add cleared ECC support

2013-10-21 17:49:14 +01:00
25 changed files with 5851 additions and 2897 deletions
--- a/.fmf/version
+++ b/.fmf/version
@ -1 +0,0 @@
-1
--- a/.gitignore
+++ b/.gitignore
@ -4,41 +4,3 @@ libgcrypt-1.4.5-hobbled.tar.bz2
 /libgcrypt-1.5.1-hobbled.tar.xz
 /libgcrypt-1.5.2-hobbled.tar.xz
 /libgcrypt-1.5.3-hobbled.tar.xz
-/libgcrypt-1.6.1-hobbled.tar.xz
-/libgcrypt-1.6.2-hobbled.tar.xz
-/libgcrypt-1.6.3-hobbled.tar.xz
-/libgcrypt-1.6.4-hobbled.tar.xz
-/libgcrypt-1.6.5-hobbled.tar.xz
-/libgcrypt-1.6.6-hobbled.tar.xz
-/libgcrypt-1.7.3-hobbled.tar.xz
-/libgcrypt-1.7.5-hobbled.tar.xz
-/libgcrypt-1.7.6-hobbled.tar.xz
-/libgcrypt-1.7.7-hobbled.tar.xz
-/libgcrypt-1.7.8-hobbled.tar.xz
-/libgcrypt-1.8.0-hobbled.tar.xz
-/libgcrypt-1.8.1-hobbled.tar.xz
-/libgcrypt-1.8.2-hobbled.tar.xz
-/libgcrypt-1.8.3-hobbled.tar.xz
-/libgcrypt-1.8.4-hobbled.tar.xz
-/libgcrypt-1.8.5-hobbled.tar.xz
-/libgcrypt-1.8.6-hobbled.tar.xz
-/libgcrypt-1.8.7-hobbled.tar.xz
-/libgcrypt-1.9.0-hobbled.tar.xz
-/libgcrypt-1.9.1-hobbled.tar.xz
-/libgcrypt-1.9.2-hobbled.tar.xz
-/libgcrypt-1.9.3-hobbled.tar.xz
-/libgcrypt-1.9.4-hobbled.tar.xz
-/libgcrypt-1.10.0.tar.bz2
-/libgcrypt-1.10.0.tar.bz2.sig
-/libgcrypt-1.10.1.tar.bz2
-/libgcrypt-1.10.1.tar.bz2.sig
-/libgcrypt-1.10.2.tar.bz2
-/libgcrypt-1.10.2.tar.bz2.sig
-/libgcrypt-1.10.3.tar.bz2
-/libgcrypt-1.10.3.tar.bz2.sig
-/libgcrypt-1.11.0.tar.bz2
-/libgcrypt-1.11.0.tar.bz2.sig
-/libgcrypt-1.11.1.tar.bz2
-/libgcrypt-1.11.1.tar.bz2.sig
-/libgcrypt-1.11.2.tar.bz2
-/libgcrypt-1.11.2.tar.bz2.sig
--- a/curves.c
+++ b/curves.c
@ -0,0 +1,166 @@
+/* curves.c -  ECC curves regression tests
+ *	Copyright (C) 2011 Free Software Foundation, Inc.
+ *
+ * This file is part of Libgcrypt.
+ *
+ * Libgcrypt is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * Libgcrypt is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdarg.h>
+
+#include "../src/gcrypt.h"
+
+/* Number of curves defined in ../cipger/ecc.c */
+#define N_CURVES 2
+
+/* A real world sample public key.  */
+static char const sample_key_1[] =
+"(public-key\n"
+" (ecdsa\n"
+"  (p #00FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF#)\n"
+"  (a #00FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC#)\n"
+"  (b #5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B#)\n"
+"  (g #046B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C296"
+        "4FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5#)\n"
+"  (n #00FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551#)\n"
+"  (q #0442B927242237639A36CE9221B340DB1A9AB76DF2FE3E171277F6A4023DED146EE"
+      "86525E38CCECFF3FB8D152CC6334F70D23A525175C1BCBDDE6E023B2228770E#)\n"
+"  ))";
+static char const sample_key_1_curve[] = "NIST P-256";
+static unsigned int sample_key_1_nbits = 256;
+
+/* Program option flags.  */
+static int verbose;
+static int error_count;
+
+static void
+fail (const char *format, ...)
+{
+  va_list arg_ptr;
+
+  va_start (arg_ptr, format);
+  vfprintf (stderr, format, arg_ptr);
+  va_end (arg_ptr);
+  error_count++;
+}
+
+static void
+die (const char *format, ...)
+{
+  va_list arg_ptr;
+
+  va_start (arg_ptr, format);
+  vfprintf (stderr, format, arg_ptr);
+  va_end (arg_ptr);
+  exit (1);
+}
+
+
+static void
+list_curves (void)
+{
+  int idx;
+  const char *name;
+  unsigned int nbits;
+
+  for (idx=0; (name = gcry_pk_get_curve (NULL, idx, &nbits)); idx++)
+    {
+      if (verbose)
+        printf ("%s - %u bits\n", name, nbits);
+    }
+  if (idx != N_CURVES)
+    fail ("expected %d curves but got %d\n", N_CURVES, idx);
+  if (gcry_pk_get_curve (NULL, -1, NULL))
+    fail ("curve iteration failed\n");
+}
+
+
+static void
+check_matching (void)
+{
+  gpg_error_t err;
+  gcry_sexp_t key;
+  const char *name;
+  unsigned int nbits;
+
+  err = gcry_sexp_new (&key, sample_key_1, 0, 1);
+  if (err)
+    die ("parsing s-expression string failed: %s\n", gpg_strerror (err));
+  name = gcry_pk_get_curve (key, 0, &nbits);
+  if (!name)
+    fail ("curve name not found for sample_key_1\n");
+  else if (strcmp (name, sample_key_1_curve))
+    fail ("expected curve name %s but got %s for sample_key_1\n",
+          sample_key_1_curve, name);
+  else if (nbits != sample_key_1_nbits)
+    fail ("expected curve size %u but got %u for sample_key_1\n",
+          sample_key_1_nbits, nbits);
+
+  gcry_sexp_release (key);
+
+}
+
+
+static void
+check_get_params (void)
+{
+  gcry_sexp_t param;
+  const char *name;
+
+  param = gcry_pk_get_param (GCRY_PK_ECDSA, sample_key_1_curve);
+  if (!param)
+    fail ("error gerring parameters for `%s'\n", sample_key_1_curve);
+
+  name = gcry_pk_get_curve (param, 0, NULL);
+  if (!name)
+    fail ("get_param: curve name not found for sample_key_1\n");
+  else if (strcmp (name, sample_key_1_curve))
+    fail ("get_param: expected curve name %s but got %s for sample_key_1\n",
+          sample_key_1_curve, name);
+
+  gcry_sexp_release (param);
+
+}
+
+
+int
+main (int argc, char **argv)
+{
+  int debug = 0;
+
+  if (argc > 1 && !strcmp (argv[1], "--verbose"))
+    verbose = 1;
+  else if (argc > 1 && !strcmp (argv[1], "--debug"))
+    verbose = debug = 1;
+
+  if (!gcry_check_version (GCRYPT_VERSION))
+    die ("version mismatch\n");
+
+  gcry_control (GCRYCTL_DISABLE_SECMEM, 0);
+  gcry_control (GCRYCTL_INITIALIZATION_FINISHED, 0);
+  if (debug)
+    gcry_control (GCRYCTL_SET_DEBUG_FLAGS, 1u, 0);
+  list_curves ();
+  check_matching ();
+  check_get_params ();
+
+  return error_count ? 1 : 0;
+}
--- a/ecc.c
+++ b/ecc.c
--- a/9
+++ b/9
@ -0,0 +1,9 @@
+#!/bin/sh
+
+# Quit out if anything fails.
+set -e -x
+
+# Clean out patent-or-otherwise-encumbered code.
+# EC:    ????????? ??/??/2015
+
+rm -f cipher/ecc.c
--- a/libgcrypt-1.10.1-annobin.patch
+++ b/libgcrypt-1.10.1-annobin.patch
@ -1,22 +0,0 @@
-diff -rup libgcrypt.orig/src/Makefile.am libgcrypt-1.8.3/src/Makefile.am
--- libgcrypt.orig/src/Makefile.am	2021-10-18 16:36:20.914025497 +0100
-+++ libgcrypt-1.8.3/src/Makefile.am	2021-10-19 12:23:08.652960618 +0100
-@@ -108,6 +108,7 @@ endif !HAVE_W32_SYSTEM
- 
- 
- libgcrypt_la_LDFLAGS = $(no_undefined) $(export_symbols) $(extra_ltoptions) \
-+	-Wc,-fplugin=annobin \
- 	$(libgcrypt_version_script_cmd) -version-info \
- 	@LIBGCRYPT_LT_CURRENT@:@LIBGCRYPT_LT_REVISION@:@LIBGCRYPT_LT_AGE@
- libgcrypt_la_DEPENDENCIES = \
-Only in libgcrypt-1.8.3/src: Makefile.am.annobin
-diff -rup libgcrypt.orig/src/Makefile.in libgcrypt-1.8.3/src/Makefile.in
--- libgcrypt.orig/src/Makefile.in	2021-10-18 16:36:20.914025497 +0100
-+++ libgcrypt-1.8.3/src/Makefile.in	2021-10-19 12:23:37.791875325 +0100
-@@ -483,6 +483,7 @@ gcrypt_hwf_modules = @GCRYPT_HWF_MODULES
- @HAVE_W32_SYSTEM_TRUE@gcrypt_deps = $(gcrypt_res) libgcrypt.def
- @HAVE_W32_SYSTEM_FALSE@gcrypt_res_ldflag = 
- libgcrypt_la_LDFLAGS = $(no_undefined) $(export_symbols) $(extra_ltoptions) \
-+	-Wc,-fplugin=annobin \
- 	$(libgcrypt_version_script_cmd) -version-info \
- 	@LIBGCRYPT_LT_CURRENT@:@LIBGCRYPT_LT_REVISION@:@LIBGCRYPT_LT_AGE@
--- a/libgcrypt-1.11.0-marvin.patch
+++ b/libgcrypt-1.11.0-marvin.patch
--- a/libgcrypt-1.5.0-fips-cavs.patch
+++ b/libgcrypt-1.5.0-fips-cavs.patch
--- a/libgcrypt-1.5.0-fips-cfgrandom.patch
+++ b/libgcrypt-1.5.0-fips-cfgrandom.patch
@ -0,0 +1,126 @@
+diff -up libgcrypt-1.5.0/random/random-fips.c.cfgrandom libgcrypt-1.5.0/random/random-fips.c
+--- libgcrypt-1.5.0/random/random-fips.c.cfgrandom	2011-07-21 14:50:34.000000000 +0200
+++ libgcrypt-1.5.0/random/random-fips.c	2011-07-21 14:50:34.000000000 +0200
+@@ -27,10 +27,10 @@
+    There are 3 random context which map to the different levels of
+    random quality:
+ 
+-   Generator                Seed and Key        Kernel entropy (init/reseed)
+-   ------------------------------------------------------------
+-   GCRY_VERY_STRONG_RANDOM  /dev/random         256/128 bits
+-   GCRY_STRONG_RANDOM       /dev/random         256/128 bits
+   Generator                Seed and Key                      Kernel entropy (init/reseed)
+   ---------------------------------------------------------------------------------------
+   GCRY_VERY_STRONG_RANDOM  /etc/gcrypt/rngseed+/dev/urandom  256/128 bits
+   GCRY_STRONG_RANDOM       /etc/gcrypt/rngseed+/dev/urandom  256/128 bits
+    gcry_create_nonce        GCRY_STRONG_RANDOM  n/a
+ 
+    All random generators return their data in 128 bit blocks.  If the
+@@ -40,8 +40,10 @@
+    (SEED_TTL) output blocks; the re-seeding is disabled in test mode.
+ 
+    The GCRY_VERY_STRONG_RANDOM and GCRY_STRONG_RANDOM generators are
+-   keyed and seeded from the /dev/random device.  Thus these
+-   generators may block until the kernel has collected enough entropy.
+   keyed and seeded with data that is loaded from the /etc/gcrypt/rngseed
+   if the device or symlink to device exists xored with the data
+   from the /dev/urandom device. This allows the system administrator
+   to always seed the RNGs from /dev/random if it is required.
+ 
+    The gcry_create_nonce generator is keyed and seeded from the
+    GCRY_STRONG_RANDOM generator.  It may also block if the
+@@ -560,9 +562,13 @@ get_entropy (size_t nbytes)
+   entropy_collect_buffer_len = 0;
+ 
+ #if USE_RNDLINUX
+  _gcry_rndlinux_gather_random (entropy_collect_cb, 0,
+                                     X931_AES_KEYLEN,
+                                     -1);
+  entropy_collect_buffer_len = 0;
+   rc = _gcry_rndlinux_gather_random (entropy_collect_cb, 0,
+                                      X931_AES_KEYLEN,
+-                                     GCRY_VERY_STRONG_RANDOM);
+                                     GCRY_STRONG_RANDOM);
+ #elif USE_RNDW32
+   do
+     {
+diff -up libgcrypt-1.5.0/random/rndlinux.c.cfgrandom libgcrypt-1.5.0/random/rndlinux.c
+--- libgcrypt-1.5.0/random/rndlinux.c.cfgrandom	2011-02-04 20:16:03.000000000 +0100
+++ libgcrypt-1.5.0/random/rndlinux.c	2011-07-21 14:50:34.000000000 +0200
+@@ -36,7 +36,9 @@
+ #include "g10lib.h"
+ #include "rand-internal.h"
+ 
+-static int open_device ( const char *name );
+#define NAME_OF_CFG_RNGSEED "/etc/gcrypt/rngseed"
+
+static int open_device ( const char *name, int fatal );
+ 
+ 
+ static int
+@@ -57,13 +59,17 @@ set_cloexec_flag (int fd)
+  * Used to open the /dev/random devices (Linux, xBSD, Solaris (if it exists)).
+  */
+ static int
+-open_device ( const char *name )
+open_device ( const char *name, int fatal )
+ {
+   int fd;
+ 
+   fd = open ( name, O_RDONLY );
+   if ( fd == -1 )
+-    log_fatal ("can't open %s: %s\n", name, strerror(errno) );
+    {
+      if (! fatal)
+        return fd;
+      log_fatal ("can't open %s: %s\n", name, strerror(errno) );
+    }
+ 
+   if (set_cloexec_flag (fd))
+     log_error ("error setting FD_CLOEXEC on fd %d: %s\n",
+@@ -92,6 +98,7 @@ _gcry_rndlinux_gather_random (void (*add
+ {
+   static int fd_urandom = -1;
+   static int fd_random = -1;
+  static int fd_configured = -1;
+   int fd;
+   int n;
+   byte buffer[768];
+@@ -100,6 +107,7 @@ _gcry_rndlinux_gather_random (void (*add
+   size_t last_so_far = 0;
+   int any_need_entropy = 0;
+   int delay;
+  size_t orig_length = length;
+ 
+   /* First read from a hardware source.  However let it account only
+      for up to 50% of the requested bytes.  */
+@@ -110,16 +118,26 @@ _gcry_rndlinux_gather_random (void (*add
+     length -= n_hw;
+ 
+   /* Open the requested device.  */
+
+  if (level == -1)
+    {
+      if (fd_configured == -1)
+        fd_configured = open_device ( NAME_OF_CFG_RNGSEED, 0 );
+      fd = fd_configured;
+      if (fd == -1)
+        return -1;
+    }
+
+   if (level >= 2)
+     {
+       if( fd_random == -1 )
+-        fd_random = open_device ( NAME_OF_DEV_RANDOM );
+        fd_random = open_device ( NAME_OF_DEV_RANDOM, 1 );
+       fd = fd_random;
+     }
+-  else
+  else if (level != -1)
+     {
+       if( fd_urandom == -1 )
+-        fd_urandom = open_device ( NAME_OF_DEV_URANDOM );
+        fd_urandom = open_device ( NAME_OF_DEV_URANDOM, 1 );
+       fd = fd_urandom;
+     }
+ 
--- a/libgcrypt-1.5.0-leak.patch
+++ b/libgcrypt-1.5.0-leak.patch
@ -0,0 +1,73 @@
+diff -up libgcrypt-1.5.0/cipher/elgamal.c.leak libgcrypt-1.5.0/cipher/elgamal.c
+--- libgcrypt-1.5.0/cipher/elgamal.c.leak	2011-02-04 20:09:38.000000000 +0100
+++ libgcrypt-1.5.0/cipher/elgamal.c	2012-12-03 14:51:10.743067964 +0100
+@@ -641,7 +641,10 @@ elg_generate_ext (int algo, unsigned int
+     }
+ 
+   if (xvalue)
+-    ec = generate_using_x (&sk, nbits, xvalue, retfactors);
+    {
+      ec = generate_using_x (&sk, nbits, xvalue, retfactors);
+      gcry_mpi_release(xvalue);
+    }
+   else
+     {
+       generate (&sk, nbits, retfactors);
+diff -up libgcrypt-1.5.0/cipher/primegen.c.leak libgcrypt-1.5.0/cipher/primegen.c
+--- libgcrypt-1.5.0/cipher/primegen.c.leak	2012-04-05 15:37:52.000000000 +0200
+++ libgcrypt-1.5.0/cipher/primegen.c	2012-12-03 14:44:14.610010867 +0100
+@@ -1198,10 +1198,7 @@ gcry_prime_group_generator (gcry_mpi_t *
+                             gcry_mpi_t prime, gcry_mpi_t *factors,
+                             gcry_mpi_t start_g)
+ {
+-  gcry_mpi_t tmp = gcry_mpi_new (0);
+-  gcry_mpi_t b = gcry_mpi_new (0);
+-  gcry_mpi_t pmin1 = gcry_mpi_new (0);
+-  gcry_mpi_t g = start_g? gcry_mpi_copy (start_g) : gcry_mpi_set_ui (NULL, 3);
+  gcry_mpi_t tmp, b, pmin1, g;
+   int first = 1;
+   int i, n;
+ 
+@@ -1214,6 +1211,11 @@ gcry_prime_group_generator (gcry_mpi_t *
+   if (n < 2)
+     return gpg_error (GPG_ERR_INV_ARG);
+ 
+  tmp = gcry_mpi_new (0);
+  b = gcry_mpi_new (0);
+  pmin1 = gcry_mpi_new (0);
+  g = start_g? gcry_mpi_copy (start_g) : gcry_mpi_set_ui (NULL, 3);
+
+   /* Extra sanity check - usually disabled. */
+ /*   mpi_set (tmp, factors[0]); */
+ /*   for(i = 1; i < n; i++) */
+diff -up libgcrypt-1.5.0/cipher/pubkey.c.leak libgcrypt-1.5.0/cipher/pubkey.c
+--- libgcrypt-1.5.0/cipher/pubkey.c.leak	2011-06-13 12:23:50.000000000 +0200
+++ libgcrypt-1.5.0/cipher/pubkey.c	2012-12-03 15:23:42.377183489 +0100
+@@ -2853,6 +2853,8 @@ gcry_pk_encrypt (gcry_sexp_t *r_ciph, gc
+ 
+   REGISTER_DEFAULT_PUBKEYS;
+ 
+  init_encoding_ctx (&ctx, PUBKEY_OP_ENCRYPT, gcry_pk_get_nbits (s_pkey));
+
+   /* Get the key. */
+   rc = sexp_to_key (s_pkey, 0, NULL, &pkey, &module);
+   if (rc)
+@@ -2873,7 +2875,6 @@ gcry_pk_encrypt (gcry_sexp_t *r_ciph, gc
+   algo_elems = pubkey->elements_enc;
+ 
+   /* Get the stuff we want to encrypt. */
+-  init_encoding_ctx (&ctx, PUBKEY_OP_ENCRYPT, gcry_pk_get_nbits (s_pkey));
+   rc = sexp_data_to_mpi (s_data, &data, &ctx);
+   if (rc)
+     goto leave;
+diff -up libgcrypt-1.5.0/src/hmac256.c.leak libgcrypt-1.5.0/src/hmac256.c
+--- libgcrypt-1.5.0/src/hmac256.c.leak	2011-02-04 20:17:33.000000000 +0100
+++ libgcrypt-1.5.0/src/hmac256.c	2012-12-03 15:37:36.504955809 +0100
+@@ -435,7 +435,6 @@ _gcry_hmac256_finalize (hmac256_context_
+       tmphd = _gcry_hmac256_new (NULL, 0);
+       if (!tmphd)
+         {
+-          free (hd);
+           return NULL;
+         }
+       _gcry_hmac256_update (tmphd, hd->opad, 64);
--- a/libgcrypt-1.5.0-noecc.patch
+++ b/libgcrypt-1.5.0-noecc.patch
@ -0,0 +1,12 @@
+diff -up libgcrypt-1.5.0/tests/Makefile.noecc libgcrypt-1.5.0/tests/Makefile
+--- libgcrypt-1.5.0/tests/Makefile.in.noecc	2011-07-21 15:34:33.000000000 +0200
+++ libgcrypt-1.5.0/tests/Makefile.in	2011-07-21 15:39:35.000000000 +0200
+@@ -57,7 +57,7 @@ TESTS = version$(EXEEXT) t-mpi-bit$(EXEE
+ 	ac-data$(EXEEXT) basic$(EXEEXT) mpitests$(EXEEXT) \
+ 	tsexp$(EXEEXT) keygen$(EXEEXT) pubkey$(EXEEXT) hmac$(EXEEXT) \
+ 	keygrip$(EXEEXT) fips186-dsa$(EXEEXT) aeswrap$(EXEEXT) \
+-	curves$(EXEEXT) t-kdf$(EXEEXT) pkcs1v2$(EXEEXT) \
+	t-kdf$(EXEEXT) pkcs1v2$(EXEEXT) \
+ 	$(am__EXEEXT_1) benchmark$(EXEEXT)
+ 
+ # random.c uses fork() thus a test for W32 does not make any sense.
--- a/libgcrypt-1.5.0-tests.patch
+++ b/libgcrypt-1.5.0-tests.patch
@ -0,0 +1,214 @@
+diff -up libgcrypt-1.5.0/cipher/dsa.c.tests libgcrypt-1.5.0/cipher/dsa.c
+--- libgcrypt-1.5.0/cipher/dsa.c.tests	2011-06-13 12:24:46.000000000 +0200
+++ libgcrypt-1.5.0/cipher/dsa.c	2011-07-20 16:44:51.000000000 +0200
+@@ -479,22 +479,21 @@ generate_fips186 (DSA_secret_key *sk, un
+             initial_seed.seed = gcry_sexp_nth_data (initial_seed.sexp, 1,
+                                                     &initial_seed.seedlen);
+         }
+-
+-      /* Fixme: Enable 186-3 after it has been approved and after fixing
+-         the generation function.  */
+-      /*   if (use_fips186_2) */
+-      (void)use_fips186_2;
+-      ec = _gcry_generate_fips186_2_prime (nbits, qbits,
+-                                           initial_seed.seed,
+      
+      if (use_fips186_2)
+        ec = _gcry_generate_fips186_2_prime (nbits, qbits, 
+                                           initial_seed.seed, 
+                                            initial_seed.seedlen,
+                                            &prime_q, &prime_p,
+                                            r_counter,
+                                            r_seed, r_seedlen);
+-      /*   else */
+-      /*     ec = _gcry_generate_fips186_3_prime (nbits, qbits, NULL, 0, */
+-      /*                                          &prime_q, &prime_p, */
+-      /*                                          r_counter, */
+-      /*                                          r_seed, r_seedlen, NULL); */
+      else
+        ec = _gcry_generate_fips186_3_prime (nbits, qbits,
+                                          initial_seed.seed,
+                                          initial_seed.seedlen,
+                                          &prime_q, &prime_p,
+                                          r_counter,
+                                          r_seed, r_seedlen, NULL);
+       gcry_sexp_release (initial_seed.sexp);
+       if (ec)
+         goto leave;
+diff -up libgcrypt-1.5.0/cipher/primegen.c.tests libgcrypt-1.5.0/cipher/primegen.c
+--- libgcrypt-1.5.0/cipher/primegen.c.tests	2011-03-28 14:19:52.000000000 +0200
+++ libgcrypt-1.5.0/cipher/primegen.c	2011-07-21 14:36:03.000000000 +0200
+@@ -1647,7 +1647,7 @@ _gcry_generate_fips186_3_prime (unsigned
+   gpg_err_code_t ec;
+   unsigned char seed_help_buffer[256/8];  /* Used to hold a generated SEED. */
+   unsigned char *seed_plus;     /* Malloced buffer to hold SEED+x.  */
+-  unsigned char digest[256/8];  /* Helper buffer for SHA-1 digest.  */
+  unsigned char digest[256/8];  /* Helper buffer for SHA-x digest.  */
+   gcry_mpi_t val_2 = NULL;      /* Helper for the prime test.  */
+   gcry_mpi_t tmpval = NULL;     /* Helper variable.  */
+   int hashalgo;                 /* The id of the Approved Hash Function.  */
+@@ -1737,7 +1737,7 @@ _gcry_generate_fips186_3_prime (unsigned
+         }
+       gcry_mpi_release (prime_q); prime_q = NULL;
+       ec = gpg_err_code (gcry_mpi_scan (&prime_q, GCRYMPI_FMT_USG,
+-                                        value_u, sizeof value_u, NULL));
+                                        value_u, qbits/8, NULL));
+       if (ec)
+         goto leave;
+       mpi_set_highbit (prime_q, qbits-1 );
+@@ -1782,11 +1782,11 @@ _gcry_generate_fips186_3_prime (unsigned
+               if (seed_plus[i])
+                 break;
+             }
+-          gcry_md_hash_buffer (GCRY_MD_SHA1, digest, seed_plus, seedlen);
+          gcry_md_hash_buffer (hashalgo, digest, seed_plus, seedlen);
+ 
+           gcry_mpi_release (tmpval); tmpval = NULL;
+           ec = gpg_err_code (gcry_mpi_scan (&tmpval, GCRYMPI_FMT_USG,
+-                                            digest, sizeof digest, NULL));
+                                            digest, qbits/8, NULL));
+           if (ec)
+             goto leave;
+           if (value_j == value_n)
+@@ -1822,11 +1822,11 @@ _gcry_generate_fips186_3_prime (unsigned
+     }
+ 
+   /* Step 12:  Save p, q, counter and seed.  */
+-  log_debug ("fips186-3 pbits p=%u q=%u counter=%d\n",
+/*  log_debug ("fips186-3 pbits p=%u q=%u counter=%d\n",
+              mpi_get_nbits (prime_p), mpi_get_nbits (prime_q), counter);
+   log_printhex("fips186-3 seed:", seed, seedlen);
+   log_mpidump ("fips186-3 prime p", prime_p);
+-  log_mpidump ("fips186-3 prime q", prime_q);
+  log_mpidump ("fips186-3 prime q", prime_q); */
+   if (r_q)
+     {
+       *r_q = prime_q;
+diff -up libgcrypt-1.5.0/cipher/rsa.c.tests libgcrypt-1.5.0/cipher/rsa.c
+--- libgcrypt-1.5.0/cipher/rsa.c.tests	2011-06-10 10:53:41.000000000 +0200
+++ libgcrypt-1.5.0/cipher/rsa.c	2011-07-21 14:36:59.000000000 +0200
+@@ -388,7 +388,7 @@ generate_x931 (RSA_secret_key *sk, unsig
+ 
+   *swapped = 0;
+ 
+-  if (e_value == 1)   /* Alias for a secure value. */
+  if (e_value == 1 || e_value == 0)   /* Alias for a secure value. */
+     e_value = 65537;
+ 
+   /* Point 1 of section 4.1:  k = 1024 + 256s with S >= 0  */
+diff -up libgcrypt-1.5.0/random/random-fips.c.tests libgcrypt-1.5.0/random/random-fips.c
+--- libgcrypt-1.5.0/random/random-fips.c.tests	2011-07-20 16:40:59.000000000 +0200
+++ libgcrypt-1.5.0/random/random-fips.c	2011-07-20 16:40:59.000000000 +0200
+@@ -691,6 +691,7 @@ get_random (void *buffer, size_t length,
+ 
+   check_guards (rng_ctx);
+ 
+ reinitialize:
+   /* Initialize the cipher handle and thus setup the key if needed.  */
+   if (!rng_ctx->cipher_hd)
+     {
+@@ -710,13 +711,11 @@ get_random (void *buffer, size_t length,
+   if (rng_ctx->key_init_pid != getpid ()
+       || rng_ctx->seed_init_pid != getpid ())
+     {
+-      /* We are in a child of us.  Because we have no way yet to do
+-         proper re-initialization (including self-checks etc), the
+-         only chance we have is to bail out.  Obviusly a fork/exec
+-         won't harm because the exec overwrites the old image. */
+-      fips_signal_error ("fork without proper re-initialization "
+-                         "detected in RNG");
+-      goto bailout;
+      /* Just reinitialize the key & seed. */
+      gcry_cipher_close(rng_ctx->cipher_hd);
+      rng_ctx->cipher_hd = NULL;
+      rng_ctx->is_seeded = 0;
+      goto reinitialize;
+     }
+ 
+   if (x931_aes_driver (buffer, length, rng_ctx))
+diff -up libgcrypt-1.5.0/tests/ac.c.tests libgcrypt-1.5.0/tests/ac.c
+--- libgcrypt-1.5.0/tests/ac.c.tests	2011-02-04 20:18:20.000000000 +0100
+++ libgcrypt-1.5.0/tests/ac.c	2011-07-20 16:40:59.000000000 +0200
+@@ -150,6 +150,9 @@ main (int argc, char **argv)
+   if (!gcry_check_version (GCRYPT_VERSION))
+     die ("version mismatch\n");
+   gcry_control (GCRYCTL_INITIALIZATION_FINISHED, 0);
+  if (gcry_fips_mode_active())
+    /* ac not functional in the fips mode, skip it */
+    return 77;
+   if (debug)
+     gcry_control (GCRYCTL_SET_DEBUG_FLAGS, 1u , 0);
+   /* No valuable keys are create, so we can speed up our RNG. */
+diff -up libgcrypt-1.5.0/tests/ac-data.c.tests libgcrypt-1.5.0/tests/ac-data.c
+--- libgcrypt-1.5.0/tests/ac-data.c.tests	2011-02-04 20:18:20.000000000 +0100
+++ libgcrypt-1.5.0/tests/ac-data.c	2011-07-20 16:40:59.000000000 +0200
+@@ -198,6 +198,9 @@ main (int argc, char **argv)
+   if (!gcry_check_version (GCRYPT_VERSION))
+     die ("version mismatch\n");
+   gcry_control (GCRYCTL_INITIALIZATION_FINISHED, 0);
+  if (gcry_fips_mode_active())
+    /* ac not functional in the fips mode, skip it */
+    return 77;
+   if (debug)
+     gcry_control (GCRYCTL_SET_DEBUG_FLAGS, 1u , 0);
+ 
+diff -up libgcrypt-1.5.0/tests/ac-schemes.c.tests libgcrypt-1.5.0/tests/ac-schemes.c
+--- libgcrypt-1.5.0/tests/ac-schemes.c.tests	2011-02-04 20:18:20.000000000 +0100
+++ libgcrypt-1.5.0/tests/ac-schemes.c	2011-07-20 16:40:59.000000000 +0200
+@@ -338,6 +338,9 @@ main (int argc, char **argv)
+   if (! gcry_check_version (GCRYPT_VERSION))
+     die ("version mismatch\n");
+   gcry_control (GCRYCTL_INITIALIZATION_FINISHED, 0);
+  if (gcry_fips_mode_active())
+    /* ac not functional in the fips mode, skip it */
+    return 77;
+   if (debug)
+     gcry_control (GCRYCTL_SET_DEBUG_FLAGS, 1u, 0);
+ 
+diff -up libgcrypt-1.5.0/tests/keygen.c.tests libgcrypt-1.5.0/tests/keygen.c
+--- libgcrypt-1.5.0/tests/keygen.c.tests	2011-02-04 20:18:20.000000000 +0100
+++ libgcrypt-1.5.0/tests/keygen.c	2011-07-21 14:39:03.000000000 +0200
+@@ -148,12 +148,12 @@ check_rsa_keys (void)
+     }
+ 
+   if (verbose)
+-    fprintf (stderr, "creating 1536 bit DSA key\n");
+    fprintf (stderr, "creating 2048 bit DSA key\n");
+   rc = gcry_sexp_new (&keyparm,
+                       "(genkey\n"
+                       " (dsa\n"
+-                      "  (nbits 4:1536)\n"
+-                      "  (qbits 3:224)\n"
+                      "  (nbits 4:2048)\n"
+                      "  (qbits 3:256)\n"
+                       " ))", 0, 1);
+   if (rc)
+     die ("error creating S-expression: %s\n", gpg_strerror (rc));
+@@ -190,11 +190,11 @@ check_rsa_keys (void)
+ 
+ 
+   if (verbose)
+-    fprintf (stderr, "creating 512 bit RSA key with e=257\n");
+    fprintf (stderr, "creating 1024 bit RSA key with e=257\n");
+   rc = gcry_sexp_new (&keyparm,
+                       "(genkey\n"
+                       " (rsa\n"
+-                      "  (nbits 3:512)\n"
+                      "  (nbits 4:1024)\n"
+                       "  (rsa-use-e 3:257)\n"
+                       " ))", 0, 1);
+   if (rc)
+@@ -208,11 +208,11 @@ check_rsa_keys (void)
+   gcry_sexp_release (key);
+ 
+   if (verbose)
+-    fprintf (stderr, "creating 512 bit RSA key with default e\n");
+    fprintf (stderr, "creating 1024 bit RSA key with default secure e\n");
+   rc = gcry_sexp_new (&keyparm,
+                       "(genkey\n"
+                       " (rsa\n"
+-                      "  (nbits 3:512)\n"
+                      "  (nbits 4:1024)\n"
+                       "  (rsa-use-e 1:0)\n"
+                       " ))", 0, 1);
+   if (rc)
--- a/libgcrypt-1.5.0-use-fipscheck.patch
+++ b/libgcrypt-1.5.0-use-fipscheck.patch
@ -0,0 +1,87 @@
+diff -up libgcrypt-1.5.0/src/fips.c.use-fipscheck libgcrypt-1.5.0/src/fips.c
+--- libgcrypt-1.5.0/src/fips.c.use-fipscheck	2011-02-04 20:17:33.000000000 +0100
+++ libgcrypt-1.5.0/src/fips.c	2011-07-20 16:17:21.000000000 +0200
+@@ -570,23 +570,48 @@ run_random_selftests (void)
+   return !!err;
+ }
+ 
+static int
+get_library_path(const char *libname, const char *symbolname, char *path, size_t pathlen)
+{
+    Dl_info info;
+    void *dl, *sym;
+    int rv = -1;
+
+        dl = dlopen(libname, RTLD_LAZY);
+        if (dl == NULL) {
+            return -1;
+        }       
+
+    sym = dlsym(dl, symbolname);
+
+    if (sym != NULL && dladdr(sym, &info)) {
+	strncpy(path, info.dli_fname, pathlen-1);
+	path[pathlen-1] = '\0';
+	rv = 0;
+    }
+
+    dlclose(dl);	
+    
+    return rv;
+}
+
+ /* Run an integrity check on the binary.  Returns 0 on success.  */
+ static int
+ check_binary_integrity (void)
+ {
+ #ifdef ENABLE_HMAC_BINARY_CHECK
+   gpg_error_t err;
+-  Dl_info info;
+  char libpath[4096];
+   unsigned char digest[32];
+   int dlen;
+   char *fname = NULL;
+-  const char key[] = "What am I, a doctor or a moonshuttle conductor?";
+-
+-  if (!dladdr ("gcry_check_version", &info))
+  const char key[] = "orboDeJITITejsirpADONivirpUkvarP";
+  
+  if (get_library_path ("libgcrypt.so.11", "gcry_check_version", libpath, sizeof(libpath)))
+     err = gpg_error_from_syserror ();
+   else
+     {
+-      dlen = _gcry_hmac256_file (digest, sizeof digest, info.dli_fname,
+      dlen = _gcry_hmac256_file (digest, sizeof digest, libpath,
+                                  key, strlen (key));
+       if (dlen < 0)
+         err = gpg_error_from_syserror ();
+@@ -594,7 +619,7 @@ check_binary_integrity (void)
+         err = gpg_error (GPG_ERR_INTERNAL);
+       else
+         {
+-          fname = gcry_malloc (strlen (info.dli_fname) + 1 + 5 + 1 );
+          fname = gcry_malloc (strlen (libpath) + 1 + 5 + 1 );
+           if (!fname)
+             err = gpg_error_from_syserror ();
+           else
+@@ -603,7 +628,7 @@ check_binary_integrity (void)
+               char *p;
+ 
+               /* Prefix the basename with a dot.  */
+-              strcpy (fname, info.dli_fname);
+              strcpy (fname, libpath);
+               p = strrchr (fname, '/');
+               if (p)
+                 p++;
+diff -up libgcrypt-1.5.0/src/Makefile.in.use-fipscheck libgcrypt-1.5.0/src/Makefile.in
+--- libgcrypt-1.5.0/src/Makefile.in.use-fipscheck	2011-06-29 10:58:01.000000000 +0200
+++ libgcrypt-1.5.0/src/Makefile.in	2011-07-20 16:19:33.000000000 +0200
+@@ -375,7 +375,7 @@ libgcrypt_la_LIBADD = $(gcrypt_res) \
+ 	../cipher/libcipher.la \
+ 	../random/librandom.la \
+ 	../mpi/libmpi.la \
+-	../compat/libcompat.la  $(GPG_ERROR_LIBS)
+	../compat/libcompat.la  $(GPG_ERROR_LIBS) -ldl
+ 
+ dumpsexp_SOURCES = dumpsexp.c
+ dumpsexp_CFLAGS = $(arch_gpg_error_cflags)
--- a/libgcrypt-1.5.1-use-poll.patch
+++ b/libgcrypt-1.5.1-use-poll.patch
@ -0,0 +1,82 @@
+diff -up libgcrypt-1.5.1/random/rndlinux.c.use-poll libgcrypt-1.5.1/random/rndlinux.c
+--- libgcrypt-1.5.1/random/rndlinux.c.use-poll	2013-03-20 15:33:26.504867356 +0100
+++ libgcrypt-1.5.1/random/rndlinux.c	2013-03-20 15:37:24.999944048 +0100
+@@ -32,6 +32,7 @@
+ #include <string.h>
+ #include <unistd.h>
+ #include <fcntl.h>
+#include <poll.h>
+ #include "types.h"
+ #include "g10lib.h"
+ #include "rand-internal.h"
+@@ -142,49 +143,37 @@ _gcry_rndlinux_gather_random (void (*add
+     }
+ 
+   /* Enter the read loop.  */
+-  delay = 0;  /* Start with 0 seconds so that we do no block on the
+  delay = 100;  /* Start with 0 seconds so that we do no block on the
+                  first iteration and in turn call the progress function
+                  before blocking.  To give the OS a better chance to
+                  return with something we will actually use 100ms. */
+   while (length)
+     {
+-      fd_set rfds;
+-      struct timeval tv;
+       int rc;
+      struct pollfd pfd;
+ 
+-      /* If the system has no limit on the number of file descriptors
+-         and we encounter an fd which is larger than the fd_set size,
+-         we don't use the select at all.  The select code is only used
+-         to emit progress messages.  A better solution would be to
+-         fall back to poll() if available.  */
+-#ifdef FD_SETSIZE
+-      if (fd < FD_SETSIZE)
+-#endif
+      pfd.fd = fd;
+      pfd.events = POLLIN;
+
+      if ( !(rc=poll(&pfd, 1, delay)) )
+         {
+-          FD_ZERO(&rfds);
+-          FD_SET(fd, &rfds);
+-          tv.tv_sec = delay;
+-          tv.tv_usec = delay? 0 : 100000;
+-          if ( !(rc=select(fd+1, &rfds, NULL, NULL, &tv)) )
+-            {
+-              if (!any_need_entropy || last_so_far != (want - length) )
+-                {
+-                  last_so_far = want - length;
+-                  _gcry_random_progress ("need_entropy", 'X',
+-                                         (int)last_so_far, (int)want);
+-                  any_need_entropy = 1;
+-                }
+-              delay = 3; /* Use 3 seconds henceforth.  */
+-              continue;
+-            }
+-          else if( rc == -1 )
+          if (!any_need_entropy || last_so_far != (want - length) )
+             {
+-              log_error ("select() error: %s\n", strerror(errno));
+-              if (!delay)
+-                delay = 1; /* Use 1 second if we encounter an error before
+              last_so_far = want - length;
+              _gcry_random_progress ("need_entropy", 'X',
+                                     (int)last_so_far, (int)want);
+              any_need_entropy = 1;
+	    }
+          delay = 3000; /* Use 3 seconds henceforth.  */
+	  continue;
+	}
+      else if( rc == -1 )
+        {
+          log_error ("poll() error: %s\n", strerror(errno));
+          if (!delay)
+            delay = 1000; /* Use 1 second if we encounter an error before
+                           we have ever blocked.  */
+-              continue;
+-            }
+          continue;
+         }
+ 
+       do
--- a/libgcrypt-1.5.2-aliasing.patch
+++ b/libgcrypt-1.5.2-aliasing.patch
@ -0,0 +1,30 @@
+diff -up libgcrypt-1.5.2/cipher/Makefile.am.aliasing libgcrypt-1.5.2/cipher/Makefile.am
+--- libgcrypt-1.5.2/cipher/Makefile.am.aliasing	2013-04-18 16:49:13.000000000 +0200
+++ libgcrypt-1.5.2/cipher/Makefile.am	2013-04-25 21:48:57.867465215 +0200
+@@ -81,3 +81,9 @@ tiger.o: $(srcdir)/tiger.c
+ 
+ tiger.lo: $(srcdir)/tiger.c
+ 	`echo $(LTCOMPILE) -c $(srcdir)/tiger.c | $(o_flag_munging) `
+
+rijndael.o: $(srcdir)/rijndael.c
+	`echo $(COMPILE) -fno-strict-aliasing -c $(srcdir)/rijndael.c `
+
+rijndael.lo: $(srcdir)/rijndael.c
+	`echo $(LTCOMPILE) -fno-strict-aliasing -c $(srcdir)/rijndael.c `
+diff -up libgcrypt-1.5.2/cipher/Makefile.in.aliasing libgcrypt-1.5.2/cipher/Makefile.in
+--- libgcrypt-1.5.2/cipher/Makefile.in.aliasing	2013-04-18 17:06:03.000000000 +0200
+++ libgcrypt-1.5.2/cipher/Makefile.in	2013-04-25 21:48:59.164493610 +0200
+@@ -638,6 +638,12 @@ tiger.o: $(srcdir)/tiger.c
+ tiger.lo: $(srcdir)/tiger.c
+ 	`echo $(LTCOMPILE) -c $(srcdir)/tiger.c | $(o_flag_munging) `
+ 
+rijndael.o: $(srcdir)/rijndael.c
+	`echo $(COMPILE) -fno-strict-aliasing -c $(srcdir)/rijndael.c `
+
+rijndael.lo: $(srcdir)/rijndael.c
+	`echo $(LTCOMPILE) -fno-strict-aliasing -c $(srcdir)/rijndael.c `
+
+ # Tell versions [3.59,3.63) of GNU make to not export all variables.
+ # Otherwise a system limit (for SysV at least) may be exceeded.
+ .NOEXPORT:
+diff -up libgcrypt-1.5.2/cipher/rijndael.c.aliasing libgcrypt-1.5.2/cipher/rijndael.c
--- a/libgcrypt-1.5.2-mpicoder-gccopt.patch
+++ b/libgcrypt-1.5.2-mpicoder-gccopt.patch
@ -0,0 +1,102 @@
+diff -up libgcrypt-1.5.2/mpi/mpicoder.c.gccopt libgcrypt-1.5.2/mpi/mpicoder.c
+--- libgcrypt-1.5.2/mpi/mpicoder.c.gccopt	2013-04-18 16:48:42.000000000 +0200
+++ libgcrypt-1.5.2/mpi/mpicoder.c	2013-06-20 10:24:57.241510589 +0200
+@@ -555,16 +555,16 @@ gcry_mpi_print (enum gcry_mpi_format for
+           extra=1;
+ 	}
+ 
+-      if (buffer && n > len)
+-        {
+-          /* The provided buffer is too short. */
+-          gcry_free (tmp);
+-          return gcry_error (GPG_ERR_TOO_SHORT);
+-	}
+       if (buffer)
+         {
+           unsigned char *s = buffer;
+ 
+          if (n > len)
+            {
+              /* The provided buffer is too short. */
+              gcry_free (tmp);
+              return gcry_error (GPG_ERR_TOO_SHORT);
+            }
+           if (extra)
+             *s++ = 0;
+           memcpy (s, tmp, n-extra);
+@@ -580,12 +580,12 @@ gcry_mpi_print (enum gcry_mpi_format for
+       /* Note:  We ignore the sign for this format.  */
+       /* FIXME: for performance reasons we should put this into
+ 	 mpi_aprint because we can then use the buffer directly.  */
+-      if (buffer && n > len)
+-        return gcry_error (GPG_ERR_TOO_SHORT);
+       if (buffer)
+         {
+           unsigned char *tmp;
+ 
+          if (n > len)
+            return gcry_error (GPG_ERR_TOO_SHORT);
+           tmp = _gcry_mpi_get_buffer (a, &n, NULL);
+           if (!tmp)
+             return gpg_error_from_syserror ();
+@@ -603,14 +603,13 @@ gcry_mpi_print (enum gcry_mpi_format for
+       if( a->sign )
+         return gcry_error (GPG_ERR_INV_ARG);
+ 
+-      if (buffer && n+2 > len)
+-        return gcry_error (GPG_ERR_TOO_SHORT);
+-
+       if (buffer)
+         {
+           unsigned char *tmp;
+           unsigned char *s = buffer;
+ 
+          if (n+2 > len)
+            return gcry_error (GPG_ERR_TOO_SHORT);
+           s[0] = nbits >> 8;
+           s[1] = nbits;
+ 
+@@ -641,16 +640,16 @@ gcry_mpi_print (enum gcry_mpi_format for
+           extra=1;
+ 	}
+ 
+-      if (buffer && n+4 > len)
+-        {
+-          gcry_free(tmp);
+-          return gcry_error (GPG_ERR_TOO_SHORT);
+-	}
+-
+       if (buffer)
+         {
+           unsigned char *s = buffer;
+ 
+          if (n+4 > len)
+            {
+              gcry_free(tmp);
+              return gcry_error (GPG_ERR_TOO_SHORT);
+            }
+
+           *s++ = n >> 24;
+           *s++ = n >> 16;
+           *s++ = n >> 8;
+@@ -677,15 +676,15 @@ gcry_mpi_print (enum gcry_mpi_format for
+       if (!n || (*tmp & 0x80))
+         extra = 2;
+ 
+-      if (buffer && 2*n + extra + !!a->sign + 1 > len)
+-        {
+-          gcry_free(tmp);
+-          return gcry_error (GPG_ERR_TOO_SHORT);
+-	}
+       if (buffer)
+         {
+           unsigned char *s = buffer;
+ 
+          if (2*n + extra + !!a->sign + 1 > len)
+            {
+              gcry_free(tmp);
+              return gcry_error (GPG_ERR_TOO_SHORT);
+            }
+           if (a->sign)
+             *s++ = '-';
+           if (extra)
--- a/libgcrypt-1.5.3-ecc-test-fix.patch
+++ b/libgcrypt-1.5.3-ecc-test-fix.patch
@ -0,0 +1,12 @@
+diff -up libgcrypt-1.5.3/tests/benchmark.c.eccfix libgcrypt-1.5.3/tests/benchmark.c
+--- libgcrypt-1.5.3/tests/benchmark.c.eccfix	2013-10-20 23:45:32.157297611 +0100
+++ libgcrypt-1.5.3/tests/benchmark.c	2013-10-20 23:45:42.683275072 +0100
+@@ -962,7 +962,7 @@ ecc_bench (int iterations, int print_hea
+ {
+ #if USE_ECC
+   gpg_error_t err;
+-  int p_sizes[] = { 192, 224, 256, 384, 521 };
+  int p_sizes[] = { 256, 384 };
+   int testno;
+ 
+   if (print_header)
--- a/libgcrypt.spec
+++ b/libgcrypt.spec
@ -1,50 +1,60 @@
-# This is taken from gnutls.spec
-%define srpmhash() %{lua:
-local files = rpm.expand("%_specdir/libgcrypt.spec")
-for i, p in ipairs(patches) do
-   files = files.." "..p
-end
-for i, p in ipairs(sources) do
-   files = files.." "..p
-end
-local sha256sum = assert(io.popen("cat "..files.."| sha256sum"))
-local hash = sha256sum:read("*a")
-sha256sum:close()
-print(string.sub(hash, 0, 16))
-}
-
 Name: libgcrypt
-Version: 1.11.2
-Release: 1%{?dist}
-URL: https://www.gnupg.org/
-Source0: https://www.gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2
-Source1: https://www.gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2.sig
-Source2: https://gnupg.org/signature_key.asc
-# Pass the annobin flags to the libgcrypt.so (#2016349)
-Patch1: libgcrypt-1.10.1-annobin.patch
-# https://gitlab.com/redhat-crypto/libgcrypt/libgcrypt-mirror/-/merge_requests/19/
-Patch5: libgcrypt-1.11.0-marvin.patch
+Version: 1.5.3
+Release: 2%{?dist}
+URL: http://www.gnupg.org/
+Source0: libgcrypt-%{version}-hobbled.tar.xz
+# The original libgcrypt sources now contain potentially patented ECC
+# cipher support. We have to remove it in the tarball we ship with
+# the hobble-libgcrypt script. 
+# (We replace it with RH approved ECC in Source4-5)
+#Source0: ftp://ftp.gnupg.org/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2
+#Source1: ftp://ftp.gnupg.org/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2.sig
+Source2: wk@g10code.com
+Source3: hobble-libgcrypt
+# Approved ECC support (from 1.5.3)
+Source4: ecc.c
+Source5: curves.c
+# make FIPS hmac compatible with fipscheck - non upstreamable
+Patch2: libgcrypt-1.5.0-use-fipscheck.patch
+# fix tests in the FIPS mode, fix the FIPS-186-3 DSA keygen
+Patch5: libgcrypt-1.5.0-tests.patch
+# add configurable source of RNG seed and seed by default
+# from /dev/urandom in the FIPS mode
+Patch6: libgcrypt-1.5.0-fips-cfgrandom.patch
+# make the FIPS-186-3 DSA CAVS testable
+Patch7: libgcrypt-1.5.0-fips-cavs.patch
+# fix for memory leaks an other errors found by Coverity scan
+Patch9: libgcrypt-1.5.0-leak.patch
+# use poll instead of select when gathering randomness
+Patch11: libgcrypt-1.5.1-use-poll.patch
+# compile rijndael with -fno-strict-aliasing
+Patch12: libgcrypt-1.5.2-aliasing.patch
+# slight optimalization of mpicoder.c to silence Valgrind (#968288)
+Patch13: libgcrypt-1.5.2-mpicoder-gccopt.patch
+# fix tests to work with approved ECC
+Patch14: libgcrypt-1.5.3-ecc-test-fix.patch

-%global gcrylibdir %{_libdir}
-%global gcrysoname libgcrypt.so.20
-%global hmackey orboDeJITITejsirpADONivirpUkvarP
+%define gcrylibdir %{_libdir}

-License: BSD-3-Clause AND (BSD-3-Clause OR GPL-2.0-only) AND GPL-2.0-or-later AND LGPL-2.1-or-later AND LGPL-2.0-or-later AND MIT-Modern-Variant
+# Technically LGPLv2.1+, but Fedora's table doesn't draw a distinction.
+# Documentation and some utilities are GPLv2+ licensed. These files
+# are in the devel subpackage.
+License: LGPLv2+
 Summary: A general-purpose cryptography library
-BuildRequires: gcc
-BuildRequires: gawk, libgpg-error-devel >= 1.11, pkgconfig
+BuildRequires: gawk, libgpg-error-devel >= 1.4, pkgconfig
+BuildRequires: fipscheck
 # This is needed only when patching the .texi doc.
 BuildRequires: texinfo
-BuildRequires: autoconf, automake, libtool
-BuildRequires: make
-BuildRequires: gnupg2
-BuildRequires: annobin-annocheck binutils
+Group: System Environment/Libraries

 %package devel
 Summary: Development files for the %{name} package
+License: LGPLv2+ and GPLv2+
+Group: Development/Libraries
+Requires(pre): /sbin/install-info
+Requires(post): /sbin/install-info
 Requires: libgpg-error-devel
-Requires: %{name}%{?_isa} = %{version}-%{release}
-Requires: pkgconfig
+Requires: %{name} = %{version}-%{release}

 %description
 Libgcrypt is a general purpose crypto library based on the code used
@ -56,59 +66,46 @@ in GNU Privacy Guard.  This package contains files needed to develop
 applications using libgcrypt.

 %prep
-%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
 %setup -q
-%patch 1 -p1
-%patch 5 -p1
+%{SOURCE3}
+%patch2 -p1 -b .use-fipscheck
+%patch5 -p1 -b .tests
+%patch6 -p1 -b .cfgrandom
+%patch7 -p1 -b .cavs
+%patch9 -p1 -b .leak
+%patch11 -p1 -b .use-poll
+%patch12 -p1 -b .aliasing
+%patch13 -p1 -b .gccopt
+%patch14 -p1 -b .eccfix
+cp %{SOURCE4} cipher/
+rm -rf tests/curves.c
+cp %{SOURCE5} tests/curves.c

 %build
-# should be all algorithms except SM3 and SM4, aria
-export DIGESTS='crc gostr3411-94 md4 md5 rmd160 sha1 sha256 sha512 sha3 tiger whirlpool stribog blake2'
-export CIPHERS='arcfour blowfish cast5 des aes twofish serpent rfc2268 seed camellia idea salsa20 gost28147 chacha20'
-
-eval $(sed -n 's/^\(\(NAME\|VERSION_ID\)=.*\)/OS_\1/p' /etc/os-release)
-export FIPS_MODULE_NAME="$OS_NAME ${OS_VERSION_ID%%.*} %name"
-
-autoreconf -f
 %configure --disable-static \
 %ifarch sparc64
     --disable-asm \
 %endif
     --enable-noexecstack \
-     --enable-hmac-binary-check=%{hmackey} \
-     --disable-jent-support \
-     --disable-O-flag-munging \
-     --enable-digests="$DIGESTS" \
-     --enable-ciphers="$CIPHERS" \
-     --enable-marvin-workaround \
-     --with-fips-module-version="$FIPS_MODULE_NAME %{version}-%{srpmhash}"
-sed -i -e '/^sys_lib_dlsearch_path_spec/s,/lib /usr/lib,/usr/lib /lib64 /usr/lib64 /lib,g' libtool
-%make_build
+     --enable-hmac-binary-check \
+     --enable-pubkey-ciphers='dsa elgamal rsa ecc' \
+     --disable-O-flag-munging
+make %{?_smp_mflags}

 %check
+fipshmac src/.libs/libgcrypt.so.??
 make check
-# try in faked FIPS mode too
-LIBGCRYPT_FORCE_FIPS_MODE=1 make check
-
-%define libpath $RPM_BUILD_ROOT%{gcrylibdir}/%{gcrysoname}.?.?
-
-PROFILE=%{?dist} annocheck --ignore-unknown --verbose --profile=${PROFILE:1} %{libpath}

 # Add generation of HMAC checksums of the final stripped binaries 
 %define __spec_install_post \
    %{?__debug_package:%{__debug_install_post}} \
    %{__arch_install_post} \
    %{__os_install_post} \
-    cd src \
-    sed -i -e 's|FILE=.*|FILE=\\\$1|' gen-note-integrity.sh \
-    READELF=readelf AWK=awk ECHO_N="-n" bash gen-note-integrity.sh %{libpath} > %{libpath}.hmac \
-    objcopy --update-section .note.fdo.integrity=%{libpath}.hmac %{libpath} %{libpath}.new \
-    mv -f %{libpath}.new %{libpath} \
-    rm -f %{libpath}.hmac
+    fipshmac $RPM_BUILD_ROOT%{gcrylibdir}/*.so.?? \
 %{nil}

 %install
-%make_install
+make install DESTDIR=$RPM_BUILD_ROOT

 # Change /usr/lib64 back to /usr/lib.  This saves us from having to patch the
 # script to "know" that -L/usr/lib64 should be suppressed, and also removes
@ -131,336 +128,59 @@ for shlib in $RPM_BUILD_ROOT%{_libdir}/*.so* ; do
 	fi
 done

+# Overwrite development symlinks.
+pushd $RPM_BUILD_ROOT/%{_libdir}
+for shlib in %{gcrylibdir}/lib*.so.* ; do
+	shlib=`echo "$shlib" | sed -e 's,//,/,g'`
+	target=`basename "$shlib" | sed -e 's,\.so.*,,g'`.so
+	ln -sf $shlib $target
+done
+popd
+
 # Add soname symlink.
 /sbin/ldconfig -n $RPM_BUILD_ROOT/%{_lib}/
 %endif

-# Overwrite development symlinks.
-pushd $RPM_BUILD_ROOT/%{gcrylibdir}
-for shlib in lib*.so.?? ; do
-	target=$RPM_BUILD_ROOT/%{_libdir}/`echo "$shlib" | sed -e 's,\.so.*,,g'`.so
-%if "%{gcrylibdir}" != "%{_libdir}"
-	shlib=%{gcrylibdir}/$shlib
-%endif
-	ln -sf $shlib $target
-done
-popd

 # Create /etc/gcrypt (hardwired, not dependent on the configure invocation) so
 # that _someone_ owns it.
 mkdir -p -m 755 $RPM_BUILD_ROOT/etc/gcrypt

-%ldconfig_scriptlets
+%post -p /sbin/ldconfig
+
+%postun -p /sbin/ldconfig
+
+%post devel
+[ -f %{_infodir}/gcrypt.info.gz ] && \
+    /sbin/install-info %{_infodir}/gcrypt.info.gz %{_infodir}/dir
+exit 0
+
+%preun devel
+if [ $1 = 0 -a -f %{_infodir}/gcrypt.info.gz ]; then
+    /sbin/install-info --delete %{_infodir}/gcrypt.info.gz %{_infodir}/dir
+fi
+exit 0

 %files
+%defattr(-,root,root,-)
 %dir /etc/gcrypt
-%{gcrylibdir}/libgcrypt.so.*.*
-%{gcrylibdir}/%{gcrysoname}
-%license COPYING.LIB
-%doc AUTHORS NEWS THANKS
+%{gcrylibdir}/libgcrypt.so.*
+%{gcrylibdir}/.libgcrypt.so.*.hmac
+%doc COPYING.LIB AUTHORS NEWS THANKS

 %files devel
+%defattr(-,root,root,-)
 %{_bindir}/%{name}-config
 %{_bindir}/dumpsexp
 %{_bindir}/hmac256
-%{_bindir}/mpicalc
 %{_includedir}/*
 %{_libdir}/*.so
-%{_libdir}/pkgconfig/libgcrypt.pc
 %{_datadir}/aclocal/*
-%{_mandir}/man1/*

 %{_infodir}/gcrypt.info*
-%license COPYING
+%doc COPYING

 %changelog
-* Mon Nov 03 2025 Jakub Jelen <jjelen@redhat.com> - 1.11.2-1
- New upstream release (#2406804)
-
-* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.11.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Tue May 13 2025 Jakub Jelen <jjelen@redhat.com> - 1.11.1-1
- New upstream release (#2364878)
-
-* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.11.0-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
-
-* Tue Oct 29 2024 Jakub Jelen <jjelen@redhat.com> - 1.11.0-4
- Run annocheck as part of the build
- Use upstream CF protection patches
- Fix PAC/BTI protection for Aarch64
- Fix CVE-2024-2236 (#2274128)
-
-* Thu Jul 25 2024 Jakub Jelen <jjelen@redhat.com> - 1.11.0-3
- Disable -O flag munging and remove needles modification of LTO flags.
-
-* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.11.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
-
-* Wed Jun 19 2024 Jakub Jelen <jjelen@redhat.com> - 1.11.0-1
- New upstream release (#2293064)
-
-* Tue Mar 26 2024 Jakub Jelen <jjelen@redhat.com> - 1.10.3-4
- Replace deprecated fgrep (#2271503)
-
-* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.3-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.3-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Tue Nov 14 2023 Jakub Jelen <jjelen@redhat.com> - 1.10.3-1
- New upstream release (#2249639)
-
-* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.2-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
-
-* Tue Apr 11 2023 Jakub Jelen <jjelen@redhat.com> - 1.10.2-1
- New upstream release (#2185084)
-
-* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.1-7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
-
-* Sat Dec  3 2022 Florian Weimer <fweimer@redhat.com> - 1.10.1-6
- Port configure script to C99
-
-* Tue Nov 08 2022 Todd Zullinger <tmz@pobox.com> - 1.10.1-5
- enable brainpool by default (#1413618)
- fix sporadic failures generating RSA keys in FIPS mode
-
-* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.1-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
-
-* Sun May 29 2022 Todd Zullinger <tmz@pobox.com> - 1.10.1-3
- improve --disable-brainpool configure output
- use %%bcond_with to disable brainpool curves
-
-* Fri Apr 08 2022 Jakub Jelen <jjelen@redhat.com> - 1.10.1-2
- Adjust integrity check creation to match upstream (#2073018)
-
-* Tue Mar 29 2022 Jakub Jelen <jjelen@redhat.com> - 1.10.1-1
- Final release (#2069263)
-
-* Wed Feb 02 2022 Jakub Jelen <jjelen@redhat.com> - 1.10.0-1
- New upstream release (#2049322)
-
-* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.9.4-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
-
-* Mon Aug 23 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.4-1
- New upstream release (#1996467)
-
-* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.9.3-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
-
-* Tue Jun 15 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.3-3
- Fix for CVE-2021-33560 (#1970098)
-
-* Wed Apr 28 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.3-2
- Restore the CET protection (#1954049)
-
-* Tue Apr 20 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.3-1
- New upstream release (#1951325)
-
-* Thu Apr 15 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.2-3
- Fix issues reported by coverity
-
-* Mon Mar 29 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.2-2
- Fix OCB tag creation on s390x (failing gnupg2 tests)
-
-* Wed Feb 17 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.2-1
- New upstream release (#1929630)
-
-* Fri Jan 29 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.1-1
- New upstream release (#1922156, #1922097)
-
-* Wed Jan 20 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.0-1
- New upstream release (#1917878)
-
-* Tue Nov 24 2020 Jakub Jelen <jjelen@redhat.com> - 1.8.7-1
- new upstream release (#1891123)
-
-* Fri Aug 21 2020 Jeff Law <law@redhat.com> - 1.8.6-4
- Re-enable LTO
-
-* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.6-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Tue Jul 21 2020 Tom Stellard <tstellar@redhat.com> - 1.8.6-2
- Use make macros
- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
-
-* Mon Jul 20 2020 Tomáš Mráz <tmraz@redhat.com> 1.8.6-1
- new upstream version 1.8.6
-
-* Wed Jul  1 2020 Tomáš Mráz <tmraz@redhat.com> 1.8.5-7
- use the hmac256 tool to calculate the library hmac
-
-* Tue Jun 30 2020 Jeff Law <law@redhat.com>
- Disable LTO
-
-* Thu Apr 23 2020 Tomáš Mráz <tmraz@redhat.com> 1.8.5-6
- Fix regression - missing -ldl linkage
-
-* Wed Apr 22 2020 Tomáš Mráz <tmraz@redhat.com> 1.8.5-5
- AES performance improvements backported from master branch
-
-* Mon Apr 20 2020 Tomáš Mráz <tmraz@redhat.com> 1.8.5-4
- FIPS selftest is run directly from the constructor
- FIPS module is implicit with kernel FIPS flag
-
-* Thu Jan 30 2020 Tomáš Mráz <tmraz@redhat.com> 1.8.5-3
- fix the build on ARMv7
-
-* Thu Jan 23 2020 Tomáš Mráz <tmraz@redhat.com> 1.8.5-2
- Intel CET support by H. J. Lu
-
-* Tue Sep  3 2019 Tomáš Mráz <tmraz@redhat.com> 1.8.5-1
- new upstream version 1.8.5
- add CMAC selftest for FIPS POST
- add continuous FIPS entropy test
- disable non-approved FIPS hashes in the enforced FIPS mode
-
-* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.4-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
-
-* Tue Feb 12 2019 Tomáš Mráz <tmraz@redhat.com> 1.8.4-3
- fix the build tests to pass in the FIPS mode
-
-* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.4-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
-
-* Tue Nov 20 2018 Tomáš Mráz <tmraz@redhat.com> 1.8.4-1
- new upstream version 1.8.4
-
-* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.3-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
-
-* Thu Jul 12 2018 Tomáš Mráz <tmraz@redhat.com> 1.8.3-2
- make only_urandom a default in non-presence of configuration file
- run the full FIPS selftests only when the library is called from
-  application
-
-* Thu Jun 14 2018 Tomáš Mráz <tmraz@redhat.com> 1.8.3-1
- new upstream version 1.8.3
-
-* Tue Feb  6 2018 Tomáš Mráz <tmraz@redhat.com> 1.8.2-2
- fix behavior when getrandom syscall is not present (#1542453)
-
-* Thu Dec 21 2017 Tomáš Mráz <tmraz@redhat.com> 1.8.2-1
- new upstream version 1.8.2
-
-* Tue Dec  5 2017 Tomáš Mráz <tmraz@redhat.com> 1.8.1-3
- do not try to access() /dev/urandom either if getrandom() works
-
-* Mon Dec  4 2017 Tomáš Mráz <tmraz@redhat.com> 1.8.1-2
- do not try to open /dev/urandom if getrandom() works (#1380866)
-
-* Tue Sep  5 2017 Tomáš Mráz <tmraz@redhat.com> 1.8.1-1
- new upstream version 1.8.1
-
-* Wed Aug 16 2017 Tomáš Mráz <tmraz@redhat.com> 1.8.0-1
- new upstream version 1.8.0
-
-* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.7.8-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
-
-* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.7.8-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
-
-* Thu Jun 29 2017 Tomáš Mráz <tmraz@redhat.com> 1.7.8-1
- new upstream version 1.7.8
-
-* Fri Jun  2 2017 Tomáš Mráz <tmraz@redhat.com> 1.7.7-1
- new upstream version 1.7.7
- GOST is now enabled
-
-* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.7.6-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
-
-* Mon Jan 30 2017 Tomáš Mráz <tmraz@redhat.com> 1.7.6-1
- new upstream version 1.7.6
-
-* Fri Dec 16 2016 Tomáš Mráz <tmraz@redhat.com> 1.7.5-1
- new upstream version 1.7.5
-
-* Wed Nov 23 2016 Tomáš Mráz <tmraz@redhat.com> 1.7.3-1
- new upstream version 1.7.3
-
-* Wed Aug 17 2016 Tomáš Mráz <tmraz@redhat.com> 1.6.6-1
- new upstream version with important security fix (CVE-2016-6316)
-
-* Thu Jul 21 2016 Tomáš Mráz <tmraz@redhat.com> 1.6.5-1
- new upstream version fixing low impact issue CVE-2015-7511
-
-* Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 1.6.4-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
-
-* Wed Sep  9 2015 Tomáš Mráz <tmraz@redhat.com> 1.6.4-1
- new upstream version
-
-* Wed Jun 17 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.6.3-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
-
-* Fri Apr  3 2015 Tomáš Mráz <tmraz@redhat.com> 1.6.3-4
- deinitialize the RNG after the selftest is run
-
-* Tue Mar 24 2015 Tomáš Mráz <tmraz@redhat.com> 1.6.3-3
- touch only urandom in the selftest and when /dev/random is
-  unavailable for example by SELinux confinement
- fix the RSA selftest key (p q swap) (#1204517)
-
-* Fri Mar 13 2015 Tomáš Mráz <tmraz@redhat.com> 1.6.3-2
- do not use strict aliasing for bufhelp functions (#1201219)
-
-* Fri Mar  6 2015 Tomáš Mráz <tmraz@redhat.com> 1.6.3-1
- new upstream version
-
-* Wed Feb 25 2015 Tomáš Mráz <tmraz@redhat.com> 1.6.2-4
- do not initialize secure memory during the selftest (#1195850)
-
-* Sat Feb 21 2015 Till Maas <opensource@till.name> - 1.6.2-3
- Rebuilt for Fedora 23 Change
-  https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code
-
-* Wed Jan 14 2015 Tomáš Mráz <tmraz@redhat.com> 1.6.2-2
- fix buildability of programs using gcrypt.h with -ansi (#1182200)
-
-* Mon Dec  8 2014 Tomáš Mráz <tmraz@redhat.com> 1.6.2-1
- new upstream version
-
-* Sun Aug 17 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.6.1-7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
-
-* Thu Jul 17 2014 Tom Callaway <spot@fedoraproject.org> - 1.6.1-6
- fix license handling
-
-* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.6.1-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
-
-* Tue May 20 2014 Kyle McMartin <kyle@fedoraproject.org> 1.6.1-4
- Re-enable below algos, apply patch from upstream list to make
-  that code -fPIC friendly. (rhbz#1069792)
-
-* Mon May 19 2014 Kyle McMartin <kyle@fedoraproject.org> 1.6.1-3
- Disable rijndael, cast5, camellia ARM assembly, as it's non-PIC as
-  presently written, which results in .text relocations in the shared
-  library. (rhbz#1069792)
-
-* Thu Apr 24 2014 Tomáš Mráz <tmraz@redhat.com> 1.6.1-2
- drop the temporary compat shared library version
- fix the soname version in -use-fipscheck.patch
-
-* Fri Feb 28 2014 Tomáš Mráz <tmraz@redhat.com> 1.6.1-1
- new upstream version breaking ABI compatibility
- this release temporarily includes old compatibility .so
-
-* Tue Jan 21 2014 Tomáš Mráz <tmraz@redhat.com> 1.5.3-3
- add back the nistp521r1 EC curve
- fix a bug in the Whirlpool hash implementation
- speed up the PBKDF2 computation
-
 * Sun Oct 20 2013 Tom Callaway <spot@fedoraproject.org> - 1.5.3-2
 - add cleared ECC support

@ -526,7 +246,7 @@ mkdir -p -m 755 $RPM_BUILD_ROOT/etc/gcrypt
 * Mon Feb 07 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.4.5-7
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild

-* Fri Feb  4 2011 Tomas Mraz <tmraz@redhat.com> 1.4.5-6
+* Thu Feb  4 2011 Tomas Mraz <tmraz@redhat.com> 1.4.5-6
 - fix a bug in the fips-186-3 dsa parameter generation code

 * Tue Feb  1 2011 Tomas Mraz <tmraz@redhat.com> 1.4.5-5
@ -703,5 +423,5 @@ mkdir -p -m 755 $RPM_BUILD_ROOT/etc/gcrypt
 * Thu Jan 10 2002 Nalin Dahyabhai <nalin@redhat.com> 1.1.5-1
 - fix the Source tag so that it's a real URL

-* Thu Dec 20 2001 Nalin Dahyabhai <nalin@redhat.com>
+* Wed Dec 20 2001 Nalin Dahyabhai <nalin@redhat.com>
 - initial package
--- a/signature_key.asc
+++ b/signature_key.asc
@ -1,86 +0,0 @@
-----BEGIN PGP PUBLIC KEY BLOCK-----
-
-mQGNBFjLuq4BDACnM7zNSIaVMAacTwjXa5TGYe13i6ilHe4VL0NShzrgzjcQg531
-3cRgiiiNA7OSOypMqVs73Jez6ZUctn2GVsHBrS/io9NcuC9pVwf8a61WlcEa+EtB
-a3G7HlBmEWnwaUdAtWKNuAi9Xn+Ir7H2xEdksmmd5a0/QnL+sX705boVPF/tpYtb
-LGpPxa78tNrtxDkSwy8Wmi0IADYLI5yI7/yUGeJd8RSCU/fLRKC9fG7YOZRq0tsO
-MhVNWmtUjbG6e73Lu8LKnCZgs1/fC8hvPyARieSV5mdN8s1oWd7oYctfgL4uBleD
-ItAA8GhjKejutzHN8Ei/APw6AiiSyEjnPg+cTX8OgvLGJWjks0H6mPZeB1v/kGyZ
-hBS9vm540h2/MmlVN2ntiCK5TZGeSWpqddiqusfVXotMRpN4HeLKoZh4RAncaCbZ
-F/S+YLeN+kMXY4k3Fqt1fjTX6veFCbthI9pDdHzU9LfUVNp9D/5ktC/tYMORMegV
-+wSMxi9G2YWKJkMAEQEAAYkBzgQfAQgAOBYhBFuAxXVCmPDLVdjtarzvfilLCS4o
-BQJYy8DdFwyAAZSlyaA8L+XKOwldjh/fcjz0YraxAgcAAAoJELzvfilLCS4oNgoL
-/0+K1xIx8JW7Lk5M6bYCvNA4fdlEcwQIT4UidJFM9m+suxYFWIGfebvHpRlEuJTg
-dBjkEit8uLAoJXU0BRkKTLrzTF+qDUE79Wfx/R+0nOgJ7aMykQOi0AvuwzMYz4dg
-xIVS2Daou4DF7bh/KF8+fqrmq8P8W1ZrkuFDanMWpHeAPx1uj2skYbo7uPqFdvlJ
-hlNHrcxlcCkjf1InAt0Xt5lMvEsCRUPf9xAH4mNEhs0lh9c+200YPRmtnLWAzc1K
-ckLIC8Q+mUR3DjZDqBlDBEPegXkrI0+MlvRA+9AnAm4YPqTMUfpZ6ZOAWeFjC/6Z
-QYxG/AdWGkb4WFindzklQfybEuiekP8vU07ACQwSwH8PYe0UCom1YrlRUjX7QLkn
-ZLWoeZg8BZy9GTM1Ut7Q1Q2uTw6mxxISuef+RFgYOHjWwLpFWZpqC88xERl7o/iz
-iERJRt/593IctbjO9wenWt2peIAwzR4nz7LqM6ZFTdRAETmcdSvYRhg2Qt8hUE47
-CbQkQW5kcmUgSGVpbmVja2UgKFJlbGVhc2UgU2lnbmluZyBLZXkpiQHUBBMBCAA+
-FiEEW4DFdUKY8MtV2O1qvO9+KUsJLigFAljLuq4CGwMFCRLMAwAFCwkIBwIGFQgJ
-CgsCBBYCAwECHgECF4AACgkQvO9+KUsJLihC/QwAhCC+SEvcFLcutgZ8HfcCtoZs
-IoVzZEy7DjqIvGgnTssD8HCLnIAHCDvnP7dJW3uMuLCdSqym3cjlEIiQMsaGywkl
-fzJISAwJrGQdWSKRd535jXpEXQlXDKal/IwMKAUt0PZtlCc9S3gwixQryxdJ28lJ
-6h2T9fVDr8ZswMmTAFG91uctfhjKOMgPt8UhSPGW484WsIsQgkbOvf+Kfswl0eHu
-ywX+pKAB5ZQ/9GVC6Ug4xfrdiJL0azJTPnvjMY5JYp6/L9RURs5hP5AnHR2j/PPo
-sAtsFCjmbRbOMiASzklnUJPbSz5kfLloDWZmrUScjbzmsXehGyt433JGyRhZJl4x
-/jPbzKhaaAHsGd+fRao6vlLOwFywDDVMp6JuyK7UeUb7I8ekTbSkGFA+l2Oa3O6/
-Y7PYhq7hwwAFuZckYI98IpHNCG1fS9W07FyKdvQbK1PbF1JFRKfsUCWYMKqDnbqE
-o5jivPEHZImw6iYhhXcyEYl8fjcb9T6/S+wOP7aviQGzBBABCAAdFiEElKXJoDwv
-5co7CV2OH99yPPRitrEFAljLv5sACgkQH99yPPRitrFw4gv/XFMFN+/LHsn9hJOP
-4rCwl1yUuxXuYmZgc0sRoY3EpeQkJVyKurQuqqKoy2VuoMiF0O1kAQmGoFtVPUk7
-b8hCoutqB5GyeyKcoLP+WINgVhB2gXg7TSp3MPLBKkgqvSDvPitgRxBqFb4LW8LJ
-bDbfwGrzIvXfDV3WvsrHVPbc2fhlWdL8d+3AE6mFiXF3eTpgmV3ApSBQV12MkkCk
-icLIPmp+ZxZON+OP52ZXkRtfMgOy4Oa/41agrViDAZdMOGeGkhPertQheQZgXzmo
-GF5Wz498HPM80Kv35X91l3iGzL+icEtO+tWea2YscsZ6qpRe2lfVPHk3B+anlmCj
-m4kM4cBd39xa4HHSVh/bRHbZNtgVr7slQCKxlHgQOGVI5vCxPCwEsgJ2KBk03Nk/
-IA9EKO+czfh3/bHW6uMbEqrYDCnt+hmzZrpKDSGcwS/KOhvMUIMlb7/8vDKum6mp
-/8xAtVZ6IAxYZNt3qg7Y7aLRtzCTyqm8rJQrZPtRaQcgLoEimDMEX0PliRYJKwYB
-BAHaRw8BAQdAz75Hlekc16JhhfI0MKdEVxLdkxhcMCO0ZG6WMBAmNpe0H1dlcm5l
-ciBLb2NoIChkaXN0IHNpZ25pbmcgMjAyMCmImgQTFgoAQhYhBG2qbmSnbShAVxtJ
-AlKIl7gmQDraBQJfQ+w1AhsDBQkShccRBQsJCAcCAyICAQYVCgkICwIEFgIDAQIe
-BwIXgAAKCRBSiJe4JkA62nmuAP9uL/HOdB0gvwWrH+FpURJLs4bnaZaPIk9ARrU0
-EXRgJgD/YCGfHQXpIPT0ZaXuwJexK04Z+qMFR/bM1q1Leo5CjgaIbQQQEQsAHRYh
-BIBhWHD1utaQMzaG0PKthaweQrNnBQJfQ/HmAAoJEPKthaweQrNnIZkA3jG6LcZv
-V/URn8Y8OJqsyYa4C3NI4nN+OhEvYhgA4PHzMnALeXIpA2gblvjFIPJPAhDBAU37
-c5PA6+6IdQQQFggAHRYhBK6oTtzwGthsRwHIXGMROuhmWH0KBQJfQ/IlAAoJEGMR
-OuhmWH0K1+MA/0uJ5AHcnSfIBEWHNJwwVVLGyrxAWtS2U+zeymp/UvlPAQDErCLZ
-l0dBiPG3vlowFx5TNep7tanBs6ZJn8F1ao1tAIkBMwQQAQgAHRYhBNhpISPEBl3q
-Xg86tSSbOdJPJeO2BQJfQ/OuAAoJECSbOdJPJeO2DVoH/0o9if66ph6FJrgr+A/W
-HNVeHxmM5tUQhpL1wpRS70SKcsJgolf5CxO5iTQf3HlZe544xGbIU/aCTJsWw9zi
-UE8KmhAtKV4eL/7oQ7xx4nxPnABLpudtM8A44nsM1x/XiYrJnnDm29QjYEGd2Hi8
-7npc7VWKzLoj+I/WcXquynJi5O9TUxW9Bknd1pjpxFkf8v+msjBzCD5VKJgr0CR8
-wA6peQBWeGZX2HacosMIZH4TfL0r0TFla6LJIkNBz9DyIm1yL4L8oRH0950hQljP
-C7TM3L7aRpX+4Kph6llFz6g7MALGFP95kyJ6o+XED9ORuuQVZMBMIkNC0tXOu10V
-bdqIdQQQFgoAHRYhBMHTS2khnkruwLocIeP9/yGORbcrBQJfQ/P8AAoJEOP9/yGO
-Rbcr3lQBAMas8Vl3Hdl3g2I283lz1uHiGvlwcnk2TLeB+U4zIwC9AQCy0nnazVNt
-VQPID1ZCMoaOX7AzOjaqQDLf4j+dVTxgBJgzBGCkgocWCSsGAQQB2kcPAQEHQJmd
-fwp8jEN5P3eEjhQiWk6zQi8utvgOvYD57XmE+H8+tCBOaWliZSBZdXRha2EgKEdu
-dVBHIFJlbGVhc2UgS2V5KYiaBBMWCgBCFiEErI4RW/c+LY1H+pkI6Y6bLRnGyL0F
-AmCkgocCGwMFCQsNBpkFCwkIBwIDIgIBBhUKCQgLAgQWAgMBAh4HAheAAAoJEOmO
-my0Zxsi9/4IA/1rvSr3MU+Sv4jhNDzD+CeC3gmHkPew6pi9VHEsEwdgmAQD2BtiX
-7w1sJL/CBylGWv5jxj4345mP9YfZm0RsgzPjDIh1BBAWCAAdFiEEJJyzdxdQdF1c
-3TI84mewUjZPAo0FAmFAQ54ACgkQ4mewUjZPAo1CiAD+KTT1UVdQTGHMyvHwZocS
-QjU8xhcZrTet+dvvjrE5+4MA/RBdJPZgFevUKu68NEy0Lo+RbkeCtmQJ/c8v5ieF
-vW0AiQEzBBABCAAdFiEEEkEkvTtIYq96CkLxALRevUynur4FAmFAQ7cACgkQALRe
-vUynur4kaAgAolPR8TNWVS0vXMKrr0k0l2M/8QkZTaLZx1GT9Nx1yb4WJKY7ElPM
-YkhGDxetvFBETx0pH/6R3jtj6Crmur+NKHVSRY+rCYpFPDn6ciIOryssRx2G4kCZ
-t+nFB9JyDbBOZAR8DK4pN1mAxG/yLDt4oKcUQsP2xlEFum+phxyR8KyYCpkwKRxY
-eK+6lfilQuveoUwp/Xx5wXPNUy6q4eOOovCW7gS7I7288NGHCa2ul8sD6vA9C4mM
-4Zxaole9P9wwJe1zZFtCIy88zHM9vqv+YM9DxMCaW24+rUztr7eD4bCRdG+QlSh+
-7R/TaqSxY1eAAd1J5tma9CNJO73pTKU+/JhTBGFpSqMTCSskAwMCCAEBBwIDBF6X
-D9NmUQDgiyYNbhs1DMJ14mIw812wY1HVx/4QWYWiBunhrvSFxVbzsjD7/Wv+v3bm
-MPrL+M2DLyFiSewNmcS0JEdudVBHLmNvbSAoUmVsZWFzZSBTaWduaW5nIEtleSAy
-MDIxKYiaBBMTCABCFiEEAvON/3Mf+XywOaHaVJ5pXpBboggFAmFpSqMCGwMFCQ9x
-14oFCwkIBwIDIgIBBhUKCQgLAgQWAgMBAh4HAheAAAoJEFSeaV6QW6IITkoA/RYa
-jaTl1eEBU/Gdm12o3jrI55N5xZK2XTqSx25clVyjAP0XwMW/Og5+ND1ri3bAqADV
-WlBDUswz8wYxsb0C4kYBkoh1BBAWCgAdFiEEbapuZKdtKEBXG0kCUoiXuCZAOtoF
-AmFpTvEACgkQUoiXuCZAOtrJQAEAh7YyykjAy/Qs1yC3ji8iBfIVnPXvblrIx3SR
-RyDwRC8BAKtZbEuKTtPlgkLUgMleTcZJ/vEhJE+GvfQ9o5gWCqEFiHUEEBYKAB0W
-IQTB00tpIZ5K7sC6HCHj/f8hjkW3KwUCYWlPWgAKCRDj/f8hjkW3Kx4eAQDp6aGS
-N/fU4xLl8RSvQUVjVA+aCTrMQR3hRwqw8liF2wEA3O3ECxz6e1+DoItYoJBBLKLw
-eiInsGZ/+h5XYrpXTgA=
-=4+Sn
-----END PGP PUBLIC KEY BLOCK-----
--- a/3
+++ b/3
@ -1,2 +1 @@
-SHA512 (libgcrypt-1.11.2.tar.bz2) = b706cea602cc8f0896e57ce979643bf78974b05faec27c1b053b773c57d8b04250e30e95a4ef5899e1df981d01d8d08f0a36e10b5820a5ec4183e74c02e5f1f0
-SHA512 (libgcrypt-1.11.2.tar.bz2.sig) = e63d240a9b97aa218c98c5baa72a30321ae85412d4a8748e36578bd9498fe8c8ee2ba84835d1783cdfc1e5dfb66b0a89409d6263e9c06f4cd11e919d4bce0cd2
+99e0f2dc94dac6eceab709d03d613328  libgcrypt-1.5.3-hobbled.tar.xz
--- a/tests/smoke-test/Makefile
+++ b/tests/smoke-test/Makefile
@ -1,75 +0,0 @@
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Makefile of /CoreOS/libgcrypt/smoke-test
-#   Description: Test calls upstream test suite.
-#   Author: Ondrej Moris <omoris@redhat.com>
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Copyright (c) 2010 Red Hat, Inc. All rights reserved.
-#
-#   This copyrighted material is made available to anyone wishing
-#   to use, modify, copy, or redistribute it subject to the terms
-#   and conditions of the GNU General Public License version 2.
-#
-#   This program is distributed in the hope that it will be
-#   useful, but WITHOUT ANY WARRANTY; without even the implied
-#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
-#   PURPOSE. See the GNU General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public
-#   License along with this program; if not, write to the Free
-#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-#   Boston, MA 02110-1301, USA.
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-export TEST=/CoreOS/libgcrypt/smoke-test
-export TESTVERSION=1.0
-
-BUILT_FILES=
-
-FILES=$(METADATA) runtest.sh Makefile PURPOSE
-
-.PHONY: all install download clean
-
-run: $(FILES) build
-	./runtest.sh
-
-build: $(BUILT_FILES)
-	chmod a+x runtest.sh
-
-clean:
-	rm -f *~ $(BUILT_FILES)
-
-
-include /usr/share/rhts/lib/rhts-make.include
-
-$(METADATA): Makefile
-	@echo "Owner:           Ondrej Moris <omoris@redhat.com>" > $(METADATA)
-	@echo "Name:            $(TEST)" >> $(METADATA)
-	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
-	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
-	@echo "Description:     Test calls upstream test suite." >> $(METADATA)
-	@echo "Type:            Sanity" >> $(METADATA)
-	@echo "TestTime:        15m" >> $(METADATA)
-	@echo "RunFor:          libgcrypt" >> $(METADATA)
-	@echo "Requires:        libgcrypt" >> $(METADATA)
-	@echo "Requires:        nfs-utils" >> $(METADATA)
-	@echo "Requires:        rpm-build" >> $(METADATA)
-	@echo "Requires:        autoconf automake libtool" >> $(METADATA)
-	@echo "Requires:        gawk" >> $(METADATA)
-	@echo "Requires:        gcc-c++" >> $(METADATA)
-	@echo "Requires:        libgpg-error-devel" >> $(METADATA)
-	@echo "Requires:        pkgconfig texinfo fipscheck libkcapi-fipscheck" >> $(METADATA)
-	@echo "Requires:        crypto-policies-scripts" >> $(METADATA)
-	@echo "Requires:        bc" >> $(METADATA)
-	@echo "RhtsRequires:    library(distribution/fips)" >> $(METADATA)
-	@echo "Releases:        -RHEL3 -RHEL4" >> $(METADATA)
-	@echo "Priority:        Normal" >> $(METADATA)
-	@echo "Architectures:   i386 x86_64 s390x ia64" >> $(METADATA)
-	@echo "License:         GPLv2" >> $(METADATA)
-	@echo "Confidential:    no" >> $(METADATA)
-	@echo "Destructive:     no" >> $(METADATA)
-
-	rhts-lint $(METADATA)
--- a/tests/smoke-test/PURPOSE
+++ b/tests/smoke-test/PURPOSE
@ -1,3 +0,0 @@
-PURPOSE of /CoreOS/libgcrypt/Sanity/smoke-test
-Description: Test calls upstream test suite.
-Author: Ondrej Moris <omoris@redhat.com>
--- a/tests/smoke-test/main.fmf
+++ b/tests/smoke-test/main.fmf
@ -1,25 +0,0 @@
-summary: Test calls upstream test suite.
-test: ./runtest.sh
-enabled: true
-framework: beakerlib
-require:
-  - library(distribution/fips)
-recommend:
-  - libgcrypt
-  - nfs-utils
-  - rpm-build
-  - autoconf
-  - automake
-  - libtool
-  - gawk
-  - gcc-c++
-  - libgpg-error-devel
-  - pkgconfig
-  - texinfo
-  - fipscheck
-  - libkcapi-fipscheck
-  - crypto-policies-scripts
-  - bc
-  - annobin-annocheck
-  - gnupg2
-duration: 45m
--- a/tests/smoke-test/runtest.sh
+++ b/tests/smoke-test/runtest.sh
@ -1,145 +0,0 @@
-#!/bin/bash
-# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   runtest.sh of /CoreOS/libgcrypt/smoke-test
-#   Description: Test calls upstream test suite.
-#   Author: Ondrej Moris <omoris@redhat.com>
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Copyright (c) 2010 Red Hat, Inc. All rights reserved.
-#
-#   This copyrighted material is made available to anyone wishing
-#   to use, modify, copy, or redistribute it subject to the terms
-#   and conditions of the GNU General Public License version 2.
-#
-#   This program is distributed in the hope that it will be
-#   useful, but WITHOUT ANY WARRANTY; without even the implied
-#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
-#   PURPOSE. See the GNU General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public
-#   License along with this program; if not, write to the Free
-#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-#   Boston, MA 02110-1301, USA.
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-. /usr/share/beakerlib/beakerlib.sh
-
-PACKAGE="libgcrypt"
-
-rlJournalStart
-
-    rlPhaseStartSetup
-        rlImport distribution/fips || rlFail "FIPS library needed for some phases"
-        TmpDir=`mktemp -d`
-        rlAssertRpm $PACKAGE
-        rlRun "rlFileBackup --clean /etc/gcrypt/fips_enabled"
-        if [[ -r /etc/gcrypt/hwf.deny ]]; then
-            rlRun "rlFileBackup /etc/gcrypt/hwf.deny"
-            rlRun "rm -f /etc/gcrypt/hwf.deny"
-        fi
-        rlRun "pushd $TmpDir" 0
-        rlRun "rlFetchSrcForInstalled $PACKAGE"
-        rlRun "rpm -ihv `ls *.rpm`" 0
-        if grep '1' /proc/sys/crypto/fips_enabled; then
-            rlRun "echo '1' > /etc/gcrypt/fips_enabled" 0
-        fi
-    rlPhaseEnd
-
-    rlPhaseStartTest "Package build"
-        TOPDIR=`rpm --eval %_topdir`
-        rlRun "pushd $TOPDIR" 0
-        rlRun "rm -rf BUILD/libgcrypt-*" 0-255
-        rlRun "rpmbuild -vv -bc SPECS/libgcrypt.spec" 0
-        libgcrypt_dir="libgcrypt-`rpm -q --qf "%{VERSION}\n" libgcrypt | head -1`"
-        if [ -d "BUILD/$libgcrypt_dir-build" ]; then
-            BUILDDIR="BUILD/$libgcrypt_dir-build/$libgcrypt_dir"
-        else
-            BUILDDIR="BUILD/$libgcrypt_dir"
-        fi
-        rlRun "pushd $BUILDDIR" 0
-        rlRun "fipshmac src/.libs/libgcrypt.so.??" 0
-        rlRun "popd"
-        rlRun "popd"
-    rlPhaseEnd
-
-    rlPhaseStartTest "Upstream testsuite"
-        rlRun "pushd $TOPDIR/$BUILDDIR" 0
-        exp_fails=()
-
-        rlRun "echo 'Expecting ${#exp_fails[@]} fails'"
-        exp_exitcode=0
-        if [[ ${#exp_fails[@]} -gt 0 ]]; then exp_exitcode=2; fi
-        rlRun "make check &> $TmpDir/make_check.out" $exp_exitcode
-        rlRun "grep ^FAIL: $TmpDir/make_check.out" 0,1 "Print fails"
-        if [[ ${#exp_fails[@]} -gt 0 ]]; then
-            for f in $(grep '^FAIL:' $TmpDir/make_check.out | awk -F ': ' '{print $2}'); do
-                if [[ "${exp_fails[@]}" =~ "$f" ]]; then
-                    rlLog "$f failure is expected"
-                else
-                    rlFail "$f failure is not expected"
-                fi
-            done
-        else
-            rlRun "grep \"All [0-9]\+ tests passed\" $TmpDir/make_check.out" 0 \
-                "All tests passed"
-        fi
-        rlRun "cat $TmpDir/make_check.out"
-        rlRun "popd"
-    rlPhaseEnd
-
-    if ! (rlIsRHEL '<=8.4' || ([[ $fipsMode = "enabled" ]] &&  rlIsFedora '<37')); then
-    # (we are ~expecting to fix HW optimization problem around Fedora-37)
-    rlPhaseStartTest "Performance with HW optimizations disabled - bz1990059"
-        # we are gathering more samples, so that this test is robust in shared environments
-        N_SAMPLES=5
-        N_MEDIAN=$(echo "$N_SAMPLES/2+1" |bc)
-        HWF_DENY_FILE="/etc/gcrypt/hwf.deny"
-        # Disabling via cmdline arguments would need either handpicking
-        # all the algorithms (variant with ":"), or making "all" work.
-        # "--disable-hwf all" does not work: https://dev.gnupg.org/T5636
-        #dis_arg="--disable-hwf all"
-        dis_arg=""
-
-        for x in "cipher:aes256:CBC enc" "hash:sha256:SHA256" "mac:hmac_sha256:HMAC_SHA256"; do
-            alg_type=$(echo $x |cut -d: -f1)
-            algorithm=$(echo $x |cut -d: -f2)
-            alg_line=$(echo $x |cut -d: -f3)
-            rlRun "rm -f $algorithm.ena $algorithm.dis"
-            rlLogInfo "Performance measurements started ..."
-            for i in `seq 1 $N_SAMPLES`; do
-                # run with HW optimizations ENAbled
-                rm -f $HWF_DENY_FILE
-                $TOPDIR/$BUILDDIR/tests/bench-slope $alg_type $algorithm |grep "$alg_line" >>$algorithm.ena
-
-                # run with HW optimizations DISabled
-                # this looks idiotic, but I wasn't able to make --disable-hwf work
-                echo "all" >$HWF_DENY_FILE
-                $TOPDIR/$BUILDDIR/tests/bench-slope $dis_arg $alg_type $algorithm |grep "$alg_line" >>$algorithm.dis
-            done
-            rlLogInfo "Performance measurements finished"
-            rlRun "cat $algorithm.ena"
-            rlRun "cat $algorithm.dis"
-            dis=$(cat $algorithm.dis |cut -d'|' -f2 |awk '{ print $1 }' |sort -n |sed -n "$N_MEDIAN p")
-            ena=$(cat $algorithm.ena |cut -d'|' -f2 |awk '{ print $1 }' |sort -n |sed -n "$N_MEDIAN p")
-            rlRun "echo '$algorithm Time: disabled $dis enabled $ena'"
-            if (( $(echo "$dis > $ena" |bc -l) )); then
-                rlPass "HW optimizations work for $algorithm"
-            else
-                rlFail "HW optimizations DO NOT work for $algorithm"
-            fi
-        done
-    rlPhaseEnd
-    fi
-
-    rlPhaseStartCleanup
-        rlRun "popd"
-        rlRun "rm -r $TmpDir" 0
-        rlRun "rlFileRestore"
-    rlPhaseEnd
-
-rlJournalPrintText
-rlJournalEnd
--- a/wk@g10code.com
+++ b/wk@g10code.com