- FIPS specific openssl config is not required in RHEL/Fedora

libica-no-fips-config.patch

@@ -0,0 +1,33 @@
+From 56b6ca219ecd37ba2c7e520ddac83eb801ce76ad Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Dan=20Hor=C3=A1k?= <dan@danny.cz>
+Date: Mon, 16 May 2022 15:44:06 +0200
+Subject: [libica PATCH] FIPS specific openssl config is not required in
+ RHEL/Fedora
+
+---
+ src/fips.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/fips.c b/src/fips.c
+index 129a1a7..6466133 100644
+--- a/src/fips.c
++++ b/src/fips.c
+@@ -235,12 +235,15 @@ fips_init(void)
+ 		FIPS_mode_set(1);
+ #else
+ 		fips = 0;
++		/* FIPS specific openssl config is not required in RHEL/Fedora */
++#if 0
+ 		if (!OSSL_LIB_CTX_load_config(openssl_libctx, LIBICA_FIPS_CONFIG)) {
+ 			syslog(LOG_ERR, "Libica failed to load openssl fips config %s\n",
+ 					LIBICA_FIPS_CONFIG);
+ 			fips |= ICA_FIPS_INTEGRITY;
+ 			return;
+ 		}
++#endif
+ 
+ 		openssl_provider = OSSL_PROVIDER_load(openssl_libctx, "fips");
+ 		if (openssl_provider == NULL) {
+-- 
+2.34.3
+

libica.spec

@@ -11,6 +11,9 @@ Source0: https://github.com/opencryptoki/%{name}/archive/v%{version}/%{name}-%{v
 # https://bugzilla.redhat.com/show_bug.cgi?id=1630582
 # https://github.com/opencryptoki/libica/pull/24
 Patch0: %{name}-4.0.0-annotate.patch
+# FIPS openssl config is not needed on RHEL/Fedora
+# https://bugzilla.redhat.com/show_bug.cgi?id=2084097
+Patch1: %{name}-no-fips-config.patch
 BuildRequires: gcc
 BuildRequires: openssl-devel
 BuildRequires: openssl
@@ -85,8 +88,7 @@ fi
 %if %{with_fips}
 %if 0%{?fedora} >= 36 || 0%{?rhel} >= 9
 # openssl 3.0 is available since Fedora 36 and RHEL 9
-%dir %{_sysconfdir}/libica
-%{_sysconfdir}/libica/openssl3-fips.cnf
+%exclude %{_sysconfdir}/libica/openssl3-fips.cnf
 %endif
 %{_libdir}/.libica.*.hmac
 %{_libdir}/.libica-cex.*.hmac
@@ -104,8 +106,8 @@ fi
 
 
 %changelog
-* Fri May 13 2022 Dan Horák <dan[at]danny.cz> - 4.0.1-2
-- provide RHEL/Fedora-compatible openssl3 FIPS config
+* Mon May 16 2022 Dan Horák <dan[at]danny.cz> - 4.0.1-2
+- FIPS specific openssl config is not required in RHEL/Fedora
 
 * Tue Feb 08 2022 Dan Horák <dan[at]danny.cz> - 4.0.1-1
 - updated to 4.0.1