rpms/opensc
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Unbreak FIPS mode due to SHA1

Browse Source
This commit is contained in:
Jakub Jelen 2026-04-13 15:41:53 +02:00
parent 1b6bd073de
commit 8852607587
2 changed files with 44 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
opensc-0.27.1-fips-sha1.patch Normal file
View File

@ -0,0 +1,40 @@
commit 0a75757af176a21a9c791de167a05122ee12c377
Author: Jakub Jelen <jjelen@redhat.com>
Date: Sun Apr 19 20:42:44 2026 +0200
Revert "Do not register SHA1-based mechanisms in FIPS mode"
This reverts commit 91e61b9a7667ce0bf62e4b0e872e39a34295eb89.
Not registering SHA1 in the OpenSSL module fails later on when registering
hash + sign mechanisms, leading to unexpected issues. Alternative solution
was to not register the compound mechanisms, but reverting this change
looks cleaner. When we will really have FIPS provider without SHA1,
it can be resurrected.
diff --git a/src/pkcs11/openssl.c b/src/pkcs11/openssl.c
index 0a5d4394a..c9c7c7150 100644
--- a/src/pkcs11/openssl.c
+++ b/src/pkcs11/openssl.c
@@ -305,14 +305,12 @@ sc_pkcs11_register_openssl_mechanisms(struct sc_pkcs11_card *p11card)
#endif
#endif /* !defined(OPENSSL_NO_ENGINE) */
- if (!FIPS_mode()) {
- openssl_sha1_mech.mech_data = sc_evp_md(context, "sha1");
- openssl_sha1_mech.free_mech_data = ossl_md_free;
- openssl_sha1_mech.copy_mech_data = ossl_md_copy;
- mt = dup_mem(&openssl_sha1_mech, sizeof openssl_sha1_mech);
- sc_pkcs11_register_mechanism(p11card, mt, NULL);
- sc_pkcs11_free_mechanism(&mt);
- }
+ openssl_sha1_mech.mech_data = sc_evp_md(context, "sha1");
+ openssl_sha1_mech.free_mech_data = ossl_md_free;
+ openssl_sha1_mech.copy_mech_data = ossl_md_copy;
+ mt = dup_mem(&openssl_sha1_mech, sizeof openssl_sha1_mech);
+ sc_pkcs11_register_mechanism(p11card, mt, NULL);
+ sc_pkcs11_free_mechanism(&mt);
openssl_sha224_mech.mech_data = sc_evp_md(context, "sha224");
openssl_sha224_mech.free_mech_data = ossl_md_free;

4
opensc.spec
View File

@ -10,6 +10,9 @@ Source1: opensc.module
Patch1: opensc-0.19.0-pinpad.patch
# File caching by default (#2000626)
Patch8: %{name}-0.22.0-file-cache.patch
# Registering SHA1 mechanisms does not work in FIPS mode
# https://github.com/OpenSC/OpenSC/pull/3645
Patch9: opensc-0.27.1-fips-sha1.patch
BuildRequires: make
BuildRequires: pcsc-lite-devel
@ -60,6 +63,7 @@ OpenSC libraries.
%setup -q
%patch 1 -p1 -b .pinpad
%patch 8 -p1 -b .file-cache
%patch 9 -p1 -b .fips-sha1
XFAIL_TESTS="test-pkcs11-tool-test-threads.sh test-pkcs11-tool-test.sh"