[tpm2] Some issues with tpm2-tss, tpm2-tools regarding packaging

[tpm2] Some issues with tpm2-tss, tpm2-tools regarding packaging

[Matthias Gerstner]

[-- Attachment #1: Type: text/plain, Size: 1577 bytes --]

Hello,

I want to share some issues I have experienced while updating the tpm2
packages in SUSE distributions:

- The distribution tarballs of tpm2-tss and tpm2-tools try to determine
  the package version via `git describe [...]` in configure.ac. This
  doesn't work, because there is no git repository any more. This caused
  e.g. the pkgconfig files like sapi.pc to contain an empty version
  number, which in turn caused tpm2-tools to fail to build, because the
  version check failed.

  Philip fixed the same issue in tpm2-abrmd a while ago via these
  commits:

  https://github.com/tpm2-software/tpm2-abrmd/commit/7f0d83903b842fc806e007d0c31c2f97cb2d7bd7
  https://github.com/tpm2-software/tpm2-abrmd/commit/5fe185714abe269a9ccd37ed5d33b61f923e6d65

- The current tpm2-tss-1.3.0 distribution tarball is missing files like
  README.md, CHANGELOG.md and LICENSE. But this has already been fixed
  via commit c0841fc6, so the next version should be fine.

- I wanted to verify the GPG signature of the tpm2-tools distribution
  tarball tpm2-tools-3.0.3.tar.gz, but cannot seem to find the matching
  public key 0x6DE2E9078E1F50C1 on the public key servers.

I can open GitHub issues for some of the issues if you deem it helpful.

Regards

Matthias

-- 
Matthias Gerstner <matthias.gerstner(a)suse.de>
Dipl.-Wirtsch.-Inf. (FH), Security Engineer
https://www.suse.com/security
Telefon: +49 911 740 53 290
GPG Key ID: 0x14C405C971923553

SUSE Linux GmbH
GF: Felix Imendörffer, Jane Smithard, Graham Norton
HRB 21284 (AG Nuernberg)

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: [tpm2] Some issues with tpm2-tss, tpm2-tools regarding packaging

[Javier Martinez Canillas]

[-- Attachment #1: Type: text/plain, Size: 3565 bytes --]

Hello Matthias,

On 02/22/2018 01:34 PM, Matthias Gerstner wrote:
> Hello,
> 
> I want to share some issues I have experienced while updating the tpm2
> packages in SUSE distributions:
> 
> - The distribution tarballs of tpm2-tss and tpm2-tools try to determine
>   the package version via `git describe [...]` in configure.ac. This
>   doesn't work, because there is no git repository any more. This caused
>   e.g. the pkgconfig files like sapi.pc to contain an empty version
>   number, which in turn caused tpm2-tools to fail to build, because the
>   version check failed.
> 

This shouldn't be an issue if the released tarball (as generated by make dist)
is used, only when using the source tarball. With the former, there's no need
to call bootstrap since a configure script with a PACKAGE_VERSION is shipped.

The projects provide both in the Github repository, i.e: for tpm2-tss:

https://github.com/tpm2-software/tpm2-tss/releases/download/1.3.0/tpm2-tss-1.3.0.tar.gz
https://github.com/tpm2-software/tpm2-tss/archive/1.3.0.tar.gz

If I'm looking at the right place, you are still using the latter in your pkg:

https://build.opensuse.org/package/view_file/SUSE:SLE-15:GA/tpm2-0-tss/tpm2-0-tss.spec?expand=1

Source0:        https://github.com/01org/TPM2.0-TSS/archive/%{version}.tar.gz

So this should be changed to:

Source0:       https://github.com/tpm2-software/tpm2-tss/releases/download/%{version}/tpm2-tss-%{version}.tar.gz

If you use the distributed tarball, then you don't need to call bootstrap in
your %build section and just use the distributed configure script.

I would also change the package name so you could just use %{name}-%{version}.tar.gz.
That's what I did on Fedora, if you want to compare the Spec files:

https://src.fedoraproject.org/rpms/tpm2-tss/blob/master/f/tpm2-tss.spec

Sorry if I'm not referring to the latest version of your package, I'm not that
familiar with build.opensuse.org web UI.

>   Philip fixed the same issue in tpm2-abrmd a while ago via these
>   commits:
> 
>   https://github.com/tpm2-software/tpm2-abrmd/commit/7f0d83903b842fc806e007d0c31c2f97cb2d7bd7
>   https://github.com/tpm2-software/tpm2-abrmd/commit/5fe185714abe269a9ccd37ed5d33b61f923e6d65
> 

Yes, that would at least allow to run autoreconf, but executing bootstrap will
still be a destructive operation so don't see a lot of advantage in that patch.

> - The current tpm2-tss-1.3.0 distribution tarball is missing files like
>   README.md, CHANGELOG.md and LICENSE. But this has already been fixed
>   via commit c0841fc6, so the next version should be fine.
>

Yeah.

> - I wanted to verify the GPG signature of the tpm2-tools distribution
>   tarball tpm2-tools-3.0.3.tar.gz, but cannot seem to find the matching
>   public key 0x6DE2E9078E1F50C1 on the public key servers.
>

Indeed. The same problem happens with tpm2-tss, so I guess neither Bill nor Philip
have pushed their public GPG keys to a key server:

$ gpg --verify tpm2-tss-1.3.0.tar.gz.asc tpm2-tss-1.3.0.tar.gz
gpg: Signature made Fri 08 Dec 2017 02:12:30 AM CET using RSA key ID C2E1D3BA
gpg: Can't check signature: public key not found

$ gpg --verify tpm2-tools-3.0.3.tar.gz.asc tpm2-tools-3.0.3.tar.gz                    
gpg: Signature made Mon 15 Jan 2018 11:08:10 PM CET using RSA key ID 8E1F50C1                                    
gpg: Can't check signature: public key not found

Best regards,
-- 
Javier Martinez Canillas
Software Engineer - Desktop Hardware Enablement
Red Hat

Re: [tpm2] Some issues with tpm2-tss, tpm2-tools regarding packaging

[Matthias Gerstner]

[-- Attachment #1: Type: text/plain, Size: 1327 bytes --]

Hello Javier,

thanks for your reply!

> > - The distribution tarballs of tpm2-tss and tpm2-tools try to determine
> >   the package version via `git describe [...]` in configure.ac. This
> >   doesn't work, because there is no git repository any more. This caused
> >   e.g. the pkgconfig files like sapi.pc to contain an empty version
> >   number, which in turn caused tpm2-tools to fail to build, because the
> >   version check failed.
> > 
> 
> This shouldn't be an issue if the released tarball (as generated by make dist)
> is used, only when using the source tarball. With the former, there's no need
> to call bootstrap since a configure script with a PACKAGE_VERSION is shipped.

this is true. I can't use the 1.3.0 release tarball at the moment,
because of the missing README, LICENSE and CHANGELOG files. It should
work with the next release tarball then.

> I would also change the package name so you could just use %{name}-%{version}.tar.gz.
> That's what I did on Fedora, if you want to compare the Spec files:

> https://src.fedoraproject.org/rpms/tpm2-tss/blob/master/f/tpm2-tss.spec

Thanks for the tip. I wanted to avoid the renaming business, because it
complicates upgrading and updating. So I live with the somewhat
inconsistent package names for now.

Regards

Matthias

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: [tpm2] Some issues with tpm2-tss, tpm2-tools regarding packaging

[Javier Martinez Canillas]

[-- Attachment #1: Type: text/plain, Size: 2082 bytes --]

On 02/22/2018 03:46 PM, Matthias Gerstner wrote:
> Hello Javier,
> 
> thanks for your reply!
>

You are welcome!

>>> - The distribution tarballs of tpm2-tss and tpm2-tools try to determine
>>>   the package version via `git describe [...]` in configure.ac. This
>>>   doesn't work, because there is no git repository any more. This caused
>>>   e.g. the pkgconfig files like sapi.pc to contain an empty version
>>>   number, which in turn caused tpm2-tools to fail to build, because the
>>>   version check failed.
>>>
>>
>> This shouldn't be an issue if the released tarball (as generated by make dist)
>> is used, only when using the source tarball. With the former, there's no need
>> to call bootstrap since a configure script with a PACKAGE_VERSION is shipped.
> 
> this is true. I can't use the 1.3.0 release tarball at the moment,
> because of the missing README, LICENSE and CHANGELOG files. It should
> work with the next release tarball then.
>

Yeah, keep in mind that the LICENSE is at least included though. I managed to
get commit 3ed530837a0a ("Makefile.am: Add LICENSE in tarball generated by the
make dist target") before the 1.3.0 release. Unfortunately I missed the other
files :(

But that was the most important file to me anyways, so I updated the package
even when the other files are still missing from the distributed tarball.
 
>> I would also change the package name so you could just use %{name}-%{version}.tar.gz.
>> That's what I did on Fedora, if you want to compare the Spec files:
> 
>> https://src.fedoraproject.org/rpms/tpm2-tss/blob/master/f/tpm2-tss.spec
> 
> Thanks for the tip. I wanted to avoid the renaming business, because it
> complicates upgrading and updating. So I live with the somewhat
> inconsistent package names for now.
>

Right, fortunately the Fedora packages where named tpm2-{tss,tools} from the
beginning, so was convenient for us then projects changed their names later.

Best regards,
-- 
Javier Martinez Canillas
Software Engineer - Desktop Hardware Enablement
Red Hat

Re: [tpm2] Some issues with tpm2-tss, tpm2-tools regarding packaging

[Philip Tricca]

[-- Attachment #1: Type: text/plain, Size: 1356 bytes --]

Hi Matthias,

On Thu, Feb 22, 2018 at 03:46:27PM +0100, Matthias Gerstner wrote:
> > > - The distribution tarballs of tpm2-tss and tpm2-tools try to determine
> > >   the package version via `git describe [...]` in configure.ac. This
> > >   doesn't work, because there is no git repository any more. This caused
> > >   e.g. the pkgconfig files like sapi.pc to contain an empty version
> > >   number, which in turn caused tpm2-tools to fail to build, because the
> > >   version check failed.
> > > 
> > 
> > This shouldn't be an issue if the released tarball (as generated by make dist)
> > is used, only when using the source tarball. With the former, there's no need
> > to call bootstrap since a configure script with a PACKAGE_VERSION is shipped.
> 
> this is true. I can't use the 1.3.0 release tarball at the moment,
> because of the missing README, LICENSE and CHANGELOG files. It should
> work with the next release tarball then.

We've been queuing up changes in the 1.x branch for another release and
these fixes are among them. Now that the new AC commands are in and tested
we're ready for another minor release. I've got time blocked off to get
the first RC out tomorrow. I'll be sure to get a message out to the list
to announce the new RC when it's up on github.

Thanks again for the valuable feedback,
Philip

Re: [tpm2] Some issues with tpm2-tss, tpm2-tools regarding packaging

[Scheie, Peter M]

[-- Attachment #1: Type: text/plain, Size: 2100 bytes --]

This may or may not be the correct thread to mention this, but following Philip's suggestion, this morning I switched to the rocko branch and now tpm2-tss builds correctly including setting the Version is sapi.pc.  However, when I then try to build tpm2-abrmd, oe_runmake fails, saying "No rule to make target 'install'."

Peter

-----Original Message-----
From: tpm2 [mailto:tpm2-bounces(a)lists.01.org] On Behalf Of Philip Tricca
Sent: Thursday, February 22, 2018 10:42 AM
To: Matthias Gerstner
Cc: tpm2(a)lists.01.org
Subject: Re: [tpm2] Some issues with tpm2-tss, tpm2-tools regarding packaging

Hi Matthias,

On Thu, Feb 22, 2018 at 03:46:27PM +0100, Matthias Gerstner wrote:
> > > - The distribution tarballs of tpm2-tss and tpm2-tools try to determine
> > >   the package version via `git describe [...]` in configure.ac. This
> > >   doesn't work, because there is no git repository any more. This caused
> > >   e.g. the pkgconfig files like sapi.pc to contain an empty version
> > >   number, which in turn caused tpm2-tools to fail to build, because the
> > >   version check failed.
> > > 
> > 
> > This shouldn't be an issue if the released tarball (as generated by 
> > make dist) is used, only when using the source tarball. With the 
> > former, there's no need to call bootstrap since a configure script with a PACKAGE_VERSION is shipped.
> 
> this is true. I can't use the 1.3.0 release tarball at the moment, 
> because of the missing README, LICENSE and CHANGELOG files. It should 
> work with the next release tarball then.

We've been queuing up changes in the 1.x branch for another release and these fixes are among them. Now that the new AC commands are in and tested we're ready for another minor release. I've got time blocked off to get the first RC out tomorrow. I'll be sure to get a message out to the list to announce the new RC when it's up on github.

Thanks again for the valuable feedback,
Philip
_______________________________________________
tpm2 mailing list
tpm2(a)lists.01.org
https://lists.01.org/mailman/listinfo/tpm2

Re: [tpm2] Some issues with tpm2-tss, tpm2-tools regarding packaging

[Scheie, Peter M]

[-- Attachment #1: Type: text/plain, Size: 2385 bytes --]

Oops, never mind.  User error.

Peter

-----Original Message-----
From: Scheie, Peter M 
Sent: Thursday, February 22, 2018 10:47 AM
To: 'Philip Tricca'; Matthias Gerstner
Cc: tpm2(a)lists.01.org
Subject: RE: [tpm2] Some issues with tpm2-tss, tpm2-tools regarding packaging

This may or may not be the correct thread to mention this, but following Philip's suggestion, this morning I switched to the rocko branch and now tpm2-tss builds correctly including setting the Version is sapi.pc.  However, when I then try to build tpm2-abrmd, oe_runmake fails, saying "No rule to make target 'install'."

Peter

-----Original Message-----
From: tpm2 [mailto:tpm2-bounces(a)lists.01.org] On Behalf Of Philip Tricca
Sent: Thursday, February 22, 2018 10:42 AM
To: Matthias Gerstner
Cc: tpm2(a)lists.01.org
Subject: Re: [tpm2] Some issues with tpm2-tss, tpm2-tools regarding packaging

Hi Matthias,

On Thu, Feb 22, 2018 at 03:46:27PM +0100, Matthias Gerstner wrote:
> > > - The distribution tarballs of tpm2-tss and tpm2-tools try to determine
> > >   the package version via `git describe [...]` in configure.ac. This
> > >   doesn't work, because there is no git repository any more. This caused
> > >   e.g. the pkgconfig files like sapi.pc to contain an empty version
> > >   number, which in turn caused tpm2-tools to fail to build, because the
> > >   version check failed.
> > > 
> > 
> > This shouldn't be an issue if the released tarball (as generated by 
> > make dist) is used, only when using the source tarball. With the 
> > former, there's no need to call bootstrap since a configure script with a PACKAGE_VERSION is shipped.
> 
> this is true. I can't use the 1.3.0 release tarball at the moment, 
> because of the missing README, LICENSE and CHANGELOG files. It should 
> work with the next release tarball then.

We've been queuing up changes in the 1.x branch for another release and these fixes are among them. Now that the new AC commands are in and tested we're ready for another minor release. I've got time blocked off to get the first RC out tomorrow. I'll be sure to get a message out to the list to announce the new RC when it's up on github.

Thanks again for the valuable feedback,
Philip
_______________________________________________
tpm2 mailing list
tpm2(a)lists.01.org
https://lists.01.org/mailman/listinfo/tpm2

Re: [tpm2] Some issues with tpm2-tss, tpm2-tools regarding packaging

[Philip Tricca]

[-- Attachment #1: Type: text/plain, Size: 1604 bytes --]

Javier,

On Thu, Feb 22, 2018 at 03:09:33PM +0100, Javier Martinez Canillas wrote:
> On 02/22/2018 01:34 PM, Matthias Gerstner wrote:

snip

> > - I wanted to verify the GPG signature of the tpm2-tools distribution
> >   tarball tpm2-tools-3.0.3.tar.gz, but cannot seem to find the matching
> >   public key 0x6DE2E9078E1F50C1 on the public key servers.
> >
> 
> Indeed. The same problem happens with tpm2-tss, so I guess neither Bill nor Philip
> have pushed their public GPG keys to a key server:
> 
> $ gpg --verify tpm2-tss-1.3.0.tar.gz.asc tpm2-tss-1.3.0.tar.gz
> gpg: Signature made Fri 08 Dec 2017 02:12:30 AM CET using RSA key ID C2E1D3BA
> gpg: Can't check signature: public key not found

I don't know how you've got gpg configured but my signing key is up on
the MIT PGP key server. Try:

gpg --keyserver hkp://pgp.mit.edu --search-keys 0xc2e1d3ba 

When I first started using PGP the MIT key server was the only one that
could cope with subkeys (0xc2e1d3ba is a subkey of 0x43dec7c3). That may
have changed since but I've never had cause to push my key to other
servers. What's the default key server for your distro? Do we need to
put our keys there too?

> $ gpg --verify tpm2-tools-3.0.3.tar.gz.asc tpm2-tools-3.0.3.tar.gz                    
> gpg: Signature made Mon 15 Jan 2018 11:08:10 PM CET using RSA key ID 8E1F50C1                                    
> gpg: Can't check signature: public key not found

I couldn't find Bills key either. I vaguely remember having a discussion
about this a while back but don't remember the resolution.

Philip

Re: [tpm2] Some issues with tpm2-tss, tpm2-tools regarding packaging

[Javier Martinez Canillas]

[-- Attachment #1: Type: text/plain, Size: 2900 bytes --]

Hi Philip,

On 02/22/2018 06:14 PM, Philip Tricca wrote:
> Javier,
> 
> On Thu, Feb 22, 2018 at 03:09:33PM +0100, Javier Martinez Canillas wrote:
>> On 02/22/2018 01:34 PM, Matthias Gerstner wrote:
> 
> snip
> 
>>> - I wanted to verify the GPG signature of the tpm2-tools distribution
>>>   tarball tpm2-tools-3.0.3.tar.gz, but cannot seem to find the matching
>>>   public key 0x6DE2E9078E1F50C1 on the public key servers.
>>>
>>
>> Indeed. The same problem happens with tpm2-tss, so I guess neither Bill nor Philip
>> have pushed their public GPG keys to a key server:
>>
>> $ gpg --verify tpm2-tss-1.3.0.tar.gz.asc tpm2-tss-1.3.0.tar.gz
>> gpg: Signature made Fri 08 Dec 2017 02:12:30 AM CET using RSA key ID C2E1D3BA
>> gpg: Can't check signature: public key not found
> 
> I don't know how you've got gpg configured but my signing key is up on
> the MIT PGP key server. Try:
> 
> gpg --keyserver hkp://pgp.mit.edu --search-keys 0xc2e1d3ba 
>

Right, my bad. Sorry for the noise:

$ gpg --recv C2E1D3BA
gpg: requesting key C2E1D3BA from hkp server keys.gnupg.net
gpg: key 43DEC7C3: public key "Philip Tricca <flihp(a)twobit.us>" imported
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u
gpg: Total number processed: 1
gpg:               imported: 1  (RSA: 1)

$ gpg --verify tpm2-tss-1.3.0.tar.gz.asc tpm2-tss-1.3.0.tar.gz
gpg: Signature made Fri 08 Dec 2017 02:12:30 AM CET using RSA key ID C2E1D3BA
gpg: Good signature from "Philip Tricca <flihp(a)twobit.us>"
gpg:                 aka "Philip Tricca <philip.b.tricca(a)intel.com>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 4200 7E87 6F24 8E04 A3F2  FE25 AE45 48D0 43DE C7C3
     Subkey fingerprint: 3BDA DE45 DDE4 4AFD 4120  2980 32F7 7E75 C2E1 D3BA

> When I first started using PGP the MIT key server was the only one that
> could cope with subkeys (0xc2e1d3ba is a subkey of 0x43dec7c3). That may
> have changed since but I've never had cause to push my key to other
> servers. What's the default key server for your distro? Do we need to
> put our keys there too?
> 
>> $ gpg --verify tpm2-tools-3.0.3.tar.gz.asc tpm2-tools-3.0.3.tar.gz                    
>> gpg: Signature made Mon 15 Jan 2018 11:08:10 PM CET using RSA key ID 8E1F50C1                                    
>> gpg: Can't check signature: public key not found
> 
> I couldn't find Bills key either. I vaguely remember having a discussion
> about this a while back but don't remember the resolution.
> 

Ok, great. Let's see if Bill can push it his public key to a server then.

> Philip
> 

Best regards,
-- 
Javier Martinez Canillas
Software Engineer - Desktop Hardware Enablement
Red Hat

Re: [tpm2] Some issues with tpm2-tss, tpm2-tools regarding packaging

[Roberts, William C]

[-- Attachment #1: Type: text/plain, Size: 2321 bytes --]



> -----Original Message-----
> From: tpm2 [mailto:tpm2-bounces(a)lists.01.org] On Behalf Of Matthias Gerstner
> Sent: Thursday, February 22, 2018 4:35 AM
> To: tpm2(a)lists.01.org
> Subject: [tpm2] Some issues with tpm2-tss, tpm2-tools regarding packaging
> 
> Hello,
> 
> I want to share some issues I have experienced while updating the tpm2
> packages in SUSE distributions:
> 
> - The distribution tarballs of tpm2-tss and tpm2-tools try to determine
>   the package version via `git describe [...]` in configure.ac. This
>   doesn't work, because there is no git repository any more. This caused
>   e.g. the pkgconfig files like sapi.pc to contain an empty version
>   number, which in turn caused tpm2-tools to fail to build, because the
>   version check failed.

As others have pointed out, and AFAIK. If you use the release tarballs
generated by make dist that have been posted, bootstrap is already done
and thus the pkg version is embedded. For the tss, the source file list
for the Makefile is even generated during bootstrap.

In the release tarballs, just your configure command should it get it done
and the version should be correct.

> 
>   Philip fixed the same issue in tpm2-abrmd a while ago via these
>   commits:
> 
>   https://github.com/tpm2-software/tpm2-
> abrmd/commit/7f0d83903b842fc806e007d0c31c2f97cb2d7bd7
>   https://github.com/tpm2-software/tpm2-
> abrmd/commit/5fe185714abe269a9ccd37ed5d33b61f923e6d65
> 
> - The current tpm2-tss-1.3.0 distribution tarball is missing files like
>   README.md, CHANGELOG.md and LICENSE. But this has already been fixed
>   via commit c0841fc6, so the next version should be fine.
> 
> - I wanted to verify the GPG signature of the tpm2-tools distribution
>   tarball tpm2-tools-3.0.3.tar.gz, but cannot seem to find the matching
>   public key 0x6DE2E9078E1F50C1 on the public key servers.
> 
> I can open GitHub issues for some of the issues if you deem it helpful.
> 
> Regards
> 
> Matthias
> 
> --
> Matthias Gerstner <matthias.gerstner(a)suse.de> Dipl.-Wirtsch.-Inf. (FH),
> Security Engineer https://www.suse.com/security
> Telefon: +49 911 740 53 290
> GPG Key ID: 0x14C405C971923553
> 
> SUSE Linux GmbH
> GF: Felix Imendörffer, Jane Smithard, Graham Norton HRB 21284 (AG Nuernberg)