Re: [rfc] [patch] PR28204: debuginfod ima signature verification

[Mark Wielaard <mark@klomp.org>]

Hi Frank,

On Wed, 2024-04-03 at 17:04 -0400, Frank Ch. Eigler wrote:
> The following raw diff reworks this long-blocked patch to overcome
> these three objections last fall:
> 
> - to drop "permissive" mode

We discussed a bit on irc about "wording". But I think it isn't really
how it is worded, but that there is just different features. What is
called "enforcing" is an authenticity scheme. While "permissive" is
more like an (optional) error-detecting mode. IMHO it makes sense to
simply separate those. That way you don't have a authentication scheme
that is easily defeated (when put in "permissive" mode). And you can
implement a simpler error-detection mode that can work in more cases
(by using the executable .gnu_debuglink CRC)

> - to stop redistributing published distro ima certificates
> - to not use libimaevm.so (due to concurrency / licensing concerns)

Nice, you managed to open code it with just openssl primitives.

> This is a raw diff only.  I'll be proposing some changes shortly
> downthread.

Understood. Just a few quick comments below.

One "big picture" question is whether this should be a per server URL
policy or something that is enabled/disabled for all server URLs?
That makes it less "flexible" but should simplify things a bit for the
user (and the server urls parsing).

Also is this all rpm/koji specific? Or do other distros also use ima
signatures, but encode/store them differently?

> diff --git a/config/Makefile.am b/config/Makefile.am
> index ae14e625b726..5a28e66d4408 100644
> --- a/config/Makefile.am
> +++ b/config/Makefile.am
> @@ -46,12 +46,16 @@ pkgconfig_DATA += libdebuginfod.pc
>  	if [ -n "@DEBUGINFOD_URLS@" ]; then \
>  		echo "@DEBUGINFOD_URLS@" > $(DESTDIR)$(sysconfdir)/debuginfod/elfutils.urls; \
>  	fi
> +	if [ -n "@DEBUGINFOD_IMA_CERT_PATH@" ]; then \
> +		echo "@DEBUGINFOD_IMA_CERT_PATH@" > $(DESTDIR)$(sysconfdir)/debuginfod/elfutils.certpath; \
> +	fi
>  
>  uninstall-local:
>  	rm -f $(DESTDIR)$(sysconfdir)/profile.d/debuginfod.sh
>  	rm -f $(DESTDIR)$(sysconfdir)/profile.d/debuginfod.csh
>  	rm -f $(DESTDIR)$(datadir)/fish/vendor_conf.d/debuginfod.fish
>  	rm -f $(DESTDIR)$(sysconfdir)/debuginfod/elfutils.urls
> +	rm -f $(DESTDIR)$(sysconfdir)/debuginfod/elfutils.certpath
>  	-rmdir $(DESTDIR)$(sysconfdir)/debuginfod
>  endif
>  
> diff --git a/config/elfutils.spec.in b/config/elfutils.spec.in
> index 4d802a25ad5f..460729972420 100644
> --- a/config/elfutils.spec.in
> +++ b/config/elfutils.spec.in
> @@ -43,6 +43,12 @@ BuildRequires: curl
>  # For run-debuginfod-response-headers.sh test case
>  BuildRequires: socat
>  
> +# For debuginfod rpm IMA verification
> +BuildRequires: rpm-devel
> +BuildRequires: ima-evm-utils-devel
> +BuildRequires: openssl-devel
> +BuildRequires: rpm-sign

So ima-evm-utils-devel isn't needed here anymore?

>  %define _gnu %{nil}
>  %define _programprefix eu-
>  
> diff --git a/config/profile.csh.in b/config/profile.csh.in
> index d962d969c05b..1da9626c711b 100644
> --- a/config/profile.csh.in
> +++ b/config/profile.csh.in
> @@ -4,13 +4,19 @@
>  # See also [man debuginfod-client-config] for other environment variables
>  # such as $DEBUGINFOD_MAXSIZE, $DEBUGINFOD_MAXTIME, $DEBUGINFOD_PROGRESS.
>  
> +set prefix="@prefix@"
>  if (! $?DEBUGINFOD_URLS) then
> -    set prefix="@prefix@"
>      set DEBUGINFOD_URLS=`sh -c 'cat /dev/null "$0"/*.urls 2>/dev/null; :' "@sysconfdir@/debuginfod" | tr '\n' ' '`
>      if ( "$DEBUGINFOD_URLS" != "" ) then
>          setenv DEBUGINFOD_URLS "$DEBUGINFOD_URLS"
>      else
>          unset DEBUGINFOD_URLS
>      endif
> -    unset prefix
> +    set DEBUGINFOD_IMA_CERT_PATH=`sh -c 'cat /dev/null "$0"/*.certpath 2>/dev/null; :' "@sysconfdir@/debuginfod" | tr '\n' ':'`
> +    if ( "$DEBUGINFOD_IMA_CERT_PATH" != "" ) then
> +        setenv DEBUGINFOD_IMA_CERT_PATH "$DEBUGINFOD_IMA_CERT_PATH"
> +    else
> +        unset DEBUGINFOD_IMA_CERT_PATH
> +    endif
>  endif
> +unset prefix
> diff --git a/config/profile.sh.in b/config/profile.sh.in
> index 84d3260ddcfc..7db399960915 100644
> --- a/config/profile.sh.in
> +++ b/config/profile.sh.in
> @@ -4,9 +4,15 @@
>  # See also [man debuginfod-client-config] for other environment variables
>  # such as $DEBUGINFOD_MAXSIZE, $DEBUGINFOD_MAXTIME, $DEBUGINFOD_PROGRESS.
>  
> +prefix="@prefix@"
>  if [ -z "$DEBUGINFOD_URLS" ]; then
>      prefix="@prefix@"
>      DEBUGINFOD_URLS=$(cat /dev/null "@sysconfdir@/debuginfod"/*.urls 2>/dev/null | tr '\n' ' ' || :)
>      [ -n "$DEBUGINFOD_URLS" ] && export DEBUGINFOD_URLS || unset DEBUGINFOD_URLS
> -    unset prefix
>  fi
> +
> +if [ -z "$DEBUGINFOD_IMA_CERT_PATH" ]; then
> +    DEBUGINFOD_IMA_CERT_PATH=$(cat "@sysconfdir@/debuginfod"/*.certpath 2>/dev/null | tr '\n' ':' || :)
> +    [ -n "$DEBUGINFOD_IMA_CERT_PATH" ] && export DEBUGINFOD_IMA_CERT_PATH || unset DEBUGINFOD_IMA_CERT_PATH
> +fi
> +unset prefix

We now also have a fish profile.

> diff --git a/configure.ac b/configure.ac
> index a279bb5282c9..19ccf107494b 100644
> --- a/configure.ac
> +++ b/configure.ac
> @@ -667,6 +667,35 @@ case "$ac_cv_search__obstack_free" in
>  esac
>  AC_SUBST([obstack_LIBS])
>  
> +enable_ima_verification="x"
> +AC_CHECK_LIB(rpm, headerGet, [
> +  AC_CHECK_DECL(RPMSIGTAG_FILESIGNATURES,
> +  [
> +    enable_ima_verification=$enable_ima_verification"rpm"
> +    AC_SUBST(rpm_LIBS, '-lrpm -lrpmio')
> +  ],
> +  [], [#include <rpm/rpmlib.h>])
> +])
> +
> +dnl we use only the header, not the code of this library
> +AC_CHECK_HEADER(imaevm.h, [
> +  enable_ima_verification=$enable_ima_verification"imaevm"
> +])
> +
> +AC_CHECK_LIB(crypto, EVP_MD_CTX_new, [
> +  enable_ima_verification=$enable_ima_verification"crypto"
> +  AC_SUBST(crypto_LIBS, '-lcrypto')
> +])
> +
> +debuginfod_ima_verification_enabled="no"
> +if test "$enable_ima_verification" = "xrpmimaevmcrypto"; then
> +  debuginfod_ima_verification_enabled="yes"
> +  default_ima_cert_path=`eval echo "/etc/keys/ima:/etc/pki/rpm-ima:$sysconfdir/debuginfod/ima-certs"` # expand $prefix too
> +  AC_DEFINE([ENABLE_IMA_VERIFICATION], [1], [Define if the required ima verification libraries are available])
> +  AC_DEFINE_UNQUOTED(DEBUGINFOD_IMA_CERT_PATH_DEFAULT, "$default_ima_cert_path", [Default IMA certificate path])
> +fi
> +AM_CONDITIONAL([ENABLE_IMA_VERIFICATION],[test "$enable_ima_verification" = "xrpmimaevmcrypto"])
> +

Not all these are needed anymore now are they?

>  dnl The directories with content.
>  
>  dnl Documentation.
> @@ -881,6 +910,15 @@ AC_ARG_ENABLE(debuginfod-urls,
>               fi],
>              [default_debuginfod_urls=""])
>  AC_SUBST(DEBUGINFOD_URLS, $default_debuginfod_urls)                
> +AC_ARG_ENABLE(debuginfod-ima-cert-path,
> +            [AS_HELP_STRING([--enable-debuginfod-ima-cert-path@<:@=PATH@:>@],[add PATH to profile.d DEBUGINFOD_IMA_CERT_PATH])],
> +            [if test "x${enableval}" = "xyes";
> +             then AC_MSG_ERROR([PATH required])
> +             elif test "x${enableval}" != "xno"; then
> +             default_debuginfod_ima_cert_path="${enableval}";
> +             fi],
> +            [default_debuginfod_ima_cert_path=""])
> +AC_SUBST(DEBUGINFOD_IMA_CERT_PATH, $default_debuginfod_ima_cert_path)
>  AC_CONFIG_FILES([config/profile.sh config/profile.csh config/profile.fish])
>  
>  AC_OUTPUT
> @@ -920,6 +958,7 @@ AC_MSG_NOTICE([
>      libdebuginfod client support       : ${enable_libdebuginfod}
>      Debuginfod server support          : ${enable_debuginfod}
>      Default DEBUGINFOD_URLS            : ${default_debuginfod_urls}
> +    Debuginfod RPM sig checking        : ${debuginfod_ima_verification_enabled} ${default_debuginfod_ima_cert_path}
>  
>    EXTRA TEST FEATURES (used with make check)
>      have bunzip2 installed (required)  : ${HAVE_BUNZIP2}
> diff --git a/debuginfod/ChangeLog b/debuginfod/ChangeLog
> index 0e4810bba501..f4d98c2e93bc 100644
> --- a/debuginfod/ChangeLog
> +++ b/debuginfod/ChangeLog
> @@ -1,3 +1,17 @@
> +2023-08-14  Ryan Goldberg  <rgoldber@redhat.com>
> +
> +	* debuginfod.cxx (handle_buildid_r_match): Added extraction of the
> +	per-file IMA signature for the queried file and store in http header.
> +	* (find_globbed_koji_filepath): New function.
> +	* (parse_opt): New flag --koji-sigcache.
> +	* debuginfod-client.c (debuginfod_query_server): Added policy for
> +	validating IMA signatures
> +	* (debuginfod_validate_imasig): New function.
> +	* debuginfod.h.in: Added DEBUGINFOD_IMA_CERT_PATH_ENV_VAR.
> +	* Makefile.am: Add linker flags for rpm and imaevm and crypto. Also add install/uninstall
> +	ima-certs/ to known location.
> +	* ima-certs/: New directory containing known ima verification certificates.
> +
>  2023-04-21  Frank Ch. Eigler <fche@redhat.com>

Please move this into the commit message.

>  	* debuginfod.cxx (groom): Fix -r / -X logic.
> diff --git a/debuginfod/Makefile.am b/debuginfod/Makefile.am
> index 125be97bbfcc..5e4f9669d7c1 100644
> --- a/debuginfod/Makefile.am
> +++ b/debuginfod/Makefile.am
> @@ -70,7 +70,7 @@ bin_PROGRAMS += debuginfod-find
>  endif
>  
>  debuginfod_SOURCES = debuginfod.cxx
> -debuginfod_LDADD = $(libdw) $(libelf) $(libeu) $(libdebuginfod) $(argp_LDADD) $(fts_LIBS) $(libmicrohttpd_LIBS) $(sqlite3_LIBS) $(libarchive_LIBS) -lpthread -ldl
> +debuginfod_LDADD = $(libdw) $(libelf) $(libeu) $(libdebuginfod) $(argp_LDADD) $(fts_LIBS) $(libmicrohttpd_LIBS) $(sqlite3_LIBS) $(libarchive_LIBS) $(rpm_LIBS) -lpthread -ldl
>  
>  debuginfod_find_SOURCES = debuginfod-find.c
>  debuginfod_find_LDADD = $(libdw) $(libelf) $(libeu) $(libdebuginfod) $(argp_LDADD) $(fts_LIBS)
> @@ -97,7 +97,7 @@ libdebuginfod_so_LIBS = libdebuginfod_pic.a
>  if DUMMY_LIBDEBUGINFOD
>  libdebuginfod_so_LDLIBS =
>  else
> -libdebuginfod_so_LDLIBS = -lpthread $(libcurl_LIBS) $(fts_LIBS) $(libelf)
> +libdebuginfod_so_LDLIBS = -lpthread $(libcurl_LIBS) $(fts_LIBS) $(libelf) $(crypto_LIBS)
>  endif
>  $(LIBDEBUGINFOD_SONAME): $(srcdir)/libdebuginfod.map $(libdebuginfod_so_LIBS)
>  	$(AM_V_CCLD)$(LINK) $(dso_LDFLAGS) -o $@ \
> @@ -117,7 +117,6 @@ install: install-am libdebuginfod.so
>  		$(DESTDIR)$(libdir)/libdebuginfod-$(PACKAGE_VERSION).so
>  	ln -fs libdebuginfod-$(PACKAGE_VERSION).so $(DESTDIR)$(libdir)/$(LIBDEBUGINFOD_SONAME)
>  	ln -fs libdebuginfod-$(PACKAGE_VERSION).so $(DESTDIR)$(libdir)/libdebuginfod.so
> -
>  uninstall: uninstall-am
>  	rm -f $(DESTDIR)$(libdir)/libdebuginfod-$(PACKAGE_VERSION).so
>  	rm -f $(DESTDIR)$(libdir)/$(LIBDEBUGINFOD_SONAME)

Spurious line removal?

> diff --git a/debuginfod/debuginfod-client.c b/debuginfod/debuginfod-client.c
> index 0ee7db3d6638..4618234f0718 100644
> --- a/debuginfod/debuginfod-client.c
> +++ b/debuginfod/debuginfod-client.c
> @@ -1,5 +1,5 @@
>  /* Retrieve ELF / DWARF / source files from the debuginfod.
> -   Copyright (C) 2019-2021 Red Hat, Inc.
> +   Copyright (C) 2019-2024 Red Hat, Inc.
>     Copyright (C) 2021, 2022 Mark J. Wielaard <mark@klomp.org>
>     This file is part of elfutils.
>  
> @@ -47,6 +47,17 @@
>  #include <stdlib.h>
>  #include <gelf.h>
>  
> +#ifdef ENABLE_IMA_VERIFICATION
> +#include <openssl/sha.h>
> +#include <openssl/pem.h>
> +#include <openssl/evp.h>
> +#include <openssl/x509v3.h>
> +#include <arpa/inet.h>
> +#include <imaevm.h>
> +#endif
> +typedef enum {ignore, enforcing, undefined} ima_policy_t;
> +
> +
>  /* We might be building a bootstrap dummy library, which is really simple. */
>  #ifdef DUMMY_LIBDEBUGINFOD
>  
> @@ -92,6 +103,7 @@ void debuginfod_end (debuginfod_client *c) { }
>  #include <sys/stat.h>
>  #include <sys/utsname.h>
>  #include <curl/curl.h>
> +#include <fnmatch.h>
>  
>  /* If fts.h is included before config.h, its indirect inclusions may not
>     give us the right LFS aliases of these functions, so map them manually.  */
> @@ -114,6 +126,8 @@ void debuginfod_end (debuginfod_client *c) { }
>  
>  #include <pthread.h>
>  
> +
> +
>  static pthread_once_t init_control = PTHREAD_ONCE_INIT;
> 

Sperious extra blank lines?

>  
>  static void
> @@ -122,6 +136,17 @@ libcurl_init(void)
>    curl_global_init(CURL_GLOBAL_DEFAULT);
>  }
>  
> +
> +#ifdef ENABLE_IMA_VERIFICATION
> +struct public_key_entry
> +{
> +  struct public_key_entry *next; /* singly-linked list */
> +  uint32_t keyid; /* last 4 bytes of sha1 of public key */
> +  EVP_PKEY *key; /* openssl */
> +};
> +#endif
> +
> +
>  struct debuginfod_client
>  {
>    /* Progress/interrupt callback function. */
> @@ -156,8 +181,14 @@ struct debuginfod_client
>       handle data, etc. So those don't have to be reparsed and
>       recreated on each request.  */
>    char * winning_headers;
> +
> +#ifdef ENABLE_IMA_VERIFICATION
> +  /* IMA public keys */
> +  struct public_key_entry *ima_public_keys;
> +#endif
>  };
>  
> +
>  /* The cache_clean_interval_s file within the debuginfod cache specifies
>     how frequently the cache should be cleaned. The file's st_mtime represents
>     the time of last cleaning.  */
> @@ -217,6 +248,179 @@ struct handle_data
>    size_t response_data_size;
>  };
>  
> +
> +
> +#ifdef ENABLE_IMA_VERIFICATION
> +  static inline unsigned char hex2dec(char c)
> +  {
> +    if (c >= '0' && c <= '9') return (c - '0');
> +    if (c >= 'a' && c <= 'f') return (c - 'a') + 10;
> +    if (c >= 'A' && c <= 'F') return (c - 'A') + 10;
> +    return 0;
> +  }
> +
> +  static inline ima_policy_t ima_policy_str2enum(const char* ima_pol)
> +  {
> +    if (NULL == ima_pol)                    return undefined;
> +    if (0 == strcmp(ima_pol, "ignore"))     return ignore;
> +    if (0 == strcmp(ima_pol, "enforcing"))  return enforcing;
> +    return undefined;
> +  }
> +
> +  static inline const char* ima_policy_enum2str(ima_policy_t ima_pol)
> +  {
> +    switch (ima_pol)
> +    {
> +    case ignore:
> +      return "ignore";
> +    case enforcing:
> +      return "enforcing";
> +    case undefined:
> +      return "undefined";
> +    }
> +    return "";
> +  }
> +
> +
> +static uint32_t extract_skid_pk(EVP_PKEY *pkey) // compute keyid by public key hashing
> +{
> +  if (!pkey) return 0;
> +  uint32_t keyid = 0;
> +  X509_PUBKEY *pk = NULL;
> +  const unsigned char *public_key = NULL;                                                  
> +  int len;
> +  if (X509_PUBKEY_set(&pk, pkey) &&
> +      X509_PUBKEY_get0_param(NULL, &public_key, &len, NULL, pk))
> +    {
> +      uint8_t sha1[SHA_DIGEST_LENGTH];
> +      SHA1(public_key, len, sha1);
> +      memcpy(&keyid, sha1 + 16, 4);
> +    }
> +  X509_PUBKEY_free(pk);
> +  return ntohl(keyid);
> +}
> +
> +
> +static uint32_t extract_skid(X509* x509) // compute keyid from cert or its public key 
> +  {
> +    if (!x509) return 0;
> +    uint32_t keyid = 0;
> +    // Attempt to get the skid from the certificate
> +    const ASN1_OCTET_STRING *skid_asn1_str = X509_get0_subject_key_id(x509);
> +    if (skid_asn1_str)
> +      {
> +        int skid_len = ASN1_STRING_length(skid_asn1_str);
> +        memcpy(&keyid, ASN1_STRING_get0_data(skid_asn1_str) + skid_len - sizeof(keyid), sizeof(keyid));
> +      }
> +    else // compute keyid ourselves by hashing public key
> +      {
> +        EVP_PKEY *pkey = X509_get0_pubkey(x509);
> +        keyid = htonl(extract_skid_pk(pkey));
> +      }
> +    return ntohl(keyid);
> +  }
> +
> +
> +static void load_ima_public_keys (debuginfod_client *c)
> +{
> +  /* Iterate over the directories in DEBUGINFOD_IMA_CERT_PATH. */
> +  char *cert_paths = strdup (getenv(DEBUGINFOD_IMA_CERT_PATH_ENV_VAR) ?: DEBUGINFOD_IMA_CERT_PATH_DEFAULT);
> +  if (!cert_paths)
> +    return;
> +  
> +  char* cert_dir_path;
> +  DIR *dp;
> +  struct dirent *entry;
> +  int vfd = c->verbose_fd;
> +  
> +  char *strtok_context = NULL;
> +  for(cert_dir_path = strtok_r(cert_paths, ":", &strtok_context);
> +      cert_dir_path != NULL;
> +      cert_dir_path = strtok_r(NULL, ":", &strtok_context))
> +    {
> +      dp = opendir(cert_dir_path);
> +      if(!dp) continue;
> +      while((entry = readdir(dp)))
> +        {
> +          // Only consider regular files with common x509 cert extensions
> +          if(entry->d_type != DT_REG || 0 != fnmatch("*.@(der|pem|crt|cer|cert)", entry->d_name, FNM_EXTMATCH)) continue;
> +          char certfile[PATH_MAX];
> +          strncpy(certfile, cert_dir_path, PATH_MAX - 1);
> +          if(certfile[strlen(certfile)-1] != '/') certfile[strlen(certfile)] = '/';
> +          strncat(certfile, entry->d_name, PATH_MAX - strlen(certfile) - 1);
> +          certfile[strlen(certfile)] = '\0';
> +          
> +          FILE *cert_fp = fopen(certfile, "r");
> +          if(!cert_fp) continue;
> +
> +          X509 *x509 = NULL;
> +          EVP_PKEY *pkey = NULL;
> +          char *fmt = "";
> +          // Attempt to read the fp as DER
> +          if(d2i_X509_fp(cert_fp, &x509))
> +            fmt = "der ";
> +          // Attempt to read the fp as PEM and assuming the key matches that of the signature add this key to be used
> +          // Note we fseek since this is the second time we read from the fp
> +          else if(0 == fseek(cert_fp, 0, SEEK_SET) && PEM_read_X509(cert_fp, &x509, NULL, NULL))
> +            fmt = "pem "; // PEM with full certificate
> +          else if(0 == fseek(cert_fp, 0, SEEK_SET) && PEM_read_PUBKEY(cert_fp, &pkey, NULL, NULL)) 
> +            fmt = "pem "; // some PEM files have just a PUBLIC KEY in them
> +          fclose(cert_fp);
> +
> +          if (x509)
> +            {
> +              struct public_key_entry *ne = calloc(1, sizeof(struct public_key_entry));
> +              if (ne)
> +                {
> +                  ne->key = X509_extract_key(x509);
> +                  ne->keyid = extract_skid(x509);
> +                  ne->next = c->ima_public_keys;
> +                  c->ima_public_keys = ne;
> +                  if (vfd >= 0)
> +                    dprintf(vfd, "Loaded %scertificate %s, keyid = %04x\n", fmt, certfile, ne->keyid);
> +                }
> +              X509_free (x509);
> +            }
> +          else if (pkey)
> +            {
> +              struct public_key_entry *ne = calloc(1, sizeof(struct public_key_entry));
> +              if (ne)
> +                {
> +                  ne->key = pkey; // preserve refcount
> +                  ne->keyid = extract_skid_pk(pkey);
> +                  ne->next = c->ima_public_keys;
> +                  c->ima_public_keys = ne;
> +                  if (vfd >= 0)
> +                    dprintf(vfd, "Loaded %spubkey %s, keyid = %04x\n", fmt, certfile, ne->keyid);
> +                }
> +            }
> +          else
> +            {
> +              if (vfd >= 0)
> +                dprintf(vfd, "Cannot load certificate %s\n", certfile);
> +            }
> +        } /* for each file in directory */
> +      closedir(dp);
> +    } /* for each directory */
> +  
> +  free(cert_paths);
> +}
> +
> +
> +static void free_ima_public_keys (debuginfod_client *c)
> +{
> +  while (c->ima_public_keys)
> +    {
> +      EVP_PKEY_free (c->ima_public_keys->key);
> +      struct public_key_entry *oen = c->ima_public_keys->next;
> +      free (c->ima_public_keys);
> +      c->ima_public_keys = oen;
> +    }
> +}
> +#endif
> +
> +
> +
>  static size_t
>  debuginfod_write_callback (char *ptr, size_t size, size_t nmemb, void *data)
>  {
> @@ -853,6 +1057,198 @@ cache_find_section (const char *scn_name, const char *target_cache_dir,
>    return rc;
>  }
>  
> +
> +#ifdef ENABLE_IMA_VERIFICATION
> +/* Extract the hash algorithm name from the signature header, of which
> +   there are several types.  The name will be used for openssl hashing
> +   of the file content.  The header doesn't need to be super carefully
> +   parsed, because if any part of it is wrong, be it the hash
> +   algorithm number or hash value or whatever, it will fail
> +   computation or verification.  Return NULL in case of error.  */
> +static const char*
> +get_signature_params(debuginfod_client *c, unsigned char *bin_sig)
> +{
> +  int hashalgo = 0;
> +  
> +  switch (bin_sig[0])
> +    {
> +    case EVM_IMA_XATTR_DIGSIG:
> +#ifdef IMA_VERITY_DIGSIG /* missing on debian-i386 trybot */
> +    case IMA_VERITY_DIGSIG:
> +#endif
> +      break;
> +    default:
> +      if (c->verbose_fd >= 0)
> +        dprintf (c->verbose_fd, "Unknown ima digsig %d\n", (int)bin_sig[0]);
> +      return NULL;
> +    }
> +
> +  switch (bin_sig[1])
> +    {
> +    case DIGSIG_VERSION_2:
> +      struct signature_v2_hdr hdr_v2;
> +      memcpy(& hdr_v2, & bin_sig[1], sizeof(struct signature_v2_hdr));
> +      hashalgo = hdr_v2.hash_algo;
> +      break;
> +    default:
> +      if (c->verbose_fd >= 0)
> +        dprintf (c->verbose_fd, "Unknown ima signature version %d\n", (int)bin_sig[1]);
> +      return NULL;
> +    }
> +  
> +  switch (hashalgo)
> +    {
> +    case PKEY_HASH_SHA1: return "sha1";
> +    case PKEY_HASH_SHA256: return "sha256";
> +      // (could add many others from enum pkey_hash_algo)
> +    default:
> +      if (c->verbose_fd >= 0)
> +        dprintf (c->verbose_fd, "Unknown ima pkey hash %d\n", hashalgo);
> +      return NULL;
> +    }
> +}
> +
> +
> +/* Verify given hash against given signature blob */
> +static int
> +debuginfod_verify_hash(debuginfod_client *c, const unsigned char *hash, int size,
> +                       const char *hash_algo, unsigned char *sig, int siglen)
> +{
> +	int ret = -EINVAL;
> +        struct public_key_entry *pkey;
> +	struct signature_v2_hdr hdr;
> +	EVP_PKEY_CTX *ctx;
> +	const EVP_MD *md;
> +
> +        memcpy(&hdr, sig, sizeof(struct signature_v2_hdr)); /* avoid just aliasing */
> +        
> +        /* Find the matching public key. */
> +        for (pkey = c->ima_public_keys; pkey != NULL; pkey = pkey->next)
> +          if (pkey->keyid == ntohl(hdr.keyid)) break;
> +	if (!pkey)
> +          return -ENOKEY;
> +
> +	if (!(ctx = EVP_PKEY_CTX_new(pkey->key, NULL)))
> +		goto err;
> +	if (!EVP_PKEY_verify_init(ctx))
> +		goto err;
> +	if (!(md = EVP_get_digestbyname(hash_algo)))
> +		goto err;
> +	if (!EVP_PKEY_CTX_set_signature_md(ctx, md))
> +		goto err;
> +	ret = EVP_PKEY_verify(ctx, sig + sizeof(hdr),
> +			      siglen - sizeof(hdr), hash, size);
> +	if (ret == 1)
> +		ret = 0;
> +	else if (ret == 0)
> +		ret = -EINVAL;
> +err:
> +	if (ret < 0 || ret > 1)
> +		ret = -EINVAL;
> +	EVP_PKEY_CTX_free(ctx);
> +	return ret;
> +}
> +
> +
> +
> +/* Validate an IMA file signature.
> + * Returns 0 on signature validity, -EINVAL on signature invalidity, -ENOSYS on undefined imaevm machinery,
> + * -ENOKEY on key issues, or other -errno.
> + */
> +
> +static int
> +debuginfod_validate_imasig (debuginfod_client *c, int fd)
> +{
> +  int rc = ENOSYS;
> +
> +  // int vfd = c->verbose_fd;
> +    EVP_MD_CTX *ctx = NULL;
> +    if (!c || !c->winning_headers)
> +    {
> +      rc = -ENODATA;
> +      goto exit_validate;
> +    }
> +    // Extract the HEX IMA-signature from the header
> +    char* sig_buf = NULL;
> +    char* hdr_ima_sig = strcasestr(c->winning_headers, "x-debuginfod-imasignature");
> +    if (!hdr_ima_sig || 1 != sscanf(hdr_ima_sig + strlen("x-debuginfod-imasignature:"), "%ms", &sig_buf))
> +    {
> +      rc = -ENODATA;
> +      goto exit_validate;
> +    }
> +    if (strlen(sig_buf) > MAX_SIGNATURE_SIZE) // reject if too long
> +    {
> +      rc = -EBADMSG;
> +      goto exit_validate;
> +    }
> +    // Convert the hex signature to bin
> +    size_t bin_sig_len = strlen(sig_buf)/2;
> +    unsigned char bin_sig[MAX_SIGNATURE_SIZE/2];
> +    for (size_t b = 0; b < bin_sig_len; b++)
> +      bin_sig[b] = (hex2dec(sig_buf[2*b]) << 4) | hex2dec(sig_buf[2*b+1]);
> +
> +    // Compute the binary digest of the cached file (with file descriptor fd)
> +    ctx = EVP_MD_CTX_new();
> +    const char* sighash_name = get_signature_params(c, bin_sig) ?: "";
> +    const EVP_MD *md = EVP_get_digestbyname(sighash_name);
> +    if (!ctx || !md || !EVP_DigestInit(ctx, md))
> +    {
> +      rc = -EBADMSG;
> +      goto exit_validate;
> +    }
> +
> +    long data_len;
> +    char* hdr_data_len = strcasestr(c->winning_headers, "x-debuginfod-size");
> +    if (!hdr_data_len || 1 != sscanf(hdr_data_len + strlen("x-debuginfod-size:") , "%ld", &data_len))
> +    {
> +      rc = -ENODATA;
> +      goto exit_validate;
> +    }
> +
> +    char file_data[DATA_SIZE]; // imaevm.h data chunk hash size 
> +    ssize_t n;
> +    for(off_t k = 0; k < data_len; k += n)
> +      {
> +        if (-1 == (n = pread(fd, file_data, DATA_SIZE, k)))
> +          {
> +            rc = -errno;
> +            goto exit_validate;
> +          }
> +        
> +        if (!EVP_DigestUpdate(ctx, file_data, n))
> +          {
> +            rc = -EBADMSG;
> +            goto exit_validate;
> +          }
> +      }
> +    
> +    uint8_t bin_dig[MAX_DIGEST_SIZE];
> +    unsigned int bin_dig_len;
> +    if (!EVP_DigestFinal(ctx, bin_dig, &bin_dig_len))
> +    {
> +      rc = -EBADMSG;
> +      goto exit_validate;
> +    }
> +
> +    // XXX: in case of DIGSIG_VERSION_3, need to hash the file hash, yo dawg
> +    
> +    int res = debuginfod_verify_hash(c,
> +                                     bin_dig, bin_dig_len,
> +                                     sighash_name,
> +                                     & bin_sig[1], bin_sig_len-1); // skip over first byte of signature
> +    if (c->verbose_fd >= 0)
> +      dprintf (c->verbose_fd, "Computed ima signature verification res=%d\n", res);
> +    rc = (res == 1) ? -EINVAL : res;
> +
> + exit_validate:
> +    free (sig_buf);
> +    EVP_MD_CTX_free(ctx);
> +  return rc;
> +}
> +#endif /* ENABLE_IMA_VERIFICATION */
> +
> +
> +
>  /* Query each of the server URLs found in $DEBUGINFOD_URLS for the file
>     with the specified build-id and type (debuginfo, executable, source or
>     section).  If type is source, then type_arg should be a filename.  If
> @@ -1208,12 +1604,39 @@ debuginfod_query_server (debuginfod_client *c,
>    /* Initialize the memory to zero */
>    char *strtok_saveptr;
>    char **server_url_list = NULL;
> -  char *server_url = strtok_r(server_urls, url_delim, &strtok_saveptr);
> +  ima_policy_t* url_ima_policies = NULL;
> +  char* server_url;
>    /* Count number of URLs.  */
>    int num_urls = 0;
>  
> -  while (server_url != NULL)
> +  ima_policy_t verification_mode = ignore; // The default mode
> +  for(server_url = strtok_r(server_urls, url_delim, &strtok_saveptr);
> +      server_url != NULL; server_url = strtok_r(NULL, url_delim, &strtok_saveptr))
>      {
> +      // When we encounted a (well-formed) token off the form ima:foo, we update the policy
> +      // under which results from that server will be ima verified
> +      if(startswith(server_url, "ima:"))
> +      {
> +#ifdef ENABLE_IMA_VERIFICATION
> +        ima_policy_t m = ima_policy_str2enum(server_url + strlen("ima:"));
> +        if(m != undefined)
> +          verification_mode = m;
> +        else if (vfd >= 0)
> +          dprintf(vfd, "IMA mode not recognized, skipping %s\n", server_url);
> +#else
> +        if (vfd >= 0)
> +            dprintf(vfd, "IMA signature verification is not enabled, skipping %s\n", server_url);
> +#endif
> +        continue; // Not a url, just a mode change so keep going
> +      }
> +
> +      if (verification_mode==enforcing && 0==strcmp(type,"section"))
> +        {
> +          if (vfd >= 0)
> +            dprintf(vfd, "skipping server %s section query in IMA enforcing mode\n", server_url);
> +          continue;
> +        }
> 

Aha, nice. That then works with the fallthrough later...

>    
>        /* PR 27983: If the url is already set to be used use, skip it */
>        char *slashbuildid;
>        if (strlen(server_url) > 1 && server_url[strlen(server_url)-1] == '/')
> @@ -1245,21 +1668,28 @@ debuginfod_query_server (debuginfod_client *c,
>        else
>          {
>            num_urls++;
> -          char ** realloc_ptr;
> -          realloc_ptr = reallocarray(server_url_list, num_urls,
> -                                         sizeof(char*));
> -          if (realloc_ptr == NULL)
> +          if (NULL == (server_url_list  = reallocarray(server_url_list, num_urls, sizeof(char*)))
> +#ifdef ENABLE_IMA_VERIFICATION
> +          || NULL == (url_ima_policies = reallocarray(url_ima_policies, num_urls, sizeof(ima_policy_t)))
> +#endif
> +            )
>              {
>                free (tmp_url);
>                rc = -ENOMEM;
>                goto out1;
>              }
> -          server_url_list = realloc_ptr;
>            server_url_list[num_urls-1] = tmp_url;
> +          if(NULL != url_ima_policies) url_ima_policies[num_urls-1] = verification_mode;
>          }
> -      server_url = strtok_r(NULL, url_delim, &strtok_saveptr);
>      }
>  
> +  /* No URLs survived parsing / filtering?  Abort abort abort. */
> +  if (num_urls == 0)
> +    {
> +      rc = -ENOSYS;
> +      goto out1;
> +    }
> +  
>    int retry_limit = default_retry_limit;
>    const char* retry_limit_envvar = getenv(DEBUGINFOD_RETRY_LIMIT_ENV_VAR);
>    if (retry_limit_envvar != NULL)
> @@ -1326,7 +1756,11 @@ debuginfod_query_server (debuginfod_client *c,
>        if ((server_url = server_url_list[i]) == NULL)
>          break;
>        if (vfd >= 0)
> -	dprintf (vfd, "init server %d %s\n", i, server_url);
> +#ifdef ENABLE_IMA_VERIFICATION
> +        dprintf (vfd, "init server %d %s [IMA verification policy: %s]\n", i, server_url, ima_policy_enum2str(url_ima_policies[i]));
> +#else
> +        dprintf (vfd, "init server %d %s\n", i, server_url);
> +#endif
>  
>        data[i].fd = fd;
>        data[i].target_handle = &target_handle;
> @@ -1774,6 +2208,33 @@ debuginfod_query_server (debuginfod_client *c,
>    /* PR31248: lseek back to beginning */
>    (void) lseek(fd, 0, SEEK_SET);
>                  
> +  if(NULL != url_ima_policies && ignore != url_ima_policies[committed_to])
> +  {
> +#ifdef ENABLE_IMA_VERIFICATION
> +    int result = debuginfod_validate_imasig(c, fd);
> +#else
> +    int result = -ENOSYS;
> +#endif
> +    if(0 == result)
> +    {
> +      if (vfd >= 0) dprintf (vfd, "valid signature\n");
> +    }
> +    else if(EINVAL == result || enforcing == url_ima_policies[committed_to])
> +    {
> +      // All invalid signatures are rejected.
> +      // Additionally in enforcing mode any non-valid signature is rejected, so by reaching
> +      // this case we do so since we know it is not valid. Note - this not just invalid signatures
> +      // but also signatures that cannot be validated
> +      if (vfd >= 0) dprintf (vfd, "error: invalid or missing signature (%d)\n", result);
> +      rc = -EBADMSG;
> +      goto out2;
> +    }
> +    else
> +    {
> +      // NOTREACHED
> +    }
> +  }
> +
>    /* rename tmp->real */
>    rc = rename (target_cache_tmppath, target_cache_path);
>    if (rc < 0)
> @@ -1794,6 +2255,7 @@ debuginfod_query_server (debuginfod_client *c,
>    for (int i = 0; i < num_urls; ++i)
>      free(server_url_list[i]);
>    free(server_url_list);
> +  free(url_ima_policies);
>    free (data);
>    free (server_urls);
>  
> @@ -1827,6 +2289,7 @@ debuginfod_query_server (debuginfod_client *c,
>    for (int i = 0; i < num_urls; ++i)
>      free(server_url_list[i]);
>    free(server_url_list);
> +  free(url_ima_policies);
>  
>   out0:
>    free (server_urls);
> @@ -1859,7 +2322,11 @@ debuginfod_query_server (debuginfod_client *c,
>    free (cache_miss_path);
>    free (target_cache_dir);
>    free (target_cache_path);
> +  if (rc < 0 && target_cache_tmppath != NULL)
> +    (void)unlink (target_cache_tmppath);
>    free (target_cache_tmppath);
> +
> +  
>    return rc;
>  }
>  
> @@ -1891,6 +2358,10 @@ debuginfod_begin (void)
>  	goto out1;
>      }
>  
> +#ifdef ENABLE_IMA_VERIFICATION
> +  load_ima_public_keys (client);
> +#endif
> +
>    // extra future initialization
>    
>    goto out;
> @@ -1938,6 +2409,9 @@ debuginfod_end (debuginfod_client *client)
>    curl_slist_free_all (client->headers);
>    free (client->winning_headers);
>    free (client->url);
> +#ifdef ENABLE_IMA_VERIFICATION
> +  free_ima_public_keys (client);
> +#endif
>    free (client);
>  }
>  
> @@ -1977,9 +2451,11 @@ debuginfod_find_section (debuginfod_client *client,
>  {
>    int rc = debuginfod_query_server(client, build_id, build_id_len,
>  				   "section", section, path);
> -  if (rc != -EINVAL)
> +  if (rc != -EINVAL && rc != -ENOSYS)
>      return rc;
> -
> +  /* NB: we fall through in case of ima:enforcing-filtered DEBUGINFOD_URLS servers,
> +     so we can download the entire file, verify it locally, then slice it. */
> +  
>    /* The servers may have lacked support for section queries.  Attempt to
>       download the debuginfo or executable containing the section in order
>       to extract it.  */

... here. Cool.

> diff --git a/debuginfod/debuginfod.cxx b/debuginfod/debuginfod.cxx
> index ece5031f02f9..30c818dd24bf 100644
> --- a/debuginfod/debuginfod.cxx
> +++ b/debuginfod/debuginfod.cxx
> @@ -122,6 +122,13 @@ using namespace std;
>  #define MHD_RESULT int
>  #endif
>  
> +#ifdef ENABLE_IMA_VERIFICATION
> +  #include <rpm/rpmlib.h>
> +  #include <rpm/rpmfi.h>
> +  #include <rpm/header.h>
> +  #include <glob.h>
> +#endif
> +
>  #include <curl/curl.h>
>  #include <archive.h>
>  #include <archive_entry.h>
> @@ -443,6 +450,10 @@ static const struct argp_option options[] =
>     { "disable-source-scan", ARGP_KEY_DISABLE_SOURCE_SCAN, NULL, 0, "Do not scan dwarf source info.", 0 },
>  #define ARGP_SCAN_CHECKPOINT 0x100A
>     { "scan-checkpoint", ARGP_SCAN_CHECKPOINT, "NUM", 0, "Number of files scanned before a WAL checkpoint.", 0 },
> +#ifdef ENABLE_IMA_VERIFICATION
> +#define ARGP_KEY_KOJI_SIGCACHE 0x100B
> +   { "koji-sigcache", ARGP_KEY_KOJI_SIGCACHE, NULL, 0, "Do a koji specific mapping of rpm paths to get IMA signatures.", 0 },
> +#endif
>     { NULL, 0, NULL, 0, NULL, 0 },
>    };
>  
> @@ -495,6 +506,9 @@ static bool scan_source_info = true;
>  static string tmpdir;
>  static bool passive_p = false;
>  static long scan_checkpoint = 256;
> +#ifdef ENABLE_IMA_VERIFICATION
> +static bool requires_koji_sigcache_mapping = false;
> +#endif
>  
>  static void set_metric(const string& key, double value);
>  static void inc_metric(const string& key);
> @@ -699,6 +713,11 @@ parse_opt (int key, char *arg,
>        if (scan_checkpoint < 0)
>          argp_failure(state, 1, EINVAL, "scan checkpoint");        
>        break;
> +#ifdef ENABLE_IMA_VERIFICATION
> +    case ARGP_KEY_KOJI_SIGCACHE:
> +      requires_koji_sigcache_mapping = true;
> +      break;
> +#endif
>        // case 'h': argp_state_help (state, stderr, ARGP_HELP_LONG|ARGP_HELP_EXIT_OK);
>      default: return ARGP_ERR_UNKNOWN;
>      }
> @@ -1959,6 +1978,146 @@ handle_buildid_r_match (bool internal_req_p,
>        return 0;
>      }
>  
> +  // Extract the IMA per-file signature (if it exists)
> +  string ima_sig = "";
> +  #ifdef ENABLE_IMA_VERIFICATION
> +  do
> +  {
> +    FD_t rpm_fd;
> +    if(!(rpm_fd = Fopen(b_source0.c_str(), "r.ufdio"))) // read, uncompressed, rpm/rpmio.h
> +    {
> +      if (verbose) obatched(clog) << "There was an error while opening " << b_source0 << endl;
> +      break; // Exit IMA extraction
> +    }
> +
> +    Header rpm_hdr;
> +    if(RPMRC_FAIL == rpmReadPackageFile(NULL, rpm_fd, b_source0.c_str(), &rpm_hdr))
> +    {
> +      if (verbose) obatched(clog) << "There was an error while reading the header of " << b_source0 << endl;
> +      Fclose(rpm_fd);
> +      break; // Exit IMA extraction
> +    }
> +
> +    // Fill sig_tag_data with an alloc'd copy of the array of IMA signatures (if they exist)
> +    struct rpmtd_s sig_tag_data;
> +    rpmtdReset(&sig_tag_data);
> +    do{ /* A do-while so we can break out of the koji sigcache checking on failure */
> +    if(requires_koji_sigcache_mapping)
> +    {
> +      /* NB: Koji builds result in a directory structure like the following
> +      - PACKAGE/VERSION/RELEASE
> +        - ARCH1
> +          - foo.rpm           // The rpm known by debuginfod
> +        - ...
> +        - ARCHN
> +        - data
> +          - signed            // Periodically purged (and not scanned by debuginfod)
> +          - sigcache
> +            - ARCH1
> +              - foo.rpm.sig   // An empty rpm header
> +            - ...
> +            - ARCHN
> +            - PACKAGE_KEYID1
> +              - ARCH1
> +                - foo.rpm.sig   // The header of the signed rpm. This is the file we need to extract the IMA signatures
> +              - ...
> +              - ARCHN
> +            - ...
> +            - PACKAGE_KEYIDn
> +            
> +      We therefore need to do a mapping:
> +      
> +         P/V/R/A/N-V-R.A.rpm ->
> +         P/V/R/data/sigcache/KEYID/A/N-V-R.A.rpm.sig
> +
> +      There are 2 key insights here         
> +      
> +      1. We need to go 2 directories down from sigcache to get to the
> +      rpm header. So to distinguish ARCH1/foo.rpm.sig and
> +      PACKAGE_KEYID1/ARCH1/foo.rpm.sig we can look 2 directories down
> +      
> +      2. It's safe to assume that the user will have all of the
> +      required verification certs. So we can pick from any of the
> +      PACKAGE_KEYID* directories.  For simplicity we choose first we
> +      match against
> +      
> +      See: https://pagure.io/koji/issue/3670
> +      */
> +
> +      // Do the mapping from b_source0 to the koji path for the signed rpm header
> +      string signed_rpm_path = b_source0;
> +      size_t insert_pos = string::npos;
> +      for(int i = 0; i < 2; i++) insert_pos = signed_rpm_path.rfind("/", insert_pos) - 1;
> +      string globbed_path  = signed_rpm_path.insert(insert_pos + 1, "/data/sigcache/*").append(".sig"); // The globbed path we're seeking
> +      glob_t pglob;
> +      int grc;
> +      if(0 != (grc = glob(globbed_path.c_str(), GLOB_NOSORT, NULL, &pglob)))
> +      {
> +        // Break out, but only report real errors
> +        if (verbose && grc != GLOB_NOMATCH) obatched(clog) << "There was an error (" << strerror(errno) << ") globbing " << globbed_path << endl;
> +        break; // Exit koji sigcache check
> +      }
> +      signed_rpm_path = pglob.gl_pathv[0]; // See insight 2 above
> +      globfree(&pglob);
> +
> +      if (verbose > 2) obatched(clog) << "attempting IMA signature extraction from koji header " << signed_rpm_path << endl;
> +
> +      FD_t sig_rpm_fd;
> +      if(NULL == (sig_rpm_fd = Fopen(signed_rpm_path.c_str(), "r")))
> +      {
> +        if (verbose) obatched(clog) << "There was an error while opening " << signed_rpm_path << endl;
> +        break; // Exit koji sigcache check
> +      }
> +
> +      Header sig_hdr = headerRead(sig_rpm_fd, HEADER_MAGIC_YES /* Validate magic too */ );
> +      if (!sig_hdr || 1 != headerGet(sig_hdr, RPMSIGTAG_FILESIGNATURES, &sig_tag_data, HEADERGET_ALLOC))
> +      {
> +        if (verbose) obatched(clog) << "Unable to extract RPMSIGTAG_FILESIGNATURES from " << signed_rpm_path << endl;
> +      }
> +      headerFree(sig_hdr); // We can free here since sig_tag_data has an alloc'd copy of the data
> +      Fclose(sig_rpm_fd);
> +    }
> +    }while(false);
> +
> +    if(0 == sig_tag_data.count)
> +    {
> +      // In the general case (or a fallback from the koji sigcache mapping not finding signatures)
> +      // we can just (try) extract the signatures from the rpm header
> +      if (1 != headerGet(rpm_hdr, RPMTAG_FILESIGNATURES, &sig_tag_data, HEADERGET_ALLOC))
> +      {
> +        if (verbose) obatched(clog) << "Unable to extract RPMTAG_FILESIGNATURES from " << b_source0 << endl;
> +      }
> +    }
> +    // Search the array for the signature coresponding to b_source1
> +    int idx = -1;
> +    char *sig = NULL;
> +    rpmfi hdr_fi = rpmfiNew(NULL, rpm_hdr, RPMTAG_BASENAMES, RPMFI_FLAGS_QUERY);
> +    do
> +      {
> +        sig = (char*)rpmtdNextString(&sig_tag_data);
> +        idx = rpmfiNext(hdr_fi);
> +      }
> +    while (idx != -1 && 0 != strcmp(b_source1.c_str(), rpmfiFN(hdr_fi)));
> +    rpmfiFree(hdr_fi);
> +
> +    if(sig && 0 != strlen(sig) && idx != -1)
> +    {
> +      if (verbose > 2) obatched(clog) << "Found IMA signature for " << b_source1 << ":\n" << sig << endl;
> +      ima_sig = sig;
> +      inc_metric("http_responses_total","extra","ima-sigs-extracted");
> +    }
> +    else
> +    {
> +      if (verbose > 2) obatched(clog) << "Could not find IMA signature for " << b_source1 << endl;
> +    }
> +
> +    rpmtdFreeData (&sig_tag_data);
> +    headerFree(rpm_hdr);
> +    Fclose(rpm_fd);
> +  }
> +  while(false);
> +  #endif
> +
>    // check for a match in the fdcache first
>    int fd = fdcache.lookup(b_source0, b_source1);
>    while (fd >= 0) // got one!; NB: this is really an if() with a possible branch out to the end
> @@ -2016,11 +2175,13 @@ handle_buildid_r_match (bool internal_req_p,
>  			       to_string(fs.st_size).c_str());
>        add_mhd_response_header (r, "X-DEBUGINFOD-ARCHIVE", b_source0.c_str());
>        add_mhd_response_header (r, "X-DEBUGINFOD-FILE", b_source1.c_str());
> +      if(!ima_sig.empty()) add_mhd_response_header(r, "X-DEBUGINFOD-IMASIGNATURE", ima_sig.c_str());
>        add_mhd_last_modified (r, fs.st_mtime);
>        if (verbose > 1)
>  	obatched(clog) << "serving fdcache archive " << b_source0
>  		       << " file " << b_source1
> -		       << " section=" << section << endl;
> +		       << " section=" << section
> +		       << " IMA signature=" << ima_sig << endl;
>        /* libmicrohttpd will close it. */
>        if (result_fd)
>          *result_fd = fd;
> @@ -2204,11 +2365,13 @@ handle_buildid_r_match (bool internal_req_p,
>                                     to_string(archive_entry_size(e)).c_str());
>            add_mhd_response_header (r, "X-DEBUGINFOD-ARCHIVE", b_source0.c_str());
>            add_mhd_response_header (r, "X-DEBUGINFOD-FILE", b_source1.c_str());
> +          if(!ima_sig.empty()) add_mhd_response_header(r, "X-DEBUGINFOD-IMASIGNATURE", ima_sig.c_str());
>            add_mhd_last_modified (r, archive_entry_mtime(e));
>            if (verbose > 1)
>  	    obatched(clog) << "serving archive " << b_source0
>  			   << " file " << b_source1
> -			   << " section=" << section << endl;
> +			   << " section=" << section
> +			   << " IMA signature=" << ima_sig << endl;
>            /* libmicrohttpd will close it. */
>            if (result_fd)
>              *result_fd = fd;
> diff --git a/debuginfod/debuginfod.h.in b/debuginfod/debuginfod.h.in
> index 4a256ba9af1f..73f633f0b8e9 100644
> --- a/debuginfod/debuginfod.h.in
> +++ b/debuginfod/debuginfod.h.in
> @@ -39,6 +39,7 @@
>  #define DEBUGINFOD_MAXSIZE_ENV_VAR "DEBUGINFOD_MAXSIZE"
>  #define DEBUGINFOD_MAXTIME_ENV_VAR "DEBUGINFOD_MAXTIME"
>  #define DEBUGINFOD_HEADERS_FILE_ENV_VAR "DEBUGINFOD_HEADERS_FILE"
> +#define DEBUGINFOD_IMA_CERT_PATH_ENV_VAR "DEBUGINFOD_IMA_CERT_PATH"
>  
>  /* The libdebuginfod soname.  */
>  #define DEBUGINFOD_SONAME "@LIBDEBUGINFOD_SONAME@"
> diff --git a/doc/ChangeLog b/doc/ChangeLog
> index 7f2d6ff4fd31..914f8f649511 100644
> --- a/doc/ChangeLog
> +++ b/doc/ChangeLog
> @@ -1,3 +1,10 @@
> +2023-08-14  Ryan Goldberg  <rgoldber@redhat.com>
> +
> +	* debuginfod-client-config.7: Document DEBUGINFOD_IMA_CERT_PATH,
> +	update DEBUGINFOD_URLS.
> +	* debuginfod.8: Document --koji-sigcache
> +	* debuginfod-find.1, debuginfod_find_debuginfo.3: Update SECURITY
> +

More ChangeLog that could move into the commit message.

Cheers,

Mar