Ludwig Nussel
3dd02a4dcc
- Suggest hmac package (boo#1090768)
- remove old upgrade hack for upgrades from 12.1
- New version 2.0.5
Changes since version 2.0.4
~~~~~~~~~~~~~~~~~~~~~~~~~~~
* Wipe full header areas (including unused) during LUKS format.
Since this version, the whole area up to the data offset is zeroed,
and subsequently, all keyslots areas are wiped with random data.
This ensures that no remaining old data remains in the LUKS header
areas, but it could slow down format operation on some devices.
Previously only first 4k (or 32k for LUKS2) and the used keyslot
was overwritten in the format operation.
* Several fixes to error messages that were unintentionally replaced
in previous versions with a silent exit code.
More descriptive error messages were added, including error
messages if
- a device is unusable (not a block device, no access, etc.),
- a LUKS device is not detected,
- LUKS header load code detects unsupported version,
- a keyslot decryption fails (also happens in the cipher check),
- converting an inactive keyslot.
* Device activation fails if data area overlaps with LUKS header.
* Code now uses explicit_bzero to wipe memory if available
(instead of own implementation).
* Additional VeraCrypt modes are now supported, including Camellia
and Kuznyechik symmetric ciphers (and cipher chains) and Streebog
hash function. These were introduced in a recent VeraCrypt upstream.
Note that Kuznyechik requires out-of-tree kernel module and
Streebog hash function is available only with the gcrypt cryptographic
backend for now.
OBS-URL: https://build.opensuse.org/request/show/645498
OBS-URL: https://build.opensuse.org/package/show/security/cryptsetup?expand=0&rev=144
196 lines
6.4 KiB
RPMSpec
196 lines
6.4 KiB
RPMSpec
#
|
|
# spec file for package cryptsetup
|
|
#
|
|
# Copyright (c) 2018 SUSE LINUX GmbH, Nuernberg, Germany.
|
|
#
|
|
# All modifications and additions to the file contributed by third parties
|
|
# remain the property of their copyright owners, unless otherwise agreed
|
|
# upon. The license for this file, and modifications and additions to the
|
|
# file, is the same license as for the pristine package itself (unless the
|
|
# license for the pristine package is not an Open Source License, in which
|
|
# case the license is the MIT License). An "Open Source License" is a
|
|
# license that conforms to the Open Source Definition (Version 1.9)
|
|
# published by the Open Source Initiative.
|
|
|
|
# Please submit bugfixes or comments via http://bugs.opensuse.org/
|
|
#
|
|
|
|
|
|
%define so_ver 12
|
|
%if 0%{?is_backports}
|
|
Name: cryptsetup2
|
|
%else
|
|
Name: cryptsetup
|
|
%endif
|
|
Version: 2.0.5
|
|
Release: 0
|
|
Summary: Set Up dm-crypt Based Encrypted Block Devices
|
|
License: SUSE-GPL-2.0-with-openssl-exception AND LGPL-2.0-or-later
|
|
Group: System/Base
|
|
Url: https://gitlab.com/cryptsetup/cryptsetup/
|
|
Source0: https://www.kernel.org/pub/linux/utils/cryptsetup/v2.0/cryptsetup-%{version}.tar.xz
|
|
# GPG signature of the uncompressed tarball.
|
|
Source1: https://www.kernel.org/pub/linux/utils/cryptsetup/v2.0/cryptsetup-%{version}.tar.sign
|
|
Source2: baselibs.conf
|
|
Source3: cryptsetup.keyring
|
|
BuildRequires: device-mapper-devel
|
|
BuildRequires: fipscheck
|
|
BuildRequires: fipscheck-devel
|
|
BuildRequires: libgcrypt-devel
|
|
BuildRequires: libjson-c-devel
|
|
BuildRequires: libpwquality-devel
|
|
BuildRequires: libselinux-devel
|
|
BuildRequires: libuuid-devel
|
|
# 2.6.38 has the required if_alg.h
|
|
BuildRequires: linux-glibc-devel >= 2.6.38
|
|
BuildRequires: pkgconfig
|
|
BuildRequires: popt-devel
|
|
BuildRequires: suse-module-tools
|
|
BuildRequires: pkgconfig(blkid)
|
|
BuildRequires: pkgconfig(libargon2)
|
|
%if 0%{?is_backports}
|
|
BuildRequires: autoconf
|
|
BuildRequires: automake
|
|
BuildRequires: libtool
|
|
%endif
|
|
Requires(post): coreutils
|
|
Requires(postun): coreutils
|
|
|
|
%description
|
|
cryptsetup is used to conveniently set up dm-crypt based device-mapper
|
|
targets. It allows to set up targets to read cryptoloop compatible
|
|
volumes as well as LUKS formatted ones. The package additionally
|
|
includes support for automatically setting up encrypted volumes at boot
|
|
time via the config file %{_sysconfdir}/crypttab.
|
|
|
|
%package -n libcryptsetup%{so_ver}
|
|
Summary: Set Up dm-crypt Based Encrypted Block Devices
|
|
Group: System/Libraries
|
|
Suggests: libcryptsetup%{so_ver}-hmac
|
|
|
|
%description -n libcryptsetup%{so_ver}
|
|
cryptsetup is used to conveniently set up dm-crypt based device-mapper
|
|
targets. It allows to set up targets to read cryptoloop compatible
|
|
volumes as well as LUKS formatted ones. The package additionally
|
|
includes support for automatically setting up encrypted volumes at boot
|
|
time via the config file %{_sysconfdir}/crypttab.
|
|
|
|
%package -n libcryptsetup%{so_ver}-hmac
|
|
Summary: Checksums for libcryptsetup4
|
|
Group: System/Base
|
|
|
|
%description -n libcryptsetup%{so_ver}-hmac
|
|
This package contains HMAC checksums for integrity checking of libcryptsetup4,
|
|
used for FIPS.
|
|
|
|
%package -n lib%{name}-devel
|
|
Summary: Set Up dm-crypt Based Encrypted Block Devices
|
|
Group: Development/Libraries/C and C++
|
|
Requires: glibc-devel
|
|
Requires: libcryptsetup%{so_ver} = %{version}
|
|
# cryptsetup-devel last used 11.1
|
|
Provides: cryptsetup-devel = %{version}
|
|
Obsoletes: cryptsetup-devel < %{version}
|
|
%if 0%{?is_backports}
|
|
# have to conflict with main package that is in SLE
|
|
Conflicts: cryptsetup-devel < %{version}
|
|
%endif
|
|
|
|
%description -n lib%{name}-devel
|
|
cryptsetup is used to conveniently set up dm-crypt based device-mapper
|
|
targets. It allows to set up targets to read cryptoloop compatible
|
|
volumes as well as LUKS formatted ones. The package additionally
|
|
includes support for automatically setting up encrypted volumes at boot
|
|
time via the config file %{_sysconfdir}/crypttab.
|
|
|
|
%prep
|
|
%setup -n cryptsetup-%{version} -q
|
|
%if 0%{?is_backports}
|
|
sed -i -e '/AC_INIT/s/cryptsetup/cryptsetup2/' configure.ac
|
|
autoreconf -f -i
|
|
%endif
|
|
|
|
%build
|
|
%configure \
|
|
--enable-cryptsetup-reencrypt \
|
|
--enable-selinux \
|
|
--enable-fips \
|
|
--enable-pwquality \
|
|
--enable-gcrypt-pbkdf2 \
|
|
--enable-libargon2 \
|
|
--with-luks2-lock-path=/run/cryptsetup \
|
|
--with-tmpfilesdir='%{_tmpfilesdir}'
|
|
make %{?_smp_mflags} V=1
|
|
|
|
%install
|
|
# Generate HMAC checksums (FIPS)
|
|
%define __spec_install_post \
|
|
%{?__debug_package:%{__debug_install_post}} \
|
|
%{__arch_install_post} \
|
|
%__os_install_post \
|
|
fipshmac %{buildroot}/%{_libdir}/libcryptsetup.so.* \
|
|
%{nil}
|
|
|
|
%make_install
|
|
%if 0%{?is_backports}
|
|
# need to rename a files to avoid file conflict
|
|
for i in cryptsetup integritysetup veritysetup cryptsetup-reencrypt; do
|
|
mv %{buildroot}%{_sbindir}/$i %{buildroot}%{_sbindir}/${i}2
|
|
mv %{buildroot}%{_mandir}/man8/$i.8 %{buildroot}%{_mandir}/man8/${i}2.8
|
|
done
|
|
rm -f %{buildroot}%{_tmpfilesdir}/cryptsetup.conf
|
|
%endif
|
|
install -dm 0755 %{buildroot}/sbin
|
|
ln -s ..%{_sbindir}/cryptsetup%{?is_backports:2} %{buildroot}/sbin
|
|
# don't want this file in /lib (FHS compat check), and can't move it to /usr/lib
|
|
find %{buildroot} -type f -name "*.la" -delete -print
|
|
#
|
|
%find_lang %{name} --all-name
|
|
|
|
%if !0%{?is_backports}
|
|
#
|
|
%post
|
|
%{?regenerate_initrd_post}
|
|
%tmpfiles_create %{_tmpfilesdir}/cryptsetup.conf
|
|
|
|
%postun
|
|
%{?regenerate_initrd_post}
|
|
|
|
%posttrans
|
|
%{?regenerate_initrd_posttrans}
|
|
#
|
|
%endif
|
|
|
|
%post -n libcryptsetup%{so_ver} -p /sbin/ldconfig
|
|
%postun -n libcryptsetup%{so_ver} -p /sbin/ldconfig
|
|
|
|
%files -f %{name}.lang
|
|
%doc AUTHORS COPYING* FAQ README TODO docs/ChangeLog.old docs/*ReleaseNotes
|
|
/sbin/cryptsetup%{?is_backports:2}
|
|
%{_sbindir}/cryptsetup%{?is_backports:2}
|
|
%{_sbindir}/veritysetup%{?is_backports:2}
|
|
%{_sbindir}/integritysetup%{?is_backports:2}
|
|
%{_sbindir}/cryptsetup-reencrypt%{?is_backports:2}
|
|
%{_mandir}/man8/cryptsetup%{?is_backports:2}.8%{ext_man}
|
|
%{_mandir}/man8/cryptsetup-reencrypt%{?is_backports:2}.8%{ext_man}
|
|
%{_mandir}/man8/veritysetup%{?is_backports:2}.8%{ext_man}
|
|
%{_mandir}/man8/integritysetup%{?is_backports:2}.8%{ext_man}
|
|
%if !0%{?is_backports}
|
|
%{_tmpfilesdir}/cryptsetup.conf
|
|
%ghost %dir /run/cryptsetup
|
|
%endif
|
|
|
|
%files -n libcryptsetup%{so_ver}
|
|
%{_libdir}/libcryptsetup.so.%{so_ver}*
|
|
|
|
%files -n libcryptsetup%{so_ver}-hmac
|
|
%{_libdir}/.libcryptsetup.so.%{so_ver}*hmac
|
|
|
|
%files -n lib%{name}-devel
|
|
%doc docs/examples/
|
|
%{_includedir}/libcryptsetup.h
|
|
%{_libdir}/libcryptsetup.so
|
|
%{_libdir}/pkgconfig/*
|
|
|
|
%changelog
|