Sync changes to SLFO-1.2 branch

OBS-URL: https://build.opensuse.org/request/show/1296535
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/libica?expand=0&rev=43

libica-01-fips-update-remove-sigVer-from-fips-ECDSA-kat.patch

@@ -1,28 +0,0 @@
-From 0a7e4c34a0cc58e1242d4b131e9c224736eadef2 Mon Sep 17 00:00:00 2001
-From: Joerg Schmidbauer <jschmidb@de.ibm.com>
-Date: Mon, 28 Oct 2024 13:04:19 +0100
-Subject: [PATCH] fips update: remove sigVer from fips ECDSA kat
-
-From https://github.com/usnistgov/ACVP/blob/master/src/ecdsa/sections/05-capabilities.adoc
-"The 'componentTest' property is only valid for detECDSA / sigGen / FIPS186-5 and
-ECDSA / sigGen / * registrations." i.e., only ECDSA sigGen component can be tested.
-
-Signed-off-by: Joerg Schmidbauer <jschmidb@de.ibm.com>
----
- src/fips.c | 3 ---
- 1 file changed, 3 deletions(-)
-
-diff --git a/src/fips.c b/src/fips.c
-index 4d1db07..3c26043 100644
---- a/src/fips.c
-+++ b/src/fips.c
-@@ -1240,9 +1240,6 @@ ecdsa_kat(void)
- 		/* adapter handle not needed here, just CPACF */
- 		rc = ica_ecdsa_sign_ex_internal(0, eckey, tv->hash, tv->hashlen,
- 								sigbuf, tv->siglen, tv->k);
--		if (rc)
--			goto _err_;
--		rc = ica_ecdsa_verify(0, eckey, tv->hash, tv->hashlen, sigbuf, tv->siglen);
- 		if (rc)
- 			goto _err_;
- 		if (memcmp(sigbuf, tv->sig, tv->siglen) != 0) {

libica-02-fips-update-Change-service-indicator-implementation.patch

@@ -1,116 +0,0 @@
-From 238d85eec7050be5573190c519c1c8eaacae5359 Mon Sep 17 00:00:00 2001
-From: Joerg Schmidbauer <jschmidb@de.ibm.com>
-Date: Mon, 28 Oct 2024 13:44:11 +0100
-Subject: [PATCH] fips update: Change service indicator implementation
-
-Perform checks for non-approved algorithms / parameters directly into the
-APIs that perform the services.
-
-Signed-off-by: Joerg Schmidbauer <jschmidb@de.ibm.com>
----
- src/ica_api.c | 22 ++++++++++++++++++++++
- 1 file changed, 22 insertions(+)
-
-diff --git a/src/ica_api.c b/src/ica_api.c
-index 0826af8..d071f61 100644
---- a/src/ica_api.c
-+++ b/src/ica_api.c
-@@ -1052,6 +1052,8 @@ unsigned int ica_rsa_key_generate_mod_expo(ica_adapter_handle_t adapter_handle,
- #ifdef ICA_FIPS
- 	if (fips >> 1)
- 		return EACCES;
-+	if (!fips_approved(RSA_ME) && !fips_override(RSA_ME))
-+		return EPERM;
- #endif /* ICA_FIPS */
- 
- 	if (public_key->key_length != private_key->key_length)
-@@ -1094,6 +1096,8 @@ unsigned int ica_rsa_key_generate_crt(ica_adapter_handle_t adapter_handle,
- #ifdef ICA_FIPS
- 	if (fips >> 1)
- 		return EACCES;
-+	if (!fips_approved(RSA_CRT) && !fips_override(RSA_CRT))
-+		return EPERM;
- #endif /* ICA_FIPS */
- 
- 	if (public_key->key_length != private_key->key_length)
-@@ -1130,6 +1134,8 @@ unsigned int ica_rsa_mod_expo(ica_adapter_handle_t adapter_handle,
- #ifdef ICA_FIPS
- 	if (fips >> 1)
- 		return EACCES;
-+	if (!fips_approved(RSA_ME) && !fips_override(RSA_ME))
-+		return EPERM;
- #endif /* ICA_FIPS */
- 
- 	/* check for obvious errors in parms */
-@@ -1193,6 +1199,8 @@ unsigned int ica_rsa_crt_key_check(ica_rsa_key_crt_t *rsa_key)
- #ifdef ICA_FIPS
- 	if (fips >> 1)
- 		return EACCES;
-+	if (!fips_approved(RSA_CRT) && !fips_override(RSA_CRT))
-+		return EPERM;
- #endif /* ICA_FIPS */
- 
- 	/* check if p > q  */
-@@ -1266,6 +1274,8 @@ unsigned int ica_rsa_crt(ica_adapter_handle_t adapter_handle,
- #ifdef ICA_FIPS
- 	if (fips >> 1)
- 		return EACCES;
-+	if (!fips_approved(RSA_CRT) && !fips_override(RSA_CRT))
-+		return EPERM;
- #endif /* ICA_FIPS */
- 
- 	/* check for obvious errors in parms */
-@@ -1337,6 +1347,8 @@ ICA_EC_KEY* ica_ec_key_new(unsigned int nid, unsigned int *privlen)
- #ifdef ICA_FIPS
- 	if (fips >> 1)
- 		return NULL;
-+	if (!fips_approved(EC_KGEN) && !fips_override(EC_KGEN))
-+		return NULL;
- #endif /* ICA_FIPS */
- 
- 	if ((key = malloc(sizeof(ICA_EC_KEY))) == NULL)
-@@ -1375,6 +1387,8 @@ int ica_ec_key_init(const unsigned char *X, const unsigned char *Y,
- #ifdef ICA_FIPS
- 	if (fips >> 1)
- 		return EACCES;
-+	if (!fips_approved(EC_KGEN) && !fips_override(EC_KGEN))
-+		return EPERM;
- 	if (fips & ICA_FIPS_MODE) {
- 		if (!curve_supported_via_openssl(key->nid) ||
- 			!curve_supported_via_cpacf(key->nid)) {
-@@ -1421,6 +1435,8 @@ int ica_ec_key_generate(ica_adapter_handle_t adapter_handle, ICA_EC_KEY *key)
- #ifdef ICA_FIPS
- 	if (fips >> 1)
- 		return EACCES;
-+	if (!fips_approved(EC_KGEN) && !fips_override(EC_KGEN))
-+		return EPERM;
- 	if (fips & ICA_FIPS_MODE) {
- 		if (!curve_supported_via_openssl(key->nid) ||
- 			!curve_supported_via_cpacf(key->nid))
-@@ -1494,6 +1510,8 @@ int ica_ecdh_derive_secret(ica_adapter_handle_t adapter_handle,
- #ifdef ICA_FIPS
- 	if (fips >> 1)
- 		return EACCES;
-+	if (!fips_approved(EC_DH) && !fips_override(EC_DH))
-+		return EPERM;
- 	if (fips & ICA_FIPS_MODE) {
- 		if (!curve_supported_via_openssl(privkey_A->nid) ||
- 			!curve_supported_via_cpacf(privkey_A->nid))
-@@ -1567,6 +1585,8 @@ int ica_ecdsa_sign_ex_internal(ica_adapter_handle_t adapter_handle,
- 		if (!curve_supported_via_openssl(privkey->nid) ||
- 			!curve_supported_via_cpacf(privkey->nid))
- 			return EPERM;
-+	if (!fips_approved(EC_DSA_SIGN) && !fips_override(EC_DSA_SIGN))
-+		return EPERM;
- 	}
- #endif /* ICA_FIPS */
- 
-@@ -1654,6 +1674,8 @@ int ica_ecdsa_verify(ica_adapter_handle_t adapter_handle,
- #ifdef ICA_FIPS
- 	if (fips >> 1)
- 		return EACCES;
-+	if (!fips_approved(EC_DSA_VERIFY) && !fips_override(EC_DSA_VERIFY))
-+		return EPERM;
- 	if (fips & ICA_FIPS_MODE) {
- 		if (!curve_supported_via_openssl(pubkey->nid) ||
- 			!curve_supported_via_cpacf(pubkey->nid))

libica-03-fips-update-Dynamically-update-service-indicator-based-on-IV-usage.patch

@@ -1,164 +0,0 @@
-From b7d11c21d7f15dc11ae7354a7ec97299eacd7045 Mon Sep 17 00:00:00 2001
-From: Joerg Schmidbauer <jschmidb@de.ibm.com>
-Date: Wed, 6 Nov 2024 13:12:11 +0100
-Subject: [PATCH] fips update: Dynamically update service indicator based on IV
- usage
-
-Fix handling to differentiate if the call to AES-GCM encryption API was approved
-or not. If the IV was set externally, it's non-approved, otherwise with internal
-IV it's approved. Bind the service indicator to the service by checking the
-behavior of the GCM IV in the gcm API.
-
-Signed-off-by: Joerg Schmidbauer <jschmidb@de.ibm.com>
----
- src/ica_api.c      |  6 ++++++
- src/include/fips.h | 54 +++++++++++++++++++++++++++++++++++++++++++---
- src/s390_crypto.c  | 16 ++++++++++++++
- 3 files changed, 73 insertions(+), 3 deletions(-)
-
-diff --git a/src/ica_api.c b/src/ica_api.c
-index d071f61..c1bb4e1 100644
---- a/src/ica_api.c
-+++ b/src/ica_api.c
-@@ -3727,6 +3727,8 @@ unsigned int ica_aes_gcm(unsigned char *plaintext,
- #ifdef ICA_FIPS
- 	if (fips & ICA_FIPS_MODE)
- 		return EPERM;
-+	if (!fips_approved(AES_GCM) && !fips_override(AES_GCM))
-+		return EPERM;
- #endif /* ICA_FIPS */
- 
- 	return ica_aes_gcm_internal(plaintext, plaintext_length, ciphertext,
-@@ -3776,6 +3778,8 @@ unsigned int ica_aes_gcm_initialize(const unsigned char *iv,
- 	if (!ica_external_gcm_iv_in_fips_mode_allowed &&
- 		direction == ENCRYPT && (fips & ICA_FIPS_MODE))
- 		return EPERM;
-+	if (!fips_approved(AES_GCM) && !fips_override(AES_GCM))
-+		return EPERM;
- #endif /* ICA_FIPS */
- 
- 	return ica_aes_gcm_initialize_internal(iv, iv_length, key, key_length,
-@@ -4025,6 +4029,8 @@ int ica_aes_gcm_kma_init(unsigned int direction,
- 	if (!ica_external_gcm_iv_in_fips_mode_allowed &&
- 		direction == ICA_ENCRYPT && (fips & ICA_FIPS_MODE))
- 		return EPERM;
-+	if (!fips_approved(AES_GCM_KMA) && !fips_override(AES_GCM_KMA))
-+		return EPERM;
- #endif /* ICA_FIPS */
- 
- 	return ica_aes_gcm_kma_init_internal(direction, iv, iv_length,
-diff --git a/src/include/fips.h b/src/include/fips.h
-index c0af6b6..0a6e0bd 100644
---- a/src/include/fips.h
-+++ b/src/include/fips.h
-@@ -68,19 +68,19 @@ unsigned int ica_aes_gcm_initialize_internal(const unsigned char *iv,
- /*
-  * List of non-fips-approved algorithms
-  */
--static const int FIPS_BLACKLIST[] = {DES_ECB, DES_CBC, DES_CBC_CS, DES_OFB,
-+static int FIPS_BLACKLIST[] = {DES_ECB, DES_CBC, DES_CBC_CS, DES_OFB,
-     DES_CFB, DES_CTR, DES_CTRLST, DES_CBC_MAC, DES_CMAC, P_RNG, DES3_ECB,
-     DES3_CBC, DES3_CBC_CS, DES3_OFB, DES3_CFB, DES3_CTR, DES3_CTRLST,
-     DES3_CBC_MAC, DES3_CMAC, ED25519_KEYGEN, ED25519_SIGN, ED25519_VERIFY,
-     ED448_KEYGEN, ED448_SIGN, ED448_VERIFY, X25519_KEYGEN, X25519_DERIVE,
--    X448_KEYGEN, X448_DERIVE, RSA_ME, RSA_CRT, SHA512_DRNG };
-+    X448_KEYGEN, X448_DERIVE, RSA_ME, RSA_CRT, SHA512_DRNG, -1, -1 };
- static const size_t FIPS_BLACKLIST_LEN
- 	= sizeof(FIPS_BLACKLIST) / sizeof(FIPS_BLACKLIST[0]);
- 
- /*
-  * FIPS service indicator: List of tolerated but non-approved algorithms.
-  */
--static const int FIPS_OVERRIDE_LIST[] = { RSA_ME, RSA_CRT, SHA512_DRNG };
-+static int FIPS_OVERRIDE_LIST[] = { RSA_ME, RSA_CRT, SHA512_DRNG, -1, -1 };
- static const size_t FIPS_OVERRIDE_LIST_LEN
- 	= sizeof(FIPS_OVERRIDE_LIST) / sizeof(FIPS_OVERRIDE_LIST[0]);
- 
-@@ -117,5 +117,53 @@ static inline int fips_override(int id)
- 
- 	return 0;
- }
-+
-+static inline void add_to_fips_black_list(int id)
-+{
-+	size_t i;
-+
-+	for (i = 0; i < FIPS_BLACKLIST_LEN; i++) {
-+		if (FIPS_BLACKLIST[i] == -1) {
-+			FIPS_BLACKLIST[i] = id;
-+			return;
-+		}
-+	}
-+}
-+
-+static inline void add_to_fips_override_list(int id)
-+{
-+	size_t i;
-+
-+	for (i = 0; i < FIPS_OVERRIDE_LIST_LEN; i++) {
-+		if (FIPS_OVERRIDE_LIST[i] == -1) {
-+			FIPS_OVERRIDE_LIST[i] = id;
-+			return;
-+		}
-+	}
-+}
-+
-+static inline void remove_from_fips_black_list(int id)
-+{
-+	size_t i;
-+
-+	for (i = 0; i < FIPS_BLACKLIST_LEN; i++) {
-+		if (FIPS_BLACKLIST[i] == id) {
-+			FIPS_BLACKLIST[i] = -1;
-+			return;
-+		}
-+	}
-+}
-+
-+static inline void remove_from_fips_override_list(int id)
-+{
-+	size_t i;
-+
-+	for (i = 0; i < FIPS_OVERRIDE_LIST_LEN; i++) {
-+		if (FIPS_OVERRIDE_LIST[i] == id) {
-+			FIPS_OVERRIDE_LIST[i] = -1;
-+			return;
-+		}
-+	}
-+}
- #endif /* FIPS_H */
- #endif /* ICA_FIPS */
-diff --git a/src/s390_crypto.c b/src/s390_crypto.c
-index 623864b..03655e7 100644
---- a/src/s390_crypto.c
-+++ b/src/s390_crypto.c
-@@ -30,6 +30,10 @@
- #include "init.h"
- #include "s390_crypto.h"
- 
-+#ifdef ICA_FIPS
-+extern int ica_external_gcm_iv_in_fips_mode_allowed;
-+#endif
-+
- unsigned long long facility_bits[3];
- unsigned int sha1_switch, sha256_switch, sha512_switch, sha3_switch, des_switch,
- 	     tdes_switch, aes128_switch, aes192_switch, aes256_switch,
-@@ -810,6 +814,18 @@ int s390_get_fips_indicator(libica_fips_indicator_element *indicator_list,
- 	if (*indicator_list_len < (sizeof(icaList) / sizeof(libica_func_list_element_int)))
- 		return EINVAL;
- 
-+	if (ica_external_gcm_iv_in_fips_mode_allowed) {
-+		add_to_fips_black_list(AES_GCM);
-+		add_to_fips_override_list(AES_GCM);
-+		add_to_fips_black_list(AES_GCM_KMA);
-+		add_to_fips_override_list(AES_GCM_KMA);
-+	} else {
-+		remove_from_fips_black_list(AES_GCM);
-+		remove_from_fips_override_list(AES_GCM);
-+		remove_from_fips_black_list(AES_GCM_KMA);
-+		remove_from_fips_override_list(AES_GCM_KMA);
-+	}
-+
- 	for (i = 0; i < *indicator_list_len; i++) {
- 		indicator_list[i].mech_mode_id = icaList[i].mech_mode_id;
- 		indicator_list[i].fips_approved = fips_approved(icaList[i].mech_mode_id);

libica-04-fips-update-provide-test-for-dynamic-service-indicator.patch

@@ -1,94 +0,0 @@
-From b4b25bff66035883a47ea9227abc1ffe207a31a8 Mon Sep 17 00:00:00 2001
-From: Joerg Schmidbauer <jschmidb@de.ibm.com>
-Date: Wed, 6 Nov 2024 13:17:54 +0100
-Subject: [PATCH] fips update: provide test for dynamic service indicator
-
-Add a sub-test to the fips_test using the ica_allow_external_gcm_iv_in_fips_mode
-API to allow and forbid an external GCM IV. Depending on whether the application
-allows or forbids external IVs, the service indicator changes dynamically.
-
-Signed-off-by: Joerg Schmidbauer <jschmidb@de.ibm.com>
----
- test/fips_test.c | 62 ++++++++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 62 insertions(+)
-
-diff --git a/test/fips_test.c b/test/fips_test.c
-index 2bd3d40..873c4b0 100644
---- a/test/fips_test.c
-+++ b/test/fips_test.c
-@@ -13,6 +13,64 @@
- 
- #define FIPS_FLAG "/proc/sys/crypto/fips_enabled"
- 
-+#ifdef ICA_FIPS
-+static int test_gcm_iv_usage(void)
-+{
-+	libica_fips_indicator_element *fips_list = NULL;
-+	unsigned int rc, i, fips_len, allow;
-+	unsigned int approved_expected, override_expected;
-+
-+	for (allow = 0; allow < 2; allow++) {
-+
-+		approved_expected = allow == 1 ? 0 : 1;
-+		override_expected = allow == 1 ? 1 : 0;
-+
-+		/* Check allowance of an external iv in fips mode */
-+		ica_allow_external_gcm_iv_in_fips_mode(allow);
-+
-+		/* Get fips indicator list */
-+		if (ica_get_fips_indicator(NULL, &fips_len) != 0){
-+			printf("get_fips_indicator failed\n");
-+			rc = EXIT_FAILURE;
-+			goto done;
-+		}
-+
-+		fips_list = malloc(sizeof(libica_fips_indicator_element)*fips_len);
-+		if (!fips_list) {
-+			printf("malloc fips_indicator list failed\n");
-+			rc = EXIT_FAILURE;
-+			goto done;
-+		}
-+
-+		if (ica_get_fips_indicator(fips_list, &fips_len) != 0){
-+			printf("ica_get_fips_indicator failed\n");
-+			free(fips_list);
-+			rc = EXIT_FAILURE;
-+			goto done;
-+		}
-+
-+		for (i = 0; i < fips_len; i++) {
-+			if (fips_list[i].mech_mode_id == AES_GCM ||
-+				fips_list[i].mech_mode_id == AES_GCM_KMA) {
-+				if (fips_list[i].fips_approved != approved_expected ||
-+					fips_list[i].fips_override != override_expected) {
-+					rc = EXIT_FAILURE;
-+					free(fips_list);
-+					goto done;
-+				}
-+			}
-+		}
-+
-+		free(fips_list);
-+	}
-+
-+	rc = 0;
-+
-+done:
-+	return rc;
-+}
-+#endif /* ICA_FIPS */
-+
- int
- main(void)
- {
-@@ -68,6 +126,10 @@ main(void)
- 		printf("Libica FIPS integrity check failed.\n");
- 		rv = EXIT_FAILURE;
- 	}
-+	if (test_gcm_iv_usage()) {
-+		printf("Libica FIPS gcm iv usage check failed.\n");
-+		rv = EXIT_FAILURE;
-+	}
- #endif /* ICA_FIPS */
- 
- 	printf("OpenSSL version is '%s'.\n", OPENSSL_VERSION_TEXT);

libica-4.3.0-01-disable-CEX-usage-in-OpenSSL-for-all-tests.patch

@@ -1,40 +0,0 @@
-From 49d619ea05743a3df6b9bf8160aaa0b4306118db Mon Sep 17 00:00:00 2001
-From: Holger Dengler <dengler@linux.ibm.com>
-Date: Tue, 16 Apr 2024 14:18:23 +0200
-Subject: [PATCH] test: disable CEX usage in OpenSSL for all tests
-
-OpenSSL supports CEX exploitation since version v3.2.x. Libica and its
-testcases use OpenSSL as helper and fallback, so disable the CEX
-acceleration for all tests.
-
-If the environment variable is already set, use it as is without
-modifying it. In this case, it is up to the user to choose the right
-settings.
-
-Fixes: Issue #126
-Link: https://github.com/opencryptoki/libica/issues/126
-Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
----
- test/Makefile.am | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/test/Makefile.am b/test/Makefile.am
-index 76d4f15..e56b256 100644
---- a/test/Makefile.am
-+++ b/test/Makefile.am
-@@ -61,10 +61,14 @@ TESTS += \
- ${top_builddir}/src/internal_tests/ec_internal_test
- endif
- 
-+# disable OpenSSL CEX usage for all tests
-+OPENSSL_s390xcap ?= nocex
-+
- TEST_EXTENSIONS = .sh .pl
- TESTS_ENVIRONMENT = export LD_LIBRARY_PATH=${builddir}/../src/.libs/:$$LD_LIBRARY_PATH \
- 			   PATH=${builddir}/../src/:$$PATH \
--			   LIBICA_TESTDATA=${srcdir}/testdata/;
-+			   LIBICA_TESTDATA=${srcdir}/testdata/ \
-+			   OPENSSL_s390xcap=${OPENSSL_s390xcap};
- AM_CFLAGS = @FLAGS@ -DNO_SW_FALLBACKS -I${srcdir}/../include/ -I${srcdir}/../src/include/
- LDADD = @LIBS@ ${top_builddir}/src/.libs/libica.so -lcrypto -lpthread
- 

libica-4.3.0-02-correct-rc-handling-with-s390_pcc-function.patch

@@ -1,83 +0,0 @@
-From d3a7542e7eb45c22066ecb1be62480dde41fd544 Mon Sep 17 00:00:00 2001
-From: Joerg Schmidbauer <jschmidb@de.ibm.com>
-Date: Wed, 24 Apr 2024 10:44:26 +0200
-Subject: [PATCH] Bugfix: correct rc handling with s390_pcc function
-
-Signed-off-by: Joerg Schmidbauer <jschmidb@de.ibm.com>
----
- src/include/s390_aes.h    |  2 +-
- src/include/s390_cmac.h   |  2 +-
- src/include/s390_crypto.h | 23 +++++++++++++----------
- 3 files changed, 15 insertions(+), 12 deletions(-)
-
-diff --git a/src/include/s390_aes.h b/src/include/s390_aes.h
-index 6252dde0..a6ff27bd 100644
---- a/src/include/s390_aes.h
-+++ b/src/include/s390_aes.h
-@@ -674,7 +674,7 @@ static inline int s390_aes_xts_parm(unsigned long function_code,
- 
- 	memset(&parm_block.keys, 0, key_size);
- 
--	if (rc >= 0) {
-+	if (rc == 0) {
- 		memcpy(xts_parm, parm_block.xts_parameter,
- 		       sizeof(ica_aes_vector_t));
- 		return 0;
-diff --git a/src/include/s390_cmac.h b/src/include/s390_cmac.h
-index 76b9cca5..f19c069d 100644
---- a/src/include/s390_cmac.h
-+++ b/src/include/s390_cmac.h
-@@ -161,7 +161,7 @@ static inline int s390_cmac_hw(unsigned long fc,
- 		/* calculate final block (last/full) */
- 		rc = s390_pcc(fc, pb_lookup.base);
- 		memset(pb_lookup.keys, 0, key_size);
--		if (rc < 0)
-+		if (rc != 0)
- 			return EIO;
- 
- 		_stats_increment(fc, ALGO_HW, ENCRYPT);
-diff --git a/src/include/s390_crypto.h b/src/include/s390_crypto.h
-index f34241fd..f11eacb2 100644
---- a/src/include/s390_crypto.h
-+++ b/src/include/s390_crypto.h
-@@ -244,27 +244,30 @@ void s390_crypto_switches_init(void);
- 
- /**
-  * s390_pcc:
-- * @func: the function code passed to KM; see s390_pcc_functions
-+ * @func: the function code passed to PCC; see s390_pcc_functions
-  * @param: address of parameter block; see POP for details on each func
-  *
-  * Executes the PCC operation of the CPU.
-  *
-- * Returns -1 for failure, 0 for the query func, number of processed
-- * bytes for encryption/decryption funcs
-+ * Returns condition code of the PCC instruction
-  */
- static inline int s390_pcc(unsigned long func, void *param)
- {
- 	register unsigned long r0 asm("0") = (unsigned long)func;
- 	register unsigned long r1 asm("1") = (unsigned long)param;
-+	char cc;
- 
--	asm volatile (
--		"0:	.long	%[opc] << 16\n"
--		"	brc	1,0b\n"
--		:
--		: [fc] "d" (r0), [param] "a" (r1), [opc] "i" (0xb92c)
--		: "cc", "memory");
-+	asm volatile(
-+		"0:     .insn   rre,%[opc] << 16,0,0\n" /* PCC opcode */
-+		"       brc     1,0b\n" /* handle partial completion */
-+		"       ipm     %[cc]\n"
-+		"       srl     %[cc],28\n"
-+		: [cc] "=d" (cc)
-+		: [func] "d" (r0), [param] "a" (r1), [opc] "i" (0xb92c)
-+		: "cc", "memory"
-+	);
- 
--	return 0;
-+	return cc;
- }
- 
- /**

libica-4.3.0-03-Use-__asm__-instead-of-asm.patch

@@ -1,366 +0,0 @@
-From 900557435b85f2fa6446bf9d62e80d58eff4bfbe Mon Sep 17 00:00:00 2001
-From: Joerg Schmidbauer <jschmidb@de.ibm.com>
-Date: Wed, 19 Jun 2024 12:34:26 +0200
-Subject: [PATCH] Use __asm__  instead of asm
-
-The asm keyword is a GNU extension. When writing code that can be compiled with
--ansi and the various -std options, use __asm__ instead of asm.
-
-Signed-off-by: Joerg Schmidbauer <jschmidb@de.ibm.com>
----
- src/include/s390_crypto.h | 194 +++++++++++++++++++-------------------
- 1 file changed, 97 insertions(+), 97 deletions(-)
-
-diff --git a/src/include/s390_crypto.h b/src/include/s390_crypto.h
-index f11eacb..6ef4728 100644
---- a/src/include/s390_crypto.h
-+++ b/src/include/s390_crypto.h
-@@ -253,11 +253,11 @@ void s390_crypto_switches_init(void);
-  */
- static inline int s390_pcc(unsigned long func, void *param)
- {
--	register unsigned long r0 asm("0") = (unsigned long)func;
--	register unsigned long r1 asm("1") = (unsigned long)param;
-+	register unsigned long r0 __asm__("0") = (unsigned long)func;
-+	register unsigned long r1 __asm__("1") = (unsigned long)param;
- 	char cc;
- 
--	asm volatile(
-+	__asm__ volatile(
- 		"0:     .insn   rre,%[opc] << 16,0,0\n" /* PCC opcode */
- 		"       brc     1,0b\n" /* handle partial completion */
- 		"       ipm     %[cc]\n"
-@@ -285,12 +285,12 @@ static inline int s390_pcc(unsigned long func, void *param)
- static inline int s390_kmac(unsigned long func, void *param,
- 		    const unsigned char *src, long src_len)
- {
--	register long __func asm("0") = func;
--	register void *__param asm("1") = param;
--	register const unsigned char *__src asm("2") = src;
--	register long __src_len asm("3") = src_len;
-+	register long __func __asm__("0") = func;
-+	register void *__param __asm__("1") = param;
-+	register const unsigned char *__src __asm__("2") = src;
-+	register long __src_len __asm__("3") = src_len;
- 
--	asm volatile (
-+	__asm__ volatile (
- 		"0:     .insn   rre, 0xb91e0000,%0,%0 \n"
- 		"       brc     1, 0b \n"
- 		: "+a"(__src), "+d"(__src_len)
-@@ -318,15 +318,15 @@ static inline int s390_kma(unsigned long func, void *param, unsigned char *dest,
- 		      const unsigned char *src, long src_len,
- 		      const unsigned char *aad, long aad_len)
- {
--	register long __func asm("0") = func;
--	register void *__param asm("1") = param;
--	register const unsigned char *__src asm("2") = src;
--	register long __src_len asm("3") = src_len;
--	register unsigned char *__dest asm("4") = dest;
--	register const unsigned char *__aad asm("6") = aad;
--	register long __aad_len asm("7") = aad_len;
--
--	asm volatile(
-+	register long __func __asm__("0") = func;
-+	register void *__param __asm__("1") = param;
-+	register const unsigned char *__src __asm__("2") = src;
-+	register long __src_len __asm__("3") = src_len;
-+	register unsigned char *__dest __asm__("4") = dest;
-+	register const unsigned char *__aad __asm__("6") = aad;
-+	register long __aad_len __asm__("7") = aad_len;
-+
-+	__asm__ volatile(
- 		"0:	.insn	rrf,0xb9290000,%2,%0,%3,0 \n"
- 		"1:	brc	1,0b \n" /* handle partial completion */
- 		: "+a" (__src), "+d" (__src_len), "+a" (__dest), "+a" (__aad), "+d" (__aad_len)
-@@ -353,14 +353,14 @@ static inline int s390_kmctr(unsigned long func, void *param, unsigned char *des
- 		      const unsigned char *src, long src_len,
- 		      unsigned char *counter)
- {
--	register long __func asm("0") = func;
--	register void *__param asm("1") = param;
--	register const unsigned char *__src asm("2") = src;
--	register long __src_len asm("3") = src_len;
--	register unsigned char *__dest asm("4") = dest;
--	register unsigned char *__ctr asm("6") = counter;
--
--	asm volatile(
-+	register long __func __asm__("0") = func;
-+	register void *__param __asm__("1") = param;
-+	register const unsigned char *__src __asm__("2") = src;
-+	register long __src_len __asm__("3") = src_len;
-+	register unsigned char *__dest __asm__("4") = dest;
-+	register unsigned char *__ctr __asm__("6") = counter;
-+
-+	__asm__ volatile(
- 		"0:	.insn	rrf,0xb92d0000,%2,%0,%3,0 \n"
- 		"1:	brc	1,0b \n"
- 		: "+a" (__src), "+d" (__src_len), "+a" (__dest), "+a" (__ctr)
-@@ -386,13 +386,13 @@ static inline int s390_kmctr(unsigned long func, void *param, unsigned char *des
- static inline int s390_kmf(unsigned long func, void *param, unsigned char *dest,
- 		   const unsigned char *src, long src_len, unsigned int *lcfb)
- {
--	register long __func asm("0") = ((*lcfb & 0x000000ff) << 24) | func;
--	register void *__param asm("1") = param;
--	register const unsigned char *__src asm("2") = src;
--	register long __src_len asm("3") = src_len;
--	register unsigned char *__dest asm("4") = dest;
-+	register long __func __asm__("0") = ((*lcfb & 0x000000ff) << 24) | func;
-+	register void *__param __asm__("1") = param;
-+	register const unsigned char *__src __asm__("2") = src;
-+	register long __src_len __asm__("3") = src_len;
-+	register unsigned char *__dest __asm__("4") = dest;
- 
--	asm volatile (
-+	__asm__ volatile (
- 		"0:	.insn	rre,0xb92a0000,%2,%0 \n"
- 		"	brc	1,0b \n"
- 		: "+a"(__src), "+d"(__src_len), "+a"(__dest)
-@@ -418,13 +418,13 @@ static inline int s390_kmf(unsigned long func, void *param, unsigned char *dest,
- static inline int s390_kmo(unsigned long func, void *param, unsigned char *dest,
- 		    const unsigned char *src, long src_len)
- {
--	register long __func asm("0") = func;
--	register void *__param asm("1") = param;
--	register const unsigned char *__src asm("2") = src;
--	register long __src_len asm("3") = src_len;
--	register unsigned char *__dest asm("4") = dest;
-+	register long __func __asm__("0") = func;
-+	register void *__param __asm__("1") = param;
-+	register const unsigned char *__src __asm__("2") = src;
-+	register long __src_len __asm__("3") = src_len;
-+	register unsigned char *__dest __asm__("4") = dest;
- 
--	asm volatile (
-+	__asm__ volatile (
- 		"0:	.insn	rre, 0xb92b0000,%2,%0 \n"
- 		"	brc	1, 0b \n"
- 		: "+a"(__src), "+d"(__src_len), "+a"(__dest)
-@@ -450,13 +450,13 @@ static inline int s390_kmo(unsigned long func, void *param, unsigned char *dest,
- static inline int s390_km(unsigned long func, void *param, unsigned char *dest,
- 		   const unsigned char *src, long src_len)
- {
--	register long __func asm("0") = func;
--	register void *__param asm("1") = param;
--	register const unsigned char *__src asm("2") = src;
--	register long __src_len asm("3") = src_len;
--	register unsigned char *__dest asm("4") = dest;
-+	register long __func __asm__("0") = func;
-+	register void *__param __asm__("1") = param;
-+	register const unsigned char *__src __asm__("2") = src;
-+	register long __src_len __asm__("3") = src_len;
-+	register unsigned char *__dest __asm__("4") = dest;
- 
--	asm volatile (
-+	__asm__ volatile (
- 		"0:	.insn	rre,0xb92e0000,%2,%0 \n"	/* KM opcode */
- 		"	brc	1,0b \n"	/* handle partial completion */
- 		: "+a"(__src), "+d"(__src_len), "+a"(__dest)
-@@ -482,13 +482,13 @@ static inline int s390_km(unsigned long func, void *param, unsigned char *dest,
- static inline int s390_kmc(unsigned long func, void *param, unsigned char *dest,
- 		    const unsigned char *src, long src_len)
- {
--	register long __func asm("0") = func;
--	register void *__param asm("1") = param;
--	register const unsigned char *__src asm("2") = src;
--	register long __src_len asm("3") = src_len;
--	register unsigned char *__dest asm("4") = dest;
-+	register long __func __asm__("0") = func;
-+	register void *__param __asm__("1") = param;
-+	register const unsigned char *__src __asm__("2") = src;
-+	register long __src_len __asm__("3") = src_len;
-+	register unsigned char *__dest __asm__("4") = dest;
- 
--	asm volatile (
-+	__asm__ volatile (
- 		"0:	.insn	rre, 0xb92f0000,%2,%0 \n"	/* KMC opcode */
- 		"	brc	1, 0b \n"	/* handle partial completion */
- 		: "+a"(__src), "+d"(__src_len), "+a"(__dest)
-@@ -515,15 +515,15 @@ static inline int s390_kimd_shake(unsigned long func, void *param,
- 		unsigned char *dest, long dest_len,
- 	     const unsigned char *src, long src_len)
- {
--	register long  __func asm("0") = func;
--	register void *__param asm("1") = param;
--	register unsigned char *__dest asm("2") = dest;
--	register long  __dest_len asm("3") = dest_len;
--	register const unsigned char *__src asm("4") = src;
--	register long  __src_len asm("5") = src_len;
-+	register long  __func __asm__("0") = func;
-+	register void *__param __asm__("1") = param;
-+	register unsigned char *__dest __asm__("2") = dest;
-+	register long  __dest_len __asm__("3") = dest_len;
-+	register const unsigned char *__src __asm__("4") = src;
-+	register long  __src_len __asm__("5") = src_len;
- 	int ret = -1;
- 
--	asm volatile(
-+	__asm__ volatile(
- 		"0:      .insn   rre,0xb93e0000,%1,%5\n\t" /* KIMD opcode */
- 		"        brc     1,0b\n\t" /* handle partial completion */
- 		"        la      %0,0\n\t"
-@@ -538,12 +538,12 @@ static inline int s390_kimd_shake(unsigned long func, void *param,
- static inline int s390_kimd(unsigned long func, void *param,
- 		     const unsigned char *src, long src_len)
- {
--	register long __func asm("0") = func;
--	register void *__param asm("1") = param;
--	register const unsigned char *__src asm("2") = src;
--	register long __src_len asm("3") = src_len;
-+	register long __func __asm__("0") = func;
-+	register void *__param __asm__("1") = param;
-+	register const unsigned char *__src __asm__("2") = src;
-+	register long __src_len __asm__("3") = src_len;
- 
--	asm volatile (
-+	__asm__ volatile (
- 		"0:	.insn	rre,0xb93e0000,%0,%0 \n"	/* KIMD opcode */
- 		"	brc	1,0b \n"	/* handle partial completion */
- 		: "+a"(__src), "+d"(__src_len)
-@@ -569,15 +569,15 @@ static inline int s390_klmd_shake(unsigned long func, void *param,
- 		unsigned char *dest, long dest_len,
- 		const unsigned char *src, long src_len)
- {
--	register long  __func asm("0") = func;
--	register void *__param asm("1") = param;
--	register unsigned char *__dest asm("2") = dest;
--	register long  __dest_len asm("3") = dest_len;
--	register const unsigned char *__src asm("4") = src;
--	register long  __src_len asm("5") = src_len;
-+	register long  __func __asm__("0") = func;
-+	register void *__param __asm__("1") = param;
-+	register unsigned char *__dest __asm__("2") = dest;
-+	register long  __dest_len __asm__("3") = dest_len;
-+	register const unsigned char *__src __asm__("4") = src;
-+	register long  __src_len __asm__("5") = src_len;
- 	int ret = -1;
- 
--	asm volatile(
-+	__asm__ volatile(
- 		"0:      .insn   rre,0xb93f0000,%1,%5\n\t" /* KLMD opcode */
- 		"        brc     1,0b\n\t" /* handle partial completion */
- 		"        la      %0,0\n\t"
-@@ -592,12 +592,12 @@ static inline int s390_klmd_shake(unsigned long func, void *param,
- static inline int s390_klmd(unsigned long func, void *param,
- 		const unsigned char *src, long src_len)
- {
--	register long __func asm("0") = func;
--	register void *__param asm("1") = param;
--	register const unsigned char *__src asm("2") = src;
--	register long __src_len asm("3") = src_len;
-+	register long __func __asm__("0") = func;
-+	register void *__param __asm__("1") = param;
-+	register const unsigned char *__src __asm__("2") = src;
-+	register long __src_len __asm__("3") = src_len;
- 
--	asm volatile (
-+	__asm__ volatile (
- 		"0:	.insn	rre,0xb93f0000,%0,%0 \n" /* KLMD opcode */
- 		"	brc	1,0b \n"	/* handle partial completion */
- 		: "+a"(__src), "+d"(__src_len)
-@@ -624,13 +624,13 @@ static inline int s390_klmd(unsigned long func, void *param,
- static inline int s390_kdsa(unsigned long func, void *param,
- 		            const unsigned char *src, unsigned long srclen)
- {
--	register unsigned long r0 asm("0") = (unsigned long)func;
--	register unsigned long r1 asm("1") = (unsigned long)param;
--	register unsigned long r2 asm("2") = (unsigned long)src;
--	register unsigned long r3 asm("3") = (unsigned long)srclen;
-+	register unsigned long r0 __asm__("0") = (unsigned long)func;
-+	register unsigned long r1 __asm__("1") = (unsigned long)param;
-+	register unsigned long r2 __asm__("2") = (unsigned long)src;
-+	register unsigned long r3 __asm__("3") = (unsigned long)srclen;
- 	unsigned long rc = 1;
- 
--	asm volatile(
-+	__asm__ volatile(
- 		"0:	.insn	rre,%[__opc] << 16,0,%[__src]\n"
- 		"	brc	1,0b\n" /* handle partial completion */
- 		"	brc	7,1f\n"
-@@ -668,15 +668,15 @@ static inline int s390_ppno(long func,
- 			    const unsigned char *src,
- 			    long src_len)
- {
--	register long  __func asm("0") = func;
--	register void *__param asm("1") = param;
--	register unsigned char *__dest asm("2") = dest;
--	register long  __dest_len asm("3") = dest_len;
--	register const unsigned char *__src asm("4") = src;
--	register long  __src_len asm("5") = src_len;
-+	register long  __func __asm__("0") = func;
-+	register void *__param __asm__("1") = param;
-+	register unsigned char *__dest __asm__("2") = dest;
-+	register long  __dest_len __asm__("3") = dest_len;
-+	register const unsigned char *__src __asm__("4") = src;
-+	register long  __src_len __asm__("5") = src_len;
- 	int ret = -1;
- 
--	asm volatile(
-+	__asm__ volatile(
- 		"0:      .insn   rre,0xb93c0000,%1,%5\n\t" /* PPNO opcode */
- 		"        brc     1,0b\n\t" /* handle partial completion */
- 		"        la      %0,0\n\t"
-@@ -701,13 +701,13 @@ static inline int s390_ppno(long func,
- static inline void cpacf_trng(unsigned char *ucbuf, unsigned long ucbuf_len,
-                               unsigned char *cbuf, unsigned long cbuf_len)
- {
--        register unsigned long r0 asm("0") = (unsigned long) S390_CRYPTO_TRNG;
--        register unsigned long r2 asm("2") = (unsigned long) ucbuf;
--        register unsigned long r3 asm("3") = (unsigned long) ucbuf_len;
--        register unsigned long r4 asm("4") = (unsigned long) cbuf;
--        register unsigned long r5 asm("5") = (unsigned long) cbuf_len;
-+        register unsigned long r0 __asm__("0") = (unsigned long) S390_CRYPTO_TRNG;
-+        register unsigned long r2 __asm__("2") = (unsigned long) ucbuf;
-+        register unsigned long r3 __asm__("3") = (unsigned long) ucbuf_len;
-+        register unsigned long r4 __asm__("4") = (unsigned long) cbuf;
-+        register unsigned long r5 __asm__("5") = (unsigned long) cbuf_len;
- 
--        asm volatile (
-+        __asm__ volatile (
-                 "0:     .insn   rre,0xb93c0000,%[ucbuf],%[cbuf]\n"
-                 "       brc     1,0b\n"   /* handle partial completion */
-                 : [ucbuf] "+a" (r2), [ucbuflen] "+d" (r3),
-@@ -719,21 +719,21 @@ static inline void cpacf_trng(unsigned char *ucbuf, unsigned long ucbuf_len,
- 
- static inline void s390_stckf_hw(void *buf)
- {
--	asm volatile(".insn     s,0xb27c0000,%0"
-+	__asm__ volatile(".insn     s,0xb27c0000,%0"
- 		     : "=Q" (*((unsigned long long *)buf)) : : "cc");
- }
- 
- static inline void s390_stcke_hw(void *buf)
- {
--	asm volatile(".insn     s,0xb2780000,%0"
-+	__asm__ volatile(".insn     s,0xb2780000,%0"
- 		     : "=Q" (*((unsigned long long *)buf)) : : "cc");
- }
- 
- static inline int __stfle(unsigned long long *list, int doublewords)
- {
--	register unsigned long __nr asm("0") = doublewords - 1;
-+	register unsigned long __nr __asm__("0") = doublewords - 1;
- 
--	asm volatile(".insn s,0xb2b00000,0(%1)" /* stfle */
-+	__asm__ volatile(".insn s,0xb2b00000,0(%1)" /* stfle */
- 		     : "+d" (__nr) : "a" (list) : "memory", "cc");
- 
- 	return __nr + 1;
-@@ -741,7 +741,7 @@ static inline int __stfle(unsigned long long *list, int doublewords)
- 
- static inline void s390_flip_endian_32(void *dest, const void *src)
- {
--	asm volatile(
-+	__asm__ volatile(
- 		"	lrvg	%%r0,0(0,%[__src])\n"
- 		"	lrvg	%%r1,8(0,%[__src])\n"
- 		"	lrvg	%%r4,16(0,%[__src])\n"
-@@ -757,7 +757,7 @@ static inline void s390_flip_endian_32(void *dest, const void *src)
- 
- static inline void s390_flip_endian_64(void *dest, const void *src)
- {
--	asm volatile(
-+	__asm__ volatile(
- 		"	lrvg	%%r0,0(0,%[__src])\n"
- 		"	lrvg	%%r1,8(0,%[__src])\n"
- 		"	lrvg	%%r4,16(0,%[__src])\n"

libica-4.3.0.tar.gz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:112c6136fd5ccfd6a1d33b5fd2427f5fec69aa2a0fc04e80a6ab58d7b9012db3
-size 576077

libica-4.4.1.tar.gz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:edc755494797331427c5f7900c7eecd8b5ecd3e69b7502313bf764f490b8e87a
-size 579706

libica.changes

@@ -1,37 +1,29 @@
 -------------------------------------------------------------------
-Wed Jul 30 06:53:05 UTC 2025 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
+Fri Aug  1 05:18:15 UTC 2025 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
 
 - Applied a patch (bsc#1247287)
   * libica-CONFIGURE-Make-the-OpenSSL-FIPS-config-file-name-configurable.patch
-- Added '--with-fips-config=fips_local.cnf' in "%configure" 
+- Added '--with-fips-config=fips_local.cnf' in "%configure"
 
 -------------------------------------------------------------------
-Mon Jul 28 10:40:04 UTC 2025 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
+Mon Jul 28 10:21:12 UTC 2025 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
 
-- Amended the .spec file (bsc#1246541)
+- Amended the .spec file (bsc#1246541) 
   * Added a flag '-DNO_FIPS_CONFIG_LOAD' to CPPFLAGS and CFLAGS
-  * Do not ship the config file '/etc/libica/openssl3-fips.cnf'
+  * Do not ship the config file '/etc/libica/openssl3-fips.cnf' 
 
 -------------------------------------------------------------------
-Fri May 30 09:40:05 UTC 2025 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
+Fri Feb  7 07:09:25 UTC 2025 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
 
-- Upgrade libica to version 4.4.1
-  * Bug fixes 
-- Removed obsolete patch
+- Applied a patch (jsc#PED-10289, jsc#PED-3277)
   * libica-fips-update-Fix-bug-in-condition-logic.patch
 
 -------------------------------------------------------------------
-Fri Feb  7 06:58:32 UTC 2025 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
-
-- Applied a patch (jsc#PED-10289, jsc#PED-3277) 
-  * libica-fips-update-Fix-bug-in-condition-logic.patch
-
--------------------------------------------------------------------
-Tue Dec 31 10:44:31 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
+Tue Dec 31 11:06:05 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
 
 - Upgrade libica to version 4.4.0 (jsc#PED-3277, jsc#PED-10289)
   * Updates for FIPS 140-3 certification 2024
-  * Various bug fixes and housekeeping 
+  * Various bug fixes and housekeeping
 - Removed obsolete patches
   * libica-01-fips-update-remove-sigVer-from-fips-ECDSA-kat.patch
   * libica-02-fips-update-Change-service-indicator-implementation.patch
@@ -39,13 +31,14 @@ Tue Dec 31 10:44:31 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
   * libica-04-fips-update-provide-test-for-dynamic-service-indicator.patch
 
 -------------------------------------------------------------------
-Wed Dec  4 07:05:18 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
+Wed Dec  4 07:12:38 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
 
 - Amended the .spec file (bsc#1234117, bsc#1231999)
+  * moved .so symlink to main libica4 / libica4-openssl1 packages
   * downgraded libica tools requires down to recommends again
 
 -------------------------------------------------------------------
-Wed Nov 13 08:57:23 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
+Fri Nov 15 13:08:21 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
 
 - Applied updated patches (bsc#1231302, bsc#1231303, bsc#1231304, bsc#1231305)
   * libica-02-fips-update-Change-service-indicator-implementation.patch
@@ -53,43 +46,25 @@ Wed Nov 13 08:57:23 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
   * libica-04-fips-update-provide-test-for-dynamic-service-indicator.patch
 
 -------------------------------------------------------------------
-Tue Nov  5 12:07:12 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
+Wed Nov  6 13:40:24 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
 
-- Applied patches (bsc#1231302, bsc#1231303, bsc#1231304, bsc#1231305)
-  * libica-01-fips-update-remove-sigVer-from-fips-ECDSA-kat.patch
-  * libica-02-fips-update-Change-service-indicator-implementation.patch
+- Applied additional patches (bsc#1231302)
+  * libica-03-fips-update-Dynamically-update-service-indicator-based-on-IV-usage.patch
+  * libica-04-fips-update-provide-test-for-dynamic-service-indicator.patch
 
 -------------------------------------------------------------------
-Tue Oct 29 06:22:04 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
+Tue Nov  5 11:51:31 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
 
 - Upgrade libica to version 4.3.1 (jsc#PED-9560, jsc#PED-10289, jsc#PED-3276)
   *  Various bug fixes and housekeeping
-- Removed obsolete patches
-  * libica-4.3.0-01-disable-CEX-usage-in-OpenSSL-for-all-tests.patch
-  * libica-4.3.0-02-correct-rc-handling-with-s390_pcc-function.patch
-  * libica-4.3.0-03-Use-__asm__-instead-of-asm.patch
-
--------------------------------------------------------------------
-Wed Oct 23 09:05:28 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
-
-- Amended the .spec file (bsc#1231999)
-  * Replaced Recommends libica-tools with Requires
-
--------------------------------------------------------------------
-Wed Jul  3 10:51:28 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
-
-- Applied patches
-  * libica-4.3.0-01-disable-CEX-usage-in-OpenSSL-for-all-tests.patch
-  * libica-4.3.0-02-correct-rc-handling-with-s390_pcc-function.patch
-  * libica-4.3.0-03-Use-__asm__-instead-of-asm.patch
-- Amended the .spec file to enable FIPS
-
--------------------------------------------------------------------
-Mon Jan 29 07:52:34 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
-
-- Upgrade libica to version 2.3.0 (jsc#PED-5446)
+  *** libica version 4.3.0
   * New API function ica_allow_external_gcm_iv_in_fips_mode
   * Bug fixes
+- Amended the .spec file (bsc#1231999)
+  * Replaced Recommends libica-tools with Requires
+- Applied patches (bsc#1231302, bsc#1231303, bsc#1231304, bsc#1231305)
+  * libica-01-fips-update-remove-sigVer-from-fips-ECDSA-kat.patch
+  * libica-02-fips-update-Change-service-indicator-implementation.patch
 
 -------------------------------------------------------------------
 Fri Oct  6 07:08:03 UTC 2023 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>

libica.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package libica
 #
-# Copyright (c) 2025 SUSE LLC
+# Copyright (c) 2023 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -22,7 +22,7 @@
 %endif
 
 Name:           libica
-Version:        4.4.1
+Version:        4.4.0
 Release:        0
 Summary:        Library interface for the IBM Cryptographic Accelerator device driver
 License:        CPL-1.0
@@ -37,6 +37,7 @@ Source5:        %{name}-rpmlintrc
 ###
 Patch01:        libica-FIPS-make-it-possible-to-specify-fipshmac-binary.patch
 Patch02:        libica-sles15sp5-FIPS-hmac-key.patch
+Patch03:        libica-fips-update-Fix-bug-in-condition-logic.patch
 ###
 Patch10:        libica-CONFIGURE-Make-the-OpenSSL-FIPS-config-file-name-configurable.patch
 ###
@@ -120,7 +121,7 @@ the libica library.
 %build
 autoreconf --force --install
 %configure CPPFLAGS="-Iinclude -fPIC -DNO_FIPS_CONFIG_LOAD" CFLAGS="%{optflags} -fPIC -DNO_FIPS_CONFIG_LOAD" \
-  --enable-fips --with-fips-config=fips_local.cnf
+  --enable-fips  --with-fips-config=fips_local.cnf
 
 %make_build clean
 %make_build FIPSHMAC=fipshmac BUILD_VERSION="FIPS-SUSE-%version-%release"
@@ -174,6 +175,8 @@ rmdir %{buildroot}%{_datadir}/doc/libica
 %files -n libica4
 %{_libdir}/libica.so.%{version}
 %{_libdir}/libica.so.%{major}
+# Must be in here, otherwise openssl-ibmca does not find it via DSO_load() bsc#952871
+%{_libdir}/libica.so
 %{_libdir}/.libica.so.%{version}.hmac
 %{_libdir}/.libica.so.%{major}.hmac
 %{_libdir}/libica-cex.so.%{version}
@@ -199,8 +202,6 @@ rmdir %{buildroot}%{_datadir}/doc/libica
 %dir %{_prefix}/lib/systemd/scripts
 %{_prefix}/lib/systemd/scripts/z90crypt
 %{_prefix}/lib/systemd/system/z90crypt.service
-# Must be in here, otherwise openssl-ibmca does not find it via DSO_load() bsc#952871
-%{_libdir}/libica.so
 
 %files devel
 %{_includedir}/ica_api.h