.gitignore

@@ -1 +1 @@
-SOURCES/libgcrypt-1.8.3-hobbled.tar.xz
+SOURCES/libgcrypt-1.8.5-hobbled.tar.xz

.libgcrypt.metadata

@@ -1 +1 @@
-e89427b41b148a28583825079d45a7a64234fdbf SOURCES/libgcrypt-1.8.3-hobbled.tar.xz
+1edcc623a15ed87ff832e021b4cb77fd94eb66c9 SOURCES/libgcrypt-1.8.5-hobbled.tar.xz

SOURCES/ecc-curves.c

@@ -1057,7 +1057,7 @@ _gcry_ecc_get_mpi (const char *name, mpi_ec_t ec, int copy)
   if (!strcmp (name, "q.x") && ec->Q && ec->Q->x)
     return mpi_is_const (ec->Q->x) && !copy? ec->Q->x : mpi_copy (ec->Q->x);
   if (!strcmp (name, "q.y") && ec->Q && ec->Q->y)
-    return mpi_is_const (ec->G->y) && !copy? ec->Q->y : mpi_copy (ec->Q->y);
+    return mpi_is_const (ec->Q->y) && !copy? ec->Q->y : mpi_copy (ec->Q->y);
 
   /* If the base point has been requested, return it in standard
      encoding.  */

SOURCES/libgcrypt-1.8.0-tests.patch

@@ -1,115 +0,0 @@
-diff -up libgcrypt-1.8.0/cipher/dsa.c.tests libgcrypt-1.8.0/cipher/dsa.c
---- libgcrypt-1.8.0/cipher/dsa.c.tests	2016-04-07 17:30:08.000000000 +0200
-+++ libgcrypt-1.8.0/cipher/dsa.c	2017-08-15 15:10:39.551600227 +0200
-@@ -457,11 +457,22 @@ generate_fips186 (DSA_secret_key *sk, un
-                                              &prime_q, &prime_p,
-                                              r_counter,
-                                              r_seed, r_seedlen);
--      else
--        ec = _gcry_generate_fips186_3_prime (nbits, qbits, NULL, 0,
-+      else if (!domain->p || !domain->q)
-+        ec = _gcry_generate_fips186_3_prime (nbits, qbits,
-+                                             initial_seed.seed,
-+                                             initial_seed.seedlen,
-                                              &prime_q, &prime_p,
-                                              r_counter,
-                                              r_seed, r_seedlen, NULL);
-+      else
-+        {
-+          /* Domain parameters p and q are given; use them.  */
-+          prime_p = mpi_copy (domain->p);
-+          prime_q = mpi_copy (domain->q);
-+          gcry_assert (mpi_get_nbits (prime_p) == nbits);
-+          gcry_assert (mpi_get_nbits (prime_q) == qbits);
-+          ec = 0;
-+        }
-       sexp_release (initial_seed.sexp);
-       if (ec)
-         goto leave;
-@@ -855,13 +866,12 @@ dsa_generate (const gcry_sexp_t genparms
-       sexp_release (l1);
-       sexp_release (domainsexp);
- 
--      /* Check that all domain parameters are available.  */
--      if (!domain.p || !domain.q || !domain.g)
-+      /* Check that p and q domain parameters are available.  */
-+      if (!domain.p || !domain.q || (!domain.g && !(flags & PUBKEY_FLAG_USE_FIPS186)))
-         {
-           _gcry_mpi_release (domain.p);
-           _gcry_mpi_release (domain.q);
-           _gcry_mpi_release (domain.g);
--          sexp_release (deriveparms);
-           return GPG_ERR_MISSING_VALUE;
-         }
- 
-diff -up libgcrypt-1.8.0/cipher/rsa.c.tests libgcrypt-1.8.0/cipher/rsa.c
---- libgcrypt-1.8.0/cipher/rsa.c.tests	2017-07-06 10:21:36.000000000 +0200
-+++ libgcrypt-1.8.0/cipher/rsa.c	2017-08-15 15:10:39.551600227 +0200
-@@ -696,7 +696,7 @@ generate_x931 (RSA_secret_key *sk, unsig
- 
-   *swapped = 0;
- 
--  if (e_value == 1)   /* Alias for a secure value. */
-+  if (e_value == 1 || e_value == 0)   /* Alias for a secure value. */
-     e_value = 65537;
- 
-   /* Point 1 of section 4.1:  k = 1024 + 256s with S >= 0  */
-diff -up libgcrypt-1.8.0/tests/keygen.c.tests libgcrypt-1.8.0/tests/keygen.c
---- libgcrypt-1.8.0/tests/keygen.c.tests	2017-08-15 15:10:39.551600227 +0200
-+++ libgcrypt-1.8.0/tests/keygen.c	2017-08-15 15:16:05.433176171 +0200
-@@ -200,11 +200,11 @@ check_rsa_keys (void)
- 
- 
-   if (verbose)
--    info ("creating 512 bit RSA key with e=257\n");
-+    info ("creating 1024 bit RSA key with e=257\n");
-   rc = gcry_sexp_new (&keyparm,
-                       "(genkey\n"
-                       " (rsa\n"
--                      "  (nbits 3:512)\n"
-+                      "  (nbits 4:1024)\n"
-                       "  (rsa-use-e 3:257)\n"
-                       " ))", 0, 1);
-   if (rc)
-@@ -225,11 +225,11 @@ check_rsa_keys (void)
-   gcry_sexp_release (key);
- 
-   if (verbose)
--    info ("creating 512 bit RSA key with default e\n");
-+    info ("creating 1024 bit RSA key with default e\n");
-   rc = gcry_sexp_new (&keyparm,
-                       "(genkey\n"
-                       " (rsa\n"
--                      "  (nbits 3:512)\n"
-+                      "  (nbits 4:1024)\n"
-                       "  (rsa-use-e 1:0)\n"
-                       " ))", 0, 1);
-   if (rc)
-@@ -309,12 +309,12 @@ check_dsa_keys (void)
-     }
- 
-   if (verbose)
--    info ("creating 1536 bit DSA key\n");
-+    info ("creating 2048 bit DSA key\n");
-   rc = gcry_sexp_new (&keyparm,
-                       "(genkey\n"
-                       " (dsa\n"
--                      "  (nbits 4:1536)\n"
--                      "  (qbits 3:224)\n"
-+                      "  (nbits 4:2048)\n"
-+                      "  (qbits 3:256)\n"
-                       " ))", 0, 1);
-   if (rc)
-     die ("error creating S-expression: %s\n", gpg_strerror (rc));
-diff -up libgcrypt-1.8.0/tests/pubkey.c.tests libgcrypt-1.8.0/tests/pubkey.c
---- libgcrypt-1.8.0/tests/pubkey.c.tests	2017-01-18 15:24:25.000000000 +0100
-+++ libgcrypt-1.8.0/tests/pubkey.c	2017-08-15 15:10:39.552600207 +0200
-@@ -595,7 +595,7 @@ get_dsa_key_fips186_with_seed_new (gcry_
-      "    (use-fips186)"
-      "    (transient-key)"
-      "    (derive-parms"
--     "      (seed #0cb1990c1fd3626055d7a0096f8fa99807399871#))))",
-+     "      (seed #8b4c4d671fff82e8ed932260206d0571e3a1c2cee8cd94cb73fe58f9b67488fa#))))",
-      0, 1);
-   if (rc)
-     die ("error creating S-expression: %s\n", gcry_strerror (rc));

SOURCES/libgcrypt-1.8.3-fips-ctor.patch

@@ -1,196 +1,7 @@
-diff -up libgcrypt-1.8.3/cipher/md.c.fips-ctor libgcrypt-1.8.3/cipher/md.c
---- libgcrypt-1.8.3/cipher/md.c.fips-ctor	2017-11-23 19:16:58.000000000 +0100
-+++ libgcrypt-1.8.3/cipher/md.c	2018-07-12 13:24:54.088403006 +0200
-@@ -411,11 +411,8 @@ md_enable (gcry_md_hd_t hd, int algorith
- 
-   if (!err && algorithm == GCRY_MD_MD5 && fips_mode ())
-     {
--      _gcry_inactivate_fips_mode ("MD5 used");
-       if (_gcry_enforced_fips_mode () )
-         {
--          /* We should never get to here because we do not register
--             MD5 in enforced fips mode. But better throw an error.  */
-           err = GPG_ERR_DIGEST_ALGO;
-         }
-     }
-diff -up libgcrypt-1.8.3/src/fips.c.fips-ctor libgcrypt-1.8.3/src/fips.c
---- libgcrypt-1.8.3/src/fips.c.fips-ctor	2018-07-12 13:24:54.075402698 +0200
-+++ libgcrypt-1.8.3/src/fips.c	2018-07-12 13:24:54.088403006 +0200
-@@ -91,6 +91,31 @@ static void fips_new_state (enum module_
- 
- 
- 
-+/* Initialize the FSM lock - this function may only
-+   be called once and is intended to be run from the library
-+   constructor  */
-+void
-+_gcry_initialize_fsm_lock (void)
-+{
-+  gpg_error_t err;
-+  /* Intitialize the lock to protect the FSM.  */
-+  err = gpgrt_lock_init (&fsm_lock);
-+  if (err)
-+    {
-+      /* If that fails we can't do anything but abort the
-+         process. We need to use log_info so that the FSM won't
-+         get involved.  */
-+      log_info ("FATAL: failed to create the FSM lock in libgcrypt: %s\n",
-+                gpg_strerror (err));
-+#ifdef HAVE_SYSLOG
-+      syslog (LOG_USER|LOG_ERR, "Libgcrypt error: "
-+              "creating FSM lock failed: %s - abort",
-+              gpg_strerror (err));
-+#endif /*HAVE_SYSLOG*/
-+      abort ();
-+    }
-+}
-+
- /* Check whether the OS is in FIPS mode and record that in a module
-    local variable.  If FORCE is passed as true, fips mode will be
-    enabled anyway. Note: This function is not thread-safe and should
-@@ -100,7 +125,6 @@ void
- _gcry_initialize_fips_mode (int force)
- {
-   static int done;
--  gpg_error_t err;
- 
-   /* Make sure we are not accidentally called twice.  */
-   if (done)
-@@ -179,24 +203,6 @@ _gcry_initialize_fips_mode (int force)
-       /* Yes, we are in FIPS mode.  */
-       FILE *fp;
- 
--      /* Intitialize the lock to protect the FSM.  */
--      err = gpgrt_lock_init (&fsm_lock);
--      if (err)
--        {
--          /* If that fails we can't do anything but abort the
--             process. We need to use log_info so that the FSM won't
--             get involved.  */
--          log_info ("FATAL: failed to create the FSM lock in libgcrypt: %s\n",
--                    gpg_strerror (err));
--#ifdef HAVE_SYSLOG
--          syslog (LOG_USER|LOG_ERR, "Libgcrypt error: "
--                  "creating FSM lock failed: %s - abort",
--                  gpg_strerror (err));
--#endif /*HAVE_SYSLOG*/
--          abort ();
--        }
--
--
-       /* If the FIPS force files exists, is readable and has a number
-          != 0 on its first line, we enable the enforced fips mode.  */
-       fp = fopen (FIPS_FORCE_FILE, "r");
-@@ -359,16 +365,20 @@ _gcry_fips_is_operational (void)
- {
-   int result;
- 
--  if (!fips_mode ())
-+  lock_fsm ();
-+  if (current_state == STATE_POWERON && !fips_mode ())
-+    /* If we are at this point in POWERON state it means the FIPS
-+       module installation was not completed. (/etc/system-fips
-+      is not present.) */
-     result = 1;
-   else
-     {
--      lock_fsm ();
--      if (current_state == STATE_INIT)
-+      if (current_state == STATE_INIT || current_state == STATE_SELFTEST)
-         {
--          /* If we are still in the INIT state, we need to run the
--             selftests so that the FSM can eventually get into
--             operational state.  Given that we would need a 2-phase
-+          /* If we are still in the INIT (or SELFTEST) state,
-+             we need to run (or finish) the selftests so
-+             that the FSM can eventually get into operational
-+             state. Given that we would need a 2-phase
-              initialization of libgcrypt, but that has traditionally
-              not been enforced, we use this on demand self-test
-              checking.  Note that Proper applications would do the
-@@ -384,9 +394,11 @@ _gcry_fips_is_operational (void)
-           lock_fsm ();
-         }
- 
--      result = (current_state == STATE_OPERATIONAL);
--      unlock_fsm ();
-+      result = (current_state == STATE_OPERATIONAL) || !fips_mode ();
-+      /* We always run the selftests but ignore the result
-+         in non-FIPS mode. */
-     }
-+  unlock_fsm ();
-   return result;
- }
- 
-@@ -709,9 +721,25 @@ _gcry_fips_run_selftests (int extended)
- {
-   enum module_states result = STATE_ERROR;
-   gcry_err_code_t ec = GPG_ERR_SELFTEST_FAILED;
-+  int in_poweron;
- 
--  if (fips_mode ())
--    fips_new_state (STATE_SELFTEST);
-+  lock_fsm ();
-+  in_poweron = (current_state == STATE_POWERON);
-+  unlock_fsm ();
-+
-+  fips_new_state (STATE_SELFTEST);
-+
-+  /* We first check the integrity of the binary.
-+     If run from the constructor we are in POWERON state,
-+     we return and finish the remaining selftests before
-+     real use of the library. It will be in the POWERON
-+     state meanwhile.  */
-+  if (in_poweron)
-+    if (check_binary_integrity ())
-+      goto leave;
-+
-+  if (in_poweron)
-+    return 0;
- 
-   if (run_cipher_selftests (extended))
-     goto leave;
-@@ -730,18 +758,12 @@ _gcry_fips_run_selftests (int extended)
-   if (run_pubkey_selftests (extended))
-     goto leave;
- 
--  /* Now check the integrity of the binary.  We do this this after
--     having checked the HMAC code.  */
--  if (check_binary_integrity ())
--    goto leave;
--
-   /* All selftests passed.  */
-   result = STATE_OPERATIONAL;
-   ec = 0;
- 
-  leave:
--  if (fips_mode ())
--    fips_new_state (result);
-+  fips_new_state (result);
- 
-   return ec;
- }
-@@ -797,6 +819,7 @@ fips_new_state (enum module_states new_s
-     {
-     case STATE_POWERON:
-       if (new_state == STATE_INIT
-+          || new_state == STATE_SELFTEST
-           || new_state == STATE_ERROR
-           || new_state == STATE_FATALERROR)
-         ok = 1;
-@@ -811,6 +834,8 @@ fips_new_state (enum module_states new_s
- 
-     case STATE_SELFTEST:
-       if (new_state == STATE_OPERATIONAL
-+          || new_state == STATE_INIT
-+          || new_state == STATE_SELFTEST
-           || new_state == STATE_ERROR
-           || new_state == STATE_FATALERROR)
-         ok = 1;
 diff -up libgcrypt-1.8.3/src/global.c.fips-ctor libgcrypt-1.8.3/src/global.c
 --- libgcrypt-1.8.3/src/global.c.fips-ctor	2017-11-23 19:25:58.000000000 +0100
-+++ libgcrypt-1.8.3/src/global.c	2018-07-17 19:15:43.933827112 +0200
-@@ -141,6 +141,29 @@ global_init (void)
++++ libgcrypt-1.8.3/src/global.c	2020-04-17 16:29:59.258218015 +0200
+@@ -141,6 +141,34 @@ global_init (void)
  }
  
  
@@ -202,25 +13,30 @@ diff -up libgcrypt-1.8.3/src/global.c.fips-ctor libgcrypt-1.8.3/src/global.c
 +{
 +  int rv;
 +
-+  /* We always need the FSM lock to be functional. */
-+  _gcry_initialize_fsm_lock ();
-+
 +  rv = access (FIPS_MODULE_PATH, F_OK);
 +  if (rv < 0 && errno != ENOENT)
 +    rv = 0;
 +
 +  if (!rv)
 +    {
-+      /* We run the integrity check at this point. The remaining
-+         selftests are run before use of the library by application. */
++      int no_secmem_save;
++
++      /* it should be always 0 at this point but let's keep on the safe side */
++      no_secmem_save = no_secure_memory;
++      no_secure_memory = 1;
++      /* force selftests */
++      global_init();
 +      _gcry_fips_run_selftests (0);
++      if (!fips_mode())
++         _gcry_random_close_fds ();
++      no_secure_memory = no_secmem_save;
 +    }
 +}
 +
  /* This function is called by the macro fips_is_operational and makes
     sure that the minimal initialization has been done.  This is far
     from a perfect solution and hides problems with an improper
-@@ -671,8 +694,7 @@ _gcry_vcontrol (enum gcry_ctl_cmds cmd,
+@@ -671,8 +699,7 @@ _gcry_vcontrol (enum gcry_ctl_cmds cmd,
  
      case GCRYCTL_FIPS_MODE_P:
        if (fips_mode ()
@@ -230,7 +46,7 @@ diff -up libgcrypt-1.8.3/src/global.c.fips-ctor libgcrypt-1.8.3/src/global.c
  	rc = GPG_ERR_GENERAL; /* Used as TRUE value */
        break;
  
-@@ -749,9 +771,9 @@ _gcry_vcontrol (enum gcry_ctl_cmds cmd,
+@@ -749,9 +776,9 @@ _gcry_vcontrol (enum gcry_ctl_cmds cmd,
        break;
  
      case GCRYCTL_SET_ENFORCED_FIPS_FLAG:
@@ -242,15 +58,3 @@ diff -up libgcrypt-1.8.3/src/global.c.fips-ctor libgcrypt-1.8.3/src/global.c
            _gcry_set_preferred_rng_type (0);
            _gcry_set_enforced_fips_mode ();
          }
-diff -up libgcrypt-1.8.3/src/g10lib.h.fips-ctor libgcrypt-1.8.3/src/g10lib.h
---- libgcrypt-1.8.3/src/g10lib.h.fips-ctor	2017-11-23 19:16:58.000000000 +0100
-+++ libgcrypt-1.8.3/src/g10lib.h	2018-07-12 13:24:54.089403030 +0200
-@@ -422,6 +422,8 @@ gpg_err_code_t _gcry_sexp_vextract_param
- 
- /*-- fips.c --*/
- 
-+void _gcry_initialize_fsm_lock (void);
-+
- void _gcry_initialize_fips_mode (int force);
- 
- int _gcry_fips_mode (void);

SOURCES/libgcrypt-1.8.3-getrandom.patch

@@ -1,101 +0,0 @@
-diff -up libgcrypt-1.8.3/random/random.c.getrandom libgcrypt-1.8.3/random/random.c
---- libgcrypt-1.8.3/random/random.c.getrandom	2017-11-23 19:16:58.000000000 +0100
-+++ libgcrypt-1.8.3/random/random.c	2018-07-10 15:38:34.303855808 +0200
-@@ -110,8 +110,8 @@ _gcry_random_read_conf (void)
-   unsigned int result = 0;
- 
-   fp = fopen (fname, "r");
--  if (!fp)
--    return result;
-+  if (!fp) /* We make only_urandom the default. */
-+    return RANDOM_CONF_ONLY_URANDOM;
- 
-   for (;;)
-     {
-diff -up libgcrypt-1.8.3/random/random-csprng.c.getrandom libgcrypt-1.8.3/random/random-csprng.c
---- libgcrypt-1.8.3/random/random-csprng.c.getrandom	2017-11-23 19:16:58.000000000 +0100
-+++ libgcrypt-1.8.3/random/random-csprng.c	2018-06-14 16:31:04.731179208 +0200
-@@ -55,6 +55,10 @@
- #ifdef __MINGW32__
- #include <process.h>
- #endif
-+#if defined(__linux__) && defined(HAVE_SYSCALL)
-+# include <sys/syscall.h>
-+# include <linux/random.h>
-+#endif
- #include "g10lib.h"
- #include "random.h"
- #include "rand-internal.h"
-@@ -1116,6 +1120,22 @@ getfnc_gather_random (void))(void (*)(co
-              enum random_origins, size_t, int);
- 
- #if USE_RNDLINUX
-+#if defined(__linux__) && defined(HAVE_SYSCALL) && defined(__NR_getrandom)
-+  long ret;
-+  char buffer[1];
-+
-+  _gcry_pre_syscall ();
-+  ret = syscall (__NR_getrandom,
-+                 (void*)buffer, (size_t)1, (unsigned int)GRND_NONBLOCK);
-+  _gcry_post_syscall ();
-+  if (ret != -1 || errno != ENOSYS)
-+    {
-+      fnc = _gcry_rndlinux_gather_random;
-+      return fnc;
-+    }
-+  else
-+          /* The syscall is not supported - fallback to /dev/urandom. */
-+#endif
-   if ( !access (NAME_OF_DEV_RANDOM, R_OK)
-        && !access (NAME_OF_DEV_URANDOM, R_OK))
-     {
-diff -up libgcrypt-1.8.3/random/rndlinux.c.getrandom libgcrypt-1.8.3/random/rndlinux.c
---- libgcrypt-1.8.3/random/rndlinux.c.getrandom	2018-06-14 16:31:04.722178971 +0200
-+++ libgcrypt-1.8.3/random/rndlinux.c	2018-07-10 15:55:03.301075155 +0200
-@@ -35,6 +35,7 @@
- #include <poll.h>
- #if defined(__linux__) && defined(HAVE_SYSCALL)
- # include <sys/syscall.h>
-+# include <linux/random.h>
- #endif
- 
- #include "types.h"
-@@ -204,6 +205,18 @@ _gcry_rndlinux_gather_random (void (*add
-     {
-       if (fd_urandom == -1)
-         {
-+#if defined(__linux__) && defined(HAVE_SYSCALL) && defined(__NR_getrandom)
-+          long ret;
-+
-+          _gcry_pre_syscall ();
-+          ret = syscall (__NR_getrandom,
-+                         (void*)buffer, (size_t)1, (unsigned int)GRND_NONBLOCK);
-+          _gcry_post_syscall ();
-+          if (ret > -1 || errno == EAGAIN || errno == EINTR)
-+            fd_urandom = -2;
-+	  else
-+            /* The syscall is not supported - fallback to /dev/urandom. */
-+#endif
-           fd_urandom = open_device (NAME_OF_DEV_URANDOM, (ever_opened & 2));
-           ever_opened |= 2;
-         }
-@@ -230,7 +243,7 @@ _gcry_rndlinux_gather_random (void (*add
-        * syscall and not a new device and thus we are not able to use
-        * select(2) to have a timeout. */
- #if defined(__linux__) && defined(HAVE_SYSCALL) && defined(__NR_getrandom)
--      if (fd == fd_urandom)
-+      if (fd == -2)
-         {
-           long ret;
-           size_t nbytes;
-@@ -246,9 +259,7 @@ _gcry_rndlinux_gather_random (void (*add
-               _gcry_post_syscall ();
-             }
-           while (ret == -1 && errno == EINTR);
--          if (ret == -1 && errno == ENOSYS)
--            ; /* The syscall is not supported - fallback to /dev/urandom.  */
--          else
-+          if (1)
-             { /* The syscall is supported.  Some sanity checks.  */
-               if (ret == -1)
-                 log_fatal ("unexpected error from getrandom: %s\n",

SOURCES/libgcrypt-1.8.3-md-fips-enforce.patch

@@ -1,12 +1,18 @@
 diff -up libgcrypt-1.8.3/cipher/md.c.fips-enforce libgcrypt-1.8.3/cipher/md.c
---- libgcrypt-1.8.3/cipher/md.c.fips-enforce	2018-11-01 15:40:36.051865535 +0100
-+++ libgcrypt-1.8.3/cipher/md.c	2019-06-03 11:50:21.435401753 +0200
-@@ -409,7 +409,7 @@ md_enable (gcry_md_hd_t hd, int algorith
+--- libgcrypt-1.8.3/cipher/md.c.fips-enforce	2017-11-23 19:16:58.000000000 +0100
++++ libgcrypt-1.8.3/cipher/md.c	2020-04-17 15:07:31.364945130 +0200
+@@ -409,13 +409,10 @@ md_enable (gcry_md_hd_t hd, int algorith
      }
  
  
 -  if (!err && algorithm == GCRY_MD_MD5 && fips_mode ())
 +  if (!err && !spec->flags.fips && fips_mode ())
      {
+-      _gcry_inactivate_fips_mode ("MD5 used");
        if (_gcry_enforced_fips_mode () )
          {
+-          /* We should never get to here because we do not register
+-             MD5 in enforced fips mode. But better throw an error.  */
+           err = GPG_ERR_DIGEST_ALGO;
+         }
+     }

SOURCES/libgcrypt-1.8.4-fips-keygen.patch

@@ -0,0 +1,65 @@
+diff -up libgcrypt-1.8.4/cipher/dsa.c.fips-keygen libgcrypt-1.8.4/cipher/dsa.c
+--- libgcrypt-1.8.4/cipher/dsa.c.fips-keygen	2017-11-23 19:16:58.000000000 +0100
++++ libgcrypt-1.8.4/cipher/dsa.c	2019-02-12 14:29:25.629513989 +0100
+@@ -457,11 +457,22 @@ generate_fips186 (DSA_secret_key *sk, un
+                                              &prime_q, &prime_p,
+                                              r_counter,
+                                              r_seed, r_seedlen);
+-      else
+-        ec = _gcry_generate_fips186_3_prime (nbits, qbits, NULL, 0,
++      else if (!domain->p || !domain->q)
++        ec = _gcry_generate_fips186_3_prime (nbits, qbits,
++                                             initial_seed.seed,
++                                             initial_seed.seedlen,
+                                              &prime_q, &prime_p,
+                                              r_counter,
+                                              r_seed, r_seedlen, NULL);
++      else
++        {
++          /* Domain parameters p and q are given; use them.  */
++          prime_p = mpi_copy (domain->p);
++          prime_q = mpi_copy (domain->q);
++          gcry_assert (mpi_get_nbits (prime_p) == nbits);
++          gcry_assert (mpi_get_nbits (prime_q) == qbits);
++          ec = 0;
++        }
+       sexp_release (initial_seed.sexp);
+       if (ec)
+         goto leave;
+@@ -855,13 +866,12 @@ dsa_generate (const gcry_sexp_t genparms
+       sexp_release (l1);
+       sexp_release (domainsexp);
+ 
+-      /* Check that all domain parameters are available.  */
+-      if (!domain.p || !domain.q || !domain.g)
++      /* Check that p and q domain parameters are available.  */
++      if (!domain.p || !domain.q || (!domain.g && !(flags & PUBKEY_FLAG_USE_FIPS186)))
+         {
+           _gcry_mpi_release (domain.p);
+           _gcry_mpi_release (domain.q);
+           _gcry_mpi_release (domain.g);
+-          sexp_release (deriveparms);
+           return GPG_ERR_MISSING_VALUE;
+         }
+ 
+diff -up libgcrypt-1.8.4/cipher/rsa.c.fips-keygen libgcrypt-1.8.4/cipher/rsa.c
+--- libgcrypt-1.8.4/cipher/rsa.c.fips-keygen	2017-11-23 19:16:58.000000000 +0100
++++ libgcrypt-1.8.4/cipher/rsa.c	2019-02-12 14:29:25.630513971 +0100
+@@ -389,7 +389,7 @@ generate_fips (RSA_secret_key *sk, unsig
+ 
+   if (nbits < 1024 || (nbits & 0x1FF))
+     return GPG_ERR_INV_VALUE;
+-  if (_gcry_enforced_fips_mode() && nbits != 2048 && nbits != 3072)
++  if (fips_mode() && nbits < 2048)
+       return GPG_ERR_INV_VALUE;
+ 
+   /* The random quality depends on the transient_key flag.  */
+@@ -696,7 +696,7 @@ generate_x931 (RSA_secret_key *sk, unsig
+ 
+   *swapped = 0;
+ 
+-  if (e_value == 1)   /* Alias for a secure value. */
++  if (e_value == 1 || e_value == 0)   /* Alias for a secure value. */
+     e_value = 65537;
+ 
+   /* Point 1 of section 4.1:  k = 1024 + 256s with S >= 0  */

SOURCES/libgcrypt-1.8.4-tests-fipsmode.patch

@@ -0,0 +1,184 @@
+diff -up libgcrypt-1.8.4/tests/basic.c.tests-fipsmode libgcrypt-1.8.4/tests/basic.c
+--- libgcrypt-1.8.4/tests/basic.c.tests-fipsmode	2018-04-17 17:29:40.000000000 +0200
++++ libgcrypt-1.8.4/tests/basic.c	2019-02-12 13:30:48.935791024 +0100
+@@ -6964,7 +6964,7 @@ check_ciphers (void)
+       check_one_cipher (algos[i], GCRY_CIPHER_MODE_CTR, 0);
+       if (gcry_cipher_get_algo_blklen (algos[i]) == GCRY_CCM_BLOCK_LEN)
+         check_one_cipher (algos[i], GCRY_CIPHER_MODE_CCM, 0);
+-      if (gcry_cipher_get_algo_blklen (algos[i]) == GCRY_GCM_BLOCK_LEN)
++      if (!in_fips_mode && gcry_cipher_get_algo_blklen (algos[i]) == GCRY_GCM_BLOCK_LEN)
+         check_one_cipher (algos[i], GCRY_CIPHER_MODE_GCM, 0);
+       if (gcry_cipher_get_algo_blklen (algos[i]) == GCRY_OCB_BLOCK_LEN)
+         check_one_cipher (algos[i], GCRY_CIPHER_MODE_OCB, 0);
+@@ -7010,11 +7010,17 @@ check_cipher_modes(void)
+   check_cfb_cipher ();
+   check_ofb_cipher ();
+   check_ccm_cipher ();
+-  check_gcm_cipher ();
+-  check_poly1305_cipher ();
+-  check_ocb_cipher ();
++  if (!in_fips_mode)
++    {
++      check_gcm_cipher ();
++      check_poly1305_cipher ();
++      check_ocb_cipher ();
++    }
+   check_xts_cipher ();
+-  check_gost28147_cipher ();
++  if (!in_fips_mode)
++    {
++      check_gost28147_cipher ();
++    }
+   check_stream_cipher ();
+   check_stream_cipher_large_block ();
+ 
+@@ -10001,7 +10007,7 @@ check_mac (void)
+           show_mac_not_available (algos[i].algo);
+           continue;
+         }
+-      if (gcry_mac_test_algo (algos[i].algo) && in_fips_mode)
++      if ((algos[i].algo == GCRY_MAC_GMAC_AES || gcry_mac_test_algo (algos[i].algo)) && in_fips_mode)
+         {
+           if (verbose)
+             fprintf (stderr, "  algorithm %d not available in fips mode\n",
+@@ -11095,8 +11101,6 @@ main (int argc, char **argv)
+       /* If we are in fips mode do some more tests. */
+       gcry_md_hd_t md;
+ 
+-      /* First trigger a self-test.  */
+-      xgcry_control (GCRYCTL_FORCE_FIPS_MODE, 0);
+       if (!gcry_control (GCRYCTL_OPERATIONAL_P, 0))
+         fail ("not in operational state after self-test\n");
+ 
+@@ -11121,15 +11125,6 @@ main (int argc, char **argv)
+               gcry_md_close (md);
+               if (gcry_control (GCRYCTL_OPERATIONAL_P, 0))
+                 fail ("expected error state but still in operational state\n");
+-              else
+-                {
+-                  /* Now run a self-test and to get back into
+-                     operational state.  */
+-                  xgcry_control (GCRYCTL_FORCE_FIPS_MODE, 0);
+-                  if (!gcry_control (GCRYCTL_OPERATIONAL_P, 0))
+-                    fail ("did not reach operational after error "
+-                          "and self-test\n");
+-                }
+             }
+         }
+ 
+diff -up libgcrypt-1.8.4/tests/benchmark.c.tests-fipsmode libgcrypt-1.8.4/tests/benchmark.c
+--- libgcrypt-1.8.4/tests/benchmark.c.tests-fipsmode	2019-02-12 11:31:44.859603883 +0100
++++ libgcrypt-1.8.4/tests/benchmark.c	2019-02-12 14:10:40.271999352 +0100
+@@ -872,8 +872,10 @@ cipher_bench ( const char *algoname )
+           || (blklen == 1 && modes[modeidx].mode != GCRY_CIPHER_MODE_STREAM))
+         continue;
+ 
+-      if (modes[modeidx].req_blocksize > 0
+-          && blklen != modes[modeidx].req_blocksize)
++      if ((modes[modeidx].req_blocksize > 0
++           && blklen != modes[modeidx].req_blocksize)
++          || (in_fips_mode 
++           && modes[modeidx].mode == GCRY_CIPHER_MODE_GCM))
+         {
+           printf (" %7s %7s", "-", "-" );
+           continue;
+diff -up libgcrypt-1.8.4/tests/bench-slope.c.tests-fipsmode libgcrypt-1.8.4/tests/bench-slope.c
+--- libgcrypt-1.8.4/tests/bench-slope.c.tests-fipsmode	2017-11-23 19:16:58.000000000 +0100
++++ libgcrypt-1.8.4/tests/bench-slope.c	2019-02-12 14:14:33.618763325 +0100
+@@ -1338,7 +1338,7 @@ cipher_bench_one (int algo, struct bench
+     return;
+ 
+   /* GCM has restrictions for block-size */
+-  if (mode.mode == GCRY_CIPHER_MODE_GCM && blklen != GCRY_GCM_BLOCK_LEN)
++  if (mode.mode == GCRY_CIPHER_MODE_GCM && (gcry_fips_mode_active () || blklen != GCRY_GCM_BLOCK_LEN))
+     return;
+ 
+   /* XTS has restrictions for block-size */
+diff -up libgcrypt-1.8.4/tests/pubkey.c.tests-fipsmode libgcrypt-1.8.4/tests/pubkey.c
+--- libgcrypt-1.8.4/tests/pubkey.c.tests-fipsmode	2017-11-23 19:16:58.000000000 +0100
++++ libgcrypt-1.8.4/tests/pubkey.c	2019-02-12 13:52:25.658746415 +0100
+@@ -504,15 +504,30 @@ get_dsa_key_with_domain_new (gcry_sexp_t
+   rc = gcry_sexp_new
+     (&key_spec,
+      "(genkey (dsa (transient-key)(domain"
+-     "(p #d3aed1876054db831d0c1348fbb1ada72507e5fbf9a62cbd47a63aeb7859d6921"
+-     "4adeb9146a6ec3f43520f0fd8e3125dd8bbc5d87405d1ac5f82073cd762a3f8d7"
+-     "74322657c9da88a7d2f0e1a9ceb84a39cb40876179e6a76e400498de4bb9379b0"
+-     "5f5feb7b91eb8fea97ee17a955a0a8a37587a272c4719d6feb6b54ba4ab69#)"
+-     "(q #9c916d121de9a03f71fb21bc2e1c0d116f065a4f#)"
+-     "(g #8157c5f68ca40b3ded11c353327ab9b8af3e186dd2e8dade98761a0996dda99ab"
+-     "0250d3409063ad99efae48b10c6ab2bba3ea9a67b12b911a372a2bba260176fad"
+-     "b4b93247d9712aad13aa70216c55da9858f7a298deb670a403eb1e7c91b847f1e"
+-     "ccfbd14bd806fd42cf45dbb69cd6d6b43add2a78f7d16928eaa04458dea44#)"
++     " (p #a85378d8fd3f8d72ec7418080da21317e43ec4b62ba8c862"
++     "     3b7e4d04441dd1a0658662596493ca8e9e8fbb7e34aaddb6"
++     "     2e5d67b6d09a6e61b769e7c352aa2b10e20ca0636963b552"
++     "     3e86470decbbeda027e797e7b67635d4d49c30700e74af8a"
++     "     0ff156a801af57a26e7078f1d82f74908ecb6d07e70b3503"
++     "     eed94fa32cf17a7fc3d6cf40dc7b00830e6a2566dc073e34"
++     "     3312517c6aa5152b4bfecd2e551fee346318a153423c996b"
++     "     0d5dcb9102aedd38798616f1f1e0d6c403525b1f9b3d4dc7"
++     "     66de2dfc4a56d7b8ba5963d60f3e16318870ad436952e557"
++     "     65374eab85e8ec17d6b9a4547b9b5f2752f3105be809b23a"
++     "     2c8d7469db02e24d592394a7dba069e9#)"
++     " (q #d277044e50f5a4e3f510a50a0b84fdffbca047ed27602056"
++     "     7441a0a5#)"
++     " (g #13d754e21fd241655da891c522a65a72a89bdc64ec9b54a8"
++     "     21ed4a898b490e0c4fcb72192a4a20f541f3f2925399f0ba"
++     "     ecf929aafbf79dfe4332393b32cd2e2fcf272f32a627434a"
++     "     0df242b75b414df372121e53a553f222f836b000f016485b"
++     "     6bd0898451801dcd8de64cd5365696ffc532d528c506620a"
++     "     942a0305046d8f1876341f1e570bc3974ba6b9a438e97023"
++     "     02a2e6e67bfd06d32bc679962271d7b40cd72f386e64e0d7"
++     "     ef86ca8ca5d14228dc2a4f16e3189886b5990674f4200f3a"
++     "     4cf65a3f0ddba1fa672dff2f5e143d10e4e97ae84f6da095"
++     "     35d5b9df259181a79b63b069e949972b02ba36b3586aab7e"
++     "     45f322f82e4e85ca3ab85591b3c2a966#)"
+      ")))", 0, 1);
+   if (rc)
+     die ("error creating S-expression: %s\n", gcry_strerror (rc));
+@@ -595,7 +610,7 @@ get_dsa_key_fips186_with_seed_new (gcry_
+      "    (use-fips186)"
+      "    (transient-key)"
+      "    (derive-parms"
+-     "      (seed #0cb1990c1fd3626055d7a0096f8fa99807399871#))))",
++     "      (seed #8b4c4d671fff82e8ed932260206d0571e3a1c2cee8cd94cb73fe58f9b67488fa#))))",
+      0, 1);
+   if (rc)
+     die ("error creating S-expression: %s\n", gcry_strerror (rc));
+diff -up libgcrypt-1.8.4/tests/t-cv25519.c.tests-fipsmode libgcrypt-1.8.4/tests/t-cv25519.c
+--- libgcrypt-1.8.4/tests/t-cv25519.c.tests-fipsmode	2017-11-23 19:16:58.000000000 +0100
++++ libgcrypt-1.8.4/tests/t-cv25519.c	2019-02-12 14:02:35.935705390 +0100
+@@ -560,6 +560,9 @@ main (int argc, char **argv)
+     xgcry_control (GCRYCTL_SET_DEBUG_FLAGS, 1u , 0);
+   xgcry_control (GCRYCTL_ENABLE_QUICK_RANDOM, 0);
+   xgcry_control (GCRYCTL_INITIALIZATION_FINISHED, 0);
++  /* Curve25519 isn't supported in fips mode */
++  if (gcry_fips_mode_active())
++    return 77;
+ 
+   start_timer ();
+   check_cv25519 ();
+diff -up libgcrypt-1.8.4/tests/t-secmem.c.tests-fipsmode libgcrypt-1.8.4/tests/t-secmem.c
+--- libgcrypt-1.8.4/tests/t-secmem.c.tests-fipsmode	2017-11-23 19:19:54.000000000 +0100
++++ libgcrypt-1.8.4/tests/t-secmem.c	2019-02-12 11:51:02.462190538 +0100
+@@ -174,7 +174,8 @@ main (int argc, char **argv)
+     xgcry_control (GCRYCTL_SET_DEBUG_FLAGS, 1u , 0);
+   xgcry_control (GCRYCTL_ENABLE_QUICK_RANDOM, 0);
+   xgcry_control (GCRYCTL_INIT_SECMEM, pool_size, 0);
+-  gcry_set_outofcore_handler (outofcore_handler, NULL);
++  if (!gcry_fips_mode_active ())
++    gcry_set_outofcore_handler (outofcore_handler, NULL);
+   xgcry_control (GCRYCTL_INITIALIZATION_FINISHED, 0);
+ 
+   /* Libgcrypt prints a warning when the first overflow is allocated;
+@@ -184,7 +185,8 @@ main (int argc, char **argv)
+ 
+ 
+   test_secmem ();
+-  test_secmem_overflow ();
++  if (!gcry_fips_mode_active ())
++    test_secmem_overflow ();
+   /* FIXME: We need to improve the tests, for example by registering
+    * our own log handler and comparing the output of
+    * PRIV_CTL_DUMP_SECMEM_STATS to expected pattern.  */

SOURCES/libgcrypt-1.8.4-use-poll.patch

@@ -1,6 +1,6 @@
-diff -up libgcrypt-1.8.0/random/rndlinux.c.use-poll libgcrypt-1.8.0/random/rndlinux.c
---- libgcrypt-1.8.0/random/rndlinux.c.use-poll	2017-06-24 13:34:29.000000000 +0200
-+++ libgcrypt-1.8.0/random/rndlinux.c	2017-08-15 15:37:37.604629377 +0200
+diff -up libgcrypt-1.8.4/random/rndlinux.c.use-poll libgcrypt-1.8.4/random/rndlinux.c
+--- libgcrypt-1.8.4/random/rndlinux.c.use-poll	2018-10-26 13:50:20.000000000 +0200
++++ libgcrypt-1.8.4/random/rndlinux.c	2018-11-20 15:51:56.760669058 +0100
 @@ -32,6 +32,7 @@
  #include <string.h>
  #include <unistd.h>
@@ -9,7 +9,7 @@ diff -up libgcrypt-1.8.0/random/rndlinux.c.use-poll libgcrypt-1.8.0/random/rndli
  #if defined(__linux__) && defined(HAVE_SYSCALL)
  # include <sys/syscall.h>
  #endif
-@@ -216,9 +217,8 @@ _gcry_rndlinux_gather_random (void (*add
+@@ -241,9 +242,8 @@ _gcry_rndlinux_gather_random (void (*add
                   return with something we will actually use 100ms. */
    while (length)
      {
@@ -18,9 +18,9 @@ diff -up libgcrypt-1.8.0/random/rndlinux.c.use-poll libgcrypt-1.8.0/random/rndli
        int rc;
 +      struct pollfd pfd;
  
-       /* If we have a modern Linux kernel and we want to read from the
-        * the non-blocking /dev/urandom, we first try to use the new
-@@ -276,36 +276,25 @@ _gcry_rndlinux_gather_random (void (*add
+       /* If we have a modern Linux kernel, we first try to use the new
+        * getrandom syscall.  That call guarantees that the kernel's
+@@ -300,36 +300,25 @@ _gcry_rndlinux_gather_random (void (*add
            any_need_entropy = 1;
          }
  

SOURCES/libgcrypt-1.8.5-build.patch

@@ -0,0 +1,14 @@
+diff -up libgcrypt-1.8.5/cipher/poly1305-armv7-neon.S.build libgcrypt-1.8.5/cipher/poly1305-armv7-neon.S
+--- libgcrypt-1.8.5/cipher/poly1305-armv7-neon.S.build	2017-11-23 19:16:58.000000000 +0100
++++ libgcrypt-1.8.5/cipher/poly1305-armv7-neon.S	2020-01-30 17:26:12.026404286 +0100
+@@ -87,9 +87,8 @@ _gcry_poly1305_armv7_neon_init_ext:
+ .Lpoly1305_init_ext_neon_local:
+ 	stmfd sp!, {r4-r11, lr}
+ 	sub sp, sp, #32
+-	mov r14, r2
++	mov r14, #-1
+ 	and r2, r2, r2
+-	moveq r14, #-1
+ 	UNALIGNED_LDMIA4(r1, r2, r3, r4, r5)
+ 	GET_DATA_POINTER(r7,.Lpoly1305_init_constants_neon,r8)
+ 	mov r6, r2

SOURCES/libgcrypt-1.8.5-elgamal-blinding.patch

@@ -0,0 +1,67 @@
+commit e8b7f10be275bcedb5fc05ed4837a89bfd605c61
+Author: NIIBE Yutaka <gniibe@fsij.org>
+Date:   Tue Apr 13 10:00:00 2021 +0900
+
+    cipher: Hardening ElGamal by introducing exponent blinding too.
+    
+    * cipher/elgamal.c (do_encrypt): Also do exponent blinding.
+    
+    --
+    
+    Base blinding had been introduced with USE_BLINDING.  This patch add
+    exponent blinding as well to mitigate side-channel attack on mpi_powm.
+    
+    GnuPG-bug-id: 5328
+    Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
+
+diff --git a/cipher/elgamal.c b/cipher/elgamal.c
+index 4eb52d62..9835122f 100644
+--- a/cipher/elgamal.c
++++ b/cipher/elgamal.c
+@@ -522,8 +522,9 @@ do_encrypt(gcry_mpi_t a, gcry_mpi_t b, gcry_mpi_t input, ELG_public_key *pkey )
+ static void
+ decrypt (gcry_mpi_t output, gcry_mpi_t a, gcry_mpi_t b, ELG_secret_key *skey )
+ {
+-  gcry_mpi_t t1, t2, r;
++  gcry_mpi_t t1, t2, r, r1, h;
+   unsigned int nbits = mpi_get_nbits (skey->p);
++  gcry_mpi_t x_blind;
+ 
+   mpi_normalize (a);
+   mpi_normalize (b);
+@@ -534,20 +535,33 @@ decrypt (gcry_mpi_t output, gcry_mpi_t a, gcry_mpi_t b, ELG_secret_key *skey )
+ 
+   t2 = mpi_snew (nbits);
+   r  = mpi_new (nbits);
++  r1 = mpi_new (nbits);
++  h  = mpi_new (nbits);
++  x_blind = mpi_snew (nbits);
+ 
+   /* We need a random number of about the prime size.  The random
+      number merely needs to be unpredictable; thus we use level 0.  */
+   _gcry_mpi_randomize (r, nbits, GCRY_WEAK_RANDOM);
+ 
++  /* Also, exponent blinding: x_blind = x + (p-1)*r1 */
++  _gcry_mpi_randomize (r1, nbits, GCRY_WEAK_RANDOM);
++  mpi_set_highbit (r1, nbits - 1);
++  mpi_sub_ui (h, skey->p, 1);
++  mpi_mul (x_blind, h, r1);
++  mpi_add (x_blind, skey->x, x_blind);
++
+   /* t1 = r^x mod p */
+-  mpi_powm (t1, r, skey->x, skey->p);
++  mpi_powm (t1, r, x_blind, skey->p);
+   /* t2 = (a * r)^-x mod p */
+   mpi_mulm (t2, a, r, skey->p);
+-  mpi_powm (t2, t2, skey->x, skey->p);
++  mpi_powm (t2, t2, x_blind, skey->p);
+   mpi_invm (t2, t2, skey->p);
+   /* t1 = (t1 * t2) mod p*/
+   mpi_mulm (t1, t1, t2, skey->p);
+ 
++  mpi_free (x_blind);
++  mpi_free (h);
++  mpi_free (r1);
+   mpi_free (r);
+   mpi_free (t2);
+ 

SOURCES/libgcrypt-1.8.5-fips-hwfeatures.patch

@@ -0,0 +1,13 @@
+diff -up libgcrypt-1.8.5/src/hwfeatures.c.hw-fips libgcrypt-1.8.5/src/hwfeatures.c
+--- libgcrypt-1.8.5/src/hwfeatures.c.hw-fips	2021-06-25 11:55:55.843819137 +0200
++++ libgcrypt-1.8.5/src/hwfeatures.c	2021-06-25 11:56:00.925895390 +0200
+@@ -205,9 +205,6 @@ _gcry_detect_hw_features (void)
+ {
+   hw_features = 0;
+ 
+-  if (fips_mode ())
+-    return; /* Hardware support is not to be evaluated.  */
+-
+   parse_hwf_deny_file ();
+ 
+ #if defined (HAVE_CPU_ARCH_X86)

SOURCES/libgcrypt-1.8.5-fips-module.patch

@@ -0,0 +1,139 @@
+diff -up libgcrypt-1.8.5/src/fips.c.fips-module libgcrypt-1.8.5/src/fips.c
+--- libgcrypt-1.8.5/src/fips.c.fips-module	2020-04-20 19:07:45.924919645 +0200
++++ libgcrypt-1.8.5/src/fips.c	2020-04-20 19:10:33.690722470 +0200
+@@ -35,10 +35,6 @@
+ #include "hmac256.h"
+ 
+ 
+-/* The name of the file used to force libgcrypt into fips mode. */
+-#define FIPS_FORCE_FILE "/etc/gcrypt/fips_enabled"
+-
+-
+ /* The states of the finite state machine used in fips mode.  */
+ enum module_states
+   {
+@@ -122,54 +118,6 @@ _gcry_initialize_fips_mode (int force)
+       goto leave;
+     }
+ 
+-  /* For testing the system it is useful to override the system
+-     provided detection of the FIPS mode and force FIPS mode using a
+-     file.  The filename is hardwired so that there won't be any
+-     confusion on whether /etc/gcrypt/ or /usr/local/etc/gcrypt/ is
+-     actually used.  The file itself may be empty.  */
+-  if ( !access (FIPS_FORCE_FILE, F_OK) )
+-    {
+-      gcry_assert (!no_fips_mode_required);
+-      goto leave;
+-    }
+-
+-  /* Checking based on /proc file properties.  */
+-  {
+-    static const char procfname[] = "/proc/sys/crypto/fips_enabled";
+-    FILE *fp;
+-    int saved_errno;
+-
+-    fp = fopen (procfname, "r");
+-    if (fp)
+-      {
+-        char line[256];
+-
+-        if (fgets (line, sizeof line, fp) && atoi (line))
+-          {
+-            /* System is in fips mode.  */
+-            fclose (fp);
+-            gcry_assert (!no_fips_mode_required);
+-            goto leave;
+-          }
+-        fclose (fp);
+-      }
+-    else if ((saved_errno = errno) != ENOENT
+-             && saved_errno != EACCES
+-             && !access ("/proc/version", F_OK) )
+-      {
+-        /* Problem reading the fips file despite that we have the proc
+-           file system.  We better stop right away. */
+-        log_info ("FATAL: error reading `%s' in libgcrypt: %s\n",
+-                  procfname, strerror (saved_errno));
+-#ifdef HAVE_SYSLOG
+-        syslog (LOG_USER|LOG_ERR, "Libgcrypt error: "
+-                "reading `%s' failed: %s - abort",
+-                procfname, strerror (saved_errno));
+-#endif /*HAVE_SYSLOG*/
+-        abort ();
+-      }
+-  }
+-
+   /* Fips not not requested, set flag.  */
+   no_fips_mode_required = 1;
+ 
+diff -up libgcrypt-1.8.5/src/g10lib.h.fips-module libgcrypt-1.8.5/src/g10lib.h
+--- libgcrypt-1.8.5/src/g10lib.h.fips-module	2020-04-20 19:07:45.918919759 +0200
++++ libgcrypt-1.8.5/src/g10lib.h	2020-04-20 19:11:05.003125740 +0200
+@@ -422,6 +422,9 @@ gpg_err_code_t _gcry_sexp_vextract_param
+ 
+ /*-- fips.c --*/
+ 
++/* The name of the file used to force libgcrypt into fips mode. */
++#define FIPS_FORCE_FILE "/etc/gcrypt/fips_enabled"
++
+ void _gcry_initialize_fips_mode (int force);
+ 
+ int _gcry_fips_mode (void);
+diff -up libgcrypt-1.8.5/src/global.c.fips-module libgcrypt-1.8.5/src/global.c
+--- libgcrypt-1.8.5/src/global.c.fips-module	2020-04-20 19:07:45.919919741 +0200
++++ libgcrypt-1.8.5/src/global.c	2020-04-20 19:07:45.950919149 +0200
+@@ -160,6 +160,53 @@ void __attribute__ ((constructor)) _gcry
+   rv = access (FIPS_MODULE_PATH, F_OK);
+   if (rv < 0 && errno != ENOENT)
+     rv = 0;
++ 
++  /* For testing the system it is useful to override the system
++     provided detection of the FIPS mode and force FIPS mode using a
++     file.  The filename is hardwired so that there won't be any
++     confusion on whether /etc/gcrypt/ or /usr/local/etc/gcrypt/ is
++     actually used.  The file itself may be empty.  */
++  if ( !access (FIPS_FORCE_FILE, F_OK) )
++    {
++      rv = 0;
++      force_fips_mode = 1;
++    }
++
++  /* Checking based on /proc file properties.  */
++  {
++    static const char procfname[] = "/proc/sys/crypto/fips_enabled";
++    FILE *fp;
++    int saved_errno;
++
++    fp = fopen (procfname, "r");
++    if (fp)
++      {
++        char line[256];
++
++        if (fgets (line, sizeof line, fp) && atoi (line))
++          {
++            /* System is in fips mode.  */
++            rv = 0;
++            force_fips_mode = 1;
++          }
++        fclose (fp);
++      }
++    else if ((saved_errno = errno) != ENOENT
++             && saved_errno != EACCES
++             && !access ("/proc/version", F_OK) )
++      {
++        /* Problem reading the fips file despite that we have the proc
++           file system.  We better stop right away. */
++        log_info ("FATAL: error reading `%s' in libgcrypt: %s\n",
++                  procfname, strerror (saved_errno));
++#ifdef HAVE_SYSLOG
++        syslog (LOG_USER|LOG_ERR, "Libgcrypt error: "
++                "reading `%s' failed: %s - abort",
++                procfname, strerror (saved_errno));
++#endif /*HAVE_SYSLOG*/
++        abort ();
++      }
++  }
+ 
+   if (!rv)
+     {

SOURCES/libgcrypt-1.8.5-getrandom.patch

@@ -0,0 +1,285 @@
+diff -up libgcrypt-1.8.5/random/rand-internal.h.getrandom libgcrypt-1.8.5/random/rand-internal.h
+--- libgcrypt-1.8.5/random/rand-internal.h.getrandom	2017-11-23 19:16:58.000000000 +0100
++++ libgcrypt-1.8.5/random/rand-internal.h	2020-04-20 14:55:34.875949624 +0200
+@@ -47,6 +47,7 @@ void _gcry_random_progress (const char *
+ 
+ /*-- random-csprng.c --*/
+ void _gcry_rngcsprng_initialize (int full);
++void _gcry_rngcsprng_deinit (void);
+ void _gcry_rngcsprng_close_fds (void);
+ void _gcry_rngcsprng_dump_stats (void);
+ void _gcry_rngcsprng_secure_alloc (void);
+@@ -68,6 +69,7 @@ void _gcry_rngcsprng_fast_poll (void);
+ 
+ /*-- random-drbg.c --*/
+ void _gcry_rngdrbg_inititialize (int full);
++void _gcry_rngdrbg_deinit (void);
+ void _gcry_rngdrbg_close_fds (void);
+ void _gcry_rngdrbg_dump_stats (void);
+ int  _gcry_rngdrbg_is_faked (void);
+diff -up libgcrypt-1.8.5/random/random.c.getrandom libgcrypt-1.8.5/random/random.c
+--- libgcrypt-1.8.5/random/random.c.getrandom	2017-11-23 19:16:58.000000000 +0100
++++ libgcrypt-1.8.5/random/random.c	2020-04-20 14:55:34.876949605 +0200
+@@ -110,8 +110,8 @@ _gcry_random_read_conf (void)
+   unsigned int result = 0;
+ 
+   fp = fopen (fname, "r");
+-  if (!fp)
+-    return result;
++  if (!fp) /* We make only_urandom the default. */
++    return RANDOM_CONF_ONLY_URANDOM;
+ 
+   for (;;)
+     {
+@@ -228,6 +228,22 @@ _gcry_random_initialize (int full)
+ }
+ 
+ 
++/* Deinitialize this random subsystem. */
++void
++_gcry_random_deinit (void)
++{
++  if (fips_mode ())
++    _gcry_rngdrbg_deinit ();
++  else if (rng_types.standard)
++    _gcry_rngcsprng_deinit ();
++  else if (rng_types.fips)
++    _gcry_rngdrbg_deinit ();
++  else
++    _gcry_rngcsprng_deinit ();
++  /* not needed for system */
++}
++
++
+ /* If possible close file descriptors used by the RNG. */
+ void
+ _gcry_random_close_fds (void)
+diff -up libgcrypt-1.8.5/random/random-csprng.c.getrandom libgcrypt-1.8.5/random/random-csprng.c
+--- libgcrypt-1.8.5/random/random-csprng.c.getrandom	2017-11-23 19:16:58.000000000 +0100
++++ libgcrypt-1.8.5/random/random-csprng.c	2020-04-20 15:04:27.182877975 +0200
+@@ -55,6 +55,10 @@
+ #ifdef __MINGW32__
+ #include <process.h>
+ #endif
++#if defined(__linux__) && defined(HAVE_SYSCALL)
++# include <sys/syscall.h>
++# include <linux/random.h>
++#endif
+ #include "g10lib.h"
+ #include "random.h"
+ #include "rand-internal.h"
+@@ -343,6 +347,21 @@ _gcry_rngcsprng_initialize (int full)
+ }
+ 
+ 
++void
++_gcry_rngcsprng_deinit (void)
++{
++  lock_pool();
++  pool_writepos = 0;
++  pool_readpos = 0;
++  pool_filled = 0;
++  pool_filled_counter = 0;
++  did_initial_extra_seeding = 0;
++  pool_balance = 0;
++  just_mixed = 0;
++  unlock_pool();
++}
++
++
+ /* Try to close the FDs of the random gather module.  This is
+    currently only implemented for rndlinux. */
+ void
+@@ -1116,6 +1135,22 @@ getfnc_gather_random (void))(void (*)(co
+              enum random_origins, size_t, int);
+ 
+ #if USE_RNDLINUX
++#if defined(__linux__) && defined(HAVE_SYSCALL) && defined(__NR_getrandom)
++  long ret;
++  char buffer[1];
++
++  _gcry_pre_syscall ();
++  ret = syscall (__NR_getrandom,
++                 (void*)buffer, (size_t)1, (unsigned int)GRND_NONBLOCK);
++  _gcry_post_syscall ();
++  if (ret != -1 || errno != ENOSYS)
++    {
++      fnc = _gcry_rndlinux_gather_random;
++      return fnc;
++    }
++  else
++          /* The syscall is not supported - fallback to /dev/urandom. */
++#endif
+   if ( !access (NAME_OF_DEV_RANDOM, R_OK)
+        && !access (NAME_OF_DEV_URANDOM, R_OK))
+     {
+diff -up libgcrypt-1.8.5/random/random-drbg.c.getrandom libgcrypt-1.8.5/random/random-drbg.c
+--- libgcrypt-1.8.5/random/random-drbg.c.getrandom	2017-11-23 19:16:58.000000000 +0100
++++ libgcrypt-1.8.5/random/random-drbg.c	2020-04-20 15:02:37.782947902 +0200
+@@ -1811,6 +1811,22 @@ _gcry_rngdrbg_inititialize (int full)
+ }
+ 
+ /*
++ * Deinitialize the DRBG invoked by the libgcrypt API
++ * It will be automatically re-initialized on next call
++ */
++void
++_gcry_rngdrbg_deinit (void)
++{
++  drbg_lock ();
++  if (drbg_state)
++    {
++      drbg_uninstantiate (drbg_state);
++      drbg_state = NULL;
++    }
++  drbg_unlock ();
++}
++
++/*
+  * Backend handler function for GCRYCTL_DRBG_REINIT
+  *
+  * Select a different DRBG type and initialize it.
+diff -up libgcrypt-1.8.5/random/random.h.getrandom libgcrypt-1.8.5/random/random.h
+--- libgcrypt-1.8.5/random/random.h.getrandom	2017-11-23 19:16:58.000000000 +0100
++++ libgcrypt-1.8.5/random/random.h	2020-04-20 14:55:34.877949586 +0200
+@@ -29,6 +29,7 @@ void _gcry_register_random_progress (voi
+ 
+ void _gcry_set_preferred_rng_type (int type);
+ void _gcry_random_initialize (int full);
++void _gcry_random_deinit (void);
+ void _gcry_random_close_fds (void);
+ int  _gcry_get_rng_type (int ignore_fips_mode);
+ void _gcry_random_dump_stats(void);
+diff -up libgcrypt-1.8.5/random/rndlinux.c.getrandom libgcrypt-1.8.5/random/rndlinux.c
+--- libgcrypt-1.8.5/random/rndlinux.c.getrandom	2020-04-20 15:01:50.159848963 +0200
++++ libgcrypt-1.8.5/random/rndlinux.c	2020-04-20 16:14:21.901610921 +0200
+@@ -35,6 +35,7 @@
+ #include <poll.h>
+ #if defined(__linux__) && defined(HAVE_SYSCALL)
+ # include <sys/syscall.h>
++# include <linux/random.h>
+ #endif
+ 
+ #include "types.h"
+@@ -147,12 +148,12 @@ _gcry_rndlinux_gather_random (void (*add
+   if (!add)
+     {
+       /* Special mode to close the descriptors.  */
+-      if (fd_random != -1)
++      if (fd_random >= 0)
+         {
+           close (fd_random);
+           fd_random = -1;
+         }
+-      if (fd_urandom != -1)
++      if (fd_urandom >= 0)
+         {
+           close (fd_urandom);
+           fd_urandom = -1;
+@@ -166,12 +167,12 @@ _gcry_rndlinux_gather_random (void (*add
+   apid = getpid ();
+   if (my_pid != apid)
+     {
+-      if (fd_random != -1)
++      if (fd_random >= 0)
+         {
+           close (fd_random);
+           fd_random = -1;
+         }
+-      if (fd_urandom != -1)
++      if (fd_urandom >= 0)
+         {
+           close (fd_urandom);
+           fd_urandom = -1;
+@@ -216,7 +217,23 @@ _gcry_rndlinux_gather_random (void (*add
+      that we always require the device to be existent but want a more
+      graceful behaviour if the rarely needed close operation has been
+      used and the device needs to be re-opened later. */
+-  if (level >= GCRY_VERY_STRONG_RANDOM && !only_urandom)
++#if defined(__linux__) && defined(HAVE_SYSCALL) && defined(__NR_getrandom)
++   if (fd_urandom != -2 && !_gcry_in_constructor ())
++     {
++       long ret;
++
++       _gcry_pre_syscall ();
++       ret = syscall (__NR_getrandom,
++                      (void*)buffer, (size_t)1, (unsigned int)GRND_NONBLOCK);
++       _gcry_post_syscall ();
++       if (ret > -1 || errno == EAGAIN || errno == EINTR)
++         {
++           fd_urandom = -2;
++           fd_random = -2;
++         }
++     }
++#endif
++  if (level >= GCRY_VERY_STRONG_RANDOM && !only_urandom && !_gcry_in_constructor ())
+     {
+       if (fd_random == -1)
+         {
+@@ -255,6 +272,7 @@ _gcry_rndlinux_gather_random (void (*add
+        * syscall and not a new device and thus we are not able to use
+        * select(2) to have a timeout. */
+ #if defined(__linux__) && defined(HAVE_SYSCALL) && defined(__NR_getrandom)
++      if (fd == -2)
+         {
+           long ret;
+           size_t nbytes;
+@@ -270,9 +288,7 @@ _gcry_rndlinux_gather_random (void (*add
+               _gcry_post_syscall ();
+             }
+           while (ret == -1 && errno == EINTR);
+-          if (ret == -1 && errno == ENOSYS)
+-            ; /* The syscall is not supported - fallback to pulling from fd.  */
+-          else
++          if (1)
+             { /* The syscall is supported.  Some sanity checks.  */
+               if (ret == -1)
+                 log_fatal ("unexpected error from getrandom: %s\n",
+diff -up libgcrypt-1.8.5/src/g10lib.h.getrandom libgcrypt-1.8.5/src/g10lib.h
+--- libgcrypt-1.8.5/src/g10lib.h.getrandom	2020-04-20 15:08:16.528538580 +0200
++++ libgcrypt-1.8.5/src/g10lib.h	2020-04-20 15:08:28.641309399 +0200
+@@ -464,6 +464,6 @@ gpg_err_code_t _gcry_fips_run_selftests
+ void _gcry_fips_noreturn (void);
+ #define fips_noreturn()  (_gcry_fips_noreturn ())
+ 
+-
++int _gcry_in_constructor (void);
+ 
+ #endif /* G10LIB_H */
+diff -up libgcrypt-1.8.5/src/global.c.getrandom libgcrypt-1.8.5/src/global.c
+--- libgcrypt-1.8.5/src/global.c.getrandom	2020-04-20 15:06:21.891707597 +0200
++++ libgcrypt-1.8.5/src/global.c	2020-04-20 15:07:29.018437509 +0200
+@@ -145,10 +145,18 @@ global_init (void)
+ #define FIPS_MODULE_PATH "/etc/system-fips"
+ #endif
+ 
++static int in_constructor = 0;
++
++int _gcry_in_constructor(void)
++{
++  return in_constructor;
++}
++
+ void __attribute__ ((constructor)) _gcry_global_constructor (void)
+ {
+   int rv;
+ 
++  in_constructor = 1;
+   rv = access (FIPS_MODULE_PATH, F_OK);
+   if (rv < 0 && errno != ENOENT)
+     rv = 0;
+@@ -163,10 +171,12 @@ void __attribute__ ((constructor)) _gcry
+       /* force selftests */
+       global_init();
+       _gcry_fips_run_selftests (0);
+-      if (!fips_mode())
+-         _gcry_random_close_fds ();
++      _gcry_random_close_fds ();
++      _gcry_random_deinit ();
+       no_secure_memory = no_secmem_save;
+     }
++
++  in_constructor = 0;
+ }
+ 
+ /* This function is called by the macro fips_is_operational and makes

SOURCES/libgcrypt-1.8.5-intel-cet.patch

@@ -0,0 +1,348 @@
+diff -up libgcrypt-1.8.5/cipher/camellia-aesni-avx2-amd64.S.intel-cet libgcrypt-1.8.5/cipher/camellia-aesni-avx2-amd64.S
+--- libgcrypt-1.8.5/cipher/camellia-aesni-avx2-amd64.S.intel-cet	2017-11-23 19:16:58.000000000 +0100
++++ libgcrypt-1.8.5/cipher/camellia-aesni-avx2-amd64.S	2020-01-23 15:36:44.148972045 +0100
+@@ -18,8 +18,9 @@
+  * License along with this program; if not, see <http://www.gnu.org/licenses/>.
+  */
+ 
+-#ifdef __x86_64
+ #include <config.h>
++
++#ifdef __x86_64
+ #if (defined(HAVE_COMPATIBLE_GCC_AMD64_PLATFORM_AS) || \
+      defined(HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS)) && \
+     defined(ENABLE_AESNI_SUPPORT) && defined(ENABLE_AVX2_SUPPORT)
+diff -up libgcrypt-1.8.5/cipher/camellia-aesni-avx-amd64.S.intel-cet libgcrypt-1.8.5/cipher/camellia-aesni-avx-amd64.S
+--- libgcrypt-1.8.5/cipher/camellia-aesni-avx-amd64.S.intel-cet	2017-11-23 19:16:58.000000000 +0100
++++ libgcrypt-1.8.5/cipher/camellia-aesni-avx-amd64.S	2020-01-23 15:36:44.145972088 +0100
+@@ -18,8 +18,9 @@
+  * License along with this program; if not, see <http://www.gnu.org/licenses/>.
+  */
+ 
+-#ifdef __x86_64
+ #include <config.h>
++
++#ifdef __x86_64
+ #if (defined(HAVE_COMPATIBLE_GCC_AMD64_PLATFORM_AS) || \
+      defined(HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS)) && \
+     defined(ENABLE_AESNI_SUPPORT) && defined(ENABLE_AVX_SUPPORT)
+diff -up libgcrypt-1.8.5/cipher/chacha20-avx2-amd64.S.intel-cet libgcrypt-1.8.5/cipher/chacha20-avx2-amd64.S
+--- libgcrypt-1.8.5/cipher/chacha20-avx2-amd64.S.intel-cet	2017-11-23 19:16:58.000000000 +0100
++++ libgcrypt-1.8.5/cipher/chacha20-avx2-amd64.S	2020-01-23 15:36:16.780250066 +0100
+@@ -48,6 +48,9 @@
+ .globl _gcry_chacha20_amd64_avx2_blocks
+ ELF(.type  _gcry_chacha20_amd64_avx2_blocks,@function;)
+ _gcry_chacha20_amd64_avx2_blocks:
++#ifdef _CET_ENDBR
++	_CET_ENDBR
++#endif
+ .Lchacha_blocks_avx2_local:
+ 	vzeroupper
+ 	pushq %rbx
+diff -up libgcrypt-1.8.5/cipher/chacha20-sse2-amd64.S.intel-cet libgcrypt-1.8.5/cipher/chacha20-sse2-amd64.S
+--- libgcrypt-1.8.5/cipher/chacha20-sse2-amd64.S.intel-cet	2017-11-23 19:16:58.000000000 +0100
++++ libgcrypt-1.8.5/cipher/chacha20-sse2-amd64.S	2020-01-23 15:36:16.783250095 +0100
+@@ -41,6 +41,9 @@
+ .globl _gcry_chacha20_amd64_sse2_blocks
+ ELF(.type  _gcry_chacha20_amd64_sse2_blocks,@function;)
+ _gcry_chacha20_amd64_sse2_blocks:
++#ifdef _CET_ENDBR
++	_CET_ENDBR
++#endif
+ .Lchacha_blocks_sse2_local:
+ 	pushq %rbx
+ 	pushq %rbp
+diff -up libgcrypt-1.8.5/cipher/poly1305-avx2-amd64.S.intel-cet libgcrypt-1.8.5/cipher/poly1305-avx2-amd64.S
+--- libgcrypt-1.8.5/cipher/poly1305-avx2-amd64.S.intel-cet	2017-11-23 19:16:58.000000000 +0100
++++ libgcrypt-1.8.5/cipher/poly1305-avx2-amd64.S	2020-01-23 15:36:16.784250105 +0100
+@@ -43,6 +43,9 @@
+ .globl _gcry_poly1305_amd64_avx2_init_ext
+ ELF(.type  _gcry_poly1305_amd64_avx2_init_ext,@function;)
+ _gcry_poly1305_amd64_avx2_init_ext:
++#ifdef _CET_ENDBR
++	_CET_ENDBR
++#endif
+ .Lpoly1305_init_ext_avx2_local:
+ 	xor %edx, %edx
+ 	vzeroupper
+@@ -406,6 +409,9 @@ ELF(.size _gcry_poly1305_amd64_avx2_init
+ .globl _gcry_poly1305_amd64_avx2_blocks
+ ELF(.type  _gcry_poly1305_amd64_avx2_blocks,@function;)
+ _gcry_poly1305_amd64_avx2_blocks:
++#ifdef _CET_ENDBR
++	_CET_ENDBR
++#endif
+ .Lpoly1305_blocks_avx2_local:
+ 	vzeroupper
+ 	pushq %rbp
+@@ -732,6 +738,9 @@ ELF(.size _gcry_poly1305_amd64_avx2_bloc
+ .globl _gcry_poly1305_amd64_avx2_finish_ext
+ ELF(.type  _gcry_poly1305_amd64_avx2_finish_ext,@function;)
+ _gcry_poly1305_amd64_avx2_finish_ext:
++#ifdef _CET_ENDBR
++	_CET_ENDBR
++#endif
+ .Lpoly1305_finish_ext_avx2_local:
+ 	vzeroupper
+ 	pushq %rbp
+diff -up libgcrypt-1.8.5/cipher/poly1305-sse2-amd64.S.intel-cet libgcrypt-1.8.5/cipher/poly1305-sse2-amd64.S
+--- libgcrypt-1.8.5/cipher/poly1305-sse2-amd64.S.intel-cet	2017-11-23 19:16:58.000000000 +0100
++++ libgcrypt-1.8.5/cipher/poly1305-sse2-amd64.S	2020-01-23 15:36:16.787250134 +0100
+@@ -42,6 +42,9 @@
+ .globl _gcry_poly1305_amd64_sse2_init_ext
+ ELF(.type  _gcry_poly1305_amd64_sse2_init_ext,@function;)
+ _gcry_poly1305_amd64_sse2_init_ext:
++#ifdef _CET_ENDBR
++	_CET_ENDBR
++#endif
+ .Lpoly1305_init_ext_x86_local:
+ 	xor %edx, %edx
+ 	pushq %r12
+@@ -288,6 +291,9 @@ ELF(.size _gcry_poly1305_amd64_sse2_init
+ .globl _gcry_poly1305_amd64_sse2_finish_ext
+ ELF(.type  _gcry_poly1305_amd64_sse2_finish_ext,@function;)
+ _gcry_poly1305_amd64_sse2_finish_ext:
++#ifdef _CET_ENDBR
++	_CET_ENDBR
++#endif
+ .Lpoly1305_finish_ext_x86_local:
+ 	pushq %rbp
+ 	movq %rsp, %rbp
+@@ -439,6 +445,9 @@ ELF(.size _gcry_poly1305_amd64_sse2_fini
+ .globl _gcry_poly1305_amd64_sse2_blocks
+ ELF(.type  _gcry_poly1305_amd64_sse2_blocks,@function;)
+ _gcry_poly1305_amd64_sse2_blocks:
++#ifdef _CET_ENDBR
++	_CET_ENDBR
++#endif
+ .Lpoly1305_blocks_x86_local:
+ 	pushq %rbp
+ 	movq %rsp, %rbp
+diff -up libgcrypt-1.8.5/cipher/serpent-avx2-amd64.S.intel-cet libgcrypt-1.8.5/cipher/serpent-avx2-amd64.S
+--- libgcrypt-1.8.5/cipher/serpent-avx2-amd64.S.intel-cet	2017-11-23 19:16:58.000000000 +0100
++++ libgcrypt-1.8.5/cipher/serpent-avx2-amd64.S	2020-01-23 15:36:44.151972003 +0100
+@@ -18,8 +18,9 @@
+  * License along with this program; if not, see <http://www.gnu.org/licenses/>.
+  */
+ 
+-#ifdef __x86_64
+ #include <config.h>
++
++#ifdef __x86_64
+ #if (defined(HAVE_COMPATIBLE_GCC_AMD64_PLATFORM_AS) || \
+     defined(HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS)) && defined(USE_SERPENT) && \
+     defined(ENABLE_AVX2_SUPPORT)
+diff -up libgcrypt-1.8.5/configure.ac.intel-cet libgcrypt-1.8.5/configure.ac
+--- libgcrypt-1.8.5/configure.ac.intel-cet	2019-08-29 15:00:08.000000000 +0200
++++ libgcrypt-1.8.5/configure.ac	2020-01-23 15:35:28.147774463 +0100
+@@ -95,6 +95,12 @@ AH_TOP([
+ AH_BOTTOM([
+ #define _GCRYPT_IN_LIBGCRYPT 1
+ 
++/* Add .note.gnu.property section for Intel CET in assembler sources
++   when CET is enabled.  */
++#if defined(__ASSEMBLER__) && defined(__CET__)
++# include <cet.h>
++#endif
++
+ /* If the configure check for endianness has been disabled, get it from
+    OS macros.  This is intended for making fat binary builds on OS X.  */
+ #ifdef DISABLED_ENDIAN_CHECK
+diff -up libgcrypt-1.8.5/mpi/config.links.intel-cet libgcrypt-1.8.5/mpi/config.links
+--- libgcrypt-1.8.5/mpi/config.links.intel-cet	2017-11-23 19:16:58.000000000 +0100
++++ libgcrypt-1.8.5/mpi/config.links	2020-01-23 15:35:46.398952954 +0100
+@@ -382,6 +382,16 @@ if test x"$mpi_cpu_arch" = x ; then
+     mpi_cpu_arch="unknown"
+ fi
+ 
++# Add .note.gnu.property section for Intel CET in assembler sources
++# when CET is enabled.  */
++if test x"$mpi_cpu_arch" = xx86 ; then
++    cat <<EOF >> ./mpi/asm-syntax.h
++
++#if defined(__ASSEMBLER__) && defined(__CET__)
++# include <cet.h>
++#endif
++EOF
++fi
+ 
+ # Make sysdep.h
+ echo '/* created by config.links - do not edit */' >./mpi/sysdep.h
+diff -up libgcrypt-1.8.5/mpi/i386/mpih-add1.S.intel-cet libgcrypt-1.8.5/mpi/i386/mpih-add1.S
+--- libgcrypt-1.8.5/mpi/i386/mpih-add1.S.intel-cet	2017-11-23 19:16:58.000000000 +0100
++++ libgcrypt-1.8.5/mpi/i386/mpih-add1.S	2020-01-23 15:37:40.470175379 +0100
+@@ -52,6 +52,10 @@ C_SYMBOL_NAME(_gcry_mpih_add_n:)
+ 	movl 20(%esp),%edx		/* s2_ptr */
+ 	movl 24(%esp),%ecx		/* size */
+ 
++#if defined __CET__ && (__CET__ & 1) != 0
++	pushl	%ebx
++#endif
++
+ 	movl	%ecx,%eax
+ 	shrl	$3,%ecx 		/* compute count for unrolled loop */
+ 	negl	%eax
+@@ -63,6 +67,9 @@ C_SYMBOL_NAME(_gcry_mpih_add_n:)
+ 	subl	%eax,%esi		/* ... by a constant when we ... */
+ 	subl	%eax,%edx		/* ... enter the loop */
+ 	shrl	$2,%eax 		/* restore previous value */
++#if defined __CET__ && (__CET__ & 1) != 0
++	leal	-4(,%eax,4),%ebx	/* Count for 4-byte endbr32 */
++#endif
+ #ifdef PIC
+ /* Calculate start address in loop for PIC.  Due to limitations in some
+    assemblers, Loop-L0-3 cannot be put into the leal */
+@@ -75,29 +82,53 @@ L0:	leal	(%eax,%eax,8),%eax
+ /* Calculate start address in loop for non-PIC.  */
+ 	leal	(Loop - 3)(%eax,%eax,8),%eax
+ #endif
++#if defined __CET__ && (__CET__ & 1) != 0
++	addl	%ebx,%eax		/* Adjust for endbr32 */
++#endif
+ 	jmp	*%eax			/* jump into loop */
+ 	ALIGN (3)
+ Loop:	movl	(%esi),%eax
+ 	adcl	(%edx),%eax
+ 	movl	%eax,(%edi)
++#ifdef _CET_ENDBR
++	_CET_ENDBR
++#endif
+ 	movl	4(%esi),%eax
+ 	adcl	4(%edx),%eax
+ 	movl	%eax,4(%edi)
++#ifdef _CET_ENDBR
++	_CET_ENDBR
++#endif
+ 	movl	8(%esi),%eax
+ 	adcl	8(%edx),%eax
+ 	movl	%eax,8(%edi)
++#ifdef _CET_ENDBR
++	_CET_ENDBR
++#endif
+ 	movl	12(%esi),%eax
+ 	adcl	12(%edx),%eax
+ 	movl	%eax,12(%edi)
++#ifdef _CET_ENDBR
++	_CET_ENDBR
++#endif
+ 	movl	16(%esi),%eax
+ 	adcl	16(%edx),%eax
+ 	movl	%eax,16(%edi)
++#ifdef _CET_ENDBR
++	_CET_ENDBR
++#endif
+ 	movl	20(%esi),%eax
+ 	adcl	20(%edx),%eax
+ 	movl	%eax,20(%edi)
++#ifdef _CET_ENDBR
++	_CET_ENDBR
++#endif
+ 	movl	24(%esi),%eax
+ 	adcl	24(%edx),%eax
+ 	movl	%eax,24(%edi)
++#ifdef _CET_ENDBR
++	_CET_ENDBR
++#endif
+ 	movl	28(%esi),%eax
+ 	adcl	28(%edx),%eax
+ 	movl	%eax,28(%edi)
+@@ -110,6 +141,10 @@ Loop:	movl	(%esi),%eax
+ 	sbbl	%eax,%eax
+ 	negl	%eax
+ 
++#if defined __CET__ && (__CET__ & 1) != 0
++	popl	%ebx
++#endif
++
+ 	popl %esi
+ 	popl %edi
+ 	ret
+diff -up libgcrypt-1.8.5/mpi/i386/mpih-sub1.S.intel-cet libgcrypt-1.8.5/mpi/i386/mpih-sub1.S
+--- libgcrypt-1.8.5/mpi/i386/mpih-sub1.S.intel-cet	2017-11-23 19:16:58.000000000 +0100
++++ libgcrypt-1.8.5/mpi/i386/mpih-sub1.S	2020-01-23 15:37:40.472175351 +0100
+@@ -53,6 +53,10 @@ C_SYMBOL_NAME(_gcry_mpih_sub_n:)
+ 	movl 20(%esp),%edx		/* s2_ptr */
+ 	movl 24(%esp),%ecx		/* size */
+ 
++#if defined __CET__ && (__CET__ & 1) != 0
++	pushl	%ebx
++#endif
++
+ 	movl	%ecx,%eax
+ 	shrl	$3,%ecx 		/* compute count for unrolled loop */
+ 	negl	%eax
+@@ -64,6 +68,9 @@ C_SYMBOL_NAME(_gcry_mpih_sub_n:)
+ 	subl	%eax,%esi		/* ... by a constant when we ... */
+ 	subl	%eax,%edx		/* ... enter the loop */
+ 	shrl	$2,%eax 		/* restore previous value */
++#if defined __CET__ && (__CET__ & 1) != 0
++	leal	-4(,%eax,4),%ebx	/* Count for 4-byte endbr32 */
++#endif
+ #ifdef PIC
+ /* Calculate start address in loop for PIC.  Due to limitations in some
+    assemblers, Loop-L0-3 cannot be put into the leal */
+@@ -76,29 +83,53 @@ L0:	leal	(%eax,%eax,8),%eax
+ /* Calculate start address in loop for non-PIC.  */
+ 	leal	(Loop - 3)(%eax,%eax,8),%eax
+ #endif
++#if defined __CET__ && (__CET__ & 1) != 0
++	addl	%ebx,%eax		/* Adjust for endbr32 */
++#endif
+ 	jmp	*%eax			/* jump into loop */
+ 	ALIGN (3)
+ Loop:	movl	(%esi),%eax
+ 	sbbl	(%edx),%eax
+ 	movl	%eax,(%edi)
++#ifdef _CET_ENDBR
++	_CET_ENDBR
++#endif
+ 	movl	4(%esi),%eax
+ 	sbbl	4(%edx),%eax
+ 	movl	%eax,4(%edi)
++#ifdef _CET_ENDBR
++	_CET_ENDBR
++#endif
+ 	movl	8(%esi),%eax
+ 	sbbl	8(%edx),%eax
+ 	movl	%eax,8(%edi)
++#ifdef _CET_ENDBR
++	_CET_ENDBR
++#endif
+ 	movl	12(%esi),%eax
+ 	sbbl	12(%edx),%eax
+ 	movl	%eax,12(%edi)
++#ifdef _CET_ENDBR
++	_CET_ENDBR
++#endif
+ 	movl	16(%esi),%eax
+ 	sbbl	16(%edx),%eax
+ 	movl	%eax,16(%edi)
++#ifdef _CET_ENDBR
++	_CET_ENDBR
++#endif
+ 	movl	20(%esi),%eax
+ 	sbbl	20(%edx),%eax
+ 	movl	%eax,20(%edi)
++#ifdef _CET_ENDBR
++	_CET_ENDBR
++#endif
+ 	movl	24(%esi),%eax
+ 	sbbl	24(%edx),%eax
+ 	movl	%eax,24(%edi)
++#ifdef _CET_ENDBR
++	_CET_ENDBR
++#endif
+ 	movl	28(%esi),%eax
+ 	sbbl	28(%edx),%eax
+ 	movl	%eax,28(%edi)
+@@ -111,6 +142,10 @@ Loop:	movl	(%esi),%eax
+ 	sbbl	%eax,%eax
+ 	negl	%eax
+ 
++#if defined __CET__ && (__CET__ & 1) != 0
++	popl	%ebx
++#endif
++
+ 	popl %esi
+ 	popl %edi
+ 	ret

SOURCES/libgcrypt-1.8.5-kdf-selftest.patch

@@ -0,0 +1,158 @@
+diff -up libgcrypt-1.8.5/cipher/kdf.c.kdf-selftest libgcrypt-1.8.5/cipher/kdf.c
+--- libgcrypt-1.8.5/cipher/kdf.c.kdf-selftest	2017-11-23 19:16:58.000000000 +0100
++++ libgcrypt-1.8.5/cipher/kdf.c	2020-06-15 18:14:26.494995669 +0200
+@@ -305,3 +305,99 @@ _gcry_kdf_derive (const void *passphrase
+  leave:
+   return ec;
+ }
++
++
++/* PBKDF2 selftests.
++ * Copyright (C) 2008 Free Software Foundation, Inc.
++ * Copyright (C) 2019, 2020 Red Hat, Inc.
++ */
++
++/* Check one PBKDF2 call with HASH ALGO using the regular KDF
++ * API. (passphrase,passphraselen) is the password to be derived,
++ * (salt,saltlen) the salt for the key derivation,
++ * iterations is the number of the kdf iterations,
++ * and (expect,expectlen) the expected result. Returns NULL on
++ * success or a string describing the failure.  */
++
++static const char *
++check_one (int algo,
++           const void *passphrase, size_t passphraselen,
++           const void *salt, size_t saltlen,
++           unsigned long iterations,
++           const void *expect, size_t expectlen)
++{
++  unsigned char key[512]; /* hardcoded to avoid allocation */
++  size_t keysize = expectlen;
++
++  if (keysize > sizeof(key))
++    return "invalid tests data";
++
++  if (_gcry_kdf_derive (passphrase, passphraselen, GCRY_KDF_PBKDF2,
++                        algo, salt, saltlen, iterations,
++                         keysize, key))
++    return "gcry_kdf_derive failed";
++
++  if (memcmp (key, expect, expectlen))
++    return "does not match";
++
++  return NULL;
++}
++
++static gpg_err_code_t
++run_pbkdf2_selftest (int extended, selftest_report_func_t report)
++{
++  const char *what;
++  const char *errtxt;
++
++  what = "Basic PBKDF2 SHA256";
++  errtxt = check_one (GCRY_MD_SHA256,
++        "password", 8,
++        "salt", 4,
++        2,
++        "\xae\x4d\x0c\x95\xaf\x6b\x46\xd3\x2d\x0a\xdf\xf9\x28\xf0\x6d\xd0"
++        "\x2a\x30\x3f\x8e\xf3\xc2\x51\xdf\xd6\xe2\xd8\x5a\x95\x47\x4c\x43", 32);
++  if (errtxt)
++    goto failed;
++
++  if (extended)
++    {
++      what = "Extended PBKDF2 SHA256";
++      errtxt = check_one (GCRY_MD_SHA256,
++        "passwordPASSWORDpassword", 24,
++        "saltSALTsaltSALTsaltSALTsaltSALTsalt", 36,
++        4096,
++        "\x34\x8c\x89\xdb\xcb\xd3\x2b\x2f\x32\xd8\x14\xb8\x11\x6e\x84\xcf"
++        "\x2b\x17\x34\x7e\xbc\x18\x00\x18\x1c\x4e\x2a\x1f\xb8\xdd\x53\xe1"
++        "\xc6\x35\x51\x8c\x7d\xac\x47\xe9", 40);
++      if (errtxt)
++        goto failed;
++    }
++
++  return 0; /* Succeeded. */
++
++ failed:
++  if (report)
++    report ("kdf", GCRY_KDF_PBKDF2, what, errtxt);
++  return GPG_ERR_SELFTEST_FAILED;
++}
++
++
++/* Run the selftests for KDF with KDF algorithm ALGO with optional
++   reporting function REPORT.  */
++gpg_error_t
++_gcry_kdf_selftest (int algo, int extended, selftest_report_func_t report)
++{
++  gcry_err_code_t ec = 0;
++
++  if (algo == GCRY_KDF_PBKDF2)
++    {
++      ec = run_pbkdf2_selftest (extended, report);
++    }
++  else
++    {
++      ec = GPG_ERR_UNSUPPORTED_ALGORITHM;
++      if (report)
++        report ("kdf", algo, "module", "algorithm not available");
++    }
++  return gpg_error (ec);
++}
+diff -up libgcrypt-1.8.5/src/cipher-proto.h.kdf-selftest libgcrypt-1.8.5/src/cipher-proto.h
+--- libgcrypt-1.8.5/src/cipher-proto.h.kdf-selftest	2020-06-15 18:03:25.785353036 +0200
++++ libgcrypt-1.8.5/src/cipher-proto.h	2020-06-15 18:03:25.788353061 +0200
+@@ -259,6 +259,8 @@ gcry_error_t _gcry_hmac_selftest (int al
+                                   selftest_report_func_t report);
+ gcry_error_t _gcry_cmac_selftest (int algo, int extended,
+                                   selftest_report_func_t report);
++gcry_error_t _gcry_kdf_selftest (int algo, int extended,
++                                  selftest_report_func_t report);
+ 
+ gcry_error_t _gcry_random_selftest (selftest_report_func_t report);
+ 
+diff -up libgcrypt-1.8.5/src/fips.c.kdf-selftest libgcrypt-1.8.5/src/fips.c
+--- libgcrypt-1.8.5/src/fips.c.kdf-selftest	2020-06-15 18:03:25.777352968 +0200
++++ libgcrypt-1.8.5/src/fips.c	2020-06-15 18:08:40.651028096 +0200
+@@ -490,6 +490,29 @@ run_mac_selftests (int extended)
+   return anyerr;
+ }
+ 
++/* Run self-tests for all KDF algorithms.  Return 0 on success. */
++static int
++run_kdf_selftests (int extended)
++{
++  static int algos[] =
++    {
++      GCRY_KDF_PBKDF2,
++      0
++    };
++  int idx;
++  gpg_error_t err;
++  int anyerr = 0;
++
++  for (idx=0; algos[idx]; idx++)
++    {
++      err = _gcry_kdf_selftest (algos[idx], extended, reporter);
++      reporter ("kdf", algos[idx], NULL, err? gpg_strerror (err):NULL);
++      if (err)
++        anyerr = 1;
++    }
++  return anyerr;
++}
++
+ 
+ /* Run self-tests for all required public key algorithms.  Return 0 on
+    success. */
+@@ -673,6 +696,9 @@ _gcry_fips_run_selftests (int extended)
+   if (run_mac_selftests (extended))
+     goto leave;
+ 
++  if (run_kdf_selftests (extended))
++    goto leave;
++
+   /* Run random tests before the pubkey tests because the latter
+      require random.  */
+   if (run_random_selftests ())

SOURCES/libgcrypt-1.8.5-ppc-bugfix.patch

@@ -0,0 +1,274 @@
+diff --git a/cipher/crc-ppc.c b/cipher/crc-ppc.c
+index 4d7f0add..b9a40130 100644
+--- a/cipher/crc-ppc.c
++++ b/cipher/crc-ppc.c
+@@ -154,26 +154,63 @@ static const vector16x_u8 bswap_const ALIGNED_64 =
+ #ifdef WORDS_BIGENDIAN
+ # define CRC_VEC_U64_DEF(lo, hi) { (hi), (lo) }
+ # define CRC_VEC_U64_LOAD(offs, ptr) \
+-          asm_swap_u64(vec_vsx_ld((offs), (const unsigned long long *)(ptr)))
++	  asm_swap_u64(asm_vec_u64_load(offs, ptr))
+ # define CRC_VEC_U64_LOAD_LE(offs, ptr) \
+-	  CRC_VEC_SWAP(vec_vsx_ld((offs), (const unsigned long long *)(ptr)))
++	  CRC_VEC_SWAP(asm_vec_u64_load(offs, ptr))
+ # define CRC_VEC_U64_LOAD_BE(offs, ptr) \
+-         vec_vsx_ld((offs), (const unsigned long long *)(ptr))
++	  asm_vec_u64_load(offs, ptr)
+ # define CRC_VEC_SWAP_TO_LE(v) CRC_VEC_SWAP(v)
+ # define CRC_VEC_SWAP_TO_BE(v) (v)
+ # define VEC_U64_LO 1
+ # define VEC_U64_HI 0
++
++static ASM_FUNC_ATTR_INLINE vector2x_u64
++asm_vec_u64_load(unsigned long offset, const void *ptr)
++{
++  vector2x_u64 vecu64;
++#if __GNUC__ >= 4
++  if (__builtin_constant_p (offset) && offset == 0)
++    __asm__ volatile ("lxvd2x %x0,0,%1\n\t"
++		      : "=wa" (vecu64)
++		      : "r" ((uintptr_t)ptr)
++		      : "memory");
++  else
++#endif
++    __asm__ volatile ("lxvd2x %x0,%1,%2\n\t"
++		      : "=wa" (vecu64)
++		      : "r" (offset), "r" ((uintptr_t)ptr)
++		      : "memory", "r0");
++  return vecu64;
++}
+ #else
+ # define CRC_VEC_U64_DEF(lo, hi) { (lo), (hi) }
+-# define CRC_VEC_U64_LOAD(offs, ptr) \
+-	  vec_vsx_ld((offs), (const unsigned long long *)(ptr))
+-# define CRC_VEC_U64_LOAD_LE(offs, ptr) CRC_VEC_U64_LOAD((offs), (ptr))
++# define CRC_VEC_U64_LOAD(offs, ptr) asm_vec_u64_load_le(offs, ptr)
++# define CRC_VEC_U64_LOAD_LE(offs, ptr) asm_vec_u64_load_le(offs, ptr)
+ # define CRC_VEC_U64_LOAD_BE(offs, ptr) asm_vec_u64_load_be(offs, ptr)
+ # define CRC_VEC_SWAP_TO_LE(v) (v)
+ # define CRC_VEC_SWAP_TO_BE(v) CRC_VEC_SWAP(v)
+ # define VEC_U64_LO 0
+ # define VEC_U64_HI 1
+ 
++static ASM_FUNC_ATTR_INLINE vector2x_u64
++asm_vec_u64_load_le(unsigned long offset, const void *ptr)
++{
++  vector2x_u64 vecu64;
++#if __GNUC__ >= 4
++  if (__builtin_constant_p (offset) && offset == 0)
++    __asm__ volatile ("lxvd2x %x0,0,%1\n\t"
++		      : "=wa" (vecu64)
++		      : "r" ((uintptr_t)ptr)
++		      : "memory");
++  else
++#endif
++    __asm__ volatile ("lxvd2x %x0,%1,%2\n\t"
++		      : "=wa" (vecu64)
++		      : "r" (offset), "r" ((uintptr_t)ptr)
++		      : "memory", "r0");
++  return asm_swap_u64(vecu64);
++}
++
+ static ASM_FUNC_ATTR_INLINE vector2x_u64
+ asm_vec_u64_load_be(unsigned int offset, const void *ptr)
+ {
+diff --git a/cipher/sha512-ppc.c b/cipher/sha512-ppc.c
+index a758e1ea..31ea25bf 100644
+--- a/cipher/sha512-ppc.c
++++ b/cipher/sha512-ppc.c
+@@ -115,14 +115,62 @@ vec_merge_idx0_elems(vector2x_u64 v0, vector2x_u64 v1)
+ static ASM_FUNC_ATTR_INLINE vector2x_u64
+ vec_vshasigma_u64(vector2x_u64 v, unsigned int a, unsigned int b)
+ {
+-  asm ("vshasigmad %0,%1,%2,%3"
+-       : "=v" (v)
+-       : "v" (v), "g" (a), "g" (b)
+-       : "memory");
++  __asm__ ("vshasigmad %0,%1,%2,%3"
++	   : "=v" (v)
++	   : "v" (v), "g" (a), "g" (b)
++	   : "memory");
+   return v;
+ }
+ 
+ 
++static ASM_FUNC_ATTR_INLINE vector2x_u64
++vec_u64_load(unsigned long offset, const void *ptr)
++{
++  vector2x_u64 vecu64;
++#if __GNUC__ >= 4
++  if (__builtin_constant_p (offset) && offset == 0)
++    __asm__ ("lxvd2x %x0,0,%1\n\t"
++	     : "=wa" (vecu64)
++	     : "r" ((uintptr_t)ptr)
++	     : "memory");
++  else
++#endif
++    __asm__ ("lxvd2x %x0,%1,%2\n\t"
++	     : "=wa" (vecu64)
++	     : "r" (offset), "r" ((uintptr_t)ptr)
++	     : "memory", "r0");
++#ifndef WORDS_BIGENDIAN
++  __asm__ ("xxswapd %x0, %x1"
++	   : "=wa" (vecu64)
++	   : "wa" (vecu64));
++#endif
++  return vecu64;
++}
++
++
++static ASM_FUNC_ATTR_INLINE void
++vec_u64_store(vector2x_u64 vecu64, unsigned long offset, void *ptr)
++{
++#ifndef WORDS_BIGENDIAN
++  __asm__ ("xxswapd %x0, %x1"
++	   : "=wa" (vecu64)
++	   : "wa" (vecu64));
++#endif
++#if __GNUC__ >= 4
++  if (__builtin_constant_p (offset) && offset == 0)
++    __asm__ ("stxvd2x %x0,0,%1\n\t"
++	     :
++	     : "wa" (vecu64), "r" ((uintptr_t)ptr)
++	     : "memory");
++  else
++#endif
++    __asm__ ("stxvd2x %x0,%1,%2\n\t"
++	     :
++	     : "wa" (vecu64), "r" (offset), "r" ((uintptr_t)ptr)
++	     : "memory", "r0");
++}
++
++
+ /* SHA2 round in vector registers */
+ #define R(a,b,c,d,e,f,g,h,k,w) do                             \
+     {                                                         \
+@@ -168,13 +216,13 @@ _gcry_sha512_transform_ppc8(u64 state[8],
+   vector2x_u64 a, b, c, d, e, f, g, h, t1, t2;
+   u64 w[16];
+ 
+-  h0 = vec_vsx_ld (8 * 0, (unsigned long long *)state);
++  h0 = vec_u64_load (8 * 0, (unsigned long long *)state);
+   h1 = vec_rol_elems (h0, 1);
+-  h2 = vec_vsx_ld (8 * 2, (unsigned long long *)state);
++  h2 = vec_u64_load (8 * 2, (unsigned long long *)state);
+   h3 = vec_rol_elems (h2, 1);
+-  h4 = vec_vsx_ld (8 * 4, (unsigned long long *)state);
++  h4 = vec_u64_load (8 * 4, (unsigned long long *)state);
+   h5 = vec_rol_elems (h4, 1);
+-  h6 = vec_vsx_ld (8 * 6, (unsigned long long *)state);
++  h6 = vec_u64_load (8 * 6, (unsigned long long *)state);
+   h7 = vec_rol_elems (h6, 1);
+ 
+   while (nblks >= 2)
+@@ -514,10 +562,10 @@ _gcry_sha512_transform_ppc8(u64 state[8],
+   h2 = vec_merge_idx0_elems (h2, h3);
+   h4 = vec_merge_idx0_elems (h4, h5);
+   h6 = vec_merge_idx0_elems (h6, h7);
+-  vec_vsx_st (h0, 8 * 0, (unsigned long long *)state);
+-  vec_vsx_st (h2, 8 * 2, (unsigned long long *)state);
+-  vec_vsx_st (h4, 8 * 4, (unsigned long long *)state);
+-  vec_vsx_st (h6, 8 * 6, (unsigned long long *)state);
++  vec_u64_store (h0, 8 * 0, (unsigned long long *)state);
++  vec_u64_store (h2, 8 * 2, (unsigned long long *)state);
++  vec_u64_store (h4, 8 * 4, (unsigned long long *)state);
++  vec_u64_store (h6, 8 * 6, (unsigned long long *)state);
+ 
+   return sizeof(w);
+ }
+diff --git a/configure.ac b/configure.ac
+index b6b6455a..be35ce42 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -1745,10 +1745,12 @@ AC_CACHE_CHECK([whether compiler supports PowerPC AltiVec/VSX intrinsics],
+ 	AC_COMPILE_IFELSE([AC_LANG_SOURCE(
+ 	[[#include <altivec.h>
+ 	  typedef vector unsigned char block;
++	  typedef vector unsigned int vecu32;
+ 	  block fn(block in)
+ 	  {
+ 	    block t = vec_perm (in, in, vec_vsx_ld (0, (unsigned char*)0));
+-	    return vec_cipher_be (t, in);
++	    vecu32 y = vec_vsx_ld (0, (unsigned int*)0);
++	    return vec_cipher_be (t, in) ^ (block)y;
+ 	  }
+ 	  ]])],
+ 	[gcry_cv_cc_ppc_altivec=yes])
+@@ -1769,10 +1771,12 @@ if test "$gcry_cv_cc_ppc_altivec" = "no" &&
+     AC_COMPILE_IFELSE([AC_LANG_SOURCE(
+       [[#include <altivec.h>
+ 	typedef vector unsigned char block;
++	typedef vector unsigned int vecu32;
+ 	block fn(block in)
+ 	{
+ 	  block t = vec_perm (in, in, vec_vsx_ld (0, (unsigned char*)0));
+-	  return vec_cipher_be (t, in);
++	  vecu32 y = vec_vsx_ld (0, (unsigned int*)0);
++	  return vec_cipher_be (t, in) ^ (block)y;
+ 	}]])],
+       [gcry_cv_cc_ppc_altivec_cflags=yes])])
+   if test "$gcry_cv_cc_ppc_altivec_cflags" = "yes" ; then
+
+diff --git a/configure.ac b/configure.ac
+index 202ac888..fd447906 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -2562,13 +2562,13 @@ if test "$found" = "1" ; then
+          GCRYPT_DIGESTS="$GCRYPT_DIGESTS crc-intel-pclmul.lo"
+       ;;
+       powerpc64le-*-*)
+-         GCRYPT_CIPHERS="$GCRYPT_CIPHERS crc-ppc.lo"
++         GCRYPT_DIGESTS="$GCRYPT_DIGESTS crc-ppc.lo"
+       ;;
+       powerpc64-*-*)
+-         GCRYPT_CIPHERS="$GCRYPT_CIPHERS crc-ppc.lo"
++         GCRYPT_DIGESTS="$GCRYPT_DIGESTS crc-ppc.lo"
+       ;;
+       powerpc-*-*)
+-         GCRYPT_CIPHERS="$GCRYPT_CIPHERS crc-ppc.lo"
++         GCRYPT_DIGESTS="$GCRYPT_DIGESTS crc-ppc.lo"
+       ;;
+    esac
+ fi
+@@ -2635,17 +2635,17 @@ if test "$found" = "1" ; then
+       ;;
+       powerpc64le-*-*)
+          # Build with the crypto extension implementation
+-         GCRYPT_CIPHERS="$GCRYPT_CIPHERS sha256-ppc.lo"
++         GCRYPT_DIGESTS="$GCRYPT_DIGESTS sha256-ppc.lo"
+       ;;
+       powerpc64-*-*)
+          # Big-Endian.
+          # Build with the crypto extension implementation
+-         GCRYPT_CIPHERS="$GCRYPT_CIPHERS sha256-ppc.lo"
++         GCRYPT_DIGESTS="$GCRYPT_DIGESTS sha256-ppc.lo"
+       ;;
+       powerpc-*-*)
+          # Big-Endian.
+          # Build with the crypto extension implementation
+-         GCRYPT_CIPHERS="$GCRYPT_CIPHERS sha256-ppc.lo"
++         GCRYPT_DIGESTS="$GCRYPT_DIGESTS sha256-ppc.lo"
+    esac
+ fi
+ 
+@@ -2667,17 +2667,17 @@ if test "$found" = "1" ; then
+       ;;
+       powerpc64le-*-*)
+          # Build with the crypto extension implementation
+-         GCRYPT_CIPHERS="$GCRYPT_CIPHERS sha512-ppc.lo"
++         GCRYPT_DIGESTS="$GCRYPT_DIGESTS sha512-ppc.lo"
+       ;;
+       powerpc64-*-*)
+          # Big-Endian.
+          # Build with the crypto extension implementation
+-         GCRYPT_CIPHERS="$GCRYPT_CIPHERS sha512-ppc.lo"
++         GCRYPT_DIGESTS="$GCRYPT_DIGESTS sha512-ppc.lo"
+       ;;
+       powerpc-*-*)
+          # Big-Endian.
+          # Build with the crypto extension implementation
+-         GCRYPT_CIPHERS="$GCRYPT_CIPHERS sha512-ppc.lo"
++         GCRYPT_DIGESTS="$GCRYPT_DIGESTS sha512-ppc.lo"
+    esac
+ 
+    if test x"$neonsupport" = xyes ; then

SOURCES/libgcrypt-1.8.5-ppc-crc32.patch

@@ -0,0 +1,794 @@
+diff --git a/cipher/Makefile.am b/cipher/Makefile.am
+index cb41c251..1728e9f9 100644
+--- a/cipher/Makefile.am
++++ b/cipher/Makefile.am
+@@ -67,7 +67,7 @@ cast5.c cast5-amd64.S cast5-arm.S \
+ chacha20.c chacha20-sse2-amd64.S chacha20-ssse3-amd64.S chacha20-avx2-amd64.S \
+   chacha20-armv7-neon.S \
+ crc.c \
+-  crc-intel-pclmul.c \
++  crc-intel-pclmul.c crc-ppc.c \
+ des.c des-amd64.S \
+ dsa.c \
+ elgamal.c \
+@@ -159,3 +159,9 @@ sha512-ppc.o: $(srcdir)/sha512-ppc.c Makefile
+ 
+ sha512-ppc.lo: $(srcdir)/sha512-ppc.c Makefile
+ 	`echo $(LTCOMPILE) $(ppc_vcrypto_cflags) -c $< `
++
++crc-ppc.o: $(srcdir)/crc-ppc.c Makefile
++	`echo $(COMPILE) $(ppc_vcrypto_cflags) -c $< `
++
++crc-ppc.lo: $(srcdir)/crc-ppc.c Makefile
++	`echo $(LTCOMPILE) $(ppc_vcrypto_cflags) -c $< `
+diff --git a/cipher/crc-ppc.c b/cipher/crc-ppc.c
+new file mode 100644
+index 00000000..4d7f0add
+--- /dev/null
++++ b/cipher/crc-ppc.c
+@@ -0,0 +1,619 @@
++/* crc-ppc.c - POWER8 vpmsum accelerated CRC implementation
++ * Copyright (C) 2019-2020 Jussi Kivilinna <jussi.kivilinna@iki.fi>
++ *
++ * This file is part of Libgcrypt.
++ *
++ * Libgcrypt is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU Lesser General Public License as
++ * published by the Free Software Foundation; either version 2.1 of
++ * the License, or (at your option) any later version.
++ *
++ * Libgcrypt is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU Lesser General Public License for more details.
++ *
++ * You should have received a copy of the GNU Lesser General Public
++ * License along with this program; if not, write to the Free Software
++ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
++ *
++ */
++
++#include <config.h>
++#include <stdio.h>
++#include <stdlib.h>
++#include <string.h>
++
++#include "g10lib.h"
++
++#include "bithelp.h"
++#include "bufhelp.h"
++
++
++#if defined(ENABLE_PPC_CRYPTO_SUPPORT) && \
++    defined(HAVE_COMPATIBLE_CC_PPC_ALTIVEC) && \
++    defined(HAVE_GCC_INLINE_ASM_PPC_ALTIVEC) && \
++    __GNUC__ >= 4
++
++#include <altivec.h>
++#include "bufhelp.h"
++
++
++#define ALWAYS_INLINE inline __attribute__((always_inline))
++#define NO_INLINE __attribute__((noinline))
++#define NO_INSTRUMENT_FUNCTION __attribute__((no_instrument_function))
++
++#define ASM_FUNC_ATTR          NO_INSTRUMENT_FUNCTION
++#define ASM_FUNC_ATTR_INLINE   ASM_FUNC_ATTR ALWAYS_INLINE
++#define ASM_FUNC_ATTR_NOINLINE ASM_FUNC_ATTR NO_INLINE
++
++#define ALIGNED_64 __attribute__ ((aligned (64)))
++
++
++typedef vector unsigned char vector16x_u8;
++typedef vector unsigned int vector4x_u32;
++typedef vector unsigned long long vector2x_u64;
++
++
++/* Constants structure for generic reflected/non-reflected CRC32 PMULL
++ * functions. */
++struct crc32_consts_s
++{
++  /* k: { x^(32*17), x^(32*15), x^(32*5), x^(32*3), x^(32*2), 0 } mod P(x) */
++  unsigned long long k[6];
++  /* my_p: { floor(x^64 / P(x)), P(x) } */
++  unsigned long long my_p[2];
++};
++
++/* PMULL constants for CRC32 and CRC32RFC1510. */
++static const struct crc32_consts_s crc32_consts ALIGNED_64 =
++{
++  { /* k[6] = reverse_33bits( x^(32*y) mod P(x) ) */
++    U64_C(0x154442bd4), U64_C(0x1c6e41596), /* y = { 17, 15 } */
++    U64_C(0x1751997d0), U64_C(0x0ccaa009e), /* y = { 5, 3 } */
++    U64_C(0x163cd6124), 0                   /* y = 2 */
++  },
++  { /* my_p[2] = reverse_33bits ( { floor(x^64 / P(x)), P(x) } ) */
++    U64_C(0x1f7011641), U64_C(0x1db710641)
++  }
++};
++
++/* PMULL constants for CRC24RFC2440 (polynomial multiplied with x⁸). */
++static const struct crc32_consts_s crc24rfc2440_consts ALIGNED_64 =
++{
++  { /* k[6] = x^(32*y) mod P(x) << 32*/
++    U64_C(0x08289a00) << 32, U64_C(0x74b44a00) << 32, /* y = { 17, 15 } */
++    U64_C(0xc4b14d00) << 32, U64_C(0xfd7e0c00) << 32, /* y = { 5, 3 } */
++    U64_C(0xd9fe8c00) << 32, 0                        /* y = 2 */
++  },
++  { /* my_p[2] = { floor(x^64 / P(x)), P(x) } */
++    U64_C(0x1f845fe24), U64_C(0x1864cfb00)
++  }
++};
++
++
++static ASM_FUNC_ATTR_INLINE vector2x_u64
++asm_vpmsumd(vector2x_u64 a, vector2x_u64 b)
++{
++  __asm__("vpmsumd %0, %1, %2"
++	  : "=v" (a)
++	  : "v" (a), "v" (b));
++  return a;
++}
++
++
++static ASM_FUNC_ATTR_INLINE vector2x_u64
++asm_swap_u64(vector2x_u64 a)
++{
++  __asm__("xxswapd %x0, %x1"
++	  : "=wa" (a)
++	  : "wa" (a));
++  return a;
++}
++
++
++static ASM_FUNC_ATTR_INLINE vector4x_u32
++vec_sld_u32(vector4x_u32 a, vector4x_u32 b, unsigned int idx)
++{
++  return vec_sld (a, b, (4 * idx) & 15);
++}
++
++
++static const byte crc32_partial_fold_input_mask[16 + 16] ALIGNED_64 =
++  {
++    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
++    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
++  };
++static const byte crc32_shuf_shift[3 * 16] ALIGNED_64 =
++  {
++    0x1f, 0x1f, 0x1f, 0x1f, 0x1f, 0x1f, 0x1f, 0x1f,
++    0x1f, 0x1f, 0x1f, 0x1f, 0x1f, 0x1f, 0x1f, 0x1f,
++    0x0f, 0x0e, 0x0d, 0x0c, 0x0b, 0x0a, 0x09, 0x08,
++    0x07, 0x06, 0x05, 0x04, 0x03, 0x02, 0x01, 0x00,
++    0x1f, 0x1f, 0x1f, 0x1f, 0x1f, 0x1f, 0x1f, 0x1f,
++    0x1f, 0x1f, 0x1f, 0x1f, 0x1f, 0x1f, 0x1f, 0x1f,
++  };
++static const byte crc32_refl_shuf_shift[3 * 16] ALIGNED_64 =
++  {
++    0x1f, 0x1f, 0x1f, 0x1f, 0x1f, 0x1f, 0x1f, 0x1f,
++    0x1f, 0x1f, 0x1f, 0x1f, 0x1f, 0x1f, 0x1f, 0x1f,
++    0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
++    0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
++    0x1f, 0x1f, 0x1f, 0x1f, 0x1f, 0x1f, 0x1f, 0x1f,
++    0x1f, 0x1f, 0x1f, 0x1f, 0x1f, 0x1f, 0x1f, 0x1f,
++  };
++static const vector16x_u8 bswap_const ALIGNED_64 =
++  { 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0 };
++
++
++#define CRC_VEC_SWAP(v) ({ vector2x_u64 __vecu64 = (v); \
++                           vec_perm(__vecu64, __vecu64, bswap_const); })
++
++#ifdef WORDS_BIGENDIAN
++# define CRC_VEC_U64_DEF(lo, hi) { (hi), (lo) }
++# define CRC_VEC_U64_LOAD(offs, ptr) \
++          asm_swap_u64(vec_vsx_ld((offs), (const unsigned long long *)(ptr)))
++# define CRC_VEC_U64_LOAD_LE(offs, ptr) \
++	  CRC_VEC_SWAP(vec_vsx_ld((offs), (const unsigned long long *)(ptr)))
++# define CRC_VEC_U64_LOAD_BE(offs, ptr) \
++         vec_vsx_ld((offs), (const unsigned long long *)(ptr))
++# define CRC_VEC_SWAP_TO_LE(v) CRC_VEC_SWAP(v)
++# define CRC_VEC_SWAP_TO_BE(v) (v)
++# define VEC_U64_LO 1
++# define VEC_U64_HI 0
++#else
++# define CRC_VEC_U64_DEF(lo, hi) { (lo), (hi) }
++# define CRC_VEC_U64_LOAD(offs, ptr) \
++	  vec_vsx_ld((offs), (const unsigned long long *)(ptr))
++# define CRC_VEC_U64_LOAD_LE(offs, ptr) CRC_VEC_U64_LOAD((offs), (ptr))
++# define CRC_VEC_U64_LOAD_BE(offs, ptr) asm_vec_u64_load_be(offs, ptr)
++# define CRC_VEC_SWAP_TO_LE(v) (v)
++# define CRC_VEC_SWAP_TO_BE(v) CRC_VEC_SWAP(v)
++# define VEC_U64_LO 0
++# define VEC_U64_HI 1
++
++static ASM_FUNC_ATTR_INLINE vector2x_u64
++asm_vec_u64_load_be(unsigned int offset, const void *ptr)
++{
++  static const vector16x_u8 vec_load_le_const =
++    { ~7, ~6, ~5, ~4, ~3, ~2, ~1, ~0, ~15, ~14, ~13, ~12, ~11, ~10, ~9, ~8 };
++  vector2x_u64 vecu64;
++
++#if __GNUC__ >= 4
++  if (__builtin_constant_p (offset) && offset == 0)
++    __asm__ ("lxvd2x %%vs32,0,%1\n\t"
++	     "vperm %0,%%v0,%%v0,%2\n\t"
++	     : "=v" (vecu64)
++	     : "r" ((uintptr_t)(ptr)), "v" (vec_load_le_const)
++	     : "memory", "v0");
++#endif
++  else
++    __asm__ ("lxvd2x %%vs32,%1,%2\n\t"
++	     "vperm %0,%%v0,%%v0,%3\n\t"
++	     : "=v" (vecu64)
++	     : "r" (offset), "r" ((uintptr_t)(ptr)),
++	       "v" (vec_load_le_const)
++	     : "memory", "r0", "v0");
++
++  return vecu64;
++}
++#endif
++
++
++static ASM_FUNC_ATTR_INLINE void
++crc32r_ppc8_ce_bulk (u32 *pcrc, const byte *inbuf, size_t inlen,
++		     const struct crc32_consts_s *consts)
++{
++  vector4x_u32 zero = { 0, 0, 0, 0 };
++  vector2x_u64 low_64bit_mask = CRC_VEC_U64_DEF((u64)-1, 0);
++  vector2x_u64 low_32bit_mask = CRC_VEC_U64_DEF((u32)-1, 0);
++  vector2x_u64 my_p = CRC_VEC_U64_LOAD(0, &consts->my_p[0]);
++  vector2x_u64 k1k2 = CRC_VEC_U64_LOAD(0, &consts->k[1 - 1]);
++  vector2x_u64 k3k4 = CRC_VEC_U64_LOAD(0, &consts->k[3 - 1]);
++  vector2x_u64 k4lo = CRC_VEC_U64_DEF(k3k4[VEC_U64_HI], 0);
++  vector2x_u64 k5lo = CRC_VEC_U64_LOAD(0, &consts->k[5 - 1]);
++  vector2x_u64 crc = CRC_VEC_U64_DEF(*pcrc, 0);
++  vector2x_u64 crc0, crc1, crc2, crc3;
++  vector2x_u64 v0;
++
++  if (inlen >= 8 * 16)
++    {
++      crc0 = CRC_VEC_U64_LOAD_LE(0 * 16, inbuf);
++      crc0 ^= crc;
++      crc1 = CRC_VEC_U64_LOAD_LE(1 * 16, inbuf);
++      crc2 = CRC_VEC_U64_LOAD_LE(2 * 16, inbuf);
++      crc3 = CRC_VEC_U64_LOAD_LE(3 * 16, inbuf);
++
++      inbuf += 4 * 16;
++      inlen -= 4 * 16;
++
++      /* Fold by 4. */
++      while (inlen >= 4 * 16)
++	{
++	  v0 = CRC_VEC_U64_LOAD_LE(0 * 16, inbuf);
++	  crc0 = asm_vpmsumd(crc0, k1k2) ^ v0;
++
++	  v0 = CRC_VEC_U64_LOAD_LE(1 * 16, inbuf);
++	  crc1 = asm_vpmsumd(crc1, k1k2) ^ v0;
++
++	  v0 = CRC_VEC_U64_LOAD_LE(2 * 16, inbuf);
++	  crc2 = asm_vpmsumd(crc2, k1k2) ^ v0;
++
++	  v0 = CRC_VEC_U64_LOAD_LE(3 * 16, inbuf);
++	  crc3 = asm_vpmsumd(crc3, k1k2) ^ v0;
++
++	  inbuf += 4 * 16;
++	  inlen -= 4 * 16;
++	}
++
++      /* Fold 4 to 1. */
++      crc1 ^= asm_vpmsumd(crc0, k3k4);
++      crc2 ^= asm_vpmsumd(crc1, k3k4);
++      crc3 ^= asm_vpmsumd(crc2, k3k4);
++      crc = crc3;
++    }
++  else
++    {
++      v0 = CRC_VEC_U64_LOAD_LE(0, inbuf);
++      crc ^= v0;
++
++      inbuf += 16;
++      inlen -= 16;
++    }
++
++  /* Fold by 1. */
++  while (inlen >= 16)
++    {
++      v0 = CRC_VEC_U64_LOAD_LE(0, inbuf);
++      crc = asm_vpmsumd(k3k4, crc);
++      crc ^= v0;
++
++      inbuf += 16;
++      inlen -= 16;
++    }
++
++  /* Partial fold. */
++  if (inlen)
++    {
++      /* Load last input and add padding zeros. */
++      vector2x_u64 mask = CRC_VEC_U64_LOAD_LE(inlen, crc32_partial_fold_input_mask);
++      vector2x_u64 shl_shuf = CRC_VEC_U64_LOAD_LE(inlen, crc32_refl_shuf_shift);
++      vector2x_u64 shr_shuf = CRC_VEC_U64_LOAD_LE(inlen + 16, crc32_refl_shuf_shift);
++
++      v0 = CRC_VEC_U64_LOAD_LE(inlen - 16, inbuf);
++      v0 &= mask;
++
++      crc = CRC_VEC_SWAP_TO_LE(crc);
++      v0 |= (vector2x_u64)vec_perm((vector16x_u8)crc, (vector16x_u8)zero,
++				   (vector16x_u8)shr_shuf);
++      crc = (vector2x_u64)vec_perm((vector16x_u8)crc, (vector16x_u8)zero,
++				   (vector16x_u8)shl_shuf);
++      crc = asm_vpmsumd(k3k4, crc);
++      crc ^= v0;
++
++      inbuf += inlen;
++      inlen -= inlen;
++    }
++
++  /* Final fold. */
++
++  /* reduce 128-bits to 96-bits */
++  v0 = asm_swap_u64(crc);
++  v0 &= low_64bit_mask;
++  crc = asm_vpmsumd(k4lo, crc);
++  crc ^= v0;
++
++  /* reduce 96-bits to 64-bits */
++  v0 = (vector2x_u64)vec_sld_u32((vector4x_u32)crc,
++				 (vector4x_u32)crc, 3);  /* [x0][x3][x2][x1] */
++  v0 &= low_64bit_mask;                                  /* [00][00][x2][x1] */
++  crc = crc & low_32bit_mask;                            /* [00][00][00][x0] */
++  crc = v0 ^ asm_vpmsumd(k5lo, crc);                     /* [00][00][xx][xx] */
++
++  /* barrett reduction */
++  v0 = crc << 32;                                        /* [00][00][x0][00] */
++  v0 = asm_vpmsumd(my_p, v0);
++  v0 = asm_swap_u64(v0);
++  v0 = asm_vpmsumd(my_p, v0);
++  crc = (vector2x_u64)vec_sld_u32((vector4x_u32)crc,
++				  zero, 1);              /* [00][x1][x0][00] */
++  crc ^= v0;
++
++  *pcrc = (u32)crc[VEC_U64_HI];
++}
++
++
++static ASM_FUNC_ATTR_INLINE u32
++crc32r_ppc8_ce_reduction_4 (u32 data, u32 crc,
++			    const struct crc32_consts_s *consts)
++{
++  vector4x_u32 zero = { 0, 0, 0, 0 };
++  vector2x_u64 my_p = CRC_VEC_U64_LOAD(0, &consts->my_p[0]);
++  vector2x_u64 v0 = CRC_VEC_U64_DEF((u64)data, 0);
++  v0 = asm_vpmsumd(v0, my_p);                          /* [00][00][xx][xx] */
++  v0 = (vector2x_u64)vec_sld_u32((vector4x_u32)v0,
++				 zero, 3);             /* [x0][00][00][00] */
++  v0 = (vector2x_u64)vec_sld_u32((vector4x_u32)v0,
++				 (vector4x_u32)v0, 3); /* [00][x0][00][00] */
++  v0 = asm_vpmsumd(v0, my_p);                          /* [00][00][xx][xx] */
++  return (v0[VEC_U64_LO] >> 32) ^ crc;
++}
++
++
++static ASM_FUNC_ATTR_INLINE void
++crc32r_less_than_16 (u32 *pcrc, const byte *inbuf, size_t inlen,
++		     const struct crc32_consts_s *consts)
++{
++  u32 crc = *pcrc;
++  u32 data;
++
++  while (inlen >= 4)
++    {
++      data = buf_get_le32(inbuf);
++      data ^= crc;
++
++      inlen -= 4;
++      inbuf += 4;
++
++      crc = crc32r_ppc8_ce_reduction_4 (data, 0, consts);
++    }
++
++  switch (inlen)
++    {
++    case 0:
++      break;
++    case 1:
++      data = inbuf[0];
++      data ^= crc;
++      data <<= 24;
++      crc >>= 8;
++      crc = crc32r_ppc8_ce_reduction_4 (data, crc, consts);
++      break;
++    case 2:
++      data = inbuf[0] << 0;
++      data |= inbuf[1] << 8;
++      data ^= crc;
++      data <<= 16;
++      crc >>= 16;
++      crc = crc32r_ppc8_ce_reduction_4 (data, crc, consts);
++      break;
++    case 3:
++      data = inbuf[0] << 0;
++      data |= inbuf[1] << 8;
++      data |= inbuf[2] << 16;
++      data ^= crc;
++      data <<= 8;
++      crc >>= 24;
++      crc = crc32r_ppc8_ce_reduction_4 (data, crc, consts);
++      break;
++    }
++
++  *pcrc = crc;
++}
++
++
++static ASM_FUNC_ATTR_INLINE void
++crc32_ppc8_ce_bulk (u32 *pcrc, const byte *inbuf, size_t inlen,
++		    const struct crc32_consts_s *consts)
++{
++  vector4x_u32 zero = { 0, 0, 0, 0 };
++  vector2x_u64 low_96bit_mask = CRC_VEC_U64_DEF(~0, ~((u64)(u32)-1 << 32));
++  vector2x_u64 p_my = asm_swap_u64(CRC_VEC_U64_LOAD(0, &consts->my_p[0]));
++  vector2x_u64 p_my_lo, p_my_hi;
++  vector2x_u64 k2k1 = asm_swap_u64(CRC_VEC_U64_LOAD(0, &consts->k[1 - 1]));
++  vector2x_u64 k4k3 = asm_swap_u64(CRC_VEC_U64_LOAD(0, &consts->k[3 - 1]));
++  vector2x_u64 k4hi = CRC_VEC_U64_DEF(0, consts->k[4 - 1]);
++  vector2x_u64 k5hi = CRC_VEC_U64_DEF(0, consts->k[5 - 1]);
++  vector2x_u64 crc = CRC_VEC_U64_DEF(0, _gcry_bswap64(*pcrc));
++  vector2x_u64 crc0, crc1, crc2, crc3;
++  vector2x_u64 v0;
++
++  if (inlen >= 8 * 16)
++    {
++      crc0 = CRC_VEC_U64_LOAD_BE(0 * 16, inbuf);
++      crc0 ^= crc;
++      crc1 = CRC_VEC_U64_LOAD_BE(1 * 16, inbuf);
++      crc2 = CRC_VEC_U64_LOAD_BE(2 * 16, inbuf);
++      crc3 = CRC_VEC_U64_LOAD_BE(3 * 16, inbuf);
++
++      inbuf += 4 * 16;
++      inlen -= 4 * 16;
++
++      /* Fold by 4. */
++      while (inlen >= 4 * 16)
++	{
++	  v0 = CRC_VEC_U64_LOAD_BE(0 * 16, inbuf);
++	  crc0 = asm_vpmsumd(crc0, k2k1) ^ v0;
++
++	  v0 = CRC_VEC_U64_LOAD_BE(1 * 16, inbuf);
++	  crc1 = asm_vpmsumd(crc1, k2k1) ^ v0;
++
++	  v0 = CRC_VEC_U64_LOAD_BE(2 * 16, inbuf);
++	  crc2 = asm_vpmsumd(crc2, k2k1) ^ v0;
++
++	  v0 = CRC_VEC_U64_LOAD_BE(3 * 16, inbuf);
++	  crc3 = asm_vpmsumd(crc3, k2k1) ^ v0;
++
++	  inbuf += 4 * 16;
++	  inlen -= 4 * 16;
++	}
++
++      /* Fold 4 to 1. */
++      crc1 ^= asm_vpmsumd(crc0, k4k3);
++      crc2 ^= asm_vpmsumd(crc1, k4k3);
++      crc3 ^= asm_vpmsumd(crc2, k4k3);
++      crc = crc3;
++    }
++  else
++    {
++      v0 = CRC_VEC_U64_LOAD_BE(0, inbuf);
++      crc ^= v0;
++
++      inbuf += 16;
++      inlen -= 16;
++    }
++
++  /* Fold by 1. */
++  while (inlen >= 16)
++    {
++      v0 = CRC_VEC_U64_LOAD_BE(0, inbuf);
++      crc = asm_vpmsumd(k4k3, crc);
++      crc ^= v0;
++
++      inbuf += 16;
++      inlen -= 16;
++    }
++
++  /* Partial fold. */
++  if (inlen)
++    {
++      /* Load last input and add padding zeros. */
++      vector2x_u64 mask = CRC_VEC_U64_LOAD_LE(inlen, crc32_partial_fold_input_mask);
++      vector2x_u64 shl_shuf = CRC_VEC_U64_LOAD_LE(32 - inlen, crc32_refl_shuf_shift);
++      vector2x_u64 shr_shuf = CRC_VEC_U64_LOAD_LE(inlen + 16, crc32_shuf_shift);
++
++      v0 = CRC_VEC_U64_LOAD_LE(inlen - 16, inbuf);
++      v0 &= mask;
++
++      crc = CRC_VEC_SWAP_TO_LE(crc);
++      crc2 = (vector2x_u64)vec_perm((vector16x_u8)crc, (vector16x_u8)zero,
++				    (vector16x_u8)shr_shuf);
++      v0 |= crc2;
++      v0 = CRC_VEC_SWAP(v0);
++      crc = (vector2x_u64)vec_perm((vector16x_u8)crc, (vector16x_u8)zero,
++				   (vector16x_u8)shl_shuf);
++      crc = asm_vpmsumd(k4k3, crc);
++      crc ^= v0;
++
++      inbuf += inlen;
++      inlen -= inlen;
++    }
++
++  /* Final fold. */
++
++  /* reduce 128-bits to 96-bits */
++  v0 = (vector2x_u64)vec_sld_u32((vector4x_u32)crc,
++				 (vector4x_u32)zero, 2);
++  crc = asm_vpmsumd(k4hi, crc);
++  crc ^= v0; /* bottom 32-bit are zero */
++
++  /* reduce 96-bits to 64-bits */
++  v0 = crc & low_96bit_mask;    /* [00][x2][x1][00] */
++  crc >>= 32;                   /* [00][x3][00][x0] */
++  crc = asm_vpmsumd(k5hi, crc); /* [00][xx][xx][00] */
++  crc ^= v0;                    /* top and bottom 32-bit are zero */
++
++  /* barrett reduction */
++  p_my_hi = p_my;
++  p_my_lo = p_my;
++  p_my_hi[VEC_U64_LO] = 0;
++  p_my_lo[VEC_U64_HI] = 0;
++  v0 = crc >> 32;                                        /* [00][00][00][x1] */
++  crc = asm_vpmsumd(p_my_hi, crc);                       /* [00][xx][xx][xx] */
++  crc = (vector2x_u64)vec_sld_u32((vector4x_u32)crc,
++				  (vector4x_u32)crc, 3); /* [x0][00][x2][x1] */
++  crc = asm_vpmsumd(p_my_lo, crc);                       /* [00][xx][xx][xx] */
++  crc ^= v0;
++
++  *pcrc = _gcry_bswap32(crc[VEC_U64_LO]);
++}
++
++
++static ASM_FUNC_ATTR_INLINE u32
++crc32_ppc8_ce_reduction_4 (u32 data, u32 crc,
++			   const struct crc32_consts_s *consts)
++{
++  vector2x_u64 my_p = CRC_VEC_U64_LOAD(0, &consts->my_p[0]);
++  vector2x_u64 v0 = CRC_VEC_U64_DEF((u64)data << 32, 0);
++  v0 = asm_vpmsumd(v0, my_p); /* [00][x1][x0][00] */
++  v0[VEC_U64_LO] = 0;         /* [00][x1][00][00] */
++  v0 = asm_vpmsumd(v0, my_p); /* [00][00][xx][xx] */
++  return _gcry_bswap32(v0[VEC_U64_LO]) ^ crc;
++}
++
++
++static ASM_FUNC_ATTR_INLINE void
++crc32_less_than_16 (u32 *pcrc, const byte *inbuf, size_t inlen,
++		    const struct crc32_consts_s *consts)
++{
++  u32 crc = *pcrc;
++  u32 data;
++
++  while (inlen >= 4)
++    {
++      data = buf_get_le32(inbuf);
++      data ^= crc;
++      data = _gcry_bswap32(data);
++
++      inlen -= 4;
++      inbuf += 4;
++
++      crc = crc32_ppc8_ce_reduction_4 (data, 0, consts);
++    }
++
++  switch (inlen)
++    {
++    case 0:
++      break;
++    case 1:
++      data = inbuf[0];
++      data ^= crc;
++      data = data & 0xffU;
++      crc = crc >> 8;
++      crc = crc32_ppc8_ce_reduction_4 (data, crc, consts);
++      break;
++    case 2:
++      data = inbuf[0] << 0;
++      data |= inbuf[1] << 8;
++      data ^= crc;
++      data = _gcry_bswap32(data << 16);
++      crc = crc >> 16;
++      crc = crc32_ppc8_ce_reduction_4 (data, crc, consts);
++      break;
++    case 3:
++      data = inbuf[0] << 0;
++      data |= inbuf[1] << 8;
++      data |= inbuf[2] << 16;
++      data ^= crc;
++      data = _gcry_bswap32(data << 8);
++      crc = crc >> 24;
++      crc = crc32_ppc8_ce_reduction_4 (data, crc, consts);
++      break;
++    }
++
++  *pcrc = crc;
++}
++
++void ASM_FUNC_ATTR
++_gcry_crc32_ppc8_vpmsum (u32 *pcrc, const byte *inbuf, size_t inlen)
++{
++  const struct crc32_consts_s *consts = &crc32_consts;
++
++  if (!inlen)
++    return;
++
++  if (inlen >= 16)
++    crc32r_ppc8_ce_bulk (pcrc, inbuf, inlen, consts);
++  else
++    crc32r_less_than_16 (pcrc, inbuf, inlen, consts);
++}
++
++void ASM_FUNC_ATTR
++_gcry_crc24rfc2440_ppc8_vpmsum (u32 *pcrc, const byte *inbuf, size_t inlen)
++{
++  const struct crc32_consts_s *consts = &crc24rfc2440_consts;
++
++  if (!inlen)
++    return;
++
++  /* Note: *pcrc in input endian. */
++
++  if (inlen >= 16)
++    crc32_ppc8_ce_bulk (pcrc, inbuf, inlen, consts);
++  else
++    crc32_less_than_16 (pcrc, inbuf, inlen, consts);
++}
++
++#endif
+diff --git a/cipher/crc.c b/cipher/crc.c
+index a1ce50b6..bbb159ce 100644
+--- a/cipher/crc.c
++++ b/cipher/crc.c
+@@ -43,11 +43,27 @@
+ #endif /* USE_INTEL_PCLMUL */
+ 
+ 
++/* USE_PPC_VPMSUM indicates whether to enable PowerPC vector
++ * accelerated code. */
++#undef USE_PPC_VPMSUM
++#ifdef ENABLE_PPC_CRYPTO_SUPPORT
++# if defined(HAVE_COMPATIBLE_CC_PPC_ALTIVEC) && \
++     defined(HAVE_GCC_INLINE_ASM_PPC_ALTIVEC)
++#  if __GNUC__ >= 4
++#   define USE_PPC_VPMSUM 1
++#  endif
++# endif
++#endif /* USE_PPC_VPMSUM */
++
++
+ typedef struct
+ {
+   u32 CRC;
+ #ifdef USE_INTEL_PCLMUL
+   unsigned int use_pclmul:1;           /* Intel PCLMUL shall be used.  */
++#endif
++#ifdef USE_PPC_VPMSUM
++  unsigned int use_vpmsum:1;           /* POWER vpmsum shall be used. */
+ #endif
+   byte buf[4];
+ }
+@@ -61,6 +77,20 @@ void _gcry_crc24rfc2440_intel_pclmul (u32 *pcrc, const byte *inbuf,
+ 				      size_t inlen);
+ #endif
+ 
++#ifdef USE_ARM_PMULL
++/*-- crc-armv8-ce.c --*/
++void _gcry_crc32_armv8_ce_pmull (u32 *pcrc, const byte *inbuf, size_t inlen);
++void _gcry_crc24rfc2440_armv8_ce_pmull (u32 *pcrc, const byte *inbuf,
++					size_t inlen);
++#endif
++
++#ifdef USE_PPC_VPMSUM
++/*-- crc-ppc.c --*/
++void _gcry_crc32_ppc8_vpmsum (u32 *pcrc, const byte *inbuf, size_t inlen);
++void _gcry_crc24rfc2440_ppc8_vpmsum (u32 *pcrc, const byte *inbuf,
++				     size_t inlen);
++#endif
++
+ 
+ /*
+  * Code generated by universal_crc by Danjel McGougan
+@@ -361,11 +391,13 @@ static void
+ crc32_init (void *context, unsigned int flags)
+ {
+   CRC_CONTEXT *ctx = (CRC_CONTEXT *) context;
+-#ifdef USE_INTEL_PCLMUL
+   u32 hwf = _gcry_get_hw_features ();
+-
++#ifdef USE_INTEL_PCLMUL
+   ctx->use_pclmul = (hwf & HWF_INTEL_SSE4_1) && (hwf & HWF_INTEL_PCLMUL);
+ #endif
++#ifdef USE_PPC_VPMSUM
++  ctx->use_vpmsum = !!(hwf & HWF_PPC_ARCH_2_07);
++#endif
+ 
+   (void)flags;
+ 
+@@ -386,6 +418,13 @@ crc32_write (void *context, const void *inbuf_arg, size_t inlen)
+       return;
+     }
+ #endif
++#ifdef USE_PPC_VPMSUM
++  if (ctx->use_vpmsum)
++    {
++      _gcry_crc32_ppc8_vpmsum(&ctx->CRC, inbuf, inlen);
++      return;
++    }
++#endif
+ 
+   if (!inbuf || !inlen)
+     return;
+@@ -444,6 +483,10 @@ crc32rfc1510_init (void *context, unsigned int flags)
+ 
+   ctx->use_pclmul = (hwf & HWF_INTEL_SSE4_1) && (hwf & HWF_INTEL_PCLMUL);
+ #endif
++#ifdef USE_PPC_VPMSUM
++  u32 hwf = _gcry_get_hw_features ();
++  ctx->use_vpmsum = !!(hwf & HWF_PPC_ARCH_2_07);
++#endif
+ 
+   (void)flags;
+ 
+@@ -774,6 +817,10 @@ crc24rfc2440_init (void *context, unsigned int flags)
+ 
+   ctx->use_pclmul = (hwf & HWF_INTEL_SSE4_1) && (hwf & HWF_INTEL_PCLMUL);
+ #endif
++#ifdef USE_PPC_VPMSUM
++  u32 hwf = _gcry_get_hw_features ();
++  ctx->use_vpmsum = !!(hwf & HWF_PPC_ARCH_2_07);
++#endif
+ 
+   (void)flags;
+ 
+@@ -794,6 +841,13 @@ crc24rfc2440_write (void *context, const void *inbuf_arg, size_t inlen)
+       return;
+     }
+ #endif
++#ifdef USE_PPC_VPMSUM
++  if (ctx->use_vpmsum)
++    {
++      _gcry_crc24rfc2440_ppc8_vpmsum(&ctx->CRC, inbuf, inlen);
++      return;
++    }
++#endif
+ 
+   if (!inbuf || !inlen)
+     return;
+diff --git a/configure.ac b/configure.ac
+index 953a20e9..b6b6455a 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -1916,6 +1916,7 @@ AC_CACHE_CHECK([whether GCC inline assembler supports PowerPC AltiVec/VSX/crypto
+ 		    "vadduwm %v0, %v1, %v22;\n"
+ 		    "vshasigmaw %v0, %v1, 0, 15;\n"
+ 		    "vshasigmad %v0, %v1, 0, 15;\n"
++		    "vpmsumd %v11, %v11, %v11;\n"
+ 		  );
+             ]])],
+           [gcry_cv_gcc_inline_asm_ppc_altivec=yes])
+@@ -2556,6 +2557,15 @@ if test "$found" = "1" ; then
+          # Build with the assembly implementation
+          GCRYPT_DIGESTS="$GCRYPT_DIGESTS crc-intel-pclmul.lo"
+       ;;
++      powerpc64le-*-*)
++         GCRYPT_CIPHERS="$GCRYPT_CIPHERS crc-ppc.lo"
++      ;;
++      powerpc64-*-*)
++         GCRYPT_CIPHERS="$GCRYPT_CIPHERS crc-ppc.lo"
++      ;;
++      powerpc-*-*)
++         GCRYPT_CIPHERS="$GCRYPT_CIPHERS crc-ppc.lo"
++      ;;
+    esac
+ fi

SOURCES/libgcrypt-1.8.5-use-fipscheck.patch

@@ -1,7 +1,7 @@
-diff -up libgcrypt-1.6.2/src/fips.c.use-fipscheck libgcrypt-1.6.2/src/fips.c
---- libgcrypt-1.6.2/src/fips.c.use-fipscheck	2014-08-21 14:50:39.000000000 +0200
-+++ libgcrypt-1.6.2/src/fips.c	2014-09-26 11:42:20.999588282 +0200
-@@ -578,23 +578,50 @@ run_random_selftests (void)
+diff -up libgcrypt-1.8.5/src/fips.c.use-fipscheck libgcrypt-1.8.5/src/fips.c
+--- libgcrypt-1.8.5/src/fips.c.use-fipscheck	2017-11-23 19:16:58.000000000 +0100
++++ libgcrypt-1.8.5/src/fips.c	2020-04-23 10:18:36.235764741 +0200
+@@ -581,23 +581,50 @@ run_random_selftests (void)
    return !!err;
  }
  
@@ -57,7 +57,7 @@ diff -up libgcrypt-1.6.2/src/fips.c.use-fipscheck libgcrypt-1.6.2/src/fips.c
                                   key, strlen (key));
        if (dlen < 0)
          err = gpg_error_from_syserror ();
-@@ -602,7 +629,7 @@ check_binary_integrity (void)
+@@ -605,7 +632,7 @@ check_binary_integrity (void)
          err = gpg_error (GPG_ERR_INTERNAL);
        else
          {
@@ -66,7 +66,7 @@ diff -up libgcrypt-1.6.2/src/fips.c.use-fipscheck libgcrypt-1.6.2/src/fips.c
            if (!fname)
              err = gpg_error_from_syserror ();
            else
-@@ -611,7 +638,7 @@ check_binary_integrity (void)
+@@ -614,7 +641,7 @@ check_binary_integrity (void)
                char *p;
  
                /* Prefix the basename with a dot.  */
@@ -75,15 +75,15 @@ diff -up libgcrypt-1.6.2/src/fips.c.use-fipscheck libgcrypt-1.6.2/src/fips.c
                p = strrchr (fname, '/');
                if (p)
                  p++;
-diff -up libgcrypt-1.6.2/src/Makefile.in.use-fipscheck libgcrypt-1.6.2/src/Makefile.in
---- libgcrypt-1.6.2/src/Makefile.in.use-fipscheck	2014-08-21 15:14:08.000000000 +0200
-+++ libgcrypt-1.6.2/src/Makefile.in	2014-09-26 11:41:13.271059281 +0200
-@@ -449,7 +449,7 @@ libgcrypt_la_LIBADD = $(gcrypt_res) \
+diff -up libgcrypt-1.8.5/src/Makefile.am.use-fipscheck libgcrypt-1.8.5/src/Makefile.am
+--- libgcrypt-1.8.5/src/Makefile.am.use-fipscheck	2020-04-23 10:18:36.237764702 +0200
++++ libgcrypt-1.8.5/src/Makefile.am	2020-04-23 10:19:03.186247455 +0200
+@@ -125,7 +125,7 @@ libgcrypt_la_LIBADD = $(gcrypt_res) \
  	../cipher/libcipher.la \
  	../random/librandom.la \
  	../mpi/libmpi.la \
 -	../compat/libcompat.la  $(GPG_ERROR_LIBS)
 +	../compat/libcompat.la  $(GPG_ERROR_LIBS) -ldl
  
+ 
  dumpsexp_SOURCES = dumpsexp.c
- dumpsexp_CFLAGS = $(arch_gpg_error_cflags)

SOURCES/libgcrypt-1.9.3-CVE-2021-40528.patch

@@ -0,0 +1,100 @@
+commit 3462280f2e23e16adf3ed5176e0f2413d8861320
+Author: NIIBE Yutaka <gniibe@fsij.org>
+Date:   Fri May 21 11:15:07 2021 +0900
+
+    cipher: Fix ElGamal encryption for other implementations.
+    
+    * cipher/elgamal.c (gen_k): Remove support of smaller K.
+    (do_encrypt): Never use smaller K.
+    (sign): Folllow the change of gen_k.
+    
+    --
+    
+    Cherry-pick master commit of:
+            632d80ef30e13de6926d503aa697f92b5dbfbc5e
+    
+    This change basically reverts encryption changes in two commits:
+    
+            74386120dad6b3da62db37f7044267c8ef34689b
+            78531373a342aeb847950f404343a05e36022065
+    
+    Use of smaller K for ephemeral key in ElGamal encryption is only good,
+    when we can guarantee that recipient's key is generated by our
+    implementation (or compatible).
+    
+    For detail, please see:
+    
+        Luca De Feo, Bertram Poettering, Alessandro Sorniotti,
+        "On the (in)security of ElGamal in OpenPGP";
+        in the proceedings of  CCS'2021.
+    
+    CVE-id: CVE-2021-33560
+    GnuPG-bug-id: 5328
+    Suggested-by: Luca De Feo, Bertram Poettering, Alessandro Sorniotti
+    Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
+
+diff --git a/cipher/elgamal.c b/cipher/elgamal.c
+index 9835122f..eead4502 100644
+--- a/cipher/elgamal.c
++++ b/cipher/elgamal.c
+@@ -66,7 +66,7 @@ static const char *elg_names[] =
+ 
+ 
+ static int test_keys (ELG_secret_key *sk, unsigned int nbits, int nodie);
+-static gcry_mpi_t gen_k (gcry_mpi_t p, int small_k);
++static gcry_mpi_t gen_k (gcry_mpi_t p);
+ static gcry_err_code_t generate (ELG_secret_key *sk, unsigned nbits,
+                                  gcry_mpi_t **factors);
+ static int  check_secret_key (ELG_secret_key *sk);
+@@ -189,11 +189,10 @@ test_keys ( ELG_secret_key *sk, unsigned int nbits, int nodie )
+ 
+ /****************
+  * Generate a random secret exponent k from prime p, so that k is
+- * relatively prime to p-1.  With SMALL_K set, k will be selected for
+- * better encryption performance - this must never be used signing!
++ * relatively prime to p-1.
+  */
+ static gcry_mpi_t
+-gen_k( gcry_mpi_t p, int small_k )
++gen_k( gcry_mpi_t p )
+ {
+   gcry_mpi_t k = mpi_alloc_secure( 0 );
+   gcry_mpi_t temp = mpi_alloc( mpi_get_nlimbs(p) );
+@@ -202,18 +201,7 @@ gen_k( gcry_mpi_t p, int small_k )
+   unsigned int nbits, nbytes;
+   char *rndbuf = NULL;
+ 
+-  if (small_k)
+-    {
+-      /* Using a k much lesser than p is sufficient for encryption and
+-       * it greatly improves the encryption performance.  We use
+-       * Wiener's table and add a large safety margin. */
+-      nbits = wiener_map( orig_nbits ) * 3 / 2;
+-      if( nbits >= orig_nbits )
+-        BUG();
+-    }
+-  else
+-    nbits = orig_nbits;
+-
++  nbits = orig_nbits;
+ 
+   nbytes = (nbits+7)/8;
+   if( DBG_CIPHER )
+@@ -492,7 +480,7 @@ do_encrypt(gcry_mpi_t a, gcry_mpi_t b, gcry_mpi_t input, ELG_public_key *pkey )
+    * error code.
+    */
+ 
+-  k = gen_k( pkey->p, 1 );
++  k = gen_k( pkey->p );
+   mpi_powm (a, pkey->g, k, pkey->p);
+ 
+   /* b = (y^k * input) mod p
+@@ -608,7 +596,7 @@ sign(gcry_mpi_t a, gcry_mpi_t b, gcry_mpi_t input, ELG_secret_key *skey )
+     *
+     */
+     mpi_sub_ui(p_1, p_1, 1);
+-    k = gen_k( skey->p, 0 /* no small K ! */ );
++    k = gen_k( skey->p );
+     mpi_powm( a, skey->g, k, skey->p );
+     mpi_mul(t, skey->x, a );
+     mpi_subm(t, input, t, p_1 );

SPECS/libgcrypt.spec

@@ -1,6 +1,6 @@
 Name: libgcrypt
-Version: 1.8.3
-Release: 4%{?dist}
+Version: 1.8.5
+Release: 7%{?dist}
 URL: http://www.gnupg.org/
 Source0: libgcrypt-%{version}-hobbled.tar.xz
 # The original libgcrypt sources now contain potentially patented ECC
@@ -18,13 +18,15 @@ Source6: t-mpi-point.c
 Source7: random.conf
 # make FIPS hmac compatible with fipscheck - non upstreamable
 # update on soname bump
-Patch2: libgcrypt-1.6.2-use-fipscheck.patch
-# fix tests in the FIPS mode, allow CAVS testing of DSA keygen
-Patch5: libgcrypt-1.8.0-tests.patch
+Patch2: libgcrypt-1.8.5-use-fipscheck.patch
+# modify FIPS RSA and DSA keygen to comply with requirements
+Patch5: libgcrypt-1.8.4-fips-keygen.patch
+# fix the tests to work correctly in the FIPS mode
+Patch6: libgcrypt-1.8.4-tests-fipsmode.patch
 # update the CAVS tests
 Patch7: libgcrypt-1.7.3-fips-cavs.patch
 # use poll instead of select when gathering randomness
-Patch11: libgcrypt-1.8.0-use-poll.patch
+Patch11: libgcrypt-1.8.4-use-poll.patch
 # slight optimalization of mpicoder.c to silence Valgrind (#968288)
 Patch13: libgcrypt-1.6.1-mpicoder-gccopt.patch
 # fix tests to work with approved ECC
@@ -34,13 +36,39 @@ Patch18: libgcrypt-1.8.3-fips-ctor.patch
 # Block some operations if in FIPS non-operational state
 Patch22: libgcrypt-1.7.3-fips-reqs.patch
 # Do not try to open /dev/urandom if getrandom() works
-Patch24: libgcrypt-1.8.3-getrandom.patch
+Patch24: libgcrypt-1.8.5-getrandom.patch
 # CMAC selftest for FIPS POST
 Patch25: libgcrypt-1.8.3-cmac-selftest.patch
 # Continuous FIPS entropy test
 Patch26: libgcrypt-1.8.3-fips-enttest.patch
 # Disable non-approved FIPS hashes in the enforced FIPS mode
 Patch27: libgcrypt-1.8.3-md-fips-enforce.patch
+# Intel CET support, in upstream master
+Patch28: libgcrypt-1.8.5-intel-cet.patch
+# Fix build on ARMv7
+Patch29: libgcrypt-1.8.5-build.patch
+# FIPS module is redefined a little bit (implicit by kernel FIPS mode)
+Patch30: libgcrypt-1.8.5-fips-module.patch
+# Backported AES performance improvements
+Patch31: libgcrypt-1.8.5-aes-perf.patch
+# FIPS selftest for PBKDF2
+Patch32: libgcrypt-1.8.5-kdf-selftest.patch
+# ppc64 performance for SHA2 (#1855231)
+Patch33: libgcrypt-1.8.5-ppc-sha2.patch
+# ppc64 performance for CRC32 (#1855231)
+Patch34: libgcrypt-1.8.5-ppc-crc32.patch
+# ppc64 bugfixes (#1855231)
+Patch35: libgcrypt-1.8.5-ppc-bugfix.patch
+# ppc64 performance AES-GCM (#1855231)
+Patch36: libgcrypt-1.8.5-ppc-aes-gcm.patch
+# Fix elgamal cross-configuration (CVE-2021-40528)
+Patch37: libgcrypt-1.9.3-CVE-2021-40528.patch
+# We can use HW optimizations in FIPS (#1976137)
+Patch38: libgcrypt-1.8.5-fips-hwfeatures.patch
+# ppc64 performance chacha20 and poly1305 (#1855231)
+Patch39: libgcrypt-1.8.5-ppc-chacha20-poly1305.patch
+# Fix CVE-2021-33560 (elgamal blinding)
+Patch40: libgcrypt-1.8.5-elgamal-blinding.patch
 
 %define gcrylibdir %{_libdir}
 
@@ -54,12 +82,11 @@ BuildRequires: gawk, libgpg-error-devel >= 1.11, pkgconfig
 BuildRequires: fipscheck
 # This is needed only when patching the .texi doc.
 BuildRequires: texinfo
-Group: System Environment/Libraries
+BuildRequires: autoconf, automake, libtool
 
 %package devel
 Summary: Development files for the %{name} package
 License: LGPLv2+ and GPLv2+
-Group: Development/Libraries
 Requires(pre): /sbin/install-info
 Requires(post): /sbin/install-info
 Requires: libgpg-error-devel
@@ -78,7 +105,8 @@ applications using libgcrypt.
 %setup -q
 %{SOURCE3}
 %patch2 -p1 -b .use-fipscheck
-%patch5 -p1 -b .tests
+%patch5 -p1 -b .fips-keygen
+%patch6 -p1 -b .tests-fipsmode
 %patch7 -p1 -b .cavs
 %patch11 -p1 -b .use-poll
 %patch13 -p1 -b .gccopt
@@ -89,11 +117,25 @@ applications using libgcrypt.
 %patch25 -p1 -b .cmac-selftest
 %patch26 -p1 -b .fips-enttest
 %patch27 -p1 -b .fips-enforce
+%patch28 -p1 -b .intel-cet
+%patch29 -p1 -b .build
+%patch30 -p1 -b .fips-module
+%patch31 -p1 -b .aes-perf
+%patch32 -p1 -b .kdf-selftest
+%patch33 -p1 -b .ppc-sha2
+%patch34 -p1 -b .ppc-crc32
+%patch35 -p1 -b .ppc-bugfix
+%patch36 -p1 -b .ppc-aes-gcm
+%patch37 -p1 -b .CVE-2021-40528
+%patch38 -p1 -b .hw-fips
+%patch39 -p1 -b .ppc-chacha
+%patch40 -p1 -b .elgamal-blinding
 
 cp %{SOURCE4} cipher/
 cp %{SOURCE5} %{SOURCE6} tests/
 
 %build
+autoreconf -f
 %configure --disable-static \
 %ifarch sparc64
      --disable-asm \
@@ -161,6 +203,9 @@ popd
 mkdir -p -m 755 $RPM_BUILD_ROOT/etc/gcrypt
 install -m644 %{SOURCE7} $RPM_BUILD_ROOT/etc/gcrypt/random.conf
 
+# Drop the pkgconfig as it would require an updated libgpg-error
+rm $RPM_BUILD_ROOT/%{_libdir}/pkgconfig/libgcrypt.pc
+
 %post -p /sbin/ldconfig
 
 %postun -p /sbin/ldconfig
@@ -200,6 +245,26 @@ exit 0
 %license COPYING
 
 %changelog
+* Tue Apr 05 2022 Jakub Jelen <jjelen@redhat.com> - 1.8.5-7
+- Fix CVE-2021-33560 (#2018525)
+
+* Mon Jun 28 2021 Jakub Jelen <jjelen@redhat.com> - 1.8.5-6
+- Fix for CVE-2021-40528 (#1971421)
+- Enable HW optimizations in FIPS (#1976137)
+- Performance enchancements for ChaCha20 and Poly1305 (#1855231)
+
+* Thu May 13 2021 Jakub Jelen <jjelen@redhat.com> - 1.8.5-5
+- Performance enchancements for AES-GCM, CRC32 and SHA2 (#1855231)
+
+* Mon Jun 15 2020 Tomáš Mráz <tmraz@redhat.com> 1.8.5-4
+- add PBKDF2 selftest for FIPS POST
+
+* Tue Apr 28 2020 Tomáš Mráz <tmraz@redhat.com> 1.8.5-3
+- new upstream version 1.8.5
+- AES performance improvements backported from master branch
+- FIPS module is implicit with kernel FIPS flag
+- always run the FIPS selftests if FIPS module is installed
+
 * Mon Jun 24 2019 Tomáš Mráz <tmraz@redhat.com> 1.8.3-4
 - improve the continuous FIPS entropy test