import opencryptoki-3.18.0-4.el9
This commit is contained in:
CentOS Sources
Stepan Oksanichenko
parent
1356859811
commit
2975f2ed08
2
.gitignore
vendored
2
.gitignore
vendored
@ -1 +1 @@
|
|||||||
SOURCES/opencryptoki-3.17.0.tar.gz
|
SOURCES/opencryptoki-3.18.0.tar.gz
|
||||||
|
|||||||
@ -1 +1 @@
|
|||||||
598f43d2a04a878a4577f143251f4631625ac49b SOURCES/opencryptoki-3.17.0.tar.gz
|
257eb4d5458c52bf7c1634fea155bf217d561bd4 SOURCES/opencryptoki-3.18.0.tar.gz
|
||||||
|
|||||||
@ -1,56 +0,0 @@
|
|||||||
From a431e3742a1bdac515d0b491e77caeeb44720354 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Ingo Franzki <ifranzki@linux.ibm.com>
|
|
||||||
Date: Tue, 1 Feb 2022 13:50:18 +0100
|
|
||||||
Subject: [PATCH 1/2] EP11: Dilithium: Specify OID of key strength at key
|
|
||||||
generation
|
|
||||||
|
|
||||||
Newer EP11 firmware versions require that the OID of the desired
|
|
||||||
Dilithium key strength is specified with attribute CKA_IBM_PQC_PARAMS
|
|
||||||
at key generation. Older firmware versions ignore this attribute.
|
|
||||||
|
|
||||||
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
|
|
||||||
---
|
|
||||||
usr/lib/ep11_stdll/ep11_specific.c | 20 ++++++++++++++++++++
|
|
||||||
1 file changed, 20 insertions(+)
|
|
||||||
|
|
||||||
diff --git a/usr/lib/ep11_stdll/ep11_specific.c b/usr/lib/ep11_stdll/ep11_specific.c
|
|
||||||
index 75fd46a5..4ca9678a 100644
|
|
||||||
--- a/usr/lib/ep11_stdll/ep11_specific.c
|
|
||||||
+++ b/usr/lib/ep11_stdll/ep11_specific.c
|
|
||||||
@@ -6347,6 +6347,8 @@ static CK_RV ibm_dilithium_generate_keypair(STDLL_TokData_t * tokdata,
|
|
||||||
CK_ULONG new_publ_attrs_len = 0, new_priv_attrs_len = 0;
|
|
||||||
CK_ATTRIBUTE *new_publ_attrs2 = NULL, *new_priv_attrs2 = NULL;
|
|
||||||
CK_ULONG new_publ_attrs2_len = 0, new_priv_attrs2_len = 0;
|
|
||||||
+ const CK_BYTE dilithium_oid[] = { 0x06, 0x0b, 0x2b, 0x06, 0x01, 0x04, 0x01,
|
|
||||||
+ 0x02, 0x82, 0x0b, 0x01, 0x06, 0x05 };
|
|
||||||
|
|
||||||
UNUSED(h);
|
|
||||||
|
|
||||||
@@ -6371,6 +6373,24 @@ static CK_RV ibm_dilithium_generate_keypair(STDLL_TokData_t * tokdata,
|
|
||||||
goto error;
|
|
||||||
}
|
|
||||||
|
|
||||||
+ rc = add_to_attribute_array(&new_publ_attrs, &new_publ_attrs_len,
|
|
||||||
+ CKA_IBM_PQC_PARAMS, (CK_BYTE *)dilithium_oid,
|
|
||||||
+ sizeof(dilithium_oid));
|
|
||||||
+ if (rc != CKR_OK) {
|
|
||||||
+ TRACE_ERROR("%s add_to_attribute_array failed with rc=0x%lx\n",
|
|
||||||
+ __func__, rc);
|
|
||||||
+ goto error;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ rc = add_to_attribute_array(&new_priv_attrs, &new_priv_attrs_len,
|
|
||||||
+ CKA_IBM_PQC_PARAMS,(CK_BYTE *)dilithium_oid,
|
|
||||||
+ sizeof(dilithium_oid));
|
|
||||||
+ if (rc != CKR_OK) {
|
|
||||||
+ TRACE_ERROR("%s add_to_attribute_array failed with rc=0x%lx\n",
|
|
||||||
+ __func__, rc);
|
|
||||||
+ goto error;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
rc = check_key_attributes(tokdata, ktype, CKO_PUBLIC_KEY,
|
|
||||||
new_publ_attrs, new_publ_attrs_len,
|
|
||||||
&new_publ_attrs2, &new_publ_attrs2_len, -1);
|
|
||||||
--
|
|
||||||
2.16.2.windows.1
|
|
||||||
|
|
||||||
@ -1,66 +0,0 @@
|
|||||||
From 20f401a98d5c06648f5dd6ea62aa82f86662d90c Mon Sep 17 00:00:00 2001
|
|
||||||
From: Ingo Franzki <ifranzki@linux.ibm.com>
|
|
||||||
Date: Tue, 8 Mar 2022 15:01:24 +0100
|
|
||||||
Subject: [PATCH 2/2] EP11: Fix host library version query
|
|
||||||
|
|
||||||
Look at release and modification level, not just the modification level.
|
|
||||||
Release and modification level are encoded into the one byte minor
|
|
||||||
field of a CK_VERSION. The high order 4 bits are the release number, the
|
|
||||||
low order 4 bits the modification level.
|
|
||||||
|
|
||||||
This allows host library version checks for release and modification levels.
|
|
||||||
|
|
||||||
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
|
|
||||||
---
|
|
||||||
usr/lib/ep11_stdll/ep11_specific.c | 19 ++++++++++++++++---
|
|
||||||
1 file changed, 16 insertions(+), 3 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/usr/lib/ep11_stdll/ep11_specific.c b/usr/lib/ep11_stdll/ep11_specific.c
|
|
||||||
index 4ca9678a..2d7581fa 100644
|
|
||||||
--- a/usr/lib/ep11_stdll/ep11_specific.c
|
|
||||||
+++ b/usr/lib/ep11_stdll/ep11_specific.c
|
|
||||||
@@ -2588,9 +2588,10 @@ CK_RV ep11tok_init(STDLL_TokData_t * tokdata, CK_SLOT_ID SlotNumber,
|
|
||||||
goto error;
|
|
||||||
}
|
|
||||||
|
|
||||||
- TRACE_INFO("%s Host library version: %d.%d\n", __func__,
|
|
||||||
+ TRACE_INFO("%s Host library version: %d.%d.%d\n", __func__,
|
|
||||||
ep11_data->ep11_lib_version.major,
|
|
||||||
- ep11_data->ep11_lib_version.minor);
|
|
||||||
+ (ep11_data->ep11_lib_version.minor & 0xF0) >> 4,
|
|
||||||
+ (ep11_data->ep11_lib_version.minor & 0x0F));
|
|
||||||
|
|
||||||
rc = refresh_target_info(tokdata);
|
|
||||||
if (rc != CKR_OK) {
|
|
||||||
@@ -11289,8 +11290,19 @@ static CK_RV ep11tok_get_ep11_library_version(CK_VERSION *lib_version)
|
|
||||||
rc);
|
|
||||||
return rc;
|
|
||||||
}
|
|
||||||
+ TRACE_DEVEL("%s host_version=0x08%x\n", __func__, host_version);
|
|
||||||
lib_version->major = (host_version & 0x00FF0000) >> 16;
|
|
||||||
- lib_version->minor = host_version & 0x000000FF;
|
|
||||||
+ /* Minor is 4 bits release number and 4 bits modification level */
|
|
||||||
+ lib_version->minor = (host_version & 0x00000F00) >> 4 |
|
|
||||||
+ (host_version & 0x0000000F);
|
|
||||||
+ if ((host_version & 0x0000F000) != 0) {
|
|
||||||
+ lib_version->minor |= 0xF0;
|
|
||||||
+ TRACE_DEVEL("%s relelase > 15, treating as 15\n", __func__);
|
|
||||||
+ }
|
|
||||||
+ if ((host_version & 0x000000F0) != 0) {
|
|
||||||
+ lib_version->minor |= 0x0F;
|
|
||||||
+ TRACE_DEVEL("%s modification level > 15, treating as 15\n", __func__);
|
|
||||||
+ }
|
|
||||||
/*
|
|
||||||
* EP11 host library < v2.0 returns an invalid version (i.e. 0x100). This
|
|
||||||
* can safely be treated as version 1.0
|
|
||||||
@@ -11399,6 +11411,7 @@ CK_RV ep11tok_copy_firmware_info(STDLL_TokData_t *tokdata,
|
|
||||||
if (target_info->card_versions != NULL)
|
|
||||||
pInfo->hardwareVersion = target_info->card_versions->firmware_version;
|
|
||||||
pInfo->firmwareVersion = ep11_data->ep11_lib_version;
|
|
||||||
+ pInfo->firmwareVersion.minor >>= 4; /* report release, skip mod-level */
|
|
||||||
memcpy(pInfo->serialNumber, target_info->serialNumber,
|
|
||||||
sizeof(pInfo->serialNumber));
|
|
||||||
|
|
||||||
--
|
|
||||||
2.16.2.windows.1
|
|
||||||
|
|
||||||
@ -1,88 +0,0 @@
|
|||||||
commit 8e9800b492f7a40ed5dfcd85e042701b6a5c5a26
|
|
||||||
Author: Ingo Franzki <ifranzki@linux.ibm.com>
|
|
||||||
Date: Tue Dec 7 16:39:28 2021 +0100
|
|
||||||
|
|
||||||
ICA/EP11: Support libica version 4
|
|
||||||
|
|
||||||
Try to load libica version 4 (libica.so.4), but fall back to version 3
|
|
||||||
(libica.so.3) if version 4 is not available.
|
|
||||||
|
|
||||||
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
|
|
||||||
|
|
||||||
diff --git a/usr/lib/ep11_stdll/ep11_specific.c b/usr/lib/ep11_stdll/ep11_specific.c
|
|
||||||
index 4029e5a5..f223017d 100644
|
|
||||||
--- a/usr/lib/ep11_stdll/ep11_specific.c
|
|
||||||
+++ b/usr/lib/ep11_stdll/ep11_specific.c
|
|
||||||
@@ -68,7 +68,8 @@
|
|
||||||
#define EP11SHAREDLIB_V2 "libep11.so.2"
|
|
||||||
#define EP11SHAREDLIB_V1 "libep11.so.1"
|
|
||||||
#define EP11SHAREDLIB "libep11.so"
|
|
||||||
-#define ICASHAREDLIB "libica.so.3"
|
|
||||||
+#define ICASHAREDLIB_V4 "libica.so.4"
|
|
||||||
+#define ICASHAREDLIB_V3 "libica.so.3"
|
|
||||||
|
|
||||||
CK_RV ep11tok_get_mechanism_list(STDLL_TokData_t * tokdata,
|
|
||||||
CK_MECHANISM_TYPE_PTR mlist,
|
|
||||||
@@ -2044,9 +2045,9 @@ static CK_RV make_wrapblob(STDLL_TokData_t * tokdata, CK_ATTRIBUTE * tmpl_in,
|
|
||||||
}
|
|
||||||
|
|
||||||
#ifdef EP11_HSMSIM
|
|
||||||
-#define DLOPEN_FLAGS RTLD_GLOBAL | RTLD_NOW | RTLD_DEEPBIND
|
|
||||||
+#define DLOPEN_FLAGS RTLD_NOW | RTLD_DEEPBIND
|
|
||||||
#else
|
|
||||||
-#define DLOPEN_FLAGS RTLD_GLOBAL | RTLD_NOW
|
|
||||||
+#define DLOPEN_FLAGS RTLD_NOW
|
|
||||||
#endif
|
|
||||||
|
|
||||||
static void *ep11_load_host_lib()
|
|
||||||
@@ -2209,12 +2210,16 @@ static CK_RV ep11tok_load_libica(STDLL_TokData_t *tokdata)
|
|
||||||
return CKR_OK;
|
|
||||||
|
|
||||||
if (strcmp(ep11_data->digest_libica_path, "") == 0) {
|
|
||||||
- strcpy(ep11_data->digest_libica_path, ICASHAREDLIB);
|
|
||||||
+ strcpy(ep11_data->digest_libica_path, ICASHAREDLIB_V4);
|
|
||||||
default_libica = 1;
|
|
||||||
+ libica->library = dlopen(ep11_data->digest_libica_path, RTLD_NOW);
|
|
||||||
+ if (libica->library == NULL) {
|
|
||||||
+ strcpy(ep11_data->digest_libica_path, ICASHAREDLIB_V3);
|
|
||||||
+ libica->library = dlopen(ep11_data->digest_libica_path, RTLD_NOW);
|
|
||||||
+ }
|
|
||||||
+ } else {
|
|
||||||
+ libica->library = dlopen(ep11_data->digest_libica_path, RTLD_NOW);
|
|
||||||
}
|
|
||||||
-
|
|
||||||
- libica->library = dlopen(ep11_data->digest_libica_path,
|
|
||||||
- RTLD_GLOBAL | RTLD_NOW);
|
|
||||||
if (libica->library == NULL) {
|
|
||||||
errstr = dlerror();
|
|
||||||
OCK_SYSLOG(default_libica ? LOG_WARNING : LOG_ERR,
|
|
||||||
diff --git a/usr/lib/ica_s390_stdll/ica_specific.c b/usr/lib/ica_s390_stdll/ica_specific.c
|
|
||||||
index fd18de42..c4fa9654 100644
|
|
||||||
--- a/usr/lib/ica_s390_stdll/ica_specific.c
|
|
||||||
+++ b/usr/lib/ica_s390_stdll/ica_specific.c
|
|
||||||
@@ -83,7 +83,8 @@ const char label[] = "icatok";
|
|
||||||
|
|
||||||
static pthread_mutex_t rngmtx = PTHREAD_MUTEX_INITIALIZER;
|
|
||||||
|
|
||||||
-#define LIBICA_SHARED_LIB "libica.so.3"
|
|
||||||
+#define LIBICA_SHARED_LIB_V3 "libica.so.3"
|
|
||||||
+#define LIBICA_SHARED_LIB_V4 "libica.so.4"
|
|
||||||
#define BIND(dso, sym) do { \
|
|
||||||
if (p_##sym == NULL) \
|
|
||||||
*(void **)(&p_##sym) = dlsym(dso, #sym); \
|
|
||||||
@@ -221,9 +222,13 @@ static CK_RV load_libica(void)
|
|
||||||
void *ibmca_dso = NULL;
|
|
||||||
|
|
||||||
/* Load libica */
|
|
||||||
- ibmca_dso = dlopen(LIBICA_SHARED_LIB, RTLD_NOW);
|
|
||||||
+ ibmca_dso = dlopen(LIBICA_SHARED_LIB_V4, RTLD_NOW);
|
|
||||||
+ if (ibmca_dso == NULL)
|
|
||||||
+ ibmca_dso = dlopen(LIBICA_SHARED_LIB_V3, RTLD_NOW);
|
|
||||||
+
|
|
||||||
if (ibmca_dso == NULL) {
|
|
||||||
- TRACE_ERROR("%s: dlopen(%s) failed\n", __func__, LIBICA_SHARED_LIB);
|
|
||||||
+ TRACE_ERROR("%s: dlopen(%s or %s) failed: %s\n", __func__,
|
|
||||||
+ LIBICA_SHARED_LIB_V4, LIBICA_SHARED_LIB_V3, dlerror());
|
|
||||||
return CKR_FUNCTION_FAILED;
|
|
||||||
}
|
|
||||||
|
|
||||||
@ -1,12 +0,0 @@
|
|||||||
diff -up opencryptoki-3.17.0/Makefile.am.me opencryptoki-3.17.0/Makefile.am
|
|
||||||
--- opencryptoki-3.17.0/Makefile.am.me 2021-11-09 09:45:49.032661898 +0100
|
|
||||||
+++ opencryptoki-3.17.0/Makefile.am 2021-11-09 09:46:41.353400986 +0100
|
|
||||||
@@ -76,7 +76,7 @@ if ENABLE_EP11TOK
|
|
||||||
endif
|
|
||||||
if ENABLE_P11SAK
|
|
||||||
test -f $(DESTDIR)$(sysconfdir)/opencryptoki || $(MKDIR_P) $(DESTDIR)$(sysconfdir)/opencryptoki || true
|
|
||||||
- test -f $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || $(INSTALL) -g pkcs11 -m 0640 $(srcdir)/usr/sbin/p11sak/p11sak_defined_attrs.conf $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || true
|
|
||||||
+ test -f $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || $(INSTALL) -m 0644 $(srcdir)/usr/sbin/p11sak/p11sak_defined_attrs.conf $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || true
|
|
||||||
endif
|
|
||||||
if ENABLE_ICATOK
|
|
||||||
cd $(DESTDIR)$(libdir)/opencryptoki/stdll && \
|
|
||||||
@ -1,12 +0,0 @@
|
|||||||
diff -up opencryptoki-3.17.0/usr/lib/api/api_interface.c.me opencryptoki-3.17.0/usr/lib/api/api_interface.c
|
|
||||||
--- opencryptoki-3.17.0/usr/lib/api/api_interface.c.me 2022-01-17 12:04:18.937010924 +0100
|
|
||||||
+++ opencryptoki-3.17.0/usr/lib/api/api_interface.c 2022-01-17 12:04:54.020182038 +0100
|
|
||||||
@@ -2869,7 +2869,7 @@ CK_RV C_Initialize(CK_VOID_PTR pVoid)
|
|
||||||
|
|
||||||
rc = check_user_and_group();
|
|
||||||
if (rc != CKR_OK)
|
|
||||||
- return rc;
|
|
||||||
+ goto done;
|
|
||||||
|
|
||||||
if (!Anchor) {
|
|
||||||
Anchor = (API_Proc_Struct_t *) malloc(sizeof(API_Proc_Struct_t));
|
|
||||||
47
SOURCES/opencryptoki-3.18.0-fix-json-output.patch
Normal file
47
SOURCES/opencryptoki-3.18.0-fix-json-output.patch
Normal file
@ -0,0 +1,47 @@
|
|||||||
|
commit 1600eebb422ae2a733de3a0bd47464620e39ab0d
|
||||||
|
Author: Ingo Franzki <ifranzki@linux.ibm.com>
|
||||||
|
Date: Tue Jun 7 08:58:16 2022 +0200
|
||||||
|
|
||||||
|
pkcsstats: Fix JSON output in case of errors
|
||||||
|
|
||||||
|
Produce correct JSON output, even if an error occurs during obtaining
|
||||||
|
of the statistics for a user.
|
||||||
|
|
||||||
|
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
|
||||||
|
|
||||||
|
diff --git a/usr/sbin/pkcsstats/pkcsstats.c b/usr/sbin/pkcsstats/pkcsstats.c
|
||||||
|
index 8eb049dd..65d4833f 100644
|
||||||
|
--- a/usr/sbin/pkcsstats/pkcsstats.c
|
||||||
|
+++ b/usr/sbin/pkcsstats/pkcsstats.c
|
||||||
|
@@ -789,7 +789,7 @@ int main(int argc, char **argv)
|
||||||
|
bool reset = false, reset_all = false;
|
||||||
|
bool delete = false, delete_all = false;
|
||||||
|
bool slot_id_specified = false;
|
||||||
|
- bool json = false;
|
||||||
|
+ bool json = false, json_started = false;
|
||||||
|
CK_SLOT_ID slot_id = 0;
|
||||||
|
void *dll = NULL;
|
||||||
|
CK_FUNCTION_LIST *func_list = NULL;
|
||||||
|
@@ -949,8 +949,11 @@ int main(int argc, char **argv)
|
||||||
|
goto done;
|
||||||
|
}
|
||||||
|
|
||||||
|
- if (json && print_json_start() != 0)
|
||||||
|
- goto done;
|
||||||
|
+ if (json) {
|
||||||
|
+ if (print_json_start() != 0)
|
||||||
|
+ goto done;
|
||||||
|
+ json_started = true;
|
||||||
|
+ }
|
||||||
|
|
||||||
|
dd.func_list = func_list;
|
||||||
|
dd.num_slots = num_slots;
|
||||||
|
@@ -972,7 +975,7 @@ int main(int argc, char **argv)
|
||||||
|
}
|
||||||
|
|
||||||
|
done:
|
||||||
|
- if (rc == 0 && json)
|
||||||
|
+ if (json && json_started)
|
||||||
|
printf("\n\t]\n}\n");
|
||||||
|
|
||||||
|
if (slots != NULL)
|
||||||
21
SOURCES/opencryptoki-3.18.0-p11sak.patch
Normal file
21
SOURCES/opencryptoki-3.18.0-p11sak.patch
Normal file
@ -0,0 +1,21 @@
|
|||||||
|
diff -up opencryptoki-3.18.0/Makefile.am.me opencryptoki-3.18.0/Makefile.am
|
||||||
|
--- opencryptoki-3.18.0/Makefile.am.me 2022-05-09 22:25:07.980238715 +0200
|
||||||
|
+++ opencryptoki-3.18.0/Makefile.am 2022-05-09 22:25:29.292722755 +0200
|
||||||
|
@@ -78,7 +78,7 @@ if ENABLE_EP11TOK
|
||||||
|
endif
|
||||||
|
if ENABLE_P11SAK
|
||||||
|
test -f $(DESTDIR)$(sysconfdir)/opencryptoki || $(MKDIR_P) $(DESTDIR)$(sysconfdir)/opencryptoki || true
|
||||||
|
- test -f $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || $(INSTALL) -g pkcs11 -m 0640 $(srcdir)/usr/sbin/p11sak/p11sak_defined_attrs.conf $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || true
|
||||||
|
+ test -f $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || $(INSTALL) -m 0640 $(srcdir)/usr/sbin/p11sak/p11sak_defined_attrs.conf $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || true
|
||||||
|
endif
|
||||||
|
if ENABLE_ICATOK
|
||||||
|
cd $(DESTDIR)$(libdir)/opencryptoki/stdll && \
|
||||||
|
@@ -129,7 +129,7 @@ endif
|
||||||
|
if ENABLE_DAEMON
|
||||||
|
test -f $(DESTDIR)$(sysconfdir)/opencryptoki || $(MKDIR_P) $(DESTDIR)$(sysconfdir)/opencryptoki || true
|
||||||
|
test -f $(DESTDIR)$(sysconfdir)/opencryptoki/opencryptoki.conf || $(INSTALL) -m 644 $(srcdir)/usr/sbin/pkcsslotd/opencryptoki.conf $(DESTDIR)$(sysconfdir)/opencryptoki/opencryptoki.conf || true
|
||||||
|
- test -f $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || $(INSTALL) -m 640 -o root -g pkcs11 -T $(srcdir)/doc/strength-example.conf $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || true
|
||||||
|
+ test -f $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || $(INSTALL) -m 640 -o root -T $(srcdir)/doc/strength-example.conf $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || true
|
||||||
|
if ENABLE_SYSTEMD
|
||||||
|
mkdir -p $(DESTDIR)/usr/lib/tmpfiles.d
|
||||||
|
cp $(srcdir)/misc/tmpfiles.conf $(DESTDIR)/usr/lib/tmpfiles.d/opencryptoki.conf
|
||||||
@ -1,29 +0,0 @@
|
|||||||
diff -up opencryptoki-3.16.0/misc/pkcsslotd.service.in.me opencryptoki-3.16.0/misc/pkcsslotd.service.in
|
|
||||||
--- opencryptoki-3.16.0/misc/pkcsslotd.service.in.me 2021-06-25 09:25:11.464487847 +0200
|
|
||||||
+++ opencryptoki-3.16.0/misc/pkcsslotd.service.in 2021-06-25 09:25:38.701225760 +0200
|
|
||||||
@@ -4,7 +4,7 @@ After=local-fs.target
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
Type=forking
|
|
||||||
-PIDFile=/var/run/pkcsslotd.pid
|
|
||||||
+PIDFile=/run/pkcsslotd.pid
|
|
||||||
ExecStart=@sbindir@/pkcsslotd
|
|
||||||
|
|
||||||
[Install]
|
|
||||||
diff -up opencryptoki-3.16.0/usr/include/slotmgr.h.me opencryptoki-3.16.0/usr/include/slotmgr.h
|
|
||||||
--- opencryptoki-3.16.0/usr/include/slotmgr.h.me 2021-06-30 17:28:18.000594834 +0200
|
|
||||||
+++ opencryptoki-3.16.0/usr/include/slotmgr.h 2021-06-30 17:28:38.920890278 +0200
|
|
||||||
@@ -30,10 +30,10 @@
|
|
||||||
#define TOK_PATH SBIN_PATH "/pkcsslotd"
|
|
||||||
#define OCK_API_LOCK_FILE LOCKDIR_PATH "/LCK..APIlock"
|
|
||||||
|
|
||||||
-#define PROC_SOCKET_FILE_PATH "/var/run/pkcsslotd.socket"
|
|
||||||
-#define ADMIN_SOCKET_FILE_PATH "/var/run/pkcsslotd.admin.socket"
|
|
||||||
+#define PROC_SOCKET_FILE_PATH "/run/pkcsslotd.socket"
|
|
||||||
+#define ADMIN_SOCKET_FILE_PATH "/run/pkcsslotd.admin.socket"
|
|
||||||
|
|
||||||
-#define PID_FILE_PATH "/var/run/pkcsslotd.pid"
|
|
||||||
+#define PID_FILE_PATH "/run/pkcsslotd.pid"
|
|
||||||
#define OCK_CONFIG OCK_CONFDIR "/opencryptoki.conf"
|
|
||||||
|
|
||||||
#ifndef CK_BOOL
|
|
||||||
@ -1,7 +1,7 @@
|
|||||||
Name: opencryptoki
|
Name: opencryptoki
|
||||||
Summary: Implementation of the PKCS#11 (Cryptoki) specification v3.0
|
Summary: Implementation of the PKCS#11 (Cryptoki) specification v3.0
|
||||||
Version: 3.17.0
|
Version: 3.18.0
|
||||||
Release: 8%{?dist}
|
Release: 4%{?dist}
|
||||||
License: CPL
|
License: CPL
|
||||||
URL: https://github.com/opencryptoki/opencryptoki
|
URL: https://github.com/opencryptoki/opencryptoki
|
||||||
Source0: https://github.com/opencryptoki/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz
|
Source0: https://github.com/opencryptoki/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz
|
||||||
@ -9,18 +9,13 @@ Source0: https://github.com/opencryptoki/%{name}/archive/v%{version}/%{name}-%{
|
|||||||
Patch0: opencryptoki-3.11.0-group.patch
|
Patch0: opencryptoki-3.11.0-group.patch
|
||||||
# bz#1373833, change tmpfiles snippets from /var/lock/* to /run/lock/*
|
# bz#1373833, change tmpfiles snippets from /var/lock/* to /run/lock/*
|
||||||
Patch1: opencryptoki-3.11.0-lockdir.patch
|
Patch1: opencryptoki-3.11.0-lockdir.patch
|
||||||
# add missing p11sak_defined_attrs.conf
|
# add missing p11sak_defined_attrs.conf, strength.conf
|
||||||
Patch2: opencryptoki-3.17.0-p11sak.patch
|
Patch2: opencryptoki-3.18.0-p11sak.patch
|
||||||
# upstream patches
|
# upstream patches
|
||||||
# PIDfile below legacy directory /var/run/
|
Patch100: opencryptoki-3.18.0-fix-json-output.patch
|
||||||
Patch300: opencryptoki-pkcsslotd-pidfile.patch
|
Patch101: opencryptoki-3.18.0-returning_CKR_BUFFER_TOO_SMALL.patch
|
||||||
Patch301: opencryptoki-3.17.0-unlock-globmutex-if-user-and-group-check-fail.patch
|
|
||||||
Patch302: opencryptoki-3.17-libica4-8e9800b492f7a40ed5dfcd85e042701b6a5c5a26.patch
|
|
||||||
Patch303: 0001-EP11-Dilithium-Specify-OID-of-key-strength-at-key-ge.patch
|
|
||||||
Patch304: 0002-EP11-Fix-host-library-version-query.patch
|
|
||||||
Patch305: opencryptoki-3.18.0-returning_CKR_BUFFER_TOO_SMALL.patch
|
|
||||||
|
|
||||||
Requires(pre): coreutils
|
Requires(pre): coreutils diffutils
|
||||||
Requires: (selinux-policy >= 34.1.8-1 if selinux-policy-targeted)
|
Requires: (selinux-policy >= 34.1.8-1 if selinux-policy-targeted)
|
||||||
BuildRequires: gcc
|
BuildRequires: gcc
|
||||||
BuildRequires: gcc-c++
|
BuildRequires: gcc-c++
|
||||||
@ -244,18 +239,24 @@ fi
|
|||||||
%doc ChangeLog FAQ README.md
|
%doc ChangeLog FAQ README.md
|
||||||
%doc doc/opencryptoki-howto.md
|
%doc doc/opencryptoki-howto.md
|
||||||
%doc doc/README.token_data
|
%doc doc/README.token_data
|
||||||
|
%doc %{_docdir}/%{name}/*.conf
|
||||||
%dir %{_sysconfdir}/%{name}
|
%dir %{_sysconfdir}/%{name}
|
||||||
%config(noreplace) %{_sysconfdir}/%{name}/%{name}.conf
|
%config(noreplace) %{_sysconfdir}/%{name}/%{name}.conf
|
||||||
%attr(0640, root, pkcs11) %config(noreplace) %{_sysconfdir}/%{name}/p11sak_defined_attrs.conf
|
%attr(0640, root, pkcs11) %config(noreplace) %{_sysconfdir}/%{name}/p11sak_defined_attrs.conf
|
||||||
|
%attr(0640, root, pkcs11) %config(noreplace) %{_sysconfdir}/%{name}/strength.conf
|
||||||
%{_tmpfilesdir}/%{name}.conf
|
%{_tmpfilesdir}/%{name}.conf
|
||||||
%{_unitdir}/pkcsslotd.service
|
%{_unitdir}/pkcsslotd.service
|
||||||
%{_sbindir}/p11sak
|
%{_sbindir}/p11sak
|
||||||
%{_sbindir}/pkcstok_migrate
|
%{_sbindir}/pkcstok_migrate
|
||||||
%{_sbindir}/pkcsconf
|
%{_sbindir}/pkcsconf
|
||||||
%{_sbindir}/pkcsslotd
|
%{_sbindir}/pkcsslotd
|
||||||
|
%{_sbindir}/pkcsstats
|
||||||
%{_mandir}/man1/p11sak.1*
|
%{_mandir}/man1/p11sak.1*
|
||||||
%{_mandir}/man1/pkcstok_migrate.1*
|
%{_mandir}/man1/pkcstok_migrate.1*
|
||||||
%{_mandir}/man1/pkcsconf.1*
|
%{_mandir}/man1/pkcsconf.1*
|
||||||
|
%{_mandir}/man1/pkcsstats.1*
|
||||||
|
%{_mandir}/man5/policy.conf.5*
|
||||||
|
%{_mandir}/man5/strength.conf.5*
|
||||||
%{_mandir}/man5/%{name}.conf.5*
|
%{_mandir}/man5/%{name}.conf.5*
|
||||||
%{_mandir}/man5/p11sak_defined_attrs.conf.5*
|
%{_mandir}/man5/p11sak_defined_attrs.conf.5*
|
||||||
%{_mandir}/man7/%{name}.7*
|
%{_mandir}/man7/%{name}.7*
|
||||||
@ -339,17 +340,28 @@ fi
|
|||||||
|
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
* Mon Sep 12 2022 Than Ngo <than@redhat.com> - 3.17.0-8
|
* Fri Jul 29 2022 Than Ngo <than@redhat.com> - 3.18.0-4
|
||||||
- Resolves: #2127873, do not touch opencryptoki.conf if it is in place already and even if it is unchanged
|
- Related: #2044179, do not touch opencryptoki.conf if it is in place already and even if it is unchanged
|
||||||
|
|
||||||
* Wed Aug 03 2022 Than Ngo <than@redhat.com> - 3.17.0-7
|
* Tue Jun 07 2022 Than Ngo <than@redhat.com> - 3.18.0-3
|
||||||
- Resolves: #2114913, EP11: Fix C_GetMechanismList returning CKR_BUFFER_TOO_SMALL
|
- Related: #2044179, fix json output
|
||||||
|
|
||||||
|
* Mon May 09 2022 Than Ngo <than@redhat.com> - 3.18.0-2
|
||||||
|
- Related: #2044179, add missing strength.conf
|
||||||
|
|
||||||
|
* Mon May 09 2022 Than Ngo <than@redhat.com> - 3.18.0-1
|
||||||
|
- Resolves: #2044179, rebase to 3.18.0
|
||||||
|
- Resolves: #2068091, pkcsconf -t failed with Segmentation fault in FIPS mode
|
||||||
|
- Resolves: #2066763, Dilithium support not available
|
||||||
|
- Resolves: #2064697, OpenSSL 3.0 Compatibility for IBM Security Libraries and Tools
|
||||||
|
- Resolves: #2044181, support crypto profiles
|
||||||
|
- Resolves: #2044180, add crypto counters
|
||||||
|
|
||||||
* Tue May 03 2022 Than Ngo <than@redhat.com> - 3.17.0-6
|
* Tue May 03 2022 Than Ngo <than@redhat.com> - 3.17.0-6
|
||||||
- Resolves: #2081355, Dilithium support not available
|
- Resolves: #2066763, Dilithium support not available
|
||||||
|
|
||||||
* Mon Mar 14 2022 Than Ngo <than@redhat.com> - 3.17.0-5
|
* Mon Mar 14 2022 Than Ngo <than@redhat.com> - 3.17.0-5
|
||||||
- Related: #2015888, ICA/EP11: Support libica version 4
|
- Resolves: #2064697, ICA/EP11: Support libica version 4
|
||||||
|
|
||||||
* Mon Jan 17 2022 Than Ngo <than@redhat.com> - 3.17.0-4
|
* Mon Jan 17 2022 Than Ngo <than@redhat.com> - 3.17.0-4
|
||||||
- Resolves: #2040678, API: Unlock GlobMutex if user and group check fails
|
- Resolves: #2040678, API: Unlock GlobMutex if user and group check fails
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user