From 2ab860efe4e966be071d6ef627e2428968112437 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Dan=20Hor=C3=A1k?= Date: Thu, 6 Aug 2026 09:53:27 +0200 Subject: [PATCH] Initial commit on c9s Resolves: RHEL-186086 --- .gitignore | 1 + libzpc-2.0.1-fixes.patch | 683 +++++++++++++++++++++++++++++++++++++++ libzpc2.spec | 88 +++++ sources | 1 + 4 files changed, 773 insertions(+) create mode 100644 libzpc-2.0.1-fixes.patch create mode 100644 libzpc2.spec create mode 100644 sources diff --git a/.gitignore b/.gitignore index e69de29..63e5c3e 100644 --- a/.gitignore +++ b/.gitignore @@ -0,0 +1 @@ +/libzpc-*.tar.gz diff --git a/libzpc-2.0.1-fixes.patch b/libzpc-2.0.1-fixes.patch new file mode 100644 index 0000000..f8654c9 --- /dev/null +++ b/libzpc-2.0.1-fixes.patch @@ -0,0 +1,683 @@ +From bc266b73843be55d06f6223ec4ecc844f7216dc4 Mon Sep 17 00:00:00 2001 +From: Ingo Franzki +Date: Mon, 15 Jun 2026 14:23:54 +0200 +Subject: [PATCH 1/6] Fix detection of PCC instruction availability + +According to the Principles or Operations manual, the PCC instruction was +added with Message-Security assist 4 (MSA 4), not 3. + +Signed-off-by: Ingo Franzki +--- + src/globals.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/src/globals.c b/src/globals.c +index 8797286..3650be2 100644 +--- a/src/globals.c ++++ b/src/globals.c +@@ -280,10 +280,10 @@ void zpc_init(void) + } + } + +- /* Check MSA3. */ +- if (facility_list_nmemb >= OFF64(MSA3) + 1 +- && (facility_list[OFF64(MSA3)] & MASK64(MSA3))) { +- DEBUG("detected message-security-assist extension 3"); ++ /* Check MSA4. */ ++ if (facility_list_nmemb >= OFF64(MSA4) + 1 ++ && (facility_list[OFF64(MSA4)] & MASK64(MSA4))) { ++ DEBUG("detected message-security-assist extension 4"); + + memset(status_word, 0, sizeof(status_word)); + cpacf_pcc(CPACF_PCC_QUERY, &status_word); +-- +2.55.0 + + +From f12d031e99f29574c5f1a06e46b75c37f0e1c211 Mon Sep 17 00:00:00 2001 +From: Holger Dengler +Date: Fri, 19 Jun 2026 16:10:55 +0200 +Subject: [PATCH 2/6] man: Update pre-built man-pages + +Signed-off-by: Holger Dengler +--- + man/hbkzpcprovider.7 | 176 ++++++++++++++++++++++++++++++++++++++ + man/hbkzpcprovider.conf.5 | 134 +++++++++++++++++++++++++++++ + man/zpckey.1 | 106 +++++++++++++++++++++++ + 3 files changed, 416 insertions(+) + create mode 100644 man/hbkzpcprovider.7 + create mode 100644 man/hbkzpcprovider.conf.5 + create mode 100644 man/zpckey.1 + +diff --git a/man/hbkzpcprovider.7 b/man/hbkzpcprovider.7 +new file mode 100644 +index 0000000..78ba542 +--- /dev/null ++++ b/man/hbkzpcprovider.7 +@@ -0,0 +1,176 @@ ++.\" Automatically generated by Pandoc 3.7.0.2 ++.\" ++.TH "HBKZPCPROVIDER" "7" "2026" "LIBZPC v2" ++.SH NAME ++\f[CR]hbkzpc provider\f[R] \- An OpenSSL provider that provides an ++interface to the hardware\-backed key cryptographic operations, ++available on IBM Z and IBM LinuxONE. ++.SH DESCRIPTION ++IBM Z and IBM LinuxONE systems offer several types of hardware assists ++with different features, including the CP Assist for Cryptographic ++Functions (\f[I]CPACF\f[R]) and the IBM Crypto Express (\f[I]CEX\f[R]) ++features. ++.PP ++The \f[CR]hbkzpc provider\f[R] enables applications using the OpenSSL ++crypto library API to exploit the protected key cryptography ++(\f[I]ZPC\f[R]) functions, provided by CPACF on IBM Z and IBM LinuxONE. ++.PP ++To use the \f[CR]hbkzpc provider\f[R] via the OpenSSL crypto library ++API, it must be referenced in the OpenSSL configuration. ++For more details, see hbkzpcprovider.conf(5). ++.SS Hardware\-backed keys ++Hardware\-backed keys (\f[I]HBK\f[R]) are a generic concept, where the ++secret information of cryptographic keys is never exposed to the main ++memory, but cryptographic operations with such keys are still possible. ++Instead of the raw secret key information, opaque key objects are ++exposed to the applications. ++The internals of these opaque key objects (key slot reference, wrapped ++key blob, etc.) ++depends on the concrete implementation of the generic concept. ++It is essential, that the knowledge of the opaque key object does not ++expose any information about the real secret information of the key. ++.SS IBM Z protected key cryptography ++The IBM Z protected key cryptography is the implementation of the ++generic hardware\-backed key concept on IBM Z and IBM LinuxONE. ++The platform uses IBM Crypto Express (\f[I]CEX\f[R]) adapters (or often ++called: feature) or the IBM Secure Execution for Linux ultravisor to ++securely store secret key material and securely export them to the ++firmware. ++The \f[CR]hbkzpc provider\f[R] can handle opaque key objects (protected ++key origins), which describe and reference these secure keys. ++.PP ++ZPC provides many cryptographic functions with protected keys. ++The \f[CR]hbkzpc provider\f[R] supports ECDSA/EdDSA sign/verify ++operations for a list of ECC\-curves. ++See section \f[I]Provider functions\f[R] for more details. ++.SS Protected key origins ++A protected key origin for the \f[CR]hbkzpc provider\f[R] is used to ++internally export the referenced secure key to the firmware. ++While the resulting protected keys are volatile and can become invalid ++at any time, the protected key origins are persistent and can be stored ++without exposing any secret information. ++.PP ++A protected key origin is specified by a HBKZPC unified resource ++identifier (URI). ++These URIs can be encoded to protected key origin files. ++The \f[CR]hbkzpc provider\f[R] can handle either URIs directly or URIs ++which are encoded and stored in files (DER or PEM). ++See section \f[I]URI\f[R] for more details. ++.PP ++The \f[CR]zpckey\f[R] tool supports composing such protected key ++origins. ++See zpckey(1) for more details. ++.PP ++The \f[CR]hbkzpc provider\f[R] supports protected key origins for ++retrievable secrets in IBM Secure Execution for Linux (SEL) ultravisor. ++.SS Provider functions ++The \f[CR]hbkzpc provider\f[R] plugs into the OpenSSL provider API and ++provides the following functions: ++.IP \(bu 2 ++signature\-algorithms for ECDSA and EdDSA ++.IP \(bu 2 ++key\-manager for provider\-specific keys ++.IP \(bu 2 ++store\-loader for provider\-specific key URIs ++.IP \(bu 2 ++decoder for DER/PEM encoded provider\-specific key URI files ++.SS Supported ECC curves ++The \f[CR]hbkzpc provider\f[R] supports the following ECC\-curves for ++ECDSA and EdDSA respectively: ++.IP \(bu 2 ++prime256v1 ++.IP \(bu 2 ++secp384r1 ++.IP \(bu 2 ++secp521r1 ++.IP \(bu 2 ++ED25519 ++.IP \(bu 2 ++ED448 ++.SH URI ++The HBKZPC unified resource identifier (URI) specifies all information ++of the protected key origins, which is required for the provider to ++derive the related protected key. ++The URI has the following syntax (ABNF representation): ++.IP ++.EX ++hbkzpc\-URI = \(dqhbkzpc:\(dq hbkzpc\-param ++hbkzpc\-param = [ hbkzpc\-pattr *(\(dq;\(dq hbkzpc\-pattr) ] ++ ++hbkzpc\-pattr = origin\-type / origin\-alg / origin\-blob / ++ origin\-pubkey / comment ++ ++origin\-type = \(dqorigin\-type\(dq \(dq=\(dq *pchar ++origin\-alg = \(dqorigin\-alg\(dq \(dq=\(dq oid / *(pchar) ++origin\-blob = \(dqorigin\-blob\(dq \(dq=\(dq hex\-string ++origin\-pubkey = \(dqorigin\-pubkey\(dq \(dq=\(dq hex\-string ++comment = \(dqcomment\(dq \(dq=\(dq *pchar\-pct ++ ++oid = DIGIT *(\(dq.\(dq DIGIT) ++ ++hex\-byte = 2*HEXDIG ++hex\-string = [ hex\-byte *(hex\-byte) ] ++ ++pchar\-pct = pchar / pct\-encoded ++pchar = unreserved / res\-avail ++res\-avail = \(dq:\(dq / \(dq[\(dq / \(dq]\(dq / \(dq\(at\(dq / \(dq!\(dq / \(dq$\(dq / ++ \(dq\(aq\(dq / \(dq(\(dq / \(dq)\(dq / \(dq*\(dq / \(dq+\(dq / \(dq,\(dq / \(dq=\(dq ++ ++pct\-encoded = [ \(dq%\(dq 2*HEXDIG ] ++unreserved = ALPHA / DIGIT / \(dq\-\(dq / \(dq.\(dq / \(dq_\(dq / \(dq\(ti\(dq ++.EE ++.SH ENCODING ++The URI can also be encoded and stored to a file. ++Supported encoding formats are DER and PEM. ++.SS DER encoding ++For the DER encoding, the HBKZPC URI is encapsulated with a ASN.1 ++structure. ++Each DER file contains one structure in binary form. ++The structure has the following syntax: ++.IP ++.EX ++HardwareBackedKeyZPCFormat DEFINITIONS ::= BEGIN ++ HBKZPC ::= SEQUENCE { ++ desc [0] EXPLICIT VisibleString, ++ uri [1] EXPLICIT UTF8String, ++ } ++END ++.EE ++.PP ++The DER decoder of the \f[CR]hbkzpc provider\f[R] only handles DER files ++with a description (\f[I]desc\f[R]) of \f[I]HBKZPC Provider URI ++v1.0\f[R]. ++.SS PEM encoding ++The PEM encoding is a base64\-encoded DER structure. ++The encoded data is surrounded by a start and end tag. ++A PEM encoded file has the following form: ++.IP ++.EX ++\-\-\-\-\-BEGIN HARDWARE BACKED KEY ZPC\-\-\-\-\- ++[... ...] ++\-\-\-\-\-END HARDWARE BACKED KEY ZPC\-\-\-\-\- ++.EE ++.PP ++The PEM decoder of the \f[CR]hbkzpc provider\f[R] only handles PEM files ++with the label \f[I]HARDWARE BACKED KEY ZPC\f[R]. ++.SH GLOSSARY ++.TP ++CEX ++IBM Crypto Express ++.TP ++CPACF ++CP Assist for Cryptographic Functions ++.TP ++HBK ++hardware\-backed key ++.TP ++SEL ++IBM Secure Execution for Linux ++.TP ++URI ++unified resource identifier ++.TP ++ZPC ++IBM Z protected key cryptography ++.SH SEE ALSO ++zpckey(1), hbkzpcprovider.conf(5), provider(7SSL). +diff --git a/man/hbkzpcprovider.conf.5 b/man/hbkzpcprovider.conf.5 +new file mode 100644 +index 0000000..537c21b +--- /dev/null ++++ b/man/hbkzpcprovider.conf.5 +@@ -0,0 +1,134 @@ ++.\" Automatically generated by Pandoc 3.7.0.2 ++.\" ++.TH "HBKZPCPROVIDER.CNF" "5" "2026" "LIBZPC v2" ++.SH NAME ++hbkzpcprovider.conf \- Configuration syntax for the ++\f[CR]hbkzpc provider\f[R] ++.SH DESCRIPTION ++This page documents the syntax of the OpenSSL configuration file for the ++\f[CR]hbkzpc provider\f[R]. ++It is a sub\-set of the OpenSSL configuration file format, described in ++config(5SSL). ++.SH CONFIGURATION ++.SS OpenSSL Configuration ++The \f[CR]hbkzpc provider\f[R] can be configured application\-specific ++or system\-wide. ++In both cases, the configuration file needs to define and reference a ++section for the \f[CR]hbkzpc provider\f[R], following the OpenSSL ++configuration syntax (config(5SSL)). ++.PP ++The provider section for the \f[CR]hbkzpc provider\f[R] specifies the ++shared library of the provider (mandatory) and an activation flag ++(optional). ++.PP ++Since OpenSSL configuration supports drop\-ins (keyword ++\f[CR].inlcude\f[R]), the configuration for the ++\f[CR]hbkzpc provider\f[R] can also be placed in a separate ++configuration file. ++.SS Provider Section ++A provider section in the OpenSSL configuration defines generic ++parameters, as well as provider\-specific parameters. ++Each provider section must be referenced in the global providers ++sections (\f[I]provider_sect\f[R]) of the OpenSSL configuration file. ++The \f[CR]hbkzpc provider\f[R] supports no provider\-specific ++parameters, but the provider section for the \f[CR]hbkzpc provider\f[R] ++must specify at least the generic provider section parameter ++\f[I]module\f[R]. ++For more details about the generic provider parameters, see ++config(5SSL). ++.TP ++module (mandatory) ++This parameter takes a path to the provider shared object file. ++For the \f[CR]hbkzpc provider\f[R], use the absolute path to the ++installation location of \f[CR]zpcprovider.so\f[R] or the relative path ++to the OpenSSL modules directory. ++.TP ++activate (optional) ++If present and set to \f[CR]1\f[R], then the associated provider is ++activated. ++Conversely, setting this value to \f[CR]0\f[R] or not specifying the ++parameter at all prevents the provider from being activated (default: ++\f[CR]0\f[R]). ++.PP ++The \f[I]identity\f[R] parameter may be used in the provider section, ++but it has no impact to the registration of the ++\f[CR]hbkzpc provider\f[R]. ++It will always register itself with \(lqprovider=hbkzpc\(rq. ++Multiple instances of this provider may work but are not supported. ++.SH EXAMPLES ++The following drop\-in example specifies the \f[CR]hbkzpc provider\f[R] ++module and activates it. ++.IP ++.EX ++[provider_sect] ++hbkzpc = hbkzpc_sect ++ ++[hbkzpc_sect] ++module = zpcprovider.so ++activate = 1 ++.EE ++.PP ++The drop\-in file needs to be included in the main OpenSSL ++configuration, either by specifying the drop\-in file or the drop\-in ++directory (for example \f[CR]/etc/pki/tls/openssl.d/\f[R] on Fedora). ++.IP ++.EX ++\&.include /path/to/drop\-in\-directory ++.EE ++.PP ++The following configuration example covers a complete minimal OpenSSL ++configuration. ++It can be used for example as a temporary replacement for the ++system\-wide OpenSSL configuration. ++.IP ++.EX ++HOME = . ++ ++openssl_conf = openssl_init ++ ++[openssl_init] ++providers = provider_sect ++alg_section = evp_properties ++ ++[provider_sect] ++default = default_sect ++base = base_sect ++hbkzpc = hbkzpc_sect ++ ++[evp_properties] ++ ++[base_sect] ++activate = 1 ++ ++[default_sect] ++activate = 1 ++ ++[hbkzpc_sect] ++module = /path/to/zpcprovider.so ++activate = 1 ++.EE ++.PP ++To use this configuration example for an application, store it to a file ++(e.g.\ my\-openssl.conf) and reference this file in the environment ++variable \f[CR]OPENSSL_CONF\f[R]. ++The following command lists all configured providers: base, default and ++hbkzpc. ++.IP ++.EX ++$ env OPENSSL_CONF=my\-openssl.conf openssl list \-providers ++Providers: ++ base ++ name: OpenSSL Base Provider ++ version: 4.0.0 ++ status: active ++ default ++ name: OpenSSL Default Provider ++ version: 4.0.0 ++ status: active ++ hbkzpc ++ name: hbkzpc ++ version: 2.0.0 ++ status: active ++.EE ++.SH SEE ALSO ++hbkzpcprovider(7), config(5SSL). +diff --git a/man/zpckey.1 b/man/zpckey.1 +new file mode 100644 +index 0000000..877a592 +--- /dev/null ++++ b/man/zpckey.1 +@@ -0,0 +1,106 @@ ++.\" Automatically generated by Pandoc 3.7.0.2 ++.\" ++.TH "ZPCKEY" "1" "2026" "LIBZPC v2" ++.SH NAME ++zpckey \- A key management tooling for protected key origins, used by ++the OpenSSL provider for protected keys (\f[CR]hbkzpc provider\f[R]). ++.SH SYNOPSIS ++zpckey [\-h|\(enhelp] [\-V|\(enversion] ++.PP ++zpckey compose [] ++.PP ++zpckey show [] ++.SH DESCRIPTION ++The zpckey command provides key management functions for protected key ++origins, used by the \f[CR]hbkzpc provider\f[R] (hbkzpcprovider(7)). ++IBM Z and IBM LinuxONE offer different types of cryptographic hardware ++with different features, including the CP Assist for Cryptographic ++Functions (CPACF) and the IBM Crypto Express (CEX) features. ++.PP ++The CPACF provides functions to perform cryptographic operations with a ++kind of hardware\-backed keys, the so called protected keys. ++.PP ++The CEX cards provide secure key generation and storage (secure keys), ++as well as cryptographic operations with these keys. ++.SH OPTIONS ++.TP ++\-V, \-\-version ++Show version ++.TP ++\-h, \-\-help ++Show short help ++.SH ZPCKEY COMPOSE ++The \f[I]compose\f[R] command supports the composition of protected key ++origins, which can be used for the \f[CR]hbkzpc provider\f[R]. ++.SS Required Arguments: ++.TP ++\-t, \-\-origin\-type ++Protected key origin type ++.TP ++\-a, \-\-origin\-alg ++Protected key origin algorithm ++.SS Protected key origin types (): ++.IP \(bu 2 ++uv: Ultravisor retrievable secrets ++.SS Protected key origin algorithms (): ++.IP \(bu 2 ++prime256v1 (alt.: 1.2.840.10045.3.1.7) ++.IP \(bu 2 ++secp384r1 (alt.: 1.3.132.0.34) ++.IP \(bu 2 ++secp521r1 (alt.: 1.3.132.0.35) ++.IP \(bu 2 ++ED25519 (alt.: 1.3.101.112) ++.IP \(bu 2 ++ED448 (alt.: 1.3.101.113) ++.IP \(bu 2 ++AES\-128 ++.IP \(bu 2 ++AES\-192 ++.IP \(bu 2 ++AES\-256 ++.IP \(bu 2 ++AES\-128\-XTS ++.IP \(bu 2 ++AES\-256\-XTS ++.SS Optional Arguments: ++.TP ++\-p, \-\-pubkey ++Public key file ++.TP ++\-o, \-\-out ++Output file ++.TP ++\-\-outform ++Output file format URI, DER or PEM (default: PEM) ++.TP ++\-c, \-\-comment ++Comment (metadata) ++.TP ++\-h, \-\-help ++Show short help ++.SS Origin Arguments: ++.TP ++For = \f[I]uv\f[R], one out of the following must be specified: ++.TP ++\-\-uv\-secret\-id ++UV secret ID ++.TP ++\-\-uv\-secret\-name ++UV secret name ++.SH ZPCKEY SHOW ++The \f[I]show\f[R] command prints information about the key file to ++stdout. ++.SS Required Arguments: ++.TP ++\-i, \-\-in ++Input file ++.SS Optional Arguments: ++.TP ++\-\-inform ++Input file format PEM or DER (default: PEM) ++.TP ++\-h, \-\-help ++Show short help ++.SH SEE ALSO ++hbkzpcprovider.conf(5), hbkzpcprovider(7) +-- +2.55.0 + + +From 7960adcc472595fd89786757edcb051cf9c57df9 Mon Sep 17 00:00:00 2001 +From: Holger Dengler +Date: Fri, 19 Jun 2026 16:09:15 +0200 +Subject: [PATCH 3/6] cmake: Install pre-built man-pages + +Instead of installing converted man-pages, use the pre-built man-pages +instead. + +Signed-off-by: Holger Dengler +--- + CMakeLists.txt | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/CMakeLists.txt b/CMakeLists.txt +index 7cf6445..2f7a9db 100644 +--- a/CMakeLists.txt ++++ b/CMakeLists.txt +@@ -327,12 +327,12 @@ install( + ) + + install( +- FILES ${CMAKE_BINARY_DIR}/hbkzpcprovider.conf.5 ++ FILES ${CMAKE_SOURCE_DIR}/man/hbkzpcprovider.conf.5 + DESTINATION ${CMAKE_INSTALL_MANDIR}/man5 + ) + + install( +- FILES ${CMAKE_BINARY_DIR}/hbkzpcprovider.7 ++ FILES ${CMAKE_SOURCE_DIR}/man/hbkzpcprovider.7 + DESTINATION ${CMAKE_INSTALL_MANDIR}/man7 + ) + +@@ -383,7 +383,7 @@ install( + ) + + install( +- FILES ${CMAKE_BINARY_DIR}/zpckey.1 ++ FILES ${CMAKE_SOURCE_DIR}/man/zpckey.1 + DESTINATION ${CMAKE_INSTALL_MANDIR}/man1 + ) + +-- +2.55.0 + + +From 6ca79151e61cdf905d90aad375788ca0d59cb929 Mon Sep 17 00:00:00 2001 +From: Holger Dengler +Date: Fri, 19 Jun 2026 16:15:28 +0200 +Subject: [PATCH 4/6] cmake: Change man-page related build target + +Remove the man-page conversion target and change it to an explicit +update-man target. The conversion script has been relocated to the +misc/ sub-directory. The script now also gets reasonable defaults for +the source and target directory, so that it can also used manually +without parameters. + +Signed-off-by: Holger Dengler +--- + CMakeLists.txt | 5 +++-- + README.md | 19 ++++++++++++++++--- + conv_man.sh => misc/update-man | 5 +++-- + 3 files changed, 22 insertions(+), 7 deletions(-) + rename conv_man.sh => misc/update-man (79%) + +diff --git a/CMakeLists.txt b/CMakeLists.txt +index 2f7a9db..74e3684 100644 +--- a/CMakeLists.txt ++++ b/CMakeLists.txt +@@ -751,8 +751,9 @@ find_program(PANDOC pandoc) + if (PANDOC) + + add_custom_target( +- man ALL +- COMMAND ${CMAKE_SOURCE_DIR}/conv_man.sh "${CMAKE_SOURCE_DIR}/man" "${CMAKE_BINARY_DIR}" ++ update-man ALL ++ COMMAND ${CMAKE_SOURCE_DIR}/misc/update-man ${CMAKE_SOURCE_DIR}/man/ ${CMAKE_SOURCE_DIR}/man/ ++ VERBATIM + ) + + endif () # PANDOC_FOUND +diff --git a/README.md b/README.md +index 02d569b..632f3af 100644 +--- a/README.md ++++ b/README.md +@@ -39,9 +39,6 @@ Additional prerequisites for building the internal test program: + - libjson-c devel package >= 0.13 + - internet connection + +-Additional prerequisites for building the man-pages: +-- pandoc +- + Additional prerequisites for building the internal html and latex doc: + - doxygen >= 1.8.17 + - latex, bibtex +@@ -74,6 +71,22 @@ Custom compile options can also be passed to `cmake` via the `CFLAGS` and + `CXXFLAGS` environment variables in the usual way. + + ++Man-Pages ++--------- ++ ++The man-pages are generated from the related markdown sources. To ++update one of the man-pages, make the changes to the markdown-file, ++and use the `update-man` build target to update the pre-built man-page ++files (troff format). After updating the pre-built man-pages, commit ++them in a separate patch to the repository. ++ ++ # make changes to man/.
.md ++ cmake --build --target update-man # or ++ make -C build update-man ++ git add man/*.[157] ++ git commit -s -m "man: Update pre-built man-pages" ++ ++ + Cross-Building for s390x architecture + ------------------------------------- + +diff --git a/conv_man.sh b/misc/update-man +similarity index 79% +rename from conv_man.sh +rename to misc/update-man +index 992e147..ca15a72 100755 +--- a/conv_man.sh ++++ b/misc/update-man +@@ -2,10 +2,11 @@ + # SPDX-License-Identifier: MIT + # Copyright contributors to the libzpc project + +-SRCDIR=${1} +-DSTDIR=${2} ++SRCDIR=${1:-"./man/"} ++DSTDIR=${2:-"./man/"} + + [ -z "${SRCDIR}" ] || [ -z "${DSTDIR}" ] && exit 1 ++[ ! -d "${SRCDIR}" ] || [ ! -d "${DSTDIR}" ] && exit 1 + command -v pandoc >/dev/null 2>&1 || exit 1 + + for MD in "${SRCDIR}"/*.md; do +-- +2.55.0 + + +From a3f3b2b56df97e39436efce8f4e8883cee2887d4 Mon Sep 17 00:00:00 2001 +From: Holger Dengler +Date: Fri, 19 Jun 2026 18:22:58 +0200 +Subject: [PATCH 5/6] spec: Remove the pandoc dependency + +Signed-off-by: Holger Dengler +--- + libzpc.spec | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/libzpc.spec b/libzpc.spec +index ae30f1d..3700e37 100644 +--- a/libzpc.spec ++++ b/libzpc.spec +@@ -14,7 +14,6 @@ BuildRequires: gcc + BuildRequires: g++ + BuildRequires: make + BuildRequires: clang-tools-extra +-BuildRequires: pandoc + BuildRequires: json-c-devel + BuildRequires: openssl-devel >= 3.0.7 + +-- +2.55.0 + + +From 73b32ef1f419ba45da3b516c72540315650d2d6b Mon Sep 17 00:00:00 2001 +From: Holger Dengler +Date: Fri, 19 Jun 2026 18:23:44 +0200 +Subject: [PATCH 6/6] travis: Remove the pandoc dependency + +Signed-off-by: Holger Dengler +--- + .travis.yml | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/.travis.yml b/.travis.yml +index f029fcc..4e82506 100644 +--- a/.travis.yml ++++ b/.travis.yml +@@ -12,7 +12,7 @@ compiler: + + before_install: + - sudo apt-get update -qq +- - sudo apt-get install -y cmake pandoc clang-format libjson-c-dev libssl-dev ++ - sudo apt-get install -y cmake clang-format libjson-c-dev libssl-dev + + script: + - set -o pipefail +-- +2.55.0 + diff --git a/libzpc2.spec b/libzpc2.spec new file mode 100644 index 0000000..ed9f1c6 --- /dev/null +++ b/libzpc2.spec @@ -0,0 +1,88 @@ +Name: libzpc2 +Version: 2.0.1 +Release: %autorelease +Summary: Open Source library for the IBM Z Protected-key crypto feature + +License: MIT +Url: https://github.com/opencryptoki/libzpc +Source0: %{url}/archive/v%{version}/libzpc-%{version}.tar.gz + +# post GA fixes +Patch0: libzpc-2.0.1-fixes.patch + +BuildRequires: cmake +BuildRequires: gcc +BuildRequires: g++ +BuildRequires: make +BuildRequires: clang-tools-extra +BuildRequires: json-c-devel +BuildRequires: openssl-devel + + +%description +The IBM Z Protected-key Crypto library %{name} is an open-source project +targeting the 64-bit Linux on IBM Z (s390x) platform. It provides access +to z/Architecture's extensive performance-boosting hardware support and its +protected-key feature which ensures that key material is never present in +main memory at any time. + + +%ifarch s390x +%package -n libzpc-provider +Summary: OpenSSL provider module for %{name} +Provides: libzpc2-provider = %{version}-%{release} + +%description -n libzpc-provider +The %{name}-provider package contains a provider module for OpenSSL v3.0 (and +later), interfacing to the protected key feature of z/Architecture. +%endif + + +%package -n libzpc-tools +Summary: Key management tool for %{name} keys +Provides: libzpc2-tools = %{version}-%{release} + +%description -n libzpc-tools +The %{name}-tools package contains a key management tool for key origins. +As the protected keys itself are volatile, the tooling can be used to manage +persistent protected key origins, from which protected keys can be (re-)derived. + + +%prep +%autosetup -p1 -n libzpc-%{version} +%global modulesdir %(pkg-config --variable=modulesdir libcrypto) + +%build +%cmake +%cmake_build + +%install +%cmake_install +%ifarch s390x +install -m644 %_vpath_builddir/hbkzpcprovider.conf \ + -D -t $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/openssl.d/ +%endif + +%check +%ctest + + +%ifarch s390x +%files -n libzpc-provider +%doc README.md CHANGES.md +%license LICENSE +%{modulesdir}/zpcprovider.so +%{_mandir}/man5/hbkzpcprovider.conf.5* +%{_mandir}/man7/hbkzpcprovider.7* +%config(noreplace) %{_sysconfdir}/pki/tls/openssl.d/hbkzpcprovider.conf +%endif + +%files -n libzpc-tools +%doc README.md CHANGES.md +%license LICENSE +%{_bindir}/zpckey +%{_mandir}/man1/zpckey.1* + + +%changelog +%autochangelog diff --git a/sources b/sources new file mode 100644 index 0000000..e64ce04 --- /dev/null +++ b/sources @@ -0,0 +1 @@ +SHA512 (libzpc-2.0.1.tar.gz) = 0bd09cff0fcc427884c54ee09f05b55b585d4aad6c435ecd955cc4dddcbb0fabb8f77543d45210b3791cbc20cb7292ac9b8cf8aa2f501a8d0ab59922801a3692