diff --git a/.gitignore b/.gitignore
index 4d1eec9..c1aad31 100644
--- a/.gitignore
+++ b/.gitignore
@@ -246,3 +246,5 @@ libselinux-2.0.96.tgz
 /libselinux-3.9.tar.gz.asc
 /libselinux-3.10.tar.gz
 /libselinux-3.10.tar.gz.asc
+/libselinux-3.11.tar.gz
+/libselinux-3.11.tar.gz.asc
diff --git a/0001-Use-SHA-2-instead-of-SHA-1.patch b/0001-Use-SHA-2-instead-of-SHA-1.patch
index 823fac5..3473914 100644
--- a/0001-Use-SHA-2-instead-of-SHA-1.patch
+++ b/0001-Use-SHA-2-instead-of-SHA-1.patch
@@ -1,7 +1,8 @@
-From f7d9065003f00606b216aba0a913c3568e2880e7 Mon Sep 17 00:00:00 2001
+From cbaf1040c655bd544eedca3b8e070720dfc3b2be Mon Sep 17 00:00:00 2001
 From: Petr Lautrbach <plautrba@redhat.com>
 Date: Fri, 30 Jul 2021 14:14:37 +0200
 Subject: [PATCH] Use SHA-2 instead of SHA-1
+Content-type: text/plain
 
 The use of SHA-1 in RHEL9 is deprecated
 ---
@@ -12,28 +13,28 @@ The use of SHA-1 in RHEL9 is deprecated
  libselinux/man/man3/selinux_restorecon.3      |  18 +-
  .../man/man3/selinux_restorecon_xattr.3       |   2 +-
  libselinux/src/Makefile                       |   2 +-
- libselinux/src/label_file.c                   |  40 +--
- libselinux/src/label_internal.h               |  10 +-
- libselinux/src/label_support.c                |  10 +-
- libselinux/src/selinux_restorecon.c           |  24 +-
- libselinux/src/sha1.c                         | 223 -------------
- libselinux/src/sha1.h                         |  85 -----
+ libselinux/src/label_file.c                   |  46 +--
+ libselinux/src/label_internal.h               |  18 +-
+ libselinux/src/label_support.c                |  17 +-
+ libselinux/src/selinux_restorecon.c           |  48 ++-
+ libselinux/src/sha1.c                         | 284 -----------------
+ libselinux/src/sha1.h                         |  68 ----
  libselinux/src/sha256.c                       | 294 ++++++++++++++++++
  libselinux/src/sha256.h                       |  89 ++++++
  libselinux/utils/selabel_digest.c             |  26 +-
  .../selabel_get_digests_all_partial_matches.c |  28 +-
- 17 files changed, 471 insertions(+), 396 deletions(-)
+ 17 files changed, 501 insertions(+), 455 deletions(-)
  delete mode 100644 libselinux/src/sha1.c
  delete mode 100644 libselinux/src/sha1.h
  create mode 100644 libselinux/src/sha256.c
  create mode 100644 libselinux/src/sha256.h
 
 diff --git a/libselinux/include/selinux/label.h b/libselinux/include/selinux/label.h
-index ce189a3a..ce77d32d 100644
+index 05e1fd569980..0e683ff2ad3c 100644
 --- a/libselinux/include/selinux/label.h
 +++ b/libselinux/include/selinux/label.h
-@@ -120,13 +120,13 @@ extern int selabel_lookup_best_match_raw(struct selabel_handle *rec, char **con,
- 					 const char *key, const char **aliases, int type);
+@@ -123,13 +123,13 @@ extern int selabel_lookup_best_match_raw(struct selabel_handle *rec, char **con,
+ 					 int type);
  
  /**
 - * selabel_digest - Retrieve the SHA1 digest and the list of specfiles used to
@@ -50,7 +51,7 @@ index ce189a3a..ce77d32d 100644
   * @num_specfiles: number of specfiles in the list.
   *
 diff --git a/libselinux/include/selinux/restorecon.h b/libselinux/include/selinux/restorecon.h
-index 65aaef23..161b23b9 100644
+index 6680589ec659..c8356de9ebeb 100644
 --- a/libselinux/include/selinux/restorecon.h
 +++ b/libselinux/include/selinux/restorecon.h
 @@ -43,8 +43,8 @@ extern int selinux_restorecon_parallel(const char *pathname,
@@ -62,10 +63,10 @@ index 65aaef23..161b23b9 100644
 + * Force the checking of labels even if the stored SHA256 digest
 + * matches the specfiles SHA256 digest (requires CAP_SYS_ADMIN).
   */
- #define SELINUX_RESTORECON_IGNORE_DIGEST		0x00001
+ #define SELINUX_RESTORECON_IGNORE_DIGEST 0x00001
  /*
 diff --git a/libselinux/man/man3/selabel_digest.3 b/libselinux/man/man3/selabel_digest.3
-index 56a008f0..5f7c4253 100644
+index 56a008f00df0..5f7c42533d0e 100644
 --- a/libselinux/man/man3/selabel_digest.3
 +++ b/libselinux/man/man3/selabel_digest.3
 @@ -20,11 +20,11 @@ selabel_digest \- Return digest of specfiles and list of files used
@@ -83,7 +84,7 @@ index 56a008f0..5f7c4253 100644
  with the number of entries in
  .IR num_specfiles .
 diff --git a/libselinux/man/man3/selabel_open.3 b/libselinux/man/man3/selabel_open.3
-index 0e03e1be..14ab888d 100644
+index 0e03e1be111e..14ab888d2e03 100644
 --- a/libselinux/man/man3/selabel_open.3
 +++ b/libselinux/man/man3/selabel_open.3
 @@ -69,7 +69,7 @@ is used; a custom validation function can be provided via
@@ -96,7 +97,7 @@ index 0e03e1be..14ab888d 100644
  .BR selabel_digest (3)
  .
 diff --git a/libselinux/man/man3/selinux_restorecon.3 b/libselinux/man/man3/selinux_restorecon.3
-index 218aaf6d..5f6d4b38 100644
+index 9bcd3d42bb45..3f283c4f4273 100644
 --- a/libselinux/man/man3/selinux_restorecon.3
 +++ b/libselinux/man/man3/selinux_restorecon.3
 @@ -36,7 +36,7 @@ If this is a directory and the
@@ -137,7 +138,7 @@ index 218aaf6d..5f6d4b38 100644
  extended attribute as described in the
  .B NOTES
  section.
-@@ -179,12 +179,12 @@ for fetching the ignored (skipped) error count after
+@@ -179,7 +179,7 @@ for fetching the ignored (skipped) error count after
  or
  .BR selinux_restorecon_parallel (3)
  completes with success. In case any errors were skipped during the file tree
@@ -145,6 +146,9 @@ index 218aaf6d..5f6d4b38 100644
 +walk, the specfile entries SHA256 digest will not have been written to the
  .IR security.sehash
  extended attribute.
+ .sp
+@@ -197,7 +197,7 @@ Use this option when relabeling untrusted directories that might
+ contain hard links to files owned by others.
  .RE
  .sp
 -The behavior regarding the checking and updating of the SHA1 digest described
@@ -152,7 +156,7 @@ index 218aaf6d..5f6d4b38 100644
  above is the default behavior. It is possible to change this by first calling
  .BR selabel_open (3)
  and not enabling the
-@@ -247,7 +247,7 @@ To improve performance when relabeling file systems recursively (e.g. the
+@@ -260,7 +260,7 @@ To improve performance when relabeling file systems recursively (e.g. the
  .B SELINUX_RESTORECON_RECURSE
  flag is set)
  .BR selinux_restorecon ()
@@ -161,7 +165,7 @@ index 218aaf6d..5f6d4b38 100644
  .BR selabel_get_digests_all_partial_matches (3)
  to an extended attribute named
  .IR security.sehash
-@@ -269,7 +269,7 @@ Should any of the specfile entries have changed, then when
+@@ -282,7 +282,7 @@ Should any of the specfile entries have changed, then when
  .BR selinux_restorecon ()
  is run again with the
  .B SELINUX_RESTORECON_RECURSE
@@ -171,7 +175,7 @@ index 218aaf6d..5f6d4b38 100644
  .B SELINUX_RESTORECON_SET_SPECFILE_CTX
  flag (provided
 diff --git a/libselinux/man/man3/selinux_restorecon_xattr.3 b/libselinux/man/man3/selinux_restorecon_xattr.3
-index c5632681..098c840f 100644
+index c56326814b94..098c840fc59b 100644
 --- a/libselinux/man/man3/selinux_restorecon_xattr.3
 +++ b/libselinux/man/man3/selinux_restorecon_xattr.3
 @@ -119,7 +119,7 @@ By default
@@ -184,10 +188,10 @@ index c5632681..098c840f 100644
  .BR selabel_open (3)
  must be called specifying the required
 diff --git a/libselinux/src/Makefile b/libselinux/src/Makefile
-index 0dbba7f4..4a0a59cc 100644
+index 9ecdbd4d0af8..fde55cd681c2 100644
 --- a/libselinux/src/Makefile
 +++ b/libselinux/src/Makefile
-@@ -132,7 +132,7 @@ DISABLE_FLAGS+= -DNO_MEDIA_BACKEND -DNO_DB_BACKEND -DNO_X_BACKEND \
+@@ -130,7 +130,7 @@ DISABLE_FLAGS+= -DNO_MEDIA_BACKEND -DNO_DB_BACKEND -DNO_X_BACKEND \
  	-DBUILD_HOST
  SRCS= callbacks.c freecon.c label.c label_file.c \
  	label_backends_android.c regex.c label_support.c \
@@ -197,10 +201,10 @@ index 0dbba7f4..4a0a59cc 100644
  endif
  
 diff --git a/libselinux/src/label_file.c b/libselinux/src/label_file.c
-index b785eab6..4c87de15 100644
+index 0c0499eb0365..938a0e2a5fb3 100644
 --- a/libselinux/src/label_file.c
 +++ b/libselinux/src/label_file.c
-@@ -1958,7 +1958,7 @@ static struct lookup_result *lookup_common(struct selabel_handle *rec,
+@@ -2244,7 +2244,7 @@ static struct lookup_result *lookup_common(struct selabel_handle *rec,
  
  /*
   * Returns true if the digest of all partial matched contexts is the same as
@@ -209,7 +213,7 @@ index b785eab6..4c87de15 100644
   * digest will always be returned. The caller must free any returned digests.
   */
  static bool get_digests_all_partial_matches(struct selabel_handle *rec,
-@@ -1967,39 +1967,39 @@ static bool get_digests_all_partial_matches(struct selabel_handle *rec,
+@@ -2253,40 +2253,40 @@ static bool get_digests_all_partial_matches(struct selabel_handle *rec,
  					    uint8_t **xattr_digest,
  					    size_t *digest_len)
  {
@@ -219,13 +223,17 @@ index b785eab6..4c87de15 100644
 -				     read_digest, SHA1_HASH_SIZE
 +				     read_digest, SHA256_HASH_SIZE
  #ifdef __APPLE__
- 				     , 0, 0
+ 				     ,
+ 				     0, 0
  #endif /* __APPLE __ */
- 				    );
+-	);
 -	uint8_t hash_digest[SHA1_HASH_SIZE];
+-	bool status =
+-		selabel_hash_all_partial_matches(rec, pathname, hash_digest);
++				    );
 +	uint8_t hash_digest[SHA256_HASH_SIZE];
- 	bool status = selabel_hash_all_partial_matches(rec, pathname,
- 						       hash_digest);
++	bool status = selabel_hash_all_partial_matches(rec, pathname,
++						       hash_digest);
  
  	*xattr_digest = NULL;
  	*calculated_digest = NULL;
@@ -254,13 +262,13 @@ index b785eab6..4c87de15 100644
  	}
  
 -	if (status && read_size == SHA1_HASH_SIZE &&
--		memcmp(read_digest, hash_digest, SHA1_HASH_SIZE) == 0)
+-	    memcmp(read_digest, hash_digest, SHA1_HASH_SIZE) == 0)
 +	if (status && read_size == SHA256_HASH_SIZE &&
 +		memcmp(read_digest, hash_digest, SHA256_HASH_SIZE) == 0)
  		return true;
  
  	return false;
-@@ -2018,22 +2018,22 @@ static bool hash_all_partial_matches(struct selabel_handle *rec, const char *key
+@@ -2307,22 +2307,22 @@ static bool hash_all_partial_matches(struct selabel_handle *rec,
  		return false;
  	}
  
@@ -270,9 +278,9 @@ index b785eab6..4c87de15 100644
 +	Sha256Initialise(&context);
  
  	for (const struct lookup_result *m = matches; m; m = m->next) {
- 		const char* regex_str = m->regex_str;
+ 		const char *regex_str = m->regex_str;
  		uint8_t file_kind = m->file_kind;
- 		const char* ctx_raw = m->lr->ctx_raw;
+ 		const char *ctx_raw = m->lr->ctx_raw;
  
 -		Sha1Update(&context, regex_str, strlen(regex_str) + 1);
 -		Sha1Update(&context, &file_kind, sizeof(file_kind));
@@ -292,7 +300,7 @@ index b785eab6..4c87de15 100644
  	free_lookup_result(matches);
  	return true;
 diff --git a/libselinux/src/label_internal.h b/libselinux/src/label_internal.h
-index 743dbf94..4180df92 100644
+index 4ff39d96f9f5..dd426a824cab 100644
 --- a/libselinux/src/label_internal.h
 +++ b/libselinux/src/label_internal.h
 @@ -13,7 +13,7 @@
@@ -304,7 +312,7 @@ index 743dbf94..4180df92 100644
  
  #if defined(ANDROID) || defined(__APPLE__)
  // Android and Mac do not have fgets_unlocked()
-@@ -47,15 +47,15 @@ int selabel_service_init(struct selabel_handle *rec,
+@@ -41,19 +41,19 @@ int selabel_service_init(struct selabel_handle *rec,
   */
  
  /*
@@ -318,12 +326,20 @@ index 743dbf94..4180df92 100644
 +#define DIGEST_SPECFILE_SIZE SHA256_HASH_SIZE
  #define DIGEST_FILES_MAX 8
  struct selabel_digest {
--	unsigned char *digest;	/* SHA1 digest of specfiles */
+-	unsigned char *digest; /* SHA1 digest of specfiles */
+-	unsigned char *hashbuf; /* buffer to hold specfiles */
+-	size_t hashbuf_size; /* buffer size */
+-	size_t specfile_cnt; /* how many specfiles processed */
+-	char **specfile_list; /* and their names */
 +	unsigned char *digest;	/* SHA256 digest of specfiles */
- 	unsigned char *hashbuf;	/* buffer to hold specfiles */
- 	size_t hashbuf_size;	/* buffer size */
- 	size_t specfile_cnt;	/* how many specfiles processed */
-@@ -111,7 +111,7 @@ struct selabel_handle {
++	unsigned char *hashbuf;	/* buffer to hold specfiles */
++	size_t hashbuf_size;	/* buffer size */
++	size_t specfile_cnt;	/* how many specfiles processed */
++	char **specfile_list;	/* and their names */
+ };
+ 
+ extern int digest_add_specfile(struct selabel_digest *digest, FILE *fp,
+@@ -101,7 +101,7 @@ struct selabel_handle {
  	 */
  	char *spec_file;
  
@@ -333,33 +349,37 @@ index 743dbf94..4180df92 100644
  };
  
 diff --git a/libselinux/src/label_support.c b/libselinux/src/label_support.c
-index 57e191c8..1b6fabca 100644
+index cc5c279e88fa..aea5ed19b45a 100644
 --- a/libselinux/src/label_support.c
 +++ b/libselinux/src/label_support.c
-@@ -123,7 +123,7 @@ int  read_spec_entries(char *line_buf, size_t nread, const char **errbuf, int nu
+@@ -131,28 +131,27 @@ int read_spec_entries(char *line_buf, size_t nread, const char **errbuf,
  /* Once all the specfiles are in the hash_buf, generate the hash. */
- void  digest_gen_hash(struct selabel_digest *digest)
+ void digest_gen_hash(struct selabel_digest *digest)
  {
 -	Sha1Context context;
 +	Sha256Context context;
  	size_t remaining_size;
  	const unsigned char *ptr;
+-	const uint32_t chunkSize = UINT32_MAX >> 3;
  
-@@ -131,19 +131,19 @@ void  digest_gen_hash(struct selabel_digest *digest)
+ 	/* If SELABEL_OPT_DIGEST not set then just return */
  	if (!digest)
  		return;
  
 -	Sha1Initialise(&context);
 +	Sha256Initialise(&context);
  
- 	/* Process in blocks of UINT32_MAX bytes */
+ 	/* Process in blocks of chunkSize bytes */
  	remaining_size = digest->hashbuf_size;
  	ptr = digest->hashbuf;
- 	while (remaining_size > UINT32_MAX) {
--		Sha1Update(&context, ptr, UINT32_MAX);
+-	while (remaining_size > chunkSize) {
+-		Sha1Update(&context, ptr, chunkSize);
+-		remaining_size -= chunkSize;
+-		ptr += chunkSize;
++	while (remaining_size > UINT32_MAX) {
 +		Sha256Update(&context, ptr, UINT32_MAX);
- 		remaining_size -= UINT32_MAX;
- 		ptr += UINT32_MAX;
++		remaining_size -= UINT32_MAX;
++		ptr += UINT32_MAX;
  	}
 -	Sha1Update(&context, ptr, remaining_size);
 +	Sha256Update(&context, ptr, remaining_size);
@@ -370,19 +390,19 @@ index 57e191c8..1b6fabca 100644
  	digest->hashbuf = NULL;
  }
 diff --git a/libselinux/src/selinux_restorecon.c b/libselinux/src/selinux_restorecon.c
-index 8fadf4d2..28749ee2 100644
+index b34d8e60bb5b..d48d5a83ed6e 100644
 --- a/libselinux/src/selinux_restorecon.c
 +++ b/libselinux/src/selinux_restorecon.c
-@@ -37,7 +37,7 @@
+@@ -38,7 +38,7 @@
  #include "callbacks.h"
  #include "selinux_internal.h"
  #include "label_file.h"
 -#include "sha1.h"
 +#include "sha256.h"
  
- #define STAR_COUNT 1024
- 
-@@ -311,7 +311,7 @@ static uint64_t exclude_non_seclabel_mounts(void)
+ static struct selabel_handle *fc_sehandle = NULL;
+ static bool selabel_no_digest;
+@@ -360,7 +360,7 @@ static uint64_t exclude_non_seclabel_mounts(void)
  static int add_xattr_entry(const char *directory, bool delete_nonmatch,
  			   bool delete_all)
  {
@@ -391,7 +411,7 @@ index 8fadf4d2..28749ee2 100644
  	size_t i, digest_len = 0;
  	int rc;
  	enum digest_result digest_result;
-@@ -335,15 +335,15 @@ static int add_xattr_entry(const char *directory, bool delete_nonmatch,
+@@ -385,15 +385,15 @@ static int add_xattr_entry(const char *directory, bool delete_nonmatch,
  	}
  
  	/* Convert entry to a hex encoded string. */
@@ -410,7 +430,7 @@ index 8fadf4d2..28749ee2 100644
  
  	digest_result = match ? MATCH : NOMATCH;
  
-@@ -363,7 +363,7 @@ static int add_xattr_entry(const char *directory, bool delete_nonmatch,
+@@ -414,7 +414,7 @@ static int add_xattr_entry(const char *directory, bool delete_nonmatch,
  	/* Now add entries to link list. */
  	new_entry = malloc(sizeof(struct dir_xattr));
  	if (!new_entry) {
@@ -419,7 +439,7 @@ index 8fadf4d2..28749ee2 100644
  		goto oom;
  	}
  	new_entry->next = NULL;
-@@ -371,15 +371,15 @@ static int add_xattr_entry(const char *directory, bool delete_nonmatch,
+@@ -422,11 +422,17 @@ static int add_xattr_entry(const char *directory, bool delete_nonmatch,
  	new_entry->directory = strdup(directory);
  	if (!new_entry->directory) {
  		free(new_entry);
@@ -428,49 +448,112 @@ index 8fadf4d2..28749ee2 100644
  		goto oom;
  	}
  
--	new_entry->digest = strdup(sha1_buf);
+-	new_entry->digest = sha1_buf;
 +	new_entry->digest = strdup(sha256_buf);
- 	if (!new_entry->digest) {
- 		free(new_entry->directory);
- 		free(new_entry);
--		free(sha1_buf);
++	if (!new_entry->digest) {
++		free(new_entry->directory);
++		free(new_entry);
 +		free(sha256_buf);
- 		goto oom;
- 	}
++		goto oom;
++	}
  
-@@ -393,7 +393,7 @@ static int add_xattr_entry(const char *directory, bool delete_nonmatch,
+ 	new_entry->result = digest_result;
+ 
+@@ -437,7 +443,7 @@ static int add_xattr_entry(const char *directory, bool delete_nonmatch,
+ 		dir_xattr_last->next = new_entry;
  		dir_xattr_last = new_entry;
  	}
- 
--	free(sha1_buf);
+-
 +	free(sha256_buf);
  	return 0;
  
  oom:
-@@ -823,7 +823,7 @@ err:
+@@ -891,6 +897,11 @@ err:
+ 	goto out1;
+ }
  
- struct dir_hash_node {
- 	char *path;
++struct dir_hash_node {
++	char *path;
++	uint8_t digest[SHA256_HASH_SIZE];
++	struct dir_hash_node *next;
++};
+ /*
+  * Returns true if the digest of all partial matched contexts is the same as
+  * the one saved by setxattr. Otherwise returns false and sets @have_digest
+@@ -898,7 +909,7 @@ err:
+  * relabeling this directory.
+  */
+ static bool check_context_match_for_dir(const char *pathname,
+-					uint8_t digest_out[SHA1_HASH_SIZE],
++					uint8_t digest_out[SHA256_HASH_SIZE],
+ 					bool *have_digest)
+ {
+ 	bool status;
+@@ -918,8 +929,8 @@ static bool check_context_match_for_dir(const char *pathname,
+ 
+ 	/* Save digest of all matched contexts for the current directory. */
+ 	if (calculated_digest) {
+-		assert(digest_len == SHA1_HASH_SIZE);
+-		memcpy(digest_out, calculated_digest, SHA1_HASH_SIZE);
++		assert(digest_len == SHA256_HASH_SIZE);
++		memcpy(digest_out, calculated_digest, SHA256_HASH_SIZE);
+ 		*have_digest = true;
+ 	}
+ 
+@@ -934,7 +945,7 @@ struct walk_level {
+ 	dev_t dev;
+ 	ino_t ino;
+ 	size_t pathlen;
 -	uint8_t digest[SHA1_HASH_SIZE];
 +	uint8_t digest[SHA256_HASH_SIZE];
- 	struct dir_hash_node *next;
+ 	bool write_digest;
  };
- /*
-@@ -1343,7 +1343,7 @@ static int selinux_restorecon_common(const char *pathname_orig,
- 			if (setxattr(current->path,
- 			    RESTORECON_PARTIAL_MATCH_DIGEST,
- 			    current->digest,
--			    SHA1_HASH_SIZE, 0) < 0) {
-+			    SHA256_HASH_SIZE, 0) < 0) {
+ 
+@@ -1227,7 +1238,7 @@ static int walk_next(struct rest_state *state, int *ent_fd, int *rd_fd,
+ 			    !state->skipped_errors &&
+ 			    fsetxattr(dirfd(top->dirp),
+ 				      RESTORECON_PARTIAL_MATCH_DIGEST,
+-				      top->digest, SHA1_HASH_SIZE, 0) < 0) {
++				      top->digest, SHA256_HASH_SIZE, 0) < 0) {
  				selinux_log(SELINUX_ERROR,
- 					    "setxattr failed: %s: %m\n",
- 					    current->path);
+ 					    "Could not set digest on %s: %m\n",
+ 					    state->pathbuf);
+@@ -1398,7 +1409,7 @@ static void *selinux_restorecon_thread(void *arg)
+ 				continue;
+ 			}
+ 
+-			uint8_t digest[SHA1_HASH_SIZE];
++			uint8_t digest[SHA256_HASH_SIZE];
+ 			bool have_digest = false;
+ 
+ 			if (descend && state->setrestorecondigest &&
+@@ -1430,7 +1441,7 @@ static void *selinux_restorecon_thread(void *arg)
+ 						&state->stack[state->depth - 1];
+ 
+ 					memcpy(wl->digest, digest,
+-					       SHA1_HASH_SIZE);
++					       SHA256_HASH_SIZE);
+ 					wl->write_digest = true;
+ 				}
+ 			}
+@@ -1768,6 +1779,11 @@ static int selinux_restorecon_common(const char *pathname_orig,
+ 	if (state.saved_errno)
+ 		goto out;
+ 
++	/*
++	 * Note: Digest writing now happens in walk_pop() during traversal,
++	 * not at the end. This FTS-based code is obsolete.
++	 */
++
+ 	skipped_errors = state.skipped_errors;
+ 
+ out:
 diff --git a/libselinux/src/sha1.c b/libselinux/src/sha1.c
 deleted file mode 100644
-index 452b0cc2..00000000
+index 279625ee177f..000000000000
 --- a/libselinux/src/sha1.c
 +++ /dev/null
-@@ -1,223 +0,0 @@
+@@ -1,284 +0,0 @@
 -///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
 -//  LibSha1
 -//
@@ -505,10 +588,9 @@ index 452b0cc2..00000000
 -//  TYPES
 -///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
 -
--typedef union
--{
--    uint8_t     c [64];
--    uint32_t    l [16];
+-typedef union {
+-	uint8_t c[64];
+-	uint32_t l[16];
 -} CHAR64LONG16;
 -
 -///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
@@ -518,79 +600,157 @@ index 452b0cc2..00000000
 -#define rol(value, bits) (((value) << (bits)) | ((value) >> (32 - (bits))))
 -
 -// blk0() and blk() perform the initial expand.
--#define blk0(i) (block->l[i] = (rol(block->l[i],24)&0xFF00FF00) \
--    |(rol(block->l[i],8)&0x00FF00FF))
+-#define blk0(i)                                              \
+-	(block->l[i] = (rol(block->l[i], 24) & 0xFF00FF00) | \
+-		       (rol(block->l[i], 8) & 0x00FF00FF))
 -
--#define blk(i) (block->l[i&15] = rol(block->l[(i+13)&15]^block->l[(i+8)&15] \
--    ^block->l[(i+2)&15]^block->l[i&15],1))
+-#define blk(i)                                                          \
+-	(block->l[i & 15] =                                             \
+-		 rol(block->l[(i + 13) & 15] ^ block->l[(i + 8) & 15] ^ \
+-			     block->l[(i + 2) & 15] ^ block->l[i & 15], \
+-		     1))
 -
 -// (R0+R1), R2, R3, R4 are the different operations used in SHA1
--#define R0(v,w,x,y,z,i)  do { z += ((w&(x^y))^y)     + blk0(i)+ 0x5A827999 + rol(v,5); w=rol(w,30); } while (0)
--#define R1(v,w,x,y,z,i)  do { z += ((w&(x^y))^y)     + blk(i) + 0x5A827999 + rol(v,5); w=rol(w,30); } while (0)
--#define R2(v,w,x,y,z,i)  do { z += (w^x^y)           + blk(i) + 0x6ED9EBA1 + rol(v,5); w=rol(w,30); } while (0)
--#define R3(v,w,x,y,z,i)  do { z += (((w|x)&y)|(w&x)) + blk(i) + 0x8F1BBCDC + rol(v,5); w=rol(w,30); } while (0)
--#define R4(v,w,x,y,z,i)  do { z += (w^x^y)           + blk(i) + 0xCA62C1D6 + rol(v,5); w=rol(w,30); } while (0)
--
+-#define R0(v, w, x, y, z, i)                                                 \
+-	do {                                                                 \
+-		z += ((w & (x ^ y)) ^ y) + blk0(i) + 0x5A827999 + rol(v, 5); \
+-		w = rol(w, 30);                                              \
+-	} while (0)
+-#define R1(v, w, x, y, z, i)                                                \
+-	do {                                                                \
+-		z += ((w & (x ^ y)) ^ y) + blk(i) + 0x5A827999 + rol(v, 5); \
+-		w = rol(w, 30);                                             \
+-	} while (0)
+-#define R2(v, w, x, y, z, i)                                        \
+-	do {                                                        \
+-		z += (w ^ x ^ y) + blk(i) + 0x6ED9EBA1 + rol(v, 5); \
+-		w = rol(w, 30);                                     \
+-	} while (0)
+-#define R3(v, w, x, y, z, i)                                           \
+-	do {                                                           \
+-		z += (((w | x) & y) | (w & x)) + blk(i) + 0x8F1BBCDC + \
+-		     rol(v, 5);                                        \
+-		w = rol(w, 30);                                        \
+-	} while (0)
+-#define R4(v, w, x, y, z, i)                                        \
+-	do {                                                        \
+-		z += (w ^ x ^ y) + blk(i) + 0xCA62C1D6 + rol(v, 5); \
+-		w = rol(w, 30);                                     \
+-	} while (0)
 -
 -///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
 -//  TransformFunction
 -//
 -//  Hash a single 512-bit block. This is the core of the algorithm
 -///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
--ignore_unsigned_overflow_
--static
--void
--    TransformFunction
--    (
--        uint32_t            state[5],
--        const uint8_t       buffer[64]
--    )
+-ignore_unsigned_overflow_ static void
+-TransformFunction(uint32_t state[5], const uint8_t buffer[64])
 -{
--    uint32_t            a;
--    uint32_t            b;
--    uint32_t            c;
--    uint32_t            d;
--    uint32_t            e;
--    CHAR64LONG16        workspace;
--    CHAR64LONG16*       block = &workspace;
+-	uint32_t a;
+-	uint32_t b;
+-	uint32_t c;
+-	uint32_t d;
+-	uint32_t e;
+-	CHAR64LONG16 workspace;
+-	CHAR64LONG16 *block = &workspace;
 -
--    memcpy(block, buffer, 64);
+-	memcpy(block, buffer, 64);
 -
--    // Copy context->state[] to working vars
--    a = state[0];
--    b = state[1];
--    c = state[2];
--    d = state[3];
--    e = state[4];
+-	// Copy context->state[] to working vars
+-	a = state[0];
+-	b = state[1];
+-	c = state[2];
+-	d = state[3];
+-	e = state[4];
 -
--    // 4 rounds of 20 operations each. Loop unrolled.
--    R0(a,b,c,d,e, 0); R0(e,a,b,c,d, 1); R0(d,e,a,b,c, 2); R0(c,d,e,a,b, 3);
--    R0(b,c,d,e,a, 4); R0(a,b,c,d,e, 5); R0(e,a,b,c,d, 6); R0(d,e,a,b,c, 7);
--    R0(c,d,e,a,b, 8); R0(b,c,d,e,a, 9); R0(a,b,c,d,e,10); R0(e,a,b,c,d,11);
--    R0(d,e,a,b,c,12); R0(c,d,e,a,b,13); R0(b,c,d,e,a,14); R0(a,b,c,d,e,15);
--    R1(e,a,b,c,d,16); R1(d,e,a,b,c,17); R1(c,d,e,a,b,18); R1(b,c,d,e,a,19);
--    R2(a,b,c,d,e,20); R2(e,a,b,c,d,21); R2(d,e,a,b,c,22); R2(c,d,e,a,b,23);
--    R2(b,c,d,e,a,24); R2(a,b,c,d,e,25); R2(e,a,b,c,d,26); R2(d,e,a,b,c,27);
--    R2(c,d,e,a,b,28); R2(b,c,d,e,a,29); R2(a,b,c,d,e,30); R2(e,a,b,c,d,31);
--    R2(d,e,a,b,c,32); R2(c,d,e,a,b,33); R2(b,c,d,e,a,34); R2(a,b,c,d,e,35);
--    R2(e,a,b,c,d,36); R2(d,e,a,b,c,37); R2(c,d,e,a,b,38); R2(b,c,d,e,a,39);
--    R3(a,b,c,d,e,40); R3(e,a,b,c,d,41); R3(d,e,a,b,c,42); R3(c,d,e,a,b,43);
--    R3(b,c,d,e,a,44); R3(a,b,c,d,e,45); R3(e,a,b,c,d,46); R3(d,e,a,b,c,47);
--    R3(c,d,e,a,b,48); R3(b,c,d,e,a,49); R3(a,b,c,d,e,50); R3(e,a,b,c,d,51);
--    R3(d,e,a,b,c,52); R3(c,d,e,a,b,53); R3(b,c,d,e,a,54); R3(a,b,c,d,e,55);
--    R3(e,a,b,c,d,56); R3(d,e,a,b,c,57); R3(c,d,e,a,b,58); R3(b,c,d,e,a,59);
--    R4(a,b,c,d,e,60); R4(e,a,b,c,d,61); R4(d,e,a,b,c,62); R4(c,d,e,a,b,63);
--    R4(b,c,d,e,a,64); R4(a,b,c,d,e,65); R4(e,a,b,c,d,66); R4(d,e,a,b,c,67);
--    R4(c,d,e,a,b,68); R4(b,c,d,e,a,69); R4(a,b,c,d,e,70); R4(e,a,b,c,d,71);
--    R4(d,e,a,b,c,72); R4(c,d,e,a,b,73); R4(b,c,d,e,a,74); R4(a,b,c,d,e,75);
--    R4(e,a,b,c,d,76); R4(d,e,a,b,c,77); R4(c,d,e,a,b,78); R4(b,c,d,e,a,79);
+-	// 4 rounds of 20 operations each. Loop unrolled.
+-	R0(a, b, c, d, e, 0);
+-	R0(e, a, b, c, d, 1);
+-	R0(d, e, a, b, c, 2);
+-	R0(c, d, e, a, b, 3);
+-	R0(b, c, d, e, a, 4);
+-	R0(a, b, c, d, e, 5);
+-	R0(e, a, b, c, d, 6);
+-	R0(d, e, a, b, c, 7);
+-	R0(c, d, e, a, b, 8);
+-	R0(b, c, d, e, a, 9);
+-	R0(a, b, c, d, e, 10);
+-	R0(e, a, b, c, d, 11);
+-	R0(d, e, a, b, c, 12);
+-	R0(c, d, e, a, b, 13);
+-	R0(b, c, d, e, a, 14);
+-	R0(a, b, c, d, e, 15);
+-	R1(e, a, b, c, d, 16);
+-	R1(d, e, a, b, c, 17);
+-	R1(c, d, e, a, b, 18);
+-	R1(b, c, d, e, a, 19);
+-	R2(a, b, c, d, e, 20);
+-	R2(e, a, b, c, d, 21);
+-	R2(d, e, a, b, c, 22);
+-	R2(c, d, e, a, b, 23);
+-	R2(b, c, d, e, a, 24);
+-	R2(a, b, c, d, e, 25);
+-	R2(e, a, b, c, d, 26);
+-	R2(d, e, a, b, c, 27);
+-	R2(c, d, e, a, b, 28);
+-	R2(b, c, d, e, a, 29);
+-	R2(a, b, c, d, e, 30);
+-	R2(e, a, b, c, d, 31);
+-	R2(d, e, a, b, c, 32);
+-	R2(c, d, e, a, b, 33);
+-	R2(b, c, d, e, a, 34);
+-	R2(a, b, c, d, e, 35);
+-	R2(e, a, b, c, d, 36);
+-	R2(d, e, a, b, c, 37);
+-	R2(c, d, e, a, b, 38);
+-	R2(b, c, d, e, a, 39);
+-	R3(a, b, c, d, e, 40);
+-	R3(e, a, b, c, d, 41);
+-	R3(d, e, a, b, c, 42);
+-	R3(c, d, e, a, b, 43);
+-	R3(b, c, d, e, a, 44);
+-	R3(a, b, c, d, e, 45);
+-	R3(e, a, b, c, d, 46);
+-	R3(d, e, a, b, c, 47);
+-	R3(c, d, e, a, b, 48);
+-	R3(b, c, d, e, a, 49);
+-	R3(a, b, c, d, e, 50);
+-	R3(e, a, b, c, d, 51);
+-	R3(d, e, a, b, c, 52);
+-	R3(c, d, e, a, b, 53);
+-	R3(b, c, d, e, a, 54);
+-	R3(a, b, c, d, e, 55);
+-	R3(e, a, b, c, d, 56);
+-	R3(d, e, a, b, c, 57);
+-	R3(c, d, e, a, b, 58);
+-	R3(b, c, d, e, a, 59);
+-	R4(a, b, c, d, e, 60);
+-	R4(e, a, b, c, d, 61);
+-	R4(d, e, a, b, c, 62);
+-	R4(c, d, e, a, b, 63);
+-	R4(b, c, d, e, a, 64);
+-	R4(a, b, c, d, e, 65);
+-	R4(e, a, b, c, d, 66);
+-	R4(d, e, a, b, c, 67);
+-	R4(c, d, e, a, b, 68);
+-	R4(b, c, d, e, a, 69);
+-	R4(a, b, c, d, e, 70);
+-	R4(e, a, b, c, d, 71);
+-	R4(d, e, a, b, c, 72);
+-	R4(c, d, e, a, b, 73);
+-	R4(b, c, d, e, a, 74);
+-	R4(a, b, c, d, e, 75);
+-	R4(e, a, b, c, d, 76);
+-	R4(d, e, a, b, c, 77);
+-	R4(c, d, e, a, b, 78);
+-	R4(b, c, d, e, a, 79);
 -
--    // Add the working vars back into context.state[]
--    state[0] += a;
--    state[1] += b;
--    state[2] += c;
--    state[3] += d;
--    state[4] += e;
+-	// Add the working vars back into context.state[]
+-	state[0] += a;
+-	state[1] += b;
+-	state[2] += c;
+-	state[3] += d;
+-	state[4] += e;
 -}
 -
 -///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
@@ -602,20 +762,16 @@ index 452b0cc2..00000000
 -//
 -//  Initialises an SHA1 Context. Use this to initialise/reset a context.
 -///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
--void 
--    Sha1Initialise
--    (
--        Sha1Context*                Context
--    )
+-void Sha1Initialise(Sha1Context *Context)
 -{
--    // SHA1 initialization constants
--    Context->State[0] = 0x67452301;
--    Context->State[1] = 0xEFCDAB89;
--    Context->State[2] = 0x98BADCFE;
--    Context->State[3] = 0x10325476;
--    Context->State[4] = 0xC3D2E1F0;
--    Context->Count[0] = 0;
--    Context->Count[1] = 0;
+-	// SHA1 initialization constants
+-	Context->State[0] = 0x67452301;
+-	Context->State[1] = 0xEFCDAB89;
+-	Context->State[2] = 0x98BADCFE;
+-	Context->State[3] = 0x10325476;
+-	Context->State[4] = 0xC3D2E1F0;
+-	Context->Count[0] = 0;
+-	Context->Count[1] = 0;
 -}
 -
 -///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
@@ -624,41 +780,32 @@ index 452b0cc2..00000000
 -//  Adds data to the SHA1 context. This will process the data and update the internal state of the context. Keep on
 -//  calling this function until all the data has been added. Then call Sha1Finalise to calculate the hash.
 -///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
--void 
--    Sha1Update
--    (
--        Sha1Context*        Context,
--        const void*         Buffer,
--        uint32_t            BufferSize
--    )
+-void Sha1Update(Sha1Context *Context, const void *Buffer, uint32_t BufferSize)
 -{
--    uint32_t    i;
--    uint32_t    j;
+-	uint32_t i;
+-	uint32_t j;
 -
--    j = (Context->Count[0] >> 3) & 63;
--    if ((Context->Count[0] += BufferSize << 3) < (BufferSize << 3))
--    {
--        Context->Count[1]++;
--    }
+-	j = (Context->Count[0] >> 3) & 63;
+-	if ((Context->Count[0] += BufferSize << 3) < (BufferSize << 3)) {
+-		Context->Count[1]++;
+-	}
 -
--    Context->Count[1] += (BufferSize >> 29);
--    if ((j + BufferSize) > 63)
--    {
--        i = 64 - j;
--        memcpy(&Context->Buffer[j], Buffer, i);
--        TransformFunction(Context->State, Context->Buffer);
--        for (; i + 63 < BufferSize; i += 64)
--        {
--            TransformFunction(Context->State, (const uint8_t*)Buffer + i);
--        }
--        j = 0;
--    }
--    else
--    {
--        i = 0;
--    }
+-	Context->Count[1] += (BufferSize >> 29);
+-	if ((j + BufferSize) > 63) {
+-		i = 64 - j;
+-		memcpy(&Context->Buffer[j], Buffer, i);
+-		TransformFunction(Context->State, Context->Buffer);
+-		for (; i + 63 < BufferSize; i += 64) {
+-			TransformFunction(Context->State,
+-					  (const uint8_t *)Buffer + i);
+-		}
+-		j = 0;
+-	} else {
+-		i = 0;
+-	}
 -
--    memcpy(&Context->Buffer[j], &((const uint8_t*)Buffer)[i], BufferSize - i);
+-	memcpy(&Context->Buffer[j], &((const uint8_t *)Buffer)[i],
+-	       BufferSize - i);
 -}
 -
 -///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
@@ -667,39 +814,36 @@ index 452b0cc2..00000000
 -//  Performs the final calculation of the hash and returns the digest (20 byte buffer containing 160bit hash). After
 -//  calling this, Sha1Initialised must be used to reuse the context.
 -///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
--void 
--    Sha1Finalise
--    (
--        Sha1Context*                Context,
--        SHA1_HASH*                  Digest
--    )
+-void Sha1Finalise(Sha1Context *Context, SHA1_HASH *Digest)
 -{
--    uint32_t    i;
--    uint8_t     finalcount[8];
+-	uint32_t i;
+-	uint8_t finalcount[8];
 -
--    for (i = 0; i < 8; i++)
--    {
--        finalcount[i] = (unsigned char)((Context->Count[(i >= 4 ? 0 : 1)]
--         >> ((3-(i & 3)) * 8) ) & 255);  // Endian independent
--    }
--    Sha1Update(Context, (const uint8_t*)"\x80", 1);
--    while ((Context->Count[0] & 504) != 448)
--    {
--        Sha1Update(Context, (const uint8_t*)"\0", 1);
--    }
+-	for (i = 0; i < 8; i++) {
+-		finalcount[i] =
+-			(unsigned char)((Context->Count[(i >= 4 ? 0 : 1)] >>
+-					 ((3 - (i & 3)) * 8)) &
+-					255); // Endian independent
+-	}
+-	Sha1Update(Context, (const uint8_t *)"\x80", 1);
+-	while ((Context->Count[0] & 504) != 448) {
+-		Sha1Update(Context, (const uint8_t *)"\0", 1);
+-	}
 -
--    Sha1Update(Context, finalcount, 8);  // Should cause a Sha1TransformFunction()
--    for (i = 0; i < SHA1_HASH_SIZE; i++)
--    {
--        Digest->bytes[i] = (uint8_t)((Context->State[i>>2] >> ((3-(i & 3)) * 8) ) & 255);
--    }
+-	Sha1Update(Context, finalcount,
+-		   8); // Should cause a Sha1TransformFunction()
+-	for (i = 0; i < SHA1_HASH_SIZE; i++) {
+-		Digest->bytes[i] = (uint8_t)((Context->State[i >> 2] >>
+-					      ((3 - (i & 3)) * 8)) &
+-					     255);
+-	}
 -}
 diff --git a/libselinux/src/sha1.h b/libselinux/src/sha1.h
 deleted file mode 100644
-index f83a6e7e..00000000
+index fbf4d65538fb..000000000000
 --- a/libselinux/src/sha1.h
 +++ /dev/null
-@@ -1,85 +0,0 @@
+@@ -1,68 +0,0 @@
 -///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
 -//  LibSha1
 -//
@@ -727,18 +871,16 @@ index f83a6e7e..00000000
 -///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
 -
 -// Sha1Context - This must be initialised using Sha1Initialised. Do not modify the contents of this structure directly.
--typedef struct
--{
--    uint32_t        State[5];
--    uint32_t        Count[2];
--    uint8_t         Buffer[64];
+-typedef struct {
+-	uint32_t State[5];
+-	uint32_t Count[2];
+-	uint8_t Buffer[64];
 -} Sha1Context;
 -
--#define SHA1_HASH_SIZE           ( 160 / 8 )
+-#define SHA1_HASH_SIZE (160 / 8)
 -
--typedef struct
--{
--    uint8_t      bytes [SHA1_HASH_SIZE];
+-typedef struct {
+-	uint8_t bytes[SHA1_HASH_SIZE];
 -} SHA1_HASH;
 -
 -///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
@@ -750,11 +892,7 @@ index f83a6e7e..00000000
 -//
 -//  Initialises an SHA1 Context. Use this to initialise/reset a context.
 -///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
--void
--    Sha1Initialise
--    (
--        Sha1Context*                Context
--    );
+-void Sha1Initialise(Sha1Context *Context);
 -
 -///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
 -//  Sha1Update
@@ -762,13 +900,7 @@ index f83a6e7e..00000000
 -//  Adds data to the SHA1 context. This will process the data and update the internal state of the context. Keep on
 -//  calling this function until all the data has been added. Then call Sha1Finalise to calculate the hash.
 -///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
--void
--    Sha1Update
--    (
--        Sha1Context*        Context,
--        const void*         Buffer,
--        uint32_t            BufferSize
--    );
+-void Sha1Update(Sha1Context *Context, const void *Buffer, uint32_t BufferSize);
 -
 -///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
 -//  Sha1Finalise
@@ -776,18 +908,13 @@ index f83a6e7e..00000000
 -//  Performs the final calculation of the hash and returns the digest (20 byte buffer containing 160bit hash). After
 -//  calling this, Sha1Initialised must be used to reuse the context.
 -///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
--void
--    Sha1Finalise
--    (
--        Sha1Context*                Context,
--        SHA1_HASH*                  Digest
--    );
+-void Sha1Finalise(Sha1Context *Context, SHA1_HASH *Digest);
 -
 -///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
 -#endif //_sha1_h_
 diff --git a/libselinux/src/sha256.c b/libselinux/src/sha256.c
 new file mode 100644
-index 00000000..fe2aeef0
+index 000000000000..fe2aeef07f53
 --- /dev/null
 +++ b/libselinux/src/sha256.c
 @@ -0,0 +1,294 @@
@@ -1087,7 +1214,7 @@ index 00000000..fe2aeef0
 +}
 diff --git a/libselinux/src/sha256.h b/libselinux/src/sha256.h
 new file mode 100644
-index 00000000..406ed869
+index 000000000000..406ed869cd82
 --- /dev/null
 +++ b/libselinux/src/sha256.h
 @@ -0,0 +1,89 @@
@@ -1181,13 +1308,13 @@ index 00000000..406ed869
 +        SHA256_HASH*        Digest          // [in]
 +    );
 diff --git a/libselinux/utils/selabel_digest.c b/libselinux/utils/selabel_digest.c
-index 47aad21f..8bcd44a1 100644
+index 2c395db6f84f..77c1b1131e31 100644
 --- a/libselinux/utils/selabel_digest.c
 +++ b/libselinux/utils/selabel_digest.c
-@@ -13,8 +13,8 @@ static __attribute__ ((__noreturn__)) void usage(const char *progname)
+@@ -13,8 +13,8 @@ static __attribute__((__noreturn__)) void usage(const char *progname)
  		"Where:\n\t"
  		"-b  The backend - \"file\", \"media\", \"x\", \"db\" or "
- 			"\"prop\"\n\t"
+ 		"\"prop\"\n\t"
 -		"-v  Run \"cat <specfile_list> | openssl dgst -sha1 -hex\"\n\t"
 -		"    on the list of specfiles to compare the SHA1 digests.\n\t"
 +		"-v  Run \"cat <specfile_list> | openssl dgst -sha256 -hex\"\n\t"
@@ -1195,7 +1322,7 @@ index 47aad21f..8bcd44a1 100644
  		"-B  Use base specfiles only (valid for \"-b file\" only).\n\t"
  		"-i  Do not request a digest.\n\t"
  		"-f  Optional file containing the specs (defaults to\n\t"
-@@ -61,12 +61,12 @@ int main(int argc, char **argv)
+@@ -63,12 +63,12 @@ int main(int argc, char **argv)
  	int rc, opt, validate = 0;
  	char *baseonly = NULL, *file = NULL, *digest = (char *)1;
  	char **specfiles = NULL;
@@ -1209,17 +1336,17 @@ index 47aad21f..8bcd44a1 100644
 +	char *sha256_buf = NULL;
  
  	struct selabel_handle *hnd;
- 	struct selinux_opt selabel_option[] = {
-@@ -136,7 +136,7 @@ int main(int argc, char **argv)
+ 	struct selinux_opt selabel_option[] = { { SELABEL_OPT_PATH, file },
+@@ -138,7 +138,7 @@ int main(int argc, char **argv)
  		return -1;
  	}
  
 -	rc = selabel_digest(hnd, &sha1_digest, &digest_len, &specfiles,
 +	rc = selabel_digest(hnd, &sha256_digest, &digest_len, &specfiles,
- 							    &num_specfiles);
+ 			    &num_specfiles);
  
  	if (rc) {
-@@ -151,19 +151,19 @@ int main(int argc, char **argv)
+@@ -153,19 +153,19 @@ int main(int argc, char **argv)
  		goto err;
  	}
  
@@ -1228,7 +1355,7 @@ index 47aad21f..8bcd44a1 100644
 +	sha256_buf = malloc(digest_len * 2 + 1);
 +	if (!sha256_buf) {
  		fprintf(stderr, "Could not malloc buffer ERROR: %s\n",
- 						    strerror(errno));
+ 			strerror(errno));
  		rc = -1;
  		goto err;
  	}
@@ -1244,15 +1371,16 @@ index 47aad21f..8bcd44a1 100644
  	printf("calculated using the following specfile(s):\n");
  
  	if (specfiles) {
-@@ -198,19 +198,19 @@ int main(int argc, char **argv)
- 		}
+@@ -204,7 +204,7 @@ int main(int argc, char **argv)
  
  		if (validate) {
--			ret = snprintf(cmd_ptr, cmd_rem, "| /usr/bin/openssl dgst -sha1 -hex");
-+			ret = snprintf(cmd_ptr, cmd_rem, "| /usr/bin/openssl dgst -sha256 -hex");
+ 			ret = snprintf(cmd_ptr, cmd_rem,
+-				       "| /usr/bin/openssl dgst -sha1 -hex");
++				       "| /usr/bin/openssl dgst -sha256 -hex");
  			if (ret < 0 || (size_t)ret >= cmd_rem) {
- 				fprintf(stderr, "Could not format validate command\n");
- 				rc = -1;
+ 				fprintf(stderr,
+ 					"Could not format validate command\n");
+@@ -212,12 +212,12 @@ int main(int argc, char **argv)
  				goto err;
  			}
  
@@ -1268,10 +1396,10 @@ index 47aad21f..8bcd44a1 100644
  	return rc;
  }
 diff --git a/libselinux/utils/selabel_get_digests_all_partial_matches.c b/libselinux/utils/selabel_get_digests_all_partial_matches.c
-index e2733b41..98e533dc 100644
+index 0552ef0f58df..649e8b7aa0a2 100644
 --- a/libselinux/utils/selabel_get_digests_all_partial_matches.c
 +++ b/libselinux/utils/selabel_get_digests_all_partial_matches.c
-@@ -16,8 +16,8 @@ static __attribute__ ((__noreturn__)) void usage(const char *progname)
+@@ -16,8 +16,8 @@ static __attribute__((__noreturn__)) void usage(const char *progname)
  		"-v  Validate file_contxts entries against loaded policy.\n\t"
  		"-r  Recursively descend directories.\n\t"
  		"-f  Optional file_contexts file (defaults to current policy).\n\t"
@@ -1281,8 +1409,8 @@ index e2733b41..98e533dc 100644
 +		"This will check the directory selinux.sehash SHA256 digest for "
  		"<path> against\na newly generated digest based on the "
  		"file_context entries for that node\n(using the regx, mode "
- 		"and path entries).\n", progname);
-@@ -35,7 +35,7 @@ int main(int argc, char **argv)
+ 		"and path entries).\n",
+@@ -36,7 +36,7 @@ int main(int argc, char **argv)
  	char *paths[2] = { NULL, NULL };
  	uint8_t *xattr_digest = NULL;
  	uint8_t *calculated_digest = NULL;
@@ -1291,17 +1419,18 @@ index e2733b41..98e533dc 100644
  
  	struct selabel_handle *hnd;
  	struct selinux_opt selabel_option[] = {
-@@ -104,27 +104,27 @@ int main(int argc, char **argv)
- 							 &xattr_digest,
- 							 &digest_len);
+@@ -101,8 +101,8 @@ int main(int argc, char **argv)
+ 				hnd, ftsent->fts_path, &calculated_digest,
+ 				&xattr_digest, &digest_len);
  
 -			sha1_buf = calloc(1, digest_len * 2 + 1);
 -			if (!sha1_buf) {
 +			sha256_buf = calloc(1, digest_len * 2 + 1);
 +			if (!sha256_buf) {
- 				fprintf(stderr, "Could not calloc buffer ERROR: %s\n",
- 					    strerror(errno));
- 				return -1;
+ 				fprintf(stderr,
+ 					"Could not calloc buffer ERROR: %s\n",
+ 					strerror(errno));
+@@ -110,19 +110,19 @@ int main(int argc, char **argv)
  			}
  
  			if (status) { /* They match */
@@ -1325,7 +1454,7 @@ index e2733b41..98e533dc 100644
  					       ftsent->fts_path);
  					printf("as file_context entry is \"<<none>>\"\n");
  					goto cleanup;
-@@ -134,25 +134,25 @@ int main(int argc, char **argv)
+@@ -132,25 +132,25 @@ int main(int argc, char **argv)
  				       ftsent->fts_path);
  
  				for (i = 0; i < digest_len; i++)
@@ -1348,7 +1477,7 @@ index e2733b41..98e533dc 100644
 +					printf("%s\n", sha256_buf);
  				}
  			}
- 			cleanup:
+ cleanup:
  			free(xattr_digest);
  			free(calculated_digest);
 -			free(sha1_buf);
@@ -1357,5 +1486,5 @@ index e2733b41..98e533dc 100644
  		}
  		default:
 -- 
-2.53.0
+2.54.0
 
diff --git a/0002-Revert-libselinux-python-Use-system-Python3-build-mo.patch b/0002-Revert-libselinux-python-Use-system-Python3-build-mo.patch
new file mode 100644
index 0000000..ace4cc3
--- /dev/null
+++ b/0002-Revert-libselinux-python-Use-system-Python3-build-mo.patch
@@ -0,0 +1,27 @@
+From eeb5dbe746492dd4722745c5cf7ba2b46ac0a805 Mon Sep 17 00:00:00 2001
+From: Vit Mojzis <vmojzis@redhat.com>
+Date: Fri, 10 Jul 2026 13:20:24 +0200
+Subject: [PATCH] Revert "libselinux,python: Use system Python3 build module"
+
+This reverts commit e11e59675f6981e8b7cf990478887c9147b2b20a.
+
+python3-build is not available in RHEL-10
+---
+ libselinux/src/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/libselinux/src/Makefile b/libselinux/src/Makefile
+index fde55cd6..a5bb06d0 100644
+--- a/libselinux/src/Makefile
++++ b/libselinux/src/Makefile
+@@ -151,6 +151,7 @@ all: $(LIBSO)
+ endif
+ 
+ pywrap: all selinuxswig_python_exception.i
++	$(PYTHON) -m pip install build wheel
+ 	CFLAGS="$(CPPFLAGS) $(CFLAGS) $(SWIG_CFLAGS)" $(PYTHON) -m build --no-isolation --wheel .
+ 
+ rubywrap: all $(SWIGRUBYSO)
+-- 
+2.53.0
+
diff --git a/0002-libselinux-Ignore-directories-removed-during-relabel.patch b/0002-libselinux-Ignore-directories-removed-during-relabel.patch
deleted file mode 100644
index a136c49..0000000
--- a/0002-libselinux-Ignore-directories-removed-during-relabel.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From a7cbb5f2d9d0248d53e942c96343153936337997 Mon Sep 17 00:00:00 2001
-From: Vit Mojzis <vmojzis@redhat.com>
-Date: Fri, 30 Jan 2026 16:32:10 +0100
-Subject: [PATCH] libselinux: Ignore directories removed during relabeling
-
-Extend 54c79a74f5b9154762abaadf8194665598b24115 to directories, since
-users will expect them to be ignored as well.
-
-In case ignore_noent is specified, ignore directories removed during
-relabeling (race condition between directory read and removal after
-parent directory read).
-
-Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
-Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
----
- libselinux/src/selinux_restorecon.c | 7 ++++---
- 1 file changed, 4 insertions(+), 3 deletions(-)
-
-diff --git a/libselinux/src/selinux_restorecon.c b/libselinux/src/selinux_restorecon.c
-index 28749ee2..05044cc3 100644
---- a/libselinux/src/selinux_restorecon.c
-+++ b/libselinux/src/selinux_restorecon.c
-@@ -942,9 +942,10 @@ loop_body:
- 		case FTS_DNR:
- 			error = errno;
- 			errno = ftsent->fts_errno;
--			selinux_log(SELINUX_ERROR,
--				    "Could not read %s: %m.\n",
--				    ftsent->fts_path);
-+			if (!state->flags.ignore_noent || errno != ENOENT)
-+				selinux_log(SELINUX_ERROR,
-+					    "Could not read %s: %m.\n",
-+					    ftsent->fts_path);
- 			errno = error;
- 			fts_set(fts, ftsent, FTS_SKIP);
- 			continue;
--- 
-2.53.0
-
diff --git a/0003-Revert-libselinux-update-pywrap-targets-for-modern-p.patch b/0003-Revert-libselinux-update-pywrap-targets-for-modern-p.patch
new file mode 100644
index 0000000..bad09d0
--- /dev/null
+++ b/0003-Revert-libselinux-update-pywrap-targets-for-modern-p.patch
@@ -0,0 +1,60 @@
+From 17e8cfb4af093ee0913adacf0c4473465ce05520 Mon Sep 17 00:00:00 2001
+From: Vit Mojzis <vmojzis@redhat.com>
+Date: Fri, 10 Jul 2026 13:31:01 +0200
+Subject: [PATCH] Revert "libselinux: update pywrap targets for modern python
+ builds"
+
+This reverts commit dfedefffbbdde609a7aacb1ef570c7ca1bb70915.
+
+'pip install build' fails on systems without network and python3-build
+is not available in RHEL-10
+---
+ libselinux/src/.gitignore | 1 -
+ libselinux/src/Makefile   | 8 ++++----
+ 2 files changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/libselinux/src/.gitignore b/libselinux/src/.gitignore
+index 5413ccf0..94400e81 100644
+--- a/libselinux/src/.gitignore
++++ b/libselinux/src/.gitignore
+@@ -2,4 +2,3 @@ selinux.py
+ selinuxswig_python_wrap.c
+ selinuxswig_ruby_wrap.c
+ selinux.egg-info/
+-dist/
+diff --git a/libselinux/src/Makefile b/libselinux/src/Makefile
+index a5bb06d0..0688f7d0 100644
+--- a/libselinux/src/Makefile
++++ b/libselinux/src/Makefile
+@@ -151,8 +151,7 @@ all: $(LIBSO)
+ endif
+ 
+ pywrap: all selinuxswig_python_exception.i
+-	$(PYTHON) -m pip install build wheel
+-	CFLAGS="$(CPPFLAGS) $(CFLAGS) $(SWIG_CFLAGS)" $(PYTHON) -m build --no-isolation --wheel .
++	CFLAGS="$(CPPFLAGS) $(CFLAGS) $(SWIG_CFLAGS)" $(PYTHON) setup.py build_ext
+ 
+ rubywrap: all $(SWIGRUBYSO)
+ 
+@@ -197,7 +196,7 @@ ifneq ($(DISABLE_SHARED),y)
+ endif
+ 
+ install-pywrap: pywrap
+-	$(PYTHON) -m pip install --no-build-isolation --force-reinstall --prefix=$(PREFIX) `test -n "$(DESTDIR)" && echo --root $(DESTDIR) --ignore-installed --no-deps` dist/*.whl
++	CFLAGS="$(CPPFLAGS) $(CFLAGS) $(SWIG_CFLAGS)" $(PYTHON) -m pip install --no-build-isolation --prefix=$(PREFIX) `test -n "$(DESTDIR)" && echo --root $(DESTDIR) --ignore-installed --no-deps` $(PYTHON_SETUP_ARGS) .
+ 	install -m 644 $(SWIGPYOUT) $(DESTDIR)$(PYTHONLIBDIR)/selinux/__init__.py
+ 	ln -sf --relative $(DESTDIR)$(PYTHONLIBDIR)/selinux/_selinux$(PYCEXT) $(DESTDIR)$(PYTHONLIBDIR)/_selinux$(PYCEXT)
+ 
+@@ -210,7 +209,8 @@ relabel:
+ 
+ clean-pywrap:
+ 	-rm -f $(SWIGLOBJ) $(SWIGSO) $(AUDIT2WHYLOBJ) $(AUDIT2WHYSO)
+-	-rm -rf build dist *.egg-info *~ \#* *pyc .#*
++	$(PYTHON) setup.py clean
++	-rm -rf build *~ \#* *pyc .#* selinux.egg-info/
+ 
+ clean-rubywrap:
+ 	-rm -f $(SWIGRUBYLOBJ) $(SWIGRUBYSO)
+-- 
+2.53.0
+
diff --git a/changelog b/changelog
index f2b883d..10a9584 100644
--- a/changelog
+++ b/changelog
@@ -1,3 +1,6 @@
+* Wed Jul 01 2026 Petr Lautrbach <lautrbach@redhat.com> - 3.11-1
+- SELinux userspace 3.11 release
+
 * Tue May 05 2026 Vit Mojzis <vmojzis@redhat.com> - 3.10-2
 - Ignore directories removed during relabeling (RHEL-110181)
 
diff --git a/libselinux.spec b/libselinux.spec
index 1e57f7c..da2eb8e 100644
--- a/libselinux.spec
+++ b/libselinux.spec
@@ -1,30 +1,32 @@
 %define ruby_inc %(pkg-config --cflags ruby)
-%define libsepolver 3.10-1
+%define libsepolver 3.11-1
 
 Summary: SELinux library and simple utilities
 Name: libselinux
-Version: 3.10
-Release: 2%{?dist}
+Version: 3.11
+Release: 1%{?dist}
 License: LicenseRef-Fedora-Public-Domain
 # https://github.com/SELinuxProject/selinux/wiki/Releases
 Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}/libselinux-%{version}.tar.gz
 Source1: https://github.com/SELinuxProject/selinux/releases/download/%{version}/libselinux-%{version}.tar.gz.asc
-Source2: https://github.com/perfinion.gpg
+Source2: https://github.com/bachradsusi.gpg
 Source3: selinuxconlist.8
 Source4: selinuxdefcon.8
 
 Url: https://github.com/SELinuxProject/selinux/wiki
 # $ git clone https://github.com/fedora-selinux/selinux.git
 # $ cd selinux
-# $ git format-patch -N 3.10 -- libselinux
+# $ git format-patch -N 3.11 -- libselinux
 # $ i=1; for j in 00*patch; do printf "Patch%04d: %s\n" $i $j; i=$((i+1));done
 # Patch list start
 Patch0001: 0001-Use-SHA-2-instead-of-SHA-1.patch
-Patch0002: 0002-libselinux-Ignore-directories-removed-during-relabel.patch
+Patch0002: 0002-Revert-libselinux-python-Use-system-Python3-build-mo.patch
+Patch0003: 0003-Revert-libselinux-update-pywrap-targets-for-modern-p.patch
 # Patch list end
 BuildRequires: gcc make
 BuildRequires: ruby-devel ruby libsepol-static >= %{libsepolver} swig pcre2-devel
-BuildRequires: python3 python3-devel python3-setuptools python3-wheel python3-pip
+BuildRequires: python3 python3-devel python3-setuptools python3-pip
+BuildRequires: (python3-wheel if python3-setuptools < 71)
 BuildRequires: systemd
 BuildRequires: gnupg2
 Requires: libsepol%{?_isa} >= %{libsepolver} pcre2
diff --git a/sources b/sources
index 557820a..f772a29 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (libselinux-3.10.tar.gz) = 5783f737675eb94e0bdff082013589e5bddfa0669a357df185eb89f4f88cec8b90779e86c4b17b58f5c248175da0208c80cc2642046e348c7384dd799f1ba4c1
-SHA512 (libselinux-3.10.tar.gz.asc) = 6e0a18eb77b810eb7cbf756dcd82f57fa71d7c8d066ea99f754760d9e61db8f22e776c729a7387b01638249dacc270da7a5eb6a7ed38377ba858bebcd090cce6
+SHA512 (libselinux-3.11.tar.gz) = 49eb0b180b77b4b61505117ecd98ab9fdd79a36801b6d2216813ea370a02ba4f58a0f87a18e92a2d4eeffc11d9df67e4692d2d8f5d3ee77a2abd3f606196aaad
+SHA512 (libselinux-3.11.tar.gz.asc) = fa950a332a353dfbb7959b785956076d0547b6cf5387ecbaeeb11f8171a4fc3679772707364dee4bf8db76232eb2ea6a8f0280674a8351dcf98074892c3100de