.gitignore

@@ -1,20 +1,4 @@
-/rpm-sequoia-1.0.1.crate
-/rpm-sequoia-1.1.2.crate
-/rpm-sequoia-1.2.0.crate
-/rpm-sequoia-1.3.0.crate
-/rpm-sequoia-1.4.0.crate
-/rpm-sequoia-1.4.0-vendor.tar.xz
-/rpm-sequoia-1.4.1.crate
-/rpm-sequoia-1.4.1-vendor.tar.xz
-/rpm-sequoia-1.5.0.crate
-/rpm-sequoia-1.5.0-vendor.tar.xz
 /rpm-sequoia-1.6.0.crate
 /rpm-sequoia-1.6.0-vendor.tar.xz
 /rpm-sequoia-1.9.0.1.tar.gz
 /rpm-sequoia-vendor-1.9.0.1.tar.gz
-/rpm-sequoia-1.9.0.2.tar.gz
-/rpm-sequoia-vendor-1.9.0.2.tar.gz
-/rpm-sequoia-1.9.0.3.tar.gz
-/rpm-sequoia-vendor-1.9.0.3.tar.gz
-/rpm-sequoia-1.10.1.1.tar.gz
-/rpm-sequoia-vendor-1.10.1.1.tar.gz

gating.yaml

@@ -1,6 +1,6 @@
 --- !Policy
 product_versions:
-  - rhel-10
+  - rhel-9
 decision_context: osci_compose_gate
 rules:
   - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/ci/fips-disabled-buildroot-disabled.functional}

rpm-sequoia-fix-metadata.diff

@@ -0,0 +1,18 @@
+diff -up a/Cargo.toml b/Cargo.toml
+--- a/Cargo.toml	2025-06-20 23:38:40.780060126 +0200
++++ b/Cargo.toml	2025-06-20 23:39:27.431884313 +0200
+@@ -42,13 +42,9 @@ crate-type = ["cdylib"]
+ 
+ # We explicitly do not want to enable Sequoia's decompression support.
+ # Hence we only select a crypto backend.
+-default = ["crypto-nettle"]
++default = ["crypto-openssl"]
+ crypto-nettle = ["sequoia-openpgp/crypto-nettle"]
+-crypto-rust = ["sequoia-openpgp/crypto-rust"]
+-crypto-cng = ["sequoia-openpgp/crypto-cng"]
+ crypto-openssl = ["sequoia-openpgp/crypto-openssl"]
+-crypto-botan = ["sequoia-openpgp/crypto-botan"]
+-crypto-botan2 = ["sequoia-openpgp/crypto-botan2"]
+ 
+ [patch.crates-io]
+ buffered-reader = { git = "https://gitlab.com/sequoia-pgp/sequoia", branch = "justus/pqc" }

rust-rpm-sequoia.spec

@@ -4,15 +4,12 @@
 %global crate rpm-sequoia
 
 Name:           rust-rpm-sequoia
-Version:        1.10.1.1
+Version:        1.9.0.1
 Release:        %autorelease
 Summary:        Implementation of the RPM PGP interface using Sequoia
 
 License:        LGPL-2.0-or-later
 URL:            https://crates.io/crates/rpm-sequoia
-# The version 1.10.1 upstream + patches to use pqc branches in openpgp and pqc-ossl in policy-config
-# Generated using:
-#  git archive --format=tar.gz --prefix rpm-sequoia-1.10.1.1/ -o ../rpm-sequoia-1.10.1.1.tar.gz pqc
 Source:         %{crate}-%{version}.tar.gz
 # Generated using cargo-vendor-filterer:
 #   cargo vendor-filterer --platform x86_64-unknown-linux-gnu \
@@ -21,9 +18,12 @@ Source:         %{crate}-%{version}.tar.gz
 #                         --platform i686-unknown-linux-gnu \
 #                         --platform s390x-unknown-linux-gnu \
 #                         --all-features
-#   tar -czf ../rpm-sequoia-vendor-1.10.1.1.tar.gz vendor
+#   tar -czf ../%%{crate}-vendor-%%{version}.tar.gz vendor
 Source1:        %{crate}-vendor-%{version}.tar.gz
 Source2:        vendor.toml
+# Manually created patch for downstream crate metadata changes
+# * default to the OpenSSL crypto backend of sequoia-openpgp
+Patch:          rpm-sequoia-fix-metadata.diff
 
 %if 0%{?rhel}
 BuildRequires:  rust-toolset
@@ -31,7 +31,7 @@ BuildRequires:  rust-toolset
 BuildRequires:  cargo-rpm-macros >= 24
 %endif
 # vendored openssl-sys
-BuildRequires:  openssl-devel clang-devel
+BuildRequires:  openssl-devel
 
 %global _description %{expand:
 An implementation of the RPM PGP interface using Sequoia.}
@@ -53,8 +53,6 @@ Summary:        %{summary}
 License:        LGPL-2.0-or-later AND Apache-2.0 AND BSL-1.0 AND MIT AND Unicode-DFS-2016 AND (Apache-2.0 OR MIT) AND (MIT OR Apache-2.0 OR Zlib) AND (Unlicense OR MIT)
 # LICENSE.dependencies contains a full license breakdown
 
-Requires:  openssl-libs >= 1:3.5.1-4.el10_1
-
 %description -n %{crate} %{_description}
 
 %files       -n %{crate}
@@ -76,6 +74,7 @@ Requires:       %{crate}%{?_isa} = %{version}-%{release}
 
 %prep
 %autosetup -n %{crate}-%{version} -N -a1
+%autopatch -M 99 -p1
 %cargo_prep -N
 # include full configuration for vendored dependencies
 cat %{SOURCE2} >> .cargo/config.toml

sources

@@ -1,2 +1,2 @@
-SHA512 (rpm-sequoia-1.10.1.1.tar.gz) = 6038343036b7b0317c202f046d146245363988ae2d52021246bdb4e560422b557b38e0b17f88de630e58afce43f29b32e2de15a011af769de2f2b27ba8fb434a
-SHA512 (rpm-sequoia-vendor-1.10.1.1.tar.gz) = fca5b244a1442056acd550dc9c1c19426c157a25f7a06849700319be775b6d57c379685edd1e2f596c10e987057a057d688a43e41e27a0f22b5f70987eaf2c02
+SHA512 (rpm-sequoia-1.9.0.1.tar.gz) = 7efab5c09f495761b8978faaa2ecef8f85f58a494c5fd4bfff6e37c446b3eed94a13d60b2d5bf1997d79ad449a1cca9549545cacc1d1e1023888fbbeaa3b7ad9
+SHA512 (rpm-sequoia-vendor-1.9.0.1.tar.gz) = 430ff4c185bda0d7c62c578cbd9e7ab40de7013d936feaf056682c39ee0c5ae15a697b7877e762c21cfae3d77264d0d96e81805e7db8a953fcf8eacda8844c7b

vendor.toml

@@ -1,15 +1,19 @@
-
 [source.crates-io]
 replace-with = "vendored-sources"
 
-[source."git+https://gitlab.com/jjelen/sequoia-policy-config?branch=jjelen/pqc-ossl"]
-git = "https://gitlab.com/jjelen/sequoia-policy-config"
-branch = "jjelen/pqc-ossl"
+[source."git+https://github.com/teythoon/rust-openssl?branch=justus/pqc"]
+git = "https://github.com/teythoon/rust-openssl"
+branch = "justus/pqc"
 replace-with = "vendored-sources"
 
-[source."git+https://gitlab.com/sequoia-pgp/sequoia?branch=pqc"]
+[source."git+https://gitlab.com/sequoia-pgp/sequoia-policy-config?branch=justus/pqc"]
+git = "https://gitlab.com/sequoia-pgp/sequoia-policy-config"
+branch = "justus/pqc"
+replace-with = "vendored-sources"
+
+[source."git+https://gitlab.com/sequoia-pgp/sequoia?branch=justus/pqc"]
 git = "https://gitlab.com/sequoia-pgp/sequoia"
-branch = "pqc"
+branch = "justus/pqc"
 replace-with = "vendored-sources"
 
 [source.vendored-sources]