27 changed files with 225 additions and 2534 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1 +1 @@
-SOURCES/tpm2-tss-2.3.2.tar.gz
+SOURCES/tpm2-tss-3.2.3.tar.gz
--- a/.tpm2-tss.metadata
+++ b/.tpm2-tss.metadata
@ -1 +1 @@
-c24ce8b20a8686ada775239389292f6d78020668 SOURCES/tpm2-tss-2.3.2.tar.gz
+79248e4597db1424d981c93af278bb7d141c6a12 SOURCES/tpm2-tss-3.2.3.tar.gz
--- a/SOURCES/0001-ESYS-Fix-initialization-of-app-data-in-Esys_Initiali.patch
+++ b/SOURCES/0001-ESYS-Fix-initialization-of-app-data-in-Esys_Initiali.patch
@ -1,39 +0,0 @@
-From 285667d640b8dd7d2d80e0c5d5fcc44f6abad442 Mon Sep 17 00:00:00 2001
-From: Juergen Repp <juergen.repp@sit.fraunhofer.de>
-Date: Mon, 27 Apr 2020 16:33:16 +0200
-Subject: [PATCH 1/4] ESYS: Fix initialization of app data in Esys_Initialize
- (Fixes #1704).
-
-An unintended free of the tcti parameter in cleanup was possible.
-
-Signed-off-by: Juergen Repp <juergen.repp@sit.fraunhofer.de>
---
- src/tss2-esys/esys_context.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/src/tss2-esys/esys_context.c b/src/tss2-esys/esys_context.c
-index b912a688..150a3495 100644
--- a/src/tss2-esys/esys_context.c
-+++ b/src/tss2-esys/esys_context.c
-@@ -54,15 +54,15 @@ Esys_Initialize(ESYS_CONTEXT ** esys_context, TSS2_TCTI_CONTEXT * tcti,
-     *esys_context = calloc(1, sizeof(ESYS_CONTEXT));
-     return_if_null(*esys_context, "Out of memory.", TSS2_ESYS_RC_MEMORY);
- 
-+    /* Store the application provided tcti to be return on Esys_GetTcti(). */
-+    (*esys_context)->tcti_app_param = tcti;
-+
-     /* Allocate memory for the SYS context */
-     syssize = Tss2_Sys_GetContextSize(0);
-     (*esys_context)->sys = calloc(1, syssize);
-     goto_if_null((*esys_context)->sys, "Error: During malloc.",
-                  TSS2_ESYS_RC_MEMORY, cleanup_return);
- 
-    /* Store the application provided tcti to be return on Esys_GetTcti(). */
-    (*esys_context)->tcti_app_param = tcti;
-
-     /* If no tcti was provided, initialize the default one. */
-     if (tcti == NULL) {
-         r = Tss2_TctiLdr_Initialize (NULL, &tcti);
-- 
-2.41.0
-
--- a/SOURCES/0001-Esys_CreateLoaded-fix-resource-name-calculation.patch
+++ b/SOURCES/0001-Esys_CreateLoaded-fix-resource-name-calculation.patch
@ -1,128 +0,0 @@
-From 70e9fae7ef535e7cf27a72ddbc818dfefcbdbdbb Mon Sep 17 00:00:00 2001
-From: William Roberts <william.c.roberts@intel.com>
-Date: Wed, 18 Sep 2019 11:29:57 -0700
-Subject: [PATCH] Esys_CreateLoaded: fix resource name calculation
-
-The name calculated and cached for the ESYS_TR resource object was based
-on the user supplied TPMT_PUBLIC. However, this template is often
-missing data that the TPM fills in and returns in the TPM2B_PUBLIC
-structure. Because of this, the cached name returned from
-Esys_TR_GetName() and the name read from Esys_ReadPublic() would differ.
-
-Add a test to detect this condition and correct it by copying the
-returned TPM2B_PUBLIC to the ESYS_TR resource nodes TPM2B_PUBLIC cache
-and calculate the name off of that.
-
-Fixes: #1516
-
-Signed-off-by: William Roberts <william.c.roberts@intel.com>
---
- src/tss2-esys/api/Esys_CreateLoaded.c    | 14 ++++-----
- test/integration/esys-createloaded.int.c | 37 ++++++++++++++++++++++++
- 2 files changed, 42 insertions(+), 9 deletions(-)
-
-diff --git a/src/tss2-esys/api/Esys_CreateLoaded.c b/src/tss2-esys/api/Esys_CreateLoaded.c
-index a92649cade27..44c4400fcff9 100644
--- a/src/tss2-esys/api/Esys_CreateLoaded.c
-+++ b/src/tss2-esys/api/Esys_CreateLoaded.c
-@@ -317,14 +317,6 @@ Esys_CreateLoaded_Finish(
-         goto_error(r, TSS2_ESYS_RC_MEMORY, "Out of memory", error_cleanup);
-     }
- 
-    /* Update the meta data of the ESYS_TR object */
-    objectHandleNode->rsrc.rsrcType = IESYSC_KEY_RSRC;
-    size_t offset = 0;
-    r = Tss2_MU_TPMT_PUBLIC_Unmarshal(&esysContext->in.CreateLoaded.inPublic->buffer[0],
-                                      sizeof(TPMT_PUBLIC), &offset ,
-                                      &objectHandleNode->rsrc.misc.rsrc_key_pub.publicArea);
-    goto_if_error(r, "Unmarshal TPMT_PUBULIC", error_cleanup);
-
-     /*Receive the TPM response and handle resubmissions if necessary. */
-     r = Tss2_Sys_ExecuteFinish(esysContext->sys, esysContext->timeout);
-     if ((r & ~TSS2_RC_LAYER_MASK) == TSS2_BASE_RC_TRY_AGAIN) {
-@@ -386,8 +378,12 @@ Esys_CreateLoaded_Finish(
-                         error_cleanup);
- 
- 
-+    /* Update the meta data of the ESYS_TR object */
-+    objectHandleNode->rsrc.rsrcType = IESYSC_KEY_RSRC;
-+    objectHandleNode->rsrc.misc.rsrc_key_pub = *loutPublic;
-+
-     /* Check name and outPublic for consistency */
-    if (!iesys_compare_name(loutPublic, &name))
-+    if (!iesys_compare_name(&objectHandleNode->rsrc.misc.rsrc_key_pub, &name))
-         goto_error(r, TSS2_ESYS_RC_MALFORMED_RESPONSE,
-             "in Public name not equal name in response", error_cleanup);
- 
-diff --git a/test/integration/esys-createloaded.int.c b/test/integration/esys-createloaded.int.c
-index ec8d68a0d43d..118f2a3bb1ff 100644
--- a/test/integration/esys-createloaded.int.c
-+++ b/test/integration/esys-createloaded.int.c
-@@ -8,6 +8,7 @@
- #include <config.h>
- #endif
- 
-+#include <stdbool.h>
- #include <stdlib.h>
- 
- #include "tss2_esys.h"
-@@ -19,6 +20,35 @@
- #include "util/log.h"
- #include "util/aux_util.h"
- 
-+static bool check_name(ESYS_CONTEXT * esys_context, ESYS_TR object_handle)
-+{
-+    bool result = false;
-+
-+    TPM2B_NAME *read_name = NULL;
-+    TPM2B_NAME *get_name = NULL;
-+
-+    TSS2_RC r = Esys_ReadPublic(esys_context, object_handle,
-+                                ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE,
-+                                NULL, &read_name, NULL);
-+    goto_if_error(r, "Error esys readpublic", out);
-+
-+    r = Esys_TR_GetName(esys_context, object_handle, &get_name);
-+    goto_if_error(r, "Error esys getname", out);
-+
-+    if (read_name->size != get_name->size) {
-+        LOG_ERROR("name size mismatch %u != %u",
-+                  read_name->size, get_name->size);
-+        goto out;
-+    }
-+
-+    result = memcmp(read_name->name, get_name->name, get_name->size) == 0;
-+
-+out:
-+    free(read_name);
-+    free(get_name);
-+
-+    return result;
-+}
- /** This test is intended to test the ESAPI command CreateLoaded.
-  *
-  * We start by creating a primary key (Esys_CreatePrimary).
-@@ -29,6 +59,8 @@
-  *  - Esys_CreatePrimary() (M)
-  *  - Esys_FlushContext() (M)
-  *  - Esys_StartAuthSession() (M)
-+ *  - Esys_TR_GetName() (M)
-+ *  - Esys_TR_ReadPublic() (M)
-  *
-  * Used compiler defines: TEST_SESSION
-  *
-@@ -239,6 +271,11 @@ test_esys_createloaded(ESYS_CONTEXT * esys_context)
- 
-     goto_if_error(r, "Error During CreateLoaded", error);
- 
-+    bool names_match = check_name(esys_context, objectHandle);
-+    if (!names_match) {
-+        goto error;
-+    }
-+
-     r = Esys_FlushContext(esys_context, primaryHandle);
-     goto_if_error(r, "Flushing context", error);
- 
-- 
-2.27.0
-
--- a/SOURCES/0001-Return-proper-error-code-on-memory-allocation-failur.patch
+++ b/SOURCES/0001-Return-proper-error-code-on-memory-allocation-failur.patch
@ -1,25 +0,0 @@
-From 93aab9433b5d66a916e28016a4b60c4a1c39acfc Mon Sep 17 00:00:00 2001
-From: Pieter Agten <pieter.agten@gmail.com>
-Date: Tue, 3 Dec 2019 20:52:29 +0100
-Subject: [PATCH] Return proper error code on memory allocation failure
-
-Signed-off-by: Pieter Agten <pieter.agten@gmail.com>
---
- src/tss2-tcti/tctildr.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/src/tss2-tcti/tctildr.c b/src/tss2-tcti/tctildr.c
-index ff967317b57b..1528f6e52fd0 100644
--- a/src/tss2-tcti/tctildr.c
-+++ b/src/tss2-tcti/tctildr.c
-@@ -421,6 +421,7 @@ Tss2_TctiLdr_Initialize_Ex (const char *name,
-     }
-     ldr_ctx = calloc (1, sizeof (TSS2_TCTILDR_CONTEXT));
-     if (ldr_ctx == NULL) {
-+        rc = TSS2_TCTI_RC_MEMORY;
-         goto err;
-     }
-     TSS2_TCTI_MAGIC (ldr_ctx) = TCTILDR_MAGIC;
-- 
-2.27.0
-
--- a/SOURCES/0001-build-update-exported-symbols-map-for-libtss2-mu.patch
+++ b/SOURCES/0001-build-update-exported-symbols-map-for-libtss2-mu.patch
@ -1,51 +0,0 @@
-From b27956422d1b5bb53a56366e9b7e978f6b95e2f9 Mon Sep 17 00:00:00 2001
-From: Erik Larsson <who+github@cnackers.org>
-Date: Mon, 2 Dec 2019 11:21:02 +0100
-Subject: [PATCH] build: update exported symbols map for libtss2-mu
-
-Signed-off-by: Erik Larsson <who+github@cnackers.org>
---
- lib/tss2-mu.def | 4 ++++
- lib/tss2-mu.map | 4 ++--
- 2 files changed, 6 insertions(+), 2 deletions(-)
-
-diff --git a/lib/tss2-mu.def b/lib/tss2-mu.def
-index 36f4ba37b9fc..3c80cf225f77 100644
--- a/lib/tss2-mu.def
-+++ b/lib/tss2-mu.def
-@@ -226,6 +226,10 @@ EXPORTS
-     Tss2_MU_TPMU_PUBLIC_PARMS_Unmarshal
-     Tss2_MU_TPMU_PUBLIC_ID_Marshal
-     Tss2_MU_TPMU_PUBLIC_ID_Unmarshal
-+    Tss2_MU_TPMU_NAME_Marshal
-+    Tss2_MU_TPMU_NAME_Unmarshal
-+    Tss2_MU_TPMU_ENCRYPTED_SECRET_Marshal
-+    Tss2_MU_TPMU_ENCRYPTED_SECRET_Unmarshal
-     Tss2_MU_TPMT_HA_Marshal
-     Tss2_MU_TPMT_HA_Unmarshal
-     Tss2_MU_TPMT_SYM_DEF_Marshal
-diff --git a/lib/tss2-mu.map b/lib/tss2-mu.map
-index 8ac754ed096a..09d9317e6749 100644
--- a/lib/tss2-mu.map
-+++ b/lib/tss2-mu.map
-@@ -228,6 +228,8 @@
-         Tss2_MU_TPMU_PUBLIC_ID_Unmarshal;
-         Tss2_MU_TPMU_NAME_Marshal;
-         Tss2_MU_TPMU_NAME_Unmarshal;
-+        Tss2_MU_TPMU_ENCRYPTED_SECRET_Marshal;
-+        Tss2_MU_TPMU_ENCRYPTED_SECRET_Unmarshal;
-         Tss2_MU_TPMT_HA_Marshal;
-         Tss2_MU_TPMT_HA_Unmarshal;
-         Tss2_MU_TPMT_SYM_DEF_Marshal;
-@@ -274,8 +276,6 @@
-         Tss2_MU_TPM2_NT_Unmarshal;
-         Tss2_MU_TPMI_ALG_HASH_Marshal;
-         Tss2_MU_TPMI_ALG_HASH_Unmarshal;
-        Tss2_MU_TPMI_BYTE_Marshal;
-        Tss2_MU_TPMI_BYTE_Unmarshal;
-     local:
-         *;
- };
-- 
-2.27.0
-
--- a/SOURCES/0001-esys-Check-object-handle-node-before-calling-compute.patch
+++ b/SOURCES/0001-esys-Check-object-handle-node-before-calling-compute.patch
--- a/SOURCES/0001-esys-fix-Esys_StartAuthSession-called-with-optional-.patch
+++ b/SOURCES/0001-esys-fix-Esys_StartAuthSession-called-with-optional-.patch
@ -1,45 +0,0 @@
-From 0bd19b61c8cd07d03b6efffc05f95d5ec427a3d6 Mon Sep 17 00:00:00 2001
-From: Tadeusz Struk <tadeusz.struk@intel.com>
-Date: Tue, 14 Jan 2020 10:55:20 -0800
-Subject: [PATCH] esys: fix Esys_StartAuthSession called with optional params
-
-For an HMAC session if any of the optional params are ESYS_TR_NONE
-we need to use the same tpm2_handles TPM2_RH_NULL (0x40000007)
-as in the prepare call to correctly calculate cpHash and HMAC
-values for the session.
-
-Fixes: #1590
-
-Signed-off-by: Tadeusz Struk <tadeusz.struk@intel.com>
---
- src/tss2-esys/api/Esys_StartAuthSession.c | 14 +++++++++++++-
- 1 file changed, 13 insertions(+), 1 deletion(-)
-
-diff --git a/src/tss2-esys/api/Esys_StartAuthSession.c b/src/tss2-esys/api/Esys_StartAuthSession.c
-index 313604a2077c..3ccd842a7572 100644
--- a/src/tss2-esys/api/Esys_StartAuthSession.c
-+++ b/src/tss2-esys/api/Esys_StartAuthSession.c
-@@ -260,7 +260,19 @@ Esys_StartAuthSession_Async(
-     iesys_compute_session_value(esysContext->session_tab[2], NULL, NULL);
- 
-     /* Generate the auth values and set them in the SAPI command buffer */
-    r = iesys_gen_auths(esysContext, tpmKeyNode, bindNode, NULL, &auths);
-+
-+    RSRC_NODE_T none;
-+    size_t offset = 0;
-+    none.rsrc.handle = TPM2_RH_NULL;
-+    none.rsrc.rsrcType = IESYSC_WITHOUT_MISC_RSRC;
-+    r = Tss2_MU_TPM2_HANDLE_Marshal(TPM2_RH_NULL,
-+                                none.rsrc.name.name,
-+                                sizeof(none.rsrc.name.name),
-+                                &offset);
-+    return_state_if_error(r, _ESYS_STATE_INIT, "Marshaling TPM handle.");
-+    none.rsrc.name.size = offset;
-+    r = iesys_gen_auths(esysContext, tpmKeyNode ? tpmKeyNode : &none,
-+                                     bindNode ? bindNode : &none, NULL, &auths);
-     return_state_if_error(r, _ESYS_STATE_INIT,
-                           "Error in computation of auth values");
- 
-- 
-2.27.0
-
--- a/SOURCES/0001-esys-fix-hmac-calculation-for-tpm2_clear-command.patch
+++ b/SOURCES/0001-esys-fix-hmac-calculation-for-tpm2_clear-command.patch
@ -1,39 +0,0 @@
-From 3d3808c3eb02c27f1b114baddd03960892044909 Mon Sep 17 00:00:00 2001
-From: Tadeusz Struk <tadeusz.struk@intel.com>
-Date: Mon, 2 Mar 2020 14:45:52 -0800
-Subject: [PATCH] esys: fix hmac calculation for tpm2_clear command
-
-After tpm2_clear command is executed it sets all ownerAuth,
-endorsementAuth, and lockoutAuth to the Empty Buffer and then
-this is used for a response auth calculation.
-This requires to recalculate the esys session auth value after
-tpm2_clear is executed or the calculated response HMAC value
-will be invalid and the command will fail with
-err: 0x0007001b "Authorizing the TPM response failed"
-
-Fixes: #1641
-
-Signed-off-by: Tadeusz Struk <tadeusz.struk@intel.com>
---
- src/tss2-esys/api/Esys_Clear.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/src/tss2-esys/api/Esys_Clear.c b/src/tss2-esys/api/Esys_Clear.c
-index f5c0b827425a..0f43f7e9b85f 100644
--- a/src/tss2-esys/api/Esys_Clear.c
-+++ b/src/tss2-esys/api/Esys_Clear.c
-@@ -199,6 +199,11 @@ Esys_Clear_Async(
-     return_state_if_error(r, _ESYS_STATE_INTERNALERROR,
-                           "Finish (Execute Async)");
- 
-+    /* If the command authorization is LOCKOUT we need to
-+     * recompute session value with an empty auth */
-+    if (authHandle == ESYS_TR_RH_LOCKOUT)
-+        iesys_compute_session_value(esysContext->session_tab[0], NULL, NULL);
-+
-     esysContext->state = _ESYS_STATE_SENT;
- 
-     return r;
-- 
-2.30.1
-
--- a/SOURCES/0001-esys-fix-keysize-of-ECC-curve-TPM2_ECC_NISTP224.patch
+++ b/SOURCES/0001-esys-fix-keysize-of-ECC-curve-TPM2_ECC_NISTP224.patch
@ -1,29 +0,0 @@
-From 76641c1e6b016979973fead7a24bb8fca4ee8325 Mon Sep 17 00:00:00 2001
-From: Johannes Holland <johannes.holland@infineon.com>
-Date: Thu, 26 Sep 2019 09:46:09 +0100
-Subject: [PATCH] esys: fix keysize of ECC curve TPM2_ECC_NISTP224
-
-In esys_crypto_ossl.c, for the ECC curve TPM2_ECC_NISTP244 a key size of
-38 is selected. However, 224 bit / 8 bit/byte = 28 byte.
-
-Signed-off-by: Johannes Holland <johannes.holland@infineon.com>
---
- src/tss2-esys/esys_crypto_ossl.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/tss2-esys/esys_crypto_ossl.c b/src/tss2-esys/esys_crypto_ossl.c
-index 124501964ae7..3c5d86d69705 100644
--- a/src/tss2-esys/esys_crypto_ossl.c
-+++ b/src/tss2-esys/esys_crypto_ossl.c
-@@ -804,7 +804,7 @@ iesys_cryptossl_get_ecdh_point(TPM2B_PUBLIC *key,
-         break;
-     case TPM2_ECC_NIST_P224:
-         curveId = NID_secp224r1;
-        key_size = 38;
-+        key_size = 28;
-         break;
-     case TPM2_ECC_NIST_P256:
-         curveId = NID_X9_62_prime256v1;
-- 
-2.27.0
-
--- a/SOURCES/0001-esys-fixup-compute_encrypted_salt-err-handling-in-Es.patch
+++ b/SOURCES/0001-esys-fixup-compute_encrypted_salt-err-handling-in-Es.patch
@ -1,47 +0,0 @@
-From 380d5f9ec3aa1f5e456598fe66d275467660177b Mon Sep 17 00:00:00 2001
-From: Tadeusz Struk <tadeusz.struk@intel.com>
-Date: Thu, 16 Jan 2020 09:27:04 -0800
-Subject: [PATCH] esys: fixup compute_encrypted_salt err handling in
- Esys_StartAuthSession
-
-Use return_state_if_error() macro for compute_encrypted_salt()
-error handling in Esys_StartAuthSession to maintain the correct
-context state.
-
-Signed-off-by: Tadeusz Struk <tadeusz.struk@intel.com>
---
- src/tss2-esys/api/Esys_StartAuthSession.c | 13 ++++---------
- 1 file changed, 4 insertions(+), 9 deletions(-)
-
-diff --git a/src/tss2-esys/api/Esys_StartAuthSession.c b/src/tss2-esys/api/Esys_StartAuthSession.c
-index 3ccd842a7572..1717928a717d 100644
--- a/src/tss2-esys/api/Esys_StartAuthSession.c
-+++ b/src/tss2-esys/api/Esys_StartAuthSession.c
-@@ -223,20 +223,15 @@ Esys_StartAuthSession_Async(
-     TSS2_RC r2;
-     r2 = iesys_compute_encrypted_salt(esysContext, tpmKeyNode,
-                                       &encryptedSaltAux);
-    return_if_error(r2, "Error in parameter encryption.");
-+    return_state_if_error(r2, _ESYS_STATE_INIT, "Error in parameter encryption.");
- 
-     if (nonceCaller == NULL) {
-         r2 = iesys_crypto_hash_get_digest_size(authHash,&authHash_size);
-        if (r2 != TSS2_RC_SUCCESS) {
-            LOG_ERROR("Error: initialize auth session (%x).", r2);
-            return r2;
-        }
-+        return_state_if_error(r2, _ESYS_STATE_INIT, "Error in hash_get_digest_size.");
-+
-         r2 = iesys_crypto_random2b(&esysContext->in.StartAuthSession.nonceCallerData,
-                                    authHash_size);
-        if (r2 != TSS2_RC_SUCCESS) {
-            LOG_ERROR("Error: initialize auth session (%x).", r2);
-            return r2;
-        }
-+        return_state_if_error(r2, _ESYS_STATE_INIT, "Error in crypto_random2b.");
-         esysContext->in.StartAuthSession.nonceCaller
-            = &esysContext->in.StartAuthSession.nonceCallerData;
-         nonceCaller = esysContext->in.StartAuthSession.nonceCaller;
-- 
-2.27.0
-
--- a/SOURCES/0001-esys-zero-out-ctx-salt-after-on-startAuthSession_fin.patch
+++ b/SOURCES/0001-esys-zero-out-ctx-salt-after-on-startAuthSession_fin.patch
@ -1,38 +0,0 @@
-From 1ec07af70925ece698b733d55dedd1d9878b70f2 Mon Sep 17 00:00:00 2001
-From: Tadeusz Struk <tadeusz.struk@intel.com>
-Date: Fri, 24 Jan 2020 19:05:34 -0800
-Subject: [PATCH] esys: zero out ctx->salt after on startAuthSession_finish
-
-The ctx->salt is used to calculate session key during
-startAuthSession call if the caller pass a valid tpmKey
-parameter. There salt is calculated in the _Async call
-and the the session key is calculated in the _Finish call.
-The problem is that if in the same context an unsalted
-session is created after a salted session the ctx->salt
-will still hold the old value and it will incorrectly
-be used for session key calculation in the the subsequent
-_Finish call. To fix this the salt needs to be set to
-cleaned after no longer needed.
-
-Fixes: #1574
-
-Signed-off-by: Tadeusz Struk <tadeusz.struk@intel.com>
---
- src/tss2-esys/api/Esys_StartAuthSession.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/src/tss2-esys/api/Esys_StartAuthSession.c b/src/tss2-esys/api/Esys_StartAuthSession.c
-index 1717928a717d..6367419d7c9a 100644
--- a/src/tss2-esys/api/Esys_StartAuthSession.c
-+++ b/src/tss2-esys/api/Esys_StartAuthSession.c
-@@ -497,6 +497,7 @@ Esys_StartAuthSession_Finish(
-     goto_if_error(r, "Marshal session name", error_cleanup);
- 
-     sessionHandleNode->rsrc.name.size = offset;
-+    memset(&esysContext->salt, '\0', sizeof(esysContext->salt));
-     esysContext->state = _ESYS_STATE_INIT;
- 
-     return TSS2_RC_SUCCESS;
-- 
-2.27.0
-
--- a/SOURCES/0001-esys_iutil-fix-possible-NPD.patch
+++ b/SOURCES/0001-esys_iutil-fix-possible-NPD.patch
@ -0,0 +1,41 @@
+From f5907e96363729e16475172ef1056532d9404482 Mon Sep 17 00:00:00 2001
+From: William Roberts <william.c.roberts@intel.com>
+Date: Fri, 3 Jun 2022 11:51:02 -0500
+Subject: [PATCH 1/2] esys_iutil: fix possible NPD
+
+Clang-10 scan-build reports:
+src/tss2-esys/esys_iutil.c:1366:56: warning: Dereference of null pointer
+            auths->auths[auths->count].sessionHandle = session->rsrc.handle;
+                                                       ^~~~~~~~~~~~~~~~~~~~
+1 warning generated.
+
+The code above the report checks that session might be NULL:
+RSRC_NODE_T *session = esys_context->session_tab[session_idx];
+    if (session != NULL) {
+        IESYS_SESSION *rsrc_session = &session->rsrc.misc.rsrc_session;
+        if (rsrc_session->type_policy_session == POLICY_PASSWORD) {
+
+Thus suggesting/indicating session may be NULL in subsequent code where
+session is dereferenced.
+
+Signed-off-by: William Roberts <william.c.roberts@intel.com>
+---
+ src/tss2-esys/esys_iutil.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/tss2-esys/esys_iutil.c b/src/tss2-esys/esys_iutil.c
+index 4d31cef8..b364dd73 100644
+--- a/src/tss2-esys/esys_iutil.c
+++ b/src/tss2-esys/esys_iutil.c
+@@ -1352,7 +1352,7 @@ iesys_gen_auths(ESYS_CONTEXT * esys_context,
+                                 && encryptNonceIdx > 0) ? encryptNonce : NULL,
+                                &auths->auths[session_idx]);
+         return_if_error(r, "Error while computing hmacs");
+-        if (esys_context->session_tab[session_idx] != NULL) {
+        if (esys_context->session_tab[session_idx] != NULL && session != NULL) {
+             auths->auths[auths->count].sessionHandle = session->rsrc.handle;
+             auths->count++;
+         }
+-- 
+2.39.2
+
--- a/SOURCES/0001-esys_iutil-use-memcmp-in-byte-array-comparison.patch
+++ b/SOURCES/0001-esys_iutil-use-memcmp-in-byte-array-comparison.patch
@ -1,62 +0,0 @@
-From 0bf42a4489973005ddd912a800dfb92eff2806e8 Mon Sep 17 00:00:00 2001
-From: William Roberts <william.c.roberts@intel.com>
-Date: Mon, 16 Sep 2019 17:12:23 -0700
-Subject: [PATCH] esys_iutil: use memcmp in byte array comparison
-
-Rather than a byte for byte forloop, use memcmp() so the compiler can
-use architectural optimizations.
-
-Signed-off-by: William Roberts <william.c.roberts@intel.com>
---
- src/tss2-esys/esys_iutil.c | 27 +++++----------------------
- 1 file changed, 5 insertions(+), 22 deletions(-)
-
-diff --git a/src/tss2-esys/esys_iutil.c b/src/tss2-esys/esys_iutil.c
-index 94d0332c5b7d..08a9b7dffcbd 100644
--- a/src/tss2-esys/esys_iutil.c
-+++ b/src/tss2-esys/esys_iutil.c
-@@ -35,23 +35,6 @@ cmp_UINT16(const UINT16 * in1, const UINT16 * in2)
-     }
- }
- 
-/**
- * Compare variables of type BYTE.
- * @param[in] in1 Variable to be compared with:
- * @param[in] in2
- */
-static bool
-cmp_BYTE(const BYTE * in1, const BYTE * in2)
-{
-    LOG_TRACE("call");
-    if (*in1 == *in2)
-        return true;
-    else {
-        LOG_TRACE("cmp false");
-        return false;
-    }
-}
-
- /**
-  * Compare two arrays of type BYTE.
-  * @param[in] in1 array to be compared with:.
-@@ -65,12 +48,12 @@ cmp_BYTE_array(const BYTE * in1, size_t count1, const BYTE * in2, size_t count2)
-         LOG_TRACE("cmp false");
-         return false;
-     }
-    for (size_t i = 0; i < count1; i++) {
-        if (!cmp_BYTE(&in1[i], &in2[i])) {
-            LOG_TRACE("cmp false");
-            return false;
-        }
-+
-+    if (memcmp(in1, in2, count2) != 0) {
-+        LOG_TRACE("cmp false");
-+        return false;
-     }
-+
-     return true;
- }
- 
-- 
-2.27.0
-
--- a/SOURCES/0001-man-Clean-up-libmandoc-parser-warnings.patch
+++ b/SOURCES/0001-man-Clean-up-libmandoc-parser-warnings.patch
@ -1,84 +0,0 @@
-From d696645b147eaac5d5c90ff3dca672e52d89d7f0 Mon Sep 17 00:00:00 2001
-From: Jerry Snitselaar <jsnitsel@redhat.com>
-Date: Mon, 27 Apr 2020 12:16:47 -0700
-Subject: [PATCH] man: Clean up libmandoc parser warnings
-
- Fix typo in Tss2_Tcti_Device_Init.3.in.
- Remove .RE macros that had no preceding .RS macro in Tss2_TctiLdr_Initialize.3.in.
-  Replace .RE .sp with .LP.
- ' is a control character, format function names to be similar to
-  other manpages, and use \(oq and \(cq for quotes instead in tss2-tctildr.7.in.
-
-Signed-off-by: Jerry Snitselaar <jsnitsel@redhat.com>
---
- man/Tss2_TctiLdr_Initialize.3.in |  6 ++----
- man/Tss2_Tcti_Device_Init.3.in   |  2 +-
- man/tss2-tctildr.7.in            | 12 ++++++++----
- 3 files changed, 11 insertions(+), 9 deletions(-)
-
-diff --git a/man/Tss2_TctiLdr_Initialize.3.in b/man/Tss2_TctiLdr_Initialize.3.in
-index 8e5fffaa247b..eb5ea1f8315f 100644
--- a/man/Tss2_TctiLdr_Initialize.3.in
-+++ b/man/Tss2_TctiLdr_Initialize.3.in
-@@ -65,8 +65,7 @@ libtss2-tcti-tabrmd.so.0
- libtss2-tcti-device.so.0
- .IP \[bu]
- libtss2-tcti-mssim.so.0
-.RE
-.sp
-+.LP
- When the
- .I name
- string is neither NULL nor the empty string the implementation will attempt
-@@ -81,8 +80,7 @@ name with the following permutations:
- libtss2-tcti-<name>.so.0
- .IP \[bu]
- libtss2-tcti-<name>.so
-.RE
-.sp
-+.LP
- The
- .I config
- string is not interpreted by the TctiLdr init functions and is passed
-diff --git a/man/Tss2_Tcti_Device_Init.3.in b/man/Tss2_Tcti_Device_Init.3.in
-index 3cd2eed7fb0b..122ede1536bc 100644
--- a/man/Tss2_Tcti_Device_Init.3.in
-+++ b/man/Tss2_Tcti_Device_Init.3.in
-@@ -86,7 +86,7 @@ is returned if any parameters contain unexpected values.
- is returned if any parameters are NULL when they should not be.
- .B TSS2_TCTI_RC_BAD_CONTEXT
- is returned if the size of the provided
-.i tctiContext
-+.I tctiContext
- is insufficient.
- .SH EXAMPLE
- TCTI initialization fragment:
-diff --git a/man/tss2-tctildr.7.in b/man/tss2-tctildr.7.in
-index a907aec0cd64..7432316ec6bb 100644
--- a/man/tss2-tctildr.7.in
-+++ b/man/tss2-tctildr.7.in
-@@ -10,13 +10,17 @@ instances.
- .SH DESCRIPTION
- The TCTI dynamic loading and initialization protocol requires a lot of
- boilerplate code. To reduce duplication the tss2-tctildr library adds the
-'Tss2_TctiLdr_Initialize', 'Tss2_TctiLdr_Initialize_Ex' and
-'Tss2_TctiLdr_Finalize' functions to abstract away the machinery required
-+.BR Tss2_TctiLdr_Initialize (),
-+.BR Tss2_TctiLdr_Initialize_Ex (),
-+and
-+.BR Tss2_TctiLdr_Finalize ()
-+functions to abstract away the machinery required
- to load, initialize, and finalize a TCTI context.
- 
- To assist in the discovery of TCTIs this library provides the
-'Tss2_TctiLdr_GetInfo' function. This function, paired with a 'free'
-function to free the memory allocated by 'GetInfo', provides a simple
-+.BR Tss2_TctiLdr_GetInfo ()
-+function. This function, paired with a \(oqfree\(cq
-+function to free the memory allocated by \(oqGetInfo\(cq, provides a simple
- query interface for discovery of the available and default TCTIs
- available to the tss2-tctildr implementation
- 
-- 
-2.24.0
-
--- a/SOURCES/0001-mu-Remove-use-of-VLAs-for-Marshalling-TPML-types.patch
+++ b/SOURCES/0001-mu-Remove-use-of-VLAs-for-Marshalling-TPML-types.patch
@ -1,71 +0,0 @@
-From 58ee0fd916671942e62ac9930f18225761a6dd66 Mon Sep 17 00:00:00 2001
-From: Joe Richey <joerichey@google.com>
-Date: Tue, 21 Jan 2020 20:04:45 -0800
-Subject: [PATCH] mu: Remove use of VLAs for Marshalling TPML types
-
-All of the `Tss2_MU_*_Marshal()` functions have the property that
-`buffer` can be NULL, `offset` can be NULL, but both cannot be
-NULL. Some Marshal functions check this directly (returning
-`TSS2_MU_RC_BAD_REFERENCE` on error), but most do this by composing
-existing Marshalling functions together.
-
-The TMPL Marshal functions does things differently, it creates a local
-VLA `local_buffer[buffer_size]` and uses that as the buffer pointer if
-a NULL buffer is given. This is unnecessary, as this pointer is only
-used for debug logging and passed to other Marshalling functions, which
-will correctly handle a NULL buffer.
-
-Note that the VLA in the existing code is of length `buffer_size` (the
-length of the _entire_ buffer, _not_ the length of the data being
-unmarshaled). This can potentially result in a very large stack
-allocation, or stack overflow.
-
-Signed-off-by: Joe Richey <joerichey@google.com>
---
- src/tss2-mu/tpml-types.c | 11 +++--------
- 1 file changed, 3 insertions(+), 8 deletions(-)
-
-diff --git a/src/tss2-mu/tpml-types.c b/src/tss2-mu/tpml-types.c
-index 9506a26efd14..ae1ed6177d75 100644
--- a/src/tss2-mu/tpml-types.c
-+++ b/src/tss2-mu/tpml-types.c
-@@ -29,8 +29,6 @@ TSS2_RC Tss2_MU_##type##_Marshal(type const *src, uint8_t buffer[], \
-     size_t  local_offset = 0; \
-     UINT32 i, count = 0; \
-     TSS2_RC ret = TSS2_RC_SUCCESS; \
-    uint8_t *buf_ptr = buffer; \
-    uint8_t local_buffer[buffer_size]; \
- \
-     if (offset != NULL) { \
-         LOG_TRACE("offset non-NULL, initial value: %zu", *offset); \
-@@ -60,24 +58,21 @@ TSS2_RC Tss2_MU_##type##_Marshal(type const *src, uint8_t buffer[], \
-         LOG_WARNING("count too big"); \
-         return TSS2_SYS_RC_BAD_VALUE; \
-     } \
-\
-    if (buf_ptr == NULL) \
-        buf_ptr = local_buffer; \
- \
-     LOG_DEBUG(\
-          "Marshalling " #type " from 0x%" PRIxPTR " to buffer 0x%" PRIxPTR \
-          " at index 0x%zx", \
-          (uintptr_t)&src, \
-         (uintptr_t)buf_ptr, \
-+         (uintptr_t)buffer, \
-          local_offset); \
- \
-    ret = Tss2_MU_UINT32_Marshal(src->count, buf_ptr, buffer_size, &local_offset); \
-+    ret = Tss2_MU_UINT32_Marshal(src->count, buffer, buffer_size, &local_offset); \
-     if (ret) \
-         return ret; \
- \
-     for (i = 0; i < src->count; i++) \
-     { \
-        ret = marshal_func(op src->buf_name[i], buf_ptr, buffer_size, &local_offset); \
-+        ret = marshal_func(op src->buf_name[i], buffer, buffer_size, &local_offset); \
-         if (ret) \
-             return ret; \
-     } \
-- 
-2.27.0
-
--- a/SOURCES/0001-sys-match-counter-variable-type-for-cmdAuthsArray-co.patch
+++ b/SOURCES/0001-sys-match-counter-variable-type-for-cmdAuthsArray-co.patch
@ -1,29 +0,0 @@
-From 5ab8190843597ff6a255c59f91582e4dca117927 Mon Sep 17 00:00:00 2001
-From: Jonas Witschel <diabonas@gmx.de>
-Date: Thu, 21 Nov 2019 14:49:27 +0100
-Subject: [PATCH] sys: match counter variable type for cmdAuthsArray->count
-
-TSS2L_SYS_AUTH_COMMAND.count is defined as uint16_t, so the counter
-variable should be uint16_t as well.
-
-Signed-off-by: Jonas Witschel <diabonas@gmx.de>
---
- src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c b/src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c
-index 1bc3f3c2556f..d946c14e5cfb 100644
--- a/src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c
-+++ b/src/tss2-sys/api/Tss2_Sys_SetCmdAuths.c
-@@ -20,7 +20,7 @@ TSS2_RC Tss2_Sys_SetCmdAuths(
-     const TSS2L_SYS_AUTH_COMMAND *cmdAuthsArray)
- {
-     _TSS2_SYS_CONTEXT_BLOB *ctx = syscontext_cast(sysContext);
-    uint8_t i;
-+    uint16_t i;
-     UINT32 authSize = 0;
-     UINT32 newCmdSize = 0;
-     size_t authOffset;
-- 
-2.27.0
-
--- a/SOURCES/0001-tcti-device-getPollHandles-should-allow-num_handles-.patch
+++ b/SOURCES/0001-tcti-device-getPollHandles-should-allow-num_handles-.patch
@ -1,39 +0,0 @@
-From c42450a294c4267998aa16a477e9218ee5953aa9 Mon Sep 17 00:00:00 2001
-From: Jeffrey Ferreira <jeffpferreira@gmail.com>
-Date: Thu, 19 Sep 2019 13:32:00 -0700
-Subject: [PATCH] tcti-device: getPollHandles should allow num_handles query
-
-Signed-off-by: Jeffrey Ferreira <jeffpferreira@gmail.com>
---
- src/tss2-tcti/tcti-device.c | 11 +++++++++--
- 1 file changed, 9 insertions(+), 2 deletions(-)
-
-diff --git a/src/tss2-tcti/tcti-device.c b/src/tss2-tcti/tcti-device.c
-index 44c9fe2083d5..53a698cad061 100644
--- a/src/tss2-tcti/tcti-device.c
-+++ b/src/tss2-tcti/tcti-device.c
-@@ -368,12 +368,19 @@ tcti_device_get_poll_handles (
-         return TSS2_TCTI_RC_BAD_CONTEXT;
-     }
- 
-    if (handles == NULL || num_handles == NULL) {
-+    if (num_handles == NULL) {
-         return TSS2_TCTI_RC_BAD_REFERENCE;
-     }
- 
-+    if (handles != NULL && *num_handles < 1) {
-+        return TSS2_TCTI_RC_INSUFFICIENT_BUFFER;
-+    }
-+
-     *num_handles = 1;
-    handles->fd = tcti_dev->fd;
-+    if (handles != NULL) {
-+        handles->fd = tcti_dev->fd;
-+    }
-+
-     return TSS2_RC_SUCCESS;
- #else
-     (void)(tctiContext);
-- 
-2.27.0
-
--- a/SOURCES/0001-tctildr-fix-segmentation-fault-if-name_conf-is-too-b.patch
+++ b/SOURCES/0001-tctildr-fix-segmentation-fault-if-name_conf-is-too-b.patch
@ -1,39 +0,0 @@
-From ffca561b2de43df0a9f7f9c0e717fca943f2c38b Mon Sep 17 00:00:00 2001
-From: Johannes Holland <joh.ho@gmx.de>
-Date: Tue, 20 Aug 2019 16:58:09 +0200
-Subject: [PATCH] tctildr: fix segmentation fault if name_conf is too big
-
-When strlen(name_conf) is too big and logging is set to at least DEBUG,
-tctildr_conf_parse will cause a segmentation fault. This happens when
-the unit tests are run with logging set to DEBUG. Hence, the logging
-call has to be done after the check for strlen(name_conf).
-
-Signed-off-by: Johannes Holland <joh.ho@gmx.de>
---
- src/tss2-tcti/tctildr.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/src/tss2-tcti/tctildr.c b/src/tss2-tcti/tctildr.c
-index 76248f358860..ff967317b57b 100644
--- a/src/tss2-tcti/tctildr.c
-+++ b/src/tss2-tcti/tctildr.c
-@@ -117,7 +117,6 @@ tctildr_conf_parse (const char *name_conf,
-     char *split;
-     size_t combined_length;
- 
-    LOG_DEBUG ("name_conf: \"%s\"", name_conf);
-     if (name_conf == NULL) {
-         LOG_ERROR ("'name_conf' param may NOT be NULL");
-         return TSS2_TCTI_RC_BAD_REFERENCE;
-@@ -127,6 +126,8 @@ tctildr_conf_parse (const char *name_conf,
-         LOG_ERROR ("combined conf length must be between 0 and PATH_MAX");
-         return TSS2_TCTI_RC_BAD_VALUE;
-     }
-+
-+    LOG_DEBUG ("name_conf: \"%s\"", name_conf);
-     if (combined_length == 0)
-         return TSS2_RC_SUCCESS;
-     split = strchr (name_conf, ':');
-- 
-2.27.0
-
--- a/SOURCES/0001-tctildr-remove-the-private-implementation-of-strndup.patch
+++ b/SOURCES/0001-tctildr-remove-the-private-implementation-of-strndup.patch
@ -1,96 +0,0 @@
-From 464da22b71e26421f55d4e8abc14711f89c89a28 Mon Sep 17 00:00:00 2001
-From: Tadeusz Struk <tadeusz.struk@intel.com>
-Date: Thu, 20 Feb 2020 14:11:43 -0800
-Subject: [PATCH] tctildr: remove the private implementation of strndup
-
-In fact the private implementation of strndup is only
-needed for windows.
-
-Fixes: #1633
-
-Signed-off-by: Tadeusz Struk <tadeusz.struk@intel.com>
---
- configure.ac            |  2 +-
- src/tss2-tcti/tctildr.c | 37 +++++++++++++++++--------------------
- 2 files changed, 18 insertions(+), 21 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index d7724805966b..aa4ffb1b78a1 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -45,7 +45,6 @@ case "${host_os}" in
- esac
- AC_SUBST([LIBSOCKET_LDFLAGS])
- 
-AC_CHECK_FUNCS([strndup])
- AC_ARG_ENABLE([unit],
-             [AS_HELP_STRING([--enable-unit],
-                             [build cmocka unit tests])],,
-@@ -65,6 +64,7 @@ AC_ARG_ENABLE([esapi],
- 
- AM_CONDITIONAL(ESAPI, test "x$enable_esapi" = "xyes")
- 
-+AC_CHECK_FUNC([strndup],[],[AC_MSG_ERROR([strndup function not found])])
- AC_ARG_ENABLE([tcti-device-async],
-     AS_HELP_STRING([--enable-tcti-device-async],
- 	           [Enable asynchronus operation on TCTI device
-diff --git a/src/tss2-tcti/tctildr.c b/src/tss2-tcti/tctildr.c
-index a46b301b3ea7..92af1d3a787d 100644
--- a/src/tss2-tcti/tctildr.c
-+++ b/src/tss2-tcti/tctildr.c
-@@ -15,8 +15,25 @@
- #include <linux/limits.h>
- #elif defined(_MSC_VER)
- #include <windows.h>
-+#include <limits.h>
- #ifndef PATH_MAX
- #define PATH_MAX MAX_PATH
-+
-+static char *strndup(const char* s, size_t n)
-+{
-+    char *dst = NULL;
-+
-+    if (n + 1 >= USHRT_MAX)
-+        return NULL;
-+
-+    dst = calloc(1, n + 1);
-+
-+    if (dst == NULL)
-+        return NULL;
-+
-+    memcpy(dst, s, n);
-+    return dst;
-+}
- #endif
- #else
- #include <limits.h>
-@@ -268,26 +285,6 @@ Tss2_TctiLdr_Finalize (TSS2_TCTI_CONTEXT **tctiContext)
-     *tctiContext = NULL;
- }
- 
-#if !defined(HAVE_STRNDUP)
-char*
-strndup (const char* s,
-         size_t n)
-{
-    char* dst = NULL;
-
-    if (n + 1 < n) {
-        return NULL;
-    }
-    dst = calloc(1, n + 1);
-    if (dst == NULL) {
-        return NULL;
-    }
-    memcpy(dst, s, n);
-
-    return dst;
-}
-#endif /* HAVE_STRNDUP */
-
- TSS2_RC
- copy_info (const TSS2_TCTI_INFO *info_src,
-            TSS2_TCTI_INFO *info_dst)
-- 
-2.30.1
-
--- a/SOURCES/0001-tss2_rc-ensure-layer-number-is-in-bounds.patch
+++ b/SOURCES/0001-tss2_rc-ensure-layer-number-is-in-bounds.patch
@ -1,139 +0,0 @@
-From 79f62668a31a2da938f83d534a49ad7f9bc144ca Mon Sep 17 00:00:00 2001
-From: William Roberts <william.c.roberts@intel.com>
-Date: Thu, 19 Jan 2023 11:53:06 -0600
-Subject: [PATCH] tss2_rc: ensure layer number is in bounds
-
-The layer handler array was defined as 255, the max number of uint8,
-which is the size of the layer field, however valid values are 0-255
-allowing for 256 possibilities and thus the array was off by one and
-needed to be sized to 256 entries. Update the size and add tests.
-
-Note: previous implementations incorrectly dropped bits on unknown error
-output, ie TSS2_RC of 0xFFFFFF should yeild a string of 255:0xFFFFFF,
-but earlier implementations returned 255:0xFFFF, dropping the middle
-bits, this patch fixes that.
-
-Fixes: CVE-2023-22745
-
-Signed-off-by: William Roberts <william.c.roberts@intel.com>
---
- src/tss2-rc/tss2_rc.c    | 31 +++++++++++++++++++++----------
- test/unit/test_tss2_rc.c | 21 ++++++++++++++++++++-
- 2 files changed, 41 insertions(+), 11 deletions(-)
-
-diff --git a/src/tss2-rc/tss2_rc.c b/src/tss2-rc/tss2_rc.c
-index 93743048..0a64958f 100644
--- a/src/tss2-rc/tss2_rc.c
-+++ b/src/tss2-rc/tss2_rc.c
-@@ -1,5 +1,8 @@
- /* SPDX-License-Identifier: BSD-2-Clause */
-
-+#ifdef HAVE_CONFIG_H
-+#include "config.h"
-+#endif
-+#include <assert.h>
- #include <stdarg.h>
- #include <stdbool.h>
- #include <stdio.h>
-@@ -777,7 +780,7 @@ sys_err_handler (TSS2_RC rc)
- static struct {
-     char name[TSS2_ERR_LAYER_NAME_MAX];
-     TSS2_RC_HANDLER handler;
-} layer_handler[TPM2_ERROR_TSS2_RC_LAYER_COUNT] = {
-+} layer_handler[TPM2_ERROR_TSS2_RC_LAYER_COUNT + 1] = {
-     ADD_HANDLER("tpm" , tpm2_ehandler),
-     ADD_NULL_HANDLER,                       /* layer 1  is unused */
-     ADD_NULL_HANDLER,                       /* layer 2  is unused */
-@@ -812,7 +815,7 @@ unknown_layer_handler(TSS2_RC rc)
-     static __thread char buf[32];
- 
-     clearbuf(buf);
-    catbuf(buf, "0x%X", tpm2_error_get(rc));
-+    catbuf(buf, "0x%X", rc);
- 
-     return buf;
- }
-@@ -909,19 +912,27 @@ Tss2_RC_Decode(TSS2_RC rc)
-         catbuf(buf, "%u:", layer);
-     }
- 
-    handler = !handler ? unknown_layer_handler : handler;
-
-     /*
-      * Handlers only need the error bits. This way they don't
-      * need to concern themselves with masking off the layer
-      * bits or anything else.
-      */
-    UINT16 err_bits = tpm2_error_get(rc);
-    const char *e = err_bits ? handler(err_bits) : "success";
-    if (e) {
-        catbuf(buf, "%s", e);
-+    if (handler) {
-+        UINT16 err_bits = tpm2_error_get(rc);
-+        const char *e = err_bits ? handler(err_bits) : "success";
-+        if (e) {
-+            catbuf(buf, "%s", e);
-+        } else {
-+            catbuf(buf, "0x%X", err_bits);
-+        }
-     } else {
-        catbuf(buf, "0x%X", err_bits);
-+        /*
-+         * we don't want to drop any bits if we don't know what to do with it
-+         * so drop the layer byte since we we already have that.
-+         */
-+        const char *e = unknown_layer_handler(rc >> 8);
-+        assert(e);
-+        catbuf(buf, "%s", e);
-     }
- 
-     return buf;
-diff --git a/test/unit/test_tss2_rc.c b/test/unit/test_tss2_rc.c
-index 1c8d66c9..9369beda 100644
--- a/test/unit/test_tss2_rc.c
-+++ b/test/unit/test_tss2_rc.c
-@@ -198,7 +198,7 @@ test_custom_handler(void **state)
-      * Test an unknown layer
-      */
-     e = Tss2_RC_Decode(rc);
-    assert_string_equal(e, "1:0x2A");
-+    assert_string_equal(e, "1:0x100");
- }
- 
- static void
-@@ -281,6 +281,23 @@ test_tcti(void **state)
-     assert_string_equal(e, "tcti:Fails to connect to next lower layer");
- }
- 
-+static void
-+test_all_FFs(void **state)
-+{
-+    (void) state;
-+
-+    const char *e = Tss2_RC_Decode(0xFFFFFFFF);
-+    assert_string_equal(e, "255:0xFFFFFF");
-+}
-+
-+static void
-+test_all_FFs_set_handler(void **state)
-+{
-+    (void) state;
-+    Tss2_RC_SetHandler(0xFF, "garbage", custom_err_handler);
-+    Tss2_RC_SetHandler(0xFF, NULL, NULL);
-+}
-+
- /* link required symbol, but tpm2_tool.c declares it AND main, which
-  * we have a main below for cmocka tests.
-  */
-@@ -312,6 +329,8 @@ main(int argc, char* argv[])
-             cmocka_unit_test(test_esys),
-             cmocka_unit_test(test_mu),
-             cmocka_unit_test(test_tcti),
-+            cmocka_unit_test(test_all_FFs),
-+            cmocka_unit_test(test_all_FFs_set_handler)
-     };
- 
-     return cmocka_run_group_tests(tests, NULL, NULL);
-- 
-2.40.1
-
--- a/SOURCES/0002-esys-Shared-secret-calculation-is-not-spec-compliant.patch
+++ b/SOURCES/0002-esys-Shared-secret-calculation-is-not-spec-compliant.patch
@ -1,31 +0,0 @@
-From b94392537a1ed43918483a2bfa8a90e5fd05354d Mon Sep 17 00:00:00 2001
-From: Stefan Thom <mail@LordOfDorks.com>
-Date: Fri, 5 Jun 2020 12:11:39 -0700
-Subject: [PATCH 2/4] esys: Shared secret calculation is not spec compliant.
-
-Refer to specification part 1 Architecture, Section 20.1 AuditSession
-Introduction: If the session was bound when created (see 19.6.10 and
-19.6.12), the bind value is lost and any further use of the session for
-authorization will require that the authValue be used in the HMAC.
-
-Signed-off-by: Stefan Thom <mail@LordOfDorks.com>
---
- src/tss2-esys/esys_tr.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/src/tss2-esys/esys_tr.c b/src/tss2-esys/esys_tr.c
-index c9ea537a..d14c7d35 100644
--- a/src/tss2-esys/esys_tr.c
-+++ b/src/tss2-esys/esys_tr.c
-@@ -511,6 +511,8 @@ Esys_TRSess_SetAttributes(ESYS_CONTEXT * esys_context, ESYS_TR esys_handle,
-     esys_object->rsrc.misc.rsrc_session.sessionAttributes =
-         (esys_object->rsrc.misc.rsrc_session.
-          sessionAttributes & ~mask) | (flags & mask);
-+    if (esys_object->rsrc.misc.rsrc_session.sessionAttributes & TPMA_SESSION_AUDIT)
-+        esys_object->rsrc.misc.rsrc_session.bound_entity.size = 0;
-     return TSS2_RC_SUCCESS;
- }
- 
-- 
-2.41.0
-
--- a/SOURCES/0003-esys_iutil.c-Fix-issue-where-nonceTPM-was-included-t.patch
+++ b/SOURCES/0003-esys_iutil.c-Fix-issue-where-nonceTPM-was-included-t.patch
@ -1,45 +0,0 @@
-From 7a56b84b5990b07efd30b5bf79331c74d28df954 Mon Sep 17 00:00:00 2001
-From: Imran Desai <imran.desai@intel.com>
-Date: Mon, 22 Mar 2021 16:43:36 -0700
-Subject: [PATCH 3/4] esys_iutil.c: Fix issue where nonceTPM was included twice
- in hmac
-
-Fixes #2037
-
-TPM2.0 Architecture 19.6.5 Note 7
-
-If the same session (not the first session) is used for decrypt and
-encrypt, its nonceTPM is only used once. If different sessions are
-used for decrypt and encrypt, both nonceTPMs are included.
-
-Signed-off-by: Imran Desai <imran.desai@intel.com>
---
- src/tss2-esys/esys_iutil.c | 12 ++++++++++++
- 1 file changed, 12 insertions(+)
-
-diff --git a/src/tss2-esys/esys_iutil.c b/src/tss2-esys/esys_iutil.c
-index 08a9b7df..1910c570 100644
--- a/src/tss2-esys/esys_iutil.c
-+++ b/src/tss2-esys/esys_iutil.c
-@@ -1265,6 +1265,18 @@ iesys_gen_auths(ESYS_CONTEXT * esys_context,
-                                     &encryptNonce);
-     return_if_error(r, "More than one crypt session");
- 
-+    /*
-+     * TPM2.0 Architecture 19.6.5 Note 7
-+     *
-+     * If the same session (not the first session) is used for decrypt and
-+     * encrypt, its nonceTPM is only used once. If different sessions are used
-+     * for decrypt and encrypt, both nonceTPMs are included
-+     */
-+    if (decryptNonceIdx && (decryptNonceIdx == encryptNonceIdx)) {
-+        decryptNonceIdx = 0;
-+    }
-+
-+
-     /* Compute cp hash values for command buffer for all used algorithms */
- 
-     r = iesys_compute_cp_hashtab(esys_context,
-- 
-2.41.0
-
--- a/SOURCES/0004-ESYS-Fix-buffer-overflow-in-xor-parameter-obfuscatio.patch
+++ b/SOURCES/0004-ESYS-Fix-buffer-overflow-in-xor-parameter-obfuscatio.patch
@ -1,42 +0,0 @@
-From 3a540d570d265c80dca31bfec23d267cdfa1c294 Mon Sep 17 00:00:00 2001
-From: Juergen Repp <juergen.repp@sit.fraunhofer.de>
-Date: Mon, 12 Jul 2021 10:52:53 +0200
-Subject: [PATCH 4/4] ESYS: Fix buffer overflow in xor parameter obfuscation.
-
-If trace is activated LOGBLOB_TRACE is called with a wrong pointer to display
-the obfuscated data. Fixes #2115.
-
-Signed-off-by: Juergen Repp <juergen.repp@sit.fraunhofer.de>
---
- src/tss2-esys/esys_crypto.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/src/tss2-esys/esys_crypto.c b/src/tss2-esys/esys_crypto.c
-index aef3e50b..a2b7b937 100644
--- a/src/tss2-esys/esys_crypto.c
-+++ b/src/tss2-esys/esys_crypto.c
-@@ -499,6 +499,7 @@ iesys_xor_parameter_obfuscation(TPM2_ALG_ID hash_alg,
-     size_t data_size_bits = data_size * 8;
-     size_t rest_size = data_size;
-     BYTE *kdfa_byte_ptr;
-+    BYTE *data_start = data;
- 
-     if (key == NULL || data == NULL) {
-         LOG_ERROR("Bad reference");
-@@ -514,11 +515,11 @@ iesys_xor_parameter_obfuscation(TPM2_ALG_ID hash_alg,
-         return_if_error(r, "iesys_crypto_KDFa failed");
-         /* XOR next data sub block with KDFa result  */
-         kdfa_byte_ptr = kdfa_result;
-        LOGBLOB_TRACE(data, data_size, "Parameter data before XOR");
-+        LOGBLOB_TRACE(data_start, data_size, "Parameter data before XOR");
-         for(size_t i = digest_size < rest_size ? digest_size : rest_size; i > 0;
-             i--)
-             *data++ ^= *kdfa_byte_ptr++;
-        LOGBLOB_TRACE(data, data_size, "Parameter data after XOR");
-+        LOGBLOB_TRACE(data_start, data_size, "Parameter data after XOR");
-         rest_size = rest_size < digest_size ? 0 : rest_size - digest_size;
-     }
-     return TSS2_RC_SUCCESS;
-- 
-2.41.0
-
--- a/SOURCES/tpm2-tss-3.0.0-doxygen.patch
+++ b/SOURCES/tpm2-tss-3.0.0-doxygen.patch
@ -0,0 +1,15 @@
+diff -up tpm2-tss-3.0.0/Doxyfile.in.me tpm2-tss-3.0.0/Doxyfile.in
+--- tpm2-tss-3.0.0/Doxyfile.in.me	2020-09-15 20:24:26.463314644 +0200
+++ tpm2-tss-3.0.0/Doxyfile.in	2020-09-15 20:26:29.010866650 +0200
+@@ -947,7 +947,10 @@ EXCLUDE_PATTERNS       =
+ # Note that the wildcards are matched against the file with absolute path, so to
+ # exclude all test directories use the pattern */test/*
+ 
+-EXCLUDE_SYMBOLS        = *_IN IESYS_CMD_IN_PARAM
+EXCLUDE_SYMBOLS        = StartAuthSession_IN CreatePrimary_IN ContextSave_IN ContextLoad_IN \
+                         Load_IN LoadExternal_IN CreateLoaded_IN EvictControl_IN HMAC_Start_IN \
+                         HierarchyChangeAuth_IN SequenceComplete_IN Policy_IN NV_IN FlushContext_IN \
+                         IESYS_CMD_IN_PARAM
+ 
+ # The EXAMPLE_PATH tag can be used to specify one or more files or directories
+ # that contain example code fragments that are included (see the \include
--- a/SOURCES/tpm2-tss-systemd-sysusers.conf
+++ b/SOURCES/tpm2-tss-systemd-sysusers.conf
@ -0,0 +1,2 @@
+#Type Name ID  GECOS                         Home directory Shell
+u     tss  59  "Account used for TPM access" -              -
--- a/SPECS/tpm2-tss.spec
+++ b/SPECS/tpm2-tss.spec
@ -1,49 +1,32 @@
-Name:           tpm2-tss
-Version:        2.3.2
-Release:        6%{?dist}
-Summary:        TPM2.0 Software Stack
+Name:          tpm2-tss
+Version:       3.2.3
+Release:       1%{?dist}
+Summary:       TPM2.0 Software Stack

-# The entire source code is under BSD except implementation.h and tpmb.h which
-# is under TCGL(Trusted Computing Group License).
-License:        BSD
-URL:            https://github.com/tpm2-software/tpm2-tss
-Source0:        https://github.com/tpm2-software/tpm2-tss/releases/download/%{version}/%{name}-%{version}.tar.gz
-# patch submitted upstream https://github.com/tpm2-software/tpm2-tss/pull/1707
-Patch0:         0001-man-Clean-up-libmandoc-parser-warnings.patch
-# Upstream patches
-Patch1:         0001-esys-Check-object-handle-node-before-calling-compute.patch
-Patch2:         0001-build-update-exported-symbols-map-for-libtss2-mu.patch
-Patch3:         0001-esys-fix-Esys_StartAuthSession-called-with-optional-.patch
-Patch4:         0001-esys-fixup-compute_encrypted_salt-err-handling-in-Es.patch
-Patch5:         0001-esys-zero-out-ctx-salt-after-on-startAuthSession_fin.patch
-Patch6:         0001-mu-Remove-use-of-VLAs-for-Marshalling-TPML-types.patch
-Patch7:         0001-esys_iutil-use-memcmp-in-byte-array-comparison.patch
-Patch8:         0001-tcti-device-getPollHandles-should-allow-num_handles-.patch
-Patch9:         0001-tctildr-fix-segmentation-fault-if-name_conf-is-too-b.patch
-Patch10:        0001-esys-fix-keysize-of-ECC-curve-TPM2_ECC_NISTP224.patch
-Patch11:        0001-Esys_CreateLoaded-fix-resource-name-calculation.patch
-Patch12:        0001-sys-match-counter-variable-type-for-cmdAuthsArray-co.patch
-Patch13:        0001-Return-proper-error-code-on-memory-allocation-failur.patch
-Patch14:        0001-esys-fix-hmac-calculation-for-tpm2_clear-command.patch
-Patch15:        0001-tctildr-remove-the-private-implementation-of-strndup.patch
-Patch16:        0001-tss2_rc-ensure-layer-number-is-in-bounds.patch
-Patch17:        0001-ESYS-Fix-initialization-of-app-data-in-Esys_Initiali.patch
-Patch18:        0002-esys-Shared-secret-calculation-is-not-spec-compliant.patch
-Patch19:        0003-esys_iutil.c-Fix-issue-where-nonceTPM-was-included-t.patch
-Patch20:        0004-ESYS-Fix-buffer-overflow-in-xor-parameter-obfuscatio.patch
+License:       BSD
+URL:           https://github.com/tpm2-software/tpm2-tss
+Source0:       https://github.com/tpm2-software/tpm2-tss/releases/download/%{version}/%{name}-%{version}.tar.gz
+Source1:       tpm2-tss-systemd-sysusers.conf
+# doxygen patch
+Patch0: tpm2-tss-3.0.0-doxygen.patch
+Patch2: 0001-esys_iutil-fix-possible-NPD.patch

 %global udevrules_prefix 60-

-BuildRequires:  gcc
-BuildRequires:  gcc-c++
-BuildRequires:  doxygen
-BuildRequires:  autoconf-archive
-BuildRequires:  libtool
-BuildRequires:  pkgconfig
-BuildRequires:  systemd
-BuildRequires:  libgcrypt-devel
-BuildRequires:  openssl-devel
-Requires(pre):  shadow-utils
+BuildRequires: make
+BuildRequires: autoconf-archive
+BuildRequires: doxygen
+BuildRequires: gcc
+BuildRequires: gcc-c++
+BuildRequires: json-c-devel
+BuildRequires: libcurl-devel
+BuildRequires: libgcrypt-devel
+BuildRequires: libtool
+BuildRequires: openssl-devel
+BuildRequires: pkgconfig
+BuildRequires: systemd
+BuildRequires: systemd-rpm-macros
+Requires(pre): shadow-utils

 %description
 tpm2-tss is a software stack supporting Trusted Platform Module(TPM) 2.0 system
@ -55,7 +38,10 @@ APIs for applications to access TPM module through kernel TPM drivers.

 %build
 # Use built-in tpm-udev.rules, with specified installation path and prefix.
-%configure --disable-static --disable-silent-rules --with-udevrulesdir=%{_udevrulesdir} --with-udevrulesprefix=%{udevrules_prefix}
+%configure --disable-static --disable-silent-rules \
+           --disable-tcti-pcap --disable-tcti-libtpms \
+           --with-udevrulesdir=%{_udevrulesdir} --with-udevrulesprefix=%{udevrules_prefix} \
+           --with-runstatedir=%{_rundir} --with-tmpfilesdir=%{_tmpfilesdir} --with-sysusersdir=%{_sysusersdir}

 # This is to fix Rpath errors. Taken from https://fedoraproject.org/wiki/Packaging:Guidelines#Removing_Rpath
 sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool
@ -66,31 +52,33 @@ sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool
 %install
 %make_install
 find %{buildroot}%{_libdir} -type f -name \*.la -delete
+rm %{buildroot}%{_sysusersdir}/tpm2-tss.conf
+install -p -D -m 0644 %{SOURCE1} %{buildroot}%{_sysusersdir}/tpm2-tss.conf

 %pre
-getent group tss >/dev/null || groupadd -f -g 59 -r tss
-if ! getent passwd tss >/dev/null ; then
-    if ! getent passwd 59 >/dev/null ; then
-      useradd -r -u 59 -g tss -d / -s /sbin/nologin -c "Account used for TPM access" tss
-    else
-      useradd -r -g tss -d / -s /sbin/nologin -c "Account used for TPM access" tss
-    fi
-fi
+%sysusers_create_compat %{SOURCE1}
 exit 0

+%ldconfig_scriptlets
+
 %files
 %doc README.md CHANGELOG.md
 %license LICENSE
-%{_libdir}/libtss2-mu.so.*
-%{_libdir}/libtss2-sys.so.*
-%{_libdir}/libtss2-esys.so.*
-%{_libdir}/libtss2-rc.so.*
-%{_libdir}/libtss2-tctildr.so.*
-%{_libdir}/libtss2-tcti-device.so.*
-%{_libdir}/libtss2-tcti-mssim.so.*
+%{_sysconfdir}/tpm2-tss/
+%{_libdir}/libtss2-mu.so.0*
+%{_libdir}/libtss2-sys.so.1*
+%{_libdir}/libtss2-esys.so.0*
+%{_libdir}/libtss2-fapi.so.1*
+%{_libdir}/libtss2-rc.so.0*
+%{_libdir}/libtss2-tctildr.so.0*
+%{_libdir}/libtss2-tcti-cmd.so.0*
+%{_libdir}/libtss2-tcti-device.so.0*
+%{_libdir}/libtss2-tcti-mssim.so.0*
+%{_libdir}/libtss2-tcti-swtpm.so.0*
+%{_sysusersdir}/tpm2-tss.conf
+%{_tmpfilesdir}/tpm2-tss-fapi.conf
 %{_udevrulesdir}/%{udevrules_prefix}tpm-udev.rules

-
 %package        devel
 Summary:        Headers and libraries for building apps that use tpm2-tss 
 Requires:       %{name}%{_isa} = %{version}-%{release}
@ -104,71 +92,148 @@ use tpm2-tss.
 %{_libdir}/libtss2-mu.so
 %{_libdir}/libtss2-sys.so
 %{_libdir}/libtss2-esys.so
+%{_libdir}/libtss2-fapi.so
 %{_libdir}/libtss2-rc.so
 %{_libdir}/libtss2-tctildr.so
-%{_libdir}/libtss2-tcti-default.so
+%{_libdir}/libtss2-tcti-cmd.so
 %{_libdir}/libtss2-tcti-device.so
 %{_libdir}/libtss2-tcti-mssim.so
+%{_libdir}/libtss2-tcti-swtpm.so
 %{_libdir}/pkgconfig/tss2-mu.pc
 %{_libdir}/pkgconfig/tss2-sys.pc
 %{_libdir}/pkgconfig/tss2-esys.pc
+%{_libdir}/pkgconfig/tss2-fapi.pc
 %{_libdir}/pkgconfig/tss2-rc.pc
 %{_libdir}/pkgconfig/tss2-tctildr.pc
+%{_libdir}/pkgconfig/tss2-tcti-cmd.pc
 %{_libdir}/pkgconfig/tss2-tcti-device.pc
 %{_libdir}/pkgconfig/tss2-tcti-mssim.pc
+%{_libdir}/pkgconfig/tss2-tcti-swtpm.pc
 %{_mandir}/man3/*.3.gz
+%{_mandir}/man5/*.5.gz
 %{_mandir}/man7/tss2*.7.gz

-%post -p /sbin/ldconfig
-
-%postun -p /sbin/ldconfig

 %changelog
-* Wed Oct 18 2023 Štěpán Horáček <shoracek@redhat.com> - 2.3.2-6
- Fix home directory of the tss user
-  Related: RHEL-14439
+* Thu May 30 2024 Štěpán Horáček <shoracek@redhat.com> - 3.2.3-1
+- Rebase to 3.2.3
+  Resolves: RHEL-23206

-* Wed Jun 7 2023 Štěpán Horáček <shoracek@redhat.com> - 2.3.2-5
- Ensure layer number is in bounds
-  Resolves: rhbz#2160302
-  Resolves: rhbz#2162611 
+* Mon Jul 3 2023 Štěpán Horáček <shoracek@redhat.com> - 3.2.2-2
+- Remove misapplied license
+  Resolves: rhbz#2160307

-* Tue Apr 20 2021 Jerry Snitselaar <jsnitsel@redhat.com> - 2.3.2-4
- Fix hmac calculation for tpm2_clear command.
- Remove private implementation of strndup.
-resolves: rhbz#1920825 rhbz#1940861
+* Fri Jun 23 2023 Štěpán Horáček <shoracek@redhat.com> - 3.2.2-1
+- Rebase to 3.2.2
+- Use systemd-sysusers to create user
+  Resolves: CVE-2023-22745
+  Resolves: rhbz#2095479
+  Resolves: rhbz#2160307
+  Resolves: rhbz#2162613

-* Mon Nov 16 2020 Jerry Snitselaar <jsnitsel@redhat.com> - 2.3.2-3
- Add tss user if doesn't exist.
- Update exported symbols map for libtss2-mu
- esys: Check object handle node before calling compute_session_value
- esys: fix resource name calculation
- esys: fix Esys_StartAuthSession called with optional params
- esys: fix keysize of ECC curve TPM2_ECC_NISTP224
- esys: fixup compute_encrypted_salt error handling
- esys: use memcmp in byte array comparison
- esys: zero out ctx->salt after startAuthSession_finish
- mu: Remove use of VLAs for Marshalling TPML types
- return proper error code on memory allocation failure
- sys: match counter variable type for cmdAuthsArray->count
- tcti-device: getPollHandles should allow num_handles query
- tctildr: fix segmentation fault if name_conf is too big
-resolves: rhbz#1879071 rhbz#1855180
+* Wed Aug 10 2022 Štěpán Horáček <shoracek@redhat.com> - 3.0.3-8
+- Fix memory leaks, potential crashes, upgrade to OpenSSL 3
+  Resolves: rhbz#2041919

-* Mon Apr 27 2020 Jerry Snitselaar <jsnitsel@redhat.com> - 2.3.2-2
- Clean up libmandoc parser errors.
-resolves: rhbz#1789684
+* Thu Feb 17 2022 Štěpán Horáček <shoracek@redhat.com> - 3.0.3-7
+- Rebuild with latest json-c library
+  Related: rhbz#2023328

-* Thu Feb 20 2020 Jerry Snitselaar <jsnitsel@redhat.com> - 2.3.2-1
+* Wed Aug 18 2021 Štěpán Horáček <shoracek@redhat.com> - 3.0.3-6
+- Fix failures while using OpenSSL 3
+  Resolves: rhbz#1984634
+
+* Tue Aug 10 2021 Mohan Boddu <mboddu@redhat.com> - 3.0.3-5
+- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
+  Related: rhbz#1991688
+
+* Wed Jun 16 2021 Mohan Boddu <mboddu@redhat.com> - 3.0.3-4
+- Rebuilt for RHEL 9 BETA for openssl 3.0
+  Related: rhbz#1971065
+
+* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 3.0.3-3
+- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
+
+* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 3.0.3-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Thu Nov 26 2020 Peter Robinson <pbrobinson@fedoraproject.org> - 3.0.3-1
+- Update to 3.0.2
+
+* Sun Nov 22 2020 Peter Robinson <pbrobinson@fedoraproject.org> - 3.0.2-1
+- Update to 3.0.2
+
+* Wed Sep 23 2020 Peter Robinson <pbrobinson@fedoraproject.org> - 3.0.1-1
+- Update to 3.0.1
+
+* Tue Sep 15 2020 Than Ngo <than@redhat.com> - 3.0.0-4
+- Fix doxygen crash
+
+* Tue Sep 15 2020 Peter Robinson <pbrobinson@fedoraproject.org> - 3.0.0-3
+- Create tss user, if it doesn't exist, for userspace TPM access
+
+* Fri Aug 07 2020 Peter Robinson <pbrobinson@fedoraproject.org> - 3.0.0-2
+- Install sysusers config in sysusersdir (rhbz #1834519)
+
+* Wed Aug 05 2020 Peter Robinson <pbrobinson@fedoraproject.org> - 3.0.0-1
+- Update to 3.0.0
+
+* Wed Aug 05 2020 Peter Robinson <pbrobinson@fedoraproject.org> - 2.4.2-1
+- Update to 2.4.2
+
+* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.1-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Thu May 14 2020 Peter Robinson <pbrobinson@fedoraproject.org> - 2.4.1-1
+- Update to 2.4.1
+
+* Fri May 08 2020 Paul Wouters <pwouters@redhat.com> - 2.4.0-3
+- Use proper rundir and tmpfiles macros so proper directories are used
+
+* Tue Apr 21 2020 Björn Esser <besser82@fedoraproject.org> - 2.4.0-2
+- Rebuild (json-c)
+
+* Thu Mar 12 2020 Peter Robinson <pbrobinson@fedoraproject.org> - 2.4.0-1
+- Update to 2.4.0 release
+
+* Mon Feb 24 2020 Peter Robinson <pbrobinson@fedoraproject.org> - 2.3.3-1
+- Update to 2.3.3 release
+
+* Fri Jan 31 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.3.2-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Fri Dec 13 2019 Yunying Sun <yunying.sun@intel.com> - 2.3.2-1
 - Update to 2.3.2 release
-resolves: rhbz#1789684

-* Tue May 28 2019 Jerry Snitselaar <jsnitsel@redhat.com> - 2.0.0-5
- Add CI gating support
-resolves: rhbz#1682418
+* Fri Sep 6 2019 Yunying Sun <yunying.sun@intel.com> - 2.3.1-1
+- Update to 2.3.1 release

-* Mon Jul 23 2018 Jerry Snitselaar <jsnitsel@redhat.com> - 2.0.0-4
- Remove TCGL from spec license list.
+* Thu Aug 15 2019 Yunying Sun <yunying.sun@intel.com> - 2.3.0-1
+- Update to 2.3.0 release
+
+* Sat Jul 27 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.2.3-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Wed May 29 2019 Yunying Sun <yunying.sun@intel.com> - 2.2.3-1
+- Update to 2.2.3 release
+
+* Fri Mar 29 2019 Yunying Sun <yunying.sun@intel.com> - 2.2.2-1
+- Update to 2.2.2 release
+
+* Mon Mar  4 2019 Peter Robinson <pbrobinson@fedoraproject.org> 2.2.1-1
+- Update to 2.2.1 release
+
+* Wed Feb 06 2019 Javier Martinez Canillas <javierm@redhat.com> - 2.2.0-1
+- Update to 2.2.0 release
+
+* Sun Feb 03 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Wed Oct 10 2018 Yunying Sun <yunying.sun@intel.com> - 2.1.0-1
+- Update to 2.1.0 release
+
+* Thu Aug 30 2018 Yunying Sun <yunying.sun@intel.com> - 2.0.1-1
+- Update to 2.0.1 release

 * Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.0.0-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild