1.11.2-1

Resolves: #2382944

.fmf/version

@@ -0,0 +1 @@
+1

.gitignore

@@ -38,3 +38,7 @@ libgcrypt-1.4.5-hobbled.tar.bz2
 /libgcrypt-1.10.3.tar.bz2.sig
 /libgcrypt-1.11.0.tar.bz2
 /libgcrypt-1.11.0.tar.bz2.sig
+/libgcrypt-1.11.1.tar.bz2
+/libgcrypt-1.11.1.tar.bz2.sig
+/libgcrypt-1.11.2.tar.bz2
+/libgcrypt-1.11.2.tar.bz2.sig

libgcrypt-1.11.0-Disable-SHA3-s390x-acceleration-for-CSHAKE.patch

@@ -1,63 +0,0 @@
-From 2486d9b5ae015c1786cb84466a751da4bc0d7122 Mon Sep 17 00:00:00 2001
-From: Jussi Kivilinna <jussi.kivilinna@iki.fi>
-Date: Thu, 20 Jun 2024 20:10:09 +0300
-Subject: [PATCH] Disable SHA3 s390x acceleration for CSHAKE
-
-* cipher/keccak.c (keccak_final_s390x): Add assert check for
-expected SHAKE suffix.
-(_gcry_cshake_customize, cshake_hash_buffers): Disable s390x
-acceleration when selecting CSHAKE suffix.
---
-
-Signed-off-by: Jussi Kivilinna <jussi.kivilinna@iki.fi>
----
- cipher/keccak.c | 16 ++++++++++++++--
- 1 file changed, 14 insertions(+), 2 deletions(-)
-
-diff --git a/cipher/keccak.c b/cipher/keccak.c
-index aaf83a62..44cc9f71 100644
---- a/cipher/keccak.c
-+++ b/cipher/keccak.c
-@@ -745,6 +745,8 @@ keccak_final_s390x (void *context)
-     }
-   else
-     {
-+      gcry_assert(ctx->suffix == SHAKE_DELIMITED_SUFFIX);
-+
-       klmd_shake_execute (ctx->kimd_func, &ctx->state, NULL, 0, ctx->buf,
- 			  ctx->count);
-       ctx->count = 0;
-@@ -1497,9 +1499,14 @@ _gcry_cshake_customize (void *context, struct gcry_cshake_customization *p)
-     /* No customization */
-     return 0;
- 
-+  ctx->suffix = CSHAKE_DELIMITED_SUFFIX;
-+#ifdef USE_S390X_CRYPTO
-+  /* CSHAKE suffix is not supported by s390x/kimd. */
-+  ctx->kimd_func = 0;
-+#endif
-+
-   len_written = cshake_input_n (ctx, p->n, p->n_len);
-   cshake_input_s (ctx, p->s, p->s_len, len_written);
--  ctx->suffix = CSHAKE_DELIMITED_SUFFIX;
-   return 0;
- }
- 
-@@ -1536,9 +1543,14 @@ cshake_hash_buffers (const gcry_md_spec_t *spec, void *outbuf, size_t nbytes,
-           size_t s_len = iov[1].len;
-           size_t len;
- 
-+          ctx.suffix = CSHAKE_DELIMITED_SUFFIX;
-+#ifdef USE_S390X_CRYPTO
-+          /* CSHAKE suffix is not supported by s390x/kimd. */
-+          ctx.kimd_func = 0;
-+#endif
-+
-           len = cshake_input_n (&ctx, n, n_len);
-           cshake_input_s (&ctx, s, s_len, len);
--          ctx.suffix = CSHAKE_DELIMITED_SUFFIX;
-         }
-       iovcnt -= 2;
-       iov += 2;
--- 
-2.43.0

libgcrypt.spec

@@ -14,16 +14,16 @@ print(string.sub(hash, 0, 16))
 }
 
 Name: libgcrypt
-Version: 1.11.0
-Release: 3%{?dist}
+Version: 1.11.2
+Release: 1%{?dist}
 URL: https://www.gnupg.org/
 Source0: https://www.gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2
 Source1: https://www.gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2.sig
 Source2: https://gnupg.org/signature_key.asc
 # Pass the annobin flags to the libgcrypt.so (#2016349)
 Patch1: libgcrypt-1.10.1-annobin.patch
-# https://dev.gnupg.org/T7167
-Patch2: libgcrypt-1.11.0-Disable-SHA3-s390x-acceleration-for-CSHAKE.patch
+# https://gitlab.com/redhat-crypto/libgcrypt/libgcrypt-mirror/-/merge_requests/19/
+Patch5: libgcrypt-1.11.0-marvin.patch
 
 %global gcrylibdir %{_libdir}
 %global gcrysoname libgcrypt.so.20
@@ -38,6 +38,7 @@ BuildRequires: texinfo
 BuildRequires: autoconf, automake, libtool
 BuildRequires: make
 BuildRequires: gnupg2
+BuildRequires: annobin-annocheck binutils
 
 %package devel
 Summary: Development files for the %{name} package
@@ -58,7 +59,7 @@ applications using libgcrypt.
 %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
 %setup -q
 %patch 1 -p1
-%patch 2 -p1
+%patch 5 -p1
 
 %build
 # should be all algorithms except SM3 and SM4, aria
@@ -79,6 +80,7 @@ autoreconf -f
      --disable-O-flag-munging \
      --enable-digests="$DIGESTS" \
      --enable-ciphers="$CIPHERS" \
+     --enable-marvin-workaround \
      --with-fips-module-version="$FIPS_MODULE_NAME %{version}-%{srpmhash}"
 sed -i -e '/^sys_lib_dlsearch_path_spec/s,/lib /usr/lib,/usr/lib /lib64 /usr/lib64 /lib,g' libtool
 %make_build
@@ -88,8 +90,11 @@ make check
 # try in faked FIPS mode too
 LIBGCRYPT_FORCE_FIPS_MODE=1 make check
 
-# Add generation of HMAC checksums of the final stripped binaries 
 %define libpath $RPM_BUILD_ROOT%{gcrylibdir}/%{gcrysoname}.?.?
+
+PROFILE=%{?dist} annocheck --ignore-unknown --verbose --profile=${PROFILE:1} %{libpath}
+
+# Add generation of HMAC checksums of the final stripped binaries 
 %define __spec_install_post \
     %{?__debug_package:%{__debug_install_post}} \
     %{__arch_install_post} \
@@ -169,6 +174,24 @@ mkdir -p -m 755 $RPM_BUILD_ROOT/etc/gcrypt
 %license COPYING
 
 %changelog
+* Mon Nov 03 2025 Jakub Jelen <jjelen@redhat.com> - 1.11.2-1
+- New upstream release (#2406804)
+
+* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.11.1-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Tue May 13 2025 Jakub Jelen <jjelen@redhat.com> - 1.11.1-1
+- New upstream release (#2364878)
+
+* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.11.0-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Tue Oct 29 2024 Jakub Jelen <jjelen@redhat.com> - 1.11.0-4
+- Run annocheck as part of the build
+- Use upstream CF protection patches
+- Fix PAC/BTI protection for Aarch64
+- Fix CVE-2024-2236 (#2274128)
+
 * Thu Jul 25 2024 Jakub Jelen <jjelen@redhat.com> - 1.11.0-3
 - Disable -O flag munging and remove needles modification of LTO flags.
 

sources

@@ -1,2 +1,2 @@
-SHA512 (libgcrypt-1.11.0.tar.bz2) = 8e093e69e3c45d30838625ca008e995556f0d5b272de1c003d44ef94633bcc0d0ef5d95e8725eb531bfafb4490ac273488633e0c801200d4666194f86c3e270e
-SHA512 (libgcrypt-1.11.0.tar.bz2.sig) = 8c5ceb50d70ccdedcc1ff4b31a65a07198567b85f582e3e67699cc3e5d012bebf7b1d4903652d11905a9cd845976ad7d3642474804777d0bdc46c6847d92fe38
+SHA512 (libgcrypt-1.11.2.tar.bz2) = b706cea602cc8f0896e57ce979643bf78974b05faec27c1b053b773c57d8b04250e30e95a4ef5899e1df981d01d8d08f0a36e10b5820a5ec4183e74c02e5f1f0
+SHA512 (libgcrypt-1.11.2.tar.bz2.sig) = e63d240a9b97aa218c98c5baa72a30321ae85412d4a8748e36578bd9498fe8c8ee2ba84835d1783cdfc1e5dfb66b0a89409d6263e9c06f4cd11e919d4bce0cd2

tests/smoke-test/main.fmf

@@ -0,0 +1,25 @@
+summary: Test calls upstream test suite.
+test: ./runtest.sh
+enabled: true
+framework: beakerlib
+require:
+  - library(distribution/fips)
+recommend:
+  - libgcrypt
+  - nfs-utils
+  - rpm-build
+  - autoconf
+  - automake
+  - libtool
+  - gawk
+  - gcc-c++
+  - libgpg-error-devel
+  - pkgconfig
+  - texinfo
+  - fipscheck
+  - libkcapi-fipscheck
+  - crypto-policies-scripts
+  - bc
+  - annobin-annocheck
+  - gnupg2
+duration: 45m

tests/smoke-test/runtest.sh

@@ -54,41 +54,35 @@ rlJournalStart
         rlRun "pushd $TOPDIR" 0
         rlRun "rm -rf BUILD/libgcrypt-*" 0-255
         rlRun "rpmbuild -vv -bc SPECS/libgcrypt.spec" 0
-        rlRun "pushd BUILD/libgcrypt-*" 0
+        libgcrypt_dir="libgcrypt-`rpm -q --qf "%{VERSION}\n" libgcrypt | head -1`"
+        if [ -d "BUILD/$libgcrypt_dir-build" ]; then
+            BUILDDIR="BUILD/$libgcrypt_dir-build/$libgcrypt_dir"
+        else
+            BUILDDIR="BUILD/$libgcrypt_dir"
+        fi
+        rlRun "pushd $BUILDDIR" 0
         rlRun "fipshmac src/.libs/libgcrypt.so.??" 0
         rlRun "popd"
         rlRun "popd"
     rlPhaseEnd
 
     rlPhaseStartTest "Upstream testsuite"
-        rlRun "pushd $TOPDIR/BUILD/libgcrypt-*" 0
+        rlRun "pushd $TOPDIR/$BUILDDIR" 0
         exp_fails=()
-        if [[ $fipsMode = 'enabled' ]]; then
-            if rlIsFedora 33; then
-                exp_fails+=("basic")
-                exp_fails+=("basic-disable-all-hwf")
-                exp_fails+=("t-kdf")
-                exp_fails+=("t-secmem")
-            elif rlIsFedora 34; then
-                exp_fails+=("basic")
-                exp_fails+=("basic-disable-all-hwf")
-                exp_fails+=("t-kdf")
-                exp_fails+=("t-secmem")
-                exp_fails+=("t-x448")
-            elif rlIsFedora 35; then # Fedora-35
-                exp_fails+=("curves")
-            fi
-        fi
+
         rlRun "echo 'Expecting ${#exp_fails[@]} fails'"
         exp_exitcode=0
         if [[ ${#exp_fails[@]} -gt 0 ]]; then exp_exitcode=2; fi
         rlRun "make check &> $TmpDir/make_check.out" $exp_exitcode
         rlRun "grep ^FAIL: $TmpDir/make_check.out" 0,1 "Print fails"
         if [[ ${#exp_fails[@]} -gt 0 ]]; then
-            for f in "${exp_fails[@]}"; do
-                rlAssertGrep "^FAIL: $f\$" $TmpDir/make_check.out
+            for f in $(grep '^FAIL:' $TmpDir/make_check.out | awk -F ': ' '{print $2}'); do
+                if [[ "${exp_fails[@]}" =~ "$f" ]]; then
+                    rlLog "$f failure is expected"
+                else
+                    rlFail "$f failure is not expected"
+                fi
             done
-            [[ $(grep -c '^FAIL:' $TmpDir/make_check.out) -eq ${#exp_fails[@]} ]] || rlFail "Unexpected fails present"
         else
             rlRun "grep \"All [0-9]\+ tests passed\" $TmpDir/make_check.out" 0 \
                 "All tests passed"
@@ -119,12 +113,12 @@ rlJournalStart
             for i in `seq 1 $N_SAMPLES`; do
                 # run with HW optimizations ENAbled
                 rm -f $HWF_DENY_FILE
-                $TOPDIR/BUILD/libgcrypt-*/tests/bench-slope $alg_type $algorithm |grep "$alg_line" >>$algorithm.ena
+                $TOPDIR/$BUILDDIR/tests/bench-slope $alg_type $algorithm |grep "$alg_line" >>$algorithm.ena
 
                 # run with HW optimizations DISabled
                 # this looks idiotic, but I wasn't able to make --disable-hwf work
                 echo "all" >$HWF_DENY_FILE
-                $TOPDIR/BUILD/libgcrypt-*/tests/bench-slope $dis_arg $alg_type $algorithm |grep "$alg_line" >>$algorithm.dis
+                $TOPDIR/$BUILDDIR/tests/bench-slope $dis_arg $alg_type $algorithm |grep "$alg_line" >>$algorithm.dis
             done
             rlLogInfo "Performance measurements finished"
             rlRun "cat $algorithm.ena"

tests/tests.yml

@@ -1,20 +0,0 @@
-- hosts: localhost
-  tags:
-  - classic
-  - container
-  roles:
-  - role: standard-test-beakerlib
-    tests:
-    - smoke-test
-    required_packages:
-    - fipscheck
-    - gawk
-    - gcc-c++
-    - libgcrypt
-    - libgpg-error-devel
-    - libselinux-utils
-    - nfs-utils
-    - pkgconfig
-    - rpm-build
-    - texinfo
-    - wget