[Rpm-maint] [rpm-software-management/rpm] rpmsign: Adopting PKCS#11 opaque keys support in libfsverity for fsverity signatures (#1779)

[malmond77]

@malmond77 commented on this pull request.



> @@ -88,10 +100,11 @@ SIGN OPTIONS
 
 :   Sign package files with fsverity signatures. The file signing key
     (RSA private key) and the signing certificate must be set before
-    signing the package. The key can be configured on the command line
-    with **\--fskpath** or the macro %\_file\_signing\_key, and the cert
-    can be configured on the command line with **\--certpath** or the
-    macro %\_file\_signing\_cert.
+    signing the package. The key can be configured either on the command
+    line with **\--fskpath** or the macro %\_file\_signing\_key, or with pkcs#11 token using **\--pkcs11_module** and **\--pkcs11_module**

Wrap this very long line please

> @@ -149,9 +170,9 @@ static int doSign(poptContext optCon, struct rpmSignArgs *sargs)
 
     if (flags_sign_files(sargs->signflags)) {
 	char *fileSigningKeyPassword = NULL;
-	char *key = rpmExpand("%{?_file_signing_key}", NULL);

I'm concerned this is not backward compatible. We can only consider removing a feature if it's never used because it's broken. Is this broken?

> @@ -187,7 +208,7 @@ int main(int argc, char *argv[])
     int ec = EXIT_FAILURE;
     poptContext optCon = NULL;
     const char *arg;
-    

Eliminate whitespace only changes.

>      char *cert = rpmExpand("%{?_file_signing_cert}", NULL);
     char *algorithm = rpmExpand("%{?_verity_algorithm}", NULL);
     uint16_t algo = 0;
 
+    if (rstreq(key, "")) {
+	free(key);

Be careful to follow the existing indentation style: it's tabs *and* spaces - most editors end up picking one and this looks weird.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/pull/1779#pullrequestreview-772086851
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rpm.org/pipermail/rpm-maint/attachments/20211005/baef7227/attachment.html>