[Rpm-maint] [rpm-software-management/rpm] rpmsign: enable signing files with PKCS11 tokens (PR #4125)

[Simo Sorce]

@simo5 commented on this pull request.



> +[[slots]]
+slot = 1
+dbtype = "sqlite"
+dbargs = "${token_dir}/token.sql"
+KRYOPTIC_EOF
+pkcs11-tool --module "${pkcs11_mod}" --init-token \
+  --label "${token_label}" --so-pin "${token_pin}"
+pkcs11-tool --module "${pkcs11_mod}" --init-pin \
+  --login --so-pin "${token_pin}" --pin "${token_pin}"
+pkcs11-tool --module "${pkcs11_mod}" --login \
+  --pin "${token_pin}" --keypairgen --key-type EC:prime256v1 \
+  --id 01 --label "ima-signing"
+
+RPMTEST_CHECK([[
+cp /data/RPMS/hello-2.0-1.x86_64.rpm /tmp/
+rpmsign --addsign --key-id 4344591E1964C5FC --signfiles \

@jeremycline one way I used in other places IIRC was to preload a small library that would replace the dlopen seen by the application with one that drops RTLDEEPIND before calling the real dlopen() .... a bit annoying to do it that way though ...

note that RTLDEEPBIND is used to make sure the common API symbols for PKCS11 drivers are looked up in the loaded library ... it can often work without it but it is a bit iffy.

I am willing to add maybe an environment variable to make it conditional though, if you think that is an option that may work for you. (if that is the case please open a bug in pkcs11-provider and I will try to get there and do it).

-- 
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/pull/4125#discussion_r2921219404
You are receiving this because you are subscribed to this thread.

Message ID: <rpm-software-management/rpm/pull/4125/review/3932791617 at github.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rpm.org/pipermail/rpm-maint/attachments/20260311/27e1485b/attachment.htm>