import UBI crypto-policies-20230731-1.git3177e06.el8

.crypto-policies.metadata

@@ -1 +1 @@
-96ee4b140080ebc2b327cd2c6e608a55ecf7daf3 SOURCES/crypto-policies-git51d1222.tar.gz
+731e23be60f0b6183f8d37978c36a07377ebc47a SOURCES/crypto-policies-git3177e06.tar.gz

.gitignore

@@ -1 +1 @@
-SOURCES/crypto-policies-git51d1222.tar.gz
+SOURCES/crypto-policies-git3177e06.tar.gz

SPECS/crypto-policies.spec

@@ -1,5 +1,5 @@
-%global git_date 20200713
-%global git_commit 51d12223920a7c1e50c3161bcc351ae380142e97
+%global git_date 20230731
+%global git_commit 3177e06c203c082d479760337c7cad65a4dcc81e
 %{?git_commit:%global git_commit_hash %(c=%{git_commit}; echo ${c:0:7})}
 
 %global _python_bytecompile_extra 0
@@ -11,7 +11,7 @@ Summary:        System-wide crypto policies
 
 License:        LGPLv2+
 URL:            https://gitlab.com/redhat-crypto/fedora-crypto-policies
-# For RHEL-8 we use the upstream branch rhel8.
+# For RHEL-8 we use the upstream branch rhel8
 Source0:        https://gitlab.com/redhat-crypto/fedora-crypto-policies/-/archive/%{git_commit_hash}/%{name}-git%{git_commit_hash}.tar.gz
 
 BuildArch: noarch
@@ -26,15 +26,19 @@ BuildRequires: perl-generators
 BuildRequires: perl(File::pushd), perl(File::Temp), perl(File::Copy)
 BuildRequires: perl(File::Which)
 BuildRequires: python3-devel
+BuildRequires: python3-pytest
+BuildRequires: python3-coverage
 
 Conflicts: nss < 3.44.0
 Conflicts: libreswan < 3.28
+Conflicts: openssl < 1.1.1k
 Conflicts: openssh < 8.0p1-5
 Conflicts: gnutls < 3.6.12
+Conflicts: libssh < 0.9.4
 # Most users want this, the split is mostly for minimal images
 Recommends: crypto-policies-scripts
 
-# Self-obsolete to install both subpackages after split.
+# Self-obsolete to install both subpackages after split
 Obsoletes: %{name} < 20200527-1.git0a29b28
 
 %description
@@ -58,6 +62,7 @@ to enable or disable the system FIPS mode.
 
 %prep
 %setup -q -n fedora-crypto-policies-%{git_commit_hash}-%{git_commit}
+%autopatch -p1
 
 %build
 %make_build
@@ -92,7 +97,7 @@ done
 %py_byte_compile %{__python3} %{buildroot}%{_datadir}/crypto-policies/python
 
 %check
-make check %{?_smp_mflags}
+make ON_RHEL8=1 test
 
 %post -p <lua>
 if not posix.access("%{_sysconfdir}/crypto-policies/config") then
@@ -116,10 +121,12 @@ if not posix.access("%{_sysconfdir}/crypto-policies/config") then
     end
     local policypath = "%{_datarootdir}/crypto-policies/"..policy
     for fn in posix.files(policypath) do
-        local backend = fn:gsub(".*/", ""):gsub("%%..*", "")
-        local cfgfn = "%{_sysconfdir}/crypto-policies/back-ends/"..backend..".config"
-        posix.unlink(cfgfn)
-        posix.symlink(policypath.."/"..fn, cfgfn)
+        if fn ~= "." and fn ~= ".." then
+            local backend = fn:gsub(".*/", ""):gsub("%%..*", "")
+            local cfgfn = "%{_sysconfdir}/crypto-policies/back-ends/"..backend..".config"
+            posix.unlink(cfgfn)
+            posix.symlink(policypath.."/"..fn, cfgfn)
+        end
     end
 end
 
@@ -139,17 +146,19 @@ end
 
 %ghost %config(missingok,noreplace) %{_sysconfdir}/crypto-policies/config
 
-%ghost %config(missingok,noreplace) %{_sysconfdir}/crypto-policies/back-ends/gnutls.config
-%ghost %config(missingok,noreplace) %{_sysconfdir}/crypto-policies/back-ends/openssl.config
-%ghost %config(missingok,noreplace) %{_sysconfdir}/crypto-policies/back-ends/opensslcnf.config
-%ghost %config(missingok,noreplace) %{_sysconfdir}/crypto-policies/back-ends/openssh.config
-%ghost %config(missingok,noreplace) %{_sysconfdir}/crypto-policies/back-ends/opensshserver.config
-%ghost %config(missingok,noreplace) %{_sysconfdir}/crypto-policies/back-ends/nss.config
-%ghost %config(missingok,noreplace) %{_sysconfdir}/crypto-policies/back-ends/bind.config
-%ghost %config(missingok,noreplace) %{_sysconfdir}/crypto-policies/back-ends/java.config
-%ghost %config(missingok,noreplace) %{_sysconfdir}/crypto-policies/back-ends/krb5.config
-%ghost %config(missingok,noreplace) %{_sysconfdir}/crypto-policies/back-ends/libreswan.config
-%ghost %config(missingok,noreplace) %{_sysconfdir}/crypto-policies/back-ends/libssh.config
+%ghost %config(missingok,noreplace) %verify(not mode) %{_sysconfdir}/crypto-policies/back-ends/gnutls.config
+%ghost %config(missingok,noreplace) %verify(not mode) %{_sysconfdir}/crypto-policies/back-ends/openssl.config
+%ghost %config(missingok,noreplace) %verify(not mode) %{_sysconfdir}/crypto-policies/back-ends/opensslcnf.config
+%ghost %config(missingok,noreplace) %verify(not mode) %{_sysconfdir}/crypto-policies/back-ends/openssh.config
+%ghost %config(missingok,noreplace) %verify(not mode) %{_sysconfdir}/crypto-policies/back-ends/opensshserver.config
+%ghost %config(missingok,noreplace) %verify(not mode) %{_sysconfdir}/crypto-policies/back-ends/nss.config
+%ghost %config(missingok,noreplace) %verify(not mode) %{_sysconfdir}/crypto-policies/back-ends/bind.config
+%ghost %config(missingok,noreplace) %verify(not mode) %{_sysconfdir}/crypto-policies/back-ends/java.config
+%ghost %config(missingok,noreplace) %verify(not mode) %{_sysconfdir}/crypto-policies/back-ends/krb5.config
+%ghost %config(missingok,noreplace) %verify(not mode) %{_sysconfdir}/crypto-policies/back-ends/libreswan.config
+%ghost %config(missingok,noreplace) %verify(not mode) %{_sysconfdir}/crypto-policies/back-ends/libssh.config
+# %verify(not mode) comes from the fact
+# these turn into symlinks and back to regular files at will, see bz1898986
 
 %ghost %{_sysconfdir}/crypto-policies/state/current
 %ghost %{_sysconfdir}/crypto-policies/state/CURRENT.pol
@@ -179,6 +188,42 @@ end
 %{_mandir}/man8/fips-finish-install.8*
 
 %changelog
+* Tue Jul 31 2023 Alexander Sosedkin <asosedkin@redhat.com> - 20230731-1.git3177e06
+- krb5: sort enctypes mac-first, cipher-second, prioritize SHA-2 ones
+- krb5: fix policy generator to account for macs
+- docs: replace `FIPS 140-2` with just `FIPS 140`
+
+* Thu Dec 15 2022 Alexander Sosedkin <asosedkin@redhat.com> - 20221215-1.gitece0092
+- bind: expand the list of disableable algorithms
+- tests/java: fix java.security.disableSystemPropertiesFile=true
+- stop accidentally creating /etc/crypto-policies/back-ends/.config symlink
+
+* Tue Nov 16 2021 Alexander Sosedkin <asosedkin@redhat.com> - 20211116-1.gitae470d6
+- OSPP: relax -ECDSA-SHA2-512, -FFDHE-*
+- fips-mode-setup, fips-finish-install: call zipl more often (s390x-specific)
+- libssh: enable diffie-hellman-group14-sha256 support
+- openssl: fix disabling ChaCha20
+
+* Thu Jun 17 2021 Alexander Sosedkin <asosedkin@redhat.com> - 20210617-1.gitc776d3e
+- implement scoped policies, e.g., cipher@SSH = ... (#1960266)
+- implement algorithm globbing, e.g., cipher@SSH = -*-CBC
+- deprecate derived properties:
+  tls_cipher, ssh_cipher, ssh_group, ike_protocol
+- deprecate sha1_in_dnssec property
+- deprecate unscoped form of protocol property
+- update documentation
+- expand upstream test coverage
+- openssl: set MinProtocol / MaxProtocol separately for TLS and DTLS (#1946522)
+- support AES-192 ciphers in custom policies for non-TLS scenarios (#1876846)
+- stop claiming Camellia is disabled (#1925104)
+- disable CBC ciphers in FUTURE for everything but Kerberos (#1933016)
+- drop SHA224 from signature algorithms in FIPS:OSPP (#1934755)
+- condition ecdh-sha2-nistp384 on SECP384R1
+
+* Tue Feb 09 2021 Alexander Sosedkin <asosedkin@redhat.com> - 20210209-1.gitbfb6bed
+- OSPP subpolicy: tweak for RHEL-8.3+
+- libssh: respect ssh_certs
+
 * Mon Jul 13 2020 Tomáš Mráz <tmraz@redhat.com> - 20200713-1.git51d1222
 - OSPP subpolicy: remove AES-CCM
 - openssl: handle the AES-CCM removal properly