Djam/kernel-5.15
1
0
Fork 0
mirror of https://abf.rosa.ru/djam/kernel-5.15.git synced 2025-02-23 18:42:55 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Sign modules with GOST in Nickel

Browse source 
LibreSSL has been built with this patch:
https://github.com/GostCrypt/libressl-openbsd/commit/6baa93
This commit is contained in:
Mikhail Novosyolov 2020-03-29 01:07:43 +03:00
parent 1bca216017
commit 66a5846b35
1 changed files with 7 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
kernel.spec
View file

@ -11,7 +11,7 @@
%define sublevel 28 %define sublevel 28
# Release number. Increase this before a rebuild. # Release number. Increase this before a rebuild.
%define rpmrel 1 %define rpmrel 2
%define fullrpmrel %{rpmrel} %define fullrpmrel %{rpmrel}
%define rpmtag %{disttag} %define rpmtag %{disttag}
@ -53,13 +53,16 @@
%endif %endif
# User Mode Linux, https://habr.com/ru/company/itsumma/blog/459558/ # User Mode Linux, https://habr.com/ru/company/itsumma/blog/459558/
%bcond_without uml %bcond_without uml
%bcond_with gost_sign
# "Nickel" is a special brand for certified distros # "Nickel" is a special brand for certified distros
# gost_sign will probably be enabled outside of Nickel later,
# but for now let's better do not make such experiments in stable platforms
%if %{mdvver} == 201900 || %{mdvver} == 201905 %if %{mdvver} == 201900 || %{mdvver} == 201905
%bcond_without nickel %bcond_without nickel
%bcond_without gost_sign
%else %else
%bcond_with nickel %bcond_with nickel
%bcond_with gost_sign
%endif %endif
# Kernel flavour # Kernel flavour
@ -1299,13 +1302,8 @@ _libressl_sign(){
fi fi
f="$1" f="$1"
%if %{with gost_sign} %if %{with gost_sign}
# This is an incorrect signature, GOST support is needed in CMS (?!) %{src_dir}/scripts/sign-file streebog512 \
libressl dgst -streebog512 \ "%{certs_signing_key_priv_rnd}.GOST" "%{certs_signing_key_priv_rnd}.GOST" "$f"
-sign "%{certs_signing_key_priv_rnd}" "$f" \
> "${f}.sig"
%{src_dir}/scripts/sign-file -s "${f}.sig" streebog512 \
"%{certs_signing_key_priv_rnd}.GOST" "$f"
rm "${f}.sig"
%else %else
%{src_dir}/scripts/sign-file sha512 \ %{src_dir}/scripts/sign-file sha512 \
"%{certs_signing_key_priv_rnd}.RSA" "%{certs_signing_key_priv_rnd}.RSA" "$f" "%{certs_signing_key_priv_rnd}.RSA" "%{certs_signing_key_priv_rnd}.RSA" "$f"