1.11.2-1

Resolves: #2382944

.fmf/version

@@ -0,0 +1 @@
+1

.gitignore

@@ -32,3 +32,13 @@ libgcrypt-1.4.5-hobbled.tar.bz2
 /libgcrypt-1.10.0.tar.bz2.sig
 /libgcrypt-1.10.1.tar.bz2
 /libgcrypt-1.10.1.tar.bz2.sig
+/libgcrypt-1.10.2.tar.bz2
+/libgcrypt-1.10.2.tar.bz2.sig
+/libgcrypt-1.10.3.tar.bz2
+/libgcrypt-1.10.3.tar.bz2.sig
+/libgcrypt-1.11.0.tar.bz2
+/libgcrypt-1.11.0.tar.bz2.sig
+/libgcrypt-1.11.1.tar.bz2
+/libgcrypt-1.11.1.tar.bz2.sig
+/libgcrypt-1.11.2.tar.bz2
+/libgcrypt-1.11.2.tar.bz2.sig

libgcrypt-1.10.0-disable-brainpool.patch

@@ -1,314 +0,0 @@
-From f778433dd29fe07aa1791a0137f6f14febcce607 Mon Sep 17 00:00:00 2001
-From: Jakub Jelen <jjelen@redhat.com>
-Date: Fri, 10 Sep 2021 18:39:00 +0200
-Subject: [PATCH] Allow building libgcrypt without Brainpool curves
-
-* README: Document possibility to build without brainpool curves
-* cipher/ecc-curves.c: Conditionalize brainpool curves definitions
-* configure.ac: Implement possibility to build without brainpool curves
-* tests/curves.c: Skip brainpool curves if they are not built-in
-* tests/keygrip.c: Skip brainpool curves if they are not built-in
-* tests/bench-slope.c: Skip brainpoll curves in they are not built-in
-
---
-
-Signed-off-by: Jakub Jelen <jjelen@redhat.com>
----
- README              |  3 +++
- cipher/ecc-curves.c |  4 ++++
- configure.ac        | 13 +++++++++++++
- tests/bench-slope.c | 12 ++++++++++++
- tests/curves.c      | 46 ++++++++++++++++++++++++++++++---------------
- tests/keygrip.c     |  2 ++
- 6 files changed, 65 insertions(+), 15 deletions(-)
-
-diff --git a/README b/README
-index 4d7697dd..b290d01e 100644
---- a/README
-+++ b/README
-@@ -121,6 +121,9 @@
-                      the list used with the current build the program
-                      tests/version may be used.
- 
-+     --disable-brainpool
-+                     Do not build in support for Brainpool curves.
-+
-      --disable-endian-check
-                      Don't let configure test for the endianness but
-                      try to use the OS provided macros at compile
-diff --git a/cipher/ecc-curves.c b/cipher/ecc-curves.c
-index 7c86e12c..8fd95a9c 100644
---- a/cipher/ecc-curves.c
-+++ b/cipher/ecc-curves.c
-@@ -77,6 +77,7 @@ static const struct
-     { "NIST P-521", "1.3.132.0.35" },
-     { "NIST P-521", "nistp521"   },          /* rfc5656.  */
- 
-+#ifdef ENABLE_BRAINPOOL
-     { "brainpoolP160r1", "1.3.36.3.3.2.8.1.1.1" },
-     { "brainpoolP192r1", "1.3.36.3.3.2.8.1.1.3" },
-     { "brainpoolP224r1", "1.3.36.3.3.2.8.1.1.5" },
-@@ -84,6 +85,7 @@ static const struct
-     { "brainpoolP320r1", "1.3.36.3.3.2.8.1.1.9" },
-     { "brainpoolP384r1", "1.3.36.3.3.2.8.1.1.11"},
-     { "brainpoolP512r1", "1.3.36.3.3.2.8.1.1.13"},
-+#endif /* ENABLE_BRAINPOOL */
- 
-     { "GOST2001-test", "1.2.643.2.2.35.0" },
-     { "GOST2001-CryptoPro-A", "1.2.643.2.2.35.1" },
-@@ -297,6 +299,7 @@ static const ecc_domain_parms_t domain_parms[] =
-       1
-     },
- 
-+#ifdef ENABLE_BRAINPOOL
-     { "brainpoolP160r1", 160, 0,
-       MPI_EC_WEIERSTRASS, ECC_DIALECT_STANDARD,
-       "0xe95e4a5f737059dc60dfc7ad95b3d8139515620f",
-@@ -391,6 +394,7 @@ static const ecc_domain_parms_t domain_parms[] =
-       "b2dcde494a5f485e5bca4bd88a2763aed1ca2b2fa8f0540678cd1e0f3ad80892",
-       1
-     },
-+#endif /* ENABLE_BRAINPOOL */
-     {
-       "GOST2001-test", 256, 0,
-       MPI_EC_WEIERSTRASS, ECC_DIALECT_STANDARD,
-diff --git a/configure.ac b/configure.ac
-index 0e67baf9..a63f7360 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -595,6 +595,14 @@ AC_ARG_WITH(fips-module-version,
- AC_DEFINE_UNQUOTED(FIPS_MODULE_VERSION, "$fips_module_version",
-                    [Define FIPS module version for certification])
- 
-+# Implementation of the --disable-brainpool switch.
-+AC_MSG_CHECKING([whether brainpool curves support is requested])
-+AC_ARG_ENABLE(brainpool,
-+              AS_HELP_STRING([--disable-brainpool],
-+                             [Disable the brainpool curves]),
-+              use_brainpool="$enableval",use_brainpool=yes)
-+AC_MSG_RESULT($use_brainpool)
-+
- # Implementation of the --disable-jent-support switch.
- AC_MSG_CHECKING([whether jitter entropy support is requested])
- AC_ARG_ENABLE(jent-support,
-@@ -2459,6 +2467,10 @@ if test x"$ppccryptosupport" = xyes ; then
-   AC_DEFINE(ENABLE_PPC_CRYPTO_SUPPORT,1,
-             [Enable support for POWER 8 (PowerISA 2.07) crypto extension.])
- fi
-+if test x"$use_brainpool" = xyes ; then
-+  AC_DEFINE(ENABLE_BRAINPOOL, 1,
-+            [Enable support for the brainpool curves.])
-+fi
- if test x"$jentsupport" = xyes ; then
-   AC_DEFINE(ENABLE_JENT_SUPPORT, 1,
-             [Enable support for the jitter entropy collector.])
-@@ -3294,6 +3306,7 @@ GCRY_MSG_WRAP([Enabled digest algorithms:],[$enabled_digests])
- GCRY_MSG_WRAP([Enabled kdf algorithms:   ],[$enabled_kdfs])
- GCRY_MSG_WRAP([Enabled pubkey algorithms:],[$enabled_pubkey_ciphers])
- GCRY_MSG_SHOW([Random number generator:  ],[$random])
-+GCRY_MSG_SHOW([Enabled Brainpool curves: ],[$use_brainpool])
- GCRY_MSG_SHOW([Try using jitter entropy: ],[$jentsupport])
- GCRY_MSG_SHOW([Using linux capabilities: ],[$use_capabilities])
- GCRY_MSG_SHOW([FIPS module version:      ],[$fips_module_version])
-diff --git a/tests/bench-slope.c b/tests/bench-slope.c
-index 5c49ac25..1b5941af 100644
---- a/tests/bench-slope.c
-+++ b/tests/bench-slope.c
-@@ -2316,7 +2316,9 @@ enum bench_ecc_algo
-   ECC_ALGO_NIST_P384,
-   ECC_ALGO_NIST_P521,
-   ECC_ALGO_SECP256K1,
-+#ifdef ENABLE_BRAINPOOL
-   ECC_ALGO_BRAINP256R1,
-+#endif /* ENABLE_BRAINPOOL */
-   __MAX_ECC_ALGO
- };
- 
-@@ -2366,7 +2368,9 @@ ecc_algo_fips_allowed (int algo)
-       case ECC_ALGO_NIST_P521:
- 	return 1;
-       case ECC_ALGO_SECP256K1:
-+#ifdef ENABLE_BRAINPOOL
-       case ECC_ALGO_BRAINP256R1:
-+#endif /* ENABLE_BRAINPOOL */
-       case ECC_ALGO_ED25519:
-       case ECC_ALGO_ED448:
-       case ECC_ALGO_X25519:
-@@ -2402,8 +2406,10 @@ ecc_algo_name (int algo)
- 	return "NIST-P521";
-       case ECC_ALGO_SECP256K1:
- 	return "secp256k1";
-+#ifdef ENABLE_BRAINPOOL
-       case ECC_ALGO_BRAINP256R1:
- 	return "brainpoolP256r1";
-+#endif /* ENABLE_BRAINPOOL */
-       default:
- 	return NULL;
-     }
-@@ -2434,8 +2440,10 @@ ecc_algo_curve (int algo)
- 	return "NIST P-521";
-       case ECC_ALGO_SECP256K1:
- 	return "secp256k1";
-+#ifdef ENABLE_BRAINPOOL
-       case ECC_ALGO_BRAINP256R1:
- 	return "brainpoolP256r1";
-+#endif /* ENABLE_BRAINPOOL */
-       default:
- 	return NULL;
-     }
-@@ -2466,8 +2474,10 @@ ecc_nbits (int algo)
- 	return 521;
-       case ECC_ALGO_SECP256K1:
- 	return 256;
-+#ifdef ENABLE_BRAINPOOL
-       case ECC_ALGO_BRAINP256R1:
- 	return 256;
-+#endif /* ENABLE_BRAINPOOL */
-       default:
- 	return 0;
-     }
-@@ -2665,6 +2675,7 @@ bench_ecc_init (struct bench_obj *obj)
-         err = gcry_sexp_build (&hd->data, NULL,
- 			       "(data (flags raw) (value %m))", x);
- 	break;
-+#ifdef ENABLE_BRAINPOOL
-       case ECC_ALGO_BRAINP256R1:
-         err = gcry_sexp_build (&hd->key_spec, NULL,
-                                "(genkey (ECDSA (curve brainpoolP256r1)))");
-@@ -2673,6 +2684,7 @@ bench_ecc_init (struct bench_obj *obj)
-         err = gcry_sexp_build (&hd->data, NULL,
- 			       "(data (flags raw) (value %m))", x);
- 	break;
-+#endif /* ENABLE_BRAINPOOL */
-     }
- 
-   gcry_mpi_release (x);
-diff --git a/tests/curves.c b/tests/curves.c
-index 3c738171..8eb79565 100644
---- a/tests/curves.c
-+++ b/tests/curves.c
-@@ -33,7 +33,11 @@
- #include "t-common.h"
- 
- /* Number of curves defined in ../cipher/ecc-curves.c */
--#define N_CURVES 27
-+#ifdef ENABLE_BRAINPOOL
-+# define N_CURVES 27
-+#else
-+# define N_CURVES 20
-+#endif
- 
- /* A real world sample public key.  */
- static char const sample_key_1[] =
-@@ -52,6 +56,7 @@ static char const sample_key_1[] =
- static char const sample_key_1_curve[] = "NIST P-256";
- static unsigned int sample_key_1_nbits = 256;
- 
-+#ifdef ENABLE_BRAINPOOL
- /* A made up sample public key.  */
- static char const sample_key_2[] =
- "(public-key\n"
-@@ -68,6 +73,7 @@ static char const sample_key_2[] =
- "  ))";
- static char const sample_key_2_curve[] = "brainpoolP160r1";
- static unsigned int sample_key_2_nbits = 160;
-+#endif /* ENABLE_BRAINPOOL */
- 
- static int in_fips_mode;
- 
-@@ -113,6 +119,7 @@ check_matching (void)
- 
-   gcry_sexp_release (key);
- 
-+#ifdef ENABLE_BRAINPOOL
-   if (!in_fips_mode)
-     {
-       err = gcry_sexp_new (&key, sample_key_2, 0, 1);
-@@ -130,6 +137,7 @@ check_matching (void)
- 
-       gcry_sexp_release (key);
-     }
-+#endif /* ENABLE_BRAINPOOL */
- }
- 
- #define TEST_ERROR_EXPECTED (1 << 0)
-@@ -185,20 +193,26 @@ check_get_params (void)
-        { GCRY_PK_ECC, "1.3.132.0.35" },
-        { GCRY_PK_ECC, "nistp521"   },
- 
--       { GCRY_PK_ECC, "brainpoolP160r1",       TEST_NOFIPS },
--       { GCRY_PK_ECC, "1.3.36.3.3.2.8.1.1.1",  TEST_NOFIPS },
--       { GCRY_PK_ECC, "brainpoolP192r1",       TEST_NOFIPS },
--       { GCRY_PK_ECC, "1.3.36.3.3.2.8.1.1.3",  TEST_NOFIPS },
--       { GCRY_PK_ECC, "brainpoolP224r1",       TEST_NOFIPS },
--       { GCRY_PK_ECC, "1.3.36.3.3.2.8.1.1.5",  TEST_NOFIPS },
--       { GCRY_PK_ECC, "brainpoolP256r1",       TEST_NOFIPS },
--       { GCRY_PK_ECC, "1.3.36.3.3.2.8.1.1.7",  TEST_NOFIPS },
--       { GCRY_PK_ECC, "brainpoolP320r1",       TEST_NOFIPS },
--       { GCRY_PK_ECC, "1.3.36.3.3.2.8.1.1.9",  TEST_NOFIPS },
--       { GCRY_PK_ECC, "brainpoolP384r1",       TEST_NOFIPS },
--       { GCRY_PK_ECC, "1.3.36.3.3.2.8.1.1.11", TEST_NOFIPS },
--       { GCRY_PK_ECC, "brainpoolP512r1",       TEST_NOFIPS },
--       { GCRY_PK_ECC, "1.3.36.3.3.2.8.1.1.13", TEST_NOFIPS },
-+#ifdef ENABLE_BRAINPOOL
-+# define BRAINPOOL_FLAGS TEST_NOFIPS
-+#else
-+# define BRAINPOOL_FLAGS TEST_ERROR_EXPECTED
-+#endif /* ENABLE_BRAINPOOL */
-+       { GCRY_PK_ECC, "brainpoolP160r1",       BRAINPOOL_FLAGS },
-+       { GCRY_PK_ECC, "1.3.36.3.3.2.8.1.1.1",  BRAINPOOL_FLAGS },
-+       { GCRY_PK_ECC, "brainpoolP192r1",       BRAINPOOL_FLAGS },
-+       { GCRY_PK_ECC, "1.3.36.3.3.2.8.1.1.3",  BRAINPOOL_FLAGS },
-+       { GCRY_PK_ECC, "brainpoolP224r1",       BRAINPOOL_FLAGS },
-+       { GCRY_PK_ECC, "1.3.36.3.3.2.8.1.1.5",  BRAINPOOL_FLAGS },
-+       { GCRY_PK_ECC, "brainpoolP256r1",       BRAINPOOL_FLAGS },
-+       { GCRY_PK_ECC, "1.3.36.3.3.2.8.1.1.7",  BRAINPOOL_FLAGS },
-+       { GCRY_PK_ECC, "brainpoolP320r1",       BRAINPOOL_FLAGS },
-+       { GCRY_PK_ECC, "1.3.36.3.3.2.8.1.1.9",  BRAINPOOL_FLAGS },
-+       { GCRY_PK_ECC, "brainpoolP384r1",       BRAINPOOL_FLAGS },
-+       { GCRY_PK_ECC, "1.3.36.3.3.2.8.1.1.11", BRAINPOOL_FLAGS },
-+       { GCRY_PK_ECC, "brainpoolP512r1",       BRAINPOOL_FLAGS },
-+       { GCRY_PK_ECC, "1.3.36.3.3.2.8.1.1.13", BRAINPOOL_FLAGS },
-+#undef BRAINPOOL_ERROR_EXPECTED
- 
-        { GCRY_PK_ECC, "GOST2001-test", TEST_NOFIPS },
-        { GCRY_PK_ECC, "1.2.643.2.2.35.0", TEST_NOFIPS },
-@@ -282,6 +296,7 @@ check_get_params (void)
- 
-   gcry_sexp_release (param);
- 
-+#ifdef ENABLE_BRAINPOOL
-   if (!in_fips_mode)
-     {
-       param = gcry_pk_get_param (GCRY_PK_ECDSA, sample_key_2_curve);
-@@ -297,6 +312,7 @@ check_get_params (void)
- 
-       gcry_sexp_release (param);
-     }
-+#endif /* ENABLE_BRAINPOOL */
- 
-   /* Some simple tests */
-   for (idx=0; idx < DIM (tv); idx++)
-diff --git a/tests/keygrip.c b/tests/keygrip.c
-index 49bd71bc..fc4c17be 100644
---- a/tests/keygrip.c
-+++ b/tests/keygrip.c
-@@ -149,6 +149,7 @@ static struct
-       " (q #04C8A4CEC2E9A9BC8E173531A67B0840DF345C32E261ADD780E6D83D56EFADFD5DE872F8B854819B59543CE0B7F822330464FBC4E6324DADDCD9D059554F63B344#)))",
-       "\xE6\xDF\x94\x2D\xBD\x8C\x77\x05\xA3\xDD\x41\x6E\xFC\x04\x01\xDB\x31\x0E\x99\xB6"
-     },
-+#ifdef ENABLE_BRAINPOOL
-     {
-       GCRY_PK_ECC,
-       "(public-key"
-@@ -197,6 +198,7 @@ static struct
-       "\xD6\xE1\xBF\x43\xAC\x9B\x9A\x12\xE7\x3F",
-       1
-     },
-+#endif /*ENABLE_BRAINPOOL */
-     { /* Ed25519 standard */
-       GCRY_PK_ECC,
-       "(public-key"
--- 
-2.34.1
-

libgcrypt.spec

@@ -13,29 +13,23 @@ sha256sum:close()
 print(string.sub(hash, 0, 16))
 }
 
-# disable brainpool curves by default
-%bcond_with brainpool
-
 Name: libgcrypt
-Version: 1.10.1
-Release: 4%{?dist}
+Version: 1.11.2
+Release: 1%{?dist}
 URL: https://www.gnupg.org/
 Source0: https://www.gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2
 Source1: https://www.gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2.sig
-Source2: wk@g10code.com
-# brainpool curves are still not allowed to be shipped in Fedora
-Patch1: libgcrypt-1.10.0-disable-brainpool.patch
+Source2: https://gnupg.org/signature_key.asc
 # Pass the annobin flags to the libgcrypt.so (#2016349)
-Patch2: libgcrypt-1.10.1-annobin.patch
+Patch1: libgcrypt-1.10.1-annobin.patch
+# https://gitlab.com/redhat-crypto/libgcrypt/libgcrypt-mirror/-/merge_requests/19/
+Patch5: libgcrypt-1.11.0-marvin.patch
 
 %global gcrylibdir %{_libdir}
 %global gcrysoname libgcrypt.so.20
 %global hmackey orboDeJITITejsirpADONivirpUkvarP
 
-# Technically LGPLv2.1+, but Fedora's table doesn't draw a distinction.
-# Documentation and some utilities are GPLv2+ licensed. These files
-# are in the devel subpackage.
-License: LGPLv2+
+License: BSD-3-Clause AND (BSD-3-Clause OR GPL-2.0-only) AND GPL-2.0-or-later AND LGPL-2.1-or-later AND LGPL-2.0-or-later AND MIT-Modern-Variant
 Summary: A general-purpose cryptography library
 BuildRequires: gcc
 BuildRequires: gawk, libgpg-error-devel >= 1.11, pkgconfig
@@ -43,10 +37,11 @@ BuildRequires: gawk, libgpg-error-devel >= 1.11, pkgconfig
 BuildRequires: texinfo
 BuildRequires: autoconf, automake, libtool
 BuildRequires: make
+BuildRequires: gnupg2
+BuildRequires: annobin-annocheck binutils
 
 %package devel
 Summary: Development files for the %{name} package
-License: LGPLv2+ and GPLv2+
 Requires: libgpg-error-devel
 Requires: %{name}%{?_isa} = %{version}-%{release}
 Requires: pkgconfig
@@ -61,21 +56,13 @@ in GNU Privacy Guard.  This package contains files needed to develop
 applications using libgcrypt.
 
 %prep
+%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
 %setup -q
-%patch1 -p1
-%patch2 -p1
+%patch 1 -p1
+%patch 5 -p1
 
 %build
-# This package has a configure test which uses ASMs, but does not link the
-# resultant .o files.  As such the ASM test is always successful, even on
-# architectures were the ASM is not valid when compiling with LTO.
-#
-# -ffat-lto-objects is sufficient to address this issue.  It is the default
-# for F33, but is expected to only be enabled for packages that need it in
-# F34, so we use it here explicitly
-%define _lto_cflags -flto=auto -ffat-lto-objects
-
-# should be all algorithms except SM3 and SM4
+# should be all algorithms except SM3 and SM4, aria
 export DIGESTS='crc gostr3411-94 md4 md5 rmd160 sha1 sha256 sha512 sha3 tiger whirlpool stribog blake2'
 export CIPHERS='arcfour blowfish cast5 des aes twofish serpent rfc2268 seed camellia idea salsa20 gost28147 chacha20'
 
@@ -89,9 +76,11 @@ autoreconf -f
 %endif
      --enable-noexecstack \
      --enable-hmac-binary-check=%{hmackey} \
-     %{!?with_brainpool:--disable-brainpool} \
+     --disable-jent-support \
+     --disable-O-flag-munging \
      --enable-digests="$DIGESTS" \
      --enable-ciphers="$CIPHERS" \
+     --enable-marvin-workaround \
      --with-fips-module-version="$FIPS_MODULE_NAME %{version}-%{srpmhash}"
 sed -i -e '/^sys_lib_dlsearch_path_spec/s,/lib /usr/lib,/usr/lib /lib64 /usr/lib64 /lib,g' libtool
 %make_build
@@ -101,18 +90,21 @@ make check
 # try in faked FIPS mode too
 LIBGCRYPT_FORCE_FIPS_MODE=1 make check
 
-# Add generation of HMAC checksums of the final stripped binaries 
 %define libpath $RPM_BUILD_ROOT%{gcrylibdir}/%{gcrysoname}.?.?
+
+PROFILE=%{?dist} annocheck --ignore-unknown --verbose --profile=${PROFILE:1} %{libpath}
+
+# Add generation of HMAC checksums of the final stripped binaries 
 %define __spec_install_post \
     %{?__debug_package:%{__debug_install_post}} \
     %{__arch_install_post} \
     %{__os_install_post} \
-    pushd src \
+    cd src \
     sed -i -e 's|FILE=.*|FILE=\\\$1|' gen-note-integrity.sh \
     READELF=readelf AWK=awk ECHO_N="-n" bash gen-note-integrity.sh %{libpath} > %{libpath}.hmac \
-    objcopy --update-section .note.fdo.integrity=%{libpath}.hmac %{libpath} new \
-    mv -f new %{libpath} \
-    rm -f %{libpath}.hmac \
+    objcopy --update-section .note.fdo.integrity=%{libpath}.hmac %{libpath} %{libpath}.new \
+    mv -f %{libpath}.new %{libpath} \
+    rm -f %{libpath}.hmac
 %{nil}
 
 %install
@@ -182,6 +174,61 @@ mkdir -p -m 755 $RPM_BUILD_ROOT/etc/gcrypt
 %license COPYING
 
 %changelog
+* Mon Nov 03 2025 Jakub Jelen <jjelen@redhat.com> - 1.11.2-1
+- New upstream release (#2406804)
+
+* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.11.1-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Tue May 13 2025 Jakub Jelen <jjelen@redhat.com> - 1.11.1-1
+- New upstream release (#2364878)
+
+* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.11.0-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Tue Oct 29 2024 Jakub Jelen <jjelen@redhat.com> - 1.11.0-4
+- Run annocheck as part of the build
+- Use upstream CF protection patches
+- Fix PAC/BTI protection for Aarch64
+- Fix CVE-2024-2236 (#2274128)
+
+* Thu Jul 25 2024 Jakub Jelen <jjelen@redhat.com> - 1.11.0-3
+- Disable -O flag munging and remove needles modification of LTO flags.
+
+* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.11.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
+* Wed Jun 19 2024 Jakub Jelen <jjelen@redhat.com> - 1.11.0-1
+- New upstream release (#2293064)
+
+* Tue Mar 26 2024 Jakub Jelen <jjelen@redhat.com> - 1.10.3-4
+- Replace deprecated fgrep (#2271503)
+
+* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.3-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.3-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Tue Nov 14 2023 Jakub Jelen <jjelen@redhat.com> - 1.10.3-1
+- New upstream release (#2249639)
+
+* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.2-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Tue Apr 11 2023 Jakub Jelen <jjelen@redhat.com> - 1.10.2-1
+- New upstream release (#2185084)
+
+* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.1-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Sat Dec  3 2022 Florian Weimer <fweimer@redhat.com> - 1.10.1-6
+- Port configure script to C99
+
+* Tue Nov 08 2022 Todd Zullinger <tmz@pobox.com> - 1.10.1-5
+- enable brainpool by default (#1413618)
+- fix sporadic failures generating RSA keys in FIPS mode
+
 * Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.1-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
 

signature_key.asc

@@ -0,0 +1,86 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQGNBFjLuq4BDACnM7zNSIaVMAacTwjXa5TGYe13i6ilHe4VL0NShzrgzjcQg531
+3cRgiiiNA7OSOypMqVs73Jez6ZUctn2GVsHBrS/io9NcuC9pVwf8a61WlcEa+EtB
+a3G7HlBmEWnwaUdAtWKNuAi9Xn+Ir7H2xEdksmmd5a0/QnL+sX705boVPF/tpYtb
+LGpPxa78tNrtxDkSwy8Wmi0IADYLI5yI7/yUGeJd8RSCU/fLRKC9fG7YOZRq0tsO
+MhVNWmtUjbG6e73Lu8LKnCZgs1/fC8hvPyARieSV5mdN8s1oWd7oYctfgL4uBleD
+ItAA8GhjKejutzHN8Ei/APw6AiiSyEjnPg+cTX8OgvLGJWjks0H6mPZeB1v/kGyZ
+hBS9vm540h2/MmlVN2ntiCK5TZGeSWpqddiqusfVXotMRpN4HeLKoZh4RAncaCbZ
+F/S+YLeN+kMXY4k3Fqt1fjTX6veFCbthI9pDdHzU9LfUVNp9D/5ktC/tYMORMegV
++wSMxi9G2YWKJkMAEQEAAYkBzgQfAQgAOBYhBFuAxXVCmPDLVdjtarzvfilLCS4o
+BQJYy8DdFwyAAZSlyaA8L+XKOwldjh/fcjz0YraxAgcAAAoJELzvfilLCS4oNgoL
+/0+K1xIx8JW7Lk5M6bYCvNA4fdlEcwQIT4UidJFM9m+suxYFWIGfebvHpRlEuJTg
+dBjkEit8uLAoJXU0BRkKTLrzTF+qDUE79Wfx/R+0nOgJ7aMykQOi0AvuwzMYz4dg
+xIVS2Daou4DF7bh/KF8+fqrmq8P8W1ZrkuFDanMWpHeAPx1uj2skYbo7uPqFdvlJ
+hlNHrcxlcCkjf1InAt0Xt5lMvEsCRUPf9xAH4mNEhs0lh9c+200YPRmtnLWAzc1K
+ckLIC8Q+mUR3DjZDqBlDBEPegXkrI0+MlvRA+9AnAm4YPqTMUfpZ6ZOAWeFjC/6Z
+QYxG/AdWGkb4WFindzklQfybEuiekP8vU07ACQwSwH8PYe0UCom1YrlRUjX7QLkn
+ZLWoeZg8BZy9GTM1Ut7Q1Q2uTw6mxxISuef+RFgYOHjWwLpFWZpqC88xERl7o/iz
+iERJRt/593IctbjO9wenWt2peIAwzR4nz7LqM6ZFTdRAETmcdSvYRhg2Qt8hUE47
+CbQkQW5kcmUgSGVpbmVja2UgKFJlbGVhc2UgU2lnbmluZyBLZXkpiQHUBBMBCAA+
+FiEEW4DFdUKY8MtV2O1qvO9+KUsJLigFAljLuq4CGwMFCRLMAwAFCwkIBwIGFQgJ
+CgsCBBYCAwECHgECF4AACgkQvO9+KUsJLihC/QwAhCC+SEvcFLcutgZ8HfcCtoZs
+IoVzZEy7DjqIvGgnTssD8HCLnIAHCDvnP7dJW3uMuLCdSqym3cjlEIiQMsaGywkl
+fzJISAwJrGQdWSKRd535jXpEXQlXDKal/IwMKAUt0PZtlCc9S3gwixQryxdJ28lJ
+6h2T9fVDr8ZswMmTAFG91uctfhjKOMgPt8UhSPGW484WsIsQgkbOvf+Kfswl0eHu
+ywX+pKAB5ZQ/9GVC6Ug4xfrdiJL0azJTPnvjMY5JYp6/L9RURs5hP5AnHR2j/PPo
+sAtsFCjmbRbOMiASzklnUJPbSz5kfLloDWZmrUScjbzmsXehGyt433JGyRhZJl4x
+/jPbzKhaaAHsGd+fRao6vlLOwFywDDVMp6JuyK7UeUb7I8ekTbSkGFA+l2Oa3O6/
+Y7PYhq7hwwAFuZckYI98IpHNCG1fS9W07FyKdvQbK1PbF1JFRKfsUCWYMKqDnbqE
+o5jivPEHZImw6iYhhXcyEYl8fjcb9T6/S+wOP7aviQGzBBABCAAdFiEElKXJoDwv
+5co7CV2OH99yPPRitrEFAljLv5sACgkQH99yPPRitrFw4gv/XFMFN+/LHsn9hJOP
+4rCwl1yUuxXuYmZgc0sRoY3EpeQkJVyKurQuqqKoy2VuoMiF0O1kAQmGoFtVPUk7
+b8hCoutqB5GyeyKcoLP+WINgVhB2gXg7TSp3MPLBKkgqvSDvPitgRxBqFb4LW8LJ
+bDbfwGrzIvXfDV3WvsrHVPbc2fhlWdL8d+3AE6mFiXF3eTpgmV3ApSBQV12MkkCk
+icLIPmp+ZxZON+OP52ZXkRtfMgOy4Oa/41agrViDAZdMOGeGkhPertQheQZgXzmo
+GF5Wz498HPM80Kv35X91l3iGzL+icEtO+tWea2YscsZ6qpRe2lfVPHk3B+anlmCj
+m4kM4cBd39xa4HHSVh/bRHbZNtgVr7slQCKxlHgQOGVI5vCxPCwEsgJ2KBk03Nk/
+IA9EKO+czfh3/bHW6uMbEqrYDCnt+hmzZrpKDSGcwS/KOhvMUIMlb7/8vDKum6mp
+/8xAtVZ6IAxYZNt3qg7Y7aLRtzCTyqm8rJQrZPtRaQcgLoEimDMEX0PliRYJKwYB
+BAHaRw8BAQdAz75Hlekc16JhhfI0MKdEVxLdkxhcMCO0ZG6WMBAmNpe0H1dlcm5l
+ciBLb2NoIChkaXN0IHNpZ25pbmcgMjAyMCmImgQTFgoAQhYhBG2qbmSnbShAVxtJ
+AlKIl7gmQDraBQJfQ+w1AhsDBQkShccRBQsJCAcCAyICAQYVCgkICwIEFgIDAQIe
+BwIXgAAKCRBSiJe4JkA62nmuAP9uL/HOdB0gvwWrH+FpURJLs4bnaZaPIk9ARrU0
+EXRgJgD/YCGfHQXpIPT0ZaXuwJexK04Z+qMFR/bM1q1Leo5CjgaIbQQQEQsAHRYh
+BIBhWHD1utaQMzaG0PKthaweQrNnBQJfQ/HmAAoJEPKthaweQrNnIZkA3jG6LcZv
+V/URn8Y8OJqsyYa4C3NI4nN+OhEvYhgA4PHzMnALeXIpA2gblvjFIPJPAhDBAU37
+c5PA6+6IdQQQFggAHRYhBK6oTtzwGthsRwHIXGMROuhmWH0KBQJfQ/IlAAoJEGMR
+OuhmWH0K1+MA/0uJ5AHcnSfIBEWHNJwwVVLGyrxAWtS2U+zeymp/UvlPAQDErCLZ
+l0dBiPG3vlowFx5TNep7tanBs6ZJn8F1ao1tAIkBMwQQAQgAHRYhBNhpISPEBl3q
+Xg86tSSbOdJPJeO2BQJfQ/OuAAoJECSbOdJPJeO2DVoH/0o9if66ph6FJrgr+A/W
+HNVeHxmM5tUQhpL1wpRS70SKcsJgolf5CxO5iTQf3HlZe544xGbIU/aCTJsWw9zi
+UE8KmhAtKV4eL/7oQ7xx4nxPnABLpudtM8A44nsM1x/XiYrJnnDm29QjYEGd2Hi8
+7npc7VWKzLoj+I/WcXquynJi5O9TUxW9Bknd1pjpxFkf8v+msjBzCD5VKJgr0CR8
+wA6peQBWeGZX2HacosMIZH4TfL0r0TFla6LJIkNBz9DyIm1yL4L8oRH0950hQljP
+C7TM3L7aRpX+4Kph6llFz6g7MALGFP95kyJ6o+XED9ORuuQVZMBMIkNC0tXOu10V
+bdqIdQQQFgoAHRYhBMHTS2khnkruwLocIeP9/yGORbcrBQJfQ/P8AAoJEOP9/yGO
+Rbcr3lQBAMas8Vl3Hdl3g2I283lz1uHiGvlwcnk2TLeB+U4zIwC9AQCy0nnazVNt
+VQPID1ZCMoaOX7AzOjaqQDLf4j+dVTxgBJgzBGCkgocWCSsGAQQB2kcPAQEHQJmd
+fwp8jEN5P3eEjhQiWk6zQi8utvgOvYD57XmE+H8+tCBOaWliZSBZdXRha2EgKEdu
+dVBHIFJlbGVhc2UgS2V5KYiaBBMWCgBCFiEErI4RW/c+LY1H+pkI6Y6bLRnGyL0F
+AmCkgocCGwMFCQsNBpkFCwkIBwIDIgIBBhUKCQgLAgQWAgMBAh4HAheAAAoJEOmO
+my0Zxsi9/4IA/1rvSr3MU+Sv4jhNDzD+CeC3gmHkPew6pi9VHEsEwdgmAQD2BtiX
+7w1sJL/CBylGWv5jxj4345mP9YfZm0RsgzPjDIh1BBAWCAAdFiEEJJyzdxdQdF1c
+3TI84mewUjZPAo0FAmFAQ54ACgkQ4mewUjZPAo1CiAD+KTT1UVdQTGHMyvHwZocS
+QjU8xhcZrTet+dvvjrE5+4MA/RBdJPZgFevUKu68NEy0Lo+RbkeCtmQJ/c8v5ieF
+vW0AiQEzBBABCAAdFiEEEkEkvTtIYq96CkLxALRevUynur4FAmFAQ7cACgkQALRe
+vUynur4kaAgAolPR8TNWVS0vXMKrr0k0l2M/8QkZTaLZx1GT9Nx1yb4WJKY7ElPM
+YkhGDxetvFBETx0pH/6R3jtj6Crmur+NKHVSRY+rCYpFPDn6ciIOryssRx2G4kCZ
+t+nFB9JyDbBOZAR8DK4pN1mAxG/yLDt4oKcUQsP2xlEFum+phxyR8KyYCpkwKRxY
+eK+6lfilQuveoUwp/Xx5wXPNUy6q4eOOovCW7gS7I7288NGHCa2ul8sD6vA9C4mM
+4Zxaole9P9wwJe1zZFtCIy88zHM9vqv+YM9DxMCaW24+rUztr7eD4bCRdG+QlSh+
+7R/TaqSxY1eAAd1J5tma9CNJO73pTKU+/JhTBGFpSqMTCSskAwMCCAEBBwIDBF6X
+D9NmUQDgiyYNbhs1DMJ14mIw812wY1HVx/4QWYWiBunhrvSFxVbzsjD7/Wv+v3bm
+MPrL+M2DLyFiSewNmcS0JEdudVBHLmNvbSAoUmVsZWFzZSBTaWduaW5nIEtleSAy
+MDIxKYiaBBMTCABCFiEEAvON/3Mf+XywOaHaVJ5pXpBboggFAmFpSqMCGwMFCQ9x
+14oFCwkIBwIDIgIBBhUKCQgLAgQWAgMBAh4HAheAAAoJEFSeaV6QW6IITkoA/RYa
+jaTl1eEBU/Gdm12o3jrI55N5xZK2XTqSx25clVyjAP0XwMW/Og5+ND1ri3bAqADV
+WlBDUswz8wYxsb0C4kYBkoh1BBAWCgAdFiEEbapuZKdtKEBXG0kCUoiXuCZAOtoF
+AmFpTvEACgkQUoiXuCZAOtrJQAEAh7YyykjAy/Qs1yC3ji8iBfIVnPXvblrIx3SR
+RyDwRC8BAKtZbEuKTtPlgkLUgMleTcZJ/vEhJE+GvfQ9o5gWCqEFiHUEEBYKAB0W
+IQTB00tpIZ5K7sC6HCHj/f8hjkW3KwUCYWlPWgAKCRDj/f8hjkW3Kx4eAQDp6aGS
+N/fU4xLl8RSvQUVjVA+aCTrMQR3hRwqw8liF2wEA3O3ECxz6e1+DoItYoJBBLKLw
+eiInsGZ/+h5XYrpXTgA=
+=4+Sn
+-----END PGP PUBLIC KEY BLOCK-----

sources

@@ -1,2 +1,2 @@
-SHA512 (libgcrypt-1.10.1.tar.bz2) = e5ca7966624fff16c3013795836a2c4377f0193dbb4ac5ad2b79654b1fa8992e17d83816569a402212dc8367a7980d4141f5d6ac282bae6b9f02186365b61f13
-SHA512 (libgcrypt-1.10.1.tar.bz2.sig) = b156ae05079776698bc95ba5a9e48e95de8f716aa1760ef4b2e7cb8518ccec660337fc7823f865bde870461800d472fd8e458d03a7095b6bb614f6dd96f796d8
+SHA512 (libgcrypt-1.11.2.tar.bz2) = b706cea602cc8f0896e57ce979643bf78974b05faec27c1b053b773c57d8b04250e30e95a4ef5899e1df981d01d8d08f0a36e10b5820a5ec4183e74c02e5f1f0
+SHA512 (libgcrypt-1.11.2.tar.bz2.sig) = e63d240a9b97aa218c98c5baa72a30321ae85412d4a8748e36578bd9498fe8c8ee2ba84835d1783cdfc1e5dfb66b0a89409d6263e9c06f4cd11e919d4bce0cd2

tests/smoke-test/main.fmf

@@ -0,0 +1,25 @@
+summary: Test calls upstream test suite.
+test: ./runtest.sh
+enabled: true
+framework: beakerlib
+require:
+  - library(distribution/fips)
+recommend:
+  - libgcrypt
+  - nfs-utils
+  - rpm-build
+  - autoconf
+  - automake
+  - libtool
+  - gawk
+  - gcc-c++
+  - libgpg-error-devel
+  - pkgconfig
+  - texinfo
+  - fipscheck
+  - libkcapi-fipscheck
+  - crypto-policies-scripts
+  - bc
+  - annobin-annocheck
+  - gnupg2
+duration: 45m

tests/smoke-test/runtest.sh

@@ -54,41 +54,35 @@ rlJournalStart
         rlRun "pushd $TOPDIR" 0
         rlRun "rm -rf BUILD/libgcrypt-*" 0-255
         rlRun "rpmbuild -vv -bc SPECS/libgcrypt.spec" 0
-        rlRun "pushd BUILD/libgcrypt-*" 0
+        libgcrypt_dir="libgcrypt-`rpm -q --qf "%{VERSION}\n" libgcrypt | head -1`"
+        if [ -d "BUILD/$libgcrypt_dir-build" ]; then
+            BUILDDIR="BUILD/$libgcrypt_dir-build/$libgcrypt_dir"
+        else
+            BUILDDIR="BUILD/$libgcrypt_dir"
+        fi
+        rlRun "pushd $BUILDDIR" 0
         rlRun "fipshmac src/.libs/libgcrypt.so.??" 0
         rlRun "popd"
         rlRun "popd"
     rlPhaseEnd
 
     rlPhaseStartTest "Upstream testsuite"
-        rlRun "pushd $TOPDIR/BUILD/libgcrypt-*" 0
+        rlRun "pushd $TOPDIR/$BUILDDIR" 0
         exp_fails=()
-        if [[ $fipsMode = 'enabled' ]]; then
-            if rlIsFedora 33; then
-                exp_fails+=("basic")
-                exp_fails+=("basic-disable-all-hwf")
-                exp_fails+=("t-kdf")
-                exp_fails+=("t-secmem")
-            elif rlIsFedora 34; then
-                exp_fails+=("basic")
-                exp_fails+=("basic-disable-all-hwf")
-                exp_fails+=("t-kdf")
-                exp_fails+=("t-secmem")
-                exp_fails+=("t-x448")
-            elif rlIsFedora 35; then # Fedora-35
-                exp_fails+=("curves")
-            fi
-        fi
+
         rlRun "echo 'Expecting ${#exp_fails[@]} fails'"
         exp_exitcode=0
         if [[ ${#exp_fails[@]} -gt 0 ]]; then exp_exitcode=2; fi
         rlRun "make check &> $TmpDir/make_check.out" $exp_exitcode
         rlRun "grep ^FAIL: $TmpDir/make_check.out" 0,1 "Print fails"
         if [[ ${#exp_fails[@]} -gt 0 ]]; then
-            for f in "${exp_fails[@]}"; do
-                rlAssertGrep "^FAIL: $f\$" $TmpDir/make_check.out
+            for f in $(grep '^FAIL:' $TmpDir/make_check.out | awk -F ': ' '{print $2}'); do
+                if [[ "${exp_fails[@]}" =~ "$f" ]]; then
+                    rlLog "$f failure is expected"
+                else
+                    rlFail "$f failure is not expected"
+                fi
             done
-            [[ $(grep -c '^FAIL:' $TmpDir/make_check.out) -eq ${#exp_fails[@]} ]] || rlFail "Unexpected fails present"
         else
             rlRun "grep \"All [0-9]\+ tests passed\" $TmpDir/make_check.out" 0 \
                 "All tests passed"
@@ -119,12 +113,12 @@ rlJournalStart
             for i in `seq 1 $N_SAMPLES`; do
                 # run with HW optimizations ENAbled
                 rm -f $HWF_DENY_FILE
-                $TOPDIR/BUILD/libgcrypt-*/tests/bench-slope $alg_type $algorithm |grep "$alg_line" >>$algorithm.ena
+                $TOPDIR/$BUILDDIR/tests/bench-slope $alg_type $algorithm |grep "$alg_line" >>$algorithm.ena
 
                 # run with HW optimizations DISabled
                 # this looks idiotic, but I wasn't able to make --disable-hwf work
                 echo "all" >$HWF_DENY_FILE
-                $TOPDIR/BUILD/libgcrypt-*/tests/bench-slope $dis_arg $alg_type $algorithm |grep "$alg_line" >>$algorithm.dis
+                $TOPDIR/$BUILDDIR/tests/bench-slope $dis_arg $alg_type $algorithm |grep "$alg_line" >>$algorithm.dis
             done
             rlLogInfo "Performance measurements finished"
             rlRun "cat $algorithm.ena"

tests/tests.yml

@@ -1,20 +0,0 @@
-- hosts: localhost
-  tags:
-  - classic
-  - container
-  roles:
-  - role: standard-test-beakerlib
-    tests:
-    - smoke-test
-    required_packages:
-    - fipscheck
-    - gawk
-    - gcc-c++
-    - libgcrypt
-    - libgpg-error-devel
-    - libselinux-utils
-    - nfs-utils
-    - pkgconfig
-    - rpm-build
-    - texinfo
-    - wget