rpms/crypto-policies
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Update from upstream (de-perl, stop linting)

Browse Source 
- packaging: remove perl build-dependency, it's not needed anymore
- packaging: use newly introduced SKIP_LINTING=1
- packaging: drop stale workarounds

Resolves: RHEL-27850
This commit is contained in:
Alexander Sosedkin 2024-03-04 12:43:09 +01:00
parent a950d9ca32
commit ad330f5b47
2 changed files with 17 additions and 51 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

66
crypto-policies.spec
View File

@ -1,31 +1,9 @@
%global git_date 20240202
%global git_commit 283706dbc258f4ac0b19b3291bc18f9b691b222f
%global git_date 20240304
%global git_commit b1c706d663ae796caab6d1144668ba63ea84a28a
%{?git_commit:%global git_commit_hash %(c=%{git_commit}; echo ${c:0:7})}
%global _python_bytecompile_extra 0
# RSAMinSize vs RequiredRSASize vs nothing, remove when OpenSSH >= 9.1
%if 0%{?rhel} == 9
# RHEL-9: must be RequiredRSASize in RHEL >= 9.2, Conflicts-enforced,
%global MIN_RSA_NAME RequiredRSASize
%elif 0%{?rhel} == 10
# ELN: RequiredRSASize for openssh >= 9.0p1-5, RSAMinSize for >= 9.0p1-2
%if v"%(rpm -q openssh | head -n1)" >= v"openssh-9.0p1-5"
%global MIN_RSA_NAME RequiredRSASize
%elif v"%(rpm -q openssh | head -n1)" >= v"openssh-9.0p1-2"
%global MIN_RSA_NAME RSAMinSize
%else
%global MIN_RSA_NAME none
%endif
%else
# some other distro, follow autodetection which checks for openssh >= 9.1
%if v"%(rpm -q openssh | head -n1)" >= v"openssh-9.1"
%global MIN_RSA_NAME RequiredRSASize
%else
%global MIN_RSA_NAME none
%endif
%endif
Name: crypto-policies
Version: %{git_date}
Release: 1.git%{git_commit_hash}%{?dist}
@ -44,26 +22,19 @@ BuildRequires: asciidoc
BuildRequires: libxslt
BuildRequires: openssl
BuildRequires: nss-tools
BuildRequires: gnutls-utils >= 3.6.0
BuildRequires: gnutls-utils
BuildRequires: openssh-clients
BuildRequires: java-devel
BuildRequires: bind
BuildRequires: perl-interpreter
BuildRequires: perl-generators
BuildRequires: perl(File::pushd), perl(File::Temp), perl(File::Copy)
BuildRequires: perl(File::Which)
BuildRequires: python3-devel >= 3.6
BuildRequires: python3-devel >= 3.9
BuildRequires: python3-pytest
BuildRequires: make
Conflicts: openssl < 1:3.0.1-10
Conflicts: openssl-libs < 1:3.0.1-10
Conflicts: nss < 3.90.0
Conflicts: libreswan < 3.28
Conflicts: openssh < 8.7p1-24
%if 0%{?rhel} == 10
Conflicts: gnutls < 3.7.2-3
%else
Conflicts: gnutls < 3.7.6-22
%endif
%description
This package provides pre-built configuration files with
@ -91,12 +62,11 @@ to enable or disable the system FIPS mode.
%build
sed -i \
"s/MIN_RSA_DEFAULT = .*/MIN_RSA_DEFAULT = '%{MIN_RSA_NAME}'/" \
"s/MIN_RSA_DEFAULT = .*/MIN_RSA_DEFAULT = 'RequiredRSASize'/" \
python/policygenerators/openssh.py
grep "MIN_RSA_DEFAULT = '%{MIN_RSA_NAME}'" python/policygenerators/openssh.py
%if 0%{?rhel} == 10
# currently ELN 3.90-1 doesn't carry the TLS-REQUIRE-EMS patch
grep "MIN_RSA_DEFAULT = 'RequiredRSASize'" python/policygenerators/openssh.py
%if 0%{?rhel} == 11
# currently ELN NSS doesn't carry the TLS-REQUIRE-EMS patch
sed -i "s/'NSS_NO_TLS_REQUIRE_EMS', '0'/'NSS_NO_TLS_REQUIRE_EMS', '1'/" \
python/policygenerators/nss.py tests/nss.py
sed -i "s/:TLS-REQUIRE-EMS:/:/" tests/outputs/*FIPS*.txt
@ -141,16 +111,7 @@ done
%py_byte_compile %{__python3} %{buildroot}%{_datadir}/crypto-policies/python
%check
# RSAMinSize vs RequiredRSASize vs nothing, remove when OpenSSH >= 9.1
%if "%{MIN_RSA_NAME}" == "none"
sed -i '/RequiredRSASize .*/d' tests/outputs/*.txt
%elif "%{MIN_RSA_NAME}" == "RSAMinSize"
sed -i 's/RequiredRSASize/RSAMinSize/' tests/outputs/*.txt
%else
[ "%{MIN_RSA_NAME}" == "RequiredRSASize" ] || exit 7
%endif
make ON_RHEL9=1 test
make test SKIP_LINTING=1
%post -p <lua>
if not posix.access("%{_sysconfdir}/crypto-policies/config") then
@ -241,6 +202,11 @@ end
%{_mandir}/man8/fips-finish-install.8*
%changelog
* Mon Mar 04 2024 Alexander Sosedkin <asosedkin@redhat.com> - 20240304-1.gitb1c706d
- packaging: remove perl build-dependency, it's not needed anymore
- packaging: use newly introduced SKIP_LINTING=1
- packaging: drop stale workarounds
* Fri Feb 02 2024 Alexander Sosedkin <asosedkin@redhat.com> - 20240202-1.git283706d
- fips-finish-install: make sure ostree is detected in chroot
- fips-mode-setup: make sure ostree is detected in chroot

2
sources
View File

@ -1 +1 @@
SHA512 (crypto-policies-git283706d.tar.gz) = 7d25f1549e7c3dfbd47512f1c7f22baf6ed2a24b328d80150b5ed4adfcc6dcdd97e5a777429fa9d2aa82bdef554a147dccbd8e5247cd05bf4ac18eeaaabdcb20
SHA512 (crypto-policies-gitb1c706d.tar.gz) = 02817c3008d1d7a4533a2d15fbb09fe49bad7776325dd5cf752fc6c8284d45b8a180b88de0105b3ace489d18180b951f1fbf7e265a191d4e8082f980775150dd