From 0b9e254a5124175049658eb31a91db9c56093de5 Mon Sep 17 00:00:00 2001
From: Adam Samalik <asamalik@redhat.com>
Date: May 22 2024 10:21:19 +0000
Subject: deduplicate digests before IMA signing


---

diff --git a/calligrabot/wrapper.py b/calligrabot/wrapper.py
index 3048485..b55e6f0 100644
--- a/calligrabot/wrapper.py
+++ b/calligrabot/wrapper.py
@@ -133,6 +133,7 @@ def sign_rpms(
     )
 
     if ima_sign_key:
+        imadigest_undeduplicated = os.path.join(tmpdir.name, "ima_digests_undeduplicated")
         imadigest = os.path.join(tmpdir.name, "ima_digests")
 
     rpmfiles = list()
@@ -141,7 +142,7 @@ def sign_rpms(
         rpmfiles.append(rpmfile)
         if ima_sign_key:
             rpm_head_signing.extract_header(
-                rpmfile, rpmfile + ".hdr", imadigest
+                rpmfile, rpmfile + ".hdr", imadigest_undeduplicated
             )
 
     log.info(
@@ -169,6 +170,30 @@ def sign_rpms(
 
     if ima_sign_key:
         log.info(
+            "Deduplicating IMA digests: {} -> {}.".format(
+                imadigest_undeduplicated,
+                imadigest,
+            )
+        )
+
+        with open(imadigest_undeduplicated, "r") as file:
+            imadigest_undeduplicated_lines = file.readlines()
+
+        # Deduplicate in a reproducible way
+        imadigest_lines = sorted(list(set(imadigest_undeduplicated_lines)))
+
+        log.info(
+            "Went from {} digests to {} unique digests. Writing...".format(
+                len(imadigest_undeduplicated_lines),
+                len(imadigest_lines),
+            )
+        )
+
+        with open(imadigest, "w") as file:
+            for line in imadigest_lines:
+                file.write(line)
+
+        log.info(
             "IMA signing header digest {} with key {}.".format(
                 imadigest,
                 ima_sign_key,