- add post GA fixes

- let provider log into /tmp

openssl-ibmca-2.4.0-log-into-tmp.patch

@@ -0,0 +1,42 @@
+From b6d3f8f1fa3013a748eb538f8c2d31936d4188c2 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Dan=20Hor=C3=A1k?= <dan@danny.cz>
+Date: Wed, 26 Jul 2023 07:31:43 +0000
+Subject: [PATCH] provider: use /tmp as logdir
+
+The location for storing debug traces of the provider needs to be world
+writeable. Using the original /var/log/ibmca has security implication,
+so switch to using /tmp instead.
+---
+ configure.ac                        | 2 +-
+ src/provider/doc/ibmca-provider.man | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index cea8ce8..57b3205 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -10,7 +10,7 @@ AM_INIT_AUTOMAKE([foreign])
+ 
+ AC_PATH_PROG([CHMOD], [chmod], [/bin/chmod])
+ 
+-logdir=$localstatedir/log/ibmca
++logdir=/tmp
+ AC_SUBST(logdir)
+ 
+ # Cmdline arguments.
+diff --git a/src/provider/doc/ibmca-provider.man b/src/provider/doc/ibmca-provider.man
+index 52350e4..b3d5174 100644
+--- a/src/provider/doc/ibmca-provider.man
++++ b/src/provider/doc/ibmca-provider.man
+@@ -153,7 +153,7 @@ If
+ .B $IBMCA_DEBUG
+ is set to \fBstderr\fP debug output to stderr for the IBMCA provider is enabled.
+ If it is set to \fBon\fP the debug output is written into a trace file in
+-\fB[/usr/local]/var/log/ibmca/trace-<provider-name>.<pid>\fP, where <pid> is
++\fB[/tmp/trace-<provider-name>.<pid>\fP, where <pid> is
+ the process ID of the current process.
+ .PP
+ .SH SEE ALSO
+-- 
+2.41.0
+

openssl-ibmca.spec

@@ -3,12 +3,14 @@
 Summary: OpenSSL provider for IBMCA
 Name: openssl-ibmca
 Version: 2.4.0
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: Apache-2.0
 URL: https://github.com/opencryptoki
 Source0: https://github.com/opencryptoki/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz
 # post GA fixes
-#Patch0: %%{name}-%%{version}-fixes.patch
+Patch0: %{name}-%{version}-fixes.patch
+# https://github.com/opencryptoki/openssl-ibmca/issues/107
+Patch1: %{name}-2.4.0-log-into-tmp.patch
 Requires: libica >= 4.0.0
 BuildRequires: make
 BuildRequires: gcc
@@ -56,6 +58,10 @@ make check
 
 
 %changelog
+* Wed Jul 26 2023 Dan Horák <dan@danny.cz> - 2.4.0-3
+- add post GA fixes
+- let provider log into /tmp
+
 * Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.0-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild