From edbdcfe8dd068b858a2597980418204f8f8aa97e Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Thu, 18 May 2017 13:16:00 +0200
Subject: [PATCH 1/8] Make "trust anchor --remove" work again

---
 p11-kit-modifiable.patch | 158 +++++++++++++++++++++++++++++++++++++++
 p11-kit.spec             |   7 +-
 2 files changed, 164 insertions(+), 1 deletion(-)
 create mode 100644 p11-kit-modifiable.patch

diff --git a/p11-kit-modifiable.patch b/p11-kit-modifiable.patch
new file mode 100644
index 0000000..958bc4f
--- /dev/null
+++ b/p11-kit-modifiable.patch
@@ -0,0 +1,158 @@
+From acf8c4a91a76bf8049f6bfbd95b04e2e36bae4ea Mon Sep 17 00:00:00 2001
+From: Daiki Ueno <dueno@redhat.com>
+Date: Thu, 18 May 2017 10:45:26 +0200
+Subject: [PATCH 1/2] Revert "trust: Honor "modifiable" setting in persist
+ file"
+
+This reverts commit 8eed1e60b0921d05872e2f43eee9088cef038d7e, which
+broke "trust anchor --remove".
+---
+ trust/input/verisign-v1.p11-kit |  1 -
+ trust/parser.c                  | 10 +---------
+ trust/test-parser.c             |  1 -
+ 3 files changed, 1 insertion(+), 11 deletions(-)
+
+diff --git a/trust/input/verisign-v1.p11-kit b/trust/input/verisign-v1.p11-kit
+index aea49ea..eaa080d 100644
+--- a/trust/input/verisign-v1.p11-kit
++++ b/trust/input/verisign-v1.p11-kit
+@@ -1,6 +1,5 @@
+ [p11-kit-object-v1]
+ trusted: true
+-modifiable: false
+ 
+ -----BEGIN CERTIFICATE-----
+ MIICPDCCAaUCED9pHoGc8JpK83P/uUii5N0wDQYJKoZIhvcNAQEFBQAwXzELMAkG
+diff --git a/trust/parser.c b/trust/parser.c
+index 52d1128..41513d4 100644
+--- a/trust/parser.c
++++ b/trust/parser.c
+@@ -610,7 +610,6 @@ p11_parser_format_persist (p11_parser *parser,
+ {
+ 	CK_BBOOL modifiablev = CK_TRUE;
+ 	CK_ATTRIBUTE *attrs;
+-	CK_ATTRIBUTE *attr;
+ 	p11_array *objects;
+ 	bool ret;
+ 	int i;
+@@ -631,14 +630,7 @@ p11_parser_format_persist (p11_parser *parser,
+ 	ret = p11_persist_read (parser->persist, parser->basename, data, length, objects);
+ 	if (ret) {
+ 		for (i = 0; i < objects->num; i++) {
+-			/* By default, we mark objects read from a persist
+-			 * file as modifiable, as the persist format is
+-			 * writable.  However, if CKA_MODIFIABLE is explictly
+-			 * set in the file, respect the setting.  */
+-			attrs = objects->elem[i];
+-			attr = p11_attrs_find_valid (objects->elem[i], CKA_MODIFIABLE);
+-			if (!attr)
+-				attrs = p11_attrs_build (attrs, &modifiable, NULL);
++			attrs = p11_attrs_build (objects->elem[i], &modifiable, NULL);
+ 			sink_object (parser, attrs);
+ 		}
+ 	}
+diff --git a/trust/test-parser.c b/trust/test-parser.c
+index 088cff9..b5c2525 100644
+--- a/trust/test-parser.c
++++ b/trust/test-parser.c
+@@ -168,7 +168,6 @@ test_parse_p11_kit_persist (void)
+ 		{ CKA_CLASS, &certificate, sizeof (certificate) },
+ 		{ CKA_VALUE, (void *)verisign_v1_ca, sizeof (verisign_v1_ca) },
+ 		{ CKA_TRUSTED, &truev, sizeof (truev) },
+-		{ CKA_MODIFIABLE, &falsev, sizeof (falsev) },
+ 		{ CKA_X_DISTRUSTED, &falsev, sizeof (falsev) },
+ 		{ CKA_INVALID },
+ 	};
+-- 
+2.9.4
+
+
+From 66c6a7e912d39d66cd4cc91375ac7be418bf7176 Mon Sep 17 00:00:00 2001
+From: Daiki Ueno <dueno@redhat.com>
+Date: Thu, 18 May 2017 11:11:45 +0200
+Subject: [PATCH 2/2] trust: Check magic comment in persist file for
+ modifiablity
+
+A persistent file written by the trust module starts with the line "#
+This file has been auto-generated and written by p11-kit".  This can
+be used as a magic word to determine whether the objects read from a
+.p11-kit file are read-only.
+---
+ trust/parser.c     | 6 +++++-
+ trust/persist.c    | 9 ++++++++-
+ trust/test-token.c | 1 +
+ 3 files changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/trust/parser.c b/trust/parser.c
+index 41513d4..abe86fc 100644
+--- a/trust/parser.c
++++ b/trust/parser.c
+@@ -49,6 +49,7 @@
+ #include "pem.h"
+ #include "pkcs11x.h"
+ #include "persist.h"
++#include "types.h"
+ #include "x509.h"
+ 
+ #include <libtasn1.h>
+@@ -630,7 +631,10 @@ p11_parser_format_persist (p11_parser *parser,
+ 	ret = p11_persist_read (parser->persist, parser->basename, data, length, objects);
+ 	if (ret) {
+ 		for (i = 0; i < objects->num; i++) {
+-			attrs = p11_attrs_build (objects->elem[i], &modifiable, NULL);
++			CK_BBOOL generatedv;
++			attrs = objects->elem[i];
++			if (p11_attrs_find_bool (attrs, CKA_X_GENERATED, &generatedv) && generatedv)
++				attrs = p11_attrs_build (attrs, &modifiable, NULL);
+ 			sink_object (parser, attrs);
+ 		}
+ 	}
+diff --git a/trust/persist.c b/trust/persist.c
+index 63a531e..928260e 100644
+--- a/trust/persist.c
++++ b/trust/persist.c
+@@ -631,6 +631,9 @@ p11_persist_read (p11_persist *persist,
+ 	CK_ATTRIBUTE *attrs;
+ 	bool failed;
+ 	bool skip;
++	CK_BBOOL generatedv = CK_FALSE;
++	CK_ATTRIBUTE generated = { CKA_X_GENERATED, &generatedv, sizeof (generatedv) };
++	static const char comment[] = "# This file has been auto-generated and written by p11-kit.";
+ 
+ 	return_val_if_fail (persist != NULL, false);
+ 	return_val_if_fail (objects != NULL, false);
+@@ -639,6 +642,10 @@ p11_persist_read (p11_persist *persist,
+ 	attrs = NULL;
+ 	failed = false;
+ 
++	if (length >= sizeof (comment) - 1 &&
++	    memcmp ((const char *)data, comment, sizeof (comment) - 1) == 0)
++		generatedv = CK_TRUE;
++
+ 	p11_lexer_init (&lexer, filename, (const char *)data, length);
+ 	while (p11_lexer_next (&lexer, &failed)) {
+ 		switch (lexer.tok_type) {
+@@ -650,7 +657,7 @@ p11_persist_read (p11_persist *persist,
+ 				p11_lexer_msg (&lexer, "unrecognized or invalid section header");
+ 				skip = true;
+ 			} else {
+-				attrs = p11_attrs_build (NULL, NULL);
++				attrs = p11_attrs_build (NULL, &generated, NULL);
+ 				return_val_if_fail (attrs != NULL, false);
+ 				skip = false;
+ 			}
+diff --git a/trust/test-token.c b/trust/test-token.c
+index ad22fcb..3e7d735 100644
+--- a/trust/test-token.c
++++ b/trust/test-token.c
+@@ -610,6 +610,7 @@ static void
+ test_modify_multiple (void)
+ {
+ 	const char *test_data =
++		"# This file has been auto-generated and written by p11-kit.\n"
+ 		"[p11-kit-object-v1]\n"
+ 		"class: data\n"
+ 		"label: \"first\"\n"
+-- 
+2.9.4
+
diff --git a/p11-kit.spec b/p11-kit.spec
index 683b312..d444c46 100644
--- a/p11-kit.spec
+++ b/p11-kit.spec
@@ -1,12 +1,13 @@
 Name:           p11-kit
 Version:        0.23.5
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        Library for loading and sharing PKCS#11 modules
 
 License:        BSD
 URL:            http://p11-glue.freedesktop.org/p11-kit.html
 Source0:        https://github.com/p11-glue/p11-kit/releases/download/%{version}/p11-kit-%{version}.tar.gz
 Source1:        trust-extract-compat
+Patch0:         p11-kit-modifiable.patch
 
 BuildRequires:  libtasn1-devel >= 2.3
 BuildRequires:  libffi-devel
@@ -61,6 +62,7 @@ feature is still experimental.
 
 %prep
 %setup -q
+%patch0 -p1
 
 %build
 # These paths are the source paths that  come from the plan here:
@@ -133,6 +135,9 @@ fi
 
 
 %changelog
+* Thu May 18 2017 Daiki Ueno <dueno@redhat.com> - 0.23.5-2
+- Make "trust anchor --remove" work again
+
 * Thu Mar  2 2017 Daiki Ueno <dueno@redhat.com> - 0.23.5-1
 - Update to 0.23.5 release
 - Rename -tools subpackage to -server and remove systemd unit files

From e6da7f0a6910b6f68a51ffc92561908ce27e98c9 Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Thu, 18 May 2017 14:52:14 +0200
Subject: [PATCH 2/8] Update p11-kit-modifiable.patch to simplify the logic

---
 p11-kit-modifiable.patch | 98 ++++++++++++++++++++++++++++++++++++++++
 p11-kit.spec             |  5 +-
 2 files changed, 102 insertions(+), 1 deletion(-)

diff --git a/p11-kit-modifiable.patch b/p11-kit-modifiable.patch
index 958bc4f..3d4b4d3 100644
--- a/p11-kit-modifiable.patch
+++ b/p11-kit-modifiable.patch
@@ -156,3 +156,101 @@ index ad22fcb..3e7d735 100644
 -- 
 2.9.4
 
+From d661194319f2375c1764125b449bf924c0cbc8a1 Mon Sep 17 00:00:00 2001
+From: Daiki Ueno <dueno@redhat.com>
+Date: Thu, 18 May 2017 14:27:36 +0200
+Subject: [PATCH] trust: Simplify the check for the magic
+
+Instead of reusing the CKA_X_GENERATED attribute, check the file
+contents directly in the caller side.
+---
+ trust/parser.c  |  7 +++----
+ trust/persist.c | 19 +++++++++++--------
+ trust/persist.h |  3 +++
+ 3 files changed, 17 insertions(+), 12 deletions(-)
+
+diff --git a/trust/parser.c b/trust/parser.c
+index abe86fc..f92cdc9 100644
+--- a/trust/parser.c
++++ b/trust/parser.c
+@@ -630,11 +630,10 @@ p11_parser_format_persist (p11_parser *parser,
+ 
+ 	ret = p11_persist_read (parser->persist, parser->basename, data, length, objects);
+ 	if (ret) {
++		if (!p11_persist_is_generated (data, length))
++			modifiablev = CK_FALSE;
+ 		for (i = 0; i < objects->num; i++) {
+-			CK_BBOOL generatedv;
+-			attrs = objects->elem[i];
+-			if (p11_attrs_find_bool (attrs, CKA_X_GENERATED, &generatedv) && generatedv)
+-				attrs = p11_attrs_build (attrs, &modifiable, NULL);
++			attrs = p11_attrs_build (objects->elem[i], &modifiable, NULL);
+ 			sink_object (parser, attrs);
+ 		}
+ 	}
+diff --git a/trust/persist.c b/trust/persist.c
+index 928260e..887b316 100644
+--- a/trust/persist.c
++++ b/trust/persist.c
+@@ -70,6 +70,16 @@ p11_persist_magic (const unsigned char *data,
+ 	return (strnstr ((char *)data, "[" PERSIST_HEADER "]", length) != NULL);
+ }
+ 
++bool
++p11_persist_is_generated (const unsigned char *data,
++			  size_t length)
++{
++	static const char comment[] =
++		"# This file has been auto-generated and written by p11-kit.";
++	return length >= sizeof (comment) - 1 &&
++		memcmp ((const char *)data, comment, sizeof (comment) - 1) == 0;
++}
++
+ p11_persist *
+ p11_persist_new (void)
+ {
+@@ -631,9 +641,6 @@ p11_persist_read (p11_persist *persist,
+ 	CK_ATTRIBUTE *attrs;
+ 	bool failed;
+ 	bool skip;
+-	CK_BBOOL generatedv = CK_FALSE;
+-	CK_ATTRIBUTE generated = { CKA_X_GENERATED, &generatedv, sizeof (generatedv) };
+-	static const char comment[] = "# This file has been auto-generated and written by p11-kit.";
+ 
+ 	return_val_if_fail (persist != NULL, false);
+ 	return_val_if_fail (objects != NULL, false);
+@@ -642,10 +649,6 @@ p11_persist_read (p11_persist *persist,
+ 	attrs = NULL;
+ 	failed = false;
+ 
+-	if (length >= sizeof (comment) - 1 &&
+-	    memcmp ((const char *)data, comment, sizeof (comment) - 1) == 0)
+-		generatedv = CK_TRUE;
+-
+ 	p11_lexer_init (&lexer, filename, (const char *)data, length);
+ 	while (p11_lexer_next (&lexer, &failed)) {
+ 		switch (lexer.tok_type) {
+@@ -657,7 +660,7 @@ p11_persist_read (p11_persist *persist,
+ 				p11_lexer_msg (&lexer, "unrecognized or invalid section header");
+ 				skip = true;
+ 			} else {
+-				attrs = p11_attrs_build (NULL, &generated, NULL);
++				attrs = p11_attrs_build (NULL, NULL);
+ 				return_val_if_fail (attrs != NULL, false);
+ 				skip = false;
+ 			}
+diff --git a/trust/persist.h b/trust/persist.h
+index 0ef142c..6344e4e 100644
+--- a/trust/persist.h
++++ b/trust/persist.h
+@@ -60,4 +60,7 @@ bool             p11_persist_write  (p11_persist *persist,
+ 
+ void             p11_persist_free   (p11_persist *persist);
+ 
++bool             p11_persist_is_generated (const unsigned char *data,
++					   size_t length);
++
+ #endif /* P11_PERSIST_H_ */
+-- 
+2.9.4
+
diff --git a/p11-kit.spec b/p11-kit.spec
index d444c46..2148501 100644
--- a/p11-kit.spec
+++ b/p11-kit.spec
@@ -1,6 +1,6 @@
 Name:           p11-kit
 Version:        0.23.5
-Release:        2%{?dist}
+Release:        3%{?dist}
 Summary:        Library for loading and sharing PKCS#11 modules
 
 License:        BSD
@@ -135,6 +135,9 @@ fi
 
 
 %changelog
+* Thu May 18 2017 Daiki Ueno <dueno@redhat.com> - 0.23.5-3
+- Update p11-kit-modifiable.patch to simplify the logic
+
 * Thu May 18 2017 Daiki Ueno <dueno@redhat.com> - 0.23.5-2
 - Make "trust anchor --remove" work again
 

From 6b58b6728e57ec927f100f077a3b5f55e7da77ea Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Tue, 15 Aug 2017 14:56:14 +0200
Subject: [PATCH 3/8] Update to 0.23.8 release

---
 p11-kit.spec | 9 +++++----
 sources      | 2 +-
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/p11-kit.spec b/p11-kit.spec
index 2148501..3a9bb1a 100644
--- a/p11-kit.spec
+++ b/p11-kit.spec
@@ -1,13 +1,12 @@
 Name:           p11-kit
-Version:        0.23.5
-Release:        3%{?dist}
+Version:        0.23.8
+Release:        1%{?dist}
 Summary:        Library for loading and sharing PKCS#11 modules
 
 License:        BSD
 URL:            http://p11-glue.freedesktop.org/p11-kit.html
 Source0:        https://github.com/p11-glue/p11-kit/releases/download/%{version}/p11-kit-%{version}.tar.gz
 Source1:        trust-extract-compat
-Patch0:         p11-kit-modifiable.patch
 
 BuildRequires:  libtasn1-devel >= 2.3
 BuildRequires:  libffi-devel
@@ -62,7 +61,6 @@ feature is still experimental.
 
 %prep
 %setup -q
-%patch0 -p1
 
 %build
 # These paths are the source paths that  come from the plan here:
@@ -135,6 +133,9 @@ fi
 
 
 %changelog
+* Tue Aug 15 2017 Daiki Ueno <dueno@redhat.com> - 0.23.8-1
+- Update to 0.23.8 release
+
 * Thu May 18 2017 Daiki Ueno <dueno@redhat.com> - 0.23.5-3
 - Update p11-kit-modifiable.patch to simplify the logic
 
diff --git a/sources b/sources
index 0c0cf6b..f8458d5 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (p11-kit-0.23.5.tar.gz) = 5276db3c9bb14d5e0441e7b781033b1684edfc1d4da88a9c9ce501ed1f6121918d3afe6725ceb0e2d65fc253c2f9eebf37c3380741de6c1b09cec06ae86417a7
+SHA512 (p11-kit-0.23.8.tar.gz) = cf3b28e4bed8cc18ef49fa7af1e4ad04f1b97dbd08f1e0bab07c280f0aa35306c01e35896bc990c9ed7bdecd6c5ce697ccb95288ef04dd3740db384343ea2f24

From d16a588ec48d882b754e8d3b79bbc6f24fb06fc3 Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Tue, 15 Aug 2017 16:01:53 +0200
Subject: [PATCH 4/8] Remove unused patch

---
 p11-kit-modifiable.patch | 256 ---------------------------------------
 1 file changed, 256 deletions(-)
 delete mode 100644 p11-kit-modifiable.patch

diff --git a/p11-kit-modifiable.patch b/p11-kit-modifiable.patch
deleted file mode 100644
index 3d4b4d3..0000000
--- a/p11-kit-modifiable.patch
+++ /dev/null
@@ -1,256 +0,0 @@
-From acf8c4a91a76bf8049f6bfbd95b04e2e36bae4ea Mon Sep 17 00:00:00 2001
-From: Daiki Ueno <dueno@redhat.com>
-Date: Thu, 18 May 2017 10:45:26 +0200
-Subject: [PATCH 1/2] Revert "trust: Honor "modifiable" setting in persist
- file"
-
-This reverts commit 8eed1e60b0921d05872e2f43eee9088cef038d7e, which
-broke "trust anchor --remove".
----
- trust/input/verisign-v1.p11-kit |  1 -
- trust/parser.c                  | 10 +---------
- trust/test-parser.c             |  1 -
- 3 files changed, 1 insertion(+), 11 deletions(-)
-
-diff --git a/trust/input/verisign-v1.p11-kit b/trust/input/verisign-v1.p11-kit
-index aea49ea..eaa080d 100644
---- a/trust/input/verisign-v1.p11-kit
-+++ b/trust/input/verisign-v1.p11-kit
-@@ -1,6 +1,5 @@
- [p11-kit-object-v1]
- trusted: true
--modifiable: false
- 
- -----BEGIN CERTIFICATE-----
- MIICPDCCAaUCED9pHoGc8JpK83P/uUii5N0wDQYJKoZIhvcNAQEFBQAwXzELMAkG
-diff --git a/trust/parser.c b/trust/parser.c
-index 52d1128..41513d4 100644
---- a/trust/parser.c
-+++ b/trust/parser.c
-@@ -610,7 +610,6 @@ p11_parser_format_persist (p11_parser *parser,
- {
- 	CK_BBOOL modifiablev = CK_TRUE;
- 	CK_ATTRIBUTE *attrs;
--	CK_ATTRIBUTE *attr;
- 	p11_array *objects;
- 	bool ret;
- 	int i;
-@@ -631,14 +630,7 @@ p11_parser_format_persist (p11_parser *parser,
- 	ret = p11_persist_read (parser->persist, parser->basename, data, length, objects);
- 	if (ret) {
- 		for (i = 0; i < objects->num; i++) {
--			/* By default, we mark objects read from a persist
--			 * file as modifiable, as the persist format is
--			 * writable.  However, if CKA_MODIFIABLE is explictly
--			 * set in the file, respect the setting.  */
--			attrs = objects->elem[i];
--			attr = p11_attrs_find_valid (objects->elem[i], CKA_MODIFIABLE);
--			if (!attr)
--				attrs = p11_attrs_build (attrs, &modifiable, NULL);
-+			attrs = p11_attrs_build (objects->elem[i], &modifiable, NULL);
- 			sink_object (parser, attrs);
- 		}
- 	}
-diff --git a/trust/test-parser.c b/trust/test-parser.c
-index 088cff9..b5c2525 100644
---- a/trust/test-parser.c
-+++ b/trust/test-parser.c
-@@ -168,7 +168,6 @@ test_parse_p11_kit_persist (void)
- 		{ CKA_CLASS, &certificate, sizeof (certificate) },
- 		{ CKA_VALUE, (void *)verisign_v1_ca, sizeof (verisign_v1_ca) },
- 		{ CKA_TRUSTED, &truev, sizeof (truev) },
--		{ CKA_MODIFIABLE, &falsev, sizeof (falsev) },
- 		{ CKA_X_DISTRUSTED, &falsev, sizeof (falsev) },
- 		{ CKA_INVALID },
- 	};
--- 
-2.9.4
-
-
-From 66c6a7e912d39d66cd4cc91375ac7be418bf7176 Mon Sep 17 00:00:00 2001
-From: Daiki Ueno <dueno@redhat.com>
-Date: Thu, 18 May 2017 11:11:45 +0200
-Subject: [PATCH 2/2] trust: Check magic comment in persist file for
- modifiablity
-
-A persistent file written by the trust module starts with the line "#
-This file has been auto-generated and written by p11-kit".  This can
-be used as a magic word to determine whether the objects read from a
-.p11-kit file are read-only.
----
- trust/parser.c     | 6 +++++-
- trust/persist.c    | 9 ++++++++-
- trust/test-token.c | 1 +
- 3 files changed, 14 insertions(+), 2 deletions(-)
-
-diff --git a/trust/parser.c b/trust/parser.c
-index 41513d4..abe86fc 100644
---- a/trust/parser.c
-+++ b/trust/parser.c
-@@ -49,6 +49,7 @@
- #include "pem.h"
- #include "pkcs11x.h"
- #include "persist.h"
-+#include "types.h"
- #include "x509.h"
- 
- #include <libtasn1.h>
-@@ -630,7 +631,10 @@ p11_parser_format_persist (p11_parser *parser,
- 	ret = p11_persist_read (parser->persist, parser->basename, data, length, objects);
- 	if (ret) {
- 		for (i = 0; i < objects->num; i++) {
--			attrs = p11_attrs_build (objects->elem[i], &modifiable, NULL);
-+			CK_BBOOL generatedv;
-+			attrs = objects->elem[i];
-+			if (p11_attrs_find_bool (attrs, CKA_X_GENERATED, &generatedv) && generatedv)
-+				attrs = p11_attrs_build (attrs, &modifiable, NULL);
- 			sink_object (parser, attrs);
- 		}
- 	}
-diff --git a/trust/persist.c b/trust/persist.c
-index 63a531e..928260e 100644
---- a/trust/persist.c
-+++ b/trust/persist.c
-@@ -631,6 +631,9 @@ p11_persist_read (p11_persist *persist,
- 	CK_ATTRIBUTE *attrs;
- 	bool failed;
- 	bool skip;
-+	CK_BBOOL generatedv = CK_FALSE;
-+	CK_ATTRIBUTE generated = { CKA_X_GENERATED, &generatedv, sizeof (generatedv) };
-+	static const char comment[] = "# This file has been auto-generated and written by p11-kit.";
- 
- 	return_val_if_fail (persist != NULL, false);
- 	return_val_if_fail (objects != NULL, false);
-@@ -639,6 +642,10 @@ p11_persist_read (p11_persist *persist,
- 	attrs = NULL;
- 	failed = false;
- 
-+	if (length >= sizeof (comment) - 1 &&
-+	    memcmp ((const char *)data, comment, sizeof (comment) - 1) == 0)
-+		generatedv = CK_TRUE;
-+
- 	p11_lexer_init (&lexer, filename, (const char *)data, length);
- 	while (p11_lexer_next (&lexer, &failed)) {
- 		switch (lexer.tok_type) {
-@@ -650,7 +657,7 @@ p11_persist_read (p11_persist *persist,
- 				p11_lexer_msg (&lexer, "unrecognized or invalid section header");
- 				skip = true;
- 			} else {
--				attrs = p11_attrs_build (NULL, NULL);
-+				attrs = p11_attrs_build (NULL, &generated, NULL);
- 				return_val_if_fail (attrs != NULL, false);
- 				skip = false;
- 			}
-diff --git a/trust/test-token.c b/trust/test-token.c
-index ad22fcb..3e7d735 100644
---- a/trust/test-token.c
-+++ b/trust/test-token.c
-@@ -610,6 +610,7 @@ static void
- test_modify_multiple (void)
- {
- 	const char *test_data =
-+		"# This file has been auto-generated and written by p11-kit.\n"
- 		"[p11-kit-object-v1]\n"
- 		"class: data\n"
- 		"label: \"first\"\n"
--- 
-2.9.4
-
-From d661194319f2375c1764125b449bf924c0cbc8a1 Mon Sep 17 00:00:00 2001
-From: Daiki Ueno <dueno@redhat.com>
-Date: Thu, 18 May 2017 14:27:36 +0200
-Subject: [PATCH] trust: Simplify the check for the magic
-
-Instead of reusing the CKA_X_GENERATED attribute, check the file
-contents directly in the caller side.
----
- trust/parser.c  |  7 +++----
- trust/persist.c | 19 +++++++++++--------
- trust/persist.h |  3 +++
- 3 files changed, 17 insertions(+), 12 deletions(-)
-
-diff --git a/trust/parser.c b/trust/parser.c
-index abe86fc..f92cdc9 100644
---- a/trust/parser.c
-+++ b/trust/parser.c
-@@ -630,11 +630,10 @@ p11_parser_format_persist (p11_parser *parser,
- 
- 	ret = p11_persist_read (parser->persist, parser->basename, data, length, objects);
- 	if (ret) {
-+		if (!p11_persist_is_generated (data, length))
-+			modifiablev = CK_FALSE;
- 		for (i = 0; i < objects->num; i++) {
--			CK_BBOOL generatedv;
--			attrs = objects->elem[i];
--			if (p11_attrs_find_bool (attrs, CKA_X_GENERATED, &generatedv) && generatedv)
--				attrs = p11_attrs_build (attrs, &modifiable, NULL);
-+			attrs = p11_attrs_build (objects->elem[i], &modifiable, NULL);
- 			sink_object (parser, attrs);
- 		}
- 	}
-diff --git a/trust/persist.c b/trust/persist.c
-index 928260e..887b316 100644
---- a/trust/persist.c
-+++ b/trust/persist.c
-@@ -70,6 +70,16 @@ p11_persist_magic (const unsigned char *data,
- 	return (strnstr ((char *)data, "[" PERSIST_HEADER "]", length) != NULL);
- }
- 
-+bool
-+p11_persist_is_generated (const unsigned char *data,
-+			  size_t length)
-+{
-+	static const char comment[] =
-+		"# This file has been auto-generated and written by p11-kit.";
-+	return length >= sizeof (comment) - 1 &&
-+		memcmp ((const char *)data, comment, sizeof (comment) - 1) == 0;
-+}
-+
- p11_persist *
- p11_persist_new (void)
- {
-@@ -631,9 +641,6 @@ p11_persist_read (p11_persist *persist,
- 	CK_ATTRIBUTE *attrs;
- 	bool failed;
- 	bool skip;
--	CK_BBOOL generatedv = CK_FALSE;
--	CK_ATTRIBUTE generated = { CKA_X_GENERATED, &generatedv, sizeof (generatedv) };
--	static const char comment[] = "# This file has been auto-generated and written by p11-kit.";
- 
- 	return_val_if_fail (persist != NULL, false);
- 	return_val_if_fail (objects != NULL, false);
-@@ -642,10 +649,6 @@ p11_persist_read (p11_persist *persist,
- 	attrs = NULL;
- 	failed = false;
- 
--	if (length >= sizeof (comment) - 1 &&
--	    memcmp ((const char *)data, comment, sizeof (comment) - 1) == 0)
--		generatedv = CK_TRUE;
--
- 	p11_lexer_init (&lexer, filename, (const char *)data, length);
- 	while (p11_lexer_next (&lexer, &failed)) {
- 		switch (lexer.tok_type) {
-@@ -657,7 +660,7 @@ p11_persist_read (p11_persist *persist,
- 				p11_lexer_msg (&lexer, "unrecognized or invalid section header");
- 				skip = true;
- 			} else {
--				attrs = p11_attrs_build (NULL, &generated, NULL);
-+				attrs = p11_attrs_build (NULL, NULL);
- 				return_val_if_fail (attrs != NULL, false);
- 				skip = false;
- 			}
-diff --git a/trust/persist.h b/trust/persist.h
-index 0ef142c..6344e4e 100644
---- a/trust/persist.h
-+++ b/trust/persist.h
-@@ -60,4 +60,7 @@ bool             p11_persist_write  (p11_persist *persist,
- 
- void             p11_persist_free   (p11_persist *persist);
- 
-+bool             p11_persist_is_generated (const unsigned char *data,
-+					   size_t length);
-+
- #endif /* P11_PERSIST_H_ */
--- 
-2.9.4
-

From 9ace4b154a798eb67971b6d81b43c72c801faf06 Mon Sep 17 00:00:00 2001
From: Stef Walter <stefw@redhat.com>
Date: Thu, 21 Sep 2017 00:35:32 +0200
Subject: [PATCH 5/8] tests: Add initial integration test for p11-kit

These are documented here and will be used to ensure that p11-kit
works as expected.

https://fedoraproject.org/wiki/CI

This is just the first such test. Feel free to edit it if there
are mistakes or add others, or check out the docs:

https://fedoraproject.org/wiki/CI/Tests
---
 tests/.gitignore                              |  2 +
 tests/tests.yml                               | 14 +++++
 .../PURPOSE                                   | 17 ++++++
 .../runtest.sh                                | 59 +++++++++++++++++++
 4 files changed, 92 insertions(+)
 create mode 100644 tests/.gitignore
 create mode 100644 tests/tests.yml
 create mode 100644 tests/trust-anchor-complains-about-invalid-attribute-and/PURPOSE
 create mode 100755 tests/trust-anchor-complains-about-invalid-attribute-and/runtest.sh

diff --git a/tests/.gitignore b/tests/.gitignore
new file mode 100644
index 0000000..13555f0
--- /dev/null
+++ b/tests/.gitignore
@@ -0,0 +1,2 @@
+*.retry
+artifacts/
diff --git a/tests/tests.yml b/tests/tests.yml
new file mode 100644
index 0000000..6188ad8
--- /dev/null
+++ b/tests/tests.yml
@@ -0,0 +1,14 @@
+---
+# This first play always runs on the local staging system
+- hosts: localhost
+  roles:
+  - role: standard-test-beakerlib
+    tags:
+    - classic
+    - atomic
+    - container
+    tests:
+    - trust-anchor-complains-about-invalid-attribute-and
+    required_packages:
+    - openssl
+    - p11-kit
diff --git a/tests/trust-anchor-complains-about-invalid-attribute-and/PURPOSE b/tests/trust-anchor-complains-about-invalid-attribute-and/PURPOSE
new file mode 100644
index 0000000..e7886f9
--- /dev/null
+++ b/tests/trust-anchor-complains-about-invalid-attribute-and/PURPOSE
@@ -0,0 +1,17 @@
+PURPOSE of /CoreOS/p11-kit/trust-anchor-complains-about-invalid-attribute-and
+Description: Test for trust anchor complains about invalid attribute and
+Author: Hubert Kario <hkario@redhat.com>
+Bug summary: trust anchor complains about invalid attribute and fails when a new certificate tries to store into trust place
+
+Steps to Reproduce:
+1. /etc/pki/tls/certs/make-dummy-cert mycert-tmp.pem
+2. openssl x509 -in mycert-tmp.pem -addtrust clientAuth -addtrust serverAuth -addtrust emailProtection -out mycert.pem
+3. trust anchor --store mycert.pem
+
+Actual results:
+p11-kit: the CKA_TRUSTED attribute is not valid for the object
+p11-kit: couldn't create object: Certain fields have invalid values
+
+
+Expected results:
+Certificate is stored in trust place.
diff --git a/tests/trust-anchor-complains-about-invalid-attribute-and/runtest.sh b/tests/trust-anchor-complains-about-invalid-attribute-and/runtest.sh
new file mode 100755
index 0000000..3ca17e1
--- /dev/null
+++ b/tests/trust-anchor-complains-about-invalid-attribute-and/runtest.sh
@@ -0,0 +1,59 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/p11-kit/trust-anchor-complains-about-invalid-attribute-and
+#   Description: Test for trust anchor complains about invalid attribute and
+#   Author: Hubert Kario <hkario@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2017 Red Hat, Inc.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="p11-kit"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
+        rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
+        rlRun "pushd $TmpDir"
+        rlRun "rlFileBackup --clean /etc/pki"
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        DUMMY_MAKER_BIN="/etc/pki/tls/certs/make-dummy-cert"
+        [ -x /usr/bin/make-dummy-cert ] && DUMMY_MAKER_BIN="/usr/bin/make-dummy-cert"
+        rlRun "$DUMMY_MAKER_BIN mycert-tmp.pem"
+        rlRun "openssl x509 -in mycert-tmp.pem -addtrust clientAuth -addtrust serverAuth -addtrust emailProtection -out mycert.pem"
+        rlAssertNotExists "/etc/pki/ca-trust/source/localhost.localdomain.p11-kit"
+        rlRun -s "trust anchor --store mycert.pem"
+        rlAssertNotGrep "p11-kit:" $rlRun_LOG
+        rlAssertExists "/etc/pki/ca-trust/source/localhost.localdomain.p11-kit"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "popd"
+        rlRun "rlFileRestore"
+        rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd

From b07aba67cf8c1c93ef37e00e8cc20e709c144697 Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Wed, 4 Oct 2017 13:21:48 +0200
Subject: [PATCH 6/8] Update to 0.23.9-1

- Update to upstream 0.23.9 release
---
 .gitignore   |  2 ++
 p11-kit.spec | 12 ++++++++++--
 sources      |  3 ++-
 3 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/.gitignore b/.gitignore
index bdef1dd..d9dfc82 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,3 +3,5 @@
 /*.src.rpm
 /p11-kit-0.*/
 /x86_64/
+/trust-extract-compat
+/p11-kit-0.23.9.tar.gz
diff --git a/p11-kit.spec b/p11-kit.spec
index 3a9bb1a..bdb72f1 100644
--- a/p11-kit.spec
+++ b/p11-kit.spec
@@ -1,6 +1,7 @@
+# This spec file has been automatically updated
+Version:	0.23.9
+Release: 1%{?dist}
 Name:           p11-kit
-Version:        0.23.8
-Release:        1%{?dist}
 Summary:        Library for loading and sharing PKCS#11 modules
 
 License:        BSD
@@ -12,6 +13,9 @@ BuildRequires:  libtasn1-devel >= 2.3
 BuildRequires:  libffi-devel
 BuildRequires:  gtk-doc
 BuildRequires:	systemd
+# Work around for https://bugzilla.redhat.com/show_bug.cgi?id=1497147
+# Remove this once it is fixed
+BuildRequires:  pkgconfig(glib-2.0)
 
 %description
 p11-kit provides a way to load and enumerate PKCS#11 modules, as well
@@ -123,6 +127,7 @@ fi
 %files trust
 %{_bindir}/trust
 %dir %{_libdir}/pkcs11
+%ghost %{_libdir}/libnssckbi.so
 %{_libdir}/pkcs11/p11-kit-trust.so
 %{_datadir}/p11-kit/modules/p11-kit-trust.module
 %{_libexecdir}/p11-kit/trust-extract-compat
@@ -133,6 +138,9 @@ fi
 
 
 %changelog
+* Wed Oct 04 2017 Daiki Ueno <dueno@redhat.com> - 0.23.9-1
+- Update to upstream 0.23.9 release
+
 * Tue Aug 15 2017 Daiki Ueno <dueno@redhat.com> - 0.23.8-1
 - Update to 0.23.8 release
 
diff --git a/sources b/sources
index f8458d5..d8660d0 100644
--- a/sources
+++ b/sources
@@ -1 +1,2 @@
-SHA512 (p11-kit-0.23.8.tar.gz) = cf3b28e4bed8cc18ef49fa7af1e4ad04f1b97dbd08f1e0bab07c280f0aa35306c01e35896bc990c9ed7bdecd6c5ce697ccb95288ef04dd3740db384343ea2f24
+SHA512 (trust-extract-compat) = 91210705f9bcf1a13c0de1ca9943e3ac68296bfcb7953fc59241de060247b470b39be6e914dd4d92e38a78d5df0962c83315ad78f8c0eade8e62d884b05fdd42
+SHA512 (p11-kit-0.23.9.tar.gz) = 6a8a569483763d3ffacadf669b8ba9b9be38a77dd8dc366ca0cb91c44753517fa1879d4422e4e8dfbcac594565727839a619566a170c0f94f8e112f18b0086ed

From e4e4f5629c969cabefa005b85d6299f9176230bc Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Thu, 5 Oct 2017 17:27:55 +0200
Subject: [PATCH 7/8] Update to 0.23.9-2

- server: Make it possible to eval envvar settings
---
 .gitignore                    |  3 ++
 p11-kit-client.service        | 11 ++++++++
 p11-kit-server-eval-env.patch | 52 +++++++++++++++++++++++++++++++++++
 p11-kit.spec                  | 12 ++++++--
 sources                       |  1 +
 5 files changed, 77 insertions(+), 2 deletions(-)
 create mode 100644 p11-kit-client.service
 create mode 100644 p11-kit-server-eval-env.patch

diff --git a/.gitignore b/.gitignore
index d9dfc82..f2d8374 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,3 +5,6 @@
 /x86_64/
 /trust-extract-compat
 /p11-kit-0.23.9.tar.gz
+/p11-kit-client.service
+/trust-extract-compat
+/p11-kit-0.23.9.tar.gz
diff --git a/p11-kit-client.service b/p11-kit-client.service
new file mode 100644
index 0000000..c9b8e30
--- /dev/null
+++ b/p11-kit-client.service
@@ -0,0 +1,11 @@
+[Unit]
+Description=p11-kit client
+
+[Service]
+Type=oneshot
+RemainAfterExit=true
+RuntimeDirectory=p11-kit
+ExecStart=/usr/bin/true
+
+[Install]
+WantedBy=default.target
diff --git a/p11-kit-server-eval-env.patch b/p11-kit-server-eval-env.patch
new file mode 100644
index 0000000..cd2a812
--- /dev/null
+++ b/p11-kit-server-eval-env.patch
@@ -0,0 +1,52 @@
+From 031912fa844c4f3da327c8b2578d9d9ce2a6473e Mon Sep 17 00:00:00 2001
+From: Daiki Ueno <dueno@redhat.com>
+Date: Thu, 5 Oct 2017 10:59:02 +0200
+Subject: [PATCH] server: Make it possible to eval envvar settings
+
+Previously, calling "eval $(p11-kit server)" from shell hung because
+the program didn't properly close stdout before forking.
+---
+ p11-kit/server.c | 20 +++++++++++---------
+ 1 file changed, 11 insertions(+), 9 deletions(-)
+
+diff --git a/p11-kit/server.c b/p11-kit/server.c
+index 97e18e2..96c77ec 100644
+--- a/p11-kit/server.c
++++ b/p11-kit/server.c
+@@ -346,6 +346,17 @@ server_loop (Server *server,
+ 	if (server->socket == -1)
+ 		return 1;
+ 
++	if (!quiet) {
++		char *path;
++
++		path = p11_path_encode (server->socket_name);
++		printf ("P11_KIT_SERVER_ADDRESS=unix:path=%s\n", path);
++		free (path);
++		printf ("P11_KIT_SERVER_PID=%d\n", getpid ());
++		fflush (stdout);
++		close (STDOUT_FILENO);
++	}
++
+ 	/* run as daemon */
+ 	if (!foreground) {
+ 		pid = fork ();
+@@ -372,15 +383,6 @@ server_loop (Server *server,
+ 
+ 	sigprocmask (SIG_BLOCK, &blockset, NULL);
+ 
+-	if (!quiet) {
+-		char *path;
+-
+-		path = p11_path_encode (server->socket_name);
+-		printf ("P11_KIT_SERVER_ADDRESS=unix:path=%s\n", path);
+-		free (path);
+-		printf ("P11_KIT_SERVER_PID=%d\n", getpid ());
+-	}
+-
+ 	/* accept connections */
+ 	ret = 0;
+ 	for (;;) {
+-- 
+2.13.6
+
diff --git a/p11-kit.spec b/p11-kit.spec
index bdb72f1..7e60dec 100644
--- a/p11-kit.spec
+++ b/p11-kit.spec
@@ -1,6 +1,7 @@
 # This spec file has been automatically updated
 Version:	0.23.9
-Release: 1%{?dist}
+Release: 2%{?dist}
+Patch1:	p11-kit-server-eval-env.patch
 Name:           p11-kit
 Summary:        Library for loading and sharing PKCS#11 modules
 
@@ -8,6 +9,7 @@ License:        BSD
 URL:            http://p11-glue.freedesktop.org/p11-kit.html
 Source0:        https://github.com/p11-glue/p11-kit/releases/download/%{version}/p11-kit-%{version}.tar.gz
 Source1:        trust-extract-compat
+Source2:	p11-kit-client.service
 
 BuildRequires:  libtasn1-devel >= 2.3
 BuildRequires:  libffi-devel
@@ -64,7 +66,7 @@ feature is still experimental.
 
 
 %prep
-%setup -q
+%autosetup -p1
 
 %build
 # These paths are the source paths that  come from the plan here:
@@ -80,6 +82,8 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/pkcs11/*.la
 install -p -m 755 %{SOURCE1} $RPM_BUILD_ROOT%{_libexecdir}/p11-kit/
 # Install the example conf with %%doc instead
 rm $RPM_BUILD_ROOT%{_sysconfdir}/pkcs11/pkcs11.conf.example
+mkdir -p $RPM_BUILD_ROOT%{_userunitdir}
+install -p -m 644 %{SOURCE2} $RPM_BUILD_ROOT%{_userunitdir}
 
 %check
 make check
@@ -134,10 +138,14 @@ fi
 
 %files server
 %{_libdir}/pkcs11/p11-kit-client.so
+%{_userunitdir}/p11-kit-client.service
 %{_libexecdir}/p11-kit/p11-kit-server
 
 
 %changelog
+* Thu Oct 05 2017 Daiki Ueno <dueno@redhat.com> - 0.23.9-2
+- server: Make it possible to eval envvar settings
+
 * Wed Oct 04 2017 Daiki Ueno <dueno@redhat.com> - 0.23.9-1
 - Update to upstream 0.23.9 release
 
diff --git a/sources b/sources
index d8660d0..e959f3c 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,3 @@
+SHA512 (p11-kit-client.service) = 0f08618851c6eafb35c630957044fc96324be4d3828cdd2aa9b5d6e1245549197ca5b969d6a2f735c893d73c02e885cdc3205bd43e37f6124ebc6cfa61970d3b
 SHA512 (trust-extract-compat) = 91210705f9bcf1a13c0de1ca9943e3ac68296bfcb7953fc59241de060247b470b39be6e914dd4d92e38a78d5df0962c83315ad78f8c0eade8e62d884b05fdd42
 SHA512 (p11-kit-0.23.9.tar.gz) = 6a8a569483763d3ffacadf669b8ba9b9be38a77dd8dc366ca0cb91c44753517fa1879d4422e4e8dfbcac594565727839a619566a170c0f94f8e112f18b0086ed

From 69572929bc4aa81dab377ee2ed602c4bac44c049 Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Wed, 28 Feb 2018 11:34:34 +0100
Subject: [PATCH 8/8] Update to 0.23.10-1

- Update to upstream 0.23.10 release
---
 .gitignore                    |  3 ++
 p11-kit-server-eval-env.patch | 52 -----------------------------------
 p11-kit.spec                  |  8 ++++--
 sources                       |  2 +-
 4 files changed, 9 insertions(+), 56 deletions(-)
 delete mode 100644 p11-kit-server-eval-env.patch

diff --git a/.gitignore b/.gitignore
index f2d8374..775a045 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,3 +8,6 @@
 /p11-kit-client.service
 /trust-extract-compat
 /p11-kit-0.23.9.tar.gz
+/p11-kit-client.service
+/trust-extract-compat
+/p11-kit-0.23.10.tar.gz
diff --git a/p11-kit-server-eval-env.patch b/p11-kit-server-eval-env.patch
deleted file mode 100644
index cd2a812..0000000
--- a/p11-kit-server-eval-env.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From 031912fa844c4f3da327c8b2578d9d9ce2a6473e Mon Sep 17 00:00:00 2001
-From: Daiki Ueno <dueno@redhat.com>
-Date: Thu, 5 Oct 2017 10:59:02 +0200
-Subject: [PATCH] server: Make it possible to eval envvar settings
-
-Previously, calling "eval $(p11-kit server)" from shell hung because
-the program didn't properly close stdout before forking.
----
- p11-kit/server.c | 20 +++++++++++---------
- 1 file changed, 11 insertions(+), 9 deletions(-)
-
-diff --git a/p11-kit/server.c b/p11-kit/server.c
-index 97e18e2..96c77ec 100644
---- a/p11-kit/server.c
-+++ b/p11-kit/server.c
-@@ -346,6 +346,17 @@ server_loop (Server *server,
- 	if (server->socket == -1)
- 		return 1;
- 
-+	if (!quiet) {
-+		char *path;
-+
-+		path = p11_path_encode (server->socket_name);
-+		printf ("P11_KIT_SERVER_ADDRESS=unix:path=%s\n", path);
-+		free (path);
-+		printf ("P11_KIT_SERVER_PID=%d\n", getpid ());
-+		fflush (stdout);
-+		close (STDOUT_FILENO);
-+	}
-+
- 	/* run as daemon */
- 	if (!foreground) {
- 		pid = fork ();
-@@ -372,15 +383,6 @@ server_loop (Server *server,
- 
- 	sigprocmask (SIG_BLOCK, &blockset, NULL);
- 
--	if (!quiet) {
--		char *path;
--
--		path = p11_path_encode (server->socket_name);
--		printf ("P11_KIT_SERVER_ADDRESS=unix:path=%s\n", path);
--		free (path);
--		printf ("P11_KIT_SERVER_PID=%d\n", getpid ());
--	}
--
- 	/* accept connections */
- 	ret = 0;
- 	for (;;) {
--- 
-2.13.6
-
diff --git a/p11-kit.spec b/p11-kit.spec
index 7e60dec..2554f1d 100644
--- a/p11-kit.spec
+++ b/p11-kit.spec
@@ -1,7 +1,6 @@
 # This spec file has been automatically updated
-Version:	0.23.9
-Release: 2%{?dist}
-Patch1:	p11-kit-server-eval-env.patch
+Version:	0.23.10
+Release: 1%{?dist}
 Name:           p11-kit
 Summary:        Library for loading and sharing PKCS#11 modules
 
@@ -143,6 +142,9 @@ fi
 
 
 %changelog
+* Wed Feb 28 2018 Daiki Ueno <dueno@redhat.com> - 0.23.10-1
+- Update to upstream 0.23.10 release
+
 * Thu Oct 05 2017 Daiki Ueno <dueno@redhat.com> - 0.23.9-2
 - server: Make it possible to eval envvar settings
 
diff --git a/sources b/sources
index e959f3c..3fa1635 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
 SHA512 (p11-kit-client.service) = 0f08618851c6eafb35c630957044fc96324be4d3828cdd2aa9b5d6e1245549197ca5b969d6a2f735c893d73c02e885cdc3205bd43e37f6124ebc6cfa61970d3b
 SHA512 (trust-extract-compat) = 91210705f9bcf1a13c0de1ca9943e3ac68296bfcb7953fc59241de060247b470b39be6e914dd4d92e38a78d5df0962c83315ad78f8c0eade8e62d884b05fdd42
-SHA512 (p11-kit-0.23.9.tar.gz) = 6a8a569483763d3ffacadf669b8ba9b9be38a77dd8dc366ca0cb91c44753517fa1879d4422e4e8dfbcac594565727839a619566a170c0f94f8e112f18b0086ed
+SHA512 (p11-kit-0.23.10.tar.gz) = 42a004613f951e4e18c10cd204bcba348267cc7b3ae0d9f26d69012b086af446947660575d5751539b8d4dd77fa9b684054ad5ac978119e0a2e94fcdf9842178