Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package pesign for openSUSE:Factory checked in at 2026-10-20 12:36:17 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/pesign (Old) and /work/SRC/openSUSE:Factory/.pesign.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "pesign" Tue Oct 20 12:36:17 2026 rev:53 rq:1386104 version:117 Changes: -------- --- /work/SRC/openSUSE:Factory/pesign/pesign.changes 2026-07-20 09:57:12.359821428 +0200 +++ /work/SRC/openSUSE:Factory/.pesign.new.3698736/pesign.changes 2026-10-20 12:36:37.587265184 +0200 @@ -1,0 +2,27 @@ +Sun Oct 18 10:54:41 UTC 2026 - Martin Pluskal <[email protected]> + +- Update to version 117: + * Add support for RSA3072, RSA4096, SHA384 and ML-DSA (PQC) + algorithms + * Add loongarch64 (la64) EFI support and branch protection for + aarch64 builds + * Fix signature removal, efikeygen segfaults, handling of tokens + without trust support, and daemon pid handling + * pesign-rpmbuild-helper: support inplace editing for the %pesign + macro + * Allow disabling the docs at build time (ENABLE_DOCS) + * Drop patches applied upstream: pesign-skip-auth-on-friendly-slot.patch, + pesign-bsc1202933-Remove-pesign-authorize.patch, + pesign-fix-cert-match-check.patch, pesign-fix-efikeygen-segfault.patch, + pesign-bsc1221694-fix-reversed-calloc-arguments.patch, + pesign-bsc1238023-initialize-pwdata.patch, + pesign-bsc1258751-constify-return-of-strrchr.patch and + pesign-disable-arm32-wchar_t-warnings.patch + * Rebase pesign-boo1185663-set-rpmmacrodir.patch onto the 117 + Makefiles + * Add pesign-fix-wincert-maybe-uninitialized.patch to silence + -Werror=maybe-uninitialized (LTO false positive in + get_current_sigspace_size) + * Switch Source and URL over to the rhboot/pesign upstream + +------------------------------------------------------------------- Old: ---- pesign-116.tar.bz2 pesign-bsc1202933-Remove-pesign-authorize.patch pesign-bsc1221694-fix-reversed-calloc-arguments.patch pesign-bsc1238023-initialize-pwdata.patch pesign-bsc1258751-constify-return-of-strrchr.patch pesign-disable-arm32-wchar_t-warnings.patch pesign-fix-cert-match-check.patch pesign-fix-efikeygen-segfault.patch pesign-skip-auth-on-friendly-slot.patch New: ---- pesign-117.tar.bz2 pesign-fix-wincert-maybe-uninitialized.patch ----------(Old B)---------- Old: * Drop patches applied upstream: pesign-skip-auth-on-friendly-slot.patch, pesign-bsc1202933-Remove-pesign-authorize.patch, pesign-fix-cert-match-check.patch, pesign-fix-efikeygen-segfault.patch, Old: pesign-fix-cert-match-check.patch, pesign-fix-efikeygen-segfault.patch, pesign-bsc1221694-fix-reversed-calloc-arguments.patch, pesign-bsc1238023-initialize-pwdata.patch, Old: pesign-bsc1221694-fix-reversed-calloc-arguments.patch, pesign-bsc1238023-initialize-pwdata.patch, pesign-bsc1258751-constify-return-of-strrchr.patch and Old: pesign-bsc1238023-initialize-pwdata.patch, pesign-bsc1258751-constify-return-of-strrchr.patch and pesign-disable-arm32-wchar_t-warnings.patch Old: pesign-bsc1258751-constify-return-of-strrchr.patch and pesign-disable-arm32-wchar_t-warnings.patch * Rebase pesign-boo1185663-set-rpmmacrodir.patch onto the 117 Old: pesign-bsc1202933-Remove-pesign-authorize.patch, pesign-fix-cert-match-check.patch, pesign-fix-efikeygen-segfault.patch, pesign-bsc1221694-fix-reversed-calloc-arguments.patch, Old: pesign-bsc1202933-Remove-pesign-authorize.patch, pesign-fix-cert-match-check.patch, pesign-fix-efikeygen-segfault.patch, pesign-bsc1221694-fix-reversed-calloc-arguments.patch, Old: * Allow disabling the docs at build time (ENABLE_DOCS) * Drop patches applied upstream: pesign-skip-auth-on-friendly-slot.patch, pesign-bsc1202933-Remove-pesign-authorize.patch, ----------(Old E)---------- ----------(New B)---------- New: Makefiles * Add pesign-fix-wincert-maybe-uninitialized.patch to silence -Werror=maybe-uninitialized (LTO false positive in ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ pesign.spec ++++++ --- /var/tmp/diff_new_pack.nYoycp/_old 2026-10-20 12:36:38.630308668 +0200 +++ /var/tmp/diff_new_pack.nYoycp/_new 2026-10-20 12:36:38.632308751 +0200 @@ -17,45 +17,40 @@ Name: pesign -Version: 116 +Version: 117 Release: 0 Summary: Signing tool for PE-COFF binaries License: GPL-3.0-or-later -Group: Productivity/Security -URL: https://github.com/rhinstaller/pesign -Source: https://github.com/rhinstaller/pesign/releases/download/%{version}/%{name}-%{version}.tar.bz2 +URL: https://github.com/rhboot/pesign +Source: https://github.com/rhboot/pesign/releases/download/%{version}/%{name}-%{version}.tar.bz2 Source1: pesign.sysusers # PATCH-FIX-SUSE pesign-suse-build.patch [email protected] -- Adjust Makefile for the build service Patch1: pesign-suse-build.patch -Patch2: pesign-skip-auth-on-friendly-slot.patch # PATCH-FIX-UPSTREAM pesign-fix-authvar-write-loop.patch [email protected] -- Fix the write loop in authvar -Patch3: pesign-fix-authvar-write-loop.patch +Patch2: pesign-fix-authvar-write-loop.patch # PATCH-FIX-SUSE pesign-boo1143063-remove-var-tracking.patch -- boo#1143063 Remove var-tracking from default CFLAGS -Patch4: pesign-boo1143063-remove-var-tracking.patch +Patch3: pesign-boo1143063-remove-var-tracking.patch # PATCH-FIX-UPSTREAM pesign-boo1185663-set-rpmmacrodir.patch boo#1185663 [email protected] -- Set the rpm macro directory at build time -Patch5: pesign-boo1185663-set-rpmmacrodir.patch -Patch6: harden_pesign.service.patch -Patch7: pesign-bsc1202933-Remove-pesign-authorize.patch -Patch8: pesign-bsc1202933-Make-etc-pki-pesign-writeable.patch -Patch9: pesign-fix-cert-match-check.patch -Patch10: pesign-fix-efikeygen-segfault.patch -Patch11: pesign-bsc1221694-fix-reversed-calloc-arguments.patch -# PATCH-FIX-UPSTREAM pesign-bsc1238023-initialize-pwdata.patch bsc#1238023 [email protected] -- Fall back to password prompt correctly -Patch12: pesign-bsc1238023-initialize-pwdata.patch -Patch13: pesign-bsc1258751-constify-return-of-strrchr.patch -Patch14: pesign-disable-arm32-wchar_t-warnings.patch -BuildRequires: efivar-devel >= 38 -BuildRequires: libuuid-devel +Patch4: pesign-boo1185663-set-rpmmacrodir.patch +Patch5: harden_pesign.service.patch +Patch6: pesign-bsc1202933-Make-etc-pki-pesign-writeable.patch +# PATCH-FIX-SUSE pesign-fix-wincert-maybe-uninitialized.patch -- initialize dd to silence -Werror=maybe-uninitialized (LTO false positive) +Patch7: pesign-fix-wincert-maybe-uninitialized.patch BuildRequires: mandoc -BuildRequires: mozilla-nss-devel -BuildRequires: pkg-config -BuildRequires: popt-devel +BuildRequires: pkgconfig BuildRequires: sysuser-tools +BuildRequires: pkgconfig(efiboot) >= 38 +BuildRequires: pkgconfig(efisec) >= 38 +BuildRequires: pkgconfig(efivar) >= 38 +BuildRequires: pkgconfig(nss) +BuildRequires: pkgconfig(nss-util) +BuildRequires: pkgconfig(popt) BuildRequires: pkgconfig(systemd) -%sysusers_requires -ExclusiveArch: ia64 %ix86 x86_64 aarch64 %arm riscv64 loongarch64 -Recommends: %{name}-systemd +BuildRequires: pkgconfig(uuid) Requires: mozilla-nss-tools +Recommends: %{name}-systemd +ExclusiveArch: ia64 %{ix86} x86_64 aarch64 %{arm} riscv64 loongarch64 +%sysusers_requires %description Signing tool for PE-COFF binaries. It is vaguely compliant @@ -64,11 +59,11 @@ %package systemd Summary: Systemd units for pesign Requires: %{name} = %{version} -%{?systemd_requires} -BuildArch: noarch Provides: pesign:%{_sbindir}/rcpesign Provides: pesign:%{_tmpfilesdir}/pesign.conf Provides: pesign:%{_unitdir}/pesign.service +BuildArch: noarch +%{?systemd_requires} %description systemd Systemd units for the pesign package. @@ -79,7 +74,7 @@ %build %sysusers_generate_pre %{SOURCE1} %{name} %{name}.conf export CPPFLAGS="%{optflags} -D_GLIBCXX_ASSERTIONS" -make %{?_smp_mflags} CFLAGS="%{optflags}" LDFLAGS="${LDFLAGS} -pie" libexecdir=%{_libexecdir} +%make_build CFLAGS="%{optflags}" LDFLAGS="${LDFLAGS} -pie" libexecdir=%{_libexecdir} %install mkdir -p %{buildroot}%{_sbindir} @@ -93,7 +88,7 @@ ln -sv %{_sbindir}/service %{buildroot}%{_sbindir}/rc%{name} # there's some stuff that's not really meant to be shipped yet -rm -rf %{buildroot}/boot %{buildroot}%{_prefix}/include +rm -rf %{buildroot}/boot %{buildroot}%{_includedir} rm -rf %{buildroot}%{_libdir}/libdpe* install -Dm0644 %{SOURCE1} %{buildroot}%{_sysusersdir}/%{name}.conf @@ -114,7 +109,6 @@ %service_del_postun pesign.service %files -%defattr(-,root,root) %license COPYING %{_bindir}/pesign %{_bindir}/pesign-client ++++++ harden_pesign.service.patch ++++++ --- /var/tmp/diff_new_pack.nYoycp/_old 2026-10-20 12:36:38.659309877 +0200 +++ /var/tmp/diff_new_pack.nYoycp/_new 2026-10-20 12:36:38.664310085 +0200 @@ -1,9 +1,9 @@ -Index: pesign-115/src/pesign.service.in +Index: pesign-117/src/pesign.service.in =================================================================== ---- pesign-115.orig/src/pesign.service.in -+++ pesign-115/src/pesign.service.in +--- pesign-117.orig/src/pesign.service.in ++++ pesign-117/src/pesign.service.in @@ -3,6 +3,19 @@ Description=Pesign signing daemon - + [Service] PrivateTmp=true +# added automatically, for details please see @@ -18,8 +18,8 @@ +ProtectKernelLogs=true +ProtectControlGroups=true +RestrictRealtime=true -+# end of automatic additions ++# end of automatic additions PIDFile=@@RUNDIR@@/pesign.pid ExecStart=/usr/bin/pesign --daemonize --nofork - ExecStartPost=@@LIBEXECDIR@@/pesign/pesign-authorize + ++++++ pesign-116.tar.bz2 -> pesign-117.tar.bz2 ++++++ ++++ 2027 lines of diff (skipped) ++++++ pesign-boo1185663-set-rpmmacrodir.patch ++++++ --- /var/tmp/diff_new_pack.nYoycp/_old 2026-10-20 12:36:38.839317382 +0200 +++ /var/tmp/diff_new_pack.nYoycp/_new 2026-10-20 12:36:38.842317507 +0200 @@ -1,7 +1,18 @@ -Index: pesign-115/Make.defaults -=================================================================== ---- pesign-115.orig/Make.defaults -+++ pesign-115/Make.defaults +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Gary Lin <[email protected]> +Date: Thu, 1 Jan 2026 00:00:00 +0000 +Subject: [PATCH] Set the rpm macro directory at build time + +References: boo#1185663 +Upstream never made the rpm macro directory configurable; carry the +downstream default so the spec can override it via rpmmacrodir=. + +Signed-off-by: Gary Lin <[email protected]> +--- +diff --git a/Make.defaults b/Make.defaults +index b91e1e3..086dbb4 100644 +--- a/Make.defaults ++++ b/Make.defaults @@ -13,6 +13,7 @@ rundir ?= /run/ rundir := $(abspath $(rundir))/ pcdir ?= $(libdir)pkgconfig/ @@ -10,19 +21,21 @@ DESTDIR ?= INSTALLROOT = $(DESTDIR) -Index: pesign-115/src/Makefile -=================================================================== ---- pesign-115.orig/src/Makefile -+++ pesign-115/src/Makefile -@@ -88,8 +88,8 @@ install : - $(INSTALL) -m 644 pesign.popt $(INSTALLROOT)/etc/popt.d/ +diff --git a/src/Makefile b/src/Makefile +index 79d3bc2..71f4ab5 100644 +--- a/src/Makefile ++++ b/src/Makefile +@@ -101,8 +101,8 @@ ifeq ($(ENABLE_DOCS), 1) $(INSTALL) -d -m 755 $(INSTALLROOT)$(mandir)man1/ $(INSTALL) -m 644 $(MAN1TARGETS) $(INSTALLROOT)$(mandir)man1/ + endif - $(INSTALL) -d -m 755 $(INSTALLROOT)/etc/rpm/ - $(INSTALL) -m 644 macros.pesign $(INSTALLROOT)/etc/rpm/ + $(INSTALL) -d -m 755 $(INSTALLROOT)$(rpmmacrodir) + $(INSTALL) -m 644 macros.pesign $(INSTALLROOT)$(rpmmacrodir) $(INSTALL) -d -m 755 $(INSTALLROOT)$(libexecdir)/pesign/ - $(INSTALL) -m 750 pesign-authorize $(INSTALLROOT)$(libexecdir)/pesign/ $(INSTALL) -m 755 pesign-rpmbuild-helper $(INSTALLROOT)$(libexecdir)/pesign/ + $(INSTALL) -d -m 700 $(INSTALLROOT)/etc/pesign +-- +2.51.0 ++++++ pesign-bsc1202933-Make-etc-pki-pesign-writeable.patch ++++++ --- /var/tmp/diff_new_pack.nYoycp/_old 2026-10-20 12:36:38.857318132 +0200 +++ /var/tmp/diff_new_pack.nYoycp/_new 2026-10-20 12:36:38.860318257 +0200 @@ -11,16 +11,16 @@ src/pesign.service.in | 1 + 1 file changed, 1 insertion(+) -Index: pesign-116/src/pesign.service.in -=================================================================== ---- pesign-116.orig/src/pesign.service.in -+++ pesign-116/src/pesign.service.in -@@ -18,6 +18,7 @@ RestrictRealtime=true - # end of automatic additions +--- a/src/pesign.service.in ++++ b/src/pesign.service.in +@@ -18,6 +18,7 @@ + # end of automatic additions PIDFile=@@RUNDIR@@/pesign.pid ExecStart=/usr/bin/pesign --daemonize --nofork +ReadWritePaths=/etc/pki/pesign/ [Install] WantedBy=multi-user.target +-- +2.51.0 ++++++ pesign-fix-wincert-maybe-uninitialized.patch ++++++ >From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Martin Pluskal <[email protected]> Date: Sun, 18 Oct 2026 12:00:00 +0000 Subject: [PATCH] wincert: initialize dd to silence -Werror=maybe-uninitialized pe_getdatadir() always initializes *dd on success and the failure path exits, so this is an LTO false positive seen with GCC 16. Initialize the pointer to make the failure mode explicit. Signed-off-by: Martin Pluskal <[email protected]> --- src/wincert.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/wincert.c b/src/wincert.c index ea8a025..69d90b6 100644 --- a/src/wincert.c +++ b/src/wincert.c @@ -201,7 +201,7 @@ done: static ssize_t get_current_sigspace_size(Pe *pe) { - data_directory *dd; + data_directory *dd = NULL; int rc = pe_getdatadir(pe, &dd); if (rc < 0) { -- 2.51.0
