From 4a47da3f29a27ba5c04243a0cb74393077b5e2e9 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 25 Jul 2019 13:35:33 +0000 Subject: [PATCH 01/61] - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- libkcapi.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libkcapi.spec b/libkcapi.spec index cabb560..20f8efa 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -97,7 +97,7 @@ bin/kcapi-hasher -n fipshmac -d "$lib_path"/fipscheck \\\ Name: libkcapi Version: %{vmajor}.%{vminor}.%{vpatch} -Release: 2%{?dist} +Release: 3%{?dist} Summary: User space interface to the Linux Kernel Crypto API License: BSD or GPLv2 @@ -447,6 +447,9 @@ popd %changelog +* Thu Jul 25 2019 Fedora Release Engineering - 1.1.4-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + * Sat Feb 02 2019 Ondrej Mosnáček - 1.1.4-1 - Update to upstream version 1.1.4 From 12b9ffe9dacdf0b235ab81078518e3ed9192bc57 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Thu, 25 Jul 2019 16:58:29 +0200 Subject: [PATCH 02/61] Work around cppcheck issue Signed-off-by: Ondrej Mosnacek --- 001-workaround-cppcheck-bug.patch | 13 +++++++++++++ libkcapi.spec | 9 ++++++++- 2 files changed, 21 insertions(+), 1 deletion(-) create mode 100644 001-workaround-cppcheck-bug.patch diff --git a/001-workaround-cppcheck-bug.patch b/001-workaround-cppcheck-bug.patch new file mode 100644 index 0000000..1819e83 --- /dev/null +++ b/001-workaround-cppcheck-bug.patch @@ -0,0 +1,13 @@ +diff --git a/test/kcapi-main.c b/test/kcapi-main.c +index 2ae0edb..6818e67 100644 +--- a/test/kcapi-main.c ++++ b/test/kcapi-main.c +@@ -237,7 +237,7 @@ static inline uint64_t _time_delta(struct timespec *start, struct timespec *end) + + static int get_random(uint8_t *buf, uint32_t buflen, unsigned int flags) + { +- int ret; ++ int ret = 0; + + if (buflen > INT_MAX) + return 1; diff --git a/libkcapi.spec b/libkcapi.spec index 20f8efa..500801f 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -97,7 +97,7 @@ bin/kcapi-hasher -n fipshmac -d "$lib_path"/fipscheck \\\ Name: libkcapi Version: %{vmajor}.%{vminor}.%{vpatch} -Release: 3%{?dist} +Release: 4%{?dist} Summary: User space interface to the Linux Kernel Crypto API License: BSD or GPLv2 @@ -106,6 +106,7 @@ Source0: http://www.chronox.de/%{name}/%{name}-%{version}.tar.xz Source1: http://www.chronox.de/%{name}/%{name}-%{version}.tar.xz.asc Patch0: %{giturl}/commit/52620ec798a5.patch#/000-Fix-build-with-gcc-8.2.x.patch +Patch1: 001-workaround-cppcheck-bug.patch BuildRequires: clang BuildRequires: coreutils @@ -447,9 +448,15 @@ popd %changelog +* Thu Jul 25 2019 Ondrej Mosnáček - 1.1.4-4 +- Work around cppcheck issue + * Thu Jul 25 2019 Fedora Release Engineering - 1.1.4-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild +* Mon May 27 2019 Ondrej Mosnáček - 1.1.4-2 +- Fix FTBFS: hardlink is now in bindir + * Sat Feb 02 2019 Ondrej Mosnáček - 1.1.4-1 - Update to upstream version 1.1.4 From 4cdceabb5d9f427cac83cf50ccbc3190b5a79c3f Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Thu, 25 Jul 2019 13:05:04 +0200 Subject: [PATCH 03/61] Enable gating Signed-off-by: Ondrej Mosnacek --- gating.yaml | 6 ++++++ libkcapi.spec | 1 + 2 files changed, 7 insertions(+) create mode 100644 gating.yaml diff --git a/gating.yaml b/gating.yaml new file mode 100644 index 0000000..4e26a6f --- /dev/null +++ b/gating.yaml @@ -0,0 +1,6 @@ +--- !Policy +product_versions: + - fedora-* +decision_context: bodhi_update_push_stable +rules: + - !PassingTestCaseRule {test_case_name: org.centos.prod.ci.pipeline.allpackages-build.package.test.functional.complete} diff --git a/libkcapi.spec b/libkcapi.spec index 500801f..6fac283 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -450,6 +450,7 @@ popd %changelog * Thu Jul 25 2019 Ondrej Mosnáček - 1.1.4-4 - Work around cppcheck issue +- Enable gating * Thu Jul 25 2019 Fedora Release Engineering - 1.1.4-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild From 154ab8363dc1a8c80c0cd519c89abb9584570230 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Sat, 27 Jul 2019 18:48:24 +0200 Subject: [PATCH 04/61] Backport patch to fix tests This patch fixes detection of kernel version, which should fix the failing build-time tests on some arches. Signed-off-by: Ondrej Mosnacek --- 002-Enable-testing-on-kernels-5.0.patch | 65 +++++++++++++++++++++++++ libkcapi.spec | 6 ++- 2 files changed, 70 insertions(+), 1 deletion(-) create mode 100644 002-Enable-testing-on-kernels-5.0.patch diff --git a/002-Enable-testing-on-kernels-5.0.patch b/002-Enable-testing-on-kernels-5.0.patch new file mode 100644 index 0000000..24b437c --- /dev/null +++ b/002-Enable-testing-on-kernels-5.0.patch @@ -0,0 +1,65 @@ +From 4529c9d0583654fcdc74de09b5de5edcf6959b04 Mon Sep 17 00:00:00 2001 +From: Stephan Mueller +Date: Mon, 27 May 2019 11:33:16 +0200 +Subject: [PATCH] Enable testing on kernels >= 5.0 + +Signed-off-by: Stephan Mueller +--- + test/libtest.sh | 6 +++++- + test/test.sh | 11 ++++++++--- + 2 files changed, 13 insertions(+), 4 deletions(-) + +diff --git a/test/libtest.sh b/test/libtest.sh +index 93b2c93..5a1377b 100644 +--- a/test/libtest.sh ++++ b/test/libtest.sh +@@ -128,7 +128,11 @@ check_min_kernelver() { + major=$1 + minor=$2 + +- if [ $(uname -r | cut -d"." -f1) -ge $major ]; then ++ if [ $(uname -r | cut -d"." -f1) -gt $major ]; then ++ return 0 ++ fi ++ ++ if [ $(uname -r | cut -d"." -f1) -eq $major ]; then + if [ $(uname -r | cut -d"." -f2) -ge $minor ]; then + return 0 + fi +diff --git a/test/test.sh b/test/test.sh +index 6320ad0..96136c5 100755 +--- a/test/test.sh ++++ b/test/test.sh +@@ -907,8 +907,13 @@ kppfunc() + rfc4106_aad_iv() { + assoc=$1 + iv=$2 ++ + # New name with 4.2 +- if [ $(uname -r | cut -d"." -f1) -ge 4 ]; then ++ if [ $(uname -r | cut -d"." -f1) -gt 4 ]; then ++ assoc="${assoc}${iv}" ++ fi ++ ++ if [ $(uname -r | cut -d"." -f1) -eq 4 ]; then + if [ $(uname -r | cut -d"." -f2) -ge 2 ]; then + assoc="${assoc}${iv}" + fi +@@ -1549,7 +1554,7 @@ else + echo_deact "AEAD tests of copied AAD deactivated" + fi + +-if $(check_min_kernelver 4 99); then ++if $(check_min_kernelver 5 99); then + asymfunc 4 + asymfunc 4 -s + asymfunc 4 -v +@@ -1572,7 +1577,7 @@ else + echo_deact "All asymmetric tests deactivated" + fi + +-if $(check_min_kernelver 4 99); then ++if $(check_min_kernelver 5 99); then + kppfunc 13 + kppfunc 13 X -m + kppfunc 13 -v diff --git a/libkcapi.spec b/libkcapi.spec index 6fac283..ed39ebd 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -97,7 +97,7 @@ bin/kcapi-hasher -n fipshmac -d "$lib_path"/fipscheck \\\ Name: libkcapi Version: %{vmajor}.%{vminor}.%{vpatch} -Release: 4%{?dist} +Release: 5%{?dist} Summary: User space interface to the Linux Kernel Crypto API License: BSD or GPLv2 @@ -107,6 +107,7 @@ Source1: http://www.chronox.de/%{name}/%{name}-%{version}.tar.xz.asc Patch0: %{giturl}/commit/52620ec798a5.patch#/000-Fix-build-with-gcc-8.2.x.patch Patch1: 001-workaround-cppcheck-bug.patch +Patch2: %{giturl}/commit/4529c9d05836.patch#/002-Enable-testing-on-kernels-5.0.patch BuildRequires: clang BuildRequires: coreutils @@ -448,6 +449,9 @@ popd %changelog +* Sat Jul 27 2019 Ondrej Mosnáček - 1.1.4-5 +- Backport patch to fix tests + * Thu Jul 25 2019 Ondrej Mosnáček - 1.1.4-4 - Work around cppcheck issue - Enable gating From 3d486e6132dfbd11ddf33512ca6caad2b5e1564c Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Sat, 27 Jul 2019 22:08:39 +0200 Subject: [PATCH 05/61] Backport patch to fix test failure on aarch64 Another patch needed to fix failing tests... Signed-off-by: Ondrej Mosnacek --- 003-fix-test-case.patch | 35 +++++++++++++++++++++++++++++++++++ libkcapi.spec | 6 +++++- 2 files changed, 40 insertions(+), 1 deletion(-) create mode 100644 003-fix-test-case.patch diff --git a/003-fix-test-case.patch b/003-fix-test-case.patch new file mode 100644 index 0000000..44521b3 --- /dev/null +++ b/003-fix-test-case.patch @@ -0,0 +1,35 @@ +From b455bb77dcf7a38bb881898efcd5122aa61e68cc Mon Sep 17 00:00:00 2001 +From: Stephan Mueller +Date: Mon, 27 May 2019 13:21:03 +0200 +Subject: [PATCH] fix test case + +- fix possible mem leak + +- fix counting of available memory + +Signed-off-by: Stephan Mueller +--- + test/kcapi-main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/test/kcapi-main.c b/test/kcapi-main.c +index 46cce51..bce21b7 100644 +--- a/test/kcapi-main.c ++++ b/test/kcapi-main.c +@@ -282,6 +282,7 @@ static int fuzz_init_test(unsigned int size) + + if (get_random(name, size, 0)) { + printf("get_random call failed\n"); ++ free(name); + return 1; + } + +@@ -1016,7 +1017,7 @@ static int cavs_sym_stream(struct kcapi_cavs *cavs_test, uint32_t loops, + } + + outiov.iov_base = (uint8_t *)outiov.iov_base + ret; +- outiov.iov_len += ret; ++ outiov.iov_len -= ret; + outptr += ret; + } + diff --git a/libkcapi.spec b/libkcapi.spec index ed39ebd..35753ee 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -97,7 +97,7 @@ bin/kcapi-hasher -n fipshmac -d "$lib_path"/fipscheck \\\ Name: libkcapi Version: %{vmajor}.%{vminor}.%{vpatch} -Release: 5%{?dist} +Release: 6%{?dist} Summary: User space interface to the Linux Kernel Crypto API License: BSD or GPLv2 @@ -108,6 +108,7 @@ Source1: http://www.chronox.de/%{name}/%{name}-%{version}.tar.xz.asc Patch0: %{giturl}/commit/52620ec798a5.patch#/000-Fix-build-with-gcc-8.2.x.patch Patch1: 001-workaround-cppcheck-bug.patch Patch2: %{giturl}/commit/4529c9d05836.patch#/002-Enable-testing-on-kernels-5.0.patch +Patch3: %{giturl}/commit/b455bb77dcf7.patch#/003-fix-test-case.patch BuildRequires: clang BuildRequires: coreutils @@ -449,6 +450,9 @@ popd %changelog +* Sat Jul 27 2019 Ondrej Mosnáček - 1.1.4-6 +- Backport patch to fix test failure on aarch64 + * Sat Jul 27 2019 Ondrej Mosnáček - 1.1.4-5 - Backport patch to fix tests From f5e41950602f9565b4702374a56e7dd4258fc5fc Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Sat, 27 Jul 2019 22:11:15 +0200 Subject: [PATCH 06/61] Remove no longer needed ppc64 workaround The kernel bug causing failures on ppc64le is now fixed in recent/stable kernels [1], so we can remove the workaround. [1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=dcf7b48212c0fab7df69e84fab22d6cb7c8c0fb9 Signed-off-by: Ondrej Mosnacek --- libkcapi.spec | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/libkcapi.spec b/libkcapi.spec index 35753ee..aa40f1d 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -285,10 +285,6 @@ net.core.optmem_max = %{sysctl_optmem_max} EOF %endif -%ifarch %{power64} -%{__sed} -i -e 's!exit \$failures!#&!' test/kcapi-enc-test.sh -%endif - %{_bindir}/autoreconf -fiv @@ -452,6 +448,7 @@ popd %changelog * Sat Jul 27 2019 Ondrej Mosnáček - 1.1.4-6 - Backport patch to fix test failure on aarch64 +- Remove no longer needed ppc64 workaround * Sat Jul 27 2019 Ondrej Mosnáček - 1.1.4-5 - Backport patch to fix tests From c645f59d4c37deb08074b96945df6e22cac30f0a Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Tue, 13 Aug 2019 14:58:56 +0200 Subject: [PATCH 07/61] Update to upstream version 1.1.5 --- 000-Fix-build-with-gcc-8.2.x.patch | 51 --------------- 002-Enable-testing-on-kernels-5.0.patch | 65 ------------------- 003-fix-test-case.patch | 35 ---------- ...patch => 100-workaround-cppcheck-bug.patch | 0 libkcapi.spec | 15 +++-- sources | 4 +- 6 files changed, 11 insertions(+), 159 deletions(-) delete mode 100644 000-Fix-build-with-gcc-8.2.x.patch delete mode 100644 002-Enable-testing-on-kernels-5.0.patch delete mode 100644 003-fix-test-case.patch rename 001-workaround-cppcheck-bug.patch => 100-workaround-cppcheck-bug.patch (100%) diff --git a/000-Fix-build-with-gcc-8.2.x.patch b/000-Fix-build-with-gcc-8.2.x.patch deleted file mode 100644 index 6fd575a..0000000 --- a/000-Fix-build-with-gcc-8.2.x.patch +++ /dev/null @@ -1,51 +0,0 @@ -From 52620ec798a580b2053d16a42362e9926729eb30 Mon Sep 17 00:00:00 2001 -From: Fabrice Fontaine -Date: Sun, 20 Jan 2019 20:04:13 +0100 -Subject: [PATCH] apps/kcapi-hasher.c: fix build with gcc 8.2.x - -Fixes: - - http://autobuild.buildroot.org/results/8355bc42238e885f7f11ed3d9d37fc55ebdead2b - -Signed-off-by: Fabrice Fontaine -Signed-off-by: Stephan Mueller ---- - apps/kcapi-hasher.c | 12 ++++++++---- - 1 file changed, 8 insertions(+), 4 deletions(-) - -diff --git a/apps/kcapi-hasher.c b/apps/kcapi-hasher.c -index d6be685..7172b12 100644 ---- a/apps/kcapi-hasher.c -+++ b/apps/kcapi-hasher.c -@@ -357,16 +357,20 @@ static int hasher(struct kcapi_handle *handle, const struct hash_params *params, - } - - /* -- * GCC v8.1.0 introduced -Wstringop-truncation but it is not smart enough to -- * find that cursor string will be NULL-terminated after all paste() calls and -- * warns with: -+ * GCC v8.1.0 introduced -Wstringop-truncation and GCC v8.2.0 introduced -+ * -Wstringop-overflow but it is not smart enough to find that cursor string -+ * will be NULL-terminated after all paste() calls and warns with: - * error: 'strncpy' destination unchanged after copying no bytes [-Werror=stringop-truncation] - * error: 'strncpy' output truncated before terminating nul copying 5 bytes from a string of the same length [-Werror=stringop-truncation] -+ * error: 'strncpy' specified bound depends on the length of the source argument [-Werror=stringop-overflow=] - */ - #pragma GCC diagnostic push - #if GCC_VERSION >= 80100 - #pragma GCC diagnostic ignored "-Wstringop-truncation" - #endif -+#if GCC_VERSION >= 80200 -+#pragma GCC diagnostic ignored "-Wstringop-overflow" -+#endif - static char *paste(char *dst, const char *src, size_t size) - { - strncpy(dst, src, size); -@@ -417,7 +421,7 @@ static char *get_hmac_file(const char *filename, const char *checkdir) - strncpy(cursor, "\0", 1); - return checkfile; - } --#pragma GCC diagnostic pop /* -Wstringop-truncation */ -+#pragma GCC diagnostic pop /* -Wstringop-truncation -Wstringop-overflow */ - - static int hash_files(const struct hash_params *params, - char *filenames[], uint32_t files, diff --git a/002-Enable-testing-on-kernels-5.0.patch b/002-Enable-testing-on-kernels-5.0.patch deleted file mode 100644 index 24b437c..0000000 --- a/002-Enable-testing-on-kernels-5.0.patch +++ /dev/null @@ -1,65 +0,0 @@ -From 4529c9d0583654fcdc74de09b5de5edcf6959b04 Mon Sep 17 00:00:00 2001 -From: Stephan Mueller -Date: Mon, 27 May 2019 11:33:16 +0200 -Subject: [PATCH] Enable testing on kernels >= 5.0 - -Signed-off-by: Stephan Mueller ---- - test/libtest.sh | 6 +++++- - test/test.sh | 11 ++++++++--- - 2 files changed, 13 insertions(+), 4 deletions(-) - -diff --git a/test/libtest.sh b/test/libtest.sh -index 93b2c93..5a1377b 100644 ---- a/test/libtest.sh -+++ b/test/libtest.sh -@@ -128,7 +128,11 @@ check_min_kernelver() { - major=$1 - minor=$2 - -- if [ $(uname -r | cut -d"." -f1) -ge $major ]; then -+ if [ $(uname -r | cut -d"." -f1) -gt $major ]; then -+ return 0 -+ fi -+ -+ if [ $(uname -r | cut -d"." -f1) -eq $major ]; then - if [ $(uname -r | cut -d"." -f2) -ge $minor ]; then - return 0 - fi -diff --git a/test/test.sh b/test/test.sh -index 6320ad0..96136c5 100755 ---- a/test/test.sh -+++ b/test/test.sh -@@ -907,8 +907,13 @@ kppfunc() - rfc4106_aad_iv() { - assoc=$1 - iv=$2 -+ - # New name with 4.2 -- if [ $(uname -r | cut -d"." -f1) -ge 4 ]; then -+ if [ $(uname -r | cut -d"." -f1) -gt 4 ]; then -+ assoc="${assoc}${iv}" -+ fi -+ -+ if [ $(uname -r | cut -d"." -f1) -eq 4 ]; then - if [ $(uname -r | cut -d"." -f2) -ge 2 ]; then - assoc="${assoc}${iv}" - fi -@@ -1549,7 +1554,7 @@ else - echo_deact "AEAD tests of copied AAD deactivated" - fi - --if $(check_min_kernelver 4 99); then -+if $(check_min_kernelver 5 99); then - asymfunc 4 - asymfunc 4 -s - asymfunc 4 -v -@@ -1572,7 +1577,7 @@ else - echo_deact "All asymmetric tests deactivated" - fi - --if $(check_min_kernelver 4 99); then -+if $(check_min_kernelver 5 99); then - kppfunc 13 - kppfunc 13 X -m - kppfunc 13 -v diff --git a/003-fix-test-case.patch b/003-fix-test-case.patch deleted file mode 100644 index 44521b3..0000000 --- a/003-fix-test-case.patch +++ /dev/null @@ -1,35 +0,0 @@ -From b455bb77dcf7a38bb881898efcd5122aa61e68cc Mon Sep 17 00:00:00 2001 -From: Stephan Mueller -Date: Mon, 27 May 2019 13:21:03 +0200 -Subject: [PATCH] fix test case - -- fix possible mem leak - -- fix counting of available memory - -Signed-off-by: Stephan Mueller ---- - test/kcapi-main.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/test/kcapi-main.c b/test/kcapi-main.c -index 46cce51..bce21b7 100644 ---- a/test/kcapi-main.c -+++ b/test/kcapi-main.c -@@ -282,6 +282,7 @@ static int fuzz_init_test(unsigned int size) - - if (get_random(name, size, 0)) { - printf("get_random call failed\n"); -+ free(name); - return 1; - } - -@@ -1016,7 +1017,7 @@ static int cavs_sym_stream(struct kcapi_cavs *cavs_test, uint32_t loops, - } - - outiov.iov_base = (uint8_t *)outiov.iov_base + ret; -- outiov.iov_len += ret; -+ outiov.iov_len -= ret; - outptr += ret; - } - diff --git a/001-workaround-cppcheck-bug.patch b/100-workaround-cppcheck-bug.patch similarity index 100% rename from 001-workaround-cppcheck-bug.patch rename to 100-workaround-cppcheck-bug.patch diff --git a/libkcapi.spec b/libkcapi.spec index aa40f1d..f7b7658 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -1,7 +1,7 @@ # Shared object version of libkcapi. %global vmajor 1 %global vminor 1 -%global vpatch 4 +%global vpatch 5 # Do we build the replacements packages? %bcond_with replace_coreutils @@ -97,7 +97,7 @@ bin/kcapi-hasher -n fipshmac -d "$lib_path"/fipscheck \\\ Name: libkcapi Version: %{vmajor}.%{vminor}.%{vpatch} -Release: 6%{?dist} +Release: 1%{?dist} Summary: User space interface to the Linux Kernel Crypto API License: BSD or GPLv2 @@ -105,10 +105,7 @@ URL: http://www.chronox.de/%{name}.html Source0: http://www.chronox.de/%{name}/%{name}-%{version}.tar.xz Source1: http://www.chronox.de/%{name}/%{name}-%{version}.tar.xz.asc -Patch0: %{giturl}/commit/52620ec798a5.patch#/000-Fix-build-with-gcc-8.2.x.patch -Patch1: 001-workaround-cppcheck-bug.patch -Patch2: %{giturl}/commit/4529c9d05836.patch#/002-Enable-testing-on-kernels-5.0.patch -Patch3: %{giturl}/commit/b455bb77dcf7.patch#/003-fix-test-case.patch +Patch100: 100-workaround-cppcheck-bug.patch BuildRequires: clang BuildRequires: coreutils @@ -369,6 +366,8 @@ done # which is the lowest limit needed to run the testsuite. If that limit # is not met, we do not run it. %if %{test_optmem_max} >= 20480 +# Skip the testsuite on old kernels. +%if %{lua:print(rpm.vercmp(posix.uname('%r'), '5.1'));} >= 0 # Real testsuite. pushd test ENABLE_FUZZ_TEST=1 \ @@ -376,6 +375,7 @@ NO_32BIT_TEST=1 \ ./test-invocation.sh popd %endif +%endif %ldconfig_scriptlets @@ -446,6 +446,9 @@ popd %changelog +* Tue Aug 13 2019 Ondrej Mosnáček - 1.1.5-1 +- Update to upstream version 1.1.5 + * Sat Jul 27 2019 Ondrej Mosnáček - 1.1.4-6 - Backport patch to fix test failure on aarch64 - Remove no longer needed ppc64 workaround diff --git a/sources b/sources index 650fff7..0c37ace 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (libkcapi-1.1.4.tar.xz) = b07cc4435829ad73585ca79d06cd57edf6c2e68f66dceac07a72332aa9cd325b79add02fd220166ee5e07a3d7b305df0dc941bccf1310784b3b16bf50291c4f9 -SHA512 (libkcapi-1.1.4.tar.xz.asc) = 22245f4a1fa98f3ad3a21a01e464bd6fba56d8541d5825739c928e577cdb7f5b30098dcdab1086bbbf33707e2c27ebd03c2810dc0e98d27120016dd0749ef7ba +SHA512 (libkcapi-1.1.5.tar.xz) = a9cd82464310d73d79d4aa7808cfe077a7b186511a34396c0521a158198769a7b97785af6072255e2cc8dcc23f5171694811faebcf9801aeb9861d729274fbc2 +SHA512 (libkcapi-1.1.5.tar.xz.asc) = 0630fa29d9f835bd0d1fcd4a58b9d89bf8b1f576d2f1ae5e385bbbff04edd9ba4cad1bdf6132e80f4d15d86e8d8488fa0cb187fbfaa559ed6aa6ad2a15bd97ef From 50dcd7a51faebebe0e25a3173cbe8b2d89083207 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 29 Jan 2020 09:29:32 +0000 Subject: [PATCH 08/61] - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- libkcapi.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libkcapi.spec b/libkcapi.spec index f7b7658..a06a066 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -97,7 +97,7 @@ bin/kcapi-hasher -n fipshmac -d "$lib_path"/fipscheck \\\ Name: libkcapi Version: %{vmajor}.%{vminor}.%{vpatch} -Release: 1%{?dist} +Release: 2%{?dist} Summary: User space interface to the Linux Kernel Crypto API License: BSD or GPLv2 @@ -446,6 +446,9 @@ popd %changelog +* Wed Jan 29 2020 Fedora Release Engineering - 1.1.5-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + * Tue Aug 13 2019 Ondrej Mosnáček - 1.1.5-1 - Update to upstream version 1.1.5 From d1117b07e60f89be9cd37fb1faef9696b593d894 Mon Sep 17 00:00:00 2001 From: Sahana Prasad Date: Wed, 22 Apr 2020 11:45:41 +0200 Subject: [PATCH 09/61] libkcapi.spec: Disables kcapi-enc tests until the kernel bug bz 1826022 is fixed. Signed-off-by: Sahana Prasad --- libkcapi.spec | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/libkcapi.spec b/libkcapi.spec index a06a066..aad5bef 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -97,7 +97,7 @@ bin/kcapi-hasher -n fipshmac -d "$lib_path"/fipscheck \\\ Name: libkcapi Version: %{vmajor}.%{vminor}.%{vpatch} -Release: 2%{?dist} +Release: 3%{?dist} Summary: User space interface to the Linux Kernel Crypto API License: BSD or GPLv2 @@ -120,6 +120,7 @@ BuildRequires: openssl BuildRequires: perl BuildRequires: systemd BuildRequires: xmlto +BuildRequires: sed # For ownership of %%{_sysctldir}. Requires: systemd @@ -370,6 +371,7 @@ done %if %{lua:print(rpm.vercmp(posix.uname('%r'), '5.1'));} >= 0 # Real testsuite. pushd test +```sed -i '/kcapi-enc-test/,+6d' test-invocation.sh``` ENABLE_FUZZ_TEST=1 \ NO_32BIT_TEST=1 \ ./test-invocation.sh @@ -446,6 +448,9 @@ popd %changelog +* Wed Apr 22 2020 Sahana Prasad - 1.1.5-3 +- Disables kcapi-enc tests until the kernel bug bz 1826022 is fixed. + * Wed Jan 29 2020 Fedora Release Engineering - 1.1.5-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild From 65b6380cc17fc52e69868c27a2e5e046922844e2 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Wed, 22 Apr 2020 12:41:47 +0200 Subject: [PATCH 10/61] Cleanup previous commit Remove backticks added by mistake and add a comment explaining the reson for the workaround. Signed-off-by: Ondrej Mosnacek --- libkcapi.spec | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libkcapi.spec b/libkcapi.spec index aad5bef..a37e9cd 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -371,7 +371,8 @@ done %if %{lua:print(rpm.vercmp(posix.uname('%r'), '5.1'));} >= 0 # Real testsuite. pushd test -```sed -i '/kcapi-enc-test/,+6d' test-invocation.sh``` +# Temporarily disable failing enc tests until BZ 1826022 is fixed. +sed -i '/kcapi-enc-test/,+6d' test-invocation.sh ENABLE_FUZZ_TEST=1 \ NO_32BIT_TEST=1 \ ./test-invocation.sh From 87985ec6fd71e7486226db68b7c0eb7b77b069c5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Mr=C3=A1z?= Date: Wed, 22 Apr 2020 10:04:50 +0000 Subject: [PATCH 11/61] Produce fipscheck replacement on Fedora 33+ --- libkcapi.spec | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/libkcapi.spec b/libkcapi.spec index a37e9cd..e215942 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -5,7 +5,12 @@ # Do we build the replacements packages? %bcond_with replace_coreutils +# Replace fipscheck by default in Fedora 33+: +%if 0%{?fedora} >= 33 || 0%{?rhel} >= 9 +%bcond_without replace_fipscheck +%else %bcond_with replace_fipscheck +%endif # Replace hmaccalc by default in Fedora 28+: %if 0%{?fedora} >= 28 || 0%{?rhel} >= 8 %bcond_without replace_hmaccalc @@ -56,8 +61,7 @@ # Do we replace fipscheck? %if %{with replace_fipscheck} -# TODO: Adapt this when replacing fipscheck initially. -%global fipscheck_evr 1.5.0-3%{?dist} +%global fipscheck_evr 1.5.0-9 %endif # Do we replace hmaccalc? @@ -451,6 +455,7 @@ popd %changelog * Wed Apr 22 2020 Sahana Prasad - 1.1.5-3 - Disables kcapi-enc tests until the kernel bug bz 1826022 is fixed. +- Produce also the fipscheck replacement package * Wed Jan 29 2020 Fedora Release Engineering - 1.1.5-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild From c19476ae7965dee0e9afe15a8e369b5c91607987 Mon Sep 17 00:00:00 2001 From: Tomas Mraz Date: Thu, 23 Apr 2020 14:41:44 +0200 Subject: [PATCH 12/61] Add . prefix to files created by fipshmac if -d option is not specified --- 110-fipshmac-compat.patch | 30 ++++++++++++++++++++++++++++++ libkcapi.spec | 6 +++++- 2 files changed, 35 insertions(+), 1 deletion(-) create mode 100644 110-fipshmac-compat.patch diff --git a/110-fipshmac-compat.patch b/110-fipshmac-compat.patch new file mode 100644 index 0000000..42502f6 --- /dev/null +++ b/110-fipshmac-compat.patch @@ -0,0 +1,30 @@ +diff -up libkcapi-1.1.5/apps/kcapi-hasher.c.fipshmac-compat libkcapi-1.1.5/apps/kcapi-hasher.c +--- libkcapi-1.1.5/apps/kcapi-hasher.c.fipshmac-compat 2019-01-23 07:14:51.000000000 +0100 ++++ libkcapi-1.1.5/apps/kcapi-hasher.c 2020-04-23 14:37:59.518173594 +0200 +@@ -386,10 +386,16 @@ static char *paste(char *dst, const char + static char *get_hmac_file(const char *filename, const char *checkdir) + { + size_t i, filelen, pathlen, namelen, basenamestart = 0; +- size_t prefixlen = strlen(CHECK_PREFIX); ++ const char *check_prefix = CHECK_PREFIX; ++ size_t prefixlen = strlen(check_prefix); + size_t suffixlen = strlen(CHECK_SUFFIX); + char *cursor, *checkfile = NULL; + ++ if (prefixlen == 0 && checkdir == NULL) { ++ check_prefix = "."; ++ prefixlen = 1; ++ } ++ + filelen = strlen(filename); + if (filelen > 4096) { + fprintf(stderr, "File too long\n"); +@@ -415,7 +421,7 @@ static char *get_hmac_file(const char *f + } else if (pathlen > 0) + cursor = paste(cursor, filename, pathlen); + +- cursor = paste(cursor, CHECK_PREFIX, prefixlen); ++ cursor = paste(cursor, check_prefix, prefixlen); + cursor = paste(cursor, filename + basenamestart, namelen); + cursor = paste(cursor, "."CHECK_SUFFIX, 1 + suffixlen); + strncpy(cursor, "\0", 1); diff --git a/libkcapi.spec b/libkcapi.spec index e215942..57613bf 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -101,7 +101,7 @@ bin/kcapi-hasher -n fipshmac -d "$lib_path"/fipscheck \\\ Name: libkcapi Version: %{vmajor}.%{vminor}.%{vpatch} -Release: 3%{?dist} +Release: 4%{?dist} Summary: User space interface to the Linux Kernel Crypto API License: BSD or GPLv2 @@ -110,6 +110,7 @@ Source0: http://www.chronox.de/%{name}/%{name}-%{version}.tar.xz Source1: http://www.chronox.de/%{name}/%{name}-%{version}.tar.xz.asc Patch100: 100-workaround-cppcheck-bug.patch +Patch110: 110-fipshmac-compat.patch BuildRequires: clang BuildRequires: coreutils @@ -453,6 +454,9 @@ popd %changelog +* Thu Apr 23 2020 Tomáš Mráz - 1.1.5-4 +- Add . prefix to files created by fipshmac if -d option is not specified + * Wed Apr 22 2020 Sahana Prasad - 1.1.5-3 - Disables kcapi-enc tests until the kernel bug bz 1826022 is fixed. - Produce also the fipscheck replacement package From 302b990936a15d7ec01396135f9839aefcc5d8fb Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Thu, 23 Apr 2020 14:54:16 +0200 Subject: [PATCH 13/61] Add the fipscheck smoke test Since we are now replacing fipscheck, add its existing dist-git test to libkcapi. Signed-off-by: Ondrej Mosnacek --- tests/fipscheck-smoke-test/Makefile | 71 +++++++++++++++++++++++++++ tests/fipscheck-smoke-test/PURPOSE | 3 ++ tests/fipscheck-smoke-test/runtest.sh | 71 +++++++++++++++++++++++++++ tests/tests.yml | 22 ++++++++- 4 files changed, 166 insertions(+), 1 deletion(-) create mode 100644 tests/fipscheck-smoke-test/Makefile create mode 100644 tests/fipscheck-smoke-test/PURPOSE create mode 100755 tests/fipscheck-smoke-test/runtest.sh diff --git a/tests/fipscheck-smoke-test/Makefile b/tests/fipscheck-smoke-test/Makefile new file mode 100644 index 0000000..0e0dda3 --- /dev/null +++ b/tests/fipscheck-smoke-test/Makefile @@ -0,0 +1,71 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/libgcrypt/smoke-test +# Description: Test calls upstream test suite. +# Author: Ondrej Moris +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2010 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/libgcrypt/smoke-test +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Ondrej Moris " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Test calls upstream test suite." >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: libgcrypt" >> $(METADATA) + @echo "Requires: libgcrypt" >> $(METADATA) + @echo "Requires: nfs-utils" >> $(METADATA) + @echo "Requires: rpm-build" >> $(METADATA) + @echo "Requires: gawk" >> $(METADATA) + @echo "Requires: gcc-c++ fipscheck" >> $(METADATA) + @echo "Requires: libgpg-error-devel wget" >> $(METADATA) + @echo "Requires: pkgconfig texinfo libselinux-utils" >> $(METADATA) + @echo "Releases: -RHEL3 -RHEL4" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "Architectures: i386 x86_64 s390x ia64" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + + rhts-lint $(METADATA) diff --git a/tests/fipscheck-smoke-test/PURPOSE b/tests/fipscheck-smoke-test/PURPOSE new file mode 100644 index 0000000..5df6ca9 --- /dev/null +++ b/tests/fipscheck-smoke-test/PURPOSE @@ -0,0 +1,3 @@ +PURPOSE of /CoreOS/libgcrypt/Sanity/smoke-test +Description: Test calls upstream test suite. +Author: Ondrej Moris diff --git a/tests/fipscheck-smoke-test/runtest.sh b/tests/fipscheck-smoke-test/runtest.sh new file mode 100755 index 0000000..dd1803d --- /dev/null +++ b/tests/fipscheck-smoke-test/runtest.sh @@ -0,0 +1,71 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/libgcrypt/smoke-test +# Description: Test calls upstream test suite. +# Author: Ondrej Moris +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2010 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +#. /usr/bin/rhts-environment.sh +. /usr/share/beakerlib/beakerlib.sh + +PACKAGE="libgcrypt" + +rlJournalStart + + rlPhaseStartSetup + TmpDir=`mktemp -d` + rlAssertRpm $PACKAGE + rlFileBackup --clean "/etc/gcrypt/fips_enabled" + rlRun "pushd $TmpDir" 0 + rlFetchSrcForInstalled $PACKAGE + rlRun "rpm -ihv `ls *.rpm`" 0 + if grep '1' /proc/sys/crypto/fips_enabled; then + rlRun "echo '1' > /etc/gcrypt/fips_enabled" 0 + fi + rlPhaseEnd + + rlPhaseStartTest + TOPDIR=`rpm --eval %_topdir` + rlRun "pushd $TOPDIR" 0 + rlRun "rm -rf BUILD/libgcrypt-*" 0-255 + rlRun "rpmbuild -vv -bc SPECS/libgcrypt.spec" 0 + rlRun "pushd BUILD/libgcrypt-*" 0 + rlRun "fipshmac src/.libs/libgcrypt.so.??" 0 + rlRun "make check > $TmpDir/make_check.out" 0 + rlRun "popd" 0 + rlRun "popd" 0 + rlRun "grep \"All [0-9]\+ tests passed\" $TmpDir/make_check.out" 0 \ + "All tests passed" + rlRun "cat $TmpDir/make_check.out" 0 + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "popd" 0 + rlRun "rm -r $TmpDir" 0 + rlFileRestore + rlPhaseEnd + +rlJournalPrintText +rlJournalEnd diff --git a/tests/tests.yml b/tests/tests.yml index 9d6ad04..dd03673 100644 --- a/tests/tests.yml +++ b/tests/tests.yml @@ -2,7 +2,6 @@ tags: - classic - container - - atomic roles: - role: standard-test-basic required_packages: @@ -22,3 +21,24 @@ run: /usr/libexec/libkcapi/kcapi-convenience.sh - upstream-fuzz-test: run: /usr/libexec/libkcapi/kcapi-fuzz-test.sh + +- hosts: localhost + tags: + - classic + - container + roles: + - role: standard-test-beakerlib + required_packages: + - fipscheck + - gawk + - gcc-c++ + - libgcrypt + - libgpg-error-devel + - libselinux-utils + - nfs-utils + - pkgconfig + - rpm-build + - texinfo + - wget + tests: + - fipscheck-smoke-test From 538d7604c93b59d358152386ac753bc9514b804b Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Wed, 29 Apr 2020 13:09:50 +0200 Subject: [PATCH 14/61] Fix the CI test failures Disable the enc-test (failing due to kernel bug) also in the YAML tests and add a missing dependency to the fipscheck smoke test. Signed-off-by: Ondrej Mosnacek --- tests/tests.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tests/tests.yml b/tests/tests.yml index dd03673..40094a1 100644 --- a/tests/tests.yml +++ b/tests/tests.yml @@ -10,7 +10,9 @@ - upstream-basic-test: run: /usr/libexec/libkcapi/test.sh - upstream-enc-test: - run: /usr/libexec/libkcapi/kcapi-enc-test.sh + # temporarily disabled until kernel bug is fixed: + # https://lore.kernel.org/linux-crypto/CAAUqJDvZt7_j+eor1sXRg+QmrdXTjMiymFnji86PoatsYPUugA@mail.gmail.com/T/ + run: /usr/libexec/libkcapi/kcapi-enc-test.sh || true - upstream-enc-test-large: run: /usr/libexec/libkcapi/kcapi-enc-test-large.sh - upstream-dgst-test: @@ -35,6 +37,7 @@ - libgcrypt - libgpg-error-devel - libselinux-utils + - libtool - nfs-utils - pkgconfig - rpm-build From 7393454a2fa1ef2cd320609aeb05ca3aacf8ab3c Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Wed, 29 Apr 2020 09:07:49 +0200 Subject: [PATCH 15/61] Enable building on old kernels This adds scripts that mock sha512hmac and fipshmac using openssl. These are used instead of the built hashers to hash libkcapi binaries on kernels that don't suport the userspace Crypto API interface properly (e.g. RHEL-7 kernels). Signed-off-by: Ondrej Mosnacek --- fipshmac-openssl.sh | 9 +++++++++ libkcapi.spec | 21 ++++++++++++++++----- sha512hmac-openssl.sh | 6 ++++++ 3 files changed, 31 insertions(+), 5 deletions(-) create mode 100644 fipshmac-openssl.sh create mode 100644 sha512hmac-openssl.sh diff --git a/fipshmac-openssl.sh b/fipshmac-openssl.sh new file mode 100644 index 0000000..c554434 --- /dev/null +++ b/fipshmac-openssl.sh @@ -0,0 +1,9 @@ +#!/bin/bash + +# Mocks fipshmac using the openssl tool. +# Only for use during RPM build. + +[ "$1" = '-d' ] || exit 1 + +openssl sha256 -hmac orboDeJITITejsirpADONivirpUkvarP -hex "$3" | cut -f 2 -d ' ' \ + >"$2/$(basename "$3").hmac" diff --git a/libkcapi.spec b/libkcapi.spec index 57613bf..b449fe2 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -72,6 +72,15 @@ %global apps_hmaccalc sha1hmac sha224hmac sha256hmac sha384hmac sha512hmac %global apps_fipscheck sha1sum sha224sum sha256sum sha384sum sha512sum md5sum fipscheck fipshmac +# On old kernels use mock hashers implemented via openssl +%if %{lua:print(rpm.vercmp(posix.uname('%r'), '3.19'));} >= 0 +%global sha512hmac bin/kcapi-hasher -n sha512hmac +%global fipshmac bin/kcapi-hasher -n fipshmac +%else +%global sha512hmac bash %{_sourcedir}/sha512hmac-openssl.sh +%global fipshmac bash %{_sourcedir}/fipshmac-openssl.sh +%endif + # Add generation of HMAC checksums of the final stripped # binaries. %%define with lazy globbing is used here # intentionally, because using %%global does not work. @@ -83,16 +92,15 @@ bin_path=%{buildroot}%{_bindir} \ lib_path=%{buildroot}/%{_lib} \ for app in %{apps_hmaccalc}; do \ test -e "$bin_path"/$app || continue \ - { bin/kcapi-hasher -n sha512hmac "$bin_path"/$app || exit 1; } \\\ + { %sha512hmac "$bin_path"/$app || exit 1; } \\\ | cut -f 1 -d ' ' >"$lib_path"/hmaccalc/$app.hmac \ done \ for app in %{apps_fipscheck}; do \ test -e "$bin_path"/$app || continue \ - bin/kcapi-hasher -n fipshmac -d "$lib_path"/fipscheck \\\ - "$bin_path"/$app || exit 1 \ + %fipshmac -d "$lib_path"/fipscheck "$bin_path"/$app || exit 1 \ done \ -%{_bindir}/hardlink -cfv %{buildroot}%{_bindir} \ -bin/kcapi-hasher -n fipshmac -d "$lib_path"/fipscheck \\\ +%{_bindir}/hardlink -cfv %{buildroot}%{_bindir} \ +%fipshmac -d "$lib_path"/fipscheck \\\ "$lib_path"/libkcapi.so.%{version} || exit 1 \ %{__ln_s} libkcapi.so.%{version}.hmac \\\ "$lib_path"/fipscheck/libkcapi.so.%{vmajor}.hmac \ @@ -108,10 +116,13 @@ License: BSD or GPLv2 URL: http://www.chronox.de/%{name}.html Source0: http://www.chronox.de/%{name}/%{name}-%{version}.tar.xz Source1: http://www.chronox.de/%{name}/%{name}-%{version}.tar.xz.asc +Source2: sha512hmac-openssl.sh +Source3: fipshmac-openssl.sh Patch100: 100-workaround-cppcheck-bug.patch Patch110: 110-fipshmac-compat.patch +BuildRequires: bash BuildRequires: clang BuildRequires: coreutils BuildRequires: cppcheck diff --git a/sha512hmac-openssl.sh b/sha512hmac-openssl.sh new file mode 100644 index 0000000..6496394 --- /dev/null +++ b/sha512hmac-openssl.sh @@ -0,0 +1,6 @@ +#!/bin/bash + +# Mocks sha512hmac using the openssl tool. +# Only for use during RPM build. + +openssl sha512 -hmac FIPS-FTW-RHT2009 -hex "$1" | cut -f 2 -d ' ' From c57ecf744166342cfe6cf4671ff6e2412a4649d2 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Thu, 30 Apr 2020 13:07:39 +0200 Subject: [PATCH 16/61] Avoid conflicts between different versions of packages Remove duplicate files from the -doc subpackage and make it depend on the base package (intentionally without %{_isa} since any base package of the same version ships the same license files). Signed-off-by: Ondrej Mosnacek --- libkcapi.spec | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/libkcapi.spec b/libkcapi.spec index b449fe2..350d8f8 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -169,6 +169,10 @@ Header files for applications that use %{name}. %package doc Summary: User documentation for the %{name} package BuildArch: noarch +# Depend on one of the base packages because they have the license files +# We cannot just bundle them into doc because they might conflict with an +# older or newer version of the base package. +Requires: %{name} == %{version}-%{release} %description doc User documentation for %{name}. @@ -424,8 +428,9 @@ popd %files doc -%doc %{_pkgdocdir} -%license %{_datadir}/licenses/%{name}* +%doc %{_pkgdocdir}/html +%doc %{_pkgdocdir}/%{name}.pdf +%doc %{_pkgdocdir}/%{name}.ps %if %{with replace_coreutils} From 294dffd21f488bd674b3c3c3de49222810702dde Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Tue, 5 May 2020 10:22:44 +0200 Subject: [PATCH 17/61] Bump release and update changelog for 1.1.5-5 Signed-off-by: Ondrej Mosnacek --- libkcapi.spec | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/libkcapi.spec b/libkcapi.spec index 350d8f8..83f6359 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -109,7 +109,7 @@ done \ Name: libkcapi Version: %{vmajor}.%{vminor}.%{vpatch} -Release: 4%{?dist} +Release: 5%{?dist} Summary: User space interface to the Linux Kernel Crypto API License: BSD or GPLv2 @@ -470,6 +470,11 @@ popd %changelog +* Tue May 05 2020 Ondrej Mosnáček - 1.1.5-5 +- Fix the CI test failures +- Enable building on old kernels +- Avoid conflicts between different versions of packages + * Thu Apr 23 2020 Tomáš Mráz - 1.1.5-4 - Add . prefix to files created by fipshmac if -d option is not specified From bc1c80da03e49779d4ff32bb2562998fa354b0fd Mon Sep 17 00:00:00 2001 From: Aleksandra Fedorova Date: Wed, 20 May 2020 22:04:57 +0200 Subject: [PATCH 18/61] Update gating test name Messaging scheme has changed and old centos-related test names are now deprecated. See https://pagure.io/fedora-ci/general/issue/110 --- gating.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gating.yaml b/gating.yaml index 4e26a6f..c2182c7 100644 --- a/gating.yaml +++ b/gating.yaml @@ -3,4 +3,4 @@ product_versions: - fedora-* decision_context: bodhi_update_push_stable rules: - - !PassingTestCaseRule {test_case_name: org.centos.prod.ci.pipeline.allpackages-build.package.test.functional.complete} + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} From d7a1af30f269e51d02a2d4b34eb6d68f38fbc071 Mon Sep 17 00:00:00 2001 From: Sahana Prasad Date: Mon, 25 May 2020 11:16:36 +0200 Subject: [PATCH 19/61] Update to upstream version 1.2.0 tracked by BZ 1839592 Signed-off-by: Sahana Prasad --- 100-workaround-cppcheck-bug.patch | 13 ------------- 110-fipshmac-compat.patch | 30 ------------------------------ libkcapi.spec | 17 +++++++++-------- sources | 4 ++-- tests/tests.yml | 4 +--- 5 files changed, 12 insertions(+), 56 deletions(-) delete mode 100644 100-workaround-cppcheck-bug.patch delete mode 100644 110-fipshmac-compat.patch diff --git a/100-workaround-cppcheck-bug.patch b/100-workaround-cppcheck-bug.patch deleted file mode 100644 index 1819e83..0000000 --- a/100-workaround-cppcheck-bug.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/test/kcapi-main.c b/test/kcapi-main.c -index 2ae0edb..6818e67 100644 ---- a/test/kcapi-main.c -+++ b/test/kcapi-main.c -@@ -237,7 +237,7 @@ static inline uint64_t _time_delta(struct timespec *start, struct timespec *end) - - static int get_random(uint8_t *buf, uint32_t buflen, unsigned int flags) - { -- int ret; -+ int ret = 0; - - if (buflen > INT_MAX) - return 1; diff --git a/110-fipshmac-compat.patch b/110-fipshmac-compat.patch deleted file mode 100644 index 42502f6..0000000 --- a/110-fipshmac-compat.patch +++ /dev/null @@ -1,30 +0,0 @@ -diff -up libkcapi-1.1.5/apps/kcapi-hasher.c.fipshmac-compat libkcapi-1.1.5/apps/kcapi-hasher.c ---- libkcapi-1.1.5/apps/kcapi-hasher.c.fipshmac-compat 2019-01-23 07:14:51.000000000 +0100 -+++ libkcapi-1.1.5/apps/kcapi-hasher.c 2020-04-23 14:37:59.518173594 +0200 -@@ -386,10 +386,16 @@ static char *paste(char *dst, const char - static char *get_hmac_file(const char *filename, const char *checkdir) - { - size_t i, filelen, pathlen, namelen, basenamestart = 0; -- size_t prefixlen = strlen(CHECK_PREFIX); -+ const char *check_prefix = CHECK_PREFIX; -+ size_t prefixlen = strlen(check_prefix); - size_t suffixlen = strlen(CHECK_SUFFIX); - char *cursor, *checkfile = NULL; - -+ if (prefixlen == 0 && checkdir == NULL) { -+ check_prefix = "."; -+ prefixlen = 1; -+ } -+ - filelen = strlen(filename); - if (filelen > 4096) { - fprintf(stderr, "File too long\n"); -@@ -415,7 +421,7 @@ static char *get_hmac_file(const char *f - } else if (pathlen > 0) - cursor = paste(cursor, filename, pathlen); - -- cursor = paste(cursor, CHECK_PREFIX, prefixlen); -+ cursor = paste(cursor, check_prefix, prefixlen); - cursor = paste(cursor, filename + basenamestart, namelen); - cursor = paste(cursor, "."CHECK_SUFFIX, 1 + suffixlen); - strncpy(cursor, "\0", 1); diff --git a/libkcapi.spec b/libkcapi.spec index 83f6359..20e01fa 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -1,7 +1,7 @@ # Shared object version of libkcapi. %global vmajor 1 -%global vminor 1 -%global vpatch 5 +%global vminor 2 +%global vpatch 0 # Do we build the replacements packages? %bcond_with replace_coreutils @@ -109,7 +109,7 @@ done \ Name: libkcapi Version: %{vmajor}.%{vminor}.%{vpatch} -Release: 5%{?dist} +Release: 1%{?dist} Summary: User space interface to the Linux Kernel Crypto API License: BSD or GPLv2 @@ -119,8 +119,6 @@ Source1: http://www.chronox.de/%{name}/%{name}-%{version}.tar.xz.asc Source2: sha512hmac-openssl.sh Source3: fipshmac-openssl.sh -Patch100: 100-workaround-cppcheck-bug.patch -Patch110: 110-fipshmac-compat.patch BuildRequires: bash BuildRequires: clang @@ -136,7 +134,6 @@ BuildRequires: openssl BuildRequires: perl BuildRequires: systemd BuildRequires: xmlto -BuildRequires: sed # For ownership of %%{_sysctldir}. Requires: systemd @@ -391,8 +388,6 @@ done %if %{lua:print(rpm.vercmp(posix.uname('%r'), '5.1'));} >= 0 # Real testsuite. pushd test -# Temporarily disable failing enc tests until BZ 1826022 is fixed. -sed -i '/kcapi-enc-test/,+6d' test-invocation.sh ENABLE_FUZZ_TEST=1 \ NO_32BIT_TEST=1 \ ./test-invocation.sh @@ -470,6 +465,12 @@ popd %changelog +* Mon May 25 2020 Sahana Prasad - 1.2.0-1 +- Update to upstream version 1.2.0 tracked by BZ 1839592. +- Enable kcapi-enc tests as libkcapi BZ 1826022 is fixed. +- Remove 110-fipshmac-compat.patch as the changes are merged upstream. +- Remove 100-workaround-cppcheck-bug.patch as the changes are merged upstream. + * Tue May 05 2020 Ondrej Mosnáček - 1.1.5-5 - Fix the CI test failures - Enable building on old kernels diff --git a/sources b/sources index 0c37ace..a634ca6 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (libkcapi-1.1.5.tar.xz) = a9cd82464310d73d79d4aa7808cfe077a7b186511a34396c0521a158198769a7b97785af6072255e2cc8dcc23f5171694811faebcf9801aeb9861d729274fbc2 -SHA512 (libkcapi-1.1.5.tar.xz.asc) = 0630fa29d9f835bd0d1fcd4a58b9d89bf8b1f576d2f1ae5e385bbbff04edd9ba4cad1bdf6132e80f4d15d86e8d8488fa0cb187fbfaa559ed6aa6ad2a15bd97ef +SHA512 (libkcapi-1.2.0.tar.xz) = f097aac4fb06d0e0a7f62376506caa2d4cdb03572be89286ff335684f9a10285ffea4b3cfb37fd49e51435aa6636256aa12f0cf970fd48b1358aace8ac14b289 +SHA512 (libkcapi-1.2.0.tar.xz.asc) = 336769b04c75ee23d4cae98697a6ea14e5bd244bcefaa2396d80dab95538620c9353100685bd0568f61b8dfa3089c6ff7e4fdcdde949012ba0d7fe6aac650577 diff --git a/tests/tests.yml b/tests/tests.yml index 40094a1..1a0db89 100644 --- a/tests/tests.yml +++ b/tests/tests.yml @@ -10,9 +10,7 @@ - upstream-basic-test: run: /usr/libexec/libkcapi/test.sh - upstream-enc-test: - # temporarily disabled until kernel bug is fixed: - # https://lore.kernel.org/linux-crypto/CAAUqJDvZt7_j+eor1sXRg+QmrdXTjMiymFnji86PoatsYPUugA@mail.gmail.com/T/ - run: /usr/libexec/libkcapi/kcapi-enc-test.sh || true + run: /usr/libexec/libkcapi/kcapi-enc-test.sh - upstream-enc-test-large: run: /usr/libexec/libkcapi/kcapi-enc-test-large.sh - upstream-dgst-test: From 225db776e3fc749299d6100767c6c1400fa0b8eb Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Tue, 28 Jul 2020 04:56:25 +0000 Subject: [PATCH 20/61] - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- libkcapi.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libkcapi.spec b/libkcapi.spec index 20e01fa..7e90a25 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -109,7 +109,7 @@ done \ Name: libkcapi Version: %{vmajor}.%{vminor}.%{vpatch} -Release: 1%{?dist} +Release: 2%{?dist} Summary: User space interface to the Linux Kernel Crypto API License: BSD or GPLv2 @@ -465,6 +465,9 @@ popd %changelog +* Tue Jul 28 2020 Fedora Release Engineering - 1.2.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + * Mon May 25 2020 Sahana Prasad - 1.2.0-1 - Update to upstream version 1.2.0 tracked by BZ 1839592. - Enable kcapi-enc tests as libkcapi BZ 1826022 is fixed. From fb857c42d085533a8ca34c2850afaac6b104ff7c Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Fri, 14 Aug 2020 11:03:37 +0200 Subject: [PATCH 21/61] Require perl-interpreter instead of full perl perl-interpreter pulls in less packages and as it turns out is actually sufficient to build the package and run the tests so swtich to it. Signed-off-by: Ondrej Mosnacek --- libkcapi.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libkcapi.spec b/libkcapi.spec index 7e90a25..d44c275 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -131,7 +131,7 @@ BuildRequires: hardlink BuildRequires: kernel-headers >= %{min_kernel_ver} BuildRequires: libtool BuildRequires: openssl -BuildRequires: perl +BuildRequires: perl-interpreter BuildRequires: systemd BuildRequires: xmlto @@ -256,7 +256,7 @@ Requires: %{name}-checksum%{?_isa} == %{version}-%{release} %endif Requires: coreutils Requires: openssl -Requires: perl +Requires: perl-interpreter %description tests Auxiliary scripts for testing %{name}. From afdaa1cd48edfa6c06d7b5bd075ccbbdb5624aff Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Fri, 14 Aug 2020 11:22:09 +0200 Subject: [PATCH 22/61] Backport fix for 5.9 kernels Kernel 5.9 will become more strict about the usage of MSG_MORE so this upstream patch is needed to keep libkcapi working with the new kernel. Signed-off-by: Ondrej Mosnacek --- 000-Kern-5.8-fix-MSG_MORE-usage.patch | 163 ++++++++++++++++++++++++++ libkcapi.spec | 1 + 2 files changed, 164 insertions(+) create mode 100644 000-Kern-5.8-fix-MSG_MORE-usage.patch diff --git a/000-Kern-5.8-fix-MSG_MORE-usage.patch b/000-Kern-5.8-fix-MSG_MORE-usage.patch new file mode 100644 index 0000000..5841ef6 --- /dev/null +++ b/000-Kern-5.8-fix-MSG_MORE-usage.patch @@ -0,0 +1,163 @@ +From b612c52c5ccf021d01e6c786db1a31a697f21d97 Mon Sep 17 00:00:00 2001 +From: Stephan Mueller +Date: Thu, 13 Aug 2020 21:58:07 +0200 +Subject: [PATCH] Kern 5.8: fix MSG_MORE usage + +With kernel 5.8, a precise use of MSG_MORE is mandatory to support +a stream cipher approach (init -> update -> update -> ... -> final). +All but the last update operations must use MSG_MORE, the last update +operation must not use MSG_MORE. + +Reported-by: Ondrej Mosnacek +Signed-off-by: Stephan Mueller +--- + lib/kcapi-aead.c | 24 ++++++++++++++---------- + lib/kcapi-kernel-if.c | 6 ++---- + test/kcapi-main.c | 31 +++++++++++++++++-------------- + 3 files changed, 33 insertions(+), 28 deletions(-) + +diff --git a/lib/kcapi-aead.c b/lib/kcapi-aead.c +index d241618..45a0bd7 100644 +--- a/lib/kcapi-aead.c ++++ b/lib/kcapi-aead.c +@@ -210,13 +210,15 @@ _kcapi_aead_encrypt_aio_fallback(struct kcapi_handle *handle, + uint32_t iovlen, const uint8_t *iv) + { + uint32_t i; +- int32_t ret = kcapi_aead_stream_init_enc(handle, iv, NULL, 0); +- +- if (ret < 0) +- return ret; ++ int32_t ret = 0; + + for (i = 0; i < iovlen; i++) { +- int rc = kcapi_aead_stream_update_last(handle, iniov, 1); ++ int rc = kcapi_aead_stream_init_enc(handle, iv, NULL, 0); ++ ++ if (rc < 0) ++ return rc; ++ ++ rc = kcapi_aead_stream_update_last(handle, iniov, 1); + if (rc < 0) + return rc; + +@@ -271,13 +273,15 @@ _kcapi_aead_decrypt_aio_fallback(struct kcapi_handle *handle, + uint32_t iovlen, const uint8_t *iv) + { + uint32_t i; +- int32_t ret = kcapi_aead_stream_init_dec(handle, iv, NULL, 0); +- +- if (ret < 0) +- return ret; ++ int32_t ret = 0; + + for (i = 0; i < iovlen; i++) { +- int rc = kcapi_aead_stream_update_last(handle, iniov, 1); ++ int rc = kcapi_aead_stream_init_dec(handle, iv, NULL, 0); ++ ++ if (rc < 0) ++ return rc; ++ ++ rc = kcapi_aead_stream_update_last(handle, iniov, 1); + if (rc < 0) + return rc; + +diff --git a/lib/kcapi-kernel-if.c b/lib/kcapi-kernel-if.c +index bea994f..42cf1ad 100644 +--- a/lib/kcapi-kernel-if.c ++++ b/lib/kcapi-kernel-if.c +@@ -439,8 +439,7 @@ int _kcapi_aio_send_iov(struct kcapi_handle *handle, struct iovec *iov, + if (0 > ret) + return ret; + } else { +- ret = _kcapi_common_send_meta(handle, NULL, 0, enc, +- len ? MSG_MORE : 0); ++ ret = _kcapi_common_send_meta(handle, NULL, 0, enc, MSG_MORE); + if (0 > ret) + return ret; + ret = _kcapi_common_vmsplice_iov(handle, iov, iovlen, 0); +@@ -1246,8 +1245,7 @@ int32_t _kcapi_cipher_crypt(struct kcapi_handle *handle, const uint8_t *in, + if (0 > ret) + return ret; + } else { +- ret = _kcapi_common_send_meta(handle, NULL, 0, enc, +- inlen ? MSG_MORE : 0); ++ ret = _kcapi_common_send_meta(handle, NULL, 0, enc, MSG_MORE); + if (0 > ret) + return ret; + ret = _kcapi_common_vmsplice_chunk(handle, in, inlen, 0); +diff --git a/test/kcapi-main.c b/test/kcapi-main.c +index 51f6ec7..64e466c 100644 +--- a/test/kcapi-main.c ++++ b/test/kcapi-main.c +@@ -846,7 +846,7 @@ static int cavs_sym(struct kcapi_cavs *cavs_test, uint32_t loops, + goto out; + } + +- for(i = 0; i < loops; i++) { ++ for (i = 0; i < loops; i++) { + _get_time(&begin); + if (cavs_test->enc) { + ret = kcapi_cipher_encrypt(handle, +@@ -886,7 +886,7 @@ static int cavs_sym(struct kcapi_cavs *cavs_test, uint32_t loops, + } + + static void mt_sym_writer(struct kcapi_handle *handle, struct iovec *iov, +- int forking) ++ int forking, int last) + { + int ret; + +@@ -899,7 +899,10 @@ static void mt_sym_writer(struct kcapi_handle *handle, struct iovec *iov, + return; + } + +- ret = kcapi_cipher_stream_update_last(handle, iov, 1); ++ if (last) ++ ret = kcapi_cipher_stream_update_last(handle, iov, 1); ++ else ++ ret = kcapi_cipher_stream_update(handle, iov, 1); + if (0 > ret) + printf("Sending of data failed\n"); + +@@ -1004,7 +1007,7 @@ static int cavs_sym_stream(struct kcapi_cavs *cavs_test, uint32_t loops, + iov.iov_len = cavs_test->ctlen; + } + +- mt_sym_writer(handle_ptr, &iov, forking); ++ mt_sym_writer(handle_ptr, &iov, forking, i == (loops * 2 - 1)); + + outiov.iov_base = outbuf_ptr; + outiov.iov_len = outbuflen; +@@ -1636,21 +1639,21 @@ static int cavs_aead_stream(struct kcapi_cavs *cavs_test, uint32_t loops, + if (ret) + goto out; + +- if (cavs_test->enc) +- ret = kcapi_aead_stream_init_enc(handle, newiv, NULL, 0); +- +- else +- ret = kcapi_aead_stream_init_dec(handle, newiv, NULL, 0); +- if (0 > ret) { +- printf("Initialization of cipher buffer failed\n"); +- goto out; +- } +- + for (i = 0; i < loops; i++) { + int errsv = 0; + + memset(outbuf, 0, outbuflen); + ++ if (cavs_test->enc) ++ ret = kcapi_aead_stream_init_enc(handle, newiv, NULL, 0); ++ else ++ ret = kcapi_aead_stream_init_dec(handle, newiv, NULL, 0); ++ if (0 > ret) { ++ printf("Initialization of cipher buffer failed\n"); ++ goto out; ++ } ++ ++ + iov.iov_base = cavs_test->assoc; + iov.iov_len = cavs_test->assoclen; + if (cavs_test->enc) { diff --git a/libkcapi.spec b/libkcapi.spec index d44c275..8c0960d 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -119,6 +119,7 @@ Source1: http://www.chronox.de/%{name}/%{name}-%{version}.tar.xz.asc Source2: sha512hmac-openssl.sh Source3: fipshmac-openssl.sh +Patch0: %{giturl}/commit/b612c52c5ccf.patch#/000-Kern-5.8-fix-MSG_MORE-usage.patch BuildRequires: bash BuildRequires: clang From ba6b846bc343b2bab9fe27b664a4980d5a57c6f4 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Fri, 14 Aug 2020 11:26:52 +0200 Subject: [PATCH 23/61] Bump release and update changelog for 1.2.0-3 Signed-off-by: Ondrej Mosnacek --- libkcapi.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/libkcapi.spec b/libkcapi.spec index 8c0960d..aa95389 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -109,7 +109,7 @@ done \ Name: libkcapi Version: %{vmajor}.%{vminor}.%{vpatch} -Release: 2%{?dist} +Release: 3%{?dist} Summary: User space interface to the Linux Kernel Crypto API License: BSD or GPLv2 @@ -466,6 +466,10 @@ popd %changelog +* Fri Aug 14 2020 Ondrej Mosnáček - 1.2.0-3 +- Require perl-interpreter instead of full perl +- Backport fix for 5.9 kernels + * Tue Jul 28 2020 Fedora Release Engineering - 1.2.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild From 7a34808f0c3a9a092a2fd180ce75f0f253436671 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Tue, 3 Nov 2020 16:49:29 +0100 Subject: [PATCH 24/61] Depend on git-core instead of full git See: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/message/GS7GOUITUEASRELL7SKGLVJLGS3ZVJ45/ Signed-off-by: Ondrej Mosnacek --- libkcapi.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libkcapi.spec b/libkcapi.spec index aa95389..7b6881b 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -127,7 +127,7 @@ BuildRequires: coreutils BuildRequires: cppcheck BuildRequires: docbook-utils-pdf BuildRequires: gcc -BuildRequires: git +BuildRequires: git-core BuildRequires: hardlink BuildRequires: kernel-headers >= %{min_kernel_ver} BuildRequires: libtool From e34cfed4124880ebfb5052cb44d87b7f1d6db43d Mon Sep 17 00:00:00 2001 From: Tom Stellard Date: Tue, 5 Jan 2021 02:05:31 +0000 Subject: [PATCH 25/61] Add BuildRequires: make https://fedoraproject.org/wiki/Changes/Remove_make_from_BuildRoot --- libkcapi.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/libkcapi.spec b/libkcapi.spec index 7b6881b..aca6b41 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -135,6 +135,7 @@ BuildRequires: openssl BuildRequires: perl-interpreter BuildRequires: systemd BuildRequires: xmlto +BuildRequires: make # For ownership of %%{_sysctldir}. Requires: systemd From 70628a02c9f047cfc7745e8cb48e0be298b88ca9 Mon Sep 17 00:00:00 2001 From: Robert Scheck Date: Wed, 13 Jan 2021 01:47:40 +0000 Subject: [PATCH 26/61] Minor spec file optimizations --- libkcapi.spec | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/libkcapi.spec b/libkcapi.spec index aca6b41..3d1b0ad 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -113,9 +113,9 @@ Release: 3%{?dist} Summary: User space interface to the Linux Kernel Crypto API License: BSD or GPLv2 -URL: http://www.chronox.de/%{name}.html -Source0: http://www.chronox.de/%{name}/%{name}-%{version}.tar.xz -Source1: http://www.chronox.de/%{name}/%{name}-%{version}.tar.xz.asc +URL: https://www.chronox.de/%{name}.html +Source0: https://www.chronox.de/%{name}/%{name}-%{version}.tar.xz +Source1: https://www.chronox.de/%{name}/%{name}-%{version}.tar.xz.asc Source2: sha512hmac-openssl.sh Source3: fipshmac-openssl.sh @@ -135,7 +135,7 @@ BuildRequires: openssl BuildRequires: perl-interpreter BuildRequires: systemd BuildRequires: xmlto -BuildRequires: make +BuildRequires: make # For ownership of %%{_sysctldir}. Requires: systemd From dbcdc9af40e8aaf8be7d5b2ac898d77f7d2e56a2 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Tue, 26 Jan 2021 17:21:13 +0000 Subject: [PATCH 27/61] - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- libkcapi.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libkcapi.spec b/libkcapi.spec index 3d1b0ad..4da1f39 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -109,7 +109,7 @@ done \ Name: libkcapi Version: %{vmajor}.%{vminor}.%{vpatch} -Release: 3%{?dist} +Release: 4%{?dist} Summary: User space interface to the Linux Kernel Crypto API License: BSD or GPLv2 @@ -467,6 +467,9 @@ popd %changelog +* Tue Jan 26 2021 Fedora Release Engineering - 1.2.0-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + * Fri Aug 14 2020 Ondrej Mosnáček - 1.2.0-3 - Require perl-interpreter instead of full perl - Backport fix for 5.9 kernels From f0029bf72c8739f65c191a96d8c540c73461db1c Mon Sep 17 00:00:00 2001 From: Sahana Prasad Date: Mon, 22 Feb 2021 11:14:57 +0100 Subject: [PATCH 28/61] Update to upstream version 1.2.1 Remove cppcheck dependency for rhel bz#1931518 and Fedora (temporarily) #bz1923600 Signed-off-by: Sahana Prasad --- 000-Kern-5.8-fix-MSG_MORE-usage.patch | 163 -------------------------- libkcapi.spec | 32 +++-- sources | 4 +- 3 files changed, 26 insertions(+), 173 deletions(-) delete mode 100644 000-Kern-5.8-fix-MSG_MORE-usage.patch diff --git a/000-Kern-5.8-fix-MSG_MORE-usage.patch b/000-Kern-5.8-fix-MSG_MORE-usage.patch deleted file mode 100644 index 5841ef6..0000000 --- a/000-Kern-5.8-fix-MSG_MORE-usage.patch +++ /dev/null @@ -1,163 +0,0 @@ -From b612c52c5ccf021d01e6c786db1a31a697f21d97 Mon Sep 17 00:00:00 2001 -From: Stephan Mueller -Date: Thu, 13 Aug 2020 21:58:07 +0200 -Subject: [PATCH] Kern 5.8: fix MSG_MORE usage - -With kernel 5.8, a precise use of MSG_MORE is mandatory to support -a stream cipher approach (init -> update -> update -> ... -> final). -All but the last update operations must use MSG_MORE, the last update -operation must not use MSG_MORE. - -Reported-by: Ondrej Mosnacek -Signed-off-by: Stephan Mueller ---- - lib/kcapi-aead.c | 24 ++++++++++++++---------- - lib/kcapi-kernel-if.c | 6 ++---- - test/kcapi-main.c | 31 +++++++++++++++++-------------- - 3 files changed, 33 insertions(+), 28 deletions(-) - -diff --git a/lib/kcapi-aead.c b/lib/kcapi-aead.c -index d241618..45a0bd7 100644 ---- a/lib/kcapi-aead.c -+++ b/lib/kcapi-aead.c -@@ -210,13 +210,15 @@ _kcapi_aead_encrypt_aio_fallback(struct kcapi_handle *handle, - uint32_t iovlen, const uint8_t *iv) - { - uint32_t i; -- int32_t ret = kcapi_aead_stream_init_enc(handle, iv, NULL, 0); -- -- if (ret < 0) -- return ret; -+ int32_t ret = 0; - - for (i = 0; i < iovlen; i++) { -- int rc = kcapi_aead_stream_update_last(handle, iniov, 1); -+ int rc = kcapi_aead_stream_init_enc(handle, iv, NULL, 0); -+ -+ if (rc < 0) -+ return rc; -+ -+ rc = kcapi_aead_stream_update_last(handle, iniov, 1); - if (rc < 0) - return rc; - -@@ -271,13 +273,15 @@ _kcapi_aead_decrypt_aio_fallback(struct kcapi_handle *handle, - uint32_t iovlen, const uint8_t *iv) - { - uint32_t i; -- int32_t ret = kcapi_aead_stream_init_dec(handle, iv, NULL, 0); -- -- if (ret < 0) -- return ret; -+ int32_t ret = 0; - - for (i = 0; i < iovlen; i++) { -- int rc = kcapi_aead_stream_update_last(handle, iniov, 1); -+ int rc = kcapi_aead_stream_init_dec(handle, iv, NULL, 0); -+ -+ if (rc < 0) -+ return rc; -+ -+ rc = kcapi_aead_stream_update_last(handle, iniov, 1); - if (rc < 0) - return rc; - -diff --git a/lib/kcapi-kernel-if.c b/lib/kcapi-kernel-if.c -index bea994f..42cf1ad 100644 ---- a/lib/kcapi-kernel-if.c -+++ b/lib/kcapi-kernel-if.c -@@ -439,8 +439,7 @@ int _kcapi_aio_send_iov(struct kcapi_handle *handle, struct iovec *iov, - if (0 > ret) - return ret; - } else { -- ret = _kcapi_common_send_meta(handle, NULL, 0, enc, -- len ? MSG_MORE : 0); -+ ret = _kcapi_common_send_meta(handle, NULL, 0, enc, MSG_MORE); - if (0 > ret) - return ret; - ret = _kcapi_common_vmsplice_iov(handle, iov, iovlen, 0); -@@ -1246,8 +1245,7 @@ int32_t _kcapi_cipher_crypt(struct kcapi_handle *handle, const uint8_t *in, - if (0 > ret) - return ret; - } else { -- ret = _kcapi_common_send_meta(handle, NULL, 0, enc, -- inlen ? MSG_MORE : 0); -+ ret = _kcapi_common_send_meta(handle, NULL, 0, enc, MSG_MORE); - if (0 > ret) - return ret; - ret = _kcapi_common_vmsplice_chunk(handle, in, inlen, 0); -diff --git a/test/kcapi-main.c b/test/kcapi-main.c -index 51f6ec7..64e466c 100644 ---- a/test/kcapi-main.c -+++ b/test/kcapi-main.c -@@ -846,7 +846,7 @@ static int cavs_sym(struct kcapi_cavs *cavs_test, uint32_t loops, - goto out; - } - -- for(i = 0; i < loops; i++) { -+ for (i = 0; i < loops; i++) { - _get_time(&begin); - if (cavs_test->enc) { - ret = kcapi_cipher_encrypt(handle, -@@ -886,7 +886,7 @@ static int cavs_sym(struct kcapi_cavs *cavs_test, uint32_t loops, - } - - static void mt_sym_writer(struct kcapi_handle *handle, struct iovec *iov, -- int forking) -+ int forking, int last) - { - int ret; - -@@ -899,7 +899,10 @@ static void mt_sym_writer(struct kcapi_handle *handle, struct iovec *iov, - return; - } - -- ret = kcapi_cipher_stream_update_last(handle, iov, 1); -+ if (last) -+ ret = kcapi_cipher_stream_update_last(handle, iov, 1); -+ else -+ ret = kcapi_cipher_stream_update(handle, iov, 1); - if (0 > ret) - printf("Sending of data failed\n"); - -@@ -1004,7 +1007,7 @@ static int cavs_sym_stream(struct kcapi_cavs *cavs_test, uint32_t loops, - iov.iov_len = cavs_test->ctlen; - } - -- mt_sym_writer(handle_ptr, &iov, forking); -+ mt_sym_writer(handle_ptr, &iov, forking, i == (loops * 2 - 1)); - - outiov.iov_base = outbuf_ptr; - outiov.iov_len = outbuflen; -@@ -1636,21 +1639,21 @@ static int cavs_aead_stream(struct kcapi_cavs *cavs_test, uint32_t loops, - if (ret) - goto out; - -- if (cavs_test->enc) -- ret = kcapi_aead_stream_init_enc(handle, newiv, NULL, 0); -- -- else -- ret = kcapi_aead_stream_init_dec(handle, newiv, NULL, 0); -- if (0 > ret) { -- printf("Initialization of cipher buffer failed\n"); -- goto out; -- } -- - for (i = 0; i < loops; i++) { - int errsv = 0; - - memset(outbuf, 0, outbuflen); - -+ if (cavs_test->enc) -+ ret = kcapi_aead_stream_init_enc(handle, newiv, NULL, 0); -+ else -+ ret = kcapi_aead_stream_init_dec(handle, newiv, NULL, 0); -+ if (0 > ret) { -+ printf("Initialization of cipher buffer failed\n"); -+ goto out; -+ } -+ -+ - iov.iov_base = cavs_test->assoc; - iov.iov_len = cavs_test->assoclen; - if (cavs_test->enc) { diff --git a/libkcapi.spec b/libkcapi.spec index 4da1f39..df56972 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -1,7 +1,7 @@ # Shared object version of libkcapi. %global vmajor 1 %global vminor 2 -%global vpatch 0 +%global vpatch 1 # Do we build the replacements packages? %bcond_with replace_coreutils @@ -106,10 +106,16 @@ done \ "$lib_path"/fipscheck/libkcapi.so.%{vmajor}.hmac \ %{nil} +# disable cppcheck analysis in ELN/RHEL to avoid the dependency bz#1931518 +%if 0%{?rhel} +%bcond_with cppcheck +%else +%bcond_without cppcheck +%endif Name: libkcapi Version: %{vmajor}.%{vminor}.%{vpatch} -Release: 4%{?dist} +Release: 1%{?dist} Summary: User space interface to the Linux Kernel Crypto API License: BSD or GPLv2 @@ -119,12 +125,9 @@ Source1: https://www.chronox.de/%{name}/%{name}-%{version}.tar.xz.asc Source2: sha512hmac-openssl.sh Source3: fipshmac-openssl.sh -Patch0: %{giturl}/commit/b612c52c5ccf.patch#/000-Kern-5.8-fix-MSG_MORE-usage.patch - BuildRequires: bash BuildRequires: clang BuildRequires: coreutils -BuildRequires: cppcheck BuildRequires: docbook-utils-pdf BuildRequires: gcc BuildRequires: git-core @@ -136,6 +139,11 @@ BuildRequires: perl-interpreter BuildRequires: systemd BuildRequires: xmlto BuildRequires: make +#Temoporarily disabling cppcheck on Fedora untill #bz1923600 +#is fixed in rawhide +#%if %{with cppcheck} +#BuildRequires: cppcheck +#%endif # For ownership of %%{_sysctldir}. Requires: systemd @@ -378,9 +386,12 @@ done %check # Some basic sanity checks. -for t in cppcheck scan; do - %make_build $t -done +%make_build scan +#Temoporarily disabling cppcheck on Fedora untill #bz1923600 +#is fixed in rawhide +#%if %{with cppcheck} +#%make_build cppcheck +#%endif # On some arches `/proc/sys/net/core/optmem_max` is lower than 20480, # which is the lowest limit needed to run the testsuite. If that limit @@ -467,6 +478,11 @@ popd %changelog +* Mon Mar 15 2021 Sahana Prasad - 1.2.1-1 +- Update to upstream version 1.2.1 +- Remove patch fix MSG_MORE uasge as it is added upstream +- Remove cppcheck dependency for rhel bz#1931518 + * Tue Jan 26 2021 Fedora Release Engineering - 1.2.0-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild diff --git a/sources b/sources index a634ca6..8e514ec 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (libkcapi-1.2.0.tar.xz) = f097aac4fb06d0e0a7f62376506caa2d4cdb03572be89286ff335684f9a10285ffea4b3cfb37fd49e51435aa6636256aa12f0cf970fd48b1358aace8ac14b289 -SHA512 (libkcapi-1.2.0.tar.xz.asc) = 336769b04c75ee23d4cae98697a6ea14e5bd244bcefaa2396d80dab95538620c9353100685bd0568f61b8dfa3089c6ff7e4fdcdde949012ba0d7fe6aac650577 +SHA512 (libkcapi-1.2.1.tar.xz) = bfe5e4fa4368973cfcadbde3b2a278e31bc5c36a6afba9fc92fdd5903e4e8050d09000a195c764c981753896ef543635add98bbb930dbe52a56d2f6318bc1241 +SHA512 (libkcapi-1.2.1.tar.xz.asc) = f2823add4528e16c45ccb59e2124da29007b0285faed5194fe5969f4928411faa63b3b6586bd103085b666a4dfb977cfdf0d20db6588d426ab92e29e360a37e7 From eee399ccc3061cc801db84885e1cd04fed80aee4 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Wed, 24 Mar 2021 10:39:26 +0100 Subject: [PATCH 29/61] Clean up cppcheck conditional Move it up near the other conditional macro defs and utilize it for the temporary cppcheck disablement. Signed-off-by: Ondrej Mosnacek --- libkcapi.spec | 31 ++++++++++++++----------------- 1 file changed, 14 insertions(+), 17 deletions(-) diff --git a/libkcapi.spec b/libkcapi.spec index df56972..6cce4b3 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -22,6 +22,14 @@ %else %bcond_with test_package %endif +# disable cppcheck analysis in ELN/RHEL to avoid the dependency bz#1931518 +%if 0%{?rhel} +%bcond_with cppcheck +%else +# Temporarily disable cppcheck on Fedora until bz#1923600 is fixed in rawhide +%bcond_with cppcheck +#bcond_without cppcheck +%endif # This package needs at least Linux Kernel v4.10.0. %global min_kernel_ver 4.10.0 @@ -106,13 +114,6 @@ done \ "$lib_path"/fipscheck/libkcapi.so.%{vmajor}.hmac \ %{nil} -# disable cppcheck analysis in ELN/RHEL to avoid the dependency bz#1931518 -%if 0%{?rhel} -%bcond_with cppcheck -%else -%bcond_without cppcheck -%endif - Name: libkcapi Version: %{vmajor}.%{vminor}.%{vpatch} Release: 1%{?dist} @@ -139,11 +140,9 @@ BuildRequires: perl-interpreter BuildRequires: systemd BuildRequires: xmlto BuildRequires: make -#Temoporarily disabling cppcheck on Fedora untill #bz1923600 -#is fixed in rawhide -#%if %{with cppcheck} -#BuildRequires: cppcheck -#%endif +%if %{with cppcheck} +BuildRequires: cppcheck +%endif # For ownership of %%{_sysctldir}. Requires: systemd @@ -387,11 +386,9 @@ done %check # Some basic sanity checks. %make_build scan -#Temoporarily disabling cppcheck on Fedora untill #bz1923600 -#is fixed in rawhide -#%if %{with cppcheck} -#%make_build cppcheck -#%endif +%if %{with cppcheck} +%make_build cppcheck +%endif # On some arches `/proc/sys/net/core/optmem_max` is lower than 20480, # which is the lowest limit needed to run the testsuite. If that limit From f95b05caae7963ba28dc449204b980cc27282c0e Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Wed, 24 Mar 2021 11:13:36 +0100 Subject: [PATCH 30/61] Add a few more convenience conditionals Allow optionally building without `make test`, fuzz tests, `make scan`, or without the -doc subpackage. You can now e.g. quickly build locally without tests as follows: fedpkg mockbuild --without test Signed-off-by: Ondrej Mosnacek --- libkcapi.spec | 43 +++++++++++++++++++++++++++++++++++++++---- 1 file changed, 39 insertions(+), 4 deletions(-) diff --git a/libkcapi.spec b/libkcapi.spec index 6cce4b3..0b325a8 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -31,6 +31,15 @@ #bcond_without cppcheck %endif +# Use `--without test` to build without running the tests +%bcond_without test +# Use `--without fuzz_test` to skip the fuzz test during build +%bcond_without fuzz_test +# Use `--without doc` to build without the -doc subpackage +%bcond_without doc +# Use `--without clang_sa` to skip clang static analysis during build +%bcond_without clang_sa + # This package needs at least Linux Kernel v4.10.0. %global min_kernel_ver 4.10.0 @@ -127,19 +136,23 @@ Source2: sha512hmac-openssl.sh Source3: fipshmac-openssl.sh BuildRequires: bash -BuildRequires: clang BuildRequires: coreutils -BuildRequires: docbook-utils-pdf BuildRequires: gcc BuildRequires: git-core BuildRequires: hardlink BuildRequires: kernel-headers >= %{min_kernel_ver} BuildRequires: libtool +BuildRequires: make BuildRequires: openssl BuildRequires: perl-interpreter BuildRequires: systemd BuildRequires: xmlto -BuildRequires: make +%if %{with doc} +BuildRequires: docbook-utils-pdf +%endif +%if %{with clang_sa} +BuildRequires: clang +%endif %if %{with cppcheck} BuildRequires: cppcheck %endif @@ -172,6 +185,7 @@ Requires: %{name}%{?_isa} == %{version}-%{release} Header files for applications that use %{name}. +%if %{with doc} %package doc Summary: User documentation for the %{name} package BuildArch: noarch @@ -182,6 +196,7 @@ Requires: %{name} == %{version}-%{release} %description doc User documentation for %{name}. +%endif %if %{with replace_coreutils} @@ -327,7 +342,11 @@ EOF --enable-sum-prefix= \ --enable-sum-dir=/%{_lib} \ --with-pkgconfigdir=%{_libdir}/pkgconfig +%if %{with doc} %make_build all doc +%else +%make_build all man +%endif %install @@ -344,8 +363,14 @@ EOF %if %{with_sysctl_tweak} README.%{distroname_ext} \ %endif - README.md CHANGES.md TODO doc/%{name}.p{df,s} +%if %{with doc} + doc/%{name}.p{df,s} \ +%endif + README.md CHANGES.md TODO + +%if %{with doc} %{__cp} -pr lib/doc/html %{buildroot}%{_pkgdocdir} +%endif # Install replacement tools, if enabled. %if !%{with replace_coreutils} @@ -371,11 +396,13 @@ EOF # Remove 0-size files. %{_bindir}/find %{buildroot} -type f -size 0 -print -delete +%if %{with doc} # Make sure all docs have non-exec permissions, except for the dirs. %{_bindir}/find %{buildroot}%{_pkgdocdir} -type f -print | \ %{_bindir}/xargs %{__chmod} -c 0644 %{_bindir}/find %{buildroot}%{_pkgdocdir} -type d -print | \ %{_bindir}/xargs %{__chmod} -c 0755 +%endif # Possibly save some space by hardlinking. for d in %{_mandir} %{_pkgdocdir}; do @@ -385,11 +412,14 @@ done %check # Some basic sanity checks. +%if %{with clang_sa} %make_build scan +%endif %if %{with cppcheck} %make_build cppcheck %endif +%if %{with test} # On some arches `/proc/sys/net/core/optmem_max` is lower than 20480, # which is the lowest limit needed to run the testsuite. If that limit # is not met, we do not run it. @@ -398,12 +428,15 @@ done %if %{lua:print(rpm.vercmp(posix.uname('%r'), '5.1'));} >= 0 # Real testsuite. pushd test +%if %{with fuzz_test} ENABLE_FUZZ_TEST=1 \ +%endif NO_32BIT_TEST=1 \ ./test-invocation.sh popd %endif %endif +%endif %ldconfig_scriptlets @@ -432,10 +465,12 @@ popd %{_libdir}/pkgconfig/%{name}.pc +%if %{with doc} %files doc %doc %{_pkgdocdir}/html %doc %{_pkgdocdir}/%{name}.pdf %doc %{_pkgdocdir}/%{name}.ps +%endif %if %{with replace_coreutils} From 8d3f288df5a2a04ccdcf2109286b4fe8177dc52f Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Sat, 27 Mar 2021 14:26:36 +0100 Subject: [PATCH 31/61] Add a patch to fix fuzz tests Add a pending patch to fix fuzz tests hanging infinitely: https://github.com/smuellerDD/libkcapi/pull/110 Signed-off-by: Ondrej Mosnacek --- 001-fix-fuzz-test.patch | 37 +++++++++++++++++++++++++++++++++++++ libkcapi.spec | 3 +++ 2 files changed, 40 insertions(+) create mode 100644 001-fix-fuzz-test.patch diff --git a/001-fix-fuzz-test.patch b/001-fix-fuzz-test.patch new file mode 100644 index 0000000..c1fdbc5 --- /dev/null +++ b/001-fix-fuzz-test.patch @@ -0,0 +1,37 @@ +From e8c22fe01c6dd46399396694cd1d72a6988dc287 Mon Sep 17 00:00:00 2001 +From: Ondrej Mosnacek +Date: Sat, 27 Mar 2021 13:46:45 +0100 +Subject: [PATCH] kcapi: Fix hang in fuzz tests with recent kernels + +After kernel commit f3c802a1f300 ("crypto: algif_aead - Only wake up +when..."), the fuzz tests hang indefinitely, because they request more +output data than the operation can produce. Fix this by requesting at +most the expected size of the output data. + +Signed-off-by: Ondrej Mosnacek +--- + test/kcapi-main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/test/kcapi-main.c b/test/kcapi-main.c +index 64e466c..975e8d1 100644 +--- a/test/kcapi-main.c ++++ b/test/kcapi-main.c +@@ -380,7 +380,7 @@ static int fuzz_cipher(struct kcapi_cavs *cavs_test, unsigned long flags, + } + + for (i = 0; i < sizeof(indata); i++) { +- unsigned int outlen = sizeof(outdata); ++ unsigned int outlen = i; + uint8_t *out = outdata; + uint8_t *iv = indata; + uint8_t *in = indata; +@@ -474,7 +474,7 @@ static int fuzz_aead(struct kcapi_cavs *cavs_test, unsigned long flags, + } + + for (i = 0; i < sizeof(indata); i++) { +- unsigned int outlen = sizeof(outdata); ++ unsigned int outlen = i; + uint8_t *out = outdata; + uint8_t *iv = indata; + uint8_t *in = indata; diff --git a/libkcapi.spec b/libkcapi.spec index 0b325a8..6a0c2e5 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -135,6 +135,8 @@ Source1: https://www.chronox.de/%{name}/%{name}-%{version}.tar.xz.asc Source2: sha512hmac-openssl.sh Source3: fipshmac-openssl.sh +Patch001: %{giturl}/pull/110.patch#/001-fix-fuzz-test.patch + BuildRequires: bash BuildRequires: coreutils BuildRequires: gcc @@ -514,6 +516,7 @@ popd - Update to upstream version 1.2.1 - Remove patch fix MSG_MORE uasge as it is added upstream - Remove cppcheck dependency for rhel bz#1931518 +- Add a patch to fix fuzz tests * Tue Jan 26 2021 Fedora Release Engineering - 1.2.0-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild From 5db30d35f3a03860e8a9f2deda675b94ec6e2cb9 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Sat, 27 Mar 2021 15:57:45 +0100 Subject: [PATCH 32/61] Fix rpmlint error (usage of %{_sourcedir}) Fixes the following reported by rpmlint: libkcapi.src:97: E: use-of-RPM_SOURCE_DIR Fixed by using the appropriate %{SOURCE} macros as documented in: https://fedoraproject.org/wiki/Packaging:RPM_Source_Dir Signed-off-by: Ondrej Mosnacek --- libkcapi.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libkcapi.spec b/libkcapi.spec index 6a0c2e5..7058918 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -94,8 +94,8 @@ %global sha512hmac bin/kcapi-hasher -n sha512hmac %global fipshmac bin/kcapi-hasher -n fipshmac %else -%global sha512hmac bash %{_sourcedir}/sha512hmac-openssl.sh -%global fipshmac bash %{_sourcedir}/fipshmac-openssl.sh +%global sha512hmac bash %{SOURCE2} +%global fipshmac bash %{SOURCE3} %endif # Add generation of HMAC checksums of the final stripped From a5c9c9e34b11f7cab920ba2da6eb1967a28b72a9 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Mon, 12 Jul 2021 07:41:55 -0400 Subject: [PATCH 33/61] Update to upstream version 1.3.0 --- 001-fix-fuzz-test.patch | 37 ------------------------------------- libkcapi.spec | 9 +++++---- sources | 4 ++-- 3 files changed, 7 insertions(+), 43 deletions(-) delete mode 100644 001-fix-fuzz-test.patch diff --git a/001-fix-fuzz-test.patch b/001-fix-fuzz-test.patch deleted file mode 100644 index c1fdbc5..0000000 --- a/001-fix-fuzz-test.patch +++ /dev/null @@ -1,37 +0,0 @@ -From e8c22fe01c6dd46399396694cd1d72a6988dc287 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Sat, 27 Mar 2021 13:46:45 +0100 -Subject: [PATCH] kcapi: Fix hang in fuzz tests with recent kernels - -After kernel commit f3c802a1f300 ("crypto: algif_aead - Only wake up -when..."), the fuzz tests hang indefinitely, because they request more -output data than the operation can produce. Fix this by requesting at -most the expected size of the output data. - -Signed-off-by: Ondrej Mosnacek ---- - test/kcapi-main.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/test/kcapi-main.c b/test/kcapi-main.c -index 64e466c..975e8d1 100644 ---- a/test/kcapi-main.c -+++ b/test/kcapi-main.c -@@ -380,7 +380,7 @@ static int fuzz_cipher(struct kcapi_cavs *cavs_test, unsigned long flags, - } - - for (i = 0; i < sizeof(indata); i++) { -- unsigned int outlen = sizeof(outdata); -+ unsigned int outlen = i; - uint8_t *out = outdata; - uint8_t *iv = indata; - uint8_t *in = indata; -@@ -474,7 +474,7 @@ static int fuzz_aead(struct kcapi_cavs *cavs_test, unsigned long flags, - } - - for (i = 0; i < sizeof(indata); i++) { -- unsigned int outlen = sizeof(outdata); -+ unsigned int outlen = i; - uint8_t *out = outdata; - uint8_t *iv = indata; - uint8_t *in = indata; diff --git a/libkcapi.spec b/libkcapi.spec index 7058918..66e68a2 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -1,7 +1,7 @@ # Shared object version of libkcapi. %global vmajor 1 -%global vminor 2 -%global vpatch 1 +%global vminor 3 +%global vpatch 0 # Do we build the replacements packages? %bcond_with replace_coreutils @@ -135,8 +135,6 @@ Source1: https://www.chronox.de/%{name}/%{name}-%{version}.tar.xz.asc Source2: sha512hmac-openssl.sh Source3: fipshmac-openssl.sh -Patch001: %{giturl}/pull/110.patch#/001-fix-fuzz-test.patch - BuildRequires: bash BuildRequires: coreutils BuildRequires: gcc @@ -512,6 +510,9 @@ popd %changelog +* Mon Jul 12 2021 Simo Sorce - 1.3.0-1 +- Update to upstream version 1.3.0 + * Mon Mar 15 2021 Sahana Prasad - 1.2.1-1 - Update to upstream version 1.2.1 - Remove patch fix MSG_MORE uasge as it is added upstream diff --git a/sources b/sources index 8e514ec..613d2f6 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (libkcapi-1.2.1.tar.xz) = bfe5e4fa4368973cfcadbde3b2a278e31bc5c36a6afba9fc92fdd5903e4e8050d09000a195c764c981753896ef543635add98bbb930dbe52a56d2f6318bc1241 -SHA512 (libkcapi-1.2.1.tar.xz.asc) = f2823add4528e16c45ccb59e2124da29007b0285faed5194fe5969f4928411faa63b3b6586bd103085b666a4dfb977cfdf0d20db6588d426ab92e29e360a37e7 +SHA512 (libkcapi-1.3.0.tar.xz) = 3b6fbf9b6651dec870c9181709c8e7d7882d4967fe1c4d53a59cc428fcf83e2ec1f56f09406d8918f145beb417dffbfdf4719c2c61631d8008bb049970323ed0 +SHA512 (libkcapi-1.3.0.tar.xz.asc) = 9b89ea6743e43727bc9e003bb617970f4ab389b3d740a16105ca6eeff2a3485a56664aecf957c5e30fb54f5dfa44fc0cc015dd4e9b518b16db2fad55e8cba69c From 3461a3d164837d852130a2de0aa465b17bfcf780 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Mon, 12 Jul 2021 08:15:57 -0400 Subject: [PATCH 34/61] Fix build due to -Werror --- 001-libkcapi-1.3.0-werror.patch | 13 +++++++++++++ libkcapi.spec | 2 ++ 2 files changed, 15 insertions(+) create mode 100644 001-libkcapi-1.3.0-werror.patch diff --git a/001-libkcapi-1.3.0-werror.patch b/001-libkcapi-1.3.0-werror.patch new file mode 100644 index 0000000..e1fd9ba --- /dev/null +++ b/001-libkcapi-1.3.0-werror.patch @@ -0,0 +1,13 @@ +diff -uPr libkcapi-1.3.0/lib/doc/bin/docproc.c libkcapi-1.3.0.werror/lib/doc/bin/docproc.c +--- libkcapi-1.3.0/lib/doc/bin/docproc.c 2021-04-18 11:55:57.000000000 -0400 ++++ libkcapi-1.3.0.werror/lib/doc/bin/docproc.c 2021-07-12 08:13:21.812438118 -0400 +@@ -361,7 +361,8 @@ + { + char *vec[4]; /* kerneldoc -list file NULL */ + pid_t pid; +- ssize_t ret, i, count, start; ++ ssize_t ret, i, count; ++ unsigned int start; + char real_filename[PATH_MAX + 1]; + int pipefd[2]; + char *data, *str; diff --git a/libkcapi.spec b/libkcapi.spec index 66e68a2..58ea165 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -135,6 +135,8 @@ Source1: https://www.chronox.de/%{name}/%{name}-%{version}.tar.xz.asc Source2: sha512hmac-openssl.sh Source3: fipshmac-openssl.sh +Patch1: 001-libkcapi-1.3.0-werror.patch + BuildRequires: bash BuildRequires: coreutils BuildRequires: gcc From 75152a308a894d08c3ce73e045204237b5ed0078 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Mon, 12 Jul 2021 09:00:24 -0400 Subject: [PATCH 35/61] Additional upstream fixes for 32bit types Replace custom patch with upstream one. Add patch to fix issues with s390x --- 001-libkcapi-1.3.0-32bit-werror.patch | 83 +++++++++++++++++++++++++++ 001-libkcapi-1.3.0-werror.patch | 13 ----- 002-libkcapi-1.3.0-s390-types.patch | 47 +++++++++++++++ libkcapi.spec | 3 +- 4 files changed, 132 insertions(+), 14 deletions(-) create mode 100644 001-libkcapi-1.3.0-32bit-werror.patch delete mode 100644 001-libkcapi-1.3.0-werror.patch create mode 100644 002-libkcapi-1.3.0-s390-types.patch diff --git a/001-libkcapi-1.3.0-32bit-werror.patch b/001-libkcapi-1.3.0-32bit-werror.patch new file mode 100644 index 0000000..ef2b0b2 --- /dev/null +++ b/001-libkcapi-1.3.0-32bit-werror.patch @@ -0,0 +1,83 @@ +From 299e5e8c38de9be99b86885c1af60dd5e1cc9888 Mon Sep 17 00:00:00 2001 +From: Ondrej Mosnacek +Date: Mon, 17 May 2021 22:19:32 +0200 +Subject: [PATCH] docproc: fix -Wconversion warnings on 32-bit + +On i686, GCC 11.1.1 complains: +``` +lib/doc/bin/docproc.c: In function 'find_all_symbols': +lib/doc/bin/docproc.c:433:17: error: conversion to 'ssize_t' {aka 'int'} from 'unsigned int' may change the sign of the result [-Werror=sign-conversion] + 433 | start = all_list_len; + | ^~~~~~~~~~~~ +lib/doc/bin/docproc.c:441:48: error: comparison of integer expressions of different signedness: 'ssize_t' {aka 'int'} and 'unsigned int' [-Werror=sign-compare] + 441 | for (i = 0; i < (int)data_len && start != all_list_len; i++) { + | ^~ +cc1: all warnings being treated as errors +``` + +Fix this by declaring all of all_list_len, i, count, and start as +size_t and remove a few casts that are no longer necessary. + +Signed-off-by: Ondrej Mosnacek +Signed-off-by: Stephan Mueller +--- + lib/doc/bin/docproc.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/lib/doc/bin/docproc.c b/lib/doc/bin/docproc.c +index 556d5d4..74b3cdb 100644 +--- a/lib/doc/bin/docproc.c ++++ b/lib/doc/bin/docproc.c +@@ -77,11 +77,11 @@ FILELINE * docsection; + static char *srctree, *kernsrctree; + + static char **all_list = NULL; +-static unsigned int all_list_len = 0; ++static size_t all_list_len = 0; + + static void consume_symbol(const char *sym) + { +- unsigned int i; ++ size_t i; + + for (i = 0; i < all_list_len; i++) { + if (!all_list[i]) +@@ -361,11 +361,11 @@ static void find_all_symbols(char *filename) + { + char *vec[4]; /* kerneldoc -list file NULL */ + pid_t pid; +- ssize_t ret, i, count, start; ++ ssize_t ret; + char real_filename[PATH_MAX + 1]; + int pipefd[2]; + char *data, *str; +- size_t data_len = 0; ++ size_t i, count, start, data_len = 0; + + vec[0] = KERNELDOC; + vec[1] = LIST; +@@ -424,21 +424,21 @@ static void find_all_symbols(char *filename) + + count = 0; + /* poor man's strtok, but with counting */ +- for (i = 0; i < (int)data_len; i++) { ++ for (i = 0; i < data_len; i++) { + if (data[i] == '\n') { + count++; + data[i] = '\0'; + } + } + start = all_list_len; +- all_list_len += (unsigned int)count; ++ all_list_len += count; + all_list = realloc(all_list, sizeof(char *) * all_list_len); + if (!all_list) { + perror("realloc"); + exit(1); + } + str = data; +- for (i = 0; i < (int)data_len && start != all_list_len; i++) { ++ for (i = 0; i < data_len && start != all_list_len; i++) { + if (data[i] == '\0') { + all_list[start] = str; + str = data + i + 1; diff --git a/001-libkcapi-1.3.0-werror.patch b/001-libkcapi-1.3.0-werror.patch deleted file mode 100644 index e1fd9ba..0000000 --- a/001-libkcapi-1.3.0-werror.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff -uPr libkcapi-1.3.0/lib/doc/bin/docproc.c libkcapi-1.3.0.werror/lib/doc/bin/docproc.c ---- libkcapi-1.3.0/lib/doc/bin/docproc.c 2021-04-18 11:55:57.000000000 -0400 -+++ libkcapi-1.3.0.werror/lib/doc/bin/docproc.c 2021-07-12 08:13:21.812438118 -0400 -@@ -361,7 +361,8 @@ - { - char *vec[4]; /* kerneldoc -list file NULL */ - pid_t pid; -- ssize_t ret, i, count, start; -+ ssize_t ret, i, count; -+ unsigned int start; - char real_filename[PATH_MAX + 1]; - int pipefd[2]; - char *data, *str; diff --git a/002-libkcapi-1.3.0-s390-types.patch b/002-libkcapi-1.3.0-s390-types.patch new file mode 100644 index 0000000..552de91 --- /dev/null +++ b/002-libkcapi-1.3.0-s390-types.patch @@ -0,0 +1,47 @@ +From 00603fbe01de879eb1bd49a4475b0e619f4bb3b0 Mon Sep 17 00:00:00 2001 +From: Ondrej Mosnacek +Date: Tue, 18 May 2021 15:03:17 +0200 +Subject: [PATCH] Fix bad types in _kcapi_common_send_meta() + +The types for 'type' and 'assoclen' variables need to match the kernel +ABI, so they can't be changed to size_t. On most arches it is by chance +still working, but on s390x usign size_t here makes almost all tests +fail. Change the variables back to uint32_t pointers to fix this. + +Signed-off-by: Ondrej Mosnacek +Signed-off-by: Stephan Mueller +--- + lib/kcapi-kernel-if.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/lib/kcapi-kernel-if.c b/lib/kcapi-kernel-if.c +index a92e2f7..4968a8a 100644 +--- a/lib/kcapi-kernel-if.c ++++ b/lib/kcapi-kernel-if.c +@@ -125,7 +125,7 @@ ssize_t _kcapi_common_send_meta(struct kcapi_handle *handle, + + /* plaintext / ciphertext data */ + struct cmsghdr *header = NULL; +- size_t *type = NULL; ++ uint32_t *type = NULL; + struct msghdr msg; + + /* IV data */ +@@ -135,7 +135,7 @@ ssize_t _kcapi_common_send_meta(struct kcapi_handle *handle, + 0; + + /* AEAD data */ +- size_t *assoclen = NULL; ++ uint32_t *assoclen = NULL; + size_t assoc_msg_size = handle->aead.assoclen ? + CMSG_SPACE(sizeof(*assoclen)) : 0; + +@@ -205,7 +205,7 @@ ssize_t _kcapi_common_send_meta(struct kcapi_handle *handle, + header->cmsg_type = ALG_SET_AEAD_ASSOCLEN; + header->cmsg_len = CMSG_LEN(sizeof(*assoclen)); + assoclen = (void*)CMSG_DATA(header); +- *assoclen = handle->aead.assoclen; ++ *assoclen = (uint32_t)handle->aead.assoclen; + } + + ret = sendmsg(*_kcapi_get_opfd(handle), &msg, (int)flags); diff --git a/libkcapi.spec b/libkcapi.spec index 58ea165..fbbb683 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -135,7 +135,8 @@ Source1: https://www.chronox.de/%{name}/%{name}-%{version}.tar.xz.asc Source2: sha512hmac-openssl.sh Source3: fipshmac-openssl.sh -Patch1: 001-libkcapi-1.3.0-werror.patch +Patch1: 001-libkcapi-1.3.0-32bit-werror.patch +Patch2: 002-libkcapi-1.3.0-s390-types.patch BuildRequires: bash BuildRequires: coreutils From 381e5d6b9369a901c2fdc7c530667db80885a322 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Wed, 14 Jul 2021 05:39:26 -0400 Subject: [PATCH 36/61] Update to upstream version 1.3.1 which fixes ABI issues Signed-off-by: Simo Sorce --- 001-libkcapi-1.3.0-32bit-werror.patch | 83 --------------------------- 002-libkcapi-1.3.0-s390-types.patch | 47 --------------- libkcapi.spec | 8 +-- sources | 4 +- 4 files changed, 6 insertions(+), 136 deletions(-) delete mode 100644 001-libkcapi-1.3.0-32bit-werror.patch delete mode 100644 002-libkcapi-1.3.0-s390-types.patch diff --git a/001-libkcapi-1.3.0-32bit-werror.patch b/001-libkcapi-1.3.0-32bit-werror.patch deleted file mode 100644 index ef2b0b2..0000000 --- a/001-libkcapi-1.3.0-32bit-werror.patch +++ /dev/null @@ -1,83 +0,0 @@ -From 299e5e8c38de9be99b86885c1af60dd5e1cc9888 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Mon, 17 May 2021 22:19:32 +0200 -Subject: [PATCH] docproc: fix -Wconversion warnings on 32-bit - -On i686, GCC 11.1.1 complains: -``` -lib/doc/bin/docproc.c: In function 'find_all_symbols': -lib/doc/bin/docproc.c:433:17: error: conversion to 'ssize_t' {aka 'int'} from 'unsigned int' may change the sign of the result [-Werror=sign-conversion] - 433 | start = all_list_len; - | ^~~~~~~~~~~~ -lib/doc/bin/docproc.c:441:48: error: comparison of integer expressions of different signedness: 'ssize_t' {aka 'int'} and 'unsigned int' [-Werror=sign-compare] - 441 | for (i = 0; i < (int)data_len && start != all_list_len; i++) { - | ^~ -cc1: all warnings being treated as errors -``` - -Fix this by declaring all of all_list_len, i, count, and start as -size_t and remove a few casts that are no longer necessary. - -Signed-off-by: Ondrej Mosnacek -Signed-off-by: Stephan Mueller ---- - lib/doc/bin/docproc.c | 14 +++++++------- - 1 file changed, 7 insertions(+), 7 deletions(-) - -diff --git a/lib/doc/bin/docproc.c b/lib/doc/bin/docproc.c -index 556d5d4..74b3cdb 100644 ---- a/lib/doc/bin/docproc.c -+++ b/lib/doc/bin/docproc.c -@@ -77,11 +77,11 @@ FILELINE * docsection; - static char *srctree, *kernsrctree; - - static char **all_list = NULL; --static unsigned int all_list_len = 0; -+static size_t all_list_len = 0; - - static void consume_symbol(const char *sym) - { -- unsigned int i; -+ size_t i; - - for (i = 0; i < all_list_len; i++) { - if (!all_list[i]) -@@ -361,11 +361,11 @@ static void find_all_symbols(char *filename) - { - char *vec[4]; /* kerneldoc -list file NULL */ - pid_t pid; -- ssize_t ret, i, count, start; -+ ssize_t ret; - char real_filename[PATH_MAX + 1]; - int pipefd[2]; - char *data, *str; -- size_t data_len = 0; -+ size_t i, count, start, data_len = 0; - - vec[0] = KERNELDOC; - vec[1] = LIST; -@@ -424,21 +424,21 @@ static void find_all_symbols(char *filename) - - count = 0; - /* poor man's strtok, but with counting */ -- for (i = 0; i < (int)data_len; i++) { -+ for (i = 0; i < data_len; i++) { - if (data[i] == '\n') { - count++; - data[i] = '\0'; - } - } - start = all_list_len; -- all_list_len += (unsigned int)count; -+ all_list_len += count; - all_list = realloc(all_list, sizeof(char *) * all_list_len); - if (!all_list) { - perror("realloc"); - exit(1); - } - str = data; -- for (i = 0; i < (int)data_len && start != all_list_len; i++) { -+ for (i = 0; i < data_len && start != all_list_len; i++) { - if (data[i] == '\0') { - all_list[start] = str; - str = data + i + 1; diff --git a/002-libkcapi-1.3.0-s390-types.patch b/002-libkcapi-1.3.0-s390-types.patch deleted file mode 100644 index 552de91..0000000 --- a/002-libkcapi-1.3.0-s390-types.patch +++ /dev/null @@ -1,47 +0,0 @@ -From 00603fbe01de879eb1bd49a4475b0e619f4bb3b0 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Tue, 18 May 2021 15:03:17 +0200 -Subject: [PATCH] Fix bad types in _kcapi_common_send_meta() - -The types for 'type' and 'assoclen' variables need to match the kernel -ABI, so they can't be changed to size_t. On most arches it is by chance -still working, but on s390x usign size_t here makes almost all tests -fail. Change the variables back to uint32_t pointers to fix this. - -Signed-off-by: Ondrej Mosnacek -Signed-off-by: Stephan Mueller ---- - lib/kcapi-kernel-if.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/lib/kcapi-kernel-if.c b/lib/kcapi-kernel-if.c -index a92e2f7..4968a8a 100644 ---- a/lib/kcapi-kernel-if.c -+++ b/lib/kcapi-kernel-if.c -@@ -125,7 +125,7 @@ ssize_t _kcapi_common_send_meta(struct kcapi_handle *handle, - - /* plaintext / ciphertext data */ - struct cmsghdr *header = NULL; -- size_t *type = NULL; -+ uint32_t *type = NULL; - struct msghdr msg; - - /* IV data */ -@@ -135,7 +135,7 @@ ssize_t _kcapi_common_send_meta(struct kcapi_handle *handle, - 0; - - /* AEAD data */ -- size_t *assoclen = NULL; -+ uint32_t *assoclen = NULL; - size_t assoc_msg_size = handle->aead.assoclen ? - CMSG_SPACE(sizeof(*assoclen)) : 0; - -@@ -205,7 +205,7 @@ ssize_t _kcapi_common_send_meta(struct kcapi_handle *handle, - header->cmsg_type = ALG_SET_AEAD_ASSOCLEN; - header->cmsg_len = CMSG_LEN(sizeof(*assoclen)); - assoclen = (void*)CMSG_DATA(header); -- *assoclen = handle->aead.assoclen; -+ *assoclen = (uint32_t)handle->aead.assoclen; - } - - ret = sendmsg(*_kcapi_get_opfd(handle), &msg, (int)flags); diff --git a/libkcapi.spec b/libkcapi.spec index fbbb683..917a8f2 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -1,7 +1,7 @@ # Shared object version of libkcapi. %global vmajor 1 %global vminor 3 -%global vpatch 0 +%global vpatch 1 # Do we build the replacements packages? %bcond_with replace_coreutils @@ -135,9 +135,6 @@ Source1: https://www.chronox.de/%{name}/%{name}-%{version}.tar.xz.asc Source2: sha512hmac-openssl.sh Source3: fipshmac-openssl.sh -Patch1: 001-libkcapi-1.3.0-32bit-werror.patch -Patch2: 002-libkcapi-1.3.0-s390-types.patch - BuildRequires: bash BuildRequires: coreutils BuildRequires: gcc @@ -513,6 +510,9 @@ popd %changelog +* Wed Jul 14 2021 Simo Sorce - 1.3.1-1 +- Update to upstream version 1.3.1 which fixes ABI issues + * Mon Jul 12 2021 Simo Sorce - 1.3.0-1 - Update to upstream version 1.3.0 diff --git a/sources b/sources index 613d2f6..02e03e8 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (libkcapi-1.3.0.tar.xz) = 3b6fbf9b6651dec870c9181709c8e7d7882d4967fe1c4d53a59cc428fcf83e2ec1f56f09406d8918f145beb417dffbfdf4719c2c61631d8008bb049970323ed0 -SHA512 (libkcapi-1.3.0.tar.xz.asc) = 9b89ea6743e43727bc9e003bb617970f4ab389b3d740a16105ca6eeff2a3485a56664aecf957c5e30fb54f5dfa44fc0cc015dd4e9b518b16db2fad55e8cba69c +SHA512 (libkcapi-1.3.1.tar.xz) = 2240e5410e1df4b54f42182bf294ac13d82fd78d60466cafef7644bf7c9144c064ba1fd78d110d66bc41fd220ad2f211081eb64a0da5c8740716a3146d72ba30 +SHA512 (libkcapi-1.3.1.tar.xz.asc) = fb5f85401921e884e7eb7b989baed2c98371a90b61056c929bf8348e7864fc001b67d7e5bf5f799d61befbefa6ab60b296c1d781fc30069936edc3eb40134954 From dbc39a8ccf649e8d8e13227520154e940b7b9075 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Wed, 14 Jul 2021 06:05:26 -0400 Subject: [PATCH 37/61] Disable LTO for now, it breaks the build This is the error I get building locally if LTO is not disabled: Error: invalid attempt to declare external version name as default in symbol `kcapi_memset_secure@@LIBKCAPI_1.3.1' Signed-off-by: Simo Sorce --- libkcapi.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libkcapi.spec b/libkcapi.spec index 917a8f2..39f4b85 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -1,3 +1,5 @@ +%global _lto_cflags %nil + # Shared object version of libkcapi. %global vmajor 1 %global vminor 3 From 38549627e1b766f89a8e32e69d3bf4e9f77e8d18 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Wed, 14 Jul 2021 11:09:46 -0400 Subject: [PATCH 38/61] Remove LTO build suppression by using better symver machinery Signed-off-by: Simo Sorce --- 0001-Use-GCCs-__symver__-attribute.patch | 49 ++++++++++++++++++++++++ libkcapi.spec | 9 +++-- 2 files changed, 55 insertions(+), 3 deletions(-) create mode 100644 0001-Use-GCCs-__symver__-attribute.patch diff --git a/0001-Use-GCCs-__symver__-attribute.patch b/0001-Use-GCCs-__symver__-attribute.patch new file mode 100644 index 0000000..d900222 --- /dev/null +++ b/0001-Use-GCCs-__symver__-attribute.patch @@ -0,0 +1,49 @@ +From 2abf7fecb5162e4b59ba134c813ebee839eb45e9 Mon Sep 17 00:00:00 2001 +From: Simo Sorce +Date: Wed, 14 Jul 2021 10:52:01 -0400 +Subject: [PATCH] Use GCCs __symver__ attribute + +This is needed to allow LTO builds, as the __asm__ directives do not give +enough context to the compiler and the build fails when the -flto flag is +passed in. + +Unfotunately __symver__ is avilbel only startig from GCC 10, so we need +more macro juggling. + +Signed-off-by: Simo Sorce +--- + lib/internal.h | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/lib/internal.h b/lib/internal.h +index 29fdb7b..64dad24 100644 +--- a/lib/internal.h ++++ b/lib/internal.h +@@ -350,6 +350,16 @@ static inline int io_getevents(__attribute__((unused)) aio_context_t ctx, + #if __GNUC__ >= 4 + # define DSO_PUBLIC __attribute__ ((visibility ("default"))) + ++#if __GNUC__ >= 10 ++# define IMPL_SYMVER(name, version) \ ++ __attribute__ ((visibility ("default"))) \ ++ __attribute__((__symver__("kcapi_" #name "@@LIBKCAPI_" version))) ++ ++# define ORIG_SYMVER(name, version) \ ++ __attribute__ ((visibility ("default"))) \ ++ __attribute__((__symver__("kcapi_" #name "@LIBKCAPI_" version))) ++ ++#else + # define IMPL_SYMVER(name, version) \ + __asm__(".global impl_" #name ";"\ + ".symver impl_" #name ",kcapi_" #name "@@LIBKCAPI_" version);\ +@@ -359,6 +369,7 @@ static inline int io_getevents(__attribute__((unused)) aio_context_t ctx, + __asm__(".global orig_" #name ";"\ + ".symver orig_" #name ",kcapi_" #name "@LIBKCAPI_" version);\ + __attribute__ ((visibility ("default"))) ++#endif + + #else + # error "Compiler version too old" +-- +2.31.1 + diff --git a/libkcapi.spec b/libkcapi.spec index 39f4b85..ad1218f 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -1,5 +1,3 @@ -%global _lto_cflags %nil - # Shared object version of libkcapi. %global vmajor 1 %global vminor 3 @@ -127,7 +125,7 @@ done \ Name: libkcapi Version: %{vmajor}.%{vminor}.%{vpatch} -Release: 1%{?dist} +Release: 2%{?dist} Summary: User space interface to the Linux Kernel Crypto API License: BSD or GPLv2 @@ -137,6 +135,8 @@ Source1: https://www.chronox.de/%{name}/%{name}-%{version}.tar.xz.asc Source2: sha512hmac-openssl.sh Source3: fipshmac-openssl.sh +Patch1: 0001-Use-GCCs-__symver__-attribute.patch + BuildRequires: bash BuildRequires: coreutils BuildRequires: gcc @@ -512,6 +512,9 @@ popd %changelog +* Wed Jul 14 2021 Simo Sorce - 1.3.1-2 +- Remove LTO build suppression by using better symver machinery + * Wed Jul 14 2021 Simo Sorce - 1.3.1-1 - Update to upstream version 1.3.1 which fixes ABI issues From 7353c32d471e52bc14138e3f1c704b8c0486c361 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 22 Jul 2021 11:40:47 +0000 Subject: [PATCH 39/61] - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- libkcapi.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libkcapi.spec b/libkcapi.spec index ad1218f..42bca0a 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -125,7 +125,7 @@ done \ Name: libkcapi Version: %{vmajor}.%{vminor}.%{vpatch} -Release: 2%{?dist} +Release: 3%{?dist} Summary: User space interface to the Linux Kernel Crypto API License: BSD or GPLv2 @@ -512,6 +512,9 @@ popd %changelog +* Thu Jul 22 2021 Fedora Release Engineering - 1.3.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + * Wed Jul 14 2021 Simo Sorce - 1.3.1-2 - Remove LTO build suppression by using better symver machinery From ea5231da382c5bd33428520b69288ed8385752ec Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 20 Jan 2022 16:31:54 +0000 Subject: [PATCH 40/61] - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- libkcapi.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libkcapi.spec b/libkcapi.spec index 42bca0a..f16f147 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -125,7 +125,7 @@ done \ Name: libkcapi Version: %{vmajor}.%{vminor}.%{vpatch} -Release: 3%{?dist} +Release: 4%{?dist} Summary: User space interface to the Linux Kernel Crypto API License: BSD or GPLv2 @@ -512,6 +512,9 @@ popd %changelog +* Thu Jan 20 2022 Fedora Release Engineering - 1.3.1-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + * Thu Jul 22 2021 Fedora Release Engineering - 1.3.1-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild From 44c3299decd2346cbffc50c1f8c9fa60ce35a94e Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Wed, 21 Jul 2021 13:28:51 +0200 Subject: [PATCH 41/61] Re-enable cppcheck scanning on Fedora It has been updated to version 2.5 in Fedora, which no longer produces false positives on libkcapi code. Signed-off-by: Ondrej Mosnacek --- libkcapi.spec | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/libkcapi.spec b/libkcapi.spec index f16f147..e2ebb61 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -26,9 +26,7 @@ %if 0%{?rhel} %bcond_with cppcheck %else -# Temporarily disable cppcheck on Fedora until bz#1923600 is fixed in rawhide -%bcond_with cppcheck -#bcond_without cppcheck +%bcond_without cppcheck %endif # Use `--without test` to build without running the tests @@ -156,7 +154,7 @@ BuildRequires: docbook-utils-pdf BuildRequires: clang %endif %if %{with cppcheck} -BuildRequires: cppcheck +BuildRequires: cppcheck >= 2.4 %endif # For ownership of %%{_sysctldir}. From 9506ff89478841014d1a3eb54204466058d807d7 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 21 Jul 2022 18:10:03 +0000 Subject: [PATCH 42/61] Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- libkcapi.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libkcapi.spec b/libkcapi.spec index e2ebb61..a5952c4 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -123,7 +123,7 @@ done \ Name: libkcapi Version: %{vmajor}.%{vminor}.%{vpatch} -Release: 4%{?dist} +Release: 5%{?dist} Summary: User space interface to the Linux Kernel Crypto API License: BSD or GPLv2 @@ -510,6 +510,9 @@ popd %changelog +* Thu Jul 21 2022 Fedora Release Engineering - 1.3.1-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + * Thu Jan 20 2022 Fedora Release Engineering - 1.3.1-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild From e965b0fc5c1daf9646095e0ea0f6a1ffd135498a Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Thu, 24 Mar 2022 14:10:29 +0100 Subject: [PATCH 43/61] Update to upstream version 1.4.0 Signed-off-by: Ondrej Mosnacek --- 0001-Use-GCCs-__symver__-attribute.patch | 49 ------------------------ libkcapi.spec | 25 ++++++++---- sources | 4 +- 3 files changed, 19 insertions(+), 59 deletions(-) delete mode 100644 0001-Use-GCCs-__symver__-attribute.patch diff --git a/0001-Use-GCCs-__symver__-attribute.patch b/0001-Use-GCCs-__symver__-attribute.patch deleted file mode 100644 index d900222..0000000 --- a/0001-Use-GCCs-__symver__-attribute.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 2abf7fecb5162e4b59ba134c813ebee839eb45e9 Mon Sep 17 00:00:00 2001 -From: Simo Sorce -Date: Wed, 14 Jul 2021 10:52:01 -0400 -Subject: [PATCH] Use GCCs __symver__ attribute - -This is needed to allow LTO builds, as the __asm__ directives do not give -enough context to the compiler and the build fails when the -flto flag is -passed in. - -Unfotunately __symver__ is avilbel only startig from GCC 10, so we need -more macro juggling. - -Signed-off-by: Simo Sorce ---- - lib/internal.h | 11 +++++++++++ - 1 file changed, 11 insertions(+) - -diff --git a/lib/internal.h b/lib/internal.h -index 29fdb7b..64dad24 100644 ---- a/lib/internal.h -+++ b/lib/internal.h -@@ -350,6 +350,16 @@ static inline int io_getevents(__attribute__((unused)) aio_context_t ctx, - #if __GNUC__ >= 4 - # define DSO_PUBLIC __attribute__ ((visibility ("default"))) - -+#if __GNUC__ >= 10 -+# define IMPL_SYMVER(name, version) \ -+ __attribute__ ((visibility ("default"))) \ -+ __attribute__((__symver__("kcapi_" #name "@@LIBKCAPI_" version))) -+ -+# define ORIG_SYMVER(name, version) \ -+ __attribute__ ((visibility ("default"))) \ -+ __attribute__((__symver__("kcapi_" #name "@LIBKCAPI_" version))) -+ -+#else - # define IMPL_SYMVER(name, version) \ - __asm__(".global impl_" #name ";"\ - ".symver impl_" #name ",kcapi_" #name "@@LIBKCAPI_" version);\ -@@ -359,6 +369,7 @@ static inline int io_getevents(__attribute__((unused)) aio_context_t ctx, - __asm__(".global orig_" #name ";"\ - ".symver orig_" #name ",kcapi_" #name "@LIBKCAPI_" version);\ - __attribute__ ((visibility ("default"))) -+#endif - - #else - # error "Compiler version too old" --- -2.31.1 - diff --git a/libkcapi.spec b/libkcapi.spec index a5952c4..a88ee1e 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -1,7 +1,7 @@ # Shared object version of libkcapi. %global vmajor 1 -%global vminor 3 -%global vpatch 1 +%global vminor 4 +%global vpatch 0 # Do we build the replacements packages? %bcond_with replace_coreutils @@ -84,8 +84,8 @@ %global hmaccalc_evr 0.9.14-10%{?dist} %endif -%global apps_hmaccalc sha1hmac sha224hmac sha256hmac sha384hmac sha512hmac -%global apps_fipscheck sha1sum sha224sum sha256sum sha384sum sha512sum md5sum fipscheck fipshmac +%global apps_hmaccalc sha1hmac sha224hmac sha256hmac sha384hmac sha512hmac sm3hmac +%global apps_fipscheck sha1sum sha224sum sha256sum sha384sum sha512sum md5sum sm3sum fipscheck fipshmac # On old kernels use mock hashers implemented via openssl %if %{lua:print(rpm.vercmp(posix.uname('%r'), '3.19'));} >= 0 @@ -123,7 +123,7 @@ done \ Name: libkcapi Version: %{vmajor}.%{vminor}.%{vpatch} -Release: 5%{?dist} +Release: 1%{?dist} Summary: User space interface to the Linux Kernel Crypto API License: BSD or GPLv2 @@ -133,8 +133,6 @@ Source1: https://www.chronox.de/%{name}/%{name}-%{version}.tar.xz.asc Source2: sha512hmac-openssl.sh Source3: fipshmac-openssl.sh -Patch1: 0001-Use-GCCs-__symver__-attribute.patch - BuildRequires: bash BuildRequires: coreutils BuildRequires: gcc @@ -376,7 +374,8 @@ EOF %if !%{with replace_coreutils} %{__rm} -f \ %{buildroot}%{_bindir}/md5sum \ - %{buildroot}%{_bindir}/sha*sum + %{buildroot}%{_bindir}/sha*sum \ + %{buildroot}%{_bindir}/sm*sum %endif %if !%{with replace_fipscheck} @@ -385,6 +384,7 @@ EOF %if !%{with replace_hmaccalc} %{__rm} -f %{buildroot}%{_bindir}/sha*hmac +%{__rm} -f %{buildroot}%{_bindir}/sm*hmac %endif # We don't ship autocrap dumplings. @@ -477,8 +477,10 @@ popd %files checksum %{_bindir}/md5sum %{_bindir}/sha*sum +%{_bindir}/sm*sum /%{_lib}/fipscheck/md5sum.hmac /%{_lib}/fipscheck/sha*sum.hmac +/%{_lib}/fipscheck/sm*sum.hmac %endif %if %{with replace_fipscheck} @@ -490,7 +492,9 @@ popd %if %{with replace_hmaccalc} %files hmaccalc %{_bindir}/sha*hmac +%{_bindir}/sm*hmac /%{_lib}/hmaccalc/sha*hmac.hmac +/%{_lib}/hmaccalc/sm*hmac.hmac %endif @@ -510,6 +514,11 @@ popd %changelog +* Sat Aug 13 2022 Ondrej Mosnáček - 1.4.0-1 +- Update to upstream version 1.4.0 +- Re-enable cppcheck scanning on Fedora +- Resolves: rhbz#2056732 + * Thu Jul 21 2022 Fedora Release Engineering - 1.3.1-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild diff --git a/sources b/sources index 02e03e8..7e8a98f 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (libkcapi-1.3.1.tar.xz) = 2240e5410e1df4b54f42182bf294ac13d82fd78d60466cafef7644bf7c9144c064ba1fd78d110d66bc41fd220ad2f211081eb64a0da5c8740716a3146d72ba30 -SHA512 (libkcapi-1.3.1.tar.xz.asc) = fb5f85401921e884e7eb7b989baed2c98371a90b61056c929bf8348e7864fc001b67d7e5bf5f799d61befbefa6ab60b296c1d781fc30069936edc3eb40134954 +SHA512 (libkcapi-1.4.0.tar.xz) = fa3df1fe22eba32585de5df044f907d3ad189c33f5704fe29b0fdeda92e772ef077055b80e17bc1646a8cdedaf4f195aadf0b133f493597f0f7657b04ea93a99 +SHA512 (libkcapi-1.4.0.tar.xz.asc) = a41303cba88b214c82537bb5de2584a72a239670318753ba6873a2c3ebe3b56ffd381fdf7ae266aa21857e850bebdfbfdec487c98655ddbc2b9a0ba0d4f383ca From 3c0d9c58cc14e37761c372030b323d566bddce32 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Sat, 13 Aug 2022 23:34:12 +0200 Subject: [PATCH 44/61] Switch to rpmautospec --- changelog | 247 ++++++++++++++++++++++++++++++++++++++++++++++++++ libkcapi.spec | 247 +------------------------------------------------- 2 files changed, 249 insertions(+), 245 deletions(-) create mode 100644 changelog diff --git a/changelog b/changelog new file mode 100644 index 0000000..ce71afd --- /dev/null +++ b/changelog @@ -0,0 +1,247 @@ +* Sat Aug 13 2022 Ondrej Mosnáček - 1.4.0-2 +- Switch to rpmautospec + +* Sat Aug 13 2022 Ondrej Mosnáček - 1.4.0-1 +- Update to upstream version 1.4.0 +- Re-enable cppcheck scanning on Fedora +- Resolves: rhbz#2056732 + +* Thu Jul 21 2022 Fedora Release Engineering - 1.3.1-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Thu Jan 20 2022 Fedora Release Engineering - 1.3.1-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Thu Jul 22 2021 Fedora Release Engineering - 1.3.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Wed Jul 14 2021 Simo Sorce - 1.3.1-2 +- Remove LTO build suppression by using better symver machinery + +* Wed Jul 14 2021 Simo Sorce - 1.3.1-1 +- Update to upstream version 1.3.1 which fixes ABI issues + +* Mon Jul 12 2021 Simo Sorce - 1.3.0-1 +- Update to upstream version 1.3.0 + +* Mon Mar 15 2021 Sahana Prasad - 1.2.1-1 +- Update to upstream version 1.2.1 +- Remove patch fix MSG_MORE uasge as it is added upstream +- Remove cppcheck dependency for rhel bz#1931518 +- Add a patch to fix fuzz tests + +* Tue Jan 26 2021 Fedora Release Engineering - 1.2.0-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Fri Aug 14 2020 Ondrej Mosnáček - 1.2.0-3 +- Require perl-interpreter instead of full perl +- Backport fix for 5.9 kernels + +* Tue Jul 28 2020 Fedora Release Engineering - 1.2.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Mon May 25 2020 Sahana Prasad - 1.2.0-1 +- Update to upstream version 1.2.0 tracked by BZ 1839592. +- Enable kcapi-enc tests as libkcapi BZ 1826022 is fixed. +- Remove 110-fipshmac-compat.patch as the changes are merged upstream. +- Remove 100-workaround-cppcheck-bug.patch as the changes are merged upstream. + +* Tue May 05 2020 Ondrej Mosnáček - 1.1.5-5 +- Fix the CI test failures +- Enable building on old kernels +- Avoid conflicts between different versions of packages + +* Thu Apr 23 2020 Tomáš Mráz - 1.1.5-4 +- Add . prefix to files created by fipshmac if -d option is not specified + +* Wed Apr 22 2020 Sahana Prasad - 1.1.5-3 +- Disables kcapi-enc tests until the kernel bug bz 1826022 is fixed. +- Produce also the fipscheck replacement package + +* Wed Jan 29 2020 Fedora Release Engineering - 1.1.5-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Tue Aug 13 2019 Ondrej Mosnáček - 1.1.5-1 +- Update to upstream version 1.1.5 + +* Sat Jul 27 2019 Ondrej Mosnáček - 1.1.4-6 +- Backport patch to fix test failure on aarch64 +- Remove no longer needed ppc64 workaround + +* Sat Jul 27 2019 Ondrej Mosnáček - 1.1.4-5 +- Backport patch to fix tests + +* Thu Jul 25 2019 Ondrej Mosnáček - 1.1.4-4 +- Work around cppcheck issue +- Enable gating + +* Thu Jul 25 2019 Fedora Release Engineering - 1.1.4-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Mon May 27 2019 Ondrej Mosnáček - 1.1.4-2 +- Fix FTBFS: hardlink is now in bindir + +* Sat Feb 02 2019 Ondrej Mosnáček - 1.1.4-1 +- Update to upstream version 1.1.4 + +* Fri Feb 01 2019 Ondrej Mosnáček - 1.1.3-3 +- Fix build with new GCC + +* Fri Feb 01 2019 Fedora Release Engineering - 1.1.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Thu Aug 23 2018 Ondrej Mosnáček - 1.1.3-1 +- Update to upstream version 1.1.3 + +* Thu Aug 09 2018 Ondrej Mosnáček - 1.1.1-16 +- Add missing dependencies to the tests package +- Update patch from upstream + +* Thu Aug 09 2018 Ondrej Mosnáček - 1.1.1-15 +- Build and tests require perl + +* Thu Aug 09 2018 Ondrej Mosnáček - 1.1.1-14 +- Add missing script to the 'tests' package + +* Wed Aug 08 2018 Ondrej Mosnáček - 1.1.1-13 +- Add missing requires to the 'tests' subpackage + +* Tue Aug 07 2018 Ondrej Mosnáček - 1.1.1-12 +- Produce a subpackage with test scripts +- Build the 'tests' subpackage conditionally + +* Wed Aug 01 2018 Ondrej Mosnáček - 1.1.1-11 +- Add patch to fix unwanted closing of FD 0 + +* Tue Jul 31 2018 Ondrej Mosnáček - 1.1.1-10 +- Remove the kernel headers workaround + +* Fri Jul 27 2018 Igor Gnatenko - 1.1.1-9 +- Rebuild for new binutils + +* Fri Jul 27 2018 Ondrej Mosnáček - 1.1.1-8 +- Add more Coverity fixes from upstream +- Add patch to fix AEAD fuzz test for BE arches +- Fixup specfile + +* Mon Jul 23 2018 Ondrej Mosnáček - 1.1.1-7 +- Add various fixes from upstream +- Drop the Requires on kernel package + +* Mon Jul 16 2018 Ondrej Mosnáček - 1.1.1-6 +- Put .hmac files into a separate directory + +* Fri Jul 13 2018 Fedora Release Engineering - 1.1.1-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Thu Jul 12 2018 Ondrej Mosnáček - 1.1.1-4 +- Add patch to work around FTBFS on rawhide + +* Wed Jul 11 2018 Ondrej Mosnáček - 1.1.1-3 +- Fix off-by-one error in checkfile parsing + +* Wed Jul 11 2018 Ondrej Mosnáček - 1.1.1-2 +- Fix command-line parsing in libkcapi-hmaccalc + +* Mon Jun 18 2018 Ondrej Mosnáček - 1.1.1-1 +- Update to upstream version 1.1.1 + +* Wed May 09 2018 Ondrej Mosnáček - 1.1.0-5 +- Skip CLang static analysis in RHEL +- Revert "Skip CLang static analysis in RHEL" +- Use own sha512hmac and fipscheck + +* Wed May 02 2018 Ondrej Mosnáček - 1.1.0-4 +- Fix description lines being too long + +* Fri Apr 27 2018 Björn Esser - 1.1.0-3 +- Fix conditional for hmaccalc replacement + +* Mon Apr 16 2018 Ondrej Mosnáček - 1.1.0-2 +- Enable hmaccalc replacements in Fedora 28+ + +* Thu Apr 12 2018 Ondrej Mosnáček - 1.1.0-1 +- Update to upstream version 1.1.0 + +* Sat Mar 31 2018 Björn Esser - 1.0.3-10 +- Replace single patches with a monolitic one from upstream +- Obsolete replacements subpackage +- Ignore failing tests on %%{power64} temporarily + +* Thu Mar 08 2018 Ondrej Mosnáček - 1.0.3-9 +- Split up the replacements subpackage + +* Mon Feb 26 2018 Björn Esser - 1.0.3-8 +- Increase optmem_max preset to 81920 + +* Mon Feb 26 2018 Björn Esser - 1.0.3-7 +- Obsoletes work by package name, not by provides (rhbz#1537225) + +* Sun Feb 25 2018 Björn Esser - 1.0.3-6 +- Add patch to fix a copy-paste typo + +* Sat Feb 17 2018 Björn Esser - 1.0.3-5 +- Add patch to fix build with -Werror + +* Wed Feb 07 2018 Fedora Release Engineering +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + +* Sun Feb 04 2018 Björn Esser - 1.0.3-3 +- Switch to %%ldconfig_scriptlets + +* Wed Jan 17 2018 Björn Esser - 1.0.3-2 +- Decrease optmem_max preset to 40960 +- Let the build fail, if the minimum kernel version cannot be met +- Conditionalize the sysctl.d tweak on version of the kernel +- Conditionalize the name of README.distro on the distro + +* Tue Jan 16 2018 Björn Esser - 1.0.3-1 +- Initial import (rhbz#1533929) + +* Tue Jan 16 2018 Björn Esser - 1.0.3-0.13 +- Increase optmem_max preset to 81920 + +* Tue Jan 16 2018 Björn Esser - 1.0.3-0.12 +- Add sysctl.d preset and README.fedora + +* Mon Jan 15 2018 Björn Esser - 1.0.3-0.11 +- Make the contents of the -replacements package configurable + +* Mon Jan 15 2018 Björn Esser - 1.0.3-0.10 +- Fix Obsoletes of the -replacements package + +* Sun Jan 14 2018 Björn Esser - 1.0.3-0.9 +- Disable the -replacements package until we have a plan for it + +* Sun Jan 14 2018 Björn Esser - 1.0.3-0.8 +- Move the kcapi-hasher binary to -replacements package, since it is + not of much use without the linked invocation names and saves the + extra Requires on the -tools package + +* Sun Jan 14 2018 Björn Esser - 1.0.3-0.7 +- Fix internal Requires of sub-packages +- Hardlink files in %%{_bindir} + +* Sun Jan 14 2018 Björn Esser - 1.0.3-0.6 +- Add patches from upstream + +* Sat Jan 13 2018 Björn Esser - 1.0.3-0.5 +- Add patches from upstream + +* Sat Jan 13 2018 Björn Esser - 1.0.3-0.4 +- Asume the testsuite cannot be run, if the value of optmem_max cannot + be obtained + +* Sat Jan 13 2018 Björn Esser - 1.0.3-0.3 +- Move libraries to /%%{_lib} instead of %%{_libdir}, which is useful + during boot when the library might be needed before a potentially + seperate /usr partition is mounted + +* Sat Jan 13 2018 Björn Esser - 1.0.3-0.2 +- Asume optmem_max is at least 20480, if the real value cannot be obtained + +* Fri Jan 12 2018 Björn Esser - 1.0.3-0.1 +- New upstream release + +* Wed Jan 10 2018 Björn Esser - 1.0.2-0.1 +- Initial rpm release (rhbz#1533929) diff --git a/libkcapi.spec b/libkcapi.spec index a88ee1e..80f6921 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -123,7 +123,7 @@ done \ Name: libkcapi Version: %{vmajor}.%{vminor}.%{vpatch} -Release: 1%{?dist} +Release: %autorelease Summary: User space interface to the Linux Kernel Crypto API License: BSD or GPLv2 @@ -514,247 +514,4 @@ popd %changelog -* Sat Aug 13 2022 Ondrej Mosnáček - 1.4.0-1 -- Update to upstream version 1.4.0 -- Re-enable cppcheck scanning on Fedora -- Resolves: rhbz#2056732 - -* Thu Jul 21 2022 Fedora Release Engineering - 1.3.1-5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - -* Thu Jan 20 2022 Fedora Release Engineering - 1.3.1-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - -* Thu Jul 22 2021 Fedora Release Engineering - 1.3.1-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - -* Wed Jul 14 2021 Simo Sorce - 1.3.1-2 -- Remove LTO build suppression by using better symver machinery - -* Wed Jul 14 2021 Simo Sorce - 1.3.1-1 -- Update to upstream version 1.3.1 which fixes ABI issues - -* Mon Jul 12 2021 Simo Sorce - 1.3.0-1 -- Update to upstream version 1.3.0 - -* Mon Mar 15 2021 Sahana Prasad - 1.2.1-1 -- Update to upstream version 1.2.1 -- Remove patch fix MSG_MORE uasge as it is added upstream -- Remove cppcheck dependency for rhel bz#1931518 -- Add a patch to fix fuzz tests - -* Tue Jan 26 2021 Fedora Release Engineering - 1.2.0-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - -* Fri Aug 14 2020 Ondrej Mosnáček - 1.2.0-3 -- Require perl-interpreter instead of full perl -- Backport fix for 5.9 kernels - -* Tue Jul 28 2020 Fedora Release Engineering - 1.2.0-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - -* Mon May 25 2020 Sahana Prasad - 1.2.0-1 -- Update to upstream version 1.2.0 tracked by BZ 1839592. -- Enable kcapi-enc tests as libkcapi BZ 1826022 is fixed. -- Remove 110-fipshmac-compat.patch as the changes are merged upstream. -- Remove 100-workaround-cppcheck-bug.patch as the changes are merged upstream. - -* Tue May 05 2020 Ondrej Mosnáček - 1.1.5-5 -- Fix the CI test failures -- Enable building on old kernels -- Avoid conflicts between different versions of packages - -* Thu Apr 23 2020 Tomáš Mráz - 1.1.5-4 -- Add . prefix to files created by fipshmac if -d option is not specified - -* Wed Apr 22 2020 Sahana Prasad - 1.1.5-3 -- Disables kcapi-enc tests until the kernel bug bz 1826022 is fixed. -- Produce also the fipscheck replacement package - -* Wed Jan 29 2020 Fedora Release Engineering - 1.1.5-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - -* Tue Aug 13 2019 Ondrej Mosnáček - 1.1.5-1 -- Update to upstream version 1.1.5 - -* Sat Jul 27 2019 Ondrej Mosnáček - 1.1.4-6 -- Backport patch to fix test failure on aarch64 -- Remove no longer needed ppc64 workaround - -* Sat Jul 27 2019 Ondrej Mosnáček - 1.1.4-5 -- Backport patch to fix tests - -* Thu Jul 25 2019 Ondrej Mosnáček - 1.1.4-4 -- Work around cppcheck issue -- Enable gating - -* Thu Jul 25 2019 Fedora Release Engineering - 1.1.4-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - -* Mon May 27 2019 Ondrej Mosnáček - 1.1.4-2 -- Fix FTBFS: hardlink is now in bindir - -* Sat Feb 02 2019 Ondrej Mosnáček - 1.1.4-1 -- Update to upstream version 1.1.4 - -* Fri Feb 01 2019 Ondrej Mosnáček - 1.1.3-3 -- Fix build with new GCC - -* Fri Feb 01 2019 Fedora Release Engineering - 1.1.3-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild - -* Thu Aug 23 2018 Ondrej Mosnáček - 1.1.3-1 -- Update to upstream version 1.1.3 - -* Thu Aug 09 2018 Ondrej Mosnáček - 1.1.1-16 -- Add missing dependencies to the tests package -- Update patch from upstream - -* Thu Aug 09 2018 Ondrej Mosnáček - 1.1.1-15 -- Build and tests require perl - -* Thu Aug 09 2018 Ondrej Mosnáček - 1.1.1-14 -- Add missing script to the 'tests' package - -* Wed Aug 08 2018 Ondrej Mosnáček - 1.1.1-13 -- Add missing requires to the 'tests' subpackage - -* Tue Aug 07 2018 Ondrej Mosnáček - 1.1.1-12 -- Produce a subpackage with test scripts -- Build the 'tests' subpackage conditionally - -* Wed Aug 01 2018 Ondrej Mosnáček - 1.1.1-11 -- Add patch to fix unwanted closing of FD 0 - -* Tue Jul 31 2018 Ondrej Mosnáček - 1.1.1-10 -- Remove the kernel headers workaround - -* Fri Jul 27 2018 Igor Gnatenko - 1.1.1-9 -- Rebuild for new binutils - -* Fri Jul 27 2018 Ondrej Mosnáček - 1.1.1-8 -- Add more Coverity fixes from upstream -- Add patch to fix AEAD fuzz test for BE arches -- Fixup specfile - -* Mon Jul 23 2018 Ondrej Mosnáček - 1.1.1-7 -- Add various fixes from upstream -- Drop the Requires on kernel package - -* Mon Jul 16 2018 Ondrej Mosnáček - 1.1.1-6 -- Put .hmac files into a separate directory - -* Fri Jul 13 2018 Fedora Release Engineering - 1.1.1-5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild - -* Thu Jul 12 2018 Ondrej Mosnáček - 1.1.1-4 -- Add patch to work around FTBFS on rawhide - -* Wed Jul 11 2018 Ondrej Mosnáček - 1.1.1-3 -- Fix off-by-one error in checkfile parsing - -* Wed Jul 11 2018 Ondrej Mosnáček - 1.1.1-2 -- Fix command-line parsing in libkcapi-hmaccalc - -* Mon Jun 18 2018 Ondrej Mosnáček - 1.1.1-1 -- Update to upstream version 1.1.1 - -* Wed May 09 2018 Ondrej Mosnáček - 1.1.0-5 -- Skip CLang static analysis in RHEL -- Revert "Skip CLang static analysis in RHEL" -- Use own sha512hmac and fipscheck - -* Wed May 02 2018 Ondrej Mosnáček - 1.1.0-4 -- Fix description lines being too long - -* Fri Apr 27 2018 Björn Esser - 1.1.0-3 -- Fix conditional for hmaccalc replacement - -* Mon Apr 16 2018 Ondrej Mosnáček - 1.1.0-2 -- Enable hmaccalc replacements in Fedora 28+ - -* Thu Apr 12 2018 Ondrej Mosnáček - 1.1.0-1 -- Update to upstream version 1.1.0 - -* Sat Mar 31 2018 Björn Esser - 1.0.3-10 -- Replace single patches with a monolitic one from upstream -- Obsolete replacements subpackage -- Ignore failing tests on %%{power64} temporarily - -* Thu Mar 08 2018 Ondrej Mosnáček - 1.0.3-9 -- Split up the replacements subpackage - -* Mon Feb 26 2018 Björn Esser - 1.0.3-8 -- Increase optmem_max preset to 81920 - -* Mon Feb 26 2018 Björn Esser - 1.0.3-7 -- Obsoletes work by package name, not by provides (rhbz#1537225) - -* Sun Feb 25 2018 Björn Esser - 1.0.3-6 -- Add patch to fix a copy-paste typo - -* Sat Feb 17 2018 Björn Esser - 1.0.3-5 -- Add patch to fix build with -Werror - -* Wed Feb 07 2018 Fedora Release Engineering -- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild - -* Sun Feb 04 2018 Björn Esser - 1.0.3-3 -- Switch to %%ldconfig_scriptlets - -* Wed Jan 17 2018 Björn Esser - 1.0.3-2 -- Decrease optmem_max preset to 40960 -- Let the build fail, if the minimum kernel version cannot be met -- Conditionalize the sysctl.d tweak on version of the kernel -- Conditionalize the name of README.distro on the distro - -* Tue Jan 16 2018 Björn Esser - 1.0.3-1 -- Initial import (rhbz#1533929) - -* Tue Jan 16 2018 Björn Esser - 1.0.3-0.13 -- Increase optmem_max preset to 81920 - -* Tue Jan 16 2018 Björn Esser - 1.0.3-0.12 -- Add sysctl.d preset and README.fedora - -* Mon Jan 15 2018 Björn Esser - 1.0.3-0.11 -- Make the contents of the -replacements package configurable - -* Mon Jan 15 2018 Björn Esser - 1.0.3-0.10 -- Fix Obsoletes of the -replacements package - -* Sun Jan 14 2018 Björn Esser - 1.0.3-0.9 -- Disable the -replacements package until we have a plan for it - -* Sun Jan 14 2018 Björn Esser - 1.0.3-0.8 -- Move the kcapi-hasher binary to -replacements package, since it is - not of much use without the linked invocation names and saves the - extra Requires on the -tools package - -* Sun Jan 14 2018 Björn Esser - 1.0.3-0.7 -- Fix internal Requires of sub-packages -- Hardlink files in %%{_bindir} - -* Sun Jan 14 2018 Björn Esser - 1.0.3-0.6 -- Add patches from upstream - -* Sat Jan 13 2018 Björn Esser - 1.0.3-0.5 -- Add patches from upstream - -* Sat Jan 13 2018 Björn Esser - 1.0.3-0.4 -- Asume the testsuite cannot be run, if the value of optmem_max cannot - be obtained - -* Sat Jan 13 2018 Björn Esser - 1.0.3-0.3 -- Move libraries to /%%{_lib} instead of %%{_libdir}, which is useful - during boot when the library might be needed before a potentially - seperate /usr partition is mounted - -* Sat Jan 13 2018 Björn Esser - 1.0.3-0.2 -- Asume optmem_max is at least 20480, if the real value cannot be obtained - -* Fri Jan 12 2018 Björn Esser - 1.0.3-0.1 -- New upstream release - -* Wed Jan 10 2018 Björn Esser - 1.0.2-0.1 -- Initial rpm release (rhbz#1533929) +%autochangelog From c3c3d074ac535aaeb6b91e688519ea608ee429a4 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Thu, 25 Aug 2022 20:23:56 +0200 Subject: [PATCH 45/61] Add a patch to fix tests with kernels 6.0+ Signed-off-by: Ondrej Mosnacek --- 001-tests-kernel-version.patch | 40 ++++++++++++++++++++++++++++++++++ libkcapi.spec | 2 ++ 2 files changed, 42 insertions(+) create mode 100644 001-tests-kernel-version.patch diff --git a/001-tests-kernel-version.patch b/001-tests-kernel-version.patch new file mode 100644 index 0000000..aa21536 --- /dev/null +++ b/001-tests-kernel-version.patch @@ -0,0 +1,40 @@ +From c2af62dcc7a287f3c14f6aaec5724401c1ea470a Mon Sep 17 00:00:00 2001 +From: Ondrej Mosnacek +Date: Mon, 15 Aug 2022 10:19:50 +0200 +Subject: [PATCH] tests: fix overly-optimistic kernel version checks + +The mainline kernel is now at version 6.0 so these >= 5.99 checks are +now incorrectly enabling tests that don't work. Instead of bumping the +imaginary version and face the same problem again in a couple years, +replace the checks with 'false' and a TODO comment. + +Signed-off-by: Ondrej Mosnacek +Signed-off-by: Stephan Mueller +--- + test/test.sh | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/test/test.sh b/test/test.sh +index 1d9be73..a75b802 100755 +--- a/test/test.sh ++++ b/test/test.sh +@@ -1560,7 +1560,8 @@ else + echo_deact "AEAD tests of copied AAD deactivated" + fi + +-if $(check_min_kernelver 5 99); then ++# TODO add version check when supported upstream ++if false; then + asymfunc 4 + asymfunc 4 -s + asymfunc 4 -v +@@ -1583,7 +1584,8 @@ else + echo_deact "All asymmetric tests deactivated" + fi + +-if $(check_min_kernelver 5 99); then ++# TODO add version check when supported upstream ++if false; then + kppfunc 13 + kppfunc 13 X -m + kppfunc 13 -v diff --git a/libkcapi.spec b/libkcapi.spec index 80f6921..0a6779c 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -133,6 +133,8 @@ Source1: https://www.chronox.de/%{name}/%{name}-%{version}.tar.xz.asc Source2: sha512hmac-openssl.sh Source3: fipshmac-openssl.sh +Patch: %{giturl}/commit/c2af62dcc7a2.patch#/001-tests-kernel-version.patch + BuildRequires: bash BuildRequires: coreutils BuildRequires: gcc From 205a7d5c3f96d697c50a15531ea455330b1546a4 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Sun, 14 Aug 2022 13:26:18 +0200 Subject: [PATCH 46/61] Convert tests to TMT Ditch the legacy STR format in favor of TMT/FMF. Signed-off-by: Ondrej Mosnacek --- .fmf/version | 1 + plans/ci.fmf | 5 ++ tests/fipscheck-smoke-test/Makefile | 71 --------------------------- tests/fipscheck-smoke-test/PURPOSE | 3 -- tests/fipscheck-smoke-test/main.fmf | 17 +++++++ tests/fipscheck-smoke-test/runtest.sh | 3 +- tests/main.fmf | 29 +++++++++++ tests/tests.yml | 45 ----------------- 8 files changed, 53 insertions(+), 121 deletions(-) create mode 100644 .fmf/version create mode 100644 plans/ci.fmf delete mode 100644 tests/fipscheck-smoke-test/Makefile delete mode 100644 tests/fipscheck-smoke-test/PURPOSE create mode 100644 tests/fipscheck-smoke-test/main.fmf create mode 100644 tests/main.fmf delete mode 100644 tests/tests.yml diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/plans/ci.fmf b/plans/ci.fmf new file mode 100644 index 0000000..d3cd36f --- /dev/null +++ b/plans/ci.fmf @@ -0,0 +1,5 @@ +summary: Run CI tests +discover: + how: fmf +execute: + how: tmt diff --git a/tests/fipscheck-smoke-test/Makefile b/tests/fipscheck-smoke-test/Makefile deleted file mode 100644 index 0e0dda3..0000000 --- a/tests/fipscheck-smoke-test/Makefile +++ /dev/null @@ -1,71 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/libgcrypt/smoke-test -# Description: Test calls upstream test suite. -# Author: Ondrej Moris -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2010 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/libgcrypt/smoke-test -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Ondrej Moris " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: Test calls upstream test suite." >> $(METADATA) - @echo "Type: Sanity" >> $(METADATA) - @echo "TestTime: 15m" >> $(METADATA) - @echo "RunFor: libgcrypt" >> $(METADATA) - @echo "Requires: libgcrypt" >> $(METADATA) - @echo "Requires: nfs-utils" >> $(METADATA) - @echo "Requires: rpm-build" >> $(METADATA) - @echo "Requires: gawk" >> $(METADATA) - @echo "Requires: gcc-c++ fipscheck" >> $(METADATA) - @echo "Requires: libgpg-error-devel wget" >> $(METADATA) - @echo "Requires: pkgconfig texinfo libselinux-utils" >> $(METADATA) - @echo "Releases: -RHEL3 -RHEL4" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "Architectures: i386 x86_64 s390x ia64" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - - rhts-lint $(METADATA) diff --git a/tests/fipscheck-smoke-test/PURPOSE b/tests/fipscheck-smoke-test/PURPOSE deleted file mode 100644 index 5df6ca9..0000000 --- a/tests/fipscheck-smoke-test/PURPOSE +++ /dev/null @@ -1,3 +0,0 @@ -PURPOSE of /CoreOS/libgcrypt/Sanity/smoke-test -Description: Test calls upstream test suite. -Author: Ondrej Moris diff --git a/tests/fipscheck-smoke-test/main.fmf b/tests/fipscheck-smoke-test/main.fmf new file mode 100644 index 0000000..a81cae2 --- /dev/null +++ b/tests/fipscheck-smoke-test/main.fmf @@ -0,0 +1,17 @@ +summary: Fipscheck smoke test +framework: beakerlib +test: ./runtest.sh +require: +- fipscheck +- gawk +- gcc-c++ +- libgcrypt +- libgpg-error-devel +- libselinux-utils +- libtool +- nfs-utils +- pkgconfig +- rpm-build +- texinfo +- wget +tier: 2 diff --git a/tests/fipscheck-smoke-test/runtest.sh b/tests/fipscheck-smoke-test/runtest.sh index dd1803d..6f9bbab 100755 --- a/tests/fipscheck-smoke-test/runtest.sh +++ b/tests/fipscheck-smoke-test/runtest.sh @@ -26,8 +26,7 @@ # # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# Include rhts environment -#. /usr/bin/rhts-environment.sh +# Include beakerlib environment . /usr/share/beakerlib/beakerlib.sh PACKAGE="libgcrypt" diff --git a/tests/main.fmf b/tests/main.fmf new file mode 100644 index 0000000..4b6064e --- /dev/null +++ b/tests/main.fmf @@ -0,0 +1,29 @@ +component: libkcapi +contact: Ondrej Mosnacek + +/upstream: + require: [libkcapi-tests] + tier: 1 + + /basic: + summary: Basic functionality + test: /usr/libexec/libkcapi/test.sh + /encrypt: + summary: Encryption/decryption + test: /usr/libexec/libkcapi/kcapi-enc-test.sh + /encrypt-large: + summary: Encryption/decryption of large data + test: /usr/libexec/libkcapi/kcapi-enc-test-large.sh + /digest: + summary: Message digest + test: /usr/libexec/libkcapi/kcapi-dgst-test.sh + /digest-convenience: + summary: Message digest convenience functions + test: /usr/libexec/libkcapi/kcapi-convenience.sh + /hasher: + summary: Checksum helpers + test: /usr/libexec/libkcapi/hasher-test.sh + /fuzz-test: + summary: Fuzz test + test: /usr/libexec/libkcapi/kcapi-fuzz-test.sh + duration: 2h diff --git a/tests/tests.yml b/tests/tests.yml deleted file mode 100644 index 1a0db89..0000000 --- a/tests/tests.yml +++ /dev/null @@ -1,45 +0,0 @@ -- hosts: localhost - tags: - - classic - - container - roles: - - role: standard-test-basic - required_packages: - - libkcapi-tests - tests: - - upstream-basic-test: - run: /usr/libexec/libkcapi/test.sh - - upstream-enc-test: - run: /usr/libexec/libkcapi/kcapi-enc-test.sh - - upstream-enc-test-large: - run: /usr/libexec/libkcapi/kcapi-enc-test-large.sh - - upstream-dgst-test: - run: /usr/libexec/libkcapi/kcapi-dgst-test.sh - - upstream-hasher-test: - run: /usr/libexec/libkcapi/hasher-test.sh - - upstream-convenience-test: - run: /usr/libexec/libkcapi/kcapi-convenience.sh - - upstream-fuzz-test: - run: /usr/libexec/libkcapi/kcapi-fuzz-test.sh - -- hosts: localhost - tags: - - classic - - container - roles: - - role: standard-test-beakerlib - required_packages: - - fipscheck - - gawk - - gcc-c++ - - libgcrypt - - libgpg-error-devel - - libselinux-utils - - libtool - - nfs-utils - - pkgconfig - - rpm-build - - texinfo - - wget - tests: - - fipscheck-smoke-test From 04ba39d474f52879b2d135f5ca15be93b3b05115 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 19 Jan 2023 16:40:28 +0000 Subject: [PATCH 47/61] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering From e0f0f65d7851cfeaedacb21a0e1dcd7374a72ad1 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 20 Jul 2023 11:15:09 +0000 Subject: [PATCH 48/61] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering From 358a5759e843499bd47d5bb5954e7b705598235c Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Fri, 28 Jul 2023 15:09:48 -0400 Subject: [PATCH 49/61] Fix build with cppcheck-2.11 String literal concatenation raises syntaxError with cppcheck-2.11, which is a regression: https://trac.cppcheck.net/ticket/11830 --- libkcapi.spec | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libkcapi.spec b/libkcapi.spec index 0a6779c..4d0e210 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -418,7 +418,9 @@ done %make_build scan %endif %if %{with cppcheck} -%make_build cppcheck +# string literal concatenation raises syntaxError with cppcheck-2.11 +# https://trac.cppcheck.net/ticket/11830 +%make_build cppcheck CPPCHECK="cppcheck -UCHECK_DIR" %endif %if %{with test} From 8ccb7646224af41e382bcef72b769a7cff048217 Mon Sep 17 00:00:00 2001 From: Zoltan Fridrich Date: Wed, 30 Aug 2023 16:51:19 +0200 Subject: [PATCH 50/61] Migrate to SPDX license Signed-off-by: Zoltan Fridrich --- libkcapi.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libkcapi.spec b/libkcapi.spec index 4d0e210..700f0c3 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -126,7 +126,7 @@ Version: %{vmajor}.%{vminor}.%{vpatch} Release: %autorelease Summary: User space interface to the Linux Kernel Crypto API -License: BSD or GPLv2 +License: BSD-3-Clause OR GPL-2.0-only URL: https://www.chronox.de/%{name}.html Source0: https://www.chronox.de/%{name}/%{name}-%{version}.tar.xz Source1: https://www.chronox.de/%{name}/%{name}-%{version}.tar.xz.asc From e12f61b6c3e5cb6371d7ccfd0cbb5d974e0edf18 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sun, 21 Jan 2024 04:26:50 +0000 Subject: [PATCH 51/61] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From b5d3571bcb3dd931d515a64fbc5fef328037e4fe Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 25 Jan 2024 02:37:46 +0000 Subject: [PATCH 52/61] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From 57a3a10c995979321286a620faf9784cb3a71a1e Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 18 Jul 2024 14:13:54 +0000 Subject: [PATCH 53/61] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild From f96f2e26b1133829e79b84582069fa879c7d1209 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ondrej=20Mosn=C3=A1=C4=8Dek?= Date: Wed, 31 Jul 2024 14:40:09 +0200 Subject: [PATCH 54/61] Fix upstream URLs (fedora#2291348) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Ondrej Mosnáček --- libkcapi.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libkcapi.spec b/libkcapi.spec index 700f0c3..ee60885 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -127,9 +127,9 @@ Release: %autorelease Summary: User space interface to the Linux Kernel Crypto API License: BSD-3-Clause OR GPL-2.0-only -URL: https://www.chronox.de/%{name}.html -Source0: https://www.chronox.de/%{name}/%{name}-%{version}.tar.xz -Source1: https://www.chronox.de/%{name}/%{name}-%{version}.tar.xz.asc +URL: https://www.chronox.de/%{name}/ +Source0: https://www.chronox.de/%{name}/releases/%{version}/%{name}-%{version}.tar.xz +Source1: https://www.chronox.de/%{name}/releases/%{version}/%{name}-%{version}.tar.xz.asc Source2: sha512hmac-openssl.sh Source3: fipshmac-openssl.sh From 706c546f2781fed6c0d3a4d59e12b004b228b562 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ondrej=20Mosn=C3=A1=C4=8Dek?= Date: Wed, 31 Jul 2024 12:48:44 +0200 Subject: [PATCH 55/61] Fix cppcheck failure (fedora#2300902) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Suggested-by: Zoltán Fridrich Signed-off-by: Ondrej Mosnáček --- libkcapi.spec | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/libkcapi.spec b/libkcapi.spec index ee60885..c215181 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -418,9 +418,11 @@ done %make_build scan %endif %if %{with cppcheck} -# string literal concatenation raises syntaxError with cppcheck-2.11 -# https://trac.cppcheck.net/ticket/11830 -%make_build cppcheck CPPCHECK="cppcheck -UCHECK_DIR" +# -UCHECK_DIR: string literal concatenation raises syntaxError +# with cppcheck-2.11 (https://trac.cppcheck.net/ticket/11830) +# --check-level=exhaustive: otherwise it emits warnings that get +# treated like errors +%make_build cppcheck CPPCHECK="cppcheck --check-level=exhaustive -UCHECK_DIR" %endif %if %{with test} From 86530d6b925d8ea0c92ead28b19a0f1be2c1a261 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ondrej=20Mosn=C3=A1=C4=8Dek?= Date: Sat, 13 Jan 2024 15:05:28 +0100 Subject: [PATCH 56/61] Update to version 1.5.0 (fedora#2257976) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Also adjust handling of binaries to account of upstream moving things around. Signed-off-by: Ondrej Mosnáček --- 001-tests-kernel-version.patch | 40 -------------- libkcapi.spec | 98 +++++++++++++++++++--------------- sources | 4 +- 3 files changed, 58 insertions(+), 84 deletions(-) delete mode 100644 001-tests-kernel-version.patch diff --git a/001-tests-kernel-version.patch b/001-tests-kernel-version.patch deleted file mode 100644 index aa21536..0000000 --- a/001-tests-kernel-version.patch +++ /dev/null @@ -1,40 +0,0 @@ -From c2af62dcc7a287f3c14f6aaec5724401c1ea470a Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Mon, 15 Aug 2022 10:19:50 +0200 -Subject: [PATCH] tests: fix overly-optimistic kernel version checks - -The mainline kernel is now at version 6.0 so these >= 5.99 checks are -now incorrectly enabling tests that don't work. Instead of bumping the -imaginary version and face the same problem again in a couple years, -replace the checks with 'false' and a TODO comment. - -Signed-off-by: Ondrej Mosnacek -Signed-off-by: Stephan Mueller ---- - test/test.sh | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - -diff --git a/test/test.sh b/test/test.sh -index 1d9be73..a75b802 100755 ---- a/test/test.sh -+++ b/test/test.sh -@@ -1560,7 +1560,8 @@ else - echo_deact "AEAD tests of copied AAD deactivated" - fi - --if $(check_min_kernelver 5 99); then -+# TODO add version check when supported upstream -+if false; then - asymfunc 4 - asymfunc 4 -s - asymfunc 4 -v -@@ -1583,7 +1584,8 @@ else - echo_deact "All asymmetric tests deactivated" - fi - --if $(check_min_kernelver 5 99); then -+# TODO add version check when supported upstream -+if false; then - kppfunc 13 - kppfunc 13 X -m - kppfunc 13 -v diff --git a/libkcapi.spec b/libkcapi.spec index c215181..bb1ebd0 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -1,6 +1,6 @@ # Shared object version of libkcapi. %global vmajor 1 -%global vminor 4 +%global vminor 5 %global vpatch 0 # Do we build the replacements packages? @@ -84,8 +84,9 @@ %global hmaccalc_evr 0.9.14-10%{?dist} %endif +%global apps_coreutils sha1sum sha224sum sha256sum sha384sum sha512sum md5sum sm3sum %global apps_hmaccalc sha1hmac sha224hmac sha256hmac sha384hmac sha512hmac sm3hmac -%global apps_fipscheck sha1sum sha224sum sha256sum sha384sum sha512sum md5sum sm3sum fipscheck fipshmac +%global apps_fipscheck fipscheck fipshmac # On old kernels use mock hashers implemented via openssl %if %{lua:print(rpm.vercmp(posix.uname('%r'), '3.19'));} >= 0 @@ -96,8 +97,8 @@ %global fipshmac bash %{SOURCE3} %endif -# Add generation of HMAC checksums of the final stripped -# binaries. %%define with lazy globbing is used here +# Add generation of HMAC checksum of the final stripped +# binary. %%define with lazy globbing is used here # intentionally, because using %%global does not work. %define __spec_install_post \ %{?__debug_package:%{__debug_install_post}} \ @@ -105,20 +106,12 @@ %{__os_install_post} \ bin_path=%{buildroot}%{_bindir} \ lib_path=%{buildroot}/%{_lib} \ -for app in %{apps_hmaccalc}; do \ - test -e "$bin_path"/$app || continue \ - { %sha512hmac "$bin_path"/$app || exit 1; } \\\ - | cut -f 1 -d ' ' >"$lib_path"/hmaccalc/$app.hmac \ -done \ -for app in %{apps_fipscheck}; do \ - test -e "$bin_path"/$app || continue \ - %fipshmac -d "$lib_path"/fipscheck "$bin_path"/$app || exit 1 \ -done \ -%{_bindir}/hardlink -cfv %{buildroot}%{_bindir} \ -%fipshmac -d "$lib_path"/fipscheck \\\ - "$lib_path"/libkcapi.so.%{version} || exit 1 \ +{ %sha512hmac "$bin_path"/kcapi-hasher || exit 1; } | \\\ + cut -f 1 -d ' ' >"$lib_path"/hmaccalc/kcapi-hasher.hmac \ +{ %sha512hmac "$lib_path"/libkcapi.so.%{version} || exit 1; } | \\\ + cut -f 1 -d ' ' >"$lib_path"/hmaccalc/libkcapi.so.%{version}.hmac \ %{__ln_s} libkcapi.so.%{version}.hmac \\\ - "$lib_path"/fipscheck/libkcapi.so.%{vmajor}.hmac \ + "$lib_path"/hmaccalc/libkcapi.so.%{vmajor}.hmac \ %{nil} Name: libkcapi @@ -133,8 +126,6 @@ Source1: https://www.chronox.de/%{name}/releases/%{version}/%{name}-%{ver Source2: sha512hmac-openssl.sh Source3: fipshmac-openssl.sh -Patch: %{giturl}/commit/c2af62dcc7a2.patch#/001-tests-kernel-version.patch - BuildRequires: bash BuildRequires: coreutils BuildRequires: gcc @@ -199,10 +190,18 @@ User documentation for %{name}. %endif +%package hasher +Summary: Common %{name} hashing application +Requires: %{name}%{?_isa} == %{version}-%{release} + +%description hasher +Provides The kcapi-hasher binary used by other %{name} subpackages. + + %if %{with replace_coreutils} %package checksum Summary: Drop-in replacement for *sum utils provided by the %{name} package -Requires: %{name}%{?_isa} == %{version}-%{release} +Requires: %{name}-hasher%{?_isa} == %{version}-%{release} Requires: coreutils%{?_isa} >= %{coreutils_evr} @@ -218,7 +217,7 @@ coreutils) using %{name}. %if %{with replace_fipscheck} %package fipscheck Summary: Drop-in replacements for fipscheck/fipshmac provided by the %{name} package -Requires: %{name}%{?_isa} == %{version}-%{release} +Requires: %{name}-hasher%{?_isa} == %{version}-%{release} Obsoletes: fipscheck <= %{fipscheck_evr} @@ -234,7 +233,7 @@ package fipscheck) using %{name}. %if %{with replace_hmaccalc} %package hmaccalc Summary: Drop-in replacements for hmaccalc provided by the %{name} package -Requires: %{name}%{?_isa} == %{version}-%{release} +Requires: %{name}-hasher%{?_isa} == %{version}-%{release} Obsoletes: hmaccalc <= %{hmaccalc_evr} @@ -259,7 +258,8 @@ is highly discouraged. %package tools Summary: Utility applications for the %{name} package -Requires: %{name}%{?_isa} == %{version}-%{release} +Requires: %{name}%{?_isa} == %{version}-%{release} +Requires: %{name}-hasher%{?_isa} == %{version}-%{release} %description tools Utility applications that are provided with %{name}. This includes @@ -290,6 +290,10 @@ Auxiliary scripts for testing %{name}. %prep %autosetup -p 1 -S git +# Work around https://bugzilla.redhat.com/show_bug.cgi?id=2258240 +sed -i -e 's|XML V45|XML V4.1.2|' -e 's|/xml/4\.5/|/xml/4.1.2/|' \ + lib/doc/libkcapi.tmpl + %if %{with_sysctl_tweak} %{__cat} << EOF > README.%{distroname_ext} This package increases the default limit of the ancillary buffer size @@ -373,20 +377,22 @@ EOF %endif # Install replacement tools, if enabled. -%if !%{with replace_coreutils} -%{__rm} -f \ - %{buildroot}%{_bindir}/md5sum \ - %{buildroot}%{_bindir}/sha*sum \ - %{buildroot}%{_bindir}/sm*sum +%if %{with replace_coreutils} +for app in %apps_coreutils; do + %{__ln_s} ../libexec/libkcapi/$app %{buildroot}%{_bindir}/$app +done %endif -%if !%{with replace_fipscheck} -%{__rm} -f %{buildroot}%{_bindir}/fips* +%if %{with replace_fipscheck} +for app in %apps_fipscheck; do + %{__ln_s} ../libexec/libkcapi/$app %{buildroot}%{_bindir}/$app +done %endif -%if !%{with replace_hmaccalc} -%{__rm} -f %{buildroot}%{_bindir}/sha*hmac -%{__rm} -f %{buildroot}%{_bindir}/sm*hmac +%if %{with replace_hmaccalc} +for app in %apps_hmaccalc; do + %{__ln_s} ../libexec/libkcapi/$app %{buildroot}%{_bindir}/$app +done %endif # We don't ship autocrap dumplings. @@ -454,8 +460,8 @@ popd %license COPYING* /%{_lib}/%{name}.so.%{vmajor} /%{_lib}/%{name}.so.%{version} -/%{_lib}/fipscheck/%{name}.so.%{vmajor}.hmac -/%{_lib}/fipscheck/%{name}.so.%{version}.hmac +/%{_lib}/hmaccalc/%{name}.so.%{vmajor}.hmac +/%{_lib}/hmaccalc/%{name}.so.%{version}.hmac %if %{with_sysctl_tweak} %doc %{_pkgdocdir}/README.%{distroname_ext} %{_sysctldir}/%{sysctl_prio}-%{name}-optmem_max.conf @@ -479,28 +485,33 @@ popd %endif +%files hasher +%{_bindir}/kcapi-hasher +%{_libexecdir}/%{name}/md5sum +%{_libexecdir}/%{name}/sha*sum +%{_libexecdir}/%{name}/sm*sum +%{_libexecdir}/%{name}/fips* +%{_libexecdir}/%{name}/sha*hmac +%{_libexecdir}/%{name}/sm*hmac +/%{_lib}/hmaccalc/kcapi-hasher.hmac + + %if %{with replace_coreutils} %files checksum %{_bindir}/md5sum %{_bindir}/sha*sum %{_bindir}/sm*sum -/%{_lib}/fipscheck/md5sum.hmac -/%{_lib}/fipscheck/sha*sum.hmac -/%{_lib}/fipscheck/sm*sum.hmac %endif %if %{with replace_fipscheck} %files fipscheck %{_bindir}/fips* -/%{_lib}/fipscheck/fips*.hmac %endif %if %{with replace_hmaccalc} %files hmaccalc %{_bindir}/sha*hmac %{_bindir}/sm*hmac -/%{_lib}/hmaccalc/sha*hmac.hmac -/%{_lib}/hmaccalc/sm*hmac.hmac %endif @@ -515,7 +526,10 @@ popd %if %{with test_package} %files tests -%{_libexecdir}/%{name}/* +%{_libexecdir}/%{name}/kcapi +%{_libexecdir}/%{name}/kcapi-convenience +%{_libexecdir}/%{name}/kcapi-enc-test-large +%{_libexecdir}/%{name}/*.sh %endif diff --git a/sources b/sources index 7e8a98f..0f7842a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (libkcapi-1.4.0.tar.xz) = fa3df1fe22eba32585de5df044f907d3ad189c33f5704fe29b0fdeda92e772ef077055b80e17bc1646a8cdedaf4f195aadf0b133f493597f0f7657b04ea93a99 -SHA512 (libkcapi-1.4.0.tar.xz.asc) = a41303cba88b214c82537bb5de2584a72a239670318753ba6873a2c3ebe3b56ffd381fdf7ae266aa21857e850bebdfbfdec487c98655ddbc2b9a0ba0d4f383ca +SHA512 (libkcapi-1.5.0.tar.xz) = db156ee94fc63815a31876ab072aca72a806b26961c43f2caf8495c53b95484de71cd3be84dc9e5c9560e9ee704979be059ff6c102b4893d6bbdf9a8a69a667a +SHA512 (libkcapi-1.5.0.tar.xz.asc) = 69cfb6bf98f89c503e7fda07a54eddb9fcc2dafe418f1bc1216c051565c214a6caab83495c19b650a5c6e46e22080f8df4dd2152ab364993ed5badd256495159 From b5b79c5c2b2e81f7a58fdbb71f6e6ead771cb266 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ondrej=20Mosn=C3=A1=C4=8Dek?= Date: Mon, 5 Aug 2024 14:08:07 +0200 Subject: [PATCH 57/61] Remove fipscheck-smoke-test MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This test doesn't seem to work any more. Long term it would be better to replace it with more meaningful tests, but for now let's just remove it. [skip changelog] Signed-off-by: Ondrej Mosnáček --- tests/fipscheck-smoke-test/main.fmf | 17 ------- tests/fipscheck-smoke-test/runtest.sh | 70 --------------------------- 2 files changed, 87 deletions(-) delete mode 100644 tests/fipscheck-smoke-test/main.fmf delete mode 100755 tests/fipscheck-smoke-test/runtest.sh diff --git a/tests/fipscheck-smoke-test/main.fmf b/tests/fipscheck-smoke-test/main.fmf deleted file mode 100644 index a81cae2..0000000 --- a/tests/fipscheck-smoke-test/main.fmf +++ /dev/null @@ -1,17 +0,0 @@ -summary: Fipscheck smoke test -framework: beakerlib -test: ./runtest.sh -require: -- fipscheck -- gawk -- gcc-c++ -- libgcrypt -- libgpg-error-devel -- libselinux-utils -- libtool -- nfs-utils -- pkgconfig -- rpm-build -- texinfo -- wget -tier: 2 diff --git a/tests/fipscheck-smoke-test/runtest.sh b/tests/fipscheck-smoke-test/runtest.sh deleted file mode 100755 index 6f9bbab..0000000 --- a/tests/fipscheck-smoke-test/runtest.sh +++ /dev/null @@ -1,70 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/libgcrypt/smoke-test -# Description: Test calls upstream test suite. -# Author: Ondrej Moris -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2010 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include beakerlib environment -. /usr/share/beakerlib/beakerlib.sh - -PACKAGE="libgcrypt" - -rlJournalStart - - rlPhaseStartSetup - TmpDir=`mktemp -d` - rlAssertRpm $PACKAGE - rlFileBackup --clean "/etc/gcrypt/fips_enabled" - rlRun "pushd $TmpDir" 0 - rlFetchSrcForInstalled $PACKAGE - rlRun "rpm -ihv `ls *.rpm`" 0 - if grep '1' /proc/sys/crypto/fips_enabled; then - rlRun "echo '1' > /etc/gcrypt/fips_enabled" 0 - fi - rlPhaseEnd - - rlPhaseStartTest - TOPDIR=`rpm --eval %_topdir` - rlRun "pushd $TOPDIR" 0 - rlRun "rm -rf BUILD/libgcrypt-*" 0-255 - rlRun "rpmbuild -vv -bc SPECS/libgcrypt.spec" 0 - rlRun "pushd BUILD/libgcrypt-*" 0 - rlRun "fipshmac src/.libs/libgcrypt.so.??" 0 - rlRun "make check > $TmpDir/make_check.out" 0 - rlRun "popd" 0 - rlRun "popd" 0 - rlRun "grep \"All [0-9]\+ tests passed\" $TmpDir/make_check.out" 0 \ - "All tests passed" - rlRun "cat $TmpDir/make_check.out" 0 - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "popd" 0 - rlRun "rm -r $TmpDir" 0 - rlFileRestore - rlPhaseEnd - -rlJournalPrintText -rlJournalEnd From be04c759526171b26fe68e81fba5c8a3f3984fb3 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Thu, 15 Jul 2021 06:44:20 -0400 Subject: [PATCH 58/61] Use _libdir as recommended by guidelines MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Simo Sorce [omos: rebased] Signed-off-by: Ondrej Mosnáček --- libkcapi.spec | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/libkcapi.spec b/libkcapi.spec index bb1ebd0..9e7f58b 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -105,7 +105,7 @@ %{__arch_install_post} \ %{__os_install_post} \ bin_path=%{buildroot}%{_bindir} \ -lib_path=%{buildroot}/%{_lib} \ +lib_path=%{buildroot}%{_libdir} \ { %sha512hmac "$bin_path"/kcapi-hasher || exit 1; } | \\\ cut -f 1 -d ' ' >"$lib_path"/hmaccalc/kcapi-hasher.hmac \ { %sha512hmac "$lib_path"/libkcapi.so.%{version} || exit 1; } | \\\ @@ -333,7 +333,7 @@ EOF %build %configure \ - --libdir=/%{_lib} \ + --libdir=%{_libdir} \ --disable-silent-rules \ --enable-kcapi-encapp \ --enable-kcapi-dgstapp \ @@ -344,7 +344,7 @@ EOF --enable-shared \ --enable-static \ --enable-sum-prefix= \ - --enable-sum-dir=/%{_lib} \ + --enable-sum-dir=%{_libdir} \ --with-pkgconfigdir=%{_libdir}/pkgconfig %if %{with doc} %make_build all doc @@ -458,10 +458,10 @@ popd %doc %dir %{_pkgdocdir} %doc %{_pkgdocdir}/README.md %license COPYING* -/%{_lib}/%{name}.so.%{vmajor} -/%{_lib}/%{name}.so.%{version} -/%{_lib}/hmaccalc/%{name}.so.%{vmajor}.hmac -/%{_lib}/hmaccalc/%{name}.so.%{version}.hmac +%{_libdir}/%{name}.so.%{vmajor} +%{_libdir}/%{name}.so.%{version} +%{_libdir}/hmaccalc/%{name}.so.%{vmajor}.hmac +%{_libdir}/hmaccalc/%{name}.so.%{version}.hmac %if %{with_sysctl_tweak} %doc %{_pkgdocdir}/README.%{distroname_ext} %{_sysctldir}/%{sysctl_prio}-%{name}-optmem_max.conf @@ -473,7 +473,7 @@ popd %doc %{_pkgdocdir}/TODO %{_includedir}/kcapi.h %{_mandir}/man3/kcapi_*.3.* -/%{_lib}/%{name}.so +%{_libdir}/%{name}.so %{_libdir}/pkgconfig/%{name}.pc @@ -493,7 +493,7 @@ popd %{_libexecdir}/%{name}/fips* %{_libexecdir}/%{name}/sha*hmac %{_libexecdir}/%{name}/sm*hmac -/%{_lib}/hmaccalc/kcapi-hasher.hmac +%{_libdir}/hmaccalc/kcapi-hasher.hmac %if %{with replace_coreutils} @@ -516,7 +516,7 @@ popd %files static -/%{_lib}/%{name}.a +%{_libdir}/%{name}.a %files tools From 406ea0357f8d19527b827de7b08e37ec366aabc6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ondrej=20Mosn=C3=A1=C4=8Dek?= Date: Mon, 19 Aug 2024 18:39:20 +0200 Subject: [PATCH 59/61] Do not ship duplicate kcapi-hasher in libkcapi-tools MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Ship kcapi-hasher manpage in libkcapi-hasher Signed-off-by: Ondrej Mosnáček --- libkcapi.spec | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/libkcapi.spec b/libkcapi.spec index 9e7f58b..9338486 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -494,6 +494,7 @@ popd %{_libexecdir}/%{name}/sha*hmac %{_libexecdir}/%{name}/sm*hmac %{_libdir}/hmaccalc/kcapi-hasher.hmac +%{_mandir}/man1/kcapi-hasher.1.* %if %{with replace_coreutils} @@ -520,8 +521,16 @@ popd %files tools -%{_bindir}/kcapi* -%{_mandir}/man1/kcapi*.1.* +%{_bindir}/kcapi +%{_bindir}/kcapi-convenience +%{_bindir}/kcapi-dgst +%{_bindir}/kcapi-enc +%{_bindir}/kcapi-enc-test-large +%{_bindir}/kcapi-rng +%{_bindir}/kcapi-speed +%{_mandir}/man1/kcapi-dgst.1.* +%{_mandir}/man1/kcapi-enc.1.* +%{_mandir}/man1/kcapi-rng.1.* %if %{with test_package} From e1808a2fa96e7bb86cb38ba016685be608dbc616 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 17 Jan 2025 11:39:04 +0000 Subject: [PATCH 60/61] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From 9e4e0a064d581efc5ad80d4c10bf1ff5520b6697 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 24 Jul 2025 19:51:53 +0000 Subject: [PATCH 61/61] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild