From b7fa5e3e06e1e22b2f54af679cba0ea9f4082c53 Mon Sep 17 00:00:00 2001
From: Jeremy Cline <jeremycline@linux.microsoft.com>
Date: Apr 18 2025 16:44:40 +0000
Subject: pesign: ensure password files end in a newline


It's necessary (although not documented) for the password file passed to
pesign to end in a `\r` or `\n` character. The password parsing code[0]
reads into a 200 char buffer and then walks from the end of the buffer
looking for an end-of-line character, writing null bytes until it is
found.

Without the newline, the entire buffer is zeroed out and a negative
return code is given to the caller. The calling function returns a NULL
pointer if this occurs. The caller of _that_ function does not check if
the returned pointer is null, but when the password is used it obviously
doesn't match and so pesign fails with an error about the password not
matching.

[0] https://github.com/rhboot/pesign/blob/d734b6a00c95eaf205d713ea580a9df8f9b6c1ec/src/password.c#L101

---

diff --git a/src/server.py b/src/server.py
index 2207e59..df4f2ff 100644
--- a/src/server.py
+++ b/src/server.py
@@ -1988,7 +1988,7 @@ class TempNSSDb(object):
         return open(pw_r, mode='r', closefd=True)
 
     def prepare_pwfile(self):
-        return self.prepare_secretfile(self._db_pass.encode('utf-8'))
+        return self.prepare_secretfile(self._db_pass.encode('utf-8') + b'\n')
 
     def execute_certutil(self, args):
         pw_r = self.prepare_pwfile()
@@ -2018,7 +2018,7 @@ class TempNSSDb(object):
 
     def add_pkcs12(self, pkcs12_bytes, passphrase):
         pw_r = self.prepare_pwfile()
-        pk12_pass_r = self.prepare_secretfile(passphrase.encode('utf-8'))
+        pk12_pass_r = self.prepare_secretfile(passphrase.encode('utf-8') + b'\n')
 
         # pk12util will not read the actual PKCS12 contents from a pipe, so
         # instead just write those to a temporary (nameless) file.