@@ -744,6 +744,7 @@ RECIPE_MAINTAINER:pn-rpcbind = "Hongxu Jia <hongxu.jia@windriver.com>"
RECIPE_MAINTAINER:pn-rng-tools = "Anuj Mittal <anuj.mittal@intel.com>"
RECIPE_MAINTAINER:pn-rpcsvc-proto = "Khem Raj <raj.khem@gmail.com>"
RECIPE_MAINTAINER:pn-rpm = "Robert Yang <liezhi.yang@windriver.com>"
+RECIPE_MAINTAINER:pn-rpm-sequoia-crypto-policy = "Zoltán Böszörményi <zboszor@gmail.com>"
RECIPE_MAINTAINER:pn-rsync = "Yi Zhao <yi.zhao@windriver.com>"
RECIPE_MAINTAINER:pn-rt-tests = "Unassigned <unassigned@yoctoproject.org>"
RECIPE_MAINTAINER:pn-ruby = "Ross Burton <ross.burton@arm.com>"
new file mode 100644
@@ -0,0 +1,43 @@
+From f4adfb74c1f13cbddcbc20b6aa6aebe58956083e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Zolt=C3=A1n=20B=C3=B6sz=C3=B6rm=C3=A9nyi?=
+ <zboszor@gmail.com>
+Date: Thu, 6 Feb 2025 12:20:09 +0100
+Subject: [PATCH 1/4] Make xsltproc settable as XSLTPROC
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This allows not building the documentation with:
+
+ make ASCIIDOC=echo XSLTPROC=echo
+
+Signed-off-by: Zoltán Böszörményi <zboszor@gmail.com>
+Upstream-Status: Submitted [https://gitlab.com/redhat-crypto/fedora-crypto-policies/-/merge_requests/226]
+---
+ Makefile | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/Makefile b/Makefile
+index 9d2b5c7..36b3702 100644
+--- a/Makefile
++++ b/Makefile
+@@ -15,6 +15,7 @@ NUM_PROCS = $$(getconf _NPROCESSORS_ONLN)
+ PYVERSION = -3
+ DIFFTOOL?=meld
+ ASCIIDOC?=asciidoc
++XSLTPROC?=xsltproc
+ ifneq ("$(wildcard /usr/lib/python*/*/asciidoc/resources/docbook-xsl/manpage.xsl)","")
+ MANPAGEXSL?=$(wildcard /usr/lib/python*/*/asciidoc/resources/docbook-xsl/manpage.xsl)
+ else
+@@ -134,7 +135,7 @@ clean:
+
+ %: %.txt
+ $(ASCIIDOC) -v -d manpage -b docbook $<
+- xsltproc --nonet -o $@ ${MANPAGEXSL} $@.xml
++ $(XSLTPROC) --nonet -o $@ ${MANPAGEXSL} $@.xml
+
+ dist:
+ rm -rf crypto-policies && git clone . crypto-policies && rm -rf crypto-policies/.git/ && tar -czf crypto-policies-git$(VERSION).tar.gz crypto-policies && rm -rf crypto-policies
+--
+2.48.1
+
new file mode 100644
@@ -0,0 +1,41 @@
+From 47e70118dbd491a2aaf5669dc93e3f1471d19510 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Zolt=C3=A1n=20B=C3=B6sz=C3=B6rm=C3=A9nyi?=
+ <zboszor@gmail.com>
+Date: Thu, 6 Feb 2025 12:00:36 +0100
+Subject: [PATCH 2/4] Don't use hardcoded python3 path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This can help with cross-compiling.
+
+Signed-off-by: Zoltán Böszörményi <zboszor@gmail.com>
+Upstream-Status: Submitted [https://gitlab.com/redhat-crypto/fedora-crypto-policies/-/merge_requests/226]
+---
+ python/build-crypto-policies.py | 2 +-
+ python/update-crypto-policies.py | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/python/build-crypto-policies.py b/python/build-crypto-policies.py
+index a08ece2..a75b6f6 100755
+--- a/python/build-crypto-policies.py
++++ b/python/build-crypto-policies.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python3
++#!/usr/bin/env python3
+
+ # SPDX-License-Identifier: LGPL-2.1-or-later
+
+diff --git a/python/update-crypto-policies.py b/python/update-crypto-policies.py
+index 97487dc..935bc9e 100755
+--- a/python/update-crypto-policies.py
++++ b/python/update-crypto-policies.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python3
++#!/usr/bin/env python3
+
+ # SPDX-License-Identifier: LGPL-2.1-or-later
+
+--
+2.48.1
+
new file mode 100644
@@ -0,0 +1,68 @@
+From 446afdd9d27a6444a0da0f19a16b2923e9ad6c27 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Zolt=C3=A1n=20B=C3=B6sz=C3=B6rm=C3=A9nyi?=
+ <zboszor@gmail.com>
+Date: Mon, 10 Feb 2025 11:09:20 +0100
+Subject: [PATCH 3/4] Allow skipping policy validation when building them
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This helps building the crypto policies on hosts without nss.
+
+Signed-off-by: Zoltán Böszörményi <zboszor@gmail.com>
+Upstream-Status: Submitted [https://gitlab.com/redhat-crypto/fedora-crypto-policies/-/merge_requests/226]
+---
+ Makefile | 5 ++++-
+ python/build-crypto-policies.py | 8 +++++++-
+ 2 files changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index 36b3702..df9fc55 100644
+--- a/Makefile
++++ b/Makefile
+@@ -21,12 +21,15 @@ MANPAGEXSL?=$(wildcard /usr/lib/python*/*/asciidoc/resources/docbook-xsl/manpage
+ else
+ MANPAGEXSL?=/usr/share/asciidoc/docbook-xsl/manpage.xsl
+ endif
++ifeq ($(NOVALIDATE), 1)
++NOVALIDATEARG = --novalidate
++endif
+
+ all: build
+
+ build: $(MAN7PAGES) $(MAN8PAGES)
+ mkdir -p output
+- python/build-crypto-policies.py --reloadcmds policies output
++ python/build-crypto-policies.py $(NOVALIDATEARG) --reloadcmds policies output
+
+ install: $(MANPAGES)
+ mkdir -p $(DESTDIR)$(MANDIR)
+diff --git a/python/build-crypto-policies.py b/python/build-crypto-policies.py
+index a75b6f6..f70be27 100755
+--- a/python/build-crypto-policies.py
++++ b/python/build-crypto-policies.py
+@@ -33,6 +33,8 @@ def parse_args():
+ parser.add_argument('--test', action='store_true',
+ help='compare the generated config file '
+ 'with the existing one')
++ parser.add_argument('--novalidate', action='store_true',
++ help='do not validate the policy when building it')
+ parser.add_argument('--policy', type=str, metavar='POLICY',
+ help='generate the specified policy only')
+ parser.add_argument('--reloadcmds', action='store_true',
+@@ -104,7 +106,11 @@ def build_policy(cmdline, policy_name, subpolicy_names=None):
+ gen = cls()
+ config = gen.generate_config(ucp)
+
+- if policy_name in {'EMPTY', 'GOST-ONLY'} or gen.test_config(config):
++ if (
++ cmdline.novalidate
++ or policy_name in {'EMPTY', 'GOST-ONLY'}
++ or gen.test_config(config)
++ ):
+ try:
+ name = ':'.join([policy_name, *subpolicy_names])
+ if not save_config(cmdline, name, gen.CONFIG_NAME, config):
+--
+2.48.1
+
new file mode 100644
@@ -0,0 +1,41 @@
+From e294ff05430c8290d2c5e2b35f1e381a0223937e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Zolt=C3=A1n=20B=C3=B6sz=C3=B6rm=C3=A9nyi?=
+ <zboszor@gmail.com>
+Date: Mon, 10 Feb 2025 11:15:16 +0100
+Subject: [PATCH 4/4] Allow passing the crypto policy list with a make variable
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This allows building only the policies you are interested in.
+
+Signed-off-by: Zoltán Böszörményi <zboszor@gmail.com>
+Upstream-Status: Submitted [https://gitlab.com/redhat-crypto/fedora-crypto-policies/-/merge_requests/226]
+---
+ Makefile | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/Makefile b/Makefile
+index df9fc55..bfc6626 100644
+--- a/Makefile
++++ b/Makefile
+@@ -24,12 +24,15 @@ endif
+ ifeq ($(NOVALIDATE), 1)
+ NOVALIDATEARG = --novalidate
+ endif
++ifdef POLICY
++POLICYARG = --policy $(POLICY)
++endif
+
+ all: build
+
+ build: $(MAN7PAGES) $(MAN8PAGES)
+ mkdir -p output
+- python/build-crypto-policies.py $(NOVALIDATEARG) --reloadcmds policies output
++ python/build-crypto-policies.py $(NOVALIDATEARG) $(POLICYARG) --reloadcmds policies output
+
+ install: $(MANPAGES)
+ mkdir -p $(DESTDIR)$(MANDIR)
+--
+2.48.1
+
new file mode 100644
@@ -0,0 +1,36 @@
+SUMMARY = "Crypto policy for rpm-sequoia"
+HOMEPAGE = "https://gitlab.com/redhat-crypto/fedora-crypto-policies/"
+
+LICENSE = "LGPL-2.1-or-later"
+
+LIC_FILES_CHKSUM = "file://COPYING.LESSER;md5=a6f89e2100d9b6cdffcea4f398e37343"
+
+DEPENDS = "coreutils-native openssl-native make-native"
+
+inherit allarch python3native
+
+SRC_URI = " \
+ git://gitlab.com/redhat-crypto/fedora-crypto-policies.git;protocol=https;branch=master \
+ file://0001-Make-xsltproc-settable-as-XSLTPROC.patch \
+ file://0002-Don-t-use-hardcoded-python3-path.patch \
+ file://0003-Allow-skipping-policy-validation-when-building-them.patch \
+ file://0004-Allow-passing-the-crypto-policy-list-with-a-make-var.patch \
+"
+
+SRCREV = "445ecc87af202c8fc9249b453f41c3ac4553ffbd"
+UPSTREAM_CHECK_COMMITS = "1"
+
+S = "${UNPACKDIR}/git"
+
+do_compile () {
+ make ASCIIDOC=echo XSLTPROC=echo NOVALIDATE=1 POLICY=DEFAULT
+}
+
+do_install () {
+ install -d -m755 ${D}${datadir}/crypto-policies/back-ends
+ install -m644 ${S}/output/DEFAULT/rpm-sequoia.txt ${D}${datadir}/crypto-policies/back-ends/rpm-sequoia.config
+}
+
+FILES:${PN} = "${datadir}/crypto-policies/back-ends/*"
+
+BBCLASSEXTEND = "native"
This ships a crypto policy file for rpm-sequoia. Signed-off-by: Zoltán Böszörményi <zboszor@gmail.com> --- meta/conf/distro/include/maintainers.inc | 1 + ...1-Make-xsltproc-settable-as-XSLTPROC.patch | 43 ++++++++++++ ...002-Don-t-use-hardcoded-python3-path.patch | 41 +++++++++++ ...policy-validation-when-building-them.patch | 68 +++++++++++++++++++ ...e-crypto-policy-list-with-a-make-var.patch | 41 +++++++++++ .../rpm-sequoia-crypto-policy_git.bb | 36 ++++++++++ 6 files changed, 230 insertions(+) create mode 100644 meta/recipes-devtools/rpm-sequoia/rpm-sequoia-crypto-policy/0001-Make-xsltproc-settable-as-XSLTPROC.patch create mode 100644 meta/recipes-devtools/rpm-sequoia/rpm-sequoia-crypto-policy/0002-Don-t-use-hardcoded-python3-path.patch create mode 100644 meta/recipes-devtools/rpm-sequoia/rpm-sequoia-crypto-policy/0003-Allow-skipping-policy-validation-when-building-them.patch create mode 100644 meta/recipes-devtools/rpm-sequoia/rpm-sequoia-crypto-policy/0004-Allow-passing-the-crypto-policy-list-with-a-make-var.patch create mode 100644 meta/recipes-devtools/rpm-sequoia/rpm-sequoia-crypto-policy_git.bb