.gitignore

@@ -1 +1 @@
-SOURCES/opencryptoki-3.21.0.tar.gz
+SOURCES/opencryptoki-3.22.0.tar.gz

.opencryptoki.metadata

@@ -1 +1 @@
-4a0f2ed8f965a948057ab833f1fafabf58929d3f SOURCES/opencryptoki-3.21.0.tar.gz
+4618b82afde56a8177e888c26d336c6f521bed8a SOURCES/opencryptoki-3.22.0.tar.gz

SOURCES/opencryptoki-3.21-sandboxing.patch

@@ -0,0 +1,27 @@
+diff -up opencryptoki-3.21.0/misc/pkcsslotd.service.in.me opencryptoki-3.21.0/misc/pkcsslotd.service.in
+--- opencryptoki-3.21.0/misc/pkcsslotd.service.in.me	2023-05-16 20:50:08.128841932 +0200
++++ opencryptoki-3.21.0/misc/pkcsslotd.service.in	2023-05-16 21:19:35.208570589 +0200
+@@ -22,17 +22,17 @@ PrivateUsers=no
+ PrivateNetwork=no
+ RestrictAddressFamilies=AF_UNIX AF_NETLINK
+ IPAddressDeny=any
+-ProtectClock=yes
++#ProtectClock=yes
+ ProtectKernelTunables=yes
+ ProtectKernelModules=yes
+-ProtectKernelLogs=yes
++#ProtectKernelLogs=yes
+ ProtectControlGroups=yes
+ ProtectHome=yes
+-ProtectHostname=yes
+-ProtectProc=default
++#ProtectHostname=yes
++#ProtectProc=default
+ ProtectSystem=strict
+-ReadWritePaths=@localstatedir@
+-ProcSubset=all
++ReadWritePaths=@localstatedir@ /run
++#ProcSubset=all
+ MemoryDenyWriteExecute=yes
+ RestrictRealtime=yes
+ RestrictNamespaces=yes

SOURCES/opencryptoki-3.21.0-2ba0f41ef5e14d4b509c8854e27cf98e3ee89445.patch

@@ -1,34 +0,0 @@
-commit 2ba0f41ef5e14d4b509c8854e27cf98e3ee89445
-Author: Ingo Franzki <ifranzki@linux.ibm.com>
-Date:   Mon Jul 10 13:22:48 2023 +0200
-
-    p11sak: Fix parsing of slot number 0
-    
-    Running command 'p11sak list-key aes --slot 0' may result in
-    'p11sak: Invalid argument '0' for option '-s/--slot''
-    
-    This is because of the error checking after strtoul() within function
-    process_number_argument(). In case errno is not zero, it treats a
-    parsed value of zero as an error.
-    
-    Under certain circumstances, errno is non-zero already before calling
-    strtoul(), and stays non-zero in case of strtoul() succeeds. This leads to
-    an incorrect error checking, and it is treated as error.
-    
-    Initialize errno to zero before calling strtoul() to avoid such false error
-    detection.
-    
-    Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
-
-diff --git a/usr/sbin/p11sak/p11sak.c b/usr/sbin/p11sak/p11sak.c
-index 6e11cb41..38665bbd 100644
---- a/usr/sbin/p11sak/p11sak.c
-+++ b/usr/sbin/p11sak/p11sak.c
-@@ -1712,6 +1712,7 @@ static CK_RV process_number_argument(const struct p11sak_arg *arg, char *val)
- {
-     char *endptr;
- 
-+    errno = 0;
-     *arg->value.number = strtoul(val, &endptr, 0);
- 
-     if ((errno == ERANGE && *arg->value.number == ULONG_MAX) ||

SOURCES/opencryptoki-3.21.0-4ff774568e334a719fc8de16fe2309e2070f0da8.patch

@@ -1,52 +0,0 @@
-commit 4ff774568e334a719fc8de16fe2309e2070f0da8
-Author: Ingo Franzki <ifranzki@linux.ibm.com>
-Date:   Mon May 22 11:40:01 2023 +0200
-
-    p11sak: Fix user confirmation prompt behavior when stdin is closed
-    
-    Treat any error during user confirmation prompt as 'cancel' and skip all
-    operations.
-    
-    One can for example close stdin during a user prompt via CTRL+D. This was
-    erroneously treated as positive confirmation and therefore caused the
-    operation to be performed on the current key object and all further objects
-    matching the filter as well, instead of canceling the operation entirely.
-    
-    Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
-
-diff --git a/usr/sbin/p11sak/p11sak.c b/usr/sbin/p11sak/p11sak.c
-index d75d8343..5b54b538 100644
---- a/usr/sbin/p11sak/p11sak.c
-+++ b/usr/sbin/p11sak/p11sak.c
-@@ -4736,6 +4736,7 @@ static CK_RV handle_key_remove(CK_OBJECT_HANDLE key, CK_OBJECT_CLASS class,
-             data->num_skipped++;
-             return CKR_OK;
-         case 'c':
-+        case '\0':
-             data->skip_all = true;
-             data->num_skipped++;
-             return CKR_OK;
-@@ -4825,6 +4826,7 @@ static CK_RV handle_key_set_attr(CK_OBJECT_HANDLE key, CK_OBJECT_CLASS class,
-             data->num_skipped++;
-             return CKR_OK;
-         case 'c':
-+        case '\0':
-             data->skip_all = true;
-             data->num_skipped++;
-             return CKR_OK;
-@@ -4974,6 +4976,7 @@ static CK_RV handle_key_copy(CK_OBJECT_HANDLE key, CK_OBJECT_CLASS class,
-             data->num_skipped++;
-             return CKR_OK;
-         case 'c':
-+        case '\0':
-             data->skip_all = true;
-             data->num_skipped++;
-             return CKR_OK;
-@@ -6983,6 +6986,7 @@ static CK_RV handle_key_export(CK_OBJECT_HANDLE key, CK_OBJECT_CLASS class,
-             data->num_skipped++;
-             return CKR_OK;
-         case 'c':
-+        case '\0':
-             data->skip_all = true;
-             data->num_skipped++;
-             return CKR_OK;

SOURCES/opencryptoki-3.21.0-92999f344a3ad99a67a1bcfd9ad28f28c33e51bc.patch

@@ -1,96 +0,0 @@
-commit 92999f344a3ad99a67a1bcfd9ad28f28c33e51bc
-Author: Ingo Franzki <ifranzki@linux.ibm.com>
-Date:   Mon Jul 10 10:19:13 2023 +0200
-
-    p11sak: Fix listing of key objects when other object types are present
-    
-    A command like 'p11sak list-key all --slot N ...' fails with
-    
-      p11sak: Attribute CKA_KEY_TYPE is not available in key object
-      p11sak: Failed to iterate over key objects for key type All: 0xD0: CKR_TEMPLATE_INCOMPLETE
-      p11sak: Failed to perform the 'list-key' command: CKR_TEMPLATE_INCOMPLETE
-    
-    when the object repository contains other, non-key objects, e.g. certificates.
-    
-    When 'all' is used as key type, then no filter for CKA_KEY_TYPE is used
-    with C_FindObjects(), and thus other non-key objects also match the filter.
-    When a specific key type is specified, then only such objects match that
-    have the desired CKA_KEY_TYPE attribute value.
-    
-    Fix this by checking the object class in get_key_infos() and skip the object,
-    if it is not a key object.
-    
-    Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
-
-diff --git a/usr/sbin/p11sak/p11sak.c b/usr/sbin/p11sak/p11sak.c
-index a6213720..6e11cb41 100644
---- a/usr/sbin/p11sak/p11sak.c
-+++ b/usr/sbin/p11sak/p11sak.c
-@@ -3403,6 +3403,16 @@ static CK_RV get_key_infos(CK_OBJECT_HANDLE key, CK_OBJECT_CLASS *class,
-         }
-     }
- 
-+    switch (class_val) {
-+    case CKO_PUBLIC_KEY:
-+    case CKO_PRIVATE_KEY:
-+    case CKO_SECRET_KEY:
-+        break;
-+    default:
-+        free(attrs[0].pValue);
-+        return CKR_KEY_NEEDED;
-+    }
-+
-     for (i = 0; i < num_attrs; i++) {
-         if (attrs[i].ulValueLen == CK_UNAVAILABLE_INFORMATION) {
-             warnx("Attribute %s is not available in key object",
-@@ -3614,6 +3624,10 @@ static CK_RV iterate_key_objects(const struct p11sak_keytype *keytype,
-             if (manual_filtering) {
-                 rc = get_key_infos(keys[i], NULL, NULL, NULL, &label,
-                                    NULL, NULL);
-+                if (rc == CKR_KEY_NEEDED) {
-+                    rc = CKR_OK;
-+                    goto next;
-+                }
-                 if (rc != CKR_OK)
-                     break;
- 
-@@ -3672,6 +3686,10 @@ done_find:
-     for (i = 0; i < num_matched_keys; i++) {
-         rc = get_key_infos(matched_keys[i], &class, &ktype, &keysize,
-                            &label, &typestr, &type);
-+        if (rc == CKR_KEY_NEEDED) {
-+            rc = CKR_OK;
-+            goto next2;
-+        }
-         if (rc != CKR_OK)
-             break;
- 
-@@ -3680,6 +3698,7 @@ done_find:
-         if (rc != CKR_OK)
-             break;
- 
-+next2:
-         if (label != NULL)
-             free(label);
-         label = NULL;
-@@ -4480,10 +4499,20 @@ static CK_RV p11sak_list_key_compare(CK_OBJECT_HANDLE key1,
-     *result = 0;
- 
-     rc = get_key_infos(key1, &class1, &ktype1, &keysize1, &label1, NULL, NULL);
-+    if (rc == CKR_KEY_NEEDED) {
-+        rc = CKR_OK;
-+        *result = 1; /* non-key objects are always greater than key objects */
-+        goto done;
-+    }
-     if (rc != CKR_OK)
-         goto done;
- 
-     rc = get_key_infos(key2, &class2, &ktype2, &keysize2, &label2, NULL, NULL);
-+    if (rc == CKR_KEY_NEEDED) {
-+        rc = CKR_OK;
-+        *result = -1; /* key objects are always smaller than non-key objects */
-+        goto done;
-+    }
-     if (rc != CKR_OK)
-         goto done;
- 

SOURCES/opencryptoki-3.21.0-f4166214552a92d8d66de8011ab11c9c2c6bb0a4.patch

@@ -1,84 +0,0 @@
-commit f4166214552a92d8d66de8011ab11c9c2c6bb0a4
-Author: Ingo Franzki <ifranzki@linux.ibm.com>
-Date:   Mon May 22 13:31:21 2023 +0200
-
-    pkcsstats: Fix handling of user name
-    
-    The struct passwd returned by getpwuid() is a pointer to a static area, that
-    may get overwritten by subsequent calls to getpwuid() or similar.
-    Actually, C_Initialize() itself is using getpwuid() internally, and thus will
-    interfere with the getpwuid() usage in pkcsstats.
-    
-    Make a copy of the returned user name before calling C_Initialize() in
-    init_ock() to ensure to work with the desired user name, and not with anything
-    left over from previous calls.
-    
-    Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
-
-diff --git a/usr/sbin/pkcsstats/pkcsstats.c b/usr/sbin/pkcsstats/pkcsstats.c
-index c2444cf5..a842a295 100644
---- a/usr/sbin/pkcsstats/pkcsstats.c
-+++ b/usr/sbin/pkcsstats/pkcsstats.c
-@@ -783,6 +783,7 @@ int main(int argc, char **argv)
-     int opt = 0;
-     struct passwd *pswd = NULL;
-     int user_id = -1;
-+    char *user_name = NULL;
-     bool summary = false, all_users = false, all_mechs = false;
-     bool reset = false, reset_all = false;
-     bool delete = false, delete_all = false;
-@@ -903,19 +904,27 @@ int main(int argc, char **argv)
-         }
-     }
- 
-+    user_name = strdup(pswd->pw_name);
-+    if (user_name == NULL) {
-+        warnx("Failed to get current user name");
-+        exit(EXIT_FAILURE);
-+    }
-+
-     if (delete) {
-         if (slot_id_specified) {
-             warnx("Options -s/--slot and -d/--delete can not be specified together");
-+            free(user_name);
-             exit(EXIT_FAILURE);
-         }
- 
--        rc = delete_shm(user_id, pswd->pw_name);
-+        rc = delete_shm(user_id, user_name);
-         goto done;
-     }
- 
-     if (delete_all) {
-         if (slot_id_specified) {
-             warnx("Options -s/--slot and -D/--delete-all can not be specified together");
-+            free(user_name);
-             exit(EXIT_FAILURE);
-         }
- 
-@@ -932,7 +941,7 @@ int main(int argc, char **argv)
-         goto done;
- 
-     if (reset) {
--        rc = reset_shm(user_id, pswd->pw_name, num_slots, slots,
-+        rc = reset_shm(user_id, user_name, num_slots, slots,
-                        slot_id_specified, slot_id);
-         goto done;
-     }
-@@ -968,7 +977,7 @@ int main(int argc, char **argv)
-         rc = display_summary(&dd);
-         goto done;
-     } else {
--        rc = display_stats(user_id, pswd->pw_name, &dd);
-+        rc = display_stats(user_id, user_name, &dd);
-         goto done;
-     }
- 
-@@ -984,5 +993,7 @@ done:
-         dlclose(dll);
-     }
- 
-+    free(user_name);
-+
-     return rc == 0 ? EXIT_SUCCESS : EXIT_FAILURE;
- }

SOURCES/opencryptoki-CVE-2024-0914-part1.patch

@@ -1,4 +1,4 @@
-commit 47c55113f81794408a0afda2e19e1a5aa40d2212
+commit f931d6e47bf2fb26aa9cf52e231d13edc1c837a1
 Author: Ingo Franzki <ifranzki@linux.ibm.com>
 Date:   Tue Dec 12 17:16:56 2023 +0100
 

SOURCES/opencryptoki-CVE-2024-0914-part2.patch

@@ -1,4 +1,4 @@
-commit 034d70ec4cfde81ea71cf8acbe9097fa15e49a02
+commit 5f1a4f8641306ee192b70c8a32c9ee8a0fe9be5f
 Author: Ingo Franzki <ifranzki@linux.ibm.com>
 Date:   Mon Jan 15 12:53:37 2024 +0100
 
@@ -51,7 +51,7 @@ index 2bb3dffe..21b6b702 100644
   * The OpenSSL code is licensed under the Apache License 2.0 (the "License"). 
   * You can obtain a copy in the file LICENSE in the OpenSSL source distribution
 diff --git a/usr/lib/common/h_extern.h b/usr/lib/common/h_extern.h
-index a14542fa..a6ee4c33 100644
+index a88b57d0..29496d99 100644
 --- a/usr/lib/common/h_extern.h
 +++ b/usr/lib/common/h_extern.h
 @@ -731,7 +731,8 @@ CK_RV rsa_format_block(STDLL_TokData_t *tokdata,

SOURCES/opencryptoki-CVE-2024-0914-part3.patch

@@ -1,4 +1,4 @@
-commit 2fb51b9e4d390f889c109e1765c3284b5d6f5fb8
+commit e2b496f58a84c2f537667655fe08a0d4923f0c70
 Author: Ingo Franzki <ifranzki@linux.ibm.com>
 Date:   Fri Jan 12 09:36:27 2024 +0100
 
@@ -119,10 +119,10 @@ index 8a1e8723..bbb0f601 100644
              decr_mgr_cleanup(tokdata, sess, &sess->decr_ctx);
      }
 diff --git a/usr/lib/ep11_stdll/ep11_specific.c b/usr/lib/ep11_stdll/ep11_specific.c
-index df1f68f9..42793955 100644
+index 073b349f..6d08b95e 100644
 --- a/usr/lib/ep11_stdll/ep11_specific.c
 +++ b/usr/lib/ep11_stdll/ep11_specific.c
-@@ -10777,10 +10777,12 @@ CK_RV ep11tok_decrypt_final(STDLL_TokData_t * tokdata, SESSION * session,
+@@ -9552,10 +9552,12 @@ CK_RV ep11tok_decrypt_final(STDLL_TokData_t * tokdata, SESSION * session,
      rc = constant_time_select(constant_time_eq(rc, CKR_OK),
                                ep11_error_to_pkcs11_error(rc, session),
                                rc);
@@ -139,7 +139,7 @@ index df1f68f9..42793955 100644
      }
  
  done:
-@@ -10836,10 +10838,12 @@ CK_RV ep11tok_decrypt(STDLL_TokData_t * tokdata, SESSION * session,
+@@ -9611,10 +9613,12 @@ CK_RV ep11tok_decrypt(STDLL_TokData_t * tokdata, SESSION * session,
      rc = constant_time_select(constant_time_eq(rc, CKR_OK),
                                ep11_error_to_pkcs11_error(rc, session),
                                rc);
@@ -156,7 +156,7 @@ index df1f68f9..42793955 100644
      }
  
  done:
-@@ -10901,10 +10905,12 @@ CK_RV ep11tok_decrypt_update(STDLL_TokData_t * tokdata, SESSION * session,
+@@ -9676,10 +9680,12 @@ CK_RV ep11tok_decrypt_update(STDLL_TokData_t * tokdata, SESSION * session,
      rc = constant_time_select(constant_time_eq(rc, CKR_OK),
                                ep11_error_to_pkcs11_error(rc, session),
                                rc);
@@ -174,10 +174,10 @@ index df1f68f9..42793955 100644
  
  done:
 diff --git a/usr/lib/ep11_stdll/new_host.c b/usr/lib/ep11_stdll/new_host.c
-index ce18f729..f7ee0546 100644
+index 55e34c18..299a1d3c 100644
 --- a/usr/lib/ep11_stdll/new_host.c
 +++ b/usr/lib/ep11_stdll/new_host.c
-@@ -37,6 +37,7 @@
+@@ -38,6 +38,7 @@
  #include "slotmgr.h"
  #include "attributes.h"
  #include "ep11_specific.h"
@@ -185,7 +185,7 @@ index ce18f729..f7ee0546 100644
  
  #include "../api/apiproto.h"
  #include "../api/policy.h"
-@@ -2465,6 +2466,7 @@ CK_RV SC_Decrypt(STDLL_TokData_t *tokdata, ST_SESSION_HANDLE *sSession,
+@@ -2466,6 +2467,7 @@ CK_RV SC_Decrypt(STDLL_TokData_t *tokdata, ST_SESSION_HANDLE *sSession,
      SESSION *sess = NULL;
      CK_BBOOL length_only = FALSE;
      CK_RV rc = CKR_OK;
@@ -193,7 +193,7 @@ index ce18f729..f7ee0546 100644
  
      if (tokdata->initialized == FALSE) {
          TRACE_ERROR("%s\n", ock_err(ERR_CRYPTOKI_NOT_INITIALIZED));
-@@ -2512,17 +2514,29 @@ CK_RV SC_Decrypt(STDLL_TokData_t *tokdata, ST_SESSION_HANDLE *sSession,
+@@ -2513,17 +2515,29 @@ CK_RV SC_Decrypt(STDLL_TokData_t *tokdata, ST_SESSION_HANDLE *sSession,
                                      length_only, sess->decr_ctx.key,
                                      pEncryptedData, ulEncryptedDataLen,
                                      pData, pulDataLen);
@@ -226,7 +226,7 @@ index ce18f729..f7ee0546 100644
          if (sess)
              decr_mgr_cleanup(tokdata, sess, &sess->decr_ctx);
      }
-@@ -2544,6 +2558,7 @@ CK_RV SC_DecryptUpdate(STDLL_TokData_t *tokdata, ST_SESSION_HANDLE *sSession,
+@@ -2545,6 +2559,7 @@ CK_RV SC_DecryptUpdate(STDLL_TokData_t *tokdata, ST_SESSION_HANDLE *sSession,
  {
      SESSION *sess = NULL;
      CK_RV rc = CKR_OK;
@@ -234,7 +234,7 @@ index ce18f729..f7ee0546 100644
  
      if (tokdata->initialized == FALSE) {
          TRACE_ERROR("%s\n", ock_err(ERR_CRYPTOKI_NOT_INITIALIZED));
-@@ -2595,11 +2610,18 @@ CK_RV SC_DecryptUpdate(STDLL_TokData_t *tokdata, ST_SESSION_HANDLE *sSession,
+@@ -2596,11 +2611,18 @@ CK_RV SC_DecryptUpdate(STDLL_TokData_t *tokdata, ST_SESSION_HANDLE *sSession,
  
      rc = ep11tok_decrypt_update(tokdata, sess, pEncryptedPart,
                                  ulEncryptedPartLen, pPart, pulPartLen);
@@ -255,7 +255,7 @@ index ce18f729..f7ee0546 100644
          if (sess)
              decr_mgr_cleanup(tokdata, sess, &sess->decr_ctx);
      }
-@@ -2621,6 +2643,7 @@ CK_RV SC_DecryptFinal(STDLL_TokData_t *tokdata, ST_SESSION_HANDLE *sSession,
+@@ -2622,6 +2644,7 @@ CK_RV SC_DecryptFinal(STDLL_TokData_t *tokdata, ST_SESSION_HANDLE *sSession,
      SESSION *sess = NULL;
      CK_BBOOL length_only = FALSE;
      CK_RV rc = CKR_OK;
@@ -263,7 +263,7 @@ index ce18f729..f7ee0546 100644
  
      if (tokdata->initialized == FALSE) {
          TRACE_ERROR("%s\n", ock_err(ERR_CRYPTOKI_NOT_INITIALIZED));
-@@ -2669,10 +2692,18 @@ CK_RV SC_DecryptFinal(STDLL_TokData_t *tokdata, ST_SESSION_HANDLE *sSession,
+@@ -2670,10 +2693,18 @@ CK_RV SC_DecryptFinal(STDLL_TokData_t *tokdata, ST_SESSION_HANDLE *sSession,
      }
  
      rc = ep11tok_decrypt_final(tokdata, sess, pLastPart, pulLastPartLen);
@@ -285,7 +285,7 @@ index ce18f729..f7ee0546 100644
              decr_mgr_cleanup(tokdata, sess, &sess->decr_ctx);
      }
 diff --git a/usr/lib/icsf_stdll/new_host.c b/usr/lib/icsf_stdll/new_host.c
-index 115fd40b..192fe128 100644
+index 6c419750..d8064559 100644
 --- a/usr/lib/icsf_stdll/new_host.c
 +++ b/usr/lib/icsf_stdll/new_host.c
 @@ -35,6 +35,8 @@

SOURCES/opencryptoki-CVE-2024-0914-part4.patch

@@ -1,4 +1,4 @@
-commit bc06acfb6c5e7a0fb4a384084b04404414360eaa
+commit 7d064610937cdfb3cf8976adbb7eec6be3ea9d9f
 Author: Ingo Franzki <ifranzki@linux.ibm.com>
 Date:   Tue Jan 16 10:01:20 2024 +0100
 
@@ -829,7 +829,7 @@ index 7ed70262..6281d982 100644
 +     },
 +};
 diff --git a/testcases/crypto/rsa_func.c b/testcases/crypto/rsa_func.c
-index d9f4ebaf..cb7bf491 100644
+index 2c9984d0..c092110e 100644
 --- a/testcases/crypto/rsa_func.c
 +++ b/testcases/crypto/rsa_func.c
 @@ -1963,6 +1963,164 @@ testcase_cleanup:

SOURCES/opencryptoki-CVE-2024-0914-part5.patch

@@ -1,4 +1,4 @@
-commit c859ed40828bf808e83a3f437c2e34c9c843a4c3
+commit d756ba1ec270a289950e66398c7e8be59c4a594d
 Author: Ingo Franzki <ifranzki@linux.ibm.com>
 Date:   Fri Feb 9 14:07:34 2024 +0100
 

SPECS/opencryptoki.spec

@@ -1,40 +1,33 @@
 Name: opencryptoki
 Summary: Implementation of the PKCS#11 (Cryptoki) specification v3.0
-Version:		3.21.0
-Release:		9%{?dist}
+Version: 3.22.0
+Release: 3%{?dist}
 License: CPL
+Group: System Environment/Base
 URL: https://github.com/opencryptoki/opencryptoki
 Source0: https://github.com/opencryptoki/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz
 # bz#1373833, change tmpfiles snippets from /var/lock/* to /run/lock/*
 Patch1: opencryptoki-3.11.0-lockdir.patch
-# add missing p11sak_defined_attrs.conf, strength.conf
+# add missing p11sak_defined_attrs.conf
 Patch2: opencryptoki-3.21.0-p11sak.patch
+# comment some unsupported sandbox options and add /run to ReadWritePaths to exclude
+# /run directory from being made read-only on rhel8
+Patch3: opencryptoki-3.21-sandboxing.patch
 
 # upstream patches
 # CVE-2024-0914 opencryptoki: timing side-channel in handling of RSA PKCS#1 v1.5 padded ciphertexts
-Patch20: opencryptoki-v3.21.0-CVE-2024-0914-part01.patch
-Patch21: opencryptoki-v3.21.0-CVE-2024-0914-part02.patch
-Patch22: opencryptoki-v3.21.0-CVE-2024-0914-part03.patch
-Patch23: opencryptoki-v3.21.0-CVE-2024-0914-part04.patch
-Patch24: opencryptoki-v3.21.0-CVE-2024-0914-part05.patch
-
-# pkcsstats: Fix handling of user name
-Patch100: opencryptoki-3.21.0-f4166214552a92d8d66de8011ab11c9c2c6bb0a4.patch
-# p11sak: Fix user confirmation prompt behavior when stdin is closed
-Patch101: opencryptoki-3.21.0-4ff774568e334a719fc8de16fe2309e2070f0da8.patch
-# p11sak fails as soon as there reside non-key objects
-Patch102: opencryptoki-3.21.0-92999f344a3ad99a67a1bcfd9ad28f28c33e51bc.patch
-# opencryptoki p11sak tool: slot option does not accept argument 0 for slot index 0
-Patch103: opencryptoki-3.21.0-2ba0f41ef5e14d4b509c8854e27cf98e3ee89445.patch
+Patch20: opencryptoki-CVE-2024-0914-part1.patch
+Patch21: opencryptoki-CVE-2024-0914-part2.patch
+Patch22: opencryptoki-CVE-2024-0914-part3.patch
+Patch23: opencryptoki-CVE-2024-0914-part4.patch
+Patch24: opencryptoki-CVE-2024-0914-part5.patch
 
 Requires(pre): coreutils diffutils
-Requires: 		(selinux-policy >= 38.1.14-1 if selinux-policy-targeted)
+Requires: (selinux-policy >= 3.14.3-121 if selinux-policy-targeted)
 BuildRequires: gcc
 BuildRequires: gcc-c++
 BuildRequires: openssl-devel >= 1.1.1
-%if 0%{?tmptok}
 BuildRequires: trousers-devel
-%endif
 BuildRequires: openldap-devel
 BuildRequires: autoconf automake libtool
 BuildRequires: bison flex
@@ -63,6 +56,7 @@ This package contains the Slot Daemon (pkcsslotd) and general utilities.
 
 
 %package libs
+Group:			System Environment/Libraries
 Summary:		The run-time libraries for opencryptoki package
 Requires(pre):	shadow-utils
 
@@ -78,6 +72,7 @@ functional.
 
 
 %package devel
+Group:			Development/Libraries
 Summary:		Development files for openCryptoki
 Requires:		%{name}-libs%{?_isa} = %{version}-%{release}
 
@@ -87,6 +82,7 @@ opencryptoki and PKCS#11 based applications
 
 
 %package swtok
+Group:			System Environment/Libraries
 Summary:		The software token implementation for opencryptoki
 Requires(pre):		%{name}-libs%{?_isa} = %{version}-%{release}
 Requires:		%{name}-libs%{?_isa} = %{version}-%{release}
@@ -103,6 +99,7 @@ without any specific cryptographic hardware.
 
 
 %package tpmtok
+Group:			System Environment/Libraries
 Summary:		Trusted Platform Module (TPM) device support for opencryptoki
 Requires(pre):		%{name}-libs%{?_isa} = %{version}-%{release}
 Requires:		%{name}-libs%{?_isa} = %{version}-%{release}
@@ -119,6 +116,7 @@ Trusted Platform Module (TPM) devices in the opencryptoki stack.
 
 
 %package icsftok
+Group:			System Environment/Libraries
 Summary:		ICSF token support for opencryptoki
 Requires(pre):		%{name}-libs%{?_isa} = %{version}-%{release}
 Requires:		%{name}-libs%{?_isa} = %{version}-%{release}
@@ -136,6 +134,7 @@ ICSF token in the opencryptoki stack.
 
 %ifarch s390 s390x
 %package icatok
+Group:			System Environment/Libraries
 Summary:		ICA cryptographic devices (clear-key) support for opencryptoki
 Requires(pre):		%{name}-libs%{?_isa} = %{version}-%{release}
 Requires:		%{name}-libs%{?_isa} = %{version}-%{release}
@@ -153,6 +152,7 @@ cryptographic hardware such as IBM 4764 or 4765 that uses the
 "accelerator" or "clear-key" path.
 
 %package ccatok
+Group:			System Environment/Libraries
 Summary:		CCA cryptographic devices (secure-key) support for opencryptoki
 Requires(pre):		%{name}-libs%{?_isa} = %{version}-%{release}
 Requires:		%{name}-libs%{?_isa} = %{version}-%{release}
@@ -170,6 +170,7 @@ cryptographic hardware such as IBM 4764 or 4765 that uses the
 "co-processor" or "secure-key" path.
 
 %package ep11tok
+Group:			System Environment/Libraries
 Summary:		CCA cryptographic devices (secure-key) support for opencryptoki
 Requires(pre):		%{name}-libs%{?_isa} = %{version}-%{release}
 Requires:		%{name}-libs%{?_isa} = %{version}-%{release}
@@ -195,24 +196,44 @@ configured with Enterprise PKCS#11 (EP11) firmware.
 %build
 ./bootstrap.sh
 
-%configure --with-systemd=%{_unitdir} --enable-testcases	\
+%configure --with-systemd=%{_unitdir}  \
     --with-pkcsslotd-user=pkcsslotd --with-pkcs-group=pkcs11 \
-%if 0%{?tpmtok}
-    --enable-tpmtok \
-%else
-    --disable-tpmtok \
-%endif
 %ifarch s390 s390x
     --enable-icatok --enable-ccatok --enable-ep11tok --enable-pkcsep11_migrate
 %else
-    --disable-icatok --disable-ccatok --disable-ep11tok --disable-pkcsep11_migrate
+    --disable-icatok --disable-ccatok --disable-ep11tok --disable-pkcsep11_migrate --disable-pkcscca_migrate
 %endif
 
-%make_build CHGRP=/bin/true
+make %{?_smp_mflags} CHGRP=/bin/true
 
 
 %install
-%make_install CHGRP=/bin/true
+make install DESTDIR=$RPM_BUILD_ROOT CHGRP=/bin/true
+
+# Remove unwanted cruft
+rm -f $RPM_BUILD_ROOT/%{_libdir}/%{name}/*.la
+rm -f $RPM_BUILD_ROOT/%{_libdir}/%{name}/stdll/*.la
+
+
+%post libs -p /sbin/ldconfig
+%post swtok -p /sbin/ldconfig
+%post tpmtok -p /sbin/ldconfig
+%post icsftok -p /sbin/ldconfig
+%ifarch s390 s390x
+%post icatok -p /sbin/ldconfig
+%post ccatok -p /sbin/ldconfig
+%post ep11tok -p /sbin/ldconfig
+%endif
+
+%postun libs -p /sbin/ldconfig
+%postun swtok -p /sbin/ldconfig
+%postun tpmtok -p /sbin/ldconfig
+%postun icsftok -p /sbin/ldconfig
+%ifarch s390 s390x
+%postun icatok -p /sbin/ldconfig
+%postun ccatok -p /sbin/ldconfig
+%postun ep11tok -p /sbin/ldconfig
+%endif
 
 %pre
 # don't touch opencryptoki.conf even if it is unchanged due to new tokversion
@@ -239,7 +260,7 @@ fi
 
 %systemd_post pkcsslotd.service
 if test $1 -eq 1; then
-	%tmpfiles_create %{name}.conf
+    %tmpfiles_create
 fi
 
 %preun
@@ -248,6 +269,8 @@ fi
 %postun
 %systemd_postun_with_restart pkcsslotd.service
 
+%triggerun -- opencryptoki < 3.21.0-1
+/usr/bin/systemctl daemon-reload
 
 %files
 %doc ChangeLog FAQ README.md
@@ -311,13 +334,11 @@ fi
 %dir %attr(770,root,pkcs11) %{_sharedstatedir}/%{name}/swtok/
 %dir %attr(770,root,pkcs11) %{_sharedstatedir}/%{name}/swtok/TOK_OBJ/
 
-%if 0%{?tmptok}
 %files tpmtok
 %doc doc/README.tpm_stdll
 %{_libdir}/opencryptoki/stdll/libpkcs11_tpm.*
 %{_libdir}/opencryptoki/stdll/PKCS11_TPM.so
 %dir %attr(770,root,pkcs11) %{_sharedstatedir}/%{name}/tpm/
-%endif
 
 %files icsftok
 %doc doc/README.icsf_stdll
@@ -360,199 +381,196 @@ fi
 
 
 %changelog
-* Wed Feb 07 2024 Than Ngo <than@redhat.com> - 3.21.0-9
-- timing side-channel in handling of RSA PKCS#1 v1.5 padded ciphertexts (Marvin)
-Resolves: RHEL-23490
-
-* Fri Jul 14 2023 Than Ngo <than@redhat.com> - 3.21.0-8
-- Resolves: #2222592, p11sak tool: slot option does not accept argument 0 for slot index 0
-- Resolves: #2222596, p11sak fails as soon as there reside non-key objects
-
-* Tue Jun 13 2023 Than Ngo <than@redhat.com> - 3.21.0-5
-- add requirement on selinux-policy >= 38.1.14-1 for pkcsslotd policy sandboxing
-Related: #2160061
-
-* Fri May 26 2023 Than Ngo <than@redhat.com> - 3.21.0-4
-- add verify attributes for opencryptoki.conf to ignore the verification
+* Fri Feb 16 2024 Than Ngo <than@redhat.com> - 3.22.0-3
+- Fix implicit rejection with RSA keys with empty CKA_PRIVATE_EXPONENT
+Related: RHEL-22791
 
-Related: #2160061
-
-* Mon May 22 2023 Than Ngo <than@redhat.com> - 3.21.0-3
-- Resolves: #2110497, concurrent MK rotation for cca token
-- Resolves: #2110498, concurrent MK rotation for ep11 token
-- Resolves: #2110499, ep11 token: PKCS #11 3.0 - support AES_XTS
-- Resolves: #2111010, cca token: protected key support 
-- Resolves: #2160061, rebase to 3.21.0
-- Resolves: #2160105, pkcsslotd hardening
-- Resolves: #2160107, p11sak support Dilithium and Kyber keys
-- Resolves: #2160109, ica and soft tokens: PKCS #11 3.0 - support AES_XTS
-
-* Mon Jan 30 2023 Than Ngo <than@redhat.com> - 3.19.0-2
-- Resolves: #2044182, Support of ep11 token for new IBM Z Hardware (IBM z16) 
-
-* Tue Oct 11 2022 Than Ngo <than@redhat.com> - 3.19.0-1
-- Resolves: #2126294, opencryptoki fails after generating > 500 RSA keys
-- Resolves: #2110314, rebase to 3.19.0
-- Resolves: #2110989, openCryptoki key generation with expected MKVP only on CCA and EP11 tokens
-- Resolves: #2110476, openCryptoki ep11 token: master key consistency
-- Resolves: #2018458, openCryptoki ep11 token: vendor specific key derivation
+* Thu Feb 08 2024 Than Ngo <than@redhat.com> - 3.22.0-2
+- timing side-channel in handling of RSA PKCS#1 v1.5 padded ciphertexts (Marvin)
+Resolves: RHEL-22791
 
-* Fri Jul 29 2022 Than Ngo <than@redhat.com> - 3.18.0-4
-- Related: #2044179, do not touch opencryptoki.conf if it is in place already and even if it is unchanged
+* Thu Nov 23 2023 Than Ngo <than@redhat.com> - 3.22.0-1
+- Resolves: RHEL-11413, update to 3.22.0
 
-* Tue Jun 07 2022 Than Ngo <than@redhat.com> - 3.18.0-3
-- Related: #2044179, fix json output
+* Tue Jul 18 2023 Than Ngo <than@redhat.com> - 3.21.0-9
+- Resolves: #2223588, FTBFS
 
-* Mon May 09 2022 Than Ngo <than@redhat.com> - 3.18.0-2
-- Related: #2044179, add missing strength.conf
+* Tue Jul 18 2023 Than Ngo <than@redhat.com> - 3.21.0-8
+- Related: #2222595, add triggerun to reload daemon
 
-* Mon May 09 2022 Than Ngo <than@redhat.com> - 3.18.0-1
-- Resolves: #2044179, rebase to 3.18.0
-- Resolves: #2068091, pkcsconf -t failed with Segmentation fault in FIPS mode
-- Resolves: #2066763, Dilithium support not available
-- Resolves: #2064697, OpenSSL 3.0 Compatibility for IBM Security Libraries and Tools
-- Resolves: #2044181, support crypto profiles
-- Resolves: #2044180, add crypto counters
+* Fri Jul 14 2023 Than Ngo <than@redhat.com> - 3.21.0-7
+- Resolves: #2222595, p11sak tool: slot option does not accept argument 0 for slot index 0
+- Resolves: #2222594, p11sak fails as soon as there reside non-key objects
 
-* Tue May 03 2022 Than Ngo <than@redhat.com> - 3.17.0-6
-- Resolves: #2066763, Dilithium support not available
+* Tue Jul 04 2023 Than Ngo <than@redhat.com> - 3.21.0-6
+- add workaround for segfault in PEM_write_bio() on OpenSSL 1.1.1
+Related: #2159741
 
-* Mon Mar 14 2022 Than Ngo <than@redhat.com> - 3.17.0-5
-- Resolves: #2064697, ICA/EP11: Support libica version 4
+* Tue Jun 13 2023 Than Ngo <than@redhat.com> - 3.21.0-5
+- add requirement on selinux-policy >= 3.14.3-121 for pkcsslotd policy sandboxing
+Related: #2159697
 
-* Mon Jan 17 2022 Than Ngo <than@redhat.com> - 3.17.0-4
-- Resolves: #2040678, API: Unlock GlobMutex if user and group check fails
+* Thu May 25 2023 Than Ngo <than@redhat.com> - 3.21.0-4
+- add verify attributes for opencryptoki.conf to ignore the verification
+Related: #2159697
 
-* Sat Dec 04 2021 Than Ngo <than@redhat.com> - 3.17.0-3
-- Related: #2015888, added missing patch pkcsslotd-pidfile
+* Mon May 22 2023 Than Ngo <than@redhat.com> - 3.21.0-3
+- pkcsstats: Fix handling of user name
+- p11sak: Fix user confirmation prompt behavior when stdin is closed
+Related: #2159697
+
+* Tue May 16 2023 Than Ngo <than@redhat.com> - 3.21.0-2
+- add missing /var/lib/opencryptoki/HSM_MK_CHANGE
+- disable unsupported sandbox options and add /run to ReadWritePaths to exclude
+  /run directory from being made read-only on rhel8
+Related: #2159697
+
+* Mon May 15 2023 Than Ngo <than@redhat.com> - 3.21.0-1
+- Resolves: #1984865, ep11 and cca: support concurrent HSM master key changes
+- Resolves: #2110500, ep11 token: PKCS #11 3.0 - support AES_XTS 
+- Resolves: #2111011, cca token: protected key support
+- Resolves: #2159697, update to 3.21.0
+- Resolves: #2159740, pkcsslotd hardening
+- Resolves: #2159741, p11sak support Dilithium and Kyber keys
+- Resolves: #2159742, ica and soft tokens: PKCS #11 3.0 - support AES_XTS
 
-* Wed Nov 24 2021 Than Ngo <than@redhat.com> - 3.17.0-2
-- Related: #2015888, add missing p11sak_defined_attrs.conf
+* Mon Jan 30 2023 Than Ngo <than@redhat.com> - 3.19.0-2
+- Resolves: #2043856, Support of ep11 token for new IBM Z Hardware (IBM z16)
 
-* Wed Nov 03 2021 Than Ngo <than@redhat.com> - 3.17.0-1
-- Resolves: #2015888, rebase to 3.17.0
-- Resolves: #2017720, openCryptoki key management tool 
+* Tue Nov 01 2022 Than Ngo <than@redhat.com> - 3.19.0-1
+- Resolves: #2126612, opencryptoki fails after generating > 500 RSA keys
+- Resolves: #2110315, rebase to 3.19.0
+- Resolves: #2110990, openCryptoki key generation with expected MKVP only on CCA and EP11 tokens
+- Resolves: #2110477, openCryptoki ep11 token: master key consistency
+- Resolves: #1984871, openCryptoki ep11 token: vendor specific key derivation
 
-* Thu Aug 26 2021 Than Ngo <than@redhat.com> - 3.16.0-12
-- Related: #1989138, Support for OpenSSL 3.0
+* Mon Aug 01 2022 Than Ngo <than@redhat.com> - 3.18.0-3
+- Related: #2043854, do not touch opencryptoki.conf if it is in place already and even if it is unchanged
+- Resolves: #2112785, EP11: Fix C_GetMechanismList returning CKR_BUFFER_TOO_SMALL
 
-* Mon Aug 23 2021 Than Ngo <than@redhat.com> - 3.16.0-11
-- Resolves: #1989138, Support for OpenSSL 3.0
+* Tue Jun 07 2022 Than Ngo <than@redhat.com> - 3.18.0-2
+- Related: #2043854, fix json output
 
-* Thu Aug 19 2021 Than Ngo <than@redhat.com> - 3.16.0-10
-- Resolves: #1987186, pkcstok_migrate leaves options with multiple strings in opencryptoki.conf options without double-quotes
+* Tue May 24 2022 Than Ngo <than@redhat.com> - 3.18.0-1
+- Resolves: #2043845, rebase to 3.18.0
+- Resolves: #2043854, add crypto counters
+- Resolves: #2043855, support crypto profiles
 
-* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 3.16.0-9
-- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
-  Related: rhbz#1991688
+* Fri Apr 15 2022 Than Ngo <than@redhat.com> - 3.17.0-4
+- Resolves: #2066762, Dilithium support not available 
 
-* Wed Jul 28 2021 Florian Weimer <fweimer@redhat.com> - 3.16.0-8
-- Rebuild to pick up OpenSSL 3.0 Beta ABI (#1984097)
+* Mon Jan 17 2022 Than Ngo <than@redhat.com> - 3.17.0-3
+- Resolves: #2040677, API: Unlock GlobMutex if user and group check fails
 
-* Fri Jul 16 2021 Than Ngo <than@redhat.com> - 3.16.0-7
-- Resolves: #1974365, Fix detection if pkcsslotd is still running
+* Tue Nov 09 2021 Than Ngo <than@redhat.com> - 3.17.0-2
+- Related: #1984993, add missing p11sak_defined_attrs.conf 
 
-* Fri Jun 25 2021 Than Ngo <than@redhat.com> - 3.16.0-6
-- Resolves: #1974693, pkcsslotd PIDfile below legacy directory /var/run/
+* Tue Oct 19 2021 Than Ngo <than@redhat.com> - 3.17.0-1
+- Resolves: #1984993, rebase to 3.17.0
+- Resolves: #1984870, openCryptoki key management tool
 
-* Wed Jun 16 2021 Mohan Boddu <mboddu@redhat.com> - 3.16.0-5
-- Rebuilt for RHEL 9 BETA for openssl 3.0
-  Related: rhbz#1971065
+* Mon Sep 13 2021 Than Ngo <than@redhat.com> - 3.16.0-6
+- Fix: Could not open /run/lock/opencryptoki/LCK..APIlock
 
-* Tue Jun 15 2021 Than Ngo <than@redhat.com> - 3.16.0-4
-- Related: #1924120, add conditional requirement on new selinux-policy
+* Thu Aug 19 2021 Than Ngo <than@redhat.com> - 3.16.0-5
+- Resolves: #1987256, pkcstok_migrate leaves options with multiple strings in opencryptoki.conf options without double-quotes
 
-* Mon May 17 2021 Than Ngo <than@redhat.com> - 3.16.0-3
-- Resolves: #1959894, Soft token does not check if an EC key is valid
-- Resolves: #1924120, Event Notification Support
+* Fri Jul 16 2021 Than Ngo <than@redhat.com> - 3.16.0-4
+- Resolves: #1964304, Fix detection if pkcsslotd is still running
 
-* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 3.16.0-2
-- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
+* Tue Jun 15 2021 Than Ngo <than@redhat.com> - 3.16.0-3
+- Related: #1919223, add conditional requirement
 
-* Wed Mar 31 2021 Dan Horák <dan[at]danny.cz> - 3.16.0-1
-- Rebase to 3.16.0
+* Fri Jun 11 2021 Than Ngo <than@redhat.com> - 3.16.0-2
+- Related: #1919223, add requirement on selinux-policy >= 3.14.3-70 for using ipsec
 
-* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.15.1-6
-- Rebuilt for updated systemd-rpm-macros
-  See https://pagure.io/fesco/issue/2583.
+* Tue Jun 01 2021 Than Ngo <than@redhat.com> - 3.16.0-1
+- Resolves: #1919223, rebase to 3.16.0
+- Resolves: #1922195, Event Notification Support
+- Resolves: #1959936, Soft token does not check if an EC key is valid
+- Resolves: #1851104, import and export of secure key objects
+- Resolves: #1851106, openCryptoki ep11 token: protected key support
+- Resolves: #1851107, openCryptoki ep11 token: support attribute bound keys
 
 * Fri Feb 12 2021 Than Ngo <than@redhat.com> - 3.15.1-5
-- Added upstream patch, a slot ID has nothing to do with the number of slots
+- Resolves: #1928120, Fix problem with C_Get/SetOperationState and digest contexts
 
-* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 3.15.1-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+* Fri Feb 12 2021 Than Ngo <than@redhat.com> - 3.15.1-4
+- Resolves: #1927745, pkcscca migration fails with usr/sb2 is not a valid slot ID
 
-* Tue Dec 22 2020 Than Ngo <than@redhat.com> - 3.15.1-3
-- Drop tpm1.2 support by default
+* Thu Nov 26 2020 Than Ngo <than@redhat.com> - 3.15.1-3
+- Resolves: #1902022
+   Fix compiling with c++
+   Added error message handling for p11sak remove-key command
 
-* Tue Dec 22 2020 Than Ngo <than@redhat.com> - 3.15.1-2
-- Fix compiling with c++
-- Added error message handling for p11sak remove-key command
-- Add BR on make
+* Thu Nov 26 2020 Than Ngo <than@redhat.com> - 3.15.1-2
+- Related: #1847433, Added error message handling for p11sak remove-key command
 
 * Mon Nov 02 2020 Than Ngo <than@redhat.com> - 3.15.1-1
-- Rebase to 3.15.1
-
-* Mon Oct 19 2020 Dan Horák <dan[at]danny.cz> - 3.15.0-1
-- Rebase to 3.15.0
-
-* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.14.0-6
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Tue Jul 14 2020 Tom Stellard <tstellar@redhat.com> - 3.14.0-5
-- Use make macros
-- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
-
-* Wed Jul 08 2020 Than Ngo <than@redhat.com> - 3.14.0-4
-- added PIN conversion tool
-
-* Wed Jul 01 2020 Than Ngo <than@redhat.com> - 3.14.0-3
-- upstream fix - handle early error cases in C_Initialize
-
-* Wed May 27 2020 Than Ngo <than@redhat.com> - 3.14.0-2
-- fix regression, segfault in C_SetPin
-
-* Fri May 15 2020 Dan Horák <dan[at]danny.cz> - 3.14.0-1
-- Rebase to 3.14.0
-
-* Fri Mar 06 2020 Dan Horák <dan[at]danny.cz> - 3.13.0-1
-- Rebase to 3.13.0
-
-* Mon Feb 03 2020 Dan Horák <dan[at]danny.cz> - 3.12.1-3
-- fix build with gcc 10
-
-* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.12.1-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
-
-* Wed Nov 27 2019 Dan Horák <dan[at]danny.cz> - 3.12.1-1
-- Rebase to 3.12.1
-
-* Wed Nov 13 2019 Dan Horák <dan[at]danny.cz> - 3.12.0-1
-- Rebase to 3.12.0
-
-* Sun Sep 22 2019 Dan Horák <dan[at]danny.cz> - 3.11.1-1
-- Rebase to 3.11.1
-
-* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 3.11.0-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
-
-* Thu Mar 28 2019 Than Ngo <than@redhat.com> - 3.11.0-4
-- enable testcase by default
-- fix URL
-
-* Tue Feb 19 2019 Than Ngo <than@redhat.com> - 3.11.0-3
-- Resolved #1063763 - opencryptoki tools should inform the user that he is not in pkcs11 group
-
-* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 3.11.0-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
-
-* Thu Jan 31 2019 Than Ngo <than@redhat.com> - 3.11.0-1
-- Updated to 3.11.0
-- Resolved #1341079 - Failed to create directory or subvolume "/var/lock/opencryptoki"
-- Ported root's group membership's patch for 3.11.0
-
-* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 3.10.0-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+- Related: #1847433
+  upstream fixes:
+    - Free generated key in all error cases
+    - CCA: Zeroize key buffer to avoid CCA 8/32 error
+    - Do not delete the map-btree entry if destroying an object is not allowed
+    - Remove now unused header timeb.h
+    - TESTCASES: Use FIPS conforming keys for 3DES CBC-MAC test vectors
+    - Fix buffer overrun in C_CopyObject
+    - TPM: Fix double free in openssl_gen_key
+
+* Mon Oct 19 2020 Than Ngo <than@redhat.com> - 3.15.0-1
+- Resolves: #1847433, rebase to 3.15.0 
+- Resolves: #1851105, PKCS #11 3.0 - baseline provider support
+- Resolves: #1851108, openCryptoki ep11 token: enhanced functionality
+- Resolves: #1851109, openCryptoki key management tool: key deletion function
+
+* Mon Jul 06 2020 Than Ngo <than@redhat.com> - 3.14.0-5
+- Related: #1853420, more fixes
+
+* Fri Jul 03 2020 Than Ngo <than@redhat.com> - 3.14.0-4
+- Resolves: #1853420, endian issue 
+
+* Mon Jun 15 2020 Than Ngo <than@redhat.com> - 3.14.0-3
+- Resolves: #1780294, PIN conversion tool
+
+* Tue May 26 2020 Than Ngo <than@redhat.com> - 3.14.0-2
+- Related: #1780293, fix regression, segfault in C_SetPin
+
+* Tue May 19 2020 Than Ngo <than@redhat.com> - 3.14.0-1
+- Resolves: #1723863 - ep11 token: Enhanced Support
+- Resolves: #1780285 - ep11 token: Support for new IBM Z hardware z15
+- Resolves: #1780293 - rebase to 3.14.0
+- Resolves: #1800549 - key management tool: list keys function
+ -Resolves: #1800555 - key management tool: random key generation function
+
+* Fri Dec 13 2019 Than Ngo <than@redhat.com> - 3.12.1-2
+- Resolves: #1782445, EP11: Fix EC-uncompress buffer length
+
+* Thu Nov 28 2019 Than Ngo <than@redhat.com> - 3.12.1-1
+- Resolves: #1777313, rebase to 3.12.1
+
+* Tue Nov 12 2019 Than Ngo <than@redhat.com> - 3.12.0-1
+- Resolves: #1726243, rebase to 3.12.0
+
+* Mon Aug 26 2019 Dan Horák <dhorak@redhat.com> - 3.11.1-2
+- Resolves: #1739433, ICA HW token missing after the package update
+
+* Mon May 06 2019 Than Ngo <than@redhat.com> - 3.11.1-1
+- Resolves: #1706140, rebase to 3.11.1
+
+* Tue Mar 26 2019 Than Ngo <than@redhat.com> - 3.11.0-3
+- Resolves: #1667941, 3des tests failures due to FIPS incompatible test scenarios
+- Resolves: #1651731, ep11 token: enhanced IBM z14 functions
+- Resolves: #1651732, ep11 token: support m_*Single functions from ep11 lib
+- Resolves: #1525407, use CPACF hashes in ep11 token
+- Resolves: #1651238, rebase to 3.11.0
+- Resolves: #1682530, gating
+
+* Fri Dec 14 2018 Than Ngo <than@redhat.com> - 3.10.0-3
+- Resolves: #1657683, can't establish libica token in FIPS mode
+- Resolves: #1652856, EP11 token fails when using Strict-Session mode or VHSM-Mode
+
+* Thu Oct 25 2018 Than Ngo <than@redhat.com> - 3.10.0-2
+- Resolves: #1602641, covscan
 
 * Tue Jun 12 2018 Dan Horák <dan[at]danny.cz> - 3.10.0-1
 - Rebase to 3.10.0