Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild

- Ship kcapi-hasher manpage in libkcapi-hasher

Signed-off-by: Ondrej Mosnáček <omosnacek@gmail.com>

.fmf/version

@@ -0,0 +1 @@
+1

000-Fix-build-with-gcc-8.2.x.patch

@@ -1,51 +0,0 @@
-From 52620ec798a580b2053d16a42362e9926729eb30 Mon Sep 17 00:00:00 2001
-From: Fabrice Fontaine <fontaine.fabrice@gmail.com>
-Date: Sun, 20 Jan 2019 20:04:13 +0100
-Subject: [PATCH] apps/kcapi-hasher.c: fix build with gcc 8.2.x
-
-Fixes:
- - http://autobuild.buildroot.org/results/8355bc42238e885f7f11ed3d9d37fc55ebdead2b
-
-Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
-Signed-off-by: Stephan Mueller <smueller@chronox.de>
----
- apps/kcapi-hasher.c | 12 ++++++++----
- 1 file changed, 8 insertions(+), 4 deletions(-)
-
-diff --git a/apps/kcapi-hasher.c b/apps/kcapi-hasher.c
-index d6be685..7172b12 100644
---- a/apps/kcapi-hasher.c
-+++ b/apps/kcapi-hasher.c
-@@ -357,16 +357,20 @@ static int hasher(struct kcapi_handle *handle, const struct hash_params *params,
- }
- 
- /*
-- * GCC v8.1.0 introduced -Wstringop-truncation but it is not smart enough to
-- * find that cursor string will be NULL-terminated after all paste() calls and
-- * warns with:
-+ * GCC v8.1.0 introduced -Wstringop-truncation and GCC v8.2.0 introduced
-+ * -Wstringop-overflow but it is not smart enough to find that cursor string
-+ * will be NULL-terminated after all paste() calls and warns with:
-  * error: 'strncpy' destination unchanged after copying no bytes [-Werror=stringop-truncation]
-  * error: 'strncpy' output truncated before terminating nul copying 5 bytes from a string of the same length [-Werror=stringop-truncation]
-+ * error: 'strncpy' specified bound depends on the length of the source argument [-Werror=stringop-overflow=]
-  */
- #pragma GCC diagnostic push
- #if GCC_VERSION >= 80100
- #pragma GCC diagnostic ignored "-Wstringop-truncation"
- #endif
-+#if GCC_VERSION >= 80200
-+#pragma GCC diagnostic ignored "-Wstringop-overflow"
-+#endif
- static char *paste(char *dst, const char *src, size_t size)
- {
- 	strncpy(dst, src, size);
-@@ -417,7 +421,7 @@ static char *get_hmac_file(const char *filename, const char *checkdir)
- 	strncpy(cursor, "\0", 1);
- 	return checkfile;
- }
--#pragma GCC diagnostic pop /* -Wstringop-truncation */
-+#pragma GCC diagnostic pop /* -Wstringop-truncation -Wstringop-overflow */
- 
- static int hash_files(const struct hash_params *params,
- 		      char *filenames[], uint32_t files,

changelog

@@ -0,0 +1,247 @@
+* Sat Aug 13 2022 Ondrej Mosnáček <omosnace@redhat.com> - 1.4.0-2
+- Switch to rpmautospec
+
+* Sat Aug 13 2022 Ondrej Mosnáček <omosnace@redhat.com> - 1.4.0-1
+- Update to upstream version 1.4.0
+- Re-enable cppcheck scanning on Fedora
+- Resolves: rhbz#2056732
+
+* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.3.1-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.3.1-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.3.1-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Wed Jul 14 2021 Simo Sorce <simo@redhat.com> - 1.3.1-2
+- Remove LTO build suppression by using better symver machinery
+
+* Wed Jul 14 2021 Simo Sorce <simo@redhat.com> - 1.3.1-1
+- Update to upstream version 1.3.1 which fixes ABI issues
+
+* Mon Jul 12 2021 Simo Sorce <simo@redhat.com> - 1.3.0-1
+- Update to upstream version 1.3.0
+
+* Mon Mar 15 2021 Sahana Prasad <sahana@redhat.com> - 1.2.1-1
+- Update to upstream version 1.2.1
+- Remove patch fix MSG_MORE uasge as it is added upstream
+- Remove cppcheck dependency for rhel bz#1931518
+- Add a patch to fix fuzz tests
+
+* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.0-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Fri Aug 14 2020 Ondrej Mosnáček <omosnace@redhat.com> - 1.2.0-3
+- Require perl-interpreter instead of full perl
+- Backport fix for 5.9 kernels
+
+* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Mon May 25 2020 Sahana Prasad <omosnace@redhat.com> - 1.2.0-1
+- Update to upstream version 1.2.0 tracked by BZ 1839592.
+- Enable kcapi-enc tests as libkcapi BZ 1826022 is fixed.
+- Remove 110-fipshmac-compat.patch as the changes are merged upstream.
+- Remove 100-workaround-cppcheck-bug.patch as the changes are merged upstream.
+
+* Tue May 05 2020 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.5-5
+- Fix the CI test failures
+- Enable building on old kernels
+- Avoid conflicts between different versions of packages
+
+* Thu Apr 23 2020 Tomáš Mráz <tmraz@redhat.com> - 1.1.5-4
+- Add . prefix to files created by fipshmac if -d option is not specified
+
+* Wed Apr 22 2020 Sahana Prasad <sahana@redhat.com> - 1.1.5-3
+- Disables kcapi-enc tests until the kernel bug bz 1826022 is fixed.
+- Produce also the fipscheck replacement package
+
+* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.5-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Tue Aug 13 2019 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.5-1
+- Update to upstream version 1.1.5
+
+* Sat Jul 27 2019 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.4-6
+- Backport patch to fix test failure on aarch64
+- Remove no longer needed ppc64 workaround
+
+* Sat Jul 27 2019 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.4-5
+- Backport patch to fix tests
+
+* Thu Jul 25 2019 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.4-4
+- Work around cppcheck issue
+- Enable gating
+
+* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.4-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Mon May 27 2019 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.4-2
+- Fix FTBFS: hardlink is now in bindir
+
+* Sat Feb 02 2019 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.4-1
+- Update to upstream version 1.1.4
+
+* Fri Feb 01 2019 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.3-3
+- Fix build with new GCC
+
+* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.3-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Thu Aug 23 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.3-1
+- Update to upstream version 1.1.3
+
+* Thu Aug 09 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-16
+- Add missing dependencies to the tests package
+- Update patch from upstream
+
+* Thu Aug 09 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-15
+- Build and tests require perl
+
+* Thu Aug 09 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-14
+- Add missing script to the 'tests' package
+
+* Wed Aug 08 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-13
+- Add missing requires to the 'tests' subpackage
+
+* Tue Aug 07 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-12
+- Produce a subpackage with test scripts
+- Build the 'tests' subpackage conditionally
+
+* Wed Aug 01 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-11
+- Add patch to fix unwanted closing of FD 0
+
+* Tue Jul 31 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-10
+- Remove the kernel headers workaround
+
+* Fri Jul 27 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 1.1.1-9
+- Rebuild for new binutils
+
+* Fri Jul 27 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-8
+- Add more Coverity fixes from upstream
+- Add patch to fix AEAD fuzz test for BE arches
+- Fixup specfile
+
+* Mon Jul 23 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-7
+- Add various fixes from upstream
+- Drop the Requires on kernel package
+
+* Mon Jul 16 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-6
+- Put .hmac files into a separate directory
+
+* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.1-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
+* Thu Jul 12 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-4
+- Add patch to work around FTBFS on rawhide
+
+* Wed Jul 11 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-3
+- Fix off-by-one error in checkfile parsing
+
+* Wed Jul 11 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-2
+- Fix command-line parsing in libkcapi-hmaccalc
+
+* Mon Jun 18 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-1
+- Update to upstream version 1.1.1
+
+* Wed May 09 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.0-5
+- Skip CLang static analysis in RHEL
+- Revert "Skip CLang static analysis in RHEL"
+- Use own sha512hmac and fipscheck
+
+* Wed May 02 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.0-4
+- Fix description lines being too long
+
+* Fri Apr 27 2018 Björn Esser <besser82@fedoraproject.org> - 1.1.0-3
+- Fix conditional for hmaccalc replacement
+
+* Mon Apr 16 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.0-2
+- Enable hmaccalc replacements in Fedora 28+
+
+* Thu Apr 12 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.0-1
+- Update to upstream version 1.1.0
+
+* Sat Mar 31 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-10
+- Replace single patches with a monolitic one from upstream
+- Obsolete replacements subpackage
+- Ignore failing tests on %%{power64} temporarily
+
+* Thu Mar 08 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.0.3-9
+- Split up the replacements subpackage
+
+* Mon Feb 26 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-8
+- Increase optmem_max preset to 81920
+
+* Mon Feb 26 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-7
+- Obsoletes work by package name, not by provides (rhbz#1537225)
+
+* Sun Feb 25 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-6
+- Add patch to fix a copy-paste typo
+
+* Sat Feb 17 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-5
+- Add patch to fix build with -Werror
+
+* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org>
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
+
+* Sun Feb 04 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-3
+- Switch to %%ldconfig_scriptlets
+
+* Wed Jan 17 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-2
+- Decrease optmem_max preset to 40960
+- Let the build fail, if the minimum kernel version cannot be met
+- Conditionalize the sysctl.d tweak on version of the kernel
+- Conditionalize the name of README.distro on the distro
+
+* Tue Jan 16 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-1
+- Initial import (rhbz#1533929)
+
+* Tue Jan 16 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.13
+- Increase optmem_max preset to 81920
+
+* Tue Jan 16 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.12
+- Add sysctl.d preset and README.fedora
+
+* Mon Jan 15 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.11
+- Make the contents of the -replacements package configurable
+
+* Mon Jan 15 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.10
+- Fix Obsoletes of the -replacements package
+
+* Sun Jan 14 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.9
+- Disable the -replacements package until we have a plan for it
+
+* Sun Jan 14 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.8
+- Move the kcapi-hasher binary to -replacements package, since it is
+  not of much use without the linked invocation names and saves the
+  extra Requires on the -tools package
+
+* Sun Jan 14 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.7
+- Fix internal Requires of sub-packages
+- Hardlink files in %%{_bindir}
+
+* Sun Jan 14 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.6
+- Add patches from upstream
+
+* Sat Jan 13 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.5
+- Add patches from upstream
+
+* Sat Jan 13 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.4
+- Asume the testsuite cannot be run, if the value of optmem_max cannot
+  be obtained
+
+* Sat Jan 13 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.3
+- Move libraries to /%%{_lib} instead of %%{_libdir}, which is useful
+  during boot when the library might be needed before a potentially
+  seperate /usr partition is mounted
+
+* Sat Jan 13 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.2
+- Asume optmem_max is at least 20480, if the real value cannot be obtained
+
+* Fri Jan 12 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.1
+- New upstream release
+
+* Wed Jan 10 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.2-0.1
+- Initial rpm release (rhbz#1533929)

fipshmac-openssl.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+
+# Mocks fipshmac using the openssl tool.
+# Only for use during RPM build.
+
+[ "$1" = '-d' ] || exit 1
+
+openssl sha256 -hmac orboDeJITITejsirpADONivirpUkvarP -hex "$3" | cut -f 2 -d ' ' \
+	>"$2/$(basename "$3").hmac"

gating.yaml

@@ -0,0 +1,6 @@
+--- !Policy
+product_versions:
+  - fedora-*
+decision_context: bodhi_update_push_stable
+rules:
+  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}

libkcapi.spec

@@ -1,11 +1,16 @@
 # Shared object version of libkcapi.
 %global vmajor            1
-%global vminor            1
-%global vpatch            4
+%global vminor            5
+%global vpatch            0
 
 # Do we build the replacements packages?
 %bcond_with replace_coreutils
+# Replace fipscheck by default in Fedora 33+:
+%if 0%{?fedora} >= 33 || 0%{?rhel} >= 9
+%bcond_without replace_fipscheck
+%else
 %bcond_with replace_fipscheck
+%endif
 # Replace hmaccalc by default in Fedora 28+:
 %if 0%{?fedora} >= 28 || 0%{?rhel} >= 8
 %bcond_without replace_hmaccalc
@@ -17,6 +22,21 @@
 %else
 %bcond_with test_package
 %endif
+# disable cppcheck analysis in ELN/RHEL to avoid the dependency bz#1931518
+%if 0%{?rhel}
+%bcond_with cppcheck
+%else
+%bcond_without cppcheck
+%endif
+
+# Use `--without test` to build without running the tests
+%bcond_without test
+# Use `--without fuzz_test` to skip the fuzz test during build
+%bcond_without fuzz_test
+# Use `--without doc` to build without the -doc subpackage
+%bcond_without doc
+# Use `--without clang_sa` to skip clang static analysis during build
+%bcond_without clang_sa
 
 # This package needs at least Linux Kernel v4.10.0.
 %global min_kernel_ver    4.10.0
@@ -56,8 +76,7 @@
 
 # Do we replace fipscheck?
 %if %{with replace_fipscheck}
-# TODO: Adapt this when replacing fipscheck initially.
-%global fipscheck_evr     1.5.0-3%{?dist}
+%global fipscheck_evr     1.5.0-9
 %endif
 
 # Do we replace hmaccalc?
@@ -65,61 +84,69 @@
 %global hmaccalc_evr      0.9.14-10%{?dist}
 %endif
 
-%global apps_hmaccalc sha1hmac sha224hmac sha256hmac sha384hmac sha512hmac
-%global apps_fipscheck sha1sum sha224sum sha256sum sha384sum sha512sum md5sum fipscheck fipshmac
+%global apps_coreutils sha1sum sha224sum sha256sum sha384sum sha512sum md5sum sm3sum
+%global apps_hmaccalc sha1hmac sha224hmac sha256hmac sha384hmac sha512hmac sm3hmac
+%global apps_fipscheck fipscheck fipshmac
 
-# Add generation of HMAC checksums of the final stripped
-# binaries.  %%define with lazy globbing is used here
+# On old kernels use mock hashers implemented via openssl
+%if %{lua:print(rpm.vercmp(posix.uname('%r'), '3.19'));} >= 0
+%global sha512hmac bin/kcapi-hasher -n sha512hmac
+%global fipshmac   bin/kcapi-hasher -n fipshmac
+%else
+%global sha512hmac bash %{SOURCE2}
+%global fipshmac   bash %{SOURCE3}
+%endif
+
+# Add generation of HMAC checksum of the final stripped
+# binary.  %%define with lazy globbing is used here
 # intentionally, because using %%global does not work.
 %define __spec_install_post                                      \
 %{?__debug_package:%{__debug_install_post}}                      \
 %{__arch_install_post}                                           \
 %{__os_install_post}                                             \
 bin_path=%{buildroot}%{_bindir}                                  \
-lib_path=%{buildroot}/%{_lib}                                    \
-for app in %{apps_hmaccalc}; do                                  \
-  test -e "$bin_path"/$app || continue                           \
-  { bin/kcapi-hasher -n sha512hmac "$bin_path"/$app || exit 1; } \\\
-    | cut -f 1 -d ' ' >"$lib_path"/hmaccalc/$app.hmac            \
-done                                                             \
-for app in %{apps_fipscheck}; do                                 \
-  test -e "$bin_path"/$app || continue                           \
-  bin/kcapi-hasher -n fipshmac -d "$lib_path"/fipscheck          \\\
-    "$bin_path"/$app || exit 1                                   \
-done                                                             \
-%{_bindir}/hardlink -cfv %{buildroot}%{_bindir}                 \
-bin/kcapi-hasher -n fipshmac -d "$lib_path"/fipscheck            \\\
-  "$lib_path"/libkcapi.so.%{version} || exit 1                   \
+lib_path=%{buildroot}%{_libdir}                                  \
+{ %sha512hmac "$bin_path"/kcapi-hasher || exit 1; } |            \\\
+  cut -f 1 -d ' ' >"$lib_path"/hmaccalc/kcapi-hasher.hmac        \
+{ %sha512hmac "$lib_path"/libkcapi.so.%{version} || exit 1; } |  \\\
+  cut -f 1 -d ' ' >"$lib_path"/hmaccalc/libkcapi.so.%{version}.hmac \
 %{__ln_s} libkcapi.so.%{version}.hmac                            \\\
-  "$lib_path"/fipscheck/libkcapi.so.%{vmajor}.hmac               \
+  "$lib_path"/hmaccalc/libkcapi.so.%{vmajor}.hmac                \
 %{nil}
 
-
 Name:           libkcapi
 Version:        %{vmajor}.%{vminor}.%{vpatch}
-Release:        2%{?dist}
+Release:        %autorelease
 Summary:        User space interface to the Linux Kernel Crypto API
 
-License:        BSD or GPLv2
-URL:            http://www.chronox.de/%{name}.html
-Source0:        http://www.chronox.de/%{name}/%{name}-%{version}.tar.xz
-Source1:        http://www.chronox.de/%{name}/%{name}-%{version}.tar.xz.asc
+License:        BSD-3-Clause OR GPL-2.0-only
+URL:            https://www.chronox.de/%{name}/
+Source0:        https://www.chronox.de/%{name}/releases/%{version}/%{name}-%{version}.tar.xz
+Source1:        https://www.chronox.de/%{name}/releases/%{version}/%{name}-%{version}.tar.xz.asc
+Source2:        sha512hmac-openssl.sh
+Source3:        fipshmac-openssl.sh
 
-Patch0:         %{giturl}/commit/52620ec798a5.patch#/000-Fix-build-with-gcc-8.2.x.patch
-
-BuildRequires:  clang
+BuildRequires:  bash
 BuildRequires:  coreutils
-BuildRequires:  cppcheck
-BuildRequires:  docbook-utils-pdf
 BuildRequires:  gcc
-BuildRequires:  git
+BuildRequires:  git-core
 BuildRequires:  hardlink
 BuildRequires:  kernel-headers >= %{min_kernel_ver}
 BuildRequires:  libtool
+BuildRequires:  make
 BuildRequires:  openssl
-BuildRequires:  perl
+BuildRequires:  perl-interpreter
 BuildRequires:  systemd
 BuildRequires:  xmlto
+%if %{with doc}
+BuildRequires:  docbook-utils-pdf
+%endif
+%if %{with clang_sa}
+BuildRequires:  clang
+%endif
+%if %{with cppcheck}
+BuildRequires:  cppcheck >= 2.4
+%endif
 
 # For ownership of %%{_sysctldir}.
 Requires:       systemd
@@ -149,18 +176,32 @@ Requires:       %{name}%{?_isa} == %{version}-%{release}
 Header files for applications that use %{name}.
 
 
+%if %{with doc}
 %package        doc
 Summary:        User documentation for the %{name} package
 BuildArch:      noarch
+# Depend on one of the base packages because they have the license files
+# We cannot just bundle them into doc because they might conflict with an
+# older or newer version of the base package.
+Requires:       %{name} == %{version}-%{release}
 
 %description    doc
 User documentation for %{name}.
+%endif
+
+
+%package        hasher
+Summary:        Common %{name} hashing application
+Requires:       %{name}%{?_isa}    == %{version}-%{release}
+
+%description    hasher
+Provides The kcapi-hasher binary used by other %{name} subpackages.
 
 
 %if %{with replace_coreutils}
 %package        checksum
 Summary:        Drop-in replacement for *sum utils provided by the %{name} package
-Requires:       %{name}%{?_isa}    == %{version}-%{release}
+Requires:       %{name}-hasher%{?_isa} == %{version}-%{release}
 
 Requires:       coreutils%{?_isa}  >= %{coreutils_evr}
 
@@ -176,7 +217,7 @@ coreutils) using %{name}.
 %if %{with replace_fipscheck}
 %package        fipscheck
 Summary:        Drop-in replacements for fipscheck/fipshmac provided by the %{name} package
-Requires:       %{name}%{?_isa}   == %{version}-%{release}
+Requires:       %{name}-hasher%{?_isa} == %{version}-%{release}
 
 Obsoletes:      fipscheck         <= %{fipscheck_evr}
 
@@ -192,7 +233,7 @@ package fipscheck) using %{name}.
 %if %{with replace_hmaccalc}
 %package        hmaccalc
 Summary:        Drop-in replacements for hmaccalc provided by the %{name} package
-Requires:       %{name}%{?_isa}   == %{version}-%{release}
+Requires:       %{name}-hasher%{?_isa} == %{version}-%{release}
 
 Obsoletes:      hmaccalc          <= %{hmaccalc_evr}
 
@@ -217,7 +258,8 @@ is highly discouraged.
 
 %package        tools
 Summary:        Utility applications for the %{name} package
-Requires:       %{name}%{?_isa} == %{version}-%{release}
+Requires:       %{name}%{?_isa}        == %{version}-%{release}
+Requires:       %{name}-hasher%{?_isa} == %{version}-%{release}
 
 %description    tools
 Utility applications that are provided with %{name}.  This includes
@@ -238,7 +280,7 @@ Requires:       %{name}-checksum%{?_isa} == %{version}-%{release}
 %endif
 Requires:       coreutils
 Requires:       openssl
-Requires:       perl
+Requires:       perl-interpreter
 
 %description    tests
 Auxiliary scripts for testing %{name}.
@@ -248,6 +290,10 @@ Auxiliary scripts for testing %{name}.
 %prep
 %autosetup -p 1 -S git
 
+# Work around https://bugzilla.redhat.com/show_bug.cgi?id=2258240
+sed -i -e 's|XML V45|XML V4.1.2|' -e 's|/xml/4\.5/|/xml/4.1.2/|' \
+    lib/doc/libkcapi.tmpl
+
 %if %{with_sysctl_tweak}
 %{__cat} << EOF > README.%{distroname_ext}
 This package increases the default limit of the ancillary buffer size
@@ -282,16 +328,12 @@ net.core.optmem_max = %{sysctl_optmem_max}
 EOF
 %endif
 
-%ifarch %{power64}
-%{__sed} -i -e 's!exit \$failures!#&!' test/kcapi-enc-test.sh
-%endif
-
 %{_bindir}/autoreconf -fiv
 
 
 %build
 %configure               \
-  --libdir=/%{_lib}      \
+  --libdir=%{_libdir}    \
   --disable-silent-rules \
   --enable-kcapi-encapp  \
   --enable-kcapi-dgstapp \
@@ -302,9 +344,13 @@ EOF
   --enable-shared        \
   --enable-static        \
   --enable-sum-prefix=   \
-  --enable-sum-dir=/%{_lib} \
+  --enable-sum-dir=%{_libdir} \
   --with-pkgconfigdir=%{_libdir}/pkgconfig
+%if %{with doc}
 %make_build all doc
+%else
+%make_build all man
+%endif
 
 
 %install
@@ -321,22 +367,32 @@ EOF
 %if %{with_sysctl_tweak}
   README.%{distroname_ext}                          \
 %endif
-  README.md CHANGES.md TODO doc/%{name}.p{df,s}
+%if %{with doc}
+  doc/%{name}.p{df,s}                               \
+%endif
+  README.md CHANGES.md TODO
+
+%if %{with doc}
 %{__cp} -pr lib/doc/html %{buildroot}%{_pkgdocdir}
+%endif
 
 # Install replacement tools, if enabled.
-%if !%{with replace_coreutils}
-%{__rm} -f                            \
-  %{buildroot}%{_bindir}/md5sum       \
-  %{buildroot}%{_bindir}/sha*sum
+%if %{with replace_coreutils}
+for app in %apps_coreutils; do
+  %{__ln_s} ../libexec/libkcapi/$app %{buildroot}%{_bindir}/$app
+done
 %endif
 
-%if !%{with replace_fipscheck}
-%{__rm} -f %{buildroot}%{_bindir}/fips*
+%if %{with replace_fipscheck}
+for app in %apps_fipscheck; do
+  %{__ln_s} ../libexec/libkcapi/$app %{buildroot}%{_bindir}/$app
+done
 %endif
 
-%if !%{with replace_hmaccalc}
-%{__rm} -f %{buildroot}%{_bindir}/sha*hmac
+%if %{with replace_hmaccalc}
+for app in %apps_hmaccalc; do
+  %{__ln_s} ../libexec/libkcapi/$app %{buildroot}%{_bindir}/$app
+done
 %endif
 
 # We don't ship autocrap dumplings.
@@ -348,11 +404,13 @@ EOF
 # Remove 0-size files.
 %{_bindir}/find %{buildroot} -type f -size 0 -print -delete
 
+%if %{with doc}
 # Make sure all docs have non-exec permissions, except for the dirs.
 %{_bindir}/find %{buildroot}%{_pkgdocdir} -type f -print | \
   %{_bindir}/xargs %{__chmod} -c 0644
 %{_bindir}/find %{buildroot}%{_pkgdocdir} -type d -print | \
   %{_bindir}/xargs %{__chmod} -c 0755
+%endif
 
 # Possibly save some space by hardlinking.
 for d in %{_mandir} %{_pkgdocdir}; do
@@ -362,21 +420,35 @@ done
 
 %check
 # Some basic sanity checks.
-for t in cppcheck scan; do
-  %make_build $t
-done
+%if %{with clang_sa}
+%make_build scan
+%endif
+%if %{with cppcheck}
+# -UCHECK_DIR: string literal concatenation raises syntaxError
+# with cppcheck-2.11 (https://trac.cppcheck.net/ticket/11830)
+# --check-level=exhaustive: otherwise it emits warnings that get
+# treated like errors
+%make_build cppcheck CPPCHECK="cppcheck --check-level=exhaustive -UCHECK_DIR"
+%endif
 
+%if %{with test}
 # On some arches `/proc/sys/net/core/optmem_max` is lower than 20480,
 # which is the lowest limit needed to run the testsuite.  If that limit
 # is not met, we do not run it.
 %if %{test_optmem_max} >= 20480
+# Skip the testsuite on old kernels.
+%if %{lua:print(rpm.vercmp(posix.uname('%r'), '5.1'));} >= 0
 # Real testsuite.
 pushd test
+%if %{with fuzz_test}
 ENABLE_FUZZ_TEST=1 \
+%endif
 NO_32BIT_TEST=1    \
   ./test-invocation.sh
 popd
 %endif
+%endif
+%endif
 
 
 %ldconfig_scriptlets
@@ -386,10 +458,10 @@ popd
 %doc %dir %{_pkgdocdir}
 %doc %{_pkgdocdir}/README.md
 %license COPYING*
-/%{_lib}/%{name}.so.%{vmajor}
-/%{_lib}/%{name}.so.%{version}
-/%{_lib}/fipscheck/%{name}.so.%{vmajor}.hmac
-/%{_lib}/fipscheck/%{name}.so.%{version}.hmac
+%{_libdir}/%{name}.so.%{vmajor}
+%{_libdir}/%{name}.so.%{version}
+%{_libdir}/hmaccalc/%{name}.so.%{vmajor}.hmac
+%{_libdir}/hmaccalc/%{name}.so.%{version}.hmac
 %if %{with_sysctl_tweak}
 %doc %{_pkgdocdir}/README.%{distroname_ext}
 %{_sysctldir}/%{sysctl_prio}-%{name}-optmem_max.conf
@@ -401,213 +473,74 @@ popd
 %doc %{_pkgdocdir}/TODO
 %{_includedir}/kcapi.h
 %{_mandir}/man3/kcapi_*.3.*
-/%{_lib}/%{name}.so
+%{_libdir}/%{name}.so
 %{_libdir}/pkgconfig/%{name}.pc
 
 
+%if %{with doc}
 %files          doc
-%doc %{_pkgdocdir}
-%license %{_datadir}/licenses/%{name}*
+%doc %{_pkgdocdir}/html
+%doc %{_pkgdocdir}/%{name}.pdf
+%doc %{_pkgdocdir}/%{name}.ps
+%endif
+
+
+%files          hasher
+%{_bindir}/kcapi-hasher
+%{_libexecdir}/%{name}/md5sum
+%{_libexecdir}/%{name}/sha*sum
+%{_libexecdir}/%{name}/sm*sum
+%{_libexecdir}/%{name}/fips*
+%{_libexecdir}/%{name}/sha*hmac
+%{_libexecdir}/%{name}/sm*hmac
+%{_libdir}/hmaccalc/kcapi-hasher.hmac
+%{_mandir}/man1/kcapi-hasher.1.*
 
 
 %if %{with replace_coreutils}
 %files          checksum
 %{_bindir}/md5sum
 %{_bindir}/sha*sum
-/%{_lib}/fipscheck/md5sum.hmac
-/%{_lib}/fipscheck/sha*sum.hmac
+%{_bindir}/sm*sum
 %endif
 
 %if %{with replace_fipscheck}
 %files          fipscheck
 %{_bindir}/fips*
-/%{_lib}/fipscheck/fips*.hmac
 %endif
 
 %if %{with replace_hmaccalc}
 %files          hmaccalc
 %{_bindir}/sha*hmac
-/%{_lib}/hmaccalc/sha*hmac.hmac
+%{_bindir}/sm*hmac
 %endif
 
 
 %files          static
-/%{_lib}/%{name}.a
+%{_libdir}/%{name}.a
 
 
 %files          tools
-%{_bindir}/kcapi*
-%{_mandir}/man1/kcapi*.1.*
+%{_bindir}/kcapi
+%{_bindir}/kcapi-convenience
+%{_bindir}/kcapi-dgst
+%{_bindir}/kcapi-enc
+%{_bindir}/kcapi-enc-test-large
+%{_bindir}/kcapi-rng
+%{_bindir}/kcapi-speed
+%{_mandir}/man1/kcapi-dgst.1.*
+%{_mandir}/man1/kcapi-enc.1.*
+%{_mandir}/man1/kcapi-rng.1.*
 
 
 %if %{with test_package}
 %files          tests
-%{_libexecdir}/%{name}/*
+%{_libexecdir}/%{name}/kcapi
+%{_libexecdir}/%{name}/kcapi-convenience
+%{_libexecdir}/%{name}/kcapi-enc-test-large
+%{_libexecdir}/%{name}/*.sh
 %endif
 
 
 %changelog
-* Sat Feb 02 2019 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.4-1
-- Update to upstream version 1.1.4
-
-* Fri Feb 01 2019 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.3-3
-- Fix build with new GCC
-
-* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.3-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
-
-* Thu Aug 23 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.3-1
-- Update to upstream version 1.1.3
-
-* Thu Aug 09 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-16
-- Add missing dependencies to the tests package
-- Update patch from upstream
-
-* Thu Aug 09 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-15
-- Build and tests require perl
-
-* Thu Aug 09 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-14
-- Add missing script to the 'tests' package
-
-* Wed Aug 08 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-13
-- Add missing requires to the 'tests' subpackage
-
-* Tue Aug 07 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-12
-- Produce a subpackage with test scripts
-- Build the 'tests' subpackage conditionally
-
-* Wed Aug 01 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-11
-- Add patch to fix unwanted closing of FD 0
-
-* Tue Jul 31 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-10
-- Remove the kernel headers workaround
-
-* Fri Jul 27 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 1.1.1-9
-- Rebuild for new binutils
-
-* Fri Jul 27 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-8
-- Add more Coverity fixes from upstream
-- Add patch to fix AEAD fuzz test for BE arches
-- Fixup specfile
-
-* Mon Jul 23 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-7
-- Add various fixes from upstream
-- Drop the Requires on kernel package
-
-* Mon Jul 16 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-6
-- Put .hmac files into a separate directory
-
-* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.1-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
-
-* Thu Jul 12 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-4
-- Add patch to work around FTBFS on rawhide
-
-* Wed Jul 11 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-3
-- Fix off-by-one error in checkfile parsing
-
-* Wed Jul 11 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-2
-- Fix command-line parsing in libkcapi-hmaccalc
-
-* Mon Jun 18 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-1
-- Update to upstream version 1.1.1
-
-* Wed May 09 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.0-5
-- Skip CLang static analysis in RHEL
-- Revert "Skip CLang static analysis in RHEL"
-- Use own sha512hmac and fipscheck
-
-* Wed May 02 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.0-4
-- Fix description lines being too long
-
-* Fri Apr 27 2018 Björn Esser <besser82@fedoraproject.org> - 1.1.0-3
-- Fix conditional for hmaccalc replacement
-
-* Mon Apr 16 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.0-2
-- Enable hmaccalc replacements in Fedora 28+
-
-* Thu Apr 12 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.0-1
-- Update to upstream version 1.1.0
-
-* Sat Mar 31 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-10
-- Replace single patches with a monolitic one from upstream
-- Obsolete replacements subpackage
-- Ignore failing tests on %%{power64} temporarily
-
-* Thu Mar 08 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.0.3-9
-- Split up the replacements subpackage
-
-* Mon Feb 26 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-8
-- Increase optmem_max preset to 81920
-
-* Mon Feb 26 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-7
-- Obsoletes work by package name, not by provides (rhbz#1537225)
-
-* Sun Feb 25 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-6
-- Add patch to fix a copy-paste typo
-
-* Sat Feb 17 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-5
-- Add patch to fix build with -Werror
-
-* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org>
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
-
-* Sun Feb 04 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-3
-- Switch to %%ldconfig_scriptlets
-
-* Wed Jan 17 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-2
-- Decrease optmem_max preset to 40960
-- Let the build fail, if the minimum kernel version cannot be met
-- Conditionalize the sysctl.d tweak on version of the kernel
-- Conditionalize the name of README.distro on the distro
-
-* Tue Jan 16 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-1
-- Initial import (rhbz#1533929)
-
-* Tue Jan 16 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.13
-- Increase optmem_max preset to 81920
-
-* Tue Jan 16 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.12
-- Add sysctl.d preset and README.fedora
-
-* Mon Jan 15 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.11
-- Make the contents of the -replacements package configurable
-
-* Mon Jan 15 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.10
-- Fix Obsoletes of the -replacements package
-
-* Sun Jan 14 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.9
-- Disable the -replacements package until we have a plan for it
-
-* Sun Jan 14 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.8
-- Move the kcapi-hasher binary to -replacements package, since it is
-  not of much use without the linked invocation names and saves the
-  extra Requires on the -tools package
-
-* Sun Jan 14 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.7
-- Fix internal Requires of sub-packages
-- Hardlink files in %%{_bindir}
-
-* Sun Jan 14 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.6
-- Add patches from upstream
-
-* Sat Jan 13 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.5
-- Add patches from upstream
-
-* Sat Jan 13 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.4
-- Asume the testsuite cannot be run, if the value of optmem_max cannot
-  be obtained
-
-* Sat Jan 13 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.3
-- Move libraries to /%%{_lib} instead of %%{_libdir}, which is useful
-  during boot when the library might be needed before a potentially
-  seperate /usr partition is mounted
-
-* Sat Jan 13 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.2
-- Asume optmem_max is at least 20480, if the real value cannot be obtained
-
-* Fri Jan 12 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.1
-- New upstream release
-
-* Wed Jan 10 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.2-0.1
-- Initial rpm release (rhbz#1533929)
+%autochangelog

plans/ci.fmf

@@ -0,0 +1,5 @@
+summary: Run CI tests
+discover:
+    how: fmf
+execute:
+    how: tmt

sha512hmac-openssl.sh

@@ -0,0 +1,6 @@
+#!/bin/bash
+
+# Mocks sha512hmac using the openssl tool.
+# Only for use during RPM build.
+
+openssl sha512 -hmac FIPS-FTW-RHT2009 -hex "$1" | cut -f 2 -d ' '

sources

@@ -1,2 +1,2 @@
-SHA512 (libkcapi-1.1.4.tar.xz) = b07cc4435829ad73585ca79d06cd57edf6c2e68f66dceac07a72332aa9cd325b79add02fd220166ee5e07a3d7b305df0dc941bccf1310784b3b16bf50291c4f9
-SHA512 (libkcapi-1.1.4.tar.xz.asc) = 22245f4a1fa98f3ad3a21a01e464bd6fba56d8541d5825739c928e577cdb7f5b30098dcdab1086bbbf33707e2c27ebd03c2810dc0e98d27120016dd0749ef7ba
+SHA512 (libkcapi-1.5.0.tar.xz) = db156ee94fc63815a31876ab072aca72a806b26961c43f2caf8495c53b95484de71cd3be84dc9e5c9560e9ee704979be059ff6c102b4893d6bbdf9a8a69a667a
+SHA512 (libkcapi-1.5.0.tar.xz.asc) = 69cfb6bf98f89c503e7fda07a54eddb9fcc2dafe418f1bc1216c051565c214a6caab83495c19b650a5c6e46e22080f8df4dd2152ab364993ed5badd256495159

tests/main.fmf

@@ -0,0 +1,29 @@
+component: libkcapi
+contact: Ondrej Mosnacek <omosnacek@gmail.com>
+
+/upstream:
+    require: [libkcapi-tests]
+    tier: 1
+
+    /basic:
+        summary: Basic functionality
+        test: /usr/libexec/libkcapi/test.sh
+    /encrypt:
+        summary: Encryption/decryption
+        test: /usr/libexec/libkcapi/kcapi-enc-test.sh
+    /encrypt-large:
+        summary: Encryption/decryption of large data
+        test: /usr/libexec/libkcapi/kcapi-enc-test-large.sh
+    /digest:
+        summary: Message digest
+        test: /usr/libexec/libkcapi/kcapi-dgst-test.sh
+    /digest-convenience:
+        summary: Message digest convenience functions
+        test: /usr/libexec/libkcapi/kcapi-convenience.sh
+    /hasher:
+        summary: Checksum helpers
+        test: /usr/libexec/libkcapi/hasher-test.sh
+    /fuzz-test:
+        summary: Fuzz test
+        test: /usr/libexec/libkcapi/kcapi-fuzz-test.sh
+        duration: 2h

tests/tests.yml

@@ -1,24 +0,0 @@
-- hosts: localhost
-  tags:
-  - classic
-  - container
-  - atomic
-  roles:
-  - role: standard-test-basic
-    required_packages:
-    - libkcapi-tests
-    tests:
-    - upstream-basic-test:
-        run: /usr/libexec/libkcapi/test.sh
-    - upstream-enc-test:
-        run: /usr/libexec/libkcapi/kcapi-enc-test.sh
-    - upstream-enc-test-large:
-        run: /usr/libexec/libkcapi/kcapi-enc-test-large.sh
-    - upstream-dgst-test:
-        run: /usr/libexec/libkcapi/kcapi-dgst-test.sh
-    - upstream-hasher-test:
-        run: /usr/libexec/libkcapi/hasher-test.sh
-    - upstream-convenience-test:
-        run: /usr/libexec/libkcapi/kcapi-convenience.sh
-    - upstream-fuzz-test:
-        run: /usr/libexec/libkcapi/kcapi-fuzz-test.sh