From 5f28c0a7f0829efa11968a3d4fabfd0460979cb1 Mon Sep 17 00:00:00 2001 From: Jakub Jelen Date: Tue, 13 May 2025 10:25:59 +0200 Subject: [PATCH 1/4] 1.11.1-1 --- .gitignore | 2 + ...e-SHA3-s390x-acceleration-for-CSHAKE.patch | 63 ---- libgcrypt-1.11.0-cf-protection.patch | 328 ------------------ libgcrypt-1.11.0-marvin.patch | 13 +- libgcrypt-1.11.0-pac-bti-protection.patch | 229 ------------ libgcrypt.spec | 20 +- sources | 4 +- 7 files changed, 18 insertions(+), 641 deletions(-) delete mode 100644 libgcrypt-1.11.0-Disable-SHA3-s390x-acceleration-for-CSHAKE.patch delete mode 100644 libgcrypt-1.11.0-cf-protection.patch delete mode 100644 libgcrypt-1.11.0-pac-bti-protection.patch diff --git a/.gitignore b/.gitignore index 069ccb4..544f5c1 100644 --- a/.gitignore +++ b/.gitignore @@ -38,3 +38,5 @@ libgcrypt-1.4.5-hobbled.tar.bz2 /libgcrypt-1.10.3.tar.bz2.sig /libgcrypt-1.11.0.tar.bz2 /libgcrypt-1.11.0.tar.bz2.sig +/libgcrypt-1.11.1.tar.bz2 +/libgcrypt-1.11.1.tar.bz2.sig diff --git a/libgcrypt-1.11.0-Disable-SHA3-s390x-acceleration-for-CSHAKE.patch b/libgcrypt-1.11.0-Disable-SHA3-s390x-acceleration-for-CSHAKE.patch deleted file mode 100644 index 0267ea0..0000000 --- a/libgcrypt-1.11.0-Disable-SHA3-s390x-acceleration-for-CSHAKE.patch +++ /dev/null @@ -1,63 +0,0 @@ -From 2486d9b5ae015c1786cb84466a751da4bc0d7122 Mon Sep 17 00:00:00 2001 -From: Jussi Kivilinna -Date: Thu, 20 Jun 2024 20:10:09 +0300 -Subject: [PATCH] Disable SHA3 s390x acceleration for CSHAKE - -* cipher/keccak.c (keccak_final_s390x): Add assert check for -expected SHAKE suffix. -(_gcry_cshake_customize, cshake_hash_buffers): Disable s390x -acceleration when selecting CSHAKE suffix. --- - -Signed-off-by: Jussi Kivilinna ---- - cipher/keccak.c | 16 ++++++++++++++-- - 1 file changed, 14 insertions(+), 2 deletions(-) - -diff --git a/cipher/keccak.c b/cipher/keccak.c -index aaf83a62..44cc9f71 100644 ---- a/cipher/keccak.c -+++ b/cipher/keccak.c -@@ -745,6 +745,8 @@ keccak_final_s390x (void *context) - } - else - { -+ gcry_assert(ctx->suffix == SHAKE_DELIMITED_SUFFIX); -+ - klmd_shake_execute (ctx->kimd_func, &ctx->state, NULL, 0, ctx->buf, - ctx->count); - ctx->count = 0; -@@ -1497,9 +1499,14 @@ _gcry_cshake_customize (void *context, struct gcry_cshake_customization *p) - /* No customization */ - return 0; - -+ ctx->suffix = CSHAKE_DELIMITED_SUFFIX; -+#ifdef USE_S390X_CRYPTO -+ /* CSHAKE suffix is not supported by s390x/kimd. */ -+ ctx->kimd_func = 0; -+#endif -+ - len_written = cshake_input_n (ctx, p->n, p->n_len); - cshake_input_s (ctx, p->s, p->s_len, len_written); -- ctx->suffix = CSHAKE_DELIMITED_SUFFIX; - return 0; - } - -@@ -1536,9 +1543,14 @@ cshake_hash_buffers (const gcry_md_spec_t *spec, void *outbuf, size_t nbytes, - size_t s_len = iov[1].len; - size_t len; - -+ ctx.suffix = CSHAKE_DELIMITED_SUFFIX; -+#ifdef USE_S390X_CRYPTO -+ /* CSHAKE suffix is not supported by s390x/kimd. */ -+ ctx.kimd_func = 0; -+#endif -+ - len = cshake_input_n (&ctx, n, n_len); - cshake_input_s (&ctx, s, s_len, len); -- ctx.suffix = CSHAKE_DELIMITED_SUFFIX; - } - iovcnt -= 2; - iov += 2; --- -2.43.0 diff --git a/libgcrypt-1.11.0-cf-protection.patch b/libgcrypt-1.11.0-cf-protection.patch deleted file mode 100644 index ece660e..0000000 --- a/libgcrypt-1.11.0-cf-protection.patch +++ /dev/null @@ -1,328 +0,0 @@ -From 7ee2e73495d051ca09dd57c90132a7a9cc53bc62 Mon Sep 17 00:00:00 2001 -From: Jussi Kivilinna -Date: Fri, 26 Jul 2024 11:00:30 +0300 -Subject: [PATCH] asm-common-amd64: add missing CFI directives for large memory - model code - -* cipher/asm-common-amd64.h [__code_model_large__] -(GET_EXTERN_POINTER): Add CFI_PUSH/CFI_POP directives. --- - -Signed-off-by: Jussi Kivilinna ---- - cipher/asm-common-amd64.h | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/cipher/asm-common-amd64.h b/cipher/asm-common-amd64.h -index 870fef9a..3fa065e8 100644 ---- a/cipher/asm-common-amd64.h -+++ b/cipher/asm-common-amd64.h -@@ -59,14 +59,18 @@ - # ifdef __code_model_large__ - # define GET_EXTERN_POINTER(name, reg) \ - pushq %r15; \ -+ CFI_PUSH(%r15); \ - pushq %r14; \ -+ CFI_PUSH(%r14); \ - 1: leaq 1b(%rip), reg; \ - movabsq $_GLOBAL_OFFSET_TABLE_-1b, %r14; \ - movabsq $name@GOT, %r15; \ - addq %r14, reg; \ - popq %r14; \ -+ CFI_POP(%r14); \ - movq (reg, %r15), reg; \ -- popq %r15; -+ popq %r15; \ -+ CFI_POP(%r15); - # else - # define GET_EXTERN_POINTER(name, reg) movq name@GOTPCREL(%rip), reg - # endif --- -2.45.2 - -From dd42a4e03e066c49a6d83e0d3a07e4261d77121a Mon Sep 17 00:00:00 2001 -From: Jussi Kivilinna -Date: Sat, 27 Jul 2024 08:16:56 +0300 -Subject: [PATCH] Do not build i386 assembly on x86-64 - -* configure.ac: Enable building i386 "rijndael-vaes" only -on i?86 host instead of x86 MPI arch ("i?86 + x86-64"). --- - -GnuPG-bug-id: 7220 -Signed-off-by: Jussi Kivilinna ---- - configure.ac | 9 +++++---- - 1 file changed, 5 insertions(+), 4 deletions(-) - -diff --git a/configure.ac b/configure.ac -index d3dffb4b..1e182552 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -3025,6 +3025,11 @@ if test "$found" = "1" ; then - AC_DEFINE(USE_AES, 1, [Defined if this module should be included]) - - case "${host}" in -+ i?86-*-*) -+ # Build with the VAES/AVX2 implementation -+ GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS rijndael-vaes-i386.lo" -+ GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS rijndael-vaes-avx2-i386.lo" -+ ;; - x86_64-*-*) - # Build with the assembly implementation - GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS rijndael-amd64.lo" -@@ -3089,10 +3094,6 @@ if test "$found" = "1" ; then - - # Build with the Padlock implementation - GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS rijndael-padlock.lo" -- -- # Build with the VAES/AVX2 implementation -- GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS rijndael-vaes-i386.lo" -- GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS rijndael-vaes-avx2-i386.lo" - ;; - esac - fi --- -2.45.2 - -From 5797d75e3b916caf504bed73a8629c6c168be58d Mon Sep 17 00:00:00 2001 -From: Jussi Kivilinna -Date: Sat, 27 Jul 2024 08:50:57 +0300 -Subject: [PATCH] Do not build amd64 assembly on i386 - -* configure.ac: Build "serpent-avx2-amd64" and -"camellia-*-amd64" only on x86-64. --- - -GnuPG-bug-id: 7220 -Signed-off-by: Jussi Kivilinna ---- - configure.ac | 50 +++++++++++++++++++++++++++----------------------- - 1 file changed, 27 insertions(+), 23 deletions(-) - -diff --git a/configure.ac b/configure.ac -index 1e182552..191aa38d 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -3133,14 +3133,14 @@ if test "$found" = "1" ; then - x86_64-*-*) - # Build with the SSE2 implementation - GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS serpent-sse2-amd64.lo" -+ -+ if test x"$avx2support" = xyes ; then -+ # Build with the AVX2 implementation -+ GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS serpent-avx2-amd64.lo" -+ fi - ;; - esac - -- if test x"$avx2support" = xyes ; then -- # Build with the AVX2 implementation -- GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS serpent-avx2-amd64.lo" -- fi -- - if test x"$avx512support" = xyes ; then - # Build with the AVX512 implementation - GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS serpent-avx512-x86.lo" -@@ -3186,28 +3186,32 @@ if test "$found" = "1" ; then - ;; - esac - -- if test x"$avxsupport" = xyes ; then -- if test x"$aesnisupport" = xyes ; then -- # Build with the AES-NI/AVX implementation -- GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS camellia-aesni-avx-amd64.lo" -- fi -- fi -+ case "${host}" in -+ x86_64-*-*) -+ if test x"$avxsupport" = xyes ; then -+ if test x"$aesnisupport" = xyes ; then -+ # Build with the AES-NI/AVX implementation -+ GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS camellia-aesni-avx-amd64.lo" -+ fi -+ fi - -- if test x"$avx2support" = xyes ; then -- if test x"$aesnisupport" = xyes ; then -- # Build with the AES-NI/AVX2 implementation -- GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS camellia-aesni-avx2-amd64.lo" -+ if test x"$avx2support" = xyes ; then -+ if test x"$aesnisupport" = xyes ; then -+ # Build with the AES-NI/AVX2 implementation -+ GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS camellia-aesni-avx2-amd64.lo" - -- # Build with the VAES/AVX2 implementation -- GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS camellia-vaes-avx2-amd64.lo" -+ # Build with the VAES/AVX2 implementation -+ GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS camellia-vaes-avx2-amd64.lo" - -- # Build with the GFNI/AVX2 implementation -- GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS camellia-gfni-avx2-amd64.lo" -+ # Build with the GFNI/AVX2 implementation -+ GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS camellia-gfni-avx2-amd64.lo" - -- # Build with the GFNI/AVX512 implementation -- GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS camellia-gfni-avx512-amd64.lo" -- fi -- fi -+ # Build with the GFNI/AVX512 implementation -+ GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS camellia-gfni-avx512-amd64.lo" -+ fi -+ fi -+ ;; -+ esac - fi - - LIST_MEMBER(idea, $enabled_ciphers) --- -2.45.2 - -From d69e6a29b986cf1cb21e09d337a0de2564ef34f2 Mon Sep 17 00:00:00 2001 -From: Jussi Kivilinna -Date: Fri, 26 Jul 2024 10:59:12 +0300 -Subject: [PATCH] Add CET support for x86-64 assembly - -* cipher/asm-common-amd64.h (ENDBRANCH): New. -(CFI_STARTPROC): Add ENDBRANCH. -[__CET__] (note.gnu.property): Add CET property section. --- - -GnuPG-bug-id: 7220 -Signed-off-by: Jussi Kivilinna ---- - cipher/asm-common-amd64.h | 30 ++++++++++++++++++++++++++++-- - 1 file changed, 28 insertions(+), 2 deletions(-) - -diff --git a/cipher/asm-common-amd64.h b/cipher/asm-common-amd64.h -index 3fa065e8..465ef62b 100644 ---- a/cipher/asm-common-amd64.h -+++ b/cipher/asm-common-amd64.h -@@ -76,9 +76,15 @@ - # endif - #endif - -+#ifdef __CET__ -+#define ENDBRANCH endbr64 -+#else -+#define ENDBRANCH /*_*/ -+#endif -+ - #ifdef HAVE_GCC_ASM_CFI_DIRECTIVES - /* CFI directives to emit DWARF stack unwinding information. */ --# define CFI_STARTPROC() .cfi_startproc -+# define CFI_STARTPROC() .cfi_startproc; ENDBRANCH - # define CFI_ENDPROC() .cfi_endproc - # define CFI_REMEMBER_STATE() .cfi_remember_state - # define CFI_RESTORE_STATE() .cfi_restore_state -@@ -146,7 +152,7 @@ - DW_SLEB128_28BIT(rsp_offs) - - #else --# define CFI_STARTPROC() -+# define CFI_STARTPROC() ENDBRANCH - # define CFI_ENDPROC() - # define CFI_REMEMBER_STATE() - # define CFI_RESTORE_STATE() -@@ -214,4 +220,24 @@ - vpopcntb xmm16, xmm16; /* Supported only by newer AVX512 CPUs. */ \ - vpxord ymm16, ymm16, ymm16; - -+#ifdef __CET__ -+/* Generate CET property for all assembly files including this header. */ -+ELF(.section .note.gnu.property,"a") -+ELF(.align 8) -+ELF(.long 1f - 0f) -+ELF(.long 4f - 1f) -+ELF(.long 5) -+ELF(0:) -+ELF(.byte 0x47, 0x4e, 0x55, 0) /* string "GNU" */ -+ELF(1:) -+ELF(.align 8) -+ELF(.long 0xc0000002) -+ELF(.long 3f - 2f) -+ELF(2:) -+ELF(.long 0x3) -+ELF(3:) -+ELF(.align 8) -+ELF(4:) -+#endif -+ - #endif /* GCRY_ASM_COMMON_AMD64_H */ --- -2.45.2 - -From 64ec13d11b08fbe31cc6f83e9464e7e251d41019 Mon Sep 17 00:00:00 2001 -From: Jussi Kivilinna -Date: Fri, 26 Jul 2024 11:09:37 +0300 -Subject: [PATCH] Add CET support for i386 assembly - -* cipher/asm-common-i386.h (ENDBRANCH): New. -(CFI_STARTPROC): Add ENDBRANCH. -[__CET__] (note.gnu.property): Add CET property section. --- - -GnuPG-bug-id: 7220 -Signed-off-by: Jussi Kivilinna ---- - cipher/asm-common-i386.h | 30 ++++++++++++++++++++++++++++-- - 1 file changed, 28 insertions(+), 2 deletions(-) - -diff --git a/cipher/asm-common-i386.h b/cipher/asm-common-i386.h -index d746ebc4..346a8ff2 100644 ---- a/cipher/asm-common-i386.h -+++ b/cipher/asm-common-i386.h -@@ -59,9 +59,15 @@ - movl name##@GOT(%reg), %reg; - #endif - -+#ifdef __CET__ -+#define ENDBRANCH endbr32 -+#else -+#define ENDBRANCH /*_*/ -+#endif -+ - #ifdef HAVE_GCC_ASM_CFI_DIRECTIVES - /* CFI directives to emit DWARF stack unwinding information. */ --# define CFI_STARTPROC() .cfi_startproc -+# define CFI_STARTPROC() .cfi_startproc; ENDBRANCH - # define CFI_ENDPROC() .cfi_endproc - # define CFI_REMEMBER_STATE() .cfi_remember_state - # define CFI_RESTORE_STATE() .cfi_restore_state -@@ -121,7 +127,7 @@ - DW_SLEB128_28BIT(esp_offs) - - #else --# define CFI_STARTPROC() -+# define CFI_STARTPROC() ENDBRANCH - # define CFI_ENDPROC() - # define CFI_REMEMBER_STATE() - # define CFI_RESTORE_STATE() -@@ -158,4 +164,24 @@ - vpopcntb xmm7, xmm7; /* Supported only by newer AVX512 CPUs. */ \ - vpxord ymm7, ymm7, ymm7; - -+#ifdef __CET__ -+/* Generate CET property for all assembly files including this header. */ -+ELF(.section .note.gnu.property,"a") -+ELF(.align 4) -+ELF(.long 1f - 0f) -+ELF(.long 4f - 1f) -+ELF(.long 5) -+ELF(0:) -+ELF(.byte 0x47, 0x4e, 0x55, 0) /* string "GNU" */ -+ELF(1:) -+ELF(.align 4) -+ELF(.long 0xc0000002) -+ELF(.long 3f - 2f) -+ELF(2:) -+ELF(.long 0x3) -+ELF(3:) -+ELF(.align 4) -+ELF(4:) -+#endif -+ - #endif /* GCRY_ASM_COMMON_AMD64_H */ --- -2.45.2 - diff --git a/libgcrypt-1.11.0-marvin.patch b/libgcrypt-1.11.0-marvin.patch index d2998f0..78b6809 100644 --- a/libgcrypt-1.11.0-marvin.patch +++ b/libgcrypt-1.11.0-marvin.patch @@ -759,17 +759,17 @@ index 245967eb..74055a4b 100644 static inline size_t ct_lt_s (size_t a, size_t b) @@ -112,6 +121,7 @@ unsigned int _gcry_ct_memequal (const void *b1, const void *b2, size_t len); - #endif DEFINE_CT_TYPE_GEN_MASK(uintptr, uintptr_t) DEFINE_CT_TYPE_GEN_MASK(ulong, unsigned long) + DEFINE_CT_TYPE_GEN_MASK(int16, int16_t) +DEFINE_CT_TYPE_GEN_MASK(uchar, unsigned char) /* * Return all bits set if A is 0 and return 1 otherwise. @@ -137,6 +147,7 @@ DEFINE_CT_TYPE_GEN_MASK(int16, int16_t) - #endif DEFINE_CT_TYPE_GEN_INV_MASK(uintptr, uintptr_t) DEFINE_CT_TYPE_GEN_INV_MASK(ulong, unsigned long) + DEFINE_CT_TYPE_GEN_INV_MASK(int16, int16_t) +DEFINE_CT_TYPE_GEN_INV_MASK(uchar, unsigned char) /* @@ -1582,9 +1582,9 @@ index 74055a4b..5e656e15 100644 static inline size_t @@ -164,6 +164,7 @@ DEFINE_CT_TYPE_GEN_INV_MASK(uchar, unsigned char) - } DEFINE_CT_TYPE_SELECT_FUNC(uintptr, uintptr_t) DEFINE_CT_TYPE_SELECT_FUNC(ulong, unsigned long) + DEFINE_CT_TYPE_SELECT_FUNC(int16, int16_t) +DEFINE_CT_TYPE_SELECT_FUNC(uchar, unsigned char) /* @@ -1969,7 +1969,7 @@ index ab070a94..a2153728 100644 { show_sexp ("sign result:\n", sig); fail ("mismatch in gcry_pk_sign\n"); -@@ -429,45 +431,89 @@ check_v15crypt (void) +@@ -429,44 +431,89 @@ check_v15crypt (void) size_t mesg_len, seed_len, encr_len; gcry_sexp_t plain, ciph; @@ -2018,7 +2018,7 @@ index ab070a94..a2153728 100644 + } - err = gcry_sexp_build (&plain, NULL, -- "(data (flags pkcs1)(hash-algo sha1)" +- "(data (flags pkcs1)" - "(value %b)(random-override %b))", - (int)mesg_len, mesg, - (int)seed_len, seed); @@ -2076,14 +2076,13 @@ index ab070a94..a2153728 100644 - plain = NULL; - - /* Now test the decryption. */ -- seed = data_from_hex (tbl[tno].m[mno].seed, &seed_len); - encr = data_from_hex (tbl[tno].m[mno].encr, &encr_len); + gcry_sexp_release (ciph); + ciph = NULL; +#endif /* WITH_MARVIN_WORKAROUND */ err = gcry_sexp_build (&ciph, NULL, - "(enc-val (flags pkcs1)(hash-algo sha1)" + "(enc-val (flags pkcs1)" @@ -484,15 +530,19 @@ check_v15crypt (void) } else diff --git a/libgcrypt-1.11.0-pac-bti-protection.patch b/libgcrypt-1.11.0-pac-bti-protection.patch deleted file mode 100644 index 3c713ab..0000000 --- a/libgcrypt-1.11.0-pac-bti-protection.patch +++ /dev/null @@ -1,229 +0,0 @@ -From afdd68b162103820edb72ad170f8ee26f206b396 Mon Sep 17 00:00:00 2001 -From: Jussi Kivilinna -Date: Sun, 4 Aug 2024 18:51:34 +0300 -Subject: [PATCH] Add PAC/BTI support for AArch64 assembly - -* cipher/asm-common-aarch64.h (AARCH64_BTI_PROPERTY_FLAG) -(AARCH64_HINT_BTI_C, AARCH64_PAC_PROPERTY_FLAG) -(note.gnu.property): New. -(CFI_STARTPROC): Add AARCH64_HINT_BTI_C. --- - -GnuPG-bug-id: 7220 -Signed-off-by: Jussi Kivilinna ---- - cipher/asm-common-aarch64.h | 50 +++++++++++++++++++++++++++++++++++-- - 1 file changed, 48 insertions(+), 2 deletions(-) - -diff --git a/cipher/asm-common-aarch64.h b/cipher/asm-common-aarch64.h -index 3a72d7c4..ff65ea6a 100644 ---- a/cipher/asm-common-aarch64.h -+++ b/cipher/asm-common-aarch64.h -@@ -45,9 +45,25 @@ - add reg, reg, #:lo12:name ; - #endif - -+#if defined(__ARM_FEATURE_BTI_DEFAULT) && __ARM_FEATURE_BTI_DEFAULT == 1 -+# define AARCH64_BTI_PROPERTY_FLAG (1 << 0) -+# define AARCH64_HINT_BTI_C \ -+ hint #34 -+#else -+# define AARCH64_BTI_PROPERTY_FLAG 0 /* No BTI */ -+# define AARCH64_HINT_BTI_C /*_*/ -+#endif -+ -+#if defined(__ARM_FEATURE_PAC_DEFAULT) && (__ARM_FEATURE_PAC_DEFAULT & 3) != 0 -+/* PAC enabled, signed with either A or B key. */ -+# define AARCH64_PAC_PROPERTY_FLAG (1 << 1) -+#else -+# define AARCH64_PAC_PROPERTY_FLAG 0 /* No PAC */ -+#endif -+ - #ifdef HAVE_GCC_ASM_CFI_DIRECTIVES - /* CFI directives to emit DWARF stack unwinding information. */ --# define CFI_STARTPROC() .cfi_startproc -+# define CFI_STARTPROC() .cfi_startproc; AARCH64_HINT_BTI_C - # define CFI_ENDPROC() .cfi_endproc - # define CFI_REMEMBER_STATE() .cfi_remember_state - # define CFI_RESTORE_STATE() .cfi_restore_state -@@ -89,7 +105,7 @@ - DW_SLEB128_28BIT(rsp_offs) - - #else --# define CFI_STARTPROC() -+# define CFI_STARTPROC() AARCH64_HINT_BTI_C - # define CFI_ENDPROC() - # define CFI_REMEMBER_STATE() - # define CFI_RESTORE_STATE() -@@ -129,4 +145,34 @@ - ldp d8, d9, [sp], #16; \ - CFI_ADJUST_CFA_OFFSET(-16); - -+#if (AARCH64_BTI_PROPERTY_FLAG | AARCH64_PAC_PROPERTY_FLAG) -+/* Generate PAC/BTI property for all assembly files including this header. -+ * -+ * libgcrypt support these extensions: -+ * - Armv8.3-A Pointer Authentication (PAC): -+ * As currently all AArch64 assembly functions are leaf functions and do -+ * not store/load link register LR, we just mark PAC as supported. -+ * -+ * - Armv8.5-A Branch Target Identification (BTI): -+ * All AArch64 assembly functions get branch target instruction through -+ * CFI_STARTPROC macro. -+ */ -+ELF(.section .note.gnu.property,"a") -+ELF(.balign 8) -+ELF(.long 1f - 0f) -+ELF(.long 4f - 1f) -+ELF(.long 5) -+ELF(0:) -+ELF(.byte 0x47, 0x4e, 0x55, 0) /* string "GNU" */ -+ELF(1:) -+ELF(.balign 8) -+ELF(.long 0xc0000000) -+ELF(.long 3f - 2f) -+ELF(2:) -+ELF(.long (AARCH64_BTI_PROPERTY_FLAG | AARCH64_PAC_PROPERTY_FLAG)) -+ELF(3:) -+ELF(.balign 8) -+ELF(4:) -+#endif -+ - #endif /* GCRY_ASM_COMMON_AARCH64_H */ --- -2.43.0 - -From 07706d69f238f6a3bfc3f74145686a02decbee9c Mon Sep 17 00:00:00 2001 -From: Jussi Kivilinna -Date: Mon, 5 Aug 2024 20:18:05 +0300 -Subject: [PATCH] Do not build 32-bit ARM assembly on Aarch64 - -* configure.ac: Build "serpent-armv7-neon", "salsa20-armv7-neon", -"chacha20-armv7-neon", "sha512-armv7-neon" and "keccak-armv7-neon" -only on 32-bit ARM. --- - -GnuPG-bug-id: 7220 -Signed-off-by: Jussi Kivilinna ---- - configure.ac | 54 ++++++++++++++++++++++++++++------------------------ - 1 file changed, 29 insertions(+), 25 deletions(-) - -diff --git a/configure.ac b/configure.ac -index 191aa38d..2b6ddb7b 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -3139,17 +3139,18 @@ if test "$found" = "1" ; then - GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS serpent-avx2-amd64.lo" - fi - ;; -+ arm*-*-*) -+ if test x"$neonsupport" = xyes ; then -+ # Build with the NEON implementation -+ GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS serpent-armv7-neon.lo" -+ fi -+ ;; - esac - - if test x"$avx512support" = xyes ; then - # Build with the AVX512 implementation - GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS serpent-avx512-x86.lo" - fi -- -- if test x"$neonsupport" = xyes ; then -- # Build with the NEON implementation -- GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS serpent-armv7-neon.lo" -- fi - fi - - LIST_MEMBER(rfc2268, $enabled_ciphers) -@@ -3230,12 +3231,13 @@ if test "$found" = "1" ; then - # Build with the assembly implementation - GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS salsa20-amd64.lo" - ;; -+ arm*-*-*) -+ if test x"$neonsupport" = xyes ; then -+ # Build with the NEON implementation -+ GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS salsa20-armv7-neon.lo" -+ fi -+ ;; - esac -- -- if test x"$neonsupport" = xyes ; then -- # Build with the NEON implementation -- GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS salsa20-armv7-neon.lo" -- fi - fi - - LIST_MEMBER(gost28147, $enabled_ciphers) -@@ -3256,6 +3258,12 @@ if test "$found" = "1" ; then - GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS chacha20-amd64-avx2.lo" - GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS chacha20-amd64-avx512.lo" - ;; -+ arm*-*-*) -+ if test x"$neonsupport" = xyes ; then -+ # Build with the NEON implementation -+ GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS chacha20-armv7-neon.lo" -+ fi -+ ;; - aarch64-*-*) - # Build with the assembly implementation - GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS chacha20-aarch64.lo" -@@ -3282,11 +3290,6 @@ if test "$found" = "1" ; then - GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS chacha20-s390x.lo" - ;; - esac -- -- if test x"$neonsupport" = xyes ; then -- # Build with the NEON implementation -- GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS chacha20-armv7-neon.lo" -- fi - fi - - LIST_MEMBER(sm4, $enabled_ciphers) -@@ -3491,6 +3494,11 @@ if test "$found" = "1" ; then - arm*-*-*) - # Build with the assembly implementation - GCRYPT_ASM_DIGESTS="$GCRYPT_ASM_DIGESTS sha512-arm.lo" -+ -+ if test x"$neonsupport" = xyes ; then -+ # Build with the NEON implementation -+ GCRYPT_ASM_DIGESTS="$GCRYPT_ASM_DIGESTS sha512-armv7-neon.lo" -+ fi - ;; - aarch64-*-*) - # Build with the assembly implementation -@@ -3510,11 +3518,6 @@ if test "$found" = "1" ; then - # Build with the crypto extension implementation - GCRYPT_ASM_DIGESTS="$GCRYPT_ASM_DIGESTS sha512-ppc.lo" - esac -- -- if test x"$neonsupport" = xyes ; then -- # Build with the NEON implementation -- GCRYPT_ASM_DIGESTS="$GCRYPT_ASM_DIGESTS sha512-armv7-neon.lo" -- fi - fi - - LIST_MEMBER(sha3, $enabled_digests) -@@ -3527,12 +3530,13 @@ if test "$found" = "1" ; then - # Build with the assembly implementation - GCRYPT_ASM_DIGESTS="$GCRYPT_ASM_DIGESTS keccak-amd64-avx512.lo" - ;; -+ arm*-*-*) -+ if test x"$neonsupport" = xyes ; then -+ # Build with the NEON implementation -+ GCRYPT_ASM_DIGESTS="$GCRYPT_ASM_DIGESTS keccak-armv7-neon.lo" -+ fi -+ ;; - esac -- -- if test x"$neonsupport" = xyes ; then -- # Build with the NEON implementation -- GCRYPT_ASM_DIGESTS="$GCRYPT_ASM_DIGESTS keccak-armv7-neon.lo" -- fi - fi - - LIST_MEMBER(tiger, $enabled_digests) --- -2.43.0 - diff --git a/libgcrypt.spec b/libgcrypt.spec index eb5c8cb..4e539f6 100644 --- a/libgcrypt.spec +++ b/libgcrypt.spec @@ -14,19 +14,14 @@ print(string.sub(hash, 0, 16)) } Name: libgcrypt -Version: 1.11.0 -Release: 5%{?dist} +Version: 1.11.1 +Release: 1%{?dist} URL: https://www.gnupg.org/ Source0: https://www.gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2 Source1: https://www.gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2.sig Source2: https://gnupg.org/signature_key.asc # Pass the annobin flags to the libgcrypt.so (#2016349) Patch1: libgcrypt-1.10.1-annobin.patch -# https://dev.gnupg.org/T7167 -Patch2: libgcrypt-1.11.0-Disable-SHA3-s390x-acceleration-for-CSHAKE.patch -# https://dev.gnupg.org/T7220 -Patch3: libgcrypt-1.11.0-cf-protection.patch -Patch4: libgcrypt-1.11.0-pac-bti-protection.patch # https://gitlab.com/redhat-crypto/libgcrypt/libgcrypt-mirror/-/merge_requests/19/ Patch5: libgcrypt-1.11.0-marvin.patch @@ -64,9 +59,6 @@ applications using libgcrypt. %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}' %setup -q %patch 1 -p1 -%patch 2 -p1 -%patch 3 -p1 -%patch 4 -p1 %patch 5 -p1 %build @@ -98,10 +90,11 @@ make check # try in faked FIPS mode too LIBGCRYPT_FORCE_FIPS_MODE=1 make check -PROFILE=%{?dist} annocheck --ignore-unknown --verbose --profile=${PROFILE:1} $RPM_BUILD_ROOT%{gcrylibdir}/libgcrypt.so.20.5.0 +%define libpath $RPM_BUILD_ROOT%{gcrylibdir}/%{gcrysoname}.?.? + +PROFILE=%{?dist} annocheck --ignore-unknown --verbose --profile=${PROFILE:1} %{libpath} # Add generation of HMAC checksums of the final stripped binaries -%define libpath $RPM_BUILD_ROOT%{gcrylibdir}/%{gcrysoname}.?.? %define __spec_install_post \ %{?__debug_package:%{__debug_install_post}} \ %{__arch_install_post} \ @@ -181,6 +174,9 @@ mkdir -p -m 755 $RPM_BUILD_ROOT/etc/gcrypt %license COPYING %changelog +* Tue May 13 2025 Jakub Jelen - 1.11.1-1 +- New upstream release (#2364878) + * Fri Jan 17 2025 Fedora Release Engineering - 1.11.0-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild diff --git a/sources b/sources index 4ef369d..a713620 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (libgcrypt-1.11.0.tar.bz2) = 8e093e69e3c45d30838625ca008e995556f0d5b272de1c003d44ef94633bcc0d0ef5d95e8725eb531bfafb4490ac273488633e0c801200d4666194f86c3e270e -SHA512 (libgcrypt-1.11.0.tar.bz2.sig) = 8c5ceb50d70ccdedcc1ff4b31a65a07198567b85f582e3e67699cc3e5d012bebf7b1d4903652d11905a9cd845976ad7d3642474804777d0bdc46c6847d92fe38 +SHA512 (libgcrypt-1.11.1.tar.bz2) = 85846d62ce785e4250a2bf8a2b13ec24837e48ab8e10d537ad4a18d650d2cca747f82fd1501feab47ad3114b9593b36c9fa7a892f48139e2a71ef61295a47678 +SHA512 (libgcrypt-1.11.1.tar.bz2.sig) = a9b9e2466f32623f417574537656f776baf9a933fba96fd969dda26b6bf13864ee5765112654b269f79a7f20a4a0712cf8cec7be759966088045bca040e01edc From 891b7aeee36921d11a6a54959d7be5c3db613b1d Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 24 Jul 2025 19:41:03 +0000 Subject: [PATCH 2/4] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- libgcrypt.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libgcrypt.spec b/libgcrypt.spec index 4e539f6..c4fac5c 100644 --- a/libgcrypt.spec +++ b/libgcrypt.spec @@ -15,7 +15,7 @@ print(string.sub(hash, 0, 16)) Name: libgcrypt Version: 1.11.1 -Release: 1%{?dist} +Release: 2%{?dist} URL: https://www.gnupg.org/ Source0: https://www.gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2 Source1: https://www.gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2.sig @@ -174,6 +174,9 @@ mkdir -p -m 755 $RPM_BUILD_ROOT/etc/gcrypt %license COPYING %changelog +* Thu Jul 24 2025 Fedora Release Engineering - 1.11.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Tue May 13 2025 Jakub Jelen - 1.11.1-1 - New upstream release (#2364878) From baffb13bdca386a97d06e7e8f758bbe182e4ba31 Mon Sep 17 00:00:00 2001 From: Jakub Jelen Date: Tue, 29 Jul 2025 12:52:21 +0200 Subject: [PATCH 3/4] Migrate STI tests to fmf + update the test to actually work Resolves: #2382944 --- .fmf/version | 1 + tests/smoke-test/main.fmf | 25 +++++++++++++++++++++++ tests/smoke-test/runtest.sh | 40 ++++++++++++++++--------------------- tests/tests.yml | 20 ------------------- 4 files changed, 43 insertions(+), 43 deletions(-) create mode 100644 .fmf/version create mode 100644 tests/smoke-test/main.fmf delete mode 100644 tests/tests.yml diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/tests/smoke-test/main.fmf b/tests/smoke-test/main.fmf new file mode 100644 index 0000000..70bd1ba --- /dev/null +++ b/tests/smoke-test/main.fmf @@ -0,0 +1,25 @@ +summary: Test calls upstream test suite. +test: ./runtest.sh +enabled: true +framework: beakerlib +require: + - library(distribution/fips) +recommend: + - libgcrypt + - nfs-utils + - rpm-build + - autoconf + - automake + - libtool + - gawk + - gcc-c++ + - libgpg-error-devel + - pkgconfig + - texinfo + - fipscheck + - libkcapi-fipscheck + - crypto-policies-scripts + - bc + - annobin-annocheck + - gnupg2 +duration: 45m diff --git a/tests/smoke-test/runtest.sh b/tests/smoke-test/runtest.sh index ddd0182..0f5bc82 100755 --- a/tests/smoke-test/runtest.sh +++ b/tests/smoke-test/runtest.sh @@ -54,41 +54,35 @@ rlJournalStart rlRun "pushd $TOPDIR" 0 rlRun "rm -rf BUILD/libgcrypt-*" 0-255 rlRun "rpmbuild -vv -bc SPECS/libgcrypt.spec" 0 - rlRun "pushd BUILD/libgcrypt-*" 0 + libgcrypt_dir="libgcrypt-`rpm -q --qf "%{VERSION}\n" libgcrypt | head -1`" + if [ -d "BUILD/$libgcrypt_dir-build" ]; then + BUILDDIR="BUILD/$libgcrypt_dir-build/$libgcrypt_dir" + else + BUILDDIR="BUILD/$libgcrypt_dir" + fi + rlRun "pushd $BUILDDIR" 0 rlRun "fipshmac src/.libs/libgcrypt.so.??" 0 rlRun "popd" rlRun "popd" rlPhaseEnd rlPhaseStartTest "Upstream testsuite" - rlRun "pushd $TOPDIR/BUILD/libgcrypt-*" 0 + rlRun "pushd $TOPDIR/$BUILDDIR" 0 exp_fails=() - if [[ $fipsMode = 'enabled' ]]; then - if rlIsFedora 33; then - exp_fails+=("basic") - exp_fails+=("basic-disable-all-hwf") - exp_fails+=("t-kdf") - exp_fails+=("t-secmem") - elif rlIsFedora 34; then - exp_fails+=("basic") - exp_fails+=("basic-disable-all-hwf") - exp_fails+=("t-kdf") - exp_fails+=("t-secmem") - exp_fails+=("t-x448") - elif rlIsFedora 35; then # Fedora-35 - exp_fails+=("curves") - fi - fi + rlRun "echo 'Expecting ${#exp_fails[@]} fails'" exp_exitcode=0 if [[ ${#exp_fails[@]} -gt 0 ]]; then exp_exitcode=2; fi rlRun "make check &> $TmpDir/make_check.out" $exp_exitcode rlRun "grep ^FAIL: $TmpDir/make_check.out" 0,1 "Print fails" if [[ ${#exp_fails[@]} -gt 0 ]]; then - for f in "${exp_fails[@]}"; do - rlAssertGrep "^FAIL: $f\$" $TmpDir/make_check.out + for f in $(grep '^FAIL:' $TmpDir/make_check.out | awk -F ': ' '{print $2}'); do + if [[ "${exp_fails[@]}" =~ "$f" ]]; then + rlLog "$f failure is expected" + else + rlFail "$f failure is not expected" + fi done - [[ $(grep -c '^FAIL:' $TmpDir/make_check.out) -eq ${#exp_fails[@]} ]] || rlFail "Unexpected fails present" else rlRun "grep \"All [0-9]\+ tests passed\" $TmpDir/make_check.out" 0 \ "All tests passed" @@ -119,12 +113,12 @@ rlJournalStart for i in `seq 1 $N_SAMPLES`; do # run with HW optimizations ENAbled rm -f $HWF_DENY_FILE - $TOPDIR/BUILD/libgcrypt-*/tests/bench-slope $alg_type $algorithm |grep "$alg_line" >>$algorithm.ena + $TOPDIR/$BUILDDIR/tests/bench-slope $alg_type $algorithm |grep "$alg_line" >>$algorithm.ena # run with HW optimizations DISabled # this looks idiotic, but I wasn't able to make --disable-hwf work echo "all" >$HWF_DENY_FILE - $TOPDIR/BUILD/libgcrypt-*/tests/bench-slope $dis_arg $alg_type $algorithm |grep "$alg_line" >>$algorithm.dis + $TOPDIR/$BUILDDIR/tests/bench-slope $dis_arg $alg_type $algorithm |grep "$alg_line" >>$algorithm.dis done rlLogInfo "Performance measurements finished" rlRun "cat $algorithm.ena" diff --git a/tests/tests.yml b/tests/tests.yml deleted file mode 100644 index dd115e9..0000000 --- a/tests/tests.yml +++ /dev/null @@ -1,20 +0,0 @@ -- hosts: localhost - tags: - - classic - - container - roles: - - role: standard-test-beakerlib - tests: - - smoke-test - required_packages: - - fipscheck - - gawk - - gcc-c++ - - libgcrypt - - libgpg-error-devel - - libselinux-utils - - nfs-utils - - pkgconfig - - rpm-build - - texinfo - - wget From 42572cdcf22a43f0d0c562e7b9f97d046a9d97e1 Mon Sep 17 00:00:00 2001 From: Jakub Jelen Date: Mon, 3 Nov 2025 10:29:58 +0100 Subject: [PATCH 4/4] 1.11.2-1 --- .gitignore | 2 ++ libgcrypt.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 544f5c1..552f393 100644 --- a/.gitignore +++ b/.gitignore @@ -40,3 +40,5 @@ libgcrypt-1.4.5-hobbled.tar.bz2 /libgcrypt-1.11.0.tar.bz2.sig /libgcrypt-1.11.1.tar.bz2 /libgcrypt-1.11.1.tar.bz2.sig +/libgcrypt-1.11.2.tar.bz2 +/libgcrypt-1.11.2.tar.bz2.sig diff --git a/libgcrypt.spec b/libgcrypt.spec index c4fac5c..23ec779 100644 --- a/libgcrypt.spec +++ b/libgcrypt.spec @@ -14,8 +14,8 @@ print(string.sub(hash, 0, 16)) } Name: libgcrypt -Version: 1.11.1 -Release: 2%{?dist} +Version: 1.11.2 +Release: 1%{?dist} URL: https://www.gnupg.org/ Source0: https://www.gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2 Source1: https://www.gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2.sig @@ -174,6 +174,9 @@ mkdir -p -m 755 $RPM_BUILD_ROOT/etc/gcrypt %license COPYING %changelog +* Mon Nov 03 2025 Jakub Jelen - 1.11.2-1 +- New upstream release (#2406804) + * Thu Jul 24 2025 Fedora Release Engineering - 1.11.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild diff --git a/sources b/sources index a713620..90c992c 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (libgcrypt-1.11.1.tar.bz2) = 85846d62ce785e4250a2bf8a2b13ec24837e48ab8e10d537ad4a18d650d2cca747f82fd1501feab47ad3114b9593b36c9fa7a892f48139e2a71ef61295a47678 -SHA512 (libgcrypt-1.11.1.tar.bz2.sig) = a9b9e2466f32623f417574537656f776baf9a933fba96fd969dda26b6bf13864ee5765112654b269f79a7f20a4a0712cf8cec7be759966088045bca040e01edc +SHA512 (libgcrypt-1.11.2.tar.bz2) = b706cea602cc8f0896e57ce979643bf78974b05faec27c1b053b773c57d8b04250e30e95a4ef5899e1df981d01d8d08f0a36e10b5820a5ec4183e74c02e5f1f0 +SHA512 (libgcrypt-1.11.2.tar.bz2.sig) = e63d240a9b97aa218c98c5baa72a30321ae85412d4a8748e36578bd9498fe8c8ee2ba84835d1783cdfc1e5dfb66b0a89409d6263e9c06f4cd11e919d4bce0cd2