Blame SPECS/openssl.spec

bf760f
# For the curious:
bf760f
# 0.9.8jk + EAP-FAST soversion = 8
bf760f
# 1.0.0 soversion = 10
bf760f
# 1.1.0 soversion = 1.1 (same as upstream although presence of some symbols
bf760f
#                        depends on build configuration options)
bf760f
# 3.0.0 soversion = 3 (same as upstream)
bf760f
%define soversion 3
bf760f
bf760f
# Arches on which we need to prevent arch conflicts on opensslconf.h, must
bf760f
# also be handled in opensslconf-new.h.
bf760f
%define multilib_arches %{ix86} ia64 %{mips} ppc ppc64 s390 s390x sparcv9 sparc64 x86_64
bf760f
727bdf
%define srpmhash() %{lua:
727bdf
local files = rpm.expand("%_specdir/openssl.spec")
727bdf
for i, p in ipairs(patches) do
727bdf
   files = files.." "..p
727bdf
end
727bdf
for i, p in ipairs(sources) do
727bdf
   files = files.." "..p
727bdf
end
727bdf
local sha256sum = assert(io.popen("cat "..files.." 2>/dev/null | sha256sum"))
727bdf
local hash = sha256sum:read("*a")
727bdf
sha256sum:close()
727bdf
print(string.sub(hash, 0, 16))
727bdf
}
727bdf
bf760f
%global _performance_build 1
bf760f
bf760f
Summary: Utilities from the general purpose cryptography library with TLS implementation
bf760f
Name: openssl
bf760f
Version: 3.0.1
727bdf
Release: 41%{?dist}
bf760f
Epoch: 1
bf760f
# We have to remove certain patented algorithms from the openssl source
bf760f
# tarball with the hobble-openssl script which is included below.
bf760f
# The original openssl upstream tarball cannot be shipped in the .src.rpm.
bf760f
Source: openssl-%{version}-hobbled.tar.xz
bf760f
Source1: hobble-openssl
bf760f
Source2: Makefile.certificate
bf760f
Source3: genpatches
bf760f
Source6: make-dummy-cert
bf760f
Source7: renew-dummy-cert
bf760f
Source9: configuration-switch.h
bf760f
Source10: configuration-prefix.h
bf760f
Source12: ec_curve.c
bf760f
Source13: ectest.c
bf760f
Source14: 0025-for-tests.patch
bf760f
bf760f
# Patches exported from source git
bf760f
# Aarch64 and ppc64le use lib64
bf760f
Patch1: 0001-Aarch64-and-ppc64le-use-lib64.patch
bf760f
# Use more general default values in openssl.cnf
bf760f
Patch2: 0002-Use-more-general-default-values-in-openssl.cnf.patch
bf760f
# Do not install html docs
bf760f
Patch3: 0003-Do-not-install-html-docs.patch
bf760f
# Override default paths for the CA directory tree
bf760f
Patch4: 0004-Override-default-paths-for-the-CA-directory-tree.patch
bf760f
# apps/ca: fix md option help text
bf760f
Patch5: 0005-apps-ca-fix-md-option-help-text.patch
bf760f
# Disable signature verification with totally unsafe hash algorithms
bf760f
Patch6: 0006-Disable-signature-verification-with-totally-unsafe-h.patch
bf760f
# Add support for PROFILE=SYSTEM system default cipherlist
bf760f
Patch7: 0007-Add-support-for-PROFILE-SYSTEM-system-default-cipher.patch
bf760f
# Add FIPS_mode() compatibility macro
bf760f
Patch8: 0008-Add-FIPS_mode-compatibility-macro.patch
bf760f
# Add check to see if fips flag is enabled in kernel
bf760f
Patch9: 0009-Add-Kernel-FIPS-mode-flag-support.patch
bf760f
# remove unsupported EC curves
bf760f
Patch11: 0011-Remove-EC-curves.patch
bf760f
# Disable explicit EC curves
727bdf
# https://bugzilla.redhat.com/show_bug.cgi?id=2066412
bf760f
Patch12: 0012-Disable-explicit-ec.patch
727bdf
# https://github.com/openssl/openssl/pull/17981
727bdf
Patch13: 0013-FIPS-provider-explicit-ec.patch
727bdf
# https://github.com/openssl/openssl/pull/17998
727bdf
Patch14: 0014-FIPS-disable-explicit-ec.patch
727bdf
# https://github.com/openssl/openssl/pull/18609
727bdf
Patch15: 0015-FIPS-decoded-from-explicit.patch
bf760f
# Instructions to load legacy provider in openssl.cnf
bf760f
Patch24: 0024-load-legacy-prov.patch
bf760f
# Tmp: test name change
bf760f
Patch31: 0031-tmp-Fix-test-names.patch
bf760f
# We load FIPS provider and set FIPS properties implicitly
bf760f
Patch32: 0032-Force-fips.patch
bf760f
# Embed HMAC into the fips.so
bf760f
Patch33: 0033-FIPS-embed-hmac.patch
bf760f
# Comment out fipsinstall command-line utility
bf760f
Patch34: 0034.fipsinstall_disable.patch
bf760f
# Skip unavailable algorithms running `openssl speed`
bf760f
Patch35: 0035-speed-skip-unavailable-dgst.patch
727bdf
# Extra public/private key checks required by FIPS-140-3
727bdf
Patch44: 0044-FIPS-140-3-keychecks.patch
bf760f
# Minimize fips services
bf760f
Patch45: 0045-FIPS-services-minimize.patch
bf760f
# Backport of s390x hardening, https://github.com/openssl/openssl/pull/17486
bf760f
Patch46: 0046-FIPS-s390x-hardening.patch
bf760f
# Execute KATS before HMAC verification
bf760f
Patch47: 0047-FIPS-early-KATS.patch
bf760f
# Backport of correctly handle 2^14 byte long records #17538
bf760f
Patch48: 0048-correctly-handle-records.patch
bf760f
# Selectively disallow SHA1 signatures
bf760f
Patch49: 0049-Selectively-disallow-SHA1-signatures.patch
bf760f
# https://bugzilla.redhat.com/show_bug.cgi?id=2049265
bf760f
Patch50: 0050-FIPS-enable-pkcs12-mac.patch
bf760f
# Backport of patch for RHEL for Edge rhbz #2027261
bf760f
Patch51: 0051-Support-different-R_BITS-lengths-for-KBKDF.patch
bf760f
# Allow SHA1 in seclevel 2 if rh-allow-sha1-signatures = yes
bf760f
Patch52: 0052-Allow-SHA1-in-seclevel-2-if-rh-allow-sha1-signatures.patch
bf760f
# CVE 2022-0778
bf760f
Patch53: 0053-CVE-2022-0778.patch
727bdf
# https://bugzilla.redhat.com/show_bug.cgi?id=2004915, backport of 2c0f7d46b8449423446cfe1e52fc1e1ecd506b62
727bdf
Patch54: 0054-Replace-size-check-with-more-meaningful-pubkey-check.patch
021e03
# https://github.com/openssl/openssl/pull/17324
021e03
Patch55: 0055-nonlegacy-fetch-null-deref.patch
021e03
# https://github.com/openssl/openssl/pull/18103
021e03
Patch56: 0056-strcasecmp.patch
021e03
# https://github.com/openssl/openssl/pull/18175
021e03
Patch57: 0057-strcasecmp-fix.patch
727bdf
# https://bugzilla.redhat.com/show_bug.cgi?id=2053289
727bdf
Patch58: 0058-FIPS-limit-rsa-encrypt.patch
727bdf
# https://bugzilla.redhat.com/show_bug.cgi?id=2069235
727bdf
Patch60: 0060-FIPS-KAT-signature-tests.patch
727bdf
# https://bugzilla.redhat.com/show_bug.cgi?id=2087147
727bdf
Patch61: 0061-Deny-SHA-1-signature-verification-in-FIPS-provider.patch
727bdf
Patch62: 0062-fips-Expose-a-FIPS-indicator.patch
727bdf
# https://github.com/openssl/openssl/pull/18141
727bdf
Patch63: 0063-CVE-2022-1473.patch
727bdf
# upstream commits 55c80c222293a972587004c185dc5653ae207a0e 2eda98790c5c2741d76d23cc1e74b0dc4f4b391a
727bdf
Patch64: 0064-CVE-2022-1343.diff
727bdf
# upstream commit 1ad73b4d27bd8c1b369a3cd453681d3a4f1bb9b2
727bdf
Patch65: 0065-CVE-2022-1292.patch
727bdf
# https://github.com/openssl/openssl/pull/18444
727bdf
# https://github.com/openssl/openssl/pull/18467
727bdf
Patch66: 0066-replace-expired-certs.patch
727bdf
# https://github.com/openssl/openssl/pull/18512
727bdf
Patch67: 0067-fix-ppc64-montgomery.patch
727bdf
#https://github.com/openssl/openssl/commit/2c9c35870601b4a44d86ddbf512b38df38285cfa
727bdf
#https://github.com/openssl/openssl/commit/8a3579a7b7067a983e69a4eda839ac408c120739
727bdf
Patch68: 0068-CVE-2022-2068.patch
727bdf
# https://github.com/openssl/openssl/commit/a98f339ddd7e8f487d6e0088d4a9a42324885a93
727bdf
# https://github.com/openssl/openssl/commit/52d50d52c2f1f4b70d37696bfa74fe5e581e7ba8
727bdf
Patch69: 0069-CVE-2022-2097.patch
727bdf
# https://github.com/openssl/openssl/commit/edceec7fe0c9a5534ae155c8398c63dd7dd95483
727bdf
Patch70: 0070-EVP_PKEY_Q_keygen-Call-OPENSSL_init_crypto-to-init-s.patch
727bdf
# https://github.com/openssl/openssl/commit/44a563dde1584cd9284e80b6e45ee5019be8d36c
727bdf
# https://github.com/openssl/openssl/commit/345c99b6654b8313c792d54f829943068911ddbd
727bdf
Patch71: 0071-AES-GCM-performance-optimization.patch
727bdf
# https://github.com/openssl/openssl/commit/f596bbe4da779b56eea34d96168b557d78e1149
727bdf
# https://github.com/openssl/openssl/commit/7e1f3ffcc5bc15fb9a12b9e3bb202f544c6ed5aa
727bdf
# hunks in crypto/ppccap.c from https://github.com/openssl/openssl/commit/f5485b97b6c9977c0d39c7669b9f97a879312447
727bdf
Patch72: 0072-ChaCha20-performance-optimizations-for-ppc64le.patch
727bdf
# https://bugzilla.redhat.com/show_bug.cgi?id=2102535
727bdf
Patch73: 0073-FIPS-Use-OAEP-in-KATs-support-fixed-OAEP-seed.patch
727bdf
# https://bugzilla.redhat.com/show_bug.cgi?id=2102535
727bdf
Patch74: 0074-FIPS-Use-digest_sign-digest_verify-in-self-test.patch
727bdf
# https://bugzilla.redhat.com/show_bug.cgi?id=2102535
727bdf
Patch75: 0075-FIPS-Use-FFDHE2048-in-self-test.patch
727bdf
# Downstream only. Reseed DRBG using getrandom(GRND_RANDOM)
727bdf
# https://bugzilla.redhat.com/show_bug.cgi?id=2102541
727bdf
Patch76: 0076-FIPS-140-3-DRBG.patch
727bdf
# https://bugzilla.redhat.com/show_bug.cgi?id=2102542
727bdf
Patch77: 0077-FIPS-140-3-zeroization.patch
727bdf
# https://bugzilla.redhat.com/show_bug.cgi?id=2114772
727bdf
Patch78: 0078-Add-FIPS-indicator-parameter-to-HKDF.patch
bf760f
bf760f
License: ASL 2.0
bf760f
URL: http://www.openssl.org/
bf760f
BuildRequires: gcc g++
bf760f
BuildRequires: coreutils, perl-interpreter, sed, zlib-devel, /usr/bin/cmp
bf760f
BuildRequires: lksctp-tools-devel
bf760f
BuildRequires: /usr/bin/rename
bf760f
BuildRequires: /usr/bin/pod2man
bf760f
BuildRequires: /usr/sbin/sysctl
bf760f
BuildRequires: perl(Test::Harness), perl(Test::More), perl(Math::BigInt)
bf760f
BuildRequires: perl(Module::Load::Conditional), perl(File::Temp)
bf760f
BuildRequires: perl(Time::HiRes), perl(IPC::Cmd), perl(Pod::Html), perl(Digest::SHA)
bf760f
BuildRequires: perl(FindBin), perl(lib), perl(File::Compare), perl(File::Copy), perl(bigint)
bf760f
BuildRequires: git-core
bf760f
Requires: coreutils
bf760f
Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
bf760f
bf760f
%description
bf760f
The OpenSSL toolkit provides support for secure communications between
bf760f
machines. OpenSSL includes a certificate management tool and shared
bf760f
libraries which provide various cryptographic algorithms and
bf760f
protocols.
bf760f
bf760f
%package libs
bf760f
Summary: A general purpose cryptography library with TLS implementation
bf760f
Requires: ca-certificates >= 2008-5
bf760f
Requires: crypto-policies >= 20180730
bf760f
Recommends: openssl-pkcs11%{?_isa}
bf760f
bf760f
%description libs
bf760f
OpenSSL is a toolkit for supporting cryptography. The openssl-libs
bf760f
package contains the libraries that are used by various applications which
bf760f
support cryptographic algorithms and protocols.
bf760f
bf760f
%package devel
bf760f
Summary: Files for development of applications which will use OpenSSL
bf760f
Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
bf760f
Requires: pkgconfig
bf760f
bf760f
%description devel
bf760f
OpenSSL is a toolkit for supporting cryptography. The openssl-devel
bf760f
package contains include files needed to develop applications which
bf760f
support various cryptographic algorithms and protocols.
bf760f
bf760f
%package perl
bf760f
Summary: Perl scripts provided with OpenSSL
bf760f
Requires: perl-interpreter
bf760f
Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release}
bf760f
bf760f
%description perl
bf760f
OpenSSL is a toolkit for supporting cryptography. The openssl-perl
bf760f
package provides Perl scripts for converting certificates and keys
bf760f
from other formats to the formats used by the OpenSSL toolkit.
bf760f
bf760f
%prep
bf760f
%autosetup -S git -n %{name}-%{version}
bf760f
bf760f
# The hobble_openssl is called here redundantly, just to be sure.
bf760f
# The tarball has already the sources removed.
bf760f
%{SOURCE1} > /dev/null
bf760f
bf760f
cp %{SOURCE12} crypto/ec/
bf760f
cp %{SOURCE13} test/
bf760f
bf760f
%build
bf760f
# Figure out which flags we want to use.
bf760f
# default
bf760f
sslarch=%{_os}-%{_target_cpu}
bf760f
%ifarch %ix86
bf760f
sslarch=linux-elf
bf760f
if ! echo %{_target} | grep -q i686 ; then
bf760f
	sslflags="no-asm 386"
bf760f
fi
bf760f
%endif
bf760f
%ifarch x86_64
bf760f
sslflags=enable-ec_nistp_64_gcc_128
bf760f
%endif
bf760f
%ifarch sparcv9
bf760f
sslarch=linux-sparcv9
bf760f
sslflags=no-asm
bf760f
%endif
bf760f
%ifarch sparc64
bf760f
sslarch=linux64-sparcv9
bf760f
sslflags=no-asm
bf760f
%endif
bf760f
%ifarch alpha alphaev56 alphaev6 alphaev67
bf760f
sslarch=linux-alpha-gcc
bf760f
%endif
bf760f
%ifarch s390 sh3eb sh4eb
bf760f
sslarch="linux-generic32 -DB_ENDIAN"
bf760f
%endif
bf760f
%ifarch s390x
bf760f
sslarch="linux64-s390x"
bf760f
%endif
bf760f
%ifarch %{arm}
bf760f
sslarch=linux-armv4
bf760f
%endif
bf760f
%ifarch aarch64
bf760f
sslarch=linux-aarch64
bf760f
sslflags=enable-ec_nistp_64_gcc_128
bf760f
%endif
bf760f
%ifarch sh3 sh4
bf760f
sslarch=linux-generic32
bf760f
%endif
bf760f
%ifarch ppc64 ppc64p7
bf760f
sslarch=linux-ppc64
bf760f
%endif
bf760f
%ifarch ppc64le
bf760f
sslarch="linux-ppc64le"
bf760f
sslflags=enable-ec_nistp_64_gcc_128
bf760f
%endif
bf760f
%ifarch mips mipsel
bf760f
sslarch="linux-mips32 -mips32r2"
bf760f
%endif
bf760f
%ifarch mips64 mips64el
bf760f
sslarch="linux64-mips64 -mips64r2"
bf760f
%endif
bf760f
%ifarch mips64el
bf760f
sslflags=enable-ec_nistp_64_gcc_128
bf760f
%endif
bf760f
%ifarch riscv64
bf760f
sslarch=linux-generic64
bf760f
%endif
bf760f
bf760f
# Add -Wa,--noexecstack here so that libcrypto's assembler modules will be
bf760f
# marked as not requiring an executable stack.
bf760f
# Also add -DPURIFY to make using valgrind with openssl easier as we do not
bf760f
# want to depend on the uninitialized memory as a source of entropy anyway.
bf760f
RPM_OPT_FLAGS="$RPM_OPT_FLAGS -Wa,--noexecstack -Wa,--generate-missing-build-notes=yes -DPURIFY $RPM_LD_FLAGS"
bf760f
bf760f
export HASHBANGPERL=/usr/bin/perl
bf760f
727bdf
%define fips %{version}-%{srpmhash}
bf760f
# ia64, x86_64, ppc are OK by default
bf760f
# Configure the build tree.  Override OpenSSL defaults with known-good defaults
bf760f
# usable on all platforms.  The Configure script already knows to use -fPIC and
bf760f
# RPM_OPT_FLAGS, so we can skip specifiying them here.
bf760f
./Configure \
bf760f
	--prefix=%{_prefix} --openssldir=%{_sysconfdir}/pki/tls ${sslflags} \
bf760f
	--system-ciphers-file=%{_sysconfdir}/crypto-policies/back-ends/openssl.config \
bf760f
	zlib enable-camellia enable-seed enable-rfc3779 enable-sctp \
bf760f
	enable-cms enable-md2 enable-rc5 enable-ktls enable-fips\
bf760f
	no-mdc2 no-ec2m no-sm2 no-sm4 enable-buildtest-c++\
bf760f
	shared  ${sslarch} $RPM_OPT_FLAGS '-DDEVRANDOM="\"/dev/urandom\"" -DREDHAT_FIPS_VERSION="\"%{fips}\""'
bf760f
bf760f
# Do not run this in a production package the FIPS symbols must be patched-in
bf760f
#util/mkdef.pl crypto update
bf760f
bf760f
make %{?_smp_mflags} all
bf760f
bf760f
# Clean up the .pc files
bf760f
for i in libcrypto.pc libssl.pc openssl.pc ; do
bf760f
  sed -i '/^Libs.private:/{s/-L[^ ]* //;s/-Wl[^ ]* //}' $i
bf760f
done
bf760f
bf760f
%check
bf760f
# Verify that what was compiled actually works.
bf760f
bf760f
# Hack - either enable SCTP AUTH chunks in kernel or disable sctp for check
bf760f
(sysctl net.sctp.addip_enable=1 && sysctl net.sctp.auth_enable=1) || \
bf760f
(echo 'Failed to enable SCTP AUTH chunks, disabling SCTP for tests...' &&
bf760f
 sed '/"msan" => "default",/a\ \ "sctp" => "default",' configdata.pm > configdata.pm.new && \
bf760f
 touch -r configdata.pm configdata.pm.new && \
bf760f
 mv -f configdata.pm.new configdata.pm)
bf760f
bf760f
# We must revert patch4 before tests otherwise they will fail
bf760f
patch -p1 -R < %{PATCH4}
bf760f
#We must disable default provider before tests otherwise they will fail
bf760f
patch -p1 < %{SOURCE14}
bf760f
bf760f
OPENSSL_ENABLE_MD5_VERIFY=
bf760f
export OPENSSL_ENABLE_MD5_VERIFY
bf760f
OPENSSL_ENABLE_SHA1_SIGNATURES=
bf760f
export OPENSSL_ENABLE_SHA1_SIGNATURES
bf760f
OPENSSL_SYSTEM_CIPHERS_OVERRIDE=xyz_nonexistent_file
bf760f
export OPENSSL_SYSTEM_CIPHERS_OVERRIDE
bf760f
#embed HMAC into fips provider for test run
bf760f
LD_LIBRARY_PATH=. apps/openssl dgst -binary -sha256 -mac HMAC -macopt hexkey:f4556650ac31d35461610bac4ed81b1a181b2d8a43ea2854cbae22ca74560813 < providers/fips.so > providers/fips.so.hmac
bf760f
objcopy --update-section .rodata1=providers/fips.so.hmac providers/fips.so providers/fips.so.mac
bf760f
mv providers/fips.so.mac providers/fips.so
bf760f
#run tests itself
bf760f
make test HARNESS_JOBS=8
bf760f
bf760f
# Add generation of HMAC checksum of the final stripped library
bf760f
# We manually copy standard definition of __spec_install_post
bf760f
# and add hmac calculation/embedding to fips.so
bf760f
%define __spec_install_post \
bf760f
    %{?__debug_package:%{__debug_install_post}} \
bf760f
    %{__arch_install_post} \
bf760f
    %{__os_install_post} \
bf760f
    LD_LIBRARY_PATH=. apps/openssl dgst -binary -sha256 -mac HMAC -macopt hexkey:f4556650ac31d35461610bac4ed81b1a181b2d8a43ea2854cbae22ca74560813 < $RPM_BUILD_ROOT%{_libdir}/ossl-modules/fips.so > $RPM_BUILD_ROOT%{_libdir}/ossl-modules/fips.so.hmac \
bf760f
    objcopy --update-section .rodata1=$RPM_BUILD_ROOT%{_libdir}/ossl-modules/fips.so.hmac $RPM_BUILD_ROOT%{_libdir}/ossl-modules/fips.so $RPM_BUILD_ROOT%{_libdir}/ossl-modules/fips.so.mac \
bf760f
    mv $RPM_BUILD_ROOT%{_libdir}/ossl-modules/fips.so.mac $RPM_BUILD_ROOT%{_libdir}/ossl-modules/fips.so \
bf760f
    rm $RPM_BUILD_ROOT%{_libdir}/ossl-modules/fips.so.hmac \
bf760f
%{nil}
bf760f
bf760f
%define __provides_exclude_from %{_libdir}/openssl
bf760f
bf760f
%install
bf760f
[ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT
bf760f
# Install OpenSSL.
bf760f
install -d $RPM_BUILD_ROOT{%{_bindir},%{_includedir},%{_libdir},%{_mandir},%{_libdir}/openssl,%{_pkgdocdir}}
bf760f
%make_install
bf760f
rename so.%{soversion} so.%{version} $RPM_BUILD_ROOT%{_libdir}/*.so.%{soversion}
bf760f
for lib in $RPM_BUILD_ROOT%{_libdir}/*.so.%{version} ; do
bf760f
	chmod 755 ${lib}
bf760f
	ln -s -f `basename ${lib}` $RPM_BUILD_ROOT%{_libdir}/`basename ${lib} .%{version}`
bf760f
	ln -s -f `basename ${lib}` $RPM_BUILD_ROOT%{_libdir}/`basename ${lib} .%{version}`.%{soversion}
bf760f
done
bf760f
bf760f
# Remove static libraries
bf760f
for lib in $RPM_BUILD_ROOT%{_libdir}/*.a ; do
bf760f
	rm -f ${lib}
bf760f
done
bf760f
bf760f
# Install a makefile for generating keys and self-signed certs, and a script
bf760f
# for generating them on the fly.
bf760f
mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/certs
bf760f
install -m644 %{SOURCE2} $RPM_BUILD_ROOT%{_pkgdocdir}/Makefile.certificate
bf760f
install -m755 %{SOURCE6} $RPM_BUILD_ROOT%{_bindir}/make-dummy-cert
bf760f
install -m755 %{SOURCE7} $RPM_BUILD_ROOT%{_bindir}/renew-dummy-cert
bf760f
bf760f
# Move runable perl scripts to bindir
bf760f
mv $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/misc/*.pl $RPM_BUILD_ROOT%{_bindir}
bf760f
mv $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/misc/tsget $RPM_BUILD_ROOT%{_bindir}
bf760f
bf760f
# Rename man pages so that they don't conflict with other system man pages.
bf760f
pushd $RPM_BUILD_ROOT%{_mandir}
bf760f
mv man5/config.5ossl man5/openssl.cnf.5
bf760f
popd
bf760f
bf760f
mkdir -m755 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA
bf760f
mkdir -m700 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA/private
bf760f
mkdir -m755 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA/certs
bf760f
mkdir -m755 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA/crl
bf760f
mkdir -m755 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA/newcerts
bf760f
bf760f
# Ensure the config file timestamps are identical across builds to avoid
bf760f
# mulitlib conflicts and unnecessary renames on upgrade
bf760f
touch -r %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/openssl.cnf
bf760f
touch -r %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/ct_log_list.cnf
bf760f
bf760f
rm -f $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/openssl.cnf.dist
bf760f
rm -f $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/ct_log_list.cnf.dist
bf760f
#we don't use native fipsmodule.cnf because FIPS module is loaded automatically
bf760f
rm -f $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/fipsmodule.cnf
bf760f
bf760f
# Determine which arch opensslconf.h is going to try to #include.
bf760f
basearch=%{_arch}
bf760f
%ifarch %{ix86}
bf760f
basearch=i386
bf760f
%endif
bf760f
%ifarch sparcv9
bf760f
basearch=sparc
bf760f
%endif
bf760f
%ifarch sparc64
bf760f
basearch=sparc64
bf760f
%endif
bf760f
bf760f
# Next step of gradual disablement of SSL3.
bf760f
# Make SSL3 disappear to newly built dependencies.
bf760f
sed -i '/^\#ifndef OPENSSL_NO_SSL_TRACE/i\
bf760f
#ifndef OPENSSL_NO_SSL3\
bf760f
# define OPENSSL_NO_SSL3\
bf760f
#endif' $RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf.h
bf760f
bf760f
%ifarch %{multilib_arches}
bf760f
# Do an configuration.h switcheroo to avoid file conflicts on systems where you
bf760f
# can have both a 32- and 64-bit version of the library, and they each need
bf760f
# their own correct-but-different versions of opensslconf.h to be usable.
bf760f
install -m644 %{SOURCE10} \
bf760f
	$RPM_BUILD_ROOT/%{_prefix}/include/openssl/configuration-${basearch}.h
bf760f
cat $RPM_BUILD_ROOT/%{_prefix}/include/openssl/configuration.h >> \
bf760f
	$RPM_BUILD_ROOT/%{_prefix}/include/openssl/configuration-${basearch}.h
bf760f
install -m644 %{SOURCE9} \
bf760f
	$RPM_BUILD_ROOT/%{_prefix}/include/openssl/configuration.h
bf760f
%endif
bf760f
bf760f
%files
bf760f
%{!?_licensedir:%global license %%doc}
bf760f
%license LICENSE.txt
bf760f
%doc NEWS.md README.md
bf760f
%{_bindir}/make-dummy-cert
bf760f
%{_bindir}/renew-dummy-cert
bf760f
%{_bindir}/openssl
bf760f
%{_mandir}/man1/*
bf760f
%{_mandir}/man5/*
bf760f
%{_mandir}/man7/*
bf760f
%{_pkgdocdir}/Makefile.certificate
bf760f
%exclude %{_mandir}/man1/*.pl*
bf760f
%exclude %{_mandir}/man1/tsget*
bf760f
bf760f
%files libs
bf760f
%{!?_licensedir:%global license %%doc}
bf760f
%license LICENSE.txt
bf760f
%dir %{_sysconfdir}/pki/tls
bf760f
%dir %{_sysconfdir}/pki/tls/certs
bf760f
%dir %{_sysconfdir}/pki/tls/misc
bf760f
%dir %{_sysconfdir}/pki/tls/private
bf760f
%config(noreplace) %{_sysconfdir}/pki/tls/openssl.cnf
bf760f
%config(noreplace) %{_sysconfdir}/pki/tls/ct_log_list.cnf
bf760f
%attr(0755,root,root) %{_libdir}/libcrypto.so.%{version}
bf760f
%{_libdir}/libcrypto.so.%{soversion}
bf760f
%attr(0755,root,root) %{_libdir}/libssl.so.%{version}
bf760f
%{_libdir}/libssl.so.%{soversion}
bf760f
%attr(0755,root,root) %{_libdir}/engines-%{soversion}
bf760f
%attr(0755,root,root) %{_libdir}/ossl-modules
bf760f
bf760f
%files devel
bf760f
%doc CHANGES.md doc/dir-locals.example.el doc/openssl-c-indent.el
bf760f
%{_prefix}/include/openssl
bf760f
%{_libdir}/*.so
bf760f
%{_mandir}/man3/*
bf760f
%{_libdir}/pkgconfig/*.pc
bf760f
bf760f
%files perl
bf760f
%{_bindir}/c_rehash
bf760f
%{_bindir}/*.pl
bf760f
%{_bindir}/tsget
bf760f
%{_mandir}/man1/*.pl*
bf760f
%{_mandir}/man1/tsget*
bf760f
%dir %{_sysconfdir}/pki/CA
bf760f
%dir %{_sysconfdir}/pki/CA/private
bf760f
%dir %{_sysconfdir}/pki/CA/certs
bf760f
%dir %{_sysconfdir}/pki/CA/crl
bf760f
%dir %{_sysconfdir}/pki/CA/newcerts
bf760f
bf760f
%ldconfig_scriptlets libs
bf760f
bf760f
%changelog
727bdf
* Thu Aug 11 2022 Clemens Lang <cllang@redhat.com> - 1:3.0.1-41
727bdf
- Zeroize public keys as required by FIPS 140-3
727bdf
  Resolves: rhbz#2115861
727bdf
- Add FIPS indicator for HKDF
727bdf
  Resolves: rhbz#2118388
727bdf
727bdf
* Fri Aug 05 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.1-40
727bdf
- Deal with DH keys in FIPS mode according FIPS-140-3 requirements
727bdf
  Related: rhbz#2115856
727bdf
- Deal with ECDH keys in FIPS mode according FIPS-140-3 requirements
727bdf
  Related: rhbz#2115857
727bdf
- Use signature for RSA pairwise test according FIPS-140-3 requirements
727bdf
  Related: rhbz#2115858
727bdf
- Reseed all the parent DRBGs in chain on reseeding a DRBG
727bdf
  Related: rhbz#2115859
727bdf
- Zeroization according to FIPS-140-3 requirements
727bdf
  Related: rhbz#2115861
727bdf
727bdf
* Mon Aug 01 2022 Clemens Lang <cllang@redhat.com> - 1:3.0.1-39
727bdf
- Use RSA-OAEP in FIPS RSA encryption/decryption FIPS self-test
727bdf
- Use Use digest_sign & digest_verify in FIPS signature self test
727bdf
- Use FFDHE2048 in Diffie-Hellman FIPS self-test
727bdf
  Resolves: rhbz#2112978
727bdf
727bdf
* Thu Jul 14 2022 Clemens Lang <cllang@redhat.com> - 1:3.0.1-38
727bdf
- Fix segfault in EVP_PKEY_Q_keygen() when OpenSSL was not previously
727bdf
  initialized.
727bdf
  Resolves: rhbz#2107530
727bdf
- Improve AES-GCM performance on Power9 and Power10 ppc64le
727bdf
  Resolves: rhbz#2103044
727bdf
- Improve ChaCha20 performance on Power10 ppc64le
727bdf
  Resolves: rhbz#2103044
727bdf
727bdf
* Tue Jul 05 2022 Clemens Lang <cllang@redhat.com> - 1:3.0.1-37
727bdf
- CVE-2022-2097: AES OCB fails to encrypt some bytes on 32-bit x86
727bdf
  Resolves: CVE-2022-2097
727bdf
727bdf
* Thu Jun 16 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.1-36
727bdf
- Ciphersuites with RSAPSK KX should be filterd in FIPS mode
727bdf
- Related: rhbz#2091994
727bdf
- FIPS provider should block RSA encryption for key transport.
727bdf
- Other RSA encryption options should still be available if key length is enough
727bdf
- Related: rhbz#2091977
727bdf
- Improve diagnostics when passing unsupported groups in TLS
727bdf
- Related: rhbz#2086554
727bdf
- Fix PPC64 Montgomery multiplication bug
727bdf
- Related: rhbz#2101346
727bdf
- Strict certificates validation shouldn't allow explicit EC parameters
727bdf
- Related: rhbz#2085521
727bdf
- CVE-2022-2068: the c_rehash script allows command injection
727bdf
- Related: rhbz#2098276
727bdf
727bdf
* Wed Jun 08 2022 Clemens Lang <cllang@redhat.com> - 1:3.0.1-35
727bdf
- Add explicit indicators for signatures in FIPS mode and mark signature
727bdf
  primitives as unapproved.
727bdf
  Resolves: rhbz#2087234
727bdf
727bdf
* Fri Jun 03 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.1-34
727bdf
- Some OpenSSL test certificates are expired, updating
727bdf
- Resolves: rhbz#2095696
727bdf
727bdf
* Thu May 26 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.1-33
727bdf
- CVE-2022-1473 openssl: OPENSSL_LH_flush() breaks reuse of memory
727bdf
- Resolves: rhbz#2089443
727bdf
- CVE-2022-1343 openssl: Signer certificate verification returned
727bdf
  inaccurate response when using OCSP_NOCHECKS
727bdf
- Resolves: rhbz#2089439
727bdf
- CVE-2022-1292 openssl: c_rehash script allows command injection
727bdf
- Resolves: rhbz#2090361
727bdf
- Revert "Disable EVP_PKEY_sign/EVP_PKEY_verify in FIPS mode"
727bdf
  Related: rhbz#2087234
727bdf
- Use KAT for ECDSA signature tests, s390 arch
727bdf
- Resolves: rhbz#2086866
727bdf
727bdf
* Thu May 19 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.1-32
727bdf
- `openssl ecparam -list_curves` lists only FIPS-approved curves in FIPS mode
727bdf
- Resolves: rhbz#2091929
727bdf
- Ciphersuites with RSA KX should be filterd in FIPS mode
727bdf
- Related: rhbz#2091994
727bdf
- In FIPS mode, signature verification works with keys of arbitrary size
727bdf
  above 2048 bit, and only with 1024, 1280, 1536, 1792 bits for keys
727bdf
  below 2048 bits
727bdf
- Resolves: rhbz#2091938
727bdf
727bdf
* Wed May 18 2022 Clemens Lang <cllang@redhat.com> - 1:3.0.1-31
727bdf
- Disable SHA-1 signature verification in FIPS mode
727bdf
- Disable EVP_PKEY_sign/EVP_PKEY_verify in FIPS mode
727bdf
  Resolves: rhbz#2087234
727bdf
727bdf
* Mon May 16 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.1-30
727bdf
- Use KAT for ECDSA signature tests
727bdf
- Resolves: rhbz#2086866
727bdf
727bdf
* Thu May 12 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.1-29
727bdf
- `-config` argument of openssl app should work properly in FIPS mode
727bdf
- Resolves: rhbz#2085500
727bdf
- openssl req defaults on PKCS#8 encryption changed to AES-256-CBC
727bdf
- Resolves: rhbz#2085499
727bdf
727bdf
* Fri May 06 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.1-28
727bdf
- OpenSSL should not accept custom elliptic curve parameters
727bdf
- Resolves rhbz#2085508
727bdf
- OpenSSL should not accept explicit curve parameters in FIPS mode
727bdf
- Resolves rhbz#2085521
727bdf
727bdf
* Fri May 06 2022 Clemens Lang <cllang@redhat.com> - 1:3.0.1-27
727bdf
- Change FIPS module version to include hash of specfile, patches and sources
727bdf
  Resolves: rhbz#2082585
727bdf
727bdf
* Thu May 05 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.1-26
727bdf
- OpenSSL FIPS module should not build in non-approved algorithms
727bdf
  Resolves: rhbz#2082584
727bdf
727bdf
* Mon May 02 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.1-25
727bdf
- FIPS provider should block RSA encryption for key transport.
727bdf
- Other RSA encryption options should still be available
727bdf
- Resolves: rhbz#2053289
727bdf
727bdf
* Mon May 02 2022 Clemens Lang <cllang@redhat.com> - 1:3.0.1-24
727bdf
- Fix occasional internal error in TLS when DHE is used
727bdf
  Resolves: rhbz#2080323
727bdf
021e03
* Tue Apr 26 2022 Clemens Lang <cllang@redhat.com> - 1:3.0.1-23
021e03
- Update missing initialization patch with feedback from upstream
021e03
  Resolves: rhbz#2076654
021e03
021e03
* Fri Apr 22 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.1-22
021e03
- Invocation of the missing initialization
021e03
- Resolves: rhbz#2076654
021e03
021e03
* Wed Apr 20 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.1-21
021e03
- Fix openssl curl error with LANG=tr_TR.utf8
021e03
- Resolves: rhbz#2076654
021e03
bf760f
* Fri Mar 18 2022 Clemens Lang <cllang@redhat.com> - 1:3.0.1-20
bf760f
- Fix acceptance of SHA-1 certificates with rh-allow-sha1-signatures = yes when
bf760f
  no OpenSSL library context is set
bf760f
- Resolves: rhbz#2063306
bf760f
bf760f
* Fri Mar 18 2022 Clemens Lang <cllang@redhat.com> - 1:3.0.1-19
bf760f
- Fix TLS connections with SHA1 signatures if rh-allow-sha1-signatures = yes
bf760f
- Resolves: rhbz#2063306
bf760f
bf760f
* Wed Mar 16 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.1-18
bf760f
- CVE-2022-0778 fix
bf760f
- Resolves: rhbz#2062314
bf760f
bf760f
* Thu Mar 10 2022 Clemens Lang <cllang@redhat.com> - 1:3.0.1-15.1
bf760f
- Fix invocation of EVP_PKEY_CTX_set_rsa_padding(RSA_PKCS1_PSS_PADDING) before
bf760f
  setting an allowed digest with EVP_PKEY_CTX_set_signature_md()
bf760f
- Resolves: rhbz#2061607
bf760f
bf760f
* Tue Mar 01 2022 Clemens Lang <cllang@redhat.com> - 1:3.0.1-14.1
bf760f
- Allow SHA1 in SECLEVEL 2 if rh-allow-sha1-signatures = yes
bf760f
- Resolves: rhbz#2031742
bf760f
bf760f
* Fri Feb 25 2022 Clemens Lang <cllang@redhat.com> - 1:3.0.1-14
bf760f
- Prevent use of SHA1 with ECDSA
bf760f
- Resolves: rhbz#2031742
bf760f
bf760f
* Fri Feb 25 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.1-13
bf760f
- OpenSSL will generate keys with prime192v1 curve if it is provided using explicit parameters
bf760f
- Resolves: rhbz#1977867
bf760f
bf760f
* Thu Feb 24 2022 Peter Robinson <pbrobinson@fedoraproject.org> - 1:3.0.1-12
bf760f
- Support KBKDF (NIST SP800-108) with an R value of 8bits
bf760f
- Resolves: rhbz#2027261
bf760f
bf760f
* Wed Feb 23 2022 Clemens Lang <cllang@redhat.com> - 1:3.0.1-11
bf760f
- Allow SHA1 usage in MGF1 for RSASSA-PSS signatures
bf760f
- Resolves: rhbz#2031742
bf760f
bf760f
* Wed Feb 23 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.1-10
bf760f
- rebuilt
bf760f
bf760f
* Tue Feb 22 2022 Clemens Lang <cllang@redhat.com> - 1:3.0.1-9
bf760f
- Allow SHA1 usage in HMAC in TLS
bf760f
- Resolves: rhbz#2031742
bf760f
bf760f
* Tue Feb 22 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.1-8
bf760f
- OpenSSL will generate keys with prime192v1 curve if it is provided using explicit parameters
bf760f
- Resolves: rhbz#1977867
bf760f
- pkcs12 export broken in FIPS mode
bf760f
- Resolves: rhbz#2049265
bf760f
bf760f
* Tue Feb 22 2022 Clemens Lang <cllang@redhat.com> - 1:3.0.1-8
bf760f
- Disable SHA1 signature creation and verification by default
bf760f
- Set rh-allow-sha1-signatures = yes to re-enable
bf760f
- Resolves: rhbz#2031742
bf760f
bf760f
* Thu Feb 03 2022 Sahana Prasad <sahana@redhat.com> - 1:3.0.1-7
bf760f
- s_server: correctly handle 2^14 byte long records
bf760f
- Resolves: rhbz#2042011
bf760f
bf760f
* Tue Feb 01 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.1-6
bf760f
- Adjust FIPS provider version
bf760f
- Related: rhbz#2026445
bf760f
bf760f
* Wed Jan 26 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.1-5
bf760f
- On the s390x, zeroize all the copies of TLS premaster secret
bf760f
- Related: rhbz#2040448
bf760f
bf760f
* Fri Jan 21 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.1-4
bf760f
- rebuilt
bf760f
bf760f
* Fri Jan 21 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.1-3
bf760f
- KATS tests should be executed before HMAC verification
bf760f
- Restoring fips=yes for SHA1
bf760f
- Related: rhbz#2026445, rhbz#2041994
bf760f
bf760f
* Thu Jan 20 2022 Sahana Prasad <sahana@redhat.com> - 1:3.0.1-2
bf760f
- Add enable-buildtest-c++ to the configure options.
bf760f
- Related: rhbz#1990814
bf760f
bf760f
* Tue Jan 18 2022 Sahana Prasad <sahana@redhat.com> - 1:3.0.1-1
bf760f
- Rebase to upstream version 3.0.1
bf760f
- Fixes CVE-2021-4044 Invalid handling of X509_verify_cert() internal errors in libssl
bf760f
- Resolves: rhbz#2038910, rhbz#2035148
bf760f
bf760f
* Mon Jan 17 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.0-7
bf760f
- Remove algorithms we don't plan to certify from fips module
bf760f
- Remove native fipsmodule.cnf
bf760f
- Related: rhbz#2026445
bf760f
bf760f
* Tue Dec 21 2021 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.0-6
bf760f
- openssl speed should run in FIPS mode
bf760f
- Related: rhbz#1977318
bf760f
bf760f
* Wed Nov 24 2021 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.0-5
bf760f
- rebuilt for spec cleanup
bf760f
- Related: rhbz#1985362
bf760f
bf760f
* Thu Nov 18 2021 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.0-4
bf760f
- Embed FIPS HMAC in fips.so
bf760f
- Enforce loading FIPS provider when FIPS kernel flag is on
bf760f
- Related: rhbz#1985362
bf760f
bf760f
* Thu Oct 07 2021 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.0-3
bf760f
- Fix memory leak in s_client
bf760f
- Related: rhbz#1996092
bf760f
bf760f
* Mon Sep 20 2021 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.0-2
bf760f
- Avoid double-free on error seeding the RNG.
bf760f
- KTLS and FIPS may interfere, so tests need to be tuned
bf760f
- Resolves: rhbz#1952844, rhbz#1961643
bf760f
bf760f
* Thu Sep 09 2021 Sahana Prasad <sahana@redhat.com> - 1:3.0.0-1
bf760f
- Rebase to upstream version 3.0.0
bf760f
- Related: rhbz#1990814
bf760f
bf760f
* Wed Aug 25 2021 Sahana Prasad <sahana@redhat.com> - 1:3.0.0-0.beta2.7
bf760f
- Removes the dual-abi build as it not required anymore. The mass rebuild
bf760f
  was completed and all packages are rebuilt against Beta version.
bf760f
- Resolves: rhbz#1984097
bf760f
bf760f
* Mon Aug 23 2021 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.0-0.beta2.6
bf760f
- Correctly process CMS reading from /dev/stdin
bf760f
- Resolves: rhbz#1986315
bf760f
bf760f
* Mon Aug 16 2021 Sahana Prasad <sahana@redhat.com> - 3.0.0-0.beta2.5
bf760f
- Add instruction for loading legacy provider in openssl.cnf
bf760f
- Resolves: rhbz#1975836
bf760f
bf760f
* Mon Aug 16 2021 Sahana Prasad <sahana@redhat.com> - 3.0.0-0.beta2.4
bf760f
- Adds support for IDEA encryption.
bf760f
- Resolves: rhbz#1990602
bf760f
bf760f
* Tue Aug 10 2021 Sahana Prasad <sahana@redhat.com> - 3.0.0-0.beta2.3
bf760f
- Fixes core dump in openssl req -modulus
bf760f
- Fixes 'openssl req' to not ask for password when non-encrypted private key
bf760f
  is used
bf760f
- cms: Do not try to check binary format on stdin and -rctform fix
bf760f
- Resolves: rhbz#1988137, rhbz#1988468, rhbz#1988137
bf760f
bf760f
* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 1:3.0.0-0.beta2.2.1
bf760f
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
bf760f
  Related: rhbz#1991688
bf760f
bf760f
* Wed Aug 04 2021 Dmitry Belyavskiy <dbelyavs@redhat.com> - 3.0.0-0.beta2.2
bf760f
- When signature_algorithm extension is omitted, use more relevant alerts
bf760f
- Resolves: rhbz#1965017
bf760f
bf760f
* Tue Aug 03 2021 Sahana Prasad <sahana@redhat.com> 3.0.0-0.beta2.1
bf760f
- Rebase to upstream version beta2
bf760f
- Related: rhbz#1903209
bf760f
bf760f
* Thu Jul 22 2021 Sahana Prasad <sahana@redhat.com> 3.0.0-0.beta1.5
bf760f
- Prevents creation of duplicate cert entries in PKCS #12 files
bf760f
- Resolves: rhbz#1978670
bf760f
bf760f
* Wed Jul 21 2021 Sahana Prasad <sahana@redhat.com> 3.0.0-0.beta1.4
bf760f
- NVR bump to update to OpenSSL 3.0 Beta1
bf760f
bf760f
* Mon Jul 19 2021 Sahana Prasad <sahana@redhat.com> 3.0.0-0.beta1.3
bf760f
- Update patch dual-abi.patch to add the #define macros in implementation
bf760f
  files instead of public header files
bf760f
bf760f
* Wed Jul 14 2021 Sahana Prasad <sahana@redhat.com> 3.0.0-0.beta1.2
bf760f
- Removes unused patch dual-abi.patch
bf760f
bf760f
* Wed Jul 14 2021 Sahana Prasad <sahana@redhat.com> 3.0.0-0.beta1.1
bf760f
- Update to Beta1 version
bf760f
- Includes a patch to support dual-ABI, as Beta1 brekas ABI with alpha16
bf760f
bf760f
* Tue Jul 06 2021 Sahana Prasad <sahana@redhat.com> 3.0.0-0.alpha16.7
bf760f
- Fixes override of openssl_conf in openssl.cnf
bf760f
- Use AI_ADDRCONFIG only when explicit host name is given
bf760f
- Temporarily remove fipsmodule.cnf for arch i686
bf760f
- Fixes segmentation fault in BN_lebin2bn
bf760f
- Resolves: rhbz#1975847, rhbz#1976845, rhbz#1973477, rhbz#1975855
bf760f
bf760f
* Fri Jul 02 2021 Sahana Prasad <sahana@redhat.com> 3.0.0-0.alpha16.6
bf760f
- Adds FIPS mode compatibility patch (sahana@redhat.com)
bf760f
- Related: rhbz#1977318
bf760f
bf760f
* Fri Jul 02 2021 Sahana Prasad <sahana@redhat.com> 3.0.0-0.alpha16.5
bf760f
- Fixes system hang issue when booted in FIPS mode (sahana@redhat.com)
bf760f
- Temporarily disable downstream FIPS patches
bf760f
- Related: rhbz#1977318
bf760f
bf760f
* Fri Jun 11 2021 Mohan Boddu <mboddu@redhat.com> 3.0.0-0.alpha16.4
bf760f
- Speeding up building openssl (dbelyavs@redhat.com)
bf760f
  Resolves: rhbz#1903209
bf760f
bf760f
* Fri Jun 04 2021 Sahana Prasad <sahana@redhat.com> 3.0.0-0.alpha16.3
bf760f
- Fix reading SPKAC data from stdin
bf760f
- Fix incorrect OSSL_PKEY_PARAM_MAX_SIZE for ed25519 and ed448
bf760f
- Return 0 after cleanup in OPENSSL_init_crypto()
bf760f
- Cleanup the peer point formats on regotiation
bf760f
- Fix default digest to SHA256
bf760f
bf760f
* Thu May 27 2021 Sahana Prasad <sahana@redhat.com> 3.0.0-0.alpha16.2
bf760f
- Enable FIPS via config options
bf760f
bf760f
* Mon May 17 2021 Sahana Prasad <sahana@redhat.com> 3.0.0-0.alpha16.1
bf760f
- Update to alpha 16 version
bf760f
  Resolves: rhbz#1952901 openssl sends alert after orderly connection close
bf760f
bf760f
* Mon Apr 26 2021 Sahana Prasad <sahana@redhat.com> 3.0.0-0.alpha15.1
bf760f
- Update to alpha 15 version
bf760f
  Resolves: rhbz#1903209, rhbz#1952598, 
bf760f
bf760f
* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 1:3.0.0-0.alpha13.1.1
bf760f
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
bf760f
bf760f
* Fri Apr 09 2021 Sahana Prasad <sahana@redhat.com> 3.0.0-0.alpha13.1
bf760f
- Update to new major release OpenSSL 3.0.0 alpha 13
bf760f
  Resolves: rhbz#1903209