Accepting request 1168604 from security:tls
OBS-URL: https://build.opensuse.org/request/show/1168604 OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-ibmca?expand=0&rev=50
This commit is contained in:
commit
27508c4aee
@ -1,5 +1,4 @@
|
|||||||
<multibuild>
|
<multibuild>
|
||||||
<flavor>openssl1</flavor>
|
|
||||||
<flavor>engine</flavor>
|
<flavor>engine</flavor>
|
||||||
<flavor>provider</flavor>
|
<flavor>provider</flavor>
|
||||||
</multibuild>
|
</multibuild>
|
||||||
|
@ -1,3 +1,48 @@
|
|||||||
|
-------------------------------------------------------------------
|
||||||
|
Wed Apr 17 14:04:14 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
|
||||||
|
|
||||||
|
- Amended the .spec file
|
||||||
|
- Changed the package names
|
||||||
|
+-------------+---------------------------------+--------------------------+
|
||||||
|
| Flavor | Package name | Note |
|
||||||
|
+-------------+---------------------------------+--------------------------+
|
||||||
|
| '' | openssl-ibmca | Both engine and provider |
|
||||||
|
| openssl1_1 | openssl1_1-ibmca | openssl1 flavor |
|
||||||
|
| engine | openssl-ibmca-engine | Only engine |
|
||||||
|
| provider | openssl-ibmca-provider | Only provider |
|
||||||
|
+-------------+---------------------------------+--------------------------+
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Wed Apr 17 08:41:08 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
|
||||||
|
|
||||||
|
- Applied a patch for openssl1_1 (bsc#1221627)
|
||||||
|
* openssl1-rename-libica-files.patch
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Tue Apr 9 14:08:05 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
|
||||||
|
|
||||||
|
- Re-implemented flavors (openssl3, engine, provider) (bsc#1221627)
|
||||||
|
+------------+---------------------------------+--------------------------+
|
||||||
|
| Flavor | Package name | Note |
|
||||||
|
+------------+---------------------------------+--------------------------+
|
||||||
|
| '' | openssl-ibmca | openssl1 flavor |
|
||||||
|
| engine | openssl3-ibmca-engine | Only engine |
|
||||||
|
| provider | openssl3-ibmca-provider | Only provider |
|
||||||
|
| openssl3 | openssl3-ibmca | Both engine and provider |
|
||||||
|
+------------+---------------------------------+--------------------------+
|
||||||
|
- Changing/editing 'dynamic_path' after the installation on the target system
|
||||||
|
* From /usr/lib64/ossl-modules to /usr/lib64/engines-3 in
|
||||||
|
/usr/share/doc/packages/openssl3-ibmca/ibmca-engine-opensslconfig
|
||||||
|
for openssl3 flavor
|
||||||
|
|
||||||
|
-------------------------------------------------------------------
|
||||||
|
Thu Apr 4 07:02:23 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
|
||||||
|
|
||||||
|
- Amended the .spec file (bsc#1221627)
|
||||||
|
* Removed the flavors
|
||||||
|
* Removed 'muiltibuild' environment
|
||||||
|
* Removed the 'provider' logic
|
||||||
|
|
||||||
-------------------------------------------------------------------
|
-------------------------------------------------------------------
|
||||||
Mon Mar 18 19:18:47 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
|
Mon Mar 18 19:18:47 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
|
||||||
|
|
||||||
|
@ -16,99 +16,127 @@
|
|||||||
#
|
#
|
||||||
|
|
||||||
|
|
||||||
%define flavor @BUILD_FLAVOR@%{nil}
|
|
||||||
|
|
||||||
%if "%{flavor}" == ""
|
|
||||||
%define openssl3 1
|
|
||||||
%define provider 0
|
|
||||||
%endif
|
|
||||||
|
|
||||||
%if "%{flavor}" == "openssl1"
|
|
||||||
%define openssl3 0
|
|
||||||
%define provider 0
|
|
||||||
%endif
|
|
||||||
|
|
||||||
%if "%{flavor}" == "engine"
|
|
||||||
%define openssl3 1
|
|
||||||
%define provider 0
|
|
||||||
%endif
|
|
||||||
|
|
||||||
%if "%{flavor}" == "provider"
|
|
||||||
%define openssl3 1
|
|
||||||
%define provider 1
|
|
||||||
%endif
|
|
||||||
|
|
||||||
%global enginesdir %(pkg-config --variable=enginesdir libcrypto)
|
%global enginesdir %(pkg-config --variable=enginesdir libcrypto)
|
||||||
%global modulesdir %(pkg-config --variable=modulesdir libcrypto)
|
%global modulesdir %(pkg-config --variable=modulesdir libcrypto)
|
||||||
|
|
||||||
|
%global sslengcnf %{_sysconfdir}/ssl/engines3.d
|
||||||
|
%global sslengdef %{_sysconfdir}/ssl/engdef3.d
|
||||||
|
|
||||||
|
%define flavor @BUILD_FLAVOR@%{nil}
|
||||||
|
|
||||||
|
%if "%{flavor}" == ""
|
||||||
Name: openssl-ibmca
|
Name: openssl-ibmca
|
||||||
|
%endif
|
||||||
|
|
||||||
|
%if "%{flavor}" == "engine"
|
||||||
|
Name: openssl-ibmca-engine
|
||||||
|
%endif
|
||||||
|
|
||||||
|
%if "%{flavor}" == "provider"
|
||||||
|
Name: openssl-ibmca-provider
|
||||||
|
%endif
|
||||||
|
|
||||||
|
%if "%{flavor}" == "openssl1_1"
|
||||||
|
%global sslengcnf %{_sysconfdir}/ssl/engines1.1.d
|
||||||
|
%global sslengdef %{_sysconfdir}/ssl/engdef1.1.d
|
||||||
|
Name: openssl1_1-ibmca
|
||||||
|
%endif
|
||||||
|
|
||||||
Version: 2.4.1
|
Version: 2.4.1
|
||||||
Release: 0
|
Release: 0
|
||||||
Summary: The IBMCA OpenSSL dynamic engine
|
Summary: The IBMCA OpenSSL dynamic engine
|
||||||
License: Apache-2.0
|
License: Apache-2.0
|
||||||
Group: Hardware/Other
|
Group: Hardware/Other
|
||||||
URL: https://github.com/opencryptoki/openssl-ibmca
|
URL: https://github.com/opencryptoki/openssl-ibmca
|
||||||
Source: https://github.com/opencryptoki/%{name}/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz
|
Source: https://github.com/opencryptoki/openssl-ibmca/archive/v%{version}.tar.gz#/openssl-ibmca-%{version}.tar.gz
|
||||||
Source1: engine_section.txt
|
Source1: engine_section.txt
|
||||||
Source2: _multibuild
|
Source2: _multibuild
|
||||||
###
|
###
|
||||||
BuildRequires: autoconf
|
BuildRequires: autoconf
|
||||||
BuildRequires: automake
|
BuildRequires: automake
|
||||||
|
BuildRequires: libtool
|
||||||
|
###
|
||||||
|
%if "%{flavor}" != "openssl1_1"
|
||||||
BuildRequires: libica-devel >= 4.0.0
|
BuildRequires: libica-devel >= 4.0.0
|
||||||
BuildRequires: libica-tools >= 4.0.0
|
BuildRequires: libica-tools >= 4.0.0
|
||||||
BuildRequires: libtool
|
BuildRequires: libopenssl-3-devel
|
||||||
Requires: libica4 >= 4
|
BuildRequires: libopenssl3
|
||||||
%if %{openssl3}
|
Requires: libica4 >= 4.0.0
|
||||||
BuildRequires: openssl-devel > 3.0.0
|
Requires: libopenssl3
|
||||||
Requires: openssl > 3.0.0
|
|
||||||
%else
|
%else
|
||||||
BuildRequires: openssl-devel
|
BuildRequires: libica-openssl1_1-devel
|
||||||
Requires: openssl
|
BuildRequires: libica-openssl1_1-tools
|
||||||
|
BuildRequires: libopenssl-1_1-devel
|
||||||
|
BuildRequires: libopenssl1_1
|
||||||
|
BuildRequires: openssl
|
||||||
|
Requires: libica4-openssl1_1
|
||||||
|
Requires: libopenssl1_1
|
||||||
%endif
|
%endif
|
||||||
|
###
|
||||||
ExclusiveArch: s390x
|
ExclusiveArch: s390x
|
||||||
|
|
||||||
|
%if "%{flavor}" == "openssl1_1"
|
||||||
|
Patch001: openssl1-rename-libica-files.patch
|
||||||
|
%endif
|
||||||
|
|
||||||
%description
|
%description
|
||||||
This package contains a shared object OpenSSL dynamic engine which interfaces
|
This package contains a shared object OpenSSL dynamic engine which interfaces
|
||||||
to libica, a library enabling the IBM s390/x CPACF crypto instructions.
|
to libica, a library enabling the IBM s390/x CPACF crypto instructions.
|
||||||
|
|
||||||
%prep
|
%prep
|
||||||
%autosetup -p1
|
%autosetup -p1 -n openssl-ibmca-%{version}
|
||||||
./bootstrap.sh
|
./bootstrap.sh
|
||||||
|
|
||||||
%build
|
%build
|
||||||
export CFLAGS="%{optflags}"
|
export CFLAGS="%{optflags}"
|
||||||
export CPPFLAGS="%{optflags}"
|
export CPPFLAGS="%{optflags}"
|
||||||
|
|
||||||
%if %{provider}
|
%if "%{flavor}" == ""
|
||||||
%configure \
|
%configure \
|
||||||
|
--libdir=%{modulesdir}
|
||||||
|
mkdir -p %{buildroot}/%{enginesdir}
|
||||||
|
%endif
|
||||||
|
|
||||||
|
%if "%{flavor}" == "engine"
|
||||||
|
%configure \
|
||||||
|
--disable-provider \
|
||||||
|
--libdir=%{enginesdir}
|
||||||
|
%endif
|
||||||
|
|
||||||
|
%if "%{flavor}" == "provider"
|
||||||
|
%configure \
|
||||||
--disable-engine \
|
--disable-engine \
|
||||||
--libdir=%{modulesdir}
|
--libdir=%{modulesdir}
|
||||||
%else
|
%endif
|
||||||
%configure \
|
|
||||||
--disable-provider \
|
%if "%{flavor}" == "openssl1_1"
|
||||||
|
%configure \
|
||||||
--libdir=%{enginesdir}
|
--libdir=%{enginesdir}
|
||||||
%endif
|
%endif
|
||||||
|
|
||||||
%make_build
|
%make_build
|
||||||
|
|
||||||
%install
|
%install
|
||||||
%if %{provider}
|
|
||||||
#
|
|
||||||
###
|
|
||||||
#
|
|
||||||
%else
|
|
||||||
# Update the sample config file so that the dynamic path points
|
# Update the sample config file so that the dynamic path points
|
||||||
# to the correct version of the engines directory.
|
# to the correct version of the engines directory.
|
||||||
|
%if "%{flavor}" != "provider"
|
||||||
sed -i -e "/^dynamic_path/s, = .*/, = %{enginesdir}/," src/engine/openssl.cnf.sample
|
sed -i -e "/^dynamic_path/s, = .*/, = %{enginesdir}/," src/engine/openssl.cnf.sample
|
||||||
%endif
|
%endif
|
||||||
|
|
||||||
%make_install
|
%make_install
|
||||||
%if %{provider}
|
|
||||||
rm -f %{buildroot}/%{modulesdir}/ibmca-provider.la
|
%if "%{flavor}" == "openssl1_1"
|
||||||
%else
|
rm -f %{buildroot}/%{enginesdir}/ibmca-provider.*
|
||||||
rm -f %{buildroot}/%{enginesdir}/ibmca.la
|
|
||||||
%endif
|
%endif
|
||||||
|
|
||||||
|
%if "%{flavor}" == ""
|
||||||
|
mkdir -p %{buildroot}/%{enginesdir}
|
||||||
|
mv %{buildroot}/%{modulesdir}/ibmca.* %{buildroot}/%{enginesdir}/
|
||||||
|
%endif
|
||||||
|
|
||||||
|
rm -f %{buildroot}/%{enginesdir}/ibmca*.la
|
||||||
|
rm -f %{buildroot}/%{modulesdir}/ibmca*.la
|
||||||
|
|
||||||
# This file contains the declaration of the ibmca engine section. It
|
# This file contains the declaration of the ibmca engine section. It
|
||||||
# needs to be on the "real" file system when the postinstall scriptlet
|
# needs to be on the "real" file system when the postinstall scriptlet
|
||||||
# is run. It will be read by the openssl .include directive that points
|
# is run. It will be read by the openssl .include directive that points
|
||||||
@ -127,45 +155,55 @@ grep -v "^#" src/engine/openssl.cnf.sample | \
|
|||||||
%post
|
%post
|
||||||
#Original fix for bsc#942839 was to update on first install
|
#Original fix for bsc#942839 was to update on first install
|
||||||
#For bsc#966139 update if openssl_def not found
|
#For bsc#966139 update if openssl_def not found
|
||||||
SSLENGCNF=%{_sysconfdir}/ssl/engines.d
|
|
||||||
SSLENGDEF=%{_sysconfdir}/ssl/engdef.d
|
|
||||||
|
|
||||||
%if %{openssl3}
|
mkdir -p %{sslengcnf}
|
||||||
mkdir -p ${SSLENGCNF}
|
mkdir -p %{sslengdef}
|
||||||
mkdir -p ${SSLENGDEF}
|
cp -p %{_datadir}/%{name}/openssl-ibmca.sectiondef.txt %{sslengcnf}/openssl-ibmca.cnf
|
||||||
|
cp -p %{_datadir}/%{name}/openssl-ibmca.enginedef.cnf %{sslengdef}/openssl-ibmca.cnf
|
||||||
|
|
||||||
|
%if "%{flavor}" == ""
|
||||||
|
cp -p /usr/share/doc/packages/openssl-ibmca/ibmca-engine-opensslconfig /usr/share/doc/packages/openssl-ibmca/ibmca-engine-opensslconfig.orig
|
||||||
|
sed -e 's/ossl-modules/engines-3/' /usr/share/doc/packages/openssl-ibmca/ibmca-engine-opensslconfig.orig > /usr/share/doc/packages/openssl-ibmca/ibmca-engine-opensslconfig
|
||||||
|
rm /usr/share/doc/packages/openssl-ibmca/ibmca-engine-opensslconfig.orig
|
||||||
%endif
|
%endif
|
||||||
|
|
||||||
cp -p %{_datadir}/%{name}/openssl-ibmca.sectiondef.txt ${SSLENGCNF}/openssl-ibmca.cnf
|
|
||||||
cp -p %{_datadir}/%{name}/openssl-ibmca.enginedef.cnf ${SSLENGDEF}/openssl-ibmca.cnf
|
|
||||||
|
|
||||||
%postun
|
%postun
|
||||||
SSLENGCNF=%{_sysconfdir}/ssl/engines.d
|
|
||||||
SSLENGDEF=%{_sysconfdir}/ssl/engdef.d
|
|
||||||
if [ $1 -eq 0 ]; then # last uninstall
|
if [ $1 -eq 0 ]; then # last uninstall
|
||||||
rm -f ${SSLENGCNF}/openssl-ibmca.cnf
|
rm -f %{sslengcnf}/openssl-ibmca.cnf
|
||||||
rm -f ${SSLENGDEF}/openssl-ibmca.cnf
|
rm -f %{sslengdef}/openssl-ibmca.cnf
|
||||||
fi
|
fi
|
||||||
|
|
||||||
%files
|
%files
|
||||||
%license LICENSE
|
%license LICENSE
|
||||||
%doc ChangeLog
|
%doc ChangeLog
|
||||||
%doc README.md
|
%doc README.md
|
||||||
%doc src/engine/openssl.cnf.sample
|
|
||||||
%doc src/engine/ibmca-engine-opensslconfig.in
|
|
||||||
%dir %{_datadir}/%{name}
|
%dir %{_datadir}/%{name}
|
||||||
%{_datadir}/%{name}/openssl-ibmca.sectiondef.txt
|
%{_datadir}/%{name}/openssl-ibmca.sectiondef.txt
|
||||||
%{_datadir}/%{name}/openssl-ibmca.enginedef.cnf
|
%{_datadir}/%{name}/openssl-ibmca.enginedef.cnf
|
||||||
%if %{openssl3}
|
%if "%{flavor}" == ""
|
||||||
%if %{provider}
|
%doc src/engine/ibmca-engine-opensslconfig
|
||||||
|
%doc src/provider/ibmca-provider-opensslconfig
|
||||||
|
%doc src/engine/openssl.cnf.sample
|
||||||
|
%{enginesdir}/ibmca.*
|
||||||
|
%{modulesdir}/ibmca-provider.*
|
||||||
|
%{_mandir}/man5/ibmca.5%{?ext_man}
|
||||||
|
%{_mandir}/man5/ibmca-provider.5%{?ext_man}
|
||||||
|
%endif
|
||||||
|
%if "%{flavor}" == "provider"
|
||||||
|
%doc src/provider/ibmca-provider-opensslconfig
|
||||||
%{modulesdir}/ibmca-provider.*
|
%{modulesdir}/ibmca-provider.*
|
||||||
%{_mandir}/man5/ibmca-provider.5%{?ext_man}
|
%{_mandir}/man5/ibmca-provider.5%{?ext_man}
|
||||||
%else
|
%endif
|
||||||
|
%if "%{flavor}" == "engine"
|
||||||
|
%doc src/engine/ibmca-engine-opensslconfig
|
||||||
|
%doc src/engine/openssl.cnf.sample
|
||||||
|
%{enginesdir}/ibmca.*
|
||||||
|
%{_mandir}/man5/ibmca.5%{?ext_man}
|
||||||
|
%endif
|
||||||
|
%if "%{flavor}" == "openssl1_1"
|
||||||
|
%doc src/engine/openssl.cnf.sample
|
||||||
%{enginesdir}/ibmca.*
|
%{enginesdir}/ibmca.*
|
||||||
%{_mandir}/man5/ibmca.5%{?ext_man}
|
%{_mandir}/man5/ibmca.5%{?ext_man}
|
||||||
%endif
|
|
||||||
%else
|
|
||||||
%{enginesdir}/ibmca.*
|
|
||||||
%{_mandir}/man5/ibmca.5%{?ext_man}
|
|
||||||
%endif
|
%endif
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
65
openssl1-rename-libica-files.patch
Normal file
65
openssl1-rename-libica-files.patch
Normal file
@ -0,0 +1,65 @@
|
|||||||
|
--- openssl-ibmca-2.4.1/configure.ac 2023-09-21 08:52:43.000000000 +0200
|
||||||
|
+++ changed/configure.ac 2024-04-17 10:13:02.267582864 +0200
|
||||||
|
@@ -69,7 +69,7 @@
|
||||||
|
# Checks for header files.
|
||||||
|
AC_CHECK_HEADERS([arpa/inet.h fcntl.h malloc.h netdb.h netinet/in.h stddef.h stdlib.h \
|
||||||
|
string.h strings.h sys/ioctl.h sys/param.h sys/socket.h sys/time.h unistd.h])
|
||||||
|
-AC_CHECK_HEADER([ica_api.h], [], AC_MSG_ERROR([*** libica-devel >= 3.6.0 is required ***]))
|
||||||
|
+AC_CHECK_HEADER([ica_api.h], [], AC_MSG_ERROR([*** libica-openssl1_1-devel >= 3.6.0 is required ***]))
|
||||||
|
|
||||||
|
|
||||||
|
# Checks for typedefs, structures, and compiler characteristics.
|
||||||
|
@@ -81,15 +81,15 @@
|
||||||
|
# Checks for library functions.
|
||||||
|
AC_CHECK_FUNCS([gethostbyaddr gethostbyname memset strcasecmp strncasecmp strstr malloc])
|
||||||
|
AC_CHECK_DECLS([ICA_FLAG_DHW,DES_ECB], [],
|
||||||
|
- AC_MSG_ERROR([*** libica-devel >= 3.6.0 are required ***]),
|
||||||
|
+ AC_MSG_ERROR([*** libica-openssl1_1-devel >= 3.6.0 are required ***]),
|
||||||
|
[#include <ica_api.h>])
|
||||||
|
AC_CHECK_DECLS([OSSL_ASYM_CIPHER_PARAM_IMPLICIT_REJECTION],
|
||||||
|
[openssl_implicit_rejection="yes"], [openssl_implicit_rejection="no"],
|
||||||
|
[#include <openssl/core_names.h>])
|
||||||
|
AM_CONDITIONAL([OPENSSL_IMPLICIT_REJECTION], [test "x$openssl_implicit_rejection" = xyes])
|
||||||
|
|
||||||
|
-AC_ARG_WITH([libica-cex],
|
||||||
|
- [AS_HELP_STRING([--with-libica-cex],[Use libica-cex as default library for the IBMCA engine])],
|
||||||
|
+AC_ARG_WITH([libica-openssl1_1-cex],
|
||||||
|
+ [AS_HELP_STRING([--with-libica-openssl1_1-cex],[Use libica-openssl1_1-cex as default library for the IBMCA engine])],
|
||||||
|
[usecexonly=${withval}],
|
||||||
|
[])
|
||||||
|
|
||||||
|
@@ -99,11 +99,11 @@
|
||||||
|
[libicaversion=4])
|
||||||
|
|
||||||
|
if test "x$usecexonly" = xyes; then
|
||||||
|
- defaultlib="libica-cex.so.$libicaversion"
|
||||||
|
- ica="ica-cex"
|
||||||
|
+ defaultlib="libica-openssl1_1-cex.so.$libicaversion"
|
||||||
|
+ ica="ica-openssl1_1-cex"
|
||||||
|
else
|
||||||
|
- defaultlib="libica.so.$libicaversion"
|
||||||
|
- ica="ica"
|
||||||
|
+ defaultlib="libica-openssl1_1.so.$libicaversion"
|
||||||
|
+ ica="ica-openssl1_1"
|
||||||
|
fi
|
||||||
|
# In cex-only mode, testing the ciphers does not make any sense since
|
||||||
|
# they will fall back to OpenSSL without the engine. So remove these
|
||||||
|
@@ -135,7 +135,7 @@
|
||||||
|
|
||||||
|
|
||||||
|
AC_DEFINE_UNQUOTED([LIBICA_SHARED_LIB],["$defaultlib"])
|
||||||
|
-AC_SUBST([ICA],["$ica"])
|
||||||
|
+AC_SUBST([ICA],["$ica-openssl1_1"])
|
||||||
|
|
||||||
|
AC_CHECK_PROG([openssl_var],[openssl],[yes],[no])
|
||||||
|
if test "x$openssl_var" != xyes; then
|
||||||
|
@@ -169,7 +169,7 @@
|
||||||
|
echo " default library: $defaultlib"
|
||||||
|
echo "IBMCA provider: $enable_provider"
|
||||||
|
if test "x$useproviderfulllibica" = xyes; then
|
||||||
|
- echo " libica library: libica"
|
||||||
|
+ echo " libica library: libica-openssl1_1"
|
||||||
|
else
|
||||||
|
- echo " libica library: libica-cex"
|
||||||
|
+ echo " libica library: libica-openssl1_1-cex"
|
||||||
|
fi
|
Loading…
Reference in New Issue
Block a user