Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package swtpm for openSUSE:Factory checked in at 2026-08-25 13:18:49 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/swtpm (Old) and /work/SRC/openSUSE:Factory/.swtpm.new.1258 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "swtpm" Tue Aug 25 13:18:49 2026 rev:28 rq:1373339 version:0.10.2 Changes: -------- --- /work/SRC/openSUSE:Factory/swtpm/swtpm.changes 2026-08-05 17:47:02.834986492 +0200 +++ /work/SRC/openSUSE:Factory/.swtpm.new.1258/swtpm.changes 2026-08-25 13:18:56.253522939 +0200 @@ -1,0 +2,13 @@ +Sun Aug 23 18:26:09 UTC 2026 - Andreas Stieger <[email protected]> + +- update to 0.10.2: + * CVE-2026-75900: swtpm: Fix length check in + SWTPM_NVRAM_CheckHeader() (boo#1275653) + * Properly check for truncation following snprintf call +- drop patches included upstream: + * 1271417-drop-tunable-requires.patch + * 1027.patch + * 1132.patch +- add upstream signing key and validate source signature + +------------------------------------------------------------------- Old: ---- 1027.patch 1132.patch 1271417-drop-tunable-requires.patch swtpm-0.10.1.tar.gz New: ---- swtpm-0.10.2.tar.gz swtpm-0.10.2.tar.gz.asc swtpm.keyring ----------(Old B)---------- Old: * 1271417-drop-tunable-requires.patch * 1027.patch * 1132.patch Old: * 1027.patch * 1132.patch - add upstream signing key and validate source signature Old:- drop patches included upstream: * 1271417-drop-tunable-requires.patch * 1027.patch ----------(Old E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ swtpm.spec ++++++ --- /var/tmp/diff_new_pack.7emEGQ/_old 2026-08-25 13:18:57.990584192 +0200 +++ /var/tmp/diff_new_pack.7emEGQ/_new 2026-08-25 13:18:57.999584510 +0200 @@ -31,21 +31,17 @@ %define modulename3 swtpmcuse %define modulename4 swtpm_libvirt Name: swtpm -Version: 0.10.1 +Version: 0.10.2 Release: 0 Summary: Software TPM emulator License: BSD-3-Clause Group: System/Base URL: https://github.com/stefanberger/swtpm Source0: %{url}/archive/v%{version}/%{name}-%{version}.tar.gz +Source1: %{url}/releases/download/v%{version}/v%{version}.tar.gz.asc#/%{name}-%{version}.tar.gz.asc +Source2: %{name}.keyring Source100: swtpm-rpmlintrc Patch0: swtpm-fix-build.patch -# PATCH-FIX-UPSTREAM -Patch1: https://patch-diff.githubusercontent.com/raw/stefanberger/swtpm/pull/1027.patch -# PATCH-FIX-UPSTREAM - [email protected] bsc#1271417 drop tunable requires as it overrides booleanif -Patch2: 1271417-drop-tunable-requires.patch -# PATCH-FIX-UPSTREAM - [email protected] bsc#1266339 allow unix_stream_socket and setsched for virtqemud -Patch3: https://patch-diff.githubusercontent.com/raw/stefanberger/swtpm/pull/1132.patch BuildRequires: autoconf BuildRequires: automake BuildRequires: expect @@ -59,7 +55,7 @@ BuildRequires: libseccomp-devel BuildRequires: libtasn1-devel BuildRequires: libtool -BuildRequires: libtpms-devel +BuildRequires: libtpms-devel >= 0.10 BuildRequires: pkgconfig %if %{with use_selinux} BuildRequires: selinux-policy-devel @@ -179,6 +175,7 @@ %dir %attr(0750,tss,root) %{_localstatedir}/lib/swtpm-localca %files devel +%license LICENSE %{_libdir}/swtpm/*.so %{_includedir}/swtpm %{_mandir}/man3/swtpm*%{?ext_man} ++++++ swtpm-0.10.1.tar.gz -> swtpm-0.10.2.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/swtpm-0.10.1/CHANGES new/swtpm-0.10.2/CHANGES --- old/swtpm-0.10.1/CHANGES 2025-04-30 14:32:33.000000000 +0200 +++ new/swtpm-0.10.2/CHANGES 2026-08-19 02:32:30.000000000 +0200 @@ -1,5 +1,16 @@ CHANGES - changes for swtpm +version 0.10.2: + - swtpm: + - Fix length check in SWTPM_NVRAM_CheckHeader() (CVE-2026-75900) + - Properly check for truncation following snprintf call + - selinux: + - Fix policy loading with 3.11 SElinux toolchain (bsc#1271417) + - Add SELinux policy for virtqemud_t swtpm_t setsched process and unix socket interactions. + - tests: + - Retry NVWrite command after 0x922 return code and inc lockout counter + - Extend regex to allow for optional RSA-4096 keys + version 0.10.1: - swtpm: - Fix build error on 32bit systems due to inconsistent _FILE_OFFSET_BITS diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/swtpm-0.10.1/configure.ac new/swtpm-0.10.2/configure.ac --- old/swtpm-0.10.1/configure.ac 2025-04-30 14:32:33.000000000 +0200 +++ new/swtpm-0.10.2/configure.ac 2026-08-19 02:32:30.000000000 +0200 @@ -23,7 +23,7 @@ # This file is derived from tpm-tool's configure.in. # -AC_INIT([swtpm],[0.10.1]) +AC_INIT([swtpm],[0.10.2]) AC_PREREQ([2.69]) AC_CONFIG_SRCDIR(Makefile.am) AC_CONFIG_HEADERS([config.h]) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/swtpm-0.10.1/debian/changelog new/swtpm-0.10.2/debian/changelog --- old/swtpm-0.10.1/debian/changelog 2025-04-30 14:32:33.000000000 +0200 +++ new/swtpm-0.10.2/debian/changelog 2026-08-19 02:32:30.000000000 +0200 @@ -1,3 +1,9 @@ +swtpm (0.10.2) RELEASED; urgency=medium + + * Stable release + + -- Stefan Berger <[email protected]> Wed, 18 Aug 2026 09:00:00 -0500 + swtpm (0.10.1) RELEASED; urgency=medium * Stable release diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/swtpm-0.10.1/src/selinux/swtpm.te new/swtpm-0.10.2/src/selinux/swtpm.te --- old/swtpm-0.10.1/src/selinux/swtpm.te 2025-04-30 14:32:33.000000000 +0200 +++ new/swtpm-0.10.2/src/selinux/swtpm.te 2026-08-19 02:32:30.000000000 +0200 @@ -14,7 +14,6 @@ type virtqemud_t; type virtqemud_tmp_t; class file map; - tunable virt_use_nfs; } attribute_role swtpm_roles; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/swtpm-0.10.1/src/selinux/swtpm_libvirt.te new/swtpm-0.10.2/src/selinux/swtpm_libvirt.te --- old/swtpm-0.10.1/src/selinux/swtpm_libvirt.te 2025-04-30 14:32:33.000000000 +0200 +++ new/swtpm-0.10.2/src/selinux/swtpm_libvirt.te 2026-08-19 02:32:30.000000000 +0200 @@ -40,7 +40,8 @@ allow virtqemud_t svirt_tcg_t:process { noatsecure rlimitinh setsched siginh signal signull transition }; allow virtqemud_t svirt_tcg_t:unix_stream_socket { bind connectto create listen }; allow virtqemud_t svirt_tcg_devpts_t:chr_file { ioctl open read write }; -allow virtqemud_t swtpm_t:process { noatsecure rlimitinh siginh signull }; +allow virtqemud_t swtpm_t:process { noatsecure rlimitinh siginh signull setsched }; +allow virtqemud_t swtpm_t:unix_stream_socket { bind connectto create listen }; allow virtqemud_t urandom_device_t:chr_file setattr; # Some rules are due to swtpm-localca ( https://bugzilla.redhat.com/show_bug.cgi?id=2278905#c34 ) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/swtpm-0.10.1/src/swtpm/swtpm_nvstore.c new/swtpm-0.10.2/src/swtpm/swtpm_nvstore.c --- old/swtpm-0.10.1/src/swtpm/swtpm_nvstore.c 2025-04-30 14:32:33.000000000 +0200 +++ new/swtpm-0.10.2/src/swtpm/swtpm_nvstore.c 2026-08-19 02:32:30.000000000 +0200 @@ -269,7 +269,7 @@ } else { n = snprintf(filename, bufsize, "tpm%s-%02lx.%s", suffix, (unsigned long)tpm_number, name); } - if ((size_t)n > bufsize) { + if ((size_t)n >= bufsize) { res = TPM_FAIL; } @@ -1106,7 +1106,7 @@ blobheader *bh = (blobheader *)data; uint16_t hdrsize; - if (length < sizeof(bh)) { + if (length < sizeof(*bh)) { if (!quiet) logprintf(STDERR_FILENO, "not enough bytes for header: %u\n", length); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/swtpm-0.10.1/src/swtpm/swtpm_nvstore_dir.c new/swtpm-0.10.2/src/swtpm/swtpm_nvstore_dir.c --- old/swtpm-0.10.1/src/swtpm/swtpm_nvstore_dir.c 2025-04-30 14:32:33.000000000 +0200 +++ new/swtpm-0.10.2/src/swtpm/swtpm_nvstore_dir.c 2026-08-19 02:32:30.000000000 +0200 @@ -181,7 +181,7 @@ tpm_number, name, is_tempfile); if (rc == 0) { n = snprintf(filepath, bufsize, "%s/%s", tpm_state_path, filename); - if ((size_t) n > bufsize) + if ((size_t) n >= bufsize) rc = TPM_FAIL; } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/swtpm-0.10.1/swtpm.spec new/swtpm-0.10.2/swtpm.spec --- old/swtpm-0.10.1/swtpm.spec 2025-04-30 14:32:33.000000000 +0200 +++ new/swtpm-0.10.2/swtpm.spec 2026-08-19 02:32:30.000000000 +0200 @@ -8,7 +8,7 @@ Summary: TPM Emulator Name: swtpm -Version: 0.10.1 +Version: 0.10.2 Release: 1%{?dist} License: BSD-3-Clause Url: https://github.com/stefanberger/swtpm @@ -203,6 +203,9 @@ %{_libexecdir}/installed-tests/swtpm/ %changelog +* Wed Aug 19 2026 Stefan Berger <[email protected]> - 0.10.2-0.20260819git------- +- v0.10.2 release + * Wed Apr 30 2025 Stefan Berger <[email protected]> - 0.10.1-0.20250430git------- - v0.10.1 release diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/swtpm-0.10.1/swtpm.spec.in new/swtpm-0.10.2/swtpm.spec.in --- old/swtpm-0.10.1/swtpm.spec.in 2025-04-30 14:32:33.000000000 +0200 +++ new/swtpm-0.10.2/swtpm.spec.in 2026-08-19 02:32:30.000000000 +0200 @@ -203,6 +203,9 @@ %{_libexecdir}/installed-tests/swtpm/ %changelog +* Wed Aug 19 2026 Stefan Berger <[email protected]> - 0.10.2-0.20260819git------- +- v0.10.2 release + * Wed Apr 30 2025 Stefan Berger <[email protected]> - 0.10.1-0.20250430git------- - v0.10.1 release diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/swtpm-0.10.1/tests/_test_print_capabilities new/swtpm-0.10.2/tests/_test_print_capabilities --- old/swtpm-0.10.1/tests/_test_print_capabilities 2025-04-30 14:32:33.000000000 +0200 +++ new/swtpm-0.10.2/tests/_test_print_capabilities 2026-08-19 02:32:30.000000000 +0200 @@ -52,8 +52,8 @@ '"features": \[ "tpm-1.2",( "tpm-2.0",)? "cmdarg-keyfile-fd", "cmdarg-pwdfile-fd", '\ '"tpm12-not-need-root", "cmdarg-write-ek-cert-files", "cmdarg-create-config-files", '\ '"cmdarg-reconfigure-pcr-banks"'\ -'(, "tpm2-rsa-keysize-2048")?(, "tpm2-rsa-keysize-3072")?, "cmdarg-profile", '\ -'"cmdarg-profile-remove-disabled" \], '\ +'(, "tpm2-rsa-keysize-2048")?(, "tpm2-rsa-keysize-3072")?(, "tpm2-rsa-keysize-4096")?, '\ +'"cmdarg-profile", "cmdarg-profile-remove-disabled" \], '\ '"profiles": \[ [^]]*\], '\ '"version": "[^"]*" \}' if ! [[ ${msg} =~ ${exp} ]]; then diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/swtpm-0.10.1/tests/_test_tpm2_avoid_da_lockout new/swtpm-0.10.2/tests/_test_tpm2_avoid_da_lockout --- old/swtpm-0.10.1/tests/_test_tpm2_avoid_da_lockout 2025-04-30 14:32:33.000000000 +0200 +++ new/swtpm-0.10.2/tests/_test_tpm2_avoid_da_lockout 2026-08-19 02:32:30.000000000 +0200 @@ -53,6 +53,11 @@ cmd='\x80\x02\x00\x00\x00\x24\x00\x00\x01\x37\x01\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x09\x40\x00\x00\x09\x00\x00\x00\x00\x00\x00\x01\x41\x00\x00' RES=$(swtpm_cmd_tx "${SWTPM_INTERFACE}" ${cmd}) exp=' 80 01 00 00 00 0a 00 00 09 22' +if [ "$RES" == "$exp" ]; then + # 0x922 : retry command + RES=$(swtpm_cmd_tx "${SWTPM_INTERFACE}" ${cmd}) +fi +exp=' 80 01 00 00 00 0a 00 00 09 8e' if [ "$RES" != "$exp" ]; then echo "Error: Did not get expected result from TPM2_NV_Write" echo "expected: $exp" @@ -63,9 +68,9 @@ # The TPM_PT_LOCKOUT_COUNTER must be 0 now: tssgetcapability -cap 6 -pr 0x20e -pc 1 cmd='\x80\x01\x00\x00\x00\x16\x00\x00\x01\x7a\x00\x00\x00\x06\x00\x00\x02\x0e\x00\x00\x00\x01' RES=$(swtpm_cmd_tx "${SWTPM_INTERFACE}" ${cmd}) -exp=' 80 01 00 00 00 1b 00 00 00 00 01 00 00 00 06 00 00 00 01 00 00 02 0e 00 00 00 00' +exp=' 80 01 00 00 00 1b 00 00 00 00 01 00 00 00 06 00 00 00 01 00 00 02 0e 00 00 00 01' if [ "$RES" != "$exp" ]; then - echo "Error: Did not get expected result from TPM2_GetCapability(TPM_PT_LOCKOUT_COUNTER)" + echo "Error: Did not get expected result from 1st TPM2_GetCapability(TPM_PT_LOCKOUT_COUNTER)" echo "expected: $exp" echo "received: $RES" exit 1 @@ -92,9 +97,9 @@ # Without swtpm sending TPM2_Shutdown, it would be '1' now cmd='\x80\x01\x00\x00\x00\x16\x00\x00\x01\x7a\x00\x00\x00\x06\x00\x00\x02\x0e\x00\x00\x00\x01' RES=$(swtpm_cmd_tx "${SWTPM_INTERFACE}" ${cmd}) -exp=' 80 01 00 00 00 1b 00 00 00 00 01 00 00 00 06 00 00 00 01 00 00 02 0e 00 00 00 00' +exp=' 80 01 00 00 00 1b 00 00 00 00 01 00 00 00 06 00 00 00 01 00 00 02 0e 00 00 00 01' if [ "$RES" != "$exp" ]; then - echo "Error: Did not get expected result from TPM2_GetCapability(TPM_PT_LOCKOUT_COUNTER)" + echo "Error: Did not get expected result from 2nd TPM2_GetCapability(TPM_PT_LOCKOUT_COUNTER)" echo "expected: $exp" echo "received: $RES" exit 1 @@ -104,6 +109,11 @@ cmd='\x80\x02\x00\x00\x00\x24\x00\x00\x01\x37\x01\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x09\x40\x00\x00\x09\x00\x00\x00\x00\x00\x00\x01\x41\x00\x00' RES=$(swtpm_cmd_tx "${SWTPM_INTERFACE}" ${cmd}) exp=' 80 01 00 00 00 0a 00 00 09 22' +if [ "$RES" == "$exp" ]; then + # 0x922 : retry command + RES=$(swtpm_cmd_tx "${SWTPM_INTERFACE}" ${cmd}) +fi +exp=' 80 01 00 00 00 0a 00 00 09 8e' if [ "$RES" != "$exp" ]; then echo "Error: Did not get expected result from TPM2_NV_Write" echo "expected: $exp" @@ -136,9 +146,9 @@ # Without swtpm sending TPM2_Shutdown, it would be '2' now cmd='\x80\x01\x00\x00\x00\x16\x00\x00\x01\x7a\x00\x00\x00\x06\x00\x00\x02\x0e\x00\x00\x00\x01' RES=$(swtpm_cmd_tx "${SWTPM_INTERFACE}" ${cmd}) -exp=' 80 01 00 00 00 1b 00 00 00 00 01 00 00 00 06 00 00 00 01 00 00 02 0e 00 00 00 00' +exp=' 80 01 00 00 00 1b 00 00 00 00 01 00 00 00 06 00 00 00 01 00 00 02 0e 00 00 00 02' if [ "$RES" != "$exp" ]; then - echo "Error: Did not get expected result from TPM2_GetCapability(TPM_PT_LOCKOUT_COUNTER)" + echo "Error: Did not get expected result from 3rd TPM2_GetCapability(TPM_PT_LOCKOUT_COUNTER)" echo "expected: $exp" echo "received: $RES" exit 1 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/swtpm-0.10.1/tests/_test_tpm2_print_capabilities new/swtpm-0.10.2/tests/_test_tpm2_print_capabilities --- old/swtpm-0.10.1/tests/_test_tpm2_print_capabilities 2025-04-30 14:32:33.000000000 +0200 +++ new/swtpm-0.10.2/tests/_test_tpm2_print_capabilities 2026-08-19 02:32:30.000000000 +0200 @@ -30,7 +30,8 @@ '"flags-opt-disable-auto-shutdown", "ctrl-opt-terminate", '${seccomp}'"cmdarg-key-fd", '\ '"cmdarg-pwd-fd", "cmdarg-print-states", "cmdarg-chroot", "cmdarg-migration", '\ '"nvram-backend-dir", "nvram-backend-file"'\ -'(, "rsa-keysize-1024")?(, "rsa-keysize-2048")?(, "rsa-keysize-3072")?, "cmdarg-profile", '\ +'(, "rsa-keysize-1024")?(, "rsa-keysize-2048")?(, "rsa-keysize-3072")?'\ +'(, "rsa-keysize-4096")?, "cmdarg-profile", '\ '"cmdarg-print-profiles", "profile-opt-remove-disabled", "cmdarg-print-info", '\ '"tpmstate-opt-lock" \], '\ '"profiles": \{ "names": \[ [^]]*\], "algorithms": \{ [^\}]*\}, "commands": \{ [^\}]*\} }, '\ @@ -54,8 +55,8 @@ exp='\{ "type": "swtpm_setup", '\ '"features": \[( "tpm-1.2",)? "tpm-2.0", "cmdarg-keyfile-fd", "cmdarg-pwdfile-fd", '\ '"tpm12-not-need-root", "cmdarg-write-ek-cert-files", "cmdarg-create-config-files", '\ -'"cmdarg-reconfigure-pcr-banks"(, "tpm2-rsa-keysize-2048")?(, "tpm2-rsa-keysize-3072")?, '\ -'"cmdarg-profile", "cmdarg-profile-remove-disabled" \], '\ +'"cmdarg-reconfigure-pcr-banks"(, "tpm2-rsa-keysize-2048")?(, "tpm2-rsa-keysize-3072")?'\ +'(, "tpm2-rsa-keysize-4096")?, "cmdarg-profile", "cmdarg-profile-remove-disabled" \], '\ '"profiles": \[ [^]]*\], '\ '"version": "[^"]*" \}' if ! [[ ${msg} =~ ${exp} ]]; then diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/swtpm-0.10.1/tests/test_tpm2_libtpms_versions_profiles new/swtpm-0.10.2/tests/test_tpm2_libtpms_versions_profiles --- old/swtpm-0.10.1/tests/test_tpm2_libtpms_versions_profiles 2025-04-30 14:32:33.000000000 +0200 +++ new/swtpm-0.10.2/tests/test_tpm2_libtpms_versions_profiles 2026-08-19 02:32:30.000000000 +0200 @@ -41,7 +41,7 @@ LIBTPMS_INITIAL_BRANCH=master SWTPM_URL=https://github.com/stefanberger/swtpm -SWTPM_DEFAULT_BRANCH=master # during development change to local branch +SWTPM_DEFAULT_BRANCH=stable-0.10 # during development change to local branch cat <<_EOF_ > "${workdir}/swtpm-localca.options" --tpm-manufacturer IBM @@ -596,6 +596,12 @@ min=0 [ "${maj}" = 0 ] && min=9 # start with v0.9 + # only build a few versions of libtpms + case "${maj}.${min}" in + 0.9|0.10) ;; + *) continue;; + esac + for ((;; min++)) { git checkout "origin/stable-${maj}.${min}" &>/dev/null || break
