dist-git conversion

#2781)

.cvsignore

@@ -1,11 +0,0 @@
-libgcrypt-1.2.0.tar.gz
-libgcrypt-1.2.1.tar.bz2
-libgcrypt-1.2.1.tar.bz2.sig
-libgcrypt-1.2.2.tar.bz2
-libgcrypt-1.2.2.tar.bz2.sig
-libgcrypt-1.2.3.tar.bz2
-libgcrypt-1.2.3.tar.bz2.sig
-libgcrypt-1.2.4.tar.bz2
-libgcrypt-1.2.4.tar.bz2.sig
-libgcrypt-1.4.0.tar.bz2
-libgcrypt-1.4.0.tar.bz2.sig

.gitignore

@@ -0,0 +1 @@
+libgcrypt-1.4.4-hobbled.tar.bz2

Makefile

@@ -1,21 +0,0 @@
-# Makefile for source rpm: libgcrypt
-# $Id: Makefile,v 1.1 2004/09/09 07:25:33 cvsdist Exp $
-NAME := libgcrypt
-SPECFILE = $(firstword $(wildcard *.spec))
-
-define find-makefile-common
-for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
-endef
-
-MAKEFILE_COMMON := $(shell $(find-makefile-common))
-
-ifeq ($(MAKEFILE_COMMON),)
-# attempt a checkout
-define checkout-makefile-common
-test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2
-endef
-
-MAKEFILE_COMMON := $(shell $(checkout-makefile-common))
-endif
-
-include $(MAKEFILE_COMMON)

hobble-libgcrypt

@@ -0,0 +1,9 @@
+#!/bin/sh
+
+# Quit out if anything fails.
+set -e -x
+
+# Clean out patent-or-otherwise-encumbered code.
+# EC:    ????????? ??/??/2015
+
+rm -f cipher/ecc.c

libgcrypt-1.2.2-lib64.patch

@@ -1,14 +0,0 @@
-We should suppress an explicit -L on 64-bit arches, too.
-
---- libgcrypt-1.2.2/src/libgcrypt-config.in	2006-05-16 18:50:43.000000000 -0400
-+++ libgcrypt-1.2.2/src/libgcrypt-config.in	2006-05-16 18:50:50.000000000 -0400
-@@ -138,7 +138,8 @@
-     libs_final="$libs"
- 
-     # Set up `libdirs'.
--    if test "x$libdir" != "x/usr/lib" -a "x$libdir" != "x/lib"; then
-+    if test "x$libdir" != "x/usr/lib"   -a "x$libdir" != "x/lib" -a \
-+            "x$libdir" != "x/usr/lib64" -a "x$libdir" != "x/lib64"; then
- 	libdirs="-L$libdir"
-     fi
- 

libgcrypt-1.4.0-randinit.patch

@@ -1,90 +0,0 @@
-From gnutls-devel-bounces+joe=manyfish.co.uk@gnu.org Tue Jan 08 18:41:52 2008
-From: Werner Koch <wk@gnupg.org>
-To: Simon Josefsson <simon@josefsson.org>
-Mail-Followup-To: Simon Josefsson <simon@josefsson.org>,
-	Guus Sliepen <guus@debian.org>, gnutls-devel@gnu.org,
-	343085@bugs.debian.org, gcrypt-devel@gnupg.org
-Date: Tue, 08 Jan 2008 12:39:02 +0100
-Cc: Guus Sliepen <guus@debian.org>, gcrypt-devel@gnupg.org,
-	gnutls-devel@gnu.org, 343085@bugs.debian.org
-Subject: [patch] Re: Bug#448775: Uses too much entropy (Debian Bug #343085)
-MIME-Version: 1.0
-Content-Transfer-Encoding: 8bit
-Content-Type: text/plain; charset=utf-8
-Status: RO
-
-On Tue,  8 Jan 2008 11:59, wk@gnupg.org said:
-
-> Anyway there 3000 calls to /dev/urandom are far too many for an initial
-> pool filling.  I need to check this.
-
-Found it.  The bug was introduced with libgcrypt 1.3.1.  Here is a patch:
-
-2008-01-08  Werner Koch  <wk@g10code.com>
-
-	* random.c (add_randomness): Do not just increment
-	POOL_FILLED_COUNTER but update it by the actual amount of data.
-
-Index: cipher/random.c
-===================================================================
---- cipher/random.c	(revision 1277)
-+++ cipher/random.c	(working copy)
-@@ -1115,6 +1115,7 @@
- add_randomness (const void *buffer, size_t length, enum random_origins origin)
- {
-   const unsigned char *p = buffer;
-+  size_t count = 0;
- 
-   assert (pool_is_locked);
- 
-@@ -1123,6 +1124,7 @@
-   while (length-- )
-     {
-       rndpool[pool_writepos++] ^= *p++;
-+      count++;
-       if (pool_writepos >= POOLSIZE )
-         {
-           /* It is possible that we are invoked before the pool is
-@@ -1132,7 +1134,9 @@
-              separately.  See also the remarks about the seed file. */
-           if (origin >= RANDOM_ORIGIN_SLOWPOLL && !pool_filled)
-             {
--              if (++pool_filled_counter >= POOLSIZE)
-+              pool_filled_counter += count;
-+              count = 0;
-+              if (pool_filled_counter >= POOLSIZE)
-                 pool_filled = 1;
-             }
-           pool_writepos = 0;
-
-
-Also commited to SVN.  Old and new stats:
-
-$ LD_PRELOAD=/usr/local/lib/libgcrypt.so ./benchmark --verbose random
-random       130ms    30ms
-random usage: poolsize=600 mixed=972 polls=3000/200 added=4200/378400
-              outmix=200 getlvl1=200/13600 getlvl2=0/0
-
-$ ./benchmark --verbose random
-random        40ms    30ms
-random usage: poolsize=600 mixed=377 polls=25/200 added=1225/21400
-              outmix=200 getlvl1=200/13600 getlvl2=0/0
-
-
-
-Shalom-Salam,
-
-   Werner
-
-
-
--- 
-Die Gedanken sind frei.  Auschnahme regelt ein Bundeschgesetz.
-
-
-
-_______________________________________________
-Gnutls-devel mailing list
-Gnutls-devel@gnu.org
-http://lists.gnu.org/mailman/listinfo/gnutls-devel
-

libgcrypt-1.4.4-fips-no-access.patch

@@ -0,0 +1,13 @@
+Do not abort when the fips mode flag is simply inaccessible because of
+insufficient permissions.
+diff -up libgcrypt-1.4.4/src/fips.c.no-access libgcrypt-1.4.4/src/fips.c
+--- libgcrypt-1.4.4/src/fips.c.no-access	2009-01-29 17:37:12.000000000 +0100
++++ libgcrypt-1.4.4/src/fips.c	2009-01-29 17:37:15.000000000 +0100
+@@ -155,6 +155,7 @@ _gcry_initialize_fips_mode (int force)
+         fclose (fp);
+       }
+     else if ((saved_errno = errno) != ENOENT
++             && saved_errno != EACCES
+              && !access ("/proc/version", F_OK) )
+       {
+         /* Problem reading the fips file despite that we have the proc

libgcrypt.spec

@@ -1,14 +1,21 @@
 Name: libgcrypt
-Version: 1.4.0
+Version: 1.4.4
-Release: 3
+Release: 1%{?dist}
-Source0: ftp://ftp.gnupg.org/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2
+Source0: libgcrypt-%{version}-hobbled.tar.bz2
-Source1: ftp://ftp.gnupg.org/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2.sig
+# The original libgcrypt sources now contain potentially patented ECC
+# cipher support. We have to remove it in the tarball we ship with
+# the hobble-libgcrypt script.
+#Source0: ftp://ftp.gnupg.org/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2
+#Source1: ftp://ftp.gnupg.org/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2.sig
 Source2: wk@g10code.com
-Patch0: libgcrypt-1.4.0-randinit.patch
+Source3: hobble-libgcrypt
+Patch1: libgcrypt-1.4.4-fips-no-access.patch
+
+# Technically LGPLv2.1+, but Fedora's table doesn't draw a distinction.
 License: LGPLv2+
-Summary: A general-purpose cryptography library.
+Summary: A general-purpose cryptography library
 BuildRoot: %{_tmppath}/%{name}-%{version}-root
-BuildRequires: gawk libgpg-error-devel pkgconfig
+BuildRequires: gawk, libgpg-error-devel >= 1.4, pkgconfig
 Group: System Environment/Libraries
 
 %package devel
@@ -29,11 +36,17 @@ applications using libgcrypt.
 
 %prep
 %setup -q
-%patch0 -p0 -b .randinit
+%{SOURCE3}
+%patch1 -p1 -b .no-access
 
 %build
-%configure --disable-static --enable-noexecstack
+%configure --disable-static \
-make
+%ifarch sparc64
+     --disable-asm \
+%endif
+     --enable-noexecstack \
+     --enable-pubkey-ciphers='dsa elgamal rsa'
+make %{?_smp_mflags}
 
 %check
 make check
@@ -80,6 +93,10 @@ popd
 /sbin/ldconfig -n $RPM_BUILD_ROOT/%{_lib}/
 rm -f $RPM_BUILD_ROOT/root_marker
 
+# Create /etc/gcrypt (hardwired, not dependent on the configure invocation) so
+# that _someone_ owns it.
+mkdir -p -m 755 $RPM_BUILD_ROOT/etc/gcrypt
+
 %clean
 rm -fr $RPM_BUILD_ROOT
 
@@ -99,6 +116,7 @@ exit 0
 
 %files
 %defattr(-,root,root)
+%dir /etc/gcrypt
 /%{_lib}/*.so.*
 #%{_libdir}/%{name}
 
@@ -106,6 +124,7 @@ exit 0
 %defattr(-,root,root)
 %{_bindir}/%{name}-config
 %{_bindir}/dumpsexp
+%{_bindir}/hmac256
 %{_includedir}/*
 %{_libdir}/*.so
 %{_datadir}/aclocal/*
@@ -114,6 +133,31 @@ exit 0
 %{_infodir}/gcrypt.info*
 
 %changelog
+* Fri Jan 30 2009 Tomas Mraz <tmraz@redhat.com> 1.4.4-1
+- update to 1.4.4
+- do not abort when the fips mode kernel flag is inaccessible
+  due to permissions (#470219)
+- hobble the library to drop the ECC support
+
+* Mon Oct 20 2008 Dennis Gilmore <dennis@ausil.us> 1.4.3-2
+- disable asm on sparc64
+
+* Thu Sep 18 2008 Nalin Dahyabhai <nalin@redhat.com> 1.4.3-1
+- update to 1.4.3
+- own /etc/gcrypt
+
+* Mon Sep 15 2008 Nalin Dahyabhai <nalin@redhat.com>
+- invoke make with %%{?_smp_mflags} to build faster on multi-processor
+  systems (Steve Grubb)
+
+* Mon Sep  8 2008 Nalin Dahyabhai <nalin@redhat.com> 1.4.2-1
+- update to 1.4.2
+
+* Tue Apr 29 2008 Nalin Dahyabhai <nalin@redhat.com> 1.4.1-1
+- update to 1.4.1
+- bump libgpgerror-devel requirement to 1.4, matching the requirement enforced
+  by the configure script
+
 * Thu Apr  3 2008 Joe Orton <jorton@redhat.com> 1.4.0-3
 - add patch from upstream to fix severe performance regression
   in entropy gathering

sources

@@ -1,2 +1 @@
-b013f798a1088afb07336bce5a9c24c5  libgcrypt-1.4.0.tar.bz2
+12d3fec91c663b541d63e34eabddacc5  libgcrypt-1.4.4-hobbled.tar.bz2
-43e1b54d34732709bbec024512224450  libgcrypt-1.4.0.tar.bz2.sig