isaacpittman-hitachi / rpms / openssl

Forked from rpms/openssl 2 years ago
Clone

Blame SPECS/openssl.spec

2871ff
# For the curious:
2871ff
# 0.9.8jk + EAP-FAST soversion = 8
2871ff
# 1.0.0 soversion = 10
2871ff
# 1.1.0 soversion = 1.1 (same as upstream although presence of some symbols
2871ff
#                        depends on build configuration options)
2871ff
# 3.0.0 soversion = 3 (same as upstream)
2871ff
%define soversion 3
2871ff
2871ff
# Arches on which we need to prevent arch conflicts on opensslconf.h, must
2871ff
# also be handled in opensslconf-new.h.
2871ff
%define multilib_arches %{ix86} ia64 %{mips} ppc ppc64 s390 s390x sparcv9 sparc64 x86_64
2871ff
2871ff
%global _performance_build 1
2871ff
2871ff
Summary: Utilities from the general purpose cryptography library with TLS implementation
2871ff
Name: openssl
a74baf
Version: 3.0.1
a74baf
Release: 5%{?dist}
2871ff
Epoch: 1
2871ff
# We have to remove certain patented algorithms from the openssl source
2871ff
# tarball with the hobble-openssl script which is included below.
2871ff
# The original openssl upstream tarball cannot be shipped in the .src.rpm.
2871ff
Source: openssl-%{version}-hobbled.tar.xz
2871ff
Source1: hobble-openssl
2871ff
Source2: Makefile.certificate
2871ff
Source3: genpatches
2871ff
Source6: make-dummy-cert
2871ff
Source7: renew-dummy-cert
2871ff
Source9: configuration-switch.h
2871ff
Source10: configuration-prefix.h
2871ff
Source12: ec_curve.c
2871ff
Source13: ectest.c
6ed7c9
Source14: 0025-for-tests.patch
2871ff
2871ff
# Patches exported from source git
2871ff
# Aarch64 and ppc64le use lib64
2871ff
Patch1: 0001-Aarch64-and-ppc64le-use-lib64.patch
2871ff
# Use more general default values in openssl.cnf
2871ff
Patch2: 0002-Use-more-general-default-values-in-openssl.cnf.patch
2871ff
# Do not install html docs
2871ff
Patch3: 0003-Do-not-install-html-docs.patch
2871ff
# Override default paths for the CA directory tree
2871ff
Patch4: 0004-Override-default-paths-for-the-CA-directory-tree.patch
2871ff
# apps/ca: fix md option help text
2871ff
Patch5: 0005-apps-ca-fix-md-option-help-text.patch
2871ff
# Disable signature verification with totally unsafe hash algorithms
2871ff
Patch6: 0006-Disable-signature-verification-with-totally-unsafe-h.patch
2871ff
# Add support for PROFILE=SYSTEM system default cipherlist
2871ff
Patch7: 0007-Add-support-for-PROFILE-SYSTEM-system-default-cipher.patch
2871ff
# Add FIPS_mode() compatibility macro
2871ff
Patch8: 0008-Add-FIPS_mode-compatibility-macro.patch
2871ff
# Add check to see if fips flag is enabled in kernel
6ed7c9
Patch9: 0009-Add-Kernel-FIPS-mode-flag-support.patch
2871ff
# remove unsupported EC curves
2871ff
Patch11: 0011-Remove-EC-curves.patch
2871ff
# Instructions to load legacy provider in openssl.cnf
2871ff
Patch24: 0024-load-legacy-prov.patch
6ed7c9
# Tmp: test name change
6ed7c9
Patch31: 0031-tmp-Fix-test-names.patch
6ed7c9
# We load FIPS provider and set FIPS properties implicitly
6ed7c9
Patch32: 0032-Force-fips.patch
6ed7c9
# Embed HMAC into the fips.so
6ed7c9
Patch33: 0033-FIPS-embed-hmac.patch
6ed7c9
# Comment out fipsinstall command-line utility
6ed7c9
Patch34: 0034.fipsinstall_disable.patch
6f4837
# Skip unavailable algorithms running `openssl speed`
6f4837
Patch35: 0035-speed-skip-unavailable-dgst.patch
a74baf
# Minimize fips services
a74baf
Patch45: 0045-FIPS-services-minimize.patch
a74baf
# Backport of s390x hardening, https://github.com/openssl/openssl/pull/17486
a74baf
Patch46: 0046-FIPS-s390x-hardening.patch
a74baf
# Execute KATS before HMAC verification
a74baf
Patch47: 0047-FIPS-early-KATS.patch
2871ff
2871ff
License: ASL 2.0
2871ff
URL: http://www.openssl.org/
a74baf
BuildRequires: gcc g++
2871ff
BuildRequires: coreutils, perl-interpreter, sed, zlib-devel, /usr/bin/cmp
2871ff
BuildRequires: lksctp-tools-devel
2871ff
BuildRequires: /usr/bin/rename
2871ff
BuildRequires: /usr/bin/pod2man
2871ff
BuildRequires: /usr/sbin/sysctl
2871ff
BuildRequires: perl(Test::Harness), perl(Test::More), perl(Math::BigInt)
2871ff
BuildRequires: perl(Module::Load::Conditional), perl(File::Temp)
2871ff
BuildRequires: perl(Time::HiRes), perl(IPC::Cmd), perl(Pod::Html), perl(Digest::SHA)
2871ff
BuildRequires: perl(FindBin), perl(lib), perl(File::Compare), perl(File::Copy), perl(bigint)
2871ff
BuildRequires: git-core
2871ff
Requires: coreutils
2871ff
Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
2871ff
2871ff
%description
2871ff
The OpenSSL toolkit provides support for secure communications between
2871ff
machines. OpenSSL includes a certificate management tool and shared
2871ff
libraries which provide various cryptographic algorithms and
2871ff
protocols.
2871ff
2871ff
%package libs
2871ff
Summary: A general purpose cryptography library with TLS implementation
2871ff
Requires: ca-certificates >= 2008-5
2871ff
Requires: crypto-policies >= 20180730
2871ff
Recommends: openssl-pkcs11%{?_isa}
2871ff
2871ff
%description libs
2871ff
OpenSSL is a toolkit for supporting cryptography. The openssl-libs
2871ff
package contains the libraries that are used by various applications which
2871ff
support cryptographic algorithms and protocols.
2871ff
2871ff
%package devel
2871ff
Summary: Files for development of applications which will use OpenSSL
2871ff
Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
2871ff
Requires: pkgconfig
2871ff
2871ff
%description devel
2871ff
OpenSSL is a toolkit for supporting cryptography. The openssl-devel
2871ff
package contains include files needed to develop applications which
2871ff
support various cryptographic algorithms and protocols.
2871ff
2871ff
%package perl
2871ff
Summary: Perl scripts provided with OpenSSL
2871ff
Requires: perl-interpreter
2871ff
Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release}
2871ff
2871ff
%description perl
2871ff
OpenSSL is a toolkit for supporting cryptography. The openssl-perl
2871ff
package provides Perl scripts for converting certificates and keys
2871ff
from other formats to the formats used by the OpenSSL toolkit.
2871ff
2871ff
%prep
6ed7c9
%autosetup -S git -n %{name}-%{version}
2871ff
2871ff
# The hobble_openssl is called here redundantly, just to be sure.
2871ff
# The tarball has already the sources removed.
2871ff
%{SOURCE1} > /dev/null
2871ff
2871ff
cp %{SOURCE12} crypto/ec/
2871ff
cp %{SOURCE13} test/
2871ff
2871ff
%build
2871ff
# Figure out which flags we want to use.
2871ff
# default
2871ff
sslarch=%{_os}-%{_target_cpu}
2871ff
%ifarch %ix86
2871ff
sslarch=linux-elf
2871ff
if ! echo %{_target} | grep -q i686 ; then
2871ff
	sslflags="no-asm 386"
2871ff
fi
2871ff
%endif
2871ff
%ifarch x86_64
2871ff
sslflags=enable-ec_nistp_64_gcc_128
2871ff
%endif
2871ff
%ifarch sparcv9
2871ff
sslarch=linux-sparcv9
2871ff
sslflags=no-asm
2871ff
%endif
2871ff
%ifarch sparc64
2871ff
sslarch=linux64-sparcv9
2871ff
sslflags=no-asm
2871ff
%endif
2871ff
%ifarch alpha alphaev56 alphaev6 alphaev67
2871ff
sslarch=linux-alpha-gcc
2871ff
%endif
2871ff
%ifarch s390 sh3eb sh4eb
2871ff
sslarch="linux-generic32 -DB_ENDIAN"
2871ff
%endif
2871ff
%ifarch s390x
2871ff
sslarch="linux64-s390x"
2871ff
%endif
2871ff
%ifarch %{arm}
2871ff
sslarch=linux-armv4
2871ff
%endif
2871ff
%ifarch aarch64
2871ff
sslarch=linux-aarch64
2871ff
sslflags=enable-ec_nistp_64_gcc_128
2871ff
%endif
2871ff
%ifarch sh3 sh4
2871ff
sslarch=linux-generic32
2871ff
%endif
2871ff
%ifarch ppc64 ppc64p7
2871ff
sslarch=linux-ppc64
2871ff
%endif
2871ff
%ifarch ppc64le
2871ff
sslarch="linux-ppc64le"
2871ff
sslflags=enable-ec_nistp_64_gcc_128
2871ff
%endif
2871ff
%ifarch mips mipsel
2871ff
sslarch="linux-mips32 -mips32r2"
2871ff
%endif
2871ff
%ifarch mips64 mips64el
2871ff
sslarch="linux64-mips64 -mips64r2"
2871ff
%endif
2871ff
%ifarch mips64el
2871ff
sslflags=enable-ec_nistp_64_gcc_128
2871ff
%endif
2871ff
%ifarch riscv64
2871ff
sslarch=linux-generic64
2871ff
%endif
2871ff
2871ff
# Add -Wa,--noexecstack here so that libcrypto's assembler modules will be
2871ff
# marked as not requiring an executable stack.
2871ff
# Also add -DPURIFY to make using valgrind with openssl easier as we do not
2871ff
# want to depend on the uninitialized memory as a source of entropy anyway.
2871ff
RPM_OPT_FLAGS="$RPM_OPT_FLAGS -Wa,--noexecstack -Wa,--generate-missing-build-notes=yes -DPURIFY $RPM_LD_FLAGS"
2871ff
2871ff
export HASHBANGPERL=/usr/bin/perl
2871ff
2871ff
# ia64, x86_64, ppc are OK by default
2871ff
# Configure the build tree.  Override OpenSSL defaults with known-good defaults
2871ff
# usable on all platforms.  The Configure script already knows to use -fPIC and
2871ff
# RPM_OPT_FLAGS, so we can skip specifiying them here.
2871ff
./Configure \
2871ff
	--prefix=%{_prefix} --openssldir=%{_sysconfdir}/pki/tls ${sslflags} \
2871ff
	--system-ciphers-file=%{_sysconfdir}/crypto-policies/back-ends/openssl.config \
2871ff
	zlib enable-camellia enable-seed enable-rfc3779 enable-sctp \
2871ff
	enable-cms enable-md2 enable-rc5 enable-ktls enable-fips\
a74baf
	no-mdc2 no-ec2m no-sm2 no-sm4 enable-buildtest-c++\
2871ff
	shared  ${sslarch} $RPM_OPT_FLAGS '-DDEVRANDOM="\"/dev/urandom\""'
2871ff
2871ff
# Do not run this in a production package the FIPS symbols must be patched-in
2871ff
#util/mkdef.pl crypto update
2871ff
a74baf
make %{?_smp_mflags} all
2871ff
2871ff
# Clean up the .pc files
2871ff
for i in libcrypto.pc libssl.pc openssl.pc ; do
2871ff
  sed -i '/^Libs.private:/{s/-L[^ ]* //;s/-Wl[^ ]* //}' $i
2871ff
done
2871ff
2871ff
%check
2871ff
# Verify that what was compiled actually works.
2871ff
2871ff
# Hack - either enable SCTP AUTH chunks in kernel or disable sctp for check
2871ff
(sysctl net.sctp.addip_enable=1 && sysctl net.sctp.auth_enable=1) || \
2871ff
(echo 'Failed to enable SCTP AUTH chunks, disabling SCTP for tests...' &&
2871ff
 sed '/"msan" => "default",/a\ \ "sctp" => "default",' configdata.pm > configdata.pm.new && \
2871ff
 touch -r configdata.pm configdata.pm.new && \
2871ff
 mv -f configdata.pm.new configdata.pm)
2871ff
2871ff
# We must revert patch4 before tests otherwise they will fail
2871ff
patch -p1 -R < %{PATCH4}
6ed7c9
#We must disable default provider before tests otherwise they will fail
6ed7c9
patch -p1 < %{SOURCE14}
2871ff
2871ff
OPENSSL_ENABLE_MD5_VERIFY=
2871ff
export OPENSSL_ENABLE_MD5_VERIFY
2871ff
OPENSSL_SYSTEM_CIPHERS_OVERRIDE=xyz_nonexistent_file
2871ff
export OPENSSL_SYSTEM_CIPHERS_OVERRIDE
6ed7c9
#embed HMAC into fips provider for test run
6ed7c9
LD_LIBRARY_PATH=. apps/openssl dgst -binary -sha256 -mac HMAC -macopt hexkey:f4556650ac31d35461610bac4ed81b1a181b2d8a43ea2854cbae22ca74560813 < providers/fips.so > providers/fips.so.hmac
6ed7c9
objcopy --update-section .rodata1=providers/fips.so.hmac providers/fips.so providers/fips.so.mac
6ed7c9
mv providers/fips.so.mac providers/fips.so
6ed7c9
#run tests itself
2871ff
make test HARNESS_JOBS=8
2871ff
2871ff
# Add generation of HMAC checksum of the final stripped library
6ed7c9
# We manually copy standard definition of __spec_install_post
6ed7c9
# and add hmac calculation/embedding to fips.so
6ed7c9
%define __spec_install_post \
6ed7c9
    %{?__debug_package:%{__debug_install_post}} \
6ed7c9
    %{__arch_install_post} \
6ed7c9
    %{__os_install_post} \
6ed7c9
    LD_LIBRARY_PATH=. apps/openssl dgst -binary -sha256 -mac HMAC -macopt hexkey:f4556650ac31d35461610bac4ed81b1a181b2d8a43ea2854cbae22ca74560813 < $RPM_BUILD_ROOT%{_libdir}/ossl-modules/fips.so > $RPM_BUILD_ROOT%{_libdir}/ossl-modules/fips.so.hmac \
6ed7c9
    objcopy --update-section .rodata1=$RPM_BUILD_ROOT%{_libdir}/ossl-modules/fips.so.hmac $RPM_BUILD_ROOT%{_libdir}/ossl-modules/fips.so $RPM_BUILD_ROOT%{_libdir}/ossl-modules/fips.so.mac \
6ed7c9
    mv $RPM_BUILD_ROOT%{_libdir}/ossl-modules/fips.so.mac $RPM_BUILD_ROOT%{_libdir}/ossl-modules/fips.so \
6ed7c9
    rm $RPM_BUILD_ROOT%{_libdir}/ossl-modules/fips.so.hmac \
6ed7c9
%{nil}
2871ff
2871ff
%define __provides_exclude_from %{_libdir}/openssl
2871ff
2871ff
%install
2871ff
[ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT
2871ff
# Install OpenSSL.
2871ff
install -d $RPM_BUILD_ROOT{%{_bindir},%{_includedir},%{_libdir},%{_mandir},%{_libdir}/openssl,%{_pkgdocdir}}
2871ff
%make_install
2871ff
rename so.%{soversion} so.%{version} $RPM_BUILD_ROOT%{_libdir}/*.so.%{soversion}
2871ff
for lib in $RPM_BUILD_ROOT%{_libdir}/*.so.%{version} ; do
2871ff
	chmod 755 ${lib}
2871ff
	ln -s -f `basename ${lib}` $RPM_BUILD_ROOT%{_libdir}/`basename ${lib} .%{version}`
2871ff
	ln -s -f `basename ${lib}` $RPM_BUILD_ROOT%{_libdir}/`basename ${lib} .%{version}`.%{soversion}
2871ff
done
2871ff
2871ff
# Remove static libraries
2871ff
for lib in $RPM_BUILD_ROOT%{_libdir}/*.a ; do
2871ff
	rm -f ${lib}
2871ff
done
2871ff
2871ff
# Install a makefile for generating keys and self-signed certs, and a script
2871ff
# for generating them on the fly.
2871ff
mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/certs
2871ff
install -m644 %{SOURCE2} $RPM_BUILD_ROOT%{_pkgdocdir}/Makefile.certificate
2871ff
install -m755 %{SOURCE6} $RPM_BUILD_ROOT%{_bindir}/make-dummy-cert
2871ff
install -m755 %{SOURCE7} $RPM_BUILD_ROOT%{_bindir}/renew-dummy-cert
2871ff
2871ff
# Move runable perl scripts to bindir
2871ff
mv $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/misc/*.pl $RPM_BUILD_ROOT%{_bindir}
2871ff
mv $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/misc/tsget $RPM_BUILD_ROOT%{_bindir}
2871ff
2871ff
# Rename man pages so that they don't conflict with other system man pages.
2871ff
pushd $RPM_BUILD_ROOT%{_mandir}
2871ff
mv man5/config.5ossl man5/openssl.cnf.5
2871ff
popd
2871ff
2871ff
mkdir -m755 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA
2871ff
mkdir -m700 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA/private
2871ff
mkdir -m755 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA/certs
2871ff
mkdir -m755 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA/crl
2871ff
mkdir -m755 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA/newcerts
2871ff
2871ff
# Ensure the config file timestamps are identical across builds to avoid
2871ff
# mulitlib conflicts and unnecessary renames on upgrade
2871ff
touch -r %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/openssl.cnf
2871ff
touch -r %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/ct_log_list.cnf
2871ff
2871ff
rm -f $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/openssl.cnf.dist
2871ff
rm -f $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/ct_log_list.cnf.dist
a74baf
#we don't use native fipsmodule.cnf because FIPS module is loaded automatically
2871ff
rm -f $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/fipsmodule.cnf
2871ff
2871ff
# Determine which arch opensslconf.h is going to try to #include.
2871ff
basearch=%{_arch}
2871ff
%ifarch %{ix86}
2871ff
basearch=i386
2871ff
%endif
2871ff
%ifarch sparcv9
2871ff
basearch=sparc
2871ff
%endif
2871ff
%ifarch sparc64
2871ff
basearch=sparc64
2871ff
%endif
2871ff
2871ff
# Next step of gradual disablement of SSL3.
2871ff
# Make SSL3 disappear to newly built dependencies.
2871ff
sed -i '/^\#ifndef OPENSSL_NO_SSL_TRACE/i\
2871ff
#ifndef OPENSSL_NO_SSL3\
2871ff
# define OPENSSL_NO_SSL3\
2871ff
#endif' $RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf.h
2871ff
2871ff
%ifarch %{multilib_arches}
2871ff
# Do an configuration.h switcheroo to avoid file conflicts on systems where you
2871ff
# can have both a 32- and 64-bit version of the library, and they each need
2871ff
# their own correct-but-different versions of opensslconf.h to be usable.
2871ff
install -m644 %{SOURCE10} \
2871ff
	$RPM_BUILD_ROOT/%{_prefix}/include/openssl/configuration-${basearch}.h
2871ff
cat $RPM_BUILD_ROOT/%{_prefix}/include/openssl/configuration.h >> \
2871ff
	$RPM_BUILD_ROOT/%{_prefix}/include/openssl/configuration-${basearch}.h
2871ff
install -m644 %{SOURCE9} \
2871ff
	$RPM_BUILD_ROOT/%{_prefix}/include/openssl/configuration.h
2871ff
%endif
2871ff
2871ff
%files
2871ff
%{!?_licensedir:%global license %%doc}
2871ff
%license LICENSE.txt
2871ff
%doc NEWS.md README.md
2871ff
%{_bindir}/make-dummy-cert
2871ff
%{_bindir}/renew-dummy-cert
2871ff
%{_bindir}/openssl
2871ff
%{_mandir}/man1/*
2871ff
%{_mandir}/man5/*
2871ff
%{_mandir}/man7/*
2871ff
%{_pkgdocdir}/Makefile.certificate
2871ff
%exclude %{_mandir}/man1/*.pl*
2871ff
%exclude %{_mandir}/man1/tsget*
2871ff
2871ff
%files libs
2871ff
%{!?_licensedir:%global license %%doc}
2871ff
%license LICENSE.txt
2871ff
%dir %{_sysconfdir}/pki/tls
2871ff
%dir %{_sysconfdir}/pki/tls/certs
2871ff
%dir %{_sysconfdir}/pki/tls/misc
2871ff
%dir %{_sysconfdir}/pki/tls/private
2871ff
%config(noreplace) %{_sysconfdir}/pki/tls/openssl.cnf
2871ff
%config(noreplace) %{_sysconfdir}/pki/tls/ct_log_list.cnf
2871ff
%attr(0755,root,root) %{_libdir}/libcrypto.so.%{version}
2871ff
%{_libdir}/libcrypto.so.%{soversion}
2871ff
%attr(0755,root,root) %{_libdir}/libssl.so.%{version}
2871ff
%{_libdir}/libssl.so.%{soversion}
2871ff
%attr(0755,root,root) %{_libdir}/engines-%{soversion}
2871ff
%attr(0755,root,root) %{_libdir}/ossl-modules
2871ff
2871ff
%files devel
2871ff
%doc CHANGES.md doc/dir-locals.example.el doc/openssl-c-indent.el
2871ff
%{_prefix}/include/openssl
2871ff
%{_libdir}/*.so
2871ff
%{_mandir}/man3/*
2871ff
%{_libdir}/pkgconfig/*.pc
2871ff
2871ff
%files perl
2871ff
%{_bindir}/c_rehash
2871ff
%{_bindir}/*.pl
2871ff
%{_bindir}/tsget
2871ff
%{_mandir}/man1/*.pl*
2871ff
%{_mandir}/man1/tsget*
2871ff
%dir %{_sysconfdir}/pki/CA
2871ff
%dir %{_sysconfdir}/pki/CA/private
2871ff
%dir %{_sysconfdir}/pki/CA/certs
2871ff
%dir %{_sysconfdir}/pki/CA/crl
2871ff
%dir %{_sysconfdir}/pki/CA/newcerts
2871ff
2871ff
%ldconfig_scriptlets libs
2871ff
2871ff
%changelog
a74baf
* Wed Jan 26 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.1-5
a74baf
- On the s390x, zeroize all the copies of TLS premaster secret
a74baf
- Related: rhbz#2040448
a74baf
a74baf
* Fri Jan 21 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.1-4
a74baf
- rebuilt
a74baf
a74baf
* Fri Jan 21 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.1-3
a74baf
- KATS tests should be executed before HMAC verification
a74baf
- Restoring fips=yes for SHA1
a74baf
- Related: rhbz#2026445, rhbz#2041994
a74baf
a74baf
* Thu Jan 20 2022 Sahana Prasad <sahana@redhat.com> - 1:3.0.1-2
a74baf
- Add enable-buildtest-c++ to the configure options.
a74baf
- Related: rhbz#1990814
a74baf
a74baf
* Tue Jan 18 2022 Sahana Prasad <sahana@redhat.com> - 1:3.0.1-1
a74baf
- Rebase to upstream version 3.0.1
a74baf
- Fixes CVE-2021-4044 Invalid handling of X509_verify_cert() internal errors in libssl
a74baf
- Resolves: rhbz#2038910, rhbz#2035148
a74baf
a74baf
* Mon Jan 17 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.0-7
a74baf
- Remove algorithms we don't plan to certify from fips module
a74baf
- Remove native fipsmodule.cnf
a74baf
- Related: rhbz#2026445
a74baf
6f4837
* Tue Dec 21 2021 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.0-6
6f4837
- openssl speed should run in FIPS mode
6f4837
- Related: rhbz#1977318
6f4837
cb528d
* Wed Nov 24 2021 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.0-5
cb528d
- rebuilt for spec cleanup
cb528d
- Related: rhbz#1985362
cb528d
6ed7c9
* Thu Nov 18 2021 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.0-4
6ed7c9
- Embed FIPS HMAC in fips.so
6ed7c9
- Enforce loading FIPS provider when FIPS kernel flag is on
cb528d
- Related: rhbz#1985362
6ed7c9
6ed7c9
* Thu Oct 07 2021 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.0-3
6ed7c9
- Fix memory leak in s_client
6ed7c9
- Related: rhbz#1996092
6ed7c9
6ed7c9
* Mon Sep 20 2021 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.0-2
6ed7c9
- Avoid double-free on error seeding the RNG.
6ed7c9
- KTLS and FIPS may interfere, so tests need to be tuned
6ed7c9
- Resolves: rhbz#1952844, rhbz#1961643
6ed7c9
6ed7c9
* Thu Sep 09 2021 Sahana Prasad <sahana@redhat.com> - 1:3.0.0-1
6ed7c9
- Rebase to upstream version 3.0.0
6ed7c9
- Related: rhbz#1990814
6ed7c9
2871ff
* Wed Aug 25 2021 Sahana Prasad <sahana@redhat.com> - 1:3.0.0-0.beta2.7
2871ff
- Removes the dual-abi build as it not required anymore. The mass rebuild
2871ff
  was completed and all packages are rebuilt against Beta version.
2871ff
- Resolves: rhbz#1984097
2871ff
2871ff
* Mon Aug 23 2021 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.0-0.beta2.6
2871ff
- Correctly process CMS reading from /dev/stdin
2871ff
- Resolves: rhbz#1986315
2871ff
2871ff
* Mon Aug 16 2021 Sahana Prasad <sahana@redhat.com> - 3.0.0-0.beta2.5
2871ff
- Add instruction for loading legacy provider in openssl.cnf
2871ff
- Resolves: rhbz#1975836
2871ff
2871ff
* Mon Aug 16 2021 Sahana Prasad <sahana@redhat.com> - 3.0.0-0.beta2.4
2871ff
- Adds support for IDEA encryption.
2871ff
- Resolves: rhbz#1990602
2871ff
2871ff
* Tue Aug 10 2021 Sahana Prasad <sahana@redhat.com> - 3.0.0-0.beta2.3
2871ff
- Fixes core dump in openssl req -modulus
2871ff
- Fixes 'openssl req' to not ask for password when non-encrypted private key
2871ff
  is used
2871ff
- cms: Do not try to check binary format on stdin and -rctform fix
2871ff
- Resolves: rhbz#1988137, rhbz#1988468, rhbz#1988137
2871ff
2871ff
* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 1:3.0.0-0.beta2.2.1
2871ff
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
2871ff
  Related: rhbz#1991688
2871ff
2871ff
* Wed Aug 04 2021 Dmitry Belyavskiy <dbelyavs@redhat.com> - 3.0.0-0.beta2.2
2871ff
- When signature_algorithm extension is omitted, use more relevant alerts
2871ff
- Resolves: rhbz#1965017
2871ff
2871ff
* Tue Aug 03 2021 Sahana Prasad <sahana@redhat.com> 3.0.0-0.beta2.1
2871ff
- Rebase to upstream version beta2
2871ff
- Related: rhbz#1903209
2871ff
2871ff
* Thu Jul 22 2021 Sahana Prasad <sahana@redhat.com> 3.0.0-0.beta1.5
2871ff
- Prevents creation of duplicate cert entries in PKCS #12 files
2871ff
- Resolves: rhbz#1978670
2871ff
2871ff
* Wed Jul 21 2021 Sahana Prasad <sahana@redhat.com> 3.0.0-0.beta1.4
2871ff
- NVR bump to update to OpenSSL 3.0 Beta1
2871ff
2871ff
* Mon Jul 19 2021 Sahana Prasad <sahana@redhat.com> 3.0.0-0.beta1.3
2871ff
- Update patch dual-abi.patch to add the #define macros in implementation
2871ff
  files instead of public header files
2871ff
2871ff
* Wed Jul 14 2021 Sahana Prasad <sahana@redhat.com> 3.0.0-0.beta1.2
2871ff
- Removes unused patch dual-abi.patch
2871ff
2871ff
* Wed Jul 14 2021 Sahana Prasad <sahana@redhat.com> 3.0.0-0.beta1.1
2871ff
- Update to Beta1 version
2871ff
- Includes a patch to support dual-ABI, as Beta1 brekas ABI with alpha16
2871ff
2871ff
* Tue Jul 06 2021 Sahana Prasad <sahana@redhat.com> 3.0.0-0.alpha16.7
2871ff
- Fixes override of openssl_conf in openssl.cnf
2871ff
- Use AI_ADDRCONFIG only when explicit host name is given
2871ff
- Temporarily remove fipsmodule.cnf for arch i686
2871ff
- Fixes segmentation fault in BN_lebin2bn
2871ff
- Resolves: rhbz#1975847, rhbz#1976845, rhbz#1973477, rhbz#1975855
2871ff
2871ff
* Fri Jul 02 2021 Sahana Prasad <sahana@redhat.com> 3.0.0-0.alpha16.6
2871ff
- Adds FIPS mode compatibility patch (sahana@redhat.com)
2871ff
- Related: rhbz#1977318
2871ff
2871ff
* Fri Jul 02 2021 Sahana Prasad <sahana@redhat.com> 3.0.0-0.alpha16.5
2871ff
- Fixes system hang issue when booted in FIPS mode (sahana@redhat.com)
2871ff
- Temporarily disable downstream FIPS patches
2871ff
- Related: rhbz#1977318
2871ff
2871ff
* Fri Jun 11 2021 Mohan Boddu <mboddu@redhat.com> 3.0.0-0.alpha16.4
2871ff
- Speeding up building openssl (dbelyavs@redhat.com)
2871ff
  Resolves: rhbz#1903209
2871ff
2871ff
* Fri Jun 04 2021 Sahana Prasad <sahana@redhat.com> 3.0.0-0.alpha16.3
2871ff
- Fix reading SPKAC data from stdin
2871ff
- Fix incorrect OSSL_PKEY_PARAM_MAX_SIZE for ed25519 and ed448
2871ff
- Return 0 after cleanup in OPENSSL_init_crypto()
2871ff
- Cleanup the peer point formats on regotiation
2871ff
- Fix default digest to SHA256
2871ff
2871ff
* Thu May 27 2021 Sahana Prasad <sahana@redhat.com> 3.0.0-0.alpha16.2
2871ff
- Enable FIPS via config options
2871ff
2871ff
* Mon May 17 2021 Sahana Prasad <sahana@redhat.com> 3.0.0-0.alpha16.1
2871ff
- Update to alpha 16 version
2871ff
  Resolves: rhbz#1952901 openssl sends alert after orderly connection close
2871ff
2871ff
* Mon Apr 26 2021 Sahana Prasad <sahana@redhat.com> 3.0.0-0.alpha15.1
2871ff
- Update to alpha 15 version
2871ff
  Resolves: rhbz#1903209, rhbz#1952598, 
2871ff
2871ff
* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 1:3.0.0-0.alpha13.1.1
2871ff
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
2871ff
2871ff
* Fri Apr 09 2021 Sahana Prasad <sahana@redhat.com> 3.0.0-0.alpha13.1
2871ff
- Update to new major release OpenSSL 3.0.0 alpha 13
2871ff
  Resolves: rhbz#1903209