diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/000-Fix-build-with-gcc-8.2.x.patch b/000-Fix-build-with-gcc-8.2.x.patch deleted file mode 100644 index 6fd575a..0000000 --- a/000-Fix-build-with-gcc-8.2.x.patch +++ /dev/null @@ -1,51 +0,0 @@ -From 52620ec798a580b2053d16a42362e9926729eb30 Mon Sep 17 00:00:00 2001 -From: Fabrice Fontaine -Date: Sun, 20 Jan 2019 20:04:13 +0100 -Subject: [PATCH] apps/kcapi-hasher.c: fix build with gcc 8.2.x - -Fixes: - - http://autobuild.buildroot.org/results/8355bc42238e885f7f11ed3d9d37fc55ebdead2b - -Signed-off-by: Fabrice Fontaine -Signed-off-by: Stephan Mueller ---- - apps/kcapi-hasher.c | 12 ++++++++---- - 1 file changed, 8 insertions(+), 4 deletions(-) - -diff --git a/apps/kcapi-hasher.c b/apps/kcapi-hasher.c -index d6be685..7172b12 100644 ---- a/apps/kcapi-hasher.c -+++ b/apps/kcapi-hasher.c -@@ -357,16 +357,20 @@ static int hasher(struct kcapi_handle *handle, const struct hash_params *params, - } - - /* -- * GCC v8.1.0 introduced -Wstringop-truncation but it is not smart enough to -- * find that cursor string will be NULL-terminated after all paste() calls and -- * warns with: -+ * GCC v8.1.0 introduced -Wstringop-truncation and GCC v8.2.0 introduced -+ * -Wstringop-overflow but it is not smart enough to find that cursor string -+ * will be NULL-terminated after all paste() calls and warns with: - * error: 'strncpy' destination unchanged after copying no bytes [-Werror=stringop-truncation] - * error: 'strncpy' output truncated before terminating nul copying 5 bytes from a string of the same length [-Werror=stringop-truncation] -+ * error: 'strncpy' specified bound depends on the length of the source argument [-Werror=stringop-overflow=] - */ - #pragma GCC diagnostic push - #if GCC_VERSION >= 80100 - #pragma GCC diagnostic ignored "-Wstringop-truncation" - #endif -+#if GCC_VERSION >= 80200 -+#pragma GCC diagnostic ignored "-Wstringop-overflow" -+#endif - static char *paste(char *dst, const char *src, size_t size) - { - strncpy(dst, src, size); -@@ -417,7 +421,7 @@ static char *get_hmac_file(const char *filename, const char *checkdir) - strncpy(cursor, "\0", 1); - return checkfile; - } --#pragma GCC diagnostic pop /* -Wstringop-truncation */ -+#pragma GCC diagnostic pop /* -Wstringop-truncation -Wstringop-overflow */ - - static int hash_files(const struct hash_params *params, - char *filenames[], uint32_t files, diff --git a/changelog b/changelog new file mode 100644 index 0000000..ce71afd --- /dev/null +++ b/changelog @@ -0,0 +1,247 @@ +* Sat Aug 13 2022 Ondrej Mosnáček - 1.4.0-2 +- Switch to rpmautospec + +* Sat Aug 13 2022 Ondrej Mosnáček - 1.4.0-1 +- Update to upstream version 1.4.0 +- Re-enable cppcheck scanning on Fedora +- Resolves: rhbz#2056732 + +* Thu Jul 21 2022 Fedora Release Engineering - 1.3.1-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Thu Jan 20 2022 Fedora Release Engineering - 1.3.1-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Thu Jul 22 2021 Fedora Release Engineering - 1.3.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Wed Jul 14 2021 Simo Sorce - 1.3.1-2 +- Remove LTO build suppression by using better symver machinery + +* Wed Jul 14 2021 Simo Sorce - 1.3.1-1 +- Update to upstream version 1.3.1 which fixes ABI issues + +* Mon Jul 12 2021 Simo Sorce - 1.3.0-1 +- Update to upstream version 1.3.0 + +* Mon Mar 15 2021 Sahana Prasad - 1.2.1-1 +- Update to upstream version 1.2.1 +- Remove patch fix MSG_MORE uasge as it is added upstream +- Remove cppcheck dependency for rhel bz#1931518 +- Add a patch to fix fuzz tests + +* Tue Jan 26 2021 Fedora Release Engineering - 1.2.0-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Fri Aug 14 2020 Ondrej Mosnáček - 1.2.0-3 +- Require perl-interpreter instead of full perl +- Backport fix for 5.9 kernels + +* Tue Jul 28 2020 Fedora Release Engineering - 1.2.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Mon May 25 2020 Sahana Prasad - 1.2.0-1 +- Update to upstream version 1.2.0 tracked by BZ 1839592. +- Enable kcapi-enc tests as libkcapi BZ 1826022 is fixed. +- Remove 110-fipshmac-compat.patch as the changes are merged upstream. +- Remove 100-workaround-cppcheck-bug.patch as the changes are merged upstream. + +* Tue May 05 2020 Ondrej Mosnáček - 1.1.5-5 +- Fix the CI test failures +- Enable building on old kernels +- Avoid conflicts between different versions of packages + +* Thu Apr 23 2020 Tomáš Mráz - 1.1.5-4 +- Add . prefix to files created by fipshmac if -d option is not specified + +* Wed Apr 22 2020 Sahana Prasad - 1.1.5-3 +- Disables kcapi-enc tests until the kernel bug bz 1826022 is fixed. +- Produce also the fipscheck replacement package + +* Wed Jan 29 2020 Fedora Release Engineering - 1.1.5-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Tue Aug 13 2019 Ondrej Mosnáček - 1.1.5-1 +- Update to upstream version 1.1.5 + +* Sat Jul 27 2019 Ondrej Mosnáček - 1.1.4-6 +- Backport patch to fix test failure on aarch64 +- Remove no longer needed ppc64 workaround + +* Sat Jul 27 2019 Ondrej Mosnáček - 1.1.4-5 +- Backport patch to fix tests + +* Thu Jul 25 2019 Ondrej Mosnáček - 1.1.4-4 +- Work around cppcheck issue +- Enable gating + +* Thu Jul 25 2019 Fedora Release Engineering - 1.1.4-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Mon May 27 2019 Ondrej Mosnáček - 1.1.4-2 +- Fix FTBFS: hardlink is now in bindir + +* Sat Feb 02 2019 Ondrej Mosnáček - 1.1.4-1 +- Update to upstream version 1.1.4 + +* Fri Feb 01 2019 Ondrej Mosnáček - 1.1.3-3 +- Fix build with new GCC + +* Fri Feb 01 2019 Fedora Release Engineering - 1.1.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Thu Aug 23 2018 Ondrej Mosnáček - 1.1.3-1 +- Update to upstream version 1.1.3 + +* Thu Aug 09 2018 Ondrej Mosnáček - 1.1.1-16 +- Add missing dependencies to the tests package +- Update patch from upstream + +* Thu Aug 09 2018 Ondrej Mosnáček - 1.1.1-15 +- Build and tests require perl + +* Thu Aug 09 2018 Ondrej Mosnáček - 1.1.1-14 +- Add missing script to the 'tests' package + +* Wed Aug 08 2018 Ondrej Mosnáček - 1.1.1-13 +- Add missing requires to the 'tests' subpackage + +* Tue Aug 07 2018 Ondrej Mosnáček - 1.1.1-12 +- Produce a subpackage with test scripts +- Build the 'tests' subpackage conditionally + +* Wed Aug 01 2018 Ondrej Mosnáček - 1.1.1-11 +- Add patch to fix unwanted closing of FD 0 + +* Tue Jul 31 2018 Ondrej Mosnáček - 1.1.1-10 +- Remove the kernel headers workaround + +* Fri Jul 27 2018 Igor Gnatenko - 1.1.1-9 +- Rebuild for new binutils + +* Fri Jul 27 2018 Ondrej Mosnáček - 1.1.1-8 +- Add more Coverity fixes from upstream +- Add patch to fix AEAD fuzz test for BE arches +- Fixup specfile + +* Mon Jul 23 2018 Ondrej Mosnáček - 1.1.1-7 +- Add various fixes from upstream +- Drop the Requires on kernel package + +* Mon Jul 16 2018 Ondrej Mosnáček - 1.1.1-6 +- Put .hmac files into a separate directory + +* Fri Jul 13 2018 Fedora Release Engineering - 1.1.1-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Thu Jul 12 2018 Ondrej Mosnáček - 1.1.1-4 +- Add patch to work around FTBFS on rawhide + +* Wed Jul 11 2018 Ondrej Mosnáček - 1.1.1-3 +- Fix off-by-one error in checkfile parsing + +* Wed Jul 11 2018 Ondrej Mosnáček - 1.1.1-2 +- Fix command-line parsing in libkcapi-hmaccalc + +* Mon Jun 18 2018 Ondrej Mosnáček - 1.1.1-1 +- Update to upstream version 1.1.1 + +* Wed May 09 2018 Ondrej Mosnáček - 1.1.0-5 +- Skip CLang static analysis in RHEL +- Revert "Skip CLang static analysis in RHEL" +- Use own sha512hmac and fipscheck + +* Wed May 02 2018 Ondrej Mosnáček - 1.1.0-4 +- Fix description lines being too long + +* Fri Apr 27 2018 Björn Esser - 1.1.0-3 +- Fix conditional for hmaccalc replacement + +* Mon Apr 16 2018 Ondrej Mosnáček - 1.1.0-2 +- Enable hmaccalc replacements in Fedora 28+ + +* Thu Apr 12 2018 Ondrej Mosnáček - 1.1.0-1 +- Update to upstream version 1.1.0 + +* Sat Mar 31 2018 Björn Esser - 1.0.3-10 +- Replace single patches with a monolitic one from upstream +- Obsolete replacements subpackage +- Ignore failing tests on %%{power64} temporarily + +* Thu Mar 08 2018 Ondrej Mosnáček - 1.0.3-9 +- Split up the replacements subpackage + +* Mon Feb 26 2018 Björn Esser - 1.0.3-8 +- Increase optmem_max preset to 81920 + +* Mon Feb 26 2018 Björn Esser - 1.0.3-7 +- Obsoletes work by package name, not by provides (rhbz#1537225) + +* Sun Feb 25 2018 Björn Esser - 1.0.3-6 +- Add patch to fix a copy-paste typo + +* Sat Feb 17 2018 Björn Esser - 1.0.3-5 +- Add patch to fix build with -Werror + +* Wed Feb 07 2018 Fedora Release Engineering +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + +* Sun Feb 04 2018 Björn Esser - 1.0.3-3 +- Switch to %%ldconfig_scriptlets + +* Wed Jan 17 2018 Björn Esser - 1.0.3-2 +- Decrease optmem_max preset to 40960 +- Let the build fail, if the minimum kernel version cannot be met +- Conditionalize the sysctl.d tweak on version of the kernel +- Conditionalize the name of README.distro on the distro + +* Tue Jan 16 2018 Björn Esser - 1.0.3-1 +- Initial import (rhbz#1533929) + +* Tue Jan 16 2018 Björn Esser - 1.0.3-0.13 +- Increase optmem_max preset to 81920 + +* Tue Jan 16 2018 Björn Esser - 1.0.3-0.12 +- Add sysctl.d preset and README.fedora + +* Mon Jan 15 2018 Björn Esser - 1.0.3-0.11 +- Make the contents of the -replacements package configurable + +* Mon Jan 15 2018 Björn Esser - 1.0.3-0.10 +- Fix Obsoletes of the -replacements package + +* Sun Jan 14 2018 Björn Esser - 1.0.3-0.9 +- Disable the -replacements package until we have a plan for it + +* Sun Jan 14 2018 Björn Esser - 1.0.3-0.8 +- Move the kcapi-hasher binary to -replacements package, since it is + not of much use without the linked invocation names and saves the + extra Requires on the -tools package + +* Sun Jan 14 2018 Björn Esser - 1.0.3-0.7 +- Fix internal Requires of sub-packages +- Hardlink files in %%{_bindir} + +* Sun Jan 14 2018 Björn Esser - 1.0.3-0.6 +- Add patches from upstream + +* Sat Jan 13 2018 Björn Esser - 1.0.3-0.5 +- Add patches from upstream + +* Sat Jan 13 2018 Björn Esser - 1.0.3-0.4 +- Asume the testsuite cannot be run, if the value of optmem_max cannot + be obtained + +* Sat Jan 13 2018 Björn Esser - 1.0.3-0.3 +- Move libraries to /%%{_lib} instead of %%{_libdir}, which is useful + during boot when the library might be needed before a potentially + seperate /usr partition is mounted + +* Sat Jan 13 2018 Björn Esser - 1.0.3-0.2 +- Asume optmem_max is at least 20480, if the real value cannot be obtained + +* Fri Jan 12 2018 Björn Esser - 1.0.3-0.1 +- New upstream release + +* Wed Jan 10 2018 Björn Esser - 1.0.2-0.1 +- Initial rpm release (rhbz#1533929) diff --git a/fipshmac-openssl.sh b/fipshmac-openssl.sh new file mode 100644 index 0000000..c554434 --- /dev/null +++ b/fipshmac-openssl.sh @@ -0,0 +1,9 @@ +#!/bin/bash + +# Mocks fipshmac using the openssl tool. +# Only for use during RPM build. + +[ "$1" = '-d' ] || exit 1 + +openssl sha256 -hmac orboDeJITITejsirpADONivirpUkvarP -hex "$3" | cut -f 2 -d ' ' \ + >"$2/$(basename "$3").hmac" diff --git a/gating.yaml b/gating.yaml new file mode 100644 index 0000000..c2182c7 --- /dev/null +++ b/gating.yaml @@ -0,0 +1,6 @@ +--- !Policy +product_versions: + - fedora-* +decision_context: bodhi_update_push_stable +rules: + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} diff --git a/libkcapi.spec b/libkcapi.spec index cabb560..9338486 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -1,11 +1,16 @@ # Shared object version of libkcapi. %global vmajor 1 -%global vminor 1 -%global vpatch 4 +%global vminor 5 +%global vpatch 0 # Do we build the replacements packages? %bcond_with replace_coreutils +# Replace fipscheck by default in Fedora 33+: +%if 0%{?fedora} >= 33 || 0%{?rhel} >= 9 +%bcond_without replace_fipscheck +%else %bcond_with replace_fipscheck +%endif # Replace hmaccalc by default in Fedora 28+: %if 0%{?fedora} >= 28 || 0%{?rhel} >= 8 %bcond_without replace_hmaccalc @@ -17,6 +22,21 @@ %else %bcond_with test_package %endif +# disable cppcheck analysis in ELN/RHEL to avoid the dependency bz#1931518 +%if 0%{?rhel} +%bcond_with cppcheck +%else +%bcond_without cppcheck +%endif + +# Use `--without test` to build without running the tests +%bcond_without test +# Use `--without fuzz_test` to skip the fuzz test during build +%bcond_without fuzz_test +# Use `--without doc` to build without the -doc subpackage +%bcond_without doc +# Use `--without clang_sa` to skip clang static analysis during build +%bcond_without clang_sa # This package needs at least Linux Kernel v4.10.0. %global min_kernel_ver 4.10.0 @@ -56,8 +76,7 @@ # Do we replace fipscheck? %if %{with replace_fipscheck} -# TODO: Adapt this when replacing fipscheck initially. -%global fipscheck_evr 1.5.0-3%{?dist} +%global fipscheck_evr 1.5.0-9 %endif # Do we replace hmaccalc? @@ -65,61 +84,69 @@ %global hmaccalc_evr 0.9.14-10%{?dist} %endif -%global apps_hmaccalc sha1hmac sha224hmac sha256hmac sha384hmac sha512hmac -%global apps_fipscheck sha1sum sha224sum sha256sum sha384sum sha512sum md5sum fipscheck fipshmac +%global apps_coreutils sha1sum sha224sum sha256sum sha384sum sha512sum md5sum sm3sum +%global apps_hmaccalc sha1hmac sha224hmac sha256hmac sha384hmac sha512hmac sm3hmac +%global apps_fipscheck fipscheck fipshmac -# Add generation of HMAC checksums of the final stripped -# binaries. %%define with lazy globbing is used here +# On old kernels use mock hashers implemented via openssl +%if %{lua:print(rpm.vercmp(posix.uname('%r'), '3.19'));} >= 0 +%global sha512hmac bin/kcapi-hasher -n sha512hmac +%global fipshmac bin/kcapi-hasher -n fipshmac +%else +%global sha512hmac bash %{SOURCE2} +%global fipshmac bash %{SOURCE3} +%endif + +# Add generation of HMAC checksum of the final stripped +# binary. %%define with lazy globbing is used here # intentionally, because using %%global does not work. %define __spec_install_post \ %{?__debug_package:%{__debug_install_post}} \ %{__arch_install_post} \ %{__os_install_post} \ bin_path=%{buildroot}%{_bindir} \ -lib_path=%{buildroot}/%{_lib} \ -for app in %{apps_hmaccalc}; do \ - test -e "$bin_path"/$app || continue \ - { bin/kcapi-hasher -n sha512hmac "$bin_path"/$app || exit 1; } \\\ - | cut -f 1 -d ' ' >"$lib_path"/hmaccalc/$app.hmac \ -done \ -for app in %{apps_fipscheck}; do \ - test -e "$bin_path"/$app || continue \ - bin/kcapi-hasher -n fipshmac -d "$lib_path"/fipscheck \\\ - "$bin_path"/$app || exit 1 \ -done \ -%{_bindir}/hardlink -cfv %{buildroot}%{_bindir} \ -bin/kcapi-hasher -n fipshmac -d "$lib_path"/fipscheck \\\ - "$lib_path"/libkcapi.so.%{version} || exit 1 \ +lib_path=%{buildroot}%{_libdir} \ +{ %sha512hmac "$bin_path"/kcapi-hasher || exit 1; } | \\\ + cut -f 1 -d ' ' >"$lib_path"/hmaccalc/kcapi-hasher.hmac \ +{ %sha512hmac "$lib_path"/libkcapi.so.%{version} || exit 1; } | \\\ + cut -f 1 -d ' ' >"$lib_path"/hmaccalc/libkcapi.so.%{version}.hmac \ %{__ln_s} libkcapi.so.%{version}.hmac \\\ - "$lib_path"/fipscheck/libkcapi.so.%{vmajor}.hmac \ + "$lib_path"/hmaccalc/libkcapi.so.%{vmajor}.hmac \ %{nil} - Name: libkcapi Version: %{vmajor}.%{vminor}.%{vpatch} -Release: 2%{?dist} +Release: %autorelease Summary: User space interface to the Linux Kernel Crypto API -License: BSD or GPLv2 -URL: http://www.chronox.de/%{name}.html -Source0: http://www.chronox.de/%{name}/%{name}-%{version}.tar.xz -Source1: http://www.chronox.de/%{name}/%{name}-%{version}.tar.xz.asc +License: BSD-3-Clause OR GPL-2.0-only +URL: https://www.chronox.de/%{name}/ +Source0: https://www.chronox.de/%{name}/releases/%{version}/%{name}-%{version}.tar.xz +Source1: https://www.chronox.de/%{name}/releases/%{version}/%{name}-%{version}.tar.xz.asc +Source2: sha512hmac-openssl.sh +Source3: fipshmac-openssl.sh -Patch0: %{giturl}/commit/52620ec798a5.patch#/000-Fix-build-with-gcc-8.2.x.patch - -BuildRequires: clang +BuildRequires: bash BuildRequires: coreutils -BuildRequires: cppcheck -BuildRequires: docbook-utils-pdf BuildRequires: gcc -BuildRequires: git +BuildRequires: git-core BuildRequires: hardlink BuildRequires: kernel-headers >= %{min_kernel_ver} BuildRequires: libtool +BuildRequires: make BuildRequires: openssl -BuildRequires: perl +BuildRequires: perl-interpreter BuildRequires: systemd BuildRequires: xmlto +%if %{with doc} +BuildRequires: docbook-utils-pdf +%endif +%if %{with clang_sa} +BuildRequires: clang +%endif +%if %{with cppcheck} +BuildRequires: cppcheck >= 2.4 +%endif # For ownership of %%{_sysctldir}. Requires: systemd @@ -149,18 +176,32 @@ Requires: %{name}%{?_isa} == %{version}-%{release} Header files for applications that use %{name}. +%if %{with doc} %package doc Summary: User documentation for the %{name} package BuildArch: noarch +# Depend on one of the base packages because they have the license files +# We cannot just bundle them into doc because they might conflict with an +# older or newer version of the base package. +Requires: %{name} == %{version}-%{release} %description doc User documentation for %{name}. +%endif + + +%package hasher +Summary: Common %{name} hashing application +Requires: %{name}%{?_isa} == %{version}-%{release} + +%description hasher +Provides The kcapi-hasher binary used by other %{name} subpackages. %if %{with replace_coreutils} %package checksum Summary: Drop-in replacement for *sum utils provided by the %{name} package -Requires: %{name}%{?_isa} == %{version}-%{release} +Requires: %{name}-hasher%{?_isa} == %{version}-%{release} Requires: coreutils%{?_isa} >= %{coreutils_evr} @@ -176,7 +217,7 @@ coreutils) using %{name}. %if %{with replace_fipscheck} %package fipscheck Summary: Drop-in replacements for fipscheck/fipshmac provided by the %{name} package -Requires: %{name}%{?_isa} == %{version}-%{release} +Requires: %{name}-hasher%{?_isa} == %{version}-%{release} Obsoletes: fipscheck <= %{fipscheck_evr} @@ -192,7 +233,7 @@ package fipscheck) using %{name}. %if %{with replace_hmaccalc} %package hmaccalc Summary: Drop-in replacements for hmaccalc provided by the %{name} package -Requires: %{name}%{?_isa} == %{version}-%{release} +Requires: %{name}-hasher%{?_isa} == %{version}-%{release} Obsoletes: hmaccalc <= %{hmaccalc_evr} @@ -217,7 +258,8 @@ is highly discouraged. %package tools Summary: Utility applications for the %{name} package -Requires: %{name}%{?_isa} == %{version}-%{release} +Requires: %{name}%{?_isa} == %{version}-%{release} +Requires: %{name}-hasher%{?_isa} == %{version}-%{release} %description tools Utility applications that are provided with %{name}. This includes @@ -238,7 +280,7 @@ Requires: %{name}-checksum%{?_isa} == %{version}-%{release} %endif Requires: coreutils Requires: openssl -Requires: perl +Requires: perl-interpreter %description tests Auxiliary scripts for testing %{name}. @@ -248,6 +290,10 @@ Auxiliary scripts for testing %{name}. %prep %autosetup -p 1 -S git +# Work around https://bugzilla.redhat.com/show_bug.cgi?id=2258240 +sed -i -e 's|XML V45|XML V4.1.2|' -e 's|/xml/4\.5/|/xml/4.1.2/|' \ + lib/doc/libkcapi.tmpl + %if %{with_sysctl_tweak} %{__cat} << EOF > README.%{distroname_ext} This package increases the default limit of the ancillary buffer size @@ -282,16 +328,12 @@ net.core.optmem_max = %{sysctl_optmem_max} EOF %endif -%ifarch %{power64} -%{__sed} -i -e 's!exit \$failures!#&!' test/kcapi-enc-test.sh -%endif - %{_bindir}/autoreconf -fiv %build %configure \ - --libdir=/%{_lib} \ + --libdir=%{_libdir} \ --disable-silent-rules \ --enable-kcapi-encapp \ --enable-kcapi-dgstapp \ @@ -302,9 +344,13 @@ EOF --enable-shared \ --enable-static \ --enable-sum-prefix= \ - --enable-sum-dir=/%{_lib} \ + --enable-sum-dir=%{_libdir} \ --with-pkgconfigdir=%{_libdir}/pkgconfig +%if %{with doc} %make_build all doc +%else +%make_build all man +%endif %install @@ -321,22 +367,32 @@ EOF %if %{with_sysctl_tweak} README.%{distroname_ext} \ %endif - README.md CHANGES.md TODO doc/%{name}.p{df,s} +%if %{with doc} + doc/%{name}.p{df,s} \ +%endif + README.md CHANGES.md TODO + +%if %{with doc} %{__cp} -pr lib/doc/html %{buildroot}%{_pkgdocdir} +%endif # Install replacement tools, if enabled. -%if !%{with replace_coreutils} -%{__rm} -f \ - %{buildroot}%{_bindir}/md5sum \ - %{buildroot}%{_bindir}/sha*sum +%if %{with replace_coreutils} +for app in %apps_coreutils; do + %{__ln_s} ../libexec/libkcapi/$app %{buildroot}%{_bindir}/$app +done %endif -%if !%{with replace_fipscheck} -%{__rm} -f %{buildroot}%{_bindir}/fips* +%if %{with replace_fipscheck} +for app in %apps_fipscheck; do + %{__ln_s} ../libexec/libkcapi/$app %{buildroot}%{_bindir}/$app +done %endif -%if !%{with replace_hmaccalc} -%{__rm} -f %{buildroot}%{_bindir}/sha*hmac +%if %{with replace_hmaccalc} +for app in %apps_hmaccalc; do + %{__ln_s} ../libexec/libkcapi/$app %{buildroot}%{_bindir}/$app +done %endif # We don't ship autocrap dumplings. @@ -348,11 +404,13 @@ EOF # Remove 0-size files. %{_bindir}/find %{buildroot} -type f -size 0 -print -delete +%if %{with doc} # Make sure all docs have non-exec permissions, except for the dirs. %{_bindir}/find %{buildroot}%{_pkgdocdir} -type f -print | \ %{_bindir}/xargs %{__chmod} -c 0644 %{_bindir}/find %{buildroot}%{_pkgdocdir} -type d -print | \ %{_bindir}/xargs %{__chmod} -c 0755 +%endif # Possibly save some space by hardlinking. for d in %{_mandir} %{_pkgdocdir}; do @@ -362,21 +420,35 @@ done %check # Some basic sanity checks. -for t in cppcheck scan; do - %make_build $t -done +%if %{with clang_sa} +%make_build scan +%endif +%if %{with cppcheck} +# -UCHECK_DIR: string literal concatenation raises syntaxError +# with cppcheck-2.11 (https://trac.cppcheck.net/ticket/11830) +# --check-level=exhaustive: otherwise it emits warnings that get +# treated like errors +%make_build cppcheck CPPCHECK="cppcheck --check-level=exhaustive -UCHECK_DIR" +%endif +%if %{with test} # On some arches `/proc/sys/net/core/optmem_max` is lower than 20480, # which is the lowest limit needed to run the testsuite. If that limit # is not met, we do not run it. %if %{test_optmem_max} >= 20480 +# Skip the testsuite on old kernels. +%if %{lua:print(rpm.vercmp(posix.uname('%r'), '5.1'));} >= 0 # Real testsuite. pushd test +%if %{with fuzz_test} ENABLE_FUZZ_TEST=1 \ +%endif NO_32BIT_TEST=1 \ ./test-invocation.sh popd %endif +%endif +%endif %ldconfig_scriptlets @@ -386,10 +458,10 @@ popd %doc %dir %{_pkgdocdir} %doc %{_pkgdocdir}/README.md %license COPYING* -/%{_lib}/%{name}.so.%{vmajor} -/%{_lib}/%{name}.so.%{version} -/%{_lib}/fipscheck/%{name}.so.%{vmajor}.hmac -/%{_lib}/fipscheck/%{name}.so.%{version}.hmac +%{_libdir}/%{name}.so.%{vmajor} +%{_libdir}/%{name}.so.%{version} +%{_libdir}/hmaccalc/%{name}.so.%{vmajor}.hmac +%{_libdir}/hmaccalc/%{name}.so.%{version}.hmac %if %{with_sysctl_tweak} %doc %{_pkgdocdir}/README.%{distroname_ext} %{_sysctldir}/%{sysctl_prio}-%{name}-optmem_max.conf @@ -401,213 +473,74 @@ popd %doc %{_pkgdocdir}/TODO %{_includedir}/kcapi.h %{_mandir}/man3/kcapi_*.3.* -/%{_lib}/%{name}.so +%{_libdir}/%{name}.so %{_libdir}/pkgconfig/%{name}.pc +%if %{with doc} %files doc -%doc %{_pkgdocdir} -%license %{_datadir}/licenses/%{name}* +%doc %{_pkgdocdir}/html +%doc %{_pkgdocdir}/%{name}.pdf +%doc %{_pkgdocdir}/%{name}.ps +%endif + + +%files hasher +%{_bindir}/kcapi-hasher +%{_libexecdir}/%{name}/md5sum +%{_libexecdir}/%{name}/sha*sum +%{_libexecdir}/%{name}/sm*sum +%{_libexecdir}/%{name}/fips* +%{_libexecdir}/%{name}/sha*hmac +%{_libexecdir}/%{name}/sm*hmac +%{_libdir}/hmaccalc/kcapi-hasher.hmac +%{_mandir}/man1/kcapi-hasher.1.* %if %{with replace_coreutils} %files checksum %{_bindir}/md5sum %{_bindir}/sha*sum -/%{_lib}/fipscheck/md5sum.hmac -/%{_lib}/fipscheck/sha*sum.hmac +%{_bindir}/sm*sum %endif %if %{with replace_fipscheck} %files fipscheck %{_bindir}/fips* -/%{_lib}/fipscheck/fips*.hmac %endif %if %{with replace_hmaccalc} %files hmaccalc %{_bindir}/sha*hmac -/%{_lib}/hmaccalc/sha*hmac.hmac +%{_bindir}/sm*hmac %endif %files static -/%{_lib}/%{name}.a +%{_libdir}/%{name}.a %files tools -%{_bindir}/kcapi* -%{_mandir}/man1/kcapi*.1.* +%{_bindir}/kcapi +%{_bindir}/kcapi-convenience +%{_bindir}/kcapi-dgst +%{_bindir}/kcapi-enc +%{_bindir}/kcapi-enc-test-large +%{_bindir}/kcapi-rng +%{_bindir}/kcapi-speed +%{_mandir}/man1/kcapi-dgst.1.* +%{_mandir}/man1/kcapi-enc.1.* +%{_mandir}/man1/kcapi-rng.1.* %if %{with test_package} %files tests -%{_libexecdir}/%{name}/* +%{_libexecdir}/%{name}/kcapi +%{_libexecdir}/%{name}/kcapi-convenience +%{_libexecdir}/%{name}/kcapi-enc-test-large +%{_libexecdir}/%{name}/*.sh %endif %changelog -* Sat Feb 02 2019 Ondrej Mosnáček - 1.1.4-1 -- Update to upstream version 1.1.4 - -* Fri Feb 01 2019 Ondrej Mosnáček - 1.1.3-3 -- Fix build with new GCC - -* Fri Feb 01 2019 Fedora Release Engineering - 1.1.3-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild - -* Thu Aug 23 2018 Ondrej Mosnáček - 1.1.3-1 -- Update to upstream version 1.1.3 - -* Thu Aug 09 2018 Ondrej Mosnáček - 1.1.1-16 -- Add missing dependencies to the tests package -- Update patch from upstream - -* Thu Aug 09 2018 Ondrej Mosnáček - 1.1.1-15 -- Build and tests require perl - -* Thu Aug 09 2018 Ondrej Mosnáček - 1.1.1-14 -- Add missing script to the 'tests' package - -* Wed Aug 08 2018 Ondrej Mosnáček - 1.1.1-13 -- Add missing requires to the 'tests' subpackage - -* Tue Aug 07 2018 Ondrej Mosnáček - 1.1.1-12 -- Produce a subpackage with test scripts -- Build the 'tests' subpackage conditionally - -* Wed Aug 01 2018 Ondrej Mosnáček - 1.1.1-11 -- Add patch to fix unwanted closing of FD 0 - -* Tue Jul 31 2018 Ondrej Mosnáček - 1.1.1-10 -- Remove the kernel headers workaround - -* Fri Jul 27 2018 Igor Gnatenko - 1.1.1-9 -- Rebuild for new binutils - -* Fri Jul 27 2018 Ondrej Mosnáček - 1.1.1-8 -- Add more Coverity fixes from upstream -- Add patch to fix AEAD fuzz test for BE arches -- Fixup specfile - -* Mon Jul 23 2018 Ondrej Mosnáček - 1.1.1-7 -- Add various fixes from upstream -- Drop the Requires on kernel package - -* Mon Jul 16 2018 Ondrej Mosnáček - 1.1.1-6 -- Put .hmac files into a separate directory - -* Fri Jul 13 2018 Fedora Release Engineering - 1.1.1-5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild - -* Thu Jul 12 2018 Ondrej Mosnáček - 1.1.1-4 -- Add patch to work around FTBFS on rawhide - -* Wed Jul 11 2018 Ondrej Mosnáček - 1.1.1-3 -- Fix off-by-one error in checkfile parsing - -* Wed Jul 11 2018 Ondrej Mosnáček - 1.1.1-2 -- Fix command-line parsing in libkcapi-hmaccalc - -* Mon Jun 18 2018 Ondrej Mosnáček - 1.1.1-1 -- Update to upstream version 1.1.1 - -* Wed May 09 2018 Ondrej Mosnáček - 1.1.0-5 -- Skip CLang static analysis in RHEL -- Revert "Skip CLang static analysis in RHEL" -- Use own sha512hmac and fipscheck - -* Wed May 02 2018 Ondrej Mosnáček - 1.1.0-4 -- Fix description lines being too long - -* Fri Apr 27 2018 Björn Esser - 1.1.0-3 -- Fix conditional for hmaccalc replacement - -* Mon Apr 16 2018 Ondrej Mosnáček - 1.1.0-2 -- Enable hmaccalc replacements in Fedora 28+ - -* Thu Apr 12 2018 Ondrej Mosnáček - 1.1.0-1 -- Update to upstream version 1.1.0 - -* Sat Mar 31 2018 Björn Esser - 1.0.3-10 -- Replace single patches with a monolitic one from upstream -- Obsolete replacements subpackage -- Ignore failing tests on %%{power64} temporarily - -* Thu Mar 08 2018 Ondrej Mosnáček - 1.0.3-9 -- Split up the replacements subpackage - -* Mon Feb 26 2018 Björn Esser - 1.0.3-8 -- Increase optmem_max preset to 81920 - -* Mon Feb 26 2018 Björn Esser - 1.0.3-7 -- Obsoletes work by package name, not by provides (rhbz#1537225) - -* Sun Feb 25 2018 Björn Esser - 1.0.3-6 -- Add patch to fix a copy-paste typo - -* Sat Feb 17 2018 Björn Esser - 1.0.3-5 -- Add patch to fix build with -Werror - -* Wed Feb 07 2018 Fedora Release Engineering -- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild - -* Sun Feb 04 2018 Björn Esser - 1.0.3-3 -- Switch to %%ldconfig_scriptlets - -* Wed Jan 17 2018 Björn Esser - 1.0.3-2 -- Decrease optmem_max preset to 40960 -- Let the build fail, if the minimum kernel version cannot be met -- Conditionalize the sysctl.d tweak on version of the kernel -- Conditionalize the name of README.distro on the distro - -* Tue Jan 16 2018 Björn Esser - 1.0.3-1 -- Initial import (rhbz#1533929) - -* Tue Jan 16 2018 Björn Esser - 1.0.3-0.13 -- Increase optmem_max preset to 81920 - -* Tue Jan 16 2018 Björn Esser - 1.0.3-0.12 -- Add sysctl.d preset and README.fedora - -* Mon Jan 15 2018 Björn Esser - 1.0.3-0.11 -- Make the contents of the -replacements package configurable - -* Mon Jan 15 2018 Björn Esser - 1.0.3-0.10 -- Fix Obsoletes of the -replacements package - -* Sun Jan 14 2018 Björn Esser - 1.0.3-0.9 -- Disable the -replacements package until we have a plan for it - -* Sun Jan 14 2018 Björn Esser - 1.0.3-0.8 -- Move the kcapi-hasher binary to -replacements package, since it is - not of much use without the linked invocation names and saves the - extra Requires on the -tools package - -* Sun Jan 14 2018 Björn Esser - 1.0.3-0.7 -- Fix internal Requires of sub-packages -- Hardlink files in %%{_bindir} - -* Sun Jan 14 2018 Björn Esser - 1.0.3-0.6 -- Add patches from upstream - -* Sat Jan 13 2018 Björn Esser - 1.0.3-0.5 -- Add patches from upstream - -* Sat Jan 13 2018 Björn Esser - 1.0.3-0.4 -- Asume the testsuite cannot be run, if the value of optmem_max cannot - be obtained - -* Sat Jan 13 2018 Björn Esser - 1.0.3-0.3 -- Move libraries to /%%{_lib} instead of %%{_libdir}, which is useful - during boot when the library might be needed before a potentially - seperate /usr partition is mounted - -* Sat Jan 13 2018 Björn Esser - 1.0.3-0.2 -- Asume optmem_max is at least 20480, if the real value cannot be obtained - -* Fri Jan 12 2018 Björn Esser - 1.0.3-0.1 -- New upstream release - -* Wed Jan 10 2018 Björn Esser - 1.0.2-0.1 -- Initial rpm release (rhbz#1533929) +%autochangelog diff --git a/plans/ci.fmf b/plans/ci.fmf new file mode 100644 index 0000000..d3cd36f --- /dev/null +++ b/plans/ci.fmf @@ -0,0 +1,5 @@ +summary: Run CI tests +discover: + how: fmf +execute: + how: tmt diff --git a/sha512hmac-openssl.sh b/sha512hmac-openssl.sh new file mode 100644 index 0000000..6496394 --- /dev/null +++ b/sha512hmac-openssl.sh @@ -0,0 +1,6 @@ +#!/bin/bash + +# Mocks sha512hmac using the openssl tool. +# Only for use during RPM build. + +openssl sha512 -hmac FIPS-FTW-RHT2009 -hex "$1" | cut -f 2 -d ' ' diff --git a/sources b/sources index 650fff7..0f7842a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (libkcapi-1.1.4.tar.xz) = b07cc4435829ad73585ca79d06cd57edf6c2e68f66dceac07a72332aa9cd325b79add02fd220166ee5e07a3d7b305df0dc941bccf1310784b3b16bf50291c4f9 -SHA512 (libkcapi-1.1.4.tar.xz.asc) = 22245f4a1fa98f3ad3a21a01e464bd6fba56d8541d5825739c928e577cdb7f5b30098dcdab1086bbbf33707e2c27ebd03c2810dc0e98d27120016dd0749ef7ba +SHA512 (libkcapi-1.5.0.tar.xz) = db156ee94fc63815a31876ab072aca72a806b26961c43f2caf8495c53b95484de71cd3be84dc9e5c9560e9ee704979be059ff6c102b4893d6bbdf9a8a69a667a +SHA512 (libkcapi-1.5.0.tar.xz.asc) = 69cfb6bf98f89c503e7fda07a54eddb9fcc2dafe418f1bc1216c051565c214a6caab83495c19b650a5c6e46e22080f8df4dd2152ab364993ed5badd256495159 diff --git a/tests/main.fmf b/tests/main.fmf new file mode 100644 index 0000000..4b6064e --- /dev/null +++ b/tests/main.fmf @@ -0,0 +1,29 @@ +component: libkcapi +contact: Ondrej Mosnacek + +/upstream: + require: [libkcapi-tests] + tier: 1 + + /basic: + summary: Basic functionality + test: /usr/libexec/libkcapi/test.sh + /encrypt: + summary: Encryption/decryption + test: /usr/libexec/libkcapi/kcapi-enc-test.sh + /encrypt-large: + summary: Encryption/decryption of large data + test: /usr/libexec/libkcapi/kcapi-enc-test-large.sh + /digest: + summary: Message digest + test: /usr/libexec/libkcapi/kcapi-dgst-test.sh + /digest-convenience: + summary: Message digest convenience functions + test: /usr/libexec/libkcapi/kcapi-convenience.sh + /hasher: + summary: Checksum helpers + test: /usr/libexec/libkcapi/hasher-test.sh + /fuzz-test: + summary: Fuzz test + test: /usr/libexec/libkcapi/kcapi-fuzz-test.sh + duration: 2h diff --git a/tests/tests.yml b/tests/tests.yml deleted file mode 100644 index 9d6ad04..0000000 --- a/tests/tests.yml +++ /dev/null @@ -1,24 +0,0 @@ -- hosts: localhost - tags: - - classic - - container - - atomic - roles: - - role: standard-test-basic - required_packages: - - libkcapi-tests - tests: - - upstream-basic-test: - run: /usr/libexec/libkcapi/test.sh - - upstream-enc-test: - run: /usr/libexec/libkcapi/kcapi-enc-test.sh - - upstream-enc-test-large: - run: /usr/libexec/libkcapi/kcapi-enc-test-large.sh - - upstream-dgst-test: - run: /usr/libexec/libkcapi/kcapi-dgst-test.sh - - upstream-hasher-test: - run: /usr/libexec/libkcapi/hasher-test.sh - - upstream-convenience-test: - run: /usr/libexec/libkcapi/kcapi-convenience.sh - - upstream-fuzz-test: - run: /usr/libexec/libkcapi/kcapi-fuzz-test.sh