From d3893b0474c7ae334822282bee891e7ce1ebba33 Mon Sep 17 00:00:00 2001
From: Tony Camuso <tcamuso@redhat.com>
Date: Tue, 16 Jun 2026 10:28:51 -0400
Subject: [PATCH] Update to latest upstream - 1.11.12-1

JIRA: https://redhat.atlassian.net/browse/RHEL-181888

Remove tboot-disa-ibt.patch, as the issue is now fixed in the
tboot code.

Resolves: RHEL-181888

Signed-off-by: Tony Camuso <tcamuso@redhat.com>
---
 sources               |  1 +
 tboot-disa-ibt.patch  | 12 ---------
 tboot-no-engine.patch | 57 +++++++++++++++++++++++++++++++++++++++++++
 tboot.spec            | 10 ++++++--
 4 files changed, 66 insertions(+), 14 deletions(-)
 delete mode 100644 tboot-disa-ibt.patch
 create mode 100644 tboot-no-engine.patch

diff --git a/sources b/sources
index a4251ba..85d1925 100644
--- a/sources
+++ b/sources
@@ -1 +1,2 @@
 SHA512 (tboot-1.11.10.tar.gz) = f59e948e36ec122f93e32b3c754c206b241d4ee55209ccb952f8742f9912b66d6365de5df6e31944ac75191a54c7252f39a29df861daa4a1f51a1999fcc7d846
+SHA512 (tboot-1.11.12.tar.gz) = 4dc708fa99e57cf052b09686021db892c0e83b3e3ba2720b623be53a65de4177164bae3adc975a8231a48a084a1dbe6cba8fccd99fa2ab55dd7729a2f25331be
diff --git a/tboot-disa-ibt.patch b/tboot-disa-ibt.patch
deleted file mode 100644
index 7fe6689..0000000
--- a/tboot-disa-ibt.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -r 5220085b54dd tboot/20_linux_tboot
---- a/tboot/20_linux_tboot	Thu Apr 17 08:33:41 2025 -0400
-+++ b/tboot/20_linux_tboot	Thu Aug 21 09:23:08 2025 -0400
-@@ -44,7 +44,7 @@
- # Command line for tboot itself
- : ${GRUB_CMDLINE_TBOOT='logging=serial,memory,vga'}
- # Linux kernel parameters to append for tboot
--: ${GRUB_CMDLINE_LINUX_TBOOT='intel_iommu=on'}
-+: ${GRUB_CMDLINE_LINUX_TBOOT='intel_iommu=on ibt=off'}
- # Base name of LCP policy data file for list policy
- : ${GRUB_TBOOT_POLICY_DATA=''}
- # List of SINIT modules to use, glob patterns are supported
diff --git a/tboot-no-engine.patch b/tboot-no-engine.patch
new file mode 100644
index 0000000..747657d
--- /dev/null
+++ b/tboot-no-engine.patch
@@ -0,0 +1,57 @@
+diff -up tboot-1.11.3/lcptools-v2/crtpol.c.no-engine tboot-1.11.3/lcptools-v2/crtpol.c
+--- tboot-1.11.3/lcptools-v2/crtpol.c.no-engine	2024-08-13 18:03:43.003697657 +0200
++++ tboot-1.11.3/lcptools-v2/crtpol.c	2024-08-13 18:04:49.315001612 +0200
+@@ -43,7 +43,10 @@
+ #include <errno.h>
+ #include <string.h>
+ #include <openssl/rsa.h>
++#include <openssl/opensslconf.h>
++#ifndef OPENSSL_NO_ENGINE
+ #include <openssl/engine.h>
++#endif
+ #include <openssl/pem.h>
+ #include <openssl/err.h>
+ #include <openssl/bn.h>
+diff -up tboot-1.11.3/lcptools-v2/crtpollist.c.no-engine tboot-1.11.3/lcptools-v2/crtpollist.c
+--- tboot-1.11.3/lcptools-v2/crtpollist.c.no-engine	2024-08-13 18:03:43.005697697 +0200
++++ tboot-1.11.3/lcptools-v2/crtpollist.c	2024-08-13 18:04:58.324178771 +0200
+@@ -44,7 +44,10 @@
+ #include <errno.h>
+ #include <string.h>
+ #include <openssl/rsa.h>
++#include <openssl/opensslconf.h>
++#ifndef OPENSSL_NO_ENGINE
+ #include <openssl/engine.h>
++#endif
+ #include <openssl/pem.h>
+ #include <openssl/err.h>
+ #include <openssl/bn.h>
+diff -up tboot-1.11.3/lcptools-v2/lcputils.c.no-engine tboot-1.11.3/lcptools-v2/lcputils.c
+--- tboot-1.11.3/lcptools-v2/lcputils.c.no-engine	2024-08-13 18:03:43.004697677 +0200
++++ tboot-1.11.3/lcptools-v2/lcputils.c	2024-08-13 18:04:53.293079838 +0200
+@@ -43,7 +43,10 @@
+ #include <errno.h>
+ #include <string.h>
+ #include <openssl/rsa.h>
++#include <openssl/opensslconf.h>
++#ifndef OPENSSL_NO_ENGINE
+ #include <openssl/engine.h>
++#endif
+ #include <openssl/pem.h>
+ #include <openssl/err.h>
+ #include <openssl/bn.h>
+diff -up tboot-1.11.3/lcptools-v2/pollist2.c.no-engine tboot-1.11.3/lcptools-v2/pollist2.c
+--- tboot-1.11.3/lcptools-v2/pollist2.c.no-engine	2024-08-13 18:03:43.002697637 +0200
++++ tboot-1.11.3/lcptools-v2/pollist2.c	2024-08-13 18:04:45.813932767 +0200
+@@ -41,7 +41,10 @@
+ #include <string.h>
+ #include <safe_lib.h>
+ #include <openssl/rsa.h>
++#include <openssl/opensslconf.h>
++#ifndef OPENSSL_NO_ENGINE
+ #include <openssl/engine.h>
++#endif
+ #include <openssl/pem.h>
+ #include <openssl/err.h>
+ #include <openssl/bn.h>
+
diff --git a/tboot.spec b/tboot.spec
index 019c906..666ddb3 100644
--- a/tboot.spec
+++ b/tboot.spec
@@ -1,13 +1,13 @@
 Summary:        Performs a verified launch using Intel TXT
 Name:           tboot
-Version:        1.11.10
+Version:        1.11.12
 Release:        1%{?dist}
 Epoch:          1
 
 License:        BSD
 URL:            http://sourceforge.net/projects/tboot/
 Source0:        http://downloads.sourceforge.net/%{name}/%{name}-%{version}.tar.gz
-Patch0: 	tboot-disa-ibt.patch
+Patch0:         tboot-no-engine.patch
 
 BuildRequires:  make
 BuildRequires:  gcc
@@ -93,6 +93,12 @@ make debug=y DISTDIR=$RPM_BUILD_ROOT install
 /boot/tboot-syms
 
 %changelog
+* Thu Jun 04 2026 Tony Camuso <tcamuso@redhat.com> - 1:1.11.12-1
+- Update to latest upstream
+  Remove tboot-disa-ibt.patch, as the issue is now fixed in the
+  tboot code.
+  Resolves: RHEL-181888
+
 * Tue Sep 16 2025 Tony Camuso <tcamuso@redhat.com> - 1:1.11.10-1
 - Update to latest upstream
   Add tboot-disa-ibt.patch (see https://issues.redhat.com/browse/RHEL-109479)