From 971e46ad031a44b53aa01d0787d8233dfb89a923 Mon Sep 17 00:00:00 2001 From: Jesse Keating Date: Mon, 21 Apr 2008 02:12:34 +0000 Subject: [PATCH 1/5] Initialize branch F-9 for libgcrypt --- branch | 1 + 1 file changed, 1 insertion(+) create mode 100644 branch diff --git a/branch b/branch new file mode 100644 index 0000000..1c26f78 --- /dev/null +++ b/branch @@ -0,0 +1 @@ +F-9 From e30b49216b1b957b3e653074c59f0fba13c09a22 Mon Sep 17 00:00:00 2001 From: Dennis Gilmore Date: Tue, 21 Oct 2008 04:48:26 +0000 Subject: [PATCH 2/5] disable asm on sparc64 --- libgcrypt.spec | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/libgcrypt.spec b/libgcrypt.spec index 15f1a4e..0a6bd3e 100644 --- a/libgcrypt.spec +++ b/libgcrypt.spec @@ -1,6 +1,6 @@ Name: libgcrypt Version: 1.4.0 -Release: 3 +Release: 4 Source0: ftp://ftp.gnupg.org/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2 Source1: ftp://ftp.gnupg.org/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2.sig Source2: wk@g10code.com @@ -32,7 +32,11 @@ applications using libgcrypt. %patch0 -p0 -b .randinit %build -%configure --disable-static --enable-noexecstack +%configure --disable-static \ +%ifarch sparc64 + --disable-asm \ +%endif + --enable-noexecstack make %check @@ -114,6 +118,9 @@ exit 0 %{_infodir}/gcrypt.info* %changelog +* Tue Oct 14 2008 Dennis Gilmore 1.4.0-4 +- disable asm on sparc64 + * Thu Apr 3 2008 Joe Orton 1.4.0-3 - add patch from upstream to fix severe performance regression in entropy gathering From a21b58c23626aae3b59b508db0877f907143a50d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Mr=C3=A1z?= Date: Fri, 30 Jan 2009 15:57:38 +0000 Subject: [PATCH 3/5] - update to 1.4.4 - do not abort when the fips mode kernel flag is inaccessible due to permissions (#470219) - hobble the library to drop the ECC support --- .cvsignore | 12 +--- hobble-libgcrypt | 9 +++ libgcrypt-1.2.2-lib64.patch | 14 ----- libgcrypt-1.4.0-randinit.patch | 90 ---------------------------- libgcrypt-1.4.4-fips-no-access.patch | 13 ++++ libgcrypt.spec | 59 ++++++++++++++---- sources | 3 +- 7 files changed, 72 insertions(+), 128 deletions(-) create mode 100755 hobble-libgcrypt delete mode 100644 libgcrypt-1.2.2-lib64.patch delete mode 100644 libgcrypt-1.4.0-randinit.patch create mode 100644 libgcrypt-1.4.4-fips-no-access.patch diff --git a/.cvsignore b/.cvsignore index c45e700..b8edc03 100644 --- a/.cvsignore +++ b/.cvsignore @@ -1,11 +1 @@ -libgcrypt-1.2.0.tar.gz -libgcrypt-1.2.1.tar.bz2 -libgcrypt-1.2.1.tar.bz2.sig -libgcrypt-1.2.2.tar.bz2 -libgcrypt-1.2.2.tar.bz2.sig -libgcrypt-1.2.3.tar.bz2 -libgcrypt-1.2.3.tar.bz2.sig -libgcrypt-1.2.4.tar.bz2 -libgcrypt-1.2.4.tar.bz2.sig -libgcrypt-1.4.0.tar.bz2 -libgcrypt-1.4.0.tar.bz2.sig +libgcrypt-1.4.4-hobbled.tar.bz2 diff --git a/hobble-libgcrypt b/hobble-libgcrypt new file mode 100755 index 0000000..1062d6e --- /dev/null +++ b/hobble-libgcrypt @@ -0,0 +1,9 @@ +#!/bin/sh + +# Quit out if anything fails. +set -e -x + +# Clean out patent-or-otherwise-encumbered code. +# EC: ????????? ??/??/2015 + +rm -f cipher/ecc.c diff --git a/libgcrypt-1.2.2-lib64.patch b/libgcrypt-1.2.2-lib64.patch deleted file mode 100644 index 4f68d7b..0000000 --- a/libgcrypt-1.2.2-lib64.patch +++ /dev/null @@ -1,14 +0,0 @@ -We should suppress an explicit -L on 64-bit arches, too. - ---- libgcrypt-1.2.2/src/libgcrypt-config.in 2006-05-16 18:50:43.000000000 -0400 -+++ libgcrypt-1.2.2/src/libgcrypt-config.in 2006-05-16 18:50:50.000000000 -0400 -@@ -138,7 +138,8 @@ - libs_final="$libs" - - # Set up `libdirs'. -- if test "x$libdir" != "x/usr/lib" -a "x$libdir" != "x/lib"; then -+ if test "x$libdir" != "x/usr/lib" -a "x$libdir" != "x/lib" -a \ -+ "x$libdir" != "x/usr/lib64" -a "x$libdir" != "x/lib64"; then - libdirs="-L$libdir" - fi - diff --git a/libgcrypt-1.4.0-randinit.patch b/libgcrypt-1.4.0-randinit.patch deleted file mode 100644 index eb1c04d..0000000 --- a/libgcrypt-1.4.0-randinit.patch +++ /dev/null @@ -1,90 +0,0 @@ -From gnutls-devel-bounces+joe=manyfish.co.uk@gnu.org Tue Jan 08 18:41:52 2008 -From: Werner Koch -To: Simon Josefsson -Mail-Followup-To: Simon Josefsson , - Guus Sliepen , gnutls-devel@gnu.org, - 343085@bugs.debian.org, gcrypt-devel@gnupg.org -Date: Tue, 08 Jan 2008 12:39:02 +0100 -Cc: Guus Sliepen , gcrypt-devel@gnupg.org, - gnutls-devel@gnu.org, 343085@bugs.debian.org -Subject: [patch] Re: Bug#448775: Uses too much entropy (Debian Bug #343085) -MIME-Version: 1.0 -Content-Transfer-Encoding: 8bit -Content-Type: text/plain; charset=utf-8 -Status: RO - -On Tue, 8 Jan 2008 11:59, wk@gnupg.org said: - -> Anyway there 3000 calls to /dev/urandom are far too many for an initial -> pool filling. I need to check this. - -Found it. The bug was introduced with libgcrypt 1.3.1. Here is a patch: - -2008-01-08 Werner Koch - - * random.c (add_randomness): Do not just increment - POOL_FILLED_COUNTER but update it by the actual amount of data. - -Index: cipher/random.c -=================================================================== ---- cipher/random.c (revision 1277) -+++ cipher/random.c (working copy) -@@ -1115,6 +1115,7 @@ - add_randomness (const void *buffer, size_t length, enum random_origins origin) - { - const unsigned char *p = buffer; -+ size_t count = 0; - - assert (pool_is_locked); - -@@ -1123,6 +1124,7 @@ - while (length-- ) - { - rndpool[pool_writepos++] ^= *p++; -+ count++; - if (pool_writepos >= POOLSIZE ) - { - /* It is possible that we are invoked before the pool is -@@ -1132,7 +1134,9 @@ - separately. See also the remarks about the seed file. */ - if (origin >= RANDOM_ORIGIN_SLOWPOLL && !pool_filled) - { -- if (++pool_filled_counter >= POOLSIZE) -+ pool_filled_counter += count; -+ count = 0; -+ if (pool_filled_counter >= POOLSIZE) - pool_filled = 1; - } - pool_writepos = 0; - - -Also commited to SVN. Old and new stats: - -$ LD_PRELOAD=/usr/local/lib/libgcrypt.so ./benchmark --verbose random -random 130ms 30ms -random usage: poolsize=600 mixed=972 polls=3000/200 added=4200/378400 - outmix=200 getlvl1=200/13600 getlvl2=0/0 - -$ ./benchmark --verbose random -random 40ms 30ms -random usage: poolsize=600 mixed=377 polls=25/200 added=1225/21400 - outmix=200 getlvl1=200/13600 getlvl2=0/0 - - - -Shalom-Salam, - - Werner - - - --- -Die Gedanken sind frei. Auschnahme regelt ein Bundeschgesetz. - - - -_______________________________________________ -Gnutls-devel mailing list -Gnutls-devel@gnu.org -http://lists.gnu.org/mailman/listinfo/gnutls-devel - diff --git a/libgcrypt-1.4.4-fips-no-access.patch b/libgcrypt-1.4.4-fips-no-access.patch new file mode 100644 index 0000000..f2972e9 --- /dev/null +++ b/libgcrypt-1.4.4-fips-no-access.patch @@ -0,0 +1,13 @@ +Do not abort when the fips mode flag is simply inaccessible because of +insufficient permissions. +diff -up libgcrypt-1.4.4/src/fips.c.no-access libgcrypt-1.4.4/src/fips.c +--- libgcrypt-1.4.4/src/fips.c.no-access 2009-01-29 17:37:12.000000000 +0100 ++++ libgcrypt-1.4.4/src/fips.c 2009-01-29 17:37:15.000000000 +0100 +@@ -155,6 +155,7 @@ _gcry_initialize_fips_mode (int force) + fclose (fp); + } + else if ((saved_errno = errno) != ENOENT ++ && saved_errno != EACCES + && !access ("/proc/version", F_OK) ) + { + /* Problem reading the fips file despite that we have the proc diff --git a/libgcrypt.spec b/libgcrypt.spec index 0a6bd3e..ddf91d1 100644 --- a/libgcrypt.spec +++ b/libgcrypt.spec @@ -1,14 +1,21 @@ Name: libgcrypt -Version: 1.4.0 -Release: 4 -Source0: ftp://ftp.gnupg.org/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2 -Source1: ftp://ftp.gnupg.org/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2.sig +Version: 1.4.4 +Release: 1%{?dist} +Source0: libgcrypt-%{version}-hobbled.tar.bz2 +# The original libgcrypt sources now contain potentially patented ECC +# cipher support. We have to remove it in the tarball we ship with +# the hobble-libgcrypt script. +#Source0: ftp://ftp.gnupg.org/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2 +#Source1: ftp://ftp.gnupg.org/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2.sig Source2: wk@g10code.com -Patch0: libgcrypt-1.4.0-randinit.patch +Source3: hobble-libgcrypt +Patch1: libgcrypt-1.4.4-fips-no-access.patch + +# Technically LGPLv2.1+, but Fedora's table doesn't draw a distinction. License: LGPLv2+ -Summary: A general-purpose cryptography library. +Summary: A general-purpose cryptography library BuildRoot: %{_tmppath}/%{name}-%{version}-root -BuildRequires: gawk libgpg-error-devel pkgconfig +BuildRequires: gawk, libgpg-error-devel >= 1.4, pkgconfig Group: System Environment/Libraries %package devel @@ -29,15 +36,17 @@ applications using libgcrypt. %prep %setup -q -%patch0 -p0 -b .randinit +%{SOURCE3} +%patch1 -p1 -b .no-access %build %configure --disable-static \ %ifarch sparc64 --disable-asm \ %endif - --enable-noexecstack -make + --enable-noexecstack \ + --enable-pubkey-ciphers='dsa elgamal rsa' +make %{?_smp_mflags} %check make check @@ -84,6 +93,10 @@ popd /sbin/ldconfig -n $RPM_BUILD_ROOT/%{_lib}/ rm -f $RPM_BUILD_ROOT/root_marker +# Create /etc/gcrypt (hardwired, not dependent on the configure invocation) so +# that _someone_ owns it. +mkdir -p -m 755 $RPM_BUILD_ROOT/etc/gcrypt + %clean rm -fr $RPM_BUILD_ROOT @@ -103,6 +116,7 @@ exit 0 %files %defattr(-,root,root) +%dir /etc/gcrypt /%{_lib}/*.so.* #%{_libdir}/%{name} @@ -110,6 +124,7 @@ exit 0 %defattr(-,root,root) %{_bindir}/%{name}-config %{_bindir}/dumpsexp +%{_bindir}/hmac256 %{_includedir}/* %{_libdir}/*.so %{_datadir}/aclocal/* @@ -118,9 +133,31 @@ exit 0 %{_infodir}/gcrypt.info* %changelog -* Tue Oct 14 2008 Dennis Gilmore 1.4.0-4 +* Fri Jan 30 2009 Tomas Mraz 1.4.4-1 +- update to 1.4.4 +- do not abort when the fips mode kernel flag is inaccessible + due to permissions (#470219) +- hobble the library to drop the ECC support + +* Mon Oct 20 2008 Dennis Gilmore 1.4.3-2 - disable asm on sparc64 +* Thu Sep 18 2008 Nalin Dahyabhai 1.4.3-1 +- update to 1.4.3 +- own /etc/gcrypt + +* Mon Sep 15 2008 Nalin Dahyabhai +- invoke make with %%{?_smp_mflags} to build faster on multi-processor + systems (Steve Grubb) + +* Mon Sep 8 2008 Nalin Dahyabhai 1.4.2-1 +- update to 1.4.2 + +* Tue Apr 29 2008 Nalin Dahyabhai 1.4.1-1 +- update to 1.4.1 +- bump libgpgerror-devel requirement to 1.4, matching the requirement enforced + by the configure script + * Thu Apr 3 2008 Joe Orton 1.4.0-3 - add patch from upstream to fix severe performance regression in entropy gathering diff --git a/sources b/sources index d1ea17a..04b5ae2 100644 --- a/sources +++ b/sources @@ -1,2 +1 @@ -b013f798a1088afb07336bce5a9c24c5 libgcrypt-1.4.0.tar.bz2 -43e1b54d34732709bbec024512224450 libgcrypt-1.4.0.tar.bz2.sig +12d3fec91c663b541d63e34eabddacc5 libgcrypt-1.4.4-hobbled.tar.bz2 From dfed2c2618b7335af77e2c5926fd9e27b705ee48 Mon Sep 17 00:00:00 2001 From: Bill Nottingham Date: Thu, 26 Nov 2009 01:47:43 +0000 Subject: [PATCH 4/5] Fix typo that causes a failure to update the common directory. (releng #2781) --- Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index 4de825d..58eb767 100644 --- a/Makefile +++ b/Makefile @@ -1,10 +1,10 @@ # Makefile for source rpm: libgcrypt -# $Id: Makefile,v 1.1 2004/09/09 07:25:33 cvsdist Exp $ +# $Id: Makefile,v 1.2 2007/10/15 19:00:34 notting Exp $ NAME := libgcrypt SPECFILE = $(firstword $(wildcard *.spec)) define find-makefile-common -for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done +for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$d/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done endef MAKEFILE_COMMON := $(shell $(find-makefile-common)) From 3b53c474c980c38e7cde98ab2a55cd490b59610f Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 28 Jul 2010 20:58:59 +0000 Subject: [PATCH 5/5] dist-git conversion --- .cvsignore => .gitignore | 0 Makefile | 21 --------------------- branch | 1 - 3 files changed, 22 deletions(-) rename .cvsignore => .gitignore (100%) delete mode 100644 Makefile delete mode 100644 branch diff --git a/.cvsignore b/.gitignore similarity index 100% rename from .cvsignore rename to .gitignore diff --git a/Makefile b/Makefile deleted file mode 100644 index 58eb767..0000000 --- a/Makefile +++ /dev/null @@ -1,21 +0,0 @@ -# Makefile for source rpm: libgcrypt -# $Id: Makefile,v 1.2 2007/10/15 19:00:34 notting Exp $ -NAME := libgcrypt -SPECFILE = $(firstword $(wildcard *.spec)) - -define find-makefile-common -for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$d/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done -endef - -MAKEFILE_COMMON := $(shell $(find-makefile-common)) - -ifeq ($(MAKEFILE_COMMON),) -# attempt a checkout -define checkout-makefile-common -test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2 -endef - -MAKEFILE_COMMON := $(shell $(checkout-makefile-common)) -endif - -include $(MAKEFILE_COMMON) diff --git a/branch b/branch deleted file mode 100644 index 1c26f78..0000000 --- a/branch +++ /dev/null @@ -1 +0,0 @@ -F-9