Compare commits
1 commit
| Author | SHA1 | Date | |
|---|---|---|---|
|
d228204036 |
22 changed files with 4020 additions and 2927 deletions
|
|
@ -1 +0,0 @@
|
|||
1
|
||||
38
.gitignore
vendored
38
.gitignore
vendored
|
|
@ -4,41 +4,3 @@ libgcrypt-1.4.5-hobbled.tar.bz2
|
|||
/libgcrypt-1.5.1-hobbled.tar.xz
|
||||
/libgcrypt-1.5.2-hobbled.tar.xz
|
||||
/libgcrypt-1.5.3-hobbled.tar.xz
|
||||
/libgcrypt-1.6.1-hobbled.tar.xz
|
||||
/libgcrypt-1.6.2-hobbled.tar.xz
|
||||
/libgcrypt-1.6.3-hobbled.tar.xz
|
||||
/libgcrypt-1.6.4-hobbled.tar.xz
|
||||
/libgcrypt-1.6.5-hobbled.tar.xz
|
||||
/libgcrypt-1.6.6-hobbled.tar.xz
|
||||
/libgcrypt-1.7.3-hobbled.tar.xz
|
||||
/libgcrypt-1.7.5-hobbled.tar.xz
|
||||
/libgcrypt-1.7.6-hobbled.tar.xz
|
||||
/libgcrypt-1.7.7-hobbled.tar.xz
|
||||
/libgcrypt-1.7.8-hobbled.tar.xz
|
||||
/libgcrypt-1.8.0-hobbled.tar.xz
|
||||
/libgcrypt-1.8.1-hobbled.tar.xz
|
||||
/libgcrypt-1.8.2-hobbled.tar.xz
|
||||
/libgcrypt-1.8.3-hobbled.tar.xz
|
||||
/libgcrypt-1.8.4-hobbled.tar.xz
|
||||
/libgcrypt-1.8.5-hobbled.tar.xz
|
||||
/libgcrypt-1.8.6-hobbled.tar.xz
|
||||
/libgcrypt-1.8.7-hobbled.tar.xz
|
||||
/libgcrypt-1.9.0-hobbled.tar.xz
|
||||
/libgcrypt-1.9.1-hobbled.tar.xz
|
||||
/libgcrypt-1.9.2-hobbled.tar.xz
|
||||
/libgcrypt-1.9.3-hobbled.tar.xz
|
||||
/libgcrypt-1.9.4-hobbled.tar.xz
|
||||
/libgcrypt-1.10.0.tar.bz2
|
||||
/libgcrypt-1.10.0.tar.bz2.sig
|
||||
/libgcrypt-1.10.1.tar.bz2
|
||||
/libgcrypt-1.10.1.tar.bz2.sig
|
||||
/libgcrypt-1.10.2.tar.bz2
|
||||
/libgcrypt-1.10.2.tar.bz2.sig
|
||||
/libgcrypt-1.10.3.tar.bz2
|
||||
/libgcrypt-1.10.3.tar.bz2.sig
|
||||
/libgcrypt-1.11.0.tar.bz2
|
||||
/libgcrypt-1.11.0.tar.bz2.sig
|
||||
/libgcrypt-1.11.1.tar.bz2
|
||||
/libgcrypt-1.11.1.tar.bz2.sig
|
||||
/libgcrypt-1.11.2.tar.bz2
|
||||
/libgcrypt-1.11.2.tar.bz2.sig
|
||||
|
|
|
|||
9
hobble-libgcrypt
Executable file
9
hobble-libgcrypt
Executable file
|
|
@ -0,0 +1,9 @@
|
|||
#!/bin/sh
|
||||
|
||||
# Quit out if anything fails.
|
||||
set -e -x
|
||||
|
||||
# Clean out patent-or-otherwise-encumbered code.
|
||||
# EC: ????????? ??/??/2015
|
||||
|
||||
rm -f cipher/ecc.c
|
||||
|
|
@ -1,22 +0,0 @@
|
|||
diff -rup libgcrypt.orig/src/Makefile.am libgcrypt-1.8.3/src/Makefile.am
|
||||
--- libgcrypt.orig/src/Makefile.am 2021-10-18 16:36:20.914025497 +0100
|
||||
+++ libgcrypt-1.8.3/src/Makefile.am 2021-10-19 12:23:08.652960618 +0100
|
||||
@@ -108,6 +108,7 @@ endif !HAVE_W32_SYSTEM
|
||||
|
||||
|
||||
libgcrypt_la_LDFLAGS = $(no_undefined) $(export_symbols) $(extra_ltoptions) \
|
||||
+ -Wc,-fplugin=annobin \
|
||||
$(libgcrypt_version_script_cmd) -version-info \
|
||||
@LIBGCRYPT_LT_CURRENT@:@LIBGCRYPT_LT_REVISION@:@LIBGCRYPT_LT_AGE@
|
||||
libgcrypt_la_DEPENDENCIES = \
|
||||
Only in libgcrypt-1.8.3/src: Makefile.am.annobin
|
||||
diff -rup libgcrypt.orig/src/Makefile.in libgcrypt-1.8.3/src/Makefile.in
|
||||
--- libgcrypt.orig/src/Makefile.in 2021-10-18 16:36:20.914025497 +0100
|
||||
+++ libgcrypt-1.8.3/src/Makefile.in 2021-10-19 12:23:37.791875325 +0100
|
||||
@@ -483,6 +483,7 @@ gcrypt_hwf_modules = @GCRYPT_HWF_MODULES
|
||||
@HAVE_W32_SYSTEM_TRUE@gcrypt_deps = $(gcrypt_res) libgcrypt.def
|
||||
@HAVE_W32_SYSTEM_FALSE@gcrypt_res_ldflag =
|
||||
libgcrypt_la_LDFLAGS = $(no_undefined) $(export_symbols) $(extra_ltoptions) \
|
||||
+ -Wc,-fplugin=annobin \
|
||||
$(libgcrypt_version_script_cmd) -version-info \
|
||||
@LIBGCRYPT_LT_CURRENT@:@LIBGCRYPT_LT_REVISION@:@LIBGCRYPT_LT_AGE@
|
||||
File diff suppressed because it is too large
Load diff
1174
libgcrypt-1.5.0-fips-cavs.patch
Normal file
1174
libgcrypt-1.5.0-fips-cavs.patch
Normal file
File diff suppressed because it is too large
Load diff
126
libgcrypt-1.5.0-fips-cfgrandom.patch
Normal file
126
libgcrypt-1.5.0-fips-cfgrandom.patch
Normal file
|
|
@ -0,0 +1,126 @@
|
|||
diff -up libgcrypt-1.5.0/random/random-fips.c.cfgrandom libgcrypt-1.5.0/random/random-fips.c
|
||||
--- libgcrypt-1.5.0/random/random-fips.c.cfgrandom 2011-07-21 14:50:34.000000000 +0200
|
||||
+++ libgcrypt-1.5.0/random/random-fips.c 2011-07-21 14:50:34.000000000 +0200
|
||||
@@ -27,10 +27,10 @@
|
||||
There are 3 random context which map to the different levels of
|
||||
random quality:
|
||||
|
||||
- Generator Seed and Key Kernel entropy (init/reseed)
|
||||
- ------------------------------------------------------------
|
||||
- GCRY_VERY_STRONG_RANDOM /dev/random 256/128 bits
|
||||
- GCRY_STRONG_RANDOM /dev/random 256/128 bits
|
||||
+ Generator Seed and Key Kernel entropy (init/reseed)
|
||||
+ ---------------------------------------------------------------------------------------
|
||||
+ GCRY_VERY_STRONG_RANDOM /etc/gcrypt/rngseed+/dev/urandom 256/128 bits
|
||||
+ GCRY_STRONG_RANDOM /etc/gcrypt/rngseed+/dev/urandom 256/128 bits
|
||||
gcry_create_nonce GCRY_STRONG_RANDOM n/a
|
||||
|
||||
All random generators return their data in 128 bit blocks. If the
|
||||
@@ -40,8 +40,10 @@
|
||||
(SEED_TTL) output blocks; the re-seeding is disabled in test mode.
|
||||
|
||||
The GCRY_VERY_STRONG_RANDOM and GCRY_STRONG_RANDOM generators are
|
||||
- keyed and seeded from the /dev/random device. Thus these
|
||||
- generators may block until the kernel has collected enough entropy.
|
||||
+ keyed and seeded with data that is loaded from the /etc/gcrypt/rngseed
|
||||
+ if the device or symlink to device exists xored with the data
|
||||
+ from the /dev/urandom device. This allows the system administrator
|
||||
+ to always seed the RNGs from /dev/random if it is required.
|
||||
|
||||
The gcry_create_nonce generator is keyed and seeded from the
|
||||
GCRY_STRONG_RANDOM generator. It may also block if the
|
||||
@@ -560,9 +562,13 @@ get_entropy (size_t nbytes)
|
||||
entropy_collect_buffer_len = 0;
|
||||
|
||||
#if USE_RNDLINUX
|
||||
+ _gcry_rndlinux_gather_random (entropy_collect_cb, 0,
|
||||
+ X931_AES_KEYLEN,
|
||||
+ -1);
|
||||
+ entropy_collect_buffer_len = 0;
|
||||
rc = _gcry_rndlinux_gather_random (entropy_collect_cb, 0,
|
||||
X931_AES_KEYLEN,
|
||||
- GCRY_VERY_STRONG_RANDOM);
|
||||
+ GCRY_STRONG_RANDOM);
|
||||
#elif USE_RNDW32
|
||||
do
|
||||
{
|
||||
diff -up libgcrypt-1.5.0/random/rndlinux.c.cfgrandom libgcrypt-1.5.0/random/rndlinux.c
|
||||
--- libgcrypt-1.5.0/random/rndlinux.c.cfgrandom 2011-02-04 20:16:03.000000000 +0100
|
||||
+++ libgcrypt-1.5.0/random/rndlinux.c 2011-07-21 14:50:34.000000000 +0200
|
||||
@@ -36,7 +36,9 @@
|
||||
#include "g10lib.h"
|
||||
#include "rand-internal.h"
|
||||
|
||||
-static int open_device ( const char *name );
|
||||
+#define NAME_OF_CFG_RNGSEED "/etc/gcrypt/rngseed"
|
||||
+
|
||||
+static int open_device ( const char *name, int fatal );
|
||||
|
||||
|
||||
static int
|
||||
@@ -57,13 +59,17 @@ set_cloexec_flag (int fd)
|
||||
* Used to open the /dev/random devices (Linux, xBSD, Solaris (if it exists)).
|
||||
*/
|
||||
static int
|
||||
-open_device ( const char *name )
|
||||
+open_device ( const char *name, int fatal )
|
||||
{
|
||||
int fd;
|
||||
|
||||
fd = open ( name, O_RDONLY );
|
||||
if ( fd == -1 )
|
||||
- log_fatal ("can't open %s: %s\n", name, strerror(errno) );
|
||||
+ {
|
||||
+ if (! fatal)
|
||||
+ return fd;
|
||||
+ log_fatal ("can't open %s: %s\n", name, strerror(errno) );
|
||||
+ }
|
||||
|
||||
if (set_cloexec_flag (fd))
|
||||
log_error ("error setting FD_CLOEXEC on fd %d: %s\n",
|
||||
@@ -92,6 +98,7 @@ _gcry_rndlinux_gather_random (void (*add
|
||||
{
|
||||
static int fd_urandom = -1;
|
||||
static int fd_random = -1;
|
||||
+ static int fd_configured = -1;
|
||||
int fd;
|
||||
int n;
|
||||
byte buffer[768];
|
||||
@@ -100,6 +107,7 @@ _gcry_rndlinux_gather_random (void (*add
|
||||
size_t last_so_far = 0;
|
||||
int any_need_entropy = 0;
|
||||
int delay;
|
||||
+ size_t orig_length = length;
|
||||
|
||||
/* First read from a hardware source. However let it account only
|
||||
for up to 50% of the requested bytes. */
|
||||
@@ -110,16 +118,26 @@ _gcry_rndlinux_gather_random (void (*add
|
||||
length -= n_hw;
|
||||
|
||||
/* Open the requested device. */
|
||||
+
|
||||
+ if (level == -1)
|
||||
+ {
|
||||
+ if (fd_configured == -1)
|
||||
+ fd_configured = open_device ( NAME_OF_CFG_RNGSEED, 0 );
|
||||
+ fd = fd_configured;
|
||||
+ if (fd == -1)
|
||||
+ return -1;
|
||||
+ }
|
||||
+
|
||||
if (level >= 2)
|
||||
{
|
||||
if( fd_random == -1 )
|
||||
- fd_random = open_device ( NAME_OF_DEV_RANDOM );
|
||||
+ fd_random = open_device ( NAME_OF_DEV_RANDOM, 1 );
|
||||
fd = fd_random;
|
||||
}
|
||||
- else
|
||||
+ else if (level != -1)
|
||||
{
|
||||
if( fd_urandom == -1 )
|
||||
- fd_urandom = open_device ( NAME_OF_DEV_URANDOM );
|
||||
+ fd_urandom = open_device ( NAME_OF_DEV_URANDOM, 1 );
|
||||
fd = fd_urandom;
|
||||
}
|
||||
|
||||
73
libgcrypt-1.5.0-leak.patch
Normal file
73
libgcrypt-1.5.0-leak.patch
Normal file
|
|
@ -0,0 +1,73 @@
|
|||
diff -up libgcrypt-1.5.0/cipher/elgamal.c.leak libgcrypt-1.5.0/cipher/elgamal.c
|
||||
--- libgcrypt-1.5.0/cipher/elgamal.c.leak 2011-02-04 20:09:38.000000000 +0100
|
||||
+++ libgcrypt-1.5.0/cipher/elgamal.c 2012-12-03 14:51:10.743067964 +0100
|
||||
@@ -641,7 +641,10 @@ elg_generate_ext (int algo, unsigned int
|
||||
}
|
||||
|
||||
if (xvalue)
|
||||
- ec = generate_using_x (&sk, nbits, xvalue, retfactors);
|
||||
+ {
|
||||
+ ec = generate_using_x (&sk, nbits, xvalue, retfactors);
|
||||
+ gcry_mpi_release(xvalue);
|
||||
+ }
|
||||
else
|
||||
{
|
||||
generate (&sk, nbits, retfactors);
|
||||
diff -up libgcrypt-1.5.0/cipher/primegen.c.leak libgcrypt-1.5.0/cipher/primegen.c
|
||||
--- libgcrypt-1.5.0/cipher/primegen.c.leak 2012-04-05 15:37:52.000000000 +0200
|
||||
+++ libgcrypt-1.5.0/cipher/primegen.c 2012-12-03 14:44:14.610010867 +0100
|
||||
@@ -1198,10 +1198,7 @@ gcry_prime_group_generator (gcry_mpi_t *
|
||||
gcry_mpi_t prime, gcry_mpi_t *factors,
|
||||
gcry_mpi_t start_g)
|
||||
{
|
||||
- gcry_mpi_t tmp = gcry_mpi_new (0);
|
||||
- gcry_mpi_t b = gcry_mpi_new (0);
|
||||
- gcry_mpi_t pmin1 = gcry_mpi_new (0);
|
||||
- gcry_mpi_t g = start_g? gcry_mpi_copy (start_g) : gcry_mpi_set_ui (NULL, 3);
|
||||
+ gcry_mpi_t tmp, b, pmin1, g;
|
||||
int first = 1;
|
||||
int i, n;
|
||||
|
||||
@@ -1214,6 +1211,11 @@ gcry_prime_group_generator (gcry_mpi_t *
|
||||
if (n < 2)
|
||||
return gpg_error (GPG_ERR_INV_ARG);
|
||||
|
||||
+ tmp = gcry_mpi_new (0);
|
||||
+ b = gcry_mpi_new (0);
|
||||
+ pmin1 = gcry_mpi_new (0);
|
||||
+ g = start_g? gcry_mpi_copy (start_g) : gcry_mpi_set_ui (NULL, 3);
|
||||
+
|
||||
/* Extra sanity check - usually disabled. */
|
||||
/* mpi_set (tmp, factors[0]); */
|
||||
/* for(i = 1; i < n; i++) */
|
||||
diff -up libgcrypt-1.5.0/cipher/pubkey.c.leak libgcrypt-1.5.0/cipher/pubkey.c
|
||||
--- libgcrypt-1.5.0/cipher/pubkey.c.leak 2011-06-13 12:23:50.000000000 +0200
|
||||
+++ libgcrypt-1.5.0/cipher/pubkey.c 2012-12-03 15:23:42.377183489 +0100
|
||||
@@ -2853,6 +2853,8 @@ gcry_pk_encrypt (gcry_sexp_t *r_ciph, gc
|
||||
|
||||
REGISTER_DEFAULT_PUBKEYS;
|
||||
|
||||
+ init_encoding_ctx (&ctx, PUBKEY_OP_ENCRYPT, gcry_pk_get_nbits (s_pkey));
|
||||
+
|
||||
/* Get the key. */
|
||||
rc = sexp_to_key (s_pkey, 0, NULL, &pkey, &module);
|
||||
if (rc)
|
||||
@@ -2873,7 +2875,6 @@ gcry_pk_encrypt (gcry_sexp_t *r_ciph, gc
|
||||
algo_elems = pubkey->elements_enc;
|
||||
|
||||
/* Get the stuff we want to encrypt. */
|
||||
- init_encoding_ctx (&ctx, PUBKEY_OP_ENCRYPT, gcry_pk_get_nbits (s_pkey));
|
||||
rc = sexp_data_to_mpi (s_data, &data, &ctx);
|
||||
if (rc)
|
||||
goto leave;
|
||||
diff -up libgcrypt-1.5.0/src/hmac256.c.leak libgcrypt-1.5.0/src/hmac256.c
|
||||
--- libgcrypt-1.5.0/src/hmac256.c.leak 2011-02-04 20:17:33.000000000 +0100
|
||||
+++ libgcrypt-1.5.0/src/hmac256.c 2012-12-03 15:37:36.504955809 +0100
|
||||
@@ -435,7 +435,6 @@ _gcry_hmac256_finalize (hmac256_context_
|
||||
tmphd = _gcry_hmac256_new (NULL, 0);
|
||||
if (!tmphd)
|
||||
{
|
||||
- free (hd);
|
||||
return NULL;
|
||||
}
|
||||
_gcry_hmac256_update (tmphd, hd->opad, 64);
|
||||
12
libgcrypt-1.5.0-noecc.patch
Normal file
12
libgcrypt-1.5.0-noecc.patch
Normal file
|
|
@ -0,0 +1,12 @@
|
|||
diff -up libgcrypt-1.5.0/tests/Makefile.noecc libgcrypt-1.5.0/tests/Makefile
|
||||
--- libgcrypt-1.5.0/tests/Makefile.in.noecc 2011-07-21 15:34:33.000000000 +0200
|
||||
+++ libgcrypt-1.5.0/tests/Makefile.in 2011-07-21 15:39:35.000000000 +0200
|
||||
@@ -57,7 +57,7 @@ TESTS = version$(EXEEXT) t-mpi-bit$(EXEE
|
||||
ac-data$(EXEEXT) basic$(EXEEXT) mpitests$(EXEEXT) \
|
||||
tsexp$(EXEEXT) keygen$(EXEEXT) pubkey$(EXEEXT) hmac$(EXEEXT) \
|
||||
keygrip$(EXEEXT) fips186-dsa$(EXEEXT) aeswrap$(EXEEXT) \
|
||||
- curves$(EXEEXT) t-kdf$(EXEEXT) pkcs1v2$(EXEEXT) \
|
||||
+ t-kdf$(EXEEXT) pkcs1v2$(EXEEXT) \
|
||||
$(am__EXEEXT_1) benchmark$(EXEEXT)
|
||||
|
||||
# random.c uses fork() thus a test for W32 does not make any sense.
|
||||
214
libgcrypt-1.5.0-tests.patch
Normal file
214
libgcrypt-1.5.0-tests.patch
Normal file
|
|
@ -0,0 +1,214 @@
|
|||
diff -up libgcrypt-1.5.0/cipher/dsa.c.tests libgcrypt-1.5.0/cipher/dsa.c
|
||||
--- libgcrypt-1.5.0/cipher/dsa.c.tests 2011-06-13 12:24:46.000000000 +0200
|
||||
+++ libgcrypt-1.5.0/cipher/dsa.c 2011-07-20 16:44:51.000000000 +0200
|
||||
@@ -479,22 +479,21 @@ generate_fips186 (DSA_secret_key *sk, un
|
||||
initial_seed.seed = gcry_sexp_nth_data (initial_seed.sexp, 1,
|
||||
&initial_seed.seedlen);
|
||||
}
|
||||
-
|
||||
- /* Fixme: Enable 186-3 after it has been approved and after fixing
|
||||
- the generation function. */
|
||||
- /* if (use_fips186_2) */
|
||||
- (void)use_fips186_2;
|
||||
- ec = _gcry_generate_fips186_2_prime (nbits, qbits,
|
||||
- initial_seed.seed,
|
||||
+
|
||||
+ if (use_fips186_2)
|
||||
+ ec = _gcry_generate_fips186_2_prime (nbits, qbits,
|
||||
+ initial_seed.seed,
|
||||
initial_seed.seedlen,
|
||||
&prime_q, &prime_p,
|
||||
r_counter,
|
||||
r_seed, r_seedlen);
|
||||
- /* else */
|
||||
- /* ec = _gcry_generate_fips186_3_prime (nbits, qbits, NULL, 0, */
|
||||
- /* &prime_q, &prime_p, */
|
||||
- /* r_counter, */
|
||||
- /* r_seed, r_seedlen, NULL); */
|
||||
+ else
|
||||
+ ec = _gcry_generate_fips186_3_prime (nbits, qbits,
|
||||
+ initial_seed.seed,
|
||||
+ initial_seed.seedlen,
|
||||
+ &prime_q, &prime_p,
|
||||
+ r_counter,
|
||||
+ r_seed, r_seedlen, NULL);
|
||||
gcry_sexp_release (initial_seed.sexp);
|
||||
if (ec)
|
||||
goto leave;
|
||||
diff -up libgcrypt-1.5.0/cipher/primegen.c.tests libgcrypt-1.5.0/cipher/primegen.c
|
||||
--- libgcrypt-1.5.0/cipher/primegen.c.tests 2011-03-28 14:19:52.000000000 +0200
|
||||
+++ libgcrypt-1.5.0/cipher/primegen.c 2011-07-21 14:36:03.000000000 +0200
|
||||
@@ -1647,7 +1647,7 @@ _gcry_generate_fips186_3_prime (unsigned
|
||||
gpg_err_code_t ec;
|
||||
unsigned char seed_help_buffer[256/8]; /* Used to hold a generated SEED. */
|
||||
unsigned char *seed_plus; /* Malloced buffer to hold SEED+x. */
|
||||
- unsigned char digest[256/8]; /* Helper buffer for SHA-1 digest. */
|
||||
+ unsigned char digest[256/8]; /* Helper buffer for SHA-x digest. */
|
||||
gcry_mpi_t val_2 = NULL; /* Helper for the prime test. */
|
||||
gcry_mpi_t tmpval = NULL; /* Helper variable. */
|
||||
int hashalgo; /* The id of the Approved Hash Function. */
|
||||
@@ -1737,7 +1737,7 @@ _gcry_generate_fips186_3_prime (unsigned
|
||||
}
|
||||
gcry_mpi_release (prime_q); prime_q = NULL;
|
||||
ec = gpg_err_code (gcry_mpi_scan (&prime_q, GCRYMPI_FMT_USG,
|
||||
- value_u, sizeof value_u, NULL));
|
||||
+ value_u, qbits/8, NULL));
|
||||
if (ec)
|
||||
goto leave;
|
||||
mpi_set_highbit (prime_q, qbits-1 );
|
||||
@@ -1782,11 +1782,11 @@ _gcry_generate_fips186_3_prime (unsigned
|
||||
if (seed_plus[i])
|
||||
break;
|
||||
}
|
||||
- gcry_md_hash_buffer (GCRY_MD_SHA1, digest, seed_plus, seedlen);
|
||||
+ gcry_md_hash_buffer (hashalgo, digest, seed_plus, seedlen);
|
||||
|
||||
gcry_mpi_release (tmpval); tmpval = NULL;
|
||||
ec = gpg_err_code (gcry_mpi_scan (&tmpval, GCRYMPI_FMT_USG,
|
||||
- digest, sizeof digest, NULL));
|
||||
+ digest, qbits/8, NULL));
|
||||
if (ec)
|
||||
goto leave;
|
||||
if (value_j == value_n)
|
||||
@@ -1822,11 +1822,11 @@ _gcry_generate_fips186_3_prime (unsigned
|
||||
}
|
||||
|
||||
/* Step 12: Save p, q, counter and seed. */
|
||||
- log_debug ("fips186-3 pbits p=%u q=%u counter=%d\n",
|
||||
+/* log_debug ("fips186-3 pbits p=%u q=%u counter=%d\n",
|
||||
mpi_get_nbits (prime_p), mpi_get_nbits (prime_q), counter);
|
||||
log_printhex("fips186-3 seed:", seed, seedlen);
|
||||
log_mpidump ("fips186-3 prime p", prime_p);
|
||||
- log_mpidump ("fips186-3 prime q", prime_q);
|
||||
+ log_mpidump ("fips186-3 prime q", prime_q); */
|
||||
if (r_q)
|
||||
{
|
||||
*r_q = prime_q;
|
||||
diff -up libgcrypt-1.5.0/cipher/rsa.c.tests libgcrypt-1.5.0/cipher/rsa.c
|
||||
--- libgcrypt-1.5.0/cipher/rsa.c.tests 2011-06-10 10:53:41.000000000 +0200
|
||||
+++ libgcrypt-1.5.0/cipher/rsa.c 2011-07-21 14:36:59.000000000 +0200
|
||||
@@ -388,7 +388,7 @@ generate_x931 (RSA_secret_key *sk, unsig
|
||||
|
||||
*swapped = 0;
|
||||
|
||||
- if (e_value == 1) /* Alias for a secure value. */
|
||||
+ if (e_value == 1 || e_value == 0) /* Alias for a secure value. */
|
||||
e_value = 65537;
|
||||
|
||||
/* Point 1 of section 4.1: k = 1024 + 256s with S >= 0 */
|
||||
diff -up libgcrypt-1.5.0/random/random-fips.c.tests libgcrypt-1.5.0/random/random-fips.c
|
||||
--- libgcrypt-1.5.0/random/random-fips.c.tests 2011-07-20 16:40:59.000000000 +0200
|
||||
+++ libgcrypt-1.5.0/random/random-fips.c 2011-07-20 16:40:59.000000000 +0200
|
||||
@@ -691,6 +691,7 @@ get_random (void *buffer, size_t length,
|
||||
|
||||
check_guards (rng_ctx);
|
||||
|
||||
+ reinitialize:
|
||||
/* Initialize the cipher handle and thus setup the key if needed. */
|
||||
if (!rng_ctx->cipher_hd)
|
||||
{
|
||||
@@ -710,13 +711,11 @@ get_random (void *buffer, size_t length,
|
||||
if (rng_ctx->key_init_pid != getpid ()
|
||||
|| rng_ctx->seed_init_pid != getpid ())
|
||||
{
|
||||
- /* We are in a child of us. Because we have no way yet to do
|
||||
- proper re-initialization (including self-checks etc), the
|
||||
- only chance we have is to bail out. Obviusly a fork/exec
|
||||
- won't harm because the exec overwrites the old image. */
|
||||
- fips_signal_error ("fork without proper re-initialization "
|
||||
- "detected in RNG");
|
||||
- goto bailout;
|
||||
+ /* Just reinitialize the key & seed. */
|
||||
+ gcry_cipher_close(rng_ctx->cipher_hd);
|
||||
+ rng_ctx->cipher_hd = NULL;
|
||||
+ rng_ctx->is_seeded = 0;
|
||||
+ goto reinitialize;
|
||||
}
|
||||
|
||||
if (x931_aes_driver (buffer, length, rng_ctx))
|
||||
diff -up libgcrypt-1.5.0/tests/ac.c.tests libgcrypt-1.5.0/tests/ac.c
|
||||
--- libgcrypt-1.5.0/tests/ac.c.tests 2011-02-04 20:18:20.000000000 +0100
|
||||
+++ libgcrypt-1.5.0/tests/ac.c 2011-07-20 16:40:59.000000000 +0200
|
||||
@@ -150,6 +150,9 @@ main (int argc, char **argv)
|
||||
if (!gcry_check_version (GCRYPT_VERSION))
|
||||
die ("version mismatch\n");
|
||||
gcry_control (GCRYCTL_INITIALIZATION_FINISHED, 0);
|
||||
+ if (gcry_fips_mode_active())
|
||||
+ /* ac not functional in the fips mode, skip it */
|
||||
+ return 77;
|
||||
if (debug)
|
||||
gcry_control (GCRYCTL_SET_DEBUG_FLAGS, 1u , 0);
|
||||
/* No valuable keys are create, so we can speed up our RNG. */
|
||||
diff -up libgcrypt-1.5.0/tests/ac-data.c.tests libgcrypt-1.5.0/tests/ac-data.c
|
||||
--- libgcrypt-1.5.0/tests/ac-data.c.tests 2011-02-04 20:18:20.000000000 +0100
|
||||
+++ libgcrypt-1.5.0/tests/ac-data.c 2011-07-20 16:40:59.000000000 +0200
|
||||
@@ -198,6 +198,9 @@ main (int argc, char **argv)
|
||||
if (!gcry_check_version (GCRYPT_VERSION))
|
||||
die ("version mismatch\n");
|
||||
gcry_control (GCRYCTL_INITIALIZATION_FINISHED, 0);
|
||||
+ if (gcry_fips_mode_active())
|
||||
+ /* ac not functional in the fips mode, skip it */
|
||||
+ return 77;
|
||||
if (debug)
|
||||
gcry_control (GCRYCTL_SET_DEBUG_FLAGS, 1u , 0);
|
||||
|
||||
diff -up libgcrypt-1.5.0/tests/ac-schemes.c.tests libgcrypt-1.5.0/tests/ac-schemes.c
|
||||
--- libgcrypt-1.5.0/tests/ac-schemes.c.tests 2011-02-04 20:18:20.000000000 +0100
|
||||
+++ libgcrypt-1.5.0/tests/ac-schemes.c 2011-07-20 16:40:59.000000000 +0200
|
||||
@@ -338,6 +338,9 @@ main (int argc, char **argv)
|
||||
if (! gcry_check_version (GCRYPT_VERSION))
|
||||
die ("version mismatch\n");
|
||||
gcry_control (GCRYCTL_INITIALIZATION_FINISHED, 0);
|
||||
+ if (gcry_fips_mode_active())
|
||||
+ /* ac not functional in the fips mode, skip it */
|
||||
+ return 77;
|
||||
if (debug)
|
||||
gcry_control (GCRYCTL_SET_DEBUG_FLAGS, 1u, 0);
|
||||
|
||||
diff -up libgcrypt-1.5.0/tests/keygen.c.tests libgcrypt-1.5.0/tests/keygen.c
|
||||
--- libgcrypt-1.5.0/tests/keygen.c.tests 2011-02-04 20:18:20.000000000 +0100
|
||||
+++ libgcrypt-1.5.0/tests/keygen.c 2011-07-21 14:39:03.000000000 +0200
|
||||
@@ -148,12 +148,12 @@ check_rsa_keys (void)
|
||||
}
|
||||
|
||||
if (verbose)
|
||||
- fprintf (stderr, "creating 1536 bit DSA key\n");
|
||||
+ fprintf (stderr, "creating 2048 bit DSA key\n");
|
||||
rc = gcry_sexp_new (&keyparm,
|
||||
"(genkey\n"
|
||||
" (dsa\n"
|
||||
- " (nbits 4:1536)\n"
|
||||
- " (qbits 3:224)\n"
|
||||
+ " (nbits 4:2048)\n"
|
||||
+ " (qbits 3:256)\n"
|
||||
" ))", 0, 1);
|
||||
if (rc)
|
||||
die ("error creating S-expression: %s\n", gpg_strerror (rc));
|
||||
@@ -190,11 +190,11 @@ check_rsa_keys (void)
|
||||
|
||||
|
||||
if (verbose)
|
||||
- fprintf (stderr, "creating 512 bit RSA key with e=257\n");
|
||||
+ fprintf (stderr, "creating 1024 bit RSA key with e=257\n");
|
||||
rc = gcry_sexp_new (&keyparm,
|
||||
"(genkey\n"
|
||||
" (rsa\n"
|
||||
- " (nbits 3:512)\n"
|
||||
+ " (nbits 4:1024)\n"
|
||||
" (rsa-use-e 3:257)\n"
|
||||
" ))", 0, 1);
|
||||
if (rc)
|
||||
@@ -208,11 +208,11 @@ check_rsa_keys (void)
|
||||
gcry_sexp_release (key);
|
||||
|
||||
if (verbose)
|
||||
- fprintf (stderr, "creating 512 bit RSA key with default e\n");
|
||||
+ fprintf (stderr, "creating 1024 bit RSA key with default secure e\n");
|
||||
rc = gcry_sexp_new (&keyparm,
|
||||
"(genkey\n"
|
||||
" (rsa\n"
|
||||
- " (nbits 3:512)\n"
|
||||
+ " (nbits 4:1024)\n"
|
||||
" (rsa-use-e 1:0)\n"
|
||||
" ))", 0, 1);
|
||||
if (rc)
|
||||
87
libgcrypt-1.5.0-use-fipscheck.patch
Normal file
87
libgcrypt-1.5.0-use-fipscheck.patch
Normal file
|
|
@ -0,0 +1,87 @@
|
|||
diff -up libgcrypt-1.5.0/src/fips.c.use-fipscheck libgcrypt-1.5.0/src/fips.c
|
||||
--- libgcrypt-1.5.0/src/fips.c.use-fipscheck 2011-02-04 20:17:33.000000000 +0100
|
||||
+++ libgcrypt-1.5.0/src/fips.c 2011-07-20 16:17:21.000000000 +0200
|
||||
@@ -570,23 +570,48 @@ run_random_selftests (void)
|
||||
return !!err;
|
||||
}
|
||||
|
||||
+static int
|
||||
+get_library_path(const char *libname, const char *symbolname, char *path, size_t pathlen)
|
||||
+{
|
||||
+ Dl_info info;
|
||||
+ void *dl, *sym;
|
||||
+ int rv = -1;
|
||||
+
|
||||
+ dl = dlopen(libname, RTLD_LAZY);
|
||||
+ if (dl == NULL) {
|
||||
+ return -1;
|
||||
+ }
|
||||
+
|
||||
+ sym = dlsym(dl, symbolname);
|
||||
+
|
||||
+ if (sym != NULL && dladdr(sym, &info)) {
|
||||
+ strncpy(path, info.dli_fname, pathlen-1);
|
||||
+ path[pathlen-1] = '\0';
|
||||
+ rv = 0;
|
||||
+ }
|
||||
+
|
||||
+ dlclose(dl);
|
||||
+
|
||||
+ return rv;
|
||||
+}
|
||||
+
|
||||
/* Run an integrity check on the binary. Returns 0 on success. */
|
||||
static int
|
||||
check_binary_integrity (void)
|
||||
{
|
||||
#ifdef ENABLE_HMAC_BINARY_CHECK
|
||||
gpg_error_t err;
|
||||
- Dl_info info;
|
||||
+ char libpath[4096];
|
||||
unsigned char digest[32];
|
||||
int dlen;
|
||||
char *fname = NULL;
|
||||
- const char key[] = "What am I, a doctor or a moonshuttle conductor?";
|
||||
-
|
||||
- if (!dladdr ("gcry_check_version", &info))
|
||||
+ const char key[] = "orboDeJITITejsirpADONivirpUkvarP";
|
||||
+
|
||||
+ if (get_library_path ("libgcrypt.so.11", "gcry_check_version", libpath, sizeof(libpath)))
|
||||
err = gpg_error_from_syserror ();
|
||||
else
|
||||
{
|
||||
- dlen = _gcry_hmac256_file (digest, sizeof digest, info.dli_fname,
|
||||
+ dlen = _gcry_hmac256_file (digest, sizeof digest, libpath,
|
||||
key, strlen (key));
|
||||
if (dlen < 0)
|
||||
err = gpg_error_from_syserror ();
|
||||
@@ -594,7 +619,7 @@ check_binary_integrity (void)
|
||||
err = gpg_error (GPG_ERR_INTERNAL);
|
||||
else
|
||||
{
|
||||
- fname = gcry_malloc (strlen (info.dli_fname) + 1 + 5 + 1 );
|
||||
+ fname = gcry_malloc (strlen (libpath) + 1 + 5 + 1 );
|
||||
if (!fname)
|
||||
err = gpg_error_from_syserror ();
|
||||
else
|
||||
@@ -603,7 +628,7 @@ check_binary_integrity (void)
|
||||
char *p;
|
||||
|
||||
/* Prefix the basename with a dot. */
|
||||
- strcpy (fname, info.dli_fname);
|
||||
+ strcpy (fname, libpath);
|
||||
p = strrchr (fname, '/');
|
||||
if (p)
|
||||
p++;
|
||||
diff -up libgcrypt-1.5.0/src/Makefile.in.use-fipscheck libgcrypt-1.5.0/src/Makefile.in
|
||||
--- libgcrypt-1.5.0/src/Makefile.in.use-fipscheck 2011-06-29 10:58:01.000000000 +0200
|
||||
+++ libgcrypt-1.5.0/src/Makefile.in 2011-07-20 16:19:33.000000000 +0200
|
||||
@@ -375,7 +375,7 @@ libgcrypt_la_LIBADD = $(gcrypt_res) \
|
||||
../cipher/libcipher.la \
|
||||
../random/librandom.la \
|
||||
../mpi/libmpi.la \
|
||||
- ../compat/libcompat.la $(GPG_ERROR_LIBS)
|
||||
+ ../compat/libcompat.la $(GPG_ERROR_LIBS) -ldl
|
||||
|
||||
dumpsexp_SOURCES = dumpsexp.c
|
||||
dumpsexp_CFLAGS = $(arch_gpg_error_cflags)
|
||||
82
libgcrypt-1.5.1-use-poll.patch
Normal file
82
libgcrypt-1.5.1-use-poll.patch
Normal file
|
|
@ -0,0 +1,82 @@
|
|||
diff -up libgcrypt-1.5.1/random/rndlinux.c.use-poll libgcrypt-1.5.1/random/rndlinux.c
|
||||
--- libgcrypt-1.5.1/random/rndlinux.c.use-poll 2013-03-20 15:33:26.504867356 +0100
|
||||
+++ libgcrypt-1.5.1/random/rndlinux.c 2013-03-20 15:37:24.999944048 +0100
|
||||
@@ -32,6 +32,7 @@
|
||||
#include <string.h>
|
||||
#include <unistd.h>
|
||||
#include <fcntl.h>
|
||||
+#include <poll.h>
|
||||
#include "types.h"
|
||||
#include "g10lib.h"
|
||||
#include "rand-internal.h"
|
||||
@@ -142,49 +143,37 @@ _gcry_rndlinux_gather_random (void (*add
|
||||
}
|
||||
|
||||
/* Enter the read loop. */
|
||||
- delay = 0; /* Start with 0 seconds so that we do no block on the
|
||||
+ delay = 100; /* Start with 0 seconds so that we do no block on the
|
||||
first iteration and in turn call the progress function
|
||||
before blocking. To give the OS a better chance to
|
||||
return with something we will actually use 100ms. */
|
||||
while (length)
|
||||
{
|
||||
- fd_set rfds;
|
||||
- struct timeval tv;
|
||||
int rc;
|
||||
+ struct pollfd pfd;
|
||||
|
||||
- /* If the system has no limit on the number of file descriptors
|
||||
- and we encounter an fd which is larger than the fd_set size,
|
||||
- we don't use the select at all. The select code is only used
|
||||
- to emit progress messages. A better solution would be to
|
||||
- fall back to poll() if available. */
|
||||
-#ifdef FD_SETSIZE
|
||||
- if (fd < FD_SETSIZE)
|
||||
-#endif
|
||||
+ pfd.fd = fd;
|
||||
+ pfd.events = POLLIN;
|
||||
+
|
||||
+ if ( !(rc=poll(&pfd, 1, delay)) )
|
||||
{
|
||||
- FD_ZERO(&rfds);
|
||||
- FD_SET(fd, &rfds);
|
||||
- tv.tv_sec = delay;
|
||||
- tv.tv_usec = delay? 0 : 100000;
|
||||
- if ( !(rc=select(fd+1, &rfds, NULL, NULL, &tv)) )
|
||||
- {
|
||||
- if (!any_need_entropy || last_so_far != (want - length) )
|
||||
- {
|
||||
- last_so_far = want - length;
|
||||
- _gcry_random_progress ("need_entropy", 'X',
|
||||
- (int)last_so_far, (int)want);
|
||||
- any_need_entropy = 1;
|
||||
- }
|
||||
- delay = 3; /* Use 3 seconds henceforth. */
|
||||
- continue;
|
||||
- }
|
||||
- else if( rc == -1 )
|
||||
+ if (!any_need_entropy || last_so_far != (want - length) )
|
||||
{
|
||||
- log_error ("select() error: %s\n", strerror(errno));
|
||||
- if (!delay)
|
||||
- delay = 1; /* Use 1 second if we encounter an error before
|
||||
+ last_so_far = want - length;
|
||||
+ _gcry_random_progress ("need_entropy", 'X',
|
||||
+ (int)last_so_far, (int)want);
|
||||
+ any_need_entropy = 1;
|
||||
+ }
|
||||
+ delay = 3000; /* Use 3 seconds henceforth. */
|
||||
+ continue;
|
||||
+ }
|
||||
+ else if( rc == -1 )
|
||||
+ {
|
||||
+ log_error ("poll() error: %s\n", strerror(errno));
|
||||
+ if (!delay)
|
||||
+ delay = 1000; /* Use 1 second if we encounter an error before
|
||||
we have ever blocked. */
|
||||
- continue;
|
||||
- }
|
||||
+ continue;
|
||||
}
|
||||
|
||||
do
|
||||
30
libgcrypt-1.5.2-aliasing.patch
Normal file
30
libgcrypt-1.5.2-aliasing.patch
Normal file
|
|
@ -0,0 +1,30 @@
|
|||
diff -up libgcrypt-1.5.2/cipher/Makefile.am.aliasing libgcrypt-1.5.2/cipher/Makefile.am
|
||||
--- libgcrypt-1.5.2/cipher/Makefile.am.aliasing 2013-04-18 16:49:13.000000000 +0200
|
||||
+++ libgcrypt-1.5.2/cipher/Makefile.am 2013-04-25 21:48:57.867465215 +0200
|
||||
@@ -81,3 +81,9 @@ tiger.o: $(srcdir)/tiger.c
|
||||
|
||||
tiger.lo: $(srcdir)/tiger.c
|
||||
`echo $(LTCOMPILE) -c $(srcdir)/tiger.c | $(o_flag_munging) `
|
||||
+
|
||||
+rijndael.o: $(srcdir)/rijndael.c
|
||||
+ `echo $(COMPILE) -fno-strict-aliasing -c $(srcdir)/rijndael.c `
|
||||
+
|
||||
+rijndael.lo: $(srcdir)/rijndael.c
|
||||
+ `echo $(LTCOMPILE) -fno-strict-aliasing -c $(srcdir)/rijndael.c `
|
||||
diff -up libgcrypt-1.5.2/cipher/Makefile.in.aliasing libgcrypt-1.5.2/cipher/Makefile.in
|
||||
--- libgcrypt-1.5.2/cipher/Makefile.in.aliasing 2013-04-18 17:06:03.000000000 +0200
|
||||
+++ libgcrypt-1.5.2/cipher/Makefile.in 2013-04-25 21:48:59.164493610 +0200
|
||||
@@ -638,6 +638,12 @@ tiger.o: $(srcdir)/tiger.c
|
||||
tiger.lo: $(srcdir)/tiger.c
|
||||
`echo $(LTCOMPILE) -c $(srcdir)/tiger.c | $(o_flag_munging) `
|
||||
|
||||
+rijndael.o: $(srcdir)/rijndael.c
|
||||
+ `echo $(COMPILE) -fno-strict-aliasing -c $(srcdir)/rijndael.c `
|
||||
+
|
||||
+rijndael.lo: $(srcdir)/rijndael.c
|
||||
+ `echo $(LTCOMPILE) -fno-strict-aliasing -c $(srcdir)/rijndael.c `
|
||||
+
|
||||
# Tell versions [3.59,3.63) of GNU make to not export all variables.
|
||||
# Otherwise a system limit (for SysV at least) may be exceeded.
|
||||
.NOEXPORT:
|
||||
diff -up libgcrypt-1.5.2/cipher/rijndael.c.aliasing libgcrypt-1.5.2/cipher/rijndael.c
|
||||
102
libgcrypt-1.5.2-mpicoder-gccopt.patch
Normal file
102
libgcrypt-1.5.2-mpicoder-gccopt.patch
Normal file
|
|
@ -0,0 +1,102 @@
|
|||
diff -up libgcrypt-1.5.2/mpi/mpicoder.c.gccopt libgcrypt-1.5.2/mpi/mpicoder.c
|
||||
--- libgcrypt-1.5.2/mpi/mpicoder.c.gccopt 2013-04-18 16:48:42.000000000 +0200
|
||||
+++ libgcrypt-1.5.2/mpi/mpicoder.c 2013-06-20 10:24:57.241510589 +0200
|
||||
@@ -555,16 +555,16 @@ gcry_mpi_print (enum gcry_mpi_format for
|
||||
extra=1;
|
||||
}
|
||||
|
||||
- if (buffer && n > len)
|
||||
- {
|
||||
- /* The provided buffer is too short. */
|
||||
- gcry_free (tmp);
|
||||
- return gcry_error (GPG_ERR_TOO_SHORT);
|
||||
- }
|
||||
if (buffer)
|
||||
{
|
||||
unsigned char *s = buffer;
|
||||
|
||||
+ if (n > len)
|
||||
+ {
|
||||
+ /* The provided buffer is too short. */
|
||||
+ gcry_free (tmp);
|
||||
+ return gcry_error (GPG_ERR_TOO_SHORT);
|
||||
+ }
|
||||
if (extra)
|
||||
*s++ = 0;
|
||||
memcpy (s, tmp, n-extra);
|
||||
@@ -580,12 +580,12 @@ gcry_mpi_print (enum gcry_mpi_format for
|
||||
/* Note: We ignore the sign for this format. */
|
||||
/* FIXME: for performance reasons we should put this into
|
||||
mpi_aprint because we can then use the buffer directly. */
|
||||
- if (buffer && n > len)
|
||||
- return gcry_error (GPG_ERR_TOO_SHORT);
|
||||
if (buffer)
|
||||
{
|
||||
unsigned char *tmp;
|
||||
|
||||
+ if (n > len)
|
||||
+ return gcry_error (GPG_ERR_TOO_SHORT);
|
||||
tmp = _gcry_mpi_get_buffer (a, &n, NULL);
|
||||
if (!tmp)
|
||||
return gpg_error_from_syserror ();
|
||||
@@ -603,14 +603,13 @@ gcry_mpi_print (enum gcry_mpi_format for
|
||||
if( a->sign )
|
||||
return gcry_error (GPG_ERR_INV_ARG);
|
||||
|
||||
- if (buffer && n+2 > len)
|
||||
- return gcry_error (GPG_ERR_TOO_SHORT);
|
||||
-
|
||||
if (buffer)
|
||||
{
|
||||
unsigned char *tmp;
|
||||
unsigned char *s = buffer;
|
||||
|
||||
+ if (n+2 > len)
|
||||
+ return gcry_error (GPG_ERR_TOO_SHORT);
|
||||
s[0] = nbits >> 8;
|
||||
s[1] = nbits;
|
||||
|
||||
@@ -641,16 +640,16 @@ gcry_mpi_print (enum gcry_mpi_format for
|
||||
extra=1;
|
||||
}
|
||||
|
||||
- if (buffer && n+4 > len)
|
||||
- {
|
||||
- gcry_free(tmp);
|
||||
- return gcry_error (GPG_ERR_TOO_SHORT);
|
||||
- }
|
||||
-
|
||||
if (buffer)
|
||||
{
|
||||
unsigned char *s = buffer;
|
||||
|
||||
+ if (n+4 > len)
|
||||
+ {
|
||||
+ gcry_free(tmp);
|
||||
+ return gcry_error (GPG_ERR_TOO_SHORT);
|
||||
+ }
|
||||
+
|
||||
*s++ = n >> 24;
|
||||
*s++ = n >> 16;
|
||||
*s++ = n >> 8;
|
||||
@@ -677,15 +676,15 @@ gcry_mpi_print (enum gcry_mpi_format for
|
||||
if (!n || (*tmp & 0x80))
|
||||
extra = 2;
|
||||
|
||||
- if (buffer && 2*n + extra + !!a->sign + 1 > len)
|
||||
- {
|
||||
- gcry_free(tmp);
|
||||
- return gcry_error (GPG_ERR_TOO_SHORT);
|
||||
- }
|
||||
if (buffer)
|
||||
{
|
||||
unsigned char *s = buffer;
|
||||
|
||||
+ if (2*n + extra + !!a->sign + 1 > len)
|
||||
+ {
|
||||
+ gcry_free(tmp);
|
||||
+ return gcry_error (GPG_ERR_TOO_SHORT);
|
||||
+ }
|
||||
if (a->sign)
|
||||
*s++ = '-';
|
||||
if (extra)
|
||||
511
libgcrypt.spec
511
libgcrypt.spec
|
|
@ -1,50 +1,55 @@
|
|||
# This is taken from gnutls.spec
|
||||
%define srpmhash() %{lua:
|
||||
local files = rpm.expand("%_specdir/libgcrypt.spec")
|
||||
for i, p in ipairs(patches) do
|
||||
files = files.." "..p
|
||||
end
|
||||
for i, p in ipairs(sources) do
|
||||
files = files.." "..p
|
||||
end
|
||||
local sha256sum = assert(io.popen("cat "..files.."| sha256sum"))
|
||||
local hash = sha256sum:read("*a")
|
||||
sha256sum:close()
|
||||
print(string.sub(hash, 0, 16))
|
||||
}
|
||||
|
||||
Name: libgcrypt
|
||||
Version: 1.11.2
|
||||
Version: 1.5.3
|
||||
Release: 1%{?dist}
|
||||
URL: https://www.gnupg.org/
|
||||
Source0: https://www.gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2
|
||||
Source1: https://www.gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2.sig
|
||||
Source2: https://gnupg.org/signature_key.asc
|
||||
# Pass the annobin flags to the libgcrypt.so (#2016349)
|
||||
Patch1: libgcrypt-1.10.1-annobin.patch
|
||||
# https://gitlab.com/redhat-crypto/libgcrypt/libgcrypt-mirror/-/merge_requests/19/
|
||||
Patch5: libgcrypt-1.11.0-marvin.patch
|
||||
URL: http://www.gnupg.org/
|
||||
Source0: libgcrypt-%{version}-hobbled.tar.xz
|
||||
# The original libgcrypt sources now contain potentially patented ECC
|
||||
# cipher support. We have to remove it in the tarball we ship with
|
||||
# the hobble-libgcrypt script.
|
||||
#Source0: ftp://ftp.gnupg.org/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2
|
||||
#Source1: ftp://ftp.gnupg.org/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2.sig
|
||||
Source2: wk@g10code.com
|
||||
Source3: hobble-libgcrypt
|
||||
# do not run the ecc curves test
|
||||
Patch1: libgcrypt-1.5.0-noecc.patch
|
||||
# make FIPS hmac compatible with fipscheck - non upstreamable
|
||||
Patch2: libgcrypt-1.5.0-use-fipscheck.patch
|
||||
# fix tests in the FIPS mode, fix the FIPS-186-3 DSA keygen
|
||||
Patch5: libgcrypt-1.5.0-tests.patch
|
||||
# add configurable source of RNG seed and seed by default
|
||||
# from /dev/urandom in the FIPS mode
|
||||
Patch6: libgcrypt-1.5.0-fips-cfgrandom.patch
|
||||
# make the FIPS-186-3 DSA CAVS testable
|
||||
Patch7: libgcrypt-1.5.0-fips-cavs.patch
|
||||
# fix for memory leaks an other errors found by Coverity scan
|
||||
Patch9: libgcrypt-1.5.0-leak.patch
|
||||
# use poll instead of select when gathering randomness
|
||||
Patch11: libgcrypt-1.5.1-use-poll.patch
|
||||
# compile rijndael with -fno-strict-aliasing
|
||||
Patch12: libgcrypt-1.5.2-aliasing.patch
|
||||
# slight optimalization of mpicoder.c to silence Valgrind (#968288)
|
||||
Patch13: libgcrypt-1.5.2-mpicoder-gccopt.patch
|
||||
|
||||
%global gcrylibdir %{_libdir}
|
||||
%global gcrysoname libgcrypt.so.20
|
||||
%global hmackey orboDeJITITejsirpADONivirpUkvarP
|
||||
|
||||
License: BSD-3-Clause AND (BSD-3-Clause OR GPL-2.0-only) AND GPL-2.0-or-later AND LGPL-2.1-or-later AND LGPL-2.0-or-later AND MIT-Modern-Variant
|
||||
# Technically LGPLv2.1+, but Fedora's table doesn't draw a distinction.
|
||||
# Documentation and some utilities are GPLv2+ licensed. These files
|
||||
# are in the devel subpackage.
|
||||
License: LGPLv2+
|
||||
Summary: A general-purpose cryptography library
|
||||
BuildRequires: gcc
|
||||
BuildRequires: gawk, libgpg-error-devel >= 1.11, pkgconfig
|
||||
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
|
||||
BuildRequires: gawk, libgpg-error-devel >= 1.4, pkgconfig
|
||||
BuildRequires: fipscheck
|
||||
# This is needed only when patching the .texi doc.
|
||||
BuildRequires: texinfo
|
||||
BuildRequires: autoconf, automake, libtool
|
||||
BuildRequires: make
|
||||
BuildRequires: gnupg2
|
||||
BuildRequires: annobin-annocheck binutils
|
||||
Group: System Environment/Libraries
|
||||
|
||||
%package devel
|
||||
Summary: Development files for the %{name} package
|
||||
License: LGPLv2+ and GPLv2+
|
||||
Group: Development/Libraries
|
||||
Requires(pre): /sbin/install-info
|
||||
Requires(post): /sbin/install-info
|
||||
Requires: libgpg-error-devel
|
||||
Requires: %{name}%{?_isa} = %{version}-%{release}
|
||||
Requires: pkgconfig
|
||||
Requires: %{name} = %{version}-%{release}
|
||||
|
||||
%description
|
||||
Libgcrypt is a general purpose crypto library based on the code used
|
||||
|
|
@ -56,59 +61,44 @@ in GNU Privacy Guard. This package contains files needed to develop
|
|||
applications using libgcrypt.
|
||||
|
||||
%prep
|
||||
%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
|
||||
%setup -q
|
||||
%patch 1 -p1
|
||||
%patch 5 -p1
|
||||
%{SOURCE3}
|
||||
%patch1 -p1 -b .noecc
|
||||
%patch2 -p1 -b .use-fipscheck
|
||||
%patch5 -p1 -b .tests
|
||||
%patch6 -p1 -b .cfgrandom
|
||||
%patch7 -p1 -b .cavs
|
||||
%patch9 -p1 -b .leak
|
||||
%patch11 -p1 -b .use-poll
|
||||
%patch12 -p1 -b .aliasing
|
||||
%patch13 -p1 -b .gccopt
|
||||
|
||||
%build
|
||||
# should be all algorithms except SM3 and SM4, aria
|
||||
export DIGESTS='crc gostr3411-94 md4 md5 rmd160 sha1 sha256 sha512 sha3 tiger whirlpool stribog blake2'
|
||||
export CIPHERS='arcfour blowfish cast5 des aes twofish serpent rfc2268 seed camellia idea salsa20 gost28147 chacha20'
|
||||
|
||||
eval $(sed -n 's/^\(\(NAME\|VERSION_ID\)=.*\)/OS_\1/p' /etc/os-release)
|
||||
export FIPS_MODULE_NAME="$OS_NAME ${OS_VERSION_ID%%.*} %name"
|
||||
|
||||
autoreconf -f
|
||||
%configure --disable-static \
|
||||
%ifarch sparc64
|
||||
--disable-asm \
|
||||
%endif
|
||||
--enable-noexecstack \
|
||||
--enable-hmac-binary-check=%{hmackey} \
|
||||
--disable-jent-support \
|
||||
--disable-O-flag-munging \
|
||||
--enable-digests="$DIGESTS" \
|
||||
--enable-ciphers="$CIPHERS" \
|
||||
--enable-marvin-workaround \
|
||||
--with-fips-module-version="$FIPS_MODULE_NAME %{version}-%{srpmhash}"
|
||||
sed -i -e '/^sys_lib_dlsearch_path_spec/s,/lib /usr/lib,/usr/lib /lib64 /usr/lib64 /lib,g' libtool
|
||||
%make_build
|
||||
--enable-hmac-binary-check \
|
||||
--enable-pubkey-ciphers='dsa elgamal rsa' \
|
||||
--disable-O-flag-munging
|
||||
make %{?_smp_mflags}
|
||||
|
||||
%check
|
||||
fipshmac src/.libs/libgcrypt.so.??
|
||||
make check
|
||||
# try in faked FIPS mode too
|
||||
LIBGCRYPT_FORCE_FIPS_MODE=1 make check
|
||||
|
||||
%define libpath $RPM_BUILD_ROOT%{gcrylibdir}/%{gcrysoname}.?.?
|
||||
|
||||
PROFILE=%{?dist} annocheck --ignore-unknown --verbose --profile=${PROFILE:1} %{libpath}
|
||||
|
||||
# Add generation of HMAC checksums of the final stripped binaries
|
||||
%define __spec_install_post \
|
||||
%{?__debug_package:%{__debug_install_post}} \
|
||||
%{__arch_install_post} \
|
||||
%{__os_install_post} \
|
||||
cd src \
|
||||
sed -i -e 's|FILE=.*|FILE=\\\$1|' gen-note-integrity.sh \
|
||||
READELF=readelf AWK=awk ECHO_N="-n" bash gen-note-integrity.sh %{libpath} > %{libpath}.hmac \
|
||||
objcopy --update-section .note.fdo.integrity=%{libpath}.hmac %{libpath} %{libpath}.new \
|
||||
mv -f %{libpath}.new %{libpath} \
|
||||
rm -f %{libpath}.hmac
|
||||
fipshmac $RPM_BUILD_ROOT/%{_lib}/*.so.?? \
|
||||
%{nil}
|
||||
|
||||
%install
|
||||
%make_install
|
||||
rm -fr $RPM_BUILD_ROOT
|
||||
make install DESTDIR=$RPM_BUILD_ROOT
|
||||
|
||||
# Change /usr/lib64 back to /usr/lib. This saves us from having to patch the
|
||||
# script to "know" that -L/usr/lib64 should be suppressed, and also removes
|
||||
|
|
@ -120,376 +110,81 @@ sed -i -e 's,^my_host=".*"$,my_host="none",g' $RPM_BUILD_ROOT/%{_bindir}/libgcry
|
|||
rm -f ${RPM_BUILD_ROOT}/%{_infodir}/dir ${RPM_BUILD_ROOT}/%{_libdir}/*.la
|
||||
/sbin/ldconfig -n $RPM_BUILD_ROOT/%{_libdir}
|
||||
|
||||
%if "%{gcrylibdir}" != "%{_libdir}"
|
||||
# Relocate the shared libraries to %{gcrylibdir}.
|
||||
mkdir -p $RPM_BUILD_ROOT%{gcrylibdir}
|
||||
for shlib in $RPM_BUILD_ROOT%{_libdir}/*.so* ; do
|
||||
# Relocate the shared libraries to /%{_lib}.
|
||||
mkdir -p $RPM_BUILD_ROOT/%{_lib}
|
||||
for shlib in $RPM_BUILD_ROOT/%{_libdir}/*.so* ; do
|
||||
if test -L "$shlib" ; then
|
||||
rm "$shlib"
|
||||
else
|
||||
mv "$shlib" $RPM_BUILD_ROOT%{gcrylibdir}/
|
||||
mv "$shlib" $RPM_BUILD_ROOT/%{_lib}/
|
||||
fi
|
||||
done
|
||||
|
||||
# Add soname symlink.
|
||||
/sbin/ldconfig -n $RPM_BUILD_ROOT/%{_lib}/
|
||||
%endif
|
||||
# Figure out where /%{_lib} is relative to %{_libdir}.
|
||||
touch $RPM_BUILD_ROOT/root_marker
|
||||
relroot=..
|
||||
while ! test -f $RPM_BUILD_ROOT/%{_libdir}/$relroot/root_marker ; do
|
||||
relroot=$relroot/..
|
||||
done
|
||||
|
||||
# Overwrite development symlinks.
|
||||
pushd $RPM_BUILD_ROOT/%{gcrylibdir}
|
||||
for shlib in lib*.so.?? ; do
|
||||
target=$RPM_BUILD_ROOT/%{_libdir}/`echo "$shlib" | sed -e 's,\.so.*,,g'`.so
|
||||
%if "%{gcrylibdir}" != "%{_libdir}"
|
||||
shlib=%{gcrylibdir}/$shlib
|
||||
%endif
|
||||
pushd $RPM_BUILD_ROOT/%{_libdir}
|
||||
for shlib in $relroot/%{_lib}/lib*.so.* ; do
|
||||
shlib=`echo "$shlib" | sed -e 's,//,/,g'`
|
||||
target=`basename "$shlib" | sed -e 's,\.so.*,,g'`.so
|
||||
ln -sf $shlib $target
|
||||
done
|
||||
popd
|
||||
|
||||
# Add soname symlink.
|
||||
/sbin/ldconfig -n $RPM_BUILD_ROOT/%{_lib}/
|
||||
rm -f $RPM_BUILD_ROOT/root_marker
|
||||
|
||||
# Create /etc/gcrypt (hardwired, not dependent on the configure invocation) so
|
||||
# that _someone_ owns it.
|
||||
mkdir -p -m 755 $RPM_BUILD_ROOT/etc/gcrypt
|
||||
|
||||
%ldconfig_scriptlets
|
||||
%clean
|
||||
rm -fr $RPM_BUILD_ROOT
|
||||
|
||||
%post -p /sbin/ldconfig
|
||||
|
||||
%postun -p /sbin/ldconfig
|
||||
|
||||
%post devel
|
||||
[ -f %{_infodir}/gcrypt.info.gz ] && \
|
||||
/sbin/install-info %{_infodir}/gcrypt.info.gz %{_infodir}/dir
|
||||
exit 0
|
||||
|
||||
%preun devel
|
||||
if [ $1 = 0 -a -f %{_infodir}/gcrypt.info.gz ]; then
|
||||
/sbin/install-info --delete %{_infodir}/gcrypt.info.gz %{_infodir}/dir
|
||||
fi
|
||||
exit 0
|
||||
|
||||
%files
|
||||
%defattr(-,root,root,-)
|
||||
%dir /etc/gcrypt
|
||||
%{gcrylibdir}/libgcrypt.so.*.*
|
||||
%{gcrylibdir}/%{gcrysoname}
|
||||
%license COPYING.LIB
|
||||
%doc AUTHORS NEWS THANKS
|
||||
/%{_lib}/libgcrypt.so.*
|
||||
/%{_lib}/.libgcrypt.so.*.hmac
|
||||
%doc COPYING.LIB AUTHORS NEWS THANKS
|
||||
|
||||
%files devel
|
||||
%defattr(-,root,root,-)
|
||||
%{_bindir}/%{name}-config
|
||||
%{_bindir}/dumpsexp
|
||||
%{_bindir}/hmac256
|
||||
%{_bindir}/mpicalc
|
||||
%{_includedir}/*
|
||||
%{_libdir}/*.so
|
||||
%{_libdir}/pkgconfig/libgcrypt.pc
|
||||
%{_datadir}/aclocal/*
|
||||
%{_mandir}/man1/*
|
||||
|
||||
%{_infodir}/gcrypt.info*
|
||||
%license COPYING
|
||||
%doc COPYING
|
||||
|
||||
%changelog
|
||||
* Mon Nov 03 2025 Jakub Jelen <jjelen@redhat.com> - 1.11.2-1
|
||||
- New upstream release (#2406804)
|
||||
|
||||
* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.11.1-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
|
||||
|
||||
* Tue May 13 2025 Jakub Jelen <jjelen@redhat.com> - 1.11.1-1
|
||||
- New upstream release (#2364878)
|
||||
|
||||
* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.11.0-5
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
|
||||
|
||||
* Tue Oct 29 2024 Jakub Jelen <jjelen@redhat.com> - 1.11.0-4
|
||||
- Run annocheck as part of the build
|
||||
- Use upstream CF protection patches
|
||||
- Fix PAC/BTI protection for Aarch64
|
||||
- Fix CVE-2024-2236 (#2274128)
|
||||
|
||||
* Thu Jul 25 2024 Jakub Jelen <jjelen@redhat.com> - 1.11.0-3
|
||||
- Disable -O flag munging and remove needles modification of LTO flags.
|
||||
|
||||
* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.11.0-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
|
||||
|
||||
* Wed Jun 19 2024 Jakub Jelen <jjelen@redhat.com> - 1.11.0-1
|
||||
- New upstream release (#2293064)
|
||||
|
||||
* Tue Mar 26 2024 Jakub Jelen <jjelen@redhat.com> - 1.10.3-4
|
||||
- Replace deprecated fgrep (#2271503)
|
||||
|
||||
* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.3-3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
|
||||
|
||||
* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.3-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
|
||||
|
||||
* Tue Nov 14 2023 Jakub Jelen <jjelen@redhat.com> - 1.10.3-1
|
||||
- New upstream release (#2249639)
|
||||
|
||||
* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.2-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
|
||||
|
||||
* Tue Apr 11 2023 Jakub Jelen <jjelen@redhat.com> - 1.10.2-1
|
||||
- New upstream release (#2185084)
|
||||
|
||||
* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.1-7
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
|
||||
|
||||
* Sat Dec 3 2022 Florian Weimer <fweimer@redhat.com> - 1.10.1-6
|
||||
- Port configure script to C99
|
||||
|
||||
* Tue Nov 08 2022 Todd Zullinger <tmz@pobox.com> - 1.10.1-5
|
||||
- enable brainpool by default (#1413618)
|
||||
- fix sporadic failures generating RSA keys in FIPS mode
|
||||
|
||||
* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.1-4
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
|
||||
|
||||
* Sun May 29 2022 Todd Zullinger <tmz@pobox.com> - 1.10.1-3
|
||||
- improve --disable-brainpool configure output
|
||||
- use %%bcond_with to disable brainpool curves
|
||||
|
||||
* Fri Apr 08 2022 Jakub Jelen <jjelen@redhat.com> - 1.10.1-2
|
||||
- Adjust integrity check creation to match upstream (#2073018)
|
||||
|
||||
* Tue Mar 29 2022 Jakub Jelen <jjelen@redhat.com> - 1.10.1-1
|
||||
- Final release (#2069263)
|
||||
|
||||
* Wed Feb 02 2022 Jakub Jelen <jjelen@redhat.com> - 1.10.0-1
|
||||
- New upstream release (#2049322)
|
||||
|
||||
* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.9.4-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
|
||||
|
||||
* Mon Aug 23 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.4-1
|
||||
- New upstream release (#1996467)
|
||||
|
||||
* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.9.3-4
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
|
||||
|
||||
* Tue Jun 15 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.3-3
|
||||
- Fix for CVE-2021-33560 (#1970098)
|
||||
|
||||
* Wed Apr 28 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.3-2
|
||||
- Restore the CET protection (#1954049)
|
||||
|
||||
* Tue Apr 20 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.3-1
|
||||
- New upstream release (#1951325)
|
||||
|
||||
* Thu Apr 15 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.2-3
|
||||
- Fix issues reported by coverity
|
||||
|
||||
* Mon Mar 29 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.2-2
|
||||
- Fix OCB tag creation on s390x (failing gnupg2 tests)
|
||||
|
||||
* Wed Feb 17 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.2-1
|
||||
- New upstream release (#1929630)
|
||||
|
||||
* Fri Jan 29 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.1-1
|
||||
- New upstream release (#1922156, #1922097)
|
||||
|
||||
* Wed Jan 20 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.0-1
|
||||
- New upstream release (#1917878)
|
||||
|
||||
* Tue Nov 24 2020 Jakub Jelen <jjelen@redhat.com> - 1.8.7-1
|
||||
- new upstream release (#1891123)
|
||||
|
||||
* Fri Aug 21 2020 Jeff Law <law@redhat.com> - 1.8.6-4
|
||||
- Re-enable LTO
|
||||
|
||||
* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.6-3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
|
||||
|
||||
* Tue Jul 21 2020 Tom Stellard <tstellar@redhat.com> - 1.8.6-2
|
||||
- Use make macros
|
||||
- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
|
||||
|
||||
* Mon Jul 20 2020 Tomáš Mráz <tmraz@redhat.com> 1.8.6-1
|
||||
- new upstream version 1.8.6
|
||||
|
||||
* Wed Jul 1 2020 Tomáš Mráz <tmraz@redhat.com> 1.8.5-7
|
||||
- use the hmac256 tool to calculate the library hmac
|
||||
|
||||
* Tue Jun 30 2020 Jeff Law <law@redhat.com>
|
||||
- Disable LTO
|
||||
|
||||
* Thu Apr 23 2020 Tomáš Mráz <tmraz@redhat.com> 1.8.5-6
|
||||
- Fix regression - missing -ldl linkage
|
||||
|
||||
* Wed Apr 22 2020 Tomáš Mráz <tmraz@redhat.com> 1.8.5-5
|
||||
- AES performance improvements backported from master branch
|
||||
|
||||
* Mon Apr 20 2020 Tomáš Mráz <tmraz@redhat.com> 1.8.5-4
|
||||
- FIPS selftest is run directly from the constructor
|
||||
- FIPS module is implicit with kernel FIPS flag
|
||||
|
||||
* Thu Jan 30 2020 Tomáš Mráz <tmraz@redhat.com> 1.8.5-3
|
||||
- fix the build on ARMv7
|
||||
|
||||
* Thu Jan 23 2020 Tomáš Mráz <tmraz@redhat.com> 1.8.5-2
|
||||
- Intel CET support by H. J. Lu
|
||||
|
||||
* Tue Sep 3 2019 Tomáš Mráz <tmraz@redhat.com> 1.8.5-1
|
||||
- new upstream version 1.8.5
|
||||
- add CMAC selftest for FIPS POST
|
||||
- add continuous FIPS entropy test
|
||||
- disable non-approved FIPS hashes in the enforced FIPS mode
|
||||
|
||||
* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.4-4
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
|
||||
|
||||
* Tue Feb 12 2019 Tomáš Mráz <tmraz@redhat.com> 1.8.4-3
|
||||
- fix the build tests to pass in the FIPS mode
|
||||
|
||||
* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.4-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
|
||||
|
||||
* Tue Nov 20 2018 Tomáš Mráz <tmraz@redhat.com> 1.8.4-1
|
||||
- new upstream version 1.8.4
|
||||
|
||||
* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.3-3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
|
||||
|
||||
* Thu Jul 12 2018 Tomáš Mráz <tmraz@redhat.com> 1.8.3-2
|
||||
- make only_urandom a default in non-presence of configuration file
|
||||
- run the full FIPS selftests only when the library is called from
|
||||
application
|
||||
|
||||
* Thu Jun 14 2018 Tomáš Mráz <tmraz@redhat.com> 1.8.3-1
|
||||
- new upstream version 1.8.3
|
||||
|
||||
* Tue Feb 6 2018 Tomáš Mráz <tmraz@redhat.com> 1.8.2-2
|
||||
- fix behavior when getrandom syscall is not present (#1542453)
|
||||
|
||||
* Thu Dec 21 2017 Tomáš Mráz <tmraz@redhat.com> 1.8.2-1
|
||||
- new upstream version 1.8.2
|
||||
|
||||
* Tue Dec 5 2017 Tomáš Mráz <tmraz@redhat.com> 1.8.1-3
|
||||
- do not try to access() /dev/urandom either if getrandom() works
|
||||
|
||||
* Mon Dec 4 2017 Tomáš Mráz <tmraz@redhat.com> 1.8.1-2
|
||||
- do not try to open /dev/urandom if getrandom() works (#1380866)
|
||||
|
||||
* Tue Sep 5 2017 Tomáš Mráz <tmraz@redhat.com> 1.8.1-1
|
||||
- new upstream version 1.8.1
|
||||
|
||||
* Wed Aug 16 2017 Tomáš Mráz <tmraz@redhat.com> 1.8.0-1
|
||||
- new upstream version 1.8.0
|
||||
|
||||
* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.7.8-3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
|
||||
|
||||
* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.7.8-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
|
||||
|
||||
* Thu Jun 29 2017 Tomáš Mráz <tmraz@redhat.com> 1.7.8-1
|
||||
- new upstream version 1.7.8
|
||||
|
||||
* Fri Jun 2 2017 Tomáš Mráz <tmraz@redhat.com> 1.7.7-1
|
||||
- new upstream version 1.7.7
|
||||
- GOST is now enabled
|
||||
|
||||
* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.7.6-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
|
||||
|
||||
* Mon Jan 30 2017 Tomáš Mráz <tmraz@redhat.com> 1.7.6-1
|
||||
- new upstream version 1.7.6
|
||||
|
||||
* Fri Dec 16 2016 Tomáš Mráz <tmraz@redhat.com> 1.7.5-1
|
||||
- new upstream version 1.7.5
|
||||
|
||||
* Wed Nov 23 2016 Tomáš Mráz <tmraz@redhat.com> 1.7.3-1
|
||||
- new upstream version 1.7.3
|
||||
|
||||
* Wed Aug 17 2016 Tomáš Mráz <tmraz@redhat.com> 1.6.6-1
|
||||
- new upstream version with important security fix (CVE-2016-6316)
|
||||
|
||||
* Thu Jul 21 2016 Tomáš Mráz <tmraz@redhat.com> 1.6.5-1
|
||||
- new upstream version fixing low impact issue CVE-2015-7511
|
||||
|
||||
* Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 1.6.4-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
|
||||
|
||||
* Wed Sep 9 2015 Tomáš Mráz <tmraz@redhat.com> 1.6.4-1
|
||||
- new upstream version
|
||||
|
||||
* Wed Jun 17 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.6.3-5
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
|
||||
|
||||
* Fri Apr 3 2015 Tomáš Mráz <tmraz@redhat.com> 1.6.3-4
|
||||
- deinitialize the RNG after the selftest is run
|
||||
|
||||
* Tue Mar 24 2015 Tomáš Mráz <tmraz@redhat.com> 1.6.3-3
|
||||
- touch only urandom in the selftest and when /dev/random is
|
||||
unavailable for example by SELinux confinement
|
||||
- fix the RSA selftest key (p q swap) (#1204517)
|
||||
|
||||
* Fri Mar 13 2015 Tomáš Mráz <tmraz@redhat.com> 1.6.3-2
|
||||
- do not use strict aliasing for bufhelp functions (#1201219)
|
||||
|
||||
* Fri Mar 6 2015 Tomáš Mráz <tmraz@redhat.com> 1.6.3-1
|
||||
- new upstream version
|
||||
|
||||
* Wed Feb 25 2015 Tomáš Mráz <tmraz@redhat.com> 1.6.2-4
|
||||
- do not initialize secure memory during the selftest (#1195850)
|
||||
|
||||
* Sat Feb 21 2015 Till Maas <opensource@till.name> - 1.6.2-3
|
||||
- Rebuilt for Fedora 23 Change
|
||||
https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code
|
||||
|
||||
* Wed Jan 14 2015 Tomáš Mráz <tmraz@redhat.com> 1.6.2-2
|
||||
- fix buildability of programs using gcrypt.h with -ansi (#1182200)
|
||||
|
||||
* Mon Dec 8 2014 Tomáš Mráz <tmraz@redhat.com> 1.6.2-1
|
||||
- new upstream version
|
||||
|
||||
* Sun Aug 17 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.6.1-7
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
|
||||
|
||||
* Thu Jul 17 2014 Tom Callaway <spot@fedoraproject.org> - 1.6.1-6
|
||||
- fix license handling
|
||||
|
||||
* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.6.1-5
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
|
||||
|
||||
* Tue May 20 2014 Kyle McMartin <kyle@fedoraproject.org> 1.6.1-4
|
||||
- Re-enable below algos, apply patch from upstream list to make
|
||||
that code -fPIC friendly. (rhbz#1069792)
|
||||
|
||||
* Mon May 19 2014 Kyle McMartin <kyle@fedoraproject.org> 1.6.1-3
|
||||
- Disable rijndael, cast5, camellia ARM assembly, as it's non-PIC as
|
||||
presently written, which results in .text relocations in the shared
|
||||
library. (rhbz#1069792)
|
||||
|
||||
* Thu Apr 24 2014 Tomáš Mráz <tmraz@redhat.com> 1.6.1-2
|
||||
- drop the temporary compat shared library version
|
||||
- fix the soname version in -use-fipscheck.patch
|
||||
|
||||
* Fri Feb 28 2014 Tomáš Mráz <tmraz@redhat.com> 1.6.1-1
|
||||
- new upstream version breaking ABI compatibility
|
||||
- this release temporarily includes old compatibility .so
|
||||
|
||||
* Tue Jan 21 2014 Tomáš Mráz <tmraz@redhat.com> 1.5.3-3
|
||||
- add back the nistp521r1 EC curve
|
||||
- fix a bug in the Whirlpool hash implementation
|
||||
- speed up the PBKDF2 computation
|
||||
|
||||
* Sun Oct 20 2013 Tom Callaway <spot@fedoraproject.org> - 1.5.3-2
|
||||
- add cleared ECC support
|
||||
|
||||
* Fri Jul 26 2013 Tomáš Mráz <tmraz@redhat.com> 1.5.3-1
|
||||
- new upstream version fixing cache side-channel attack on RSA private keys
|
||||
|
||||
* Thu Jun 20 2013 Tomáš Mráz <tmraz@redhat.com> 1.5.2-3
|
||||
- silence false error detected by valgrind (#968288)
|
||||
|
||||
* Thu Apr 25 2013 Tomáš Mráz <tmraz@redhat.com> 1.5.2-2
|
||||
- silence strict aliasing warning in Rijndael
|
||||
- apply UsrMove
|
||||
- spec file cleanups
|
||||
|
||||
* Fri Apr 19 2013 Tomáš Mráz <tmraz@redhat.com> 1.5.2-1
|
||||
- new upstream version
|
||||
|
||||
* Wed Mar 20 2013 Tomas Mraz <tmraz@redhat.com> 1.5.1-1
|
||||
- new upstream version
|
||||
|
||||
* Tue Mar 5 2013 Tomas Mraz <tmraz@redhat.com> 1.5.0-11
|
||||
- use poll() instead of select() when gathering randomness (#913773)
|
||||
|
||||
* Thu Feb 14 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.5.0-10
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
|
||||
|
||||
* Thu Jan 3 2013 Tomas Mraz <tmraz@redhat.com> 1.5.0-9
|
||||
- allow empty passphrase in PBKDF2 needed for cryptsetup (=891266)
|
||||
|
||||
* Mon Dec 3 2012 Tomas Mraz <tmraz@redhat.com> 1.5.0-8
|
||||
- fix multilib conflict in libgcrypt-config
|
||||
- fix minor memory leaks and other bugs found by Coverity scan
|
||||
|
|
@ -526,7 +221,7 @@ mkdir -p -m 755 $RPM_BUILD_ROOT/etc/gcrypt
|
|||
* Mon Feb 07 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.4.5-7
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
|
||||
|
||||
* Fri Feb 4 2011 Tomas Mraz <tmraz@redhat.com> 1.4.5-6
|
||||
* Thu Feb 4 2011 Tomas Mraz <tmraz@redhat.com> 1.4.5-6
|
||||
- fix a bug in the fips-186-3 dsa parameter generation code
|
||||
|
||||
* Tue Feb 1 2011 Tomas Mraz <tmraz@redhat.com> 1.4.5-5
|
||||
|
|
@ -703,5 +398,5 @@ mkdir -p -m 755 $RPM_BUILD_ROOT/etc/gcrypt
|
|||
* Thu Jan 10 2002 Nalin Dahyabhai <nalin@redhat.com> 1.1.5-1
|
||||
- fix the Source tag so that it's a real URL
|
||||
|
||||
* Thu Dec 20 2001 Nalin Dahyabhai <nalin@redhat.com>
|
||||
* Wed Dec 20 2001 Nalin Dahyabhai <nalin@redhat.com>
|
||||
- initial package
|
||||
|
|
|
|||
|
|
@ -1,86 +0,0 @@
|
|||
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||
|
||||
mQGNBFjLuq4BDACnM7zNSIaVMAacTwjXa5TGYe13i6ilHe4VL0NShzrgzjcQg531
|
||||
3cRgiiiNA7OSOypMqVs73Jez6ZUctn2GVsHBrS/io9NcuC9pVwf8a61WlcEa+EtB
|
||||
a3G7HlBmEWnwaUdAtWKNuAi9Xn+Ir7H2xEdksmmd5a0/QnL+sX705boVPF/tpYtb
|
||||
LGpPxa78tNrtxDkSwy8Wmi0IADYLI5yI7/yUGeJd8RSCU/fLRKC9fG7YOZRq0tsO
|
||||
MhVNWmtUjbG6e73Lu8LKnCZgs1/fC8hvPyARieSV5mdN8s1oWd7oYctfgL4uBleD
|
||||
ItAA8GhjKejutzHN8Ei/APw6AiiSyEjnPg+cTX8OgvLGJWjks0H6mPZeB1v/kGyZ
|
||||
hBS9vm540h2/MmlVN2ntiCK5TZGeSWpqddiqusfVXotMRpN4HeLKoZh4RAncaCbZ
|
||||
F/S+YLeN+kMXY4k3Fqt1fjTX6veFCbthI9pDdHzU9LfUVNp9D/5ktC/tYMORMegV
|
||||
+wSMxi9G2YWKJkMAEQEAAYkBzgQfAQgAOBYhBFuAxXVCmPDLVdjtarzvfilLCS4o
|
||||
BQJYy8DdFwyAAZSlyaA8L+XKOwldjh/fcjz0YraxAgcAAAoJELzvfilLCS4oNgoL
|
||||
/0+K1xIx8JW7Lk5M6bYCvNA4fdlEcwQIT4UidJFM9m+suxYFWIGfebvHpRlEuJTg
|
||||
dBjkEit8uLAoJXU0BRkKTLrzTF+qDUE79Wfx/R+0nOgJ7aMykQOi0AvuwzMYz4dg
|
||||
xIVS2Daou4DF7bh/KF8+fqrmq8P8W1ZrkuFDanMWpHeAPx1uj2skYbo7uPqFdvlJ
|
||||
hlNHrcxlcCkjf1InAt0Xt5lMvEsCRUPf9xAH4mNEhs0lh9c+200YPRmtnLWAzc1K
|
||||
ckLIC8Q+mUR3DjZDqBlDBEPegXkrI0+MlvRA+9AnAm4YPqTMUfpZ6ZOAWeFjC/6Z
|
||||
QYxG/AdWGkb4WFindzklQfybEuiekP8vU07ACQwSwH8PYe0UCom1YrlRUjX7QLkn
|
||||
ZLWoeZg8BZy9GTM1Ut7Q1Q2uTw6mxxISuef+RFgYOHjWwLpFWZpqC88xERl7o/iz
|
||||
iERJRt/593IctbjO9wenWt2peIAwzR4nz7LqM6ZFTdRAETmcdSvYRhg2Qt8hUE47
|
||||
CbQkQW5kcmUgSGVpbmVja2UgKFJlbGVhc2UgU2lnbmluZyBLZXkpiQHUBBMBCAA+
|
||||
FiEEW4DFdUKY8MtV2O1qvO9+KUsJLigFAljLuq4CGwMFCRLMAwAFCwkIBwIGFQgJ
|
||||
CgsCBBYCAwECHgECF4AACgkQvO9+KUsJLihC/QwAhCC+SEvcFLcutgZ8HfcCtoZs
|
||||
IoVzZEy7DjqIvGgnTssD8HCLnIAHCDvnP7dJW3uMuLCdSqym3cjlEIiQMsaGywkl
|
||||
fzJISAwJrGQdWSKRd535jXpEXQlXDKal/IwMKAUt0PZtlCc9S3gwixQryxdJ28lJ
|
||||
6h2T9fVDr8ZswMmTAFG91uctfhjKOMgPt8UhSPGW484WsIsQgkbOvf+Kfswl0eHu
|
||||
ywX+pKAB5ZQ/9GVC6Ug4xfrdiJL0azJTPnvjMY5JYp6/L9RURs5hP5AnHR2j/PPo
|
||||
sAtsFCjmbRbOMiASzklnUJPbSz5kfLloDWZmrUScjbzmsXehGyt433JGyRhZJl4x
|
||||
/jPbzKhaaAHsGd+fRao6vlLOwFywDDVMp6JuyK7UeUb7I8ekTbSkGFA+l2Oa3O6/
|
||||
Y7PYhq7hwwAFuZckYI98IpHNCG1fS9W07FyKdvQbK1PbF1JFRKfsUCWYMKqDnbqE
|
||||
o5jivPEHZImw6iYhhXcyEYl8fjcb9T6/S+wOP7aviQGzBBABCAAdFiEElKXJoDwv
|
||||
5co7CV2OH99yPPRitrEFAljLv5sACgkQH99yPPRitrFw4gv/XFMFN+/LHsn9hJOP
|
||||
4rCwl1yUuxXuYmZgc0sRoY3EpeQkJVyKurQuqqKoy2VuoMiF0O1kAQmGoFtVPUk7
|
||||
b8hCoutqB5GyeyKcoLP+WINgVhB2gXg7TSp3MPLBKkgqvSDvPitgRxBqFb4LW8LJ
|
||||
bDbfwGrzIvXfDV3WvsrHVPbc2fhlWdL8d+3AE6mFiXF3eTpgmV3ApSBQV12MkkCk
|
||||
icLIPmp+ZxZON+OP52ZXkRtfMgOy4Oa/41agrViDAZdMOGeGkhPertQheQZgXzmo
|
||||
GF5Wz498HPM80Kv35X91l3iGzL+icEtO+tWea2YscsZ6qpRe2lfVPHk3B+anlmCj
|
||||
m4kM4cBd39xa4HHSVh/bRHbZNtgVr7slQCKxlHgQOGVI5vCxPCwEsgJ2KBk03Nk/
|
||||
IA9EKO+czfh3/bHW6uMbEqrYDCnt+hmzZrpKDSGcwS/KOhvMUIMlb7/8vDKum6mp
|
||||
/8xAtVZ6IAxYZNt3qg7Y7aLRtzCTyqm8rJQrZPtRaQcgLoEimDMEX0PliRYJKwYB
|
||||
BAHaRw8BAQdAz75Hlekc16JhhfI0MKdEVxLdkxhcMCO0ZG6WMBAmNpe0H1dlcm5l
|
||||
ciBLb2NoIChkaXN0IHNpZ25pbmcgMjAyMCmImgQTFgoAQhYhBG2qbmSnbShAVxtJ
|
||||
AlKIl7gmQDraBQJfQ+w1AhsDBQkShccRBQsJCAcCAyICAQYVCgkICwIEFgIDAQIe
|
||||
BwIXgAAKCRBSiJe4JkA62nmuAP9uL/HOdB0gvwWrH+FpURJLs4bnaZaPIk9ARrU0
|
||||
EXRgJgD/YCGfHQXpIPT0ZaXuwJexK04Z+qMFR/bM1q1Leo5CjgaIbQQQEQsAHRYh
|
||||
BIBhWHD1utaQMzaG0PKthaweQrNnBQJfQ/HmAAoJEPKthaweQrNnIZkA3jG6LcZv
|
||||
V/URn8Y8OJqsyYa4C3NI4nN+OhEvYhgA4PHzMnALeXIpA2gblvjFIPJPAhDBAU37
|
||||
c5PA6+6IdQQQFggAHRYhBK6oTtzwGthsRwHIXGMROuhmWH0KBQJfQ/IlAAoJEGMR
|
||||
OuhmWH0K1+MA/0uJ5AHcnSfIBEWHNJwwVVLGyrxAWtS2U+zeymp/UvlPAQDErCLZ
|
||||
l0dBiPG3vlowFx5TNep7tanBs6ZJn8F1ao1tAIkBMwQQAQgAHRYhBNhpISPEBl3q
|
||||
Xg86tSSbOdJPJeO2BQJfQ/OuAAoJECSbOdJPJeO2DVoH/0o9if66ph6FJrgr+A/W
|
||||
HNVeHxmM5tUQhpL1wpRS70SKcsJgolf5CxO5iTQf3HlZe544xGbIU/aCTJsWw9zi
|
||||
UE8KmhAtKV4eL/7oQ7xx4nxPnABLpudtM8A44nsM1x/XiYrJnnDm29QjYEGd2Hi8
|
||||
7npc7VWKzLoj+I/WcXquynJi5O9TUxW9Bknd1pjpxFkf8v+msjBzCD5VKJgr0CR8
|
||||
wA6peQBWeGZX2HacosMIZH4TfL0r0TFla6LJIkNBz9DyIm1yL4L8oRH0950hQljP
|
||||
C7TM3L7aRpX+4Kph6llFz6g7MALGFP95kyJ6o+XED9ORuuQVZMBMIkNC0tXOu10V
|
||||
bdqIdQQQFgoAHRYhBMHTS2khnkruwLocIeP9/yGORbcrBQJfQ/P8AAoJEOP9/yGO
|
||||
Rbcr3lQBAMas8Vl3Hdl3g2I283lz1uHiGvlwcnk2TLeB+U4zIwC9AQCy0nnazVNt
|
||||
VQPID1ZCMoaOX7AzOjaqQDLf4j+dVTxgBJgzBGCkgocWCSsGAQQB2kcPAQEHQJmd
|
||||
fwp8jEN5P3eEjhQiWk6zQi8utvgOvYD57XmE+H8+tCBOaWliZSBZdXRha2EgKEdu
|
||||
dVBHIFJlbGVhc2UgS2V5KYiaBBMWCgBCFiEErI4RW/c+LY1H+pkI6Y6bLRnGyL0F
|
||||
AmCkgocCGwMFCQsNBpkFCwkIBwIDIgIBBhUKCQgLAgQWAgMBAh4HAheAAAoJEOmO
|
||||
my0Zxsi9/4IA/1rvSr3MU+Sv4jhNDzD+CeC3gmHkPew6pi9VHEsEwdgmAQD2BtiX
|
||||
7w1sJL/CBylGWv5jxj4345mP9YfZm0RsgzPjDIh1BBAWCAAdFiEEJJyzdxdQdF1c
|
||||
3TI84mewUjZPAo0FAmFAQ54ACgkQ4mewUjZPAo1CiAD+KTT1UVdQTGHMyvHwZocS
|
||||
QjU8xhcZrTet+dvvjrE5+4MA/RBdJPZgFevUKu68NEy0Lo+RbkeCtmQJ/c8v5ieF
|
||||
vW0AiQEzBBABCAAdFiEEEkEkvTtIYq96CkLxALRevUynur4FAmFAQ7cACgkQALRe
|
||||
vUynur4kaAgAolPR8TNWVS0vXMKrr0k0l2M/8QkZTaLZx1GT9Nx1yb4WJKY7ElPM
|
||||
YkhGDxetvFBETx0pH/6R3jtj6Crmur+NKHVSRY+rCYpFPDn6ciIOryssRx2G4kCZ
|
||||
t+nFB9JyDbBOZAR8DK4pN1mAxG/yLDt4oKcUQsP2xlEFum+phxyR8KyYCpkwKRxY
|
||||
eK+6lfilQuveoUwp/Xx5wXPNUy6q4eOOovCW7gS7I7288NGHCa2ul8sD6vA9C4mM
|
||||
4Zxaole9P9wwJe1zZFtCIy88zHM9vqv+YM9DxMCaW24+rUztr7eD4bCRdG+QlSh+
|
||||
7R/TaqSxY1eAAd1J5tma9CNJO73pTKU+/JhTBGFpSqMTCSskAwMCCAEBBwIDBF6X
|
||||
D9NmUQDgiyYNbhs1DMJ14mIw812wY1HVx/4QWYWiBunhrvSFxVbzsjD7/Wv+v3bm
|
||||
MPrL+M2DLyFiSewNmcS0JEdudVBHLmNvbSAoUmVsZWFzZSBTaWduaW5nIEtleSAy
|
||||
MDIxKYiaBBMTCABCFiEEAvON/3Mf+XywOaHaVJ5pXpBboggFAmFpSqMCGwMFCQ9x
|
||||
14oFCwkIBwIDIgIBBhUKCQgLAgQWAgMBAh4HAheAAAoJEFSeaV6QW6IITkoA/RYa
|
||||
jaTl1eEBU/Gdm12o3jrI55N5xZK2XTqSx25clVyjAP0XwMW/Og5+ND1ri3bAqADV
|
||||
WlBDUswz8wYxsb0C4kYBkoh1BBAWCgAdFiEEbapuZKdtKEBXG0kCUoiXuCZAOtoF
|
||||
AmFpTvEACgkQUoiXuCZAOtrJQAEAh7YyykjAy/Qs1yC3ji8iBfIVnPXvblrIx3SR
|
||||
RyDwRC8BAKtZbEuKTtPlgkLUgMleTcZJ/vEhJE+GvfQ9o5gWCqEFiHUEEBYKAB0W
|
||||
IQTB00tpIZ5K7sC6HCHj/f8hjkW3KwUCYWlPWgAKCRDj/f8hjkW3Kx4eAQDp6aGS
|
||||
N/fU4xLl8RSvQUVjVA+aCTrMQR3hRwqw8liF2wEA3O3ECxz6e1+DoItYoJBBLKLw
|
||||
eiInsGZ/+h5XYrpXTgA=
|
||||
=4+Sn
|
||||
-----END PGP PUBLIC KEY BLOCK-----
|
||||
3
sources
3
sources
|
|
@ -1,2 +1 @@
|
|||
SHA512 (libgcrypt-1.11.2.tar.bz2) = b706cea602cc8f0896e57ce979643bf78974b05faec27c1b053b773c57d8b04250e30e95a4ef5899e1df981d01d8d08f0a36e10b5820a5ec4183e74c02e5f1f0
|
||||
SHA512 (libgcrypt-1.11.2.tar.bz2.sig) = e63d240a9b97aa218c98c5baa72a30321ae85412d4a8748e36578bd9498fe8c8ee2ba84835d1783cdfc1e5dfb66b0a89409d6263e9c06f4cd11e919d4bce0cd2
|
||||
99e0f2dc94dac6eceab709d03d613328 libgcrypt-1.5.3-hobbled.tar.xz
|
||||
|
|
|
|||
|
|
@ -1,75 +0,0 @@
|
|||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Makefile of /CoreOS/libgcrypt/smoke-test
|
||||
# Description: Test calls upstream test suite.
|
||||
# Author: Ondrej Moris <omoris@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2010 Red Hat, Inc. All rights reserved.
|
||||
#
|
||||
# This copyrighted material is made available to anyone wishing
|
||||
# to use, modify, copy, or redistribute it subject to the terms
|
||||
# and conditions of the GNU General Public License version 2.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public
|
||||
# License along with this program; if not, write to the Free
|
||||
# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
|
||||
# Boston, MA 02110-1301, USA.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
export TEST=/CoreOS/libgcrypt/smoke-test
|
||||
export TESTVERSION=1.0
|
||||
|
||||
BUILT_FILES=
|
||||
|
||||
FILES=$(METADATA) runtest.sh Makefile PURPOSE
|
||||
|
||||
.PHONY: all install download clean
|
||||
|
||||
run: $(FILES) build
|
||||
./runtest.sh
|
||||
|
||||
build: $(BUILT_FILES)
|
||||
chmod a+x runtest.sh
|
||||
|
||||
clean:
|
||||
rm -f *~ $(BUILT_FILES)
|
||||
|
||||
|
||||
include /usr/share/rhts/lib/rhts-make.include
|
||||
|
||||
$(METADATA): Makefile
|
||||
@echo "Owner: Ondrej Moris <omoris@redhat.com>" > $(METADATA)
|
||||
@echo "Name: $(TEST)" >> $(METADATA)
|
||||
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
||||
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
||||
@echo "Description: Test calls upstream test suite." >> $(METADATA)
|
||||
@echo "Type: Sanity" >> $(METADATA)
|
||||
@echo "TestTime: 15m" >> $(METADATA)
|
||||
@echo "RunFor: libgcrypt" >> $(METADATA)
|
||||
@echo "Requires: libgcrypt" >> $(METADATA)
|
||||
@echo "Requires: nfs-utils" >> $(METADATA)
|
||||
@echo "Requires: rpm-build" >> $(METADATA)
|
||||
@echo "Requires: autoconf automake libtool" >> $(METADATA)
|
||||
@echo "Requires: gawk" >> $(METADATA)
|
||||
@echo "Requires: gcc-c++" >> $(METADATA)
|
||||
@echo "Requires: libgpg-error-devel" >> $(METADATA)
|
||||
@echo "Requires: pkgconfig texinfo fipscheck libkcapi-fipscheck" >> $(METADATA)
|
||||
@echo "Requires: crypto-policies-scripts" >> $(METADATA)
|
||||
@echo "Requires: bc" >> $(METADATA)
|
||||
@echo "RhtsRequires: library(distribution/fips)" >> $(METADATA)
|
||||
@echo "Releases: -RHEL3 -RHEL4" >> $(METADATA)
|
||||
@echo "Priority: Normal" >> $(METADATA)
|
||||
@echo "Architectures: i386 x86_64 s390x ia64" >> $(METADATA)
|
||||
@echo "License: GPLv2" >> $(METADATA)
|
||||
@echo "Confidential: no" >> $(METADATA)
|
||||
@echo "Destructive: no" >> $(METADATA)
|
||||
|
||||
rhts-lint $(METADATA)
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
PURPOSE of /CoreOS/libgcrypt/Sanity/smoke-test
|
||||
Description: Test calls upstream test suite.
|
||||
Author: Ondrej Moris <omoris@redhat.com>
|
||||
|
|
@ -1,25 +0,0 @@
|
|||
summary: Test calls upstream test suite.
|
||||
test: ./runtest.sh
|
||||
enabled: true
|
||||
framework: beakerlib
|
||||
require:
|
||||
- library(distribution/fips)
|
||||
recommend:
|
||||
- libgcrypt
|
||||
- nfs-utils
|
||||
- rpm-build
|
||||
- autoconf
|
||||
- automake
|
||||
- libtool
|
||||
- gawk
|
||||
- gcc-c++
|
||||
- libgpg-error-devel
|
||||
- pkgconfig
|
||||
- texinfo
|
||||
- fipscheck
|
||||
- libkcapi-fipscheck
|
||||
- crypto-policies-scripts
|
||||
- bc
|
||||
- annobin-annocheck
|
||||
- gnupg2
|
||||
duration: 45m
|
||||
|
|
@ -1,145 +0,0 @@
|
|||
#!/bin/bash
|
||||
# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# runtest.sh of /CoreOS/libgcrypt/smoke-test
|
||||
# Description: Test calls upstream test suite.
|
||||
# Author: Ondrej Moris <omoris@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2010 Red Hat, Inc. All rights reserved.
|
||||
#
|
||||
# This copyrighted material is made available to anyone wishing
|
||||
# to use, modify, copy, or redistribute it subject to the terms
|
||||
# and conditions of the GNU General Public License version 2.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public
|
||||
# License along with this program; if not, write to the Free
|
||||
# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
|
||||
# Boston, MA 02110-1301, USA.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
. /usr/share/beakerlib/beakerlib.sh
|
||||
|
||||
PACKAGE="libgcrypt"
|
||||
|
||||
rlJournalStart
|
||||
|
||||
rlPhaseStartSetup
|
||||
rlImport distribution/fips || rlFail "FIPS library needed for some phases"
|
||||
TmpDir=`mktemp -d`
|
||||
rlAssertRpm $PACKAGE
|
||||
rlRun "rlFileBackup --clean /etc/gcrypt/fips_enabled"
|
||||
if [[ -r /etc/gcrypt/hwf.deny ]]; then
|
||||
rlRun "rlFileBackup /etc/gcrypt/hwf.deny"
|
||||
rlRun "rm -f /etc/gcrypt/hwf.deny"
|
||||
fi
|
||||
rlRun "pushd $TmpDir" 0
|
||||
rlRun "rlFetchSrcForInstalled $PACKAGE"
|
||||
rlRun "rpm -ihv `ls *.rpm`" 0
|
||||
if grep '1' /proc/sys/crypto/fips_enabled; then
|
||||
rlRun "echo '1' > /etc/gcrypt/fips_enabled" 0
|
||||
fi
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest "Package build"
|
||||
TOPDIR=`rpm --eval %_topdir`
|
||||
rlRun "pushd $TOPDIR" 0
|
||||
rlRun "rm -rf BUILD/libgcrypt-*" 0-255
|
||||
rlRun "rpmbuild -vv -bc SPECS/libgcrypt.spec" 0
|
||||
libgcrypt_dir="libgcrypt-`rpm -q --qf "%{VERSION}\n" libgcrypt | head -1`"
|
||||
if [ -d "BUILD/$libgcrypt_dir-build" ]; then
|
||||
BUILDDIR="BUILD/$libgcrypt_dir-build/$libgcrypt_dir"
|
||||
else
|
||||
BUILDDIR="BUILD/$libgcrypt_dir"
|
||||
fi
|
||||
rlRun "pushd $BUILDDIR" 0
|
||||
rlRun "fipshmac src/.libs/libgcrypt.so.??" 0
|
||||
rlRun "popd"
|
||||
rlRun "popd"
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest "Upstream testsuite"
|
||||
rlRun "pushd $TOPDIR/$BUILDDIR" 0
|
||||
exp_fails=()
|
||||
|
||||
rlRun "echo 'Expecting ${#exp_fails[@]} fails'"
|
||||
exp_exitcode=0
|
||||
if [[ ${#exp_fails[@]} -gt 0 ]]; then exp_exitcode=2; fi
|
||||
rlRun "make check &> $TmpDir/make_check.out" $exp_exitcode
|
||||
rlRun "grep ^FAIL: $TmpDir/make_check.out" 0,1 "Print fails"
|
||||
if [[ ${#exp_fails[@]} -gt 0 ]]; then
|
||||
for f in $(grep '^FAIL:' $TmpDir/make_check.out | awk -F ': ' '{print $2}'); do
|
||||
if [[ "${exp_fails[@]}" =~ "$f" ]]; then
|
||||
rlLog "$f failure is expected"
|
||||
else
|
||||
rlFail "$f failure is not expected"
|
||||
fi
|
||||
done
|
||||
else
|
||||
rlRun "grep \"All [0-9]\+ tests passed\" $TmpDir/make_check.out" 0 \
|
||||
"All tests passed"
|
||||
fi
|
||||
rlRun "cat $TmpDir/make_check.out"
|
||||
rlRun "popd"
|
||||
rlPhaseEnd
|
||||
|
||||
if ! (rlIsRHEL '<=8.4' || ([[ $fipsMode = "enabled" ]] && rlIsFedora '<37')); then
|
||||
# (we are ~expecting to fix HW optimization problem around Fedora-37)
|
||||
rlPhaseStartTest "Performance with HW optimizations disabled - bz1990059"
|
||||
# we are gathering more samples, so that this test is robust in shared environments
|
||||
N_SAMPLES=5
|
||||
N_MEDIAN=$(echo "$N_SAMPLES/2+1" |bc)
|
||||
HWF_DENY_FILE="/etc/gcrypt/hwf.deny"
|
||||
# Disabling via cmdline arguments would need either handpicking
|
||||
# all the algorithms (variant with ":"), or making "all" work.
|
||||
# "--disable-hwf all" does not work: https://dev.gnupg.org/T5636
|
||||
#dis_arg="--disable-hwf all"
|
||||
dis_arg=""
|
||||
|
||||
for x in "cipher:aes256:CBC enc" "hash:sha256:SHA256" "mac:hmac_sha256:HMAC_SHA256"; do
|
||||
alg_type=$(echo $x |cut -d: -f1)
|
||||
algorithm=$(echo $x |cut -d: -f2)
|
||||
alg_line=$(echo $x |cut -d: -f3)
|
||||
rlRun "rm -f $algorithm.ena $algorithm.dis"
|
||||
rlLogInfo "Performance measurements started ..."
|
||||
for i in `seq 1 $N_SAMPLES`; do
|
||||
# run with HW optimizations ENAbled
|
||||
rm -f $HWF_DENY_FILE
|
||||
$TOPDIR/$BUILDDIR/tests/bench-slope $alg_type $algorithm |grep "$alg_line" >>$algorithm.ena
|
||||
|
||||
# run with HW optimizations DISabled
|
||||
# this looks idiotic, but I wasn't able to make --disable-hwf work
|
||||
echo "all" >$HWF_DENY_FILE
|
||||
$TOPDIR/$BUILDDIR/tests/bench-slope $dis_arg $alg_type $algorithm |grep "$alg_line" >>$algorithm.dis
|
||||
done
|
||||
rlLogInfo "Performance measurements finished"
|
||||
rlRun "cat $algorithm.ena"
|
||||
rlRun "cat $algorithm.dis"
|
||||
dis=$(cat $algorithm.dis |cut -d'|' -f2 |awk '{ print $1 }' |sort -n |sed -n "$N_MEDIAN p")
|
||||
ena=$(cat $algorithm.ena |cut -d'|' -f2 |awk '{ print $1 }' |sort -n |sed -n "$N_MEDIAN p")
|
||||
rlRun "echo '$algorithm Time: disabled $dis enabled $ena'"
|
||||
if (( $(echo "$dis > $ena" |bc -l) )); then
|
||||
rlPass "HW optimizations work for $algorithm"
|
||||
else
|
||||
rlFail "HW optimizations DO NOT work for $algorithm"
|
||||
fi
|
||||
done
|
||||
rlPhaseEnd
|
||||
fi
|
||||
|
||||
rlPhaseStartCleanup
|
||||
rlRun "popd"
|
||||
rlRun "rm -r $TmpDir" 0
|
||||
rlRun "rlFileRestore"
|
||||
rlPhaseEnd
|
||||
|
||||
rlJournalPrintText
|
||||
rlJournalEnd
|
||||
2007
wk@g10code.com
Normal file
2007
wk@g10code.com
Normal file
File diff suppressed because it is too large
Load diff
Loading…
Add table
Add a link
Reference in a new issue