diff --git a/0001-Fix-build-error-on-32-bit-systems-size_t-vs-CK_ULONG.patch b/0001-Fix-build-error-on-32-bit-systems-size_t-vs-CK_ULONG.patch new file mode 100644 index 0000000..c3684f9 --- /dev/null +++ b/0001-Fix-build-error-on-32-bit-systems-size_t-vs-CK_ULONG.patch @@ -0,0 +1,80 @@ +From 627d27514e7494d36d3d7924e03e4e23ac76bec3 Mon Sep 17 00:00:00 2001 +From: Andreas Tille +Date: Tue, 23 Jun 2026 14:30:32 +0200 +Subject: [PATCH] Fix build error on 32 bit systems: size_t vs CK_ULONG pointer + incompatibility + +On i386, size_t is 'unsigned int' while CK_ULONG is 'unsigned long'. + +Signed-off-by: Andreas Tille +Signed-off-by: Ingo Franzki +--- + usr/lib/common/mech_openssl.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/usr/lib/common/mech_openssl.c b/usr/lib/common/mech_openssl.c +index 6a27c660f..85d7d49ae 100644 +--- a/usr/lib/common/mech_openssl.c ++++ b/usr/lib/common/mech_openssl.c +@@ -2567,7 +2567,7 @@ CK_RV openssl_specific_ec_generate_keypair(STDLL_TokData_t *tokdata, + #endif + CK_BYTE *ecpoint = NULL, *enc_ecpoint = NULL, *d = NULL; + CK_ULONG enc_ecpoint_len, d_len; +- size_t ecpoint_len; ++ size_t ecpoint_len, d_size; + EVP_PKEY_CTX *ctx = NULL; + EVP_PKEY *ec_pkey = NULL; + int nid, pkey_type; +@@ -2762,12 +2762,14 @@ CK_RV openssl_specific_ec_generate_keypair(STDLL_TokData_t *tokdata, + BN_bn2binpad(bn_d, d, d_len); + } else { + /* Edwards/Montgomery: private key is a octet string */ ++ d_size = 0; + if (!EVP_PKEY_get_octet_string_param(ec_pkey, OSSL_PKEY_PARAM_PRIV_KEY, +- d, 0, &d_len)) { ++ d, 0, &d_size)) { + TRACE_ERROR("EVP_PKEY_get_octet_string_param failed\n"); + rc = CKR_FUNCTION_FAILED; + goto out; + } ++ d_len = d_size; + + d = OPENSSL_zalloc(d_len); + if (d == NULL) { +@@ -2777,11 +2779,12 @@ CK_RV openssl_specific_ec_generate_keypair(STDLL_TokData_t *tokdata, + } + + if (!EVP_PKEY_get_octet_string_param(ec_pkey, OSSL_PKEY_PARAM_PRIV_KEY, +- d, d_len, &d_len)) { ++ d, d_size, &d_size)) { + TRACE_ERROR("EVP_PKEY_get_octet_string_param failed\n"); + rc = CKR_FUNCTION_FAILED; + goto out; + } ++ d_len = d_size; + } + #endif + +@@ -7030,6 +7033,7 @@ CK_RV openssl_specific_pqc_get_pub_key_from_priv_key(TEMPLATE *priv_tmpl, + const char *alg_name; + EVP_PKEY *pkey = NULL; + CK_RV rc; ++ size_t pub_value_len; + + alg_name = openssl_get_pqc_oid_name(oid); + if (alg_name == NULL) { +@@ -7048,12 +7052,13 @@ CK_RV openssl_specific_pqc_get_pub_key_from_priv_key(TEMPLATE *priv_tmpl, + + rc = openssl_get_key_from_pkey(pkey, OSSL_PKEY_PARAM_PUB_KEY, + (CK_BYTE **)&pub_value->pValue, +- &pub_value->ulValueLen, ++ &pub_value_len, + FALSE); + if (rc != CKR_OK) { + TRACE_ERROR("get_key_from_pkey failed for pub key\n"); + goto out; + } ++ pub_value->ulValueLen = pub_value_len; + + pub_value->type = CKA_VALUE; + diff --git a/0002-Fix-unused-variable-d_size-Werror-unused-variable-wi.patch b/0002-Fix-unused-variable-d_size-Werror-unused-variable-wi.patch new file mode 100644 index 0000000..9c1ab78 --- /dev/null +++ b/0002-Fix-unused-variable-d_size-Werror-unused-variable-wi.patch @@ -0,0 +1,37 @@ +From ca1ac6235b9d6231578a8487dc441d1ca2a3dfd9 Mon Sep 17 00:00:00 2001 +From: Ingo Franzki +Date: Fri, 3 Jul 2026 08:51:49 +0200 +Subject: [PATCH] =?UTF-8?q?Fix=20unused=20variable=20=E2=80=98d=5Fsize?= + =?UTF-8?q?=E2=80=99=20[-Werror=3Dunused-variable]=20with=20OpenSSL=201.1.?= + =?UTF-8?q?1?= +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Move the variable declaration of 'd_size' into the >= OpenSSL 3.0.0 block, +it is only used when building with OpenSSL >= 3.0.0. + +Fixes: https://github.com/opencryptoki/opencryptoki/commit/627d27514e7494d36d3d7924e03e4e23ac76bec3 + +Signed-off-by: Ingo Franzki +--- + usr/lib/common/mech_openssl.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/usr/lib/common/mech_openssl.c b/usr/lib/common/mech_openssl.c +index 85d7d49ae..b1b70a160 100644 +--- a/usr/lib/common/mech_openssl.c ++++ b/usr/lib/common/mech_openssl.c +@@ -2564,10 +2564,11 @@ CK_RV openssl_specific_ec_generate_keypair(STDLL_TokData_t *tokdata, + #else + BIGNUM *bn_d = NULL; + int len; ++ size_t d_size; + #endif + CK_BYTE *ecpoint = NULL, *enc_ecpoint = NULL, *d = NULL; + CK_ULONG enc_ecpoint_len, d_len; +- size_t ecpoint_len, d_size; ++ size_t ecpoint_len; + EVP_PKEY_CTX *ctx = NULL; + EVP_PKEY *ec_pkey = NULL; + int nid, pkey_type; diff --git a/opencryptoki.spec b/opencryptoki.spec index 1fe86da..a4eead2 100644 --- a/opencryptoki.spec +++ b/opencryptoki.spec @@ -1,7 +1,7 @@ Name: opencryptoki Summary: Implementation of the PKCS#11 (Cryptoki) specification v3.0 and partially v3.1 Version: 3.27.0 -Release: 1%{?dist} +Release: 1%{?dist}.alma.1 License: CPL-1.0 URL: https://github.com/opencryptoki/opencryptoki Source0: https://github.com/opencryptoki/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz @@ -20,6 +20,10 @@ Patch2: opencryptoki-3.24.0-tmpfiles-image-mode.patch # https://gitlab.com/fedora/bootc/base-images/-/issues/48 Patch3: opencryptoki-lockdir-image-mode.patch +# AlmaLinux Patch +Patch1001: 0001-Fix-build-error-on-32-bit-systems-size_t-vs-CK_ULONG.patch +Patch1002: 0002-Fix-unused-variable-d_size-Werror-unused-variable-wi.patch + # upstream patches Requires(pre): coreutils @@ -409,6 +413,9 @@ fi %changelog +* Tue Aug 11 2026 Eduard Abdullin - 3.27.0-1.alma.1 +- Fix build on i686: size_t vs CK_ULONG pointer incompatibility + * Tue Jul 21 2026 Than Ngo - 3.27.0-1 - Resolves: RHEL-171557, Fix CVE-2026-40253 - Resolves: RHEL-169193, Fix syslog warning even for identically configured control points