1.11.2-1

Resolves: #2382944

.fmf/version

@@ -0,0 +1 @@
+1

.gitignore

@@ -1 +1,44 @@
 libgcrypt-1.4.5-hobbled.tar.bz2
+/libgcrypt-1.4.6-hobbled.tar.bz2
+/libgcrypt-1.5.0-hobbled.tar.bz2
+/libgcrypt-1.5.1-hobbled.tar.xz
+/libgcrypt-1.5.2-hobbled.tar.xz
+/libgcrypt-1.5.3-hobbled.tar.xz
+/libgcrypt-1.6.1-hobbled.tar.xz
+/libgcrypt-1.6.2-hobbled.tar.xz
+/libgcrypt-1.6.3-hobbled.tar.xz
+/libgcrypt-1.6.4-hobbled.tar.xz
+/libgcrypt-1.6.5-hobbled.tar.xz
+/libgcrypt-1.6.6-hobbled.tar.xz
+/libgcrypt-1.7.3-hobbled.tar.xz
+/libgcrypt-1.7.5-hobbled.tar.xz
+/libgcrypt-1.7.6-hobbled.tar.xz
+/libgcrypt-1.7.7-hobbled.tar.xz
+/libgcrypt-1.7.8-hobbled.tar.xz
+/libgcrypt-1.8.0-hobbled.tar.xz
+/libgcrypt-1.8.1-hobbled.tar.xz
+/libgcrypt-1.8.2-hobbled.tar.xz
+/libgcrypt-1.8.3-hobbled.tar.xz
+/libgcrypt-1.8.4-hobbled.tar.xz
+/libgcrypt-1.8.5-hobbled.tar.xz
+/libgcrypt-1.8.6-hobbled.tar.xz
+/libgcrypt-1.8.7-hobbled.tar.xz
+/libgcrypt-1.9.0-hobbled.tar.xz
+/libgcrypt-1.9.1-hobbled.tar.xz
+/libgcrypt-1.9.2-hobbled.tar.xz
+/libgcrypt-1.9.3-hobbled.tar.xz
+/libgcrypt-1.9.4-hobbled.tar.xz
+/libgcrypt-1.10.0.tar.bz2
+/libgcrypt-1.10.0.tar.bz2.sig
+/libgcrypt-1.10.1.tar.bz2
+/libgcrypt-1.10.1.tar.bz2.sig
+/libgcrypt-1.10.2.tar.bz2
+/libgcrypt-1.10.2.tar.bz2.sig
+/libgcrypt-1.10.3.tar.bz2
+/libgcrypt-1.10.3.tar.bz2.sig
+/libgcrypt-1.11.0.tar.bz2
+/libgcrypt-1.11.0.tar.bz2.sig
+/libgcrypt-1.11.1.tar.bz2
+/libgcrypt-1.11.1.tar.bz2.sig
+/libgcrypt-1.11.2.tar.bz2
+/libgcrypt-1.11.2.tar.bz2.sig

hobble-libgcrypt

@@ -1,9 +0,0 @@
-#!/bin/sh
-
-# Quit out if anything fails.
-set -e -x
-
-# Clean out patent-or-otherwise-encumbered code.
-# EC:    ????????? ??/??/2015
-
-rm -f cipher/ecc.c

libgcrypt-1.10.1-annobin.patch

@@ -0,0 +1,22 @@
+diff -rup libgcrypt.orig/src/Makefile.am libgcrypt-1.8.3/src/Makefile.am
+--- libgcrypt.orig/src/Makefile.am	2021-10-18 16:36:20.914025497 +0100
++++ libgcrypt-1.8.3/src/Makefile.am	2021-10-19 12:23:08.652960618 +0100
+@@ -108,6 +108,7 @@ endif !HAVE_W32_SYSTEM
+ 
+ 
+ libgcrypt_la_LDFLAGS = $(no_undefined) $(export_symbols) $(extra_ltoptions) \
++	-Wc,-fplugin=annobin \
+ 	$(libgcrypt_version_script_cmd) -version-info \
+ 	@LIBGCRYPT_LT_CURRENT@:@LIBGCRYPT_LT_REVISION@:@LIBGCRYPT_LT_AGE@
+ libgcrypt_la_DEPENDENCIES = \
+Only in libgcrypt-1.8.3/src: Makefile.am.annobin
+diff -rup libgcrypt.orig/src/Makefile.in libgcrypt-1.8.3/src/Makefile.in
+--- libgcrypt.orig/src/Makefile.in	2021-10-18 16:36:20.914025497 +0100
++++ libgcrypt-1.8.3/src/Makefile.in	2021-10-19 12:23:37.791875325 +0100
+@@ -483,6 +483,7 @@ gcrypt_hwf_modules = @GCRYPT_HWF_MODULES
+ @HAVE_W32_SYSTEM_TRUE@gcrypt_deps = $(gcrypt_res) libgcrypt.def
+ @HAVE_W32_SYSTEM_FALSE@gcrypt_res_ldflag = 
+ libgcrypt_la_LDFLAGS = $(no_undefined) $(export_symbols) $(extra_ltoptions) \
++	-Wc,-fplugin=annobin \
+ 	$(libgcrypt_version_script_cmd) -version-info \
+ 	@LIBGCRYPT_LT_CURRENT@:@LIBGCRYPT_LT_REVISION@:@LIBGCRYPT_LT_AGE@

libgcrypt-1.4.4-use-fipscheck.patch

@@ -1,86 +0,0 @@
-diff -up libgcrypt-1.4.4/src/fips.c.use-fipscheck libgcrypt-1.4.4/src/fips.c
---- libgcrypt-1.4.4/src/fips.c.use-fipscheck	2009-03-03 21:09:27.000000000 +0100
-+++ libgcrypt-1.4.4/src/fips.c	2009-03-05 11:20:48.000000000 +0100
-@@ -570,23 +570,48 @@ run_random_selftests (void)
-   return !!err;
- }
- 
-+static int
-+get_library_path(const char *libname, const char *symbolname, char *path, size_t pathlen)
-+{
-+    Dl_info info;
-+    void *dl, *sym;
-+    int rv = -1;
-+
-+        dl = dlopen(libname, RTLD_LAZY);
-+        if (dl == NULL) {
-+            return -1;
-+        }       
-+
-+    sym = dlsym(dl, symbolname);
-+
-+    if (sym != NULL && dladdr(sym, &info)) {
-+	strncpy(path, info.dli_fname, pathlen-1);
-+	path[pathlen-1] = '\0';
-+	rv = 0;
-+    }
-+
-+    dlclose(dl);	
-+    
-+    return rv;
-+}
-+
- /* Run an integrity check on the binary.  Returns 0 on success.  */
- static int
- check_binary_integrity (void)
- {
- #ifdef ENABLE_HMAC_BINARY_CHECK
-   gpg_error_t err;
--  Dl_info info;
-+  char libpath[4096];
-   unsigned char digest[32];
-   int dlen;
-   char *fname = NULL;
--  const char key[] = "What am I, a doctor or a moonshuttle conductor?";
-+  const char key[] = "orboDeJITITejsirpADONivirpUkvarP";
-   
--  if (!dladdr ("gcry_check_version", &info))
-+  if (get_library_path ("libgcrypt.so.11", "gcry_check_version", libpath, sizeof(libpath)))
-     err = gpg_error_from_syserror ();
-   else
-     {
--      dlen = _gcry_hmac256_file (digest, sizeof digest, info.dli_fname,
-+      dlen = _gcry_hmac256_file (digest, sizeof digest, libpath,
-                                  key, strlen (key));
-       if (dlen < 0)
-         err = gpg_error_from_syserror ();
-@@ -594,7 +619,7 @@ check_binary_integrity (void)
-         err = gpg_error (GPG_ERR_INTERNAL);
-       else
-         {
--          fname = gcry_malloc (strlen (info.dli_fname) + 1 + 5 + 1 );
-+          fname = gcry_malloc (strlen (libpath) + 1 + 5 + 1 );
-           if (!fname)
-             err = gpg_error_from_syserror ();
-           else
-@@ -603,7 +628,7 @@ check_binary_integrity (void)
-               char *p;
- 
-               /* Prefix the basename with a dot.  */
--              strcpy (fname, info.dli_fname);
-+              strcpy (fname, libpath);
-               p = strrchr (fname, '/');
-               if (p)
-                 p++;
-diff -up libgcrypt-1.4.4/src/Makefile.in.use-fipscheck libgcrypt-1.4.4/src/Makefile.in
---- libgcrypt-1.4.4/src/Makefile.in.use-fipscheck	2009-01-22 19:16:51.000000000 +0100
-+++ libgcrypt-1.4.4/src/Makefile.in	2009-03-05 11:31:57.000000000 +0100
-@@ -337,7 +337,7 @@ libgcrypt_la_LIBADD = \
- 	../cipher/libcipher.la \
- 	../random/librandom.la \
- 	../mpi/libmpi.la \
--	@LTLIBOBJS@ @GPG_ERROR_LIBS@
-+	@LTLIBOBJS@ @GPG_ERROR_LIBS@ -ldl
- 
- dumpsexp_SOURCES = dumpsexp.c
- dumpsexp_LDADD = 

libgcrypt-1.4.5-ImplicitDSOLinking.patch

@@ -1,24 +0,0 @@
-diff -up libgcrypt-1.4.5/tests/Makefile.am.ImplicitDSOLinking libgcrypt-1.4.5/tests/Makefile.am
---- libgcrypt-1.4.5/tests/Makefile.am.ImplicitDSOLinking	2009-04-02 04:25:34.000000000 -0500
-+++ libgcrypt-1.4.5/tests/Makefile.am	2010-02-14 14:28:49.792383613 -0600
-@@ -36,7 +36,7 @@ TESTS += benchmark
- AM_CPPFLAGS = -I../src -I$(top_srcdir)/src
- AM_CFLAGS = $(GPG_ERROR_CFLAGS)
- 
--LDADD = ../src/libgcrypt.la $(DL_LIBS)
-+LDADD = ../src/libgcrypt.la $(DL_LIBS) $(GPG_ERROR_LIBS)
- 
- EXTRA_PROGRAMS = testapi pkbench
- noinst_PROGRAMS = $(TESTS) fipsdrv
-diff -up libgcrypt-1.4.5/tests/Makefile.in.ImplicitDSOLinking libgcrypt-1.4.5/tests/Makefile.in
---- libgcrypt-1.4.5/tests/Makefile.in.ImplicitDSOLinking	2009-12-11 09:43:30.000000000 -0600
-+++ libgcrypt-1.4.5/tests/Makefile.in	2010-02-14 14:29:30.232368780 -0600
-@@ -334,7 +334,7 @@ top_srcdir = @top_srcdir@
- # a built header.
- AM_CPPFLAGS = -I../src -I$(top_srcdir)/src
- AM_CFLAGS = $(GPG_ERROR_CFLAGS)
--LDADD = ../src/libgcrypt.la $(DL_LIBS)
-+LDADD = ../src/libgcrypt.la $(DL_LIBS) $(GPG_ERROR_LIBS)
- EXTRA_DIST = README rsa-16k.key cavs_tests.sh cavs_driver.pl
- all: all-am
- 

libgcrypt.spec

@@ -1,38 +1,50 @@
-Name: libgcrypt
-Version: 1.4.5
-Release: 4%{?dist}
-URL: http://www.gnupg.org/
-Source0: libgcrypt-%{version}-hobbled.tar.bz2
-# The original libgcrypt sources now contain potentially patented ECC
-# cipher support. We have to remove it in the tarball we ship with
-# the hobble-libgcrypt script.
-#Source0: ftp://ftp.gnupg.org/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2
-#Source1: ftp://ftp.gnupg.org/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2.sig
-Source2: wk@g10code.com
-Source3: hobble-libgcrypt
-# make FIPS hmac compatible with fipscheck - non upstreamable
-Patch2: libgcrypt-1.4.4-use-fipscheck.patch
-# fix ImplicitDSOLinking (missing -lgpg-error linkage in tests/), upstreamable
-Patch3: libgcrypt-1.4.5-ImplicitDSOLinking.patch
+# This is taken from gnutls.spec
+%define srpmhash() %{lua:
+local files = rpm.expand("%_specdir/libgcrypt.spec")
+for i, p in ipairs(patches) do
+   files = files.." "..p
+end
+for i, p in ipairs(sources) do
+   files = files.." "..p
+end
+local sha256sum = assert(io.popen("cat "..files.."| sha256sum"))
+local hash = sha256sum:read("*a")
+sha256sum:close()
+print(string.sub(hash, 0, 16))
+}
 
-# Technically LGPLv2.1+, but Fedora's table doesn't draw a distinction.
-# Documentation and some utilities are GPLv2+ licensed. These files
-# are in the devel subpackage.
-License: LGPLv2+
+Name: libgcrypt
+Version: 1.11.2
+Release: 1%{?dist}
+URL: https://www.gnupg.org/
+Source0: https://www.gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2
+Source1: https://www.gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2.sig
+Source2: https://gnupg.org/signature_key.asc
+# Pass the annobin flags to the libgcrypt.so (#2016349)
+Patch1: libgcrypt-1.10.1-annobin.patch
+# https://gitlab.com/redhat-crypto/libgcrypt/libgcrypt-mirror/-/merge_requests/19/
+Patch5: libgcrypt-1.11.0-marvin.patch
+
+%global gcrylibdir %{_libdir}
+%global gcrysoname libgcrypt.so.20
+%global hmackey orboDeJITITejsirpADONivirpUkvarP
+
+License: BSD-3-Clause AND (BSD-3-Clause OR GPL-2.0-only) AND GPL-2.0-or-later AND LGPL-2.1-or-later AND LGPL-2.0-or-later AND MIT-Modern-Variant
 Summary: A general-purpose cryptography library
-BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
-BuildRequires: gawk, libgpg-error-devel >= 1.4, pkgconfig
-BuildRequires: fipscheck
-Group: System Environment/Libraries
+BuildRequires: gcc
+BuildRequires: gawk, libgpg-error-devel >= 1.11, pkgconfig
+# This is needed only when patching the .texi doc.
+BuildRequires: texinfo
+BuildRequires: autoconf, automake, libtool
+BuildRequires: make
+BuildRequires: gnupg2
+BuildRequires: annobin-annocheck binutils
 
 %package devel
 Summary: Development files for the %{name} package
-License: LGPLv2+ and GPLv2+
-Group: Development/Libraries
-Requires(pre): /sbin/install-info
-Requires(post): /sbin/install-info
 Requires: libgpg-error-devel
-Requires: %{name} = %{version}-%{release}
+Requires: %{name}%{?_isa} = %{version}-%{release}
+Requires: pkgconfig
 
 %description
 Libgcrypt is a general purpose crypto library based on the code used
@@ -44,121 +56,484 @@ in GNU Privacy Guard.  This package contains files needed to develop
 applications using libgcrypt.
 
 %prep
+%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
 %setup -q
-%{SOURCE3}
-%patch2 -p1 -b .use-fipscheck
-%patch3 -p1 -b .ImplicitDSOLinking
-
-mv AUTHORS AUTHORS.iso88591
-iconv -f ISO-8859-1 -t UTF-8 AUTHORS.iso88591 >AUTHORS
+%patch 1 -p1
+%patch 5 -p1
 
 %build
+# should be all algorithms except SM3 and SM4, aria
+export DIGESTS='crc gostr3411-94 md4 md5 rmd160 sha1 sha256 sha512 sha3 tiger whirlpool stribog blake2'
+export CIPHERS='arcfour blowfish cast5 des aes twofish serpent rfc2268 seed camellia idea salsa20 gost28147 chacha20'
+
+eval $(sed -n 's/^\(\(NAME\|VERSION_ID\)=.*\)/OS_\1/p' /etc/os-release)
+export FIPS_MODULE_NAME="$OS_NAME ${OS_VERSION_ID%%.*} %name"
+
+autoreconf -f
 %configure --disable-static \
 %ifarch sparc64
      --disable-asm \
 %endif
      --enable-noexecstack \
-     --enable-hmac-binary-check \
-     --enable-pubkey-ciphers='dsa elgamal rsa' \
-     --disable-O-flag-munging
-make %{?_smp_mflags}
+     --enable-hmac-binary-check=%{hmackey} \
+     --disable-jent-support \
+     --disable-O-flag-munging \
+     --enable-digests="$DIGESTS" \
+     --enable-ciphers="$CIPHERS" \
+     --enable-marvin-workaround \
+     --with-fips-module-version="$FIPS_MODULE_NAME %{version}-%{srpmhash}"
+sed -i -e '/^sys_lib_dlsearch_path_spec/s,/lib /usr/lib,/usr/lib /lib64 /usr/lib64 /lib,g' libtool
+%make_build
 
 %check
-fipshmac src/.libs/libgcrypt.so.??
 make check
+# try in faked FIPS mode too
+LIBGCRYPT_FORCE_FIPS_MODE=1 make check
+
+%define libpath $RPM_BUILD_ROOT%{gcrylibdir}/%{gcrysoname}.?.?
+
+PROFILE=%{?dist} annocheck --ignore-unknown --verbose --profile=${PROFILE:1} %{libpath}
 
 # Add generation of HMAC checksums of the final stripped binaries 
 %define __spec_install_post \
     %{?__debug_package:%{__debug_install_post}} \
     %{__arch_install_post} \
     %{__os_install_post} \
-    fipshmac $RPM_BUILD_ROOT/%{_lib}/*.so.?? \
+    cd src \
+    sed -i -e 's|FILE=.*|FILE=\\\$1|' gen-note-integrity.sh \
+    READELF=readelf AWK=awk ECHO_N="-n" bash gen-note-integrity.sh %{libpath} > %{libpath}.hmac \
+    objcopy --update-section .note.fdo.integrity=%{libpath}.hmac %{libpath} %{libpath}.new \
+    mv -f %{libpath}.new %{libpath} \
+    rm -f %{libpath}.hmac
 %{nil}
 
 %install
-rm -fr $RPM_BUILD_ROOT
-make install DESTDIR=$RPM_BUILD_ROOT
+%make_install
 
 # Change /usr/lib64 back to /usr/lib.  This saves us from having to patch the
 # script to "know" that -L/usr/lib64 should be suppressed, and also removes
 # a file conflict between 32- and 64-bit versions of this package.
+# Also replace my_host with none.
 sed -i -e 's,^libdir="/usr/lib.*"$,libdir="/usr/lib",g' $RPM_BUILD_ROOT/%{_bindir}/libgcrypt-config
+sed -i -e 's,^my_host=".*"$,my_host="none",g' $RPM_BUILD_ROOT/%{_bindir}/libgcrypt-config
 
 rm -f ${RPM_BUILD_ROOT}/%{_infodir}/dir ${RPM_BUILD_ROOT}/%{_libdir}/*.la
 /sbin/ldconfig -n $RPM_BUILD_ROOT/%{_libdir}
 
-# Relocate the shared libraries to /%{_lib}.
-mkdir -p $RPM_BUILD_ROOT/%{_lib}
-for shlib in $RPM_BUILD_ROOT/%{_libdir}/*.so* ; do
+%if "%{gcrylibdir}" != "%{_libdir}"
+# Relocate the shared libraries to %{gcrylibdir}.
+mkdir -p $RPM_BUILD_ROOT%{gcrylibdir}
+for shlib in $RPM_BUILD_ROOT%{_libdir}/*.so* ; do
 	if test -L "$shlib" ; then
 		rm "$shlib"
 	else
-		mv "$shlib" $RPM_BUILD_ROOT/%{_lib}/
+		mv "$shlib" $RPM_BUILD_ROOT%{gcrylibdir}/
 	fi
 done
 
-# Figure out where /%{_lib} is relative to %{_libdir}.
-touch $RPM_BUILD_ROOT/root_marker
-relroot=..
-while ! test -f $RPM_BUILD_ROOT/%{_libdir}/$relroot/root_marker ; do
-	relroot=$relroot/..
-done
+# Add soname symlink.
+/sbin/ldconfig -n $RPM_BUILD_ROOT/%{_lib}/
+%endif
 
 # Overwrite development symlinks.
-pushd $RPM_BUILD_ROOT/%{_libdir}
-for shlib in $relroot/%{_lib}/lib*.so.* ; do
-	shlib=`echo "$shlib" | sed -e 's,//,/,g'`
-	target=`basename "$shlib" | sed -e 's,\.so.*,,g'`.so
+pushd $RPM_BUILD_ROOT/%{gcrylibdir}
+for shlib in lib*.so.?? ; do
+	target=$RPM_BUILD_ROOT/%{_libdir}/`echo "$shlib" | sed -e 's,\.so.*,,g'`.so
+%if "%{gcrylibdir}" != "%{_libdir}"
+	shlib=%{gcrylibdir}/$shlib
+%endif
 	ln -sf $shlib $target
 done
 popd
 
-# Add soname symlink.
-/sbin/ldconfig -n $RPM_BUILD_ROOT/%{_lib}/
-rm -f $RPM_BUILD_ROOT/root_marker
-
 # Create /etc/gcrypt (hardwired, not dependent on the configure invocation) so
 # that _someone_ owns it.
 mkdir -p -m 755 $RPM_BUILD_ROOT/etc/gcrypt
 
-%clean
-rm -fr $RPM_BUILD_ROOT
-
-%post -p /sbin/ldconfig
-
-%postun -p /sbin/ldconfig
-
-%post devel
-[ -f %{_infodir}/gcrypt.info.gz ] && \
-    /sbin/install-info %{_infodir}/gcrypt.info.gz %{_infodir}/dir
-exit 0
-
-%preun devel
-if [ $1 = 0 -a -f %{_infodir}/gcrypt.info.gz ]; then
-    /sbin/install-info --delete %{_infodir}/gcrypt.info.gz %{_infodir}/dir
-fi
-exit 0
+%ldconfig_scriptlets
 
 %files
-%defattr(-,root,root,-)
 %dir /etc/gcrypt
-/%{_lib}/libgcrypt.so.*
-/%{_lib}/.libgcrypt.so.*.hmac
-%doc COPYING.LIB AUTHORS NEWS THANKS
+%{gcrylibdir}/libgcrypt.so.*.*
+%{gcrylibdir}/%{gcrysoname}
+%license COPYING.LIB
+%doc AUTHORS NEWS THANKS
 
 %files devel
-%defattr(-,root,root,-)
 %{_bindir}/%{name}-config
 %{_bindir}/dumpsexp
 %{_bindir}/hmac256
+%{_bindir}/mpicalc
 %{_includedir}/*
 %{_libdir}/*.so
+%{_libdir}/pkgconfig/libgcrypt.pc
 %{_datadir}/aclocal/*
+%{_mandir}/man1/*
 
 %{_infodir}/gcrypt.info*
-%doc COPYING
+%license COPYING
 
 %changelog
+* Mon Nov 03 2025 Jakub Jelen <jjelen@redhat.com> - 1.11.2-1
+- New upstream release (#2406804)
+
+* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.11.1-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Tue May 13 2025 Jakub Jelen <jjelen@redhat.com> - 1.11.1-1
+- New upstream release (#2364878)
+
+* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.11.0-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Tue Oct 29 2024 Jakub Jelen <jjelen@redhat.com> - 1.11.0-4
+- Run annocheck as part of the build
+- Use upstream CF protection patches
+- Fix PAC/BTI protection for Aarch64
+- Fix CVE-2024-2236 (#2274128)
+
+* Thu Jul 25 2024 Jakub Jelen <jjelen@redhat.com> - 1.11.0-3
+- Disable -O flag munging and remove needles modification of LTO flags.
+
+* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.11.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
+* Wed Jun 19 2024 Jakub Jelen <jjelen@redhat.com> - 1.11.0-1
+- New upstream release (#2293064)
+
+* Tue Mar 26 2024 Jakub Jelen <jjelen@redhat.com> - 1.10.3-4
+- Replace deprecated fgrep (#2271503)
+
+* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.3-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.3-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Tue Nov 14 2023 Jakub Jelen <jjelen@redhat.com> - 1.10.3-1
+- New upstream release (#2249639)
+
+* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.2-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Tue Apr 11 2023 Jakub Jelen <jjelen@redhat.com> - 1.10.2-1
+- New upstream release (#2185084)
+
+* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.1-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Sat Dec  3 2022 Florian Weimer <fweimer@redhat.com> - 1.10.1-6
+- Port configure script to C99
+
+* Tue Nov 08 2022 Todd Zullinger <tmz@pobox.com> - 1.10.1-5
+- enable brainpool by default (#1413618)
+- fix sporadic failures generating RSA keys in FIPS mode
+
+* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.1-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Sun May 29 2022 Todd Zullinger <tmz@pobox.com> - 1.10.1-3
+- improve --disable-brainpool configure output
+- use %%bcond_with to disable brainpool curves
+
+* Fri Apr 08 2022 Jakub Jelen <jjelen@redhat.com> - 1.10.1-2
+- Adjust integrity check creation to match upstream (#2073018)
+
+* Tue Mar 29 2022 Jakub Jelen <jjelen@redhat.com> - 1.10.1-1
+- Final release (#2069263)
+
+* Wed Feb 02 2022 Jakub Jelen <jjelen@redhat.com> - 1.10.0-1
+- New upstream release (#2049322)
+
+* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.9.4-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Mon Aug 23 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.4-1
+- New upstream release (#1996467)
+
+* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.9.3-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Tue Jun 15 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.3-3
+- Fix for CVE-2021-33560 (#1970098)
+
+* Wed Apr 28 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.3-2
+- Restore the CET protection (#1954049)
+
+* Tue Apr 20 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.3-1
+- New upstream release (#1951325)
+
+* Thu Apr 15 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.2-3
+- Fix issues reported by coverity
+
+* Mon Mar 29 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.2-2
+- Fix OCB tag creation on s390x (failing gnupg2 tests)
+
+* Wed Feb 17 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.2-1
+- New upstream release (#1929630)
+
+* Fri Jan 29 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.1-1
+- New upstream release (#1922156, #1922097)
+
+* Wed Jan 20 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.0-1
+- New upstream release (#1917878)
+
+* Tue Nov 24 2020 Jakub Jelen <jjelen@redhat.com> - 1.8.7-1
+- new upstream release (#1891123)
+
+* Fri Aug 21 2020 Jeff Law <law@redhat.com> - 1.8.6-4
+- Re-enable LTO
+
+* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.6-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Tue Jul 21 2020 Tom Stellard <tstellar@redhat.com> - 1.8.6-2
+- Use make macros
+- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
+
+* Mon Jul 20 2020 Tomáš Mráz <tmraz@redhat.com> 1.8.6-1
+- new upstream version 1.8.6
+
+* Wed Jul  1 2020 Tomáš Mráz <tmraz@redhat.com> 1.8.5-7
+- use the hmac256 tool to calculate the library hmac
+
+* Tue Jun 30 2020 Jeff Law <law@redhat.com>
+- Disable LTO
+
+* Thu Apr 23 2020 Tomáš Mráz <tmraz@redhat.com> 1.8.5-6
+- Fix regression - missing -ldl linkage
+
+* Wed Apr 22 2020 Tomáš Mráz <tmraz@redhat.com> 1.8.5-5
+- AES performance improvements backported from master branch
+
+* Mon Apr 20 2020 Tomáš Mráz <tmraz@redhat.com> 1.8.5-4
+- FIPS selftest is run directly from the constructor
+- FIPS module is implicit with kernel FIPS flag
+
+* Thu Jan 30 2020 Tomáš Mráz <tmraz@redhat.com> 1.8.5-3
+- fix the build on ARMv7
+
+* Thu Jan 23 2020 Tomáš Mráz <tmraz@redhat.com> 1.8.5-2
+- Intel CET support by H. J. Lu
+
+* Tue Sep  3 2019 Tomáš Mráz <tmraz@redhat.com> 1.8.5-1
+- new upstream version 1.8.5
+- add CMAC selftest for FIPS POST
+- add continuous FIPS entropy test
+- disable non-approved FIPS hashes in the enforced FIPS mode
+
+* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.4-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Tue Feb 12 2019 Tomáš Mráz <tmraz@redhat.com> 1.8.4-3
+- fix the build tests to pass in the FIPS mode
+
+* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.4-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Tue Nov 20 2018 Tomáš Mráz <tmraz@redhat.com> 1.8.4-1
+- new upstream version 1.8.4
+
+* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.3-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
+* Thu Jul 12 2018 Tomáš Mráz <tmraz@redhat.com> 1.8.3-2
+- make only_urandom a default in non-presence of configuration file
+- run the full FIPS selftests only when the library is called from
+  application
+
+* Thu Jun 14 2018 Tomáš Mráz <tmraz@redhat.com> 1.8.3-1
+- new upstream version 1.8.3
+
+* Tue Feb  6 2018 Tomáš Mráz <tmraz@redhat.com> 1.8.2-2
+- fix behavior when getrandom syscall is not present (#1542453)
+
+* Thu Dec 21 2017 Tomáš Mráz <tmraz@redhat.com> 1.8.2-1
+- new upstream version 1.8.2
+
+* Tue Dec  5 2017 Tomáš Mráz <tmraz@redhat.com> 1.8.1-3
+- do not try to access() /dev/urandom either if getrandom() works
+
+* Mon Dec  4 2017 Tomáš Mráz <tmraz@redhat.com> 1.8.1-2
+- do not try to open /dev/urandom if getrandom() works (#1380866)
+
+* Tue Sep  5 2017 Tomáš Mráz <tmraz@redhat.com> 1.8.1-1
+- new upstream version 1.8.1
+
+* Wed Aug 16 2017 Tomáš Mráz <tmraz@redhat.com> 1.8.0-1
+- new upstream version 1.8.0
+
+* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.7.8-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
+
+* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.7.8-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
+
+* Thu Jun 29 2017 Tomáš Mráz <tmraz@redhat.com> 1.7.8-1
+- new upstream version 1.7.8
+
+* Fri Jun  2 2017 Tomáš Mráz <tmraz@redhat.com> 1.7.7-1
+- new upstream version 1.7.7
+- GOST is now enabled
+
+* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.7.6-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
+
+* Mon Jan 30 2017 Tomáš Mráz <tmraz@redhat.com> 1.7.6-1
+- new upstream version 1.7.6
+
+* Fri Dec 16 2016 Tomáš Mráz <tmraz@redhat.com> 1.7.5-1
+- new upstream version 1.7.5
+
+* Wed Nov 23 2016 Tomáš Mráz <tmraz@redhat.com> 1.7.3-1
+- new upstream version 1.7.3
+
+* Wed Aug 17 2016 Tomáš Mráz <tmraz@redhat.com> 1.6.6-1
+- new upstream version with important security fix (CVE-2016-6316)
+
+* Thu Jul 21 2016 Tomáš Mráz <tmraz@redhat.com> 1.6.5-1
+- new upstream version fixing low impact issue CVE-2015-7511
+
+* Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 1.6.4-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
+
+* Wed Sep  9 2015 Tomáš Mráz <tmraz@redhat.com> 1.6.4-1
+- new upstream version
+
+* Wed Jun 17 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.6.3-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
+
+* Fri Apr  3 2015 Tomáš Mráz <tmraz@redhat.com> 1.6.3-4
+- deinitialize the RNG after the selftest is run
+
+* Tue Mar 24 2015 Tomáš Mráz <tmraz@redhat.com> 1.6.3-3
+- touch only urandom in the selftest and when /dev/random is
+  unavailable for example by SELinux confinement
+- fix the RSA selftest key (p q swap) (#1204517)
+
+* Fri Mar 13 2015 Tomáš Mráz <tmraz@redhat.com> 1.6.3-2
+- do not use strict aliasing for bufhelp functions (#1201219)
+
+* Fri Mar  6 2015 Tomáš Mráz <tmraz@redhat.com> 1.6.3-1
+- new upstream version
+
+* Wed Feb 25 2015 Tomáš Mráz <tmraz@redhat.com> 1.6.2-4
+- do not initialize secure memory during the selftest (#1195850)
+
+* Sat Feb 21 2015 Till Maas <opensource@till.name> - 1.6.2-3
+- Rebuilt for Fedora 23 Change
+  https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code
+
+* Wed Jan 14 2015 Tomáš Mráz <tmraz@redhat.com> 1.6.2-2
+- fix buildability of programs using gcrypt.h with -ansi (#1182200)
+
+* Mon Dec  8 2014 Tomáš Mráz <tmraz@redhat.com> 1.6.2-1
+- new upstream version
+
+* Sun Aug 17 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.6.1-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
+
+* Thu Jul 17 2014 Tom Callaway <spot@fedoraproject.org> - 1.6.1-6
+- fix license handling
+
+* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.6.1-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
+
+* Tue May 20 2014 Kyle McMartin <kyle@fedoraproject.org> 1.6.1-4
+- Re-enable below algos, apply patch from upstream list to make
+  that code -fPIC friendly. (rhbz#1069792)
+
+* Mon May 19 2014 Kyle McMartin <kyle@fedoraproject.org> 1.6.1-3
+- Disable rijndael, cast5, camellia ARM assembly, as it's non-PIC as
+  presently written, which results in .text relocations in the shared
+  library. (rhbz#1069792)
+
+* Thu Apr 24 2014 Tomáš Mráz <tmraz@redhat.com> 1.6.1-2
+- drop the temporary compat shared library version
+- fix the soname version in -use-fipscheck.patch
+
+* Fri Feb 28 2014 Tomáš Mráz <tmraz@redhat.com> 1.6.1-1
+- new upstream version breaking ABI compatibility
+- this release temporarily includes old compatibility .so
+
+* Tue Jan 21 2014 Tomáš Mráz <tmraz@redhat.com> 1.5.3-3
+- add back the nistp521r1 EC curve
+- fix a bug in the Whirlpool hash implementation
+- speed up the PBKDF2 computation
+
+* Sun Oct 20 2013 Tom Callaway <spot@fedoraproject.org> - 1.5.3-2
+- add cleared ECC support
+
+* Fri Jul 26 2013 Tomáš Mráz <tmraz@redhat.com> 1.5.3-1
+- new upstream version fixing cache side-channel attack on RSA private keys
+
+* Thu Jun 20 2013 Tomáš Mráz <tmraz@redhat.com> 1.5.2-3
+- silence false error detected by valgrind (#968288)
+
+* Thu Apr 25 2013 Tomáš Mráz <tmraz@redhat.com> 1.5.2-2
+- silence strict aliasing warning in Rijndael
+- apply UsrMove
+- spec file cleanups
+
+* Fri Apr 19 2013 Tomáš Mráz <tmraz@redhat.com> 1.5.2-1
+- new upstream version
+
+* Wed Mar 20 2013 Tomas Mraz <tmraz@redhat.com> 1.5.1-1
+- new upstream version
+
+* Tue Mar  5 2013 Tomas Mraz <tmraz@redhat.com> 1.5.0-11
+- use poll() instead of select() when gathering randomness (#913773)
+
+* Thu Feb 14 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.5.0-10
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
+
+* Thu Jan  3 2013 Tomas Mraz <tmraz@redhat.com> 1.5.0-9
+- allow empty passphrase in PBKDF2 needed for cryptsetup (=891266)
+
+* Mon Dec  3 2012 Tomas Mraz <tmraz@redhat.com> 1.5.0-8
+- fix multilib conflict in libgcrypt-config
+- fix minor memory leaks and other bugs found by Coverity scan
+
+* Thu Jul 19 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.5.0-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
+
+* Thu Apr  5 2012 Tomas Mraz <tmraz@redhat.com> 1.5.0-5
+- Correctly rebuild the info documentation
+
+* Wed Apr  4 2012 Tomas Mraz <tmraz@redhat.com> 1.5.0-4
+- Add GCRYCTL_SET_ENFORCED_FIPS_FLAG command
+
+* Fri Jan 13 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.5.0-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
+
+* Mon Aug 15 2011 Kalev Lember <kalevlember@gmail.com> 1.5.0-2
+- Rebuilt for rpm bug #728707
+
+* Thu Jul 21 2011 Tomas Mraz <tmraz@redhat.com> 1.5.0-1
+- new upstream version
+
+* Mon Jun 20 2011 Tomas Mraz <tmraz@redhat.com> 1.4.6-4
+- Always xor seed from /dev/urandom over /etc/gcrypt/rngseed
+
+* Mon May 30 2011 Tomas Mraz <tmraz@redhat.com> 1.4.6-3
+- Make the FIPS-186-3 DSA implementation CAVS testable
+- add configurable source of RNG seed /etc/gcrypt/rngseed
+  in the FIPS mode (#700388)
+
+* Fri Feb 11 2011 Tomas Mraz <tmraz@redhat.com> 1.4.6-1
+- new upstream version with minor changes
+
+* Mon Feb 07 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.4.5-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
+
+* Fri Feb  4 2011 Tomas Mraz <tmraz@redhat.com> 1.4.5-6
+- fix a bug in the fips-186-3 dsa parameter generation code
+
+* Tue Feb  1 2011 Tomas Mraz <tmraz@redhat.com> 1.4.5-5
+- use /dev/urandom for seeding in the FIPS mode
+- make the tests to pass in the FIPS mode also fixing
+  the FIPS-186-3 DSA keygen
+
 * Sun Feb 14 2010 Rex Dieter <rdieter@fedoraproject.org> 1.4.5-4
 - FTBFS libgcrypt-1.4.5-3.fc13: ImplicitDSOLinking (#564973)
 
@@ -328,5 +703,5 @@ exit 0
 * Thu Jan 10 2002 Nalin Dahyabhai <nalin@redhat.com> 1.1.5-1
 - fix the Source tag so that it's a real URL
 
-* Wed Dec 20 2001 Nalin Dahyabhai <nalin@redhat.com>
+* Thu Dec 20 2001 Nalin Dahyabhai <nalin@redhat.com>
 - initial package

signature_key.asc

@@ -0,0 +1,86 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQGNBFjLuq4BDACnM7zNSIaVMAacTwjXa5TGYe13i6ilHe4VL0NShzrgzjcQg531
+3cRgiiiNA7OSOypMqVs73Jez6ZUctn2GVsHBrS/io9NcuC9pVwf8a61WlcEa+EtB
+a3G7HlBmEWnwaUdAtWKNuAi9Xn+Ir7H2xEdksmmd5a0/QnL+sX705boVPF/tpYtb
+LGpPxa78tNrtxDkSwy8Wmi0IADYLI5yI7/yUGeJd8RSCU/fLRKC9fG7YOZRq0tsO
+MhVNWmtUjbG6e73Lu8LKnCZgs1/fC8hvPyARieSV5mdN8s1oWd7oYctfgL4uBleD
+ItAA8GhjKejutzHN8Ei/APw6AiiSyEjnPg+cTX8OgvLGJWjks0H6mPZeB1v/kGyZ
+hBS9vm540h2/MmlVN2ntiCK5TZGeSWpqddiqusfVXotMRpN4HeLKoZh4RAncaCbZ
+F/S+YLeN+kMXY4k3Fqt1fjTX6veFCbthI9pDdHzU9LfUVNp9D/5ktC/tYMORMegV
++wSMxi9G2YWKJkMAEQEAAYkBzgQfAQgAOBYhBFuAxXVCmPDLVdjtarzvfilLCS4o
+BQJYy8DdFwyAAZSlyaA8L+XKOwldjh/fcjz0YraxAgcAAAoJELzvfilLCS4oNgoL
+/0+K1xIx8JW7Lk5M6bYCvNA4fdlEcwQIT4UidJFM9m+suxYFWIGfebvHpRlEuJTg
+dBjkEit8uLAoJXU0BRkKTLrzTF+qDUE79Wfx/R+0nOgJ7aMykQOi0AvuwzMYz4dg
+xIVS2Daou4DF7bh/KF8+fqrmq8P8W1ZrkuFDanMWpHeAPx1uj2skYbo7uPqFdvlJ
+hlNHrcxlcCkjf1InAt0Xt5lMvEsCRUPf9xAH4mNEhs0lh9c+200YPRmtnLWAzc1K
+ckLIC8Q+mUR3DjZDqBlDBEPegXkrI0+MlvRA+9AnAm4YPqTMUfpZ6ZOAWeFjC/6Z
+QYxG/AdWGkb4WFindzklQfybEuiekP8vU07ACQwSwH8PYe0UCom1YrlRUjX7QLkn
+ZLWoeZg8BZy9GTM1Ut7Q1Q2uTw6mxxISuef+RFgYOHjWwLpFWZpqC88xERl7o/iz
+iERJRt/593IctbjO9wenWt2peIAwzR4nz7LqM6ZFTdRAETmcdSvYRhg2Qt8hUE47
+CbQkQW5kcmUgSGVpbmVja2UgKFJlbGVhc2UgU2lnbmluZyBLZXkpiQHUBBMBCAA+
+FiEEW4DFdUKY8MtV2O1qvO9+KUsJLigFAljLuq4CGwMFCRLMAwAFCwkIBwIGFQgJ
+CgsCBBYCAwECHgECF4AACgkQvO9+KUsJLihC/QwAhCC+SEvcFLcutgZ8HfcCtoZs
+IoVzZEy7DjqIvGgnTssD8HCLnIAHCDvnP7dJW3uMuLCdSqym3cjlEIiQMsaGywkl
+fzJISAwJrGQdWSKRd535jXpEXQlXDKal/IwMKAUt0PZtlCc9S3gwixQryxdJ28lJ
+6h2T9fVDr8ZswMmTAFG91uctfhjKOMgPt8UhSPGW484WsIsQgkbOvf+Kfswl0eHu
+ywX+pKAB5ZQ/9GVC6Ug4xfrdiJL0azJTPnvjMY5JYp6/L9RURs5hP5AnHR2j/PPo
+sAtsFCjmbRbOMiASzklnUJPbSz5kfLloDWZmrUScjbzmsXehGyt433JGyRhZJl4x
+/jPbzKhaaAHsGd+fRao6vlLOwFywDDVMp6JuyK7UeUb7I8ekTbSkGFA+l2Oa3O6/
+Y7PYhq7hwwAFuZckYI98IpHNCG1fS9W07FyKdvQbK1PbF1JFRKfsUCWYMKqDnbqE
+o5jivPEHZImw6iYhhXcyEYl8fjcb9T6/S+wOP7aviQGzBBABCAAdFiEElKXJoDwv
+5co7CV2OH99yPPRitrEFAljLv5sACgkQH99yPPRitrFw4gv/XFMFN+/LHsn9hJOP
+4rCwl1yUuxXuYmZgc0sRoY3EpeQkJVyKurQuqqKoy2VuoMiF0O1kAQmGoFtVPUk7
+b8hCoutqB5GyeyKcoLP+WINgVhB2gXg7TSp3MPLBKkgqvSDvPitgRxBqFb4LW8LJ
+bDbfwGrzIvXfDV3WvsrHVPbc2fhlWdL8d+3AE6mFiXF3eTpgmV3ApSBQV12MkkCk
+icLIPmp+ZxZON+OP52ZXkRtfMgOy4Oa/41agrViDAZdMOGeGkhPertQheQZgXzmo
+GF5Wz498HPM80Kv35X91l3iGzL+icEtO+tWea2YscsZ6qpRe2lfVPHk3B+anlmCj
+m4kM4cBd39xa4HHSVh/bRHbZNtgVr7slQCKxlHgQOGVI5vCxPCwEsgJ2KBk03Nk/
+IA9EKO+czfh3/bHW6uMbEqrYDCnt+hmzZrpKDSGcwS/KOhvMUIMlb7/8vDKum6mp
+/8xAtVZ6IAxYZNt3qg7Y7aLRtzCTyqm8rJQrZPtRaQcgLoEimDMEX0PliRYJKwYB
+BAHaRw8BAQdAz75Hlekc16JhhfI0MKdEVxLdkxhcMCO0ZG6WMBAmNpe0H1dlcm5l
+ciBLb2NoIChkaXN0IHNpZ25pbmcgMjAyMCmImgQTFgoAQhYhBG2qbmSnbShAVxtJ
+AlKIl7gmQDraBQJfQ+w1AhsDBQkShccRBQsJCAcCAyICAQYVCgkICwIEFgIDAQIe
+BwIXgAAKCRBSiJe4JkA62nmuAP9uL/HOdB0gvwWrH+FpURJLs4bnaZaPIk9ARrU0
+EXRgJgD/YCGfHQXpIPT0ZaXuwJexK04Z+qMFR/bM1q1Leo5CjgaIbQQQEQsAHRYh
+BIBhWHD1utaQMzaG0PKthaweQrNnBQJfQ/HmAAoJEPKthaweQrNnIZkA3jG6LcZv
+V/URn8Y8OJqsyYa4C3NI4nN+OhEvYhgA4PHzMnALeXIpA2gblvjFIPJPAhDBAU37
+c5PA6+6IdQQQFggAHRYhBK6oTtzwGthsRwHIXGMROuhmWH0KBQJfQ/IlAAoJEGMR
+OuhmWH0K1+MA/0uJ5AHcnSfIBEWHNJwwVVLGyrxAWtS2U+zeymp/UvlPAQDErCLZ
+l0dBiPG3vlowFx5TNep7tanBs6ZJn8F1ao1tAIkBMwQQAQgAHRYhBNhpISPEBl3q
+Xg86tSSbOdJPJeO2BQJfQ/OuAAoJECSbOdJPJeO2DVoH/0o9if66ph6FJrgr+A/W
+HNVeHxmM5tUQhpL1wpRS70SKcsJgolf5CxO5iTQf3HlZe544xGbIU/aCTJsWw9zi
+UE8KmhAtKV4eL/7oQ7xx4nxPnABLpudtM8A44nsM1x/XiYrJnnDm29QjYEGd2Hi8
+7npc7VWKzLoj+I/WcXquynJi5O9TUxW9Bknd1pjpxFkf8v+msjBzCD5VKJgr0CR8
+wA6peQBWeGZX2HacosMIZH4TfL0r0TFla6LJIkNBz9DyIm1yL4L8oRH0950hQljP
+C7TM3L7aRpX+4Kph6llFz6g7MALGFP95kyJ6o+XED9ORuuQVZMBMIkNC0tXOu10V
+bdqIdQQQFgoAHRYhBMHTS2khnkruwLocIeP9/yGORbcrBQJfQ/P8AAoJEOP9/yGO
+Rbcr3lQBAMas8Vl3Hdl3g2I283lz1uHiGvlwcnk2TLeB+U4zIwC9AQCy0nnazVNt
+VQPID1ZCMoaOX7AzOjaqQDLf4j+dVTxgBJgzBGCkgocWCSsGAQQB2kcPAQEHQJmd
+fwp8jEN5P3eEjhQiWk6zQi8utvgOvYD57XmE+H8+tCBOaWliZSBZdXRha2EgKEdu
+dVBHIFJlbGVhc2UgS2V5KYiaBBMWCgBCFiEErI4RW/c+LY1H+pkI6Y6bLRnGyL0F
+AmCkgocCGwMFCQsNBpkFCwkIBwIDIgIBBhUKCQgLAgQWAgMBAh4HAheAAAoJEOmO
+my0Zxsi9/4IA/1rvSr3MU+Sv4jhNDzD+CeC3gmHkPew6pi9VHEsEwdgmAQD2BtiX
+7w1sJL/CBylGWv5jxj4345mP9YfZm0RsgzPjDIh1BBAWCAAdFiEEJJyzdxdQdF1c
+3TI84mewUjZPAo0FAmFAQ54ACgkQ4mewUjZPAo1CiAD+KTT1UVdQTGHMyvHwZocS
+QjU8xhcZrTet+dvvjrE5+4MA/RBdJPZgFevUKu68NEy0Lo+RbkeCtmQJ/c8v5ieF
+vW0AiQEzBBABCAAdFiEEEkEkvTtIYq96CkLxALRevUynur4FAmFAQ7cACgkQALRe
+vUynur4kaAgAolPR8TNWVS0vXMKrr0k0l2M/8QkZTaLZx1GT9Nx1yb4WJKY7ElPM
+YkhGDxetvFBETx0pH/6R3jtj6Crmur+NKHVSRY+rCYpFPDn6ciIOryssRx2G4kCZ
+t+nFB9JyDbBOZAR8DK4pN1mAxG/yLDt4oKcUQsP2xlEFum+phxyR8KyYCpkwKRxY
+eK+6lfilQuveoUwp/Xx5wXPNUy6q4eOOovCW7gS7I7288NGHCa2ul8sD6vA9C4mM
+4Zxaole9P9wwJe1zZFtCIy88zHM9vqv+YM9DxMCaW24+rUztr7eD4bCRdG+QlSh+
+7R/TaqSxY1eAAd1J5tma9CNJO73pTKU+/JhTBGFpSqMTCSskAwMCCAEBBwIDBF6X
+D9NmUQDgiyYNbhs1DMJ14mIw812wY1HVx/4QWYWiBunhrvSFxVbzsjD7/Wv+v3bm
+MPrL+M2DLyFiSewNmcS0JEdudVBHLmNvbSAoUmVsZWFzZSBTaWduaW5nIEtleSAy
+MDIxKYiaBBMTCABCFiEEAvON/3Mf+XywOaHaVJ5pXpBboggFAmFpSqMCGwMFCQ9x
+14oFCwkIBwIDIgIBBhUKCQgLAgQWAgMBAh4HAheAAAoJEFSeaV6QW6IITkoA/RYa
+jaTl1eEBU/Gdm12o3jrI55N5xZK2XTqSx25clVyjAP0XwMW/Og5+ND1ri3bAqADV
+WlBDUswz8wYxsb0C4kYBkoh1BBAWCgAdFiEEbapuZKdtKEBXG0kCUoiXuCZAOtoF
+AmFpTvEACgkQUoiXuCZAOtrJQAEAh7YyykjAy/Qs1yC3ji8iBfIVnPXvblrIx3SR
+RyDwRC8BAKtZbEuKTtPlgkLUgMleTcZJ/vEhJE+GvfQ9o5gWCqEFiHUEEBYKAB0W
+IQTB00tpIZ5K7sC6HCHj/f8hjkW3KwUCYWlPWgAKCRDj/f8hjkW3Kx4eAQDp6aGS
+N/fU4xLl8RSvQUVjVA+aCTrMQR3hRwqw8liF2wEA3O3ECxz6e1+DoItYoJBBLKLw
+eiInsGZ/+h5XYrpXTgA=
+=4+Sn
+-----END PGP PUBLIC KEY BLOCK-----

sources

@@ -1 +1,2 @@
-56a36e06fff2ed0a3b07c901a907db5f  libgcrypt-1.4.5-hobbled.tar.bz2
+SHA512 (libgcrypt-1.11.2.tar.bz2) = b706cea602cc8f0896e57ce979643bf78974b05faec27c1b053b773c57d8b04250e30e95a4ef5899e1df981d01d8d08f0a36e10b5820a5ec4183e74c02e5f1f0
+SHA512 (libgcrypt-1.11.2.tar.bz2.sig) = e63d240a9b97aa218c98c5baa72a30321ae85412d4a8748e36578bd9498fe8c8ee2ba84835d1783cdfc1e5dfb66b0a89409d6263e9c06f4cd11e919d4bce0cd2

tests/smoke-test/Makefile

@@ -0,0 +1,75 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /CoreOS/libgcrypt/smoke-test
+#   Description: Test calls upstream test suite.
+#   Author: Ondrej Moris <omoris@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2010 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/libgcrypt/smoke-test
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	chmod a+x runtest.sh
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Ondrej Moris <omoris@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     Test calls upstream test suite." >> $(METADATA)
+	@echo "Type:            Sanity" >> $(METADATA)
+	@echo "TestTime:        15m" >> $(METADATA)
+	@echo "RunFor:          libgcrypt" >> $(METADATA)
+	@echo "Requires:        libgcrypt" >> $(METADATA)
+	@echo "Requires:        nfs-utils" >> $(METADATA)
+	@echo "Requires:        rpm-build" >> $(METADATA)
+	@echo "Requires:        autoconf automake libtool" >> $(METADATA)
+	@echo "Requires:        gawk" >> $(METADATA)
+	@echo "Requires:        gcc-c++" >> $(METADATA)
+	@echo "Requires:        libgpg-error-devel" >> $(METADATA)
+	@echo "Requires:        pkgconfig texinfo fipscheck libkcapi-fipscheck" >> $(METADATA)
+	@echo "Requires:        crypto-policies-scripts" >> $(METADATA)
+	@echo "Requires:        bc" >> $(METADATA)
+	@echo "RhtsRequires:    library(distribution/fips)" >> $(METADATA)
+	@echo "Releases:        -RHEL3 -RHEL4" >> $(METADATA)
+	@echo "Priority:        Normal" >> $(METADATA)
+	@echo "Architectures:   i386 x86_64 s390x ia64" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+	@echo "Confidential:    no" >> $(METADATA)
+	@echo "Destructive:     no" >> $(METADATA)
+
+	rhts-lint $(METADATA)

tests/smoke-test/PURPOSE

@@ -0,0 +1,3 @@
+PURPOSE of /CoreOS/libgcrypt/Sanity/smoke-test
+Description: Test calls upstream test suite.
+Author: Ondrej Moris <omoris@redhat.com>

tests/smoke-test/main.fmf

@@ -0,0 +1,25 @@
+summary: Test calls upstream test suite.
+test: ./runtest.sh
+enabled: true
+framework: beakerlib
+require:
+  - library(distribution/fips)
+recommend:
+  - libgcrypt
+  - nfs-utils
+  - rpm-build
+  - autoconf
+  - automake
+  - libtool
+  - gawk
+  - gcc-c++
+  - libgpg-error-devel
+  - pkgconfig
+  - texinfo
+  - fipscheck
+  - libkcapi-fipscheck
+  - crypto-policies-scripts
+  - bc
+  - annobin-annocheck
+  - gnupg2
+duration: 45m

tests/smoke-test/runtest.sh

@@ -0,0 +1,145 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/libgcrypt/smoke-test
+#   Description: Test calls upstream test suite.
+#   Author: Ondrej Moris <omoris@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2010 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+. /usr/share/beakerlib/beakerlib.sh
+
+PACKAGE="libgcrypt"
+
+rlJournalStart
+
+    rlPhaseStartSetup
+        rlImport distribution/fips || rlFail "FIPS library needed for some phases"
+        TmpDir=`mktemp -d`
+        rlAssertRpm $PACKAGE
+        rlRun "rlFileBackup --clean /etc/gcrypt/fips_enabled"
+        if [[ -r /etc/gcrypt/hwf.deny ]]; then
+            rlRun "rlFileBackup /etc/gcrypt/hwf.deny"
+            rlRun "rm -f /etc/gcrypt/hwf.deny"
+        fi
+        rlRun "pushd $TmpDir" 0
+        rlRun "rlFetchSrcForInstalled $PACKAGE"
+        rlRun "rpm -ihv `ls *.rpm`" 0
+        if grep '1' /proc/sys/crypto/fips_enabled; then
+            rlRun "echo '1' > /etc/gcrypt/fips_enabled" 0
+        fi
+    rlPhaseEnd
+
+    rlPhaseStartTest "Package build"
+        TOPDIR=`rpm --eval %_topdir`
+        rlRun "pushd $TOPDIR" 0
+        rlRun "rm -rf BUILD/libgcrypt-*" 0-255
+        rlRun "rpmbuild -vv -bc SPECS/libgcrypt.spec" 0
+        libgcrypt_dir="libgcrypt-`rpm -q --qf "%{VERSION}\n" libgcrypt | head -1`"
+        if [ -d "BUILD/$libgcrypt_dir-build" ]; then
+            BUILDDIR="BUILD/$libgcrypt_dir-build/$libgcrypt_dir"
+        else
+            BUILDDIR="BUILD/$libgcrypt_dir"
+        fi
+        rlRun "pushd $BUILDDIR" 0
+        rlRun "fipshmac src/.libs/libgcrypt.so.??" 0
+        rlRun "popd"
+        rlRun "popd"
+    rlPhaseEnd
+
+    rlPhaseStartTest "Upstream testsuite"
+        rlRun "pushd $TOPDIR/$BUILDDIR" 0
+        exp_fails=()
+
+        rlRun "echo 'Expecting ${#exp_fails[@]} fails'"
+        exp_exitcode=0
+        if [[ ${#exp_fails[@]} -gt 0 ]]; then exp_exitcode=2; fi
+        rlRun "make check &> $TmpDir/make_check.out" $exp_exitcode
+        rlRun "grep ^FAIL: $TmpDir/make_check.out" 0,1 "Print fails"
+        if [[ ${#exp_fails[@]} -gt 0 ]]; then
+            for f in $(grep '^FAIL:' $TmpDir/make_check.out | awk -F ': ' '{print $2}'); do
+                if [[ "${exp_fails[@]}" =~ "$f" ]]; then
+                    rlLog "$f failure is expected"
+                else
+                    rlFail "$f failure is not expected"
+                fi
+            done
+        else
+            rlRun "grep \"All [0-9]\+ tests passed\" $TmpDir/make_check.out" 0 \
+                "All tests passed"
+        fi
+        rlRun "cat $TmpDir/make_check.out"
+        rlRun "popd"
+    rlPhaseEnd
+
+    if ! (rlIsRHEL '<=8.4' || ([[ $fipsMode = "enabled" ]] &&  rlIsFedora '<37')); then
+    # (we are ~expecting to fix HW optimization problem around Fedora-37)
+    rlPhaseStartTest "Performance with HW optimizations disabled - bz1990059"
+        # we are gathering more samples, so that this test is robust in shared environments
+        N_SAMPLES=5
+        N_MEDIAN=$(echo "$N_SAMPLES/2+1" |bc)
+        HWF_DENY_FILE="/etc/gcrypt/hwf.deny"
+        # Disabling via cmdline arguments would need either handpicking
+        # all the algorithms (variant with ":"), or making "all" work.
+        # "--disable-hwf all" does not work: https://dev.gnupg.org/T5636
+        #dis_arg="--disable-hwf all"
+        dis_arg=""
+
+        for x in "cipher:aes256:CBC enc" "hash:sha256:SHA256" "mac:hmac_sha256:HMAC_SHA256"; do
+            alg_type=$(echo $x |cut -d: -f1)
+            algorithm=$(echo $x |cut -d: -f2)
+            alg_line=$(echo $x |cut -d: -f3)
+            rlRun "rm -f $algorithm.ena $algorithm.dis"
+            rlLogInfo "Performance measurements started ..."
+            for i in `seq 1 $N_SAMPLES`; do
+                # run with HW optimizations ENAbled
+                rm -f $HWF_DENY_FILE
+                $TOPDIR/$BUILDDIR/tests/bench-slope $alg_type $algorithm |grep "$alg_line" >>$algorithm.ena
+
+                # run with HW optimizations DISabled
+                # this looks idiotic, but I wasn't able to make --disable-hwf work
+                echo "all" >$HWF_DENY_FILE
+                $TOPDIR/$BUILDDIR/tests/bench-slope $dis_arg $alg_type $algorithm |grep "$alg_line" >>$algorithm.dis
+            done
+            rlLogInfo "Performance measurements finished"
+            rlRun "cat $algorithm.ena"
+            rlRun "cat $algorithm.dis"
+            dis=$(cat $algorithm.dis |cut -d'|' -f2 |awk '{ print $1 }' |sort -n |sed -n "$N_MEDIAN p")
+            ena=$(cat $algorithm.ena |cut -d'|' -f2 |awk '{ print $1 }' |sort -n |sed -n "$N_MEDIAN p")
+            rlRun "echo '$algorithm Time: disabled $dis enabled $ena'"
+            if (( $(echo "$dis > $ena" |bc -l) )); then
+                rlPass "HW optimizations work for $algorithm"
+            else
+                rlFail "HW optimizations DO NOT work for $algorithm"
+            fi
+        done
+    rlPhaseEnd
+    fi
+
+    rlPhaseStartCleanup
+        rlRun "popd"
+        rlRun "rm -r $TmpDir" 0
+        rlRun "rlFileRestore"
+    rlPhaseEnd
+
+rlJournalPrintText
+rlJournalEnd