deepin-community · deepin-community-bot · Apr 28, 2026
diff --git a/.appveyor.yml b/.appveyor.yml
@@ -2,7 +2,7 @@ version: '{build}'
 pull_requests:
   do_not_increment_build_number: true
 skip_tags: true
-image: Visual Studio 2017
+image: Visual Studio 2019
 configuration:
   - Debug
   - Release

diff --git a/.ci/docker.run b/.ci/docker.run
@@ -24,6 +24,11 @@ if [ -z "$WITH_CRYPTO" ]; then
     export WITH_CRYPTO="ossl"
 fi
 
+little_endian=$(echo -n I | od -to2 | awk 'FNR==1{ print substr($2,6,1)}')
+if [ $little_endian -eq 0 ]; then
+    export CONFIGURE_OPTIONS="$CONFIGURE_OPTIONS --with-integrationtcti=libtpms"
+fi
+
 if [ "$WITH_CRYPTO" != "ossl" ]; then
     export CONFIGURE_OPTIONS="$CONFIGURE_OPTIONS --disable-fapi --disable-policy"
 fi
@@ -69,7 +74,9 @@ if [[ "$CC" == "gcc" && "$ENABLE_COVERAGE" == "true" ]]; then
 fi
 
 if ldconfig -p 2>/dev/null| grep libasan > /dev/null && ldconfig -p 2>/dev/null| grep libubsan > /dev/null; then
-  SANITIZER_OPTION="--with-sanitizer=undefined,address"
+  if [ $little_endian -eq 1 ]; then
+    SANITIZER_OPTION="--with-sanitizer=undefined,address"
+  fi
 fi
 
 if [ "$SCANBUILD" == "yes" ]; then

diff --git a/.cirrus.yml b/.cirrus.yml
@@ -3,14 +3,17 @@ task:
     CFLAGS: "-I/usr/local/include -I/usr/local/openssl/include"
     LDFLAGS: -L/usr/local/lib
     ibmtpm_name: ibmtpm1637
+    libusb_version: v1.0.26
   freebsd_instance:
     matrix:
-      image_family: freebsd-13-1
+      image_family: freebsd-13-2
   install_script:
+    - IGNORE_OSVERSION=yes
     - pkg update -f
     - pkg upgrade -y
     - pkg install -y bash gmake coreutils libtool pkgconf autoconf autoconf-archive
     - pkg install -y automake openssl json-c cmocka uthash wget curl git util-linux
+    - pkg install -y libftdi1
     - wget --quiet --show-progress --progress=dot:giga "https://downloads.sourceforge.net/project/ibmswtpm2/$ibmtpm_name.tar.gz"
     - shasum -a256 $ibmtpm_name.tar.gz | grep ^dd3a4c3f7724243bc9ebcd5c39bbf87b82c696d1c1241cb8e5883534f6e2e327
     - mkdir -p $ibmtpm_name
@@ -21,7 +24,13 @@ task:
     - gmake -j && cp tpm_server /usr/bin/
     - cd -
     - rm -fr $ibmtpm_name $ibmtpm_name.tar.gz
+    - git clone --depth 1 -b $libusb_version https://github.com/libusb/libusb
+    - cd libusb && ./bootstrap.sh && ./configure && gmake -j install
+    - cd - && rm -fr libusb
   script:
+    #
+    # Due to a race condition that only occurs in the cirrus ci, "make distcheck" has been replaced by "make check".
+    #
     ./bootstrap &&
     ./configure --enable-self-generated-certificate --enable-unit=yes --enable-integration=yes --with-crypto=ossl --disable-doxygen-doc --enable-tcti-swtpm=no --enable-tcti-libtpms=no --enable-tcti-mssim=yes --disable-dependency-tracking &&
-    gmake -j distcheck || { cat /tmp/cirrus-ci-build/tpm2-tss-*/_build/sub/test-suite.log; exit 1; }
+    gmake -j check || { cat /tmp/cirrus-ci-build/tpm2-tss-*/_build/sub/test-suite.log; exit 1; }
diff --git a/.readthedocs.yml b/.readthedocs.yml
@@ -2,6 +2,10 @@
 # See https://docs.readthedocs.io/en/stable/config-file/v2.html for details
 
 version: 2
+build:
+  os: ubuntu-22.04
+  tools:
+    python: "3"
 sphinx:
   builder: html
   configuration: sphinx/conf.py
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -3,6 +3,88 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](http://keepachangelog.com/)
 
+## [4.1.3] - 2024-05-17
+### Fixed
+- Fix name collisions during dlopen() on some linkers
+
+## [4.1.2] - 2024-05-14
+### Fixed
+- configure.ac: Fix test of == to = to be POSIX comliant
+- Remove use of which in favor of command -v
+
+## [4.1.1] - 2024-05-07
+### Fixed
+- Fixed inclusion of .map and .def files in release tar balls
+
+## [4.1.0] - 2024-04-26
+### Security
+- Fixed CVE-2024-29040
+
+### Fixed
+- fapi: Fix length check on FAPI auth callbacks
+- mu: Correct error message for errors
+- tss2-rc: fix unknown laer handler dropping bits.
+- fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
+- fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
+- build: fix build fail after make clean.
+- mu: Fix unneeded size check in TPM2B unmarshaling.
+- fapi: Fix missing parameter encryption.
+- build: Fix failed build with --disable-vendor.
+- fapi: Fix flush of persistent handles.
+- fapi: Fix test provisioning with template with self generated certificate disabled.
+- fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
+- fapi: Revert  pcr extension  for EV_NO_ACTION events.
+- fapi: Fix strange error messages if nv, ext, or policy path does not exits.
+- fapi: Fix segfault caused by wrong allocation of pcr policy.
+- esys: Fix leak in Esys_EvictControl for persistent handles.
+- tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
+- esys: Add reference counting for Esys_TR_FromTPMPublic.
+- esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
+- fapi: fix usage of self signed certificates in TPM.
+- fapi: Usage of self signed certificates.
+- fapi: A segfault after the error handling of non existing keys.
+- fapi: Fix several leaks.
+- fapi: Fix error handling for policy execution.
+- fapi: Fix usage of persistent handles (should not be flushed)
+- fapi: Fix test provisioning with template (skip test without self generated certificate).
+- fapi: Fix pcr extension for EV_NO_ACTION
+- test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
+- tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
+- fapi:  Fix read large system eventlog (> UINT16_MAX).
+- esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
+- test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
+- fapi: Fix possible null pointer dereferencing in Fapi_List.
+- sys: Fix size check in Tss2_Sys_GetCapability.
+- esys: Fix leak in Esys_TR_FromTPMPublic.
+- esys: fix unchecked return value in esys crypto.
+- fapi: Fix wrong usage of local variable in provisioning.
+- fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
+- fapi: Fix possible out of bound array access in IMA parser.
+- tcti device: Fix possible unmarshalling from uninitialized variable.
+- fapi: Fix error checking authorization of signing key.
+- fapi: Fix cleanup of policy sessions.
+- fapi: Eventlog  H-CRTM events and different localities.
+- fapi: Fix missing synchronization of quote and eventlog.
+- faii: Fix invalid free in Fapi_Quote with empty eventlog.
+
+### Added
+- tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
+- mbedtls: add sha512 hmac.
+- fapi: Enable usage of external keys for Fapi_Encrypt.
+- fapi: Support download of AMD certificates.
+- tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
+- fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
+- rc: New TPM return codes added.
+- fapi: Further Nuvoton certificates added.
+- tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
+- tcti: Add '/dev/tcm0' to default conf
+- fapi: New Nuvoton certificates added.
+- esys: Fix leak in Esys_TR_FromTPMPublic.
+
+### Removed
+- Testing on Ubuntu 18.04 as it's near EOL (May 2023).
+
+
 ## [4.0.1] - 2023-01-23
 ### Fixed:
  - A buffer overflow in tss2-rc as CVE-2023-22745.
@@ -343,7 +425,7 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/)
 
 ### Removed
 - Removed libtss2-mu from "Requires" field of libtss2-esys.pc
-  Needs to be added explicitely now
+  Needs to be added explicitly now
 
 ### Fixed
 - All fixes from 2.2.1, 2.2.2 and 2.2.3

diff --git a/INSTALL.md b/INSTALL.md
@@ -7,7 +7,7 @@ following sections describe them for the supported platforms.
 
 ## GNU/Linux:
 * GNU Autoconf
-* GNU Autoconf Archive, version >= 2017.03.21
+* GNU Autoconf Archive, version >= 2019.01.06
 * GNU Automake
 * GNU Libtool
 * C compiler
@@ -18,6 +18,8 @@ following sections describe them for the supported platforms.
 * libcurl development libraries
 * Access Control List utility (acl)
 * JSON C Development library
+* Package libusb-1.0-0-dev
+
 
 The following are dependencies only required when building test suites.
 * Integration test suite (see ./configure option --enable-integration):
@@ -54,30 +56,41 @@ $ sudo apt -y install \
   libjson-c-dev \
   libini-config-dev \
   libcurl4-openssl-dev \
-  libuuid-dev \
-  libltdl-dev
+  uuid-dev \
+  libltdl-dev \
+  libusb-1.0-0-dev \
+  libftdi-dev
 ```
 Note: In some Ubuntu versions, the lcov and autoconf-archive packages are incompatible with each other. It is recommended to download autoconf-archive directly from upstream and copy `ax_code_coverage.m4` and `ax_prog_doxygen.m4` to the `m4/` subdirectory of your tpm2-tss directory.
 
 ### Fedora
 
+libtool automake autoconf and autoconf-archive should be installed:
+```
+$ sudo dnf install libtool automake autoconf autoconf-archive
+```
+
 There is a package already, so the package build dependencies information can be
 used to make sure that the needed packages to compile from source are installed:
 
 ```
 $ sudo dnf builddep tpm2-tss
 ```
+If you want to install a version from 4.0.0 and the default version of the release
+is lower than this version you have to install libuuid-devel additionally:
+
+```
+$ sudo dnf install libuuid-devel
+```
 
 ## Windows
-Windows dlls built using the Clang/LLVM "Platform Toolset" are currently
-prototypes. We have only tested using Visual Studio 2017 with the Universal
-C Runtime (UCRT) version 10.0.16299.0. Building the type marshaling library
-(tss2-mu.dll) and the system API (tss2-sapi.dll) should be as simple as
-loading the tpm2-tss solution (tpm2-tss.sln) with a compatible and properly
-configured version of Visual Studio 2017 and pressing the 'build' button.
+Windows dlls are built using the LLVM (clang-cl) toolset. We have only tested
+using Visual Studio 2019, but Visual Studio 2022 should also be supported.
+Building should be as simple as loading the tpm2-tss solution (tpm2-tss.sln) with
+a compatible and properly configured version of Visual Studio 2019+ and pressing the 'build' button.
 
 ### References
-Visual Studio 2017 with "Clang for Windows": https://blogs.msdn.microsoft.com/vcblog/2017/03/07/use-any-c-compiler-with-visual-studio/
+Visual Studio 2019+ with "Clang for Windows": https://learn.microsoft.com/en-us/cpp/build/clang-support-msbuild
 Universal CRT overview & setup instructions: https://docs.microsoft.com/en-us/cpp/porting/upgrade-your-code-to-the-universal-crt
 
 # Building From Source
@@ -165,6 +178,12 @@ $ sudo udevadm control --reload-rules && sudo udevadm trigger
 If this doesn't work on your distro please consult your distro's
 documentation for UDEVADM(8).
 
+Users who should have access to the TPM and the FAPI keystore should be
+included in the tss group.
+```
+ sudo usermod -aG tss <username>
+ ```
+
 ## ldconfig
 
 It may be necessary to run ldconfig (as root) to update the run-time
@@ -208,3 +227,40 @@ $ make doxygen-doc
 The generated documentation will appear here:
 * doxygen-doc/html HTML format (start with file doxygen-doc/html/index.html)
 * doxygen-doc/rtf/refman.rtf RTF format
+
+# Building for embedded
+
+The libraries SYS, ESYS, MU, RC, tctildr, tcti-spi-helper, tcti-i2c-helper
+can also be build for embedded devices. The following is an example to build
+for cortex-m4:
+```
+./bootstrap
+./configure \
+        --disable-fapi \
+        --disable-esys \
+        --disable-policy \
+        --disable-tcti-cmd \
+        --disable-tcti-device \
+        --disable-tcti-libtpms \
+        --disable-tcti-mssim \
+        --disable-tcti-pcap \
+        --disable-tcti-spi-lt2go \
+        --disable-tcti-spi-ftdi \
+        --disable-tcti-swtpm \
+        --disable-doxygen-doc \
+        --enable-nodl \
+        --host=arm-none-eabi \
+        --prefix=/home/afuchs/tpm2-software/INSTALL.uC \
+        CFLAGS='-mcpu=cortex-m4 -mfloat-abi=hard -mfpu=fpv4-sp-d16 -mthumb' \
+        LDFLAGS='--specs=nosys.specs'
+make
+```
+
+## Test operating systems in the CI
+
+* ubuntu-20.04
+* fedora-32
+* opensuse-leap
+* ubuntu-22.04
+* alpine-3.15
+* FreeBSD
diff --git a/MAINTAINERS b/MAINTAINERS
diff --git a/MAINTAINERS.md b/MAINTAINERS.md
@@ -0,0 +1,5 @@
+|email|PGP Fingerprint|
+| ------------- | ------------- |
+| Andreas Fuchs <andreas.fuchs@infineon.com>| [D533275B0123D0A679F51FF48F4F9A45D7FFEE74](https://keys.openpgp.org/vks/v1/by-fingerprint/D533275B0123D0A679F51FF48F4F9A45D7FFEE74)|
+| Bill Roberts <william.c.roberts@intel.com>| [5b482b8e3e19da7c978e1d016de2e9078e1f50c1](https://keys.openpgp.org/vks/v1/by-fingerprint/5B482B8E3E19DA7C978E1D016DE2E9078E1F50C1)|
+| Juergen Repp <juergen_repp@web.de>| [7A8F470DA9C8B2CACED1DBAAF1B152D9441A2563](https://keys.openpgp.org/vks/v1/by-fingerprint/7A8F470DA9C8B2CACED1DBAAF1B152D9441A2563)|
diff --git a/Makefile-fuzz.am b/Makefile-fuzz.am
@@ -30,8 +30,7 @@ test_fuzz_libfuzz_utils_la_LDFLAGS = $(TESTS_LDFLAGS)
 test_fuzz_libfuzz_utils_la_LIBADD = $(TESTS_LIBADD)
 test_fuzz_libfuzz_utils_la_CFLAGS = $(AM_CFLAGS) $(FUZZ_CFLAGS)
 test_fuzz_libfuzz_utils_la_SOURCES = \
-    test/integration/sys-context-util.c \
-    test/integration/sys-test-options.c
+    test/integration/test-common.c test/integration/test-common.h
 
 TESTS_LDADD += $(libtss2_utils_fuzzing)
 FUZZLDADD = $(TESTS_LDADD) $(TESTS_LDFLAGS) $(FUZZ_LDFLAGS)