ANy attempt to use stap --sign-module always fails

# stap --sign-module /home/berrange/src/virt/libvirt/examples/systemtap/qemu-monitor.stp  
....+..+...+...+.+...+..+.+...+.........+++++++++++++++++++++++++++++++++++++++++++++*..+....+.....+................+.........+...+..+...+............+......+......+..........+...+..+......+....+..............+....+..+.+...+......+........+...+...+.......+..+...+.........+.+...+.....+.+.....+...............+.+..+...+...............+...+.......+..+.+..+....+...+..+...+...+++++++++++++++++++++++++++++++++++++++++++++*..+......+...........+............+..........+..................+..+.............+........+.+......+...+..+.........+..........+...+++++
....+...+...+.....+...+....+..+..................+.+.....+.+...+..+...+...+.......+......+............+.................+...............+...+.............+......+++++++++++++++++++++++++++++++++++++++++++++*......+...+...+..+.+..+.......+..+..........+.........+......+.....+.+........+....+...........+....+........+....+...........+....+......+++++++++++++++++++++++++++++++++++++++++++++*...+...+..........+........+.......+...+.....+.........+...+.+......+.....+.+..............+.+..+..........+...+........+.........+..........+...........+.+......+.....+............+.+..............+...+....+...+........+....+...+...........+....+...+..+.+......+...+..+..........+.....................+..+.+...............+.........+..+.+..+..........+..+.............+........+.........+....+..+...+..........+..+....+........+.+...........+.+..+.......+.............................................+...+......+..............+...+...+.+........+......+..........+..+.......+...+++++
-----
Running sign-file failed
There is no machine owner key (MOK) in common with this system.
Use the following command to import a MOK into this system, then reboot:

	# sudo mokutil --import /root/.systemtap/ssl/server/moks/55:07:0d:ca:39:42:8a:34:71:c4:46:b2:3f:80:6c:fb:e1:fd:94:ad:20:35:dc:03:e0:c5:0b:3c:eb:d8:c2:3c/signing_key.x509


I follow that mokutil instruction, reboot, enroll the key, and retry stap and the same happens. it just creates yet another new key

The code logic is basically broken.

In systemtap_session::get_mok_info() it runs 'mokutil --list-enrolled' and matches with

	if (! regexp_match(line, "^(SHA1|SHA256) Fingerprint: ([0-9a-f:]+)$", matches))

mokutil --list-enrolled only prints out the SHA1 fingerprint

# mokutil --list-enrolled  | grep ^SHA
SHA1 Fingerprint: 2b:b0:10:e2:4d:94:c6:32:24:58:89:ba:aa:9e:d0:f3:d5:ef:1f:68
SHA1 Fingerprint: 92:bc:29:e3:43:28:5f:d6:35:1b:1a:0a:da:66:32:46:ec:90:57:f9
SHA1 Fingerprint: cc:d0:fa:f5:36:95:c9:6d:af:fb:21:77:66:a0:e5:1b:35:4a:21:42
SHA1 Fingerprint: aa:52:00:6e:e7:fb:b1:cc:be:b8:00:d0:44:69:7d:23:91:ce:88:34


meanwhile the code which stap created the MOK with in generate_mok() calls read_cert_info_from_file () to get the fingerprint.

read_cert_info_from_file unconditionally uses the SHA256 digest

  rv = PK11_HashBuf(SEC_OID_SHA256, fingerprint_buf, derCert.data, derCert.len);

With stap creating files named based on the SHA256 digest, but trying to read files named based on the SHA1 digest, this will never work.


Reproducible: Always

Steps to Reproduce:
1. Boot with secure boot enabled
2. stap --sign-module anything.stp

Actual Results:
Running sign-file failed
There is no machine owner key (MOK) in common with this system.
Use the following command to import a MOK into this system, then reboot:
....

Expected Results:
Finds the already enrolled key and uses it