diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/changelog b/changelog new file mode 100644 index 0000000..ce71afd --- /dev/null +++ b/changelog @@ -0,0 +1,247 @@ +* Sat Aug 13 2022 Ondrej Mosnáček - 1.4.0-2 +- Switch to rpmautospec + +* Sat Aug 13 2022 Ondrej Mosnáček - 1.4.0-1 +- Update to upstream version 1.4.0 +- Re-enable cppcheck scanning on Fedora +- Resolves: rhbz#2056732 + +* Thu Jul 21 2022 Fedora Release Engineering - 1.3.1-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Thu Jan 20 2022 Fedora Release Engineering - 1.3.1-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Thu Jul 22 2021 Fedora Release Engineering - 1.3.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Wed Jul 14 2021 Simo Sorce - 1.3.1-2 +- Remove LTO build suppression by using better symver machinery + +* Wed Jul 14 2021 Simo Sorce - 1.3.1-1 +- Update to upstream version 1.3.1 which fixes ABI issues + +* Mon Jul 12 2021 Simo Sorce - 1.3.0-1 +- Update to upstream version 1.3.0 + +* Mon Mar 15 2021 Sahana Prasad - 1.2.1-1 +- Update to upstream version 1.2.1 +- Remove patch fix MSG_MORE uasge as it is added upstream +- Remove cppcheck dependency for rhel bz#1931518 +- Add a patch to fix fuzz tests + +* Tue Jan 26 2021 Fedora Release Engineering - 1.2.0-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Fri Aug 14 2020 Ondrej Mosnáček - 1.2.0-3 +- Require perl-interpreter instead of full perl +- Backport fix for 5.9 kernels + +* Tue Jul 28 2020 Fedora Release Engineering - 1.2.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Mon May 25 2020 Sahana Prasad - 1.2.0-1 +- Update to upstream version 1.2.0 tracked by BZ 1839592. +- Enable kcapi-enc tests as libkcapi BZ 1826022 is fixed. +- Remove 110-fipshmac-compat.patch as the changes are merged upstream. +- Remove 100-workaround-cppcheck-bug.patch as the changes are merged upstream. + +* Tue May 05 2020 Ondrej Mosnáček - 1.1.5-5 +- Fix the CI test failures +- Enable building on old kernels +- Avoid conflicts between different versions of packages + +* Thu Apr 23 2020 Tomáš Mráz - 1.1.5-4 +- Add . prefix to files created by fipshmac if -d option is not specified + +* Wed Apr 22 2020 Sahana Prasad - 1.1.5-3 +- Disables kcapi-enc tests until the kernel bug bz 1826022 is fixed. +- Produce also the fipscheck replacement package + +* Wed Jan 29 2020 Fedora Release Engineering - 1.1.5-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Tue Aug 13 2019 Ondrej Mosnáček - 1.1.5-1 +- Update to upstream version 1.1.5 + +* Sat Jul 27 2019 Ondrej Mosnáček - 1.1.4-6 +- Backport patch to fix test failure on aarch64 +- Remove no longer needed ppc64 workaround + +* Sat Jul 27 2019 Ondrej Mosnáček - 1.1.4-5 +- Backport patch to fix tests + +* Thu Jul 25 2019 Ondrej Mosnáček - 1.1.4-4 +- Work around cppcheck issue +- Enable gating + +* Thu Jul 25 2019 Fedora Release Engineering - 1.1.4-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Mon May 27 2019 Ondrej Mosnáček - 1.1.4-2 +- Fix FTBFS: hardlink is now in bindir + +* Sat Feb 02 2019 Ondrej Mosnáček - 1.1.4-1 +- Update to upstream version 1.1.4 + +* Fri Feb 01 2019 Ondrej Mosnáček - 1.1.3-3 +- Fix build with new GCC + +* Fri Feb 01 2019 Fedora Release Engineering - 1.1.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Thu Aug 23 2018 Ondrej Mosnáček - 1.1.3-1 +- Update to upstream version 1.1.3 + +* Thu Aug 09 2018 Ondrej Mosnáček - 1.1.1-16 +- Add missing dependencies to the tests package +- Update patch from upstream + +* Thu Aug 09 2018 Ondrej Mosnáček - 1.1.1-15 +- Build and tests require perl + +* Thu Aug 09 2018 Ondrej Mosnáček - 1.1.1-14 +- Add missing script to the 'tests' package + +* Wed Aug 08 2018 Ondrej Mosnáček - 1.1.1-13 +- Add missing requires to the 'tests' subpackage + +* Tue Aug 07 2018 Ondrej Mosnáček - 1.1.1-12 +- Produce a subpackage with test scripts +- Build the 'tests' subpackage conditionally + +* Wed Aug 01 2018 Ondrej Mosnáček - 1.1.1-11 +- Add patch to fix unwanted closing of FD 0 + +* Tue Jul 31 2018 Ondrej Mosnáček - 1.1.1-10 +- Remove the kernel headers workaround + +* Fri Jul 27 2018 Igor Gnatenko - 1.1.1-9 +- Rebuild for new binutils + +* Fri Jul 27 2018 Ondrej Mosnáček - 1.1.1-8 +- Add more Coverity fixes from upstream +- Add patch to fix AEAD fuzz test for BE arches +- Fixup specfile + +* Mon Jul 23 2018 Ondrej Mosnáček - 1.1.1-7 +- Add various fixes from upstream +- Drop the Requires on kernel package + +* Mon Jul 16 2018 Ondrej Mosnáček - 1.1.1-6 +- Put .hmac files into a separate directory + +* Fri Jul 13 2018 Fedora Release Engineering - 1.1.1-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Thu Jul 12 2018 Ondrej Mosnáček - 1.1.1-4 +- Add patch to work around FTBFS on rawhide + +* Wed Jul 11 2018 Ondrej Mosnáček - 1.1.1-3 +- Fix off-by-one error in checkfile parsing + +* Wed Jul 11 2018 Ondrej Mosnáček - 1.1.1-2 +- Fix command-line parsing in libkcapi-hmaccalc + +* Mon Jun 18 2018 Ondrej Mosnáček - 1.1.1-1 +- Update to upstream version 1.1.1 + +* Wed May 09 2018 Ondrej Mosnáček - 1.1.0-5 +- Skip CLang static analysis in RHEL +- Revert "Skip CLang static analysis in RHEL" +- Use own sha512hmac and fipscheck + +* Wed May 02 2018 Ondrej Mosnáček - 1.1.0-4 +- Fix description lines being too long + +* Fri Apr 27 2018 Björn Esser - 1.1.0-3 +- Fix conditional for hmaccalc replacement + +* Mon Apr 16 2018 Ondrej Mosnáček - 1.1.0-2 +- Enable hmaccalc replacements in Fedora 28+ + +* Thu Apr 12 2018 Ondrej Mosnáček - 1.1.0-1 +- Update to upstream version 1.1.0 + +* Sat Mar 31 2018 Björn Esser - 1.0.3-10 +- Replace single patches with a monolitic one from upstream +- Obsolete replacements subpackage +- Ignore failing tests on %%{power64} temporarily + +* Thu Mar 08 2018 Ondrej Mosnáček - 1.0.3-9 +- Split up the replacements subpackage + +* Mon Feb 26 2018 Björn Esser - 1.0.3-8 +- Increase optmem_max preset to 81920 + +* Mon Feb 26 2018 Björn Esser - 1.0.3-7 +- Obsoletes work by package name, not by provides (rhbz#1537225) + +* Sun Feb 25 2018 Björn Esser - 1.0.3-6 +- Add patch to fix a copy-paste typo + +* Sat Feb 17 2018 Björn Esser - 1.0.3-5 +- Add patch to fix build with -Werror + +* Wed Feb 07 2018 Fedora Release Engineering +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + +* Sun Feb 04 2018 Björn Esser - 1.0.3-3 +- Switch to %%ldconfig_scriptlets + +* Wed Jan 17 2018 Björn Esser - 1.0.3-2 +- Decrease optmem_max preset to 40960 +- Let the build fail, if the minimum kernel version cannot be met +- Conditionalize the sysctl.d tweak on version of the kernel +- Conditionalize the name of README.distro on the distro + +* Tue Jan 16 2018 Björn Esser - 1.0.3-1 +- Initial import (rhbz#1533929) + +* Tue Jan 16 2018 Björn Esser - 1.0.3-0.13 +- Increase optmem_max preset to 81920 + +* Tue Jan 16 2018 Björn Esser - 1.0.3-0.12 +- Add sysctl.d preset and README.fedora + +* Mon Jan 15 2018 Björn Esser - 1.0.3-0.11 +- Make the contents of the -replacements package configurable + +* Mon Jan 15 2018 Björn Esser - 1.0.3-0.10 +- Fix Obsoletes of the -replacements package + +* Sun Jan 14 2018 Björn Esser - 1.0.3-0.9 +- Disable the -replacements package until we have a plan for it + +* Sun Jan 14 2018 Björn Esser - 1.0.3-0.8 +- Move the kcapi-hasher binary to -replacements package, since it is + not of much use without the linked invocation names and saves the + extra Requires on the -tools package + +* Sun Jan 14 2018 Björn Esser - 1.0.3-0.7 +- Fix internal Requires of sub-packages +- Hardlink files in %%{_bindir} + +* Sun Jan 14 2018 Björn Esser - 1.0.3-0.6 +- Add patches from upstream + +* Sat Jan 13 2018 Björn Esser - 1.0.3-0.5 +- Add patches from upstream + +* Sat Jan 13 2018 Björn Esser - 1.0.3-0.4 +- Asume the testsuite cannot be run, if the value of optmem_max cannot + be obtained + +* Sat Jan 13 2018 Björn Esser - 1.0.3-0.3 +- Move libraries to /%%{_lib} instead of %%{_libdir}, which is useful + during boot when the library might be needed before a potentially + seperate /usr partition is mounted + +* Sat Jan 13 2018 Björn Esser - 1.0.3-0.2 +- Asume optmem_max is at least 20480, if the real value cannot be obtained + +* Fri Jan 12 2018 Björn Esser - 1.0.3-0.1 +- New upstream release + +* Wed Jan 10 2018 Björn Esser - 1.0.2-0.1 +- Initial rpm release (rhbz#1533929) diff --git a/fipshmac-openssl.sh b/fipshmac-openssl.sh new file mode 100644 index 0000000..c554434 --- /dev/null +++ b/fipshmac-openssl.sh @@ -0,0 +1,9 @@ +#!/bin/bash + +# Mocks fipshmac using the openssl tool. +# Only for use during RPM build. + +[ "$1" = '-d' ] || exit 1 + +openssl sha256 -hmac orboDeJITITejsirpADONivirpUkvarP -hex "$3" | cut -f 2 -d ' ' \ + >"$2/$(basename "$3").hmac" diff --git a/gating.yaml b/gating.yaml new file mode 100644 index 0000000..c2182c7 --- /dev/null +++ b/gating.yaml @@ -0,0 +1,6 @@ +--- !Policy +product_versions: + - fedora-* +decision_context: bodhi_update_push_stable +rules: + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} diff --git a/libkcapi-1.1.0-kcapi-hasher_Allow_picking_basename_via_cmdline.patch b/libkcapi-1.1.0-kcapi-hasher_Allow_picking_basename_via_cmdline.patch deleted file mode 100644 index cc33cd6..0000000 --- a/libkcapi-1.1.0-kcapi-hasher_Allow_picking_basename_via_cmdline.patch +++ /dev/null @@ -1,341 +0,0 @@ -From 4986c2c95422f97ca0f8db94ce422a01f9a9fa5e Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Thu, 24 May 2018 08:28:02 +0200 -Subject: [PATCH] kcapi-hasher: Allow picking basename via cmdline - -This makes it possible to run the kcapi-hasher binary directly when -needed (even via the libtool wrapper) and to simplify the hasher tests. ---- - apps/kcapi-hasher.c | 22 ++++++++--- - test/hasher-test.sh | 108 +++++++++++++++++++--------------------------------- - 2 files changed, 57 insertions(+), 73 deletions(-) - -diff --git a/apps/kcapi-hasher.c b/apps/kcapi-hasher.c -index 9a5d2ee..ae88211 100644 ---- a/apps/kcapi-hasher.c -+++ b/apps/kcapi-hasher.c -@@ -117,14 +117,15 @@ static void usage(char *name, int fipscheck) - const char *base = basename(name); - fprintf(stderr, "\n%s - calculation of hash sum (Using Linux Kernel Crypto API)\n", basename(name)); - fprintf(stderr, "\nUsage:\n"); -- fprintf(stderr, "\t%s [OPTION]... -S|-L\n", base); -+ fprintf(stderr, "\t%s [-n BASENAME] [OPTION]... -S|-L\n", base); - if (fipscheck) -- fprintf(stderr, "\t%s [OPTION]... FILE\n", base); -+ fprintf(stderr, "\t%s [-n BASENAME] [OPTION]... FILE\n", base); - else { -- fprintf(stderr, "\t%s [OPTION]... -c FILE\n", base); -- fprintf(stderr, "\t%s [OPTION]... FILE...\n", base); -+ fprintf(stderr, "\t%s [-n BASENAME] [OPTION]... -c FILE\n", base); -+ fprintf(stderr, "\t%s [-n BASENAME] [OPTION]... FILE...\n", base); - } - fprintf(stderr, "\nOptions:\n"); -+ fprintf(stderr, "\t-n --name\t\tForce given application name (sha512hmac/...)\n"); - fprintf(stderr, "\t-S --self-sum\t\tPrint checksum of this binary and exit\n"); - fprintf(stderr, "\t-L --self-sum-lib\tPrint checksum of the libkcapi library and exit\n"); - if (!fipscheck) -@@ -781,12 +782,19 @@ int main(int argc, char *argv[]) - const char *targetfile = NULL; - uint8_t *hmackey_alloc = NULL; - uint8_t *hmackey_mmap = NULL; -+ int opt_index = 0; - int loglevel = 0; - int hmac = 0; - int fipscheck = 0; - int fipshmac = 0; - int selfcheck_mode = SELFCHECK_CHECK; - -+ static const char *opts_name_short = "n:"; -+ static const struct option opts_name[] = { -+ {"name", 1, 0, 'n'}, -+ {0, 0, 0, 0} -+ }; -+ - static const char *opts_short = "c:uh:t:SLqk:K:vbd:P"; - static const struct option opts[] = { - {"help", 0, 0, 0}, -@@ -833,6 +841,11 @@ int main(int argc, char *argv[]) - } - basen = basename(basec); - -+ if (getopt_long(argc, argv, opts_name_short, opts_name, &opt_index) == 'n') -+ basen = optarg; -+ else -+ opt_index = 0; -+ - params_self = &PARAMS_SELF_FIPSCHECK; - if (0 == strncmp(basen, "sha256sum", 9)) { - names = NAMES_SHA256; -@@ -888,7 +901,6 @@ int main(int argc, char *argv[]) - } - - while (1) { -- int opt_index = 0; - int c = getopt_long(argc, argv, opts_short, opts, &opt_index); - - if (-1 == c) -diff --git a/test/hasher-test.sh b/test/hasher-test.sh -index 28c6b5a..f36897b 100755 ---- a/test/hasher-test.sh -+++ b/test/hasher-test.sh -@@ -22,15 +22,18 @@ - - HASHERBIN="${APPDIR}/kcapi-hasher" - find_platform $HASHERBIN --HASHERBIN=$(get_binlocation $HASHERBIN) - --SUMHASHER="${TMPDIR}/md5sum ${TMPDIR}/sha1sum ${TMPDIR}/sha256sum ${TMPDIR}/sha384sum ${TMPDIR}/sha512sum" --HMACHASHER="${TMPDIR}/sha1hmac ${TMPDIR}/sha256hmac ${TMPDIR}/sha384hmac ${TMPDIR}/sha512hmac" -+function run_hasher() { -+ "$HASHERBIN" -n "$@" -+} -+ -+SUMHASHER="md5sum sha1sum sha256sum sha384sum sha512sum" -+HMACHASHER="sha1hmac sha256hmac sha384hmac sha512hmac" - CHKFILE="${TMPDIR}/chk.$$" - ANOTHER="${TMPDIR}/test.$$" - - touch $ANOTHER --trap "rm -f $ANOTHER $CHKFILE $SUMHASHER $HMACHASHER" 0 1 2 3 15 -+trap "rm -f $ANOTHER $CHKFILE" 0 1 2 3 15 - - if [ ! -e $HASHERBIN ] - then -@@ -38,20 +41,10 @@ then - exit 1 - fi - --#although a hard link suffices, we need to copy it --for i in $SUMHASHER $HMACHASHER --do -- #ln $HASHERBIN $i -- cp -f $HASHERBIN $i --done -- --libdir=$(dirname $(realpath ../.libs/libkcapi.so)) --libname=$(realpath ../.libs/libkcapi.so) -- - for hasher in $SUMHASHER $HMACHASHER - do - >$CHKFILE -- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher -c $CHKFILE -+ run_hasher $hasher -c $CHKFILE - if [ $? -eq 0 ] - then - echo_fail "Verification of empty checker file with hasher $hasher did not fail" -@@ -60,7 +53,7 @@ do - fi - - echo >$CHKFILE -- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher -c $CHKFILE -+ run_hasher $hasher -c $CHKFILE - if [ $? -eq 0 ] - then - echo_fail "Verification of empty line checker file with hasher $hasher did not fail" -@@ -68,9 +61,8 @@ do - echo_pass "Failure on empty line checker file for $hasher" - fi - -- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher $0 $ANOTHER | \ -- sed -E 's/(\w+\s)\s/\1*/' >$CHKFILE -- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher -q -c $CHKFILE -+ run_hasher $hasher $0 $ANOTHER | sed -E 's/(\w+\s)\s/\1*/' >$CHKFILE -+ run_hasher $hasher -q -c $CHKFILE - if [ $? -eq 0 ] - then - echo_pass "Parsing checker file with asterisk with $hasher" -@@ -78,8 +70,7 @@ do - echo_fail "Parsing checker file with asterisk (binary mode) with $hasher failed" - fi - -- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher $0 $ANOTHER | \ -- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher -q -c - -+ run_hasher $hasher $0 $ANOTHER | run_hasher $hasher -q -c - - if [ $? -eq 0 ] - then - echo_pass "Checker file '-' interpretation with $hasher" -@@ -87,7 +78,7 @@ do - echo_fail "Checker file '-' interpretation with $hasher failed" - fi - -- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher $0 - <$ANOTHER >/dev/null -+ run_hasher $hasher $0 - <$ANOTHER >/dev/null - if [ $? -eq 0 ] - then - echo_pass "Input file '-' interpretation with $hasher" -@@ -100,16 +91,16 @@ done - - for i in $SUMHASHER - do -- hash=$(basename $i) -- hash=${hash%%sum} - hasher=$i -- i=$(basename $i) -- [ ! -e "$hasher" ] && { -- echo_deact "Hasher $hasher does not exist" -+ hash=${hasher%%sum} -+ i=$(command -v $i) -+ -+ [ -z "$i" ] && { -+ echo_deact "reference application $hasher missing" - continue - } - -- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher $0 $ANOTHER > $CHKFILE -+ run_hasher $hasher $0 $ANOTHER > $CHKFILE - [ $? -ne 0 ] && { - echo_fail "Generation of hashes with hasher $hasher failed" - continue -@@ -131,14 +122,14 @@ do - continue - } - -- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher --status -c $CHKFILE -+ run_hasher $hasher --status -c $CHKFILE - [ $? -ne 0 ] && echo_fail "Verification of checker file $CHKFILE with hasher $hasher failed" - - echo -n 123 >$CHKFILE - - a=$(openssl dgst -$hash -hmac 123 $0 | cut -f 2 -d" ") -- b=$(LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher -K 123 $0 | cut -f 1 -d" ") -- c=$(LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher -k $CHKFILE $0 | cut -f 1 -d" ") -+ b=$(run_hasher $hasher -K 123 $0 | cut -f 1 -d" ") -+ c=$(run_hasher $hasher -k $CHKFILE $0 | cut -f 1 -d" ") - [ x"$a" != x"$b" ] && { - echo_fail "HMAC calculation for $hasher failed (cmdline key)" - continue -@@ -153,23 +144,16 @@ done - - for i in $HMACHASHER - do -- hash=$(basename $i) -- hash=${hash%%hmac} - hasher=$i -- t=$(basename $i) -- i=$(command -v $t) -+ hash=${hasher%%hmac} -+ i=$(command -v $i) - - [ -z "$i" ] && { -- echo_deact "hmaccalc reference application $t missing" -- continue -- } -- -- [ ! -e "$hasher" ] && { -- echo_fail "Hasher $hasher does not exist" -+ echo_deact "hmaccalc reference application $hasher missing" - continue - } - -- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher $0 $ANOTHER > $CHKFILE -+ run_hasher $hasher $0 $ANOTHER > $CHKFILE - [ $? -ne 0 ] && { - echo_fail "Generation of hashes with hasher $hasher failed" - continue -@@ -191,7 +175,7 @@ do - continue - } - -- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher -q -c $CHKFILE -+ run_hasher $hasher -q -c $CHKFILE - if [ $? -ne 0 ] - then - echo_fail "Verification of checker file $CHKFILE with hasher $hasher failed" -@@ -210,13 +194,8 @@ do - ref=${i%%hmac}sum - hasher=$i - -- [ ! -e "$hasher" ] && { -- echo_fail "Hasher $hasher does not exist" -- continue -- } -- -- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $ref $0 $ANOTHER > $CHKFILE -- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher -u -q -c $CHKFILE -+ run_hasher $ref $0 $ANOTHER > $CHKFILE -+ run_hasher $hasher -u -q -c $CHKFILE - if [ $? -ne 0 ] - then - echo_fail "Unkeyed verification with hasher $hasher failed" -@@ -224,8 +203,8 @@ do - echo_pass "Unkeyed verification with hasher $hasher" - fi - -- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher -u $0 $ANOTHER > $CHKFILE -- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $ref --status -c $CHKFILE -+ run_hasher $hasher -u $0 $ANOTHER > $CHKFILE -+ run_hasher $ref --status -c $CHKFILE - if [ $? -ne 0 ] - then - echo_fail "Unkeyed generation of checker file with hasher $hasher failed" -@@ -239,12 +218,10 @@ done - # - # Test hmaccalc's ignored compatibility options: - # --for i in $HMACHASHER -+for hasher in $HMACHASHER - do -- hasher=$i -- - compat="-d -P -b" -- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher $compat $0 $ANOTHER > /dev/null -+ run_hasher $hasher $compat $0 $ANOTHER > /dev/null - if [ $? -ne 0 ] - then - echo_fail "Hasher $hasher does not accept compatiblity options: $compat" -@@ -256,11 +233,9 @@ done - # - # Test hmaccalc's -S option: - # --for i in $HMACHASHER -+for hasher in $HMACHASHER - do -- hasher=$i -- -- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher -S >$CHKFILE -+ run_hasher $hasher -S >$CHKFILE - if [ $? -ne 0 ] - then - echo_fail "Hasher $hasher does not accept the -S option" -@@ -277,11 +252,9 @@ done - # - # Test hmaccalc's -h option: - # --for i in $HMACHASHER -+for hasher in $HMACHASHER - do -- hasher=$i -- -- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher -h sha1 $0 $ANOTHER >$CHKFILE -+ run_hasher $hasher -h sha1 $0 $ANOTHER >$CHKFILE - if [ $? -ne 0 ] - then - echo_fail "Hasher $hasher does not accept the -h option" -@@ -289,8 +262,7 @@ do - continue - fi - -- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $TMPDIR/sha1hmac $0 $ANOTHER | \ -- diff $CHKFILE - -+ run_hasher sha1hmac $0 $ANOTHER | diff $CHKFILE - - if [ $? -ne 0 ] - then - echo_fail "Hasher $hasher does not work correctly with the -h option" -@@ -328,7 +300,7 @@ function run_kat() { - expand_string "$data" >"$ANOTHER" - echo "${result#0x} $ANOTHER" >"$CHKFILE" - -- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname "${TMPDIR}/$hasher" -q \ -+ run_hasher $hasher -q \ - -k <(expand_string "$key") -c "$CHKFILE" $truncate_opt - if [ $? -ne 0 ] - then -@@ -337,7 +309,7 @@ function run_kat() { - echo_pass "Verification of hasher $hasher -c ... with KAT '$id'" - fi - -- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname "${TMPDIR}/$hasher" -q \ -+ run_hasher $hasher -q \ - -k <(expand_string "$key") "$ANOTHER" $truncate_opt \ - | diff - "$CHKFILE" - if [ $? -ne 0 ] diff --git a/libkcapi-1.1.0-kcapi-hasher_Fix_FIPS_self-check_always_failing.patch b/libkcapi-1.1.0-kcapi-hasher_Fix_FIPS_self-check_always_failing.patch deleted file mode 100644 index 6c9b72f..0000000 --- a/libkcapi-1.1.0-kcapi-hasher_Fix_FIPS_self-check_always_failing.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 3a860a5d5231e4912d4611397752f2010467a578 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Mon, 16 Apr 2018 19:35:57 +0200 -Subject: [PATCH] kcapi-hasher: Fix FIPS self-check always failing - ---- - apps/kcapi-hasher.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/apps/kcapi-hasher.c b/apps/kcapi-hasher.c -index 861db79..a5e9c71 100644 ---- a/apps/kcapi-hasher.c -+++ b/apps/kcapi-hasher.c -@@ -583,6 +583,7 @@ static int process_checkfile(const struct hash_params *params, - if (ret >= 0) - ret++; - } -+ checked_any = 1; - } else { - /* - * fipscheck does not have the filename in the check -@@ -591,11 +592,10 @@ static int process_checkfile(const struct hash_params *params, - if (targetfile) { - ret = hasher(handle, params, targetfile, - hexhash, hexhashlen + 1, stdout); -+ checked_any = 1; - goto out; - } - } -- -- checked_any = 1; - } - - out: diff --git a/libkcapi-1.1.0-kcapi-hasher_Fix_FIPS_self-check_of_the_libkcapi_library.patch b/libkcapi-1.1.0-kcapi-hasher_Fix_FIPS_self-check_of_the_libkcapi_library.patch deleted file mode 100644 index de5bb83..0000000 --- a/libkcapi-1.1.0-kcapi-hasher_Fix_FIPS_self-check_of_the_libkcapi_library.patch +++ /dev/null @@ -1,373 +0,0 @@ -From 1ce0b18e588e226f4e9dcc3897236ae938b9d4dd Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Wed, 18 Apr 2018 10:03:49 +0200 -Subject: [PATCH 1/4] kcapi-hasher: Use consistent lib self-check params - -Since the various hasher tools use different HMAC parameters (hash, -key) and they all need to check the libkcapi library, it is necessary -to use a consistent set of parameters for the library itself. - -This patch changes the behavior to always check the library using the -fipscheck hash and key. ---- - apps/kcapi-hasher.c | 12 +++++++----- - 1 file changed, 7 insertions(+), 5 deletions(-) - -diff --git a/apps/kcapi-hasher.c b/apps/kcapi-hasher.c -index 480a019..1d76e1d 100644 ---- a/apps/kcapi-hasher.c -+++ b/apps/kcapi-hasher.c -@@ -611,7 +611,8 @@ static int process_checkfile(const struct hash_params *params, - - } - --static int fipscheck_self(const struct hash_params *params, int just_print) -+static int fipscheck_self(const struct hash_params *params_bin, -+ const struct hash_params *params_lib, int just_print) - { - char *checkfile = NULL; - uint32_t n = 0; -@@ -668,7 +669,7 @@ static int fipscheck_self(const struct hash_params *params, int just_print) - } - - if (just_print) { -- ret = hash_files(params, names, 1, 0, 1); -+ ret = hash_files(params_bin, names, 1, 0, 1); - goto out; - } - -@@ -678,7 +679,7 @@ static int fipscheck_self(const struct hash_params *params, int just_print) - goto out; - } - -- ret = process_checkfile(params, checkfile, selfname, CHK_STATUS); -+ ret = process_checkfile(params_bin, checkfile, selfname, CHK_STATUS); - if (ret) - goto out; - -@@ -710,7 +711,7 @@ static int fipscheck_self(const struct hash_params *params, int just_print) - goto out; - } - -- ret = process_checkfile(params, checkfile, selfname, CHK_STATUS); -+ ret = process_checkfile(params_lib, checkfile, selfname, CHK_STATUS); - - out: - if (checkfile) -@@ -1010,7 +1011,8 @@ int main(int argc, char *argv[]) - } - } - -- if (fipscheck_self(params_self, print_self_hash)) { -+ /* library self-check must be consistent across apps: */ -+ if (fipscheck_self(params_self, &PARAMS_SELF_FIPSCHECK, print_self_hash)) { - fprintf(stderr, "Integrity check of application %s failed\n", - basen); - ret = 1; - -From c69e77d4abd5b77a3f396abb816af1df8c9a7733 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Wed, 18 Apr 2018 11:59:11 +0200 -Subject: [PATCH 2/4] Makefile.am: Properly install checksum files - ---- - Makefile.am | 19 ++++++++++++++----- - 1 file changed, 14 insertions(+), 5 deletions(-) - -diff --git a/Makefile.am b/Makefile.am -index ed724fe..07e2451 100644 ---- a/Makefile.am -+++ b/Makefile.am -@@ -139,16 +139,25 @@ EXTRA_bin_kcapi_hasher_DEPENDENCIES = libtool - - SCAN_FILES += $(bin_kcapi_hasher_SOURCES) - --kcapi_hasher_links = sha1sum sha224sum sha256sum sha384sum sha512sum \ -- md5sum fipscheck fipshmac \ -- sha1hmac sha224hmac sha256hmac sha384hmac sha512hmac -+hasher_links_fc = sha1sum sha224sum sha256sum sha384sum sha512sum \ -+ md5sum fipscheck fipshmac -+hasher_links_hc = sha1hmac sha224hmac sha256hmac sha384hmac sha512hmac -+hasher_links = $(hasher_links_fc) $(hasher_links_hc) -+ -+CHECKSUM_CMD_FC = $(OPENSSL) sha256 -r -hmac orboDeJITITejsirpADONivirpUkvarP -+CHECKSUM_CMD_HC = $(OPENSSL) sha512 -r -hmac FIPS-FTW-RHT2009 - - install-exec-hook: - (cd $(DESTDIR)$(bindir) && \ -- ($(foreach link, $(kcapi_hasher_links), $(LN) -f kcapi-hasher $(link);))) -+ ($(foreach link, $(hasher_links), $(LN) -f kcapi-hasher $(link);))) - if HAVE_OPENSSL - (cd $(DESTDIR)$(bindir) && \ -- ($(foreach link, $(kcapi_hasher_links), $(OPENSSL) sha256 -hmac orboDeJITITejsirpADONivirpUkvarP $(link) > $(CHECK_PREFIX)$(link).$(CHECK_SUFFIX);))) -+ ($(foreach link, $(hasher_links_fc), \ -+ $(CHECKSUM_CMD_FC) $(link) > $(CHECK_PREFIX)$(link).$(CHECK_SUFFIX);) \ -+ $(foreach link, $(hasher_links_hc), \ -+ $(CHECKSUM_CMD_HC) $(link) > $(CHECK_PREFIX)$(link).$(CHECK_SUFFIX);):)) -+ ($(foreach lib, $(wildcard $(DESTDIR)$(libdir)/libkcapi.so*), \ -+ $(CHECKSUM_CMD_FC) $(lib) > $(CHECK_PREFIX)$(lib).$(CHECK_SUFFIX);):) - endif - endif - - -From a90c618490385d9d6214dd4918dd679b0be0df9f Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Wed, 18 Apr 2018 12:17:59 +0200 -Subject: [PATCH 3/4] kcapi-hasher: Add -L option for completeness - -Since kcapi-hasher also checks the checksum of the libkcapi library, add --L option to print the checksum of the library. ---- - apps/kcapi-hasher.c | 130 ++++++++++++++++++++++++++++++---------------------- - 1 file changed, 75 insertions(+), 55 deletions(-) - -diff --git a/apps/kcapi-hasher.c b/apps/kcapi-hasher.c -index 1d76e1d..7890060 100644 ---- a/apps/kcapi-hasher.c -+++ b/apps/kcapi-hasher.c -@@ -114,7 +114,7 @@ static void usage(char *name, int fipscheck) - const char *base = basename(name); - fprintf(stderr, "\n%s - calculation of hash sum (Using Linux Kernel Crypto API)\n", basename(name)); - fprintf(stderr, "\nUsage:\n"); -- fprintf(stderr, "\t%s [OPTION]... -S\n", base); -+ fprintf(stderr, "\t%s [OPTION]... -S|-L\n", base); - if (fipscheck) - fprintf(stderr, "\t%s [OPTION]... FILE\n", base); - else { -@@ -123,6 +123,7 @@ static void usage(char *name, int fipscheck) - } - fprintf(stderr, "\nOptions:\n"); - fprintf(stderr, "\t-S --self-sum\t\tPrint checksum of this binary and exit\n"); -+ fprintf(stderr, "\t-L --self-sum-lib\tPrint checksum of the libkcapi library and exit\n"); - if (!fipscheck) - fprintf(stderr, "\t-c --check FILE\t\tVerify hash sums from file\n"); - fprintf(stderr, "\t-u --unkeyed\t\tForce unkeyed hash\n"); -@@ -611,8 +612,13 @@ static int process_checkfile(const struct hash_params *params, - - } - -+/* self-check modes: */ -+#define SELFCHECK_CHECK 0 -+#define SELFCHECK_PRINT_SELF 1 -+#define SELFCHECK_PRINT_LIB 2 -+ - static int fipscheck_self(const struct hash_params *params_bin, -- const struct hash_params *params_lib, int just_print) -+ const struct hash_params *params_lib, int mode) - { - char *checkfile = NULL; - uint32_t n = 0; -@@ -626,9 +632,9 @@ static int fipscheck_self(const struct hash_params *params_bin, - void *dl = NULL, *sym; - - #ifdef HAVE_SECURE_GETENV -- if (secure_getenv("KCAPI_HASHER_FORCE_FIPS") || just_print) { -+ if (secure_getenv("KCAPI_HASHER_FORCE_FIPS") || mode != SELFCHECK_CHECK) { - #else -- if (getenv("KCAPI_HASHER_FORCE_FIPS") || just_print) { -+ if (getenv("KCAPI_HASHER_FORCE_FIPS") || mode != SELFCHECK_CHECK) { - #endif - fipsflag[0] = 1; - } else { -@@ -660,58 +666,68 @@ static int fipscheck_self(const struct hash_params *params_bin, - } - - /* Integrity check of our application. */ -- memset(selfname, 0, sizeof(selfname)); -- selfnamesize = readlink("/proc/self/exe", selfname, BUFSIZE); -- if (selfnamesize >= BUFSIZE || selfnamesize < 0) { -- fprintf(stderr, "Cannot obtain my filename\n"); -- ret = -EFAULT; -- goto out; -- } -+ if (mode == SELFCHECK_CHECK || mode == SELFCHECK_PRINT_SELF) { -+ memset(selfname, 0, sizeof(selfname)); -+ selfnamesize = readlink("/proc/self/exe", selfname, BUFSIZE); -+ if (selfnamesize >= BUFSIZE || selfnamesize < 0) { -+ fprintf(stderr, "Cannot obtain my filename\n"); -+ ret = -EFAULT; -+ goto out; -+ } - -- if (just_print) { -- ret = hash_files(params_bin, names, 1, 0, 1); -- goto out; -- } -+ if (mode == SELFCHECK_PRINT_SELF) { -+ ret = hash_files(params_bin, names, 1, 0, 1); -+ goto out; -+ } - -- checkfile = get_hmac_file(selfname); -- if (!checkfile) { -- ret = -ENOMEM; -- goto out; -- } -+ checkfile = get_hmac_file(selfname); -+ if (!checkfile) { -+ ret = -ENOMEM; -+ goto out; -+ } - -- ret = process_checkfile(params_bin, checkfile, selfname, CHK_STATUS); -- if (ret) -- goto out; -+ ret = process_checkfile(params_bin, checkfile, selfname, CHK_STATUS); -+ if (ret) -+ goto out; -+ } - - /* Integrity check of shared libkcapi.so file. */ -- memset(selfname, 0, sizeof(selfname)); -- snprintf(selfname, (sizeof(selfname) - 1), "libkcapi.so.%u", -- KCAPI_MAJVERSION); -- dl = dlopen(selfname, RTLD_NODELETE|RTLD_NOLOAD|RTLD_LAZY); -- if (dl == NULL) { -- fprintf(stderr, "dlopen of file %s failed\n", selfname); -- ret = -EFAULT; -- goto out; -- } -+ if (mode == SELFCHECK_CHECK || mode == SELFCHECK_PRINT_LIB) { -+ memset(selfname, 0, sizeof(selfname)); -+ snprintf(selfname, (sizeof(selfname) - 1), "libkcapi.so.%u", -+ KCAPI_MAJVERSION); -+ dl = dlopen(selfname, RTLD_NODELETE|RTLD_NOLOAD|RTLD_LAZY); -+ if (dl == NULL) { -+ fprintf(stderr, "dlopen of file %s failed\n", selfname); -+ ret = -EFAULT; -+ goto out; -+ } - -- memset(selfname, 0, sizeof(selfname)); -- sym = dlsym(dl, "kcapi_md_init"); -- if (sym == NULL || !dladdr(sym, &info)) { -- fprintf(stderr, "finding symbol kcapi_md_init failed\n"); -- ret = -EFAULT; -- goto out; -- } -+ memset(selfname, 0, sizeof(selfname)); -+ sym = dlsym(dl, "kcapi_md_init"); -+ if (sym == NULL || !dladdr(sym, &info)) { -+ fprintf(stderr, "finding symbol kcapi_md_init failed\n"); -+ ret = -EFAULT; -+ goto out; -+ } - -- strncpy(selfname, info.dli_fname, (sizeof(selfname) - 1)); -+ strncpy(selfname, info.dli_fname, (sizeof(selfname) - 1)); - -- free(checkfile); -- checkfile = get_hmac_file(selfname); -- if (!checkfile) { -- ret = -ENOMEM; -- goto out; -- } -+ if (mode == SELFCHECK_PRINT_LIB) { -+ ret = hash_files(params_lib, names, 1, 0, 1); -+ goto out; -+ } -+ -+ if (checkfile) -+ free(checkfile); -+ checkfile = get_hmac_file(selfname); -+ if (!checkfile) { -+ ret = -ENOMEM; -+ goto out; -+ } - -- ret = process_checkfile(params_lib, checkfile, selfname, CHK_STATUS); -+ ret = process_checkfile(params_lib, checkfile, selfname, CHK_STATUS); -+ } - - out: - if (checkfile) -@@ -753,9 +769,9 @@ int main(int argc, char *argv[]) - int hmac = 0; - int fipscheck = 0; - int fipshmac = 0; -- int print_self_hash = 0; -+ int selfcheck_mode = SELFCHECK_CHECK; - -- static const char *opts_short = "c:uh:t:Sqk:K:vbd:P"; -+ static const char *opts_short = "c:uh:t:SLqk:K:vbd:P"; - static const struct option opts[] = { - {"help", 0, 0, 0}, - {"tag", 0, 0, 0}, -@@ -765,6 +781,7 @@ int main(int argc, char *argv[]) - {"hash", 1, 0, 'h'}, - {"truncate", 1, 0, 't'}, - {"self-sum", 0, 0, 'S'}, -+ {"self-sum-lib", 0, 0, 'L'}, - {"status", 0, 0, 'q'}, - {"key-file", 1, 0, 'k'}, - {"key", 1, 0, 'K'}, -@@ -932,7 +949,10 @@ int main(int argc, char *argv[]) - params.hashlen /= 8; - break; - case 'S': -- print_self_hash = 1; -+ selfcheck_mode = SELFCHECK_PRINT_SELF; -+ break; -+ case 'L': -+ selfcheck_mode = SELFCHECK_PRINT_LIB; - break; - case 'q': - loglevel = CHK_STATUS; -@@ -998,28 +1018,28 @@ int main(int argc, char *argv[]) - } - } - -- if (print_self_hash) { -+ if (selfcheck_mode != SELFCHECK_CHECK) { - if (checkfile) { -- fprintf(stderr, "-S and -c cannot be combined\n"); -+ fprintf(stderr, "-S/-L and -c cannot be combined\n"); - ret = 1; - goto out; - } - if (optind != argc) { -- fprintf(stderr, "-S cannot be used with input files\n"); -+ fprintf(stderr, "-S/-L cannot be used with input files\n"); - ret = 1; - goto out; - } - } - - /* library self-check must be consistent across apps: */ -- if (fipscheck_self(params_self, &PARAMS_SELF_FIPSCHECK, print_self_hash)) { -+ if (fipscheck_self(params_self, &PARAMS_SELF_FIPSCHECK, selfcheck_mode)) { - fprintf(stderr, "Integrity check of application %s failed\n", - basen); - ret = 1; - goto out; - } - -- if (print_self_hash) { -+ if (selfcheck_mode != SELFCHECK_CHECK) { - ret = 0; - goto out; - } - -From 7b176840ff60bc596a7c80685ef0a81adbc00e4b Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Thu, 19 Apr 2018 10:39:12 +0200 -Subject: [PATCH 4/4] Makefile.am: Do not install kcapi-hasher binary - -The kcapi-hasher binary is not usable on its own so it can be removed -after hard-linking the actual hasher tools. ---- - Makefile.am | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/Makefile.am b/Makefile.am -index 07e2451..383da75 100644 ---- a/Makefile.am -+++ b/Makefile.am -@@ -150,6 +150,7 @@ CHECKSUM_CMD_HC = $(OPENSSL) sha512 -r -hmac FIPS-FTW-RHT2009 - install-exec-hook: - (cd $(DESTDIR)$(bindir) && \ - ($(foreach link, $(hasher_links), $(LN) -f kcapi-hasher $(link);))) -+ -rm -f $(DESTDIR)$(bindir)/kcapi-hasher - if HAVE_OPENSSL - (cd $(DESTDIR)$(bindir) && \ - ($(foreach link, $(hasher_links_fc), \ diff --git a/libkcapi-1.1.0-kcapi-hasher_Fix_buffer_overrun_in_get_hmac_file.patch b/libkcapi-1.1.0-kcapi-hasher_Fix_buffer_overrun_in_get_hmac_file.patch deleted file mode 100644 index eaea641..0000000 --- a/libkcapi-1.1.0-kcapi-hasher_Fix_buffer_overrun_in_get_hmac_file.patch +++ /dev/null @@ -1,23 +0,0 @@ -From f8e032f150522c17094e36dcf62ec3ebc77e69d8 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Mon, 16 Apr 2018 15:39:03 +0200 -Subject: [PATCH] kcapi-hasher: Fix buffer overrun in get_hmac_file - -We need to allocate space also for the terminating null character... ---- - apps/kcapi-hasher.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/apps/kcapi-hasher.c b/apps/kcapi-hasher.c -index 861db79..2b87a45 100644 ---- a/apps/kcapi-hasher.c -+++ b/apps/kcapi-hasher.c -@@ -360,7 +360,7 @@ static char *get_hmac_file(const char *filename) - fprintf(stderr, "File too long\n"); - return NULL; - } -- checkfile = malloc(filelen + prefixlen + 1 + suffixlen); -+ checkfile = malloc(filelen + prefixlen + 1 + suffixlen + 1); - if (!checkfile) - return NULL; - diff --git a/libkcapi.spec b/libkcapi.spec index 75f9318..9338486 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -1,17 +1,42 @@ # Shared object version of libkcapi. %global vmajor 1 -%global vminor 1 +%global vminor 5 %global vpatch 0 # Do we build the replacements packages? %bcond_with replace_coreutils +# Replace fipscheck by default in Fedora 33+: +%if 0%{?fedora} >= 33 || 0%{?rhel} >= 9 +%bcond_without replace_fipscheck +%else %bcond_with replace_fipscheck +%endif # Replace hmaccalc by default in Fedora 28+: %if 0%{?fedora} >= 28 || 0%{?rhel} >= 8 %bcond_without replace_hmaccalc %else %bcond_with replace_hmaccalc %endif +%if 0%{?fedora} >= 29 || 0%{?rhel} >= 8 +%bcond_without test_package +%else +%bcond_with test_package +%endif +# disable cppcheck analysis in ELN/RHEL to avoid the dependency bz#1931518 +%if 0%{?rhel} +%bcond_with cppcheck +%else +%bcond_without cppcheck +%endif + +# Use `--without test` to build without running the tests +%bcond_without test +# Use `--without fuzz_test` to skip the fuzz test during build +%bcond_without fuzz_test +# Use `--without doc` to build without the -doc subpackage +%bcond_without doc +# Use `--without clang_sa` to skip clang static analysis during build +%bcond_without clang_sa # This package needs at least Linux Kernel v4.10.0. %global min_kernel_ver 4.10.0 @@ -51,8 +76,7 @@ # Do we replace fipscheck? %if %{with replace_fipscheck} -# TODO: Adapt this when replacing fipscheck initially. -%global fipscheck_evr 1.5.0-3%{?dist} +%global fipscheck_evr 1.5.0-9 %endif # Do we replace hmaccalc? @@ -60,67 +84,69 @@ %global hmaccalc_evr 0.9.14-10%{?dist} %endif -%global apps_hmaccalc sha1hmac sha224hmac sha256hmac sha384hmac sha512hmac -%global apps_fipscheck sha1sum sha224sum sha256sum sha384sum sha512sum md5sum fipscheck fipshmac +%global apps_coreutils sha1sum sha224sum sha256sum sha384sum sha512sum md5sum sm3sum +%global apps_hmaccalc sha1hmac sha224hmac sha256hmac sha384hmac sha512hmac sm3hmac +%global apps_fipscheck fipscheck fipshmac -# Add generation of HMAC checksums of the final stripped -# binaries. %%define with lazy globbing is used here +# On old kernels use mock hashers implemented via openssl +%if %{lua:print(rpm.vercmp(posix.uname('%r'), '3.19'));} >= 0 +%global sha512hmac bin/kcapi-hasher -n sha512hmac +%global fipshmac bin/kcapi-hasher -n fipshmac +%else +%global sha512hmac bash %{SOURCE2} +%global fipshmac bash %{SOURCE3} +%endif + +# Add generation of HMAC checksum of the final stripped +# binary. %%define with lazy globbing is used here # intentionally, because using %%global does not work. %define __spec_install_post \ %{?__debug_package:%{__debug_install_post}} \ %{__arch_install_post} \ %{__os_install_post} \ bin_path=%{buildroot}%{_bindir} \ -lib_path=%{buildroot}/%{_lib} \ -for app in %{apps_hmaccalc}; do \ - test -e "$bin_path"/$app || continue \ - { bin/kcapi-hasher -n sha512hmac "$bin_path"/$app || exit 1; } \\\ - | cut -f 1 -d ' ' >"$bin_path"/.$app.hmac \ -done \ -for app in %{apps_fipscheck}; do \ - test -e "$bin_path"/$app || continue \ - bin/kcapi-hasher -n fipshmac "$bin_path"/$app || exit 1 \ -done \ -%{_sbindir}/hardlink -cfv %{buildroot}%{_bindir} \ -bin/kcapi-hasher -n fipshmac "$lib_path"/libkcapi.so.%{version} \\\ - || exit 1 \ -%{__ln_s} .libkcapi.so.%{version}.hmac \\\ - "$lib_path"/.libkcapi.so.%{vmajor}.hmac \ +lib_path=%{buildroot}%{_libdir} \ +{ %sha512hmac "$bin_path"/kcapi-hasher || exit 1; } | \\\ + cut -f 1 -d ' ' >"$lib_path"/hmaccalc/kcapi-hasher.hmac \ +{ %sha512hmac "$lib_path"/libkcapi.so.%{version} || exit 1; } | \\\ + cut -f 1 -d ' ' >"$lib_path"/hmaccalc/libkcapi.so.%{version}.hmac \ +%{__ln_s} libkcapi.so.%{version}.hmac \\\ + "$lib_path"/hmaccalc/libkcapi.so.%{vmajor}.hmac \ %{nil} - Name: libkcapi Version: %{vmajor}.%{vminor}.%{vpatch} -Release: 5%{?dist} +Release: %autorelease Summary: User space interface to the Linux Kernel Crypto API -License: BSD or GPLv2 -URL: http://www.chronox.de/%{name}.html -Source0: http://www.chronox.de/%{name}/%{name}-%{version}.tar.xz -Source1: http://www.chronox.de/%{name}/%{name}-%{version}.tar.xz.asc +License: BSD-3-Clause OR GPL-2.0-only +URL: https://www.chronox.de/%{name}/ +Source0: https://www.chronox.de/%{name}/releases/%{version}/%{name}-%{version}.tar.xz +Source1: https://www.chronox.de/%{name}/releases/%{version}/%{name}-%{version}.tar.xz.asc +Source2: sha512hmac-openssl.sh +Source3: fipshmac-openssl.sh -Patch0: %{giturl}/pull/52.patch#/%{name}-1.1.0-kcapi-hasher_Fix_buffer_overrun_in_get_hmac_file.patch -Patch1: %{giturl}/pull/53.patch#/%{name}-1.1.0-kcapi-hasher_Fix_FIPS_self-check_always_failing.patch -Patch2: %{giturl}/pull/54.patch#/%{name}-1.1.0-kcapi-hasher_Fix_FIPS_self-check_of_the_libkcapi_library.patch -Patch3: %{giturl}/pull/57.patch#/%{name}-1.1.0-kcapi-hasher_Allow_picking_basename_via_cmdline.patch - -BuildRequires: clang +BuildRequires: bash BuildRequires: coreutils -BuildRequires: cppcheck -BuildRequires: docbook-utils-pdf BuildRequires: gcc -BuildRequires: git +BuildRequires: git-core BuildRequires: hardlink +BuildRequires: kernel-headers >= %{min_kernel_ver} BuildRequires: libtool +BuildRequires: make BuildRequires: openssl +BuildRequires: perl-interpreter BuildRequires: systemd BuildRequires: xmlto - -# To make sure this is not buildable nor installable if the -# available Linux Kernel does not support the Linux Kernel -# Crypto API User Space Interface. -BuildRequires: kernel-headers >= %{min_kernel_ver} -Requires: kernel >= %{min_kernel_ver} +%if %{with doc} +BuildRequires: docbook-utils-pdf +%endif +%if %{with clang_sa} +BuildRequires: clang +%endif +%if %{with cppcheck} +BuildRequires: cppcheck >= 2.4 +%endif # For ownership of %%{_sysctldir}. Requires: systemd @@ -150,18 +176,32 @@ Requires: %{name}%{?_isa} == %{version}-%{release} Header files for applications that use %{name}. +%if %{with doc} %package doc Summary: User documentation for the %{name} package BuildArch: noarch +# Depend on one of the base packages because they have the license files +# We cannot just bundle them into doc because they might conflict with an +# older or newer version of the base package. +Requires: %{name} == %{version}-%{release} %description doc User documentation for %{name}. +%endif + + +%package hasher +Summary: Common %{name} hashing application +Requires: %{name}%{?_isa} == %{version}-%{release} + +%description hasher +Provides The kcapi-hasher binary used by other %{name} subpackages. %if %{with replace_coreutils} %package checksum Summary: Drop-in replacement for *sum utils provided by the %{name} package -Requires: %{name}%{?_isa} == %{version}-%{release} +Requires: %{name}-hasher%{?_isa} == %{version}-%{release} Requires: coreutils%{?_isa} >= %{coreutils_evr} @@ -177,7 +217,7 @@ coreutils) using %{name}. %if %{with replace_fipscheck} %package fipscheck Summary: Drop-in replacements for fipscheck/fipshmac provided by the %{name} package -Requires: %{name}%{?_isa} == %{version}-%{release} +Requires: %{name}-hasher%{?_isa} == %{version}-%{release} Obsoletes: fipscheck <= %{fipscheck_evr} @@ -193,7 +233,7 @@ package fipscheck) using %{name}. %if %{with replace_hmaccalc} %package hmaccalc Summary: Drop-in replacements for hmaccalc provided by the %{name} package -Requires: %{name}%{?_isa} == %{version}-%{release} +Requires: %{name}-hasher%{?_isa} == %{version}-%{release} Obsoletes: hmaccalc <= %{hmaccalc_evr} @@ -218,7 +258,8 @@ is highly discouraged. %package tools Summary: Utility applications for the %{name} package -Requires: %{name}%{?_isa} == %{version}-%{release} +Requires: %{name}%{?_isa} == %{version}-%{release} +Requires: %{name}-hasher%{?_isa} == %{version}-%{release} %description tools Utility applications that are provided with %{name}. This includes @@ -226,9 +267,33 @@ tools to use message digests, symmetric ciphers and random number generators implemented in the Linux kernel from command line. +%if %{with test_package} +%package tests +Summary: Testing scripts for the %{name} package +Requires: %{name}%{?_isa} == %{version}-%{release} +Requires: %{name}-tools%{?_isa} == %{version}-%{release} +%if %{with replace_hmaccalc} +Requires: %{name}-hmaccalc%{?_isa} == %{version}-%{release} +%endif +%if %{with replace_coreutils} +Requires: %{name}-checksum%{?_isa} == %{version}-%{release} +%endif +Requires: coreutils +Requires: openssl +Requires: perl-interpreter + +%description tests +Auxiliary scripts for testing %{name}. +%endif + + %prep %autosetup -p 1 -S git +# Work around https://bugzilla.redhat.com/show_bug.cgi?id=2258240 +sed -i -e 's|XML V45|XML V4.1.2|' -e 's|/xml/4\.5/|/xml/4.1.2/|' \ + lib/doc/libkcapi.tmpl + %if %{with_sysctl_tweak} %{__cat} << EOF > README.%{distroname_ext} This package increases the default limit of the ancillary buffer size @@ -263,16 +328,12 @@ net.core.optmem_max = %{sysctl_optmem_max} EOF %endif -%ifarch %{power64} -%{__sed} -i -e 's!exit \$failures!#&!' test/kcapi-enc-test.sh -%endif - %{_bindir}/autoreconf -fiv %build %configure \ - --libdir=/%{_lib} \ + --libdir=%{_libdir} \ --disable-silent-rules \ --enable-kcapi-encapp \ --enable-kcapi-dgstapp \ @@ -282,9 +343,14 @@ EOF --enable-kcapi-test \ --enable-shared \ --enable-static \ - --enable-sum-prefix=. \ + --enable-sum-prefix= \ + --enable-sum-dir=%{_libdir} \ --with-pkgconfigdir=%{_libdir}/pkgconfig +%if %{with doc} %make_build all doc +%else +%make_build all man +%endif %install @@ -301,22 +367,32 @@ EOF %if %{with_sysctl_tweak} README.%{distroname_ext} \ %endif - README.md CHANGES TODO doc/%{name}.p{df,s} +%if %{with doc} + doc/%{name}.p{df,s} \ +%endif + README.md CHANGES.md TODO + +%if %{with doc} %{__cp} -pr lib/doc/html %{buildroot}%{_pkgdocdir} +%endif # Install replacement tools, if enabled. -%if !%{with replace_coreutils} -%{__rm} -f \ - %{buildroot}%{_bindir}/md5sum \ - %{buildroot}%{_bindir}/sha*sum +%if %{with replace_coreutils} +for app in %apps_coreutils; do + %{__ln_s} ../libexec/libkcapi/$app %{buildroot}%{_bindir}/$app +done %endif -%if !%{with replace_fipscheck} -%{__rm} -f %{buildroot}%{_bindir}/fips* +%if %{with replace_fipscheck} +for app in %apps_fipscheck; do + %{__ln_s} ../libexec/libkcapi/$app %{buildroot}%{_bindir}/$app +done %endif -%if !%{with replace_hmaccalc} -%{__rm} -f %{buildroot}%{_bindir}/sha*hmac +%if %{with replace_hmaccalc} +for app in %apps_hmaccalc; do + %{__ln_s} ../libexec/libkcapi/$app %{buildroot}%{_bindir}/$app +done %endif # We don't ship autocrap dumplings. @@ -328,35 +404,51 @@ EOF # Remove 0-size files. %{_bindir}/find %{buildroot} -type f -size 0 -print -delete +%if %{with doc} # Make sure all docs have non-exec permissions, except for the dirs. %{_bindir}/find %{buildroot}%{_pkgdocdir} -type f -print | \ %{_bindir}/xargs %{__chmod} -c 0644 %{_bindir}/find %{buildroot}%{_pkgdocdir} -type d -print | \ %{_bindir}/xargs %{__chmod} -c 0755 +%endif # Possibly save some space by hardlinking. for d in %{_mandir} %{_pkgdocdir}; do - %{_sbindir}/hardlink -cfv %{buildroot}$d + %{_bindir}/hardlink -cfv %{buildroot}$d done %check # Some basic sanity checks. -for t in cppcheck scan; do - %make_build $t -done +%if %{with clang_sa} +%make_build scan +%endif +%if %{with cppcheck} +# -UCHECK_DIR: string literal concatenation raises syntaxError +# with cppcheck-2.11 (https://trac.cppcheck.net/ticket/11830) +# --check-level=exhaustive: otherwise it emits warnings that get +# treated like errors +%make_build cppcheck CPPCHECK="cppcheck --check-level=exhaustive -UCHECK_DIR" +%endif +%if %{with test} # On some arches `/proc/sys/net/core/optmem_max` is lower than 20480, # which is the lowest limit needed to run the testsuite. If that limit # is not met, we do not run it. %if %{test_optmem_max} >= 20480 +# Skip the testsuite on old kernels. +%if %{lua:print(rpm.vercmp(posix.uname('%r'), '5.1'));} >= 0 # Real testsuite. pushd test +%if %{with fuzz_test} ENABLE_FUZZ_TEST=1 \ +%endif NO_32BIT_TEST=1 \ ./test-invocation.sh popd %endif +%endif +%endif %ldconfig_scriptlets @@ -366,10 +458,10 @@ popd %doc %dir %{_pkgdocdir} %doc %{_pkgdocdir}/README.md %license COPYING* -/%{_lib}/%{name}.so.%{vmajor} -/%{_lib}/%{name}.so.%{version} -/%{_lib}/.%{name}.so.%{vmajor}.hmac -/%{_lib}/.%{name}.so.%{version}.hmac +%{_libdir}/%{name}.so.%{vmajor} +%{_libdir}/%{name}.so.%{version} +%{_libdir}/hmaccalc/%{name}.so.%{vmajor}.hmac +%{_libdir}/hmaccalc/%{name}.so.%{version}.hmac %if %{with_sysctl_tweak} %doc %{_pkgdocdir}/README.%{distroname_ext} %{_sysctldir}/%{sysctl_prio}-%{name}-optmem_max.conf @@ -377,146 +469,78 @@ popd %files devel -%doc %{_pkgdocdir}/CHANGES +%doc %{_pkgdocdir}/CHANGES.md %doc %{_pkgdocdir}/TODO %{_includedir}/kcapi.h %{_mandir}/man3/kcapi_*.3.* -/%{_lib}/%{name}.so +%{_libdir}/%{name}.so %{_libdir}/pkgconfig/%{name}.pc +%if %{with doc} %files doc -%doc %{_pkgdocdir} -%license %{_datadir}/licenses/%{name}* +%doc %{_pkgdocdir}/html +%doc %{_pkgdocdir}/%{name}.pdf +%doc %{_pkgdocdir}/%{name}.ps +%endif + + +%files hasher +%{_bindir}/kcapi-hasher +%{_libexecdir}/%{name}/md5sum +%{_libexecdir}/%{name}/sha*sum +%{_libexecdir}/%{name}/sm*sum +%{_libexecdir}/%{name}/fips* +%{_libexecdir}/%{name}/sha*hmac +%{_libexecdir}/%{name}/sm*hmac +%{_libdir}/hmaccalc/kcapi-hasher.hmac +%{_mandir}/man1/kcapi-hasher.1.* %if %{with replace_coreutils} %files checksum %{_bindir}/md5sum -%{_bindir}/.md5sum.hmac %{_bindir}/sha*sum -%{_bindir}/.sha*sum.hmac +%{_bindir}/sm*sum %endif %if %{with replace_fipscheck} %files fipscheck %{_bindir}/fips* -%{_bindir}/.fips*.hmac %endif %if %{with replace_hmaccalc} %files hmaccalc %{_bindir}/sha*hmac -%{_bindir}/.sha*hmac.hmac +%{_bindir}/sm*hmac %endif %files static -/%{_lib}/%{name}.a +%{_libdir}/%{name}.a %files tools -%{_bindir}/kcapi* -%{_mandir}/man1/kcapi*.1.* +%{_bindir}/kcapi +%{_bindir}/kcapi-convenience +%{_bindir}/kcapi-dgst +%{_bindir}/kcapi-enc +%{_bindir}/kcapi-enc-test-large +%{_bindir}/kcapi-rng +%{_bindir}/kcapi-speed +%{_mandir}/man1/kcapi-dgst.1.* +%{_mandir}/man1/kcapi-enc.1.* +%{_mandir}/man1/kcapi-rng.1.* + + +%if %{with test_package} +%files tests +%{_libexecdir}/%{name}/kcapi +%{_libexecdir}/%{name}/kcapi-convenience +%{_libexecdir}/%{name}/kcapi-enc-test-large +%{_libexecdir}/%{name}/*.sh +%endif %changelog -* Wed May 09 2018 Ondrej Mosnáček - 1.1.0-5 -- Skip CLang static analysis in RHEL -- Revert "Skip CLang static analysis in RHEL" -- Use own sha512hmac and fipscheck - -* Wed May 02 2018 Ondrej Mosnáček - 1.1.0-4 -- Fix description lines being too long - -* Fri Apr 27 2018 Björn Esser - 1.1.0-3 -- Fix conditional for hmaccalc replacement - -* Mon Apr 16 2018 Ondrej Mosnáček - 1.1.0-2 -- Enable hmaccalc replacements in Fedora 28+ - -* Thu Apr 12 2018 Ondrej Mosnáček - 1.1.0-1 -- Update to upstream version 1.1.0 - -* Sat Mar 31 2018 Björn Esser - 1.0.3-10 -- Replace single patches with a monolitic one from upstream -- Obsolete replacements subpackage -- Ignore failing tests on %%{power64} temporarily - -* Thu Mar 08 2018 Ondrej Mosnáček - 1.0.3-9 -- Split up the replacements subpackage - -* Mon Feb 26 2018 Björn Esser - 1.0.3-8 -- Increase optmem_max preset to 81920 - -* Mon Feb 26 2018 Björn Esser - 1.0.3-7 -- Obsoletes work by package name, not by provides (rhbz#1537225) - -* Sun Feb 25 2018 Björn Esser - 1.0.3-6 -- Add patch to fix a copy-paste typo - -* Sat Feb 17 2018 Björn Esser - 1.0.3-5 -- Add patch to fix build with -Werror - -* Wed Feb 07 2018 Fedora Release Engineering -- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild - -* Sun Feb 04 2018 Björn Esser - 1.0.3-3 -- Switch to %%ldconfig_scriptlets - -* Wed Jan 17 2018 Björn Esser - 1.0.3-2 -- Decrease optmem_max preset to 40960 -- Let the build fail, if the minimum kernel version cannot be met -- Conditionalize the sysctl.d tweak on version of the kernel -- Conditionalize the name of README.distro on the distro - -* Tue Jan 16 2018 Björn Esser - 1.0.3-1 -- Initial import (rhbz#1533929) - -* Tue Jan 16 2018 Björn Esser - 1.0.3-0.13 -- Increase optmem_max preset to 81920 - -* Tue Jan 16 2018 Björn Esser - 1.0.3-0.12 -- Add sysctl.d preset and README.fedora - -* Mon Jan 15 2018 Björn Esser - 1.0.3-0.11 -- Make the contents of the -replacements package configurable - -* Mon Jan 15 2018 Björn Esser - 1.0.3-0.10 -- Fix Obsoletes of the -replacements package - -* Sun Jan 14 2018 Björn Esser - 1.0.3-0.9 -- Disable the -replacements package until we have a plan for it - -* Sun Jan 14 2018 Björn Esser - 1.0.3-0.8 -- Move the kcapi-hasher binary to -replacements package, since it is - not of much use without the linked invocation names and saves the - extra Requires on the -tools package - -* Sun Jan 14 2018 Björn Esser - 1.0.3-0.7 -- Fix internal Requires of sub-packages -- Hardlink files in %%{_bindir} - -* Sun Jan 14 2018 Björn Esser - 1.0.3-0.6 -- Add patches from upstream - -* Sat Jan 13 2018 Björn Esser - 1.0.3-0.5 -- Add patches from upstream - -* Sat Jan 13 2018 Björn Esser - 1.0.3-0.4 -- Asume the testsuite cannot be run, if the value of optmem_max cannot - be obtained - -* Sat Jan 13 2018 Björn Esser - 1.0.3-0.3 -- Move libraries to /%%{_lib} instead of %%{_libdir}, which is useful - during boot when the library might be needed before a potentially - seperate /usr partition is mounted - -* Sat Jan 13 2018 Björn Esser - 1.0.3-0.2 -- Asume optmem_max is at least 20480, if the real value cannot be obtained - -* Fri Jan 12 2018 Björn Esser - 1.0.3-0.1 -- New upstream release - -* Wed Jan 10 2018 Björn Esser - 1.0.2-0.1 -- Initial rpm release (rhbz#1533929) +%autochangelog diff --git a/plans/ci.fmf b/plans/ci.fmf new file mode 100644 index 0000000..d3cd36f --- /dev/null +++ b/plans/ci.fmf @@ -0,0 +1,5 @@ +summary: Run CI tests +discover: + how: fmf +execute: + how: tmt diff --git a/sha512hmac-openssl.sh b/sha512hmac-openssl.sh new file mode 100644 index 0000000..6496394 --- /dev/null +++ b/sha512hmac-openssl.sh @@ -0,0 +1,6 @@ +#!/bin/bash + +# Mocks sha512hmac using the openssl tool. +# Only for use during RPM build. + +openssl sha512 -hmac FIPS-FTW-RHT2009 -hex "$1" | cut -f 2 -d ' ' diff --git a/sources b/sources index f1a22ba..0f7842a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (libkcapi-1.1.0.tar.xz) = 8d7a775a7ac3a16e006cc21a40e0dbc2c068879fb277ef7a96f706aa0a822ee6c29dba59e34a42cc2e3da926ee242fb47b6c1486d846d9028d662bc71e8f25fd -SHA512 (libkcapi-1.1.0.tar.xz.asc) = f2ecc4bc477231a5f2b91476f4d300be32d796cf5f49b0b89e3f5c5735690fe4b6baec3739aa8df99eaac6eac66a63b23ce25e9b16bec17f8748fcac19843968 +SHA512 (libkcapi-1.5.0.tar.xz) = db156ee94fc63815a31876ab072aca72a806b26961c43f2caf8495c53b95484de71cd3be84dc9e5c9560e9ee704979be059ff6c102b4893d6bbdf9a8a69a667a +SHA512 (libkcapi-1.5.0.tar.xz.asc) = 69cfb6bf98f89c503e7fda07a54eddb9fcc2dafe418f1bc1216c051565c214a6caab83495c19b650a5c6e46e22080f8df4dd2152ab364993ed5badd256495159 diff --git a/tests/main.fmf b/tests/main.fmf new file mode 100644 index 0000000..4b6064e --- /dev/null +++ b/tests/main.fmf @@ -0,0 +1,29 @@ +component: libkcapi +contact: Ondrej Mosnacek + +/upstream: + require: [libkcapi-tests] + tier: 1 + + /basic: + summary: Basic functionality + test: /usr/libexec/libkcapi/test.sh + /encrypt: + summary: Encryption/decryption + test: /usr/libexec/libkcapi/kcapi-enc-test.sh + /encrypt-large: + summary: Encryption/decryption of large data + test: /usr/libexec/libkcapi/kcapi-enc-test-large.sh + /digest: + summary: Message digest + test: /usr/libexec/libkcapi/kcapi-dgst-test.sh + /digest-convenience: + summary: Message digest convenience functions + test: /usr/libexec/libkcapi/kcapi-convenience.sh + /hasher: + summary: Checksum helpers + test: /usr/libexec/libkcapi/hasher-test.sh + /fuzz-test: + summary: Fuzz test + test: /usr/libexec/libkcapi/kcapi-fuzz-test.sh + duration: 2h