mirror of
https://git.in.rschanz.org/ryan77627/guix.git
synced 2024-12-25 05:48:07 -05:00
b0e224566f
Signature verification breaks, when libcamera is grafted. Running built-in libcamera modules via proxy is not recommended by upstream and not always work. We control the build process of all libcamera modules, so to workaround the issue we disable signature verification. For more information see: <https://issues.guix.gnu.org/72828> * gnu/packages/patches/libcamera-ipa_manager-disable-signature-verification.patch: New file. * gnu/local.mk (dist_patch_DATA): Adjust accordingly. * gnu/packages/networking.scm (libcamera): Disable signature verification. [inputs]: Remove gnutls and openssl. [arguments]: Remove re-sign-binaries phase. [source]: Add disable-signature patch. Change-Id: Icf422553c0f49b28d7997a1e818a4b8d9a6b5732
55 lines
1.6 KiB
Diff
55 lines
1.6 KiB
Diff
From c99706475cde3d963a17f4f8871149711ce6c467 Mon Sep 17 00:00:00 2001
|
|
From: Andrew Tropin <andrew@trop.in>
|
|
Date: Wed, 4 Sep 2024 21:36:16 +0400
|
|
Subject: [PATCH] libcamera: ipa_manager: Disable signature verification
|
|
|
|
---
|
|
src/libcamera/ipa_manager.cpp | 28 +++++-----------------------
|
|
1 file changed, 5 insertions(+), 23 deletions(-)
|
|
|
|
diff --git a/src/libcamera/ipa_manager.cpp b/src/libcamera/ipa_manager.cpp
|
|
index cfc24d38..4fd3cf3e 100644
|
|
--- a/src/libcamera/ipa_manager.cpp
|
|
+++ b/src/libcamera/ipa_manager.cpp
|
|
@@ -284,33 +284,15 @@ IPAModule *IPAManager::module(PipelineHandler *pipe, uint32_t minVersion,
|
|
|
|
bool IPAManager::isSignatureValid([[maybe_unused]] IPAModule *ipa) const
|
|
{
|
|
-#if HAVE_IPA_PUBKEY
|
|
- char *force = utils::secure_getenv("LIBCAMERA_IPA_FORCE_ISOLATION");
|
|
- if (force && force[0] != '\0') {
|
|
- LOG(IPAManager, Debug)
|
|
- << "Isolation of IPA module " << ipa->path()
|
|
- << " forced through environment variable";
|
|
- return false;
|
|
- }
|
|
-
|
|
- File file{ ipa->path() };
|
|
- if (!file.open(File::OpenModeFlag::ReadOnly))
|
|
- return false;
|
|
-
|
|
- Span<uint8_t> data = file.map();
|
|
- if (data.empty())
|
|
- return false;
|
|
-
|
|
- bool valid = pubKey_.verify(data, ipa->signature());
|
|
+ LOG(IPAManager, Debug)
|
|
+ << "Signature verification is disabled by Guix. "
|
|
+ << "See https://issues.guix.gnu.org/72828 for more details.";
|
|
|
|
LOG(IPAManager, Debug)
|
|
<< "IPA module " << ipa->path() << " signature is "
|
|
- << (valid ? "valid" : "not valid");
|
|
+ << "not verified (verification skipped).";
|
|
|
|
- return valid;
|
|
-#else
|
|
- return false;
|
|
-#endif
|
|
+ return true;
|
|
}
|
|
|
|
} /* namespace libcamera */
|
|
--
|
|
2.45.2
|
|
|