1.11.2-1

Resolves: #2382944

.fmf/version

@@ -0,0 +1 @@
+1

.gitignore

@@ -38,3 +38,7 @@ libgcrypt-1.4.5-hobbled.tar.bz2
 /libgcrypt-1.10.3.tar.bz2.sig
 /libgcrypt-1.11.0.tar.bz2
 /libgcrypt-1.11.0.tar.bz2.sig
+/libgcrypt-1.11.1.tar.bz2
+/libgcrypt-1.11.1.tar.bz2.sig
+/libgcrypt-1.11.2.tar.bz2
+/libgcrypt-1.11.2.tar.bz2.sig

libgcrypt-1.11.0-Disable-SHA3-s390x-acceleration-for-CSHAKE.patch

@@ -1,63 +0,0 @@
-From 2486d9b5ae015c1786cb84466a751da4bc0d7122 Mon Sep 17 00:00:00 2001
-From: Jussi Kivilinna <jussi.kivilinna@iki.fi>
-Date: Thu, 20 Jun 2024 20:10:09 +0300
-Subject: [PATCH] Disable SHA3 s390x acceleration for CSHAKE
-
-* cipher/keccak.c (keccak_final_s390x): Add assert check for
-expected SHAKE suffix.
-(_gcry_cshake_customize, cshake_hash_buffers): Disable s390x
-acceleration when selecting CSHAKE suffix.
---
-
-Signed-off-by: Jussi Kivilinna <jussi.kivilinna@iki.fi>
----
- cipher/keccak.c | 16 ++++++++++++++--
- 1 file changed, 14 insertions(+), 2 deletions(-)
-
-diff --git a/cipher/keccak.c b/cipher/keccak.c
-index aaf83a62..44cc9f71 100644
---- a/cipher/keccak.c
-+++ b/cipher/keccak.c
-@@ -745,6 +745,8 @@ keccak_final_s390x (void *context)
-     }
-   else
-     {
-+      gcry_assert(ctx->suffix == SHAKE_DELIMITED_SUFFIX);
-+
-       klmd_shake_execute (ctx->kimd_func, &ctx->state, NULL, 0, ctx->buf,
- 			  ctx->count);
-       ctx->count = 0;
-@@ -1497,9 +1499,14 @@ _gcry_cshake_customize (void *context, struct gcry_cshake_customization *p)
-     /* No customization */
-     return 0;
- 
-+  ctx->suffix = CSHAKE_DELIMITED_SUFFIX;
-+#ifdef USE_S390X_CRYPTO
-+  /* CSHAKE suffix is not supported by s390x/kimd. */
-+  ctx->kimd_func = 0;
-+#endif
-+
-   len_written = cshake_input_n (ctx, p->n, p->n_len);
-   cshake_input_s (ctx, p->s, p->s_len, len_written);
--  ctx->suffix = CSHAKE_DELIMITED_SUFFIX;
-   return 0;
- }
- 
-@@ -1536,9 +1543,14 @@ cshake_hash_buffers (const gcry_md_spec_t *spec, void *outbuf, size_t nbytes,
-           size_t s_len = iov[1].len;
-           size_t len;
- 
-+          ctx.suffix = CSHAKE_DELIMITED_SUFFIX;
-+#ifdef USE_S390X_CRYPTO
-+          /* CSHAKE suffix is not supported by s390x/kimd. */
-+          ctx.kimd_func = 0;
-+#endif
-+
-           len = cshake_input_n (&ctx, n, n_len);
-           cshake_input_s (&ctx, s, s_len, len);
--          ctx.suffix = CSHAKE_DELIMITED_SUFFIX;
-         }
-       iovcnt -= 2;
-       iov += 2;
--- 
-2.43.0

libgcrypt-1.11.0-cf-protection.patch

@@ -1,328 +0,0 @@
-From 7ee2e73495d051ca09dd57c90132a7a9cc53bc62 Mon Sep 17 00:00:00 2001
-From: Jussi Kivilinna <jussi.kivilinna@iki.fi>
-Date: Fri, 26 Jul 2024 11:00:30 +0300
-Subject: [PATCH] asm-common-amd64: add missing CFI directives for large memory
- model code
-
-* cipher/asm-common-amd64.h [__code_model_large__]
-(GET_EXTERN_POINTER): Add CFI_PUSH/CFI_POP directives.
---
-
-Signed-off-by: Jussi Kivilinna <jussi.kivilinna@iki.fi>
----
- cipher/asm-common-amd64.h | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/cipher/asm-common-amd64.h b/cipher/asm-common-amd64.h
-index 870fef9a..3fa065e8 100644
---- a/cipher/asm-common-amd64.h
-+++ b/cipher/asm-common-amd64.h
-@@ -59,14 +59,18 @@
- #  ifdef __code_model_large__
- #    define GET_EXTERN_POINTER(name, reg) \
- 	       pushq %r15; \
-+	       CFI_PUSH(%r15); \
- 	       pushq %r14; \
-+	       CFI_PUSH(%r14); \
- 	    1: leaq 1b(%rip), reg; \
- 	       movabsq $_GLOBAL_OFFSET_TABLE_-1b, %r14; \
- 	       movabsq $name@GOT, %r15; \
- 	       addq %r14, reg; \
- 	       popq %r14; \
-+	       CFI_POP(%r14); \
- 	       movq (reg, %r15), reg; \
--	       popq %r15;
-+	       popq %r15; \
-+	       CFI_POP(%r15);
- #  else
- #    define GET_EXTERN_POINTER(name, reg) movq name@GOTPCREL(%rip), reg
- #  endif
--- 
-2.45.2
-
-From dd42a4e03e066c49a6d83e0d3a07e4261d77121a Mon Sep 17 00:00:00 2001
-From: Jussi Kivilinna <jussi.kivilinna@iki.fi>
-Date: Sat, 27 Jul 2024 08:16:56 +0300
-Subject: [PATCH] Do not build i386 assembly on x86-64
-
-* configure.ac: Enable building i386 "rijndael-vaes" only
-on i?86 host instead of x86 MPI arch ("i?86 + x86-64").
---
-
-GnuPG-bug-id: 7220
-Signed-off-by: Jussi Kivilinna <jussi.kivilinna@iki.fi>
----
- configure.ac | 9 +++++----
- 1 file changed, 5 insertions(+), 4 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index d3dffb4b..1e182552 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -3025,6 +3025,11 @@ if test "$found" = "1" ; then
-    AC_DEFINE(USE_AES, 1, [Defined if this module should be included])
- 
-    case "${host}" in
-+      i?86-*-*)
-+         # Build with the VAES/AVX2 implementation
-+         GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS rijndael-vaes-i386.lo"
-+         GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS rijndael-vaes-avx2-i386.lo"
-+      ;;
-       x86_64-*-*)
-          # Build with the assembly implementation
-          GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS rijndael-amd64.lo"
-@@ -3089,10 +3094,6 @@ if test "$found" = "1" ; then
- 
-          # Build with the Padlock implementation
-          GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS rijndael-padlock.lo"
--
--         # Build with the VAES/AVX2 implementation
--         GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS rijndael-vaes-i386.lo"
--         GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS rijndael-vaes-avx2-i386.lo"
-       ;;
-    esac
- fi
--- 
-2.45.2
-
-From 5797d75e3b916caf504bed73a8629c6c168be58d Mon Sep 17 00:00:00 2001
-From: Jussi Kivilinna <jussi.kivilinna@iki.fi>
-Date: Sat, 27 Jul 2024 08:50:57 +0300
-Subject: [PATCH] Do not build amd64 assembly on i386
-
-* configure.ac: Build "serpent-avx2-amd64" and
-"camellia-*-amd64" only on x86-64.
---
-
-GnuPG-bug-id: 7220
-Signed-off-by: Jussi Kivilinna <jussi.kivilinna@iki.fi>
----
- configure.ac | 50 +++++++++++++++++++++++++++-----------------------
- 1 file changed, 27 insertions(+), 23 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index 1e182552..191aa38d 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -3133,14 +3133,14 @@ if test "$found" = "1" ; then
-       x86_64-*-*)
-          # Build with the SSE2 implementation
-          GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS serpent-sse2-amd64.lo"
-+
-+         if test x"$avx2support" = xyes ; then
-+            # Build with the AVX2 implementation
-+            GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS serpent-avx2-amd64.lo"
-+         fi
-       ;;
-    esac
- 
--   if test x"$avx2support" = xyes ; then
--      # Build with the AVX2 implementation
--      GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS serpent-avx2-amd64.lo"
--   fi
--
-    if test x"$avx512support" = xyes ; then
-       # Build with the AVX512 implementation
-       GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS serpent-avx512-x86.lo"
-@@ -3186,28 +3186,32 @@ if test "$found" = "1" ; then
-       ;;
-    esac
- 
--   if test x"$avxsupport" = xyes ; then
--      if test x"$aesnisupport" = xyes ; then
--        # Build with the AES-NI/AVX implementation
--        GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS camellia-aesni-avx-amd64.lo"
--      fi
--   fi
-+   case "${host}" in
-+      x86_64-*-*)
-+         if test x"$avxsupport" = xyes ; then
-+            if test x"$aesnisupport" = xyes ; then
-+              # Build with the AES-NI/AVX implementation
-+              GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS camellia-aesni-avx-amd64.lo"
-+            fi
-+         fi
- 
--   if test x"$avx2support" = xyes ; then
--      if test x"$aesnisupport" = xyes ; then
--        # Build with the AES-NI/AVX2 implementation
--        GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS camellia-aesni-avx2-amd64.lo"
-+         if test x"$avx2support" = xyes ; then
-+            if test x"$aesnisupport" = xyes ; then
-+              # Build with the AES-NI/AVX2 implementation
-+              GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS camellia-aesni-avx2-amd64.lo"
- 
--        # Build with the VAES/AVX2 implementation
--        GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS camellia-vaes-avx2-amd64.lo"
-+              # Build with the VAES/AVX2 implementation
-+              GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS camellia-vaes-avx2-amd64.lo"
- 
--        # Build with the GFNI/AVX2 implementation
--        GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS camellia-gfni-avx2-amd64.lo"
-+              # Build with the GFNI/AVX2 implementation
-+              GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS camellia-gfni-avx2-amd64.lo"
- 
--        # Build with the GFNI/AVX512 implementation
--        GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS camellia-gfni-avx512-amd64.lo"
--      fi
--   fi
-+              # Build with the GFNI/AVX512 implementation
-+              GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS camellia-gfni-avx512-amd64.lo"
-+            fi
-+         fi
-+      ;;
-+   esac
- fi
- 
- LIST_MEMBER(idea, $enabled_ciphers)
--- 
-2.45.2
-
-From d69e6a29b986cf1cb21e09d337a0de2564ef34f2 Mon Sep 17 00:00:00 2001
-From: Jussi Kivilinna <jussi.kivilinna@iki.fi>
-Date: Fri, 26 Jul 2024 10:59:12 +0300
-Subject: [PATCH] Add CET support for x86-64 assembly
-
-* cipher/asm-common-amd64.h (ENDBRANCH): New.
-(CFI_STARTPROC): Add ENDBRANCH.
-[__CET__] (note.gnu.property): Add CET property section.
---
-
-GnuPG-bug-id: 7220
-Signed-off-by: Jussi Kivilinna <jussi.kivilinna@iki.fi>
----
- cipher/asm-common-amd64.h | 30 ++++++++++++++++++++++++++++--
- 1 file changed, 28 insertions(+), 2 deletions(-)
-
-diff --git a/cipher/asm-common-amd64.h b/cipher/asm-common-amd64.h
-index 3fa065e8..465ef62b 100644
---- a/cipher/asm-common-amd64.h
-+++ b/cipher/asm-common-amd64.h
-@@ -76,9 +76,15 @@
- #  endif
- #endif
- 
-+#ifdef __CET__
-+#define ENDBRANCH endbr64
-+#else
-+#define ENDBRANCH /*_*/
-+#endif
-+
- #ifdef HAVE_GCC_ASM_CFI_DIRECTIVES
- /* CFI directives to emit DWARF stack unwinding information. */
--# define CFI_STARTPROC()            .cfi_startproc
-+# define CFI_STARTPROC()            .cfi_startproc; ENDBRANCH
- # define CFI_ENDPROC()              .cfi_endproc
- # define CFI_REMEMBER_STATE()       .cfi_remember_state
- # define CFI_RESTORE_STATE()        .cfi_restore_state
-@@ -146,7 +152,7 @@
- 	    DW_SLEB128_28BIT(rsp_offs)
- 
- #else
--# define CFI_STARTPROC()
-+# define CFI_STARTPROC() ENDBRANCH
- # define CFI_ENDPROC()
- # define CFI_REMEMBER_STATE()
- # define CFI_RESTORE_STATE()
-@@ -214,4 +220,24 @@
- 	vpopcntb xmm16, xmm16; /* Supported only by newer AVX512 CPUs. */ \
- 	vpxord ymm16, ymm16, ymm16;
- 
-+#ifdef __CET__
-+/* Generate CET property for all assembly files including this header. */
-+ELF(.section .note.gnu.property,"a")
-+ELF(.align 8)
-+ELF(.long 1f - 0f)
-+ELF(.long 4f - 1f)
-+ELF(.long 5)
-+ELF(0:)
-+ELF(.byte 0x47, 0x4e, 0x55, 0) /* string "GNU" */
-+ELF(1:)
-+ELF(.align 8)
-+ELF(.long 0xc0000002)
-+ELF(.long 3f - 2f)
-+ELF(2:)
-+ELF(.long 0x3)
-+ELF(3:)
-+ELF(.align 8)
-+ELF(4:)
-+#endif
-+
- #endif /* GCRY_ASM_COMMON_AMD64_H */
--- 
-2.45.2
-
-From 64ec13d11b08fbe31cc6f83e9464e7e251d41019 Mon Sep 17 00:00:00 2001
-From: Jussi Kivilinna <jussi.kivilinna@iki.fi>
-Date: Fri, 26 Jul 2024 11:09:37 +0300
-Subject: [PATCH] Add CET support for i386 assembly
-
-* cipher/asm-common-i386.h (ENDBRANCH): New.
-(CFI_STARTPROC): Add ENDBRANCH.
-[__CET__] (note.gnu.property): Add CET property section.
---
-
-GnuPG-bug-id: 7220
-Signed-off-by: Jussi Kivilinna <jussi.kivilinna@iki.fi>
----
- cipher/asm-common-i386.h | 30 ++++++++++++++++++++++++++++--
- 1 file changed, 28 insertions(+), 2 deletions(-)
-
-diff --git a/cipher/asm-common-i386.h b/cipher/asm-common-i386.h
-index d746ebc4..346a8ff2 100644
---- a/cipher/asm-common-i386.h
-+++ b/cipher/asm-common-i386.h
-@@ -59,9 +59,15 @@
- 	movl name##@GOT(%reg), %reg;
- #endif
- 
-+#ifdef __CET__
-+#define ENDBRANCH endbr32
-+#else
-+#define ENDBRANCH /*_*/
-+#endif
-+
- #ifdef HAVE_GCC_ASM_CFI_DIRECTIVES
- /* CFI directives to emit DWARF stack unwinding information. */
--# define CFI_STARTPROC()            .cfi_startproc
-+# define CFI_STARTPROC()            .cfi_startproc; ENDBRANCH
- # define CFI_ENDPROC()              .cfi_endproc
- # define CFI_REMEMBER_STATE()       .cfi_remember_state
- # define CFI_RESTORE_STATE()        .cfi_restore_state
-@@ -121,7 +127,7 @@
- 	    DW_SLEB128_28BIT(esp_offs)
- 
- #else
--# define CFI_STARTPROC()
-+# define CFI_STARTPROC() ENDBRANCH
- # define CFI_ENDPROC()
- # define CFI_REMEMBER_STATE()
- # define CFI_RESTORE_STATE()
-@@ -158,4 +164,24 @@
- 	vpopcntb xmm7, xmm7; /* Supported only by newer AVX512 CPUs. */ \
- 	vpxord ymm7, ymm7, ymm7;
- 
-+#ifdef __CET__
-+/* Generate CET property for all assembly files including this header. */
-+ELF(.section .note.gnu.property,"a")
-+ELF(.align 4)
-+ELF(.long 1f - 0f)
-+ELF(.long 4f - 1f)
-+ELF(.long 5)
-+ELF(0:)
-+ELF(.byte 0x47, 0x4e, 0x55, 0) /* string "GNU" */
-+ELF(1:)
-+ELF(.align 4)
-+ELF(.long 0xc0000002)
-+ELF(.long 3f - 2f)
-+ELF(2:)
-+ELF(.long 0x3)
-+ELF(3:)
-+ELF(.align 4)
-+ELF(4:)
-+#endif
-+
- #endif /* GCRY_ASM_COMMON_AMD64_H */
--- 
-2.45.2
-

libgcrypt-1.11.0-marvin.patch

@@ -759,17 +759,17 @@ index 245967eb..74055a4b 100644
  static inline size_t
  ct_lt_s (size_t a, size_t b)
 @@ -112,6 +121,7 @@ unsigned int _gcry_ct_memequal (const void *b1, const void *b2, size_t len);
- #endif
  DEFINE_CT_TYPE_GEN_MASK(uintptr, uintptr_t)
  DEFINE_CT_TYPE_GEN_MASK(ulong, unsigned long)
+ DEFINE_CT_TYPE_GEN_MASK(int16, int16_t)
 +DEFINE_CT_TYPE_GEN_MASK(uchar, unsigned char)
  
  /*
   * Return all bits set if A is 0 and return 1 otherwise.
 @@ -137,6 +147,7 @@ DEFINE_CT_TYPE_GEN_MASK(int16, int16_t)
- #endif
  DEFINE_CT_TYPE_GEN_INV_MASK(uintptr, uintptr_t)
  DEFINE_CT_TYPE_GEN_INV_MASK(ulong, unsigned long)
+ DEFINE_CT_TYPE_GEN_INV_MASK(int16, int16_t)
 +DEFINE_CT_TYPE_GEN_INV_MASK(uchar, unsigned char)
  
  /*
@@ -1582,9 +1582,9 @@ index 74055a4b..5e656e15 100644
  
  static inline size_t
 @@ -164,6 +164,7 @@ DEFINE_CT_TYPE_GEN_INV_MASK(uchar, unsigned char)
-   }
  DEFINE_CT_TYPE_SELECT_FUNC(uintptr, uintptr_t)
  DEFINE_CT_TYPE_SELECT_FUNC(ulong, unsigned long)
+ DEFINE_CT_TYPE_SELECT_FUNC(int16, int16_t)
 +DEFINE_CT_TYPE_SELECT_FUNC(uchar, unsigned char)
  
  /*
@@ -1969,7 +1969,7 @@ index ab070a94..a2153728 100644
                  {
                    show_sexp ("sign result:\n", sig);
                    fail ("mismatch in gcry_pk_sign\n");
-@@ -429,45 +431,89 @@ check_v15crypt (void)
+@@ -429,44 +431,89 @@ check_v15crypt (void)
            size_t mesg_len, seed_len, encr_len;
            gcry_sexp_t plain, ciph;
  
@@ -2018,7 +2018,7 @@ index ab070a94..a2153728 100644
 +            }
  
 -          err = gcry_sexp_build (&plain, NULL,
--                                 "(data (flags pkcs1)(hash-algo sha1)"
+-                                 "(data (flags pkcs1)"
 -                                 "(value %b)(random-override %b))",
 -                                 (int)mesg_len, mesg,
 -                                 (int)seed_len, seed);
@@ -2076,14 +2076,13 @@ index ab070a94..a2153728 100644
 -          plain = NULL;
 -
 -          /* Now test the decryption.  */
--          seed = data_from_hex (tbl[tno].m[mno].seed, &seed_len);
 -          encr = data_from_hex (tbl[tno].m[mno].encr, &encr_len);
 +          gcry_sexp_release (ciph);
 +          ciph = NULL;
 +#endif /* WITH_MARVIN_WORKAROUND */
  
            err = gcry_sexp_build (&ciph, NULL,
-                                  "(enc-val (flags pkcs1)(hash-algo sha1)"
+                                  "(enc-val (flags pkcs1)"
 @@ -484,15 +530,19 @@ check_v15crypt (void)
              }
            else

libgcrypt-1.11.0-pac-bti-protection.patch

@@ -1,229 +0,0 @@
-From afdd68b162103820edb72ad170f8ee26f206b396 Mon Sep 17 00:00:00 2001
-From: Jussi Kivilinna <jussi.kivilinna@iki.fi>
-Date: Sun, 4 Aug 2024 18:51:34 +0300
-Subject: [PATCH] Add PAC/BTI support for AArch64 assembly
-
-* cipher/asm-common-aarch64.h (AARCH64_BTI_PROPERTY_FLAG)
-(AARCH64_HINT_BTI_C, AARCH64_PAC_PROPERTY_FLAG)
-(note.gnu.property): New.
-(CFI_STARTPROC): Add AARCH64_HINT_BTI_C.
---
-
-GnuPG-bug-id: 7220
-Signed-off-by: Jussi Kivilinna <jussi.kivilinna@iki.fi>
----
- cipher/asm-common-aarch64.h | 50 +++++++++++++++++++++++++++++++++++--
- 1 file changed, 48 insertions(+), 2 deletions(-)
-
-diff --git a/cipher/asm-common-aarch64.h b/cipher/asm-common-aarch64.h
-index 3a72d7c4..ff65ea6a 100644
---- a/cipher/asm-common-aarch64.h
-+++ b/cipher/asm-common-aarch64.h
-@@ -45,9 +45,25 @@
- 	add     reg, reg, #:lo12:name ;
- #endif
- 
-+#if defined(__ARM_FEATURE_BTI_DEFAULT) && __ARM_FEATURE_BTI_DEFAULT == 1
-+# define AARCH64_BTI_PROPERTY_FLAG (1 << 0)
-+# define AARCH64_HINT_BTI_C \
-+	hint #34
-+#else
-+# define AARCH64_BTI_PROPERTY_FLAG 0 /* No BTI */
-+# define AARCH64_HINT_BTI_C /*_*/
-+#endif
-+
-+#if defined(__ARM_FEATURE_PAC_DEFAULT) && (__ARM_FEATURE_PAC_DEFAULT & 3) != 0
-+/* PAC enabled, signed with either A or B key. */
-+# define AARCH64_PAC_PROPERTY_FLAG (1 << 1)
-+#else
-+# define AARCH64_PAC_PROPERTY_FLAG 0 /* No PAC */
-+#endif
-+
- #ifdef HAVE_GCC_ASM_CFI_DIRECTIVES
- /* CFI directives to emit DWARF stack unwinding information. */
--# define CFI_STARTPROC()            .cfi_startproc
-+# define CFI_STARTPROC()            .cfi_startproc; AARCH64_HINT_BTI_C
- # define CFI_ENDPROC()              .cfi_endproc
- # define CFI_REMEMBER_STATE()       .cfi_remember_state
- # define CFI_RESTORE_STATE()        .cfi_restore_state
-@@ -89,7 +105,7 @@
- 	    DW_SLEB128_28BIT(rsp_offs)
- 
- #else
--# define CFI_STARTPROC()
-+# define CFI_STARTPROC() AARCH64_HINT_BTI_C
- # define CFI_ENDPROC()
- # define CFI_REMEMBER_STATE()
- # define CFI_RESTORE_STATE()
-@@ -129,4 +145,34 @@
- 	ldp d8, d9, [sp], #16; \
- 	CFI_ADJUST_CFA_OFFSET(-16);
- 
-+#if (AARCH64_BTI_PROPERTY_FLAG | AARCH64_PAC_PROPERTY_FLAG)
-+/* Generate PAC/BTI property for all assembly files including this header.
-+ *
-+ * libgcrypt support these extensions:
-+ *  - Armv8.3-A Pointer Authentication (PAC):
-+ *    As currently all AArch64 assembly functions are leaf functions and do
-+ *    not store/load link register LR, we just mark PAC as supported.
-+ *
-+ *  - Armv8.5-A Branch Target Identification (BTI):
-+ *    All AArch64 assembly functions get branch target instruction through
-+ *    CFI_STARTPROC macro.
-+ */
-+ELF(.section .note.gnu.property,"a")
-+ELF(.balign 8)
-+ELF(.long 1f - 0f)
-+ELF(.long 4f - 1f)
-+ELF(.long 5)
-+ELF(0:)
-+ELF(.byte 0x47, 0x4e, 0x55, 0) /* string "GNU" */
-+ELF(1:)
-+ELF(.balign 8)
-+ELF(.long 0xc0000000)
-+ELF(.long 3f - 2f)
-+ELF(2:)
-+ELF(.long (AARCH64_BTI_PROPERTY_FLAG | AARCH64_PAC_PROPERTY_FLAG))
-+ELF(3:)
-+ELF(.balign 8)
-+ELF(4:)
-+#endif
-+
- #endif /* GCRY_ASM_COMMON_AARCH64_H */
--- 
-2.43.0
-
-From 07706d69f238f6a3bfc3f74145686a02decbee9c Mon Sep 17 00:00:00 2001
-From: Jussi Kivilinna <jussi.kivilinna@iki.fi>
-Date: Mon, 5 Aug 2024 20:18:05 +0300
-Subject: [PATCH] Do not build 32-bit ARM assembly on Aarch64
-
-* configure.ac: Build "serpent-armv7-neon", "salsa20-armv7-neon",
-"chacha20-armv7-neon", "sha512-armv7-neon" and "keccak-armv7-neon"
-only on 32-bit ARM.
---
-
-GnuPG-bug-id: 7220
-Signed-off-by: Jussi Kivilinna <jussi.kivilinna@iki.fi>
----
- configure.ac | 54 ++++++++++++++++++++++++++++------------------------
- 1 file changed, 29 insertions(+), 25 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index 191aa38d..2b6ddb7b 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -3139,17 +3139,18 @@ if test "$found" = "1" ; then
-             GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS serpent-avx2-amd64.lo"
-          fi
-       ;;
-+      arm*-*-*)
-+         if test x"$neonsupport" = xyes ; then
-+           # Build with the NEON implementation
-+           GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS serpent-armv7-neon.lo"
-+         fi
-+      ;;
-    esac
- 
-    if test x"$avx512support" = xyes ; then
-       # Build with the AVX512 implementation
-       GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS serpent-avx512-x86.lo"
-    fi
--
--   if test x"$neonsupport" = xyes ; then
--      # Build with the NEON implementation
--      GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS serpent-armv7-neon.lo"
--   fi
- fi
- 
- LIST_MEMBER(rfc2268, $enabled_ciphers)
-@@ -3230,12 +3231,13 @@ if test "$found" = "1" ; then
-          # Build with the assembly implementation
-          GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS salsa20-amd64.lo"
-       ;;
-+      arm*-*-*)
-+         if test x"$neonsupport" = xyes ; then
-+            # Build with the NEON implementation
-+            GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS salsa20-armv7-neon.lo"
-+         fi
-+      ;;
-    esac
--
--   if test x"$neonsupport" = xyes ; then
--     # Build with the NEON implementation
--     GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS salsa20-armv7-neon.lo"
--   fi
- fi
- 
- LIST_MEMBER(gost28147, $enabled_ciphers)
-@@ -3256,6 +3258,12 @@ if test "$found" = "1" ; then
-          GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS chacha20-amd64-avx2.lo"
-          GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS chacha20-amd64-avx512.lo"
-       ;;
-+      arm*-*-*)
-+         if test x"$neonsupport" = xyes ; then
-+            # Build with the NEON implementation
-+            GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS chacha20-armv7-neon.lo"
-+         fi
-+      ;;
-       aarch64-*-*)
-          # Build with the assembly implementation
-          GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS chacha20-aarch64.lo"
-@@ -3282,11 +3290,6 @@ if test "$found" = "1" ; then
-          GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS chacha20-s390x.lo"
-       ;;
-    esac
--
--   if test x"$neonsupport" = xyes ; then
--     # Build with the NEON implementation
--     GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS chacha20-armv7-neon.lo"
--   fi
- fi
- 
- LIST_MEMBER(sm4, $enabled_ciphers)
-@@ -3491,6 +3494,11 @@ if test "$found" = "1" ; then
-       arm*-*-*)
-          # Build with the assembly implementation
-          GCRYPT_ASM_DIGESTS="$GCRYPT_ASM_DIGESTS sha512-arm.lo"
-+
-+         if test x"$neonsupport" = xyes ; then
-+            # Build with the NEON implementation
-+            GCRYPT_ASM_DIGESTS="$GCRYPT_ASM_DIGESTS sha512-armv7-neon.lo"
-+         fi
-       ;;
-       aarch64-*-*)
-          # Build with the assembly implementation
-@@ -3510,11 +3518,6 @@ if test "$found" = "1" ; then
-          # Build with the crypto extension implementation
-          GCRYPT_ASM_DIGESTS="$GCRYPT_ASM_DIGESTS sha512-ppc.lo"
-    esac
--
--   if test x"$neonsupport" = xyes ; then
--     # Build with the NEON implementation
--     GCRYPT_ASM_DIGESTS="$GCRYPT_ASM_DIGESTS sha512-armv7-neon.lo"
--   fi
- fi
- 
- LIST_MEMBER(sha3, $enabled_digests)
-@@ -3527,12 +3530,13 @@ if test "$found" = "1" ; then
-          # Build with the assembly implementation
-          GCRYPT_ASM_DIGESTS="$GCRYPT_ASM_DIGESTS keccak-amd64-avx512.lo"
-       ;;
-+      arm*-*-*)
-+         if test x"$neonsupport" = xyes ; then
-+           # Build with the NEON implementation
-+           GCRYPT_ASM_DIGESTS="$GCRYPT_ASM_DIGESTS keccak-armv7-neon.lo"
-+         fi
-+      ;;
-    esac
--
--   if test x"$neonsupport" = xyes ; then
--     # Build with the NEON implementation
--     GCRYPT_ASM_DIGESTS="$GCRYPT_ASM_DIGESTS keccak-armv7-neon.lo"
--   fi
- fi
- 
- LIST_MEMBER(tiger, $enabled_digests)
--- 
-2.43.0
-

libgcrypt.spec

@@ -14,19 +14,14 @@ print(string.sub(hash, 0, 16))
 }
 
 Name: libgcrypt
-Version: 1.11.0
-Release: 5%{?dist}
+Version: 1.11.2
+Release: 1%{?dist}
 URL: https://www.gnupg.org/
 Source0: https://www.gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2
 Source1: https://www.gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2.sig
 Source2: https://gnupg.org/signature_key.asc
 # Pass the annobin flags to the libgcrypt.so (#2016349)
 Patch1: libgcrypt-1.10.1-annobin.patch
-# https://dev.gnupg.org/T7167
-Patch2: libgcrypt-1.11.0-Disable-SHA3-s390x-acceleration-for-CSHAKE.patch
-# https://dev.gnupg.org/T7220
-Patch3: libgcrypt-1.11.0-cf-protection.patch
-Patch4: libgcrypt-1.11.0-pac-bti-protection.patch
 # https://gitlab.com/redhat-crypto/libgcrypt/libgcrypt-mirror/-/merge_requests/19/
 Patch5: libgcrypt-1.11.0-marvin.patch
 
@@ -64,9 +59,6 @@ applications using libgcrypt.
 %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
 %setup -q
 %patch 1 -p1
-%patch 2 -p1
-%patch 3 -p1
-%patch 4 -p1
 %patch 5 -p1
 
 %build
@@ -98,10 +90,11 @@ make check
 # try in faked FIPS mode too
 LIBGCRYPT_FORCE_FIPS_MODE=1 make check
 
-PROFILE=%{?dist} annocheck --ignore-unknown --verbose --profile=${PROFILE:1} $RPM_BUILD_ROOT%{gcrylibdir}/libgcrypt.so.20.5.0
+%define libpath $RPM_BUILD_ROOT%{gcrylibdir}/%{gcrysoname}.?.?
+
+PROFILE=%{?dist} annocheck --ignore-unknown --verbose --profile=${PROFILE:1} %{libpath}
 
 # Add generation of HMAC checksums of the final stripped binaries 
-%define libpath $RPM_BUILD_ROOT%{gcrylibdir}/%{gcrysoname}.?.?
 %define __spec_install_post \
     %{?__debug_package:%{__debug_install_post}} \
     %{__arch_install_post} \
@@ -181,6 +174,15 @@ mkdir -p -m 755 $RPM_BUILD_ROOT/etc/gcrypt
 %license COPYING
 
 %changelog
+* Mon Nov 03 2025 Jakub Jelen <jjelen@redhat.com> - 1.11.2-1
+- New upstream release (#2406804)
+
+* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.11.1-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Tue May 13 2025 Jakub Jelen <jjelen@redhat.com> - 1.11.1-1
+- New upstream release (#2364878)
+
 * Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.11.0-5
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
 

sources

@@ -1,2 +1,2 @@
-SHA512 (libgcrypt-1.11.0.tar.bz2) = 8e093e69e3c45d30838625ca008e995556f0d5b272de1c003d44ef94633bcc0d0ef5d95e8725eb531bfafb4490ac273488633e0c801200d4666194f86c3e270e
-SHA512 (libgcrypt-1.11.0.tar.bz2.sig) = 8c5ceb50d70ccdedcc1ff4b31a65a07198567b85f582e3e67699cc3e5d012bebf7b1d4903652d11905a9cd845976ad7d3642474804777d0bdc46c6847d92fe38
+SHA512 (libgcrypt-1.11.2.tar.bz2) = b706cea602cc8f0896e57ce979643bf78974b05faec27c1b053b773c57d8b04250e30e95a4ef5899e1df981d01d8d08f0a36e10b5820a5ec4183e74c02e5f1f0
+SHA512 (libgcrypt-1.11.2.tar.bz2.sig) = e63d240a9b97aa218c98c5baa72a30321ae85412d4a8748e36578bd9498fe8c8ee2ba84835d1783cdfc1e5dfb66b0a89409d6263e9c06f4cd11e919d4bce0cd2

tests/smoke-test/main.fmf

@@ -0,0 +1,25 @@
+summary: Test calls upstream test suite.
+test: ./runtest.sh
+enabled: true
+framework: beakerlib
+require:
+  - library(distribution/fips)
+recommend:
+  - libgcrypt
+  - nfs-utils
+  - rpm-build
+  - autoconf
+  - automake
+  - libtool
+  - gawk
+  - gcc-c++
+  - libgpg-error-devel
+  - pkgconfig
+  - texinfo
+  - fipscheck
+  - libkcapi-fipscheck
+  - crypto-policies-scripts
+  - bc
+  - annobin-annocheck
+  - gnupg2
+duration: 45m

tests/smoke-test/runtest.sh

@@ -54,41 +54,35 @@ rlJournalStart
         rlRun "pushd $TOPDIR" 0
         rlRun "rm -rf BUILD/libgcrypt-*" 0-255
         rlRun "rpmbuild -vv -bc SPECS/libgcrypt.spec" 0
-        rlRun "pushd BUILD/libgcrypt-*" 0
+        libgcrypt_dir="libgcrypt-`rpm -q --qf "%{VERSION}\n" libgcrypt | head -1`"
+        if [ -d "BUILD/$libgcrypt_dir-build" ]; then
+            BUILDDIR="BUILD/$libgcrypt_dir-build/$libgcrypt_dir"
+        else
+            BUILDDIR="BUILD/$libgcrypt_dir"
+        fi
+        rlRun "pushd $BUILDDIR" 0
         rlRun "fipshmac src/.libs/libgcrypt.so.??" 0
         rlRun "popd"
         rlRun "popd"
     rlPhaseEnd
 
     rlPhaseStartTest "Upstream testsuite"
-        rlRun "pushd $TOPDIR/BUILD/libgcrypt-*" 0
+        rlRun "pushd $TOPDIR/$BUILDDIR" 0
         exp_fails=()
-        if [[ $fipsMode = 'enabled' ]]; then
-            if rlIsFedora 33; then
-                exp_fails+=("basic")
-                exp_fails+=("basic-disable-all-hwf")
-                exp_fails+=("t-kdf")
-                exp_fails+=("t-secmem")
-            elif rlIsFedora 34; then
-                exp_fails+=("basic")
-                exp_fails+=("basic-disable-all-hwf")
-                exp_fails+=("t-kdf")
-                exp_fails+=("t-secmem")
-                exp_fails+=("t-x448")
-            elif rlIsFedora 35; then # Fedora-35
-                exp_fails+=("curves")
-            fi
-        fi
+
         rlRun "echo 'Expecting ${#exp_fails[@]} fails'"
         exp_exitcode=0
         if [[ ${#exp_fails[@]} -gt 0 ]]; then exp_exitcode=2; fi
         rlRun "make check &> $TmpDir/make_check.out" $exp_exitcode
         rlRun "grep ^FAIL: $TmpDir/make_check.out" 0,1 "Print fails"
         if [[ ${#exp_fails[@]} -gt 0 ]]; then
-            for f in "${exp_fails[@]}"; do
-                rlAssertGrep "^FAIL: $f\$" $TmpDir/make_check.out
+            for f in $(grep '^FAIL:' $TmpDir/make_check.out | awk -F ': ' '{print $2}'); do
+                if [[ "${exp_fails[@]}" =~ "$f" ]]; then
+                    rlLog "$f failure is expected"
+                else
+                    rlFail "$f failure is not expected"
+                fi
             done
-            [[ $(grep -c '^FAIL:' $TmpDir/make_check.out) -eq ${#exp_fails[@]} ]] || rlFail "Unexpected fails present"
         else
             rlRun "grep \"All [0-9]\+ tests passed\" $TmpDir/make_check.out" 0 \
                 "All tests passed"
@@ -119,12 +113,12 @@ rlJournalStart
             for i in `seq 1 $N_SAMPLES`; do
                 # run with HW optimizations ENAbled
                 rm -f $HWF_DENY_FILE
-                $TOPDIR/BUILD/libgcrypt-*/tests/bench-slope $alg_type $algorithm |grep "$alg_line" >>$algorithm.ena
+                $TOPDIR/$BUILDDIR/tests/bench-slope $alg_type $algorithm |grep "$alg_line" >>$algorithm.ena
 
                 # run with HW optimizations DISabled
                 # this looks idiotic, but I wasn't able to make --disable-hwf work
                 echo "all" >$HWF_DENY_FILE
-                $TOPDIR/BUILD/libgcrypt-*/tests/bench-slope $dis_arg $alg_type $algorithm |grep "$alg_line" >>$algorithm.dis
+                $TOPDIR/$BUILDDIR/tests/bench-slope $dis_arg $alg_type $algorithm |grep "$alg_line" >>$algorithm.dis
             done
             rlLogInfo "Performance measurements finished"
             rlRun "cat $algorithm.ena"

tests/tests.yml

@@ -1,20 +0,0 @@
-- hosts: localhost
-  tags:
-  - classic
-  - container
-  roles:
-  - role: standard-test-beakerlib
-    tests:
-    - smoke-test
-    required_packages:
-    - fipscheck
-    - gawk
-    - gcc-c++
-    - libgcrypt
-    - libgpg-error-devel
-    - libselinux-utils
-    - nfs-utils
-    - pkgconfig
-    - rpm-build
-    - texinfo
-    - wget