Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package openCryptoki for openSUSE:Factory checked in at 2026-11-04 19:48:24 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/openCryptoki (Old) and /work/SRC/openSUSE:Factory/.openCryptoki.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "openCryptoki" Wed Nov 4 19:48:24 2026 rev:98 rq:1394975 version:3.28.0 Changes: -------- --- /work/SRC/openSUSE:Factory/openCryptoki/openCryptoki.changes 2026-07-14 13:47:26.225882318 +0200 +++ /work/SRC/openSUSE:Factory/.openCryptoki.new.3759290/openCryptoki.changes 2026-11-04 19:52:00.811844505 +0100 @@ -1,0 +2,38 @@ +Wed Nov 4 14:19:05 UTC 2026 - Nikolay Gueorguiev <[email protected]> + +- Upgrade openCryptoki to version 3.28 (jsc#PED-14609) + * EP11: Add support for CKM_IBM_ETH_DERIVE mechanism for Ethereum 2.0 key derivation. + * EP11: Fix Edwards/Montgomery mechanisms reporting (EP11 version dependent). + * CCA: Enable SHA3 mechanisms for Linux on x64/Power/AIX only if the respective access control points (ACPs) are set. + * ICSF: Introduce a FIPS-compliant token data store format. + * PKCSICSF: Fix token initialization in regards of the specified SO pin. + * PKCSICSF: Add support for changing the RACF password. + * COMMON: Remove dependency on liblber for BER encoding; refactor BER primitive encoding/decoding and public key encoding functions. + * TOOLS: Add an ICSF mock server that simulates ICSF for integration testing. +- Bug fixes and security hardening (symlink-following protections, integer overflow prevention, memory cleansing, and input validation across all components). +- Fixes for the following vulnerabilities (CVE assignment still pending): + * GHSA-9f33-5pv5-wfcf + * GHSA-fqmw-982p-9mcf + * GHSA-qwh5-2x7g-8cpr + * GHSA-2jpf-963x-hrx6 + * GHSA-fq9w-q64j-7fvp +- Remove obsoleted patch for version 3.27 + * ocki-3.27-remove-make-install-chgrp.patch +- Add a new SUSE patch for version 3.28 + * ocki-3.28-remove-make-install-chgrp.patch +- Packaging and spec file improvements for 3.28 and Immutable OS: + * Remove non-existent configure option --enable-pkcscca_migrate and pass + --enable-pkcsep11_session / --disable-pkcsep11_session appropriately. + * Remove obsolete configure flag --enable-locks (transactional memory dropped). + * Drop obsolete BuildRequires: libitm1. + * Add BuildRequires: autoconf, autoconf-archive, automake (required for bootstrap.sh). + * Scope BuildRequires: libudev-devel to s390/s390x where netlink AP monitoring is supported. + * Clean up openCryptoki-devel Requires: drop internal token build dependencies + (openldap2-devel, trousers-devel, libica-devel) and ensure openCryptoki base dependency is set. + * Remove obsolete and unused SysV init script openCryptoki.pkcsslotd (Source1). + * Fix CRLF line terminators in misc/opencryptoki.pc.in with dos2unix. + * Ensure full Immutable OS compatibility: use %{_tmpfilesdir} consistently, + clean up buildroot runtime directories (/var/lock, /run), and preserve systemd drop-in. + * Update package summary and description to PKCS#11 v3.0 and modern crypto adapters. + +------------------------------------------------------------------- Old: ---- ocki-3.27-remove-make-install-chgrp.patch openCryptoki-3.27.0.tar.gz openCryptoki.pkcsslotd New: ---- ocki-3.28-remove-make-install-chgrp.patch openCryptoki-3.28.0.tar.gz ----------(Old B)---------- Old:- Remove obsoleted patch for version 3.27 * ocki-3.27-remove-make-install-chgrp.patch - Add a new SUSE patch for version 3.28 ----------(Old E)---------- ----------(New B)---------- New:- Add a new SUSE patch for version 3.28 * ocki-3.28-remove-make-install-chgrp.patch - Packaging and spec file improvements for 3.28 and Immutable OS: ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ openCryptoki.spec ++++++ --- /var/tmp/diff_new_pack.aiBVWZ/_old 2026-11-04 19:52:01.828886916 +0100 +++ /var/tmp/diff_new_pack.aiBVWZ/_new 2026-11-04 19:52:01.830886999 +0100 @@ -27,39 +27,39 @@ %define oc_cvs_tag opencryptoki %ifarch s390 s390x - %define ocki_conf_flags --enable-icatok --enable-ccatok --enable-ep11tok --enable-pkcsep11_migrate + %define ocki_conf_flags --enable-icatok --enable-ccatok --enable-ep11tok --enable-pkcsep11_migrate --enable-pkcsep11_session %else %ifnarch i586 - %define ocki_conf_flags --disable-icatok --enable-ccatok --disable-ep11tok --disable-pkcsep11_migrate --enable-pkcscca_migrate + %define ocki_conf_flags --disable-icatok --enable-ccatok --disable-ep11tok --disable-pkcsep11_migrate --disable-pkcsep11_session %else - %define ocki_conf_flags --disable-icatok --disable-ccatok --disable-ep11tok --disable-pkcsep11_migrate --disable-pkcscca_migrate + %define ocki_conf_flags --disable-icatok --disable-ccatok --disable-ep11tok --disable-pkcsep11_migrate --disable-pkcsep11_session %endif %endif Name: openCryptoki -Version: 3.27.0 +Version: 3.28.0 Release: 0 -Summary: An Implementation of PKCS#11 (Cryptoki) v2.11 for IBM Cryptographic Hardware +Summary: An Implementation of PKCS#11 (Cryptoki) v3.0 for IBM Cryptographic Hardware License: CPL-1.0 Group: Productivity/Security URL: https://github.com/opencryptoki/opencryptoki Source: https://github.com/opencryptoki/%{oc_cvs_tag}/archive/refs/tags/v%{version}.tar.gz#/%{name}-%{version}.tar.gz -Source1: openCryptoki.pkcsslotd -Source2: openCryptoki-TFAQ.html -Source3: openCryptoki-rpmlintrc +Source1: openCryptoki-TFAQ.html +Source2: openCryptoki-rpmlintrc # Patch 0 is needed because group pkcs11 doesn't exist in the build environment # and because we don't want(?) various file and directory permissions to be 0700. -Patch000: ocki-3.27-remove-make-install-chgrp.patch +Patch000: ocki-3.28-remove-make-install-chgrp.patch # +BuildRequires: autoconf +BuildRequires: autoconf-archive +BuildRequires: automake BuildRequires: bison BuildRequires: dos2unix BuildRequires: fdupes BuildRequires: flex BuildRequires: gcc-c++ BuildRequires: libcap-devel -BuildRequires: libitm1 BuildRequires: libtool -BuildRequires: libudev-devel BuildRequires: openldap2-devel BuildRequires: openssl-devel >= 1.1.1 BuildRequires: pkgconfig @@ -78,14 +78,15 @@ %ifarch s390 s390x BuildRequires: libica-devel >= 3.3 BuildRequires: libica-tools +BuildRequires: libudev-devel %endif %description -Opencryptoki implements the PKCS#11 specification v2.20 for a set of -cryptographic hardware, such as IBM 4764 and 4765 crypto cards, and the -Trusted Platform Module (TPM) chip. Opencryptoki also brings a software -token implementation that can be used without any cryptographic -hardware. +Opencryptoki implements the PKCS#11 specification v3.0 (and partially +v3.1 and v3.2) for a set of cryptographic hardware, such as IBM 4767, +4768, 4769 and 4770 crypto cards, and the Trusted Platform Module (TPM) +chip. Opencryptoki also brings a software token implementation that can +be used without any cryptographic hardware. This package contains the Slot Daemon (pkcsslotd) and general utilities. %package devel @@ -93,24 +94,18 @@ Group: Development/Languages/C and C++ Requires: glibc-devel Requires: libopenssl-devel >= 1.1.1 -Requires: openldap2-devel -Requires: trousers-devel -%ifarch s390 s390x -Requires: libica-devel >= 3.3 -%endif +Requires: openCryptoki = %{version} %description devel -The PKCS#11 version 2.01 API implemented for the IBM cryptographic -cards. This package includes support for the IBM 4758 cryptographic -co-processor (with the PKCS#11 firmware loaded) and the IBM eServer -Cryptographic Accelerator (FC 4960 on pSeries). +Opencryptoki implements the PKCS#11 specification v3.0 (and partially +v3.1 and v3.2) for IBM cryptographic cards and accelerators. This package contains the development header files for building -opencryptoki and PKCS#11 based applications +opencryptoki and PKCS#11 based applications. %ifarch %{openCryptoki_32bit_arch} %package 32bit -Summary: An Implementation of PKCS#11 (Cryptoki) v2.11 for IBM Cryptographic Hardware +Summary: An Implementation of PKCS#11 (Cryptoki) v3.0 for IBM Cryptographic Hardware # this is needed to make sure the pkcs11 group exists before # installation: Group: Productivity/Security @@ -119,18 +114,16 @@ %description 32bit This is a re-packaged binary rpm. For the package source, please look -for the source of the package without the "32bit" ending +for the source of the package without the "32bit" ending. -The PKCS#11 version 2.11 API implemented for the IBM cryptographic -cards. This package includes support for the IBM 4758 cryptographic -coprocessor (with the PKCS#11 firmware loaded) and the IBM eServer -Cryptographic Accelerator (FC 4960 on pSeries). +The PKCS#11 version 3.0 API implemented for IBM cryptographic cards. +This package includes runtime libraries for 32-bit applications. %endif %ifarch %{openCryptoki_64bit_arch} %package 64bit -Summary: An Implementation of PKCS#11 (Cryptoki) v2.11 for IBM Cryptographic Hardware +Summary: An Implementation of PKCS#11 (Cryptoki) v3.0 for IBM Cryptographic Hardware # this is needed to make sure the pkcs11 group exists before # installation: Group: Productivity/Security @@ -141,10 +134,8 @@ This is a re-packaged binary rpm. For the package source, please look for the source of the package without the "64bit" ending -The PKCS#11 version 2.11 API implemented for the IBM cryptographic -cards. This package includes support for the IBM 4758 cryptographic -coprocessor (with the PKCS#11 firmware loaded) and the IBM eServer -Cryptographic Accelerator (FC 4960 on pSeries). +The PKCS#11 version 3.0 API implemented for IBM cryptographic cards. +This package includes runtime libraries for 64-bit applications. %endif @@ -152,16 +143,20 @@ # setup -q -n %%{oc_cvs_tag}-%%{version} %autosetup -p 1 -n %{oc_cvs_tag}-%{version} -cp %{SOURCE2} . +cp %{SOURCE1} . %build +dos2unix misc/opencryptoki.pc.in ./bootstrap.sh %configure --with-systemd=%{_unitdir} \ - --with-libudev=yes \ + --with-pkcsslotd-user=pkcsslotd \ + --with-pkcs-group=%{pkcs_group} \ + --enable-swtok \ + --enable-icsftok \ --enable-tpmtok \ -%ifarch aarch64 # Apparently, gcc for aarch64 doesn't support transactional memory - --enable-locks \ +%ifarch s390 s390x + --with-libudev=yes \ %endif %{ocki_conf_flags} @@ -188,15 +183,12 @@ # Install the sysusers configuration install -D -m 0644 opencryptoki-sysusers.conf %{buildroot}%{_sysusersdir}/opencryptoki.conf -# Move data templates from /var to /usr/share/opencryptoki for tmpfiles to use -install -d %{buildroot}%{_datadir}/opencryptoki/templates -install -d %{buildroot}%{_initddir} install -d %{buildroot}%{_sbindir} -install -d %{buildroot}%{_prefix}/lib/tmpfiles.d +install -d %{buildroot}%{_tmpfilesdir} # # Define the tmpfiles.d configuration # -cat > %{buildroot}%{_prefix}/lib/tmpfiles.d/opencryptoki.conf <<EOF +cat > %{buildroot}%{_tmpfilesdir}/opencryptoki.conf <<EOF # Type Path Mode UID GID Age Argument d /run/opencryptoki 0770 pkcsslotd pkcs11 - - d /var/lib/opencryptoki 0770 root pkcs11 - - @@ -212,7 +204,7 @@ EOF # %ifnarch i586 -cat >> %{buildroot}%{_prefix}/lib/tmpfiles.d/opencryptoki.conf <<EOF +cat >> %{buildroot}%{_tmpfilesdir}/opencryptoki.conf <<EOF d /var/lib/opencryptoki/ccatok 0770 root pkcs11 - - d /var/lib/opencryptoki/ccatok/TOK_OBJ 0770 root pkcs11 - - d /var/lock/opencryptoki/ccatok 0770 root pkcs11 - - @@ -220,7 +212,7 @@ %endif # %ifarch s390 s390x -cat >> %{buildroot}%{_prefix}/lib/tmpfiles.d/opencryptoki.conf <<EOF +cat >> %{buildroot}%{_tmpfilesdir}/opencryptoki.conf <<EOF d /var/lib/opencryptoki/ep11tok 0770 root pkcs11 - - d /var/lib/opencryptoki/ep11tok/TOK_OBJ 0770 root pkcs11 - - d /var/lib/opencryptoki/lite 0770 root pkcs11 - - @@ -230,7 +222,7 @@ EOF %endif # -cat >> %{buildroot}%{_prefix}/lib/tmpfiles.d/opencryptoki.conf <<EOF +cat >> %{buildroot}%{_tmpfilesdir}/opencryptoki.conf <<EOF d /var/log/opencryptoki 0770 root pkcs11 - - L+ /etc/pkcs11 - - - - /var/lib/opencryptoki EOF @@ -241,9 +233,11 @@ ReadWritePaths=/var/lib/opencryptoki/ /var/lock/opencryptoki/ EOF -# Remove manual directory creation in %%install that belongs in /var +# Remove manual directory creation in %%install that belongs in /var and /run rm -rf %{buildroot}%{_localstatedir}/lib/opencryptoki rm -rf %{buildroot}%{_localstatedir}/log/opencryptoki +rm -rf %{buildroot}%{_localstatedir}/lock +rm -rf %{buildroot}/run # mkdir -p %{buildroot}%{_datadir}/opencryptoki cp %{buildroot}%{_datadir}/doc/opencryptoki/*.conf %{buildroot}%{_datadir}/opencryptoki ++++++ ocki-3.27-remove-make-install-chgrp.patch -> ocki-3.28-remove-make-install-chgrp.patch ++++++ --- /work/SRC/openSUSE:Factory/openCryptoki/ocki-3.27-remove-make-install-chgrp.patch 2026-05-15 23:56:13.427811198 +0200 +++ /work/SRC/openSUSE:Factory/.openCryptoki.new.3759290/ocki-3.28-remove-make-install-chgrp.patch 2026-11-04 19:52:00.697839751 +0100 @@ -1,6 +1,5 @@ -diff -Naur a/Makefile.am b/Makefile.am --- a/Makefile.am 2026-05-13 13:19:05.000000000 +0200 -+++ b/Makefile.am 2026-05-15 09:38:26.931516571 +0200 ++++ b/Makefile.am 2026-11-04 15:17:27.312397400 +0100 @@ -51,19 +51,9 @@ include doc/doc.mk ++++++ openCryptoki-3.27.0.tar.gz -> openCryptoki-3.28.0.tar.gz ++++++ ++++ 63152 lines of diff (skipped)
