Version in base suite: 0.9.4-3.2 Base version: sbsigntool_0.9.4-3.2 Target version: sbsigntool_0.9.4-3.2+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/s/sbsigntool/sbsigntool_0.9.4-3.2.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/s/sbsigntool/sbsigntool_0.9.4-3.2+deb13u1.dsc changelog | 7 +++ patches/sbverify-fix-intermediate-validation.patch | 46 +++++++++++++++++++++ patches/series | 1 3 files changed, 54 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpz4nzoh96/sbsigntool_0.9.4-3.2.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpz4nzoh96/sbsigntool_0.9.4-3.2+deb13u1.dsc: no acceptable signature found diff -Nru sbsigntool-0.9.4/debian/changelog sbsigntool-0.9.4/debian/changelog --- sbsigntool-0.9.4/debian/changelog 2024-09-13 06:55:39.000000000 +0000 +++ sbsigntool-0.9.4/debian/changelog 2026-07-14 20:29:10.000000000 +0000 @@ -1,3 +1,10 @@ +sbsigntool (0.9.4-3.2+deb13u1) trixie; urgency=medium + + * Backport the "certificate validation with intermediates" fix for + trixie. Closes: #1141851 + + -- Steve McIntyre <93sam@debian.org> Tue, 14 Jul 2026 22:29:10 +0200 + sbsigntool (0.9.4-3.2) unstable; urgency=medium * Non-maintainer upload. diff -Nru sbsigntool-0.9.4/debian/patches/sbverify-fix-intermediate-validation.patch sbsigntool-0.9.4/debian/patches/sbverify-fix-intermediate-validation.patch --- sbsigntool-0.9.4/debian/patches/sbverify-fix-intermediate-validation.patch 1970-01-01 00:00:00.000000000 +0000 +++ sbsigntool-0.9.4/debian/patches/sbverify-fix-intermediate-validation.patch 2026-07-14 20:29:10.000000000 +0000 @@ -0,0 +1,46 @@ +---->8>8>8<8<8<8---- +From: James Bottomley +Subject: [PATCH] sbverify: fix intermediate certificate verification + +Openssl verification of partial chains cannot be fixed by checking +error codes in the verify callback (because the errors for +intermediate verified OK and failed are identical). Instead they must +be fixed by setting the verification flag X509_V_FLAG_PARTIAL_CHAIN +which treats any intermediate cert found as a CA. + +Fixes: df27a41 ("sbverify: fix verification with intermediate certificates") +Signed-off-by: James Bottomley +--- + src/sbverify.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/src/sbverify.c b/src/sbverify.c +index 8f14f35..422b3e0 100644 +--- a/src/sbverify.c ++++ b/src/sbverify.c +@@ -212,6 +212,7 @@ static int x509_verify_cb(int status, X509_STORE_CTX *ctx) + + else if (err == X509_V_ERR_CERT_UNTRUSTED || + err == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT || ++ err == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY || + err == X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE) { + /* all certs given with the --cert argument are trusted */ + +@@ -220,7 +221,6 @@ static int x509_verify_cb(int status, X509_STORE_CTX *ctx) + } else if (err == X509_V_ERR_CERT_HAS_EXPIRED || + err == X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD || + err == X509_V_ERR_CERT_NOT_YET_VALID || +- err == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY || + err == X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD) + /* UEFI explicitly allows expired certificates */ + status = 1; +@@ -246,6 +246,7 @@ int main(int argc, char **argv) + + status = VERIFY_FAIL; + certs = X509_STORE_new(); ++ X509_STORE_set_flags(certs, X509_V_FLAG_PARTIAL_CHAIN); + list = 0; + verbose = 0; + detached_sig_filename = NULL; +-- +2.51.0 diff -Nru sbsigntool-0.9.4/debian/patches/series sbsigntool-0.9.4/debian/patches/series --- sbsigntool-0.9.4/debian/patches/series 2024-09-13 06:55:31.000000000 +0000 +++ sbsigntool-0.9.4/debian/patches/series 2026-07-14 20:29:10.000000000 +0000 @@ -3,3 +3,4 @@ 0001-sbsigntool-add-support-for-RISC-V-images.patch OpenSSL3.patch add-support-for-LoongArch-images.patch +sbverify-fix-intermediate-validation.patch