Re: [PR PATCH] [Updated] sbctl: update to 0.11, patch, add kernel hook

[dkwo <dkwo@users.noreply.github.com>]

[-- Attachment #1: Type: text/plain, Size: 524 bytes --]

There is an updated pull request by dkwo against master on the void-packages repository

https://github.com/dkwo/void-packages sbctl
https://github.com/void-linux/void-packages/pull/46165

sbctl: update to 0.11, patch, add kernel hook
- I tested the changes in this PR: yes
- I built this PR locally for my native architecture, (x86_64-glibc)

the patch fixes https://github.com/Foxboron/sbctl/issues/102
cc maintainer @ericonr 

A patch file from https://github.com/void-linux/void-packages/pull/46165.patch is attached

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: github-pr-sbctl-46165.patch --]
[-- Type: text/x-diff, Size: 6506 bytes --]

From 8dc6327910cab4ffb7d516cabb680e51951e391b Mon Sep 17 00:00:00 2001
From: dkwo <nicolopiazzalunga@gmail.com>
Date: Sun, 17 Sep 2023 09:43:11 -0400
Subject: [PATCH 1/2] sbctl: update to 0.11, patch, add kernel hooks

---
 srcpkgs/sbctl/files/kernel-hook-postinst | 17 +++++++++++++++++
 srcpkgs/sbctl/files/kernel-hook-postrm   | 17 +++++++++++++++++
 srcpkgs/sbctl/files/kernel-hook.confd    |  3 +++
 srcpkgs/sbctl/patches/keyusage.patch     | 17 +++++++++++++++++
 srcpkgs/sbctl/template                   |  9 ++++++---
 5 files changed, 60 insertions(+), 3 deletions(-)
 create mode 100644 srcpkgs/sbctl/files/kernel-hook-postinst
 create mode 100644 srcpkgs/sbctl/files/kernel-hook-postrm
 create mode 100644 srcpkgs/sbctl/files/kernel-hook.confd
 create mode 100644 srcpkgs/sbctl/patches/keyusage.patch

diff --git a/srcpkgs/sbctl/files/kernel-hook-postinst b/srcpkgs/sbctl/files/kernel-hook-postinst
new file mode 100644
index 0000000000000..c49ece0d0bedb
--- /dev/null
+++ b/srcpkgs/sbctl/files/kernel-hook-postinst
@@ -0,0 +1,17 @@
+#!/bin/sh
+#
+# Kernel post-install hook for sbctl.
+#
+# Arguments passed to this script: $1 pkgname, $2 version.
+#
+
+[ -x usr/bin/sbctl ] || exit 0
+
+PKGNAME="$1"
+VERSION="$2"
+
+. "${ROOTDIR}/etc/default/sbctl-kernel-hook"
+
+[ -z "${SBCTL_SIGN_KERNEL}" ] && exit 0
+[ -e "boot/vmlinuz-${VERSION}" ] && usr/bin/sbctl sign -s boot/vmlinuz-${VERSION}
+[ -e "boot/vmlinux-${VERSION}" ] && usr/bin/sbctl sign -s boot/vmlinux-${VERSION}
diff --git a/srcpkgs/sbctl/files/kernel-hook-postrm b/srcpkgs/sbctl/files/kernel-hook-postrm
new file mode 100644
index 0000000000000..2fe43327ef72f
--- /dev/null
+++ b/srcpkgs/sbctl/files/kernel-hook-postrm
@@ -0,0 +1,17 @@
+#!/bin/sh
+#
+# Kernel post-remove hook for sbctl.
+#
+# Arguments passed to this script: $1 pkgname, $2 version.
+#
+
+[ -x usr/bin/sbctl ] || exit 0
+
+PKGNAME="$1"
+VERSION="$2"
+
+. "${ROOTDIR}/etc/default/sbctl-kernel-hook"
+
+[ -z "${SBCTL_SIGN_KERNEL}" ] && exit 0
+[ -e "boot/vmlinuz-${VERSION}" ] && usr/bin/sbctl rm boot/vmlinuz-${VERSION}
+[ -e "boot/vmlinux-${VERSION}" ] && usr/bin/sbctl rm boot/vmlinux-${VERSION}
diff --git a/srcpkgs/sbctl/files/kernel-hook.confd b/srcpkgs/sbctl/files/kernel-hook.confd
new file mode 100644
index 0000000000000..59a52c91c7de2
--- /dev/null
+++ b/srcpkgs/sbctl/files/kernel-hook.confd
@@ -0,0 +1,3 @@
+# Options for the kernel hook script installed by the sbctl package.
+# SBCTL_SIGN_KERNEL=yes
+# To let sbctl sign new kernel images, set it to 'yes'
diff --git a/srcpkgs/sbctl/patches/keyusage.patch b/srcpkgs/sbctl/patches/keyusage.patch
new file mode 100644
index 0000000000000..cf2d33ef91205
--- /dev/null
+++ b/srcpkgs/sbctl/patches/keyusage.patch
@@ -0,0 +1,17 @@
+omit the keyUsage bitfield, so that the certificate is accepted by the
+firmware of certain thinkpad laptops
+
+fixes https://github.com/Foxboron/sbctl/issues/102
+
+diff --git a/keys.go b/keys.go
+index ffc7858..61c2db6 100644
+--- a/keys.go
++++ b/keys.go
+@@ -58,7 +58,6 @@
+ 		SignatureAlgorithm: x509.SHA256WithRSA,
+ 		NotBefore:          time.Now(),
+ 		NotAfter:           time.Now().AddDate(5, 0, 0),
+-		KeyUsage:           x509.KeyUsageDigitalSignature,
+ 		Subject: pkix.Name{
+ 			Country:    []string{name},
+ 			CommonName: name,
diff --git a/srcpkgs/sbctl/template b/srcpkgs/sbctl/template
index 5d181cd62da0d..ce09dbede1835 100644
--- a/srcpkgs/sbctl/template
+++ b/srcpkgs/sbctl/template
@@ -1,7 +1,7 @@
 # Template file for 'sbctl'
 pkgname=sbctl
-version=0.10
-revision=3
+version=0.11
+revision=1
 build_style=go
 go_import_path="github.com/foxboron/sbctl"
 hostmakedepends="asciidoc"
@@ -10,7 +10,7 @@ maintainer="Érico Nogueira <ericonr@disroot.org>"
 license="MIT"
 homepage="https://github.com/Foxboron/sbctl"
 distfiles="https://github.com/Foxboron/sbctl/archive/${version}.tar.gz"
-checksum=22c394e1ae3f80eafe85e331ca4499d2df28bebcc4421c0af89241b897a17774
+checksum=9709c912ac38cac6afbf024588ca1b341c1a9b5a29c4c575d2863fe2ad5aed75
 
 do_build() {
 	make
@@ -23,4 +23,7 @@ do_install() {
 
 post_install() {
 	vlicense LICENSE
+	vinstall ${FILESDIR}/kernel-hook-postinst 744 etc/kernel.d/post-install 40-sbctl
+	vinstall ${FILESDIR}/kernel-hook-postrm 744 etc/kernel.d/post-remove 40-sbctl
+	vinstall ${FILESDIR}/kernel-hook.confd 644 etc/default sbctl-kernel-hook
 }

From 86f9c0d61218763cf61b8329d70e61e339cf4213 Mon Sep 17 00:00:00 2001
From: dkwo <nicolopiazzalunga@gmail.com>
Date: Thu, 26 Oct 2023 18:06:12 -0400
Subject: [PATCH 2/2] sbctl: update to 0.12

---
 srcpkgs/sbctl/template | 27 +++++++++++++++++++++------
 1 file changed, 21 insertions(+), 6 deletions(-)

diff --git a/srcpkgs/sbctl/template b/srcpkgs/sbctl/template
index ce09dbede1835..1afb25512e35c 100644
--- a/srcpkgs/sbctl/template
+++ b/srcpkgs/sbctl/template
@@ -1,28 +1,43 @@
 # Template file for 'sbctl'
 pkgname=sbctl
-version=0.11
+version=0.12
 revision=1
 build_style=go
 go_import_path="github.com/foxboron/sbctl"
+go_package="${go_import_path}/cmd/sbctl"
 hostmakedepends="asciidoc"
 short_desc="Secure Boot key manager"
 maintainer="Érico Nogueira <ericonr@disroot.org>"
 license="MIT"
 homepage="https://github.com/Foxboron/sbctl"
 distfiles="https://github.com/Foxboron/sbctl/archive/${version}.tar.gz"
-checksum=9709c912ac38cac6afbf024588ca1b341c1a9b5a29c4c575d2863fe2ad5aed75
+checksum=38f97a4e47e9ff4e175f444833c6877a26b6d78308916e704edee0f06b3057eb
 
 do_build() {
-	make
+	# want -buildmode=pie -trimpath
+	go install -p "$XBPS_MAKEJOBS" -mod="${go_mod_mode}" -modcacherw -buildmode=pie -trimpath -v -tags "${go_build_tags}" -ldflags "${go_ldflags}" ${go_package}
 }
 
-do_install() {
-	make install PREFIX=/usr DESTDIR=$DESTDIR
-	# TODO: install completions, sbctl tries to run lsblk when generating them
+post_build() {
+	make man
+	# builds it again, to generate the completions
+	make completions
+}
+
+do_check() {
+	go test -v ./...
 }
 
 post_install() {
+	vcompletion contrib/completions/bash-completion/completions/sbctl bash
+	vcompletion contrib/completions/zsh/site-functions/_sbctl zsh
+	vcompletion contrib/completions/fish/vendor_completions.d/sbctl.fish fish
+
+	vinstall contrib/kernel-install/91-sbctl.install 755 usr/lib/kernel/install.d/91-sbctl.install
+
+	vman docs/sbctl.8
 	vlicense LICENSE
+
 	vinstall ${FILESDIR}/kernel-hook-postinst 744 etc/kernel.d/post-install 40-sbctl
 	vinstall ${FILESDIR}/kernel-hook-postrm 744 etc/kernel.d/post-remove 40-sbctl
 	vinstall ${FILESDIR}/kernel-hook.confd 644 etc/default sbctl-kernel-hook