Only in /var/lib/copr-rpmbuild/results/python-cvmutils/upstream-unpacked/Source0/cvmutils-0.3.2: .distro diff -U2 -r /var/lib/copr-rpmbuild/results/python-cvmutils/upstream-unpacked/Source0/cvmutils-0.3.2/README.md /var/lib/copr-rpmbuild/results/python-cvmutils/srpm-unpacked/cvmutils-0.3.2.tar.gz-extract/cvmutils-0.3.2/README.md --- /var/lib/copr-rpmbuild/results/python-cvmutils/upstream-unpacked/Source0/cvmutils-0.3.2/README.md 2026-05-29 15:19:04.000000000 +0000 +++ /var/lib/copr-rpmbuild/results/python-cvmutils/srpm-unpacked/cvmutils-0.3.2.tar.gz-extract/cvmutils-0.3.2/README.md 2026-08-19 08:52:40.000000000 +0000 @@ -171,4 +171,29 @@ | `-r`, `--recovery-key FILE` | Add a recovery key passphrase to the root volume | | `--recovery-key-type {binary,text,both}` | Recovery key format (default: `binary`) | +| `--volume-digest-key FILE` | PEM private key to sign the `x-cvmutils` structure (adds `x-cvmutils-sig` to LUKS tokens) | + +### LUKS Token Annotations + +After sealing with `systemd-cryptenroll`, the deploy phase annotates each newly created LUKS2 token with the following custom fields: + +| Field | Type | Description | +|-------|------|-------------| +| `x-cvmutils` | object | Structure containing `timestamp` (Unix integer), `version` (string), and `volume-digest` (HMAC-SHA256 of `cryptsetup:root:` keyed with the LUKS master key, hex-encoded) | +| `x-cvmutils-sig` | string | RSA/EC signature over the canonical JSON serialisation of `x-cvmutils` (keys sorted, no spaces), signed with the key from `--volume-digest-key`, base64-encoded (only present when `--volume-digest-key` is specified) | + +The volume digest and its signature can be used to verify the integrity and origin of the LUKS volume. To verify the signature on a running system: + +```bash +TOKEN_ID=0 # adjust to the relevant token ID +python3 -c " +import sys, json, base64, subprocess +t = json.load(subprocess.Popen(['cryptsetup', 'token', 'export', '--token-id', '$TOKEN_ID', '/dev/sda3'], stdout=subprocess.PIPE).stdout) +data = json.dumps(t['x-cvmutils'], sort_keys=True, separators=(',', ':')).encode() +sig = base64.b64decode(t['x-cvmutils-sig']) +open('/tmp/cvmutils.sig', 'wb').write(sig) +open('/tmp/cvmutils.dat', 'wb').write(data) +" +openssl dgst -sha256 -verify public.pem -signature /tmp/cvmutils.sig /tmp/cvmutils.dat +``` ### Makeverity Options (Experimental) diff -U2 -r /var/lib/copr-rpmbuild/results/python-cvmutils/upstream-unpacked/Source0/cvmutils-0.3.2/cvmutils/cvmencryptimage.py /var/lib/copr-rpmbuild/results/python-cvmutils/srpm-unpacked/cvmutils-0.3.2.tar.gz-extract/cvmutils-0.3.2/cvmutils/cvmencryptimage.py --- /var/lib/copr-rpmbuild/results/python-cvmutils/upstream-unpacked/Source0/cvmutils-0.3.2/cvmutils/cvmencryptimage.py 2026-05-29 15:19:04.000000000 +0000 +++ /var/lib/copr-rpmbuild/results/python-cvmutils/srpm-unpacked/cvmutils-0.3.2.tar.gz-extract/cvmutils-0.3.2/cvmutils/cvmencryptimage.py 2026-08-19 08:52:40.000000000 +0000 @@ -19,8 +19,9 @@ from cvmutils.efi import bootchains_from_shim_fallback from cvmutils.log import Log +from cvmutils.luks import LUKS from cvmutils.partitions import Partitions from cvmutils.pcr import PCR from cvmutils.sb import SecureBoot -from cvmutils.tools import run_command +from cvmutils.tools import run_command, get_version LUKSADD_PARAMS = ["-q", "--pbkdf", "pbkdf2", "--pbkdf-force-iterations", "1000"] @@ -360,4 +361,7 @@ log.info("Sealing root volume key with systemd-cryptenroll") + luks = LUKS(pt.get_path('root'), lukspw) + token_ids_before = luks.get_token_ids() + for pcrs in pcrs_list_unique: run_command(["systemd-cryptenroll", pt.get_path('root'), "--tpm2-device-key=" + args.srkpub, @@ -365,4 +369,14 @@ "--unlock-key-file=" + tempdir + '/lukspw']) + token_ids_after = luks.get_token_ids() + new_token_ids = token_ids_after - token_ids_before + if new_token_ids: + cvmutils_data = { + "timestamp": int(time.time()), + "version": get_version(), + "volume-digest": luks.get_volume_digest(), + } + luks.annotate_tokens(new_token_ids, cvmutils_data, args.volume_digest_key) + # Remove cleartext password run_command(["cryptsetup", "luksRemoveKey", "--key-file", "-", pt.get_path('root')], input=lukspw) @@ -448,4 +462,5 @@ parser.add_argument('-r', '--recovery-key', help='Recovery key file (deploy only, adds an additional passphrase to root volume)') parser.add_argument('--recovery-key-type', choices=['binary', 'text', 'both'], default='binary', help='Recovery key type') + parser.add_argument('--volume-digest-key', help='PEM private key to sign the x-cvmutils structure (deploy only, adds x-cvmutils-sig to LUKS tokens)') parser.add_argument('--noswtpm', help='DEPRECATED', action="store_true") parser.add_argument('--pcr4',help='Expected PCR4 sha256 value for root volume key sealing (deploy only, sha256 or "auto")') Only in /var/lib/copr-rpmbuild/results/python-cvmutils/srpm-unpacked/cvmutils-0.3.2.tar.gz-extract/cvmutils-0.3.2/cvmutils: luks.py diff -U2 -r /var/lib/copr-rpmbuild/results/python-cvmutils/upstream-unpacked/Source0/cvmutils-0.3.2/cvmutils/tools.py /var/lib/copr-rpmbuild/results/python-cvmutils/srpm-unpacked/cvmutils-0.3.2.tar.gz-extract/cvmutils-0.3.2/cvmutils/tools.py --- /var/lib/copr-rpmbuild/results/python-cvmutils/upstream-unpacked/Source0/cvmutils-0.3.2/cvmutils/tools.py 2026-05-29 15:19:04.000000000 +0000 +++ /var/lib/copr-rpmbuild/results/python-cvmutils/srpm-unpacked/cvmutils-0.3.2.tar.gz-extract/cvmutils-0.3.2/cvmutils/tools.py 2026-08-19 08:52:40.000000000 +0000 @@ -6,6 +6,16 @@ import subprocess import sys +from importlib.metadata import version as pkg_version, PackageNotFoundError from cvmutils.log import Log +CVMUTILS_VERSION = "0.3.2" + +def get_version(): + """ Get cvmutils version """ + try: + return pkg_version("cvmutils") + except PackageNotFoundError: + return CVMUTILS_VERSION + # pylint: disable=redefined-builtin, too-many-arguments, too-many-positional-arguments def run_command(cmdargs, sysexit=False, canfail=False, input=None, text=True, output=None): diff -U2 -r /var/lib/copr-rpmbuild/results/python-cvmutils/upstream-unpacked/Source0/cvmutils-0.3.2/man/cvm-encrypt-image.1 /var/lib/copr-rpmbuild/results/python-cvmutils/srpm-unpacked/cvmutils-0.3.2.tar.gz-extract/cvmutils-0.3.2/man/cvm-encrypt-image.1 --- /var/lib/copr-rpmbuild/results/python-cvmutils/upstream-unpacked/Source0/cvmutils-0.3.2/man/cvm-encrypt-image.1 2026-05-29 15:19:04.000000000 +0000 +++ /var/lib/copr-rpmbuild/results/python-cvmutils/srpm-unpacked/cvmutils-0.3.2.tar.gz-extract/cvmutils-0.3.2/man/cvm-encrypt-image.1 2026-08-19 08:52:40.000000000 +0000 @@ -1,4 +1,4 @@ .\" DO NOT MODIFY THIS FILE! It was generated by help2man 1.49.3. -.TH CVM-ENCRYPT-IMAGE "1" "May 2026" "cvm-encrypt-image 0.3.2" "User Commands" +.TH CVM-ENCRYPT-IMAGE "1" "June 2026" "cvm-encrypt-image 0.3.2" "User Commands" .SH NAME cvm-encrypt-image \- manual page for cvm-encrypt-image 0.3.2 @@ -12,4 +12,5 @@ [\-r RECOVERY_KEY] [\-\-recovery\-key\-type {binary,text,both}] +[\-\-volume\-digest\-key VOLUME_DIGEST_KEY] [\-\-noswtpm] [\-\-pcr4 PCR4] [\-\-pcr7 PCR7] [\-\-nosecureboot] @@ -76,4 +77,8 @@ Recovery key type .TP +\fB\-\-volume\-digest\-key\fR VOLUME_DIGEST_KEY +PEM private key to sign the x\-cvmutils structure +(deploy only, adds x\-cvmutils\-sig to LUKS tokens) +.TP \fB\-\-noswtpm\fR DEPRECATED diff -U2 -r /var/lib/copr-rpmbuild/results/python-cvmutils/upstream-unpacked/Source0/cvmutils-0.3.2/man/cvm-reseal.1 /var/lib/copr-rpmbuild/results/python-cvmutils/srpm-unpacked/cvmutils-0.3.2.tar.gz-extract/cvmutils-0.3.2/man/cvm-reseal.1 --- /var/lib/copr-rpmbuild/results/python-cvmutils/upstream-unpacked/Source0/cvmutils-0.3.2/man/cvm-reseal.1 2026-05-29 15:19:04.000000000 +0000 +++ /var/lib/copr-rpmbuild/results/python-cvmutils/srpm-unpacked/cvmutils-0.3.2.tar.gz-extract/cvmutils-0.3.2/man/cvm-reseal.1 2026-08-19 08:52:40.000000000 +0000 @@ -1,4 +1,4 @@ .\" DO NOT MODIFY THIS FILE! It was generated by help2man 1.49.3. -.TH CVM-RESEAL "1" "May 2026" "cvm-reseal 0.3.2" "User Commands" +.TH CVM-RESEAL "1" "June 2026" "cvm-reseal 0.3.2" "User Commands" .SH NAME cvm-reseal \- manual page for cvm-reseal 0.3.2 Only in /var/lib/copr-rpmbuild/results/python-cvmutils/upstream-unpacked/Source0/cvmutils-0.3.2/tests: test-data Only in /var/lib/copr-rpmbuild/results/python-cvmutils/upstream-unpacked/Source0/cvmutils-0.3.2/tests: test_pcr_predictor.py Only in /var/lib/copr-rpmbuild/results/python-cvmutils/upstream-unpacked/Source0/cvmutils-0.3.2/tests: test_reseal.py