[Rpm-maint] [rpm-software-management/rpm] rpmsign: enable signing files with PKCS11 tokens (PR #4125)

[Jeremy Cline]

jeremycline left a comment (rpm-software-management/rpm#4125)

> Resolving a SPKI id to a private key is possible but require the certificate to be on the token with the same CKA_ID ... so needs to be tested carefully. If the token is something like a proper HSM we should be able to make it work, if it is something like a yubikey the certificate route may fail to work.
> 
> Generally I would recommend passing in a pkcs11 URI that identifies the key directly if possible, but if not possible we can try to deal with this in pkcs11-provider.

Yeah, for clarity rpmsign doesn't need the SPKI for anything, IMA just embeds it in its signature structure (presumably so it can look up the key to check it with in a keyring, my expertise in IMA is ~20 minutes of reading ima-evm-utils).

For my use-case I'm fine having the keyid be provided in a config, but if someone really wants rpmsign to handle it I'd say require users to provide the PEM or DER encoded certificate that matches whatever key you're using and then using `imaevm_read_keyid` from that file.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/pull/4125#issuecomment-3973312539
You are receiving this because you are subscribed to this thread.

Message ID: <rpm-software-management/rpm/pull/4125/c3973312539 at github.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rpm.org/pipermail/rpm-maint/attachments/20260227/c44c4157/attachment.htm>