cherry-pick.v15-1-gef76951.pins-tpm2-add-support-for-tpm2-tools-5-x.patch 5.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110
  1. Subject: Pins/tpm2: add support for tpm2-tools 5.X
  2. Origin: v15-1-gef76951 <https://github.com/latchset/clevis/commit/v15-1-gef76951>
  3. Upstream-Author: Jonas Witschel <diabonas@gmx.de>
  4. Date: Wed Nov 11 12:43:18 2020 +0100
  5. tpm2-tools 5.0 consolidates all tools into a single busybox-style binary, so
  6. the preferred way to invoke the commands would be e.g. "tpm2 createprimary"
  7. instead of "tpm2_createprimary". However, compatibility symlinks tpm2_* -> tpm2
  8. are installed by default, so we keep the old syntax for tpm2-tools 5.0 to avoid
  9. creating another special case, since the option syntax has not changed (it
  10. should be stable since version 4).
  11. tpm2-tools 3.X is deprecated, but unfortunately still packaged by a few Linux
  12. distributions, so keep supporting it for now at least.
  13. --- a/src/pins/tpm2/clevis-decrypt-tpm2
  14. +++ b/src/pins/tpm2/clevis-decrypt-tpm2
  15. @@ -49,8 +49,8 @@
  16. match='version="(.)\.'
  17. [[ $TPM2TOOLS_INFO =~ $match ]] && TPM2TOOLS_VERSION="${BASH_REMATCH[1]}"
  18. -if [[ $TPM2TOOLS_VERSION != 3 ]] && [[ $TPM2TOOLS_VERSION != 4 ]]; then
  19. - echo "The tpm2 pin requires tpm2-tools version 3 or 4" >&2
  20. +if [[ $TPM2TOOLS_VERSION -lt 3 ]] || [[ $TPM2TOOLS_VERSION -gt 5 ]]; then
  21. + echo "The tpm2 pin requires a tpm2-tools version between 3 and 5" >&2
  22. exit 1
  23. fi
  24. @@ -135,7 +135,7 @@
  25. case "$TPM2TOOLS_VERSION" in
  26. 3) tpm2_createprimary -Q -H "$auth" -g "$hash" -G "$key" -C "$TMP"/primary.context || fail=$?;;
  27. - 4) tpm2_createprimary -Q -C "$auth" -g "$hash" -G "$key" -c "$TMP"/primary.context || fail=$?;;
  28. + 4|5) tpm2_createprimary -Q -C "$auth" -g "$hash" -G "$key" -c "$TMP"/primary.context || fail=$?;;
  29. *) fail=1;;
  30. esac
  31. if [ -n "$fail" ]; then
  32. @@ -146,8 +146,8 @@
  33. case "$TPM2TOOLS_VERSION" in
  34. 3) tpm2_load -Q -c "$TMP"/primary.context -u "$TMP"/jwk.pub -r "$TMP"/jwk.priv \
  35. -C "$TMP"/load.context || fail=$?;;
  36. - 4) tpm2_load -Q -C "$TMP"/primary.context -u "$TMP"/jwk.pub -r "$TMP"/jwk.priv \
  37. - -c "$TMP"/load.context || fail=$?;;
  38. + 4|5) tpm2_load -Q -C "$TMP"/primary.context -u "$TMP"/jwk.pub -r "$TMP"/jwk.priv \
  39. + -c "$TMP"/load.context || fail=$?;;
  40. *) fail=1;;
  41. esac
  42. if [ -n "$fail" ]; then
  43. @@ -157,7 +157,7 @@
  44. case "$TPM2TOOLS_VERSION" in
  45. 3) jwk="$(tpm2_unseal -c "$TMP"/load.context ${pcr_spec:+-L $pcr_spec})" || fail=$?;;
  46. - 4) jwk="$(tpm2_unseal -c "$TMP"/load.context ${pcr_spec:+-p pcr:$pcr_spec})" || fail=$?;;
  47. + 4|5) jwk="$(tpm2_unseal -c "$TMP"/load.context ${pcr_spec:+-p pcr:$pcr_spec})" || fail=$?;;
  48. *) fail=1;;
  49. esac
  50. if [ -n "$fail" ]; then
  51. --- a/src/pins/tpm2/clevis-encrypt-tpm2
  52. +++ b/src/pins/tpm2/clevis-encrypt-tpm2
  53. @@ -71,8 +71,8 @@
  54. match='version="(.)\.'
  55. [[ $TPM2TOOLS_INFO =~ $match ]] && TPM2TOOLS_VERSION="${BASH_REMATCH[1]}"
  56. -if [[ $TPM2TOOLS_VERSION != 3 ]] && [[ $TPM2TOOLS_VERSION != 4 ]]; then
  57. - echo "The tpm2 pin requires tpm2-tools version 3 or 4" >&2
  58. +if [[ $TPM2TOOLS_VERSION -lt 3 ]] || [[ $TPM2TOOLS_VERSION -gt 5 ]]; then
  59. + echo "The tpm2 pin requires a tpm2-tools version between 3 and 5" >&2
  60. exit 1
  61. fi
  62. @@ -153,7 +153,7 @@
  63. case "$TPM2TOOLS_VERSION" in
  64. 3) tpm2_createprimary -Q -H "$auth" -g "$hash" -G "$key" -C "$TMP"/primary.context || fail=$?;;
  65. - 4) tpm2_createprimary -Q -C "$auth" -g "$hash" -G "$key" -c "$TMP"/primary.context || fail=$?;;
  66. + 4|5) tpm2_createprimary -Q -C "$auth" -g "$hash" -G "$key" -c "$TMP"/primary.context || fail=$?;;
  67. *) fail=1;;
  68. esac
  69. if [ -n "$fail" ]; then
  70. @@ -166,7 +166,7 @@
  71. if [ -z "$pcr_digest" ]; then
  72. case "$TPM2TOOLS_VERSION" in
  73. 3) tpm2_pcrlist -Q -L "$pcr_bank":"$pcr_ids" -o "$TMP"/pcr.digest || fail=$?;;
  74. - 4) tpm2_pcrread -Q "$pcr_bank":"$pcr_ids" -o "$TMP"/pcr.digest || fail=$?;;
  75. + 4|5) tpm2_pcrread -Q "$pcr_bank":"$pcr_ids" -o "$TMP"/pcr.digest || fail=$?;;
  76. *) fail=1;;
  77. esac
  78. if [ -n "$fail" ]; then
  79. @@ -183,8 +183,8 @@
  80. case "$TPM2TOOLS_VERSION" in
  81. 3) tpm2_createpolicy -Q -g "$hash" -P -L "$pcr_bank":"$pcr_ids" \
  82. -F "$TMP"/pcr.digest -f "$TMP"/pcr.policy || fail=$?;;
  83. - 4) tpm2_createpolicy -Q -g "$hash" --policy-pcr -l "$pcr_bank":"$pcr_ids" \
  84. - -f "$TMP"/pcr.digest -L "$TMP"/pcr.policy || fail=$?;;
  85. + 4|5) tpm2_createpolicy -Q -g "$hash" --policy-pcr -l "$pcr_bank":"$pcr_ids" \
  86. + -f "$TMP"/pcr.digest -L "$TMP"/pcr.policy || fail=$?;;
  87. *) fail=1;;
  88. esac
  89. if [ -n "$fail" ]; then
  90. @@ -200,8 +200,8 @@
  91. case "$TPM2TOOLS_VERSION" in
  92. 3) tpm2_create -Q -g "$hash" -G "$alg_create_key" -c "$TMP"/primary.context -u "$TMP"/jwk.pub \
  93. -r "$TMP"/jwk.priv -A "$obj_attr" "${policy_options[@]}" -I- <<< "$jwk" || fail=$?;;
  94. - 4) tpm2_create -Q -g "$hash" -C "$TMP"/primary.context -u "$TMP"/jwk.pub \
  95. - -r "$TMP"/jwk.priv -a "$obj_attr" "${policy_options[@]}" -i- <<< "$jwk" || fail=$?;;
  96. + 4|5) tpm2_create -Q -g "$hash" -C "$TMP"/primary.context -u "$TMP"/jwk.pub \
  97. + -r "$TMP"/jwk.priv -a "$obj_attr" "${policy_options[@]}" -i- <<< "$jwk" || fail=$?;;
  98. *) fail=1;;
  99. esac
  100. if [ -n "$fail" ]; then