Use imaevm_signhash if available

sign_hash is deprecated in the newest libimaevm Co-authored-by: Michal Domonkos <[email protected]> Resolves: rpm-software-management#3419
ffesti · Nov 21, 2024 · fcbe8ce · fcbe8ce
1 parent 509bcb4
commit fcbe8ce
Show file tree

Hide file tree

Showing 3 changed files with 11 additions and 0 deletions.
diff --git a/CMakeLists.txt b/CMakeLists.txt
@@ -295,6 +295,7 @@ endif()
 
 if (WITH_IMAEVM)
 	list(APPEND REQFUNCS lsetxattr)
+	check_library_exists(imaevm imaevm_signhash "" HAVE_IMAEVM_SIGNHASH)
 	add_library(IMA::IMA UNKNOWN IMPORTED)
 	find_path(IMA_INCLUDE_DIR NAMES imaevm.h REQUIRED)
 	find_library(IMA_LIBRARY NAMES imaevm REQUIRED)

diff --git a/config.h.in b/config.h.in
@@ -46,6 +46,7 @@
 #cmakedefine HAVE_LINUX_FSVERITY_H @HAVE_LINUX_FSVERITY_H@
 #cmakedefine HAVE_LOCALTIME_R @HAVE_LOCALTIME_R@
 #cmakedefine HAVE_LSETXATTR @HAVE_LSETXATTR@
+#cmakedefine HAVE_IMAEVM_SIGNHASH @HAVE_IMAEVM_SIGNHASH@
 #cmakedefine HAVE_LUTIMES @HAVE_LUTIMES@
 #cmakedefine HAVE_LZMA_H @HAVE_LZMA_H@
 #cmakedefine HAVE_MEMORY_H @HAVE_MEMORY_H@

diff --git a/sign/rpmsignfiles.cc b/sign/rpmsignfiles.cc
@@ -53,7 +53,16 @@ const char *key, char *keypass, uint32_t *siglenp)
     signature[0] = '\x03';
 
     /* calculate file signature */
+#if HAVE_IMAEVM_SIGNHASH
+    imaevm_ossl_access access_info = {
+	.type = IMAEVM_OSSL_ACCESS_TYPE_NONE,
+    };
+    siglen = imaevm_signhash(algo, fdigest, diglen, key, keypass, signature+1, 0, &access_info, 0);
+
+#else
     siglen = sign_hash(algo, fdigest, diglen, key, keypass, signature+1);
+#endif
+
     if (siglen < 0) {
 	rpmlog(RPMLOG_ERR, _("sign_hash failed\n"));
 	return NULL;