.crypto-policies.metadata

@@ -1 +1 @@
-731e23be60f0b6183f8d37978c36a07377ebc47a SOURCES/crypto-policies-git3177e06.tar.gz
+cd143a381b920b2175b5faac4b0a9a03f2d9c541 SOURCES/crypto-policies-git21ffdc8.tar.gz

.gitignore

@@ -1 +1 @@
-SOURCES/crypto-policies-git3177e06.tar.gz
+SOURCES/crypto-policies-git21ffdc8.tar.gz

SPECS/crypto-policies.spec

@@ -1,18 +1,18 @@
-%global git_date 20230731
+%global git_date 20190613
-%global git_commit 3177e06c203c082d479760337c7cad65a4dcc81e
+%global git_commit_hash 21ffdc8
-%{?git_commit:%global git_commit_hash %(c=%{git_commit}; echo ${c:0:7})}
-
-%global _python_bytecompile_extra 0
 
 Name:           crypto-policies
 Version:        %{git_date}
 Release:        1.git%{git_commit_hash}%{?dist}
-Summary:        System-wide crypto policies
+Summary:        Systemwide crypto policies
 
 License:        LGPLv2+
 URL:            https://gitlab.com/redhat-crypto/fedora-crypto-policies
-# For RHEL-8 we use the upstream branch rhel8
+
-Source0:        https://gitlab.com/redhat-crypto/fedora-crypto-policies/-/archive/%{git_commit_hash}/%{name}-git%{git_commit_hash}.tar.gz
+# This is a tarball of the git repository without the .git/
+# directory.
+# For RHEL-8 we use the upstream branch next-default.
+Source0:        crypto-policies-git%{git_commit_hash}.tar.gz
 
 BuildArch: noarch
 BuildRequires: asciidoc
@@ -26,268 +26,95 @@ BuildRequires: perl-generators
 BuildRequires: perl(File::pushd), perl(File::Temp), perl(File::Copy)
 BuildRequires: perl(File::Which)
 BuildRequires: python3-devel
-BuildRequires: python3-pytest
-BuildRequires: python3-coverage
 
-Conflicts: nss < 3.44.0
+# used by update-crypto-policies
+Requires: coreutils
+Requires: grep
+Requires: sed
+Requires(post): coreutils
+Requires(post): grep
+Requires(post): sed
+# Temporarily switched off
+# Conflicts: nss < 3.44.0
 Conflicts: libreswan < 3.28
-Conflicts: openssl < 1.1.1k
+# used by fips-mode-setup
-Conflicts: openssh < 8.0p1-5
-Conflicts: gnutls < 3.6.12
-Conflicts: libssh < 0.9.4
-# Most users want this, the split is mostly for minimal images
-Recommends: crypto-policies-scripts
-
-# Self-obsolete to install both subpackages after split
-Obsoletes: %{name} < 20200527-1.git0a29b28
-
-%description
-This package provides pre-built configuration files with
-cryptographic policies for various cryptographic back-ends,
-such as SSL/TLS libraries.
-
-%package scripts
-Summary: Tool to switch between crypto policies
-Requires: %{name} = %{version}-%{release}
 Recommends: grubby
 
-%description scripts
+%description
-This package provides a tool update-crypto-policies, which applies
+This package provides a tool update-crypto-policies, which sets
-the policies provided by the crypto-policies package. These can be
+the policy applicable for the various cryptographic back-ends, such as
-either the pre-built policies from the base package or custom policies
+SSL/TLS libraries. The policy set by the tool will be the default policy
-defined in simple policy definition files.
+used by these back-ends unless the application user configures them otherwise.
 
 The package also provides a tool fips-mode-setup, which can be used
 to enable or disable the system FIPS mode.
 
 %prep
-%setup -q -n fedora-crypto-policies-%{git_commit_hash}-%{git_commit}
+%setup -q -n %{name}
-%autopatch -p1
+
+# Temporarily remove CURVE25519 from the NSS config
+for f in back-ends/nss.pl tests/outputs/*-nss.txt ; do sed -i -E 's/CURVE25519:?//' $f ; done
+
 
 %build
-%make_build
+make %{?_smp_mflags}
 
 %install
 mkdir -p -m 755 %{buildroot}%{_datarootdir}/crypto-policies/
-mkdir -p -m 755 %{buildroot}%{_datarootdir}/crypto-policies/back-ends/
 mkdir -p -m 755 %{buildroot}%{_sysconfdir}/crypto-policies/back-ends/
-mkdir -p -m 755 %{buildroot}%{_sysconfdir}/crypto-policies/state/
 mkdir -p -m 755 %{buildroot}%{_sysconfdir}/crypto-policies/local.d/
-mkdir -p -m 755 %{buildroot}%{_sysconfdir}/crypto-policies/policies/
-mkdir -p -m 755 %{buildroot}%{_sysconfdir}/crypto-policies/policies/modules/
 mkdir -p -m 755 %{buildroot}%{_bindir}
 
 make DESTDIR=%{buildroot} DIR=%{_datarootdir}/crypto-policies MANDIR=%{_mandir} %{?_smp_mflags} install
 install -p -m 644 default-config %{buildroot}%{_sysconfdir}/crypto-policies/config
-touch %{buildroot}%{_sysconfdir}/crypto-policies/state/current
-touch %{buildroot}%{_sysconfdir}/crypto-policies/state/CURRENT.pol
-
-# Create back-end configs for mounting with read-only /etc/
-for d in LEGACY DEFAULT FUTURE FIPS ; do
-    mkdir -p -m 755 %{buildroot}%{_datarootdir}/crypto-policies/back-ends/$d
-    for f in %{buildroot}%{_datarootdir}/crypto-policies/$d/* ; do
-        ln $f %{buildroot}%{_datarootdir}/crypto-policies/back-ends/$d/$(basename $f .txt).config
-    done
-done
-
-for f in %{buildroot}%{_datarootdir}/crypto-policies/DEFAULT/* ; do
-    ln -sf %{_datarootdir}/crypto-policies/DEFAULT/$(basename $f) %{buildroot}%{_sysconfdir}/crypto-policies/back-ends/$(basename $f .txt).config
-done
-
-%py_byte_compile %{__python3} %{buildroot}%{_datadir}/crypto-policies/python
 
 %check
-make ON_RHEL8=1 test
+make check %{?_smp_mflags}
 
-%post -p <lua>
+%post
-if not posix.access("%{_sysconfdir}/crypto-policies/config") then
+%{_bindir}/update-crypto-policies --no-check >/dev/null
-    local policy = "DEFAULT"
-    local cf = io.open("/proc/sys/crypto/fips_enabled", "r")
-    if cf then
-        if cf:read() == "1" then
-            policy = "FIPS"
-        end
-        cf:close()
-    end
-    cf = io.open("%{_sysconfdir}/crypto-policies/config", "w")
-    if cf then
-        cf:write(policy.."\n")
-        cf:close()
-    end
-    cf = io.open("%{_sysconfdir}/crypto-policies/state/current", "w")
-    if cf then
-        cf:write(policy.."\n")
-        cf:close()
-    end
-    local policypath = "%{_datarootdir}/crypto-policies/"..policy
-    for fn in posix.files(policypath) do
-        if fn ~= "." and fn ~= ".." then
-            local backend = fn:gsub(".*/", ""):gsub("%%..*", "")
-            local cfgfn = "%{_sysconfdir}/crypto-policies/back-ends/"..backend..".config"
-            posix.unlink(cfgfn)
-            posix.symlink(policypath.."/"..fn, cfgfn)
-        end
-    end
-end
-
-%posttrans scripts
-%{_bindir}/update-crypto-policies --no-check >/dev/null 2>/dev/null || :
 
 
 %files
 
 %dir %{_sysconfdir}/crypto-policies/
 %dir %{_sysconfdir}/crypto-policies/back-ends/
-%dir %{_sysconfdir}/crypto-policies/state/
 %dir %{_sysconfdir}/crypto-policies/local.d/
-%dir %{_sysconfdir}/crypto-policies/policies/
-%dir %{_sysconfdir}/crypto-policies/policies/modules/
 %dir %{_datarootdir}/crypto-policies/
 
-%ghost %config(missingok,noreplace) %{_sysconfdir}/crypto-policies/config
+%config(noreplace) %{_sysconfdir}/crypto-policies/config
 
-%ghost %config(missingok,noreplace) %verify(not mode) %{_sysconfdir}/crypto-policies/back-ends/gnutls.config
+%ghost %{_sysconfdir}/crypto-policies/back-ends/gnutls.config
-%ghost %config(missingok,noreplace) %verify(not mode) %{_sysconfdir}/crypto-policies/back-ends/openssl.config
+%ghost %{_sysconfdir}/crypto-policies/back-ends/openssl.config
-%ghost %config(missingok,noreplace) %verify(not mode) %{_sysconfdir}/crypto-policies/back-ends/opensslcnf.config
+%ghost %{_sysconfdir}/crypto-policies/back-ends/opensslcnf.config
-%ghost %config(missingok,noreplace) %verify(not mode) %{_sysconfdir}/crypto-policies/back-ends/openssh.config
+%ghost %{_sysconfdir}/crypto-policies/back-ends/openssh.config
-%ghost %config(missingok,noreplace) %verify(not mode) %{_sysconfdir}/crypto-policies/back-ends/opensshserver.config
+%ghost %{_sysconfdir}/crypto-policies/back-ends/opensshserver.config
-%ghost %config(missingok,noreplace) %verify(not mode) %{_sysconfdir}/crypto-policies/back-ends/nss.config
+%ghost %{_sysconfdir}/crypto-policies/back-ends/nss.config
-%ghost %config(missingok,noreplace) %verify(not mode) %{_sysconfdir}/crypto-policies/back-ends/bind.config
+%ghost %{_sysconfdir}/crypto-policies/back-ends/bind.config
-%ghost %config(missingok,noreplace) %verify(not mode) %{_sysconfdir}/crypto-policies/back-ends/java.config
+%ghost %{_sysconfdir}/crypto-policies/back-ends/java.config
-%ghost %config(missingok,noreplace) %verify(not mode) %{_sysconfdir}/crypto-policies/back-ends/krb5.config
+%ghost %{_sysconfdir}/crypto-policies/back-ends/krb5.config
-%ghost %config(missingok,noreplace) %verify(not mode) %{_sysconfdir}/crypto-policies/back-ends/libreswan.config
+%ghost %{_sysconfdir}/crypto-policies/back-ends/openjdk.config
-%ghost %config(missingok,noreplace) %verify(not mode) %{_sysconfdir}/crypto-policies/back-ends/libssh.config
+%ghost %{_sysconfdir}/crypto-policies/back-ends/libreswan.config
-# %verify(not mode) comes from the fact
-# these turn into symlinks and back to regular files at will, see bz1898986
-
-%ghost %{_sysconfdir}/crypto-policies/state/current
-%ghost %{_sysconfdir}/crypto-policies/state/CURRENT.pol
 
+%{_bindir}/update-crypto-policies
+%{_bindir}/fips-mode-setup
+%{_bindir}/fips-finish-install
 %{_mandir}/man7/crypto-policies.7*
-%{_datarootdir}/crypto-policies/LEGACY
+%{_mandir}/man8/update-crypto-policies.8*
-%{_datarootdir}/crypto-policies/DEFAULT
+%{_mandir}/man8/fips-mode-setup.8*
-%{_datarootdir}/crypto-policies/FUTURE
+%{_mandir}/man8/fips-finish-install.8*
-%{_datarootdir}/crypto-policies/FIPS
+%{_datarootdir}/crypto-policies/LEGACY/*
-%{_datarootdir}/crypto-policies/EMPTY
+%{_datarootdir}/crypto-policies/DEFAULT/*
-%{_datarootdir}/crypto-policies/back-ends
+%{_datarootdir}/crypto-policies/FUTURE/*
+%{_datarootdir}/crypto-policies/FIPS/*
+%{_datarootdir}/crypto-policies/EMPTY/*
 %{_datarootdir}/crypto-policies/default-config
 %{_datarootdir}/crypto-policies/reload-cmds.sh
-%{_datarootdir}/crypto-policies/policies
 
 %{!?_licensedir:%global license %%doc}
 %license COPYING.LESSER
 
-%files scripts
-%{_bindir}/update-crypto-policies
-%{_mandir}/man8/update-crypto-policies.8*
-%{_datarootdir}/crypto-policies/python
-
-%{_bindir}/fips-mode-setup
-%{_bindir}/fips-finish-install
-%{_mandir}/man8/fips-mode-setup.8*
-%{_mandir}/man8/fips-finish-install.8*
-
 %changelog
-* Tue Jul 31 2023 Alexander Sosedkin <asosedkin@redhat.com> - 20230731-1.git3177e06
-- krb5: sort enctypes mac-first, cipher-second, prioritize SHA-2 ones
-- krb5: fix policy generator to account for macs
-- docs: replace `FIPS 140-2` with just `FIPS 140`
-
-* Thu Dec 15 2022 Alexander Sosedkin <asosedkin@redhat.com> - 20221215-1.gitece0092
-- bind: expand the list of disableable algorithms
-- tests/java: fix java.security.disableSystemPropertiesFile=true
-- stop accidentally creating /etc/crypto-policies/back-ends/.config symlink
-
-* Tue Nov 16 2021 Alexander Sosedkin <asosedkin@redhat.com> - 20211116-1.gitae470d6
-- OSPP: relax -ECDSA-SHA2-512, -FFDHE-*
-- fips-mode-setup, fips-finish-install: call zipl more often (s390x-specific)
-- libssh: enable diffie-hellman-group14-sha256 support
-- openssl: fix disabling ChaCha20
-
-* Thu Jun 17 2021 Alexander Sosedkin <asosedkin@redhat.com> - 20210617-1.gitc776d3e
-- implement scoped policies, e.g., cipher@SSH = ... (#1960266)
-- implement algorithm globbing, e.g., cipher@SSH = -*-CBC
-- deprecate derived properties:
-  tls_cipher, ssh_cipher, ssh_group, ike_protocol
-- deprecate sha1_in_dnssec property
-- deprecate unscoped form of protocol property
-- update documentation
-- expand upstream test coverage
-- openssl: set MinProtocol / MaxProtocol separately for TLS and DTLS (#1946522)
-- support AES-192 ciphers in custom policies for non-TLS scenarios (#1876846)
-- stop claiming Camellia is disabled (#1925104)
-- disable CBC ciphers in FUTURE for everything but Kerberos (#1933016)
-- drop SHA224 from signature algorithms in FIPS:OSPP (#1934755)
-- condition ecdh-sha2-nistp384 on SECP384R1
-
-* Tue Feb 09 2021 Alexander Sosedkin <asosedkin@redhat.com> - 20210209-1.gitbfb6bed
-- OSPP subpolicy: tweak for RHEL-8.3+
-- libssh: respect ssh_certs
-
-* Mon Jul 13 2020 Tomáš Mráz <tmraz@redhat.com> - 20200713-1.git51d1222
-- OSPP subpolicy: remove AES-CCM
-- openssl: handle the AES-CCM removal properly
-
-* Wed Jul  1 2020 Tomáš Mráz <tmraz@redhat.com> - 20200629-1.git806b5d3
-- disallow X448/ED448 in FIPS policy with gnutls >= 3.6.12
-- add AD-SUPPORT policy module
-
-* Wed Jun 10 2020 Tomáš Mráz <tmraz@redhat.com> - 20200610-1.git0ac8b1f
-- fallback to FIPS policy instead of the default-config in FIPS mode
-- java: Document properly how to override the crypto policy
-- krb5: No support for 3des anymore
-- reorder the signature algorithms to follow the order in default openssl list
-
-* Tue Jun  9 2020 Tomáš Mráz <tmraz@redhat.com> - 20200527-5.gitb234a47
-- make the post script work in environments where /proc/sys is not available
-
-* Fri May 29 2020 Tomáš Mráz <tmraz@redhat.com> - 20200527-4.gitb234a47
-- automatically set up FIPS policy in FIPS mode on first install
-
-* Thu May 28 2020 Tomáš Mráz <tmraz@redhat.com> - 20200527-2.git63fc906
-- explicitly enable DHE-DSS in gnutls config if enabled in policy
-- use grubby with --update-kernel=ALL to avoid breaking kernelopts
-- OSPP subpolicy: Allow GCM for SSH protocol
-- openssh: Support newly standardized ECDHE-GSS and DHE-GSS key exchanges
-- if the policy in FIPS mode is not a FIPS policy print a message
-- openssl: Add SignatureAlgorithms support
-- custom crypto policies: enable completely overriding contents of the list
-  value
-- added ECDHE-ONLY.pmod policy module example
-- openssh: make LEGACY policy to prefer strong public key algorithms
-- various python code cleanups
-- update-crypto-policies: dump the current policy to
-  /etc/crypto-policies/state/CURRENT.pol
-- split scripts into their own subpackage
-
-* Mon Dec 16 2019 Tomáš Mráz <tmraz@redhat.com> - 20191128-2.git23e1bf1
-- move the pre-built .config files to /usr/share/crypto-policies/back-ends
-
-* Fri Nov 29 2019 Tomáš Mráz <tmraz@redhat.com> - 20191128-1.git23e1bf1
-- fips-mode-setup: compatibility with RHCOS
-
-* Thu Nov 28 2019 Tomáš Mráz <tmraz@redhat.com> - 20191127-1.git1179826
-- add FIPS subpolicy for OSPP
-
-* Tue Oct 29 2019 Tomáš Mráz <tmraz@redhat.com> - 20191022-1.gite17cc3a
-- custom crypto policies support
-- update-crypto-policies: fix handling of list operations in policy modules
-- update-crypto-policies: fix updating of the current policy marker
-- fips-mode-setup: fixes related to containers and non-root execution
-- make it possible to use fips-mode-setup --check without dracut
-- add .config symlinks so a crypto policy can be set with read-only
-  /etc by bind-mounting /usr/share/crypto-policies/<policy> to
-  /etc/crypto-policies/back-ends
-- run the update-crypto-policies in posttrans
-
-* Wed Aug  7 2019 Tomáš Mráz <tmraz@redhat.com> - 20190807-1.git9b1477b
-- gnutls: enable TLS-1.3 in the FIPS policy
-
-* Mon Aug  5 2019 Tomáš Mráz <tmraz@redhat.com> - 20190613-2.git21ffdc8
-- fix ownership of policy directories
-- nss: enable X25519 in appropriate policies and conflict with old nss
-- openssh: conflict with old incompatible openssh version
-
 * Thu Jun 13 2019 Tomáš Mráz <tmraz@redhat.com> - 20190613-1.git21ffdc8
 - openssh: add missing curve25519-sha256 to the key exchange list
 - openssh: fix RSA certificate support