Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-69518

rpmsign --delsign / --addsign regression can corrupt packages

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Major Major
    • rhel-10.0
    • rhel-10.0.beta
    • rpm
    • rpm-4.19.1.1-11.el10
    • Yes
    • Moderate
    • rhel-sst-cs-software-management
    • ssg_core_services
    • 22
    • 24
    • 0
    • False
    • Hide

      None

      Show
      None
    • None
    • Red Hat Enterprise Linux
    • None
    • Hide

      Deleting a RH-issued signature from a package doesn't corrupt the package. This is the expected behavior with the patch applied:

      $ rpmkeys -Kv ./bash-5.2.26-4.el10.x86_64.rpm
./bash-5.2.26-4.el10.x86_64.rpm:
    Header V4 RSA/SHA256 Signature, key ID fd431d51: NOKEY
    Header SHA256 digest: OK
    Header SHA1 digest: OK
    Payload SHA256 digest: OK
    V4 RSA/SHA256 Signature, key ID fd431d51: NOKEY
    MD5 digest: OK
$ rpmsign --delsign ./bash-5.2.26-4.el10.x86_64.rpm
./bash-5.2.26-4.el10.x86_64.rpm:
$ rpmkeys -Kv ./bash-5.2.26-4.el10.x86_64.rpm
./bash-5.2.26-4.el10.x86_64.rpm:
    Header SHA256 digest: OK
    Header SHA1 digest: OK
    Payload SHA256 digest: OK
    MD5 digest: OK
      Show
      Deleting a RH-issued signature from a package doesn't corrupt the package. This is the expected behavior with the patch applied: $ rpmkeys -Kv ./bash-5.2.26-4.el10.x86_64.rpm ./bash-5.2.26-4.el10.x86_64.rpm: Header V4 RSA/SHA256 Signature, key ID fd431d51: NOKEY Header SHA256 digest: OK Header SHA1 digest: OK Payload SHA256 digest: OK V4 RSA/SHA256 Signature, key ID fd431d51: NOKEY MD5 digest: OK $ rpmsign --delsign ./bash-5.2.26-4.el10.x86_64.rpm ./bash-5.2.26-4.el10.x86_64.rpm: $ rpmkeys -Kv ./bash-5.2.26-4.el10.x86_64.rpm ./bash-5.2.26-4.el10.x86_64.rpm: Header SHA256 digest: OK Header SHA1 digest: OK Payload SHA256 digest: OK MD5 digest: OK
    • Pass
    • Automated
    • All
    • None

      A regression found by RH QE emrakova@redhat.com while testing something related:

      [pmatilai🎩︎lumikko ~]$ rpmkeys -Kv /tmp/bash-5.2.26-4.el10.x86_64.rpm
      /tmp/bash-5.2.26-4.el10.x86_64.rpm:
      Header OpenPGP V4 RSA/SHA256 signature, key ID 199e2f91fd431d51: NOKEY
      Header SHA256 digest: OK
      Payload SHA256 digest: OK
      Legacy OpenPGP V4 RSA/SHA256 signature, key ID 199e2f91fd431d51: NOKEY
      [pmatilai🎩︎lumikko ~]$ rpmsign --delsign /tmp/bash-5.2.26-4.el10.x86_64.rpm
      [pmatilai🎩︎lumikko ~]$ rpmkeys -Kv /tmp/bash-5.2.26-4.el10.x86_64.rpm
      /tmp/bash-5.2.26-4.el10.x86_64.rpm:
      error: /tmp/bash-5.2.26-4.el10.x86_64.rpm: hdr magic: BAD
      [pmatilai🎩︎lumikko ~]$

      There are other scenarios where this could happen but easiest reproducer is basically any RHEL >= 9 package that has been signed by the RH signing-server. The signing-server misplaces the IMA signatures and this trips up buggy calculations in rpmsign --addsign/resign/delsign.

              mdomonko@redhat.com Michal Domonkos
              rhn-support-pmatilai Panu Matilainen
              packaging-team-maint packaging-team-maint
              Eva Mrakova Eva Mrakova
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

                Created:
                Updated: