.fmf/version

@@ -1 +0,0 @@
-1

.gitignore

@@ -32,13 +32,3 @@ libgcrypt-1.4.5-hobbled.tar.bz2
 /libgcrypt-1.10.0.tar.bz2.sig
 /libgcrypt-1.10.1.tar.bz2
 /libgcrypt-1.10.1.tar.bz2.sig
-/libgcrypt-1.10.2.tar.bz2
-/libgcrypt-1.10.2.tar.bz2.sig
-/libgcrypt-1.10.3.tar.bz2
-/libgcrypt-1.10.3.tar.bz2.sig
-/libgcrypt-1.11.0.tar.bz2
-/libgcrypt-1.11.0.tar.bz2.sig
-/libgcrypt-1.11.1.tar.bz2
-/libgcrypt-1.11.1.tar.bz2.sig
-/libgcrypt-1.11.2.tar.bz2
-/libgcrypt-1.11.2.tar.bz2.sig

libgcrypt-1.10.0-disable-brainpool.patch

@@ -0,0 +1,314 @@
+From f778433dd29fe07aa1791a0137f6f14febcce607 Mon Sep 17 00:00:00 2001
+From: Jakub Jelen <jjelen@redhat.com>
+Date: Fri, 10 Sep 2021 18:39:00 +0200
+Subject: [PATCH] Allow building libgcrypt without Brainpool curves
+
+* README: Document possibility to build without brainpool curves
+* cipher/ecc-curves.c: Conditionalize brainpool curves definitions
+* configure.ac: Implement possibility to build without brainpool curves
+* tests/curves.c: Skip brainpool curves if they are not built-in
+* tests/keygrip.c: Skip brainpool curves if they are not built-in
+* tests/bench-slope.c: Skip brainpoll curves in they are not built-in
+
+--
+
+Signed-off-by: Jakub Jelen <jjelen@redhat.com>
+---
+ README              |  3 +++
+ cipher/ecc-curves.c |  4 ++++
+ configure.ac        | 13 +++++++++++++
+ tests/bench-slope.c | 12 ++++++++++++
+ tests/curves.c      | 46 ++++++++++++++++++++++++++++++---------------
+ tests/keygrip.c     |  2 ++
+ 6 files changed, 65 insertions(+), 15 deletions(-)
+
+diff --git a/README b/README
+index 4d7697dd..b290d01e 100644
+--- a/README
++++ b/README
+@@ -121,6 +121,9 @@
+                      the list used with the current build the program
+                      tests/version may be used.
+ 
++     --disable-brainpool
++                     Do not build in support for Brainpool curves.
++
+      --disable-endian-check
+                      Don't let configure test for the endianness but
+                      try to use the OS provided macros at compile
+diff --git a/cipher/ecc-curves.c b/cipher/ecc-curves.c
+index 7c86e12c..8fd95a9c 100644
+--- a/cipher/ecc-curves.c
++++ b/cipher/ecc-curves.c
+@@ -77,6 +77,7 @@ static const struct
+     { "NIST P-521", "1.3.132.0.35" },
+     { "NIST P-521", "nistp521"   },          /* rfc5656.  */
+ 
++#ifdef ENABLE_BRAINPOOL
+     { "brainpoolP160r1", "1.3.36.3.3.2.8.1.1.1" },
+     { "brainpoolP192r1", "1.3.36.3.3.2.8.1.1.3" },
+     { "brainpoolP224r1", "1.3.36.3.3.2.8.1.1.5" },
+@@ -84,6 +85,7 @@ static const struct
+     { "brainpoolP320r1", "1.3.36.3.3.2.8.1.1.9" },
+     { "brainpoolP384r1", "1.3.36.3.3.2.8.1.1.11"},
+     { "brainpoolP512r1", "1.3.36.3.3.2.8.1.1.13"},
++#endif /* ENABLE_BRAINPOOL */
+ 
+     { "GOST2001-test", "1.2.643.2.2.35.0" },
+     { "GOST2001-CryptoPro-A", "1.2.643.2.2.35.1" },
+@@ -297,6 +299,7 @@ static const ecc_domain_parms_t domain_parms[] =
+       1
+     },
+ 
++#ifdef ENABLE_BRAINPOOL
+     { "brainpoolP160r1", 160, 0,
+       MPI_EC_WEIERSTRASS, ECC_DIALECT_STANDARD,
+       "0xe95e4a5f737059dc60dfc7ad95b3d8139515620f",
+@@ -391,6 +394,7 @@ static const ecc_domain_parms_t domain_parms[] =
+       "b2dcde494a5f485e5bca4bd88a2763aed1ca2b2fa8f0540678cd1e0f3ad80892",
+       1
+     },
++#endif /* ENABLE_BRAINPOOL */
+     {
+       "GOST2001-test", 256, 0,
+       MPI_EC_WEIERSTRASS, ECC_DIALECT_STANDARD,
+diff --git a/configure.ac b/configure.ac
+index 0e67baf9..a63f7360 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -595,6 +595,14 @@ AC_ARG_WITH(fips-module-version,
+ AC_DEFINE_UNQUOTED(FIPS_MODULE_VERSION, "$fips_module_version",
+                    [Define FIPS module version for certification])
+ 
++# Implementation of the --disable-brainpool switch.
++AC_MSG_CHECKING([whether brainpool curves support is requested])
++AC_ARG_ENABLE(brainpool,
++              AS_HELP_STRING([--disable-brainpool],
++                             [Disable the brainpool curves]),
++              use_brainpool="$enableval",use_brainpool=yes)
++AC_MSG_RESULT($use_brainpool)
++
+ # Implementation of the --disable-jent-support switch.
+ AC_MSG_CHECKING([whether jitter entropy support is requested])
+ AC_ARG_ENABLE(jent-support,
+@@ -2459,6 +2467,10 @@ if test x"$ppccryptosupport" = xyes ; then
+   AC_DEFINE(ENABLE_PPC_CRYPTO_SUPPORT,1,
+             [Enable support for POWER 8 (PowerISA 2.07) crypto extension.])
+ fi
++if test x"$use_brainpool" = xyes ; then
++  AC_DEFINE(ENABLE_BRAINPOOL, 1,
++            [Enable support for the brainpool curves.])
++fi
+ if test x"$jentsupport" = xyes ; then
+   AC_DEFINE(ENABLE_JENT_SUPPORT, 1,
+             [Enable support for the jitter entropy collector.])
+@@ -3294,6 +3306,7 @@ GCRY_MSG_WRAP([Enabled digest algorithms:],[$enabled_digests])
+ GCRY_MSG_WRAP([Enabled kdf algorithms:   ],[$enabled_kdfs])
+ GCRY_MSG_WRAP([Enabled pubkey algorithms:],[$enabled_pubkey_ciphers])
+ GCRY_MSG_SHOW([Random number generator:  ],[$random])
++GCRY_MSG_SHOW([Enabled Brainpool curves: ],[$use_brainpool])
+ GCRY_MSG_SHOW([Try using jitter entropy: ],[$jentsupport])
+ GCRY_MSG_SHOW([Using linux capabilities: ],[$use_capabilities])
+ GCRY_MSG_SHOW([FIPS module version:      ],[$fips_module_version])
+diff --git a/tests/bench-slope.c b/tests/bench-slope.c
+index 5c49ac25..1b5941af 100644
+--- a/tests/bench-slope.c
++++ b/tests/bench-slope.c
+@@ -2316,7 +2316,9 @@ enum bench_ecc_algo
+   ECC_ALGO_NIST_P384,
+   ECC_ALGO_NIST_P521,
+   ECC_ALGO_SECP256K1,
++#ifdef ENABLE_BRAINPOOL
+   ECC_ALGO_BRAINP256R1,
++#endif /* ENABLE_BRAINPOOL */
+   __MAX_ECC_ALGO
+ };
+ 
+@@ -2366,7 +2368,9 @@ ecc_algo_fips_allowed (int algo)
+       case ECC_ALGO_NIST_P521:
+ 	return 1;
+       case ECC_ALGO_SECP256K1:
++#ifdef ENABLE_BRAINPOOL
+       case ECC_ALGO_BRAINP256R1:
++#endif /* ENABLE_BRAINPOOL */
+       case ECC_ALGO_ED25519:
+       case ECC_ALGO_ED448:
+       case ECC_ALGO_X25519:
+@@ -2402,8 +2406,10 @@ ecc_algo_name (int algo)
+ 	return "NIST-P521";
+       case ECC_ALGO_SECP256K1:
+ 	return "secp256k1";
++#ifdef ENABLE_BRAINPOOL
+       case ECC_ALGO_BRAINP256R1:
+ 	return "brainpoolP256r1";
++#endif /* ENABLE_BRAINPOOL */
+       default:
+ 	return NULL;
+     }
+@@ -2434,8 +2440,10 @@ ecc_algo_curve (int algo)
+ 	return "NIST P-521";
+       case ECC_ALGO_SECP256K1:
+ 	return "secp256k1";
++#ifdef ENABLE_BRAINPOOL
+       case ECC_ALGO_BRAINP256R1:
+ 	return "brainpoolP256r1";
++#endif /* ENABLE_BRAINPOOL */
+       default:
+ 	return NULL;
+     }
+@@ -2466,8 +2474,10 @@ ecc_nbits (int algo)
+ 	return 521;
+       case ECC_ALGO_SECP256K1:
+ 	return 256;
++#ifdef ENABLE_BRAINPOOL
+       case ECC_ALGO_BRAINP256R1:
+ 	return 256;
++#endif /* ENABLE_BRAINPOOL */
+       default:
+ 	return 0;
+     }
+@@ -2665,6 +2675,7 @@ bench_ecc_init (struct bench_obj *obj)
+         err = gcry_sexp_build (&hd->data, NULL,
+ 			       "(data (flags raw) (value %m))", x);
+ 	break;
++#ifdef ENABLE_BRAINPOOL
+       case ECC_ALGO_BRAINP256R1:
+         err = gcry_sexp_build (&hd->key_spec, NULL,
+                                "(genkey (ECDSA (curve brainpoolP256r1)))");
+@@ -2673,6 +2684,7 @@ bench_ecc_init (struct bench_obj *obj)
+         err = gcry_sexp_build (&hd->data, NULL,
+ 			       "(data (flags raw) (value %m))", x);
+ 	break;
++#endif /* ENABLE_BRAINPOOL */
+     }
+ 
+   gcry_mpi_release (x);
+diff --git a/tests/curves.c b/tests/curves.c
+index 3c738171..8eb79565 100644
+--- a/tests/curves.c
++++ b/tests/curves.c
+@@ -33,7 +33,11 @@
+ #include "t-common.h"
+ 
+ /* Number of curves defined in ../cipher/ecc-curves.c */
+-#define N_CURVES 27
++#ifdef ENABLE_BRAINPOOL
++# define N_CURVES 27
++#else
++# define N_CURVES 20
++#endif
+ 
+ /* A real world sample public key.  */
+ static char const sample_key_1[] =
+@@ -52,6 +56,7 @@ static char const sample_key_1[] =
+ static char const sample_key_1_curve[] = "NIST P-256";
+ static unsigned int sample_key_1_nbits = 256;
+ 
++#ifdef ENABLE_BRAINPOOL
+ /* A made up sample public key.  */
+ static char const sample_key_2[] =
+ "(public-key\n"
+@@ -68,6 +73,7 @@ static char const sample_key_2[] =
+ "  ))";
+ static char const sample_key_2_curve[] = "brainpoolP160r1";
+ static unsigned int sample_key_2_nbits = 160;
++#endif /* ENABLE_BRAINPOOL */
+ 
+ static int in_fips_mode;
+ 
+@@ -113,6 +119,7 @@ check_matching (void)
+ 
+   gcry_sexp_release (key);
+ 
++#ifdef ENABLE_BRAINPOOL
+   if (!in_fips_mode)
+     {
+       err = gcry_sexp_new (&key, sample_key_2, 0, 1);
+@@ -130,6 +137,7 @@ check_matching (void)
+ 
+       gcry_sexp_release (key);
+     }
++#endif /* ENABLE_BRAINPOOL */
+ }
+ 
+ #define TEST_ERROR_EXPECTED (1 << 0)
+@@ -185,20 +193,26 @@ check_get_params (void)
+        { GCRY_PK_ECC, "1.3.132.0.35" },
+        { GCRY_PK_ECC, "nistp521"   },
+ 
+-       { GCRY_PK_ECC, "brainpoolP160r1",       TEST_NOFIPS },
+-       { GCRY_PK_ECC, "1.3.36.3.3.2.8.1.1.1",  TEST_NOFIPS },
+-       { GCRY_PK_ECC, "brainpoolP192r1",       TEST_NOFIPS },
+-       { GCRY_PK_ECC, "1.3.36.3.3.2.8.1.1.3",  TEST_NOFIPS },
+-       { GCRY_PK_ECC, "brainpoolP224r1",       TEST_NOFIPS },
+-       { GCRY_PK_ECC, "1.3.36.3.3.2.8.1.1.5",  TEST_NOFIPS },
+-       { GCRY_PK_ECC, "brainpoolP256r1",       TEST_NOFIPS },
+-       { GCRY_PK_ECC, "1.3.36.3.3.2.8.1.1.7",  TEST_NOFIPS },
+-       { GCRY_PK_ECC, "brainpoolP320r1",       TEST_NOFIPS },
+-       { GCRY_PK_ECC, "1.3.36.3.3.2.8.1.1.9",  TEST_NOFIPS },
+-       { GCRY_PK_ECC, "brainpoolP384r1",       TEST_NOFIPS },
+-       { GCRY_PK_ECC, "1.3.36.3.3.2.8.1.1.11", TEST_NOFIPS },
+-       { GCRY_PK_ECC, "brainpoolP512r1",       TEST_NOFIPS },
+-       { GCRY_PK_ECC, "1.3.36.3.3.2.8.1.1.13", TEST_NOFIPS },
++#ifdef ENABLE_BRAINPOOL
++# define BRAINPOOL_FLAGS TEST_NOFIPS
++#else
++# define BRAINPOOL_FLAGS TEST_ERROR_EXPECTED
++#endif /* ENABLE_BRAINPOOL */
++       { GCRY_PK_ECC, "brainpoolP160r1",       BRAINPOOL_FLAGS },
++       { GCRY_PK_ECC, "1.3.36.3.3.2.8.1.1.1",  BRAINPOOL_FLAGS },
++       { GCRY_PK_ECC, "brainpoolP192r1",       BRAINPOOL_FLAGS },
++       { GCRY_PK_ECC, "1.3.36.3.3.2.8.1.1.3",  BRAINPOOL_FLAGS },
++       { GCRY_PK_ECC, "brainpoolP224r1",       BRAINPOOL_FLAGS },
++       { GCRY_PK_ECC, "1.3.36.3.3.2.8.1.1.5",  BRAINPOOL_FLAGS },
++       { GCRY_PK_ECC, "brainpoolP256r1",       BRAINPOOL_FLAGS },
++       { GCRY_PK_ECC, "1.3.36.3.3.2.8.1.1.7",  BRAINPOOL_FLAGS },
++       { GCRY_PK_ECC, "brainpoolP320r1",       BRAINPOOL_FLAGS },
++       { GCRY_PK_ECC, "1.3.36.3.3.2.8.1.1.9",  BRAINPOOL_FLAGS },
++       { GCRY_PK_ECC, "brainpoolP384r1",       BRAINPOOL_FLAGS },
++       { GCRY_PK_ECC, "1.3.36.3.3.2.8.1.1.11", BRAINPOOL_FLAGS },
++       { GCRY_PK_ECC, "brainpoolP512r1",       BRAINPOOL_FLAGS },
++       { GCRY_PK_ECC, "1.3.36.3.3.2.8.1.1.13", BRAINPOOL_FLAGS },
++#undef BRAINPOOL_ERROR_EXPECTED
+ 
+        { GCRY_PK_ECC, "GOST2001-test", TEST_NOFIPS },
+        { GCRY_PK_ECC, "1.2.643.2.2.35.0", TEST_NOFIPS },
+@@ -282,6 +296,7 @@ check_get_params (void)
+ 
+   gcry_sexp_release (param);
+ 
++#ifdef ENABLE_BRAINPOOL
+   if (!in_fips_mode)
+     {
+       param = gcry_pk_get_param (GCRY_PK_ECDSA, sample_key_2_curve);
+@@ -297,6 +312,7 @@ check_get_params (void)
+ 
+       gcry_sexp_release (param);
+     }
++#endif /* ENABLE_BRAINPOOL */
+ 
+   /* Some simple tests */
+   for (idx=0; idx < DIM (tv); idx++)
+diff --git a/tests/keygrip.c b/tests/keygrip.c
+index 49bd71bc..fc4c17be 100644
+--- a/tests/keygrip.c
++++ b/tests/keygrip.c
+@@ -149,6 +149,7 @@ static struct
+       " (q #04C8A4CEC2E9A9BC8E173531A67B0840DF345C32E261ADD780E6D83D56EFADFD5DE872F8B854819B59543CE0B7F822330464FBC4E6324DADDCD9D059554F63B344#)))",
+       "\xE6\xDF\x94\x2D\xBD\x8C\x77\x05\xA3\xDD\x41\x6E\xFC\x04\x01\xDB\x31\x0E\x99\xB6"
+     },
++#ifdef ENABLE_BRAINPOOL
+     {
+       GCRY_PK_ECC,
+       "(public-key"
+@@ -197,6 +198,7 @@ static struct
+       "\xD6\xE1\xBF\x43\xAC\x9B\x9A\x12\xE7\x3F",
+       1
+     },
++#endif /*ENABLE_BRAINPOOL */
+     { /* Ed25519 standard */
+       GCRY_PK_ECC,
+       "(public-key"
+-- 
+2.34.1
+

libgcrypt.spec

@@ -13,23 +13,29 @@ sha256sum:close()
 print(string.sub(hash, 0, 16))
 }
 
+# disable brainpool curves by default
+%bcond_with brainpool
+
 Name: libgcrypt
-Version: 1.11.2
-Release: 1%{?dist}
+Version: 1.10.1
+Release: 4%{?dist}
 URL: https://www.gnupg.org/
 Source0: https://www.gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2
 Source1: https://www.gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2.sig
-Source2: https://gnupg.org/signature_key.asc
+Source2: wk@g10code.com
+# brainpool curves are still not allowed to be shipped in Fedora
+Patch1: libgcrypt-1.10.0-disable-brainpool.patch
 # Pass the annobin flags to the libgcrypt.so (#2016349)
-Patch1: libgcrypt-1.10.1-annobin.patch
-# https://gitlab.com/redhat-crypto/libgcrypt/libgcrypt-mirror/-/merge_requests/19/
-Patch5: libgcrypt-1.11.0-marvin.patch
+Patch2: libgcrypt-1.10.1-annobin.patch
 
 %global gcrylibdir %{_libdir}
 %global gcrysoname libgcrypt.so.20
 %global hmackey orboDeJITITejsirpADONivirpUkvarP
 
-License: BSD-3-Clause AND (BSD-3-Clause OR GPL-2.0-only) AND GPL-2.0-or-later AND LGPL-2.1-or-later AND LGPL-2.0-or-later AND MIT-Modern-Variant
+# Technically LGPLv2.1+, but Fedora's table doesn't draw a distinction.
+# Documentation and some utilities are GPLv2+ licensed. These files
+# are in the devel subpackage.
+License: LGPLv2+
 Summary: A general-purpose cryptography library
 BuildRequires: gcc
 BuildRequires: gawk, libgpg-error-devel >= 1.11, pkgconfig
@@ -37,11 +43,10 @@ BuildRequires: gawk, libgpg-error-devel >= 1.11, pkgconfig
 BuildRequires: texinfo
 BuildRequires: autoconf, automake, libtool
 BuildRequires: make
-BuildRequires: gnupg2
-BuildRequires: annobin-annocheck binutils
 
 %package devel
 Summary: Development files for the %{name} package
+License: LGPLv2+ and GPLv2+
 Requires: libgpg-error-devel
 Requires: %{name}%{?_isa} = %{version}-%{release}
 Requires: pkgconfig
@@ -56,13 +61,21 @@ in GNU Privacy Guard.  This package contains files needed to develop
 applications using libgcrypt.
 
 %prep
-%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
 %setup -q
-%patch 1 -p1
-%patch 5 -p1
+%patch1 -p1
+%patch2 -p1
 
 %build
-# should be all algorithms except SM3 and SM4, aria
+# This package has a configure test which uses ASMs, but does not link the
+# resultant .o files.  As such the ASM test is always successful, even on
+# architectures were the ASM is not valid when compiling with LTO.
+#
+# -ffat-lto-objects is sufficient to address this issue.  It is the default
+# for F33, but is expected to only be enabled for packages that need it in
+# F34, so we use it here explicitly
+%define _lto_cflags -flto=auto -ffat-lto-objects
+
+# should be all algorithms except SM3 and SM4
 export DIGESTS='crc gostr3411-94 md4 md5 rmd160 sha1 sha256 sha512 sha3 tiger whirlpool stribog blake2'
 export CIPHERS='arcfour blowfish cast5 des aes twofish serpent rfc2268 seed camellia idea salsa20 gost28147 chacha20'
 
@@ -76,11 +89,9 @@ autoreconf -f
 %endif
      --enable-noexecstack \
      --enable-hmac-binary-check=%{hmackey} \
-     --disable-jent-support \
-     --disable-O-flag-munging \
+     %{!?with_brainpool:--disable-brainpool} \
      --enable-digests="$DIGESTS" \
      --enable-ciphers="$CIPHERS" \
-     --enable-marvin-workaround \
      --with-fips-module-version="$FIPS_MODULE_NAME %{version}-%{srpmhash}"
 sed -i -e '/^sys_lib_dlsearch_path_spec/s,/lib /usr/lib,/usr/lib /lib64 /usr/lib64 /lib,g' libtool
 %make_build
@@ -90,21 +101,18 @@ make check
 # try in faked FIPS mode too
 LIBGCRYPT_FORCE_FIPS_MODE=1 make check
 
-%define libpath $RPM_BUILD_ROOT%{gcrylibdir}/%{gcrysoname}.?.?
-
-PROFILE=%{?dist} annocheck --ignore-unknown --verbose --profile=${PROFILE:1} %{libpath}
-
 # Add generation of HMAC checksums of the final stripped binaries 
+%define libpath $RPM_BUILD_ROOT%{gcrylibdir}/%{gcrysoname}.?.?
 %define __spec_install_post \
     %{?__debug_package:%{__debug_install_post}} \
     %{__arch_install_post} \
     %{__os_install_post} \
-    cd src \
+    pushd src \
     sed -i -e 's|FILE=.*|FILE=\\\$1|' gen-note-integrity.sh \
     READELF=readelf AWK=awk ECHO_N="-n" bash gen-note-integrity.sh %{libpath} > %{libpath}.hmac \
-    objcopy --update-section .note.fdo.integrity=%{libpath}.hmac %{libpath} %{libpath}.new \
-    mv -f %{libpath}.new %{libpath} \
-    rm -f %{libpath}.hmac
+    objcopy --update-section .note.fdo.integrity=%{libpath}.hmac %{libpath} new \
+    mv -f new %{libpath} \
+    rm -f %{libpath}.hmac \
 %{nil}
 
 %install
@@ -174,61 +182,6 @@ mkdir -p -m 755 $RPM_BUILD_ROOT/etc/gcrypt
 %license COPYING
 
 %changelog
-* Mon Nov 03 2025 Jakub Jelen <jjelen@redhat.com> - 1.11.2-1
-- New upstream release (#2406804)
-
-* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.11.1-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Tue May 13 2025 Jakub Jelen <jjelen@redhat.com> - 1.11.1-1
-- New upstream release (#2364878)
-
-* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.11.0-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
-
-* Tue Oct 29 2024 Jakub Jelen <jjelen@redhat.com> - 1.11.0-4
-- Run annocheck as part of the build
-- Use upstream CF protection patches
-- Fix PAC/BTI protection for Aarch64
-- Fix CVE-2024-2236 (#2274128)
-
-* Thu Jul 25 2024 Jakub Jelen <jjelen@redhat.com> - 1.11.0-3
-- Disable -O flag munging and remove needles modification of LTO flags.
-
-* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.11.0-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
-
-* Wed Jun 19 2024 Jakub Jelen <jjelen@redhat.com> - 1.11.0-1
-- New upstream release (#2293064)
-
-* Tue Mar 26 2024 Jakub Jelen <jjelen@redhat.com> - 1.10.3-4
-- Replace deprecated fgrep (#2271503)
-
-* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.3-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.3-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Tue Nov 14 2023 Jakub Jelen <jjelen@redhat.com> - 1.10.3-1
-- New upstream release (#2249639)
-
-* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.2-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
-
-* Tue Apr 11 2023 Jakub Jelen <jjelen@redhat.com> - 1.10.2-1
-- New upstream release (#2185084)
-
-* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.1-7
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
-
-* Sat Dec  3 2022 Florian Weimer <fweimer@redhat.com> - 1.10.1-6
-- Port configure script to C99
-
-* Tue Nov 08 2022 Todd Zullinger <tmz@pobox.com> - 1.10.1-5
-- enable brainpool by default (#1413618)
-- fix sporadic failures generating RSA keys in FIPS mode
-
 * Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.1-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
 

signature_key.asc

@@ -1,86 +0,0 @@
------BEGIN PGP PUBLIC KEY BLOCK-----
-
-mQGNBFjLuq4BDACnM7zNSIaVMAacTwjXa5TGYe13i6ilHe4VL0NShzrgzjcQg531
-3cRgiiiNA7OSOypMqVs73Jez6ZUctn2GVsHBrS/io9NcuC9pVwf8a61WlcEa+EtB
-a3G7HlBmEWnwaUdAtWKNuAi9Xn+Ir7H2xEdksmmd5a0/QnL+sX705boVPF/tpYtb
-LGpPxa78tNrtxDkSwy8Wmi0IADYLI5yI7/yUGeJd8RSCU/fLRKC9fG7YOZRq0tsO
-MhVNWmtUjbG6e73Lu8LKnCZgs1/fC8hvPyARieSV5mdN8s1oWd7oYctfgL4uBleD
-ItAA8GhjKejutzHN8Ei/APw6AiiSyEjnPg+cTX8OgvLGJWjks0H6mPZeB1v/kGyZ
-hBS9vm540h2/MmlVN2ntiCK5TZGeSWpqddiqusfVXotMRpN4HeLKoZh4RAncaCbZ
-F/S+YLeN+kMXY4k3Fqt1fjTX6veFCbthI9pDdHzU9LfUVNp9D/5ktC/tYMORMegV
-+wSMxi9G2YWKJkMAEQEAAYkBzgQfAQgAOBYhBFuAxXVCmPDLVdjtarzvfilLCS4o
-BQJYy8DdFwyAAZSlyaA8L+XKOwldjh/fcjz0YraxAgcAAAoJELzvfilLCS4oNgoL
-/0+K1xIx8JW7Lk5M6bYCvNA4fdlEcwQIT4UidJFM9m+suxYFWIGfebvHpRlEuJTg
-dBjkEit8uLAoJXU0BRkKTLrzTF+qDUE79Wfx/R+0nOgJ7aMykQOi0AvuwzMYz4dg
-xIVS2Daou4DF7bh/KF8+fqrmq8P8W1ZrkuFDanMWpHeAPx1uj2skYbo7uPqFdvlJ
-hlNHrcxlcCkjf1InAt0Xt5lMvEsCRUPf9xAH4mNEhs0lh9c+200YPRmtnLWAzc1K
-ckLIC8Q+mUR3DjZDqBlDBEPegXkrI0+MlvRA+9AnAm4YPqTMUfpZ6ZOAWeFjC/6Z
-QYxG/AdWGkb4WFindzklQfybEuiekP8vU07ACQwSwH8PYe0UCom1YrlRUjX7QLkn
-ZLWoeZg8BZy9GTM1Ut7Q1Q2uTw6mxxISuef+RFgYOHjWwLpFWZpqC88xERl7o/iz
-iERJRt/593IctbjO9wenWt2peIAwzR4nz7LqM6ZFTdRAETmcdSvYRhg2Qt8hUE47
-CbQkQW5kcmUgSGVpbmVja2UgKFJlbGVhc2UgU2lnbmluZyBLZXkpiQHUBBMBCAA+
-FiEEW4DFdUKY8MtV2O1qvO9+KUsJLigFAljLuq4CGwMFCRLMAwAFCwkIBwIGFQgJ
-CgsCBBYCAwECHgECF4AACgkQvO9+KUsJLihC/QwAhCC+SEvcFLcutgZ8HfcCtoZs
-IoVzZEy7DjqIvGgnTssD8HCLnIAHCDvnP7dJW3uMuLCdSqym3cjlEIiQMsaGywkl
-fzJISAwJrGQdWSKRd535jXpEXQlXDKal/IwMKAUt0PZtlCc9S3gwixQryxdJ28lJ
-6h2T9fVDr8ZswMmTAFG91uctfhjKOMgPt8UhSPGW484WsIsQgkbOvf+Kfswl0eHu
-ywX+pKAB5ZQ/9GVC6Ug4xfrdiJL0azJTPnvjMY5JYp6/L9RURs5hP5AnHR2j/PPo
-sAtsFCjmbRbOMiASzklnUJPbSz5kfLloDWZmrUScjbzmsXehGyt433JGyRhZJl4x
-/jPbzKhaaAHsGd+fRao6vlLOwFywDDVMp6JuyK7UeUb7I8ekTbSkGFA+l2Oa3O6/
-Y7PYhq7hwwAFuZckYI98IpHNCG1fS9W07FyKdvQbK1PbF1JFRKfsUCWYMKqDnbqE
-o5jivPEHZImw6iYhhXcyEYl8fjcb9T6/S+wOP7aviQGzBBABCAAdFiEElKXJoDwv
-5co7CV2OH99yPPRitrEFAljLv5sACgkQH99yPPRitrFw4gv/XFMFN+/LHsn9hJOP
-4rCwl1yUuxXuYmZgc0sRoY3EpeQkJVyKurQuqqKoy2VuoMiF0O1kAQmGoFtVPUk7
-b8hCoutqB5GyeyKcoLP+WINgVhB2gXg7TSp3MPLBKkgqvSDvPitgRxBqFb4LW8LJ
-bDbfwGrzIvXfDV3WvsrHVPbc2fhlWdL8d+3AE6mFiXF3eTpgmV3ApSBQV12MkkCk
-icLIPmp+ZxZON+OP52ZXkRtfMgOy4Oa/41agrViDAZdMOGeGkhPertQheQZgXzmo
-GF5Wz498HPM80Kv35X91l3iGzL+icEtO+tWea2YscsZ6qpRe2lfVPHk3B+anlmCj
-m4kM4cBd39xa4HHSVh/bRHbZNtgVr7slQCKxlHgQOGVI5vCxPCwEsgJ2KBk03Nk/
-IA9EKO+czfh3/bHW6uMbEqrYDCnt+hmzZrpKDSGcwS/KOhvMUIMlb7/8vDKum6mp
-/8xAtVZ6IAxYZNt3qg7Y7aLRtzCTyqm8rJQrZPtRaQcgLoEimDMEX0PliRYJKwYB
-BAHaRw8BAQdAz75Hlekc16JhhfI0MKdEVxLdkxhcMCO0ZG6WMBAmNpe0H1dlcm5l
-ciBLb2NoIChkaXN0IHNpZ25pbmcgMjAyMCmImgQTFgoAQhYhBG2qbmSnbShAVxtJ
-AlKIl7gmQDraBQJfQ+w1AhsDBQkShccRBQsJCAcCAyICAQYVCgkICwIEFgIDAQIe
-BwIXgAAKCRBSiJe4JkA62nmuAP9uL/HOdB0gvwWrH+FpURJLs4bnaZaPIk9ARrU0
-EXRgJgD/YCGfHQXpIPT0ZaXuwJexK04Z+qMFR/bM1q1Leo5CjgaIbQQQEQsAHRYh
-BIBhWHD1utaQMzaG0PKthaweQrNnBQJfQ/HmAAoJEPKthaweQrNnIZkA3jG6LcZv
-V/URn8Y8OJqsyYa4C3NI4nN+OhEvYhgA4PHzMnALeXIpA2gblvjFIPJPAhDBAU37
-c5PA6+6IdQQQFggAHRYhBK6oTtzwGthsRwHIXGMROuhmWH0KBQJfQ/IlAAoJEGMR
-OuhmWH0K1+MA/0uJ5AHcnSfIBEWHNJwwVVLGyrxAWtS2U+zeymp/UvlPAQDErCLZ
-l0dBiPG3vlowFx5TNep7tanBs6ZJn8F1ao1tAIkBMwQQAQgAHRYhBNhpISPEBl3q
-Xg86tSSbOdJPJeO2BQJfQ/OuAAoJECSbOdJPJeO2DVoH/0o9if66ph6FJrgr+A/W
-HNVeHxmM5tUQhpL1wpRS70SKcsJgolf5CxO5iTQf3HlZe544xGbIU/aCTJsWw9zi
-UE8KmhAtKV4eL/7oQ7xx4nxPnABLpudtM8A44nsM1x/XiYrJnnDm29QjYEGd2Hi8
-7npc7VWKzLoj+I/WcXquynJi5O9TUxW9Bknd1pjpxFkf8v+msjBzCD5VKJgr0CR8
-wA6peQBWeGZX2HacosMIZH4TfL0r0TFla6LJIkNBz9DyIm1yL4L8oRH0950hQljP
-C7TM3L7aRpX+4Kph6llFz6g7MALGFP95kyJ6o+XED9ORuuQVZMBMIkNC0tXOu10V
-bdqIdQQQFgoAHRYhBMHTS2khnkruwLocIeP9/yGORbcrBQJfQ/P8AAoJEOP9/yGO
-Rbcr3lQBAMas8Vl3Hdl3g2I283lz1uHiGvlwcnk2TLeB+U4zIwC9AQCy0nnazVNt
-VQPID1ZCMoaOX7AzOjaqQDLf4j+dVTxgBJgzBGCkgocWCSsGAQQB2kcPAQEHQJmd
-fwp8jEN5P3eEjhQiWk6zQi8utvgOvYD57XmE+H8+tCBOaWliZSBZdXRha2EgKEdu
-dVBHIFJlbGVhc2UgS2V5KYiaBBMWCgBCFiEErI4RW/c+LY1H+pkI6Y6bLRnGyL0F
-AmCkgocCGwMFCQsNBpkFCwkIBwIDIgIBBhUKCQgLAgQWAgMBAh4HAheAAAoJEOmO
-my0Zxsi9/4IA/1rvSr3MU+Sv4jhNDzD+CeC3gmHkPew6pi9VHEsEwdgmAQD2BtiX
-7w1sJL/CBylGWv5jxj4345mP9YfZm0RsgzPjDIh1BBAWCAAdFiEEJJyzdxdQdF1c
-3TI84mewUjZPAo0FAmFAQ54ACgkQ4mewUjZPAo1CiAD+KTT1UVdQTGHMyvHwZocS
-QjU8xhcZrTet+dvvjrE5+4MA/RBdJPZgFevUKu68NEy0Lo+RbkeCtmQJ/c8v5ieF
-vW0AiQEzBBABCAAdFiEEEkEkvTtIYq96CkLxALRevUynur4FAmFAQ7cACgkQALRe
-vUynur4kaAgAolPR8TNWVS0vXMKrr0k0l2M/8QkZTaLZx1GT9Nx1yb4WJKY7ElPM
-YkhGDxetvFBETx0pH/6R3jtj6Crmur+NKHVSRY+rCYpFPDn6ciIOryssRx2G4kCZ
-t+nFB9JyDbBOZAR8DK4pN1mAxG/yLDt4oKcUQsP2xlEFum+phxyR8KyYCpkwKRxY
-eK+6lfilQuveoUwp/Xx5wXPNUy6q4eOOovCW7gS7I7288NGHCa2ul8sD6vA9C4mM
-4Zxaole9P9wwJe1zZFtCIy88zHM9vqv+YM9DxMCaW24+rUztr7eD4bCRdG+QlSh+
-7R/TaqSxY1eAAd1J5tma9CNJO73pTKU+/JhTBGFpSqMTCSskAwMCCAEBBwIDBF6X
-D9NmUQDgiyYNbhs1DMJ14mIw812wY1HVx/4QWYWiBunhrvSFxVbzsjD7/Wv+v3bm
-MPrL+M2DLyFiSewNmcS0JEdudVBHLmNvbSAoUmVsZWFzZSBTaWduaW5nIEtleSAy
-MDIxKYiaBBMTCABCFiEEAvON/3Mf+XywOaHaVJ5pXpBboggFAmFpSqMCGwMFCQ9x
-14oFCwkIBwIDIgIBBhUKCQgLAgQWAgMBAh4HAheAAAoJEFSeaV6QW6IITkoA/RYa
-jaTl1eEBU/Gdm12o3jrI55N5xZK2XTqSx25clVyjAP0XwMW/Og5+ND1ri3bAqADV
-WlBDUswz8wYxsb0C4kYBkoh1BBAWCgAdFiEEbapuZKdtKEBXG0kCUoiXuCZAOtoF
-AmFpTvEACgkQUoiXuCZAOtrJQAEAh7YyykjAy/Qs1yC3ji8iBfIVnPXvblrIx3SR
-RyDwRC8BAKtZbEuKTtPlgkLUgMleTcZJ/vEhJE+GvfQ9o5gWCqEFiHUEEBYKAB0W
-IQTB00tpIZ5K7sC6HCHj/f8hjkW3KwUCYWlPWgAKCRDj/f8hjkW3Kx4eAQDp6aGS
-N/fU4xLl8RSvQUVjVA+aCTrMQR3hRwqw8liF2wEA3O3ECxz6e1+DoItYoJBBLKLw
-eiInsGZ/+h5XYrpXTgA=
-=4+Sn
------END PGP PUBLIC KEY BLOCK-----

sources

@@ -1,2 +1,2 @@
-SHA512 (libgcrypt-1.11.2.tar.bz2) = b706cea602cc8f0896e57ce979643bf78974b05faec27c1b053b773c57d8b04250e30e95a4ef5899e1df981d01d8d08f0a36e10b5820a5ec4183e74c02e5f1f0
-SHA512 (libgcrypt-1.11.2.tar.bz2.sig) = e63d240a9b97aa218c98c5baa72a30321ae85412d4a8748e36578bd9498fe8c8ee2ba84835d1783cdfc1e5dfb66b0a89409d6263e9c06f4cd11e919d4bce0cd2
+SHA512 (libgcrypt-1.10.1.tar.bz2) = e5ca7966624fff16c3013795836a2c4377f0193dbb4ac5ad2b79654b1fa8992e17d83816569a402212dc8367a7980d4141f5d6ac282bae6b9f02186365b61f13
+SHA512 (libgcrypt-1.10.1.tar.bz2.sig) = b156ae05079776698bc95ba5a9e48e95de8f716aa1760ef4b2e7cb8518ccec660337fc7823f865bde870461800d472fd8e458d03a7095b6bb614f6dd96f796d8

tests/smoke-test/main.fmf

@@ -1,25 +0,0 @@
-summary: Test calls upstream test suite.
-test: ./runtest.sh
-enabled: true
-framework: beakerlib
-require:
-  - library(distribution/fips)
-recommend:
-  - libgcrypt
-  - nfs-utils
-  - rpm-build
-  - autoconf
-  - automake
-  - libtool
-  - gawk
-  - gcc-c++
-  - libgpg-error-devel
-  - pkgconfig
-  - texinfo
-  - fipscheck
-  - libkcapi-fipscheck
-  - crypto-policies-scripts
-  - bc
-  - annobin-annocheck
-  - gnupg2
-duration: 45m

tests/smoke-test/runtest.sh

@@ -54,35 +54,41 @@ rlJournalStart
         rlRun "pushd $TOPDIR" 0
         rlRun "rm -rf BUILD/libgcrypt-*" 0-255
         rlRun "rpmbuild -vv -bc SPECS/libgcrypt.spec" 0
-        libgcrypt_dir="libgcrypt-`rpm -q --qf "%{VERSION}\n" libgcrypt | head -1`"
-        if [ -d "BUILD/$libgcrypt_dir-build" ]; then
-            BUILDDIR="BUILD/$libgcrypt_dir-build/$libgcrypt_dir"
-        else
-            BUILDDIR="BUILD/$libgcrypt_dir"
-        fi
-        rlRun "pushd $BUILDDIR" 0
+        rlRun "pushd BUILD/libgcrypt-*" 0
         rlRun "fipshmac src/.libs/libgcrypt.so.??" 0
         rlRun "popd"
         rlRun "popd"
     rlPhaseEnd
 
     rlPhaseStartTest "Upstream testsuite"
-        rlRun "pushd $TOPDIR/$BUILDDIR" 0
+        rlRun "pushd $TOPDIR/BUILD/libgcrypt-*" 0
         exp_fails=()
-
+        if [[ $fipsMode = 'enabled' ]]; then
+            if rlIsFedora 33; then
+                exp_fails+=("basic")
+                exp_fails+=("basic-disable-all-hwf")
+                exp_fails+=("t-kdf")
+                exp_fails+=("t-secmem")
+            elif rlIsFedora 34; then
+                exp_fails+=("basic")
+                exp_fails+=("basic-disable-all-hwf")
+                exp_fails+=("t-kdf")
+                exp_fails+=("t-secmem")
+                exp_fails+=("t-x448")
+            elif rlIsFedora 35; then # Fedora-35
+                exp_fails+=("curves")
+            fi
+        fi
         rlRun "echo 'Expecting ${#exp_fails[@]} fails'"
         exp_exitcode=0
         if [[ ${#exp_fails[@]} -gt 0 ]]; then exp_exitcode=2; fi
         rlRun "make check &> $TmpDir/make_check.out" $exp_exitcode
         rlRun "grep ^FAIL: $TmpDir/make_check.out" 0,1 "Print fails"
         if [[ ${#exp_fails[@]} -gt 0 ]]; then
-            for f in $(grep '^FAIL:' $TmpDir/make_check.out | awk -F ': ' '{print $2}'); do
-                if [[ "${exp_fails[@]}" =~ "$f" ]]; then
-                    rlLog "$f failure is expected"
-                else
-                    rlFail "$f failure is not expected"
-                fi
+            for f in "${exp_fails[@]}"; do
+                rlAssertGrep "^FAIL: $f\$" $TmpDir/make_check.out
             done
+            [[ $(grep -c '^FAIL:' $TmpDir/make_check.out) -eq ${#exp_fails[@]} ]] || rlFail "Unexpected fails present"
         else
             rlRun "grep \"All [0-9]\+ tests passed\" $TmpDir/make_check.out" 0 \
                 "All tests passed"
@@ -113,12 +119,12 @@ rlJournalStart
             for i in `seq 1 $N_SAMPLES`; do
                 # run with HW optimizations ENAbled
                 rm -f $HWF_DENY_FILE
-                $TOPDIR/$BUILDDIR/tests/bench-slope $alg_type $algorithm |grep "$alg_line" >>$algorithm.ena
+                $TOPDIR/BUILD/libgcrypt-*/tests/bench-slope $alg_type $algorithm |grep "$alg_line" >>$algorithm.ena
 
                 # run with HW optimizations DISabled
                 # this looks idiotic, but I wasn't able to make --disable-hwf work
                 echo "all" >$HWF_DENY_FILE
-                $TOPDIR/$BUILDDIR/tests/bench-slope $dis_arg $alg_type $algorithm |grep "$alg_line" >>$algorithm.dis
+                $TOPDIR/BUILD/libgcrypt-*/tests/bench-slope $dis_arg $alg_type $algorithm |grep "$alg_line" >>$algorithm.dis
             done
             rlLogInfo "Performance measurements finished"
             rlRun "cat $algorithm.ena"

tests/tests.yml

@@ -0,0 +1,20 @@
+- hosts: localhost
+  tags:
+  - classic
+  - container
+  roles:
+  - role: standard-test-beakerlib
+    tests:
+    - smoke-test
+    required_packages:
+    - fipscheck
+    - gawk
+    - gcc-c++
+    - libgcrypt
+    - libgpg-error-devel
+    - libselinux-utils
+    - nfs-utils
+    - pkgconfig
+    - rpm-build
+    - texinfo
+    - wget