rpms/crypto-policies
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Update from upstream (PQ by default, ...)

Browse Source 
- LEGACY/DEFAULT/FUTURE: enable hybrid ML-KEM and pure ML-DSA
- drop crypto-policies-pq-preview subpackage, TEST-PQ goes into main one
- NO-PQ: introduce
- openssl: fix enabling integrity-only ciphersuites (still need min_rsa_size=0)

Resolves: RHEL-86059
Related: RHEL-59104
This commit is contained in:
Alexander Sosedkin 2025-04-23 19:25:58 +02:00
parent 14129c6639
commit 20e322ef57
2 changed files with 13 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
crypto-policies.spec
View File

@ -1,12 +1,12 @@
%global git_date 20250404
%global git_commit ca0e9a587dba7a0a62153ad6e9541b18e453a31b
%global git_date 20250424
%global git_commit 9267deef3c75cf56ea61910287e1eab47454b208
%{?git_commit:%global git_commit_hash %(c=%{git_commit}; echo ${c:0:7})}
%global _python_bytecompile_extra 0
Name: crypto-policies
Version: %{git_date}
Release: 4.git%{git_commit_hash}%{?dist}
Release: 1.git%{git_commit_hash}%{?dist}
Summary: System-wide crypto policies
License: LGPL-2.1-or-later
@ -57,20 +57,6 @@ defined in simple policy definition files.
The package also provides a tool fips-mode-setup, which can be used
to enable or disable the system FIPS mode.
%package pq-preview
Summary: Post-quantum crypto-policies [Technology Preview]
Requires: %{name} = %{version}-%{release}
Requires: (oqsprovider or openssl >= 1:3.5)
%description pq-preview
This package TEST-PQ subpolicy policy with postquantum algorithms enabled.
It also depends on liboqs and oqs-provider to ensure they're installed.
This package is part of a Technology Preview.
Technology Preview features are not fully supported,
may not be functionally complete,
and are not suitable for deployment in production.
%prep
%setup -q -n fedora-crypto-policies-%{git_commit_hash}-%{git_commit}
%autopatch -p1
@ -86,7 +72,7 @@ sed -i "s/:TLS-REQUIRE-EMS:/:/" tests/outputs/*FIPS*.txt
%if 0%{?rhel} == 11
# currently ELN NSS doesn't support mlkem768secp256r1
sed -i '/P256-MLKEM768/d' python/policygenerators/nss.py
sed -i "s/:mlkem768secp256r1:/:/" tests/outputs/*:TEST-PQ-nss.txt
sed -i "s/:mlkem768secp256r1:/:/" tests/outputs/*-nss.txt
%endif
%make_build
@ -235,8 +221,9 @@ exit 0
%{_datarootdir}/crypto-policies/policies/modules/AD-SUPPORT.pmod
%{_datarootdir}/crypto-policies/policies/modules/ECDHE-ONLY.pmod
%{_datarootdir}/crypto-policies/policies/modules/NO-ENFORCE-EMS.pmod
%{_datarootdir}/crypto-policies/policies/modules/NO-PQ.pmod
%{_datarootdir}/crypto-policies/policies/modules/OSPP.pmod
# but not TEST-PQ
%{_datarootdir}/crypto-policies/policies/modules/TEST-PQ.pmod
%{_libexecdir}/fips-setup-helper
%{_libexecdir}/fips-crypto-policy-overlay
@ -249,11 +236,14 @@ exit 0
%{_mandir}/man8/update-crypto-policies.8*
%{_datarootdir}/crypto-policies/python
%files pq-preview
%{_datarootdir}/crypto-policies/policies/modules/TEST-PQ.pmod
%changelog
* Thu Apr 24 2025 Alexander Sosedkin <asosedkin@redhat.com> - 20250424-1.git9267dee
- LEGACY/DEFAULT/FUTURE: enable hybrid ML-KEM and pure ML-DSA
- drop crypto-policies-pq-preview subpackage, TEST-PQ goes into main one
- NO-PQ: introduce
- openssl: fix enabling integrity-only ciphersuites (still need min_rsa_size=0)
* Mon Apr 22 2025 Alexander Sosedkin <asosedkin@redhat.com> - 20250404-4.gitca0e9a5
- Fix accidental turning of oqsprovider BuildRequires into Requires
- Drop requires on liboqs

2
sources
View File

@ -1 +1 @@
SHA512 (crypto-policies-gitca0e9a5.tar.gz) = 8518aac01cde2a978bec78e27cc070c06d560b0efab9f40c37b91dfb865672b1cd5d222b7578fc06e86f93ca25e679f8064ffec16e3bca37cd82d140d5d86367
SHA512 (crypto-policies-git9267dee.tar.gz) = f647f8dc845ee79b3a9204642d01a4cd459a5b4476b364bd5702b6987bf2698304d7aefa7ac40b2cc9b7718b4781cfb12d688dc750144b9dc5529a41ef948024