Debian Patches
Status for clevis/24-1
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| cherry-picked/1792137289.v24-1-gc3170a3.pkcs11-test-non-root-rejection-in-afunix-socket-unlock-591.patch | Pkcs11: test non-root rejection in afunix-socket-unlock (#591) The daemon enforces root-only access on its control and data sockets via SO_PEERCRED UID checks (security requirement for key material handling). Non-root connections are rejected but the daemon keeps running — this is the correct behavior. Previously the test assumed root and failed with EPIPE when run as a non-root user. Instead of skipping, verify the daemon rejects the connection, logs the caller's UID, and stays alive. Root users continue to run the full protocol test suite. Signed-off-by: Sergio Arroutbi <sarroutb@redhat.com> |
Sergio Arroutbi <sarroutb@redhat.com> | not-needed | upstream, commit v24-1-gc3170a3 <https://github.com/latchset/clevis/commit/v24-1-gc3170a3> | 2026-10-16 | |
| cherry-picked/1792158506.v24-2-ga0be577.fix-truncation-errors-happening-when-o2-enabled-592.patch | Fix truncation errors (happening when -O2 enabled) (#592) meson setup build defaults to --buildtype=debug which uses -O0. At this level, GCC doesn't perform deep enough data-flow analysis to detect that g_sock_file (1024 bytes) can exceed sock_addr.sun_path (108 bytes), so -Wstringop-truncation never fires. In other compilation scenarios, such as RPM build (centpkg), %meson uses --buildtype=plain with CFLAGS containing -O2. At this level, GCC tracks buffer sizes and sees the potential truncation Combined with -Werror from meson.build, it becomes a fatal error. Signed-off-by: Sergio Arroutbi <sarroutb@redhat.com> |
Sergio Arroutbi <sarroutb@redhat.com> | not-needed | upstream, commit v24-2-ga0be577 <https://github.com/latchset/clevis/commit/v24-2-ga0be577> | 2026-10-16 | |
| for-upstream/2018-10-30.use-asciidoctor-to-build-manpages.patch | Use asciidoctor to build the manpages | Christoph Biedl <debian.axhn@manchmal.in-ulm.de> | yes | upstream | 2018-10-30 | |
| for-upstream/2020-05-21.embed-more-programs-in-initram.patch | Embed more programs in the initramfs/initrd | Christoph Biedl <debian.axhn@manchmal.in-ulm.de> | yes | upstream | 2020-11-22 | |
| debian/2020-05-21.set-unprivileged-user.patch | Change to user for unprivileged operations | Christoph Biedl <debian.axhn@manchmal.in-ulm.de> | not-needed | 2020-05-21 | ||
| debian/2026-05-14-adjust-pkcs11-files-locations.patch | Adjust installation paths for pkcs11-related files. | Gerardo Esteban Malazdrewicz <gerardo@malazdrewicz.com.ar> | not-needed | debian | 2026-04-30 |