Accepting request 235564 from home:msmeissn:branches:security

- version 1.6.4
  - new tarball / signature location
  * Implement new erase (with alias luksErase) command.
  * Add internal "whirlpool_gcryptbug hash" for accessing flawed
    Whirlpool hash in gcrypt (requires gcrypt 1.6.1 or above).
  * Allow to use --disable-gcrypt-pbkdf2 during configuration
    to force use internal PBKDF2 code.
  * Require gcrypt 1.6.1 for imported implementation of PBKDF2
    (PBKDF2 in gcrypt 1.6.0 is too slow).
  * Add --keep-key to cryptsetup-reencrypt.
  * By default verify new passphrase in luksChangeKey and luksAddKey
    commands (if input is from terminal).
  * Fix memory leak in Nettle crypto backend.
  * Support --tries option even for TCRYPT devices in cryptsetup.
  * Support --allow-discards option even for TCRYPT devices.
    (Note that this could destroy hidden volume and it is not suggested
    by original TrueCrypt security model.)
  * Link against -lrt for clock_gettime to fix undefined reference
    to clock_gettime error (introduced in 1.6.2).
  * Fix misleading error message when some algorithms are not available.
  * Count system time in PBKDF2 benchmark if kernel returns no self
    usage info.

OBS-URL: https://build.opensuse.org/request/show/235564
OBS-URL: https://build.opensuse.org/package/show/security/cryptsetup?expand=0&rev=111

cryptsetup-1.6.3.tar.bz2

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:a2af4731d9442cb70bc84b7cecdd069493055d29ab65ab625c574b0f599938d8
-size 1263747

cryptsetup-1.6.3.tar.bz2.asc

@@ -1,17 +0,0 @@
------BEGIN PGP SIGNATURE-----
-Version: GnuPG v1.4.15 (GNU/Linux)
-
-iQIcBAABCAAGBQJSq3HPAAoJENmwV3vZPpj8LakP/A/pql88cfCp5wYdK64Wz57I
-GLvWaf8xXR+y1swdDyaTx92ntOi1lYk8UK8qXRrjuNf4+xbNsGm/aEKBuUq2NqzR
-jMbyA68OUTaz8KN103Znt533r5lzm0L7CZXFonFDcriTbWTxSPegHpyy22JdWaZi
-f18Fer6IpJbGBBlJBagDecr1xT+fbwUsKrTtkD4RVWie7aMgIJJVZrRchOykrF04
-hMxQs4oYtwLspOHPgpIsoTKPvx56CUadC3vvDYLSs2duVFZKmvW0XjI6EG7zn+de
-bGF8u9Wsdrl9T+dIIup+U2Az+hZhkc52USYrww/D0+p7SM9N7/6y+TRVNy7vbNr1
-e0eXrdGdsAxD9HCF4oy5482fet5mltKLCN//yfg3LMOdqMWBypXV2gq8ZL36xi/l
-E5zzujicoOQ/MUR1eRzZYj6PrXa5WxEwWEXpKVYz6b8g4C+PEQiv6Q3bLesYOxht
-fy5jMZnWzHcTefKcIgd+I8ef7cmSq4qyX7XkFhndM++ugPFU+bPb5Oqa6Tg4Ju/N
-QBBSp7uuoAsmdin8aFAd/F3wAgJS4uytsdJfaB7wOTFO9g0CQA/WnzHsc6VW6DYE
-8wF1cL4k6ypRBTFES8cxQNQV+CNanb/1M8sOotCYAbP11fHtTvp0CJzrSHn4Cuwo
-rz5bOCCIROqx/HgD0zCE
-=uOtC
------END PGP SIGNATURE-----

cryptsetup-1.6.4.tar.sign

@@ -0,0 +1,17 @@
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v1
+
+iQIcBAABCAAGBQJTD0ctAAoJENmwV3vZPpj8WAkQAKo2flibcxZAR7lW6NfW2SUo
+VysNEylCPRQbPbDOrWRGQMrjNlQWz0YU504P+GwVFOrALW7K2v71oVa+8AE3dukh
+0aogPTzso6HlNFnnjbd2IkCAbhgejn6gshhd2rF64YxLx5QOnX744aS5HgEb3QC4
+rkSGIih/rJz0GEsNb4gpuTceO9BnBINbmbV4172CbyOWvndkgArazkB5f1Qi5d2r
+SUQVZQIzGmW+qVmsGElS4AtCsYz59qfeL6+REVHEY0YV9M1MkWF3ZCsflW6t0Qgb
+MUzNb3MEYYh2NaQoF4Ul1ZbHNgnx6as9B/uCIuV6LPQiJvl7PkBlN56vO6FI2nE5
+x2yXed8Y2OJBGstHsGtMoP8DP96U0IKcEPpSwttKVwl6+qCqu3Wns27eAvrkKnD/
+8/PGrk1F9H+iB4JLez/WyrWEveQQKugkJPf8HUSNW4J5/Q/joD0/2sKfIBTYbEG1
+Hf0jvcfhnsMf4cr06K1VeOVkr596/EEQRyEKAEQHdRdSDXvZeprjA+yBai6v6V+W
+OCm4DK3D6o9jhCLeotFSlOsMfA9gxWJ9uKrEnR7ITh7PmTf8PiZbX+VkexuwP8vT
+PaDjBCRZ2mm1nIfYxohcEMNz/WgRdFKx4vmb13OyY1tEcQYjIk/EoP7EZrGNS1tJ
+5X1fSnePI1PuO+WuyaHy
+=jEBe
+-----END PGP SIGNATURE-----

cryptsetup-1.6.4.tar.xz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:70b8e86eef94bbb4441ad38460d87138130d7aaaafe5d01131c3ba50b9f0dca0
+size 1081492

cryptsetup.changes

@@ -1,3 +1,28 @@
+Tue May 27 14:38:57 UTC 2014 - meissner@suse.com
+
+- version 1.6.4
+  - new tarball / signature location
+  * Implement new erase (with alias luksErase) command.
+  * Add internal "whirlpool_gcryptbug hash" for accessing flawed
+    Whirlpool hash in gcrypt (requires gcrypt 1.6.1 or above).
+  * Allow to use --disable-gcrypt-pbkdf2 during configuration
+    to force use internal PBKDF2 code.
+  * Require gcrypt 1.6.1 for imported implementation of PBKDF2
+    (PBKDF2 in gcrypt 1.6.0 is too slow).
+  * Add --keep-key to cryptsetup-reencrypt.
+  * By default verify new passphrase in luksChangeKey and luksAddKey
+    commands (if input is from terminal).
+  * Fix memory leak in Nettle crypto backend.
+  * Support --tries option even for TCRYPT devices in cryptsetup.
+  * Support --allow-discards option even for TCRYPT devices.
+    (Note that this could destroy hidden volume and it is not suggested
+    by original TrueCrypt security model.)
+  * Link against -lrt for clock_gettime to fix undefined reference
+    to clock_gettime error (introduced in 1.6.2).
+  * Fix misleading error message when some algorithms are not available.
+  * Count system time in PBKDF2 benchmark if kernel returns no self
+    usage info.
+
 -------------------------------------------------------------------
 Wed Apr 23 16:08:09 UTC 2014 - dmueller@suse.com
 

cryptsetup.spec

@@ -18,19 +18,22 @@
 
 Name:           cryptsetup
 Url:            http://code.google.com/p/cryptsetup/
-Version:        1.6.3
+Version:        1.6.4
 Release:        0
 Summary:        Set Up dm-crypt Based Encrypted Block Devices
 License:        SUSE-GPL-2.0-with-openssl-exception and LGPL-2.0+
 Group:          System/Base
 
-Source:         http://cryptsetup.googlecode.com/files/cryptsetup-%version.tar.bz2
-Source1:        http://cryptsetup.googlecode.com/files/cryptsetup-%version.tar.bz2.asc
+Source:         https://www.kernel.org/pub/linux/utils/cryptsetup/v1.6/cryptsetup-%{version}.tar.xz
+# this is the signature of the uncompressed tarball
+Source1:        https://www.kernel.org/pub/linux/utils/cryptsetup/v1.6/cryptsetup-%{version}.tar.sign
 Source2:        baselibs.conf
 Source3:        %{name}.keyring
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 BuildRequires:  device-mapper-devel
 BuildRequires:  e2fsprogs-devel
+BuildRequires:  fipscheck
+BuildRequires:  fipscheck-devel
 BuildRequires:  libgcrypt-devel
 BuildRequires:  libselinux-devel
 BuildRequires:  libtool
@@ -84,10 +87,18 @@ test -e po/Makevars || cp po/Makevars.template po/Makevars
 %configure \
 	    --disable-static --enable-shared \
 	    --enable-cryptsetup-reencrypt \
-	    --enable-selinux
+	    --enable-selinux --enable-fips
 make %{?_smp_mflags}
 
 %install
+# Generate HMAC checksums (FIPS)
+%define __spec_install_post \
+  %{?__debug_package:%{__debug_install_post}} \
+  %{__arch_install_post} \
+  %{__os_install_post} \
+  fipshmac %{buildroot}/%{_libdir}/libcryptsetup.so.* \
+%{nil}
+
 make install DESTDIR=$RPM_BUILD_ROOT
 install -d -m 755 $RPM_BUILD_ROOT/sbin
 ln -s ..%{_sbindir}/cryptsetup $RPM_BUILD_ROOT/sbin
@@ -96,8 +107,6 @@ rm -f $RPM_BUILD_ROOT/%_libdir/*.la
 #
 %find_lang %name --all-name
 
-%pre
-
 %post
 test -n "$FIRST_ARG" || FIRST_ARG="$1"
 #
@@ -137,6 +146,7 @@ fi
 %files -n libcryptsetup4
 %defattr(-,root,root)
 /%{_libdir}/libcryptsetup.so.4*
+/%{_libdir}/.libcryptsetup.so.4*hmac
 
 %files -n libcryptsetup-devel
 %defattr(-,root,root)