.libblockdev.metadata

@@ -0,0 +1 @@
+d32fce132c75d94ad9c033a636906d63027ffba5 SOURCES/libblockdev-2.28.tar.gz

SOURCES/0002-Add-support-for-creating-and-activating-integrity-de.patch

@@ -0,0 +1,963 @@
+From 77e6a109043e87f88d2bd2b47d1cefce0eb9f5a9 Mon Sep 17 00:00:00 2001
+From: Vojtech Trefny <vtrefny@redhat.com>
+Date: Mon, 20 Sep 2021 16:38:16 +0200
+Subject: [PATCH 1/3] Add support for creating and activating integrity devices
+
+This adds support for create, open and close actions for standalone
+integrity devices using cryptsetup.
+---
+ configure.ac                        |   2 +-
+ src/lib/plugin_apis/crypto.api      | 157 +++++++++++++++++
+ src/plugins/crypto.c                | 261 +++++++++++++++++++++++++++-
+ src/plugins/crypto.h                |  41 +++++
+ src/python/gi/overrides/BlockDev.py |  24 +++
+ tests/crypto_test.py                |  96 +++++++++-
+ 6 files changed, 573 insertions(+), 8 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index 79bd97d8..79bf8045 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -210,7 +210,7 @@ AS_IF([test "x$with_crypto" != "xno"],
+       AS_IF([$PKG_CONFIG --atleast-version=2.0.3 libcryptsetup],
+             [AC_DEFINE([LIBCRYPTSETUP_2])], [])
+       AS_IF([$PKG_CONFIG --atleast-version=2.3.0 libcryptsetup],
+-            [AC_DEFINE([LIBCRYPTSETUP_BITLK])], [])
++            [AC_DEFINE([LIBCRYPTSETUP_23])], [])
+       AS_IF([$PKG_CONFIG --atleast-version=2.4.0 libcryptsetup],
+             [AC_DEFINE([LIBCRYPTSETUP_24])], [])
+       AS_IF([test "x$with_escrow" != "xno"],
+diff --git a/src/lib/plugin_apis/crypto.api b/src/lib/plugin_apis/crypto.api
+index ef0217fe..40e32c89 100644
+--- a/src/lib/plugin_apis/crypto.api
++++ b/src/lib/plugin_apis/crypto.api
+@@ -1,5 +1,6 @@
+ #include <glib.h>
+ #include <blockdev/utils.h>
++#include <libcryptsetup.h>
+ 
+ #define BD_CRYPTO_LUKS_METADATA_SIZE G_GUINT64_CONSTANT (2097152ULL) // 2 MiB
+ 
+@@ -245,6 +246,115 @@ GType bd_crypto_luks_extra_get_type () {
+     return type;
+ }
+ 
++#define BD_CRYPTO_TYPE_INTEGRITY_EXTRA (bd_crypto_integrity_extra_get_type ())
++GType bd_crypto_integrity_extra_get_type();
++
++/**
++ * BDCryptoIntegrityExtra:
++ * @sector_size: integrity sector size
++ * @journal_size: size of journal in bytes
++ * @journal_watermark: journal flush watermark in percents; in bitmap mode sectors-per-bit
++ * @journal_commit_time: journal commit time (or bitmap flush time) in ms
++ * @interleave_sectors: number of interleave sectors (power of two)
++ * @tag_size: tag size per-sector in bytes
++ * @buffer_sectors: number of sectors in one buffer
++ */
++typedef struct BDCryptoIntegrityExtra {
++    guint32 sector_size;
++    guint64 journal_size;
++    guint journal_watermark;
++    guint journal_commit_time;
++    guint32 interleave_sectors;
++    guint32 tag_size;
++    guint32 buffer_sectors;
++} BDCryptoIntegrityExtra;
++
++/**
++ * bd_crypto_integrity_extra_copy: (skip)
++ * @extra: (allow-none): %BDCryptoIntegrityExtra to copy
++ *
++ * Creates a new copy of @extra.
++ */
++BDCryptoIntegrityExtra* bd_crypto_integrity_extra_copy (BDCryptoIntegrityExtra *extra) {
++    if (extra == NULL)
++        return NULL;
++
++    BDCryptoIntegrityExtra *new_extra = g_new0 (BDCryptoIntegrityExtra, 1);
++
++    new_extra->sector_size = extra->sector_size;
++    new_extra->journal_size = extra->journal_size;
++    new_extra->journal_watermark = extra->journal_watermark;
++    new_extra->journal_commit_time = extra->journal_commit_time;
++    new_extra->interleave_sectors = extra->interleave_sectors;
++    new_extra->tag_size = extra->tag_size;
++    new_extra->buffer_sectors = extra->buffer_sectors;
++
++    return new_extra;
++}
++
++/**
++ * bd_crypto_integrity_extra_free: (skip)
++ * @extra: (allow-none): %BDCryptoIntegrityExtra to free
++ *
++ * Frees @extra.
++ */
++void bd_crypto_integrity_extra_free (BDCryptoIntegrityExtra *extra) {
++    if (extra == NULL)
++        return;
++
++    g_free (extra);
++}
++
++/**
++ * bd_crypto_integrity_extra_new: (constructor)
++ * @sector_size: integrity sector size, 0 for default (512)
++ * @journal_size: size of journal in bytes
++ * @journal_watermark: journal flush watermark in percents; in bitmap mode sectors-per-bit
++ * @journal_commit_time: journal commit time (or bitmap flush time) in ms
++ * @interleave_sectors: number of interleave sectors (power of two)
++ * @tag_size: tag size per-sector in bytes
++ * @buffer_sectors: number of sectors in one buffer
++ *
++ * Returns: (transfer full): a new Integrity extra argument
++ */
++BDCryptoIntegrityExtra* bd_crypto_integrity_extra_new (guint64 sector_size, guint64 journal_size, guint journal_watermark, guint journal_commit_time, guint64 interleave_sectors, guint64 tag_size, guint64 buffer_sectors) {
++    BDCryptoIntegrityExtra *ret = g_new0 (BDCryptoIntegrityExtra, 1);
++    ret->sector_size = sector_size;
++    ret->journal_size = journal_size;
++    ret->journal_watermark = journal_watermark;
++    ret->journal_commit_time = journal_commit_time;
++    ret->interleave_sectors = interleave_sectors;
++    ret->tag_size = tag_size;
++    ret->buffer_sectors = buffer_sectors;
++
++    return ret;
++}
++
++GType bd_crypto_integrity_extra_get_type () {
++    static GType type = 0;
++
++    if (G_UNLIKELY(type == 0)) {
++        type = g_boxed_type_register_static("BDCryptoIntegrityExtra",
++                                            (GBoxedCopyFunc) bd_crypto_integrity_extra_copy,
++                                            (GBoxedFreeFunc) bd_crypto_integrity_extra_free);
++    }
++
++    return type;
++}
++
++typedef enum {
++    BD_CRYPTO_INTEGRITY_OPEN_NO_JOURNAL         = CRYPT_ACTIVATE_NO_JOURNAL,
++    BD_CRYPTO_INTEGRITY_OPEN_RECOVERY           = CRYPT_ACTIVATE_RECOVERY,
++#ifdef CRYPT_ACTIVATE_NO_JOURNAL_BITMAP
++    BD_CRYPTO_INTEGRITY_OPEN_NO_JOURNAL_BITMAP  = CRYPT_ACTIVATE_NO_JOURNAL_BITMAP,
++#endif
++    BD_CRYPTO_INTEGRITY_OPEN_RECALCULATE        = CRYPT_ACTIVATE_RECALCULATE,
++#ifdef CRYPT_ACTIVATE_RECALCULATE_RESET
++    BD_CRYPTO_INTEGRITY_OPEN_RECALCULATE_RESET  = CRYPT_ACTIVATE_RECALCULATE_RESET,
++#endif
++    BD_CRYPTO_INTEGRITY_OPEN_ALLOW_DISCARDS     = CRYPT_ACTIVATE_ALLOW_DISCARDS,
++} BDCryptoIntegrityOpenFlags;
++
+ #define BD_CRYPTO_TYPE_LUKS_INFO (bd_crypto_luks_info_get_type ())
+ GType bd_crypto_luks_info_get_type();
+ 
+@@ -857,6 +967,53 @@ BDCryptoLUKSInfo* bd_crypto_luks_info (const gchar *luks_device, GError **error)
+  */
+ BDCryptoIntegrityInfo* bd_crypto_integrity_info (const gchar *device, GError **error);
+ 
++/**
++ * bd_crypto_integrity_format:
++ * @device: a device to format as integrity
++ * @algorithm: integrity algorithm specification (e.g. "crc32c" or "sha256") or %NULL to use the default
++ * @wipe: whether to wipe the device after format; a device that is not initially wiped will contain invalid checksums
++ * @key_data: (allow-none) (array length=key_size): integrity key or %NULL if not needed
++ * @key_size: size the integrity key and @key_data
++ * @extra: (allow-none): extra arguments for integrity format creation
++ * @error: (out): place to store error (if any)
++ *
++ * Formats the given @device as integrity according to the other parameters given.
++ *
++ * Returns: whether the given @device was successfully formatted as integrity or not
++ * (the @error) contains the error in such cases)
++ *
++ * Tech category: %BD_CRYPTO_TECH_INTEGRITY-%BD_CRYPTO_TECH_MODE_CREATE
++ */
++gboolean bd_crypto_integrity_format (const gchar *device, const gchar *algorithm, gboolean wipe, const guint8* key_data, gsize key_size, BDCryptoIntegrityExtra *extra, GError **error);
++
++/**
++ * bd_crypto_integrity_open:
++ * @device: integrity device to open
++ * @name: name for the opened @device
++ * @algorithm: (allow-none): integrity algorithm specification (e.g. "crc32c" or "sha256") or %NULL to use the default
++ * @key_data: (allow-none) (array length=key_size): integrity key or %NULL if not needed
++ * @key_size: size the integrity key and @key_data
++ * @flags: flags for the integrity device activation
++ * @extra: (allow-none): extra arguments for integrity open
++ * @error: (out): place to store error (if any)
++ *
++ * Returns: whether the @device was successfully opened or not
++ *
++ * Tech category: %BD_CRYPTO_TECH_INTEGRITY-%BD_CRYPTO_TECH_MODE_OPEN_CLOSE
++ */
++gboolean bd_crypto_integrity_open (const gchar *device, const gchar *name, const gchar *algorithm, const guint8* key_data, gsize key_size, BDCryptoIntegrityOpenFlags flags, BDCryptoIntegrityExtra *extra, GError **error);
++
++/**
++ * bd_crypto_integrity_close:
++ * @integrity_device: integrity device to close
++ * @error: (out): place to store error (if any)
++ *
++ * Returns: whether the given @integrity_device was successfully closed or not
++ *
++ * Tech category: %BD_CRYPTO_TECH_INTEGRITY-%BD_CRYPTO_TECH_MODE_OPEN_CLOSE
++ */
++gboolean bd_crypto_integrity_close (const gchar *integrity_device, GError **error);
++
+ /**
+  * bd_crypto_device_seems_encrypted:
+  * @device: the queried device
+diff --git a/src/plugins/crypto.c b/src/plugins/crypto.c
+index 51908140..8549cf23 100644
+--- a/src/plugins/crypto.c
++++ b/src/plugins/crypto.c
+@@ -50,6 +50,18 @@
+ 
+ #define SECTOR_SIZE 512
+ 
++#define DEFAULT_LUKS_KEYSIZE_BITS 256
++#define DEFAULT_LUKS_CIPHER "aes-xts-plain64"
++
++#ifdef LIBCRYPTSETUP_23
++/* 0 for autodetect since 2.3.0 */
++#define DEFAULT_INTEGRITY_TAG_SIZE 0
++#else
++/* we need some sane default for older versions, users should specify tag size when using
++   other algorithms than the default crc32c */
++#define DEFAULT_INTEGRITY_TAG_SIZE 4
++#endif
++
+ #define UNUSED __attribute__((unused))
+ 
+ /**
+@@ -146,6 +158,43 @@ BDCryptoLUKSExtra* bd_crypto_luks_extra_new (guint64 data_alignment, const gchar
+     return ret;
+ }
+ 
++BDCryptoIntegrityExtra* bd_crypto_integrity_extra_new (guint64 sector_size, guint64 journal_size, guint journal_watermark, guint journal_commit_time, guint64 interleave_sectors, guint64 tag_size, guint64 buffer_sectors) {
++    BDCryptoIntegrityExtra *ret = g_new0 (BDCryptoIntegrityExtra, 1);
++    ret->sector_size = sector_size;
++    ret->journal_size = journal_size;
++    ret->journal_watermark = journal_watermark;
++    ret->journal_commit_time = journal_commit_time;
++    ret->interleave_sectors = interleave_sectors;
++    ret->tag_size = tag_size;
++    ret->buffer_sectors = buffer_sectors;
++
++    return ret;
++}
++
++BDCryptoIntegrityExtra* bd_crypto_integrity_extra_copy (BDCryptoIntegrityExtra *extra) {
++    if (extra == NULL)
++        return NULL;
++
++    BDCryptoIntegrityExtra *new_extra = g_new0 (BDCryptoIntegrityExtra, 1);
++
++    new_extra->sector_size = extra->sector_size;
++    new_extra->journal_size = extra->journal_size;
++    new_extra->journal_watermark = extra->journal_watermark;
++    new_extra->journal_commit_time = extra->journal_commit_time;
++    new_extra->interleave_sectors = extra->interleave_sectors;
++    new_extra->tag_size = extra->tag_size;
++    new_extra->buffer_sectors = extra->buffer_sectors;
++
++    return new_extra;
++}
++
++void bd_crypto_integrity_extra_free (BDCryptoIntegrityExtra *extra) {
++    if (extra == NULL)
++        return;
++
++    g_free (extra);
++}
++
+ void bd_crypto_luks_info_free (BDCryptoLUKSInfo *info) {
+     if (info == NULL)
+         return;
+@@ -346,15 +395,15 @@ gboolean bd_crypto_is_tech_avail (BDCryptoTech tech, guint64 mode, GError **erro
+                          "Integrity technology requires libcryptsetup >= 2.0");
+             return FALSE;
+ #endif
+-            ret = mode & (BD_CRYPTO_TECH_MODE_QUERY);
++            ret = mode & (BD_CRYPTO_TECH_MODE_CREATE|BD_CRYPTO_TECH_MODE_OPEN_CLOSE|BD_CRYPTO_TECH_MODE_QUERY);
+             if (ret != mode) {
+                 g_set_error (error, BD_CRYPTO_ERROR, BD_CRYPTO_ERROR_TECH_UNAVAIL,
+-                             "Only 'query' supported for Integrity");
++                             "Only 'create', 'open' and 'query' supported for Integrity");
+                 return FALSE;
+             } else
+                 return TRUE;
+         case BD_CRYPTO_TECH_BITLK:
+-#ifndef LIBCRYPTSETUP_BITLK
++#ifndef LIBCRYPTSETUP_23
+             g_set_error (error, BD_CRYPTO_ERROR, BD_CRYPTO_ERROR_TECH_UNAVAIL,
+                          "BITLK technology requires libcryptsetup >= 2.3.0");
+             return FALSE;
+@@ -2035,6 +2084,208 @@ BDCryptoIntegrityInfo* bd_crypto_integrity_info (const gchar *device, GError **e
+ }
+ #endif
+ 
++static int _wipe_progress (guint64 size, guint64 offset, void *usrptr) {
++    /* "convert" the progress from 0-100 to 50-100 because wipe starts at 50 in bd_crypto_integrity_format */
++    gdouble progress = 50 + (((gdouble) offset / size) * 100) / 2;
++    bd_utils_report_progress (*(guint64 *) usrptr, progress, "Integrity device wipe in progress");
++
++    return 0;
++}
++
++/**
++ * bd_crypto_integrity_format:
++ * @device: a device to format as integrity
++ * @algorithm: integrity algorithm specification (e.g. "crc32c" or "sha256")
++ * @wipe: whether to wipe the device after format; a device that is not initially wiped will contain invalid checksums
++ * @key_data: (allow-none) (array length=key_size): integrity key or %NULL if not needed
++ * @key_size: size the integrity key and @key_data
++ * @extra: (allow-none): extra arguments for integrity format creation
++ * @error: (out): place to store error (if any)
++ *
++ * Formats the given @device as integrity according to the other parameters given.
++ *
++ * Returns: whether the given @device was successfully formatted as integrity or not
++ * (the @error) contains the error in such cases)
++ *
++ * Tech category: %BD_CRYPTO_TECH_INTEGRITY-%BD_CRYPTO_TECH_MODE_CREATE
++ */
++gboolean bd_crypto_integrity_format (const gchar *device, const gchar *algorithm, gboolean wipe, const guint8* key_data, gsize key_size, BDCryptoIntegrityExtra *extra, GError **error) {
++    struct crypt_device *cd = NULL;
++    gint ret;
++    guint64 progress_id = 0;
++    gchar *msg = NULL;
++    struct crypt_params_integrity params = ZERO_INIT;
++    g_autofree gchar *tmp_name = NULL;
++    g_autofree gchar *tmp_path = NULL;
++    g_autofree gchar *dev_name = NULL;
++
++    msg = g_strdup_printf ("Started formatting '%s' as integrity device", device);
++    progress_id = bd_utils_report_started (msg);
++    g_free (msg);
++
++    ret = crypt_init (&cd, device);
++    if (ret != 0) {
++        g_set_error (error, BD_CRYPTO_ERROR, BD_CRYPTO_ERROR_DEVICE,
++                     "Failed to initialize device: %s", strerror_l (-ret, c_locale));
++        bd_utils_report_finished (progress_id, (*error)->message);
++        return FALSE;
++    }
++
++    if (extra) {
++        params.sector_size = extra->sector_size;
++        params.journal_size = extra->journal_size;
++        params.journal_watermark = extra->journal_watermark;
++        params.journal_commit_time = extra->journal_commit_time;
++        params.interleave_sectors = extra->interleave_sectors;
++        params.tag_size = extra->tag_size;
++        params.buffer_sectors = extra->buffer_sectors;
++    }
++
++    params.integrity_key_size = key_size;
++    params.integrity = algorithm;
++    params.tag_size = params.tag_size ? params.tag_size : DEFAULT_INTEGRITY_TAG_SIZE;
++
++    ret = crypt_format (cd, CRYPT_INTEGRITY, NULL, NULL, NULL, NULL, 0, &params);
++    if (ret != 0) {
++        g_set_error (error, BD_CRYPTO_ERROR, BD_CRYPTO_ERROR_FORMAT_FAILED,
++                     "Failed to format device: %s", strerror_l (-ret, c_locale));
++        crypt_free (cd);
++        bd_utils_report_finished (progress_id, (*error)->message);
++        return FALSE;
++    }
++
++    if (wipe) {
++        bd_utils_report_progress (progress_id, 50, "Format created");
++
++        dev_name = g_path_get_basename (device);
++        tmp_name = g_strdup_printf ("bd-temp-integrity-%s-%d", dev_name, g_random_int ());
++        tmp_path = g_strdup_printf ("%s/%s", crypt_get_dir (), tmp_name);
++
++        ret = crypt_activate_by_volume_key (cd, tmp_name, (const char *) key_data, key_size,
++                                            CRYPT_ACTIVATE_PRIVATE | CRYPT_ACTIVATE_NO_JOURNAL);
++        if (ret != 0) {
++            g_set_error (error, BD_CRYPTO_ERROR, BD_CRYPTO_ERROR_DEVICE,
++                         "Failed to activate the newly created integrity device for wiping: %s",
++                         strerror_l (-ret, c_locale));
++            crypt_free (cd);
++            bd_utils_report_finished (progress_id, (*error)->message);
++            return FALSE;
++        }
++
++        bd_utils_report_progress (progress_id, 50, "Starting to wipe the newly created integrity device");
++        ret = crypt_wipe (cd, tmp_path, CRYPT_WIPE_ZERO, 0, 0, 1048576,
++                          0, &_wipe_progress, &progress_id);
++        bd_utils_report_progress (progress_id, 100, "Wipe finished");
++        if (ret != 0) {
++            g_set_error (error, BD_CRYPTO_ERROR, BD_CRYPTO_ERROR_DEVICE,
++                         "Failed to wipe the newly created integrity device: %s",
++                         strerror_l (-ret, c_locale));
++
++            ret = crypt_deactivate (cd, tmp_name);
++            if (ret != 0)
++                g_warning ("Failed to deactivate temporary device %s", tmp_name);
++
++            crypt_free (cd);
++            bd_utils_report_finished (progress_id, (*error)->message);
++            return FALSE;
++        }
++
++        ret = crypt_deactivate (cd, tmp_name);
++        if (ret != 0)
++            g_warning ("Failed to deactivate temporary device %s", tmp_name);
++
++    } else
++        bd_utils_report_finished (progress_id, "Completed");
++
++    crypt_free (cd);
++
++    return TRUE;
++}
++
++/**
++ * bd_crypto_integrity_open:
++ * @device: integrity device to open
++ * @name: name for the opened @device
++ * @algorithm: (allow-none): integrity algorithm specification (e.g. "crc32c" or "sha256") or %NULL to use the default
++ * @key_data: (allow-none) (array length=key_size): integrity key or %NULL if not needed
++ * @key_size: size the integrity key and @key_data
++ * @flags: flags for the integrity device activation
++ * @extra: (allow-none): extra arguments for integrity open
++ * @error: (out): place to store error (if any)
++ *
++ * Returns: whether the @device was successfully opened or not
++ *
++ * Tech category: %BD_CRYPTO_TECH_INTEGRITY-%BD_CRYPTO_TECH_MODE_OPEN_CLOSE
++ */
++gboolean bd_crypto_integrity_open (const gchar *device, const gchar *name, const gchar *algorithm, const guint8* key_data, gsize key_size, BDCryptoIntegrityOpenFlags flags, BDCryptoIntegrityExtra *extra, GError **error) {
++    struct crypt_device *cd = NULL;
++    gint ret = 0;
++    guint64 progress_id = 0;
++    gchar *msg = NULL;
++    struct crypt_params_integrity params = ZERO_INIT;
++
++    params.integrity = algorithm;
++    params.integrity_key_size = key_size;
++
++    if (extra) {
++        params.sector_size = extra->sector_size;
++        params.journal_size = extra->journal_size;
++        params.journal_watermark = extra->journal_watermark;
++        params.journal_commit_time = extra->journal_commit_time;
++        params.interleave_sectors = extra->interleave_sectors;
++        params.tag_size = extra->tag_size;
++        params.buffer_sectors = extra->buffer_sectors;
++    }
++
++    msg = g_strdup_printf ("Started opening '%s' integrity device", device);
++    progress_id = bd_utils_report_started (msg);
++    g_free (msg);
++
++    ret = crypt_init (&cd, device);
++    if (ret != 0) {
++        g_set_error (error, BD_CRYPTO_ERROR, BD_CRYPTO_ERROR_DEVICE,
++                     "Failed to initialize device: %s", strerror_l (-ret, c_locale));
++        bd_utils_report_finished (progress_id, (*error)->message);
++        return FALSE;
++    }
++
++    ret = crypt_load (cd, CRYPT_INTEGRITY, &params);
++    if (ret != 0) {
++        g_set_error (error, BD_CRYPTO_ERROR, BD_CRYPTO_ERROR_DEVICE,
++                     "Failed to load device's parameters: %s", strerror_l (-ret, c_locale));
++        crypt_free (cd);
++        bd_utils_report_finished (progress_id, (*error)->message);
++        return FALSE;
++    }
++
++    ret = crypt_activate_by_volume_key (cd, name, (const char *) key_data, key_size, flags);
++    if (ret < 0) {
++        g_set_error (error, BD_CRYPTO_ERROR, BD_CRYPTO_ERROR_DEVICE,
++                     "Failed to activate device: %s", strerror_l (-ret, c_locale));
++
++        crypt_free (cd);
++        bd_utils_report_finished (progress_id, (*error)->message);
++        return FALSE;
++    }
++
++    crypt_free (cd);
++    bd_utils_report_finished (progress_id, "Completed");
++    return TRUE;
++}
++
++/**
++ * bd_crypto_integrity_close:
++ * @integrity_device: integrity device to close
++ * @error: (out): place to store error (if any)
++ *
++ * Returns: whether the given @integrity_device was successfully closed or not
++ *
++ * Tech category: %BD_CRYPTO_TECH_INTEGRITY-%BD_CRYPTO_TECH_MODE_OPEN_CLOSE
++ */
++gboolean bd_crypto_integrity_close (const gchar *integrity_device, GError **error) {
++    return _crypto_close (integrity_device, "integrity", error);
++}
++
+ /**
+  * bd_crypto_device_seems_encrypted:
+  * @device: the queried device
+@@ -2471,7 +2722,7 @@ gboolean bd_crypto_escrow_device (const gchar *device, const gchar *passphrase,
+  *
+  * Tech category: %BD_CRYPTO_TECH_BITLK-%BD_CRYPTO_TECH_MODE_OPEN_CLOSE
+  */
+-#ifndef LIBCRYPTSETUP_BITLK
++#ifndef LIBCRYPTSETUP_23
+ gboolean bd_crypto_bitlk_open (const gchar *device UNUSED, const gchar *name UNUSED, const guint8* pass_data UNUSED, gsize data_len UNUSED, gboolean read_only UNUSED, GError **error) {
+     /* this will return FALSE and set error, because BITLK technology is not available */
+     return bd_crypto_is_tech_avail (BD_CRYPTO_TECH_BITLK, BD_CRYPTO_TECH_MODE_OPEN_CLOSE, error);
+@@ -2541,7 +2792,7 @@ gboolean bd_crypto_bitlk_open (const gchar *device, const gchar *name, const gui
+  *
+  * Tech category: %BD_CRYPTO_TECH_BITLK-%BD_CRYPTO_TECH_MODE_OPEN_CLOSE
+  */
+-#ifndef LIBCRYPTSETUP_BITLK
++#ifndef LIBCRYPTSETUP_23
+ gboolean bd_crypto_bitlk_close (const gchar *bitlk_device UNUSED, GError **error) {
+     /* this will return FALSE and set error, because BITLK technology is not available */
+     return bd_crypto_is_tech_avail (BD_CRYPTO_TECH_BITLK, BD_CRYPTO_TECH_MODE_OPEN_CLOSE, error);
+diff --git a/src/plugins/crypto.h b/src/plugins/crypto.h
+index 1c8f47ea..6c1d40dd 100644
+--- a/src/plugins/crypto.h
++++ b/src/plugins/crypto.h
+@@ -122,6 +122,43 @@ void bd_crypto_luks_extra_free (BDCryptoLUKSExtra *extra);
+ BDCryptoLUKSExtra* bd_crypto_luks_extra_copy (BDCryptoLUKSExtra *extra);
+ BDCryptoLUKSExtra* bd_crypto_luks_extra_new (guint64 data_alignment, const gchar *data_device, const gchar *integrity, guint64 sector_size, const gchar *label, const gchar *subsystem, BDCryptoLUKSPBKDF *pbkdf);
+ 
++/**
++ * BDCryptoIntegrityExtra:
++ * @sector_size: integrity sector size
++ * @journal_size: size of journal in bytes
++ * @journal_watermark: journal flush watermark in percents; in bitmap mode sectors-per-bit
++ * @journal_commit_time: journal commit time (or bitmap flush time) in ms
++ * @interleave_sectors: number of interleave sectors (power of two)
++ * @tag_size: tag size per-sector in bytes
++ * @buffer_sectors: number of sectors in one buffer
++ */
++typedef struct BDCryptoIntegrityExtra {
++    guint32 sector_size;
++    guint64 journal_size;
++    guint journal_watermark;
++    guint journal_commit_time;
++    guint32 interleave_sectors;
++    guint32 tag_size;
++    guint32 buffer_sectors;
++} BDCryptoIntegrityExtra;
++
++void bd_crypto_integrity_extra_free (BDCryptoIntegrityExtra *extra);
++BDCryptoIntegrityExtra* bd_crypto_integrity_extra_copy (BDCryptoIntegrityExtra *extra);
++BDCryptoIntegrityExtra* bd_crypto_integrity_extra_new (guint64 sector_size, guint64 journal_size, guint journal_watermark, guint journal_commit_time, guint64 interleave_sectors, guint64 tag_size, guint64 buffer_sectors);
++
++typedef enum {
++    BD_CRYPTO_INTEGRITY_OPEN_NO_JOURNAL         = CRYPT_ACTIVATE_NO_JOURNAL,
++    BD_CRYPTO_INTEGRITY_OPEN_RECOVERY           = CRYPT_ACTIVATE_RECOVERY,
++#ifdef CRYPT_ACTIVATE_NO_JOURNAL_BITMAP
++    BD_CRYPTO_INTEGRITY_OPEN_NO_JOURNAL_BITMAP  = CRYPT_ACTIVATE_NO_JOURNAL_BITMAP,
++#endif
++    BD_CRYPTO_INTEGRITY_OPEN_RECALCULATE        = CRYPT_ACTIVATE_RECALCULATE,
++#ifdef CRYPT_ACTIVATE_RECALCULATE_RESET
++    BD_CRYPTO_INTEGRITY_OPEN_RECALCULATE_RESET  = CRYPT_ACTIVATE_RECALCULATE_RESET,
++#endif
++    BD_CRYPTO_INTEGRITY_OPEN_ALLOW_DISCARDS     = CRYPT_ACTIVATE_ALLOW_DISCARDS,
++} BDCryptoIntegrityOpenFlags;
++
+ /**
+  * BDCryptoLUKSInfo:
+  * @version: LUKS version
+@@ -215,6 +252,10 @@ gboolean bd_crypto_luks_header_restore (const gchar *device, const gchar *backup
+ BDCryptoLUKSInfo* bd_crypto_luks_info (const gchar *luks_device, GError **error);
+ BDCryptoIntegrityInfo* bd_crypto_integrity_info (const gchar *device, GError **error);
+ 
++gboolean bd_crypto_integrity_format (const gchar *device, const gchar *algorithm, gboolean wipe, const guint8* key_data, gsize key_size, BDCryptoIntegrityExtra *extra, GError **error);
++gboolean bd_crypto_integrity_open (const gchar *device, const gchar *name, const gchar *algorithm, const guint8* key_data, gsize key_size, BDCryptoIntegrityOpenFlags flags, BDCryptoIntegrityExtra *extra, GError **error);
++gboolean bd_crypto_integrity_close (const gchar *integrity_device, GError **error);
++
+ gboolean bd_crypto_device_seems_encrypted (const gchar *device, GError **error);
+ gboolean bd_crypto_tc_open (const gchar *device, const gchar *name, const guint8* pass_data, gsize data_len, gboolean read_only, GError **error);
+ gboolean bd_crypto_tc_open_full (const gchar *device, const gchar *name, const guint8* pass_data, gsize data_len, const gchar **keyfiles, gboolean hidden, gboolean system, gboolean veracrypt, guint32 veracrypt_pim, gboolean read_only, GError **error);
+diff --git a/src/python/gi/overrides/BlockDev.py b/src/python/gi/overrides/BlockDev.py
+index 8574ab04..8bd03cf8 100644
+--- a/src/python/gi/overrides/BlockDev.py
++++ b/src/python/gi/overrides/BlockDev.py
+@@ -276,6 +276,30 @@ def crypto_bitlk_open(device, name, passphrase, read_only=False):
+ __all__.append("crypto_bitlk_open")
+ 
+ 
++class CryptoIntegrityExtra(BlockDev.CryptoIntegrityExtra):
++    def __new__(cls, sector_size=0, journal_size=0, journal_watermark=0, journal_commit_time=0, interleave_sectors=0, tag_size=0, buffer_sectors=0):
++        ret = BlockDev.CryptoIntegrityExtra.new(sector_size, journal_size, journal_watermark, journal_commit_time, interleave_sectors, tag_size, buffer_sectors)
++        ret.__class__ = cls
++        return ret
++    def __init__(self, *args, **kwargs):   # pylint: disable=unused-argument
++        super(CryptoIntegrityExtra, self).__init__()  #pylint: disable=bad-super-call
++CryptoIntegrityExtra = override(CryptoIntegrityExtra)
++__all__.append("CryptoIntegrityExtra")
++
++
++_crypto_integrity_format = BlockDev.crypto_integrity_format
++@override(BlockDev.crypto_integrity_format)
++def crypto_integrity_format(device, algorithm=None, wipe=True, key_data=None, extra=None):
++    return _crypto_integrity_format(device, algorithm, wipe, key_data, extra)
++__all__.append("crypto_integrity_format")
++
++_crypto_integrity_open = BlockDev.crypto_integrity_open
++@override(BlockDev.crypto_integrity_open)
++def crypto_integrity_open(device, name, algorithm, key_data=None, flags=0, extra=None):
++    return _crypto_integrity_open(device, name, algorithm, key_data, flags, extra)
++__all__.append("crypto_integrity_open")
++
++
+ _dm_create_linear = BlockDev.dm_create_linear
+ @override(BlockDev.dm_create_linear)
+ def dm_create_linear(map_name, device, length, uuid=None):
+diff --git a/tests/crypto_test.py b/tests/crypto_test.py
+index 5e02c00d..a8fc8579 100644
+--- a/tests/crypto_test.py
++++ b/tests/crypto_test.py
+@@ -2,6 +2,7 @@ import unittest
+ import os
+ import tempfile
+ import overrides_hack
++import secrets
+ import shutil
+ import subprocess
+ import six
+@@ -34,6 +35,8 @@ class CryptoTestCase(unittest.TestCase):
+ 
+     requested_plugins = BlockDev.plugin_specs_from_names(("crypto", "loop"))
+ 
++    _dm_name = "libblockdevTestLUKS"
++
+     @classmethod
+     def setUpClass(cls):
+         unittest.TestCase.setUpClass()
+@@ -64,7 +67,7 @@ class CryptoTestCase(unittest.TestCase):
+ 
+     def _clean_up(self):
+         try:
+-            BlockDev.crypto_luks_close("libblockdevTestLUKS")
++            BlockDev.crypto_luks_close(self._dm_name)
+         except:
+             pass
+ 
+@@ -1029,7 +1032,7 @@ class CryptoTestLuksSectorSize(CryptoTestCase):
+         self.assertTrue(succ)
+ 
+ 
+-class CryptoTestIntegrity(CryptoTestCase):
++class CryptoTestLUKS2Integrity(CryptoTestCase):
+     @tag_test(TestTags.SLOW)
+     @unittest.skipUnless(HAVE_LUKS2, "LUKS 2 not supported")
+     def test_luks2_integrity(self):
+@@ -1216,3 +1219,92 @@ class CryptoTestBitlk(CryptoTestCase):
+         succ = BlockDev.crypto_bitlk_close("libblockdevTestBitlk")
+         self.assertTrue(succ)
+         self.assertFalse(os.path.exists("/dev/mapper/libblockdevTestBitlk"))
++
++
++class CryptoTestIntegrity(CryptoTestCase):
++
++    _dm_name = "libblockdevTestIntegrity"
++
++    @unittest.skipUnless(HAVE_LUKS2, "Integrity not supported")
++    def test_integrity(self):
++        # basic format+open+close test
++        succ = BlockDev.crypto_integrity_format(self.loop_dev, "sha256", False)
++        self.assertTrue(succ)
++
++        succ = BlockDev.crypto_integrity_open(self.loop_dev, self._dm_name, "sha256")
++        self.assertTrue(succ)
++        self.assertTrue(os.path.exists("/dev/mapper/%s" % self._dm_name))
++
++        info = BlockDev.crypto_integrity_info(self._dm_name)
++        self.assertEqual(info.algorithm, "sha256")
++
++        succ = BlockDev.crypto_integrity_close(self._dm_name)
++        self.assertTrue(succ)
++        self.assertFalse(os.path.exists("/dev/mapper/%s" % self._dm_name))
++
++        # same now with a keyed algorithm
++        key = list(secrets.token_bytes(64))
++
++        succ = BlockDev.crypto_integrity_format(self.loop_dev, "hmac(sha256)", False, key)
++        self.assertTrue(succ)
++
++        succ = BlockDev.crypto_integrity_open(self.loop_dev, self._dm_name, "hmac(sha256)", key)
++        self.assertTrue(succ)
++        self.assertTrue(os.path.exists("/dev/mapper/%s" % self._dm_name))
++
++        info = BlockDev.crypto_integrity_info(self._dm_name)
++        self.assertEqual(info.algorithm, "hmac(sha256)")
++
++        succ = BlockDev.crypto_integrity_close(self._dm_name)
++        self.assertTrue(succ)
++        self.assertFalse(os.path.exists("/dev/mapper/%s" % self._dm_name))
++
++        # same with some custom parameters
++        extra = BlockDev.CryptoIntegrityExtra(sector_size=4096, interleave_sectors=65536)
++        succ = BlockDev.crypto_integrity_format(self.loop_dev, "crc32c", wipe=False, extra=extra)
++        self.assertTrue(succ)
++
++        succ = BlockDev.crypto_integrity_open(self.loop_dev, self._dm_name, "crc32c")
++        self.assertTrue(succ)
++        self.assertTrue(os.path.exists("/dev/mapper/%s" % self._dm_name))
++
++        info = BlockDev.crypto_integrity_info(self._dm_name)
++        self.assertEqual(info.algorithm, "crc32c")
++        self.assertEqual(info.sector_size, 4096)
++        self.assertEqual(info.interleave_sectors, 65536)
++
++        succ = BlockDev.crypto_integrity_close(self._dm_name)
++        self.assertTrue(succ)
++        self.assertFalse(os.path.exists("/dev/mapper/%s" % self._dm_name))
++
++    @tag_test(TestTags.SLOW)
++    @unittest.skipUnless(HAVE_LUKS2, "Integrity not supported")
++    def test_integrity_wipe(self):
++        # also check that wipe progress reporting works
++        progress_log = []
++
++        def _my_progress_func(_task, _status, completion, msg):
++            progress_log.append((completion, msg))
++
++        succ = BlockDev.utils_init_prog_reporting(_my_progress_func)
++        self.assertTrue(succ)
++        self.addCleanup(BlockDev.utils_init_prog_reporting, None)
++
++        succ = BlockDev.crypto_integrity_format(self.loop_dev, "sha256", True)
++        self.assertTrue(succ)
++
++        # at least one message "Integrity device wipe in progress" should be logged
++        self.assertTrue(any(prog[1] == "Integrity device wipe in progress" for prog in progress_log))
++
++        succ = BlockDev.crypto_integrity_open(self.loop_dev, self._dm_name, "sha256")
++        self.assertTrue(succ)
++        self.assertTrue(os.path.exists("/dev/mapper/%s" % self._dm_name))
++
++        # check the devices was wiped and the checksums recalculated
++        # (mkfs reads some blocks first so without checksums it would fail)
++        ret, _out, err = run_command("mkfs.ext2 /dev/mapper/%s " % self._dm_name)
++        self.assertEqual(ret, 0, msg="Failed to create ext2 filesystem on integrity: %s" % err)
++
++        succ = BlockDev.crypto_integrity_close(self._dm_name)
++        self.assertTrue(succ)
++        self.assertFalse(os.path.exists("/dev/mapper/%s" % self._dm_name))
+-- 
+2.37.3
+
+
+From ad4ac36520ec96af2a7b043189bbdf18cc3cffb9 Mon Sep 17 00:00:00 2001
+From: Vojtech Trefny <vtrefny@redhat.com>
+Date: Thu, 30 Sep 2021 16:01:40 +0200
+Subject: [PATCH 2/3] Create smaller test images for integrity tests
+
+We are going to overwrite the entire device in test_integrity_wipe
+so we need to make sure the sparse actually fits to /tmp which
+can be smaller than 1 GiB.
+---
+ tests/crypto_test.py | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/tests/crypto_test.py b/tests/crypto_test.py
+index a8fc8579..9758bf81 100644
+--- a/tests/crypto_test.py
++++ b/tests/crypto_test.py
+@@ -36,6 +36,7 @@ class CryptoTestCase(unittest.TestCase):
+     requested_plugins = BlockDev.plugin_specs_from_names(("crypto", "loop"))
+ 
+     _dm_name = "libblockdevTestLUKS"
++    _sparse_size = 1024**3
+ 
+     @classmethod
+     def setUpClass(cls):
+@@ -49,8 +50,8 @@ class CryptoTestCase(unittest.TestCase):
+ 
+     def setUp(self):
+         self.addCleanup(self._clean_up)
+-        self.dev_file = create_sparse_tempfile("crypto_test", 1024**3)
+-        self.dev_file2 = create_sparse_tempfile("crypto_test2", 1024**3)
++        self.dev_file = create_sparse_tempfile("crypto_test", self._sparse_size)
++        self.dev_file2 = create_sparse_tempfile("crypto_test2", self._sparse_size)
+         try:
+             self.loop_dev = create_lio_device(self.dev_file)
+         except RuntimeError as e:
+@@ -1224,6 +1225,7 @@ class CryptoTestBitlk(CryptoTestCase):
+ class CryptoTestIntegrity(CryptoTestCase):
+ 
+     _dm_name = "libblockdevTestIntegrity"
++    _sparse_size = 100 * 1024**2
+ 
+     @unittest.skipUnless(HAVE_LUKS2, "Integrity not supported")
+     def test_integrity(self):
+-- 
+2.37.3
+
+
+From 048a803be5186b30c0f0a7e67020486990ba6b81 Mon Sep 17 00:00:00 2001
+From: Vojtech Trefny <vtrefny@redhat.com>
+Date: Wed, 20 Oct 2021 10:27:41 +0200
+Subject: [PATCH 3/3] crypto: Do not use libcryptsetup flags directly in
+ crypto.h
+
+We can "translate" our flags in the implementation instead to
+avoid including libcryptsetup.h in our header and API files.
+---
+ src/lib/plugin_apis/crypto.api | 17 ++++++-----------
+ src/plugins/crypto.c           | 34 +++++++++++++++++++++++++++++++++-
+ src/plugins/crypto.h           | 16 ++++++----------
+ tests/crypto_test.py           | 14 ++++++++++++++
+ 4 files changed, 59 insertions(+), 22 deletions(-)
+
+diff --git a/src/lib/plugin_apis/crypto.api b/src/lib/plugin_apis/crypto.api
+index 40e32c89..cf87979d 100644
+--- a/src/lib/plugin_apis/crypto.api
++++ b/src/lib/plugin_apis/crypto.api
+@@ -1,6 +1,5 @@
+ #include <glib.h>
+ #include <blockdev/utils.h>
+-#include <libcryptsetup.h>
+ 
+ #define BD_CRYPTO_LUKS_METADATA_SIZE G_GUINT64_CONSTANT (2097152ULL) // 2 MiB
+ 
+@@ -343,16 +342,12 @@ GType bd_crypto_integrity_extra_get_type () {
+ }
+ 
+ typedef enum {
+-    BD_CRYPTO_INTEGRITY_OPEN_NO_JOURNAL         = CRYPT_ACTIVATE_NO_JOURNAL,
+-    BD_CRYPTO_INTEGRITY_OPEN_RECOVERY           = CRYPT_ACTIVATE_RECOVERY,
+-#ifdef CRYPT_ACTIVATE_NO_JOURNAL_BITMAP
+-    BD_CRYPTO_INTEGRITY_OPEN_NO_JOURNAL_BITMAP  = CRYPT_ACTIVATE_NO_JOURNAL_BITMAP,
+-#endif
+-    BD_CRYPTO_INTEGRITY_OPEN_RECALCULATE        = CRYPT_ACTIVATE_RECALCULATE,
+-#ifdef CRYPT_ACTIVATE_RECALCULATE_RESET
+-    BD_CRYPTO_INTEGRITY_OPEN_RECALCULATE_RESET  = CRYPT_ACTIVATE_RECALCULATE_RESET,
+-#endif
+-    BD_CRYPTO_INTEGRITY_OPEN_ALLOW_DISCARDS     = CRYPT_ACTIVATE_ALLOW_DISCARDS,
++    BD_CRYPTO_INTEGRITY_OPEN_NO_JOURNAL         = 1 << 0,
++    BD_CRYPTO_INTEGRITY_OPEN_RECOVERY           = 1 << 1,
++    BD_CRYPTO_INTEGRITY_OPEN_NO_JOURNAL_BITMAP  = 1 << 2,
++    BD_CRYPTO_INTEGRITY_OPEN_RECALCULATE        = 1 << 3,
++    BD_CRYPTO_INTEGRITY_OPEN_RECALCULATE_RESET  = 1 << 4,
++    BD_CRYPTO_INTEGRITY_OPEN_ALLOW_DISCARDS     = 1 << 5,
+ } BDCryptoIntegrityOpenFlags;
+ 
+ #define BD_CRYPTO_TYPE_LUKS_INFO (bd_crypto_luks_info_get_type ())
+diff --git a/src/plugins/crypto.c b/src/plugins/crypto.c
+index 8549cf23..35c38410 100644
+--- a/src/plugins/crypto.c
++++ b/src/plugins/crypto.c
+@@ -2223,6 +2223,7 @@ gboolean bd_crypto_integrity_open (const gchar *device, const gchar *name, const
+     guint64 progress_id = 0;
+     gchar *msg = NULL;
+     struct crypt_params_integrity params = ZERO_INIT;
++    guint32 activate_flags = 0;
+ 
+     params.integrity = algorithm;
+     params.integrity_key_size = key_size;
+@@ -2237,6 +2238,37 @@ gboolean bd_crypto_integrity_open (const gchar *device, const gchar *name, const
+         params.buffer_sectors = extra->buffer_sectors;
+     }
+ 
++
++    if (flags & BD_CRYPTO_INTEGRITY_OPEN_NO_JOURNAL)
++        activate_flags |= CRYPT_ACTIVATE_NO_JOURNAL;
++    if (flags & BD_CRYPTO_INTEGRITY_OPEN_RECOVERY)
++        activate_flags |= CRYPT_ACTIVATE_RECOVERY;
++    if (flags & BD_CRYPTO_INTEGRITY_OPEN_RECALCULATE)
++        activate_flags |= CRYPT_ACTIVATE_RECALCULATE;
++    if (flags & BD_CRYPTO_INTEGRITY_OPEN_ALLOW_DISCARDS)
++        activate_flags |= CRYPT_ACTIVATE_ALLOW_DISCARDS;
++    if (flags & BD_CRYPTO_INTEGRITY_OPEN_NO_JOURNAL_BITMAP) {
++#ifndef CRYPT_ACTIVATE_NO_JOURNAL_BITMAP
++        g_set_error (error, BD_CRYPTO_ERROR, BD_CRYPTO_ERROR_TECH_UNAVAIL,
++                     "Cannot activate %s with bitmap, installed version of cryptsetup doesn't support this option.", device);
++        bd_utils_report_finished (progress_id, (*error)->message);
++        return FALSE;
++#else
++        activate_flags |= CRYPT_ACTIVATE_NO_JOURNAL_BITMAP;
++#endif
++    }
++
++    if (flags & BD_CRYPTO_INTEGRITY_OPEN_RECALCULATE_RESET) {
++#ifndef CRYPT_ACTIVATE_RECALCULATE_RESET
++        g_set_error (error, BD_CRYPTO_ERROR, BD_CRYPTO_ERROR_TECH_UNAVAIL,
++                     "Cannot reset integrity recalculation while activating %s, installed version of cryptsetup doesn't support this option.", device);
++        bd_utils_report_finished (progress_id, (*error)->message);
++        return FALSE;
++#else
++        activate_flags |= CRYPT_ACTIVATE_RECALCULATE_RESET;
++#endif
++    }
++
+     msg = g_strdup_printf ("Started opening '%s' integrity device", device);
+     progress_id = bd_utils_report_started (msg);
+     g_free (msg);
+@@ -2258,7 +2290,7 @@ gboolean bd_crypto_integrity_open (const gchar *device, const gchar *name, const
+         return FALSE;
+     }
+ 
+-    ret = crypt_activate_by_volume_key (cd, name, (const char *) key_data, key_size, flags);
++    ret = crypt_activate_by_volume_key (cd, name, (const char *) key_data, key_size, activate_flags);
+     if (ret < 0) {
+         g_set_error (error, BD_CRYPTO_ERROR, BD_CRYPTO_ERROR_DEVICE,
+                      "Failed to activate device: %s", strerror_l (-ret, c_locale));
+diff --git a/src/plugins/crypto.h b/src/plugins/crypto.h
+index 6c1d40dd..536accf9 100644
+--- a/src/plugins/crypto.h
++++ b/src/plugins/crypto.h
+@@ -147,16 +147,12 @@ BDCryptoIntegrityExtra* bd_crypto_integrity_extra_copy (BDCryptoIntegrityExtra *
+ BDCryptoIntegrityExtra* bd_crypto_integrity_extra_new (guint64 sector_size, guint64 journal_size, guint journal_watermark, guint journal_commit_time, guint64 interleave_sectors, guint64 tag_size, guint64 buffer_sectors);
+ 
+ typedef enum {
+-    BD_CRYPTO_INTEGRITY_OPEN_NO_JOURNAL         = CRYPT_ACTIVATE_NO_JOURNAL,
+-    BD_CRYPTO_INTEGRITY_OPEN_RECOVERY           = CRYPT_ACTIVATE_RECOVERY,
+-#ifdef CRYPT_ACTIVATE_NO_JOURNAL_BITMAP
+-    BD_CRYPTO_INTEGRITY_OPEN_NO_JOURNAL_BITMAP  = CRYPT_ACTIVATE_NO_JOURNAL_BITMAP,
+-#endif
+-    BD_CRYPTO_INTEGRITY_OPEN_RECALCULATE        = CRYPT_ACTIVATE_RECALCULATE,
+-#ifdef CRYPT_ACTIVATE_RECALCULATE_RESET
+-    BD_CRYPTO_INTEGRITY_OPEN_RECALCULATE_RESET  = CRYPT_ACTIVATE_RECALCULATE_RESET,
+-#endif
+-    BD_CRYPTO_INTEGRITY_OPEN_ALLOW_DISCARDS     = CRYPT_ACTIVATE_ALLOW_DISCARDS,
++    BD_CRYPTO_INTEGRITY_OPEN_NO_JOURNAL         = 1 << 0,
++    BD_CRYPTO_INTEGRITY_OPEN_RECOVERY           = 1 << 1,
++    BD_CRYPTO_INTEGRITY_OPEN_NO_JOURNAL_BITMAP  = 1 << 2,
++    BD_CRYPTO_INTEGRITY_OPEN_RECALCULATE        = 1 << 3,
++    BD_CRYPTO_INTEGRITY_OPEN_RECALCULATE_RESET  = 1 << 4,
++    BD_CRYPTO_INTEGRITY_OPEN_ALLOW_DISCARDS     = 1 << 5,
+ } BDCryptoIntegrityOpenFlags;
+ 
+ /**
+diff --git a/tests/crypto_test.py b/tests/crypto_test.py
+index 9758bf81..94b89131 100644
+--- a/tests/crypto_test.py
++++ b/tests/crypto_test.py
+@@ -1279,6 +1279,20 @@ class CryptoTestIntegrity(CryptoTestCase):
+         self.assertTrue(succ)
+         self.assertFalse(os.path.exists("/dev/mapper/%s" % self._dm_name))
+ 
++        # open with flags
++        succ = BlockDev.crypto_integrity_open(self.loop_dev, self._dm_name, "crc32c",
++                                              flags=BlockDev.CryptoIntegrityOpenFlags.ALLOW_DISCARDS)
++        self.assertTrue(succ)
++        self.assertTrue(os.path.exists("/dev/mapper/%s" % self._dm_name))
++
++        # check that discard is enabled for the mapped device
++        _ret, out, _err = run_command("dmsetup table %s" % self._dm_name)
++        self.assertIn("allow_discards", out)
++
++        succ = BlockDev.crypto_integrity_close(self._dm_name)
++        self.assertTrue(succ)
++        self.assertFalse(os.path.exists("/dev/mapper/%s" % self._dm_name))
++
+     @tag_test(TestTags.SLOW)
+     @unittest.skipUnless(HAVE_LUKS2, "Integrity not supported")
+     def test_integrity_wipe(self):
+-- 
+2.37.3
+

SOURCES/0005-nvme-Fix-namespace-identifiers.patch

@@ -0,0 +1,506 @@
+From b25fd9caca9b2fb34e5a4d7d4bee0031e4758d0a Mon Sep 17 00:00:00 2001
+From: Tomas Bzatek <tbzatek@redhat.com>
+Date: Thu, 22 Sep 2022 16:31:28 +0200
+Subject: [PATCH 1/5] nvme: Avoid sending NVME_IDENTIFY_CNS_NS_DESC_LIST on
+ older devices
+
+Turned out this Identify feature was introduced only with the NVMe 1.3
+specification. To find out device supported NVMe revision an extra
+Identify Controller call is needed.
+---
+ src/plugins/nvme/nvme-info.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/src/plugins/nvme/nvme-info.c b/src/plugins/nvme/nvme-info.c
+index fdd90459..112b4054 100644
+--- a/src/plugins/nvme/nvme-info.c
++++ b/src/plugins/nvme/nvme-info.c
+@@ -431,7 +431,7 @@ BDNVMEControllerInfo * bd_nvme_get_controller_info (const gchar *device, GError
+     if (fd < 0)
+         return NULL;
+ 
+-    /* send the NVME_IDENTIFY_CNS_NS + NVME_IDENTIFY_CNS_CTRL ioctl */
++    /* send the NVME_IDENTIFY_CNS_CTRL ioctl */
+     ret = nvme_identify_ctrl (fd, &ctrl_id);
+     if (ret != 0) {
+         _nvme_status_to_error (ret, FALSE, error);
+@@ -539,9 +539,11 @@ BDNVMEControllerInfo * bd_nvme_get_controller_info (const gchar *device, GError
+  */
+ BDNVMENamespaceInfo *bd_nvme_get_namespace_info (const gchar *device, GError **error) {
+     int ret;
+-    int ret_desc;
++    int ret_ctrl;
++    int ret_desc = -1;
+     int fd;
+     __u32 nsid = 0;
++    struct nvme_id_ctrl ctrl_id = ZERO_INIT;
+     struct nvme_id_ns ns_info = ZERO_INIT;
+     uint8_t desc[NVME_IDENTIFY_DATA_SIZE] = ZERO_INIT;
+     guint8 flbas;
+@@ -565,7 +567,6 @@ BDNVMENamespaceInfo *bd_nvme_get_namespace_info (const gchar *device, GError **e
+     }
+ 
+     /* send the NVME_IDENTIFY_CNS_NS ioctl */
+-    ret_desc = nvme_identify_ns_descs (fd, nsid, (struct nvme_ns_id_desc *) &desc);
+     ret = nvme_identify_ns (fd, nsid, &ns_info);
+     if (ret != 0) {
+         _nvme_status_to_error (ret, FALSE, error);
+@@ -573,6 +574,13 @@ BDNVMENamespaceInfo *bd_nvme_get_namespace_info (const gchar *device, GError **e
+         close (fd);
+         return NULL;
+     }
++
++    /* send the NVME_IDENTIFY_CNS_CTRL ioctl */
++    ret_ctrl = nvme_identify_ctrl (fd, &ctrl_id);
++
++    /* send the NVME_IDENTIFY_CNS_NS_DESC_LIST ioctl, NVMe 1.3 */
++    if (ret_ctrl == 0 && GUINT32_FROM_LE (ctrl_id.ver) >= 0x10300)
++        ret_desc = nvme_identify_ns_descs (fd, nsid, (struct nvme_ns_id_desc *) &desc);
+     close (fd);
+ 
+     info = g_new0 (BDNVMENamespaceInfo, 1);
+-- 
+2.39.0
+
+
+From e6f7d0c4562623b03df96dc6b89ab00d8e4d6b90 Mon Sep 17 00:00:00 2001
+From: Tomas Bzatek <tbzatek@redhat.com>
+Date: Thu, 22 Sep 2022 16:56:26 +0200
+Subject: [PATCH 2/5] nvme: Add BD_NVME_NS_FEAT_ROTATIONAL
+
+A NVMe 2.0 feature indicating rotational medium on a namespace level.
+Further information can be found in the Rotational Media Information Log
+page (Log Identifier 16h) that is not implemented in libblockdev yet.
+---
+ src/lib/plugin_apis/nvme.api |  2 ++
+ src/plugins/nvme/nvme-info.c | 10 ++++++++++
+ src/plugins/nvme/nvme.h      |  2 ++
+ tests/nvme_test.py           |  1 +
+ 4 files changed, 15 insertions(+)
+
+diff --git a/src/lib/plugin_apis/nvme.api b/src/lib/plugin_apis/nvme.api
+index 79247a01..7bc2cf9e 100644
+--- a/src/lib/plugin_apis/nvme.api
++++ b/src/lib/plugin_apis/nvme.api
+@@ -317,12 +317,14 @@ GType bd_nvme_lba_format_get_type () {
+  *                                    in the NVM subsystem concurrently.
+  * @BD_NVME_NS_FEAT_FORMAT_PROGRESS: indicates the capability to report the percentage of the namespace
+  *                                   that remains to be formatted.
++ * @BD_NVME_NS_FEAT_ROTATIONAL: indicates a rotational medium.
+  */
+ /* BpG-skip-end */
+ typedef enum {
+     BD_NVME_NS_FEAT_THIN             = 1 << 0,
+     BD_NVME_NS_FEAT_MULTIPATH_SHARED = 1 << 1,
+     BD_NVME_NS_FEAT_FORMAT_PROGRESS  = 1 << 2,
++    BD_NVME_NS_FEAT_ROTATIONAL       = 1 << 3,
+ } BDNVMENamespaceFeature;
+ 
+ #define BD_NVME_TYPE_NAMESPACE_INFO (bd_nvme_namespace_info_get_type ())
+diff --git a/src/plugins/nvme/nvme-info.c b/src/plugins/nvme/nvme-info.c
+index 112b4054..c574a6f3 100644
+--- a/src/plugins/nvme/nvme-info.c
++++ b/src/plugins/nvme/nvme-info.c
+@@ -541,10 +541,12 @@ BDNVMENamespaceInfo *bd_nvme_get_namespace_info (const gchar *device, GError **e
+     int ret;
+     int ret_ctrl;
+     int ret_desc = -1;
++    int ret_ns_ind = -1;
+     int fd;
+     __u32 nsid = 0;
+     struct nvme_id_ctrl ctrl_id = ZERO_INIT;
+     struct nvme_id_ns ns_info = ZERO_INIT;
++    struct nvme_id_independent_id_ns ns_info_ind = ZERO_INIT;
+     uint8_t desc[NVME_IDENTIFY_DATA_SIZE] = ZERO_INIT;
+     guint8 flbas;
+     guint i;
+@@ -581,6 +583,10 @@ BDNVMENamespaceInfo *bd_nvme_get_namespace_info (const gchar *device, GError **e
+     /* send the NVME_IDENTIFY_CNS_NS_DESC_LIST ioctl, NVMe 1.3 */
+     if (ret_ctrl == 0 && GUINT32_FROM_LE (ctrl_id.ver) >= 0x10300)
+         ret_desc = nvme_identify_ns_descs (fd, nsid, (struct nvme_ns_id_desc *) &desc);
++
++    /* send the NVME_IDENTIFY_CNS_CSI_INDEPENDENT_ID_NS ioctl, NVMe 2.0 */
++    if (ret_ctrl == 0 && GUINT32_FROM_LE (ctrl_id.ver) >= 0x20000)
++        ret_ns_ind = nvme_identify_independent_identify_ns (fd, nsid, &ns_info_ind);
+     close (fd);
+ 
+     info = g_new0 (BDNVMENamespaceInfo, 1);
+@@ -627,6 +633,10 @@ BDNVMENamespaceInfo *bd_nvme_get_namespace_info (const gchar *device, GError **e
+             }
+         }
+     }
++    if (ret_ns_ind == 0) {
++        if ((ns_info_ind.nsfeat & 1 << 4) == 1 << 4)
++            info->features |= BD_NVME_NS_FEAT_ROTATIONAL;
++    }
+ 
+     /* translate the LBA Format array */
+     ptr_array = g_ptr_array_new ();
+diff --git a/src/plugins/nvme/nvme.h b/src/plugins/nvme/nvme.h
+index a7d30d79..ad456a82 100644
+--- a/src/plugins/nvme/nvme.h
++++ b/src/plugins/nvme/nvme.h
+@@ -202,11 +202,13 @@ typedef struct BDNVMELBAFormat {
+  *                                    in the NVM subsystem concurrently.
+  * @BD_NVME_NS_FEAT_FORMAT_PROGRESS: indicates the capability to report the percentage of the namespace
+  *                                   that remains to be formatted.
++ * @BD_NVME_NS_FEAT_ROTATIONAL: indicates a rotational medium.
+  */
+ typedef enum {
+     BD_NVME_NS_FEAT_THIN             = 1 << 0,
+     BD_NVME_NS_FEAT_MULTIPATH_SHARED = 1 << 1,
+     BD_NVME_NS_FEAT_FORMAT_PROGRESS  = 1 << 2,
++    BD_NVME_NS_FEAT_ROTATIONAL       = 1 << 3,
+ } BDNVMENamespaceFeature;
+ 
+ /**
+diff --git a/tests/nvme_test.py b/tests/nvme_test.py
+index a46f7422..f205e539 100644
+--- a/tests/nvme_test.py
++++ b/tests/nvme_test.py
+@@ -73,6 +73,7 @@ class NVMeTestCase(NVMeTest):
+         self.assertFalse(info.features & BlockDev.NVMENamespaceFeature.THIN)
+         self.assertTrue (info.features & BlockDev.NVMENamespaceFeature.MULTIPATH_SHARED)
+         self.assertFalse(info.features & BlockDev.NVMENamespaceFeature.FORMAT_PROGRESS)
++        self.assertFalse(info.features & BlockDev.NVMENamespaceFeature.ROTATIONAL)
+         self.assertEqual(info.eui64, "0000000000000000")
+         self.assertEqual(info.format_progress_remaining, 0)
+         self.assertEqual(len(info.lba_formats), 1)
+-- 
+2.39.0
+
+
+From 4ff0df937dcd357623e7b7d960c08c476b1deffb Mon Sep 17 00:00:00 2001
+From: Tomas Bzatek <tbzatek@redhat.com>
+Date: Fri, 9 Dec 2022 16:13:43 +0100
+Subject: [PATCH 3/5] nvme: Fix namespace identifiers
+
+Use Namespace Identification Descriptor list (CNS 03h) data when available
+and NVM Command Set Identify Namespace Data Structure (CNS 00h) as a fallback.
+
+Also, if the CNS 00h EUI64 or NGUID fields equal to zero, return NULL
+instead of zeroes:
+  "If the controller is not able to provide a ... identifier in this field,
+   then this field shall be cleared to 0h."
+---
+ src/plugins/nvme/nvme-info.c | 26 +++++++++++++++++++-------
+ tests/nvme_test.py           |  2 +-
+ 2 files changed, 20 insertions(+), 8 deletions(-)
+
+diff --git a/src/plugins/nvme/nvme-info.c b/src/plugins/nvme/nvme-info.c
+index c574a6f3..ac189abe 100644
+--- a/src/plugins/nvme/nvme-info.c
++++ b/src/plugins/nvme/nvme-info.c
+@@ -603,12 +603,7 @@ BDNVMENamespaceInfo *bd_nvme_get_namespace_info (const gchar *device, GError **e
+     info->format_progress_remaining = ns_info.fpi & NVME_NS_FPI_REMAINING;
+     /* TODO: what the ns_info.nvmcap really stands for? */
+     info->write_protected = (ns_info.nsattr & NVME_NS_NSATTR_WRITE_PROTECTED) == NVME_NS_NSATTR_WRITE_PROTECTED;
+-    info->nguid = g_malloc0 (sizeof (ns_info.nguid) * 2 + 1);
+-    for (i = 0; i < G_N_ELEMENTS (ns_info.nguid); i++)
+-        snprintf (info->nguid + i * 2, 3, "%02x", ns_info.nguid[i]);
+-    info->eui64 = g_malloc0 (sizeof (ns_info.eui64) * 2 + 1);
+-    for (i = 0; i < G_N_ELEMENTS (ns_info.eui64); i++)
+-        snprintf (info->eui64 + i * 2, 3, "%02x", ns_info.eui64[i]);
++
+     if (ret_desc == 0) {
+         for (i = 0; i < NVME_IDENTIFY_DATA_SIZE; i += len) {
+             struct nvme_ns_id_desc *d = (void *) desc + i;
+@@ -620,8 +615,14 @@ BDNVMENamespaceInfo *bd_nvme_get_namespace_info (const gchar *device, GError **e
+ 
+             switch (d->nidt) {
+                 case NVME_NIDT_EUI64:
++                    info->eui64 = g_malloc0 (d->nidl * 2 + 1);
++                    for (i = 0; i < d->nidl; i++)
++                        snprintf (info->eui64 + i * 2, 3, "%02x", d->nid[i]);
++                    break;
+                 case NVME_NIDT_NGUID:
+-                    /* already have these from nvme_identify_ns() */
++                    info->nguid = g_malloc0 (d->nidl * 2 + 1);
++                    for (i = 0; i < d->nidl; i++)
++                        snprintf (info->nguid + i * 2, 3, "%02x", d->nid[i]);
+                     break;
+                 case NVME_NIDT_UUID:
+                     uuid_unparse (d->nid, uuid_buf);
+@@ -633,6 +634,17 @@ BDNVMENamespaceInfo *bd_nvme_get_namespace_info (const gchar *device, GError **e
+             }
+         }
+     }
++
++    if (info->nguid == NULL && ns_info.nguid[G_N_ELEMENTS (ns_info.nguid) - 1] > 0) {
++        info->nguid = g_malloc0 (sizeof (ns_info.nguid) * 2 + 1);
++        for (i = 0; i < G_N_ELEMENTS (ns_info.nguid); i++)
++            snprintf (info->nguid + i * 2, 3, "%02x", ns_info.nguid[i]);
++    }
++    if (info->eui64 == NULL && ns_info.eui64[G_N_ELEMENTS (ns_info.eui64) - 1] > 0) {
++        info->eui64 = g_malloc0 (sizeof (ns_info.eui64) * 2 + 1);
++        for (i = 0; i < G_N_ELEMENTS (ns_info.eui64); i++)
++            snprintf (info->eui64 + i * 2, 3, "%02x", ns_info.eui64[i]);
++    }
+     if (ret_ns_ind == 0) {
+         if ((ns_info_ind.nsfeat & 1 << 4) == 1 << 4)
+             info->features |= BD_NVME_NS_FEAT_ROTATIONAL;
+diff --git a/tests/nvme_test.py b/tests/nvme_test.py
+index f205e539..a1822be6 100644
+--- a/tests/nvme_test.py
++++ b/tests/nvme_test.py
+@@ -74,7 +74,7 @@ class NVMeTestCase(NVMeTest):
+         self.assertTrue (info.features & BlockDev.NVMENamespaceFeature.MULTIPATH_SHARED)
+         self.assertFalse(info.features & BlockDev.NVMENamespaceFeature.FORMAT_PROGRESS)
+         self.assertFalse(info.features & BlockDev.NVMENamespaceFeature.ROTATIONAL)
+-        self.assertEqual(info.eui64, "0000000000000000")
++        self.assertIsNone(info.eui64)
+         self.assertEqual(info.format_progress_remaining, 0)
+         self.assertEqual(len(info.lba_formats), 1)
+         self.assertGreater(len(info.nguid), 0)
+-- 
+2.39.0
+
+
+From cdbb9a37a19d3f388910f68c4c384bafae8901ae Mon Sep 17 00:00:00 2001
+From: Tomas Bzatek <tbzatek@redhat.com>
+Date: Wed, 11 Jan 2023 18:19:36 +0100
+Subject: [PATCH 4/5] nvme: Use libnvme-1.2's nvme_uuid_to_string()
+
+This also bumps libnvme dependency to 1.2
+---
+ configure.ac                    |  5 +----
+ src/plugins/nvme/Makefile.am    |  4 ++--
+ src/plugins/nvme/nvme-error.c   |  3 ---
+ src/plugins/nvme/nvme-fabrics.c |  1 -
+ src/plugins/nvme/nvme-info.c    | 17 ++++++++++-------
+ src/plugins/nvme/nvme-op.c      |  1 -
+ src/plugins/nvme/nvme.c         |  1 -
+ 7 files changed, 13 insertions(+), 19 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index ec789c91..fbd70473 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -281,10 +281,7 @@ AS_IF([test "x$with_nvdimm" != "xno"],
+       [])
+ 
+ AS_IF([test "x$with_nvme" != "xno"],
+-      [LIBBLOCKDEV_PKG_CHECK_MODULES([NVME], [libnvme >= 1.0])
+-      AS_IF([$PKG_CONFIG --atleast-version=1.1 libnvme],
+-            [AC_DEFINE([HAVE_LIBNVME_1_1])], [])
+-      ],
++      [LIBBLOCKDEV_PKG_CHECK_MODULES([NVME], [libnvme >= 1.2])],
+       [])
+ 
+ AS_IF([test "x$with_vdo" != "xno"],
+diff --git a/src/plugins/nvme/Makefile.am b/src/plugins/nvme/Makefile.am
+index b4a10ce0..a8a856d4 100644
+--- a/src/plugins/nvme/Makefile.am
++++ b/src/plugins/nvme/Makefile.am
+@@ -2,8 +2,8 @@ AUTOMAKE_OPTIONS = subdir-objects
+ 
+ lib_LTLIBRARIES = libbd_nvme.la
+ 
+-libbd_nvme_la_CFLAGS = $(GLIB_CFLAGS) $(GIO_CFLAGS) $(UUID_CFLAGS) $(NVME_CFLAGS) -Wall -Wextra -Werror
+-libbd_nvme_la_LIBADD = ${builddir}/../../utils/libbd_utils.la $(GLIB_LIBS) $(GIO_LIBS) $(UUID_LIBS) $(NVME_LIBS)
++libbd_nvme_la_CFLAGS = $(GLIB_CFLAGS) $(GIO_CFLAGS) $(NVME_CFLAGS) -Wall -Wextra -Werror
++libbd_nvme_la_LIBADD = ${builddir}/../../utils/libbd_utils.la $(GLIB_LIBS) $(GIO_LIBS) $(NVME_LIBS)
+ libbd_nvme_la_LDFLAGS = -L${srcdir}/../../utils/ -version-info 2:0:0 -Wl,--no-undefined
+ libbd_nvme_la_CPPFLAGS = -I${builddir}/../../../include/ -I${srcdir}/../ -I. -DPACKAGE_SYSCONF_DIR=\""$(sysconfdir)"\"
+ 
+diff --git a/src/plugins/nvme/nvme-error.c b/src/plugins/nvme/nvme-error.c
+index 86f0d6a3..cb95a46d 100644
+--- a/src/plugins/nvme/nvme-error.c
++++ b/src/plugins/nvme/nvme-error.c
+@@ -28,7 +28,6 @@
+ #include <malloc.h>
+ 
+ #include <libnvme.h>
+-#include <uuid/uuid.h>
+ 
+ #include <blockdev/utils.h>
+ #include <check_deps.h>
+@@ -123,7 +122,6 @@ void _nvme_fabrics_errno_to_gerror (int result, int _errno, GError **error)
+             case ENVME_CONNECT_LOOKUP_SUBSYS:
+                 code = BD_NVME_ERROR_CONNECT;
+                 break;
+-#ifdef HAVE_LIBNVME_1_1
+             case ENVME_CONNECT_ALREADY:
+                 code = BD_NVME_ERROR_CONNECT_ALREADY;
+                 break;
+@@ -139,7 +137,6 @@ void _nvme_fabrics_errno_to_gerror (int result, int _errno, GError **error)
+             case ENVME_CONNECT_OPNOTSUPP:
+                 code = BD_NVME_ERROR_CONNECT_OPNOTSUPP;
+                 break;
+-#endif
+             default:
+                 code = BD_NVME_ERROR_CONNECT;
+         }
+diff --git a/src/plugins/nvme/nvme-fabrics.c b/src/plugins/nvme/nvme-fabrics.c
+index 20ed57f5..bba7392d 100644
+--- a/src/plugins/nvme/nvme-fabrics.c
++++ b/src/plugins/nvme/nvme-fabrics.c
+@@ -30,7 +30,6 @@
+ #include <glib/gstdio.h>
+ 
+ #include <libnvme.h>
+-#include <uuid/uuid.h>
+ 
+ #include <blockdev/utils.h>
+ #include <check_deps.h>
+diff --git a/src/plugins/nvme/nvme-info.c b/src/plugins/nvme/nvme-info.c
+index ac189abe..18719d51 100644
+--- a/src/plugins/nvme/nvme-info.c
++++ b/src/plugins/nvme/nvme-info.c
+@@ -28,7 +28,6 @@
+ #include <malloc.h>
+ 
+ #include <libnvme.h>
+-#include <uuid/uuid.h>
+ 
+ #include <blockdev/utils.h>
+ #include <check_deps.h>
+@@ -408,6 +407,14 @@ static gchar *decode_nvme_rev (guint32 ver) {
+         return g_strdup_printf ("%u.%u.%u", mjr, mnr, ter);
+ }
+ 
++static gchar *_uuid_to_str (unsigned char uuid[NVME_UUID_LEN]) {
++    gchar uuid_buf[NVME_UUID_LEN_STRING] = ZERO_INIT;
++
++    if (nvme_uuid_to_string (uuid, uuid_buf) == 0)
++        return g_strdup (uuid_buf);
++    return NULL;
++}
++
+ /**
+  * bd_nvme_get_controller_info:
+  * @device: a NVMe controller device (e.g. `/dev/nvme0`)
+@@ -461,9 +468,7 @@ BDNVMEControllerInfo * bd_nvme_get_controller_info (const gchar *device, GError
+     info->pci_vendor_id = GUINT16_FROM_LE (ctrl_id.vid);
+     info->pci_subsys_vendor_id = GUINT16_FROM_LE (ctrl_id.ssvid);
+     info->ctrl_id = GUINT16_FROM_LE (ctrl_id.cntlid);
+-    /* TODO: decode fguid as 128-bit hex string? */
+-    info->fguid = g_strdup_printf ("%-.*s", (int) sizeof (ctrl_id.fguid), ctrl_id.fguid);
+-    g_strstrip (info->fguid);
++    info->fguid = _uuid_to_str (ctrl_id.fguid);
+     info->model_number = g_strndup (ctrl_id.mn, sizeof (ctrl_id.mn));
+     g_strstrip (info->model_number);
+     info->serial_number = g_strndup (ctrl_id.sn, sizeof (ctrl_id.sn));
+@@ -607,7 +612,6 @@ BDNVMENamespaceInfo *bd_nvme_get_namespace_info (const gchar *device, GError **e
+     if (ret_desc == 0) {
+         for (i = 0; i < NVME_IDENTIFY_DATA_SIZE; i += len) {
+             struct nvme_ns_id_desc *d = (void *) desc + i;
+-            gchar uuid_buf[37] = ZERO_INIT;
+ 
+             if (!d->nidl)
+                 break;
+@@ -625,8 +629,7 @@ BDNVMENamespaceInfo *bd_nvme_get_namespace_info (const gchar *device, GError **e
+                         snprintf (info->nguid + i * 2, 3, "%02x", d->nid[i]);
+                     break;
+                 case NVME_NIDT_UUID:
+-                    uuid_unparse (d->nid, uuid_buf);
+-                    info->uuid = g_strdup (uuid_buf);
++                    info->uuid = _uuid_to_str (d->nid);
+                     break;
+                 case NVME_NIDT_CSI:
+                     /* unused */
+diff --git a/src/plugins/nvme/nvme-op.c b/src/plugins/nvme/nvme-op.c
+index 4568c453..c9e92697 100644
+--- a/src/plugins/nvme/nvme-op.c
++++ b/src/plugins/nvme/nvme-op.c
+@@ -29,7 +29,6 @@
+ #include <linux/fs.h>
+ 
+ #include <libnvme.h>
+-#include <uuid/uuid.h>
+ 
+ #include <blockdev/utils.h>
+ #include <check_deps.h>
+diff --git a/src/plugins/nvme/nvme.c b/src/plugins/nvme/nvme.c
+index 00f2f76e..4a32ac4e 100644
+--- a/src/plugins/nvme/nvme.c
++++ b/src/plugins/nvme/nvme.c
+@@ -28,7 +28,6 @@
+ #include <malloc.h>
+ 
+ #include <libnvme.h>
+-#include <uuid/uuid.h>
+ 
+ #include <blockdev/utils.h>
+ #include <check_deps.h>
+-- 
+2.39.0
+
+
+From 64263599ec39b6b0f20d8e16c1169afcf66f5d9a Mon Sep 17 00:00:00 2001
+From: Tomas Bzatek <tbzatek@redhat.com>
+Date: Thu, 12 Jan 2023 16:01:28 +0100
+Subject: [PATCH 5/5] nvme: Fix zeroed struct fields detection
+
+As often stated in the NVMe specification, fields of features that
+are either not implemented or not valid are typically cleared to zero (0h).
+---
+ src/plugins/nvme/nvme-info.c | 20 +++++++++++++++-----
+ tests/nvme_test.py           |  2 +-
+ 2 files changed, 16 insertions(+), 6 deletions(-)
+
+diff --git a/src/plugins/nvme/nvme-info.c b/src/plugins/nvme/nvme-info.c
+index 18719d51..85f94a32 100644
+--- a/src/plugins/nvme/nvme-info.c
++++ b/src/plugins/nvme/nvme-info.c
+@@ -415,6 +415,15 @@ static gchar *_uuid_to_str (unsigned char uuid[NVME_UUID_LEN]) {
+     return NULL;
+ }
+ 
++static gboolean _nvme_a_is_zero (const __u8 a[], int len) {
++    int i;
++
++    for (i = 0; i < len; i++)
++        if (a[i] > 0)
++            return FALSE;
++    return TRUE;
++}
++
+ /**
+  * bd_nvme_get_controller_info:
+  * @device: a NVMe controller device (e.g. `/dev/nvme0`)
+@@ -468,7 +477,8 @@ BDNVMEControllerInfo * bd_nvme_get_controller_info (const gchar *device, GError
+     info->pci_vendor_id = GUINT16_FROM_LE (ctrl_id.vid);
+     info->pci_subsys_vendor_id = GUINT16_FROM_LE (ctrl_id.ssvid);
+     info->ctrl_id = GUINT16_FROM_LE (ctrl_id.cntlid);
+-    info->fguid = _uuid_to_str (ctrl_id.fguid);
++    if (!_nvme_a_is_zero (ctrl_id.fguid, sizeof (ctrl_id.fguid)))
++        info->fguid = _uuid_to_str (ctrl_id.fguid);
+     info->model_number = g_strndup (ctrl_id.mn, sizeof (ctrl_id.mn));
+     g_strstrip (info->model_number);
+     info->serial_number = g_strndup (ctrl_id.sn, sizeof (ctrl_id.sn));
+@@ -638,14 +648,14 @@ BDNVMENamespaceInfo *bd_nvme_get_namespace_info (const gchar *device, GError **e
+         }
+     }
+ 
+-    if (info->nguid == NULL && ns_info.nguid[G_N_ELEMENTS (ns_info.nguid) - 1] > 0) {
++    if (info->nguid == NULL && !_nvme_a_is_zero (ns_info.nguid, sizeof (ns_info.nguid))) {
+         info->nguid = g_malloc0 (sizeof (ns_info.nguid) * 2 + 1);
+-        for (i = 0; i < G_N_ELEMENTS (ns_info.nguid); i++)
++        for (i = 0; i < sizeof (ns_info.nguid); i++)
+             snprintf (info->nguid + i * 2, 3, "%02x", ns_info.nguid[i]);
+     }
+-    if (info->eui64 == NULL && ns_info.eui64[G_N_ELEMENTS (ns_info.eui64) - 1] > 0) {
++    if (info->eui64 == NULL && !_nvme_a_is_zero (ns_info.eui64, sizeof (ns_info.eui64))) {
+         info->eui64 = g_malloc0 (sizeof (ns_info.eui64) * 2 + 1);
+-        for (i = 0; i < G_N_ELEMENTS (ns_info.eui64); i++)
++        for (i = 0; i < sizeof (ns_info.eui64); i++)
+             snprintf (info->eui64 + i * 2, 3, "%02x", ns_info.eui64[i]);
+     }
+     if (ret_ns_ind == 0) {
+diff --git a/tests/nvme_test.py b/tests/nvme_test.py
+index a1822be6..a1494d9a 100644
+--- a/tests/nvme_test.py
++++ b/tests/nvme_test.py
+@@ -116,7 +116,7 @@ class NVMeTestCase(NVMeTest):
+         self.assertFalse(info.features & BlockDev.NVMEControllerFeature.ENCLOSURE)
+         self.assertFalse(info.features & BlockDev.NVMEControllerFeature.MGMT_PCIE)
+         self.assertFalse(info.features & BlockDev.NVMEControllerFeature.MGMT_SMBUS)
+-        self.assertEqual(info.fguid, "")
++        self.assertIsNone(info.fguid)
+         self.assertEqual(info.pci_vendor_id, 0)
+         self.assertEqual(info.pci_subsys_vendor_id, 0)
+         self.assertIn("Linux", info.model_number)
+-- 
+2.39.0
+

SOURCES/0006-Allow-resizing-of-inactive-LVs-with-latest-LVM.patch

@@ -0,0 +1,219 @@
+From 08d0ab8b93907ed3e2c7588dcaecb76bc4b26055 Mon Sep 17 00:00:00 2001
+From: Vojtech Trefny <vtrefny@redhat.com>
+Date: Mon, 27 Feb 2023 11:29:29 +0100
+Subject: [PATCH 1/2] Include LVM cli in the LVM DBus plugin dependencies
+
+Strictly speaking the lvm command is not needed by the plugin, but
+the LVM DBus daemon uses it so it must be present on the system
+and we are already calling "lvm segtypes" from the plugin so if
+the command is not available for us (for example not in $PATH) the
+plugin wouldn't load anyway so an extra check isn't going to
+change anything.
+---
+ src/plugins/lvm-dbus.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/src/plugins/lvm-dbus.c b/src/plugins/lvm-dbus.c
+index d4b542e2..8496a697 100644
+--- a/src/plugins/lvm-dbus.c
++++ b/src/plugins/lvm-dbus.c
+@@ -249,11 +249,14 @@ static volatile guint avail_features = 0;
+ static volatile guint avail_module_deps = 0;
+ static GMutex deps_check_lock;
+ 
+-#define DEPS_LVMDEVICES 0
++#define DEPS_LVM 0
++#define DEPS_LVM_MASK (1 << DEPS_LVM)
++#define DEPS_LVMDEVICES 1
+ #define DEPS_LVMDEVICES_MASK (1 << DEPS_LVMDEVICES)
+-#define DEPS_LAST 1
++#define DEPS_LAST 2
+ 
+ static const UtilDep deps[DEPS_LAST] = {
++    {"lvm", LVM_MIN_VERSION, "version", "LVM version:\\s+([\\d\\.]+)"},
+     {"lvmdevices", NULL, NULL, NULL},
+ };
+ 
+@@ -2121,6 +2124,7 @@ gboolean bd_lvm_lvresize (const gchar *vg_name, const gchar *lv_name, guint64 si
+     GVariantBuilder builder;
+     GVariantType *type = NULL;
+     GVariant *params = NULL;
++    GVariant *extra_params = NULL;
+ 
+     g_variant_builder_init (&builder, G_VARIANT_TYPE_TUPLE);
+     g_variant_builder_add_value (&builder, g_variant_new ("t", size));
+@@ -2130,7 +2134,12 @@ gboolean bd_lvm_lvresize (const gchar *vg_name, const gchar *lv_name, guint64 si
+     params = g_variant_builder_end (&builder);
+     g_variant_builder_clear (&builder);
+ 
+-    call_lv_method_sync (vg_name, lv_name, "Resize", params, NULL, extra, TRUE, error);
++    g_variant_builder_init (&builder, G_VARIANT_TYPE_DICTIONARY);
++    g_variant_builder_add (&builder, "{sv}", "--fs", g_variant_new ("s", "ignore"));
++    extra_params = g_variant_builder_end (&builder);
++    g_variant_builder_clear (&builder);
++
++    call_lv_method_sync (vg_name, lv_name, "Resize", params, extra_params, extra, TRUE, error);
+     return (*error == NULL);
+ }
+ 
+-- 
+2.39.2
+
+
+From cfb23f424c2f318efea7d9fd60ec1bcdb365ee35 Mon Sep 17 00:00:00 2001
+From: Vojtech Trefny <vtrefny@redhat.com>
+Date: Mon, 27 Feb 2023 14:00:21 +0100
+Subject: [PATCH 2/2] Allow resizing of inactive LVs with latest LVM
+
+Latest LVM doesn't allow resizing of inactive LVs without the
+"--fs ignore" option to protect users from corrupting their
+filesystems. As a low level API we don't really want to offer this
+kind of protection and we should allow to resize an inactive LV.
+---
+ src/plugins/lvm-dbus.c  | 28 ++++++++++++++++++++++++----
+ src/plugins/lvm.c       | 31 ++++++++++++++++++++++++++++---
+ tests/lvm_dbus_tests.py |  4 ++++
+ tests/lvm_test.py       |  4 ++++
+ 4 files changed, 60 insertions(+), 7 deletions(-)
+
+diff --git a/src/plugins/lvm-dbus.c b/src/plugins/lvm-dbus.c
+index 8496a697..28f3bb25 100644
+--- a/src/plugins/lvm-dbus.c
++++ b/src/plugins/lvm-dbus.c
+@@ -32,6 +32,8 @@
+ #define SECTOR_SIZE 512
+ #define VDO_POOL_SUFFIX "vpool"
+ 
++#define LVM_VERSION_FSRESIZE "2.03.19"
++
+ static GMutex global_config_lock;
+ static gchar *global_config_str = NULL;
+ 
+@@ -2125,6 +2127,14 @@ gboolean bd_lvm_lvresize (const gchar *vg_name, const gchar *lv_name, guint64 si
+     GVariantType *type = NULL;
+     GVariant *params = NULL;
+     GVariant *extra_params = NULL;
++    gboolean success = FALSE;
++    BDLVMLVdata *lvinfo = NULL;
++    GError *l_error = NULL;
++
++    lvinfo = bd_lvm_lvinfo (vg_name, lv_name, error);
++    if (!lvinfo)
++        /* error is already populated */
++        return FALSE;
+ 
+     g_variant_builder_init (&builder, G_VARIANT_TYPE_TUPLE);
+     g_variant_builder_add_value (&builder, g_variant_new ("t", size));
+@@ -2134,10 +2144,20 @@ gboolean bd_lvm_lvresize (const gchar *vg_name, const gchar *lv_name, guint64 si
+     params = g_variant_builder_end (&builder);
+     g_variant_builder_clear (&builder);
+ 
+-    g_variant_builder_init (&builder, G_VARIANT_TYPE_DICTIONARY);
+-    g_variant_builder_add (&builder, "{sv}", "--fs", g_variant_new ("s", "ignore"));
+-    extra_params = g_variant_builder_end (&builder);
+-    g_variant_builder_clear (&builder);
++    if (lvinfo->attr[4] != 'a') {
++        /* starting with 2.03.19 we need to add extra option to allow resizing of inactive LVs */
++        success = bd_utils_check_util_version (deps[DEPS_LVM].name, LVM_VERSION_FSRESIZE,
++                                            deps[DEPS_LVM].ver_arg, deps[DEPS_LVM].ver_regexp, &l_error);
++        if (success) {
++            g_variant_builder_init (&builder, G_VARIANT_TYPE_DICTIONARY);
++            g_variant_builder_add (&builder, "{sv}", "--fs", g_variant_new ("s", "ignore"));
++            extra_params = g_variant_builder_end (&builder);
++            g_variant_builder_clear (&builder);
++        } else
++            g_clear_error (&l_error);
++    }
++
++    bd_lvm_lvdata_free (lvinfo);
+ 
+     call_lv_method_sync (vg_name, lv_name, "Resize", params, extra_params, extra, TRUE, error);
+     return (*error == NULL);
+diff --git a/src/plugins/lvm.c b/src/plugins/lvm.c
+index 03211f8a..f1e2941b 100644
+--- a/src/plugins/lvm.c
++++ b/src/plugins/lvm.c
+@@ -31,6 +31,8 @@
+ #define SECTOR_SIZE 512
+ #define VDO_POOL_SUFFIX "vpool"
+ 
++#define LVM_VERSION_FSRESIZE "2.03.19"
++
+ static GMutex global_config_lock;
+ static gchar *global_config_str = NULL;
+ 
+@@ -1606,15 +1608,38 @@ gboolean bd_lvm_lvrename (const gchar *vg_name, const gchar *lv_name, const gcha
+  * Tech category: %BD_LVM_TECH_BASIC-%BD_LVM_TECH_MODE_MODIFY
+  */
+ gboolean bd_lvm_lvresize (const gchar *vg_name, const gchar *lv_name, guint64 size, const BDExtraArg **extra, GError **error) {
+-    const gchar *args[6] = {"lvresize", "--force", "-L", NULL, NULL, NULL};
++    const gchar *args[8] = {"lvresize", "--force", "-L", NULL, NULL, NULL, NULL, NULL};
+     gboolean success = FALSE;
++    guint8 next_arg = 4;
++    g_autofree gchar *lvspec = NULL;
++    BDLVMLVdata *lvinfo = NULL;
++    GError *l_error = NULL;
++
++    lvinfo = bd_lvm_lvinfo (vg_name, lv_name, error);
++    if (!lvinfo)
++        /* error is already populated */
++        return FALSE;
+ 
+     args[3] = g_strdup_printf ("%"G_GUINT64_FORMAT"K", size/1024);
+-    args[4] = g_strdup_printf ("%s/%s", vg_name, lv_name);
++
++    if (lvinfo->attr[4] != 'a') {
++        /* starting with 2.03.19 we need to add extra option to allow resizing of inactive LVs */
++        success = bd_utils_check_util_version (deps[DEPS_LVM].name, LVM_VERSION_FSRESIZE,
++                                               deps[DEPS_LVM].ver_arg, deps[DEPS_LVM].ver_regexp, &l_error);
++        if (success) {
++            args[next_arg++] = "--fs";
++            args[next_arg++] = "ignore";
++        } else
++            g_clear_error (&l_error);
++    }
++
++    bd_lvm_lvdata_free (lvinfo);
++
++    lvspec = g_strdup_printf ("%s/%s", vg_name, lv_name);
++    args[next_arg++] = lvspec;
+ 
+     success = call_lvm_and_report_error (args, extra, TRUE, error);
+     g_free ((gchar *) args[3]);
+-    g_free ((gchar *) args[4]);
+ 
+     return success;
+ }
+diff --git a/tests/lvm_dbus_tests.py b/tests/lvm_dbus_tests.py
+index 61c898c1..fc12b55d 100644
+--- a/tests/lvm_dbus_tests.py
++++ b/tests/lvm_dbus_tests.py
+@@ -944,6 +944,10 @@ class LvmTestLVresize(LvmPVVGLVTestCase):
+         succ = BlockDev.lvm_lvdeactivate("testVG", "testLV", None)
+         self.assertTrue(succ)
+ 
++        # try to resize when deactivated
++        succ = BlockDev.lvm_lvresize("testVG", "testLV", 768 * 1024**2, None)
++        self.assertTrue(succ)
++
+ @unittest.skipUnless(lvm_dbus_running, "LVM DBus not running")
+ class LvmTestLVrename(LvmPVVGLVTestCase):
+     def test_lvrename(self):
+diff --git a/tests/lvm_test.py b/tests/lvm_test.py
+index 36ff10ec..7ede4b59 100644
+--- a/tests/lvm_test.py
++++ b/tests/lvm_test.py
+@@ -877,6 +877,10 @@ class LvmTestLVresize(LvmPVVGLVTestCase):
+         succ = BlockDev.lvm_lvdeactivate("testVG", "testLV", None)
+         self.assertTrue(succ)
+ 
++        # try to resize when deactivated
++        succ = BlockDev.lvm_lvresize("testVG", "testLV", 768 * 1024**2, None)
++        self.assertTrue(succ)
++
+ class LvmTestLVrename(LvmPVVGLVTestCase):
+     def test_lvrename(self):
+         """Verify that it's possible to rename an LV"""
+-- 
+2.39.2
+

SOURCES/0007-tests-Fix-test_swapon_pagesize-on-systems-with-64k-p.patch

@@ -1,4 +1,4 @@
-From 6700dfded31219c99fea054aa10fd68b90bace82 Mon Sep 17 00:00:00 2001
+From 2c59bc22d30ebfc16d5d06b1f31c4d7bbede68e9 Mon Sep 17 00:00:00 2001
 From: Vojtech Trefny <vtrefny@redhat.com>
 Date: Mon, 31 Oct 2022 12:43:17 +0100
 Subject: [PATCH] tests: Fix test_swapon_pagesize on systems with 64k pages

SOURCES/0009-Fix-issues-in-tests-when-running-in-FIPS-mode.patch

@@ -0,0 +1,70 @@
+From bc8c4fa2b3ba76647de9742c28bae751757dc2dd Mon Sep 17 00:00:00 2001
+From: Vojtech Trefny <vtrefny@redhat.com>
+Date: Thu, 18 May 2023 14:45:42 +0200
+Subject: [PATCH 1/2] tests: Use longer passphrase for LUKS in dm_test
+
+The short passphrase doesn't work when running in FIPS mode.
+---
+ tests/dm_test.py | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tests/dm_test.py b/tests/dm_test.py
+index 936e3055..3b491d89 100644
+--- a/tests/dm_test.py
++++ b/tests/dm_test.py
+@@ -59,8 +59,8 @@ class DevMapperGetSubsystemFromName(DevMapperTestCase):
+     def test_get_subsystem_from_name_crypt(self):
+         """Verify that it is possible to get luks device subsystem from its name"""
+         self.addCleanup(self._destroy_crypt)
+-        run("echo \"key\" | cryptsetup luksFormat %s -" %self.loop_dev)
+-        run("echo \"key\" | cryptsetup open %s libbd_dm_tests-subsystem_crypt --key-file=-" %self.loop_dev)
++        run("echo \"supersecretkey\" | cryptsetup luksFormat %s -" %self.loop_dev)
++        run("echo \"supersecretkey\" | cryptsetup open %s libbd_dm_tests-subsystem_crypt --key-file=-" %self.loop_dev)
+         subsystem = BlockDev.dm_get_subsystem_from_name("libbd_dm_tests-subsystem_crypt")
+         self.assertEqual(subsystem, "CRYPT")
+ 
+-- 
+2.40.1
+
+
+From b1f6d1484a980885b9870d27d2b113c98400851b Mon Sep 17 00:00:00 2001
+From: Vojtech Trefny <vtrefny@redhat.com>
+Date: Thu, 18 May 2023 14:56:32 +0200
+Subject: [PATCH 2/2] tests: Skip crypto tests with argon2 in FIPS mode
+
+argon is not available when running in FIPS mode.
+---
+ tests/crypto_test.py | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/tests/crypto_test.py b/tests/crypto_test.py
+index 94b89131..91ea1f35 100644
+--- a/tests/crypto_test.py
++++ b/tests/crypto_test.py
+@@ -175,6 +175,23 @@ class CryptoTestFormat(CryptoTestCase):
+             self.fail("Failed to get pbkdf information from:\n%s %s" % (out, err))
+         self.assertEqual(m.group(1), "pbkdf2")
+ 
++    def _is_fips_enabled(self):
++        if not os.path.exists("/proc/sys/crypto/fips_enabled"):
++            # if the file doesn't exist, we are definitely not in FIPS mode
++            return False
++
++        with open("/proc/sys/crypto/fips_enabled", "r") as f:
++            enabled = f.read()
++        return enabled.strip() == "1"
++
++    @tag_test(TestTags.SLOW, TestTags.CORE)
++    @unittest.skipUnless(HAVE_LUKS2, "LUKS 2 not supported")
++    def test_luks2_format_pbkdf_options(self):
++        """Verify that formatting device as LUKS 2 works"""
++
++        if self._is_fips_enabled():
++            self.skipTest("FIPS mode is enabled, cannot use argon2, skipping")
++
+         # different options for argon2 -- all parameters set
+         pbkdf = BlockDev.CryptoLUKSPBKDF(type="argon2id", max_memory_kb=100*1024, iterations=10, parallel_threads=1)
+         extra = BlockDev.CryptoLUKSExtra(pbkdf=pbkdf)
+-- 
+2.40.1
+

SOURCES/0010-lvm-Add-a-function-to-activate-LVs-in-shared-mode.patch

@@ -1,4 +1,4 @@
-From ee9c3afec5ef2fe1e9fd50718cd732e267b235ed Mon Sep 17 00:00:00 2001
+From 6bdbafc79e5bcdf2087148c6caa88a6c50c1e94a Mon Sep 17 00:00:00 2001
 From: Vojtech Trefny <vtrefny@redhat.com>
 Date: Mon, 24 Apr 2023 11:57:18 +0200
 Subject: [PATCH] lvm: Add a function to activate LVs in shared mode
@@ -15,10 +15,10 @@ Needed by the new blivet feature to support shared LVM setups.
  7 files changed, 124 insertions(+), 38 deletions(-)
 
 diff --git a/src/lib/plugin_apis/lvm.api b/src/lib/plugin_apis/lvm.api
-index dc8c1348..bac70a75 100644
+index b8cde70b..640eee49 100644
 --- a/src/lib/plugin_apis/lvm.api
 +++ b/src/lib/plugin_apis/lvm.api
-@@ -1055,6 +1055,22 @@ gboolean bd_lvm_lvresize (const gchar *vg_name, const gchar *lv_name, guint64 si
+@@ -1057,6 +1057,22 @@ gboolean bd_lvm_lvresize (const gchar *vg_name, const gchar *lv_name, guint64 si
   */
  gboolean bd_lvm_lvactivate (const gchar *vg_name, const gchar *lv_name, gboolean ignore_skip, const BDExtraArg **extra, GError **error);
  
@@ -42,10 +42,10 @@ index dc8c1348..bac70a75 100644
   * bd_lvm_lvdeactivate:
   * @vg_name: name of the VG containing the to-be-deactivated LV
 diff --git a/src/plugins/lvm-dbus.c b/src/plugins/lvm-dbus.c
-index b7b4480e..d8e997f9 100644
+index 28f3bb25..46e09833 100644
 --- a/src/plugins/lvm-dbus.c
 +++ b/src/plugins/lvm-dbus.c
-@@ -2115,6 +2115,27 @@ gboolean bd_lvm_lvresize (const gchar *vg_name, const gchar *lv_name, guint64 si
+@@ -2163,6 +2163,27 @@ gboolean bd_lvm_lvresize (const gchar *vg_name, const gchar *lv_name, guint64 si
      return (*error == NULL);
  }
  
@@ -73,7 +73,7 @@ index b7b4480e..d8e997f9 100644
  /**
   * bd_lvm_lvactivate:
   * @vg_name: name of the VG containing the to-be-activated LV
-@@ -2129,19 +2150,25 @@ gboolean bd_lvm_lvresize (const gchar *vg_name, const gchar *lv_name, guint64 si
+@@ -2177,19 +2198,25 @@ gboolean bd_lvm_lvresize (const gchar *vg_name, const gchar *lv_name, guint64 si
   * Tech category: %BD_LVM_TECH_BASIC-%BD_LVM_TECH_MODE_MODIFY
   */
  gboolean bd_lvm_lvactivate (const gchar *vg_name, const gchar *lv_name, gboolean ignore_skip, const BDExtraArg **extra, GError **error) {
@@ -112,10 +112,10 @@ index b7b4480e..d8e997f9 100644
  
  /**
 diff --git a/src/plugins/lvm.c b/src/plugins/lvm.c
-index 50da656c..d7281339 100644
+index f1e2941b..0db3bf4a 100644
 --- a/src/plugins/lvm.c
 +++ b/src/plugins/lvm.c
-@@ -1594,6 +1594,28 @@ gboolean bd_lvm_lvresize (const gchar *vg_name, const gchar *lv_name, guint64 si
+@@ -1644,6 +1644,28 @@ gboolean bd_lvm_lvresize (const gchar *vg_name, const gchar *lv_name, guint64 si
      return success;
  }
  
@@ -144,7 +144,7 @@ index 50da656c..d7281339 100644
  /**
   * bd_lvm_lvactivate:
   * @vg_name: name of the VG containing the to-be-activated LV
-@@ -1608,20 +1630,25 @@ gboolean bd_lvm_lvresize (const gchar *vg_name, const gchar *lv_name, guint64 si
+@@ -1658,20 +1680,25 @@ gboolean bd_lvm_lvresize (const gchar *vg_name, const gchar *lv_name, guint64 si
   * Tech category: %BD_LVM_TECH_BASIC-%BD_LVM_TECH_MODE_MODIFY
   */
  gboolean bd_lvm_lvactivate (const gchar *vg_name, const gchar *lv_name, gboolean ignore_skip, const BDExtraArg **extra, GError **error) {
@@ -184,10 +184,10 @@ index 50da656c..d7281339 100644
  
  /**
 diff --git a/src/plugins/lvm.h b/src/plugins/lvm.h
-index 2162d769..244663a4 100644
+index fabf091f..c85c043d 100644
 --- a/src/plugins/lvm.h
 +++ b/src/plugins/lvm.h
-@@ -275,6 +275,7 @@ gboolean bd_lvm_lvremove (const gchar *vg_name, const gchar *lv_name, gboolean f
+@@ -277,6 +277,7 @@ gboolean bd_lvm_lvremove (const gchar *vg_name, const gchar *lv_name, gboolean f
  gboolean bd_lvm_lvrename (const gchar *vg_name, const gchar *lv_name, const gchar *new_name, const BDExtraArg **extra, GError **error);
  gboolean bd_lvm_lvresize (const gchar *vg_name, const gchar *lv_name, guint64 size, const BDExtraArg **extra, GError **error);
  gboolean bd_lvm_lvactivate (const gchar *vg_name, const gchar *lv_name, gboolean ignore_skip, const BDExtraArg **extra, GError **error);
@@ -196,10 +196,10 @@ index 2162d769..244663a4 100644
  gboolean bd_lvm_lvsnapshotcreate (const gchar *vg_name, const gchar *origin_name, const gchar *snapshot_name, guint64 size, const BDExtraArg **extra, GError **error);
  gboolean bd_lvm_lvsnapshotmerge (const gchar *vg_name, const gchar *snapshot_name, const BDExtraArg **extra, GError **error);
 diff --git a/src/python/gi/overrides/BlockDev.py b/src/python/gi/overrides/BlockDev.py
-index f768c8bd..c7d72f4b 100644
+index 795e0de4..3e074260 100644
 --- a/src/python/gi/overrides/BlockDev.py
 +++ b/src/python/gi/overrides/BlockDev.py
-@@ -580,11 +580,10 @@ def lvm_lvresize(vg_name, lv_name, size, extra=None, **kwargs):
+@@ -605,11 +605,10 @@ def lvm_lvresize(vg_name, lv_name, size, extra=None, **kwargs):
      return _lvm_lvresize(vg_name, lv_name, size, extra)
  __all__.append("lvm_lvresize")
  
@@ -214,10 +214,10 @@ index f768c8bd..c7d72f4b 100644
  
  _lvm_lvdeactivate = BlockDev.lvm_lvdeactivate
 diff --git a/tests/lvm_dbus_tests.py b/tests/lvm_dbus_tests.py
-index 4882da88..67eaccd1 100644
+index fc12b55d..a821636e 100644
 --- a/tests/lvm_dbus_tests.py
 +++ b/tests/lvm_dbus_tests.py
-@@ -799,15 +799,15 @@ class LvmTestLVactivateDeactivate(LvmPVVGLVTestCase):
+@@ -873,15 +873,15 @@ class LvmTestLVactivateDeactivate(LvmPVVGLVTestCase):
          self.assertTrue(succ)
  
          with self.assertRaises(GLib.GError):
@@ -237,7 +237,7 @@ index 4882da88..67eaccd1 100644
          self.assertTrue(succ)
  
          with self.assertRaises(GLib.GError):
-@@ -822,7 +822,15 @@ class LvmTestLVactivateDeactivate(LvmPVVGLVTestCase):
+@@ -896,7 +896,15 @@ class LvmTestLVactivateDeactivate(LvmPVVGLVTestCase):
          succ = BlockDev.lvm_lvdeactivate("testVG", "testLV", None)
          self.assertTrue(succ)
  
@@ -255,10 +255,10 @@ index 4882da88..67eaccd1 100644
  
          succ = BlockDev.lvm_lvdeactivate("testVG", "testLV", None)
 diff --git a/tests/lvm_test.py b/tests/lvm_test.py
-index eb94c917..25e2f109 100644
+index 7ede4b59..63f43afb 100644
 --- a/tests/lvm_test.py
 +++ b/tests/lvm_test.py
-@@ -730,15 +730,15 @@ class LvmTestLVactivateDeactivate(LvmPVVGLVTestCase):
+@@ -807,15 +807,15 @@ class LvmTestLVactivateDeactivate(LvmPVVGLVTestCase):
          self.assertTrue(succ)
  
          with self.assertRaises(GLib.GError):
@@ -278,7 +278,7 @@ index eb94c917..25e2f109 100644
          self.assertTrue(succ)
  
          with self.assertRaises(GLib.GError):
-@@ -753,7 +753,15 @@ class LvmTestLVactivateDeactivate(LvmPVVGLVTestCase):
+@@ -830,7 +830,15 @@ class LvmTestLVactivateDeactivate(LvmPVVGLVTestCase):
          succ = BlockDev.lvm_lvdeactivate("testVG", "testLV", None)
          self.assertTrue(succ)
  

SOURCES/0012-lvm-Add-support-for-starting-and-stopping-VG-locking.patch

@@ -1,4 +1,4 @@
-From 5e8429d004445c6f6e6f16cab67cf14cb4d32a65 Mon Sep 17 00:00:00 2001
+From f72ba6aded6093d34d5e8a1666a844ec2b0ee5eb Mon Sep 17 00:00:00 2001
 From: Vojtech Trefny <vtrefny@redhat.com>
 Date: Tue, 18 Apr 2023 12:05:35 +0200
 Subject: [PATCH] lvm: Add support for starting and stopping VG locking
@@ -14,7 +14,7 @@ Subject: [PATCH] lvm: Add support for starting and stopping VG locking
  7 files changed, 186 insertions(+), 1 deletion(-)
 
 diff --git a/docs/libblockdev-sections.txt b/docs/libblockdev-sections.txt
-index 512820c2..7377dd17 100644
+index 540e2b96..08ea309c 100644
 --- a/docs/libblockdev-sections.txt
 +++ b/docs/libblockdev-sections.txt
 @@ -286,6 +286,8 @@ bd_lvm_vgactivate
@@ -27,18 +27,18 @@ index 512820c2..7377dd17 100644
  bd_lvm_vgs
  bd_lvm_lvorigin
 diff --git a/src/lib/plugin_apis/lvm.api b/src/lib/plugin_apis/lvm.api
-index 54c47a93..14f2620a 100644
+index 640eee49..1343fbdb 100644
 --- a/src/lib/plugin_apis/lvm.api
 +++ b/src/lib/plugin_apis/lvm.api
-@@ -601,6 +601,7 @@ typedef enum {
-     BD_LVM_TECH_CACHE_CALCS,
+@@ -603,6 +603,7 @@ typedef enum {
      BD_LVM_TECH_GLOB_CONF,
      BD_LVM_TECH_VDO,
+     BD_LVM_TECH_DEVICES,
 +    BD_LVM_TECH_SHARED,
  } BDLVMTech;
  
  typedef enum {
-@@ -941,6 +942,32 @@ gboolean bd_lvm_vgextend (const gchar *vg_name, const gchar *device, const BDExt
+@@ -943,6 +944,32 @@ gboolean bd_lvm_vgextend (const gchar *vg_name, const gchar *device, const BDExt
   */
  gboolean bd_lvm_vgreduce (const gchar *vg_name, const gchar *device, const BDExtraArg **extra, GError **error);
  
@@ -72,10 +72,10 @@ index 54c47a93..14f2620a 100644
   * bd_lvm_vginfo:
   * @vg_name: a VG to get information about
 diff --git a/src/plugins/lvm-dbus.c b/src/plugins/lvm-dbus.c
-index e1f946fe..ad44dfb3 100644
+index 46e09833..a129d884 100644
 --- a/src/plugins/lvm-dbus.c
 +++ b/src/plugins/lvm-dbus.c
-@@ -1848,10 +1848,57 @@ gboolean bd_lvm_vgreduce (const gchar *vg_name, const gchar *device, const BDExt
+@@ -1872,10 +1872,57 @@ gboolean bd_lvm_vgreduce (const gchar *vg_name, const gchar *device, const BDExt
      return ((*error) == NULL);
  }
  
@@ -135,10 +135,10 @@ index e1f946fe..ad44dfb3 100644
   * Returns: (transfer full): information about the @vg_name VG or %NULL in case
   * of error (the @error) gets populated in those cases)
 diff --git a/src/plugins/lvm.c b/src/plugins/lvm.c
-index 8bb3ae24..1aaf6747 100644
+index 0db3bf4a..b0a71224 100644
 --- a/src/plugins/lvm.c
 +++ b/src/plugins/lvm.c
-@@ -1316,6 +1316,47 @@ gboolean bd_lvm_vgreduce (const gchar *vg_name, const gchar *device, const BDExt
+@@ -1341,6 +1341,47 @@ gboolean bd_lvm_vgreduce (const gchar *vg_name, const gchar *device, const BDExt
      return call_lvm_and_report_error (args, extra, TRUE, error);
  }
  
@@ -187,18 +187,18 @@ index 8bb3ae24..1aaf6747 100644
   * bd_lvm_vginfo:
   * @vg_name: a VG to get information about
 diff --git a/src/plugins/lvm.h b/src/plugins/lvm.h
-index 244663a4..da14cc1a 100644
+index c85c043d..2e47b06f 100644
 --- a/src/plugins/lvm.h
 +++ b/src/plugins/lvm.h
-@@ -216,6 +216,7 @@ typedef enum {
-     BD_LVM_TECH_CACHE_CALCS,
+@@ -218,6 +218,7 @@ typedef enum {
      BD_LVM_TECH_GLOB_CONF,
      BD_LVM_TECH_VDO,
+     BD_LVM_TECH_DEVICES,
 +    BD_LVM_TECH_SHARED,
  } BDLVMTech;
  
  typedef enum {
-@@ -266,6 +267,8 @@ gboolean bd_lvm_vgactivate (const gchar *vg_name, const BDExtraArg **extra, GErr
+@@ -268,6 +269,8 @@ gboolean bd_lvm_vgactivate (const gchar *vg_name, const BDExtraArg **extra, GErr
  gboolean bd_lvm_vgdeactivate (const gchar *vg_name, const BDExtraArg **extra, GError **error);
  gboolean bd_lvm_vgextend (const gchar *vg_name, const gchar *device, const BDExtraArg **extra, GError **error);
  gboolean bd_lvm_vgreduce (const gchar *vg_name, const gchar *device, const BDExtraArg **extra, GError **error);
@@ -208,10 +208,10 @@ index 244663a4..da14cc1a 100644
  BDLVMVGdata** bd_lvm_vgs (GError **error);
  
 diff --git a/tests/lvm_dbus_tests.py b/tests/lvm_dbus_tests.py
-index 862a44cf..2a92c7c1 100644
+index a821636e..bc8b3052 100644
 --- a/tests/lvm_dbus_tests.py
 +++ b/tests/lvm_dbus_tests.py
-@@ -612,6 +612,39 @@ class LvmTestVGs(LvmPVVGTestCase):
+@@ -655,6 +655,39 @@ class LvmTestVGs(LvmPVVGTestCase):
          succ = BlockDev.lvm_pvremove(self.loop_dev, None)
          self.assertTrue(succ)
  
@@ -252,10 +252,10 @@ index 862a44cf..2a92c7c1 100644
  class LvmPVVGLVTestCase(LvmPVVGTestCase):
      def _clean_up(self):
 diff --git a/tests/lvm_test.py b/tests/lvm_test.py
-index 96f1670d..3ab11f04 100644
+index 63f43afb..d517001b 100644
 --- a/tests/lvm_test.py
 +++ b/tests/lvm_test.py
-@@ -585,6 +585,38 @@ class LvmTestVGs(LvmPVVGTestCase):
+@@ -632,6 +632,38 @@ class LvmTestVGs(LvmPVVGTestCase):
          succ = BlockDev.lvm_pvremove(self.loop_dev, None)
          self.assertTrue(succ)
  

SOURCES/libblockdev-gcc11.patch

@@ -0,0 +1,15 @@
+diff --git a/src/plugins/kbd.c b/src/plugins/kbd.c
+index a2908ec..97abd3b 100644
+--- a/src/plugins/kbd.c
++++ b/src/plugins/kbd.c
+@@ -732,6 +732,10 @@ static gboolean wait_for_file (const char *filename) {
+  *
+  * Tech category: %BD_KBD_TECH_BCACHE-%BD_KBD_TECH_MODE_CREATE
+  */
++/* This triggers a known false positive warning in gcc-11.  It's being
++   addressed upstream, but until the fix is available, this works around
++   the false positive.  */
++__attribute__ ((optimize ("-O1")))
+ gboolean bd_kbd_bcache_create (const gchar *backing_device, const gchar *cache_device, const BDExtraArg **extra, const gchar **bcache_device, GError **error) {
+     const gchar *argv[6] = {"make-bcache", "-B", backing_device, "-C", cache_device, NULL};
+     gboolean success = FALSE;

SPECS/libblockdev.spec

@@ -15,11 +15,12 @@
 %define with_part 1
 %define with_fs 1
 %define with_nvdimm 1
-%define with_vdo 1
+%define with_vdo 0
 %define with_gi 1
 %define with_escrow 1
-%define with_dmraid 0
+%define with_dmraid 1
 %define with_tools 1
+%define with_nvme 1
 
 # python2 is not available on RHEL > 7 and not needed on Fedora > 29
 %if 0%{?rhel} > 7 || 0%{?fedora} > 29 || %{with_python2} == 0
@@ -47,7 +48,7 @@
 
 # vdo is not available on non-x86_64 on older RHEL
 %if (0%{?rhel} && 0%{?rhel} <= 7)
-%ifnarch x86_64 aarch64 s390x ppc64le
+%ifnarch x86_64
 %define with_vdo 0
 %define vdo_copts --without-vdo
 %endif
@@ -120,21 +121,32 @@
 %if %{with_gi} != 1
 %define gi_copts --disable-introspection
 %endif
+%if %{with_nvme} != 1
+%define nvme_copts --without-nvme
+%endif
 
-%define configure_opts %{?python2_copts} %{?python3_copts} %{?bcache_copts} %{?lvm_dbus_copts} %{?btrfs_copts} %{?crypto_copts} %{?dm_copts} %{?loop_copts} %{?lvm_copts} %{?lvm_dbus_copts} %{?mdraid_copts} %{?mpath_copts} %{?swap_copts} %{?kbd_copts} %{?part_copts} %{?fs_copts} %{?nvdimm_copts} %{?vdo_copts} %{?tools_copts} %{?gi_copts}
+%define configure_opts %{?python2_copts} %{?python3_copts} %{?bcache_copts} %{?lvm_dbus_copts} %{?btrfs_copts} %{?crypto_copts} %{?dm_copts} %{?loop_copts} %{?lvm_copts} %{?lvm_dbus_copts} %{?mdraid_copts} %{?mpath_copts} %{?swap_copts} %{?kbd_copts} %{?part_copts} %{?fs_copts} %{?nvdimm_copts} %{?nvme_copts} %{?vdo_copts} %{?tools_copts} %{?gi_copts}
 
 Name:        libblockdev
 Version:     2.28
-Release:     6%{?dist}
+Release:     10%{?dist}
 Summary:     A library for low-level manipulation with block devices
 License:     LGPLv2+
 URL:         https://github.com/storaged-project/libblockdev
 Source0:     https://github.com/storaged-project/libblockdev/releases/download/%{version}-%{release}/%{name}-%{version}.tar.gz
-Patch0:      0001-crypto-Fix-GError-overwrite-from-libvolume_key.patch
-Patch1:      0002-tests-Fix-test_swapon_pagesize-on-systems-with-64k-p.patch
-Patch2:      0003-part-Fix-segfault-when-adding-a-partition-too-big-fo.patch
-Patch3:      0004-lvm-Add-a-function-to-activate-LVs-in-shared-mode.patch
-Patch4:      0005-lvm-Add-support-for-starting-and-stopping-VG-locking.patch
+Patch0:      libblockdev-gcc11.patch
+Patch1:      0001-lvm-devices-file-support.patch
+Patch2:      0002-Add-support-for-creating-and-activating-integrity-de.patch
+Patch3:      0003-NVMe-plugin-backport.patch
+Patch4:      0004-Fix-double-free-in-write_escrow_data_file.patch
+Patch5:      0005-nvme-Fix-namespace-identifiers.patch
+Patch6:      0006-Allow-resizing-of-inactive-LVs-with-latest-LVM.patch
+Patch7:      0007-tests-Fix-test_swapon_pagesize-on-systems-with-64k-p.patch
+Patch8:      0008-part-Fix-segfault-when-adding-a-partition-too-big-fo.patch
+Patch9:      0009-Fix-issues-in-tests-when-running-in-FIPS-mode.patch
+Patch10:     0010-lvm-Add-a-function-to-activate-LVs-in-shared-mode.patch
+Patch11:     0011-nvme_libblockdev-3.0.4_backport.patch
+Patch12:     0012-lvm-Add-support-for-starting-and-stopping-VG-locking.patch
 
 BuildRequires: make
 BuildRequires: glib2-devel
@@ -506,6 +518,29 @@ with the libblockdev-nvdimm plugin/library.
 %endif
 
 
+%if %{with_nvme}
+%package nvme
+BuildRequires: libnvme-devel
+BuildRequires: libuuid-devel
+Summary:     The NVMe plugin for the libblockdev library
+Requires: %{name}-utils%{?_isa} = %{version}-%{release}
+
+%description nvme
+The libblockdev library plugin (and in the same time a standalone library)
+providing the functionality related to operations with NVMe devices.
+
+%package nvme-devel
+Summary:     Development files for the libblockdev-nvme plugin/library
+Requires: %{name}-nvme%{?_isa} = %{version}-%{release}
+Requires: %{name}-utils-devel%{?_isa} = %{version}-%{release}
+Requires: glib2-devel
+
+%description nvme-devel
+This package contains header files and pkg-config files needed for development
+with the libblockdev-nvme plugin/library.
+%endif
+
+
 %if %{with_part}
 %package part
 BuildRequires: parted-devel
@@ -666,6 +701,10 @@ Requires: %{name}-mpath%{?_isa} = %{version}-%{release}
 Requires: %{name}-nvdimm%{?_isa} = %{version}-%{release}
 %endif
 
+%if %{with_nvme}
+Requires: %{name}-nvme%{?_isa} = %{version}-%{release}
+%endif
+
 %if %{with_part}
 Requires: %{name}-part%{?_isa} = %{version}-%{release}
 %endif
@@ -742,6 +781,10 @@ find %{buildroot} -type f -name "*.la" | xargs %{__rm}
 %ldconfig_scriptlets nvdimm
 %endif
 
+%if %{with_nvme}
+%ldconfig_scriptlets nvme
+%endif
+
 %if %{with_part}
 %ldconfig_scriptlets part
 %endif
@@ -941,6 +984,17 @@ find %{buildroot} -type f -name "*.la" | xargs %{__rm}
 %endif
 
 
+%if %{with_nvme}
+%files nvme
+%{_libdir}/libbd_nvme.so.*
+
+%files nvme-devel
+%{_libdir}/libbd_nvme.so
+%dir %{_includedir}/blockdev
+%{_includedir}/blockdev/nvme.h
+%endif
+
+
 %if %{with_part}
 %files part
 %{_libdir}/libbd_part.so.*
@@ -993,119 +1047,342 @@ find %{buildroot} -type f -name "*.la" | xargs %{__rm}
 %changelog
 * Wed Nov 08 2023 Vojtech Trefny <vtrefny@redhat.com> - 2.28-10
 - lvm: Add support for starting and stopping VG locking
-  Resolves: RHEL-15923
+  Resolves: RHEL-15921
 
-* Thu Oct 19 2023 Vojtech Trefny <vtrefny@redhat.com> - 2.28-5
+* Wed Nov 01 2023 Tomas Bzatek <tbzatek@redhat.com> - 2.28-9
+- nvme: HostID fixes for TP4126
+  Resolves: RHEL-1375
+- nvme: Stack smashing fixes
+  Resolves: RHEL-13127
+  Resolves: RHEL-8037
+
+* Tue Oct 17 2023 Vojtech Trefny <vtrefny@redhat.com> - 2.28-8
 - lvm: Add a function to activate LVs in shared mode
-  Resolves: RHEL-14023
+  Resolves: RHEL-14018
 
-* Tue May 16 2023 Vojtech Trefny <vtrefny@redhat.com> - 2.28-4
+* Wed May 24 2023 Vojtech Trefny <vtrefny@redhat.com> - 2.28-7
+- Fix issues in tests when running in FIPS mode
+  Resolves: rhbz#2188749
+  Resolves: rhbz#2188603
+
+* Tue May 16 2023 Vojtech Trefny <vtrefny@redhat.com> - 2.28-6
 - Fix segfault when adding a partition too big for MSDOS
-  Resolves: rhbz#2207500
+  Resolves: rhbz#2185564
 
-* Mon Apr 03 2023 Vojtech Trefny <vtrefny@redhat.com> - 2.28-3
+* Mon Apr 03 2023 Vojtech Trefny <vtrefny@redhat.com> - 2.28-5
+- Allow resizing of inactive LVs with latest LVM
+  Resolves: rhbz#2161181
 - Fix test_swapon_pagesize on systems with 64k pages
-  Resolves: rhbz#2138698
+  Resolves: rhbz#2168220
 
-* Wed Nov 30 2022 Vojtech Trefny <vtrefny@redhat.com> - 2.28-2
+* Thu Jan 05 2023 Vojtech Trefny <vtrefny@redhat.com> - 2.28-4
+- nvme: Fix namespace identifiers
+  Resolves: rhbz#2151535
+- nvme: Avoid sending NVME_IDENTIFY_CNS_NS_DESC_LIST on older devices
+  Related: rhbz#2151535
+
+* Mon Nov 28 2022 Vojtech Trefny <vtrefny@redhat.com> - 2.28-3
 - Fix double free in write_escrow_data_file
-  Resolves: rhbz#2142660
+  Resolves: rhbz#2143226
+
+* Thu Sep 22 2022 Vojtech Trefny <vtrefny@redhat.com> - 2.28-2
+- NVMe plugin backport
+  Resolves: rhbz#2123338
 
 * Wed Sep 14 2022 Vojtech Trefny <vtrefny@redhat.com> - 2.28-1
 - Rebase to the latest upstream release 2.28
-  Resolves: rhbz#2123347
+  Resolves: rhbz#2123346
+- Add dependency on device-mapper-multipath to libblockdev-mpath
+  Resolves: rhbz#2121072
+- Fix spec issues found by rpminspect
+  Resolves: rhbz#2116544
 
-* Mon Aug 08 2022 Vojtech Trefny <vtrefny@redhat.com> - 2.24-11
-- mdraid: Fix use after free
-  Related: rhbz#2078815
-
-* Mon Aug 08 2022 Vojtech Trefny <vtrefny@redhat.com> - 2.24-10
+* Mon Aug 08 2022 Vojtech Trefny <vtrefny@redhat.com> - 2.25-14
+- tests: Fix expected extended partition flags with new parted
+  Related: rhbz#2109026
 - mdraid: Fix copy-paste error when checking return value
-  Related: rhbz#2078815
+  Related: rhbz#2109026
 
-* Fri Aug 05 2022 Vojtech Trefny <vtrefny@redhat.com> - 2.24-9
+* Mon Aug 08 2022 Vojtech Trefny <vtrefny@redhat.com> - 2.25-13
 - Fix getting UUID for DDF containers
-  Resolves: rhbz#2078815
+  Resolves: rhbz#2109026
 
-* Tue Dec 07 2021 Vojtech Trefny <vtrefny@redhat.com> - 2.24-8
-- Fix vdo stats calculation
-  Resolves: rhbz#2023883
+* Wed May 11 2022 Vojtech Trefny <vtrefny@redhat.com> - 2.25-12
+- tests: Lower expected free space on newly created Ext filesystems
+  Resolves: rhbz#2065943
 
-* Wed Jun 30 2021 Vojtech Trefny <vtrefny@redhat.com> - 2.24-7
+* Mon Jan 10 2022 Vojtech Trefny <vtrefny@redhat.com> - 2.25-11
+- tests: Wait for raid and mirrored LVs to be synced before removing
+  Resolves: rhbz#2030647
+- spec: Require the same version of utils for lvm-devel and lvm-dbus-devel
+  Resolves: rhbz#2028113
+
+* Wed Dec 08 2021 Vojtech Trefny <vtrefny@redhat.com> - 2.25-10
+- Fix reading statistics for VDO pools with VDO 8
+  Resolves: rhbz#1994220
+- vdo_stats: Default to 100 % savings for invalid savings values
+  Resolves: rhbz#2025880
+- Add support for creating and unlocking standalone integrity devices
+  Resolves: rhbz#2011365
+
+* Tue Nov 30 2021 Vojtech Trefny <vtrefny@redhat.com> - 2.25-9
+- Fix patch for 'Add support LVM devices file management'
+  Resolves: rhbz#1983705
+
+* Tue Nov 30 2021 Vojtech Trefny <vtrefny@redhat.com> - 2.25-8
+- Add support LVM devices file management
+  Resolves: rhbz#1983705
+
+* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 2.25-7
+- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
+  Related: rhbz#1991688
+
+* Tue Jun 29 2021 Vojtech Trefny <vtrefny@redhat.com> - 2.25-6
 - Add workarounds for some LVM test issues
-  Resolves: rhbz#1974352
+  Resolves: rhbz#1976174
+- Adapt tests to xfsprogs 5.12 changes
+  Resolves: rhbz#1976176
 
-* Fri May 14 2021 Vojtech Trefny <vtrefny@redhat.com> - 2.24-6
+* Tue May 18 2021 Vojtech Trefny <vtrefny@redhat.com> - 2.25-5
+- Adapt to dosfstools 4.2 changes
+  Resolves: rhbz#1960624
+
+* Thu May 13 2021 Vojtech Trefny <vtrefny@redhat.com> - 2.25-4
+- Memory leaks fixes backport
+  Resolves: rhbz#1938757
 - Fix default key size for non XTS ciphers
-  Resolves: rhbz#1931847
+  Resolves: rhbz#1954005
 
-* Mon Jan 11 2021 Vojtech Trefny <vtrefny@redhat.com> - 2.24-5
-- Fix LVM thin metadata calculation fix
-  Resolves: rhbz#1901714
+* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 2.25-3
+- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
 
-* Mon Dec 14 2020 Vojtech Trefny <vtrefny@redhat.com> - 2.24-4
-- LVM thin metadata calculation fix
-  Resolves: rhbz#1901714
+* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.25-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
 
-* Wed Nov 18 2020 Vojtech Trefny <vtrefny@redhat.com> - 2.24-3
-- exec: Polling fixes
-  Resolves: rhbz#1884689
+* Mon Jan 11 2021 Vojtech Trefny <vtrefny@redhat.com> - 2.25-1
+- loop: Retry LOOP_SET_STATUS64 on EAGAIN (vtrefny)
+- Fix max size limit for LVM thinpool metadata (vtrefny)
+- lvm: Use the UNUSED macro instead of __attribute__((unused)) (vtrefny)
+- lvm: Do not use thin_metadata_size to recommend thin metadata size (vtrefny)
+- lvm: Set thin metadata limits to match limits LVM uses in lvcreate (vtrefny)
+- Mark all GIR file constants as guint64 (vtrefny)
+- lvm: Fix bd_lvm_vdopooldata_* symbols (tbzatek)
+- fs: Fix compile error in ext_repair caused by cherry pick from master (vtrefny)
+- README: Use CI status image for 2.x-branch on 2.x (vtrefny)
+- fs: Do not report error when errors were fixed by e2fsck (vtrefny)
+- tests: Add null-byte exec tests (tbzatek)
+- tests: Add bufferbloat exec tests (tbzatek)
+- exec: Clarify the BDUtilsProgExtract callback documentation (tbzatek)
+- exec: Use non-blocking read and process the buffer manually (tbzatek)
+- exec: Fix polling for stdout and stderr (tbzatek)
+- exec: Fix setting locale for util calls (vtrefny)
 
-* Mon Nov 09 2020 Vojtech Trefny <vtrefny@redhat.com> - 2.24-2
+* Thu Oct 01 2020 Vojtech Trefny <vtrefny@redhat.com> - 2.24-7
+- Do not build VDO plugin
+
+* Thu Sep 17 2020 Vojtech Trefny <vtrefny@redhat.com> - 2.24-6
 - exec: Fix setting locale for util calls
-  Resolves: rhbz#1880031
+
+* Thu Aug 20 2020 Vojtech Trefny <vtrefny@redhat.com> - 2.24-5
+- dm: Fix comparing DM RAID member devices UUID
+
+* Wed Aug 19 2020 Jeff Law <law@redhat.com> - 2.24-4
+- Work around gcc-11 false positive warning
+
+* Mon Jul 27 2020 Hans de Goede <hdegoede@redhat.com> - 2.24-3
+- Change -mpath subpackage Requires: device-mapper-multipath into Recommends
+- Related: rhbz#1857393
+
+* Sat May 23 2020 Miro Hrončok <mhroncok@redhat.com> - 2.24-2
+- Rebuilt for Python 3.9
 
 * Fri May 22 2020 Vojtech Trefny <vtrefny@redhat.com> - 2.24-1
-- Rebased to the latest upstream release 2.24
-  Resolves: rhbz#1824153
+- Mark VDO plugin as deprecated since 2.24 (vtrefny)
+- Fix multiple uninitialized values discovered by coverity (vtrefny)
+- fs: Fix potential NULL pointer dereference in mount.c (vtrefny)
+- utils: Remove deadcode in exec.c (vtrefny)
+- Do not check VDO saving percent value in LVM DBus tests (vtrefny)
+- Use libblkid to get label and UUID for XFS filesystems (vtrefny)
+- Do not open devices as read-write for read-only fs operations (vtrefny)
+- Create a common function to get label and uuid of a filesystem (vtrefny)
+- lvm: Fix getting cache stats for cache thinpools (vtrefny)
+- Do not skip LVM VDO tests when the kvdo module is already loaded (vtrefny)
+- tests: Skip LVM VDO tests if kvdo module cannot be loaded (vtrefny)
+- lvm-dbus: Add LVM VDO pools to bd_lvm_lvs (vtrefny)
+- lvm: Add a function to get VDO pool name for a VDO LV (vtrefny)
+- lvm-dbus: Get data LV name for LVM VDO pools too (vtrefny)
+- Add functions to get VDO stats for LVM VDO volumes (vtrefny)
+- Move VDO statistics code to a separate file (vtrefny)
+- Fix copy-paste bug in lvm.api (vtrefny)
+- exec: Disable encoding when reading data from stdout/stderr (vtrefny)
+- Add function to get LVM VDO write policy from a string (vtrefny)
+- Add extra parameters for creating LVM VDO volumes (vtrefny)
+- Allow calling LVM functions without locking global_config_lock (vtrefny)
+- Fix getting VDO data in the LVM DBus plugin (vtrefny)
+- Fix getting string representation of unknown VDO state index (vtrefny)
+- Add write policy and index size to LVM VDO data (vtrefny)
+- Fix converting to VDO pool without name for the VDO LV (vtrefny)
+- Add some helper functions to get LVM VDO mode and state strings (vtrefny)
+- Add support for creating and managing VDO LVs with LVM (vtrefny)
+- Fix LVM plugin so names in tests (vtrefny)
+- Do not hardcode pylint executable name in Makefile (vtrefny)
+- Add a function to check if a tool supports given feature (vtrefny)
+- configure.ac: Avoid more bashisms (gentoo)
+- mount: Fix a memleak (tbzatek)
+- exec: Fix a memleak (tbzatek)
+- vdo: Fix a memleak (tbzatek)
+- configure.ac: Avoid bashisms (polynomial-c)
+- tests: Specify loader for yaml.load in VDO tests (vtrefny)
+- lvm-dbus: Fix memory leak in bd_lvm_thlvpoolname (vtrefny)
+- lvm-dbus: Do not activate LVs during pvscan --cache (vtrefny)
+- vdo: Run "vdo create" with "--force" (vtrefny)
+- Fix typo in (un)mount error messages (vtrefny)
+- utils: Add functions to get and check current linux kernel version (tbzatek)
+- ext: Return empty string instead of "<none>" for empty UUID (vtrefny)
+- Add support for BitLocker encrypted devices using cryptsetup (vtrefny)
+- Add a helper function for closing an active crypto device (vtrefny)
+- Manually remove symlinks not removed by udev in tests (vtrefny)
+- Fix memory leak in LVM DBus plugin (vtrefny)
+- Fix expected cache pool name with newest LVM (vtrefny)
+- fs: Fix checking for UID/GID == 0 (vtrefny)
+- Fixed a number of memory leaks in lvm-dbus plugin (mthompson)
+- exec.c: Fix reading outputs with null bytes (vtrefny)
+- Fix linking against utils on Debian (vtrefny)
+- Add new function 'bd_fs_wipe_force' to control force wipe (vtrefny)
+- Use 'explicit_bzero' to erase passphrases from key files (vtrefny)
+- Sync spec with downstream (vtrefny)
 
-* Mon Dec 02 2019 Vojtech Trefny <vtrefny@redhat.com> - 2.19-12
-- Use cryptsetup to check LUKS2 label
-  Resolves: rhbz#1778689
-- Fix expected cache pool name with newest LVM
-  Related: rhbz#1778689
+* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.23-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
 
-* Thu Jun 06 2019 Vojtech Trefny <vtrefny@redhat.com> - 2.19-11
-- Fix checking swap status on lvm/md (vtrefny)
-  Resolves: rhbz#1649815
+* Mon Sep 09 2019 Vojtech Trefny <vtrefny@redhat.com> - 2.23-1
+- Fix how we get process exit code from g_spawn_sync (vtrefny)
+- Skip tests for old-style LVM snapshots on recent Fedora (vtrefny)
+- Fix skipping NTFS read-only test case on systems without NTFS (vtrefny)
+- Fix LVM_MAX_LV_SIZE in the GIR file (vtrefny)
+- Print skipped test "results" to stderr instead of stdout (vtrefny)
+- Move the NTFS read-only device test to a separate test case (vtrefny)
+- Fix parsing distro version from CPE name (vtrefny)
+- Use 'kmod_module_probe_insert_module' function for loading modules (vtrefny)
+- Hide filesystem-specific is_tech_available functions (vtrefny)
+- Mark LVM global config locks as static (vtrefny)
+- Remove unused 'get_PLUGIN_num_functions' and 'get_PLUGIN_functions' functions (vtrefny)
+- Mark 'private' plugin management functions as static (vtrefny)
+- Ignore coverity deadcode warning in 'bd_fs_is_tech_avail' (vtrefny)
+- Ignore coverity deadcode warnings in the generated code (vtrefny)
+- Use the new config file for skipping tests (vtrefny)
+- Skip bcache tests if make-bcache is not installed (vtrefny)
+- Add ability to read tests to skip from a config file (vtrefny)
+- Mark 'test_set_bitmap_location' as unstable (vtrefny)
+- Force LVM cli plugin in lvm_test (vtrefny)
+- Add a special test tag for library tests that recompile plugins (vtrefny)
+- Allow running tests against installed libblockdev (vtrefny)
+- Remove duplicate test case (vtrefny)
+- Use the new test tags in tests (vtrefny)
+- Use test tags for skipping tests (vtrefny)
+- Add a decorator for "tagging" tests (vtrefny)
+- Add function for (un)freezing filesystems (vtrefny)
+- Add a function to check whether a path is a mounpoint or not (vtrefny)
+- Skip bcache tests on all Debian versions (vtrefny)
 
-* Thu May 30 2019 Tomas Bzatek <tbzatek@redhat.com> - 2.19-10
-- Memory leak fixes (tbzatek)
-  Resolves: rhbz#1714276
+* Fri Aug 16 2019 Miro Hrončok <mhroncok@redhat.com> - 2.22-3
+- Rebuilt for Python 3.8
 
-* Mon May 06 2019 Vojtech Trefny <vtrefny@redhat.com> - 2.19-9
+* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.22-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Wed Jun 12 2019 Vojtech Trefny <vtrefny@redhat.com> - 2.22-1
+- tests: Fix Debian testing "version" for skipping (vtrefny)
+- module: Fix libkmod related leak (tbzatek)
+- btrfs: Fix number of memory leaks (tbzatek)
+- mdraid: Fix leaking BDMDExamineData.metadata (tbzatek)
+- mdraid: Fix leaking error (tbzatek)
+- part: Fix leaking string in args (tbzatek)
+- ext: Fix leaking string (tbzatek)
+- part: Fix leaking objects (tbzatek)
+- kbd: Fix g_match_info_fetch() leaks (tbzatek)
+- ext: Fix g_match_info_fetch() leaks (tbzatek)
+- ext: Fix g_strsplit() leaks (tbzatek)
+- s390: Fix g_strsplit() leaks (tbzatek)
+- mdraid: Fix g_strsplit() leaks (tbzatek)
+- exec: Fix some memory leaks (tbzatek)
+- lvm: Fix leaking BDLVMPVdata.vg_uuid (tbzatek)
+- lvm: Use g_ptr_array_free() for creating lists (tbzatek)
+- lvm: Fix some obvious memory leaks (tbzatek)
 - Remove device-mapper-multipath dependency from fs and part plugins (vtrefny)
-  Resolves: rhbz#1700297
+- bd_fs_xfs_get_info: Allow passing error == NULL (tbzatek)
+- tests: Fix removing targetcli lun (vtrefny)
+- Use existing cryptsetup API for changing keyslot passphrase (vtrefny)
+- New function to get supported sector sizes for NVDIMM namespaces (vtrefny)
+- Allow skiping tests only based on architecture (vtrefny)
+- Sync spec file with python2 obsoletion added downstream (awilliam)
+- Sync spec with downstream (vtrefny)
 
-* Mon Apr 08 2019 Vojtech Trefny <vtrefny@redhat.com> - 2.19-8
-- Allow running tests against installed version of libblockdev (vtrefny)
-  Related: rhbz#1679668
+* Tue Apr 16 2019 Vojtech Trefny <vtrefny@redhat.com> - 2.21-3
+- Remove device-mapper-multipath dependency from fs and part plugins
 
-* Mon Jan 07 2019 Vojtech Trefny <vtrefny@redhat.com> - 2.19-7
+* Thu Feb 28 2019 Adam Williamson <awilliam@redhat.com> - 2.21-2
+- Obsolete the python2 subpackage if we're not building it
+
+* Thu Feb 21 2019 Vojtech Trefny <vtrefny@redhat.com> - 2.21-1
+- Fix checking swap status on lvm/md (vtrefny)
+- tests: Stop skipping some tests on Debian testing (vtrefny)
+- tests: Remove some old/irrelevant skips (vtrefny)
+- Use 512bit keys in LUKS by default (vratislav.podzimek)
+- Add 'autoconf-archive' to build requires (vtrefny)
+- vagrant: remove F27 and add F29 (vtrefny)
+- vagrant: install 'autoconf-archive' on Ubuntu (vtrefny)
+- Enable cryptsetup debug messages when compiled using --enable-debug (vtrefny)
+- lvm-dbus: Do not pass extra arguments enclosed in a tuple (vtrefny)
+- crypto: Do not try to use keyring on systems without keyring support (vtrefny)
+- Fix LUKS2 resize password test (vtrefny)
+- Use cryptsetup to check LUKS2 label (vtrefny)
+- Skip LUKS2+integrity test on systems without dm-integrity module (vtrefny)
+- Add custom error message for wrong passphrase for open (vtrefny)
 - Use major/minor macros from sys/sysmacros.h instead of linux/kdev_t.h (vtrefny)
-  Resolves: rhbz#1644825
-
-* Tue Oct 16 2018 Vojtech Trefny <vtrefny@redhat.com> - 2.19-6
-- Fix 'Require exact version of the utils subpackage' (vtrefny)
-  Related: rhbz#1614328
-
-* Tue Oct 16 2018 Vojtech Trefny <vtrefny@redhat.com> - 2.19-5
-- Require exact version of the utils subpackage (vtrefny)
-  Related: rhbz#1614328
-
-* Mon Oct 08 2018 Vojtech Trefny <vtrefny@redhat.com> - 2.19-4
-- Use libblkid to check swap status before swapon (vtrefny)
-  Related: rhbz#1634016
+- crypto_test.py: Use blkid instead of lsblk to check luks label (vtrefny)
+- Skip VDO grow physical test (vtrefny)
+- Add libblkid-devel as a build dependency for the swap plugin (vtrefny)
 - Add error codes and Python exceptions for swapon fails (vtrefny)
-  Resolves: rhbz#1634016
+- Use libblkid to check swap status before swapon (vtrefny)
+- Add a new subpackage with the tool(s) (v.podzimek)
+- Document what the 'tools' directory contains (v.podzimek)
+- Make building tools optional (v.podzimek)
+- Add a tool for getting cached LVM statistics (v.podzimek)
+- Discard messages from libdevmapper in the LVM plugins (v.podzimek)
 
-* Mon Aug 13 2018 Vojtech Trefny <vtrefny@redhat.com> - 2.19-3
-- Build VDO plugin on all architectures with VDO support (vtrefny)
-  Related: rhbz#1614328
+* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.20-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
 
-* Mon Aug 13 2018 Vojtech Trefny <vtrefny@redhat.com> - 2.19-2
-- Do not require 'dmraid' package (vtrefny)
-  Related: rhbz#1589861
+* Mon Oct 08 2018 Vojtech Trefny <vtrefny@redhat.com> - 2.20-2
+- Use libblkid to check swap status before swapon (vtrefny)
+- Add error codes and Python exceptions for swapon fails (vtrefny)
+
+* Wed Sep 26 2018 Vojtech Trefny <vtrefny@redhat.com> - 2.20-1
+- Use unsafe caching for storage for devel/testing VMs (v.podzimek)
+- Require newer version of cryptsetup for LUKS2 tests (vtrefny)
+- Skip nvdimm tests on systems without ndctl (vtrefny)
+- Add Ubuntu 18.04 VM configuration to the vagrant template (vtrefny)
+- Add some missing test dependencies to the vagrant template (vtrefny)
+- Fix how/where the bcache tests are skipped (v.podzimek)
+- Document what the 'misc' directory contains (v.podzimek)
+- Add a Vagrantfile template (v.podzimek)
+- Fix the error message when deleting partition fails (vpodzime)
+- Fix build of plugins by changing linking order (devurandom)
+- Fix how we check zram stats from /sys/block/zram0/stat (vtrefny)
+- lvm-dbus: Fix parsing extra arguments for LVM methods calls (vtrefny)
+- Skip MDTestAddRemove on Debian (vtrefny)
+- Skip NTFS mount test on Debian testing (vtrefny)
+- Skip bcache tests on Debian testing (vtrefny)
+- tests: Try harder to get distribution version (vtrefny)
+- Mark the function stubs as static (v.podzimek)
+- Build the dm plugin without dmraid support on newer RHEL (vtrefny)
+- Fix skipping zram tests on Fedora 27 (vtrefny)
+- kbd: Check for zram module availability in 'bd_kbd_is_tech_avail' (vtrefny)
+- Always build the VDO plugin (vtrefny)
+- Do not require 'dmraid' package if built without dmraid support (vtrefny)
+- Fix licence header in dbus.c (vtrefny)
+- Fix spacing in NEWS.rst (vtrefny)
 
 * Fri Aug 10 2018 Vojtech Trefny <vtrefny@redhat.com> - 2.19-1
 - Use python interpreter explicitly when running boilerplate_generator.py (vtrefny)
@@ -1155,11 +1432,41 @@ find %{buildroot} -type f -name "*.la" | xargs %{__rm}
 - Do not build VDO plugin on non-x86_64 architectures (vtrefny)
 - Sync spec with downstream (vtrefny)
 
-* Thu Jun 28 2018 Vojtech Trefny <vtrefny@redhat.com> - 2.17-3
-- Build kbd plugin withou bcache support
+* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.18-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
 
-* Fri Jun 22 2018 Vojtech Trefny <vtrefny@redhat.com> - 2.17-2
-- Do not build btrs plugin on RHEL 8
+* Mon Jul 09 2018 Vojtech Trefny <vtrefny@redhat.com> - 2.18-3
+- Reitroduce python2 support for Fedora 29
+
+* Mon Jul 02 2018 Miro Hrončok <mhroncok@redhat.com> - 2.18-2
+- Rebuilt for Python 3.7
+
+* Wed Jun 20 2018 Vojtech Trefny <vtrefny@redhat.com> - 2.18-1
+- Add VDO to features.rst (vtrefny)
+- Remove roadmap.rst (vtrefny)
+- vdo: Add tests for bd_vdo_grow_physical() (tbzatek)
+- Do not try to build VDO plugin on Fedora (vtrefny)
+- Introduce reporting function per thread (kailueke)
+- vdo: Implement bd_vdo_grow_physical() (tbzatek)
+- Correct arguments for ext4 repair with progress (kailueke)
+- Clarify that checking an RW-mounted XFS file system is impossible (v.podzimek)
+- vdo: Resolve real device file path (tbzatek)
+- Adjust to new NVDIMM namespace modes (vtrefny)
+- Use xfs_repair instead of xfs_db in bd_fs_xfs_check() (v.podzimek)
+- Allow compiling libblockdev without libdmraid (vtrefny)
+- Only require plugins we really need in LVM dbus tests (vtrefny)
+- Add tests for VDO plugin (vtrefny)
+- Add decimal units definition to utils/sizes.h (vtrefny)
+- Add basic VDO plugin functionality (vtrefny)
+- Add the VDO plugin (vtrefny)
+- Always check for error when (un)mounting (vtrefny)
+- Fix off-by-one error when counting TCRYPT keyfiles (segfault)
+- Add 'bd_dm_is_tech_avail' to header file (vtrefny)
+- Fix release number in NEWS.rst (vtrefny)
+- Update specs.rst and features.rst (vtrefny)
+
+* Fri Jun 15 2018 Miro Hrončok <mhroncok@redhat.com> - 2.17-2
+- Rebuilt for Python 3.7
 
 * Tue Apr 24 2018 Vojtech Trefny <vtrefny@redhat.com> - 2.17-1
 - Redirect cryptsetup log to libblockdev log (vtrefny)