Bugzilla – Bug 1217058
[Build 34.1] FIPS Mode: failed to import RPM keys suddenly
Last modified: 2023-11-28 05:47:00 UTC
## Observation openQA test in scenario sle-15-SP6-Online-x86_64-fips_env_ecryptfs@64bit fails in [ecryptfs](https://openqa.suse.de/tests/12774034/modules/ecryptfs/steps/12) libecryptfs1-111-2.31.x86_64: install failed impeding testing all encrypt ciphers of ecryptfs. Logs are attached in Logs and Assets tab in openQA: https://openqa.suse.de/tests/12774034#downloads
After installing FIPS packages, zypp no longer can import keys for some reason. 2023-11-07 05:34:54 <5> susetest(1864) [zypp-core] Exception.cc(log):186 KeyRing.cc(importKey):759 THROW: Failed to import key. 2023-11-07 05:34:54 <5> susetest(1864) [zypp-core] Exception.cc(log):186 RpmDb.cc(syncTrustedKeys):659 CAUGHT: Failed to import key. 2023-11-07 05:34:55 <5> susetest(1864) [zypp-core] Exception.cc(log):186 RpmDb.cc(doInstallPackage):1814 THROW: Subprocess failed. Error: RPM failed: Command exited with status 1.
*** Bug 1217059 has been marked as a duplicate of this bug. ***
*** Bug 1217060 has been marked as a duplicate of this bug. ***
*** Bug 1217061 has been marked as a duplicate of this bug. ***
*** Bug 1217062 has been marked as a duplicate of this bug. ***
*** Bug 1217063 has been marked as a duplicate of this bug. ***
Nov 07 05:34:40.197749 susetest zypper[1644]: Libgcrypt error: integrity check failed: Checksum error Nov 07 05:34:40.198102 susetest zypper[1644]: Libgcrypt notice: state transition Self-Test => Error
I think the generated HMAC of libgcrypt cannot be verified. Blocks any fips testing -> P1
Indeed, the HMAC is incorrect and doesn't match libgcrypt.so.20. It's interesting that libgcrypt utility hmac256 produces the same output as openssl. However even if I update the HMAC file with correct value it's still failing.
i think the RPM build strips the library and so breaks the checksum, as it does not block that strippng. you could block stripping, or you regenerate the checksum in the spec file AFTER stripping like previously.
Otto?
Sorry, we had public holiday on Friday. I found that libgcrypt is no longer using hmac file .libgcrypt.so.20.hmac that we are still shipping (so I think we should remove it). Since commit 3c89aad4a the hmac checksum is inserted directly as a section into library. Unfortunately my attempts to disable stripping were unsuccessful. I will continue tomorrow.
did you try: export NO_BRP_STRIP_DEBUG=true in %install ? alternatively we could regenerate the checksum and overwrite the one in ELF,
No, it didn't help But I found a way how to re-define macro __spec_install_post and re-calculate the HMAC checksum after RPM build strips the library. Now it works well. Also I removed .libgcrypt.so.20.hmac file as it's no longer needed. Please review it > https://build.suse.de/request/show/313300
proposed patch looks good to me.
Thank you Marcus Submitted: > SLE15-SP6 https://build.suse.de/request/show/313300 > ALP:Source:1.0 https://build.suse.de/request/show/313570 > openSUSE:Factory https://build.opensuse.org/request/show/1127966
fixed If I read openqa correctly.
Verified fixed: https://openqa.suse.de/tests/12894643