diff --git a/001-tests-kernel-version.patch b/001-tests-kernel-version.patch new file mode 100644 index 0000000..aa21536 --- /dev/null +++ b/001-tests-kernel-version.patch @@ -0,0 +1,40 @@ +From c2af62dcc7a287f3c14f6aaec5724401c1ea470a Mon Sep 17 00:00:00 2001 +From: Ondrej Mosnacek +Date: Mon, 15 Aug 2022 10:19:50 +0200 +Subject: [PATCH] tests: fix overly-optimistic kernel version checks + +The mainline kernel is now at version 6.0 so these >= 5.99 checks are +now incorrectly enabling tests that don't work. Instead of bumping the +imaginary version and face the same problem again in a couple years, +replace the checks with 'false' and a TODO comment. + +Signed-off-by: Ondrej Mosnacek +Signed-off-by: Stephan Mueller +--- + test/test.sh | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/test/test.sh b/test/test.sh +index 1d9be73..a75b802 100755 +--- a/test/test.sh ++++ b/test/test.sh +@@ -1560,7 +1560,8 @@ else + echo_deact "AEAD tests of copied AAD deactivated" + fi + +-if $(check_min_kernelver 5 99); then ++# TODO add version check when supported upstream ++if false; then + asymfunc 4 + asymfunc 4 -s + asymfunc 4 -v +@@ -1583,7 +1584,8 @@ else + echo_deact "All asymmetric tests deactivated" + fi + +-if $(check_min_kernelver 5 99); then ++# TODO add version check when supported upstream ++if false; then + kppfunc 13 + kppfunc 13 X -m + kppfunc 13 -v diff --git a/libkcapi.spec b/libkcapi.spec index 9338486..0a6779c 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -1,6 +1,6 @@ # Shared object version of libkcapi. %global vmajor 1 -%global vminor 5 +%global vminor 4 %global vpatch 0 # Do we build the replacements packages? @@ -84,9 +84,8 @@ %global hmaccalc_evr 0.9.14-10%{?dist} %endif -%global apps_coreutils sha1sum sha224sum sha256sum sha384sum sha512sum md5sum sm3sum %global apps_hmaccalc sha1hmac sha224hmac sha256hmac sha384hmac sha512hmac sm3hmac -%global apps_fipscheck fipscheck fipshmac +%global apps_fipscheck sha1sum sha224sum sha256sum sha384sum sha512sum md5sum sm3sum fipscheck fipshmac # On old kernels use mock hashers implemented via openssl %if %{lua:print(rpm.vercmp(posix.uname('%r'), '3.19'));} >= 0 @@ -97,21 +96,29 @@ %global fipshmac bash %{SOURCE3} %endif -# Add generation of HMAC checksum of the final stripped -# binary. %%define with lazy globbing is used here +# Add generation of HMAC checksums of the final stripped +# binaries. %%define with lazy globbing is used here # intentionally, because using %%global does not work. %define __spec_install_post \ %{?__debug_package:%{__debug_install_post}} \ %{__arch_install_post} \ %{__os_install_post} \ bin_path=%{buildroot}%{_bindir} \ -lib_path=%{buildroot}%{_libdir} \ -{ %sha512hmac "$bin_path"/kcapi-hasher || exit 1; } | \\\ - cut -f 1 -d ' ' >"$lib_path"/hmaccalc/kcapi-hasher.hmac \ -{ %sha512hmac "$lib_path"/libkcapi.so.%{version} || exit 1; } | \\\ - cut -f 1 -d ' ' >"$lib_path"/hmaccalc/libkcapi.so.%{version}.hmac \ +lib_path=%{buildroot}/%{_lib} \ +for app in %{apps_hmaccalc}; do \ + test -e "$bin_path"/$app || continue \ + { %sha512hmac "$bin_path"/$app || exit 1; } \\\ + | cut -f 1 -d ' ' >"$lib_path"/hmaccalc/$app.hmac \ +done \ +for app in %{apps_fipscheck}; do \ + test -e "$bin_path"/$app || continue \ + %fipshmac -d "$lib_path"/fipscheck "$bin_path"/$app || exit 1 \ +done \ +%{_bindir}/hardlink -cfv %{buildroot}%{_bindir} \ +%fipshmac -d "$lib_path"/fipscheck \\\ + "$lib_path"/libkcapi.so.%{version} || exit 1 \ %{__ln_s} libkcapi.so.%{version}.hmac \\\ - "$lib_path"/hmaccalc/libkcapi.so.%{vmajor}.hmac \ + "$lib_path"/fipscheck/libkcapi.so.%{vmajor}.hmac \ %{nil} Name: libkcapi @@ -119,13 +126,15 @@ Version: %{vmajor}.%{vminor}.%{vpatch} Release: %autorelease Summary: User space interface to the Linux Kernel Crypto API -License: BSD-3-Clause OR GPL-2.0-only -URL: https://www.chronox.de/%{name}/ -Source0: https://www.chronox.de/%{name}/releases/%{version}/%{name}-%{version}.tar.xz -Source1: https://www.chronox.de/%{name}/releases/%{version}/%{name}-%{version}.tar.xz.asc +License: BSD or GPLv2 +URL: https://www.chronox.de/%{name}.html +Source0: https://www.chronox.de/%{name}/%{name}-%{version}.tar.xz +Source1: https://www.chronox.de/%{name}/%{name}-%{version}.tar.xz.asc Source2: sha512hmac-openssl.sh Source3: fipshmac-openssl.sh +Patch: %{giturl}/commit/c2af62dcc7a2.patch#/001-tests-kernel-version.patch + BuildRequires: bash BuildRequires: coreutils BuildRequires: gcc @@ -190,18 +199,10 @@ User documentation for %{name}. %endif -%package hasher -Summary: Common %{name} hashing application -Requires: %{name}%{?_isa} == %{version}-%{release} - -%description hasher -Provides The kcapi-hasher binary used by other %{name} subpackages. - - %if %{with replace_coreutils} %package checksum Summary: Drop-in replacement for *sum utils provided by the %{name} package -Requires: %{name}-hasher%{?_isa} == %{version}-%{release} +Requires: %{name}%{?_isa} == %{version}-%{release} Requires: coreutils%{?_isa} >= %{coreutils_evr} @@ -217,7 +218,7 @@ coreutils) using %{name}. %if %{with replace_fipscheck} %package fipscheck Summary: Drop-in replacements for fipscheck/fipshmac provided by the %{name} package -Requires: %{name}-hasher%{?_isa} == %{version}-%{release} +Requires: %{name}%{?_isa} == %{version}-%{release} Obsoletes: fipscheck <= %{fipscheck_evr} @@ -233,7 +234,7 @@ package fipscheck) using %{name}. %if %{with replace_hmaccalc} %package hmaccalc Summary: Drop-in replacements for hmaccalc provided by the %{name} package -Requires: %{name}-hasher%{?_isa} == %{version}-%{release} +Requires: %{name}%{?_isa} == %{version}-%{release} Obsoletes: hmaccalc <= %{hmaccalc_evr} @@ -258,8 +259,7 @@ is highly discouraged. %package tools Summary: Utility applications for the %{name} package -Requires: %{name}%{?_isa} == %{version}-%{release} -Requires: %{name}-hasher%{?_isa} == %{version}-%{release} +Requires: %{name}%{?_isa} == %{version}-%{release} %description tools Utility applications that are provided with %{name}. This includes @@ -290,10 +290,6 @@ Auxiliary scripts for testing %{name}. %prep %autosetup -p 1 -S git -# Work around https://bugzilla.redhat.com/show_bug.cgi?id=2258240 -sed -i -e 's|XML V45|XML V4.1.2|' -e 's|/xml/4\.5/|/xml/4.1.2/|' \ - lib/doc/libkcapi.tmpl - %if %{with_sysctl_tweak} %{__cat} << EOF > README.%{distroname_ext} This package increases the default limit of the ancillary buffer size @@ -333,7 +329,7 @@ EOF %build %configure \ - --libdir=%{_libdir} \ + --libdir=/%{_lib} \ --disable-silent-rules \ --enable-kcapi-encapp \ --enable-kcapi-dgstapp \ @@ -344,7 +340,7 @@ EOF --enable-shared \ --enable-static \ --enable-sum-prefix= \ - --enable-sum-dir=%{_libdir} \ + --enable-sum-dir=/%{_lib} \ --with-pkgconfigdir=%{_libdir}/pkgconfig %if %{with doc} %make_build all doc @@ -377,22 +373,20 @@ EOF %endif # Install replacement tools, if enabled. -%if %{with replace_coreutils} -for app in %apps_coreutils; do - %{__ln_s} ../libexec/libkcapi/$app %{buildroot}%{_bindir}/$app -done +%if !%{with replace_coreutils} +%{__rm} -f \ + %{buildroot}%{_bindir}/md5sum \ + %{buildroot}%{_bindir}/sha*sum \ + %{buildroot}%{_bindir}/sm*sum %endif -%if %{with replace_fipscheck} -for app in %apps_fipscheck; do - %{__ln_s} ../libexec/libkcapi/$app %{buildroot}%{_bindir}/$app -done +%if !%{with replace_fipscheck} +%{__rm} -f %{buildroot}%{_bindir}/fips* %endif -%if %{with replace_hmaccalc} -for app in %apps_hmaccalc; do - %{__ln_s} ../libexec/libkcapi/$app %{buildroot}%{_bindir}/$app -done +%if !%{with replace_hmaccalc} +%{__rm} -f %{buildroot}%{_bindir}/sha*hmac +%{__rm} -f %{buildroot}%{_bindir}/sm*hmac %endif # We don't ship autocrap dumplings. @@ -424,11 +418,7 @@ done %make_build scan %endif %if %{with cppcheck} -# -UCHECK_DIR: string literal concatenation raises syntaxError -# with cppcheck-2.11 (https://trac.cppcheck.net/ticket/11830) -# --check-level=exhaustive: otherwise it emits warnings that get -# treated like errors -%make_build cppcheck CPPCHECK="cppcheck --check-level=exhaustive -UCHECK_DIR" +%make_build cppcheck %endif %if %{with test} @@ -458,10 +448,10 @@ popd %doc %dir %{_pkgdocdir} %doc %{_pkgdocdir}/README.md %license COPYING* -%{_libdir}/%{name}.so.%{vmajor} -%{_libdir}/%{name}.so.%{version} -%{_libdir}/hmaccalc/%{name}.so.%{vmajor}.hmac -%{_libdir}/hmaccalc/%{name}.so.%{version}.hmac +/%{_lib}/%{name}.so.%{vmajor} +/%{_lib}/%{name}.so.%{version} +/%{_lib}/fipscheck/%{name}.so.%{vmajor}.hmac +/%{_lib}/fipscheck/%{name}.so.%{version}.hmac %if %{with_sysctl_tweak} %doc %{_pkgdocdir}/README.%{distroname_ext} %{_sysctldir}/%{sysctl_prio}-%{name}-optmem_max.conf @@ -473,7 +463,7 @@ popd %doc %{_pkgdocdir}/TODO %{_includedir}/kcapi.h %{_mandir}/man3/kcapi_*.3.* -%{_libdir}/%{name}.so +/%{_lib}/%{name}.so %{_libdir}/pkgconfig/%{name}.pc @@ -485,60 +475,43 @@ popd %endif -%files hasher -%{_bindir}/kcapi-hasher -%{_libexecdir}/%{name}/md5sum -%{_libexecdir}/%{name}/sha*sum -%{_libexecdir}/%{name}/sm*sum -%{_libexecdir}/%{name}/fips* -%{_libexecdir}/%{name}/sha*hmac -%{_libexecdir}/%{name}/sm*hmac -%{_libdir}/hmaccalc/kcapi-hasher.hmac -%{_mandir}/man1/kcapi-hasher.1.* - - %if %{with replace_coreutils} %files checksum %{_bindir}/md5sum %{_bindir}/sha*sum %{_bindir}/sm*sum +/%{_lib}/fipscheck/md5sum.hmac +/%{_lib}/fipscheck/sha*sum.hmac +/%{_lib}/fipscheck/sm*sum.hmac %endif %if %{with replace_fipscheck} %files fipscheck %{_bindir}/fips* +/%{_lib}/fipscheck/fips*.hmac %endif %if %{with replace_hmaccalc} %files hmaccalc %{_bindir}/sha*hmac %{_bindir}/sm*hmac +/%{_lib}/hmaccalc/sha*hmac.hmac +/%{_lib}/hmaccalc/sm*hmac.hmac %endif %files static -%{_libdir}/%{name}.a +/%{_lib}/%{name}.a %files tools -%{_bindir}/kcapi -%{_bindir}/kcapi-convenience -%{_bindir}/kcapi-dgst -%{_bindir}/kcapi-enc -%{_bindir}/kcapi-enc-test-large -%{_bindir}/kcapi-rng -%{_bindir}/kcapi-speed -%{_mandir}/man1/kcapi-dgst.1.* -%{_mandir}/man1/kcapi-enc.1.* -%{_mandir}/man1/kcapi-rng.1.* +%{_bindir}/kcapi* +%{_mandir}/man1/kcapi*.1.* %if %{with test_package} %files tests -%{_libexecdir}/%{name}/kcapi -%{_libexecdir}/%{name}/kcapi-convenience -%{_libexecdir}/%{name}/kcapi-enc-test-large -%{_libexecdir}/%{name}/*.sh +%{_libexecdir}/%{name}/* %endif diff --git a/sources b/sources index 0f7842a..7e8a98f 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (libkcapi-1.5.0.tar.xz) = db156ee94fc63815a31876ab072aca72a806b26961c43f2caf8495c53b95484de71cd3be84dc9e5c9560e9ee704979be059ff6c102b4893d6bbdf9a8a69a667a -SHA512 (libkcapi-1.5.0.tar.xz.asc) = 69cfb6bf98f89c503e7fda07a54eddb9fcc2dafe418f1bc1216c051565c214a6caab83495c19b650a5c6e46e22080f8df4dd2152ab364993ed5badd256495159 +SHA512 (libkcapi-1.4.0.tar.xz) = fa3df1fe22eba32585de5df044f907d3ad189c33f5704fe29b0fdeda92e772ef077055b80e17bc1646a8cdedaf4f195aadf0b133f493597f0f7657b04ea93a99 +SHA512 (libkcapi-1.4.0.tar.xz.asc) = a41303cba88b214c82537bb5de2584a72a239670318753ba6873a2c3ebe3b56ffd381fdf7ae266aa21857e850bebdfbfdec487c98655ddbc2b9a0ba0d4f383ca diff --git a/tests/fipscheck-smoke-test/main.fmf b/tests/fipscheck-smoke-test/main.fmf new file mode 100644 index 0000000..a81cae2 --- /dev/null +++ b/tests/fipscheck-smoke-test/main.fmf @@ -0,0 +1,17 @@ +summary: Fipscheck smoke test +framework: beakerlib +test: ./runtest.sh +require: +- fipscheck +- gawk +- gcc-c++ +- libgcrypt +- libgpg-error-devel +- libselinux-utils +- libtool +- nfs-utils +- pkgconfig +- rpm-build +- texinfo +- wget +tier: 2 diff --git a/tests/fipscheck-smoke-test/runtest.sh b/tests/fipscheck-smoke-test/runtest.sh new file mode 100755 index 0000000..6f9bbab --- /dev/null +++ b/tests/fipscheck-smoke-test/runtest.sh @@ -0,0 +1,70 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/libgcrypt/smoke-test +# Description: Test calls upstream test suite. +# Author: Ondrej Moris +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2010 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include beakerlib environment +. /usr/share/beakerlib/beakerlib.sh + +PACKAGE="libgcrypt" + +rlJournalStart + + rlPhaseStartSetup + TmpDir=`mktemp -d` + rlAssertRpm $PACKAGE + rlFileBackup --clean "/etc/gcrypt/fips_enabled" + rlRun "pushd $TmpDir" 0 + rlFetchSrcForInstalled $PACKAGE + rlRun "rpm -ihv `ls *.rpm`" 0 + if grep '1' /proc/sys/crypto/fips_enabled; then + rlRun "echo '1' > /etc/gcrypt/fips_enabled" 0 + fi + rlPhaseEnd + + rlPhaseStartTest + TOPDIR=`rpm --eval %_topdir` + rlRun "pushd $TOPDIR" 0 + rlRun "rm -rf BUILD/libgcrypt-*" 0-255 + rlRun "rpmbuild -vv -bc SPECS/libgcrypt.spec" 0 + rlRun "pushd BUILD/libgcrypt-*" 0 + rlRun "fipshmac src/.libs/libgcrypt.so.??" 0 + rlRun "make check > $TmpDir/make_check.out" 0 + rlRun "popd" 0 + rlRun "popd" 0 + rlRun "grep \"All [0-9]\+ tests passed\" $TmpDir/make_check.out" 0 \ + "All tests passed" + rlRun "cat $TmpDir/make_check.out" 0 + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "popd" 0 + rlRun "rm -r $TmpDir" 0 + rlFileRestore + rlPhaseEnd + +rlJournalPrintText +rlJournalEnd