summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta-tpm/recipes-tpm2/tpm2-tss-engine/files/0001-Configure-Allow-disabling-of-digest-sign-operations.patch48
-rw-r--r--meta-tpm/recipes-tpm2/tpm2-tss-engine/files/0002-Fix-mismatch-of-OpenSSL-function-signatures-that-cau.patch78
-rw-r--r--meta-tpm/recipes-tpm2/tpm2-tss-engine/tpm2-tss-engine_1.2.0.bb (renamed from meta-tpm/recipes-tpm2/tpm2-tss-engine/tpm2-tss-engine_1.1.0.bb)7
3 files changed, 131 insertions, 2 deletions
diff --git a/meta-tpm/recipes-tpm2/tpm2-tss-engine/files/0001-Configure-Allow-disabling-of-digest-sign-operations.patch b/meta-tpm/recipes-tpm2/tpm2-tss-engine/files/0001-Configure-Allow-disabling-of-digest-sign-operations.patch
new file mode 100644
index 0000000..f0f1fad
--- /dev/null
+++ b/meta-tpm/recipes-tpm2/tpm2-tss-engine/files/0001-Configure-Allow-disabling-of-digest-sign-operations.patch
@@ -0,0 +1,48 @@
1From af8b26e7ffe69837197fb841e9a31230ae01c9cc Mon Sep 17 00:00:00 2001
2From: Andreas Fuchs <andreas.fuchs@infineon.com>
3Date: Mon, 22 May 2023 14:06:41 +0200
4Subject: [PATCH 1/2] Configure: Allow disabling of digest-sign operations
5
6Since the digest-sign operations perform the hash on the TPM and
7TPMs in general do not support SHA512, this can lead to errors.
8Depending on the use case, it might be preferable to not support
9restricted keys (via digest+sign) but to rely on ordinary keys
10only.
11
12Upstream-Status: Backport
13Signed-off-by: Andreas Fuchs <andreas.fuchs@infineon.com>
14Signed-off-by: Armin Kuster <akuster808@gmail.com>
15
16---
17 configure.ac | 10 ++++++++--
18 1 file changed, 8 insertions(+), 2 deletions(-)
19
20diff --git a/configure.ac b/configure.ac
21index d4a9356..b379042 100644
22--- a/configure.ac
23+++ b/configure.ac
24@@ -116,13 +116,19 @@ PKG_CHECK_MODULES([CRYPTO], [libcrypto >= 1.0.2g],
25 PKG_CHECK_MODULES([TSS2_ESYS], [tss2-esys >= 2.3])
26 PKG_CHECK_MODULES([TSS2_MU], [tss2-mu])
27 PKG_CHECK_MODULES([TSS2_TCTILDR], [tss2-tctildr])
28+
29 AC_CHECK_LIB([crypto], EC_KEY_METHOD_set_compute_key,
30 [AM_CONDITIONAL([HAVE_OPENSSL_ECDH], true)],
31 [AM_CONDITIONAL([HAVE_OPENSSL_ECDH], false)])
32+
33+AC_ARG_ENABLE([digestsign],
34+ [AS_HELP_STRING([--disable-digestsign],
35+ [Disable support for digest and sign methods, helps with TPM unsupported hash algorithms.])],,
36+ [enable_digestsign=yes])
37 AC_CHECK_LIB([crypto], EVP_PKEY_meth_set_digest_custom,
38- [AM_CONDITIONAL([HAVE_OPENSSL_DIGEST_SIGN], true)],
39+ [AM_CONDITIONAL([HAVE_OPENSSL_DIGEST_SIGN], [test "x$enable_digestsign" != "xno"])],
40 [AM_CONDITIONAL([HAVE_OPENSSL_DIGEST_SIGN], false)])
41-AS_IF([test "x$ac_cv_lib_crypto_EVP_PKEY_meth_set_digest_custom" = xyes],
42+AS_IF([test "x$ac_cv_lib_crypto_EVP_PKEY_meth_set_digest_custom" = xyes && test "x$enable_digestsign" = "xyes"],
43 [AC_DEFINE([HAVE_OPENSSL_DIGEST_SIGN], [1],
44 Have required functionality from OpenSSL to support digest and sign)])
45
46--
472.43.0
48
diff --git a/meta-tpm/recipes-tpm2/tpm2-tss-engine/files/0002-Fix-mismatch-of-OpenSSL-function-signatures-that-cau.patch b/meta-tpm/recipes-tpm2/tpm2-tss-engine/files/0002-Fix-mismatch-of-OpenSSL-function-signatures-that-cau.patch
new file mode 100644
index 0000000..0bd4e2e
--- /dev/null
+++ b/meta-tpm/recipes-tpm2/tpm2-tss-engine/files/0002-Fix-mismatch-of-OpenSSL-function-signatures-that-cau.patch
@@ -0,0 +1,78 @@
1From 766505bf5c943c614fd246d27d1e5cd66543250b Mon Sep 17 00:00:00 2001
2From: Matthias Gerstner <matthias.gerstner@suse.de>
3Date: Mon, 6 May 2024 16:07:54 +0200
4Subject: [PATCH 2/2] Fix mismatch of OpenSSL function signatures that cause
5 errors with gcc-14
6
7Building with gcc-14 fails with diagnostics like this:
8
9```
10src/tpm2-tss-engine-rsa.c:805:46: error: passing argument 2 of 'EVP_PKEY_meth_set_copy' from incompatible pointer type [-Wincompatible-pointer-types]
11 805 | EVP_PKEY_meth_set_copy(pkey_rsa_methods, rsa_pkey_copy);
12 | ^~~~~~~~~~~~~
13 | |
14 | int (*)(EVP_PKEY_CTX *, EVP_PKEY_CTX *) {aka int (*)(struct evp_pkey_ctx_st *, struct evp_pkey_ctx_st *)}
15/usr/include/openssl/evp.h:2005:36: note: expected 'int (*)(EVP_PKEY_CTX *, const EVP_PKEY_CTX *)' {aka 'int (*)(struct evp_pkey_ctx_st *, const struct evp_pkey_ctx_st *)'} but argument is of type 'int (*)(EVP_PKEY_CTX *, EVP_PKEY_CTX *)' {aka 'int (*)(struct evp_pkey_ctx_st *, struct evp_pkey_ctx_st *)'}
16```
17
18A look into OpenSSL upstream shows that these functions have always had const
19`src` parameters. Thus this error was simply not detected by earlier compiler
20versions.
21
22Upstream-Status: Backport
23
24Signed-off-by: Matthias Gerstner <matthias.gerstner@suse.de>
25Signed-off-by: Armin Kuster <akuster808@gmail.com>
26
27---
28 src/tpm2-tss-engine-ecc.c | 4 ++--
29 src/tpm2-tss-engine-rsa.c | 4 ++--
30 2 files changed, 4 insertions(+), 4 deletions(-)
31
32diff --git a/src/tpm2-tss-engine-ecc.c b/src/tpm2-tss-engine-ecc.c
33index 9e72c85..f6b9c5a 100644
34--- a/src/tpm2-tss-engine-ecc.c
35+++ b/src/tpm2-tss-engine-ecc.c
36@@ -52,7 +52,7 @@ EC_KEY_METHOD *ecc_methods = NULL;
37 #endif /* OPENSSL_VERSION_NUMBER < 0x10100000 */
38
39 #ifdef HAVE_OPENSSL_DIGEST_SIGN
40-static int (*ecdsa_pkey_orig_copy)(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src);
41+static int (*ecdsa_pkey_orig_copy)(EVP_PKEY_CTX *dst, const EVP_PKEY_CTX *src);
42 static void (*ecdsa_pkey_orig_cleanup)(EVP_PKEY_CTX *ctx);
43 #endif /* HAVE_OPENSSL_DIGEST_SIGN */
44
45@@ -405,7 +405,7 @@ ecdsa_ec_key_sign(const unsigned char *dgst, int dgst_len, const BIGNUM *inv,
46
47 #ifdef HAVE_OPENSSL_DIGEST_SIGN
48 static int
49-ecdsa_pkey_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src)
50+ecdsa_pkey_copy(EVP_PKEY_CTX *dst, const EVP_PKEY_CTX *src)
51 {
52 if (ecdsa_pkey_orig_copy && !ecdsa_pkey_orig_copy(dst, src))
53 return 0;
54diff --git a/src/tpm2-tss-engine-rsa.c b/src/tpm2-tss-engine-rsa.c
55index 41de34e..e7260c2 100644
56--- a/src/tpm2-tss-engine-rsa.c
57+++ b/src/tpm2-tss-engine-rsa.c
58@@ -49,7 +49,7 @@ RSA_METHOD *rsa_methods = NULL;
59 #endif /* OPENSSL_VERSION_NUMBER < 0x10100000 */
60
61 #ifdef HAVE_OPENSSL_DIGEST_SIGN
62-static int (*rsa_pkey_orig_copy)(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src);
63+static int (*rsa_pkey_orig_copy)(EVP_PKEY_CTX *dst, const EVP_PKEY_CTX *src);
64 static void (*rsa_pkey_orig_cleanup)(EVP_PKEY_CTX *ctx);
65 #endif /* HAVE_OPENSSL_DIGEST_SIGN */
66
67@@ -637,7 +637,7 @@ RSA_METHOD rsa_methods = {
68
69 #ifdef HAVE_OPENSSL_DIGEST_SIGN
70 static int
71-rsa_pkey_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src)
72+rsa_pkey_copy(EVP_PKEY_CTX *dst, const EVP_PKEY_CTX *src)
73 {
74 if (rsa_pkey_orig_copy && !rsa_pkey_orig_copy(dst, src))
75 return 0;
76--
772.43.0
78
diff --git a/meta-tpm/recipes-tpm2/tpm2-tss-engine/tpm2-tss-engine_1.1.0.bb b/meta-tpm/recipes-tpm2/tpm2-tss-engine/tpm2-tss-engine_1.2.0.bb
index 89162ee..30865d2 100644
--- a/meta-tpm/recipes-tpm2/tpm2-tss-engine/tpm2-tss-engine_1.1.0.bb
+++ b/meta-tpm/recipes-tpm2/tpm2-tss-engine/tpm2-tss-engine_1.2.0.bb
@@ -8,9 +8,12 @@ SECTION = "security/tpm"
8 8
9DEPENDS = "autoconf-archive-native bash-completion libtss2 libgcrypt openssl" 9DEPENDS = "autoconf-archive-native bash-completion libtss2 libgcrypt openssl"
10 10
11SRC_URI = "https://github.com/tpm2-software/${BPN}/releases/download/v${PV}/${BPN}-${PV}.tar.gz" 11SRC_URI = "https://github.com/tpm2-software/${BPN}/releases/download/${PV}/${BPN}-${PV}.tar.gz \
12 file://0001-Configure-Allow-disabling-of-digest-sign-operations.patch \
13 file://0002-Fix-mismatch-of-OpenSSL-function-signatures-that-cau.patch \
14 "
12 15
13SRC_URI[sha256sum] = "ea2941695ac221d23a7f3e1321140e75b1495ae6ade876f2f4c2ed807c65e2a5" 16SRC_URI[sha256sum] = "3c94fef110dd3630b3c28c5875febba76b7d5ba2fcc04a14c4a30f5d2157c265"
14 17
15UPSTREAM_CHECK_URI = "https://github.com/tpm2-software/${BPN}/releases" 18UPSTREAM_CHECK_URI = "https://github.com/tpm2-software/${BPN}/releases"
16 19
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-11-18 20:40:21 +0000