rpm/openssl-ibmca
SHA256
1
0
Fork 0
forked from pool/openssl-ibmca
Code Pull Requests Activity

Accepting request 1168604 from security:tls

Browse Source 
OBS-URL: https://build.opensuse.org/request/show/1168604
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-ibmca?expand=0&rev=50
This commit is contained in:
Ana Guerrero 2024-04-18 20:12:04 +00:00 committed by Git OBS Bridge
commit 27508c4aee
4 changed files with 214 additions and 67 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
_multibuild
View File

@ -1,5 +1,4 @@
<multibuild>
<flavor>openssl1</flavor>
<flavor>engine</flavor>
<flavor>provider</flavor>
</multibuild>

45
openssl-ibmca.changes
View File

@ -1,3 +1,48 @@
-------------------------------------------------------------------
Wed Apr 17 14:04:14 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
- Amended the .spec file
- Changed the package names
+-------------+---------------------------------+--------------------------+
| Flavor | Package name | Note |
+-------------+---------------------------------+--------------------------+
| '' | openssl-ibmca | Both engine and provider |
| openssl1_1 | openssl1_1-ibmca | openssl1 flavor |
| engine | openssl-ibmca-engine | Only engine |
| provider | openssl-ibmca-provider | Only provider |
+-------------+---------------------------------+--------------------------+
-------------------------------------------------------------------
Wed Apr 17 08:41:08 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
- Applied a patch for openssl1_1 (bsc#1221627)
* openssl1-rename-libica-files.patch
-------------------------------------------------------------------
Tue Apr 9 14:08:05 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
- Re-implemented flavors (openssl3, engine, provider) (bsc#1221627)
+------------+---------------------------------+--------------------------+
| Flavor | Package name | Note |
+------------+---------------------------------+--------------------------+
| '' | openssl-ibmca | openssl1 flavor |
| engine | openssl3-ibmca-engine | Only engine |
| provider | openssl3-ibmca-provider | Only provider |
| openssl3 | openssl3-ibmca | Both engine and provider |
+------------+---------------------------------+--------------------------+
- Changing/editing 'dynamic_path' after the installation on the target system
* From /usr/lib64/ossl-modules to /usr/lib64/engines-3 in
/usr/share/doc/packages/openssl3-ibmca/ibmca-engine-opensslconfig
for openssl3 flavor
-------------------------------------------------------------------
Thu Apr 4 07:02:23 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
- Amended the .spec file (bsc#1221627)
* Removed the flavors
* Removed 'muiltibuild' environment
* Removed the 'provider' logic
-------------------------------------------------------------------
Mon Mar 18 19:18:47 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>

170
openssl-ibmca.spec
View File

@ -16,99 +16,127 @@
#
%define flavor @BUILD_FLAVOR@%{nil}
%if "%{flavor}" == ""
%define openssl3 1
%define provider 0
%endif
%if "%{flavor}" == "openssl1"
%define openssl3 0
%define provider 0
%endif
%if "%{flavor}" == "engine"
%define openssl3 1
%define provider 0
%endif
%if "%{flavor}" == "provider"
%define openssl3 1
%define provider 1
%endif
%global enginesdir %(pkg-config --variable=enginesdir libcrypto)
%global modulesdir %(pkg-config --variable=modulesdir libcrypto)
%global sslengcnf %{_sysconfdir}/ssl/engines3.d
%global sslengdef %{_sysconfdir}/ssl/engdef3.d
%define flavor @BUILD_FLAVOR@%{nil}
%if "%{flavor}" == ""
Name: openssl-ibmca
%endif
%if "%{flavor}" == "engine"
Name: openssl-ibmca-engine
%endif
%if "%{flavor}" == "provider"
Name: openssl-ibmca-provider
%endif
%if "%{flavor}" == "openssl1_1"
%global sslengcnf %{_sysconfdir}/ssl/engines1.1.d
%global sslengdef %{_sysconfdir}/ssl/engdef1.1.d
Name: openssl1_1-ibmca
%endif
Version: 2.4.1
Release: 0
Summary: The IBMCA OpenSSL dynamic engine
License: Apache-2.0
Group: Hardware/Other
URL: https://github.com/opencryptoki/openssl-ibmca
Source: https://github.com/opencryptoki/%{name}/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz
Source: https://github.com/opencryptoki/openssl-ibmca/archive/v%{version}.tar.gz#/openssl-ibmca-%{version}.tar.gz
Source1: engine_section.txt
Source2: _multibuild
###
BuildRequires: autoconf
BuildRequires: automake
BuildRequires: libtool
###
%if "%{flavor}" != "openssl1_1"
BuildRequires: libica-devel >= 4.0.0
BuildRequires: libica-tools >= 4.0.0
BuildRequires: libtool
Requires: libica4 >= 4
%if %{openssl3}
BuildRequires: openssl-devel > 3.0.0
Requires: openssl > 3.0.0
BuildRequires: libopenssl-3-devel
BuildRequires: libopenssl3
Requires: libica4 >= 4.0.0
Requires: libopenssl3
%else
BuildRequires: openssl-devel
Requires: openssl
BuildRequires: libica-openssl1_1-devel
BuildRequires: libica-openssl1_1-tools
BuildRequires: libopenssl-1_1-devel
BuildRequires: libopenssl1_1
BuildRequires: openssl
Requires: libica4-openssl1_1
Requires: libopenssl1_1
%endif
###
ExclusiveArch: s390x
%if "%{flavor}" == "openssl1_1"
Patch001: openssl1-rename-libica-files.patch
%endif
%description
This package contains a shared object OpenSSL dynamic engine which interfaces
to libica, a library enabling the IBM s390/x CPACF crypto instructions.
%prep
%autosetup -p1
%autosetup -p1 -n openssl-ibmca-%{version}
./bootstrap.sh
%build
export CFLAGS="%{optflags}"
export CPPFLAGS="%{optflags}"
%if %{provider}
%configure \
%if "%{flavor}" == ""
%configure \
--libdir=%{modulesdir}
mkdir -p %{buildroot}/%{enginesdir}
%endif
%if "%{flavor}" == "engine"
%configure \
--disable-provider \
--libdir=%{enginesdir}
%endif
%if "%{flavor}" == "provider"
%configure \
--disable-engine \
--libdir=%{modulesdir}
%else
%configure \
--disable-provider \
%endif
%if "%{flavor}" == "openssl1_1"
%configure \
--libdir=%{enginesdir}
%endif
%make_build
%install
%if %{provider}
#
###
#
%else
# Update the sample config file so that the dynamic path points
# to the correct version of the engines directory.
%if "%{flavor}" != "provider"
sed -i -e "/^dynamic_path/s, = .*/, = %{enginesdir}/," src/engine/openssl.cnf.sample
%endif
%make_install
%if %{provider}
rm -f %{buildroot}/%{modulesdir}/ibmca-provider.la
%else
rm -f %{buildroot}/%{enginesdir}/ibmca.la
%if "%{flavor}" == "openssl1_1"
rm -f %{buildroot}/%{enginesdir}/ibmca-provider.*
%endif
%if "%{flavor}" == ""
mkdir -p %{buildroot}/%{enginesdir}
mv %{buildroot}/%{modulesdir}/ibmca.* %{buildroot}/%{enginesdir}/
%endif
rm -f %{buildroot}/%{enginesdir}/ibmca*.la
rm -f %{buildroot}/%{modulesdir}/ibmca*.la
# This file contains the declaration of the ibmca engine section. It
# needs to be on the "real" file system when the postinstall scriptlet
# is run. It will be read by the openssl .include directive that points
@ -127,45 +155,55 @@ grep -v "^#" src/engine/openssl.cnf.sample | \
%post
#Original fix for bsc#942839 was to update on first install
#For bsc#966139 update if openssl_def not found
SSLENGCNF=%{_sysconfdir}/ssl/engines.d
SSLENGDEF=%{_sysconfdir}/ssl/engdef.d
%if %{openssl3}
mkdir -p ${SSLENGCNF}
mkdir -p ${SSLENGDEF}
mkdir -p %{sslengcnf}
mkdir -p %{sslengdef}
cp -p %{_datadir}/%{name}/openssl-ibmca.sectiondef.txt %{sslengcnf}/openssl-ibmca.cnf
cp -p %{_datadir}/%{name}/openssl-ibmca.enginedef.cnf %{sslengdef}/openssl-ibmca.cnf
%if "%{flavor}" == ""
cp -p /usr/share/doc/packages/openssl-ibmca/ibmca-engine-opensslconfig /usr/share/doc/packages/openssl-ibmca/ibmca-engine-opensslconfig.orig
sed -e 's/ossl-modules/engines-3/' /usr/share/doc/packages/openssl-ibmca/ibmca-engine-opensslconfig.orig > /usr/share/doc/packages/openssl-ibmca/ibmca-engine-opensslconfig
rm /usr/share/doc/packages/openssl-ibmca/ibmca-engine-opensslconfig.orig
%endif
cp -p %{_datadir}/%{name}/openssl-ibmca.sectiondef.txt ${SSLENGCNF}/openssl-ibmca.cnf
cp -p %{_datadir}/%{name}/openssl-ibmca.enginedef.cnf ${SSLENGDEF}/openssl-ibmca.cnf
%postun
SSLENGCNF=%{_sysconfdir}/ssl/engines.d
SSLENGDEF=%{_sysconfdir}/ssl/engdef.d
if [ $1 -eq 0 ]; then # last uninstall
rm -f ${SSLENGCNF}/openssl-ibmca.cnf
rm -f ${SSLENGDEF}/openssl-ibmca.cnf
rm -f %{sslengcnf}/openssl-ibmca.cnf
rm -f %{sslengdef}/openssl-ibmca.cnf
fi
%files
%license LICENSE
%doc ChangeLog
%doc README.md
%doc src/engine/openssl.cnf.sample
%doc src/engine/ibmca-engine-opensslconfig.in
%dir %{_datadir}/%{name}
%{_datadir}/%{name}/openssl-ibmca.sectiondef.txt
%{_datadir}/%{name}/openssl-ibmca.enginedef.cnf
%if %{openssl3}
%if %{provider}
%if "%{flavor}" == ""
%doc src/engine/ibmca-engine-opensslconfig
%doc src/provider/ibmca-provider-opensslconfig
%doc src/engine/openssl.cnf.sample
%{enginesdir}/ibmca.*
%{modulesdir}/ibmca-provider.*
%{_mandir}/man5/ibmca.5%{?ext_man}
%{_mandir}/man5/ibmca-provider.5%{?ext_man}
%endif
%if "%{flavor}" == "provider"
%doc src/provider/ibmca-provider-opensslconfig
%{modulesdir}/ibmca-provider.*
%{_mandir}/man5/ibmca-provider.5%{?ext_man}
%else
%endif
%if "%{flavor}" == "engine"
%doc src/engine/ibmca-engine-opensslconfig
%doc src/engine/openssl.cnf.sample
%{enginesdir}/ibmca.*
%{_mandir}/man5/ibmca.5%{?ext_man}
%endif
%if "%{flavor}" == "openssl1_1"
%doc src/engine/openssl.cnf.sample
%{enginesdir}/ibmca.*
%{_mandir}/man5/ibmca.5%{?ext_man}
%endif
%else
%{enginesdir}/ibmca.*
%{_mandir}/man5/ibmca.5%{?ext_man}
%endif
%changelog

65
openssl1-rename-libica-files.patch Normal file
View File

@ -0,0 +1,65 @@
--- openssl-ibmca-2.4.1/configure.ac 2023-09-21 08:52:43.000000000 +0200
+++ changed/configure.ac 2024-04-17 10:13:02.267582864 +0200
@@ -69,7 +69,7 @@
# Checks for header files.
AC_CHECK_HEADERS([arpa/inet.h fcntl.h malloc.h netdb.h netinet/in.h stddef.h stdlib.h \
string.h strings.h sys/ioctl.h sys/param.h sys/socket.h sys/time.h unistd.h])
-AC_CHECK_HEADER([ica_api.h], [], AC_MSG_ERROR([*** libica-devel >= 3.6.0 is required ***]))
+AC_CHECK_HEADER([ica_api.h], [], AC_MSG_ERROR([*** libica-openssl1_1-devel >= 3.6.0 is required ***]))
# Checks for typedefs, structures, and compiler characteristics.
@@ -81,15 +81,15 @@
# Checks for library functions.
AC_CHECK_FUNCS([gethostbyaddr gethostbyname memset strcasecmp strncasecmp strstr malloc])
AC_CHECK_DECLS([ICA_FLAG_DHW,DES_ECB], [],
- AC_MSG_ERROR([*** libica-devel >= 3.6.0 are required ***]),
+ AC_MSG_ERROR([*** libica-openssl1_1-devel >= 3.6.0 are required ***]),
[#include <ica_api.h>])
AC_CHECK_DECLS([OSSL_ASYM_CIPHER_PARAM_IMPLICIT_REJECTION],
[openssl_implicit_rejection="yes"], [openssl_implicit_rejection="no"],
[#include <openssl/core_names.h>])
AM_CONDITIONAL([OPENSSL_IMPLICIT_REJECTION], [test "x$openssl_implicit_rejection" = xyes])
-AC_ARG_WITH([libica-cex],
- [AS_HELP_STRING([--with-libica-cex],[Use libica-cex as default library for the IBMCA engine])],
+AC_ARG_WITH([libica-openssl1_1-cex],
+ [AS_HELP_STRING([--with-libica-openssl1_1-cex],[Use libica-openssl1_1-cex as default library for the IBMCA engine])],
[usecexonly=${withval}],
[])
@@ -99,11 +99,11 @@
[libicaversion=4])
if test "x$usecexonly" = xyes; then
- defaultlib="libica-cex.so.$libicaversion"
- ica="ica-cex"
+ defaultlib="libica-openssl1_1-cex.so.$libicaversion"
+ ica="ica-openssl1_1-cex"
else
- defaultlib="libica.so.$libicaversion"
- ica="ica"
+ defaultlib="libica-openssl1_1.so.$libicaversion"
+ ica="ica-openssl1_1"
fi
# In cex-only mode, testing the ciphers does not make any sense since
# they will fall back to OpenSSL without the engine. So remove these
@@ -135,7 +135,7 @@
AC_DEFINE_UNQUOTED([LIBICA_SHARED_LIB],["$defaultlib"])
-AC_SUBST([ICA],["$ica"])
+AC_SUBST([ICA],["$ica-openssl1_1"])
AC_CHECK_PROG([openssl_var],[openssl],[yes],[no])
if test "x$openssl_var" != xyes; then
@@ -169,7 +169,7 @@
echo " default library: $defaultlib"
echo "IBMCA provider: $enable_provider"
if test "x$useproviderfulllibica" = xyes; then
- echo " libica library: libica"
+ echo " libica library: libica-openssl1_1"
else
- echo " libica library: libica-cex"
+ echo " libica library: libica-openssl1_1-cex"
fi