Re: [PR PATCH] [Updated] sbctl: update to 0.11, patch, add kernel hook

[dkwo <dkwo@users.noreply.github.com>]

[-- Attachment #1: Type: text/plain, Size: 524 bytes --]

There is an updated pull request by dkwo against master on the void-packages repository

https://github.com/dkwo/void-packages sbctl
https://github.com/void-linux/void-packages/pull/46165

sbctl: update to 0.11, patch, add kernel hook
- I tested the changes in this PR: yes
- I built this PR locally for my native architecture, (x86_64-glibc)

the patch fixes https://github.com/Foxboron/sbctl/issues/102
cc maintainer @ericonr 

A patch file from https://github.com/void-linux/void-packages/pull/46165.patch is attached

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: github-pr-sbctl-46165.patch --]
[-- Type: text/x-diff, Size: 3461 bytes --]

From 3e35956e17693349659d4ae3646e97c2b92c55b6 Mon Sep 17 00:00:00 2001
From: dkwo <nicolopiazzalunga@gmail.com>
Date: Sun, 17 Sep 2023 09:43:11 -0400
Subject: [PATCH] sbctl: update to 0.11, patch, add kernel hook

---
 srcpkgs/sbctl/files/kernel-hook-postinst | 17 +++++++++++++++++
 srcpkgs/sbctl/files/kernel-hook.confd    |  3 +++
 srcpkgs/sbctl/patches/keyusage.patch     | 17 +++++++++++++++++
 srcpkgs/sbctl/template                   |  8 +++++---
 4 files changed, 42 insertions(+), 3 deletions(-)
 create mode 100644 srcpkgs/sbctl/files/kernel-hook-postinst
 create mode 100644 srcpkgs/sbctl/files/kernel-hook.confd
 create mode 100644 srcpkgs/sbctl/patches/keyusage.patch

diff --git a/srcpkgs/sbctl/files/kernel-hook-postinst b/srcpkgs/sbctl/files/kernel-hook-postinst
new file mode 100644
index 0000000000000..c49ece0d0bedb
--- /dev/null
+++ b/srcpkgs/sbctl/files/kernel-hook-postinst
@@ -0,0 +1,17 @@
+#!/bin/sh
+#
+# Kernel post-install hook for sbctl.
+#
+# Arguments passed to this script: $1 pkgname, $2 version.
+#
+
+[ -x usr/bin/sbctl ] || exit 0
+
+PKGNAME="$1"
+VERSION="$2"
+
+. "${ROOTDIR}/etc/default/sbctl-kernel-hook"
+
+[ -z "${SBCTL_SIGN_KERNEL}" ] && exit 0
+[ -e "boot/vmlinuz-${VERSION}" ] && usr/bin/sbctl sign -s boot/vmlinuz-${VERSION}
+[ -e "boot/vmlinux-${VERSION}" ] && usr/bin/sbctl sign -s boot/vmlinux-${VERSION}
diff --git a/srcpkgs/sbctl/files/kernel-hook.confd b/srcpkgs/sbctl/files/kernel-hook.confd
new file mode 100644
index 0000000000000..59a52c91c7de2
--- /dev/null
+++ b/srcpkgs/sbctl/files/kernel-hook.confd
@@ -0,0 +1,3 @@
+# Options for the kernel hook script installed by the sbctl package.
+# SBCTL_SIGN_KERNEL=yes
+# To let sbctl sign new kernel images, set it to 'yes'
diff --git a/srcpkgs/sbctl/patches/keyusage.patch b/srcpkgs/sbctl/patches/keyusage.patch
new file mode 100644
index 0000000000000..cf2d33ef91205
--- /dev/null
+++ b/srcpkgs/sbctl/patches/keyusage.patch
@@ -0,0 +1,17 @@
+omit the keyUsage bitfield, so that the certificate is accepted by the
+firmware of certain thinkpad laptops
+
+fixes https://github.com/Foxboron/sbctl/issues/102
+
+diff --git a/keys.go b/keys.go
+index ffc7858..61c2db6 100644
+--- a/keys.go
++++ b/keys.go
+@@ -58,7 +58,6 @@
+ 		SignatureAlgorithm: x509.SHA256WithRSA,
+ 		NotBefore:          time.Now(),
+ 		NotAfter:           time.Now().AddDate(5, 0, 0),
+-		KeyUsage:           x509.KeyUsageDigitalSignature,
+ 		Subject: pkix.Name{
+ 			Country:    []string{name},
+ 			CommonName: name,
diff --git a/srcpkgs/sbctl/template b/srcpkgs/sbctl/template
index 5d181cd62da0d..5fdc4210ffe3b 100644
--- a/srcpkgs/sbctl/template
+++ b/srcpkgs/sbctl/template
@@ -1,7 +1,7 @@
 # Template file for 'sbctl'
 pkgname=sbctl
-version=0.10
-revision=3
+version=0.11
+revision=1
 build_style=go
 go_import_path="github.com/foxboron/sbctl"
 hostmakedepends="asciidoc"
@@ -10,7 +10,7 @@ maintainer="Érico Nogueira <ericonr@disroot.org>"
 license="MIT"
 homepage="https://github.com/Foxboron/sbctl"
 distfiles="https://github.com/Foxboron/sbctl/archive/${version}.tar.gz"
-checksum=22c394e1ae3f80eafe85e331ca4499d2df28bebcc4421c0af89241b897a17774
+checksum=9709c912ac38cac6afbf024588ca1b341c1a9b5a29c4c575d2863fe2ad5aed75
 
 do_build() {
 	make
@@ -23,4 +23,6 @@ do_install() {
 
 post_install() {
 	vlicense LICENSE
+	vinstall ${FILESDIR}/kernel-hook-postinst 744 etc/kernel.d/post-install 40-sbctl
+	vinstall ${FILESDIR}/kernel-hook.confd 644 etc/default sbctl-kernel-hook
 }