab-error-missing-file}", fu_common_store_cab_error_missing_file_func);
g_test_add_func ("/fwupd/common{cab-error-size}", fu_common_store_cab_error_size_func);
g_test_add_func ("/fwupd/common{spawn)", fu_common_spawn_func);
- g_test_add_func ("/fwupd/common{spawn-timeout)", fu_common_spawn_timeout_func);
g_test_add_func ("/fwupd/common{firmware-builder}", fu_common_firmware_builder_func);
return g_test_run ();
}

View File

@ -1,44 +0,0 @@
From d9967378f9b0ba735550f917e4140dd99adc3155 Mon Sep 17 00:00:00 2001
From: herengui <herengui@kylinsec.com.cn>
Date: Sat, 13 May 2023 16:55:11 +0800
Subject: [PATCH] add loongarch64 support
Signed-off-by: herengui <herengui@kylinsec.com.cn>
---
meson.build | 3 +++
plugins/uefi-capsule/efi/generate_binary.py | 4 ++--
2 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/meson.build b/meson.build
index 0c768a2..d6c88cc 100644
--- a/meson.build
+++ b/meson.build
@@ -374,6 +374,9 @@ if build_standalone and get_option('plugin_uefi_capsule')
elif host_cpu == 'aarch64'
EFI_MACHINE_TYPE_NAME = 'aa64'
gnu_efi_arch = 'aarch64'
+ elif host_cpu == 'loongarch64'
+ EFI_MACHINE_TYPE_NAME = 'la464'
+ gnu_efi_arch = 'loongarch64'
else
EFI_MACHINE_TYPE_NAME = ''
gnu_efi_arch = ''
diff --git a/plugins/uefi-capsule/efi/generate_binary.py b/plugins/uefi-capsule/efi/generate_binary.py
index 3d1c44c..d263d38 100755
--- a/plugins/uefi-capsule/efi/generate_binary.py
+++ b/plugins/uefi-capsule/efi/generate_binary.py
@@ -34,9 +34,9 @@ def _run_objcopy(args):
args.outfile,
]
- # aarch64 and arm32 don't have an EFI capable objcopy
+ # aarch64, arm32 and loongarch64 don't have an EFI capable objcopy
# Use 'binary' instead, and add required symbols manually
- if args.arch in ["aarch64", "arm"]:
+ if args.arch in ["aarch64", "arm", "loongarch64"]:
argv.extend(["-O", "binary"])
else:
argv.extend(["--target", "efi-app-{}".format(args.arch)])
--
2.39.2

17
CVE-2020-10759.patch Normal file
View File

@ -0,0 +1,17 @@
diff -Naru fwupd-1.2.9/src/fu-keyring-gpg.c fwupd-1.2.9-new/src/fu-keyring-gpg.c
--- fwupd-1.2.9/src/fu-keyring-gpg.c 2019-05-20 18:18:00.000000000 +0800
+++ fwupd-1.2.9-new/src/fu-keyring-gpg.c 2022-07-25 10:51:37.434242000 +0800
@@ -297,6 +297,13 @@
"no result record from libgpgme");
return NULL;
}
+ if (result->signatures == NULL) {
+ g_set_error_literal (error,
+ FWUPD_ERROR,
+ FWUPD_ERROR_INTERNAL,
+ "no signatures from libgpgme");
+ return NULL;
+ }
/* look at each signature */
for (s = result->signatures; s != NULL ; s = s->next ) {

View File

@ -0,0 +1,47 @@
From dd0b437d866878faa4672518b4b732e8ac00aa30 Mon Sep 17 00:00:00 2001
From: Mario Limonciello <mario.limonciello@dell.com>
Date: Tue, 22 Oct 2019 09:29:41 -0500
Subject: [PATCH] trivial: fu-self-test: set polling self tests to slow
Currently the test runs for 100ms and looks to see that at least 8 times
the poll function callback hit.
This normally works well enough, but during self tests it depends upon
too much timing and leads to failures sometimes:
```
** (/<<PKGBUILDDIR>>/obj-s390x-linux-gnu/src/fu-self-test:50432): DEBUG: 15:37:55.189: poll cnt=0
*# DEBUG: poll cnt=1
** (/<<PKGBUILDDIR>>/obj-s390x-linux-gnu/src/fu-self-test:50432): DEBUG: 15:37:55.199: poll cnt=1
*** (/<<PKGBUILDDIR>>/obj-s390x-linux-gnu/src/fu-self-test:50432): DEBUG: 15:37:55.209: poll cnt=2
** (/<<PKGBUILDDIR>>/obj-s390x-linux-gnu/src/fu-self-test:50432): DEBUG: 15:37:55.227: poll cnt=3
*# DEBUG: poll cnt=4
** (/<<PKGBUILDDIR>>/obj-s390x-linux-gnu/src/fu-self-test:50432): DEBUG: 15:37:55.255: poll cnt=4
*# DEBUG: poll cnt=5
** (/<<PKGBUILDDIR>>/obj-s390x-linux-gnu/src/fu-self-test:50432): DEBUG: 15:37:55.267: poll cnt=5
Bail out! ERROR:../src/fu-self-test.c:3489:fu_device_poll_func: assertion failed (cnt >= 8): (6 >= 8)
--- stderr ---
**
ERROR:../src/fu-self-test.c:3489:fu_device_poll_func: assertion failed (cnt >= 8): (6 >= 8)
-------
```
Mark this as a slow test so that it doesn't cause CI failures.
---
src/fu-self-test.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/src/fu-self-test.c b/src/fu-self-test.c
index 869b76fc5..2f4a83aa8 100644
--- a/src/fu-self-test.c
+++ b/src/fu-self-test.c
@@ -4149,7 +4149,8 @@ main (int argc, char **argv)
g_test_add_func ("/fwupd/archive{cab}", fu_archive_cab_func);
g_test_add_func ("/fwupd/engine{requirements-other-device}", fu_engine_requirements_other_device_func);
g_test_add_func ("/fwupd/device{incorporate}", fu_device_incorporate_func);
- g_test_add_func ("/fwupd/device{poll}", fu_device_poll_func);
+ if (g_test_slow ())
+ g_test_add_func ("/fwupd/device{poll}", fu_device_poll_func);
g_test_add_func ("/fwupd/device-locker{success}", fu_device_locker_func);
g_test_add_func ("/fwupd/device-locker{fail}", fu_device_locker_fail_func);
g_test_add_func ("/fwupd/device{metadata}", fu_device_metadata_func);

BIN
fwupd-1.2.9.tar.xz Normal file

Binary file not shown.

Binary file not shown.

View File

@ -3,31 +3,28 @@
%bcond_without libsmbios
%endif
# although we ship a few tiny python files these are utilities that 99.99%
# of users do not need -- use this to avoid dragging python onto NestOS
%global __requires_exclude ^/usr/bin/python3
%ifarch x86_64 aarch64 loongarch64
%ifarch x86_64 aarch64
%bcond_without uefi
%endif
Name: fwupd
Version: 1.5.8
Release: 6
Version: 1.2.9
Release: 4
Summary: Make updating firmware on Linux automatic, safe and reliable
License: LGPLv2+
URL: https://github.com/fwupd/fwupd/releases
Source0: http://people.freedesktop.org/~hughsient/releases/%{name}-%{version}.tar.xz
#refer: https://github.com/fwupd/fwupd/commit/e74d38bfd3097471fe60dbe843a68c16516a78da
Patch0001: 0001-Fix-compiling-with-new-versions-of-efivar.patch
Patch1000: 1000-add-loongarch64-support-not-upstream-modified.patch
#Self-tests are failing due to an expired cert #1264
Patch0000: 0001-Relax-the-certificate-time-checks-in-the-self-tests-.patch
Patch6000: Set-polling-self-tests-to-slow.patch
Patch0002: 0002-Compilation-failure-due-to-assertion-error.patch
Patch0003: CVE-2020-10759.patch
BuildRequires: gettext glib2-devel libxmlb-devel valgrind valgrind-devel libgcab1-devel
BuildRequires: gpgme-devel libgudev1-devel libgusb-devel libsoup-devel polkit-devel sqlite-devel libxslt
BuildRequires: gobject-introspection-devel libarchive-devel systemd gcab elfutils-libelf-devel
BuildRequires: bash-completion json-glib-devel help2man vala meson gnutls-utils gnutls-devel gtk-doc
BuildRequires: libjcat-devel tpm2-tss-devel
%if %{with uefi}
BuildRequires: python3 python3-cairo python3-gobject python3-pillow
@ -43,21 +40,19 @@ BuildRequires: efivar-devel
BuildRequires: efivar-devel libsmbios-devel
%endif
Requires: glib2 bubblewrap libsoup libgusb libxmlb shared-mime-info libjcat tpm2-tss
Requires: pesign
Requires: glib2 bubblewrap libsoup libgusb libxmlb shared-mime-info
Requires(post):systemd
Requires(preun):systemd
Requires(postun):systemd
Obsoletes: dbxtool < 9 dbxtool-help < 9
Provides: dbxtool
Recommends: python3
%description
%{name} aims to make updating firmware on Linux automatic, safe and reliable.
%package devel
Summary: Development and installed test files for %{name}
Requires: %{name} = %{version}-%{release} libjcat-devel
Requires: %{name} = %{version}-%{release}
Provides: %{name}-tests = %{version}-%{release}
Obsoletes: %{name}-tests < %{version}-%{release}
@ -68,14 +63,13 @@ This package contains the development and installed test files for %{name}.
%prep
%autosetup -n %{name}-%{version} -p1
sed -i '/DynamicUser=yes/d' data/motd/fwupd-refresh.service.in
%build
%meson -Dtests=true -Dgtkdoc=true -Dplugin_dummy=true \
%if %{with uefi}
-Dplugin_nvme=true \
-Dplugin_uefi=true -Dplugin_nvme=true \
%else
-Dplugin_nvme=false \
-Dplugin_uefi=false -Dplugin_nvme=false \
%endif
%if %{with redfish}
-Dplugin_redfish=true \
@ -83,11 +77,10 @@ sed -i '/DynamicUser=yes/d' data/motd/fwupd-refresh.service.in
-Dplugin_redfish=false \
%endif
%if %{with libsmbios}
-Dplugin_dell=true \
-Dplugin_dell=true -Dplugin_synaptics=true \
%else
-Dplugin_dell=false \
-Dplugin_dell=false -Dplugin_synaptics=false \
%endif
-Dplugin_msr=false \
-Dman=true
%meson_build
@ -102,9 +95,6 @@ sed -i '/DynamicUser=yes/d' data/motd/fwupd-refresh.service.in
%ifarch aarch64
%pesign -s -i %{buildroot}%{_libexecdir}/%{name}/efi/%{name}aa64.efi -o %{buildroot}%{_libexecdir}/%{name}/efi/%{name}aa64.efi.signed
%endif
%ifarch loongarch64
%pesign -s -i %{buildroot}%{_libexecdir}/%{name}/efi/%{name}la464.efi -o %{buildroot}%{_libexecdir}/%{name}/efi/%{name}la464.efi.signed
%endif
%endif
mkdir -pm 0700 %{buildroot}%{_localstatedir}/lib/%{name}/gnupg
@ -133,53 +123,53 @@ mkdir -pm 0700 %{buildroot}%{_localstatedir}/lib/%{name}/gnupg
%config(noreplace)%{_sysconfdir}/%{name}/remotes.d/*.conf
%config(noreplace)%{_sysconfdir}/pki/%{name}
%config(noreplace)%{_sysconfdir}/%{name}/daemon.conf
%config(noreplace)%{_sysconfdir}/%{name}/thunderbolt.conf
%config(noreplace)%{_sysconfdir}/%{name}/uefi_capsule.conf
%config(noreplace)%{_sysconfdir}/%{name}/upower.conf
%{_sysconfdir}/pki/fwupd-metadata
%{_datadir}/dbus-1/system.d/*.%{name}.conf
%{_sysconfdir}/dbus-1/system.d/*.%{name}.conf
%{_libexecdir}/%{name}/%{name}
%{_libexecdir}/%{name}/%{name}tool
%{_libexecdir}/%{name}/%{name}agent
%{_libexecdir}/%{name}/%{name}offline
%{_datadir}/bash-*/completions/*
%{_datadir}/%{name}/metainfo/*.metainfo.xml
%{_datadir}/%{name}/remotes.d/*/*/*.md
%{_datadir}/metainfo/*.metainfo.xml
%{_datadir}/%{name}/firmware-packager
%{_datadir}/dbus-1/interfaces/*.fwupd.xml
%{_datadir}/dbus-1/system-services/*.service
%{_datadir}/polkit-1/*/org.freedesktop*
%{_datadir}/%{name}/
%{_datadir}/%{name}/quirks.d/
%{_datadir}/icons/hicolor/scalable/apps/*.%{name}.svg
%{_localstatedir}/lib/%{name}/*/*.md
%{_libdir}/lib%{name}*.so.*
%{_libdir}/girepository-1.0/*.typelib
%{_prefix}/lib/udev/rules.d/*.rules
%{_prefix}/lib/systemd/system*/%{name}.shutdown
%{_unitdir}/*.service
%{_unitdir}/*.wants/
%{_libdir}/fwupd-plugins-3/*.so
%ghost %{_localstatedir}/lib/fwupd/gnupg
%if %{with uefi}
%config(noreplace)%{_sysconfdir}/%{name}/uefi.conf
%{_libexecdir}/%{name}/efi/*.efi
%{_libexecdir}/%{name}/efi/*.efi.signed
%{_libexecdir}/%{name}/fwupdate
%{_datadir}/*/*/LC_IMAGES/%{name}*
%endif
%if %{with redfish}
%config(noreplace)%{_sysconfdir}/%{name}/redfish.conf
%endif
%{_presetdir}/fwupd-refresh.preset
/usr/lib/udev/rules.d/*.rules
/usr/lib/systemd/system-shutdown/fwupd.shutdown
%{_unitdir}/fwupd-refresh.timer
%ifarch x86_64
%{_libexecdir}/fwupd/fwupd-detect-cet
%if %{with libsmbios}
%{_datadir}/%{name}/remotes.d/dell*/*
%endif
%{_datadir}/fish/vendor_completions.d/fwupdmgr.fish
%files devel
%{_libdir}/*.so
%{_libdir}/*/*.pc
%{_includedir}/*
%{_datadir}/vala/*
%{_datadir}/gtk-doc/*/%{name}
%{_datadir}/doc/%{name}
%{_datadir}/gtk-doc/*/lib%{name}
%{_datadir}/*/*.gir
%{_datadir}/installed-tests/%{name}
%{_libexecdir}/installed-tests/%{name}
%dir %{_sysconfdir}/%{name}/remotes.d
%config(noreplace)%{_sysconfdir}/%{name}/remotes.d/%{name}-tests.conf
@ -187,24 +177,6 @@ mkdir -pm 0700 %{buildroot}%{_localstatedir}/lib/%{name}/gnupg
%{_datadir}/man/man1/*
%changelog
* Mon Aug 21 2023 herengui <herengui@kylinsec.com.cn> - 1.5.8-6
- add support for loongarch64
* Thu Dec 01 2022 yaoxin <yaoxin30@h-partners.com> - 1.5.8-5
- Resolve fwupd upgrade and downgrade error
* Thu Dec 01 2022 Ge Wang <wangge20@h-partners.com> - 1.5.8-4
- Fix fwupd-refresh service start failure
* Thu Nov 10 2022 caodongxia <caodongxia@h-partners.com> - 1.5.8-3
- Fix compiling with new versions of efivar
* Mon Jun 20 2022 fushanqing <fushanqing@kylinos.cn> - 1.5.8-2
- Remove the python installation dependency of fwupd
* Mon Oct 31 2022 yaoxin <yaoxin30@h-partners.com> - 1.5.8-1
- Upgrade to 1.5.8
* Thu Jul 14 2022 yangweidong <yangweidong9@huawei.com> - 1.2.9-4
- Solve 0002-Compilation-failure-due-to-assertion-error
- Fix CVE-2020-10759.patch