13 changed files with 953 additions and 509 deletions
--- a/.fmf/version
+++ b/.fmf/version
@ -1 +0,0 @@
-1
--- a/247
+++ b/247
@ -1,247 +0,0 @@
-* Sat Aug 13 2022 Ondrej Mosnáček <omosnace@redhat.com> - 1.4.0-2
- Switch to rpmautospec
-
-* Sat Aug 13 2022 Ondrej Mosnáček <omosnace@redhat.com> - 1.4.0-1
- Update to upstream version 1.4.0
- Re-enable cppcheck scanning on Fedora
- Resolves: rhbz#2056732
-
-* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.3.1-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
-
-* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.3.1-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
-
-* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.3.1-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
-
-* Wed Jul 14 2021 Simo Sorce <simo@redhat.com> - 1.3.1-2
- Remove LTO build suppression by using better symver machinery
-
-* Wed Jul 14 2021 Simo Sorce <simo@redhat.com> - 1.3.1-1
- Update to upstream version 1.3.1 which fixes ABI issues
-
-* Mon Jul 12 2021 Simo Sorce <simo@redhat.com> - 1.3.0-1
- Update to upstream version 1.3.0
-
-* Mon Mar 15 2021 Sahana Prasad <sahana@redhat.com> - 1.2.1-1
- Update to upstream version 1.2.1
- Remove patch fix MSG_MORE uasge as it is added upstream
- Remove cppcheck dependency for rhel bz#1931518
- Add a patch to fix fuzz tests
-
-* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.0-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
-
-* Fri Aug 14 2020 Ondrej Mosnáček <omosnace@redhat.com> - 1.2.0-3
- Require perl-interpreter instead of full perl
- Backport fix for 5.9 kernels
-
-* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Mon May 25 2020 Sahana Prasad <omosnace@redhat.com> - 1.2.0-1
- Update to upstream version 1.2.0 tracked by BZ 1839592.
- Enable kcapi-enc tests as libkcapi BZ 1826022 is fixed.
- Remove 110-fipshmac-compat.patch as the changes are merged upstream.
- Remove 100-workaround-cppcheck-bug.patch as the changes are merged upstream.
-
-* Tue May 05 2020 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.5-5
- Fix the CI test failures
- Enable building on old kernels
- Avoid conflicts between different versions of packages
-
-* Thu Apr 23 2020 Tomáš Mráz <tmraz@redhat.com> - 1.1.5-4
- Add . prefix to files created by fipshmac if -d option is not specified
-
-* Wed Apr 22 2020 Sahana Prasad <sahana@redhat.com> - 1.1.5-3
- Disables kcapi-enc tests until the kernel bug bz 1826022 is fixed.
- Produce also the fipscheck replacement package
-
-* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.5-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
-
-* Tue Aug 13 2019 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.5-1
- Update to upstream version 1.1.5
-
-* Sat Jul 27 2019 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.4-6
- Backport patch to fix test failure on aarch64
- Remove no longer needed ppc64 workaround
-
-* Sat Jul 27 2019 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.4-5
- Backport patch to fix tests
-
-* Thu Jul 25 2019 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.4-4
- Work around cppcheck issue
- Enable gating
-
-* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.4-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
-
-* Mon May 27 2019 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.4-2
- Fix FTBFS: hardlink is now in bindir
-
-* Sat Feb 02 2019 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.4-1
- Update to upstream version 1.1.4
-
-* Fri Feb 01 2019 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.3-3
- Fix build with new GCC
-
-* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.3-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
-
-* Thu Aug 23 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.3-1
- Update to upstream version 1.1.3
-
-* Thu Aug 09 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-16
- Add missing dependencies to the tests package
- Update patch from upstream
-
-* Thu Aug 09 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-15
- Build and tests require perl
-
-* Thu Aug 09 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-14
- Add missing script to the 'tests' package
-
-* Wed Aug 08 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-13
- Add missing requires to the 'tests' subpackage
-
-* Tue Aug 07 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-12
- Produce a subpackage with test scripts
- Build the 'tests' subpackage conditionally
-
-* Wed Aug 01 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-11
- Add patch to fix unwanted closing of FD 0
-
-* Tue Jul 31 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-10
- Remove the kernel headers workaround
-
-* Fri Jul 27 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 1.1.1-9
- Rebuild for new binutils
-
-* Fri Jul 27 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-8
- Add more Coverity fixes from upstream
- Add patch to fix AEAD fuzz test for BE arches
- Fixup specfile
-
-* Mon Jul 23 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-7
- Add various fixes from upstream
- Drop the Requires on kernel package
-
-* Mon Jul 16 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-6
- Put .hmac files into a separate directory
-
-* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.1-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
-
-* Thu Jul 12 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-4
- Add patch to work around FTBFS on rawhide
-
-* Wed Jul 11 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-3
- Fix off-by-one error in checkfile parsing
-
-* Wed Jul 11 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-2
- Fix command-line parsing in libkcapi-hmaccalc
-
-* Mon Jun 18 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-1
- Update to upstream version 1.1.1
-
-* Wed May 09 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.0-5
- Skip CLang static analysis in RHEL
- Revert "Skip CLang static analysis in RHEL"
- Use own sha512hmac and fipscheck
-
-* Wed May 02 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.0-4
- Fix description lines being too long
-
-* Fri Apr 27 2018 Björn Esser <besser82@fedoraproject.org> - 1.1.0-3
- Fix conditional for hmaccalc replacement
-
-* Mon Apr 16 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.0-2
- Enable hmaccalc replacements in Fedora 28+
-
-* Thu Apr 12 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.0-1
- Update to upstream version 1.1.0
-
-* Sat Mar 31 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-10
- Replace single patches with a monolitic one from upstream
- Obsolete replacements subpackage
- Ignore failing tests on %%{power64} temporarily
-
-* Thu Mar 08 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.0.3-9
- Split up the replacements subpackage
-
-* Mon Feb 26 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-8
- Increase optmem_max preset to 81920
-
-* Mon Feb 26 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-7
- Obsoletes work by package name, not by provides (rhbz#1537225)
-
-* Sun Feb 25 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-6
- Add patch to fix a copy-paste typo
-
-* Sat Feb 17 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-5
- Add patch to fix build with -Werror
-
-* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org>
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
-
-* Sun Feb 04 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-3
- Switch to %%ldconfig_scriptlets
-
-* Wed Jan 17 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-2
- Decrease optmem_max preset to 40960
- Let the build fail, if the minimum kernel version cannot be met
- Conditionalize the sysctl.d tweak on version of the kernel
- Conditionalize the name of README.distro on the distro
-
-* Tue Jan 16 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-1
- Initial import (rhbz#1533929)
-
-* Tue Jan 16 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.13
- Increase optmem_max preset to 81920
-
-* Tue Jan 16 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.12
- Add sysctl.d preset and README.fedora
-
-* Mon Jan 15 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.11
- Make the contents of the -replacements package configurable
-
-* Mon Jan 15 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.10
- Fix Obsoletes of the -replacements package
-
-* Sun Jan 14 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.9
- Disable the -replacements package until we have a plan for it
-
-* Sun Jan 14 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.8
- Move the kcapi-hasher binary to -replacements package, since it is
-  not of much use without the linked invocation names and saves the
-  extra Requires on the -tools package
-
-* Sun Jan 14 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.7
- Fix internal Requires of sub-packages
- Hardlink files in %%{_bindir}
-
-* Sun Jan 14 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.6
- Add patches from upstream
-
-* Sat Jan 13 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.5
- Add patches from upstream
-
-* Sat Jan 13 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.4
- Asume the testsuite cannot be run, if the value of optmem_max cannot
-  be obtained
-
-* Sat Jan 13 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.3
- Move libraries to /%%{_lib} instead of %%{_libdir}, which is useful
-  during boot when the library might be needed before a potentially
-  seperate /usr partition is mounted
-
-* Sat Jan 13 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.2
- Asume optmem_max is at least 20480, if the real value cannot be obtained
-
-* Fri Jan 12 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.1
- New upstream release
-
-* Wed Jan 10 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.2-0.1
- Initial rpm release (rhbz#1533929)
--- a/fipshmac-openssl.sh
+++ b/fipshmac-openssl.sh
@ -1,9 +0,0 @@
-#!/bin/bash
-
-# Mocks fipshmac using the openssl tool.
-# Only for use during RPM build.
-
-[ "$1" = '-d' ] || exit 1
-
-openssl sha256 -hmac orboDeJITITejsirpADONivirpUkvarP -hex "$3" | cut -f 2 -d ' ' \
-	>"$2/$(basename "$3").hmac"
--- a/gating.yaml
+++ b/gating.yaml
@ -1,6 +0,0 @@
--- !Policy
-product_versions:
-  - fedora-*
-decision_context: bodhi_update_push_stable
-rules:
-  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}
--- a/libkcapi-1.1.0-kcapi-hasher_Allow_picking_basename_via_cmdline.patch
+++ b/libkcapi-1.1.0-kcapi-hasher_Allow_picking_basename_via_cmdline.patch
@ -0,0 +1,341 @@
+From 4986c2c95422f97ca0f8db94ce422a01f9a9fa5e Mon Sep 17 00:00:00 2001
+From: Ondrej Mosnacek <omosnace@redhat.com>
+Date: Thu, 24 May 2018 08:28:02 +0200
+Subject: [PATCH] kcapi-hasher: Allow picking basename via cmdline
+
+This makes it possible to run the kcapi-hasher binary directly when
+needed (even via the libtool wrapper) and to simplify the hasher tests.
+---
+ apps/kcapi-hasher.c |  22 ++++++++---
+ test/hasher-test.sh | 108 +++++++++++++++++++---------------------------------
+ 2 files changed, 57 insertions(+), 73 deletions(-)
+
+diff --git a/apps/kcapi-hasher.c b/apps/kcapi-hasher.c
+index 9a5d2ee..ae88211 100644
+--- a/apps/kcapi-hasher.c
+++ b/apps/kcapi-hasher.c
+@@ -117,14 +117,15 @@ static void usage(char *name, int fipscheck)
+ 	const char *base = basename(name);
+ 	fprintf(stderr, "\n%s - calculation of hash sum (Using Linux Kernel Crypto API)\n", basename(name));
+ 	fprintf(stderr, "\nUsage:\n");
+-	fprintf(stderr, "\t%s [OPTION]... -S|-L\n", base);
+	fprintf(stderr, "\t%s [-n BASENAME] [OPTION]... -S|-L\n", base);
+ 	if (fipscheck)
+-		fprintf(stderr, "\t%s [OPTION]... FILE\n", base);
+		fprintf(stderr, "\t%s [-n BASENAME] [OPTION]... FILE\n", base);
+ 	else {
+-		fprintf(stderr, "\t%s [OPTION]... -c FILE\n", base);
+-		fprintf(stderr, "\t%s [OPTION]... FILE...\n", base);
+		fprintf(stderr, "\t%s [-n BASENAME] [OPTION]... -c FILE\n", base);
+		fprintf(stderr, "\t%s [-n BASENAME] [OPTION]... FILE...\n", base);
+ 	}
+ 	fprintf(stderr, "\nOptions:\n");
+	fprintf(stderr, "\t-n --name\t\tForce given application name (sha512hmac/...)\n");
+ 	fprintf(stderr, "\t-S --self-sum\t\tPrint checksum of this binary and exit\n");
+ 	fprintf(stderr, "\t-L --self-sum-lib\tPrint checksum of the libkcapi library and exit\n");
+ 	if (!fipscheck)
+@@ -781,12 +782,19 @@ int main(int argc, char *argv[])
+ 	const char *targetfile = NULL;
+ 	uint8_t *hmackey_alloc = NULL;
+ 	uint8_t *hmackey_mmap = NULL;
+	int opt_index = 0;
+ 	int loglevel = 0;
+ 	int hmac = 0;
+ 	int fipscheck = 0;
+ 	int fipshmac = 0;
+ 	int selfcheck_mode = SELFCHECK_CHECK;
+ 
+	static const char *opts_name_short = "n:";
+	static const struct option opts_name[] = {
+		{"name", 1, 0, 'n'},
+		{0, 0, 0, 0}
+	};
+
+ 	static const char *opts_short = "c:uh:t:SLqk:K:vbd:P";
+ 	static const struct option opts[] = {
+ 		{"help", 0, 0, 0},
+@@ -833,6 +841,11 @@ int main(int argc, char *argv[])
+ 	}
+ 	basen = basename(basec);
+ 
+	if (getopt_long(argc, argv, opts_name_short, opts_name, &opt_index) == 'n')
+		basen = optarg;
+	else
+		opt_index = 0;
+
+ 	params_self = &PARAMS_SELF_FIPSCHECK;
+ 	if (0 == strncmp(basen, "sha256sum", 9)) {
+ 		names = NAMES_SHA256;
+@@ -888,7 +901,6 @@ int main(int argc, char *argv[])
+ 	}
+ 
+ 	while (1) {
+-		int opt_index = 0;
+ 		int c = getopt_long(argc, argv, opts_short, opts, &opt_index);
+ 		
+ 		if (-1 == c)
+diff --git a/test/hasher-test.sh b/test/hasher-test.sh
+index 28c6b5a..f36897b 100755
+--- a/test/hasher-test.sh
+++ b/test/hasher-test.sh
+@@ -22,15 +22,18 @@
+ 
+ HASHERBIN="${APPDIR}/kcapi-hasher"
+ find_platform $HASHERBIN
+-HASHERBIN=$(get_binlocation $HASHERBIN)
+ 
+-SUMHASHER="${TMPDIR}/md5sum ${TMPDIR}/sha1sum ${TMPDIR}/sha256sum ${TMPDIR}/sha384sum ${TMPDIR}/sha512sum"
+-HMACHASHER="${TMPDIR}/sha1hmac ${TMPDIR}/sha256hmac ${TMPDIR}/sha384hmac ${TMPDIR}/sha512hmac"
+function run_hasher() {
+	"$HASHERBIN" -n "$@"
+}
+
+SUMHASHER="md5sum sha1sum sha256sum sha384sum sha512sum"
+HMACHASHER="sha1hmac sha256hmac sha384hmac sha512hmac"
+ CHKFILE="${TMPDIR}/chk.$$"
+ ANOTHER="${TMPDIR}/test.$$"
+ 
+ touch $ANOTHER
+-trap "rm -f $ANOTHER $CHKFILE $SUMHASHER $HMACHASHER" 0 1 2 3 15
+trap "rm -f $ANOTHER $CHKFILE" 0 1 2 3 15
+ 
+ if [ ! -e $HASHERBIN ]
+ then
+@@ -38,20 +41,10 @@ then
+ 	exit 1
+ fi
+ 
+-#although a hard link suffices, we need to copy it
+-for i in $SUMHASHER $HMACHASHER
+-do
+-	#ln $HASHERBIN $i
+-	cp -f $HASHERBIN $i
+-done
+-
+-libdir=$(dirname $(realpath ../.libs/libkcapi.so))
+-libname=$(realpath ../.libs/libkcapi.so)
+-
+ for hasher in $SUMHASHER $HMACHASHER
+ do
+ 	>$CHKFILE
+-	LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher -c $CHKFILE
+	run_hasher $hasher -c $CHKFILE
+ 	if [ $? -eq 0 ]
+ 	then
+ 		echo_fail "Verification of empty checker file with hasher $hasher did not fail"
+@@ -60,7 +53,7 @@ do
+ 	fi
+ 
+ 	echo >$CHKFILE
+-	LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher -c $CHKFILE
+	run_hasher $hasher -c $CHKFILE
+ 	if [ $? -eq 0 ]
+ 	then
+ 		echo_fail "Verification of empty line checker file with hasher $hasher did not fail"
+@@ -68,9 +61,8 @@ do
+ 		echo_pass "Failure on empty line checker file for $hasher"
+ 	fi
+ 
+-	LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher $0 $ANOTHER | \
+-		sed -E 's/(\w+\s)\s/\1*/' >$CHKFILE
+-	LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher -q -c $CHKFILE
+	run_hasher $hasher $0 $ANOTHER | sed -E 's/(\w+\s)\s/\1*/' >$CHKFILE
+	run_hasher $hasher -q -c $CHKFILE
+ 	if [ $? -eq 0 ]
+ 	then
+ 		echo_pass "Parsing checker file with asterisk with $hasher"
+@@ -78,8 +70,7 @@ do
+ 		echo_fail "Parsing checker file with asterisk (binary mode) with $hasher failed"
+ 	fi
+ 
+-	LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher $0 $ANOTHER | \
+-		LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher -q -c -
+	run_hasher $hasher $0 $ANOTHER | run_hasher $hasher -q -c -
+ 	if [ $? -eq 0 ]
+ 	then
+ 		echo_pass "Checker file '-' interpretation with $hasher"
+@@ -87,7 +78,7 @@ do
+ 		echo_fail "Checker file '-' interpretation with $hasher failed"
+ 	fi
+ 
+-	LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher $0 - <$ANOTHER >/dev/null
+	run_hasher $hasher $0 - <$ANOTHER >/dev/null
+ 	if [ $? -eq 0 ]
+ 	then
+ 		echo_pass "Input file '-' interpretation with $hasher"
+@@ -100,16 +91,16 @@ done
+ 
+ for i in $SUMHASHER
+ do
+-	hash=$(basename $i)
+-	hash=${hash%%sum}
+ 	hasher=$i
+-	i=$(basename $i)
+-	[ ! -e "$hasher" ] && {
+-		echo_deact "Hasher $hasher does not exist"
+	hash=${hasher%%sum}
+	i=$(command -v $i)
+
+	[ -z "$i" ] && {
+		echo_deact "reference application $hasher missing"
+ 		continue
+ 	}
+ 
+-	LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher $0 $ANOTHER > $CHKFILE
+	run_hasher $hasher $0 $ANOTHER > $CHKFILE
+ 	[ $? -ne 0 ] && {
+ 		echo_fail "Generation of hashes with hasher $hasher failed"
+ 		continue
+@@ -131,14 +122,14 @@ do
+ 		continue
+ 	}
+ 
+-	LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher --status -c $CHKFILE
+	run_hasher $hasher --status -c $CHKFILE
+ 	[ $? -ne 0 ] && echo_fail "Verification of checker file $CHKFILE with hasher $hasher failed"
+ 
+ 	echo -n 123 >$CHKFILE
+ 
+ 	a=$(openssl dgst -$hash -hmac 123 $0 | cut -f 2 -d" ")
+-	b=$(LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher -K 123 $0 | cut -f 1 -d" ")
+-	c=$(LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher -k $CHKFILE $0 | cut -f 1 -d" ")
+	b=$(run_hasher $hasher -K 123 $0 | cut -f 1 -d" ")
+	c=$(run_hasher $hasher -k $CHKFILE $0 | cut -f 1 -d" ")
+ 	[ x"$a" != x"$b" ] && {
+ 		echo_fail "HMAC calculation for $hasher failed (cmdline key)"
+ 		continue
+@@ -153,23 +144,16 @@ done
+ 
+ for i in $HMACHASHER
+ do
+-	hash=$(basename $i)
+-	hash=${hash%%hmac}
+ 	hasher=$i
+-	t=$(basename $i)
+-	i=$(command -v $t)
+	hash=${hasher%%hmac}
+	i=$(command -v $i)
+ 
+ 	[ -z "$i" ] && {
+-		echo_deact "hmaccalc reference application $t missing"
+-		continue
+-	}
+-
+-	[ ! -e "$hasher" ] && {
+-		echo_fail "Hasher $hasher does not exist"
+		echo_deact "hmaccalc reference application $hasher missing"
+ 		continue
+ 	}
+ 
+-	LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher $0 $ANOTHER > $CHKFILE
+	run_hasher $hasher $0 $ANOTHER > $CHKFILE
+ 	[ $? -ne 0 ] && {
+ 		echo_fail "Generation of hashes with hasher $hasher failed"
+ 		continue
+@@ -191,7 +175,7 @@ do
+ 		continue
+ 	}
+ 
+-	LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher -q -c $CHKFILE
+	run_hasher $hasher -q -c $CHKFILE
+ 	if [ $? -ne 0 ]
+ 	then
+ 		echo_fail "Verification of checker file $CHKFILE with hasher $hasher failed"
+@@ -210,13 +194,8 @@ do
+ 	ref=${i%%hmac}sum
+ 	hasher=$i
+ 
+-	[ ! -e "$hasher" ] && {
+-		echo_fail "Hasher $hasher does not exist"
+-		continue
+-	}
+-
+-	LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $ref $0 $ANOTHER > $CHKFILE
+-	LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher -u -q -c $CHKFILE
+	run_hasher $ref $0 $ANOTHER > $CHKFILE
+	run_hasher $hasher -u -q -c $CHKFILE
+ 	if [ $? -ne 0 ]
+ 	then
+ 		echo_fail "Unkeyed verification with hasher $hasher failed"
+@@ -224,8 +203,8 @@ do
+ 		echo_pass "Unkeyed verification with hasher $hasher"
+ 	fi
+ 
+-	LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher -u $0 $ANOTHER > $CHKFILE
+-	LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $ref --status -c $CHKFILE
+	run_hasher $hasher -u $0 $ANOTHER > $CHKFILE
+	run_hasher $ref --status -c $CHKFILE
+ 	if [ $? -ne 0 ]
+ 	then
+ 		echo_fail "Unkeyed generation of checker file with hasher $hasher failed"
+@@ -239,12 +218,10 @@ done
+ #
+ # Test hmaccalc's ignored compatibility options:
+ #
+-for i in $HMACHASHER
+for hasher in $HMACHASHER
+ do
+-	hasher=$i
+-
+ 	compat="-d -P -b"
+-	LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher $compat $0 $ANOTHER > /dev/null
+	run_hasher $hasher $compat $0 $ANOTHER > /dev/null
+ 	if [ $? -ne 0 ]
+ 	then
+ 		echo_fail "Hasher $hasher does not accept compatiblity options: $compat"
+@@ -256,11 +233,9 @@ done
+ #
+ # Test hmaccalc's -S option:
+ #
+-for i in $HMACHASHER
+for hasher in $HMACHASHER
+ do
+-	hasher=$i
+-
+-	LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher -S >$CHKFILE
+	run_hasher $hasher -S >$CHKFILE
+ 	if [ $? -ne 0 ]
+ 	then
+ 		echo_fail "Hasher $hasher does not accept the -S option"
+@@ -277,11 +252,9 @@ done
+ #
+ # Test hmaccalc's -h option:
+ #
+-for i in $HMACHASHER
+for hasher in $HMACHASHER
+ do
+-	hasher=$i
+-
+-	LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher -h sha1 $0 $ANOTHER >$CHKFILE
+	run_hasher $hasher -h sha1 $0 $ANOTHER >$CHKFILE
+ 	if [ $? -ne 0 ]
+ 	then
+ 		echo_fail "Hasher $hasher does not accept the -h option"
+@@ -289,8 +262,7 @@ do
+ 		continue
+ 	fi
+ 
+-	LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $TMPDIR/sha1hmac $0 $ANOTHER | \
+-		diff $CHKFILE -
+	run_hasher sha1hmac $0 $ANOTHER | diff $CHKFILE -
+ 	if  [ $? -ne 0 ]
+ 	then
+ 		echo_fail "Hasher $hasher does not work correctly with the -h option"
+@@ -328,7 +300,7 @@ function run_kat() {
+ 	expand_string "$data" >"$ANOTHER"
+ 	echo "${result#0x}  $ANOTHER" >"$CHKFILE"
+ 
+-	LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname "${TMPDIR}/$hasher" -q \
+	run_hasher $hasher -q \
+ 		-k <(expand_string "$key") -c "$CHKFILE" $truncate_opt
+ 	if [ $? -ne 0 ]
+ 	then
+@@ -337,7 +309,7 @@ function run_kat() {
+ 		echo_pass "Verification of hasher $hasher -c ... with KAT '$id'"
+ 	fi
+ 
+-	LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname "${TMPDIR}/$hasher" -q \
+	run_hasher $hasher -q \
+ 		-k <(expand_string "$key") "$ANOTHER" $truncate_opt \
+ 		| diff - "$CHKFILE"
+ 	if [ $? -ne 0 ]
--- a/libkcapi-1.1.0-kcapi-hasher_Fix_FIPS_self-check_always_failing.patch
+++ b/libkcapi-1.1.0-kcapi-hasher_Fix_FIPS_self-check_always_failing.patch
@ -0,0 +1,34 @@
+From 3a860a5d5231e4912d4611397752f2010467a578 Mon Sep 17 00:00:00 2001
+From: Ondrej Mosnacek <omosnace@redhat.com>
+Date: Mon, 16 Apr 2018 19:35:57 +0200
+Subject: [PATCH] kcapi-hasher: Fix FIPS self-check always failing
+
+---
+ apps/kcapi-hasher.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/apps/kcapi-hasher.c b/apps/kcapi-hasher.c
+index 861db79..a5e9c71 100644
+--- a/apps/kcapi-hasher.c
+++ b/apps/kcapi-hasher.c
+@@ -583,6 +583,7 @@ static int process_checkfile(const struct hash_params *params,
+ 				if (ret >= 0)
+ 					ret++;
+ 			}
+			checked_any = 1;
+ 		} else {
+ 			/*
+ 			 * fipscheck does not have the filename in the check
+@@ -591,11 +592,10 @@ static int process_checkfile(const struct hash_params *params,
+ 			if (targetfile) {
+ 				ret = hasher(handle, params, targetfile,
+ 				             hexhash, hexhashlen + 1, stdout);
+				checked_any = 1;
+ 				goto out;
+ 			}
+ 		}
+-
+-		checked_any = 1;
+ 	}
+ 
+ out:
--- a/libkcapi-1.1.0-kcapi-hasher_Fix_FIPS_self-check_of_the_libkcapi_library.patch
+++ b/libkcapi-1.1.0-kcapi-hasher_Fix_FIPS_self-check_of_the_libkcapi_library.patch
@ -0,0 +1,373 @@
+From 1ce0b18e588e226f4e9dcc3897236ae938b9d4dd Mon Sep 17 00:00:00 2001
+From: Ondrej Mosnacek <omosnace@redhat.com>
+Date: Wed, 18 Apr 2018 10:03:49 +0200
+Subject: [PATCH 1/4] kcapi-hasher: Use consistent lib self-check params
+
+Since the various hasher tools use different HMAC parameters (hash,
+key) and they all need to check the libkcapi library, it is necessary
+to use a consistent set of parameters for the library itself.
+
+This patch changes the behavior to always check the library using the
+fipscheck hash and key.
+---
+ apps/kcapi-hasher.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/apps/kcapi-hasher.c b/apps/kcapi-hasher.c
+index 480a019..1d76e1d 100644
+--- a/apps/kcapi-hasher.c
+++ b/apps/kcapi-hasher.c
+@@ -611,7 +611,8 @@ static int process_checkfile(const struct hash_params *params,
+ 
+ }
+ 
+-static int fipscheck_self(const struct hash_params *params, int just_print)
+static int fipscheck_self(const struct hash_params *params_bin,
+                          const struct hash_params *params_lib, int just_print)
+ {
+ 	char *checkfile = NULL;
+ 	uint32_t n = 0;
+@@ -668,7 +669,7 @@ static int fipscheck_self(const struct hash_params *params, int just_print)
+ 	}
+ 
+ 	if (just_print) {
+-		ret = hash_files(params, names, 1, 0, 1);
+		ret = hash_files(params_bin, names, 1, 0, 1);
+ 		goto out;
+ 	}
+ 
+@@ -678,7 +679,7 @@ static int fipscheck_self(const struct hash_params *params, int just_print)
+ 		goto out;
+ 	}
+ 
+-	ret = process_checkfile(params, checkfile, selfname, CHK_STATUS);
+	ret = process_checkfile(params_bin, checkfile, selfname, CHK_STATUS);
+ 	if (ret)
+ 		goto out;
+ 
+@@ -710,7 +711,7 @@ static int fipscheck_self(const struct hash_params *params, int just_print)
+ 		goto out;
+ 	}
+ 
+-	ret = process_checkfile(params, checkfile, selfname, CHK_STATUS);
+	ret = process_checkfile(params_lib, checkfile, selfname, CHK_STATUS);
+ 
+ out:
+ 	if (checkfile)
+@@ -1010,7 +1011,8 @@ int main(int argc, char *argv[])
+ 		}
+ 	}
+ 
+-	if (fipscheck_self(params_self, print_self_hash)) {
+	/* library self-check must be consistent across apps: */
+	if (fipscheck_self(params_self, &PARAMS_SELF_FIPSCHECK, print_self_hash)) {
+ 		fprintf(stderr, "Integrity check of application %s failed\n",
+ 			basen);
+ 		ret = 1;
+
+From c69e77d4abd5b77a3f396abb816af1df8c9a7733 Mon Sep 17 00:00:00 2001
+From: Ondrej Mosnacek <omosnace@redhat.com>
+Date: Wed, 18 Apr 2018 11:59:11 +0200
+Subject: [PATCH 2/4] Makefile.am: Properly install checksum files
+
+---
+ Makefile.am | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/Makefile.am b/Makefile.am
+index ed724fe..07e2451 100644
+--- a/Makefile.am
+++ b/Makefile.am
+@@ -139,16 +139,25 @@ EXTRA_bin_kcapi_hasher_DEPENDENCIES = libtool
+ 
+ SCAN_FILES += $(bin_kcapi_hasher_SOURCES)
+ 
+-kcapi_hasher_links = sha1sum sha224sum sha256sum sha384sum sha512sum \
+-	             md5sum fipscheck fipshmac \
+-		     sha1hmac sha224hmac sha256hmac sha384hmac sha512hmac
+hasher_links_fc = sha1sum sha224sum sha256sum sha384sum sha512sum \
+		  md5sum fipscheck fipshmac
+hasher_links_hc = sha1hmac sha224hmac sha256hmac sha384hmac sha512hmac
+hasher_links = $(hasher_links_fc) $(hasher_links_hc)
+
+CHECKSUM_CMD_FC = $(OPENSSL) sha256 -r -hmac orboDeJITITejsirpADONivirpUkvarP
+CHECKSUM_CMD_HC = $(OPENSSL) sha512 -r -hmac FIPS-FTW-RHT2009
+ 
+ install-exec-hook:
+ 	(cd $(DESTDIR)$(bindir) && \
+-	($(foreach link, $(kcapi_hasher_links), $(LN) -f kcapi-hasher $(link);)))
+	($(foreach link, $(hasher_links), $(LN) -f kcapi-hasher $(link);)))
+ if HAVE_OPENSSL
+ 	(cd $(DESTDIR)$(bindir) && \
+-	($(foreach link, $(kcapi_hasher_links), $(OPENSSL) sha256 -hmac orboDeJITITejsirpADONivirpUkvarP $(link) > $(CHECK_PREFIX)$(link).$(CHECK_SUFFIX);)))
+	($(foreach link, $(hasher_links_fc), \
+		$(CHECKSUM_CMD_FC) $(link) > $(CHECK_PREFIX)$(link).$(CHECK_SUFFIX);) \
+	$(foreach link, $(hasher_links_hc), \
+		$(CHECKSUM_CMD_HC) $(link) > $(CHECK_PREFIX)$(link).$(CHECK_SUFFIX);):))
+	($(foreach lib, $(wildcard $(DESTDIR)$(libdir)/libkcapi.so*), \
+		$(CHECKSUM_CMD_FC) $(lib)  > $(CHECK_PREFIX)$(lib).$(CHECK_SUFFIX);):)
+ endif
+ endif
+ 
+
+From a90c618490385d9d6214dd4918dd679b0be0df9f Mon Sep 17 00:00:00 2001
+From: Ondrej Mosnacek <omosnace@redhat.com>
+Date: Wed, 18 Apr 2018 12:17:59 +0200
+Subject: [PATCH 3/4] kcapi-hasher: Add -L option for completeness
+
+Since kcapi-hasher also checks the checksum of the libkcapi library, add
+-L option to print the checksum of the library.
+---
+ apps/kcapi-hasher.c | 130 ++++++++++++++++++++++++++++++----------------------
+ 1 file changed, 75 insertions(+), 55 deletions(-)
+
+diff --git a/apps/kcapi-hasher.c b/apps/kcapi-hasher.c
+index 1d76e1d..7890060 100644
+--- a/apps/kcapi-hasher.c
+++ b/apps/kcapi-hasher.c
+@@ -114,7 +114,7 @@ static void usage(char *name, int fipscheck)
+ 	const char *base = basename(name);
+ 	fprintf(stderr, "\n%s - calculation of hash sum (Using Linux Kernel Crypto API)\n", basename(name));
+ 	fprintf(stderr, "\nUsage:\n");
+-	fprintf(stderr, "\t%s [OPTION]... -S\n", base);
+	fprintf(stderr, "\t%s [OPTION]... -S|-L\n", base);
+ 	if (fipscheck)
+ 		fprintf(stderr, "\t%s [OPTION]... FILE\n", base);
+ 	else {
+@@ -123,6 +123,7 @@ static void usage(char *name, int fipscheck)
+ 	}
+ 	fprintf(stderr, "\nOptions:\n");
+ 	fprintf(stderr, "\t-S --self-sum\t\tPrint checksum of this binary and exit\n");
+	fprintf(stderr, "\t-L --self-sum-lib\tPrint checksum of the libkcapi library and exit\n");
+ 	if (!fipscheck)
+ 		fprintf(stderr, "\t-c --check FILE\t\tVerify hash sums from file\n");
+ 	fprintf(stderr, "\t-u --unkeyed\t\tForce unkeyed hash\n");
+@@ -611,8 +612,13 @@ static int process_checkfile(const struct hash_params *params,
+ 
+ }
+ 
+/* self-check modes: */
+#define SELFCHECK_CHECK		0
+#define SELFCHECK_PRINT_SELF	1
+#define SELFCHECK_PRINT_LIB	2
+
+ static int fipscheck_self(const struct hash_params *params_bin,
+-                          const struct hash_params *params_lib, int just_print)
+                          const struct hash_params *params_lib, int mode)
+ {
+ 	char *checkfile = NULL;
+ 	uint32_t n = 0;
+@@ -626,9 +632,9 @@ static int fipscheck_self(const struct hash_params *params_bin,
+ 	void *dl = NULL, *sym;
+ 
+ #ifdef HAVE_SECURE_GETENV
+-	if (secure_getenv("KCAPI_HASHER_FORCE_FIPS") || just_print) {
+	if (secure_getenv("KCAPI_HASHER_FORCE_FIPS") || mode != SELFCHECK_CHECK) {
+ #else
+-	if (getenv("KCAPI_HASHER_FORCE_FIPS") || just_print) {
+	if (getenv("KCAPI_HASHER_FORCE_FIPS") || mode != SELFCHECK_CHECK) {
+ #endif
+ 		fipsflag[0] = 1;
+ 	} else {
+@@ -660,58 +666,68 @@ static int fipscheck_self(const struct hash_params *params_bin,
+ 	}
+ 
+ 	/* Integrity check of our application. */
+-	memset(selfname, 0, sizeof(selfname));
+-	selfnamesize = readlink("/proc/self/exe", selfname, BUFSIZE);
+-	if (selfnamesize >= BUFSIZE || selfnamesize < 0) {
+-		fprintf(stderr, "Cannot obtain my filename\n");
+-		ret = -EFAULT;
+-		goto out;
+-	}
+	if (mode == SELFCHECK_CHECK || mode == SELFCHECK_PRINT_SELF) {
+		memset(selfname, 0, sizeof(selfname));
+		selfnamesize = readlink("/proc/self/exe", selfname, BUFSIZE);
+		if (selfnamesize >= BUFSIZE || selfnamesize < 0) {
+			fprintf(stderr, "Cannot obtain my filename\n");
+			ret = -EFAULT;
+			goto out;
+		}
+ 
+-	if (just_print) {
+-		ret = hash_files(params_bin, names, 1, 0, 1);
+-		goto out;
+-	}
+		if (mode == SELFCHECK_PRINT_SELF) {
+			ret = hash_files(params_bin, names, 1, 0, 1);
+			goto out;
+		}
+ 
+-	checkfile = get_hmac_file(selfname);
+-	if (!checkfile) {
+-		ret = -ENOMEM;
+-		goto out;
+-	}
+		checkfile = get_hmac_file(selfname);
+		if (!checkfile) {
+			ret = -ENOMEM;
+			goto out;
+		}
+ 
+-	ret = process_checkfile(params_bin, checkfile, selfname, CHK_STATUS);
+-	if (ret)
+-		goto out;
+		ret = process_checkfile(params_bin, checkfile, selfname, CHK_STATUS);
+		if (ret)
+			goto out;
+	}
+ 
+ 	/* Integrity check of shared libkcapi.so file. */
+-	memset(selfname, 0, sizeof(selfname));
+-	snprintf(selfname, (sizeof(selfname) - 1), "libkcapi.so.%u",
+-		 KCAPI_MAJVERSION);
+-	dl = dlopen(selfname, RTLD_NODELETE|RTLD_NOLOAD|RTLD_LAZY);
+-	if (dl == NULL) {
+-		fprintf(stderr, "dlopen of file %s failed\n", selfname);
+-		ret = -EFAULT;
+-		goto out;
+-	}
+	if (mode == SELFCHECK_CHECK || mode == SELFCHECK_PRINT_LIB) {
+		memset(selfname, 0, sizeof(selfname));
+		snprintf(selfname, (sizeof(selfname) - 1), "libkcapi.so.%u",
+		         KCAPI_MAJVERSION);
+		dl = dlopen(selfname, RTLD_NODELETE|RTLD_NOLOAD|RTLD_LAZY);
+		if (dl == NULL) {
+			fprintf(stderr, "dlopen of file %s failed\n", selfname);
+			ret = -EFAULT;
+			goto out;
+		}
+ 
+-	memset(selfname, 0, sizeof(selfname));
+-	sym = dlsym(dl, "kcapi_md_init");
+-	if (sym == NULL || !dladdr(sym, &info)) {
+-		fprintf(stderr, "finding symbol kcapi_md_init failed\n");
+-		ret = -EFAULT;
+-		goto out;
+-	}
+		memset(selfname, 0, sizeof(selfname));
+		sym = dlsym(dl, "kcapi_md_init");
+		if (sym == NULL || !dladdr(sym, &info)) {
+			fprintf(stderr, "finding symbol kcapi_md_init failed\n");
+			ret = -EFAULT;
+			goto out;
+		}
+ 
+-	strncpy(selfname, info.dli_fname, (sizeof(selfname) - 1));
+		strncpy(selfname, info.dli_fname, (sizeof(selfname) - 1));
+ 
+-	free(checkfile);
+-	checkfile = get_hmac_file(selfname);
+-	if (!checkfile) {
+-		ret = -ENOMEM;
+-		goto out;
+-	}
+		if (mode == SELFCHECK_PRINT_LIB) {
+			ret = hash_files(params_lib, names, 1, 0, 1);
+			goto out;
+		}
+
+		if (checkfile)
+			free(checkfile);
+		checkfile = get_hmac_file(selfname);
+		if (!checkfile) {
+			ret = -ENOMEM;
+			goto out;
+		}
+ 
+-	ret = process_checkfile(params_lib, checkfile, selfname, CHK_STATUS);
+		ret = process_checkfile(params_lib, checkfile, selfname, CHK_STATUS);
+	}
+ 
+ out:
+ 	if (checkfile)
+@@ -753,9 +769,9 @@ int main(int argc, char *argv[])
+ 	int hmac = 0;
+ 	int fipscheck = 0;
+ 	int fipshmac = 0;
+-	int print_self_hash = 0;
+	int selfcheck_mode = SELFCHECK_CHECK;
+ 
+-	static const char *opts_short = "c:uh:t:Sqk:K:vbd:P";
+	static const char *opts_short = "c:uh:t:SLqk:K:vbd:P";
+ 	static const struct option opts[] = {
+ 		{"help", 0, 0, 0},
+ 		{"tag", 0, 0, 0},
+@@ -765,6 +781,7 @@ int main(int argc, char *argv[])
+ 		{"hash", 1, 0, 'h'},
+ 		{"truncate", 1, 0, 't'},
+ 		{"self-sum", 0, 0, 'S'},
+		{"self-sum-lib", 0, 0, 'L'},
+ 		{"status", 0, 0, 'q'},
+ 		{"key-file", 1, 0, 'k'},
+ 		{"key", 1, 0, 'K'},
+@@ -932,7 +949,10 @@ int main(int argc, char *argv[])
+ 				params.hashlen /= 8;
+ 				break;
+ 			case 'S':
+-				print_self_hash = 1;
+				selfcheck_mode = SELFCHECK_PRINT_SELF;
+				break;
+			case 'L':
+				selfcheck_mode = SELFCHECK_PRINT_LIB;
+ 				break;
+ 			case 'q':
+ 				loglevel = CHK_STATUS;
+@@ -998,28 +1018,28 @@ int main(int argc, char *argv[])
+ 		}
+ 	}
+ 
+-	if (print_self_hash) {
+	if (selfcheck_mode != SELFCHECK_CHECK) {
+ 		if (checkfile) {
+-			fprintf(stderr, "-S and -c cannot be combined\n");
+			fprintf(stderr, "-S/-L and -c cannot be combined\n");
+ 			ret = 1;
+ 			goto out;
+ 		}
+ 		if (optind != argc) {
+-			fprintf(stderr, "-S cannot be used with input files\n");
+			fprintf(stderr, "-S/-L cannot be used with input files\n");
+ 			ret = 1;
+ 			goto out;
+ 		}
+ 	}
+ 
+ 	/* library self-check must be consistent across apps: */
+-	if (fipscheck_self(params_self, &PARAMS_SELF_FIPSCHECK, print_self_hash)) {
+	if (fipscheck_self(params_self, &PARAMS_SELF_FIPSCHECK, selfcheck_mode)) {
+ 		fprintf(stderr, "Integrity check of application %s failed\n",
+ 			basen);
+ 		ret = 1;
+ 		goto out;
+ 	}
+ 
+-	if (print_self_hash) {
+	if (selfcheck_mode != SELFCHECK_CHECK) {
+ 		ret = 0;
+ 		goto out;
+ 	}
+
+From 7b176840ff60bc596a7c80685ef0a81adbc00e4b Mon Sep 17 00:00:00 2001
+From: Ondrej Mosnacek <omosnace@redhat.com>
+Date: Thu, 19 Apr 2018 10:39:12 +0200
+Subject: [PATCH 4/4] Makefile.am: Do not install kcapi-hasher binary
+
+The kcapi-hasher binary is not usable on its own so it can be removed
+after hard-linking the actual hasher tools.
+---
+ Makefile.am | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/Makefile.am b/Makefile.am
+index 07e2451..383da75 100644
+--- a/Makefile.am
+++ b/Makefile.am
+@@ -150,6 +150,7 @@ CHECKSUM_CMD_HC = $(OPENSSL) sha512 -r -hmac FIPS-FTW-RHT2009
+ install-exec-hook:
+ 	(cd $(DESTDIR)$(bindir) && \
+ 	($(foreach link, $(hasher_links), $(LN) -f kcapi-hasher $(link);)))
+	-rm -f $(DESTDIR)$(bindir)/kcapi-hasher
+ if HAVE_OPENSSL
+ 	(cd $(DESTDIR)$(bindir) && \
+ 	($(foreach link, $(hasher_links_fc), \
--- a/libkcapi-1.1.0-kcapi-hasher_Fix_buffer_overrun_in_get_hmac_file.patch
+++ b/libkcapi-1.1.0-kcapi-hasher_Fix_buffer_overrun_in_get_hmac_file.patch
@ -0,0 +1,23 @@
+From f8e032f150522c17094e36dcf62ec3ebc77e69d8 Mon Sep 17 00:00:00 2001
+From: Ondrej Mosnacek <omosnace@redhat.com>
+Date: Mon, 16 Apr 2018 15:39:03 +0200
+Subject: [PATCH] kcapi-hasher: Fix buffer overrun in get_hmac_file
+
+We need to allocate space also for the terminating null character...
+---
+ apps/kcapi-hasher.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/apps/kcapi-hasher.c b/apps/kcapi-hasher.c
+index 861db79..2b87a45 100644
+--- a/apps/kcapi-hasher.c
+++ b/apps/kcapi-hasher.c
+@@ -360,7 +360,7 @@ static char *get_hmac_file(const char *filename)
+ 		fprintf(stderr, "File too long\n");
+ 		return NULL;
+ 	}
+-	checkfile = malloc(filelen + prefixlen + 1 + suffixlen);
+	checkfile = malloc(filelen + prefixlen + 1 + suffixlen + 1);
+ 	if (!checkfile)
+ 		return NULL;
+ 
--- a/libkcapi.spec
+++ b/libkcapi.spec
@ -1,42 +1,17 @@
 # Shared object version of libkcapi.
 %global vmajor            1
-%global vminor            5
+%global vminor            1
 %global vpatch            0

 # Do we build the replacements packages?
 %bcond_with replace_coreutils
-# Replace fipscheck by default in Fedora 33+:
-%if 0%{?fedora} >= 33 || 0%{?rhel} >= 9
-%bcond_without replace_fipscheck
-%else
 %bcond_with replace_fipscheck
-%endif
 # Replace hmaccalc by default in Fedora 28+:
 %if 0%{?fedora} >= 28 || 0%{?rhel} >= 8
 %bcond_without replace_hmaccalc
 %else
 %bcond_with replace_hmaccalc
 %endif
-%if 0%{?fedora} >= 29 || 0%{?rhel} >= 8
-%bcond_without test_package
-%else
-%bcond_with test_package
-%endif
-# disable cppcheck analysis in ELN/RHEL to avoid the dependency bz#1931518
-%if 0%{?rhel}
-%bcond_with cppcheck
-%else
-%bcond_without cppcheck
-%endif
-
-# Use `--without test` to build without running the tests
-%bcond_without test
-# Use `--without fuzz_test` to skip the fuzz test during build
-%bcond_without fuzz_test
-# Use `--without doc` to build without the -doc subpackage
-%bcond_without doc
-# Use `--without clang_sa` to skip clang static analysis during build
-%bcond_without clang_sa

 # This package needs at least Linux Kernel v4.10.0.
 %global min_kernel_ver    4.10.0
@ -76,7 +51,8 @@

 # Do we replace fipscheck?
 %if %{with replace_fipscheck}
-%global fipscheck_evr     1.5.0-9
+# TODO: Adapt this when replacing fipscheck initially.
+%global fipscheck_evr     1.5.0-3%{?dist}
 %endif

 # Do we replace hmaccalc?
@ -84,69 +60,67 @@
 %global hmaccalc_evr      0.9.14-10%{?dist}
 %endif

-%global apps_coreutils sha1sum sha224sum sha256sum sha384sum sha512sum md5sum sm3sum
-%global apps_hmaccalc sha1hmac sha224hmac sha256hmac sha384hmac sha512hmac sm3hmac
-%global apps_fipscheck fipscheck fipshmac
+%global apps_hmaccalc sha1hmac sha224hmac sha256hmac sha384hmac sha512hmac
+%global apps_fipscheck sha1sum sha224sum sha256sum sha384sum sha512sum md5sum fipscheck fipshmac

-# On old kernels use mock hashers implemented via openssl
-%if %{lua:print(rpm.vercmp(posix.uname('%r'), '3.19'));} >= 0
-%global sha512hmac bin/kcapi-hasher -n sha512hmac
-%global fipshmac   bin/kcapi-hasher -n fipshmac
-%else
-%global sha512hmac bash %{SOURCE2}
-%global fipshmac   bash %{SOURCE3}
-%endif
-
-# Add generation of HMAC checksum of the final stripped
-# binary.  %%define with lazy globbing is used here
+# Add generation of HMAC checksums of the final stripped
+# binaries.  %%define with lazy globbing is used here
 # intentionally, because using %%global does not work.
 %define __spec_install_post                                      \
 %{?__debug_package:%{__debug_install_post}}                      \
 %{__arch_install_post}                                           \
 %{__os_install_post}                                             \
 bin_path=%{buildroot}%{_bindir}                                  \
-lib_path=%{buildroot}%{_libdir}                                  \
-{ %sha512hmac "$bin_path"/kcapi-hasher || exit 1; } |            \\\
-  cut -f 1 -d ' ' >"$lib_path"/hmaccalc/kcapi-hasher.hmac        \
-{ %sha512hmac "$lib_path"/libkcapi.so.%{version} || exit 1; } |  \\\
-  cut -f 1 -d ' ' >"$lib_path"/hmaccalc/libkcapi.so.%{version}.hmac \
-%{__ln_s} libkcapi.so.%{version}.hmac                            \\\
-  "$lib_path"/hmaccalc/libkcapi.so.%{vmajor}.hmac                \
+lib_path=%{buildroot}/%{_lib}                                    \
+for app in %{apps_hmaccalc}; do                                  \
+  test -e "$bin_path"/$app || continue                           \
+  { bin/kcapi-hasher -n sha512hmac "$bin_path"/$app || exit 1; } \\\
+    | cut -f 1 -d ' ' >"$bin_path"/.$app.hmac                    \
+done                                                             \
+for app in %{apps_fipscheck}; do                                 \
+  test -e "$bin_path"/$app || continue                           \
+  bin/kcapi-hasher -n fipshmac "$bin_path"/$app || exit 1        \
+done                                                             \
+%{_sbindir}/hardlink -cfv %{buildroot}%{_bindir}                 \
+bin/kcapi-hasher -n fipshmac "$lib_path"/libkcapi.so.%{version}  \\\
+  || exit 1                                                      \
+%{__ln_s} .libkcapi.so.%{version}.hmac                           \\\
+  "$lib_path"/.libkcapi.so.%{vmajor}.hmac                        \
 %{nil}

+
 Name:           libkcapi
 Version:        %{vmajor}.%{vminor}.%{vpatch}
-Release:        %autorelease
+Release:        5%{?dist}
 Summary:        User space interface to the Linux Kernel Crypto API

-License:        BSD-3-Clause OR GPL-2.0-only
-URL:            https://www.chronox.de/%{name}/
-Source0:        https://www.chronox.de/%{name}/releases/%{version}/%{name}-%{version}.tar.xz
-Source1:        https://www.chronox.de/%{name}/releases/%{version}/%{name}-%{version}.tar.xz.asc
-Source2:        sha512hmac-openssl.sh
-Source3:        fipshmac-openssl.sh
+License:        BSD or GPLv2
+URL:            http://www.chronox.de/%{name}.html
+Source0:        http://www.chronox.de/%{name}/%{name}-%{version}.tar.xz
+Source1:        http://www.chronox.de/%{name}/%{name}-%{version}.tar.xz.asc

-BuildRequires:  bash
+Patch0:         %{giturl}/pull/52.patch#/%{name}-1.1.0-kcapi-hasher_Fix_buffer_overrun_in_get_hmac_file.patch
+Patch1:         %{giturl}/pull/53.patch#/%{name}-1.1.0-kcapi-hasher_Fix_FIPS_self-check_always_failing.patch
+Patch2:         %{giturl}/pull/54.patch#/%{name}-1.1.0-kcapi-hasher_Fix_FIPS_self-check_of_the_libkcapi_library.patch
+Patch3:         %{giturl}/pull/57.patch#/%{name}-1.1.0-kcapi-hasher_Allow_picking_basename_via_cmdline.patch
+
+BuildRequires:  clang
 BuildRequires:  coreutils
+BuildRequires:  cppcheck
+BuildRequires:  docbook-utils-pdf
 BuildRequires:  gcc
-BuildRequires:  git-core
+BuildRequires:  git
 BuildRequires:  hardlink
-BuildRequires:  kernel-headers >= %{min_kernel_ver}
 BuildRequires:  libtool
-BuildRequires:  make
 BuildRequires:  openssl
-BuildRequires:  perl-interpreter
 BuildRequires:  systemd
 BuildRequires:  xmlto
-%if %{with doc}
-BuildRequires:  docbook-utils-pdf
-%endif
-%if %{with clang_sa}
-BuildRequires:  clang
-%endif
-%if %{with cppcheck}
-BuildRequires:  cppcheck >= 2.4
-%endif
+
+# To make sure this is not buildable nor installable if the
+# available Linux Kernel does not support the Linux Kernel
+# Crypto API User Space Interface.
+BuildRequires:  kernel-headers >= %{min_kernel_ver}
+Requires:       kernel         >= %{min_kernel_ver}

 # For ownership of %%{_sysctldir}.
 Requires:       systemd
@ -176,32 +150,18 @@ Requires:       %{name}%{?_isa} == %{version}-%{release}
 Header files for applications that use %{name}.


-%if %{with doc}
 %package        doc
 Summary:        User documentation for the %{name} package
 BuildArch:      noarch
-# Depend on one of the base packages because they have the license files
-# We cannot just bundle them into doc because they might conflict with an
-# older or newer version of the base package.
-Requires:       %{name} == %{version}-%{release}

 %description    doc
 User documentation for %{name}.
-%endif
-
-
-%package        hasher
-Summary:        Common %{name} hashing application
-Requires:       %{name}%{?_isa}    == %{version}-%{release}
-
-%description    hasher
-Provides The kcapi-hasher binary used by other %{name} subpackages.


 %if %{with replace_coreutils}
 %package        checksum
 Summary:        Drop-in replacement for *sum utils provided by the %{name} package
-Requires:       %{name}-hasher%{?_isa} == %{version}-%{release}
+Requires:       %{name}%{?_isa}    == %{version}-%{release}

 Requires:       coreutils%{?_isa}  >= %{coreutils_evr}

@ -217,7 +177,7 @@ coreutils) using %{name}.
 %if %{with replace_fipscheck}
 %package        fipscheck
 Summary:        Drop-in replacements for fipscheck/fipshmac provided by the %{name} package
-Requires:       %{name}-hasher%{?_isa} == %{version}-%{release}
+Requires:       %{name}%{?_isa}   == %{version}-%{release}

 Obsoletes:      fipscheck         <= %{fipscheck_evr}

@ -233,7 +193,7 @@ package fipscheck) using %{name}.
 %if %{with replace_hmaccalc}
 %package        hmaccalc
 Summary:        Drop-in replacements for hmaccalc provided by the %{name} package
-Requires:       %{name}-hasher%{?_isa} == %{version}-%{release}
+Requires:       %{name}%{?_isa}   == %{version}-%{release}

 Obsoletes:      hmaccalc          <= %{hmaccalc_evr}

@ -258,8 +218,7 @@ is highly discouraged.

 %package        tools
 Summary:        Utility applications for the %{name} package
-Requires:       %{name}%{?_isa}        == %{version}-%{release}
-Requires:       %{name}-hasher%{?_isa} == %{version}-%{release}
+Requires:       %{name}%{?_isa} == %{version}-%{release}

 %description    tools
 Utility applications that are provided with %{name}.  This includes
@ -267,33 +226,9 @@ tools to use message digests, symmetric ciphers and random number
 generators implemented in the Linux kernel from command line.


-%if %{with test_package}
-%package        tests
-Summary:        Testing scripts for the %{name} package
-Requires:       %{name}%{?_isa}       == %{version}-%{release}
-Requires:       %{name}-tools%{?_isa} == %{version}-%{release}
-%if %{with replace_hmaccalc}
-Requires:       %{name}-hmaccalc%{?_isa} == %{version}-%{release}
-%endif
-%if %{with replace_coreutils}
-Requires:       %{name}-checksum%{?_isa} == %{version}-%{release}
-%endif
-Requires:       coreutils
-Requires:       openssl
-Requires:       perl-interpreter
-
-%description    tests
-Auxiliary scripts for testing %{name}.
-%endif
-
-
 %prep
 %autosetup -p 1 -S git

-# Work around https://bugzilla.redhat.com/show_bug.cgi?id=2258240
-sed -i -e 's|XML V45|XML V4.1.2|' -e 's|/xml/4\.5/|/xml/4.1.2/|' \
-    lib/doc/libkcapi.tmpl
-
 %if %{with_sysctl_tweak}
 %{__cat} << EOF > README.%{distroname_ext}
 This package increases the default limit of the ancillary buffer size
@ -328,12 +263,16 @@ net.core.optmem_max = %{sysctl_optmem_max}
 EOF
 %endif

+%ifarch %{power64}
+%{__sed} -i -e 's!exit \$failures!#&!' test/kcapi-enc-test.sh
+%endif
+
 %{_bindir}/autoreconf -fiv


 %build
 %configure               \
-  --libdir=%{_libdir}    \
+  --libdir=/%{_lib}      \
  --disable-silent-rules \
  --enable-kcapi-encapp  \
  --enable-kcapi-dgstapp \
@ -343,14 +282,9 @@ EOF
  --enable-kcapi-test    \
  --enable-shared        \
  --enable-static        \
-  --enable-sum-prefix=   \
-  --enable-sum-dir=%{_libdir} \
+  --enable-sum-prefix=.  \
  --with-pkgconfigdir=%{_libdir}/pkgconfig
-%if %{with doc}
 %make_build all doc
-%else
-%make_build all man
-%endif


 %install
@ -367,32 +301,22 @@ EOF
 %if %{with_sysctl_tweak}
  README.%{distroname_ext}                          \
 %endif
-%if %{with doc}
-  doc/%{name}.p{df,s}                               \
-%endif
-  README.md CHANGES.md TODO
-
-%if %{with doc}
+  README.md CHANGES TODO doc/%{name}.p{df,s}
 %{__cp} -pr lib/doc/html %{buildroot}%{_pkgdocdir}
-%endif

 # Install replacement tools, if enabled.
-%if %{with replace_coreutils}
-for app in %apps_coreutils; do
-  %{__ln_s} ../libexec/libkcapi/$app %{buildroot}%{_bindir}/$app
-done
+%if !%{with replace_coreutils}
+%{__rm} -f                            \
+  %{buildroot}%{_bindir}/md5sum       \
+  %{buildroot}%{_bindir}/sha*sum
 %endif

-%if %{with replace_fipscheck}
-for app in %apps_fipscheck; do
-  %{__ln_s} ../libexec/libkcapi/$app %{buildroot}%{_bindir}/$app
-done
+%if !%{with replace_fipscheck}
+%{__rm} -f %{buildroot}%{_bindir}/fips*
 %endif

-%if %{with replace_hmaccalc}
-for app in %apps_hmaccalc; do
-  %{__ln_s} ../libexec/libkcapi/$app %{buildroot}%{_bindir}/$app
-done
+%if !%{with replace_hmaccalc}
+%{__rm} -f %{buildroot}%{_bindir}/sha*hmac
 %endif

 # We don't ship autocrap dumplings.
@ -404,51 +328,35 @@ done
 # Remove 0-size files.
 %{_bindir}/find %{buildroot} -type f -size 0 -print -delete

-%if %{with doc}
 # Make sure all docs have non-exec permissions, except for the dirs.
 %{_bindir}/find %{buildroot}%{_pkgdocdir} -type f -print | \
  %{_bindir}/xargs %{__chmod} -c 0644
 %{_bindir}/find %{buildroot}%{_pkgdocdir} -type d -print | \
  %{_bindir}/xargs %{__chmod} -c 0755
-%endif

 # Possibly save some space by hardlinking.
 for d in %{_mandir} %{_pkgdocdir}; do
-  %{_bindir}/hardlink -cfv %{buildroot}$d
+  %{_sbindir}/hardlink -cfv %{buildroot}$d
 done


 %check
 # Some basic sanity checks.
-%if %{with clang_sa}
-%make_build scan
-%endif
-%if %{with cppcheck}
-# -UCHECK_DIR: string literal concatenation raises syntaxError
-# with cppcheck-2.11 (https://trac.cppcheck.net/ticket/11830)
-# --check-level=exhaustive: otherwise it emits warnings that get
-# treated like errors
-%make_build cppcheck CPPCHECK="cppcheck --check-level=exhaustive -UCHECK_DIR"
-%endif
+for t in cppcheck scan; do
+  %make_build $t
+done

-%if %{with test}
 # On some arches `/proc/sys/net/core/optmem_max` is lower than 20480,
 # which is the lowest limit needed to run the testsuite.  If that limit
 # is not met, we do not run it.
 %if %{test_optmem_max} >= 20480
-# Skip the testsuite on old kernels.
-%if %{lua:print(rpm.vercmp(posix.uname('%r'), '5.1'));} >= 0
 # Real testsuite.
 pushd test
-%if %{with fuzz_test}
 ENABLE_FUZZ_TEST=1 \
-%endif
 NO_32BIT_TEST=1    \
  ./test-invocation.sh
 popd
 %endif
-%endif
-%endif


 %ldconfig_scriptlets
@ -458,10 +366,10 @@ popd
 %doc %dir %{_pkgdocdir}
 %doc %{_pkgdocdir}/README.md
 %license COPYING*
-%{_libdir}/%{name}.so.%{vmajor}
-%{_libdir}/%{name}.so.%{version}
-%{_libdir}/hmaccalc/%{name}.so.%{vmajor}.hmac
-%{_libdir}/hmaccalc/%{name}.so.%{version}.hmac
+/%{_lib}/%{name}.so.%{vmajor}
+/%{_lib}/%{name}.so.%{version}
+/%{_lib}/.%{name}.so.%{vmajor}.hmac
+/%{_lib}/.%{name}.so.%{version}.hmac
 %if %{with_sysctl_tweak}
 %doc %{_pkgdocdir}/README.%{distroname_ext}
 %{_sysctldir}/%{sysctl_prio}-%{name}-optmem_max.conf
@ -469,78 +377,146 @@ popd


 %files          devel
-%doc %{_pkgdocdir}/CHANGES.md
+%doc %{_pkgdocdir}/CHANGES
 %doc %{_pkgdocdir}/TODO
 %{_includedir}/kcapi.h
 %{_mandir}/man3/kcapi_*.3.*
-%{_libdir}/%{name}.so
+/%{_lib}/%{name}.so
 %{_libdir}/pkgconfig/%{name}.pc


-%if %{with doc}
 %files          doc
-%doc %{_pkgdocdir}/html
-%doc %{_pkgdocdir}/%{name}.pdf
-%doc %{_pkgdocdir}/%{name}.ps
-%endif
-
-
-%files          hasher
-%{_bindir}/kcapi-hasher
-%{_libexecdir}/%{name}/md5sum
-%{_libexecdir}/%{name}/sha*sum
-%{_libexecdir}/%{name}/sm*sum
-%{_libexecdir}/%{name}/fips*
-%{_libexecdir}/%{name}/sha*hmac
-%{_libexecdir}/%{name}/sm*hmac
-%{_libdir}/hmaccalc/kcapi-hasher.hmac
-%{_mandir}/man1/kcapi-hasher.1.*
+%doc %{_pkgdocdir}
+%license %{_datadir}/licenses/%{name}*


 %if %{with replace_coreutils}
 %files          checksum
 %{_bindir}/md5sum
+%{_bindir}/.md5sum.hmac
 %{_bindir}/sha*sum
-%{_bindir}/sm*sum
+%{_bindir}/.sha*sum.hmac
 %endif

 %if %{with replace_fipscheck}
 %files          fipscheck
 %{_bindir}/fips*
+%{_bindir}/.fips*.hmac
 %endif

 %if %{with replace_hmaccalc}
 %files          hmaccalc
 %{_bindir}/sha*hmac
-%{_bindir}/sm*hmac
+%{_bindir}/.sha*hmac.hmac
 %endif


 %files          static
-%{_libdir}/%{name}.a
+/%{_lib}/%{name}.a


 %files          tools
-%{_bindir}/kcapi
-%{_bindir}/kcapi-convenience
-%{_bindir}/kcapi-dgst
-%{_bindir}/kcapi-enc
-%{_bindir}/kcapi-enc-test-large
-%{_bindir}/kcapi-rng
-%{_bindir}/kcapi-speed
-%{_mandir}/man1/kcapi-dgst.1.*
-%{_mandir}/man1/kcapi-enc.1.*
-%{_mandir}/man1/kcapi-rng.1.*
-
-
-%if %{with test_package}
-%files          tests
-%{_libexecdir}/%{name}/kcapi
-%{_libexecdir}/%{name}/kcapi-convenience
-%{_libexecdir}/%{name}/kcapi-enc-test-large
-%{_libexecdir}/%{name}/*.sh
-%endif
+%{_bindir}/kcapi*
+%{_mandir}/man1/kcapi*.1.*


 %changelog
-%autochangelog
+* Wed May 09 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.0-5
+- Skip CLang static analysis in RHEL
+- Revert "Skip CLang static analysis in RHEL"
+- Use own sha512hmac and fipscheck
+
+* Wed May 02 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.0-4
+- Fix description lines being too long
+
+* Fri Apr 27 2018 Björn Esser <besser82@fedoraproject.org> - 1.1.0-3
+- Fix conditional for hmaccalc replacement
+
+* Mon Apr 16 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.0-2
+- Enable hmaccalc replacements in Fedora 28+
+
+* Thu Apr 12 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.1.0-1
+- Update to upstream version 1.1.0
+
+* Sat Mar 31 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-10
+- Replace single patches with a monolitic one from upstream
+- Obsolete replacements subpackage
+- Ignore failing tests on %%{power64} temporarily
+
+* Thu Mar 08 2018 Ondrej Mosnáček <omosnace@redhat.com> - 1.0.3-9
+- Split up the replacements subpackage
+
+* Mon Feb 26 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-8
+- Increase optmem_max preset to 81920
+
+* Mon Feb 26 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-7
+- Obsoletes work by package name, not by provides (rhbz#1537225)
+
+* Sun Feb 25 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-6
+- Add patch to fix a copy-paste typo
+
+* Sat Feb 17 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-5
+- Add patch to fix build with -Werror
+
+* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org>
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
+
+* Sun Feb 04 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-3
+- Switch to %%ldconfig_scriptlets
+
+* Wed Jan 17 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-2
+- Decrease optmem_max preset to 40960
+- Let the build fail, if the minimum kernel version cannot be met
+- Conditionalize the sysctl.d tweak on version of the kernel
+- Conditionalize the name of README.distro on the distro
+
+* Tue Jan 16 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-1
+- Initial import (rhbz#1533929)
+
+* Tue Jan 16 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.13
+- Increase optmem_max preset to 81920
+
+* Tue Jan 16 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.12
+- Add sysctl.d preset and README.fedora
+
+* Mon Jan 15 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.11
+- Make the contents of the -replacements package configurable
+
+* Mon Jan 15 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.10
+- Fix Obsoletes of the -replacements package
+
+* Sun Jan 14 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.9
+- Disable the -replacements package until we have a plan for it
+
+* Sun Jan 14 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.8
+- Move the kcapi-hasher binary to -replacements package, since it is
+  not of much use without the linked invocation names and saves the
+  extra Requires on the -tools package
+
+* Sun Jan 14 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.7
+- Fix internal Requires of sub-packages
+- Hardlink files in %%{_bindir}
+
+* Sun Jan 14 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.6
+- Add patches from upstream
+
+* Sat Jan 13 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.5
+- Add patches from upstream
+
+* Sat Jan 13 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.4
+- Asume the testsuite cannot be run, if the value of optmem_max cannot
+  be obtained
+
+* Sat Jan 13 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.3
+- Move libraries to /%%{_lib} instead of %%{_libdir}, which is useful
+  during boot when the library might be needed before a potentially
+  seperate /usr partition is mounted
+
+* Sat Jan 13 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.2
+- Asume optmem_max is at least 20480, if the real value cannot be obtained
+
+* Fri Jan 12 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.3-0.1
+- New upstream release
+
+* Wed Jan 10 2018 Björn Esser <besser82@fedoraproject.org> - 1.0.2-0.1
+- Initial rpm release (rhbz#1533929)
--- a/plans/ci.fmf
+++ b/plans/ci.fmf
@ -1,5 +0,0 @@
-summary: Run CI tests
-discover:
-    how: fmf
-execute:
-    how: tmt
--- a/sha512hmac-openssl.sh
+++ b/sha512hmac-openssl.sh
@ -1,6 +0,0 @@
-#!/bin/bash
-
-# Mocks sha512hmac using the openssl tool.
-# Only for use during RPM build.
-
-openssl sha512 -hmac FIPS-FTW-RHT2009 -hex "$1" | cut -f 2 -d ' '
--- a/4
+++ b/4
@ -1,2 +1,2 @@
-SHA512 (libkcapi-1.5.0.tar.xz) = db156ee94fc63815a31876ab072aca72a806b26961c43f2caf8495c53b95484de71cd3be84dc9e5c9560e9ee704979be059ff6c102b4893d6bbdf9a8a69a667a
-SHA512 (libkcapi-1.5.0.tar.xz.asc) = 69cfb6bf98f89c503e7fda07a54eddb9fcc2dafe418f1bc1216c051565c214a6caab83495c19b650a5c6e46e22080f8df4dd2152ab364993ed5badd256495159
+SHA512 (libkcapi-1.1.0.tar.xz) = 8d7a775a7ac3a16e006cc21a40e0dbc2c068879fb277ef7a96f706aa0a822ee6c29dba59e34a42cc2e3da926ee242fb47b6c1486d846d9028d662bc71e8f25fd
+SHA512 (libkcapi-1.1.0.tar.xz.asc) = f2ecc4bc477231a5f2b91476f4d300be32d796cf5f49b0b89e3f5c5735690fe4b6baec3739aa8df99eaac6eac66a63b23ce25e9b16bec17f8748fcac19843968
--- a/tests/main.fmf
+++ b/tests/main.fmf
@ -1,29 +0,0 @@
-component: libkcapi
-contact: Ondrej Mosnacek <omosnacek@gmail.com>
-
-/upstream:
-    require: [libkcapi-tests]
-    tier: 1
-
-    /basic:
-        summary: Basic functionality
-        test: /usr/libexec/libkcapi/test.sh
-    /encrypt:
-        summary: Encryption/decryption
-        test: /usr/libexec/libkcapi/kcapi-enc-test.sh
-    /encrypt-large:
-        summary: Encryption/decryption of large data
-        test: /usr/libexec/libkcapi/kcapi-enc-test-large.sh
-    /digest:
-        summary: Message digest
-        test: /usr/libexec/libkcapi/kcapi-dgst-test.sh
-    /digest-convenience:
-        summary: Message digest convenience functions
-        test: /usr/libexec/libkcapi/kcapi-convenience.sh
-    /hasher:
-        summary: Checksum helpers
-        test: /usr/libexec/libkcapi/hasher-test.sh
-    /fuzz-test:
-        summary: Fuzz test
-        test: /usr/libexec/libkcapi/kcapi-fuzz-test.sh
-        duration: 2h