Accepting request 1296535 from security:tls

OBS-URL: https://build.opensuse.org/request/show/1296535
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/libica?expand=0&rev=43

libica-4.3.0-01-disable-CEX-usage-in-OpenSSL-for-all-tests.patch

@@ -1,40 +0,0 @@
-From 49d619ea05743a3df6b9bf8160aaa0b4306118db Mon Sep 17 00:00:00 2001
-From: Holger Dengler <dengler@linux.ibm.com>
-Date: Tue, 16 Apr 2024 14:18:23 +0200
-Subject: [PATCH] test: disable CEX usage in OpenSSL for all tests
-
-OpenSSL supports CEX exploitation since version v3.2.x. Libica and its
-testcases use OpenSSL as helper and fallback, so disable the CEX
-acceleration for all tests.
-
-If the environment variable is already set, use it as is without
-modifying it. In this case, it is up to the user to choose the right
-settings.
-
-Fixes: Issue #126
-Link: https://github.com/opencryptoki/libica/issues/126
-Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
----
- test/Makefile.am | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/test/Makefile.am b/test/Makefile.am
-index 76d4f15..e56b256 100644
---- a/test/Makefile.am
-+++ b/test/Makefile.am
-@@ -61,10 +61,14 @@ TESTS += \
- ${top_builddir}/src/internal_tests/ec_internal_test
- endif
- 
-+# disable OpenSSL CEX usage for all tests
-+OPENSSL_s390xcap ?= nocex
-+
- TEST_EXTENSIONS = .sh .pl
- TESTS_ENVIRONMENT = export LD_LIBRARY_PATH=${builddir}/../src/.libs/:$$LD_LIBRARY_PATH \
- 			   PATH=${builddir}/../src/:$$PATH \
--			   LIBICA_TESTDATA=${srcdir}/testdata/;
-+			   LIBICA_TESTDATA=${srcdir}/testdata/ \
-+			   OPENSSL_s390xcap=${OPENSSL_s390xcap};
- AM_CFLAGS = @FLAGS@ -DNO_SW_FALLBACKS -I${srcdir}/../include/ -I${srcdir}/../src/include/
- LDADD = @LIBS@ ${top_builddir}/src/.libs/libica.so -lcrypto -lpthread
- 

libica-4.3.0-02-correct-rc-handling-with-s390_pcc-function.patch

@@ -1,83 +0,0 @@
-From d3a7542e7eb45c22066ecb1be62480dde41fd544 Mon Sep 17 00:00:00 2001
-From: Joerg Schmidbauer <jschmidb@de.ibm.com>
-Date: Wed, 24 Apr 2024 10:44:26 +0200
-Subject: [PATCH] Bugfix: correct rc handling with s390_pcc function
-
-Signed-off-by: Joerg Schmidbauer <jschmidb@de.ibm.com>
----
- src/include/s390_aes.h    |  2 +-
- src/include/s390_cmac.h   |  2 +-
- src/include/s390_crypto.h | 23 +++++++++++++----------
- 3 files changed, 15 insertions(+), 12 deletions(-)
-
-diff --git a/src/include/s390_aes.h b/src/include/s390_aes.h
-index 6252dde0..a6ff27bd 100644
---- a/src/include/s390_aes.h
-+++ b/src/include/s390_aes.h
-@@ -674,7 +674,7 @@ static inline int s390_aes_xts_parm(unsigned long function_code,
- 
- 	memset(&parm_block.keys, 0, key_size);
- 
--	if (rc >= 0) {
-+	if (rc == 0) {
- 		memcpy(xts_parm, parm_block.xts_parameter,
- 		       sizeof(ica_aes_vector_t));
- 		return 0;
-diff --git a/src/include/s390_cmac.h b/src/include/s390_cmac.h
-index 76b9cca5..f19c069d 100644
---- a/src/include/s390_cmac.h
-+++ b/src/include/s390_cmac.h
-@@ -161,7 +161,7 @@ static inline int s390_cmac_hw(unsigned long fc,
- 		/* calculate final block (last/full) */
- 		rc = s390_pcc(fc, pb_lookup.base);
- 		memset(pb_lookup.keys, 0, key_size);
--		if (rc < 0)
-+		if (rc != 0)
- 			return EIO;
- 
- 		_stats_increment(fc, ALGO_HW, ENCRYPT);
-diff --git a/src/include/s390_crypto.h b/src/include/s390_crypto.h
-index f34241fd..f11eacb2 100644
---- a/src/include/s390_crypto.h
-+++ b/src/include/s390_crypto.h
-@@ -244,27 +244,30 @@ void s390_crypto_switches_init(void);
- 
- /**
-  * s390_pcc:
-- * @func: the function code passed to KM; see s390_pcc_functions
-+ * @func: the function code passed to PCC; see s390_pcc_functions
-  * @param: address of parameter block; see POP for details on each func
-  *
-  * Executes the PCC operation of the CPU.
-  *
-- * Returns -1 for failure, 0 for the query func, number of processed
-- * bytes for encryption/decryption funcs
-+ * Returns condition code of the PCC instruction
-  */
- static inline int s390_pcc(unsigned long func, void *param)
- {
- 	register unsigned long r0 asm("0") = (unsigned long)func;
- 	register unsigned long r1 asm("1") = (unsigned long)param;
-+	char cc;
- 
--	asm volatile (
--		"0:	.long	%[opc] << 16\n"
--		"	brc	1,0b\n"
--		:
--		: [fc] "d" (r0), [param] "a" (r1), [opc] "i" (0xb92c)
--		: "cc", "memory");
-+	asm volatile(
-+		"0:     .insn   rre,%[opc] << 16,0,0\n" /* PCC opcode */
-+		"       brc     1,0b\n" /* handle partial completion */
-+		"       ipm     %[cc]\n"
-+		"       srl     %[cc],28\n"
-+		: [cc] "=d" (cc)
-+		: [func] "d" (r0), [param] "a" (r1), [opc] "i" (0xb92c)
-+		: "cc", "memory"
-+	);
- 
--	return 0;
-+	return cc;
- }
- 
- /**

libica-4.3.0-03-Use-__asm__-instead-of-asm.patch

@@ -1,366 +0,0 @@
-From 900557435b85f2fa6446bf9d62e80d58eff4bfbe Mon Sep 17 00:00:00 2001
-From: Joerg Schmidbauer <jschmidb@de.ibm.com>
-Date: Wed, 19 Jun 2024 12:34:26 +0200
-Subject: [PATCH] Use __asm__  instead of asm
-
-The asm keyword is a GNU extension. When writing code that can be compiled with
--ansi and the various -std options, use __asm__ instead of asm.
-
-Signed-off-by: Joerg Schmidbauer <jschmidb@de.ibm.com>
----
- src/include/s390_crypto.h | 194 +++++++++++++++++++-------------------
- 1 file changed, 97 insertions(+), 97 deletions(-)
-
-diff --git a/src/include/s390_crypto.h b/src/include/s390_crypto.h
-index f11eacb..6ef4728 100644
---- a/src/include/s390_crypto.h
-+++ b/src/include/s390_crypto.h
-@@ -253,11 +253,11 @@ void s390_crypto_switches_init(void);
-  */
- static inline int s390_pcc(unsigned long func, void *param)
- {
--	register unsigned long r0 asm("0") = (unsigned long)func;
--	register unsigned long r1 asm("1") = (unsigned long)param;
-+	register unsigned long r0 __asm__("0") = (unsigned long)func;
-+	register unsigned long r1 __asm__("1") = (unsigned long)param;
- 	char cc;
- 
--	asm volatile(
-+	__asm__ volatile(
- 		"0:     .insn   rre,%[opc] << 16,0,0\n" /* PCC opcode */
- 		"       brc     1,0b\n" /* handle partial completion */
- 		"       ipm     %[cc]\n"
-@@ -285,12 +285,12 @@ static inline int s390_pcc(unsigned long func, void *param)
- static inline int s390_kmac(unsigned long func, void *param,
- 		    const unsigned char *src, long src_len)
- {
--	register long __func asm("0") = func;
--	register void *__param asm("1") = param;
--	register const unsigned char *__src asm("2") = src;
--	register long __src_len asm("3") = src_len;
-+	register long __func __asm__("0") = func;
-+	register void *__param __asm__("1") = param;
-+	register const unsigned char *__src __asm__("2") = src;
-+	register long __src_len __asm__("3") = src_len;
- 
--	asm volatile (
-+	__asm__ volatile (
- 		"0:     .insn   rre, 0xb91e0000,%0,%0 \n"
- 		"       brc     1, 0b \n"
- 		: "+a"(__src), "+d"(__src_len)
-@@ -318,15 +318,15 @@ static inline int s390_kma(unsigned long func, void *param, unsigned char *dest,
- 		      const unsigned char *src, long src_len,
- 		      const unsigned char *aad, long aad_len)
- {
--	register long __func asm("0") = func;
--	register void *__param asm("1") = param;
--	register const unsigned char *__src asm("2") = src;
--	register long __src_len asm("3") = src_len;
--	register unsigned char *__dest asm("4") = dest;
--	register const unsigned char *__aad asm("6") = aad;
--	register long __aad_len asm("7") = aad_len;
--
--	asm volatile(
-+	register long __func __asm__("0") = func;
-+	register void *__param __asm__("1") = param;
-+	register const unsigned char *__src __asm__("2") = src;
-+	register long __src_len __asm__("3") = src_len;
-+	register unsigned char *__dest __asm__("4") = dest;
-+	register const unsigned char *__aad __asm__("6") = aad;
-+	register long __aad_len __asm__("7") = aad_len;
-+
-+	__asm__ volatile(
- 		"0:	.insn	rrf,0xb9290000,%2,%0,%3,0 \n"
- 		"1:	brc	1,0b \n" /* handle partial completion */
- 		: "+a" (__src), "+d" (__src_len), "+a" (__dest), "+a" (__aad), "+d" (__aad_len)
-@@ -353,14 +353,14 @@ static inline int s390_kmctr(unsigned long func, void *param, unsigned char *des
- 		      const unsigned char *src, long src_len,
- 		      unsigned char *counter)
- {
--	register long __func asm("0") = func;
--	register void *__param asm("1") = param;
--	register const unsigned char *__src asm("2") = src;
--	register long __src_len asm("3") = src_len;
--	register unsigned char *__dest asm("4") = dest;
--	register unsigned char *__ctr asm("6") = counter;
--
--	asm volatile(
-+	register long __func __asm__("0") = func;
-+	register void *__param __asm__("1") = param;
-+	register const unsigned char *__src __asm__("2") = src;
-+	register long __src_len __asm__("3") = src_len;
-+	register unsigned char *__dest __asm__("4") = dest;
-+	register unsigned char *__ctr __asm__("6") = counter;
-+
-+	__asm__ volatile(
- 		"0:	.insn	rrf,0xb92d0000,%2,%0,%3,0 \n"
- 		"1:	brc	1,0b \n"
- 		: "+a" (__src), "+d" (__src_len), "+a" (__dest), "+a" (__ctr)
-@@ -386,13 +386,13 @@ static inline int s390_kmctr(unsigned long func, void *param, unsigned char *des
- static inline int s390_kmf(unsigned long func, void *param, unsigned char *dest,
- 		   const unsigned char *src, long src_len, unsigned int *lcfb)
- {
--	register long __func asm("0") = ((*lcfb & 0x000000ff) << 24) | func;
--	register void *__param asm("1") = param;
--	register const unsigned char *__src asm("2") = src;
--	register long __src_len asm("3") = src_len;
--	register unsigned char *__dest asm("4") = dest;
-+	register long __func __asm__("0") = ((*lcfb & 0x000000ff) << 24) | func;
-+	register void *__param __asm__("1") = param;
-+	register const unsigned char *__src __asm__("2") = src;
-+	register long __src_len __asm__("3") = src_len;
-+	register unsigned char *__dest __asm__("4") = dest;
- 
--	asm volatile (
-+	__asm__ volatile (
- 		"0:	.insn	rre,0xb92a0000,%2,%0 \n"
- 		"	brc	1,0b \n"
- 		: "+a"(__src), "+d"(__src_len), "+a"(__dest)
-@@ -418,13 +418,13 @@ static inline int s390_kmf(unsigned long func, void *param, unsigned char *dest,
- static inline int s390_kmo(unsigned long func, void *param, unsigned char *dest,
- 		    const unsigned char *src, long src_len)
- {
--	register long __func asm("0") = func;
--	register void *__param asm("1") = param;
--	register const unsigned char *__src asm("2") = src;
--	register long __src_len asm("3") = src_len;
--	register unsigned char *__dest asm("4") = dest;
-+	register long __func __asm__("0") = func;
-+	register void *__param __asm__("1") = param;
-+	register const unsigned char *__src __asm__("2") = src;
-+	register long __src_len __asm__("3") = src_len;
-+	register unsigned char *__dest __asm__("4") = dest;
- 
--	asm volatile (
-+	__asm__ volatile (
- 		"0:	.insn	rre, 0xb92b0000,%2,%0 \n"
- 		"	brc	1, 0b \n"
- 		: "+a"(__src), "+d"(__src_len), "+a"(__dest)
-@@ -450,13 +450,13 @@ static inline int s390_kmo(unsigned long func, void *param, unsigned char *dest,
- static inline int s390_km(unsigned long func, void *param, unsigned char *dest,
- 		   const unsigned char *src, long src_len)
- {
--	register long __func asm("0") = func;
--	register void *__param asm("1") = param;
--	register const unsigned char *__src asm("2") = src;
--	register long __src_len asm("3") = src_len;
--	register unsigned char *__dest asm("4") = dest;
-+	register long __func __asm__("0") = func;
-+	register void *__param __asm__("1") = param;
-+	register const unsigned char *__src __asm__("2") = src;
-+	register long __src_len __asm__("3") = src_len;
-+	register unsigned char *__dest __asm__("4") = dest;
- 
--	asm volatile (
-+	__asm__ volatile (
- 		"0:	.insn	rre,0xb92e0000,%2,%0 \n"	/* KM opcode */
- 		"	brc	1,0b \n"	/* handle partial completion */
- 		: "+a"(__src), "+d"(__src_len), "+a"(__dest)
-@@ -482,13 +482,13 @@ static inline int s390_km(unsigned long func, void *param, unsigned char *dest,
- static inline int s390_kmc(unsigned long func, void *param, unsigned char *dest,
- 		    const unsigned char *src, long src_len)
- {
--	register long __func asm("0") = func;
--	register void *__param asm("1") = param;
--	register const unsigned char *__src asm("2") = src;
--	register long __src_len asm("3") = src_len;
--	register unsigned char *__dest asm("4") = dest;
-+	register long __func __asm__("0") = func;
-+	register void *__param __asm__("1") = param;
-+	register const unsigned char *__src __asm__("2") = src;
-+	register long __src_len __asm__("3") = src_len;
-+	register unsigned char *__dest __asm__("4") = dest;
- 
--	asm volatile (
-+	__asm__ volatile (
- 		"0:	.insn	rre, 0xb92f0000,%2,%0 \n"	/* KMC opcode */
- 		"	brc	1, 0b \n"	/* handle partial completion */
- 		: "+a"(__src), "+d"(__src_len), "+a"(__dest)
-@@ -515,15 +515,15 @@ static inline int s390_kimd_shake(unsigned long func, void *param,
- 		unsigned char *dest, long dest_len,
- 	     const unsigned char *src, long src_len)
- {
--	register long  __func asm("0") = func;
--	register void *__param asm("1") = param;
--	register unsigned char *__dest asm("2") = dest;
--	register long  __dest_len asm("3") = dest_len;
--	register const unsigned char *__src asm("4") = src;
--	register long  __src_len asm("5") = src_len;
-+	register long  __func __asm__("0") = func;
-+	register void *__param __asm__("1") = param;
-+	register unsigned char *__dest __asm__("2") = dest;
-+	register long  __dest_len __asm__("3") = dest_len;
-+	register const unsigned char *__src __asm__("4") = src;
-+	register long  __src_len __asm__("5") = src_len;
- 	int ret = -1;
- 
--	asm volatile(
-+	__asm__ volatile(
- 		"0:      .insn   rre,0xb93e0000,%1,%5\n\t" /* KIMD opcode */
- 		"        brc     1,0b\n\t" /* handle partial completion */
- 		"        la      %0,0\n\t"
-@@ -538,12 +538,12 @@ static inline int s390_kimd_shake(unsigned long func, void *param,
- static inline int s390_kimd(unsigned long func, void *param,
- 		     const unsigned char *src, long src_len)
- {
--	register long __func asm("0") = func;
--	register void *__param asm("1") = param;
--	register const unsigned char *__src asm("2") = src;
--	register long __src_len asm("3") = src_len;
-+	register long __func __asm__("0") = func;
-+	register void *__param __asm__("1") = param;
-+	register const unsigned char *__src __asm__("2") = src;
-+	register long __src_len __asm__("3") = src_len;
- 
--	asm volatile (
-+	__asm__ volatile (
- 		"0:	.insn	rre,0xb93e0000,%0,%0 \n"	/* KIMD opcode */
- 		"	brc	1,0b \n"	/* handle partial completion */
- 		: "+a"(__src), "+d"(__src_len)
-@@ -569,15 +569,15 @@ static inline int s390_klmd_shake(unsigned long func, void *param,
- 		unsigned char *dest, long dest_len,
- 		const unsigned char *src, long src_len)
- {
--	register long  __func asm("0") = func;
--	register void *__param asm("1") = param;
--	register unsigned char *__dest asm("2") = dest;
--	register long  __dest_len asm("3") = dest_len;
--	register const unsigned char *__src asm("4") = src;
--	register long  __src_len asm("5") = src_len;
-+	register long  __func __asm__("0") = func;
-+	register void *__param __asm__("1") = param;
-+	register unsigned char *__dest __asm__("2") = dest;
-+	register long  __dest_len __asm__("3") = dest_len;
-+	register const unsigned char *__src __asm__("4") = src;
-+	register long  __src_len __asm__("5") = src_len;
- 	int ret = -1;
- 
--	asm volatile(
-+	__asm__ volatile(
- 		"0:      .insn   rre,0xb93f0000,%1,%5\n\t" /* KLMD opcode */
- 		"        brc     1,0b\n\t" /* handle partial completion */
- 		"        la      %0,0\n\t"
-@@ -592,12 +592,12 @@ static inline int s390_klmd_shake(unsigned long func, void *param,
- static inline int s390_klmd(unsigned long func, void *param,
- 		const unsigned char *src, long src_len)
- {
--	register long __func asm("0") = func;
--	register void *__param asm("1") = param;
--	register const unsigned char *__src asm("2") = src;
--	register long __src_len asm("3") = src_len;
-+	register long __func __asm__("0") = func;
-+	register void *__param __asm__("1") = param;
-+	register const unsigned char *__src __asm__("2") = src;
-+	register long __src_len __asm__("3") = src_len;
- 
--	asm volatile (
-+	__asm__ volatile (
- 		"0:	.insn	rre,0xb93f0000,%0,%0 \n" /* KLMD opcode */
- 		"	brc	1,0b \n"	/* handle partial completion */
- 		: "+a"(__src), "+d"(__src_len)
-@@ -624,13 +624,13 @@ static inline int s390_klmd(unsigned long func, void *param,
- static inline int s390_kdsa(unsigned long func, void *param,
- 		            const unsigned char *src, unsigned long srclen)
- {
--	register unsigned long r0 asm("0") = (unsigned long)func;
--	register unsigned long r1 asm("1") = (unsigned long)param;
--	register unsigned long r2 asm("2") = (unsigned long)src;
--	register unsigned long r3 asm("3") = (unsigned long)srclen;
-+	register unsigned long r0 __asm__("0") = (unsigned long)func;
-+	register unsigned long r1 __asm__("1") = (unsigned long)param;
-+	register unsigned long r2 __asm__("2") = (unsigned long)src;
-+	register unsigned long r3 __asm__("3") = (unsigned long)srclen;
- 	unsigned long rc = 1;
- 
--	asm volatile(
-+	__asm__ volatile(
- 		"0:	.insn	rre,%[__opc] << 16,0,%[__src]\n"
- 		"	brc	1,0b\n" /* handle partial completion */
- 		"	brc	7,1f\n"
-@@ -668,15 +668,15 @@ static inline int s390_ppno(long func,
- 			    const unsigned char *src,
- 			    long src_len)
- {
--	register long  __func asm("0") = func;
--	register void *__param asm("1") = param;
--	register unsigned char *__dest asm("2") = dest;
--	register long  __dest_len asm("3") = dest_len;
--	register const unsigned char *__src asm("4") = src;
--	register long  __src_len asm("5") = src_len;
-+	register long  __func __asm__("0") = func;
-+	register void *__param __asm__("1") = param;
-+	register unsigned char *__dest __asm__("2") = dest;
-+	register long  __dest_len __asm__("3") = dest_len;
-+	register const unsigned char *__src __asm__("4") = src;
-+	register long  __src_len __asm__("5") = src_len;
- 	int ret = -1;
- 
--	asm volatile(
-+	__asm__ volatile(
- 		"0:      .insn   rre,0xb93c0000,%1,%5\n\t" /* PPNO opcode */
- 		"        brc     1,0b\n\t" /* handle partial completion */
- 		"        la      %0,0\n\t"
-@@ -701,13 +701,13 @@ static inline int s390_ppno(long func,
- static inline void cpacf_trng(unsigned char *ucbuf, unsigned long ucbuf_len,
-                               unsigned char *cbuf, unsigned long cbuf_len)
- {
--        register unsigned long r0 asm("0") = (unsigned long) S390_CRYPTO_TRNG;
--        register unsigned long r2 asm("2") = (unsigned long) ucbuf;
--        register unsigned long r3 asm("3") = (unsigned long) ucbuf_len;
--        register unsigned long r4 asm("4") = (unsigned long) cbuf;
--        register unsigned long r5 asm("5") = (unsigned long) cbuf_len;
-+        register unsigned long r0 __asm__("0") = (unsigned long) S390_CRYPTO_TRNG;
-+        register unsigned long r2 __asm__("2") = (unsigned long) ucbuf;
-+        register unsigned long r3 __asm__("3") = (unsigned long) ucbuf_len;
-+        register unsigned long r4 __asm__("4") = (unsigned long) cbuf;
-+        register unsigned long r5 __asm__("5") = (unsigned long) cbuf_len;
- 
--        asm volatile (
-+        __asm__ volatile (
-                 "0:     .insn   rre,0xb93c0000,%[ucbuf],%[cbuf]\n"
-                 "       brc     1,0b\n"   /* handle partial completion */
-                 : [ucbuf] "+a" (r2), [ucbuflen] "+d" (r3),
-@@ -719,21 +719,21 @@ static inline void cpacf_trng(unsigned char *ucbuf, unsigned long ucbuf_len,
- 
- static inline void s390_stckf_hw(void *buf)
- {
--	asm volatile(".insn     s,0xb27c0000,%0"
-+	__asm__ volatile(".insn     s,0xb27c0000,%0"
- 		     : "=Q" (*((unsigned long long *)buf)) : : "cc");
- }
- 
- static inline void s390_stcke_hw(void *buf)
- {
--	asm volatile(".insn     s,0xb2780000,%0"
-+	__asm__ volatile(".insn     s,0xb2780000,%0"
- 		     : "=Q" (*((unsigned long long *)buf)) : : "cc");
- }
- 
- static inline int __stfle(unsigned long long *list, int doublewords)
- {
--	register unsigned long __nr asm("0") = doublewords - 1;
-+	register unsigned long __nr __asm__("0") = doublewords - 1;
- 
--	asm volatile(".insn s,0xb2b00000,0(%1)" /* stfle */
-+	__asm__ volatile(".insn s,0xb2b00000,0(%1)" /* stfle */
- 		     : "+d" (__nr) : "a" (list) : "memory", "cc");
- 
- 	return __nr + 1;
-@@ -741,7 +741,7 @@ static inline int __stfle(unsigned long long *list, int doublewords)
- 
- static inline void s390_flip_endian_32(void *dest, const void *src)
- {
--	asm volatile(
-+	__asm__ volatile(
- 		"	lrvg	%%r0,0(0,%[__src])\n"
- 		"	lrvg	%%r1,8(0,%[__src])\n"
- 		"	lrvg	%%r4,16(0,%[__src])\n"
-@@ -757,7 +757,7 @@ static inline void s390_flip_endian_32(void *dest, const void *src)
- 
- static inline void s390_flip_endian_64(void *dest, const void *src)
- {
--	asm volatile(
-+	__asm__ volatile(
- 		"	lrvg	%%r0,0(0,%[__src])\n"
- 		"	lrvg	%%r1,8(0,%[__src])\n"
- 		"	lrvg	%%r4,16(0,%[__src])\n"

libica-4.3.0.tar.gz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:112c6136fd5ccfd6a1d33b5fd2427f5fec69aa2a0fc04e80a6ab58d7b9012db3
-size 576077

libica-4.4.1.tar.gz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:edc755494797331427c5f7900c7eecd8b5ecd3e69b7502313bf764f490b8e87a
+size 579706

libica-CONFIGURE-Make-the-OpenSSL-FIPS-config-file-name-configurable.patch

@@ -0,0 +1,52 @@
+From 11078c8bcd99f29f2cc7094cdced801a0b53f6df Mon Sep 17 00:00:00 2001
+From: Ingo Franzki <ifranzki@linux.ibm.com>
+Date: Wed, 4 Jun 2025 11:17:35 +0200
+Subject: [PATCH] CONFIGURE: Make the OpenSSL FIPS config file name
+ configurable
+
+The name of the OpenSSL FIPS config file may be different on various
+distros. It is included in src/openssl3-fips.cnf when used with
+OpenSSL 3.0 or later.
+
+To use a specific name:
+  ./configure --enable-fips --with-fips-config=fips_local.cnf
+
+The default remains fipsmodule.cnf. It is only used when --enable-fips
+is also specified, and libica is built against OpenSSL 3.0 or later.
+
+Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
+---
+ configure.ac             | 7 +++++++
+ src/openssl3-fips.cnf.in | 2 +-
+ 2 files changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/configure.ac b/configure.ac
+index bb35b867..7e45dd70 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -100,6 +100,13 @@ if test "x$enable_fips" = xyes; then
+     fi
+ fi
+ 
++dnl --- with-fips-config
++AC_ARG_WITH([fips-config],
++	AS_HELP_STRING([--with-fips-config=FILE],[OpenSSL FIPS config file name. Default is fipsmodule.cnf]),
++	[], [with_fips_config=fipsmodule.cnf])
++FIPSCONFIGFILE="$with_fips_config"
++AC_SUBST(FIPSCONFIGFILE)
++
+ dnl --- enable_sanitizer
+ AC_ARG_ENABLE(sanitizer,
+               [  --enable-sanitizer      turn on sanitizer (may not work on all systems)],
+diff --git a/src/openssl3-fips.cnf.in b/src/openssl3-fips.cnf.in
+index 1391bcbd..0c1a4147 100644
+--- a/src/openssl3-fips.cnf.in
++++ b/src/openssl3-fips.cnf.in
+@@ -1,6 +1,6 @@
+ openssl_conf = openssl_init
+ 
+-.include @FIPSDIR@/fipsmodule.cnf
++.include @FIPSDIR@/@FIPSCONFIGFILE@
+ 
+ [openssl_init]
+ providers = provider_sect

libica.changes

@@ -1,3 +1,80 @@
+-------------------------------------------------------------------
+Wed Jul 30 06:53:05 UTC 2025 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
+
+- Applied a patch (bsc#1247287)
+  * libica-CONFIGURE-Make-the-OpenSSL-FIPS-config-file-name-configurable.patch
+- Added '--with-fips-config=fips_local.cnf' in "%configure" 
+
+-------------------------------------------------------------------
+Mon Jul 28 10:40:04 UTC 2025 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
+
+- Amended the .spec file (bsc#1246541)
+  * Added a flag '-DNO_FIPS_CONFIG_LOAD' to CPPFLAGS and CFLAGS
+  * Do not ship the config file '/etc/libica/openssl3-fips.cnf'
+
+-------------------------------------------------------------------
+Fri May 30 09:40:05 UTC 2025 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
+
+- Upgrade libica to version 4.4.1
+  * Bug fixes 
+- Removed obsolete patch
+  * libica-fips-update-Fix-bug-in-condition-logic.patch
+
+-------------------------------------------------------------------
+Fri Feb  7 06:58:32 UTC 2025 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
+
+- Applied a patch (jsc#PED-10289, jsc#PED-3277) 
+  * libica-fips-update-Fix-bug-in-condition-logic.patch
+
+-------------------------------------------------------------------
+Tue Dec 31 10:44:31 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
+
+- Upgrade libica to version 4.4.0 (jsc#PED-3277, jsc#PED-10289)
+  * Updates for FIPS 140-3 certification 2024
+  * Various bug fixes and housekeeping 
+- Removed obsolete patches
+  * libica-01-fips-update-remove-sigVer-from-fips-ECDSA-kat.patch
+  * libica-02-fips-update-Change-service-indicator-implementation.patch
+  * libica-03-fips-update-Dynamically-update-service-indicator-based-on-IV-usage.patch
+  * libica-04-fips-update-provide-test-for-dynamic-service-indicator.patch
+
+-------------------------------------------------------------------
+Wed Dec  4 07:05:18 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
+
+- Amended the .spec file (bsc#1234117, bsc#1231999)
+  * downgraded libica tools requires down to recommends again
+
+-------------------------------------------------------------------
+Wed Nov 13 08:57:23 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
+
+- Applied updated patches (bsc#1231302, bsc#1231303, bsc#1231304, bsc#1231305)
+  * libica-02-fips-update-Change-service-indicator-implementation.patch
+  * libica-03-fips-update-Dynamically-update-service-indicator-based-on-IV-usage.patch
+  * libica-04-fips-update-provide-test-for-dynamic-service-indicator.patch
+
+-------------------------------------------------------------------
+Tue Nov  5 12:07:12 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
+
+- Applied patches (bsc#1231302, bsc#1231303, bsc#1231304, bsc#1231305)
+  * libica-01-fips-update-remove-sigVer-from-fips-ECDSA-kat.patch
+  * libica-02-fips-update-Change-service-indicator-implementation.patch
+
+-------------------------------------------------------------------
+Tue Oct 29 06:22:04 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
+
+- Upgrade libica to version 4.3.1 (jsc#PED-9560, jsc#PED-10289, jsc#PED-3276)
+  *  Various bug fixes and housekeeping
+- Removed obsolete patches
+  * libica-4.3.0-01-disable-CEX-usage-in-OpenSSL-for-all-tests.patch
+  * libica-4.3.0-02-correct-rc-handling-with-s390_pcc-function.patch
+  * libica-4.3.0-03-Use-__asm__-instead-of-asm.patch
+
+-------------------------------------------------------------------
+Wed Oct 23 09:05:28 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
+
+- Amended the .spec file (bsc#1231999)
+  * Replaced Recommends libica-tools with Requires
+
 -------------------------------------------------------------------
 Wed Jul  3 10:51:28 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
 
@@ -807,5 +884,3 @@ Tue Feb  5 11:01:16 CET 2002 - froh@suse.de
 Wed Jan 30 16:20:48 CET 2002 - froh@suse.de
 
 - initial version
-
--------------------------------------------------------------------

libica.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package libica
 #
-# Copyright (c) 2024 SUSE LLC
+# Copyright (c) 2025 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -22,7 +22,7 @@
 %endif
 
 Name:           libica
-Version:        4.3.0
+Version:        4.4.1
 Release:        0
 Summary:        Library interface for the IBM Cryptographic Accelerator device driver
 License:        CPL-1.0
@@ -36,11 +36,9 @@ Source4:        z90crypt.service
 Source5:        %{name}-rpmlintrc
 ###
 Patch01:        libica-FIPS-make-it-possible-to-specify-fipshmac-binary.patch
-Patch99:        libica-sles15sp5-FIPS-hmac-key.patch
+Patch02:        libica-sles15sp5-FIPS-hmac-key.patch
 ###
-Patch110:       libica-4.3.0-01-disable-CEX-usage-in-OpenSSL-for-all-tests.patch
-Patch111:       libica-4.3.0-02-correct-rc-handling-with-s390_pcc-function.patch
-Patch112:       libica-4.3.0-03-Use-__asm__-instead-of-asm.patch
+Patch10:        libica-CONFIGURE-Make-the-OpenSSL-FIPS-config-file-name-configurable.patch
 ###
 
 BuildRequires:  autoconf
@@ -121,8 +119,8 @@ the libica library.
 
 %build
 autoreconf --force --install
-%configure CPPFLAGS="-Iinclude -fPIC" CFLAGS="%{optflags} -fPIC" \
-  --enable-fips
+%configure CPPFLAGS="-Iinclude -fPIC -DNO_FIPS_CONFIG_LOAD" CFLAGS="%{optflags} -fPIC -DNO_FIPS_CONFIG_LOAD" \
+  --enable-fips --with-fips-config=fips_local.cnf
 
 %make_build clean
 %make_build FIPSHMAC=fipshmac BUILD_VERSION="FIPS-SUSE-%version-%release"
@@ -150,6 +148,7 @@ cp -a %{SOURCE1} .
 rm -vf %{buildroot}%{_libdir}/libica*.la
 rm -f %{buildroot}%{_datadir}/doc/libica/*
 rmdir %{buildroot}%{_datadir}/doc/libica
+### Comment below two lines to enable FIPS config file 'openssl3-fips.cnf'
 # rm %{buildroot}/%{_sysconfdir}/libica/openssl3-fips.cnf
 # rmdir %{buildroot}/%{_sysconfdir}/libica