new upstream version 1.7.9

.fmf/version

@@ -1 +0,0 @@
-1

.gitignore

@@ -15,30 +15,4 @@ libgcrypt-1.4.5-hobbled.tar.bz2
 /libgcrypt-1.7.6-hobbled.tar.xz
 /libgcrypt-1.7.7-hobbled.tar.xz
 /libgcrypt-1.7.8-hobbled.tar.xz
-/libgcrypt-1.8.0-hobbled.tar.xz
-/libgcrypt-1.8.1-hobbled.tar.xz
-/libgcrypt-1.8.2-hobbled.tar.xz
-/libgcrypt-1.8.3-hobbled.tar.xz
-/libgcrypt-1.8.4-hobbled.tar.xz
-/libgcrypt-1.8.5-hobbled.tar.xz
-/libgcrypt-1.8.6-hobbled.tar.xz
-/libgcrypt-1.8.7-hobbled.tar.xz
-/libgcrypt-1.9.0-hobbled.tar.xz
-/libgcrypt-1.9.1-hobbled.tar.xz
-/libgcrypt-1.9.2-hobbled.tar.xz
-/libgcrypt-1.9.3-hobbled.tar.xz
-/libgcrypt-1.9.4-hobbled.tar.xz
-/libgcrypt-1.10.0.tar.bz2
-/libgcrypt-1.10.0.tar.bz2.sig
-/libgcrypt-1.10.1.tar.bz2
-/libgcrypt-1.10.1.tar.bz2.sig
-/libgcrypt-1.10.2.tar.bz2
-/libgcrypt-1.10.2.tar.bz2.sig
-/libgcrypt-1.10.3.tar.bz2
-/libgcrypt-1.10.3.tar.bz2.sig
-/libgcrypt-1.11.0.tar.bz2
-/libgcrypt-1.11.0.tar.bz2.sig
-/libgcrypt-1.11.1.tar.bz2
-/libgcrypt-1.11.1.tar.bz2.sig
-/libgcrypt-1.11.2.tar.bz2
-/libgcrypt-1.11.2.tar.bz2.sig
+/libgcrypt-1.7.9-hobbled.tar.xz

curves.c

@@ -0,0 +1,167 @@
+/* curves.c -  ECC curves regression tests
+ *	Copyright (C) 2011 Free Software Foundation, Inc.
+ *
+ * This file is part of Libgcrypt.
+ *
+ * Libgcrypt is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * Libgcrypt is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdarg.h>
+
+#include "../src/gcrypt-int.h"
+
+/* Number of curves defined in ../cipger/ecc.c */
+#define N_CURVES 14
+
+/* A real world sample public key.  */
+static char const sample_key_1[] =
+"(public-key\n"
+" (ecdsa\n"
+"  (p #00FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF#)\n"
+"  (a #00FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC#)\n"
+"  (b #5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B#)\n"
+"  (g #046B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C296"
+        "4FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5#)\n"
+"  (n #00FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551#)\n"
+"  (h #000000000000000000000000000000000000000000000000000000000000000001#)\n"
+"  (q #0442B927242237639A36CE9221B340DB1A9AB76DF2FE3E171277F6A4023DED146EE"
+      "86525E38CCECFF3FB8D152CC6334F70D23A525175C1BCBDDE6E023B2228770E#)\n"
+"  ))";
+static char const sample_key_1_curve[] = "NIST P-256";
+static unsigned int sample_key_1_nbits = 256;
+
+/* Program option flags.  */
+static int verbose;
+static int error_count;
+
+static void
+fail (const char *format, ...)
+{
+  va_list arg_ptr;
+
+  va_start (arg_ptr, format);
+  vfprintf (stderr, format, arg_ptr);
+  va_end (arg_ptr);
+  error_count++;
+}
+
+static void
+die (const char *format, ...)
+{
+  va_list arg_ptr;
+
+  va_start (arg_ptr, format);
+  vfprintf (stderr, format, arg_ptr);
+  va_end (arg_ptr);
+  exit (1);
+}
+
+
+static void
+list_curves (void)
+{
+  int idx;
+  const char *name;
+  unsigned int nbits;
+
+  for (idx=0; (name = gcry_pk_get_curve (NULL, idx, &nbits)); idx++)
+    {
+      if (verbose)
+        printf ("%s - %u bits\n", name, nbits);
+    }
+  if (idx != N_CURVES)
+    fail ("expected %d curves but got %d\n", N_CURVES, idx);
+  if (gcry_pk_get_curve (NULL, -1, NULL))
+    fail ("curve iteration failed\n");
+}
+
+
+static void
+check_matching (void)
+{
+  gpg_error_t err;
+  gcry_sexp_t key;
+  const char *name;
+  unsigned int nbits;
+
+  err = gcry_sexp_new (&key, sample_key_1, 0, 1);
+  if (err)
+    die ("parsing s-expression string failed: %s\n", gpg_strerror (err));
+  name = gcry_pk_get_curve (key, 0, &nbits);
+  if (!name)
+    fail ("curve name not found for sample_key_1\n");
+  else if (strcmp (name, sample_key_1_curve))
+    fail ("expected curve name %s but got %s for sample_key_1\n",
+          sample_key_1_curve, name);
+  else if (nbits != sample_key_1_nbits)
+    fail ("expected curve size %u but got %u for sample_key_1\n",
+          sample_key_1_nbits, nbits);
+
+  gcry_sexp_release (key);
+
+}
+
+
+static void
+check_get_params (void)
+{
+  gcry_sexp_t param;
+  const char *name;
+
+  param = gcry_pk_get_param (GCRY_PK_ECDSA, sample_key_1_curve);
+  if (!param)
+    fail ("error gerring parameters for `%s'\n", sample_key_1_curve);
+
+  name = gcry_pk_get_curve (param, 0, NULL);
+  if (!name)
+    fail ("get_param: curve name not found for sample_key_1\n");
+  else if (strcmp (name, sample_key_1_curve))
+    fail ("get_param: expected curve name %s but got %s for sample_key_1\n",
+          sample_key_1_curve, name);
+
+  gcry_sexp_release (param);
+
+}
+
+
+int
+main (int argc, char **argv)
+{
+  int debug = 0;
+
+  if (argc > 1 && !strcmp (argv[1], "--verbose"))
+    verbose = 1;
+  else if (argc > 1 && !strcmp (argv[1], "--debug"))
+    verbose = debug = 1;
+
+  if (!gcry_check_version (GCRYPT_VERSION))
+    die ("version mismatch\n");
+
+  gcry_control (GCRYCTL_DISABLE_SECMEM, 0);
+  gcry_control (GCRYCTL_INITIALIZATION_FINISHED, 0);
+  if (debug)
+    gcry_control (GCRYCTL_SET_DEBUG_FLAGS, 1u, 0);
+  list_curves ();
+  check_matching ();
+  check_get_params ();
+
+  return error_count ? 1 : 0;
+}

hobble-libgcrypt

@@ -0,0 +1,11 @@
+#!/bin/sh
+
+# Quit out if anything fails.
+set -e -x
+
+# Clean out patent-or-otherwise-encumbered code.
+# EC:    ????????? ??/??/2015
+
+rm -f cipher/ecc-curves.c
+rm -f tests/curves.c
+rm -f tests/t-mpi-point.c

libgcrypt-1.10.1-annobin.patch

@@ -1,22 +0,0 @@
-diff -rup libgcrypt.orig/src/Makefile.am libgcrypt-1.8.3/src/Makefile.am
---- libgcrypt.orig/src/Makefile.am	2021-10-18 16:36:20.914025497 +0100
-+++ libgcrypt-1.8.3/src/Makefile.am	2021-10-19 12:23:08.652960618 +0100
-@@ -108,6 +108,7 @@ endif !HAVE_W32_SYSTEM
- 
- 
- libgcrypt_la_LDFLAGS = $(no_undefined) $(export_symbols) $(extra_ltoptions) \
-+	-Wc,-fplugin=annobin \
- 	$(libgcrypt_version_script_cmd) -version-info \
- 	@LIBGCRYPT_LT_CURRENT@:@LIBGCRYPT_LT_REVISION@:@LIBGCRYPT_LT_AGE@
- libgcrypt_la_DEPENDENCIES = \
-Only in libgcrypt-1.8.3/src: Makefile.am.annobin
-diff -rup libgcrypt.orig/src/Makefile.in libgcrypt-1.8.3/src/Makefile.in
---- libgcrypt.orig/src/Makefile.in	2021-10-18 16:36:20.914025497 +0100
-+++ libgcrypt-1.8.3/src/Makefile.in	2021-10-19 12:23:37.791875325 +0100
-@@ -483,6 +483,7 @@ gcrypt_hwf_modules = @GCRYPT_HWF_MODULES
- @HAVE_W32_SYSTEM_TRUE@gcrypt_deps = $(gcrypt_res) libgcrypt.def
- @HAVE_W32_SYSTEM_FALSE@gcrypt_res_ldflag = 
- libgcrypt_la_LDFLAGS = $(no_undefined) $(export_symbols) $(extra_ltoptions) \
-+	-Wc,-fplugin=annobin \
- 	$(libgcrypt_version_script_cmd) -version-info \
- 	@LIBGCRYPT_LT_CURRENT@:@LIBGCRYPT_LT_REVISION@:@LIBGCRYPT_LT_AGE@

libgcrypt-1.6.1-mpicoder-gccopt.patch

@@ -0,0 +1,104 @@
+diff -up libgcrypt-1.6.1/mpi/mpicoder.c.gccopt libgcrypt-1.6.1/mpi/mpicoder.c
+--- libgcrypt-1.6.1/mpi/mpicoder.c.gccopt	2014-02-28 15:37:53.983139821 +0100
++++ libgcrypt-1.6.1/mpi/mpicoder.c	2014-02-28 15:47:35.312576387 +0100
+@@ -627,16 +627,16 @@ _gcry_mpi_print (enum gcry_mpi_format fo
+           extra = 1;
+ 	}
+ 
+-      if (buffer && n > len)
+-        {
+-          /* The provided buffer is too short. */
+-          xfree (tmp);
+-          return GPG_ERR_TOO_SHORT;
+-	}
+       if (buffer)
+         {
+           unsigned char *s = buffer;
+ 
++          if (n > len)
++            {
++              /* The provided buffer is too short. */
++              xfree (tmp);
++              return GPG_ERR_TOO_SHORT;
++            }
+           if (extra == 1)
+             *s++ = 0;
+           else if (extra)
+@@ -654,13 +654,12 @@ _gcry_mpi_print (enum gcry_mpi_format fo
+       /* Note:  We ignore the sign for this format.  */
+       /* FIXME: for performance reasons we should put this into
+ 	 mpi_aprint because we can then use the buffer directly.  */
+-
+-      if (buffer && n > len)
+-        return GPG_ERR_TOO_SHORT;
+       if (buffer)
+         {
+           unsigned char *tmp;
+ 
++          if (n > len)
++            return GPG_ERR_TOO_SHORT;
+           tmp = _gcry_mpi_get_buffer (a, 0, &n, NULL);
+           if (!tmp)
+             return gpg_err_code_from_syserror ();
+@@ -678,14 +677,14 @@ _gcry_mpi_print (enum gcry_mpi_format fo
+       if (negative)
+         return GPG_ERR_INV_ARG;
+ 
+-      if (buffer && n+2 > len)
+-        return GPG_ERR_TOO_SHORT;
+-
+       if (buffer)
+         {
+           unsigned char *tmp;
+           unsigned char *s = buffer;
+ 
++          if (n+2 > len)
++            return GPG_ERR_TOO_SHORT;
++
+           s[0] = nbits >> 8;
+           s[1] = nbits;
+ 
+@@ -724,16 +723,16 @@ _gcry_mpi_print (enum gcry_mpi_format fo
+           extra=1;
+ 	}
+ 
+-      if (buffer && n+4 > len)
+-        {
+-          xfree(tmp);
+-          return GPG_ERR_TOO_SHORT;
+-	}
+-
+       if (buffer)
+         {
+           unsigned char *s = buffer;
+ 
++          if (n+4 > len)
++            {
++              xfree(tmp);
++              return GPG_ERR_TOO_SHORT;
++            }
++
+           *s++ = n >> 24;
+           *s++ = n >> 16;
+           *s++ = n >> 8;
+@@ -761,15 +760,15 @@ _gcry_mpi_print (enum gcry_mpi_format fo
+       if (!n || (*tmp & 0x80))
+         extra = 2;
+ 
+-      if (buffer && 2*n + extra + negative + 1 > len)
+-        {
+-          xfree(tmp);
+-          return GPG_ERR_TOO_SHORT;
+-	}
+       if (buffer)
+         {
+           unsigned char *s = buffer;
+ 
++          if (2*n + extra + negative + 1 > len)
++            {
++              xfree(tmp);
++              return GPG_ERR_TOO_SHORT;
++	    }
+           if (negative)
+             *s++ = '-';
+           if (extra)

libgcrypt-1.6.2-fips-ctor.patch

@@ -0,0 +1,74 @@
+diff -up libgcrypt-1.6.2/cipher/md.c.fips-ctor libgcrypt-1.6.2/cipher/md.c
+--- libgcrypt-1.6.2/cipher/md.c.fips-ctor	2014-08-21 14:50:39.000000000 +0200
++++ libgcrypt-1.6.2/cipher/md.c	2015-02-25 13:57:21.175704866 +0100
+@@ -413,11 +413,8 @@ md_enable (gcry_md_hd_t hd, int algorith
+ 
+   if (!err && algorithm == GCRY_MD_MD5 && fips_mode ())
+     {
+-      _gcry_inactivate_fips_mode ("MD5 used");
+       if (_gcry_enforced_fips_mode () )
+         {
+-          /* We should never get to here because we do not register
+-             MD5 in enforced fips mode. But better throw an error.  */
+           err = GPG_ERR_DIGEST_ALGO;
+         }
+     }
+diff -up libgcrypt-1.6.2/src/global.c.fips-ctor libgcrypt-1.6.2/src/global.c
+--- libgcrypt-1.6.2/src/global.c.fips-ctor	2015-02-25 13:57:21.174704842 +0100
++++ libgcrypt-1.6.2/src/global.c	2015-02-25 14:03:07.066864208 +0100
+@@ -132,6 +132,36 @@ global_init (void)
+ }
+ 
+ 
++#ifndef FIPS_MODULE_PATH
++#define FIPS_MODULE_PATH "/etc/system-fips"
++#endif
++
++void __attribute__ ((constructor)) _gcry_global_constructor (void)
++{
++  int rv;
++
++  rv = access (FIPS_MODULE_PATH, F_OK);
++  if (rv < 0 && errno != ENOENT)
++    rv = 0;
++
++  if (!rv)
++    {
++      int no_secmem_save;
++
++      /* it should be always 0 at this point but let's keep on the safe side */
++      no_secmem_save = no_secure_memory;
++      no_secure_memory = 1;
++      /* force selftests */
++      global_init ();
++      if (fips_mode ())
++         _gcry_random_initialize (1);
++      _gcry_fips_run_selftests (0);
++      if (!fips_mode())
++         _gcry_random_close_fds ();
++      no_secure_memory = no_secmem_save;
++    }
++}
++
+ /* This function is called by the macro fips_is_operational and makes
+    sure that the minimal initialization has been done.  This is far
+    from a perfect solution and hides problems with an improper
+@@ -542,8 +572,7 @@ _gcry_vcontrol (enum gcry_ctl_cmds cmd,
+ 
+     case GCRYCTL_FIPS_MODE_P:
+       if (fips_mode ()
+-          && !_gcry_is_fips_mode_inactive ()
+-          && !no_secure_memory)
++          && !_gcry_is_fips_mode_inactive ())
+ 	rc = GPG_ERR_GENERAL; /* Used as TRUE value */
+       break;
+ 
+@@ -635,7 +664,7 @@ _gcry_vcontrol (enum gcry_ctl_cmds cmd,
+       break;
+ 
+     case GCRYCTL_SET_ENFORCED_FIPS_FLAG:
+-      if (!any_init_done)
++      if (fips_mode ())
+         {
+           /* Not yet initialized at all.  Set the enforced fips mode flag */
+           _gcry_set_preferred_rng_type (0);

libgcrypt-1.6.2-use-fipscheck.patch

@@ -0,0 +1,87 @@
+diff -up libgcrypt-1.6.2/src/fips.c.use-fipscheck libgcrypt-1.6.2/src/fips.c
+--- libgcrypt-1.6.2/src/fips.c.use-fipscheck	2014-08-21 14:50:39.000000000 +0200
++++ libgcrypt-1.6.2/src/fips.c	2014-09-26 11:42:20.999588282 +0200
+@@ -578,23 +578,48 @@ run_random_selftests (void)
+   return !!err;
+ }
+ 
++static int
++get_library_path(const char *libname, const char *symbolname, char *path, size_t pathlen)
++{
++    Dl_info info;
++    void *dl, *sym;
++    int rv = -1;
++
++        dl = dlopen(libname, RTLD_LAZY);
++        if (dl == NULL) {
++            return -1;
++        }       
++
++    sym = dlsym(dl, symbolname);
++
++    if (sym != NULL && dladdr(sym, &info)) {
++	strncpy(path, info.dli_fname, pathlen-1);
++	path[pathlen-1] = '\0';
++	rv = 0;
++    }
++
++    dlclose(dl);	
++    
++    return rv;
++}
++
+ /* Run an integrity check on the binary.  Returns 0 on success.  */
+ static int
+ check_binary_integrity (void)
+ {
+ #ifdef ENABLE_HMAC_BINARY_CHECK
+   gpg_error_t err;
+-  Dl_info info;
++  char libpath[4096];
+   unsigned char digest[32];
+   int dlen;
+   char *fname = NULL;
+-  const char key[] = "What am I, a doctor or a moonshuttle conductor?";
+-
+-  if (!dladdr ("gcry_check_version", &info))
++  const char key[] = "orboDeJITITejsirpADONivirpUkvarP";
++  
++  if (get_library_path ("libgcrypt.so.20", "gcry_check_version", libpath, sizeof(libpath)))
+     err = gpg_error_from_syserror ();
+   else
+     {
+-      dlen = _gcry_hmac256_file (digest, sizeof digest, info.dli_fname,
++      dlen = _gcry_hmac256_file (digest, sizeof digest, libpath,
+                                  key, strlen (key));
+       if (dlen < 0)
+         err = gpg_error_from_syserror ();
+@@ -602,7 +627,7 @@ check_binary_integrity (void)
+         err = gpg_error (GPG_ERR_INTERNAL);
+       else
+         {
+-          fname = xtrymalloc (strlen (info.dli_fname) + 1 + 5 + 1 );
++          fname = xtrymalloc (strlen (libpath) + 1 + 5 + 1 );
+           if (!fname)
+             err = gpg_error_from_syserror ();
+           else
+@@ -611,7 +636,7 @@ check_binary_integrity (void)
+               char *p;
+ 
+               /* Prefix the basename with a dot.  */
+-              strcpy (fname, info.dli_fname);
++              strcpy (fname, libpath);
+               p = strrchr (fname, '/');
+               if (p)
+                 p++;
+diff -up libgcrypt-1.6.2/src/Makefile.in.use-fipscheck libgcrypt-1.6.2/src/Makefile.in
+--- libgcrypt-1.6.2/src/Makefile.in.use-fipscheck	2014-08-21 15:14:08.000000000 +0200
++++ libgcrypt-1.6.2/src/Makefile.in	2014-09-26 11:41:13.271059281 +0200
+@@ -449,7 +449,7 @@ libgcrypt_la_LIBADD = $(gcrypt_res) \
+ 	../cipher/libcipher.la \
+ 	../random/librandom.la \
+ 	../mpi/libmpi.la \
+-	../compat/libcompat.la  $(GPG_ERROR_LIBS)
++	../compat/libcompat.la  $(GPG_ERROR_LIBS) -ldl
+ 
+ dumpsexp_SOURCES = dumpsexp.c
+ dumpsexp_CFLAGS = $(arch_gpg_error_cflags)

libgcrypt-1.6.3-urandom-only.patch

@@ -0,0 +1,29 @@
+diff -up libgcrypt-1.6.3/random/random-csprng.c.urandom-only libgcrypt-1.6.3/random/random-csprng.c
+--- libgcrypt-1.6.3/random/random-csprng.c.urandom-only	2015-02-27 10:54:03.000000000 +0100
++++ libgcrypt-1.6.3/random/random-csprng.c	2015-03-20 08:29:27.513113519 +0100
+@@ -1125,8 +1125,7 @@ getfnc_gather_random (void))(void (*)(co
+              enum random_origins, size_t, int);
+ 
+ #if USE_RNDLINUX
+-  if ( !access (NAME_OF_DEV_RANDOM, R_OK)
+-       && !access (NAME_OF_DEV_URANDOM, R_OK))
++  if (!access (NAME_OF_DEV_URANDOM, R_OK))
+     {
+       fnc = _gcry_rndlinux_gather_random;
+       return fnc;
+diff -up libgcrypt-1.6.3/random/rndlinux.c.urandom-only libgcrypt-1.6.3/random/rndlinux.c
+--- libgcrypt-1.6.3/random/rndlinux.c.urandom-only	2015-03-20 08:36:13.472098269 +0100
++++ libgcrypt-1.6.3/random/rndlinux.c	2015-03-20 08:36:43.765097131 +0100
+@@ -178,7 +178,11 @@ _gcry_rndlinux_gather_random (void (*add
+     {
+       if (fd_random == -1)
+         {
+-          fd_random = open_device (NAME_OF_DEV_RANDOM, (ever_opened & 1), 1);
++          /* We try to open /dev/random first but in case the open fails
++             we gracefully retry with /dev/urandom. */
++          fd_random = open_device (NAME_OF_DEV_RANDOM, 0, 0);
++          if (fd_random == -1)
++            fd_random = open_device (NAME_OF_DEV_URANDOM, (ever_opened & 1), 1);
+           ever_opened |= 1;
+         }
+       fd = fd_random;

libgcrypt-1.7.3-aliasing.patch

@@ -0,0 +1,24 @@
+diff -up libgcrypt-1.7.3/cipher/bufhelp.h.aliasing libgcrypt-1.7.3/cipher/bufhelp.h
+--- libgcrypt-1.7.3/cipher/bufhelp.h.aliasing	2016-04-07 17:30:08.000000000 +0200
++++ libgcrypt-1.7.3/cipher/bufhelp.h	2016-11-22 17:00:13.065692916 +0100
+@@ -35,6 +35,11 @@
+ # define BUFHELP_FAST_UNALIGNED_ACCESS 1
+ #endif
+ 
++#if _GCRY_GCC_VERSION >= 40400
++# pragma GCC push_options
++# pragma GCC optimize ("no-strict-aliasing")
++#endif
++
+ 
+ #ifdef BUFHELP_FAST_UNALIGNED_ACCESS
+ /* Define type with one-byte alignment on architectures with fast unaligned
+@@ -429,4 +434,8 @@ static inline void buf_put_le64(void *_b
+ 
+ #endif /*BUFHELP_FAST_UNALIGNED_ACCESS*/
+ 
++#if _GCRY_GCC_VERSION >= 40400
++# pragma GCC pop_options
++#endif
++
+ #endif /*GCRYPT_BUFHELP_H*/

libgcrypt-1.7.3-ecc-test-fix.patch

@@ -0,0 +1,122 @@
+diff -up libgcrypt-1.7.3/tests/benchmark.c.eccfix libgcrypt-1.7.3/tests/benchmark.c
+--- libgcrypt-1.7.3/tests/benchmark.c.eccfix	2016-07-14 11:19:17.000000000 +0200
++++ libgcrypt-1.7.3/tests/benchmark.c	2016-11-22 16:21:00.109004197 +0100
+@@ -1412,7 +1412,7 @@ ecc_bench (int iterations, int print_hea
+ {
+ #if USE_ECC
+   gpg_error_t err;
+-  const char *p_sizes[] = { "192", "224", "256", "384", "521", "Ed25519",
++  const char *p_sizes[] = { "224", "256", "384", "521", "Ed25519",
+               "gost256", "gost512" };
+   int testno;
+ 
+diff -up libgcrypt-1.7.3/tests/dsa-rfc6979.c.eccfix libgcrypt-1.7.3/tests/dsa-rfc6979.c
+--- libgcrypt-1.7.3/tests/dsa-rfc6979.c.eccfix	2016-02-18 09:38:03.000000000 +0100
++++ libgcrypt-1.7.3/tests/dsa-rfc6979.c	2016-11-22 16:22:11.804674008 +0100
+@@ -210,16 +210,6 @@ check_dsa_rfc6979 (void)
+       " ))"
+     },
+     {
+-      "ECDSA, 192 bits (prime field)",
+-      "(private-key"
+-      " (ecdsa"
+-      " (curve \"NIST P-192\")"
+-      " (q #04AC2C77F529F91689FEA0EA5EFEC7F210D8EEA0B9E047ED56"
+-      "       3BC723E57670BD4887EBC732C523063D0A7C957BC97C1C43#)"
+-      " (d #6FAB034934E4C0FC9AE67F5B5659A9D7D1FEFD187EE09FD4#)"
+-      " ))"
+-    },
+-    {
+       "ECDSA, 224 bits (prime field)",
+       "(private-key"
+       " (ecdsa"
+@@ -443,89 +433,6 @@ check_dsa_rfc6979 (void)
+       "C9F0BDABCC0D880BB137A994CC7F3980CE91CC10FAF529FC46565B15CEA854E1"
+     },
+     {
+-      "ECDSA, 192 bits (prime field)",
+-      "With SHA-1, message = \"sample\"",
+-      "sha1", "sample",
+-      "37D7CA00D2C7B0E5E412AC03BD44BA837FDD5B28CD3B0021",
+-      "98C6BD12B23EAF5E2A2045132086BE3EB8EBD62ABF6698FF",
+-      "57A22B07DEA9530F8DE9471B1DC6624472E8E2844BC25B64"
+-    },
+-    {
+-      "ECDSA, 192 bits (prime field)",
+-      "With SHA-224, message = \"sample\"",
+-      "sha224", "sample",
+-      "4381526B3FC1E7128F202E194505592F01D5FF4C5AF015D8",
+-      "A1F00DAD97AEEC91C95585F36200C65F3C01812AA60378F5",
+-      "E07EC1304C7C6C9DEBBE980B9692668F81D4DE7922A0F97A"
+-    },
+-    {
+-      "ECDSA, 192 bits (prime field)",
+-      "With SHA-256, message = \"sample\"",
+-      "sha256", "sample",
+-      "32B1B6D7D42A05CB449065727A84804FB1A3E34D8F261496",
+-      "4B0B8CE98A92866A2820E20AA6B75B56382E0F9BFD5ECB55",
+-      "CCDB006926EA9565CBADC840829D8C384E06DE1F1E381B85"
+-    },
+-    {
+-      "ECDSA, 192 bits (prime field)",
+-      "With SHA-384, message = \"sample\"",
+-      "sha384", "sample",
+-      "4730005C4FCB01834C063A7B6760096DBE284B8252EF4311",
+-      "DA63BF0B9ABCF948FBB1E9167F136145F7A20426DCC287D5",
+-      "C3AA2C960972BD7A2003A57E1C4C77F0578F8AE95E31EC5E"
+-    },
+-    {
+-      "ECDSA, 192 bits (prime field)",
+-      "With SHA-512, message = \"sample\"",
+-      "sha512", "sample",
+-      "A2AC7AB055E4F20692D49209544C203A7D1F2C0BFBC75DB1",
+-      "4D60C5AB1996BD848343B31C00850205E2EA6922DAC2E4B8",
+-      "3F6E837448F027A1BF4B34E796E32A811CBB4050908D8F67"
+-    },
+-    {
+-      "ECDSA, 192 bits (prime field)",
+-      "With SHA-1, message = \"test\"",
+-      "sha1", "test",
+-      "D9CF9C3D3297D3260773A1DA7418DB5537AB8DD93DE7FA25",
+-      "0F2141A0EBBC44D2E1AF90A50EBCFCE5E197B3B7D4DE036D",
+-      "EB18BC9E1F3D7387500CB99CF5F7C157070A8961E38700B7"
+-    },
+-    {
+-      "ECDSA, 192 bits (prime field)",
+-      "With SHA-224, message = \"test\"",
+-      "sha224", "test",
+-      "F5DC805F76EF851800700CCE82E7B98D8911B7D510059FBE",
+-      "6945A1C1D1B2206B8145548F633BB61CEF04891BAF26ED34",
+-      "B7FB7FDFC339C0B9BD61A9F5A8EAF9BE58FC5CBA2CB15293"
+-    },
+-    {
+-      "ECDSA, 192 bits (prime field)",
+-      "With SHA-256, message = \"test\"",
+-      "sha256", "test",
+-      "5C4CE89CF56D9E7C77C8585339B006B97B5F0680B4306C6C",
+-      "3A718BD8B4926C3B52EE6BBE67EF79B18CB6EB62B1AD97AE",
+-      "5662E6848A4A19B1F1AE2F72ACD4B8BBE50F1EAC65D9124F"
+-    },
+-    {
+-      "ECDSA, 192 bits (prime field)",
+-      "With SHA-384, message = \"test\"",
+-      "sha384", "test",
+-      "5AFEFB5D3393261B828DB6C91FBC68C230727B030C975693",
+-      "B234B60B4DB75A733E19280A7A6034BD6B1EE88AF5332367",
+-      "7994090B2D59BB782BE57E74A44C9A1C700413F8ABEFE77A"
+-    },
+-    {
+-      "ECDSA, 192 bits (prime field)",
+-      "With SHA-512, message = \"test\"",
+-      "sha512", "test",
+-      "0758753A5254759C7CFBAD2E2D9B0792EEE44136C9480527",
+-      "FE4F4AE86A58B6507946715934FE2D8FF9D95B6B098FE739",
+-      "74CF5605C98FBA0E1EF34D4B5A1577A7DCF59457CAE52290"
+-    },
+-
+-
+-
+-    {
+       "ECDSA, 224 bits (prime field)",
+       "With SHA-1, message = \"sample\"",
+       "sha1", "sample",

libgcrypt-1.7.3-fips-cfgrandom.patch

@@ -0,0 +1,104 @@
+diff -up libgcrypt-1.7.3/random/random-drbg.c.cfgrandom libgcrypt-1.7.3/random/random-drbg.c
+--- libgcrypt-1.7.3/random/random-drbg.c.cfgrandom	2016-04-07 17:30:08.000000000 +0200
++++ libgcrypt-1.7.3/random/random-drbg.c	2016-11-22 15:54:02.227319203 +0100
+@@ -627,8 +627,13 @@ drbg_get_entropy (drbg_state_t drbg, uns
+   read_cb_size = len;
+   read_cb_len = 0;
+ #if USE_RNDLINUX
++  /* First read from /etc/gcrypt/rngseed if available */
++  _gcry_rndlinux_gather_random (drbg_read_cb, 0, len,
++				     -1);
++  read_cb_len = 0;
++  /* then use /dev/urandom. */
+   rc = _gcry_rndlinux_gather_random (drbg_read_cb, 0, len,
+-				     GCRY_VERY_STRONG_RANDOM);
++				     GCRY_STRONG_RANDOM);
+ #elif USE_RNDUNIX
+   rc = _gcry_rndunix_gather_random (drbg_read_cb, 0, len,
+ 				    GCRY_VERY_STRONG_RANDOM);
+diff -up libgcrypt-1.7.3/random/rndlinux.c.cfgrandom libgcrypt-1.7.3/random/rndlinux.c
+--- libgcrypt-1.7.3/random/rndlinux.c.cfgrandom	2016-07-14 11:19:17.000000000 +0200
++++ libgcrypt-1.7.3/random/rndlinux.c	2016-11-22 15:45:19.921141761 +0100
+@@ -40,7 +40,9 @@
+ #include "g10lib.h"
+ #include "rand-internal.h"
+ 
+-static int open_device (const char *name, int retry);
++#define NAME_OF_CFG_RNGSEED "/etc/gcrypt/rngseed"
++
++static int open_device (const char *name, int retry, int fatal);
+ 
+ 
+ static int
+@@ -63,7 +65,7 @@ set_cloexec_flag (int fd)
+  * a fatal error but retries until it is able to reopen the device.
+  */
+ static int
+-open_device (const char *name, int retry)
++open_device (const char *name, int retry, int fatal)
+ {
+   int fd;
+ 
+@@ -71,6 +73,8 @@ open_device (const char *name, int retry
+     _gcry_random_progress ("open_dev_random", 'X', 1, 0);
+  again:
+   fd = open (name, O_RDONLY);
++  if (fd == -1 && !fatal)
++      return fd;
+   if (fd == -1 && retry)
+     {
+       struct timeval tv;
+@@ -115,6 +119,7 @@ _gcry_rndlinux_gather_random (void (*add
+ {
+   static int fd_urandom = -1;
+   static int fd_random = -1;
++  static int fd_configured = -1;
+   static unsigned char ever_opened;
+   int fd;
+   int n;
+@@ -138,6 +143,11 @@ _gcry_rndlinux_gather_random (void (*add
+           close (fd_urandom);
+           fd_urandom = -1;
+         }
++      if (fd_configured != -1)
++        {
++          close (fd_configured);
++          fd_configured = -1;
++        }
+       return 0;
+     }
+ 
+@@ -165,20 +175,30 @@ _gcry_rndlinux_gather_random (void (*add
+      that we always require the device to be existent but want a more
+      graceful behaviour if the rarely needed close operation has been
+      used and the device needs to be re-opened later. */
++
++  if (level == -1)
++    {
++      if (fd_configured == -1)
++        fd_configured = open_device ( NAME_OF_CFG_RNGSEED, 0, 0 );
++      fd = fd_configured;
++      if (fd == -1)
++        return -1;
++    }
++
+   if (level >= 2)
+     {
+       if (fd_random == -1)
+         {
+-          fd_random = open_device (NAME_OF_DEV_RANDOM, (ever_opened & 1));
++          fd_random = open_device (NAME_OF_DEV_RANDOM, (ever_opened & 1), 1);
+           ever_opened |= 1;
+         }
+       fd = fd_random;
+     }
+-  else
++  else if (level != -1)
+     {
+       if (fd_urandom == -1)
+         {
+-          fd_urandom = open_device (NAME_OF_DEV_URANDOM, (ever_opened & 2));
++          fd_urandom = open_device (NAME_OF_DEV_URANDOM, (ever_opened & 2), 1);
+           ever_opened |= 2;
+         }
+       fd = fd_urandom;

libgcrypt-1.7.3-fips-reqs.patch

@@ -0,0 +1,35 @@
+diff -up libgcrypt-1.7.3/src/visibility.c.fips-reqs libgcrypt-1.7.3/src/visibility.c
+--- libgcrypt-1.7.3/src/visibility.c.fips-reqs	2016-03-23 12:59:34.000000000 +0100
++++ libgcrypt-1.7.3/src/visibility.c	2016-11-22 16:29:36.992042480 +0100
+@@ -1288,6 +1288,8 @@ gcry_kdf_derive (const void *passphrase,
+                  unsigned long iterations,
+                  size_t keysize, void *keybuffer)
+ {
++  if (!fips_is_operational ())
++    return gpg_error (fips_not_operational ());
+   return gpg_error (_gcry_kdf_derive (passphrase, passphraselen, algo, hashalgo,
+                                       salt, saltlen, iterations,
+                                       keysize, keybuffer));
+@@ -1343,6 +1345,13 @@ void
+ gcry_mpi_randomize (gcry_mpi_t w,
+                     unsigned int nbits, enum gcry_random_level level)
+ {
++  if (!fips_is_operational ())
++    {
++      (void)fips_not_operational ();
++      fips_signal_fatal_error ("called in non-operational state");
++      fips_noreturn ();
++    }
++
+   _gcry_mpi_randomize (w, nbits, level);
+ }
+ 
+@@ -1368,6 +1377,8 @@ gcry_prime_generate (gcry_mpi_t *prime,
+                      gcry_random_level_t random_level,
+                      unsigned int flags)
+ {
++  if (!fips_is_operational ())
++    return gpg_error (fips_not_operational ());
+   return gpg_error (_gcry_prime_generate (prime, prime_bits, factor_bits,
+                                           factors, cb_func, cb_arg,
+                                           random_level, flags));

libgcrypt-1.7.3-tests.patch

@@ -0,0 +1,115 @@
+diff -up libgcrypt-1.7.3/cipher/dsa.c.tests libgcrypt-1.7.3/cipher/dsa.c
+--- libgcrypt-1.7.3/cipher/dsa.c.tests	2016-04-07 17:30:08.000000000 +0200
++++ libgcrypt-1.7.3/cipher/dsa.c	2016-11-22 15:33:48.813026002 +0100
+@@ -457,11 +457,22 @@ generate_fips186 (DSA_secret_key *sk, un
+                                              &prime_q, &prime_p,
+                                              r_counter,
+                                              r_seed, r_seedlen);
+-      else
+-        ec = _gcry_generate_fips186_3_prime (nbits, qbits, NULL, 0,
++      else if (!domain->p || !domain->q)
++        ec = _gcry_generate_fips186_3_prime (nbits, qbits,
++                                             initial_seed.seed,
++                                             initial_seed.seedlen,
+                                              &prime_q, &prime_p,
+                                              r_counter,
+                                              r_seed, r_seedlen, NULL);
++      else
++        {
++          /* Domain parameters p and q are given; use them.  */
++          prime_p = mpi_copy (domain->p);
++          prime_q = mpi_copy (domain->q);
++          gcry_assert (mpi_get_nbits (prime_p) == nbits);
++          gcry_assert (mpi_get_nbits (prime_q) == qbits);
++          ec = 0;
++        }
+       sexp_release (initial_seed.sexp);
+       if (ec)
+         goto leave;
+@@ -855,13 +866,12 @@ dsa_generate (const gcry_sexp_t genparms
+       sexp_release (l1);
+       sexp_release (domainsexp);
+ 
+-      /* Check that all domain parameters are available.  */
+-      if (!domain.p || !domain.q || !domain.g)
++      /* Check that p and q domain parameters are available.  */
++      if (!domain.p || !domain.q || (!domain.g && !(flags & PUBKEY_FLAG_USE_FIPS186)))
+         {
+           _gcry_mpi_release (domain.p);
+           _gcry_mpi_release (domain.q);
+           _gcry_mpi_release (domain.g);
+-          sexp_release (deriveparms);
+           return GPG_ERR_MISSING_VALUE;
+         }
+ 
+diff -up libgcrypt-1.7.3/cipher/rsa.c.tests libgcrypt-1.7.3/cipher/rsa.c
+--- libgcrypt-1.7.3/cipher/rsa.c.tests	2016-07-14 11:19:17.000000000 +0200
++++ libgcrypt-1.7.3/cipher/rsa.c	2016-11-22 15:25:05.426838229 +0100
+@@ -696,7 +696,7 @@ generate_x931 (RSA_secret_key *sk, unsig
+ 
+   *swapped = 0;
+ 
+-  if (e_value == 1)   /* Alias for a secure value. */
++  if (e_value == 1 || e_value == 0)   /* Alias for a secure value. */
+     e_value = 65537;
+ 
+   /* Point 1 of section 4.1:  k = 1024 + 256s with S >= 0  */
+diff -up libgcrypt-1.7.3/tests/keygen.c.tests libgcrypt-1.7.3/tests/keygen.c
+--- libgcrypt-1.7.3/tests/keygen.c.tests	2016-04-07 17:30:08.000000000 +0200
++++ libgcrypt-1.7.3/tests/keygen.c	2016-11-22 15:25:33.178484464 +0100
+@@ -257,11 +257,11 @@ check_rsa_keys (void)
+ 
+ 
+   if (verbose)
+-    show ("creating 512 bit RSA key with e=257\n");
++    show ("creating 1024 bit RSA key with e=257\n");
+   rc = gcry_sexp_new (&keyparm,
+                       "(genkey\n"
+                       " (rsa\n"
+-                      "  (nbits 3:512)\n"
++                      "  (nbits 4:1024)\n"
+                       "  (rsa-use-e 3:257)\n"
+                       " ))", 0, 1);
+   if (rc)
+@@ -282,11 +282,11 @@ check_rsa_keys (void)
+   gcry_sexp_release (key);
+ 
+   if (verbose)
+-    show ("creating 512 bit RSA key with default e\n");
++    show ("creating 1024 bit RSA key with default e\n");
+   rc = gcry_sexp_new (&keyparm,
+                       "(genkey\n"
+                       " (rsa\n"
+-                      "  (nbits 3:512)\n"
++                      "  (nbits 4:1024)\n"
+                       "  (rsa-use-e 1:0)\n"
+                       " ))", 0, 1);
+   if (rc)
+@@ -366,12 +366,12 @@ check_dsa_keys (void)
+     }
+ 
+   if (verbose)
+-    show ("creating 1536 bit DSA key\n");
++    show ("creating 2048 bit DSA key\n");
+   rc = gcry_sexp_new (&keyparm,
+                       "(genkey\n"
+                       " (dsa\n"
+-                      "  (nbits 4:1536)\n"
+-                      "  (qbits 3:224)\n"
++                      "  (nbits 4:2048)\n"
++                      "  (qbits 3:256)\n"
+                       " ))", 0, 1);
+   if (rc)
+     die ("error creating S-expression: %s\n", gpg_strerror (rc));
+diff -up libgcrypt-1.7.3/tests/pubkey.c.tests libgcrypt-1.7.3/tests/pubkey.c
+--- libgcrypt-1.7.3/tests/pubkey.c.tests	2016-07-14 11:19:17.000000000 +0200
++++ libgcrypt-1.7.3/tests/pubkey.c	2016-11-22 18:40:23.220813982 +0100
+@@ -651,7 +651,7 @@ get_dsa_key_fips186_with_seed_new (gcry_
+      "    (use-fips186)"
+      "    (transient-key)"
+      "    (derive-parms"
+-     "      (seed #0cb1990c1fd3626055d7a0096f8fa99807399871#))))",
++     "      (seed #8b4c4d671fff82e8ed932260206d0571e3a1c2cee8cd94cb73fe58f9b67488fa#))))",
+      0, 1);
+   if (rc)
+     die ("error creating S-expression: %s\n", gcry_strerror (rc));

libgcrypt-1.7.6-use-poll.patch

@@ -0,0 +1,71 @@
+diff -up libgcrypt-1.7.6/random/rndlinux.c.use-poll libgcrypt-1.7.6/random/rndlinux.c
+--- libgcrypt-1.7.6/random/rndlinux.c.use-poll	2017-01-30 14:20:13.665662981 +0100
++++ libgcrypt-1.7.6/random/rndlinux.c	2017-01-30 14:27:45.957027214 +0100
+@@ -32,6 +32,7 @@
+ #include <string.h>
+ #include <unistd.h>
+ #include <fcntl.h>
++#include <poll.h>
+ #if defined(__linux__) && defined(HAVE_SYSCALL)
+ # include <sys/syscall.h>
+ #endif
+@@ -211,9 +212,8 @@ _gcry_rndlinux_gather_random (void (*add
+                  return with something we will actually use 100ms. */
+   while (length)
+     {
+-      fd_set rfds;
+-      struct timeval tv;
+       int rc;
++      struct pollfd pfd;
+ 
+       /* If we have a modern Linux kernel and we want to read from the
+        * the non-blocking /dev/urandom, we first try to use the new
+@@ -269,33 +269,22 @@ _gcry_rndlinux_gather_random (void (*add
+           any_need_entropy = 1;
+         }
+ 
+-      /* If the system has no limit on the number of file descriptors
+-         and we encounter an fd which is larger than the fd_set size,
+-         we don't use the select at all.  The select code is only used
+-         to emit progress messages.  A better solution would be to
+-         fall back to poll() if available.  */
+-#ifdef FD_SETSIZE
+-      if (fd < FD_SETSIZE)
+-#endif
++      pfd.fd = fd;
++      pfd.events = POLLIN;
++
++      if ( !(rc=poll(&pfd, 1, delay)) )
+         {
+-          FD_ZERO(&rfds);
+-          FD_SET(fd, &rfds);
+-          tv.tv_sec = delay;
+-          tv.tv_usec = delay? 0 : 100000;
+-          if ( !(rc=select(fd+1, &rfds, NULL, NULL, &tv)) )
+-            {
+-              any_need_entropy = 1;
+-              delay = 3; /* Use 3 seconds henceforth.  */
+-              continue;
+-            }
+-          else if( rc == -1 )
+-            {
+-              log_error ("select() error: %s\n", strerror(errno));
+-              if (!delay)
+-                delay = 1; /* Use 1 second if we encounter an error before
+-                              we have ever blocked.  */
+-              continue;
+-            }
++          any_need_entropy = 1;
++          delay = 3000; /* Use 3 seconds henceforth.  */
++          continue;
++        }
++        else if( rc == -1 )
++        {
++          log_error ("poll() error: %s\n", strerror(errno));
++          if (!delay)
++            delay = 1000; /* Use 1 second if we encounter an error before
++                          we have ever blocked.  */
++          continue;
+         }
+ 
+       /* Read from the device.  */

libgcrypt.spec

@@ -1,50 +1,66 @@
-# This is taken from gnutls.spec
-%define srpmhash() %{lua:
-local files = rpm.expand("%_specdir/libgcrypt.spec")
-for i, p in ipairs(patches) do
-   files = files.." "..p
-end
-for i, p in ipairs(sources) do
-   files = files.." "..p
-end
-local sha256sum = assert(io.popen("cat "..files.."| sha256sum"))
-local hash = sha256sum:read("*a")
-sha256sum:close()
-print(string.sub(hash, 0, 16))
-}
-
 Name: libgcrypt
-Version: 1.11.2
+Version: 1.7.9
 Release: 1%{?dist}
-URL: https://www.gnupg.org/
-Source0: https://www.gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2
-Source1: https://www.gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2.sig
-Source2: https://gnupg.org/signature_key.asc
-# Pass the annobin flags to the libgcrypt.so (#2016349)
-Patch1: libgcrypt-1.10.1-annobin.patch
-# https://gitlab.com/redhat-crypto/libgcrypt/libgcrypt-mirror/-/merge_requests/19/
-Patch5: libgcrypt-1.11.0-marvin.patch
+URL: http://www.gnupg.org/
+Source0: libgcrypt-%{version}-hobbled.tar.xz
+# The original libgcrypt sources now contain potentially patented ECC
+# cipher support. We have to remove it in the tarball we ship with
+# the hobble-libgcrypt script. 
+# (We replace it with RH approved ECC in Source4-5)
+#Source0: ftp://ftp.gnupg.org/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2
+#Source1: ftp://ftp.gnupg.org/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2.sig
+Source2: wk@g10code.com
+Source3: hobble-libgcrypt
+# Approved ECC support (from 1.6.1)
+Source4: ecc-curves.c
+Source5: curves.c
+Source6: t-mpi-point.c
+# make FIPS hmac compatible with fipscheck - non upstreamable
+# update on soname bump
+Patch2: libgcrypt-1.6.2-use-fipscheck.patch
+# fix tests in the FIPS mode, allow CAVS testing of DSA keygen
+Patch5: libgcrypt-1.7.3-tests.patch
+# add configurable source of RNG seed and seed by default
+# from /dev/urandom in the FIPS mode
+Patch6: libgcrypt-1.7.3-fips-cfgrandom.patch
+# update the CAVS tests
+Patch7: libgcrypt-1.7.3-fips-cavs.patch
+# use poll instead of select when gathering randomness
+Patch11: libgcrypt-1.7.6-use-poll.patch
+# slight optimalization of mpicoder.c to silence Valgrind (#968288)
+Patch13: libgcrypt-1.6.1-mpicoder-gccopt.patch
+# fix tests to work with approved ECC
+Patch14: libgcrypt-1.7.3-ecc-test-fix.patch
+# Run the FIPS mode initialization in the shared library constructor
+Patch18: libgcrypt-1.6.2-fips-ctor.patch
+# Block some operations if in FIPS non-operational state
+Patch22: libgcrypt-1.7.3-fips-reqs.patch
+# do not use strict aliasing for bufhelp functions
+Patch23: libgcrypt-1.7.3-aliasing.patch
+# use only urandom if /dev/random cannot be opened
+Patch24: libgcrypt-1.6.3-urandom-only.patch
 
-%global gcrylibdir %{_libdir}
-%global gcrysoname libgcrypt.so.20
-%global hmackey orboDeJITITejsirpADONivirpUkvarP
+%define gcrylibdir %{_libdir}
 
-License: BSD-3-Clause AND (BSD-3-Clause OR GPL-2.0-only) AND GPL-2.0-or-later AND LGPL-2.1-or-later AND LGPL-2.0-or-later AND MIT-Modern-Variant
+# Technically LGPLv2.1+, but Fedora's table doesn't draw a distinction.
+# Documentation and some utilities are GPLv2+ licensed. These files
+# are in the devel subpackage.
+License: LGPLv2+
 Summary: A general-purpose cryptography library
-BuildRequires: gcc
 BuildRequires: gawk, libgpg-error-devel >= 1.11, pkgconfig
+BuildRequires: fipscheck
 # This is needed only when patching the .texi doc.
 BuildRequires: texinfo
-BuildRequires: autoconf, automake, libtool
-BuildRequires: make
-BuildRequires: gnupg2
-BuildRequires: annobin-annocheck binutils
+Group: System Environment/Libraries
 
 %package devel
 Summary: Development files for the %{name} package
+License: LGPLv2+ and GPLv2+
+Group: Development/Libraries
+Requires(pre): /sbin/install-info
+Requires(post): /sbin/install-info
 Requires: libgpg-error-devel
-Requires: %{name}%{?_isa} = %{version}-%{release}
-Requires: pkgconfig
+Requires: %{name} = %{version}-%{release}
 
 %description
 Libgcrypt is a general purpose crypto library based on the code used
@@ -56,59 +72,49 @@ in GNU Privacy Guard.  This package contains files needed to develop
 applications using libgcrypt.
 
 %prep
-%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
 %setup -q
-%patch 1 -p1
-%patch 5 -p1
+%{SOURCE3}
+%patch2 -p1 -b .use-fipscheck
+%patch5 -p1 -b .tests
+%patch6 -p1 -b .cfgrandom
+%patch7 -p1 -b .cavs
+%patch11 -p1 -b .use-poll
+%patch13 -p1 -b .gccopt
+%patch14 -p1 -b .eccfix
+%patch18 -p1 -b .fips-ctor
+%patch22 -p1 -b .fips-reqs
+%patch23 -p1 -b .aliasing
+%patch24 -p1 -b .urandom-only
+
+cp %{SOURCE4} cipher/
+cp %{SOURCE5} %{SOURCE6} tests/
 
 %build
-# should be all algorithms except SM3 and SM4, aria
-export DIGESTS='crc gostr3411-94 md4 md5 rmd160 sha1 sha256 sha512 sha3 tiger whirlpool stribog blake2'
-export CIPHERS='arcfour blowfish cast5 des aes twofish serpent rfc2268 seed camellia idea salsa20 gost28147 chacha20'
-
-eval $(sed -n 's/^\(\(NAME\|VERSION_ID\)=.*\)/OS_\1/p' /etc/os-release)
-export FIPS_MODULE_NAME="$OS_NAME ${OS_VERSION_ID%%.*} %name"
-
-autoreconf -f
 %configure --disable-static \
 %ifarch sparc64
      --disable-asm \
 %endif
      --enable-noexecstack \
-     --enable-hmac-binary-check=%{hmackey} \
-     --disable-jent-support \
-     --disable-O-flag-munging \
-     --enable-digests="$DIGESTS" \
-     --enable-ciphers="$CIPHERS" \
-     --enable-marvin-workaround \
-     --with-fips-module-version="$FIPS_MODULE_NAME %{version}-%{srpmhash}"
+     --enable-hmac-binary-check \
+     --enable-pubkey-ciphers='dsa elgamal rsa ecc' \
+     --disable-O-flag-munging
 sed -i -e '/^sys_lib_dlsearch_path_spec/s,/lib /usr/lib,/usr/lib /lib64 /usr/lib64 /lib,g' libtool
-%make_build
+make %{?_smp_mflags}
 
 %check
+fipshmac src/.libs/libgcrypt.so.??
 make check
-# try in faked FIPS mode too
-LIBGCRYPT_FORCE_FIPS_MODE=1 make check
-
-%define libpath $RPM_BUILD_ROOT%{gcrylibdir}/%{gcrysoname}.?.?
-
-PROFILE=%{?dist} annocheck --ignore-unknown --verbose --profile=${PROFILE:1} %{libpath}
 
 # Add generation of HMAC checksums of the final stripped binaries 
 %define __spec_install_post \
     %{?__debug_package:%{__debug_install_post}} \
     %{__arch_install_post} \
     %{__os_install_post} \
-    cd src \
-    sed -i -e 's|FILE=.*|FILE=\\\$1|' gen-note-integrity.sh \
-    READELF=readelf AWK=awk ECHO_N="-n" bash gen-note-integrity.sh %{libpath} > %{libpath}.hmac \
-    objcopy --update-section .note.fdo.integrity=%{libpath}.hmac %{libpath} %{libpath}.new \
-    mv -f %{libpath}.new %{libpath} \
-    rm -f %{libpath}.hmac
+    fipshmac $RPM_BUILD_ROOT%{gcrylibdir}/*.so.?? \
 %{nil}
 
 %install
-%make_install
+make install DESTDIR=$RPM_BUILD_ROOT
 
 # Change /usr/lib64 back to /usr/lib.  This saves us from having to patch the
 # script to "know" that -L/usr/lib64 should be suppressed, and also removes
@@ -150,224 +156,48 @@ popd
 # that _someone_ owns it.
 mkdir -p -m 755 $RPM_BUILD_ROOT/etc/gcrypt
 
-%ldconfig_scriptlets
+%post -p /sbin/ldconfig
+
+%postun -p /sbin/ldconfig
+
+%post devel
+[ -f %{_infodir}/gcrypt.info.gz ] && \
+    /sbin/install-info %{_infodir}/gcrypt.info.gz %{_infodir}/dir
+exit 0
+
+%preun devel
+if [ $1 = 0 -a -f %{_infodir}/gcrypt.info.gz ]; then
+    /sbin/install-info --delete %{_infodir}/gcrypt.info.gz %{_infodir}/dir
+fi
+exit 0
 
 %files
+%defattr(-,root,root,-)
 %dir /etc/gcrypt
-%{gcrylibdir}/libgcrypt.so.*.*
-%{gcrylibdir}/%{gcrysoname}
+%{gcrylibdir}/libgcrypt.so.*
+%{gcrylibdir}/.libgcrypt.so.*.hmac
+%{!?_licensedir:%global license %%doc}
 %license COPYING.LIB
 %doc AUTHORS NEWS THANKS
 
 %files devel
+%defattr(-,root,root,-)
 %{_bindir}/%{name}-config
 %{_bindir}/dumpsexp
 %{_bindir}/hmac256
 %{_bindir}/mpicalc
 %{_includedir}/*
 %{_libdir}/*.so
-%{_libdir}/pkgconfig/libgcrypt.pc
 %{_datadir}/aclocal/*
 %{_mandir}/man1/*
 
 %{_infodir}/gcrypt.info*
+%{!?_licensedir:%global license %%doc}
 %license COPYING
 
 %changelog
-* Mon Nov 03 2025 Jakub Jelen <jjelen@redhat.com> - 1.11.2-1
-- New upstream release (#2406804)
-
-* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.11.1-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Tue May 13 2025 Jakub Jelen <jjelen@redhat.com> - 1.11.1-1
-- New upstream release (#2364878)
-
-* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.11.0-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
-
-* Tue Oct 29 2024 Jakub Jelen <jjelen@redhat.com> - 1.11.0-4
-- Run annocheck as part of the build
-- Use upstream CF protection patches
-- Fix PAC/BTI protection for Aarch64
-- Fix CVE-2024-2236 (#2274128)
-
-* Thu Jul 25 2024 Jakub Jelen <jjelen@redhat.com> - 1.11.0-3
-- Disable -O flag munging and remove needles modification of LTO flags.
-
-* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.11.0-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
-
-* Wed Jun 19 2024 Jakub Jelen <jjelen@redhat.com> - 1.11.0-1
-- New upstream release (#2293064)
-
-* Tue Mar 26 2024 Jakub Jelen <jjelen@redhat.com> - 1.10.3-4
-- Replace deprecated fgrep (#2271503)
-
-* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.3-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.3-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Tue Nov 14 2023 Jakub Jelen <jjelen@redhat.com> - 1.10.3-1
-- New upstream release (#2249639)
-
-* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.2-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
-
-* Tue Apr 11 2023 Jakub Jelen <jjelen@redhat.com> - 1.10.2-1
-- New upstream release (#2185084)
-
-* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.1-7
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
-
-* Sat Dec  3 2022 Florian Weimer <fweimer@redhat.com> - 1.10.1-6
-- Port configure script to C99
-
-* Tue Nov 08 2022 Todd Zullinger <tmz@pobox.com> - 1.10.1-5
-- enable brainpool by default (#1413618)
-- fix sporadic failures generating RSA keys in FIPS mode
-
-* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.1-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
-
-* Sun May 29 2022 Todd Zullinger <tmz@pobox.com> - 1.10.1-3
-- improve --disable-brainpool configure output
-- use %%bcond_with to disable brainpool curves
-
-* Fri Apr 08 2022 Jakub Jelen <jjelen@redhat.com> - 1.10.1-2
-- Adjust integrity check creation to match upstream (#2073018)
-
-* Tue Mar 29 2022 Jakub Jelen <jjelen@redhat.com> - 1.10.1-1
-- Final release (#2069263)
-
-* Wed Feb 02 2022 Jakub Jelen <jjelen@redhat.com> - 1.10.0-1
-- New upstream release (#2049322)
-
-* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.9.4-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
-
-* Mon Aug 23 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.4-1
-- New upstream release (#1996467)
-
-* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.9.3-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
-
-* Tue Jun 15 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.3-3
-- Fix for CVE-2021-33560 (#1970098)
-
-* Wed Apr 28 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.3-2
-- Restore the CET protection (#1954049)
-
-* Tue Apr 20 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.3-1
-- New upstream release (#1951325)
-
-* Thu Apr 15 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.2-3
-- Fix issues reported by coverity
-
-* Mon Mar 29 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.2-2
-- Fix OCB tag creation on s390x (failing gnupg2 tests)
-
-* Wed Feb 17 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.2-1
-- New upstream release (#1929630)
-
-* Fri Jan 29 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.1-1
-- New upstream release (#1922156, #1922097)
-
-* Wed Jan 20 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.0-1
-- New upstream release (#1917878)
-
-* Tue Nov 24 2020 Jakub Jelen <jjelen@redhat.com> - 1.8.7-1
-- new upstream release (#1891123)
-
-* Fri Aug 21 2020 Jeff Law <law@redhat.com> - 1.8.6-4
-- Re-enable LTO
-
-* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.6-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Tue Jul 21 2020 Tom Stellard <tstellar@redhat.com> - 1.8.6-2
-- Use make macros
-- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
-
-* Mon Jul 20 2020 Tomáš Mráz <tmraz@redhat.com> 1.8.6-1
-- new upstream version 1.8.6
-
-* Wed Jul  1 2020 Tomáš Mráz <tmraz@redhat.com> 1.8.5-7
-- use the hmac256 tool to calculate the library hmac
-
-* Tue Jun 30 2020 Jeff Law <law@redhat.com>
-- Disable LTO
-
-* Thu Apr 23 2020 Tomáš Mráz <tmraz@redhat.com> 1.8.5-6
-- Fix regression - missing -ldl linkage
-
-* Wed Apr 22 2020 Tomáš Mráz <tmraz@redhat.com> 1.8.5-5
-- AES performance improvements backported from master branch
-
-* Mon Apr 20 2020 Tomáš Mráz <tmraz@redhat.com> 1.8.5-4
-- FIPS selftest is run directly from the constructor
-- FIPS module is implicit with kernel FIPS flag
-
-* Thu Jan 30 2020 Tomáš Mráz <tmraz@redhat.com> 1.8.5-3
-- fix the build on ARMv7
-
-* Thu Jan 23 2020 Tomáš Mráz <tmraz@redhat.com> 1.8.5-2
-- Intel CET support by H. J. Lu
-
-* Tue Sep  3 2019 Tomáš Mráz <tmraz@redhat.com> 1.8.5-1
-- new upstream version 1.8.5
-- add CMAC selftest for FIPS POST
-- add continuous FIPS entropy test
-- disable non-approved FIPS hashes in the enforced FIPS mode
-
-* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.4-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
-
-* Tue Feb 12 2019 Tomáš Mráz <tmraz@redhat.com> 1.8.4-3
-- fix the build tests to pass in the FIPS mode
-
-* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.4-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
-
-* Tue Nov 20 2018 Tomáš Mráz <tmraz@redhat.com> 1.8.4-1
-- new upstream version 1.8.4
-
-* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.3-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
-
-* Thu Jul 12 2018 Tomáš Mráz <tmraz@redhat.com> 1.8.3-2
-- make only_urandom a default in non-presence of configuration file
-- run the full FIPS selftests only when the library is called from
-  application
-
-* Thu Jun 14 2018 Tomáš Mráz <tmraz@redhat.com> 1.8.3-1
-- new upstream version 1.8.3
-
-* Tue Feb  6 2018 Tomáš Mráz <tmraz@redhat.com> 1.8.2-2
-- fix behavior when getrandom syscall is not present (#1542453)
-
-* Thu Dec 21 2017 Tomáš Mráz <tmraz@redhat.com> 1.8.2-1
-- new upstream version 1.8.2
-
-* Tue Dec  5 2017 Tomáš Mráz <tmraz@redhat.com> 1.8.1-3
-- do not try to access() /dev/urandom either if getrandom() works
-
-* Mon Dec  4 2017 Tomáš Mráz <tmraz@redhat.com> 1.8.1-2
-- do not try to open /dev/urandom if getrandom() works (#1380866)
-
-* Tue Sep  5 2017 Tomáš Mráz <tmraz@redhat.com> 1.8.1-1
-- new upstream version 1.8.1
-
-* Wed Aug 16 2017 Tomáš Mráz <tmraz@redhat.com> 1.8.0-1
-- new upstream version 1.8.0
-
-* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.7.8-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
-
-* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.7.8-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
+* Tue Oct 24 2017 Tomáš Mráz <tmraz@redhat.com> 1.7.9-1
+- new upstream version 1.7.9
 
 * Thu Jun 29 2017 Tomáš Mráz <tmraz@redhat.com> 1.7.8-1
 - new upstream version 1.7.8

signature_key.asc

@@ -1,86 +0,0 @@
------BEGIN PGP PUBLIC KEY BLOCK-----
-
-mQGNBFjLuq4BDACnM7zNSIaVMAacTwjXa5TGYe13i6ilHe4VL0NShzrgzjcQg531
-3cRgiiiNA7OSOypMqVs73Jez6ZUctn2GVsHBrS/io9NcuC9pVwf8a61WlcEa+EtB
-a3G7HlBmEWnwaUdAtWKNuAi9Xn+Ir7H2xEdksmmd5a0/QnL+sX705boVPF/tpYtb
-LGpPxa78tNrtxDkSwy8Wmi0IADYLI5yI7/yUGeJd8RSCU/fLRKC9fG7YOZRq0tsO
-MhVNWmtUjbG6e73Lu8LKnCZgs1/fC8hvPyARieSV5mdN8s1oWd7oYctfgL4uBleD
-ItAA8GhjKejutzHN8Ei/APw6AiiSyEjnPg+cTX8OgvLGJWjks0H6mPZeB1v/kGyZ
-hBS9vm540h2/MmlVN2ntiCK5TZGeSWpqddiqusfVXotMRpN4HeLKoZh4RAncaCbZ
-F/S+YLeN+kMXY4k3Fqt1fjTX6veFCbthI9pDdHzU9LfUVNp9D/5ktC/tYMORMegV
-+wSMxi9G2YWKJkMAEQEAAYkBzgQfAQgAOBYhBFuAxXVCmPDLVdjtarzvfilLCS4o
-BQJYy8DdFwyAAZSlyaA8L+XKOwldjh/fcjz0YraxAgcAAAoJELzvfilLCS4oNgoL
-/0+K1xIx8JW7Lk5M6bYCvNA4fdlEcwQIT4UidJFM9m+suxYFWIGfebvHpRlEuJTg
-dBjkEit8uLAoJXU0BRkKTLrzTF+qDUE79Wfx/R+0nOgJ7aMykQOi0AvuwzMYz4dg
-xIVS2Daou4DF7bh/KF8+fqrmq8P8W1ZrkuFDanMWpHeAPx1uj2skYbo7uPqFdvlJ
-hlNHrcxlcCkjf1InAt0Xt5lMvEsCRUPf9xAH4mNEhs0lh9c+200YPRmtnLWAzc1K
-ckLIC8Q+mUR3DjZDqBlDBEPegXkrI0+MlvRA+9AnAm4YPqTMUfpZ6ZOAWeFjC/6Z
-QYxG/AdWGkb4WFindzklQfybEuiekP8vU07ACQwSwH8PYe0UCom1YrlRUjX7QLkn
-ZLWoeZg8BZy9GTM1Ut7Q1Q2uTw6mxxISuef+RFgYOHjWwLpFWZpqC88xERl7o/iz
-iERJRt/593IctbjO9wenWt2peIAwzR4nz7LqM6ZFTdRAETmcdSvYRhg2Qt8hUE47
-CbQkQW5kcmUgSGVpbmVja2UgKFJlbGVhc2UgU2lnbmluZyBLZXkpiQHUBBMBCAA+
-FiEEW4DFdUKY8MtV2O1qvO9+KUsJLigFAljLuq4CGwMFCRLMAwAFCwkIBwIGFQgJ
-CgsCBBYCAwECHgECF4AACgkQvO9+KUsJLihC/QwAhCC+SEvcFLcutgZ8HfcCtoZs
-IoVzZEy7DjqIvGgnTssD8HCLnIAHCDvnP7dJW3uMuLCdSqym3cjlEIiQMsaGywkl
-fzJISAwJrGQdWSKRd535jXpEXQlXDKal/IwMKAUt0PZtlCc9S3gwixQryxdJ28lJ
-6h2T9fVDr8ZswMmTAFG91uctfhjKOMgPt8UhSPGW484WsIsQgkbOvf+Kfswl0eHu
-ywX+pKAB5ZQ/9GVC6Ug4xfrdiJL0azJTPnvjMY5JYp6/L9RURs5hP5AnHR2j/PPo
-sAtsFCjmbRbOMiASzklnUJPbSz5kfLloDWZmrUScjbzmsXehGyt433JGyRhZJl4x
-/jPbzKhaaAHsGd+fRao6vlLOwFywDDVMp6JuyK7UeUb7I8ekTbSkGFA+l2Oa3O6/
-Y7PYhq7hwwAFuZckYI98IpHNCG1fS9W07FyKdvQbK1PbF1JFRKfsUCWYMKqDnbqE
-o5jivPEHZImw6iYhhXcyEYl8fjcb9T6/S+wOP7aviQGzBBABCAAdFiEElKXJoDwv
-5co7CV2OH99yPPRitrEFAljLv5sACgkQH99yPPRitrFw4gv/XFMFN+/LHsn9hJOP
-4rCwl1yUuxXuYmZgc0sRoY3EpeQkJVyKurQuqqKoy2VuoMiF0O1kAQmGoFtVPUk7
-b8hCoutqB5GyeyKcoLP+WINgVhB2gXg7TSp3MPLBKkgqvSDvPitgRxBqFb4LW8LJ
-bDbfwGrzIvXfDV3WvsrHVPbc2fhlWdL8d+3AE6mFiXF3eTpgmV3ApSBQV12MkkCk
-icLIPmp+ZxZON+OP52ZXkRtfMgOy4Oa/41agrViDAZdMOGeGkhPertQheQZgXzmo
-GF5Wz498HPM80Kv35X91l3iGzL+icEtO+tWea2YscsZ6qpRe2lfVPHk3B+anlmCj
-m4kM4cBd39xa4HHSVh/bRHbZNtgVr7slQCKxlHgQOGVI5vCxPCwEsgJ2KBk03Nk/
-IA9EKO+czfh3/bHW6uMbEqrYDCnt+hmzZrpKDSGcwS/KOhvMUIMlb7/8vDKum6mp
-/8xAtVZ6IAxYZNt3qg7Y7aLRtzCTyqm8rJQrZPtRaQcgLoEimDMEX0PliRYJKwYB
-BAHaRw8BAQdAz75Hlekc16JhhfI0MKdEVxLdkxhcMCO0ZG6WMBAmNpe0H1dlcm5l
-ciBLb2NoIChkaXN0IHNpZ25pbmcgMjAyMCmImgQTFgoAQhYhBG2qbmSnbShAVxtJ
-AlKIl7gmQDraBQJfQ+w1AhsDBQkShccRBQsJCAcCAyICAQYVCgkICwIEFgIDAQIe
-BwIXgAAKCRBSiJe4JkA62nmuAP9uL/HOdB0gvwWrH+FpURJLs4bnaZaPIk9ARrU0
-EXRgJgD/YCGfHQXpIPT0ZaXuwJexK04Z+qMFR/bM1q1Leo5CjgaIbQQQEQsAHRYh
-BIBhWHD1utaQMzaG0PKthaweQrNnBQJfQ/HmAAoJEPKthaweQrNnIZkA3jG6LcZv
-V/URn8Y8OJqsyYa4C3NI4nN+OhEvYhgA4PHzMnALeXIpA2gblvjFIPJPAhDBAU37
-c5PA6+6IdQQQFggAHRYhBK6oTtzwGthsRwHIXGMROuhmWH0KBQJfQ/IlAAoJEGMR
-OuhmWH0K1+MA/0uJ5AHcnSfIBEWHNJwwVVLGyrxAWtS2U+zeymp/UvlPAQDErCLZ
-l0dBiPG3vlowFx5TNep7tanBs6ZJn8F1ao1tAIkBMwQQAQgAHRYhBNhpISPEBl3q
-Xg86tSSbOdJPJeO2BQJfQ/OuAAoJECSbOdJPJeO2DVoH/0o9if66ph6FJrgr+A/W
-HNVeHxmM5tUQhpL1wpRS70SKcsJgolf5CxO5iTQf3HlZe544xGbIU/aCTJsWw9zi
-UE8KmhAtKV4eL/7oQ7xx4nxPnABLpudtM8A44nsM1x/XiYrJnnDm29QjYEGd2Hi8
-7npc7VWKzLoj+I/WcXquynJi5O9TUxW9Bknd1pjpxFkf8v+msjBzCD5VKJgr0CR8
-wA6peQBWeGZX2HacosMIZH4TfL0r0TFla6LJIkNBz9DyIm1yL4L8oRH0950hQljP
-C7TM3L7aRpX+4Kph6llFz6g7MALGFP95kyJ6o+XED9ORuuQVZMBMIkNC0tXOu10V
-bdqIdQQQFgoAHRYhBMHTS2khnkruwLocIeP9/yGORbcrBQJfQ/P8AAoJEOP9/yGO
-Rbcr3lQBAMas8Vl3Hdl3g2I283lz1uHiGvlwcnk2TLeB+U4zIwC9AQCy0nnazVNt
-VQPID1ZCMoaOX7AzOjaqQDLf4j+dVTxgBJgzBGCkgocWCSsGAQQB2kcPAQEHQJmd
-fwp8jEN5P3eEjhQiWk6zQi8utvgOvYD57XmE+H8+tCBOaWliZSBZdXRha2EgKEdu
-dVBHIFJlbGVhc2UgS2V5KYiaBBMWCgBCFiEErI4RW/c+LY1H+pkI6Y6bLRnGyL0F
-AmCkgocCGwMFCQsNBpkFCwkIBwIDIgIBBhUKCQgLAgQWAgMBAh4HAheAAAoJEOmO
-my0Zxsi9/4IA/1rvSr3MU+Sv4jhNDzD+CeC3gmHkPew6pi9VHEsEwdgmAQD2BtiX
-7w1sJL/CBylGWv5jxj4345mP9YfZm0RsgzPjDIh1BBAWCAAdFiEEJJyzdxdQdF1c
-3TI84mewUjZPAo0FAmFAQ54ACgkQ4mewUjZPAo1CiAD+KTT1UVdQTGHMyvHwZocS
-QjU8xhcZrTet+dvvjrE5+4MA/RBdJPZgFevUKu68NEy0Lo+RbkeCtmQJ/c8v5ieF
-vW0AiQEzBBABCAAdFiEEEkEkvTtIYq96CkLxALRevUynur4FAmFAQ7cACgkQALRe
-vUynur4kaAgAolPR8TNWVS0vXMKrr0k0l2M/8QkZTaLZx1GT9Nx1yb4WJKY7ElPM
-YkhGDxetvFBETx0pH/6R3jtj6Crmur+NKHVSRY+rCYpFPDn6ciIOryssRx2G4kCZ
-t+nFB9JyDbBOZAR8DK4pN1mAxG/yLDt4oKcUQsP2xlEFum+phxyR8KyYCpkwKRxY
-eK+6lfilQuveoUwp/Xx5wXPNUy6q4eOOovCW7gS7I7288NGHCa2ul8sD6vA9C4mM
-4Zxaole9P9wwJe1zZFtCIy88zHM9vqv+YM9DxMCaW24+rUztr7eD4bCRdG+QlSh+
-7R/TaqSxY1eAAd1J5tma9CNJO73pTKU+/JhTBGFpSqMTCSskAwMCCAEBBwIDBF6X
-D9NmUQDgiyYNbhs1DMJ14mIw812wY1HVx/4QWYWiBunhrvSFxVbzsjD7/Wv+v3bm
-MPrL+M2DLyFiSewNmcS0JEdudVBHLmNvbSAoUmVsZWFzZSBTaWduaW5nIEtleSAy
-MDIxKYiaBBMTCABCFiEEAvON/3Mf+XywOaHaVJ5pXpBboggFAmFpSqMCGwMFCQ9x
-14oFCwkIBwIDIgIBBhUKCQgLAgQWAgMBAh4HAheAAAoJEFSeaV6QW6IITkoA/RYa
-jaTl1eEBU/Gdm12o3jrI55N5xZK2XTqSx25clVyjAP0XwMW/Og5+ND1ri3bAqADV
-WlBDUswz8wYxsb0C4kYBkoh1BBAWCgAdFiEEbapuZKdtKEBXG0kCUoiXuCZAOtoF
-AmFpTvEACgkQUoiXuCZAOtrJQAEAh7YyykjAy/Qs1yC3ji8iBfIVnPXvblrIx3SR
-RyDwRC8BAKtZbEuKTtPlgkLUgMleTcZJ/vEhJE+GvfQ9o5gWCqEFiHUEEBYKAB0W
-IQTB00tpIZ5K7sC6HCHj/f8hjkW3KwUCYWlPWgAKCRDj/f8hjkW3Kx4eAQDp6aGS
-N/fU4xLl8RSvQUVjVA+aCTrMQR3hRwqw8liF2wEA3O3ECxz6e1+DoItYoJBBLKLw
-eiInsGZ/+h5XYrpXTgA=
-=4+Sn
------END PGP PUBLIC KEY BLOCK-----

sources

@@ -1,2 +1 @@
-SHA512 (libgcrypt-1.11.2.tar.bz2) = b706cea602cc8f0896e57ce979643bf78974b05faec27c1b053b773c57d8b04250e30e95a4ef5899e1df981d01d8d08f0a36e10b5820a5ec4183e74c02e5f1f0
-SHA512 (libgcrypt-1.11.2.tar.bz2.sig) = e63d240a9b97aa218c98c5baa72a30321ae85412d4a8748e36578bd9498fe8c8ee2ba84835d1783cdfc1e5dfb66b0a89409d6263e9c06f4cd11e919d4bce0cd2
+SHA512 (libgcrypt-1.7.9-hobbled.tar.xz) = 691138921366b8a4588dc96c6ecfd73d17b7a5114ab8fb06b510fa5f9a04e6ff3eba448b7809bf0e9017311882ccab25ff5e1c6569b790b22ddf7296f5c37dbf

tests/smoke-test/Makefile

@@ -1,75 +0,0 @@
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Makefile of /CoreOS/libgcrypt/smoke-test
-#   Description: Test calls upstream test suite.
-#   Author: Ondrej Moris <omoris@redhat.com>
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Copyright (c) 2010 Red Hat, Inc. All rights reserved.
-#
-#   This copyrighted material is made available to anyone wishing
-#   to use, modify, copy, or redistribute it subject to the terms
-#   and conditions of the GNU General Public License version 2.
-#
-#   This program is distributed in the hope that it will be
-#   useful, but WITHOUT ANY WARRANTY; without even the implied
-#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
-#   PURPOSE. See the GNU General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public
-#   License along with this program; if not, write to the Free
-#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-#   Boston, MA 02110-1301, USA.
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-export TEST=/CoreOS/libgcrypt/smoke-test
-export TESTVERSION=1.0
-
-BUILT_FILES=
-
-FILES=$(METADATA) runtest.sh Makefile PURPOSE
-
-.PHONY: all install download clean
-
-run: $(FILES) build
-	./runtest.sh
-
-build: $(BUILT_FILES)
-	chmod a+x runtest.sh
-
-clean:
-	rm -f *~ $(BUILT_FILES)
-
-
-include /usr/share/rhts/lib/rhts-make.include
-
-$(METADATA): Makefile
-	@echo "Owner:           Ondrej Moris <omoris@redhat.com>" > $(METADATA)
-	@echo "Name:            $(TEST)" >> $(METADATA)
-	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
-	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
-	@echo "Description:     Test calls upstream test suite." >> $(METADATA)
-	@echo "Type:            Sanity" >> $(METADATA)
-	@echo "TestTime:        15m" >> $(METADATA)
-	@echo "RunFor:          libgcrypt" >> $(METADATA)
-	@echo "Requires:        libgcrypt" >> $(METADATA)
-	@echo "Requires:        nfs-utils" >> $(METADATA)
-	@echo "Requires:        rpm-build" >> $(METADATA)
-	@echo "Requires:        autoconf automake libtool" >> $(METADATA)
-	@echo "Requires:        gawk" >> $(METADATA)
-	@echo "Requires:        gcc-c++" >> $(METADATA)
-	@echo "Requires:        libgpg-error-devel" >> $(METADATA)
-	@echo "Requires:        pkgconfig texinfo fipscheck libkcapi-fipscheck" >> $(METADATA)
-	@echo "Requires:        crypto-policies-scripts" >> $(METADATA)
-	@echo "Requires:        bc" >> $(METADATA)
-	@echo "RhtsRequires:    library(distribution/fips)" >> $(METADATA)
-	@echo "Releases:        -RHEL3 -RHEL4" >> $(METADATA)
-	@echo "Priority:        Normal" >> $(METADATA)
-	@echo "Architectures:   i386 x86_64 s390x ia64" >> $(METADATA)
-	@echo "License:         GPLv2" >> $(METADATA)
-	@echo "Confidential:    no" >> $(METADATA)
-	@echo "Destructive:     no" >> $(METADATA)
-
-	rhts-lint $(METADATA)

tests/smoke-test/PURPOSE

@@ -1,3 +0,0 @@
-PURPOSE of /CoreOS/libgcrypt/Sanity/smoke-test
-Description: Test calls upstream test suite.
-Author: Ondrej Moris <omoris@redhat.com>

tests/smoke-test/main.fmf

@@ -1,25 +0,0 @@
-summary: Test calls upstream test suite.
-test: ./runtest.sh
-enabled: true
-framework: beakerlib
-require:
-  - library(distribution/fips)
-recommend:
-  - libgcrypt
-  - nfs-utils
-  - rpm-build
-  - autoconf
-  - automake
-  - libtool
-  - gawk
-  - gcc-c++
-  - libgpg-error-devel
-  - pkgconfig
-  - texinfo
-  - fipscheck
-  - libkcapi-fipscheck
-  - crypto-policies-scripts
-  - bc
-  - annobin-annocheck
-  - gnupg2
-duration: 45m

tests/smoke-test/runtest.sh

@@ -1,145 +0,0 @@
-#!/bin/bash
-# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   runtest.sh of /CoreOS/libgcrypt/smoke-test
-#   Description: Test calls upstream test suite.
-#   Author: Ondrej Moris <omoris@redhat.com>
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Copyright (c) 2010 Red Hat, Inc. All rights reserved.
-#
-#   This copyrighted material is made available to anyone wishing
-#   to use, modify, copy, or redistribute it subject to the terms
-#   and conditions of the GNU General Public License version 2.
-#
-#   This program is distributed in the hope that it will be
-#   useful, but WITHOUT ANY WARRANTY; without even the implied
-#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
-#   PURPOSE. See the GNU General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public
-#   License along with this program; if not, write to the Free
-#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-#   Boston, MA 02110-1301, USA.
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-. /usr/share/beakerlib/beakerlib.sh
-
-PACKAGE="libgcrypt"
-
-rlJournalStart
-
-    rlPhaseStartSetup
-        rlImport distribution/fips || rlFail "FIPS library needed for some phases"
-        TmpDir=`mktemp -d`
-        rlAssertRpm $PACKAGE
-        rlRun "rlFileBackup --clean /etc/gcrypt/fips_enabled"
-        if [[ -r /etc/gcrypt/hwf.deny ]]; then
-            rlRun "rlFileBackup /etc/gcrypt/hwf.deny"
-            rlRun "rm -f /etc/gcrypt/hwf.deny"
-        fi
-        rlRun "pushd $TmpDir" 0
-        rlRun "rlFetchSrcForInstalled $PACKAGE"
-        rlRun "rpm -ihv `ls *.rpm`" 0
-        if grep '1' /proc/sys/crypto/fips_enabled; then
-            rlRun "echo '1' > /etc/gcrypt/fips_enabled" 0
-        fi
-    rlPhaseEnd
-
-    rlPhaseStartTest "Package build"
-        TOPDIR=`rpm --eval %_topdir`
-        rlRun "pushd $TOPDIR" 0
-        rlRun "rm -rf BUILD/libgcrypt-*" 0-255
-        rlRun "rpmbuild -vv -bc SPECS/libgcrypt.spec" 0
-        libgcrypt_dir="libgcrypt-`rpm -q --qf "%{VERSION}\n" libgcrypt | head -1`"
-        if [ -d "BUILD/$libgcrypt_dir-build" ]; then
-            BUILDDIR="BUILD/$libgcrypt_dir-build/$libgcrypt_dir"
-        else
-            BUILDDIR="BUILD/$libgcrypt_dir"
-        fi
-        rlRun "pushd $BUILDDIR" 0
-        rlRun "fipshmac src/.libs/libgcrypt.so.??" 0
-        rlRun "popd"
-        rlRun "popd"
-    rlPhaseEnd
-
-    rlPhaseStartTest "Upstream testsuite"
-        rlRun "pushd $TOPDIR/$BUILDDIR" 0
-        exp_fails=()
-
-        rlRun "echo 'Expecting ${#exp_fails[@]} fails'"
-        exp_exitcode=0
-        if [[ ${#exp_fails[@]} -gt 0 ]]; then exp_exitcode=2; fi
-        rlRun "make check &> $TmpDir/make_check.out" $exp_exitcode
-        rlRun "grep ^FAIL: $TmpDir/make_check.out" 0,1 "Print fails"
-        if [[ ${#exp_fails[@]} -gt 0 ]]; then
-            for f in $(grep '^FAIL:' $TmpDir/make_check.out | awk -F ': ' '{print $2}'); do
-                if [[ "${exp_fails[@]}" =~ "$f" ]]; then
-                    rlLog "$f failure is expected"
-                else
-                    rlFail "$f failure is not expected"
-                fi
-            done
-        else
-            rlRun "grep \"All [0-9]\+ tests passed\" $TmpDir/make_check.out" 0 \
-                "All tests passed"
-        fi
-        rlRun "cat $TmpDir/make_check.out"
-        rlRun "popd"
-    rlPhaseEnd
-
-    if ! (rlIsRHEL '<=8.4' || ([[ $fipsMode = "enabled" ]] &&  rlIsFedora '<37')); then
-    # (we are ~expecting to fix HW optimization problem around Fedora-37)
-    rlPhaseStartTest "Performance with HW optimizations disabled - bz1990059"
-        # we are gathering more samples, so that this test is robust in shared environments
-        N_SAMPLES=5
-        N_MEDIAN=$(echo "$N_SAMPLES/2+1" |bc)
-        HWF_DENY_FILE="/etc/gcrypt/hwf.deny"
-        # Disabling via cmdline arguments would need either handpicking
-        # all the algorithms (variant with ":"), or making "all" work.
-        # "--disable-hwf all" does not work: https://dev.gnupg.org/T5636
-        #dis_arg="--disable-hwf all"
-        dis_arg=""
-
-        for x in "cipher:aes256:CBC enc" "hash:sha256:SHA256" "mac:hmac_sha256:HMAC_SHA256"; do
-            alg_type=$(echo $x |cut -d: -f1)
-            algorithm=$(echo $x |cut -d: -f2)
-            alg_line=$(echo $x |cut -d: -f3)
-            rlRun "rm -f $algorithm.ena $algorithm.dis"
-            rlLogInfo "Performance measurements started ..."
-            for i in `seq 1 $N_SAMPLES`; do
-                # run with HW optimizations ENAbled
-                rm -f $HWF_DENY_FILE
-                $TOPDIR/$BUILDDIR/tests/bench-slope $alg_type $algorithm |grep "$alg_line" >>$algorithm.ena
-
-                # run with HW optimizations DISabled
-                # this looks idiotic, but I wasn't able to make --disable-hwf work
-                echo "all" >$HWF_DENY_FILE
-                $TOPDIR/$BUILDDIR/tests/bench-slope $dis_arg $alg_type $algorithm |grep "$alg_line" >>$algorithm.dis
-            done
-            rlLogInfo "Performance measurements finished"
-            rlRun "cat $algorithm.ena"
-            rlRun "cat $algorithm.dis"
-            dis=$(cat $algorithm.dis |cut -d'|' -f2 |awk '{ print $1 }' |sort -n |sed -n "$N_MEDIAN p")
-            ena=$(cat $algorithm.ena |cut -d'|' -f2 |awk '{ print $1 }' |sort -n |sed -n "$N_MEDIAN p")
-            rlRun "echo '$algorithm Time: disabled $dis enabled $ena'"
-            if (( $(echo "$dis > $ena" |bc -l) )); then
-                rlPass "HW optimizations work for $algorithm"
-            else
-                rlFail "HW optimizations DO NOT work for $algorithm"
-            fi
-        done
-    rlPhaseEnd
-    fi
-
-    rlPhaseStartCleanup
-        rlRun "popd"
-        rlRun "rm -r $TmpDir" 0
-        rlRun "rlFileRestore"
-    rlPhaseEnd
-
-rlJournalPrintText
-rlJournalEnd