c10-beta
imports/c10-beta/openssl-fips-provider-3.0.7-6.el10
MSVSphere Packaging Team
1 month ago
commit
c94cd9125d
GPG Key ID:
B2B0B9F29E528FE8
@ -0,0 +1 @@
|
|||||||
|
SOURCES/openssl-fips-provider-3.0.7.tar.gz
|
||||||
@ -0,0 +1 @@
|
|||||||
|
67352c52fc82ec2fa5161cd68166238c9ddd1c43 SOURCES/openssl-fips-provider-3.0.7.tar.gz
|
||||||
@ -0,0 +1,5 @@
|
|||||||
|
This package provides a custom build of the OpenSSL FIPS module that has
|
||||||
|
been submitted to NIST for certification.
|
||||||
|
|
||||||
|
The actual shared object is in the subpackage openssl-fips-provider-so
|
||||||
|
due to overcome a build issue around custom debuginfo packages.
|
||||||
@ -0,0 +1,71 @@
|
|||||||
|
#!/usr/bin/bash -e
|
||||||
|
|
||||||
|
# args: build-V-R arch
|
||||||
|
|
||||||
|
if [ -z "${RPM_BUILD_ROOT}" ]; then
|
||||||
|
echo >&2 "RPM_BUILD_ROOT is not set"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
if [ -z "${ORIGINAL_PACKAGE_VERSION}" ]; then
|
||||||
|
echo >&2 "ORIGINAL_PACKAGE_VERSION is not set"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
if [ -z "${ORIGINAL_PACKAGE_RELEASE}" ]; then
|
||||||
|
echo >&2 "ORIGINAL_PACKAGE_RELEASE is not set"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
PKG_ARCH=${RPM_ARCH}
|
||||||
|
if [ "${PKG_ARCH}" = "i386" ]; then
|
||||||
|
PKG_ARCH=i686
|
||||||
|
fi
|
||||||
|
|
||||||
|
OVR=${ORIGINAL_PACKAGE_VERSION}-${ORIGINAL_PACKAGE_RELEASE}
|
||||||
|
DBGDIR=usr/lib/debug
|
||||||
|
DBGSRCDIR=usr/src/debug/openssl-${OVR}.${RPM_ARCH}
|
||||||
|
DEBUGINFO=${RPM_BUILD_DIR}/debuginfo.list
|
||||||
|
DEBUGSOURCE=${RPM_BUILD_DIR}/debugsourcefiles.list
|
||||||
|
|
||||||
|
# Remove existing files if any
|
||||||
|
rm -fr ${RPM_BUILD_ROOT}/${DBGDIR}
|
||||||
|
rm -fr ${RPM_BUILD_ROOT}/usr/src/debug/*
|
||||||
|
> ${DEBUGINFO}
|
||||||
|
> ${DEBUGSOURCE}
|
||||||
|
|
||||||
|
# fips.so
|
||||||
|
mkdir extract
|
||||||
|
pushd extract
|
||||||
|
|
||||||
|
rpm2cpio ${RPM_BUILD_DIR}/openssl-libs-${OVR}.${PKG_ARCH}.rpm |cpio -id --quiet
|
||||||
|
rpm2cpio ${RPM_BUILD_DIR}/openssl-libs-debuginfo-${OVR}.${PKG_ARCH}.rpm |cpio -id --quiet
|
||||||
|
rpm2cpio ${RPM_BUILD_DIR}/openssl-debuginfo-${OVR}.${PKG_ARCH}.rpm |cpio -id --quiet
|
||||||
|
rpm2cpio ${RPM_BUILD_DIR}/openssl-debugsource-${OVR}.${PKG_ARCH}.rpm |cpio -id --quiet
|
||||||
|
FIPS_SO=$(find usr -name fips.so)
|
||||||
|
cp -adt ${RPM_BUILD_ROOT} --parents ${FIPS_SO}
|
||||||
|
FIPS_SO_DBG=$(find usr -name fips.so-${OVR}.${RPM_ARCH}.debug)
|
||||||
|
cp -adt ${RPM_BUILD_ROOT} --parents ${FIPS_SO_DBG}
|
||||||
|
|
||||||
|
FIPS_DBG_ID=$(find -L usr -samefile ${FIPS_SO_DBG} -xtype l)
|
||||||
|
FIPS_DBG_ID_DIR=$(dirname ${FIPS_DBG_ID})
|
||||||
|
cp -adt ${RPM_BUILD_ROOT} --parents ${FIPS_DBG_ID_DIR}
|
||||||
|
cp -adt ${RPM_BUILD_ROOT} --parents ${DBGDIR}/.dwz
|
||||||
|
|
||||||
|
#remove unnecessary parts
|
||||||
|
rm -fr ${DBGSRCDIR}/apps
|
||||||
|
rm -fr ${DBGSRCDIR}/engines
|
||||||
|
rm -fr ${DBGSRCDIR}/ssl
|
||||||
|
cp -adt ${RPM_BUILD_ROOT} --parents usr/src/debug
|
||||||
|
|
||||||
|
popd
|
||||||
|
|
||||||
|
pushd ${RPM_BUILD_ROOT}
|
||||||
|
|
||||||
|
find ${DBGDIR} -type d | sed -e "s#^#%dir /#" >> ${DEBUGINFO}
|
||||||
|
find ${DBGDIR} -type f | sed -e "s#^#/#">> ${DEBUGINFO}
|
||||||
|
find ${DBGDIR} -type l | sed -e "s#^#/#">> ${DEBUGINFO}
|
||||||
|
|
||||||
|
find ${DBGSRCDIR} -type d | sed -e "s#^#%dir /#" >> ${DEBUGSOURCE}
|
||||||
|
find ${DBGSRCDIR} -type f | sed -e "s#^#/#">> ${DEBUGSOURCE}
|
||||||
|
find ${DBGSRCDIR} -type l | sed -e "s#^#/#">> ${DEBUGSOURCE}
|
||||||
|
|
||||||
|
popd
|
||||||
@ -0,0 +1,22 @@
|
|||||||
|
#!/usr/bin/bash -e
|
||||||
|
|
||||||
|
# args: version release
|
||||||
|
VERSION=$1
|
||||||
|
RELEASE=$2
|
||||||
|
OVR="${VERSION}-${RELEASE}"
|
||||||
|
rpm2cpio openssl-${OVR}.src.rpm |cpio -id
|
||||||
|
|
||||||
|
rm -fr openssl-${VERSION}
|
||||||
|
tar xf openssl-${VERSION}-hobbled.tar.gz
|
||||||
|
rm openssl.spec
|
||||||
|
|
||||||
|
pushd openssl-${VERSION}
|
||||||
|
git init
|
||||||
|
git config user.email "openssl-fips-provider-build@redhat.com"
|
||||||
|
git config user.name "openssl-fips-provider build"
|
||||||
|
git add .
|
||||||
|
git commit -m "init commit" --quiet
|
||||||
|
git apply -p1 ../*.patch
|
||||||
|
|
||||||
|
cp ../ec_curve.c crypto/ec/
|
||||||
|
cp ../ectest.c test/
|
||||||
@ -0,0 +1,217 @@
|
|||||||
|
# For the curious:
|
||||||
|
# 0.9.8jk + EAP-FAST soversion = 8
|
||||||
|
# 1.0.0 soversion = 10
|
||||||
|
# 1.1.0 soversion = 1.1 (same as upstream although presence of some symbols
|
||||||
|
# depends on build configuration options)
|
||||||
|
# 3.0.0 soversion = 3 (same as upstream)
|
||||||
|
%define soversion 3
|
||||||
|
|
||||||
|
# Arches on which we need to prevent arch conflicts on opensslconf.h, must
|
||||||
|
# also be handled in opensslconf-new.h.
|
||||||
|
%define multilib_arches %{ix86} ia64 %{mips} ppc ppc64 s390 s390x sparcv9 sparc64 x86_64
|
||||||
|
|
||||||
|
%global debug_package %{nil}
|
||||||
|
%define orig_release 18.el9_2
|
||||||
|
|
||||||
|
Summary: FIPS module for OpenSSL
|
||||||
|
Name: openssl-fips-provider
|
||||||
|
Version: 3.0.7
|
||||||
|
Release: 6%{?dist}
|
||||||
|
|
||||||
|
# We have to remove certain patented algorithms from the openssl source
|
||||||
|
# tarball with the hobble-openssl script which is included below.
|
||||||
|
# The original openssl upstream tarball cannot be shipped in the .src.rpm.
|
||||||
|
Source: %{name}-%{version}.tar.gz
|
||||||
|
Source1: extract-src.sh
|
||||||
|
Source2: extract-fips.sh
|
||||||
|
Source3: README.md
|
||||||
|
|
||||||
|
License: ASL 2.0
|
||||||
|
URL: http://www.openssl.org/
|
||||||
|
BuildRequires: gcc g++
|
||||||
|
BuildRequires: coreutils, perl-interpreter, sed, zlib-devel, /usr/bin/cmp
|
||||||
|
BuildRequires: lksctp-tools-devel
|
||||||
|
BuildRequires: /usr/bin/rename
|
||||||
|
BuildRequires: /usr/bin/pod2man
|
||||||
|
BuildRequires: /usr/sbin/sysctl
|
||||||
|
BuildRequires: perl(Test::Harness), perl(Test::More), perl(Math::BigInt)
|
||||||
|
BuildRequires: perl(Module::Load::Conditional), perl(File::Temp)
|
||||||
|
BuildRequires: perl(Time::HiRes), perl(IPC::Cmd), perl(Pod::Html), perl(Digest::SHA)
|
||||||
|
BuildRequires: perl(FindBin), perl(lib), perl(File::Compare), perl(File::Copy), perl(bigint)
|
||||||
|
BuildRequires: git-core
|
||||||
|
Requires: %{name}-so = %{version}-%{release}
|
||||||
|
|
||||||
|
%description
|
||||||
|
This package provides a custom build of the OpenSSL FIPS module that has been
|
||||||
|
submitted to NIST for certification.
|
||||||
|
|
||||||
|
%files
|
||||||
|
%doc README.md
|
||||||
|
|
||||||
|
%package so
|
||||||
|
Summary: FIPS module for OpenSSL
|
||||||
|
Requires: coreutils
|
||||||
|
Conflicts: openssl-libs < 1:3.0.7-26
|
||||||
|
Conflicts: openssl-fips-provider <= 3.0.7-2
|
||||||
|
|
||||||
|
%description so
|
||||||
|
This package provides a custom build of the OpenSSL FIPS module that has been
|
||||||
|
submitted to NIST for certification.
|
||||||
|
|
||||||
|
%files so
|
||||||
|
%attr(0755,root,root) %{_libdir}/ossl-modules/fips.so
|
||||||
|
|
||||||
|
%package so-debuginfo
|
||||||
|
Summary: Debug information for package %{name}
|
||||||
|
Group: Development/Debug
|
||||||
|
Recommends: %{name}-so-debugsource = %{version}-%{release}
|
||||||
|
%description so-debuginfo
|
||||||
|
This package provides debug information for package %{name}.
|
||||||
|
Debug information is useful when developing applications that use this
|
||||||
|
package or when debugging this package.
|
||||||
|
%files so-debuginfo -f debuginfo.list
|
||||||
|
|
||||||
|
%package so-debugsource
|
||||||
|
Summary: Debug sources for package %{name}
|
||||||
|
Group: Development/Debug
|
||||||
|
%description so-debugsource
|
||||||
|
This package provides debug sources for package %{name}.
|
||||||
|
Debug sources are useful when developing applications that use this
|
||||||
|
package or when debugging this package.
|
||||||
|
%files so-debugsource -f debugsourcefiles.list
|
||||||
|
|
||||||
|
%prep
|
||||||
|
tar xf %{SOURCE0}
|
||||||
|
%{SOURCE1} %{version} %{orig_release}
|
||||||
|
|
||||||
|
## NOTE: we do a full build every time to endure our ability to build
|
||||||
|
## from source as needed, but in RHEL we ultimately throw away all
|
||||||
|
## binaries and replace with the certified one.
|
||||||
|
%build
|
||||||
|
pushd openssl-%{version}
|
||||||
|
# Figure out which flags we want to use.
|
||||||
|
# default
|
||||||
|
sslarch=%{_os}-%{_target_cpu}
|
||||||
|
%ifarch %ix86
|
||||||
|
sslarch=linux-elf
|
||||||
|
if ! echo %{_target} | grep -q i686 ; then
|
||||||
|
sslflags="no-asm 386"
|
||||||
|
fi
|
||||||
|
%endif
|
||||||
|
%ifarch x86_64
|
||||||
|
sslflags=enable-ec_nistp_64_gcc_128
|
||||||
|
%endif
|
||||||
|
%ifarch sparcv9
|
||||||
|
sslarch=linux-sparcv9
|
||||||
|
sslflags=no-asm
|
||||||
|
%endif
|
||||||
|
%ifarch sparc64
|
||||||
|
sslarch=linux64-sparcv9
|
||||||
|
sslflags=no-asm
|
||||||
|
%endif
|
||||||
|
%ifarch alpha alphaev56 alphaev6 alphaev67
|
||||||
|
sslarch=linux-alpha-gcc
|
||||||
|
%endif
|
||||||
|
%ifarch s390 sh3eb sh4eb
|
||||||
|
sslarch="linux-generic32 -DB_ENDIAN"
|
||||||
|
%endif
|
||||||
|
%ifarch s390x
|
||||||
|
sslarch="linux64-s390x"
|
||||||
|
%endif
|
||||||
|
%ifarch %{arm}
|
||||||
|
sslarch=linux-armv4
|
||||||
|
%endif
|
||||||
|
%ifarch aarch64
|
||||||
|
sslarch=linux-aarch64
|
||||||
|
sslflags=enable-ec_nistp_64_gcc_128
|
||||||
|
%endif
|
||||||
|
%ifarch sh3 sh4
|
||||||
|
sslarch=linux-generic32
|
||||||
|
%endif
|
||||||
|
%ifarch ppc64 ppc64p7
|
||||||
|
sslarch=linux-ppc64
|
||||||
|
%endif
|
||||||
|
%ifarch ppc64le
|
||||||
|
sslarch="linux-ppc64le"
|
||||||
|
sslflags=enable-ec_nistp_64_gcc_128
|
||||||
|
%endif
|
||||||
|
%ifarch mips mipsel
|
||||||
|
sslarch="linux-mips32 -mips32r2"
|
||||||
|
%endif
|
||||||
|
%ifarch mips64 mips64el
|
||||||
|
sslarch="linux64-mips64 -mips64r2"
|
||||||
|
%endif
|
||||||
|
%ifarch mips64el
|
||||||
|
sslflags=enable-ec_nistp_64_gcc_128
|
||||||
|
%endif
|
||||||
|
%ifarch riscv64
|
||||||
|
sslarch=linux-generic64
|
||||||
|
%endif
|
||||||
|
|
||||||
|
# Add -Wa,--noexecstack here so that libcrypto's assembler modules will be
|
||||||
|
# marked as not requiring an executable stack.
|
||||||
|
# Also add -DPURIFY to make using valgrind with openssl easier as we do not
|
||||||
|
# want to depend on the uninitialized memory as a source of entropy anyway.
|
||||||
|
RPM_OPT_FLAGS="$RPM_OPT_FLAGS -Wa,--noexecstack -Wa,--generate-missing-build-notes=yes -DPURIFY $RPM_LD_FLAGS"
|
||||||
|
|
||||||
|
export HASHBANGPERL=/usr/bin/perl
|
||||||
|
|
||||||
|
%define fips %{version}-nevership
|
||||||
|
# ia64, x86_64, ppc are OK by default
|
||||||
|
# Configure the build tree. Override OpenSSL defaults with known-good defaults
|
||||||
|
# usable on all platforms. The Configure script already knows to use -fPIC and
|
||||||
|
# RPM_OPT_FLAGS, so we can skip specifiying them here.
|
||||||
|
./Configure \
|
||||||
|
--prefix=%{_prefix} --openssldir=%{_sysconfdir}/pki/tls ${sslflags} \
|
||||||
|
--system-ciphers-file=%{_sysconfdir}/crypto-policies/back-ends/openssl.config \
|
||||||
|
zlib enable-camellia enable-seed enable-rfc3779 enable-sctp \
|
||||||
|
enable-cms enable-md2 enable-rc5 enable-ktls enable-fips\
|
||||||
|
no-mdc2 no-ec2m no-sm2 no-sm4 enable-buildtest-c++\
|
||||||
|
shared ${sslarch} $RPM_OPT_FLAGS '-DDEVRANDOM="\"/dev/urandom\"" -DREDHAT_FIPS_VERSION="\"%{fips}\""'\
|
||||||
|
-Wl,--allow-multiple-definition -Wno-implicit-function-declaration
|
||||||
|
|
||||||
|
# Do not run this in a production package the FIPS symbols must be patched-in
|
||||||
|
#util/mkdef.pl crypto update
|
||||||
|
|
||||||
|
make %{?_smp_mflags} all
|
||||||
|
|
||||||
|
popd
|
||||||
|
|
||||||
|
%check
|
||||||
|
#We re not using the actual built bits, so skip any checks on those binaries.
|
||||||
|
|
||||||
|
%install
|
||||||
|
#we are not actually installing the build, as we replace all contents with the
|
||||||
|
#content from the original rpms
|
||||||
|
export ORIGINAL_PACKAGE_VERSION=%{version}
|
||||||
|
export ORIGINAL_PACKAGE_RELEASE=%{orig_release}
|
||||||
|
%{SOURCE2}
|
||||||
|
install -d $RPM_BUILD_ROOT%{_pkgdocdir}
|
||||||
|
install -m644 %{SOURCE3} $RPM_BUILD_ROOT%{_pkgdocdir}/README.md
|
||||||
|
|
||||||
|
%changelog
|
||||||
|
* Tue May 07 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 3.0.7-6
|
||||||
|
- Adjust build flags for successful build for RHEL10
|
||||||
|
Resolves: RHEL-30258
|
||||||
|
|
||||||
|
* Mon Apr 29 2024 Simo Sorce <ssorce@redhat.com> - 3.0.7-5
|
||||||
|
- Add an empty metapackage and proper requires to correctly
|
||||||
|
handle upgrades.
|
||||||
|
Related: RHEL-32123
|
||||||
|
|
||||||
|
* Tue Apr 23 2024 Simo Sorce <ssorce@redhat.com> - 3.0.7-4
|
||||||
|
- Change subpackage names to avoid build gating issues
|
||||||
|
Related: RHEL-32123
|
||||||
|
|
||||||
|
* Tue Apr 16 2024 Simo Sorce <ssorce@redhat.com> - 3.0.7-3
|
||||||
|
- Change tarball source contents
|
||||||
|
- Rework file extraction process
|
||||||
|
- Fixes debug packages
|
||||||
|
Resolves: RHEL-32123
|
||||||
|
|
||||||
|
* Wed Feb 21 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 3.0.7-2
|
||||||
|
- Denote conflict with old versions of openssl-libs package
|
||||||
|
Related: RHEL-23474
|
||||||
|
|
||||||
|
* Wed Jan 24 2024 Simo Sorce <ssorce@redhat.com> - 3.0.7-1
|
||||||
|
Initial packaging
|
||||||
Loading…
Reference in new issue