From ca3ae7081fc597cb7889ff7bf1448ac8ca83760d Mon Sep 17 00:00:00 2001 From: Tomas Hrcka Date: Tue, 10 Sep 2024 20:03:48 +0200 Subject: [PATCH 1/2] The package violates crypto policies, retired by FESCO decision https://pagure.io/fesco/issue/32675 --- .gitignore | 2 - README.md | 3 - bodhi.template.last | 44 ---------- dead.package | 1 + sources | 1 - wolfssl-fips-ver3-macro.patch | 36 -------- wolfssl.spec | 153 ---------------------------------- 7 files changed, 1 insertion(+), 239 deletions(-) delete mode 100644 .gitignore delete mode 100644 README.md delete mode 100644 bodhi.template.last create mode 100644 dead.package delete mode 100644 sources delete mode 100644 wolfssl-fips-ver3-macro.patch delete mode 100644 wolfssl.spec diff --git a/.gitignore b/.gitignore deleted file mode 100644 index 4ad6cb0..0000000 --- a/.gitignore +++ /dev/null @@ -1,2 +0,0 @@ -/wolfssl-5.7.0.tar.gz -/wolfssl-5.7.2.tar.gz diff --git a/README.md b/README.md deleted file mode 100644 index b6e617e..0000000 --- a/README.md +++ /dev/null @@ -1,3 +0,0 @@ -# wolfssl - -The wolfssl package diff --git a/bodhi.template.last b/bodhi.template.last deleted file mode 100644 index 79346e5..0000000 --- a/bodhi.template.last +++ /dev/null @@ -1,44 +0,0 @@ -[ wolfssl-5.7.0-1.fc41 ] - -# bugfix, security, enhancement, newpackage (required) -type=newpackage - -# testing, stable -request=testing - -# Bug numbers: 1234,9876 -bugs=2302646 - -# Severity: low, medium, high, urgent -# This is required for security updates. -severity=unspecified - -display_name= - - -# Here is where you give an explanation of your update. -# Content can span multiple lines, as long as they are indented deeper than -# the first line. For example, -# notes=first line -# second line -# and so on -notes=Initial specfile - -# Enable request automation based on the stable/unstable karma thresholds -autokarma=True -stable_karma=3 -unstable_karma=-3 - -# Automatically close bugs when this marked as stable -close_bugs=True - -# Suggest that users performs one of the following actions after the update: -# unspecified, restart, logout -# The default value is unspecified -suggest=unspecified - -# A boolean to require that all of the bugs in your update have been confirmed by testers. -require_bugs=True - -# A boolean to require that this update passes all test cases before reaching stable. -require_testcases=True diff --git a/dead.package b/dead.package new file mode 100644 index 0000000..530e48e --- /dev/null +++ b/dead.package @@ -0,0 +1 @@ +The package violates crypto policies, retired by FESCO decision https://pagure.io/fesco/issue/32675 diff --git a/sources b/sources deleted file mode 100644 index bbfa188..0000000 --- a/sources +++ /dev/null @@ -1 +0,0 @@ -SHA512 (wolfssl-5.7.2.tar.gz) = daec6427cbee6628da0dcaad2f721efb0591532fcb3bd688e7212aaca8a442ac10176e5b9eb6b14fea6c49a613d6b086ff777eafc5c27b25d51f758ad0aa13bd diff --git a/wolfssl-fips-ver3-macro.patch b/wolfssl-fips-ver3-macro.patch deleted file mode 100644 index 831b89a..0000000 --- a/wolfssl-fips-ver3-macro.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 86bb273fef8e94c5b2ffc1a215dac3034b0b38b5 Mon Sep 17 00:00:00 2001 -From: Andrew Bauer -Date: Mon, 19 Aug 2024 14:21:48 -0500 -Subject: [PATCH] move fips_version macro - ---- - wolfssl/wolfcrypt/sha3.h | 10 +++++----- - 1 file changed, 5 insertions(+), 5 deletions(-) - -diff --git a/wolfssl/wolfcrypt/sha3.h b/wolfssl/wolfcrypt/sha3.h -index e1ce33a1bf..75a662caea 100644 ---- a/wolfssl/wolfcrypt/sha3.h -+++ b/wolfssl/wolfcrypt/sha3.h -@@ -30,17 +30,17 @@ - #ifdef HAVE_FIPS - /* for fips @wc_fips */ - #include -+ -+ #if FIPS_VERSION3_GE(6,0,0) -+ extern const unsigned int wolfCrypt_FIPS_sha3_ro_sanity[2]; -+ WOLFSSL_LOCAL int wolfCrypt_FIPS_SHA3_sanity(void); -+ #endif - #endif - - #ifdef __cplusplus - extern "C" { - #endif - --#if FIPS_VERSION3_GE(6,0,0) -- extern const unsigned int wolfCrypt_FIPS_sha3_ro_sanity[2]; -- WOLFSSL_LOCAL int wolfCrypt_FIPS_SHA3_sanity(void); --#endif -- - #ifdef WOLFSSL_ASYNC_CRYPT - #include - #endif diff --git a/wolfssl.spec b/wolfssl.spec deleted file mode 100644 index 540781f..0000000 --- a/wolfssl.spec +++ /dev/null @@ -1,153 +0,0 @@ -%ifarch x86_64 - %global with_aesni 1 -%endif - -Name: wolfssl -Version: 5.7.2 -Release: 2%{?dist} -Summary: Lightweight SSL/TLS library written in ANSI C -License: GPL-2.0-or-later -URL: https://github.com/wolfSSL/wolfssl -Source0: %{url}/archive/v%{version}-stable.tar.gz#/%{name}-%{version}.tar.gz - -# Per i686 leaf package policy -# https://fedoraproject.org/wiki/Changes/EncourageI686LeafRemoval -ExcludeArch: %{ix86} - -BuildRequires: libtool -BuildRequires: autoconf -BuildRequires: automake -BuildRequires: make -BuildRequires: pkgconfig -BuildRequires: gcc -BuildRequires: glibc-devel -BuildRequires: doxygen -BuildRequires: sed -BuildRequires: findutils -# openssl executable needed for check -BuildRequires: openssl - -%description -The wolfSSL embedded SSL library (formerly CyaSSL) is a lightweight SSL/TLS -library written in ANSI C and targeted for embedded, RTOS, and -resource-constrained environments - primarily because of its small size, -speed, and feature set. It is commonly used in standard operating environments -as well because of its royalty-free pricing and excellent cross platform -support. wolfSSL supports industry standards up to the current TLS 1.3 and -DTLS 1.3, is up to 20 times smaller than OpenSSL, and offers progressive -ciphers such as ChaCha20, Curve25519, Blake2b and Post-Quantum TLS 1.3 groups. -User bench-marking and feedback reports dramatically better performance when -using wolfSSL over OpenSSL. - -wolfSSL is powered by the wolfCrypt cryptography library. Two versions of -wolfCrypt have been FIPS 140-2 validated (Certificate #2425 and certificate -#3389). FIPS 140-3 validation is in progress. For additional information, -visit the wolfCrypt FIPS FAQ or contact fips@wolfssl.com. - -%package devel -Summary: Header files and development libraries for %{name} -Requires: %{name}%{?_isa} = %{version}-%{release} - -%description devel -This package contains the header files and development libraries -for %{name}. If you like to develop programs using %{name}, -you will need to install %{name}-devel. - -%package doc -Summary: HTML Documentation for wolfssl -BuildArch: noarch - -%description doc -This package contains the HTML documentation for wolfssl - -%prep -%autosetup -p 1 -n %{name}-%{version}-stable - -# Fix the bundled doc builder scripts to run in our environment -sed -i 's/command -v .*/true/g' doc/generate_documentation.sh -sed -i 's/doxygen Doxyfile/doxygen -u Doxyfile \&\& doxygen Doxyfile/g' doc/generate_documentation.sh -sed -i 's/Next...\\n/Next.../g' doc/check_api.sh - -# Disable tests that need Internets -sed -i 's/^if BUILD_OCSP$/if FALSE/' scripts/include.am -sed -i 's/^if BUILD_OCSP_STAPLING$/if FALSE/' scripts/include.am - -%build -./autogen.sh - -# Wolfssl has a *lot* of build options. The options below represent an attempt at general compatiblity -# Note we need to set --disable-qt flag, in order to enable HAVE_DH_DEFAULT_PARAMS (required for Netatalk) -# -# Netatalk package needs wolfssl built with HAVE_DH_DEFAULT_PARAMS, OPENSSL_EXTRA, and OPENSSL_ALL options -# https://github.com/Netatalk/netatalk/blob/main/meson.build#L566 -%configure \ - --disable-static \ - --enable-all \ - --enable-all-crypto \ - --disable-qt \ - %{?with_aesni:--enable-aesni} - -%make_build -%make_build dox-html - -# fix the shebang in wolfssl-config -sed -i '1s|.*|#!/usr/bin/sh|' wolfssl-config - -# Eliminate duplicate files to stop rpmlint from complaining -for ndx in a 0 1 2 3 10 11; do - ln -sf groups_${ndx}.js doc/html/search/all_${ndx}.js -done -ln -sf functions_4.js doc/html/search/all_1a.js -ln -sf files_b.js doc/html/search/all_13.js -ln -sf groups_16.js doc/html/search/all_18.js - -%install -%make_install - -# It seems .la files are left hanging around for el9 builds -find %{buildroot} \( -name '*.la' -o -name '*.a' \) -type f -delete -print - -%check -%make_build test - -%files -%license COPYING LICENSING -%doc ChangeLog.md README README.md -# these files are placed into pkgdocdir during make install -%doc %{_pkgdocdir}/QUIC.md -%doc %{_pkgdocdir}/README.txt -%doc %{_pkgdocdir}/taoCert.txt - -%{_libdir}/libwolfssl.so.42{,.*} - -%files devel -%doc %{_pkgdocdir}/example -%dir %{_includedir}/wolfssl -%dir %{_includedir}/wolfssl/wolfcrypt -%dir %{_includedir}/wolfssl/openssl -%{_bindir}/wolfssl-config - -%{_includedir}/wolfssl/*.h -%{_includedir}/wolfssl/wolfcrypt/*.h -%{_includedir}/wolfssl/openssl/*.h - -%{_libdir}/pkgconfig/wolfssl.pc -%{_libdir}/libwolfssl.so - -%files doc -# offline html documentation only -%license COPYING LICENSING -%doc doc/html - -%changelog -* Tue Sep 03 2024 Andrew Bauer - 5.7.2-2 -- RHBZ#2308628 RHBZ#2308629 RHBZ#2308630 RHBZ#2308631 fixed in 5.7.2 release -- fips macro patch no longer needed - -* Sun Aug 25 2024 Andrew Bauer - 5.7.2-1 -- 5.7.2 release -- patch FIPS_VERSION3_GE macro issue - -* Fri Aug 09 2024 Andrew Bauer - 5.7.0-1 -- Initial specfile - From 7b1ca1d55b71bf0e05bba53b60d9332c048498cf Mon Sep 17 00:00:00 2001 From: Tomas Hrcka Date: Tue, 10 Sep 2024 20:03:48 +0200 Subject: [PATCH 2/2] The package violates crypto policies, retired by FESCO decision https://pagure.io/fesco/issue/32675 --- .gitignore | 2 - README.md | 3 - bodhi.template.last | 44 ---------- dead.package | 1 + sources | 1 - wolfssl-fips-ver3-macro.patch | 36 -------- wolfssl.spec | 153 ---------------------------------- 7 files changed, 1 insertion(+), 239 deletions(-) delete mode 100644 .gitignore delete mode 100644 README.md delete mode 100644 bodhi.template.last create mode 100644 dead.package delete mode 100644 sources delete mode 100644 wolfssl-fips-ver3-macro.patch delete mode 100644 wolfssl.spec diff --git a/.gitignore b/.gitignore deleted file mode 100644 index 4ad6cb0..0000000 --- a/.gitignore +++ /dev/null @@ -1,2 +0,0 @@ -/wolfssl-5.7.0.tar.gz -/wolfssl-5.7.2.tar.gz diff --git a/README.md b/README.md deleted file mode 100644 index b6e617e..0000000 --- a/README.md +++ /dev/null @@ -1,3 +0,0 @@ -# wolfssl - -The wolfssl package diff --git a/bodhi.template.last b/bodhi.template.last deleted file mode 100644 index 79346e5..0000000 --- a/bodhi.template.last +++ /dev/null @@ -1,44 +0,0 @@ -[ wolfssl-5.7.0-1.fc41 ] - -# bugfix, security, enhancement, newpackage (required) -type=newpackage - -# testing, stable -request=testing - -# Bug numbers: 1234,9876 -bugs=2302646 - -# Severity: low, medium, high, urgent -# This is required for security updates. -severity=unspecified - -display_name= - - -# Here is where you give an explanation of your update. -# Content can span multiple lines, as long as they are indented deeper than -# the first line. For example, -# notes=first line -# second line -# and so on -notes=Initial specfile - -# Enable request automation based on the stable/unstable karma thresholds -autokarma=True -stable_karma=3 -unstable_karma=-3 - -# Automatically close bugs when this marked as stable -close_bugs=True - -# Suggest that users performs one of the following actions after the update: -# unspecified, restart, logout -# The default value is unspecified -suggest=unspecified - -# A boolean to require that all of the bugs in your update have been confirmed by testers. -require_bugs=True - -# A boolean to require that this update passes all test cases before reaching stable. -require_testcases=True diff --git a/dead.package b/dead.package new file mode 100644 index 0000000..530e48e --- /dev/null +++ b/dead.package @@ -0,0 +1 @@ +The package violates crypto policies, retired by FESCO decision https://pagure.io/fesco/issue/32675 diff --git a/sources b/sources deleted file mode 100644 index bbfa188..0000000 --- a/sources +++ /dev/null @@ -1 +0,0 @@ -SHA512 (wolfssl-5.7.2.tar.gz) = daec6427cbee6628da0dcaad2f721efb0591532fcb3bd688e7212aaca8a442ac10176e5b9eb6b14fea6c49a613d6b086ff777eafc5c27b25d51f758ad0aa13bd diff --git a/wolfssl-fips-ver3-macro.patch b/wolfssl-fips-ver3-macro.patch deleted file mode 100644 index 831b89a..0000000 --- a/wolfssl-fips-ver3-macro.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 86bb273fef8e94c5b2ffc1a215dac3034b0b38b5 Mon Sep 17 00:00:00 2001 -From: Andrew Bauer -Date: Mon, 19 Aug 2024 14:21:48 -0500 -Subject: [PATCH] move fips_version macro - ---- - wolfssl/wolfcrypt/sha3.h | 10 +++++----- - 1 file changed, 5 insertions(+), 5 deletions(-) - -diff --git a/wolfssl/wolfcrypt/sha3.h b/wolfssl/wolfcrypt/sha3.h -index e1ce33a1bf..75a662caea 100644 ---- a/wolfssl/wolfcrypt/sha3.h -+++ b/wolfssl/wolfcrypt/sha3.h -@@ -30,17 +30,17 @@ - #ifdef HAVE_FIPS - /* for fips @wc_fips */ - #include -+ -+ #if FIPS_VERSION3_GE(6,0,0) -+ extern const unsigned int wolfCrypt_FIPS_sha3_ro_sanity[2]; -+ WOLFSSL_LOCAL int wolfCrypt_FIPS_SHA3_sanity(void); -+ #endif - #endif - - #ifdef __cplusplus - extern "C" { - #endif - --#if FIPS_VERSION3_GE(6,0,0) -- extern const unsigned int wolfCrypt_FIPS_sha3_ro_sanity[2]; -- WOLFSSL_LOCAL int wolfCrypt_FIPS_SHA3_sanity(void); --#endif -- - #ifdef WOLFSSL_ASYNC_CRYPT - #include - #endif diff --git a/wolfssl.spec b/wolfssl.spec deleted file mode 100644 index 540781f..0000000 --- a/wolfssl.spec +++ /dev/null @@ -1,153 +0,0 @@ -%ifarch x86_64 - %global with_aesni 1 -%endif - -Name: wolfssl -Version: 5.7.2 -Release: 2%{?dist} -Summary: Lightweight SSL/TLS library written in ANSI C -License: GPL-2.0-or-later -URL: https://github.com/wolfSSL/wolfssl -Source0: %{url}/archive/v%{version}-stable.tar.gz#/%{name}-%{version}.tar.gz - -# Per i686 leaf package policy -# https://fedoraproject.org/wiki/Changes/EncourageI686LeafRemoval -ExcludeArch: %{ix86} - -BuildRequires: libtool -BuildRequires: autoconf -BuildRequires: automake -BuildRequires: make -BuildRequires: pkgconfig -BuildRequires: gcc -BuildRequires: glibc-devel -BuildRequires: doxygen -BuildRequires: sed -BuildRequires: findutils -# openssl executable needed for check -BuildRequires: openssl - -%description -The wolfSSL embedded SSL library (formerly CyaSSL) is a lightweight SSL/TLS -library written in ANSI C and targeted for embedded, RTOS, and -resource-constrained environments - primarily because of its small size, -speed, and feature set. It is commonly used in standard operating environments -as well because of its royalty-free pricing and excellent cross platform -support. wolfSSL supports industry standards up to the current TLS 1.3 and -DTLS 1.3, is up to 20 times smaller than OpenSSL, and offers progressive -ciphers such as ChaCha20, Curve25519, Blake2b and Post-Quantum TLS 1.3 groups. -User bench-marking and feedback reports dramatically better performance when -using wolfSSL over OpenSSL. - -wolfSSL is powered by the wolfCrypt cryptography library. Two versions of -wolfCrypt have been FIPS 140-2 validated (Certificate #2425 and certificate -#3389). FIPS 140-3 validation is in progress. For additional information, -visit the wolfCrypt FIPS FAQ or contact fips@wolfssl.com. - -%package devel -Summary: Header files and development libraries for %{name} -Requires: %{name}%{?_isa} = %{version}-%{release} - -%description devel -This package contains the header files and development libraries -for %{name}. If you like to develop programs using %{name}, -you will need to install %{name}-devel. - -%package doc -Summary: HTML Documentation for wolfssl -BuildArch: noarch - -%description doc -This package contains the HTML documentation for wolfssl - -%prep -%autosetup -p 1 -n %{name}-%{version}-stable - -# Fix the bundled doc builder scripts to run in our environment -sed -i 's/command -v .*/true/g' doc/generate_documentation.sh -sed -i 's/doxygen Doxyfile/doxygen -u Doxyfile \&\& doxygen Doxyfile/g' doc/generate_documentation.sh -sed -i 's/Next...\\n/Next.../g' doc/check_api.sh - -# Disable tests that need Internets -sed -i 's/^if BUILD_OCSP$/if FALSE/' scripts/include.am -sed -i 's/^if BUILD_OCSP_STAPLING$/if FALSE/' scripts/include.am - -%build -./autogen.sh - -# Wolfssl has a *lot* of build options. The options below represent an attempt at general compatiblity -# Note we need to set --disable-qt flag, in order to enable HAVE_DH_DEFAULT_PARAMS (required for Netatalk) -# -# Netatalk package needs wolfssl built with HAVE_DH_DEFAULT_PARAMS, OPENSSL_EXTRA, and OPENSSL_ALL options -# https://github.com/Netatalk/netatalk/blob/main/meson.build#L566 -%configure \ - --disable-static \ - --enable-all \ - --enable-all-crypto \ - --disable-qt \ - %{?with_aesni:--enable-aesni} - -%make_build -%make_build dox-html - -# fix the shebang in wolfssl-config -sed -i '1s|.*|#!/usr/bin/sh|' wolfssl-config - -# Eliminate duplicate files to stop rpmlint from complaining -for ndx in a 0 1 2 3 10 11; do - ln -sf groups_${ndx}.js doc/html/search/all_${ndx}.js -done -ln -sf functions_4.js doc/html/search/all_1a.js -ln -sf files_b.js doc/html/search/all_13.js -ln -sf groups_16.js doc/html/search/all_18.js - -%install -%make_install - -# It seems .la files are left hanging around for el9 builds -find %{buildroot} \( -name '*.la' -o -name '*.a' \) -type f -delete -print - -%check -%make_build test - -%files -%license COPYING LICENSING -%doc ChangeLog.md README README.md -# these files are placed into pkgdocdir during make install -%doc %{_pkgdocdir}/QUIC.md -%doc %{_pkgdocdir}/README.txt -%doc %{_pkgdocdir}/taoCert.txt - -%{_libdir}/libwolfssl.so.42{,.*} - -%files devel -%doc %{_pkgdocdir}/example -%dir %{_includedir}/wolfssl -%dir %{_includedir}/wolfssl/wolfcrypt -%dir %{_includedir}/wolfssl/openssl -%{_bindir}/wolfssl-config - -%{_includedir}/wolfssl/*.h -%{_includedir}/wolfssl/wolfcrypt/*.h -%{_includedir}/wolfssl/openssl/*.h - -%{_libdir}/pkgconfig/wolfssl.pc -%{_libdir}/libwolfssl.so - -%files doc -# offline html documentation only -%license COPYING LICENSING -%doc doc/html - -%changelog -* Tue Sep 03 2024 Andrew Bauer - 5.7.2-2 -- RHBZ#2308628 RHBZ#2308629 RHBZ#2308630 RHBZ#2308631 fixed in 5.7.2 release -- fips macro patch no longer needed - -* Sun Aug 25 2024 Andrew Bauer - 5.7.2-1 -- 5.7.2 release -- patch FIPS_VERSION3_GE macro issue - -* Fri Aug 09 2024 Andrew Bauer - 5.7.0-1 -- Initial specfile -