Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package pcr-oracle for openSUSE:Factory checked in at 2026-07-20 09:57:00 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/pcr-oracle (Old) and /work/SRC/openSUSE:Factory/.pcr-oracle.new.24530 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "pcr-oracle" Mon Jul 20 09:57:00 2026 rev:28 rq:1366267 version:0.6.4 Changes: -------- --- /work/SRC/openSUSE:Factory/pcr-oracle/pcr-oracle.changes 2026-05-24 19:34:31.156492212 +0200 +++ /work/SRC/openSUSE:Factory/.pcr-oracle.new.24530/pcr-oracle.changes 2026-07-20 09:57:11.111779432 +0200 @@ -1,0 +2,7 @@ +Wed Jul 15 02:05:48 UTC 2026 - Gary Ching-Pang Lin <[email protected]> + +- Update to 0.6.4 + + Support TPM PCR snapshot on PowerPC 64 platform + + Fix SBAT string length calculations (bsc#1270265) + +------------------------------------------------------------------- Old: ---- pcr-oracle-0.6.3.tar.xz New: ---- pcr-oracle-0.6.4.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ pcr-oracle.spec ++++++ --- /var/tmp/diff_new_pack.qV2BvZ/_old 2026-07-20 09:57:11.723800026 +0200 +++ /var/tmp/diff_new_pack.qV2BvZ/_new 2026-07-20 09:57:11.723800026 +0200 @@ -18,7 +18,7 @@ Name: pcr-oracle -Version: 0.6.3 +Version: 0.6.4 Release: 0 Summary: Predict TPM PCR values License: GPL-2.0-or-later ++++++ _service ++++++ --- /var/tmp/diff_new_pack.qV2BvZ/_old 2026-07-20 09:57:11.759801237 +0200 +++ /var/tmp/diff_new_pack.qV2BvZ/_new 2026-07-20 09:57:11.763801372 +0200 @@ -7,7 +7,7 @@ <param name="url">https://github.com/openSUSE/pcr-oracle.git</param> <param name="filename">pcr-oracle</param> <param name="versionformat">@PARENT_TAG@</param> - <param name="revision">refs/tags/0.6.3</param> + <param name="revision">refs/tags/0.6.4</param> </service> <service name="recompress" mode="disabled"> <param name="file">pcr-oracle*.tar</param> ++++++ pcr-oracle-0.6.3.tar.xz -> pcr-oracle-0.6.4.tar.xz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/pcr-oracle-0.6.3/configure new/pcr-oracle-0.6.4/configure --- old/pcr-oracle-0.6.3/configure 2026-05-21 08:15:53.000000000 +0200 +++ new/pcr-oracle-0.6.4/configure 2026-07-15 03:54:03.000000000 +0200 @@ -12,7 +12,7 @@ # Invoke with --help for a description of options # # microconf:begin -# version 0.6.1 +# version 0.6.4 # require libtss2 # require json # require libfdisk diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/pcr-oracle-0.6.3/microconf/version new/pcr-oracle-0.6.4/microconf/version --- old/pcr-oracle-0.6.3/microconf/version 2026-05-21 08:15:53.000000000 +0200 +++ new/pcr-oracle-0.6.4/microconf/version 2026-07-15 03:54:03.000000000 +0200 @@ -1 +1 @@ -uc_version=0.6.1 +uc_version=0.6.4 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/pcr-oracle-0.6.3/src/efi-variable.c new/pcr-oracle-0.6.4/src/efi-variable.c --- old/pcr-oracle-0.6.3/src/efi-variable.c 2026-05-21 08:15:53.000000000 +0200 +++ new/pcr-oracle-0.6.4/src/efi-variable.c 2026-07-15 03:54:03.000000000 +0200 @@ -112,24 +112,61 @@ uint32_t fmt_ver; uint32_t offset_auto; uint32_t offset_latest; + size_t limit; + /* + * The structure of the .sbatlevel section: + * +--------+-----------------------------------------+ + * | Offset | Field / Content | + * +--------+-----------------------------------------+ + * | 0x00 | Format Version (always 0, 4-byte int) | + * +--------+-----------------------------------------+ + * | 0x04 | Offset to Automatic SBAT Payload | + * | | (4-byte int, relative to 0x04) | + * +--------+-----------------------------------------+ + * | 0x08 | Offset to Latest SBAT Payload | + * | | (4-byte int, relative to 0x04) | + * +--------+-----------------------------------------+ + * | ... | Automatic SBAT Payload String (\0-term) | + * +--------+-----------------------------------------+ + * | ... | Latest SBAT Payload String (\0-term) | + * +--------+-----------------------------------------+ + * + * Note: In the SbatLevelRT variable, the terminating null + * is excluded, so 'auto_len' and 'latest_len' should + * not include '\0'. + */ if (!buffer_get_u32le(sec, &fmt_ver) || !buffer_get_u32le(sec, &offset_auto) || !buffer_get_u32le(sec, &offset_latest)) return false; - if (offset_auto + 4 > offset_latest) + /* + * Prevent integer overflow of offset_latest and offset_auto and + * validate that the SBAT payloads (at least sizeof(SBAT_ORIGINAL) + * long) fit completely within the buffer. + */ + if (offset_latest >= sec->wpos || + offset_latest + 4 + sizeof(SBAT_ORIGINAL) > sec->wpos) + return false; + + if (offset_auto > offset_latest || + offset_auto + sizeof(SBAT_ORIGINAL) > offset_latest) return false; if (!buffer_seek_read(sec, offset_auto + 4)) return false; *sbat_automatic = (char *)buffer_read_pointer(sec); - *auto_len = offset_latest - (offset_auto + 4); + + limit = offset_latest - offset_auto; + *auto_len = strnlen(*sbat_automatic, limit); if (!buffer_seek_read(sec, offset_latest + 4)) return false; *sbat_latest = (char *)(buffer_read_pointer(sec)); - *latest_len = buffer_available(sec); + + limit = sec->wpos - (offset_latest + 4); + *latest_len = strnlen(*sbat_latest, limit); return true; } @@ -266,7 +303,7 @@ debug("Use candidate SbatLevel\n"); buffer_free(sbatlvlrt); - /* Copy the candidate SbatLevel string without the terminating null */ + /* Copy the candidate SbatLevel string */ if ((result = buffer_alloc_write(candidate_len)) == NULL || !buffer_put(result, sbat_candidate, candidate_len)) goto fail; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/pcr-oracle-0.6.3/src/eventlog.c new/pcr-oracle-0.6.4/src/eventlog.c --- old/pcr-oracle-0.6.3/src/eventlog.c 2026-05-21 08:15:53.000000000 +0200 +++ new/pcr-oracle-0.6.4/src/eventlog.c 2026-07-15 03:54:03.000000000 +0200 @@ -1089,7 +1089,7 @@ return true; } -#define GRUB_PREP_ENVBLK "PReP ENV Block" +#define GRUB_PREP_ENVBLK "PReP envblk" static bool __tpm_event_parse_ipl(tpm_event_t *ev, tpm_parsed_event_t *parsed, buffer_t *bp) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/pcr-oracle-0.6.3/src/oracle.c new/pcr-oracle-0.6.4/src/oracle.c --- old/pcr-oracle-0.6.3/src/oracle.c 2026-05-21 08:15:53.000000000 +0200 +++ new/pcr-oracle-0.6.4/src/oracle.c 2026-07-15 03:54:03.000000000 +0200 @@ -80,7 +80,8 @@ bool disable_synthesis; }; -#define GRUB_PCR_SNAPSHOT_PATH "/sys/firmware/efi/efivars/GrubPcrSnapshot-7ce323f2-b841-4d30-a0e9-5474a76c9a3f" +#define GRUB_EFI_PCR_SNAPSHOT_PATH "/sys/firmware/efi/efivars/GrubPcrSnapshot-7ce323f2-b841-4d30-a0e9-5474a76c9a3f" +#define GRUB_DT_PCR_SNAPSHOT_PATH "/sys/firmware/devicetree/base/chosen/grub,pcr-snapshot" enum { OPT_FROM = 256, @@ -196,7 +197,7 @@ "Valid PCR sources for the --from and --verify options include:\n" " zero Initialize PCR state to all zero\n" " current Set the PCR state to the current state of the host's PCR\n" - " snapshot Read the PCR state from a snapshot taken during boot (GrubPcrSnapshot EFI variable)\n" + " snapshot Read the PCR state from a snapshot taken during boot (GrubPcrSnapshot EFI variable or devicetree)\n" " eventlog Predict the PCR state using the event log, by substituting current values. Only valid\n" " as argument to --from.\n" "\n" @@ -220,9 +221,14 @@ pcr_bank_init_from_zero(bank); else if (!strcmp(source, "current")) pcr_bank_init_from_current(bank); - else if (!strcmp(source, "snapshot")) - pcr_bank_init_from_snapshot(bank, GRUB_PCR_SNAPSHOT_PATH); - else + else if (!strcmp(source, "snapshot")) { + const char *path = GRUB_EFI_PCR_SNAPSHOT_PATH; + + if (access(path, R_OK) != 0 && access(GRUB_DT_PCR_SNAPSHOT_PATH, R_OK) == 0) + path = GRUB_DT_PCR_SNAPSHOT_PATH; + + pcr_bank_init_from_snapshot(bank, path); + } else fatal("don't know how to load PCR bank with initial values: unsupported source \"%s\"\n", source); } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/pcr-oracle-0.6.3/src/pcr.c new/pcr-oracle-0.6.4/src/pcr.c --- old/pcr-oracle-0.6.3/src/pcr.c 2026-05-21 08:15:53.000000000 +0200 +++ new/pcr-oracle-0.6.4/src/pcr.c 2026-07-15 03:54:03.000000000 +0200 @@ -205,20 +205,23 @@ } void -pcr_bank_init_from_snapshot(tpm_pcr_bank_t *bank, const char *efivar_path) +pcr_bank_init_from_snapshot(tpm_pcr_bank_t *bank, const char *snapshot_path) { FILE *fp; char buf[4]; - debug("Trying to find PCR values in %s\n", efivar_path); - if (!(fp = fopen(efivar_path, "r"))) - fatal("Unable to open \"%s\": %m\n", efivar_path); + debug("Trying to find PCR values in %s\n", snapshot_path); + if (!(fp = fopen(snapshot_path, "r"))) + fatal("Unable to open \"%s\": %m\n", snapshot_path); /* The efivarfs files are not seekable. Use fread() to skip over - * 4 bytes of variable attributes + * 4 bytes of variable attributes. Device tree or other regular files + * do not have this attribute prefix. */ - if (fread(buf, 1, 4, fp) != 4) - fatal("Unable to skip the first 4 bytes of %s\n", efivar_path); + if (strstr(snapshot_path, "/efivars/") != NULL) { + if (fread(buf, 1, 4, fp) != 4) + fatal("Unable to skip the first 4 bytes of %s\n", snapshot_path); + } pcr_bank_init_from_snapshot_fp(fp, bank); } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/pcr-oracle-0.6.3/src/pcr.h new/pcr-oracle-0.6.4/src/pcr.h --- old/pcr-oracle-0.6.3/src/pcr.h 2026-05-21 08:15:53.000000000 +0200 +++ new/pcr-oracle-0.6.4/src/pcr.h 2026-07-15 03:54:03.000000000 +0200 @@ -49,7 +49,7 @@ extern void pcr_bank_set_locality(tpm_pcr_bank_t *bank, unsigned int index, uint8_t locality); extern void pcr_bank_init_from_zero(tpm_pcr_bank_t *bank); extern void pcr_bank_init_from_snapshot_fp(FILE *fp, tpm_pcr_bank_t *bank); -extern void pcr_bank_init_from_snapshot(tpm_pcr_bank_t *bank, const char *efivar_path); +extern void pcr_bank_init_from_snapshot(tpm_pcr_bank_t *bank, const char *snapshot_path); extern void pcr_bank_init_from_current(tpm_pcr_bank_t *bank); extern bool pcr_selection_valid_string(const char *);
