June 2024 - Arch-excludes - Fedora mailing-lists

[Report] Packages Restricting Arches
by root 11 Jun '24

11 Jun '24

List of packages currently excluding arches (2255) =========================================== - 0ad ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 ppc64le - 389-ds-base ExcludeArch: i686 - 4ti2 ExcludeArch: %{ix86} - 90-Second-Portraits ExclusiveArch: %{arm} %{ix86} x86_64 aarch64 ppc64le riscv64 - AcetoneISO ExcludeArch: ppc %{power64} s390x - Agda ExcludeArch: %{ix86} armv7hl - Agda-stdlib ExcludeArch: armv7hl %{ix86} - BareBonesBrowserLaunch ExclusiveArch: %{java_arches} noarch - CFR ExclusiveArch: %{java_arches} noarch - COPASI ExcludeArch: %{ix86} - CardManager ExclusiveArch: %{java_arches} noarch - CuraEngine ExcludeArch: %{ix86} - E ExcludeArch: %{ix86} - GAPDoc ExcludeArch: %{ix86} - GoldenCheetah ExclusiveArch: %{qt5_qtwebengine_arches} - GtkAda ExclusiveArch: %{GPRbuild_arches} - GtkAda3 ExclusiveArch: %{GPRbuild_arches} - HPCombi ExclusiveArch: x86_64 %{arm64} - IPAddress ExclusiveArch: %{java_arches} noarch - IQmol ExcludeArch: %{ix86} - JUnitParams ExclusiveArch: %{java_arches} noarch - L-function ExcludeArch: %{ix86} - LabPlot ExcludeArch: sparc64 s390 s390x - MUSIC ExcludeArch: %{ix86} - Macaulay2 ExcludeArch: %{ix86} ppc64le - Maelstrom ExcludeArch: %{ix86} - Mars ExclusiveArch: %{java_arches} noarch - NiaAML-GUI ExcludeArch: %{ix86} - OpenColorIO ExcludeArch: i686 ExclusiveArch: x86_64 ppc64le - OpenImageIO ExcludeArch: i686 ExclusiveArch: x86_64 ppc64le - OpenMolcas ExclusiveArch: x86_64 aarch64 ppc64le s390x - OpenStego ExclusiveArch: %{java_arches} noarch - Pencil2D ExcludeArch: %{ix86} - PragmARC ExclusiveArch: %{GPRbuild_arches} - ProDy ExcludeArch: ppc64 s390x - R-IRkernel ExcludeArch: %{ix86} - R-V8 ExclusiveArch: %{nodejs_arches} - R-ape ExcludeArch: %{ix86} - R-igraph ExcludeArch: %{ix86} - R-kernlab ExcludeArch: %{ix86} s390x - R-rJava ExclusiveArch: %{java_arches} - Random123 ExcludeArch: mips64r2 mips32r2 s390 - RdRand ExclusiveArch: %{ix86} x86_64 - RediSearch ExclusiveArch: x86_64 - SLOF ExclusiveArch: ppc64le - Singular ExcludeArch: %{ix86} - TOPCOM ExcludeArch: %{ix86} - VulkanMemoryAllocator ExcludeArch: %{ix86} - WoeUSB ExcludeArch: s390x - YafaRay ExclusiveArch: %{ix86} x86_64 - Zim ExcludeArch: %{ix86} - aardvark-dns ExclusiveArch: %{golang_arches_future} ExclusiveArch: aarch64 ppc64le s390x x86_64 - abiword ExcludeArch: %{ix86} - abrt-java-connector ExcludeArch: %{ix86} - accel-config ExclusiveArch: %{ix86} x86_64 - acpica-tools ExcludeArch: i686 armv7hl - acpid ExclusiveArch: ia64 x86_64 %{ix86} %{arm} aarch64 riscv64 - act ExcludeArch: %{ix86} - admeshgui ExcludeArch: %{ix86} - aemu ExcludeArch: %{ix86} %{power64} s390x - agenda ExcludeArch: %{ix86} - ahven ExclusiveArch: %{GPRbuild_arches} - algobox ExclusiveArch: %{qt5_qtwebengine_arches} - alienarena ExcludeArch: s390x - alizams ExcludeArch: %{power64} %{ix86} s390x - alt-ergo ExcludeArch: %{ix86} - american-fuzzy-lop ExclusiveArch: x86_64 - amg4psblas ExcludeArch: %{ix86} - android-tools ExcludeArch: ppc ppc64 s390x ppc64le - anet ExclusiveArch: %{GPRbuild_arches} - ansible-collection-microsoft-sql ExcludeArch: i686 - ant ExclusiveArch: %{java_arches} noarch - ant-antunit ExclusiveArch: %{java_arches} noarch - ant-contrib ExclusiveArch: %{java_arches} noarch - antlr ExclusiveArch: %{java_arches} - antlr3 ExclusiveArch: %{java_arches} - antlr4-project ExclusiveArch: %{java_arches} - antlrworks ExclusiveArch: %{java_arches} noarch - aopalliance ExclusiveArch: %{java_arches} noarch - apache-commons-beanutils ExclusiveArch: %{java_arches} noarch - apache-commons-cli ExclusiveArch: %{java_arches} noarch - apache-commons-codec ExclusiveArch: %{java_arches} noarch - apache-commons-collections ExclusiveArch: %{java_arches} noarch - apache-commons-collections4 ExclusiveArch: %{java_arches} noarch - apache-commons-compress ExclusiveArch: %{java_arches} noarch - apache-commons-configuration ExclusiveArch: %{java_arches} noarch - apache-commons-digester ExclusiveArch: %{java_arches} noarch - apache-commons-exec ExclusiveArch: %{java_arches} noarch - apache-commons-io ExclusiveArch: %{java_arches} noarch - apache-commons-jexl ExclusiveArch: %{java_arches} noarch - apache-commons-jxpath ExclusiveArch: %{java_arches} noarch - apache-commons-lang3 ExclusiveArch: %{java_arches} noarch - apache-commons-logging ExclusiveArch: %{java_arches} noarch - apache-commons-math ExclusiveArch: %{java_arches} noarch - apache-commons-modeler ExclusiveArch: %{java_arches} noarch - apache-commons-net ExclusiveArch: %{java_arches} noarch - apache-commons-parent ExclusiveArch: %{java_arches} noarch - apache-commons-pool ExclusiveArch: %{java_arches} noarch - apache-commons-vfs ExclusiveArch: %{java_arches} noarch - apache-ivy ExclusiveArch: %{java_arches} noarch - apache-logging-parent ExclusiveArch: %{java_arches} noarch - apache-parent ExclusiveArch: %{java_arches} noarch - apache-resource-bundles ExclusiveArch: %{java_arches} noarch - apache-sshd ExclusiveArch: %{java_arches} noarch - apiguardian ExclusiveArch: %{java_arches} noarch - apmd ExclusiveArch: %{ix86} - appeditor ExcludeArch: %{ix86} - appstream-generator ExclusiveArch: %{ldc_arches} - apricots ExcludeArch: ppc64le aarch64 - apron ExcludeArch: %{ix86} - aqute-bnd ExclusiveArch: %{java_arches} noarch - arbor ExcludeArch: mips64r2 mips32r2 s390x %{ix86} - arc-theme ExcludeArch: %{ix86} - args4j ExclusiveArch: %{java_arches} noarch - arianna ExclusiveArch: %{qt6_qtwebengine_arches} - arm-none-eabi-binutils-cs ExcludeArch: %{ix86} - arm-none-eabi-gcc-cs ExcludeArch: %{ix86} - arpwatch ExcludeArch: %{ix86} - asahi-installer ExcludeArch: s390x - asdcplib ExcludeArch: %{ix86} %{arm} - asmjit ExclusiveArch: aarch64 x86_64 - assertj-core ExclusiveArch: %{java_arches} noarch - astromenace ExcludeArch: ppc64 s390x - astrometry-tycho2 ExcludeArch: s390x - asv ExcludeArch: %{ix86} - atinject ExclusiveArch: %{java_arches} noarch - atlantik ExcludeArch: %{ix86} - atomic-queue ExcludeArch: %{ix86} - aubit4gl ExcludeArch: i686 s390x ppc64le - audacity ExcludeArch: %{ix86} s390x - audiocd-kio ExclusiveArch: x86_64 ppc64le aarch64 %{arm} - aunit ExclusiveArch: %{GPRbuild_arches} - auryn ExcludeArch: %{ix86} - auto ExclusiveArch: %{java_arches} noarch - autolink-java ExclusiveArch: noarch %{java_arches} - avgtime ExclusiveArch: %{ldc_arches} - avr-gcc ExcludeArch: %{ix86} - aws ExclusiveArch: %GPRbuild_arches - aws-c-cal ExcludeArch: s390x - aws-c-common ExcludeArch: s390x - aws-c-compression ExcludeArch: s390x - aws-c-io ExcludeArch: %{ix86} ExcludeArch: s390x - aws-c-sdkutils ExcludeArch: s390x - aws-checksums ExcludeArch: s390x - awscli2 ExcludeArch: s390x - azove ExcludeArch: %{ix86} - azure-cli ExclusiveArch: %{java_arches} noarch - batik ExclusiveArch: %{java_arches} noarch - bcal ExclusiveArch: x86_64 aarch64 ia64 ppc64 ppc64le s390x riscv64 - bcc ExclusiveArch: x86_64 %{power64} aarch64 s390x armv7hl riscv64 - bcel ExclusiveArch: %{java_arches} noarch - bcftools ExcludeArch: s390x - bcm283x-firmware ExclusiveArch: aarch64 - beansbinding ExclusiveArch: %{java_arches} noarch - bear ExcludeArch: %{ix86} - bear-factory ExcludeArch: ppc64le - berusky2 ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 %{mips} riscv64 - beust-jcommander ExclusiveArch: %{java_arches} noarch - bibletime ExclusiveArch: %{java_arches} - bigloo ExcludeArch: %{ix86} - binaryen ExcludeArch: ppc64 s390x - binutils ExcludeArch: aarch64-linux-gnu aarch64-redhat-linux ExcludeArch: ppc64le-linux-gnu ppc64le-redhat-linux ExcludeArch: s390x-linux-gnu s390x-redhat-linux ExcludeArch: x86_64-linux-gnu x86_64-redhat-linux i686-linux-gnu i686-redhat-linux - biosdevname ExclusiveArch: %{ix86} x86_64 - biosig4c++ ExcludeArch: %{ix86} - blake3 ExcludeArch: %{ix86} - blender ExcludeArch: %{ix86} %{arm} - bless ExclusiveArch: %mono_arches - bliss ExcludeArch: %{ix86} - blueprint-compiler ExcludeArch: s390x - bluez-hcidump ExcludeArch: s390 s390x - bochs ExcludeArch: s390x i686 - bodhi-server ExclusiveArch: %{golang_arches_future} - boinc-client ExcludeArch: s390x - bolzplatz2006 ExclusiveArch: %{java_arches} - bootc ExcludeArch: %{ix86} - bottles ExcludeArch: s390x - bouncycastle ExclusiveArch: %{java_arches} noarch - bout++ ExcludeArch: %{ix86} - bowtie ExcludeArch: i686 armv7hl - bowtie2 ExcludeArch: %{ix86} %{arm} s390x - box64 ExclusiveArch: aarch64 riscv64 ppc64le x86_64 - boxes ExcludeArch: %{ix86} - bpftrace ExclusiveArch: x86_64 %{power64} aarch64 s390x - brazil ExclusiveArch: %{java_arches} noarch - breakid ExcludeArch: %{ix86} - brewtarget ExcludeArch: %{ix86} - brial ExcludeArch: %{ix86} - bsf ExclusiveArch: %{java_arches} noarch - bsh ExclusiveArch: %{java_arches} noarch - build-helper-maven-plugin ExclusiveArch: %{java_arches} noarch - buildah ExclusiveArch: %{golang_arches_future} ExclusiveArch: aarch64 ppc64le s390x x86_64 - busybox ExcludeArch: i686 s390x - bwping ExcludeArch: %{ix86} - byebyebios ExclusiveArch: x86_64 - byte-buddy ExclusiveArch: %{java_arches} noarch - byteman ExclusiveArch: %{java_arches} noarch - cachelib ExclusiveArch: x86_64 aarch64 ppc64le - caddy ExclusiveArch: %{golang_arches} ExclusiveArch: %{golang_arches_future} - cadical ExcludeArch: %{ix86} - caffe ExclusiveArch: x86_64 aarch64 ppc64le - calamares ExclusiveArch: %{ix86} x86_64 aarch64 riscv64 - calceph ExcludeArch: %{ix86} - calibre ExclusiveArch: aarch64 x86_64 - calligra ExcludeArch: %{ix86} - cambozola ExclusiveArch: %{java_arches} noarch - canl-java ExclusiveArch: %{java_arches} noarch - cantera ExcludeArch: %{ix86} - carat ExcludeArch: %{ix86} - casc ExcludeArch: %{ix86} - cataclysm-dda ExcludeArch: i686 - catatonit ExclusiveArch: %{golang_arches_future} ExclusiveArch: aarch64 ppc64le s390x x86_64 - ccdciel ExclusiveArch: %{fpc_arches} ExcludeArch: %{ix86} - ccluster ExcludeArch: %{ix86} - cdcollect ExclusiveArch: %{mono_arches} - cdi-api ExclusiveArch: %{java_arches} noarch - cdrdao ExcludeArch: s390 s390x - ceph ExcludeArch: i686 armv7hl ExclusiveArch: x86_64 aarch64 ppc64le s390x - ceres-solver ExcludeArch: ppc64 - cfn-lint ExcludeArch: %{ix86} - cglib ExclusiveArch: %{java_arches} noarch - cgreen ExcludeArch: s390x - chatterino2 ExcludeArch: %{ix86} - chatty ExcludeArch: i686 - checkpointctl ExclusiveArch: %{golang_arches_future} - chromium ExclusiveArch: x86_64 ExclusiveArch: x86_64 aarch64 ppc64le ExclusiveArch: x86_64 aarch64 - cinnamon ExcludeArch: %{ix86} - cinnamon-control-center ExcludeArch: %{ix86} - cinnamon-desktop ExcludeArch: %{ix86} - cinnamon-menus ExcludeArch: %{ix86} - cinnamon-screensaver ExcludeArch: %{ix86} - cinnamon-session ExcludeArch: %{ix86} - cinnamon-settings-daemon ExcludeArch: %{ix86} - cjdns ExclusiveArch: %{nodejs_arches} - cjs ExcludeArch: %{ix86} - classloader-leak-test-framework ExclusiveArch: %{java_arches} noarch - classpathless-compiler ExclusiveArch: %{java_arches} noarch - cld2 ExcludeArch: ppc64 s390x - clibs-list ExcludeArch: %{ix86} - clojure ExclusiveArch: %{java_arches} noarch - clojure-core-specs-alpha ExclusiveArch: %{java_arches} noarch - clojure-maven-plugin ExclusiveArch: %{java_arches} noarch - clojure-spec-alpha ExclusiveArch: %{java_arches} noarch - cloudcompare ExcludeArch: %{ix86} - clover2 ExcludeArch: armv7hl - cmospwd ExclusiveArch: %{ix86} x86_64 - cmrt ExclusiveArch: %{ix86} x86_64 ia64 - coan ExcludeArch: ppc64 s390x - coccinelle ExcludeArch: %{ix86} - cocoalib ExcludeArch: %{ix86} - codeblocks ExcludeArch: %{ix86} - codehaus-parent ExclusiveArch: %{java_arches} noarch - cohomCalg ExcludeArch: %{ix86} - coin-or-Alps ExcludeArch: %{ix86} - coin-or-Bcp ExcludeArch: %{ix86} - coin-or-Bcps ExcludeArch: %{ix86} - coin-or-Blis ExcludeArch: %{ix86} - coin-or-Bonmin ExcludeArch: %{ix86} - coin-or-CoinMP ExcludeArch: %{ix86} - coin-or-Couenne ExcludeArch: %{ix86} - coin-or-Dip ExcludeArch: %{ix86} - coin-or-FlopC++ ExcludeArch: %{ix86} - coin-or-HiGHS ExcludeArch: %{ix86} - coin-or-Ipopt ExcludeArch: %{ix86} - coin-or-OS ExcludeArch: %{ix86} - coin-or-SYMPHONY ExcludeArch: %{ix86} - coin-or-lemon ExcludeArch: %{ix86} - colorful ExclusiveArch: %{fpc_arches} - colossus ExclusiveArch: %{java_arches} noarch - compiz-plugins-experimental ExcludeArch: s390 s390x - conmon ExclusiveArch: %{golang_arches_future} - console-image-viewer ExclusiveArch: %{java_arches} noarch - containernetworking-plugins ExclusiveArch: %{golang_arches} - containers-common ExclusiveArch: %{golang_arches} noarch - contour-terminal ExclusiveArch: x86_64 aarch64 - contractor ExcludeArch: %{ix86} - conu ExcludeArch: ppc64 - coolreader ExcludeArch: %{ix86} - coq ExclusiveArch: %{ocaml_native_compiler} - corectrl ExcludeArch: %{ix86} - cortado ExclusiveArch: %{java_arches} noarch - cosmic-comp ExcludeArch: %{ix86} - coxeter ExcludeArch: %{ix86} - cp2k ExcludeArch: s390x - cpp-hocon ExcludeArch: %{ix86} - cpu-x ExclusiveArch: i686 x86_64 - cpufetch ExclusiveArch: %{arm} aarch64 x86_64 ppc ppc64 ppc64le - cpuid ExclusiveArch: %{ix86} x86_64 - cpuinfo ExclusiveArch: x86_64 aarch64 - cqrlog ExclusiveArch: %{fpc_arches} - cramjam-cli ExcludeArch: %{ix86} - crash ExclusiveArch: %{ix86} ia64 x86_64 ppc ppc64 s390 s390x %{arm} aarch64 ppc64le - crash-gcore-command ExclusiveArch: aarch64 ppc64le x86_64 - crash-trace-command ExclusiveArch: aarch64 ppc64le s390x x86_64 - credentials-fetcher ExclusiveArch: x86_64 aarch64 s390x - crest ExcludeArch: s390x - cri-o ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 aarch64 %{arm}} - cri-tools ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 aarch64 %{arm}} - criu ExclusiveArch: x86_64 %{arm} ppc64le aarch64 s390x - crun ExclusiveArch: %{golang_arches_future} ExclusiveArch: aarch64 ppc64le riscv64 s390x x86_64 - cryfs ExcludeArch: i686 - cryptlib ExclusiveArch: x86_64 aarch64 ppc64le - crypto-policies ExclusiveArch: %{java_arches} noarch - cryptobone ExclusiveArch: x86_64 ppc64le aarch64 - cryptominisat ExcludeArch: %{ix86} - csdp ExcludeArch: %{ix86} - csslint ExclusiveArch: %{nodejs_arches} noarch - cura ExcludeArch: %{ix86} - cura-fdm-materials ExcludeArch: %{ix86} - cvc5 ExcludeArch: %{ix86} - cxsc ExcludeArch: %{ix86} - daggy ExcludeArch: s390x - dapl ExcludeArch: s390, armv7hl - daq ExclusiveArch: x86_64 aarch64 - darktable ExcludeArch: armv7hl i686 s390x - dbus-parsec ExcludeArch: ppc64le s390x - dbus-sharp ExclusiveArch: %mono_arches - dbus-sharp-glib ExclusiveArch: %mono_arches - ddccontrol ExcludeArch: s390 s390x - ddcutil ExcludeArch: s390 s390x - ddd ExcludeArch: %{ix86} - ddnet ExcludeArch: s390x - decentxml ExclusiveArch: %{java_arches} noarch - deepin-daemon ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 aarch64 %{arm}} - deepin-desktop-schemas ExclusiveArch: %{go_arches} - dhall ExcludeArch: %{ix86} - dhall-json ExcludeArch: %{ix86} - dialect ExcludeArch: s390x - diffoscope ExcludeArch: %{ix86} - dippi ExcludeArch: %{ix86} - directory-maven-plugin ExclusiveArch: %{java_arches} noarch - dirgra ExclusiveArch: %{java_arches} noarch - disruptor ExclusiveArch: %{java_arches} noarch - ditaa ExclusiveArch: %{java_arches} noarch - dl_poly ExcludeArch: i686 - dlib ExcludeArch: %{ix86} s390x - dlm ExclusiveArch: i686 x86_64 - dmidecode ExclusiveArch: %{ix86} x86_64 ia64 aarch64 - dmtcp ExclusiveArch: x86_64 - dnsdist ExcludeArch: %{ix86} #1994125 ExcludeArch: armv7hl #1994125 - docker-distribution ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 %{arm}} - dogtag-pki ExclusiveArch: %{java_arches} ExcludeArch: i686 - dolfin ExcludeArch: %{ix86} - dolphin-emu ExclusiveArch: x86_64 aarch64 - dom4j ExclusiveArch: %{java_arches} noarch - dosbox-staging ExcludeArch: %{ix86} - dotnet6.0 ExclusiveArch: aarch64 x86_64 s390x ExclusiveArch: x86_64 - dotnet8.0 ExclusiveArch: aarch64 ppc64le s390x x86_64 - doublecmd ExclusiveArch: %{ix86} x86_64 - dovecot ExcludeArch: %{ix86} - dpdk ExclusiveArch: x86_64 i686 aarch64 ppc64le - dragonbox ExcludeArch: %{ix86} - drat-trim ExcludeArch: %{ix86} - drat2er ExcludeArch: %{ix86} - dub ExclusiveArch: %{ldc_arches} - duperemove ExcludeArch: %{ix86} - dvdauthor ExcludeArch: %{ix86} - dvgrab ExcludeArch: s390 s390x - dxvk-native ExclusiveArch: %{ix86} x86_64 - dyninst ExclusiveArch: %{ix86} x86_64 ppc64le aarch64 - e-antic ExcludeArch: %{ix86} - e00compr ExcludeArch: %{ix86} - e3 ExclusiveArch: %{ix86} x86_64 - easymock ExclusiveArch: %{java_arches} noarch - eccodes ExcludeArch: i686 - ecj ExclusiveArch: %{java_arches} noarch - eclib ExcludeArch: %{ix86} - eclipse-swt ExclusiveArch: %{java_arches} - ecryptfs-utils ExcludeArch: %{ix86} - ed25519-java ExclusiveArch: %{java_arches} noarch - edac-utils ExcludeArch: %{ix86} - edflib ExcludeArch: s390x %{ix86} - edk2 ExclusiveArch: x86_64 aarch64 riscv64 - edwin-fonts ExcludeArch: %{ix86} - eegdev ExcludeArch: %{ix86} - eegview ExcludeArch: %{ix86} - efax ExcludeArch: s390 s390x - efibootmgr ExclusiveArch: %{efi} - efifs ExclusiveArch: %{efi} - efitools ExclusiveArch: %{efi} - efivar ExclusiveArch: %{efi} - electron-cash ExcludeArch: %{ix86} - electrum ExcludeArch: %{ix86} - elk ExclusiveArch: x86_64 %{ix86} ExclusiveArch: x86_64 aarch64 %{arm} %{power64} ExclusiveArch: x86_64 %{ix86} aarch64 %{arm} %{power64} - emacs-common-proofgeneral ExcludeArch: %{ix86} - emacs-company-mode ExcludeArch: %{ix86} - emacs-iedit ExcludeArch: %{ix86} - emacs-slime ExclusiveArch: %{arm} %{ix86} x86_64 ppc sparcv9 aarch64 - embree ExclusiveArch: aarch64 x86_64 - embree3 ExclusiveArch: aarch64 x86_64 - enjarify ExclusiveArch: %{java_arches} noarch - enki ExclusiveArch: %{qt5_qtwebengine_arches} noarch - envytools ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 riscv64 - eot-utils ExcludeArch: %{ix86} - ergo ExcludeArch: %{ix86} - eric ExclusiveArch: %{qt6_qtwebengine_arches} noarch - erlang-corba ExclusiveArch: %{java_arches} - esmi_ib_library ExclusiveArch: x86_64 - espresso ExcludeArch: s390x i686 armv7hl - eth-tools ExclusiveArch: x86_64 - exec-maven-plugin ExclusiveArch: %{java_arches} noarch - external-editor-revived ExclusiveArch: %{rust_arches} - extra-enforcer-rules ExclusiveArch: %{java_arches} noarch - f3d ExcludeArch: %{ix86} - fasterxml-oss-parent ExclusiveArch: %{java_arches} noarch - fb303 ExclusiveArch: x86_64 aarch64 ppc64le riscv64 - fbreader ExcludeArch: %{ix86} ExcludeArch: armv7hl - fbthrift ExclusiveArch: x86_64 aarch64 ppc64le riscv64 - fcitx-libpinyin ExclusiveArch: %{qt5_qtwebengine_arches} - fcitx5-mozc ExcludeArch: ppc ppc64 sparcv9 sparc64 s390x - fcoe-utils ExcludeArch: ppc s390 ExcludeArch: %{ix86} - felix-parent ExclusiveArch: %{java_arches} noarch - felix-utils ExclusiveArch: %{java_arches} noarch - fernflower ExclusiveArch: %{java_arches} noarch - fes ExclusiveArch: %{ix86} x86_64 - fido-device-onboard ExcludeArch: %{ix86} - filedrop ExclusiveArch: %{java_arches} noarch - filezilla ExcludeArch: s390x - firecracker ExclusiveArch: aarch64 x86_64 - firefox ExcludeArch: i686 - fishbowl ExclusiveArch: %{java_arches} noarch - fizz ExclusiveArch: x86_64 aarch64 ppc64le riscv64 - flang ExcludeArch: i686 s390x - flashrom ExcludeArch: s390 s390x - flatbuffers ExcludeArch: %{ix86} - flatpak ExcludeArch: %{ix86} - flatpak-builder ExcludeArch: %{ix86} - flatpak-module-tools ExcludeArch: i386 i686 - flexmark-java ExclusiveArch: noarch %{java_arches} - flickcurl ExcludeArch: %{ix86} - flint ExcludeArch: %{ix86} - flocq ExclusiveArch: %{ocaml_native_compiler} - floppy-support ExcludeArch: %{arm} aarch64 s390x - florist ExclusiveArch: %{GPRbuild_arches} - flterm ExcludeArch: s390 s390x sparcv9 - fluent-bit ExclusiveArch: x86_64 aarch64 - flute ExclusiveArch: %{java_arches} noarch - fmidi ExcludeArch: %{ix86} - folly ExclusiveArch: x86_64 aarch64 ppc64le riscv64 - fop ExclusiveArch: %{java_arches} noarch - forge-parent ExclusiveArch: %{java_arches} noarch - fotocx ExcludeArch: %{ix86} - foxi ExclusiveArch: x86_64 aarch64 - fpc ExclusiveArch: %{arm} aarch64 %{ix86} x86_64 ppc64le - fprintd ExcludeArch: s390 s390x - fractal ExcludeArch: %{ix86} - fragments ExcludeArch: %{ix86} - frama-c ExclusiveArch: %{ocaml_native_compiler} - free42 ExcludeArch: %{ix86} - freecol ExclusiveArch: %{java_arches} noarch - freedink ExcludeArch: s390x - freedink-dfarc ExcludeArch: s390x - freefem++ ExcludeArch: %{ix86} - freemarker ExclusiveArch: %{java_arches} noarch - freerouting ExclusiveArch: %{java_arches} noarch - freetennis ExcludeArch: sparc64 s390 s390x %{ix86} - frescobaldi ExclusiveArch: %{qt5_qtwebengine_arches} - frysk ExclusiveArch: x86_64 ppc64 - fuse-overlayfs ExclusiveArch: %{arm64} ppc64le s390x x86_64 riscv64 - fusesource-pom ExclusiveArch: %{java_arches} noarch - fwts ExclusiveArch: x86_64 %{arm} aarch64 s390x riscv64 %{power64} - fwupd-efi ExclusiveArch: x86_64 aarch64 - ga ExcludeArch: %{ix86} ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 ppc64le riscv64 - galera ExcludeArch: %{ix86} - gambas3 ExcludeArch: i686 - gap ExcludeArch: %{ix86} - gap-pkg-ace ExcludeArch: %{ix86} - gap-pkg-aclib ExcludeArch: %{ix86} - gap-pkg-alnuth ExcludeArch: %{ix86} - gap-pkg-anupq ExcludeArch: %{ix86} - gap-pkg-atlasrep ExcludeArch: %{ix86} - gap-pkg-autodoc ExcludeArch: %{ix86} - gap-pkg-automata ExcludeArch: %{ix86} - gap-pkg-autpgrp ExcludeArch: %{ix86} - gap-pkg-browse ExcludeArch: %{ix86} - gap-pkg-caratinterface ExcludeArch: %{ix86} - gap-pkg-circle ExcludeArch: %{ix86} - gap-pkg-cohomolo ExcludeArch: %{ix86} - gap-pkg-congruence ExcludeArch: %{ix86} - gap-pkg-corelg ExcludeArch: %{ix86} - gap-pkg-crime ExcludeArch: %{ix86} - gap-pkg-crisp ExcludeArch: %{ix86} - gap-pkg-crypting ExcludeArch: %{ix86} - gap-pkg-cryst ExcludeArch: %{ix86} - gap-pkg-crystcat ExcludeArch: %{ix86} - gap-pkg-ctbllib ExcludeArch: %{ix86} - gap-pkg-curlinterface ExcludeArch: %{ix86} - gap-pkg-cvec ExcludeArch: %{ix86} - gap-pkg-datastructures ExcludeArch: %{ix86} - gap-pkg-design ExcludeArch: %{ix86} - gap-pkg-digraphs ExcludeArch: %{ix86} - gap-pkg-edim ExcludeArch: %{ix86} - gap-pkg-factint ExcludeArch: %{ix86} - gap-pkg-ferret ExcludeArch: %{ix86} - gap-pkg-fga ExcludeArch: %{ix86} - gap-pkg-fining ExcludeArch: %{ix86} - gap-pkg-float ExcludeArch: %{ix86} - gap-pkg-format ExcludeArch: %{ix86} - gap-pkg-forms ExcludeArch: %{ix86} - gap-pkg-fplsa ExcludeArch: %{ix86} - gap-pkg-fr ExcludeArch: %{ix86} - gap-pkg-francy ExcludeArch: %{ix86} - gap-pkg-gbnp ExcludeArch: %{ix86} - gap-pkg-genss ExcludeArch: %{ix86} - gap-pkg-grape ExcludeArch: %{ix86} - gap-pkg-groupoids ExcludeArch: %{ix86} - gap-pkg-grpconst ExcludeArch: %{ix86} - gap-pkg-guava ExcludeArch: %{ix86} - gap-pkg-hap ExcludeArch: %{ix86} - gap-pkg-hapcryst ExcludeArch: %{ix86} - gap-pkg-hecke ExcludeArch: %{ix86} - gap-pkg-images ExcludeArch: %{ix86} - gap-pkg-io ExcludeArch: %{ix86} - gap-pkg-irredsol ExcludeArch: %{ix86} - gap-pkg-json ExcludeArch: %{ix86} - gap-pkg-jupyterkernel ExcludeArch: %{ix86} - gap-pkg-jupyterviz ExcludeArch: %{ix86} - gap-pkg-laguna ExcludeArch: %{ix86} - gap-pkg-liealgdb ExcludeArch: %{ix86} - gap-pkg-liepring ExcludeArch: %{ix86} - gap-pkg-liering ExcludeArch: %{ix86} - gap-pkg-loops ExcludeArch: %{ix86} - gap-pkg-lpres ExcludeArch: %{ix86} - gap-pkg-mapclass ExcludeArch: %{ix86} - gap-pkg-nautytracesinterface ExcludeArch: %{ix86} - gap-pkg-nq ExcludeArch: %{ix86} - gap-pkg-openmath ExcludeArch: %{ix86} - gap-pkg-orb ExcludeArch: %{ix86} - gap-pkg-permut ExcludeArch: %{ix86} - gap-pkg-polenta ExcludeArch: %{ix86} - gap-pkg-polycyclic ExcludeArch: %{ix86} - gap-pkg-polymaking ExcludeArch: %{ix86} - gap-pkg-primgrp ExcludeArch: %{ix86} - gap-pkg-profiling ExcludeArch: %{ix86} - gap-pkg-qpa ExcludeArch: %{ix86} - gap-pkg-quagroup ExcludeArch: %{ix86} - gap-pkg-radiroot ExcludeArch: %{ix86} - gap-pkg-recog ExcludeArch: %{ix86} - gap-pkg-repsn ExcludeArch: %{ix86} - gap-pkg-resclasses ExcludeArch: %{ix86} - gap-pkg-scscp ExcludeArch: %{ix86} - gap-pkg-semigroups ExcludeArch: %{ix86} - gap-pkg-singular ExcludeArch: %{ix86} - gap-pkg-sla ExcludeArch: %{ix86} - gap-pkg-smallgrp ExcludeArch: %{ix86} - gap-pkg-smallsemi ExcludeArch: %{ix86} - gap-pkg-sonata ExcludeArch: %{ix86} - gap-pkg-sophus ExcludeArch: %{ix86} - gap-pkg-spinsym ExcludeArch: %{ix86} - gap-pkg-standardff ExcludeArch: %{ix86} - gap-pkg-tomlib ExcludeArch: %{ix86} - gap-pkg-toric ExcludeArch: %{ix86} - gap-pkg-transgrp ExcludeArch: %{ix86} - gap-pkg-utils ExcludeArch: %{ix86} - gap-pkg-uuid ExcludeArch: %{ix86} - gap-pkg-xmod ExcludeArch: %{ix86} - gap-pkg-zeromqinterface ExcludeArch: %{ix86} - gappa ExcludeArch: %{ix86} - gappalib-coq ExclusiveArch: %{ocaml_native_compiler} - gauche ExcludeArch: armv7hl - gbrainy ExclusiveArch: %mono_arches - gdb-exploitable ExclusiveArch: x86_64 i386 ExclusiveArch: x86_64 noarch - gdl ExcludeArch: %{ix86} - gearhead1 ExclusiveArch: %{fpc_arches} - gearhead2 ExclusiveArch: %{fpc_arches} - gearmand ExcludeArch: ppc - geeqie ExcludeArch: %{ix86} - gfan ExcludeArch: %{ix86} - gfs2-utils ExcludeArch: %{ix86} - gfxstream ExcludeArch: %{ix86} %{power64} s390x - ghc ExcludeArch: armv7hl - ghc-cborg ExcludeArch: %{ix86} - ghc-cborg-json ExcludeArch: %{ix86} - ghc-gi-gtk ExcludeArch: armv7hl - ghc-serialise ExcludeArch: %{ix86} - ghc9.10 ExcludeArch: armv7hl - ghc9.2 ExcludeArch: armv7hl - ghc9.4 ExcludeArch: armv7hl - ghc9.6 ExcludeArch: armv7hl - ghc9.8 ExcludeArch: armv7hl - ghdl ExclusiveArch: %{GNAT_arches} ExcludeArch: armv7hl %{ix86} - ghostwriter ExclusiveArch: %{qt5_qtwebengine_arches} - gimp-fourier-plugin ExcludeArch: %{ix86} - gio-sharp ExclusiveArch: %mono_arches - gir-to-d ExclusiveArch: %{ldc_arches} - git-lfs ExcludeArch: %{ix86} - git-octopus ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 aarch64 %{arm}} - gitqlient ExclusiveArch: %{qt5_qtwebengine_arches} - giver ExclusiveArch: %{mono_arches} - gkeyfile-sharp ExclusiveArch: %mono_arches - gkrellm-wifi ExcludeArch: s390 s390x - glava ExcludeArch: %{ix86} - glibd ExclusiveArch: %{ldc_arches} - gloo ExcludeArch: i686 - glycin-loaders ExcludeArch: %{ix86} - gmsh ExcludeArch: %{ix86} - gmult ExcludeArch: %{ix86} - gn ExcludeArch: %{ix86} - gnatcoll ExclusiveArch: %{GPRbuild_arches} - gnatcoll-bindings ExclusiveArch: %{GPRbuild_arches} - gnatcoll-db ExclusiveArch: %{GPRbuild_arches} - gnofract4d ExcludeArch: %{ix86} - gnome-applets ExcludeArch: %{ix86} - gnome-bluetooth ExcludeArch: s390 s390x - gnome-bluetooth3.34 ExcludeArch: s390 s390x - gnome-boxes ExclusiveArch: x86_64 - gnome-chemistry-utils ExcludeArch: %{ix86} - gnome-desktop-sharp ExclusiveArch: %mono_arches - gnome-do ExclusiveArch: %mono_arches ExcludeArch: armv7hl - gnome-flashback ExcludeArch: %{ix86} - gnome-hexgl ExcludeArch: i686 - gnome-initial-setup ExcludeArch: %{ix86} - gnome-keyring-sharp ExclusiveArch: %mono_arches - gnome-monitor-config ExcludeArch: %{ix86} - gnome-panel ExcludeArch: %{ix86} - gnome-rdp ExclusiveArch: %{mono_arches} ExcludeArch: %{ix86} - gnome-session ExcludeArch: %{ix86} - gnome-sharp ExclusiveArch: %mono_arches - gnome-shell ExcludeArch: %{ix86} - gnome-software ExcludeArch: %{ix86} - gnome-subtitles ExclusiveArch: %mono_arches - gnome-terminal ExcludeArch: %{ix86} - gnu-efi ExclusiveArch: %{efi} - gnucash ExcludeArch: %{ix86} ExcludeArch: ppc64 s390x - gnumeric ExcludeArch: %{ix86} - go-bindata ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 %{arm}} - godep ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 %{arm}} - godot ExcludeArch: s390x - godot3 ExcludeArch: ppc64 ppc64le s390x - goffice ExcludeArch: %{ix86} - golang ExclusiveArch: %{golang_arches} - golang-entgo-ent ExcludeArch: %{arm32} %{ix86} - golang-github-ebitengine-purego ExcludeArch: ppc64le s390x - golang-github-elliotchance-orderedmap ExcludeArch: aarch64 ExcludeArch: ppc64le ExcludeArch: s390x - golang-github-facebookincubator-nvdtools ExcludeArch: i686 armv7hl - golang-github-google-goterm ExcludeArch: ppc64le s390x - golang-helm-3 ExcludeArch: armv7hl aarch64 - golang-tinygo-x-llvm ExcludeArch: %{ix86} - goldendict-ng ExclusiveArch: aarch64 x86_64 - google-compute-engine-guest-configs ExcludeArch: %{ix86} - google-cpu_features ExcludeArch: s390x - google-gson ExclusiveArch: %{java_arches} noarch - google-guest-agent ExcludeArch: ppc64le s390x - google-guice ExclusiveArch: %{java_arches} noarch - google-osconfig-agent ExcludeArch: ppc64le s390x - gotcha ExcludeArch: %{ix86} - gotun ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 %{arm}} ExclusiveArch: x86_64 - gource ExcludeArch: ppc64le - goverlay ExclusiveArch: %{fpc_arches} - gpaste ExcludeArch: %{ix86} - gpaw ExcludeArch: ppc64 ExcludeArch: %{ix86} - gperftools ExcludeArch: s390 - gprbuild ExclusiveArch: %{GPRbuild_arches} - gprolog ExclusiveArch: x86_64 %{ix86} ppc alpha aarch64 - gr-air-modes ExcludeArch: %{ix86} - grafana ExclusiveArch: %{grafana_arches} - grafana-pcp ExclusiveArch: %{grafanapcp_arches} - greenboot ExcludeArch: s390x - gretl ExcludeArch: %{ix86} - gromacs ExcludeArch: i686 armv7hl s390x - grub-customizer ExcludeArch: s390 s390x %{arm} - grub2 ExcludeArch: s390 s390x %{ix86} - grub2-breeze-theme ExcludeArch: s390 s390x %{arm} - grubby ExcludeArch: %{ix86} - gsequencer ExcludeArch: i686 - gthree ExcludeArch: i686 - gthumb ExcludeArch: s390x - gtk-sharp-beans ExclusiveArch: %mono_arches - gtk-sharp2 ExclusiveArch: %mono_arches - gtk-sharp3 ExclusiveArch: %{mono_arches} - gtkd ExclusiveArch: %{ldc_arches} - gtkhash ExcludeArch: %{ix86} - gtkwave ExcludeArch: s390x - guava ExclusiveArch: %{java_arches} noarch - gudev-sharp ExclusiveArch: %mono_arches - guestfs-tools ExclusiveArch: %{kernel_arches} ExcludeArch: %{power64} - gvisor-tap-vsock ExclusiveArch: %{golang_arches_future} ExclusiveArch: aarch64 ppc64le s390x x86_64 - hamcrest ExclusiveArch: %{java_arches} noarch - harec ExclusiveArch: x86_64 aarch64 riscv64 - harmonyseq ExcludeArch: %{ix86} - harvey ExcludeArch: %{ix86} - hashcat ExcludeArch: ppc64 s390x - hawtjni ExclusiveArch: %{java_arches} noarch - haxe ExcludeArch: %{ix86} - hcloud ExcludeArch: %{ix86} - heaptrack ExcludeArch: s390 s390x - hedgewars ExclusiveArch: %{fpc_arches} ExcludeArch: ppc64le - helix ExcludeArch: %{ix86} - hevea ExcludeArch: %{ix86} - hibernate-jpa-2.0-api ExclusiveArch: %{java_arches} noarch - hid4java ExclusiveArch: %{java_arches} noarch - highfive ExcludeArch: %{ix86} - hipblas ExclusiveArch: x86_64 - hipcub ExclusiveArch: x86_64 - hipfft ExclusiveArch: x86_64 - hipify ExclusiveArch: x86_64 - hiprand ExclusiveArch: x86_64 - hipsolver ExclusiveArch: x86_64 - hipsparse ExclusiveArch: x86_64 - hmmer ExcludeArch: aarch64 ppc64le s390x - honggfuzz ExcludeArch: %{arm} %{power64} s390 s390x - howl ExcludeArch: ppc64le s390x ExcludeArch: %{ix86} - hpx ExcludeArch: i686 - hsakmt ExclusiveArch: x86_64 aarch64 ppc64le - httpcomponents-client ExclusiveArch: %{java_arches} noarch - httpcomponents-core ExclusiveArch: %{java_arches} noarch - httpcomponents-project ExclusiveArch: %{java_arches} noarch - hydrapaper ExcludeArch: s390x - hyperhdr ExcludeArch: %{ix86} - hyperrogue ExcludeArch: armv7hl - hyperscan ExclusiveArch: x86_64 - hyperv-daemons ExclusiveArch: i686 x86_64 aarch64 - hyprcursor ExcludeArch: %{ix86} - hypridle ExcludeArch: %{ix86} - hyprland ExcludeArch: %{ix86} - hyprlang ExcludeArch: %{ix86} - hyprlock ExcludeArch: %{ix86} - hyprpaper ExcludeArch: %{ix86} - hyprutils ExcludeArch: %{ix86} - hyprwayland-scanner ExcludeArch: %{ix86} - i2c-tools ExcludeArch: s390 s390x - ibsim ExcludeArch: s390 %{arm} - ibus-typing-booster ExcludeArch: ppc64 s390x - icecat ExcludeArch: %{ix86} %{arm} - icedtea-web ExclusiveArch: %{java_arches} - icu4j ExclusiveArch: %{java_arches} noarch - ignition ExcludeArch: %{ix86} - iir1 ExcludeArch: %{ix86} - ike-scan ExcludeArch: %{ix86} - ilua ExcludeArch: %{ix86} - imagej ExclusiveArch: %{java_arches} noarch - imhex ExclusiveArch: x86_64 %{arm64} - iml ExcludeArch: %{ix86} - imvirt ExclusiveArch: %{ix86} x86_64 ia64 - indi-3rdparty-drivers ExcludeArch: %{ix86} - indi-3rdparty-libraries ExcludeArch: %{ix86} - indistarter ExclusiveArch: %{fpc_arches} - infinipath-psm ExclusiveArch: x86_64 - intel-cm-compiler ExclusiveArch: i686 x86_64 - intel-cmt-cat ExclusiveArch: x86_64 - intel-compute-runtime ExclusiveArch: x86_64 - intel-gmmlib ExcludeArch: s390x ppc64le - intel-igc ExclusiveArch: x86_64 - intel-ipp-crypto-mb ExclusiveArch: x86_64 - intel-ipsec-mb ExclusiveArch: x86_64 - intel-lpmd ExclusiveArch: x86_64 - intel-media-driver-free ExclusiveArch: i686 x86_64 - intel-mediasdk ExclusiveArch: x86_64 - intel-metee ExclusiveArch: x86_64 - intel-undervolt ExclusiveArch: i386 x86_64 - intel-vpl-gpu-rt ExclusiveArch: x86_64 - ioport ExclusiveArch: %{ix86} x86_64 - ipe ExcludeArch: %{ix86} - ipmctl ExclusiveArch: x86_64 - irda-utils ExcludeArch: s390 s390x - irqbalance ExcludeArch: s390 s390x - isa-l ExcludeArch: %{ix86} - ispc ExclusiveArch: x86_64 aarch64 - iucode-tool ExclusiveArch: %{ix86} x86_64 - iyfct ExclusiveArch: %{arm} %{ix86} x86_64 aarch64 ppc64le - jFormatString ExclusiveArch: %{java_arches} noarch - jack-mixer ExcludeArch: armv7hl ExcludeArch: i686 - jackson-annotations ExclusiveArch: %{java_arches} noarch - jackson-bom ExclusiveArch: %{java_arches} noarch - jackson-core ExclusiveArch: %{java_arches} noarch - jackson-databind ExclusiveArch: %{java_arches} noarch - jackson-jaxrs-providers ExclusiveArch: %{java_arches} noarch - jackson-modules-base ExclusiveArch: %{java_arches} noarch - jackson-parent ExclusiveArch: %{java_arches} noarch - jacoco ExclusiveArch: %{java_arches} noarch - jacop ExclusiveArch: %{java_arches} noarch - jakarta-activation ExclusiveArch: %{java_arches} noarch - jakarta-activation1 ExclusiveArch: %{java_arches} noarch - jakarta-annotations ExclusiveArch: %{java_arches} noarch - jakarta-el ExclusiveArch: %{java_arches} noarch - jakarta-interceptors ExclusiveArch: %{java_arches} noarch - jakarta-json ExclusiveArch: %{java_arches} noarch - jakarta-mail ExclusiveArch: %{java_arches} noarch - jakarta-mail1 ExclusiveArch: %{java_arches} noarch - jakarta-oro ExclusiveArch: %{java_arches} noarch - jakarta-saaj ExclusiveArch: %{java_arches} noarch - jakarta-server-pages ExclusiveArch: %{java_arches} noarch - jakarta-servlet ExclusiveArch: %{java_arches} noarch - jakarta-xml-ws ExclusiveArch: %{java_arches} noarch - janino ExclusiveArch: %{java_arches} noarch - jansi ExclusiveArch: %{java_arches} - jansi-native ExclusiveArch: %{java_arches} - jansi1 ExclusiveArch: %{java_arches} noarch - java-1.8.0-openjdk ExclusiveArch: %{java_arches} ExcludeArch: %{ix86} - java-1.8.0-openjdk-portable ExclusiveArch: %{java_arches} ExcludeArch: %{ix86} - java-11-openjdk ExclusiveArch: %{java_arches} ExcludeArch: %{ix86} - java-11-openjdk-portable ExclusiveArch: %{java_arches} ExcludeArch: %{ix86} - java-17-openjdk ExclusiveArch: %{java_arches} ExcludeArch: %{ix86} - java-17-openjdk-portable ExclusiveArch: %{java_arches} ExcludeArch: %{ix86} - java-21-openjdk ExclusiveArch: %{java_arches} ExcludeArch: %{ix86} - java-21-openjdk-portable ExclusiveArch: %{java_arches} ExcludeArch: %{ix86} - java-diff-utils ExclusiveArch: %{java_arches} noarch - java-dirq ExclusiveArch: %{java_arches} noarch - java-jd-decompiler ExclusiveArch: %{java_arches} noarch - java-latest-openjdk ExclusiveArch: %{java_arches} ExcludeArch: %{ix86} - java-latest-openjdk-portable ExclusiveArch: %{java_arches} ExcludeArch: %{ix86} - java-runtime-decompiler ExclusiveArch: %{java_arches} noarch - java-scrypt ExclusiveArch: %{java_arches} noarch - java_cup ExclusiveArch: %{java_arches} noarch - javacc ExclusiveArch: %{java_arches} noarch - javacc-maven-plugin ExclusiveArch: %{java_arches} noarch - javaewah ExclusiveArch: %{java_arches} noarch - javapackages-bootstrap ExclusiveArch: %{java_arches} - javaparser ExclusiveArch: %{java_arches} noarch - javapoet ExclusiveArch: %{java_arches} noarch - javassist ExclusiveArch: %{java_arches} noarch - jaxb ExclusiveArch: %{java_arches} noarch - jaxb-api ExclusiveArch: %{java_arches} noarch - jaxb-api2 ExclusiveArch: %{java_arches} noarch - jaxb-dtd-parser ExclusiveArch: %{java_arches} noarch - jaxb-fi ExclusiveArch: %{java_arches} noarch - jaxb-istack-commons ExclusiveArch: %{java_arches} noarch - jaxb-stax-ex ExclusiveArch: %{java_arches} noarch - jaxen ExclusiveArch: %{java_arches} noarch - jblas ExcludeArch: %{ix86} - jboss-jaxrs-2.0-api ExclusiveArch: %{java_arches} noarch - jboss-logging ExclusiveArch: %{java_arches} noarch - jboss-logging-tools ExclusiveArch: %{java_arches} noarch - jboss-parent ExclusiveArch: %{java_arches} noarch - jchardet ExclusiveArch: %{java_arches} noarch - jcip-annotations ExclusiveArch: %{java_arches} noarch - jctools ExclusiveArch: %{java_arches} noarch - jcuber ExclusiveArch: %{java_arches} noarch - jdeparser ExclusiveArch: %{java_arches} noarch - jdepend ExclusiveArch: %{java_arches} noarch - jdependency ExclusiveArch: %{java_arches} noarch - jdom ExclusiveArch: %{java_arches} noarch - jdom2 ExclusiveArch: %{java_arches} noarch - jedit ExclusiveArch: %{java_arches} noarch - jericho-html ExclusiveArch: %{java_arches} noarch - jetbrains-annotations ExclusiveArch: noarch %{java_arches} - jetty ExclusiveArch: %{java_arches} noarch - jflex ExclusiveArch: %{java_arches} noarch - jfreechart ExclusiveArch: %{java_arches} noarch - jgit ExclusiveArch: %{java_arches} noarch - jglobus ExclusiveArch: %{java_arches} noarch - jgoodies-common ExclusiveArch: %{java_arches} noarch - jgoodies-forms ExclusiveArch: %{java_arches} noarch - jgoodies-looks ExclusiveArch: %{java_arches} noarch - jigawatts ExclusiveArch: x86_64 %{arm} ppc64le aarch64 s390x - jline ExclusiveArch: %{java_arches} - jline2 ExclusiveArch: %{java_arches} noarch - jmock ExclusiveArch: %{java_arches} noarch - jmol ExclusiveArch: %{java_arches} noarch - jna ExclusiveArch: %{java_arches} - jneuroml-core ExclusiveArch: %{java_arches} noarch - jni-inchi ExclusiveArch: %{java_arches} - jo ExcludeArch: %{ix86} - jol ExclusiveArch: %{java_arches} noarch - jolokia-jvm-agent ExclusiveArch: %{java_arches} noarch - jopt-simple ExclusiveArch: %{java_arches} noarch - jorbis ExclusiveArch: %{java_arches} noarch - jowl ExclusiveArch: %{nodejs_arches} noarch - jpanoramamaker ExclusiveArch: %{java_arches} noarch - jpilot ExcludeArch: s390, s390x - jpilot-backup ExcludeArch: s390 s390x - jsch ExclusiveArch: %{java_arches} noarch - jsch-agent-proxy ExclusiveArch: %{java_arches} noarch - json_simple ExclusiveArch: %{java_arches} noarch - jsoup ExclusiveArch: %{java_arches} noarch - jsr-305 ExclusiveArch: %{java_arches} noarch - jss ExclusiveArch: %{java_arches} ExcludeArch: i686 - jssc ExclusiveArch: %{java_arches} - jtidy ExclusiveArch: %{java_arches} noarch - julia ExclusiveArch: x86_64 - junit ExclusiveArch: %{java_arches} noarch - junit5 ExclusiveArch: %{java_arches} noarch - juniversalchardet ExclusiveArch: %{java_arches} noarch - jzlib ExclusiveArch: %{java_arches} noarch - kaffeine ExcludeArch: %{ix86} - kaidan ExclusiveArch: %{qt5_qtwebengine_arches} ExcludeArch: %{ix86} - kata-containers ExcludeArch: %{arm} %{ix86} s390 s390x ExcludeArch: ppc64le - kawa ExcludeArch: i686 - kchmviewer ExclusiveArch: %{qt5_qtwebengine_arches} - kcm_wacomtablet ExcludeArch: s390 s390x - kcov ExcludeArch: s390 s390x - kdenlive ExcludeArch: %{ix86} - keepass ExclusiveArch: %{mono_arches} ExcludeArch: armv7hl - keepassxc ExcludeArch: s390x - kernel ExclusiveArch: noarch x86_64 s390x aarch64 ppc64le ExclusiveArch: noarch i386 i686 x86_64 s390x aarch64 ppc64le - kernelshark ExcludeArch: %{ix86} %{arm} - keydb ExcludeArch: %{ix86} - keylime-agent-rust ExclusiveArch: %{rust_arches} - kf5-akonadi-search ExclusiveArch: x86_64 ppc64le aarch64 %{arm} - kf5-kblog ExclusiveArch: x86_64 ppc64le aarch64 %{arm} - kf5-kcalendarcore ExclusiveArch: x86_64 ppc64le aarch64 %{arm} - kf5-kcalendarutils ExclusiveArch: x86_64 ppc64le aarch64 %{arm} - kf5-kitinerary ExclusiveArch: x86_64 ppc64le aarch64 %{arm} - kf5-ktnef ExclusiveArch: x86_64 ppc64le aarch64 %{arm} - kf5-libkdcraw ExclusiveArch: x86_64 ppc64le %{arm} - khelpcenter ExclusiveArch: %{qt6_qtwebengine_arches} - kicad ExclusiveArch: x86_64 aarch64 ppc64le - kissat ExcludeArch: %{ix86} - kitty ExcludeArch: %{ix86} - kiwix-desktop ExclusiveArch: %{qt5_qtwebengine_arches} - knot-resolver ExclusiveArch: %{ix86} x86_64 ExclusiveArch: %{arm} aarch64 %{ix86} x86_64 - kokkos ExcludeArch: i686 armv7hl - kpilot ExcludeArch: s390 s390x - krita ExcludeArch: %{ix86} - ksensors ExcludeArch: s390 s390x - kubernetes ExclusiveArch: x86_64 aarch64 ppc64le s390x %{arm} - ladspa-autotalent-plugins ExcludeArch: %{ix86} - laf-plugin ExclusiveArch: %{java_arches} noarch - latte-integrale ExcludeArch: %{ix86} - lazarus ExclusiveArch: %{fpc_arches} - lazpaint ExclusiveArch: %{fpc_arches} - lcd4linux ExcludeArch: s390 s390x - ldapjdk ExclusiveArch: %{java_arches} noarch - ldc ExclusiveArch: %{ldc_arches} ppc64le - ledmon ExcludeArch: %{ix86} - leland-fonts ExcludeArch: %{ix86} - lfortran ExclusiveArch: x86_64 - lfsc ExcludeArch: %{ix86} - lib3mf ExcludeArch: %{ix86} - libCombine ExcludeArch: %{ix86} - libaiff ExcludeArch: %{ix86} - libarcus ExcludeArch: %{ix86} - libarrow ExcludeArch: %{ix86} %{arm} - libavc1394 ExcludeArch: s390 s390x - libbase ExclusiveArch: %{java_arches} noarch - libcamera ExcludeArch: s390x ppc64le - libcamera-apps ExcludeArch: %{power64} s390x - libcint ExcludeArch: %{power64} ExcludeArch: x86_64 - libcircle ExcludeArch: %{ix86} - libcpuid ExcludeArch: aarch64 %arm ppc64le ppc64 s390x - libcrystalhd ExcludeArch: s390 s390x - libcxx ExcludeArch: ppc64 ppc64le - libdc1394 ExcludeArch: s390 s390x - libdfp ExclusiveArch: ppc ppc64 ppc64le s390 s390x x86_64 - libdigidocpp ExcludeArch: %{ix86} - libdispatch ExclusiveArch: x86_64 aarch64 ppc64le - libffado ExcludeArch: s390 s390x - libfilezilla ExcludeArch: s390x - libfonts ExclusiveArch: %{java_arches} noarch - libformula ExclusiveArch: %{java_arches} noarch - libfprint ExcludeArch: s390 s390x - libguestfs ExcludeArch: %{ix86} ExclusiveArch: %{kernel_arches} ExcludeArch: %{power64} - libhomfly ExcludeArch: %{ix86} - libibcommon ExcludeArch: s390 s390x - libica ExclusiveArch: s390 s390x - libiec61883 ExcludeArch: s390 s390x - libinsane ExcludeArch: %{ix86} - libipt ExclusiveArch: %{ix86} x86_64 ExclusiveArch: %{ix86} x86_64 - libkrun ExclusiveArch: x86_64 aarch64 - libkrunfw ExclusiveArch: x86_64 aarch64 - liblayout ExclusiveArch: %{java_arches} noarch - libldac ExcludeArch: s390x - libloader ExclusiveArch: %{java_arches} noarch - libnuml ExcludeArch: %{ix86} - libnxz ExclusiveArch: ppc64le - libobjc2 ExcludeArch: armv7hl i686 ppc64le s390x - libocxl ExclusiveArch: ppc64le - libomp17 ExcludeArch: s390x - libopenshot ExcludeArch: ppc64le - libopenshot-audio ExcludeArch: ppc64le - liborc ExcludeArch: i686 armv7hl - libpoly ExcludeArch: %{ix86} - libpsm2 ExclusiveArch: x86_64 - libquentier ExclusiveArch: %{qt5_qtwebengine_arches} - libraw1394 ExcludeArch: s390 s390x - libreoffice ExcludeArch: %{ix86} - libreoffice-TexMaths ExclusiveArch: %{java_arches} ExcludeArch: aarch64 s390x - librepository ExclusiveArch: %{java_arches} noarch - libretro-desmume2015 ExclusiveArch: i686 x86_64 - libretro-pcsx-rearmed ExcludeArch: armv7hl - librtas ExclusiveArch: %{power64} - libsavitar ExcludeArch: %{ix86} - libsedml ExcludeArch: %{ix86} - libsemigroups ExcludeArch: %{ix86} - libserializer ExclusiveArch: %{java_arches} noarch - libservicelog ExclusiveArch: ppc %{power64} - libsmbios ExclusiveArch: x86_64 %{ix86} - libsonata ExcludeArch: %{ix86} - libstoragemgmt ExcludeArch: %{ix86} - libtracecmd ExcludeArch: %{ix86} %{arm} - libunibreak ExcludeArch: %{ix86} - libunicode ExclusiveArch: x86_64 aarch64 - libunifex ExcludeArch: i686 - libunwind ExclusiveArch: %{arm} aarch64 hppa ia64 mips ppc %{power64} s390x %{ix86} x86_64 riscv64 - libva-intel-hybrid-driver ExclusiveArch: %{ix86} x86_64 ia64 - libva-nvidia-driver ExclusiveArch: %{x86_64} %{ix86} %{arm64} ppc64le - libvirt-java ExclusiveArch: %{java_arches} noarch - libvma ExclusiveArch: x86_64 ppc64le ppc64 aarch64 - libvmi ExclusiveArch: x86_64 - libvpd ExclusiveArch: %{power64} - libvpl ExclusiveArch: x86_64 - libvpl-tools ExclusiveArch: x86_64 - libx86 ExcludeArch: ppc %{power64} s390 s390x %{sparc} aarch64 armv7hl - libxsmm ExclusiveArch: x86_64 - libzdnn ExclusiveArch: s390x - libzfcphbaapi ExclusiveArch: s390 s390x - libzpc ExclusiveArch: s390x - liferea ExcludeArch: %{ix86} - linbox ExcludeArch: %{ix86} - linux-system-roles ExcludeArch: i686 - liquidctl ExcludeArch: s390 s390x - lite-xl ExcludeArch: %{ix86} - llama-cpp ExclusiveArch: x86_64 aarch64 - lld13 ExcludeArch: s390x - lld15 ExcludeArch: s390x - lld16 ExcludeArch: s390x - lld17 ExcludeArch: s390x - llhttp ExclusiveArch: %{nodejs_arches} - llvm-bolt ExcludeArch: s390x ppc64le i686 - log4j ExclusiveArch: %{java_arches} noarch - log4net ExclusiveArch: %mono_arches - loguru ExcludeArch: %{ix86} - loupe ExcludeArch: %{ix86} - love ExcludeArch: ppc ppc64 s390x - lrmi ExclusiveArch: %{ix86} - lsp-plugins ExcludeArch: %{ix86} - lsvpd ExclusiveArch: %{power64} - luajit ExcludeArch: riscv64 ppc64 ppc64le - lucene ExclusiveArch: %{java_arches} noarch - luckybackup ExcludeArch: %{ix86} - lujavrite ExclusiveArch: %{java_arches} - luminance-hdr ExcludeArch: %{ix86} - lusol ExcludeArch: %{ix86} - luxcorerender ExclusiveArch: x86_64 - lzfse ExcludeArch: s390x - m4rie ExcludeArch: %{ix86} - mactel-boot ExclusiveArch: x86_64 - magicmirror ExclusiveArch: %{nodejs_arches} noarch - magicmirror-module-airnow ExclusiveArch: %{nodejs_arches} noarch - magicmirror-module-onthisday ExclusiveArch: %{nodejs_arches} noarch - magicmirror-module-singlestock ExclusiveArch: %{nodejs_arches} noarch - makemusic-finale-fonts ExcludeArch: %{ix86} - mame ExcludeArch: %{arm} %{ix86} - manifest-tool ExclusiveArch: x86_64 aarch64 ppc64le s390x - mapnik ExcludeArch: ppc ppc64 s390 s390x - marcsabatella-campania-fonts ExcludeArch: %{ix86} - mariadb-java-client ExclusiveArch: %{java_arches} noarch - marked ExclusiveArch: %{nodejs_arches} noarch ExclusiveArch: %{ix86} x86_64 %{arm} noarch - mate-applets ExcludeArch: i386 i686 - matrix-synapse ExclusiveArch: %{rust_arches} - maven ExclusiveArch: %{java_arches} noarch - maven-antrun-plugin ExclusiveArch: %{java_arches} noarch - maven-archetype ExclusiveArch: %{java_arches} noarch - maven-archiver ExclusiveArch: %{java_arches} noarch - maven-artifact-transfer ExclusiveArch: %{java_arches} noarch - maven-assembly-plugin ExclusiveArch: %{java_arches} noarch - maven-bundle-plugin ExclusiveArch: %{java_arches} noarch - maven-clean-plugin ExclusiveArch: %{java_arches} noarch - maven-common-artifact-filters ExclusiveArch: %{java_arches} noarch - maven-compiler-plugin ExclusiveArch: %{java_arches} noarch - maven-dependency-analyzer ExclusiveArch: %{java_arches} noarch - maven-dependency-plugin ExclusiveArch: %{java_arches} noarch - maven-dependency-tree ExclusiveArch: %{java_arches} noarch - maven-doxia ExclusiveArch: %{java_arches} noarch - maven-doxia-sitetools ExclusiveArch: %{java_arches} noarch - maven-enforcer ExclusiveArch: %{java_arches} noarch - maven-file-management ExclusiveArch: %{java_arches} noarch - maven-filtering ExclusiveArch: %{java_arches} noarch - maven-invoker ExclusiveArch: %{java_arches} noarch - maven-invoker-plugin ExclusiveArch: %{java_arches} noarch - maven-jar-plugin ExclusiveArch: %{java_arches} noarch - maven-mapping ExclusiveArch: %{java_arches} noarch - maven-native ExclusiveArch: %{java_arches} noarch - maven-parent ExclusiveArch: %{java_arches} noarch - maven-patch-plugin ExclusiveArch: %{java_arches} noarch - maven-plugin-testing ExclusiveArch: %{java_arches} noarch - maven-plugin-tools ExclusiveArch: %{java_arches} noarch - maven-remote-resources-plugin ExclusiveArch: %{java_arches} noarch - maven-reporting-api ExclusiveArch: %{java_arches} noarch - maven-reporting-impl ExclusiveArch: %{java_arches} noarch - maven-resolver ExclusiveArch: %{java_arches} noarch - maven-resources-plugin ExclusiveArch: %{java_arches} noarch - maven-script-interpreter ExclusiveArch: %{java_arches} noarch - maven-shade-plugin ExclusiveArch: %{java_arches} noarch - maven-shared-incremental ExclusiveArch: %{java_arches} noarch - maven-shared-io ExclusiveArch: %{java_arches} noarch - maven-shared-utils ExclusiveArch: %{java_arches} noarch - maven-source-plugin ExclusiveArch: %{java_arches} noarch - maven-surefire ExclusiveArch: %{java_arches} noarch - maven-verifier ExclusiveArch: %{java_arches} noarch - maven-verifier-plugin ExclusiveArch: %{java_arches} noarch - maven-wagon ExclusiveArch: %{java_arches} noarch - maxima ExclusiveArch: %{arm} %{ix86} x86_64 aarch64 ppc sparcv9 ExclusiveArch: %{ix86} x86_64 ppc sparcv9 - mbpfan ExclusiveArch: x86_64 - mcelog ExclusiveArch: i686 x86_64 - mcqd ExcludeArch: %{ix86} - mcrouter ExclusiveArch: x86_64 aarch64 ppc64le - mecab-java ExclusiveArch: %java_arches - mediaconch ExclusiveArch: %{qt5_qtwebengine_arches} - mellowplayer ExclusiveArch: %{qt5_qtwebengine_arches} - memkind ExclusiveArch: x86_64 ppc64 ppc64le s390x aarch64 - memtest86+ ExclusiveArch: x86_64 %{ix86} - merkuro ExclusiveArch: %{qt6_qtwebengine_arches} - meshlab ExclusiveArch: aarch64 x86_64 ExcludeArch: %{ix86} - metamath ExcludeArch: %{ix86} - mfem ExcludeArch: %{ix86} - microcode_ctl ExclusiveArch: %{ix86} x86_64 - micropython ExclusiveArch: %{arm} x86_64 riscv64 - miglayout ExclusiveArch: %{java_arches} noarch - mine_detector ExclusiveArch: %{GPRbuild_arches} - minetest ExclusiveArch: %{ix86} x86_64 ExclusiveArch: %{arm} %{ix86} x86_64 %{mips} aarch64 - mingw-libidn2 ExclusiveArch: %{ix86} x86_64 %{arm} - mingw-qt6-qtlocation ExcludeArch: s390x - mingw-wine-gecko ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 - miopen ExclusiveArch: x86_64 - mirrormanager2 ExcludeArch: %{ix86} - mkbootdisk ExclusiveArch: %{ix86} sparc sparc64 x86_64 - mlir ExcludeArch: i686 - mlir17 ExcludeArch: i686 - mlpack ExcludeArch: %{ix86} ExcludeArch: s390 - mmapper ExcludeArch: %{ix86} - mmlib ExcludeArch: %{ix86} - mmtests ExcludeArch: s390x - moby-engine ExclusiveArch: %{golang_arches} - mockito ExclusiveArch: %{java_arches} noarch - mod_gnutls ExcludeArch: %{ix86} %{arm} - mod_mono ExclusiveArch: %mono_arches - mod_proxy_cluster ExcludeArch: i686 i386 - modello ExclusiveArch: %{java_arches} noarch - moditect ExclusiveArch: %{java_arches} noarch - module-build-service ExclusiveArch: %{ix86} x86_64 noarch - modulemaker-maven-plugin ExclusiveArch: %{java_arches} noarch - mojo-executor ExclusiveArch: %{java_arches} noarch - mojo-parent ExclusiveArch: %{java_arches} noarch - mokutil ExclusiveArch: %{ix86} x86_64 aarch64 %{arm} - mold ExcludeArch: %{ix86} - mono ExclusiveArch: %mono_arches - mono-addins ExclusiveArch: %mono_arches - mono-basic ExclusiveArch: %{mono_arches} - mono-bouncycastle ExclusiveArch: %mono_arches ExcludeArch: armv7hl - mono-cecil ExclusiveArch: %mono_arches - mono-cecil-flowanalysis ExclusiveArch: %mono_arches - mono-reflection ExclusiveArch: %mono_arches - mono-tools ExclusiveArch: %mono_arches - mono-zeroconf ExclusiveArch: %mono_arches - monodevelop ExclusiveArch: %mono_arches ExcludeArch: armv7hl - monodevelop-debugger-gdb ExclusiveArch: %{mono_arches} ExcludeArch: armv7hl - moose ExcludeArch: s390x - morphio ExcludeArch: %{ix86} - mozc ExcludeArch: ppc ppc64 sparcv9 sparc64 s390x - mozilla-ublock-origin ExcludeArch: ppc64 s390x - mp ExcludeArch: %{ix86} - mpark-patterns ExcludeArch: %{ix86} - mpi4py ExcludeArch: %{ix86} - mpibash ExcludeArch: %{ix86} - mpsolve ExcludeArch: %{ix86} - mrchem ExcludeArch: s390x - mrcpp ExcludeArch: s390x - mrrescue ExclusiveArch: %{arm} %{ix86} x86_64 aarch64 ppc64le - msolve ExcludeArch: %{ix86} - msr-tools ExclusiveArch: %{ix86} x86_64 - mstflint ExcludeArch: s390 s390x %{arm} - msv ExclusiveArch: %{java_arches} noarch - mt32emu ExcludeArch: %{ix86} - muffin ExcludeArch: %{ix86} - mumble ExcludeArch: %{ix86} - mupen64plus ExcludeArch: s390x - musescore ExcludeArch: %{ix86} - musl ExcludeArch: s390 - mvfst ExclusiveArch: x86_64 aarch64 ppc64le riscv64 - mxparser ExclusiveArch: %{java_arches} noarch - mysql-connector-java ExclusiveArch: %{java_arches} noarch - mysql-connector-net ExclusiveArch: %{mono_arches} - naev ExclusiveArch: %{arm} %{ix86} x86_64 %{mips} aarch64 ExcludeArch: %{ix86} - naga ExclusiveArch: %{java_arches} noarch - nagios-plugins-check-updates ExcludeArch: %{ix86} - nant ExclusiveArch: %mono_arches ExcludeArch: armv7hl - nativejit ExclusiveArch: x86_64 - nbc ExclusiveArch: %{fpc_arches} - nbdkit ExcludeArch: i686 - ncl ExcludeArch: %{ix86} - ndesk-dbus ExclusiveArch: %{mono_arches} - ndesk-dbus-glib ExclusiveArch: %{mono_arches} - nekohtml ExclusiveArch: %{java_arches} noarch - nemo ExcludeArch: %{ix86} - nemo-extensions ExcludeArch: %{ix86} - nest ExcludeArch: %{ix86} - netatalk ExcludeArch: aarch64 s390x - netavark ExclusiveArch: %{golang_arches_future} ExclusiveArch: aarch64 ppc64le s390x x86_64 - netcdf-fortran ExcludeArch: %{ix86} - netdata ExcludeArch: s390x - netgen-mesher ExcludeArch: %{ix86} - neuron ExcludeArch: mips64r2 mips32r2 ExcludeArch: %{ix86} - newtonsoft-json ExclusiveArch: %{mono_arches} ExcludeArch: armv7hl - nextcloud-client ExcludeArch: %{ix86} ExcludeArch: ppc64 ppc64le s390x - nodejs-acorn-object-spread ExclusiveArch: %{nodejs_arches} noarch ExclusiveArch: %{ix86} x86_64 %{arm} noarch - nodejs-backbone ExclusiveArch: %{nodejs_arches} noarch - nodejs-bash-language-server ExclusiveArch: %{nodejs_arches} noarch - nodejs-buble ExclusiveArch: %{nodejs_arches} noarch - nodejs-cjs-module-lexer ExclusiveArch: %{nodejs_arches} noarch ExclusiveArch: %{ix86} x86_64 aarch64 ppc64le riscv64 noarch - nodejs-colors ExclusiveArch: %{nodejs_arches} noarch - nodejs-less ExclusiveArch: %{nodejs_arches} noarch - nodejs-linefix ExclusiveArch: %{nodejs_arches} noarch ExclusiveArch: %{ix86} x86_64 %{arm} noarch - nodejs-nodemon ExclusiveArch: %{nodejs_arches} noarch - nodejs-packaging ExclusiveArch: %{nodejs_arches} noarch - nodejs-replace-require-self ExclusiveArch: %{nodejs_arches} noarch - nodejs-underscore ExclusiveArch: %{nodejs_arches} noarch ExclusiveArch: %{ix86} x86_64 %{arm} noarch - nodejs-undici ExclusiveArch: %{ix86} x86_64 aarch64 ppc64le riscv64 noarch - nodejs18 ExclusiveArch: %{nodejs_arches} - nodejs20 ExclusiveArch: %{nodejs_arches} - nodejs22 ExclusiveArch: %{nodejs_arches} - nom-tam-fits ExclusiveArch: %{java_arches} noarch - normaliz ExcludeArch: %{ix86} - not-ocamlfind ExcludeArch: %{ix86} - notejot ExcludeArch: %{ix86} - notify-sharp ExclusiveArch: %{mono_arches} - notify-sharp3 ExclusiveArch: %{mono_arches} - ntfs2btrfs ExcludeArch: ppc64 s390x - nuget ExclusiveArch: %{mono_arches} - numactl ExcludeArch: s390 %{arm} - numatop ExclusiveArch: x86_64 ppc64le - numptyphysics ExcludeArch: ppc64le - nunit ExclusiveArch: %{mono_arches} - nunit2 ExclusiveArch: %{mono_arches} ExcludeArch: armv7hl - nut ExcludeArch: s390 s390x - nvml ExclusiveArch: x86_64 ppc64le - nwchem ExcludeArch: %{ix86} s390x ExcludeArch: s390x - objectweb-asm ExclusiveArch: %{java_arches} noarch - objenesis ExclusiveArch: %{java_arches} noarch - obs-cef ExclusiveArch: x86_64 aarch64 - obs-service-rust2rpm ExclusiveArch: %{rust_arches} noarch - obs-studio-plugin-vkcapture ExcludeArch: s390x - ocaml ExcludeArch: %{ix86} - ocaml-SDL ExcludeArch: %{ix86} - ocaml-alcotest ExcludeArch: %{ix86} - ocaml-astring ExcludeArch: %{ix86} - ocaml-atd ExcludeArch: %{ix86} - ocaml-augeas ExcludeArch: %{ix86} - ocaml-autoconf ExcludeArch: %{ix86} - ocaml-base ExcludeArch: %{ix86} - ocaml-base64 ExcludeArch: %{ix86} - ocaml-benchmark ExcludeArch: %{ix86} - ocaml-bigarray-compat ExcludeArch: %{ix86} - ocaml-bin-prot ExcludeArch: %{ix86} - ocaml-biniou ExcludeArch: %{ix86} - ocaml-bisect-ppx ExcludeArch: %{ix86} - ocaml-bos ExcludeArch: %{ix86} - ocaml-cairo ExcludeArch: %{ix86} - ocaml-calendar ExcludeArch: %{ix86} - ocaml-camlbz2 ExcludeArch: %{ix86} - ocaml-camlidl ExcludeArch: %{ix86} - ocaml-camlimages ExcludeArch: %{ix86} - ocaml-camlp-streams ExcludeArch: %{ix86} - ocaml-camlp5 ExcludeArch: %{ix86} - ocaml-camlp5-buildscripts ExcludeArch: %{ix86} - ocaml-camomile ExcludeArch: %{ix86} - ocaml-cinaps ExcludeArch: %{ix86} - ocaml-cmdliner ExcludeArch: %{ix86} - ocaml-compiler-libs-janestreet ExcludeArch: %{ix86} - ocaml-cppo ExcludeArch: %{ix86} - ocaml-crunch ExcludeArch: %{ix86} - ocaml-cryptokit ExcludeArch: %{ix86} - ocaml-csexp ExcludeArch: %{ix86} - ocaml-csv ExcludeArch: %{ix86} - ocaml-ctypes ExcludeArch: %{ix86} - ocaml-cudf ExcludeArch: %{ix86} - ocaml-curl ExcludeArch: %{ix86} - ocaml-curses ExcludeArch: %{ix86} - ocaml-dbus ExcludeArch: %{ix86} - ocaml-dose3 ExcludeArch: %{ix86} - ocaml-dune ExcludeArch: %{ix86} - ocaml-easy-format ExcludeArch: %{ix86} - ocaml-expat ExcludeArch: %{ix86} - ocaml-extlib ExcludeArch: %{ix86} - ocaml-facile ExcludeArch: %{ix86} - ocaml-fieldslib ExcludeArch: %{ix86} - ocaml-fileutils ExcludeArch: %{ix86} - ocaml-findlib ExcludeArch: %{ix86} - ocaml-fmt ExcludeArch: %{ix86} - ocaml-fpath ExcludeArch: %{ix86} - ocaml-gen ExcludeArch: %{ix86} - ocaml-gettext ExcludeArch: %{ix86} - ocaml-graphics ExcludeArch: %{ix86} - ocaml-gsl ExcludeArch: %{arm} %{ix86} - ocaml-integers ExcludeArch: %{ix86} - ocaml-jane-street-headers ExcludeArch: %{ix86} - ocaml-jst-config ExcludeArch: %{ix86} - ocaml-lablgl ExcludeArch: %{ix86} - ocaml-lablgtk ExcludeArch: %{ix86} - ocaml-lablgtk3 ExcludeArch: %{ix86} - ocaml-labltk ExcludeArch: %{ix86} - ocaml-lacaml ExcludeArch: %{ix86} - ocaml-lambda-term ExcludeArch: %{ix86} - ocaml-libvirt ExcludeArch: %{ix86} - ocaml-logs ExcludeArch: %{ix86} - ocaml-luv ExcludeArch: %{ix86} - ocaml-lwt ExcludeArch: %{ix86} - ocaml-markup ExcludeArch: %{ix86} - ocaml-mccs ExcludeArch: %{ix86} - ocaml-mdx ExcludeArch: %{ix86} - ocaml-menhir ExcludeArch: %{ix86} - ocaml-merlin ExcludeArch: %{ix86} - ocaml-mew ExcludeArch: %{ix86} - ocaml-mew-vi ExcludeArch: %{ix86} - ocaml-mlgmpidl ExcludeArch: %{ix86} - ocaml-mlmpfr ExcludeArch: %{ix86} - ocaml-mtime ExcludeArch: %{ix86} - ocaml-mysql ExcludeArch: %{ix86} - ocaml-num ExcludeArch: %{ix86} - ocaml-obuild ExcludeArch: %{ix86} - ocaml-ocamlbuild ExcludeArch: %{ix86} - ocaml-ocamlgraph ExcludeArch: %{ix86} - ocaml-ocamlnet ExcludeArch: %{ix86} - ocaml-ocp-indent ExcludeArch: %{ix86} - ocaml-ocplib-endian ExcludeArch: %{ix86} - ocaml-ocplib-simplex ExcludeArch: %{ix86} - ocaml-octavius ExcludeArch: %{ix86} - ocaml-odoc ExcludeArch: %{ix86} - ocaml-omake ExcludeArch: %{ix86} - ocaml-opam-file-format ExcludeArch: %{ix86} - ocaml-ounit ExcludeArch: %{ix86} - ocaml-parmap ExcludeArch: %{ix86} - ocaml-parsexp ExcludeArch: %{ix86} - ocaml-pcre ExcludeArch: %{ix86} - ocaml-pcre2 ExcludeArch: %{ix86} - ocaml-perl4caml ExcludeArch: %{ix86} - ocaml-postgresql ExcludeArch: %{ix86} - ocaml-pp ExcludeArch: %{ix86} - ocaml-ppx-assert ExcludeArch: %{ix86} - ocaml-ppx-base ExcludeArch: %{ix86} - ocaml-ppx-cold ExcludeArch: %{ix86} - ocaml-ppx-compare ExcludeArch: %{ix86} - ocaml-ppx-custom-printf ExcludeArch: %{ix86} - ocaml-ppx-derivers ExcludeArch: %{ix86} - ocaml-ppx-deriving ExcludeArch: %{ix86} - ocaml-ppx-deriving-yaml ExcludeArch: %{ix86} - ocaml-ppx-deriving-yojson ExcludeArch: %{ix86} - ocaml-ppx-enumerate ExcludeArch: %{ix86} - ocaml-ppx-expect ExcludeArch: %{ix86} - ocaml-ppx-fields-conv ExcludeArch: %{ix86} - ocaml-ppx-globalize ExcludeArch: %{ix86} - ocaml-ppx-hash ExcludeArch: %{ix86} - ocaml-ppx-here ExcludeArch: %{ix86} - ocaml-ppx-import ExcludeArch: %{ix86} - ocaml-ppx-inline-test ExcludeArch: %{ix86} - ocaml-ppx-js-style ExcludeArch: %{ix86} - ocaml-ppx-let ExcludeArch: %{ix86} - ocaml-ppx-optcomp ExcludeArch: %{ix86} - ocaml-ppx-sexp-conv ExcludeArch: %{ix86} - ocaml-ppx-stable-witness ExcludeArch: %{ix86} - ocaml-ppx-variants-conv ExcludeArch: %{ix86} - ocaml-ppxlib ExcludeArch: %{ix86} - ocaml-psmt2-frontend ExcludeArch: %{ix86} - ocaml-ptime ExcludeArch: %{ix86} - ocaml-ptmap ExcludeArch: %{ix86} - ocaml-pyml ExcludeArch: %{ix86} - ocaml-qcheck ExcludeArch: %{ix86} - ocaml-qtest ExcludeArch: %{ix86} - ocaml-re ExcludeArch: %{ix86} - ocaml-react ExcludeArch: %{ix86} - ocaml-res ExcludeArch: %{ix86} - ocaml-result ExcludeArch: %{ix86} - ocaml-rresult ExcludeArch: %{ix86} - ocaml-sedlex ExcludeArch: %{ix86} - ocaml-sexplib ExcludeArch: %{ix86} - ocaml-sexplib0 ExcludeArch: %{ix86} - ocaml-sha ExcludeArch: %{ix86} - ocaml-sqlite ExcludeArch: %{ix86} - ocaml-ssl ExcludeArch: %{ix86} - ocaml-stdcompat ExcludeArch: %{ix86} - ocaml-stdio ExcludeArch: %{ix86} - ocaml-stdlib-random ExcludeArch: %{ix86} - ocaml-time-now ExcludeArch: %{ix86} - ocaml-topkg ExcludeArch: %{ix86} - ocaml-trie ExcludeArch: %{ix86} - ocaml-tyxml ExcludeArch: %{ix86} - ocaml-unionfind ExcludeArch: %{ix86} - ocaml-uucd ExcludeArch: %{ix86} - ocaml-uucp ExcludeArch: %{ix86} - ocaml-uunf ExcludeArch: %{ix86} - ocaml-uuseg ExcludeArch: %{ix86} - ocaml-uutf ExcludeArch: %{ix86} - ocaml-variantslib ExcludeArch: %{ix86} - ocaml-version ExcludeArch: %{ix86} - ocaml-xml-light ExcludeArch: %{ix86} - ocaml-xmlm ExcludeArch: %{ix86} - ocaml-xmlrpc-light ExcludeArch: %{ix86} - ocaml-yaml ExcludeArch: %{ix86} - ocaml-yojson ExcludeArch: %{ix86} - ocaml-zarith ExcludeArch: %{ix86} - ocaml-zed ExcludeArch: %{ix86} - ocaml-zip ExcludeArch: %{ix86} - ocaml-zmq ExcludeArch: %{ix86} - ocamlify ExcludeArch: %{ix86} - ocamlmod ExcludeArch: %{ix86} - oci-seccomp-bpf-hook ExclusiveArch: x86_64 %{power64} aarch64 s390x armv7hl ExclusiveArch: %{golang_arches_future} - ocrmypdf ExcludeArch: %{ix86} - octave-communications ExcludeArch: s390x - octave-iso2mesh ExcludeArch: armv7hl - octave-signal ExcludeArch: s390x - oidc-agent ExcludeArch: %{ix86} - oidn ExclusiveArch: x86_64 - oneVPL ExclusiveArch: x86_64 - oneapi-level-zero ExclusiveArch: x86_64 - onednn ExclusiveArch: x86_64 aarch64 ppc64le s390x - onedrive ExclusiveArch: %{ldc_arches} - ongres-scram ExclusiveArch: %{java_arches} noarch - ongres-stringprep ExclusiveArch: %{java_arches} noarch - onnx ExcludeArch: s390x - onnxruntime ExcludeArch: s390x %{arm} %{ix86} - oomd ExcludeArch: i686 armv7hl - opae ExclusiveArch: x86_64 - opal-prd ExclusiveArch: ppc64le - opam ExcludeArch: %{ix86} - open-vm-tools ExclusiveArch: x86_64 aarch64 ExclusiveArch: %{ix86} x86_64 aarch64 ExclusiveArch: x86_64 - openblas ExclusiveArch: %{openblas_arches} - opencsg ExcludeArch: %{ix86} - opengrm-ngram ExcludeArch: %{ix86} - openjdk-asmtools ExclusiveArch: %{java_arches} noarch - openjdk-asmtools7 ExclusiveArch: %{java_arches} noarch - openjfx ExclusiveArch: %{java_arches} - openjfx8 ExclusiveArch: x86_64 - openlibm ExclusiveArch: %{arm} %{ix86} x86_64 aarch64 %{power64} - openmeeg ExcludeArch: s390x - openmpi ExcludeArch: %{ix86} - openms ExclusiveArch: %{qt5_qtwebengine_arches} ExcludeArch: %{ix86} - openni ExclusiveArch: x86_64 %{arm} - openni-primesense ExclusiveArch: x86_64 %{arm} - openobex ExcludeArch: s390 s390x - openoffice.org-diafilter ExclusiveArch: %{java_arches} - openpgl ExclusiveArch: aarch64 x86_64 - openrgb ExcludeArch: %{ix86} - openscad ExcludeArch: %{ix86} - openshadinglanguage ExcludeArch: %{ix86} %{arm} - openshot ExcludeArch: ppc64le - opensm ExcludeArch: s390 %{arm} - openssl-ibmca ExclusiveArch: s390 s390x - openstack-java-sdk ExclusiveArch: %{java_arches} noarch - opentest4j ExclusiveArch: %{java_arches} noarch - opentype-sanitizer ExcludeArch: %{ix86} - openvdb ExcludeArch: i686 - openvkl ExclusiveArch: aarch64 x86_64 - openxr-simple-playground ExcludeArch: %{ix86} - optee_client ExclusiveArch: aarch64 - optee_os ExclusiveArch: aarch64 - options ExclusiveArch: %{java_arches} noarch - orthorobot ExclusiveArch: %{arm} %{ix86} x86_64 aarch64 ppc64le - os-autoinst ExcludeArch: %{arm} - osbuild-composer ExcludeArch: i686 armv7hl - osgi-annotation ExclusiveArch: %{java_arches} noarch - osgi-compendium ExclusiveArch: %{java_arches} noarch - osgi-core ExclusiveArch: %{java_arches} noarch - osm2pgsql ExcludeArch: %{ix86} - osslsigncode ExcludeArch: i686 - ostree ExcludeArch: %{ix86} - otf2 ExcludeArch: i686 s390x - oz ExcludeArch: %{ix86} - pacemaker ExclusiveArch: aarch64 i686 ppc64le s390x x86_64 %{arm} ExclusiveArch: aarch64 i686 ppc64le s390x x86_64 - pageedit ExclusiveArch: %{qt5_qtwebengine_arches} - paperwork ExcludeArch: %{ix86} - papi ExcludeArch: s390 s390x - papilo ExcludeArch: %{ix86} - paraview ExcludeArch: %{ix86} - pari-nftables ExcludeArch: %{ix86} - parlaylib ExcludeArch: aarch64 s390x arm-hfp ppc64le i686 - parserng ExclusiveArch: %{java_arches} noarch - pasdoc ExclusiveArch: %{fpc_arches} - pcc ExclusiveArch: %{ix86} x86_64 - pcem ExcludeArch: armv7hl i686 ppc64le s390x - pcfi ExclusiveArch: %{java_arches} noarch - pcg-cpp ExcludeArch: %{ix86} - pcm ExclusiveArch: %{ix86} x86_64 - pcp ExcludeArch: %{ix86} - pcp2pdf ExcludeArch: %{ix86} - pdbg ExclusiveArch: ppc64le - pdfarranger ExcludeArch: %{ix86} - pdfbox ExclusiveArch: %{java_arches} noarch - pdftk-java ExclusiveArch: %{java_arches} noarch - pdns ExcludeArch: %{arm} %{ix86} - pdns-recursor ExcludeArch: %{arm} %{ix86} - pdqsort ExcludeArch: %{ix86} - pengupop ExcludeArch: s390x - pentaho-libxml ExclusiveArch: %{java_arches} noarch - pentaho-reporting-flow-engine ExclusiveArch: %{java_arches} noarch - perftest ExcludeArch: s390 %{arm} - perl-Dumbbench ExclusiveArch: %{ix86} x86_64 noarch - perl-LMDB_File ExcludeArch: armv7hl i686 - perl-Math-Int128 ExcludeArch: %{arm32} %{ix86} - perl-MaxMind-DB-Reader-XS ExcludeArch: %{arm} %{ix86} - perl-MongoDB ExcludeArch: ppc %{sparc} s390 - perl-Net-Works ExcludeArch: %{arm32} %{ix86} - perl-Parse-DMIDecode ExclusiveArch: %{ix86} x86_64 ia64 aarch64 - perl-Task-Catalyst ExcludeArch: %{ix86} - perl-threads-lite ExcludeArch: aarch64 ppc ppc64 ppc64le - permlib ExcludeArch: %{ix86} - pesign ExclusiveArch: %{ix86} x86_64 ia64 aarch64 %{arm} riscv64 - pesign-test-app ExclusiveArch: x86_64 - petpvc ExcludeArch: %{ix86} - pf-bb-config ExcludeArch: s390x - pgadmin4 ExcludeArch: i686 armv7hl s390x ppc64le - phd2 ExcludeArch: %{ix86} - phosh ExcludeArch: i686 - phosh-mobile-settings ExcludeArch: i686 - php ExcludeArch: %{ix86} - php-ast ExcludeArch: %{ix86} - php-facedetect ExcludeArch: %{ix86} - php-geos ExcludeArch: %{ix86} - php-libvirt ExcludeArch: %{ix86} - php-maxminddb ExcludeArch: %{ix86} - php-pecl-amqp ExcludeArch: %{ix86} - php-pecl-apcu ExcludeArch: %{ix86} - php-pecl-apfd ExcludeArch: %{ix86} - php-pecl-dio ExcludeArch: %{ix86} - php-pecl-ds ExcludeArch: %{ix86} - php-pecl-event ExcludeArch: %{ix86} - php-pecl-fann ExcludeArch: %{ix86} - php-pecl-gearman ExcludeArch: %{ix86} - php-pecl-geoip ExcludeArch: %{ix86} - php-pecl-gmagick ExcludeArch: %{ix86} - php-pecl-http ExcludeArch: %{ix86} - php-pecl-igbinary ExcludeArch: %{ix86} - php-pecl-imagick ExcludeArch: %{ix86} - php-pecl-inotify ExcludeArch: %{ix86} - php-pecl-ip2location ExcludeArch: %{ix86} - php-pecl-json-post ExcludeArch: %{ix86} - php-pecl-krb5 ExcludeArch: %{ix86} - php-pecl-lzf ExcludeArch: %{ix86} - php-pecl-mailparse ExcludeArch: %{ix86} - php-pecl-mcrypt ExcludeArch: %{ix86} - php-pecl-memcache ExcludeArch: %{ix86} - php-pecl-memcached ExcludeArch: %{ix86} - php-pecl-mongodb ExcludeArch: %{ix86} - php-pecl-msgpack ExcludeArch: %{ix86} - php-pecl-oauth ExcludeArch: %{ix86} - php-pecl-pcov ExcludeArch: %{ix86} - php-pecl-pq ExcludeArch: %{ix86} - php-pecl-raphf ExcludeArch: %{ix86} - php-pecl-redis5 ExcludeArch: %{ix86} - php-pecl-rpminfo ExcludeArch: %{ix86} - php-pecl-rrd ExcludeArch: %{ix86} - php-pecl-selinux ExcludeArch: %{ix86} - php-pecl-ssdeep ExcludeArch: %{ix86} - php-pecl-ssh2 ExcludeArch: %{ix86} - php-pecl-uopz ExcludeArch: %{ix86} - php-pecl-uuid ExcludeArch: %{ix86} - php-pecl-var-representation ExcludeArch: %{ix86} - php-pecl-xattr ExcludeArch: %{ix86} - php-pecl-xdebug3 ExcludeArch: %{ix86} - php-pecl-xmldiff ExcludeArch: %{ix86} - php-pecl-xmlrpc ExcludeArch: %{ix86} - php-pecl-yac ExcludeArch: %{ix86} - php-pecl-zip ExcludeArch: %{ix86} - php-phpiredis ExcludeArch: %{ix86} - php-smbclient ExcludeArch: %{ix86} - php-zmq ExcludeArch: %{ix86} - php-zstd ExcludeArch: %{ix86} - picard ExcludeArch: ppc64 - picocli ExclusiveArch: %{java_arches} noarch - pigeonascent ExcludeArch: ppc64le ExcludeArch: s390x - pilot-link ExcludeArch: s390 s390x - pinta ExclusiveArch: %mono_arches ExcludeArch: armv7hl - pioneer ExclusiveArch: %{ix86} x86_64 - pl ExcludeArch: %{ix86} - planets ExcludeArch: %{ix86} - plantri ExcludeArch: %{ix86} - plantuml ExclusiveArch: %{java_arches} noarch - plasma-dialer ExclusiveArch: %{java_arches} - plasma-disks ExcludeArch: %{ix86} - playonlinux ExclusiveArch: %{arm} aarch64 %{ix86} x86_64 - plee-the-bear ExcludeArch: %{power64} - plexus-archiver ExclusiveArch: %{java_arches} noarch - plexus-build-api ExclusiveArch: %{java_arches} noarch - plexus-build-api0 ExclusiveArch: %{java_arches} noarch - plexus-cipher ExclusiveArch: %{java_arches} noarch - plexus-classworlds ExclusiveArch: %{java_arches} noarch - plexus-compiler ExclusiveArch: %{java_arches} noarch - plexus-component-api ExclusiveArch: %{java_arches} noarch - plexus-components-pom ExclusiveArch: %{java_arches} noarch - plexus-containers ExclusiveArch: %{java_arches} noarch - plexus-i18n ExclusiveArch: %{java_arches} noarch - plexus-interpolation ExclusiveArch: %{java_arches} noarch - plexus-io ExclusiveArch: %{java_arches} noarch - plexus-languages ExclusiveArch: %{java_arches} noarch - plexus-pom ExclusiveArch: %{java_arches} noarch - plexus-resources ExclusiveArch: %{java_arches} noarch - plexus-sec-dispatcher ExclusiveArch: %{java_arches} noarch - plexus-testing ExclusiveArch: %{java_arches} noarch - plexus-utils ExclusiveArch: %{java_arches} noarch - plexus-velocity ExclusiveArch: %{java_arches} noarch - plexus-xml ExclusiveArch: %{java_arches} noarch - pmix ExcludeArch: %{ix86} - pngcheck ExcludeArch: %{ix86} - podman ExclusiveArch: %{golang_arches_future} ExclusiveArch: aarch64 ppc64le s390x x86_64 - polymake ExcludeArch: %{ix86} - polyml ExcludeArch: %{ix86} - poppler-sharp ExclusiveArch: %mono_arches - popub ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 %{arm}} - postgresql-jdbc ExclusiveArch: %{java_arches} noarch - postgresql-pgpool-II ExcludeArch: %{ix86} ExcludeArch: %{ix86} ExcludeArch: %{ix86} - powerpc-utils ExclusiveArch: ppc %{power64} - powerstat ExclusiveArch: %{ix86} x86_64 - ppc64-diag ExclusiveArch: ppc %{power64} - ppl ExcludeArch: %{ix86} - pplite ExcludeArch: %{ix86} - prestopalette ExcludeArch: i686 - printer-driver-brlaser ExcludeArch: %{ix86} - procdump ExcludeArch: ppc64le - procyon ExclusiveArch: %{java_arches} noarch ExclusiveArch: %{java_arches} noarch ExclusiveArch: %{java_arches} noarch ExclusiveArch: %{java_arches} noarch ExclusiveArch: %{java_arches} noarch ExclusiveArch: %{java_arches} noarch - proguard ExclusiveArch: %{java_arches} noarch - prometheus-jmx-exporter ExclusiveArch: %{java_arches} noarch - prometheus-simpleclient-java ExclusiveArch: %{java_arches} noarch - prooftree ExcludeArch: %{ix86} - proxmark3 ExcludeArch: ppc64le s390x - proxygen ExclusiveArch: x86_64 aarch64 ppc64le - proxysql ExcludeArch: %{power64} s390x %{ix86} - prrte ExcludeArch: %{ix86} - prusa-slicer ExcludeArch: %{ix86} - psblas3 ExcludeArch: %{ix86} - pveclib ExclusiveArch: ppc %{power64} - pygrib ExcludeArch: i686 ExcludeArch: armv7hl - pygsl ExcludeArch: %{ix86} - pyosmium ExcludeArch: %{ix86} - pypy ExcludeArch: %{ix86} - pypy3.10 ExcludeArch: %{ix86} - pypy3.9 ExcludeArch: %{ix86} - pyqtwebengine ExclusiveArch: %{qt5_qtwebengine_arches} - python-ZEO ExcludeArch: %{ix86} - python-ZODB3 ExcludeArch: %{ix86} - python-aioresponses ExcludeArch: s390x - python-annarchy ExcludeArch: %{ix86} ppc64le - python-ast-monitor ExclusiveArch: %{qt6_qtwebengine_arches} noarch - python-astroplan ExcludeArch: %{ix86} - python-astroscrappy ExcludeArch: %{ix86} - python-asyncmy ExcludeArch: %{ix86} - python-aws-sam-translator ExcludeArch: %{ix86} - python-awscrt ExcludeArch: s390x - python-bitstruct ExcludeArch: s390x - python-blosc2 ExcludeArch: %{ix86} - python-bluepyopt ExcludeArch: s390x %{ix86} %{power64} - python-calcephpy ExcludeArch: %{ix86} - python-colorthief ExcludeArch: %{ix86} - python-compreffor ExcludeArch: %{ix86} - python-contextualbandits ExcludeArch: %{ix86} - python-cradox ExcludeArch: i686 armv7hl - python-cryptography ExclusiveArch: %{rust_arches} - python-cvxopt ExcludeArch: %{ix86} - python-cyipopt ExcludeArch: %{ix86} - python-dask ExcludeArch: %{ix86} - python-databases ExcludeArch: %{ix86} - python-devicely ExcludeArch: s390x - python-dijitso ExcludeArch: i686 - python-dipy ExcludeArch: %{ix86} s390x - python-ducc0 ExcludeArch: %{ix86} - python-earthpy ExcludeArch: %{ix86} - python-eccodes ExcludeArch: i686 ExcludeArch: armv7hl - python-efel ExcludeArch: s390x - python-elephant ExcludeArch: s390x ExcludeArch: %{ix86} - python-ephyviewer ExcludeArch: s390x %{ix86} - python-etcd ExclusiveArch: noarch %{ix86} x86_64 %{arm} aarch64 ppc64le s390x riscv64 - python-fastavro ExcludeArch: %{arm32} %{ix86} - python-folium ExcludeArch: %{ix86} - python-formulaic ExcludeArch: %{ix86} - python-fsleyes ExcludeArch: %{ix86} - python-fsleyes-props ExcludeArch: %{ix86} - python-fslpy ExcludeArch: %{ix86} - python-gbinder ExcludeArch: %{ix86} - python-giacpy ExcludeArch: aarch64 %{power64} s390x - python-graph-tool ExcludeArch: %{ix86} - python-hdfs ExcludeArch: %{ix86} - python-healpy ExcludeArch: %{ix86} %{arm} - python-heapdict ExcludeArch: %{ix86} - python-imagecodecs ExcludeArch: %{ix86} - python-img2pdf ExcludeArch: s390x - python-javaobj ExclusiveArch: %{java_arches} noarch - python-jnius ExclusiveArch: %{java_arches} ExclusiveArch: %{java_arches} - python-json-minify ExcludeArch: %{ix86} - python-jupymake ExcludeArch: %{ix86} - python-jupyter-c-kernel ExcludeArch: %{ix86} - python-jupyter-kernel-singular ExcludeArch: %{ix86} - python-jupyter-polymake ExcludeArch: %{ix86} - python-jupyter-sphinx ExcludeArch: %{ix86} - python-jupytext ExcludeArch: s390x - python-lazy-ops ExcludeArch: %{ix86} - python-lfpy ExcludeArch: mips64r2 mips32r2 ExcludeArch: %{power64} %{ix86} armv7hl - python-llama-cpp-python ExclusiveArch: x86_64 aarch64 - python-mapnik ExcludeArch: ppc ppc64 s390 s390x - python-missingno ExcludeArch: %{ix86} - python-mne ExcludeArch: %{ix86} - python-mne-bids ExcludeArch: %{ix86} - python-mplcairo ExcludeArch: %{ix86} - python-mplcursors ExcludeArch: %{ix86} - python-music21 ExcludeArch: %{ix86} - python-ndindex ExcludeArch: %{ix86} - python-neatdend ExcludeArch: %{ix86} - python-neo ExcludeArch: s390x - python-netpyne ExcludeArch: %{ix86} - python-neurom ExcludeArch: %{ix86} - python-neurotune ExcludeArch: %{ix86} - python-nifti-mrs ExcludeArch: %{ix86} - python-nilearn ExcludeArch: %{ix86} - python-nipy ExcludeArch: %{ix86} - python-octave-kernel ExcludeArch: %{ix86} - python-openoffice ExclusiveArch: noarch x86_64 - python-openpaperwork-core ExcludeArch: %{ix86} - python-openpaperwork-gtk ExcludeArch: %{ix86} - python-opentype-sanitizer ExcludeArch: %{ix86} - python-pandas ExcludeArch: %{ix86} - python-pandas-flavor ExcludeArch: %{ix86} - python-papermill ExcludeArch: %{ix86} - python-paperwork-backend ExcludeArch: %{ix86} - python-pari-jupyter ExcludeArch: %{ix86} - python-phyghtmap ExcludeArch: %{ix86} - python-pingouin ExcludeArch: %{ix86} - python-plotnine ExcludeArch: %{ix86} - python-pplpy ExcludeArch: %{ix86} - python-primecountpy ExcludeArch: %{ix86} - python-psycopg3 ExcludeArch: %{ix86} - python-pyahocorasick ExclusiveArch: x86_64 %{arm64} ppc64le riscv64 - python-pybids ExcludeArch: %{ix86} - python-pybv ExcludeArch: %{ix86} - python-pyedflib ExcludeArch: s390x - python-pyfastnoisesimd ExcludeArch: %{ix86} - python-pyfiglet ExcludeArch: %{ix86} - python-pykdtree ExcludeArch: %{ix86} - python-pyliblzfse ExcludeArch: s390x - python-pymapvbvd ExcludeArch: s390x - python-pymatreader ExcludeArch: %{ix86} ExcludeArch: s390x - python-pynn ExcludeArch: mips64r2 mips32r2 s390x %{ix86} - python-pyocr ExcludeArch: %{ix86} - python-pypet ExcludeArch: %{ix86} ExcludeArch: s390x - python-pyphi ExcludeArch: %{ix86} s390x - python-pypillowfight ExcludeArch: %{ix86} - python-pyqt6-webengine ExclusiveArch: %{qt6_qtwebengine_arches} - python-pyriemann ExcludeArch: %{ix86} - python-pyroaring ExcludeArch: %{ix86} - python-pyscf ExcludeArch: %{power64} - python-pyshtools ExcludeArch: %{ix86} - python-pysingular ExcludeArch: %{ix86} - python-pyswarms ExcludeArch: %{ix86} - python-pyswip ExcludeArch: %{ix86} - python-pytest-arraydiff ExcludeArch: %{ix86} - python-pytest-tornado ExcludeArch: %{ix86} - python-python-fcl ExcludeArch: %{ix86} - python-pyunicorn ExcludeArch: %{ix86} - python-pyvat ExcludeArch: %{ix86} - python-ratinabox ExcludeArch: %{ix86} - python-recordclass ExcludeArch: %{ix86} - python-reproject ExcludeArch: %{ix86} - python-ruffus ExcludeArch: %{ix86} - python-scikit-learn ExcludeArch: %{ix86} - python-scikit-misc ExcludeArch: %{ix86} - python-sgp4 ExcludeArch: %{ix86} - python-simplebayes ExcludeArch: %{ix86} - python-sklearn-genetic-opt ExcludeArch: %{ix86} - python-statsmodels ExcludeArch: %{ix86} - python-steps ExcludeArch: %{ix86} - python-tables ExcludeArch: %{ix86} - python-tdlib ExcludeArch: %{ix86} - python-tensile ExclusiveArch: x86_64 - python-tensordict ExclusiveArch: x86_64 aarch64 - python-tkrzw ExcludeArch: i686 - python-torch ExclusiveArch: x86_64 aarch64 - python-torchaudio ExclusiveArch: x86_64 aarch64 - python-torchdata ExclusiveArch: x86_64 aarch64 - python-torchtext ExclusiveArch: x86_64 aarch64 - python-torchvision ExclusiveArch: x86_64 aarch64 - python-traitsui ExcludeArch: ppc64le - python-trimesh ExcludeArch: %{ix86} - python-uranium ExcludeArch: %{ix86} - python-willow ExcludeArch: %{ix86} - python-xattr ExcludeArch: %{ix86} - python-xbout ExcludeArch: %{ix86} - python-xmp-toolkit ExcludeArch: %{ix86} - python-zeep ExcludeArch: s390x - python-zict ExcludeArch: %{ix86} - q4wine ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 - qalculate-qt ExcludeArch: %{ix86} - qatengine ExclusiveArch: x86_64 - qatlib ExcludeArch: %{arm} aarch64 %{power64} s390x i686 - qatzip ExclusiveArch: x86_64 - qbe ExclusiveArch: x86_64 aarch64 riscv64 - qbittorrent ExcludeArch: %{ix86} - qbs ExcludeArch: i686 - qcas ExcludeArch: aarch64 %{power64} s390x - qcint ExclusiveArch: x86_64 - qclib ExclusiveArch: s390 s390x - qdigidoc ExcludeArch: %{ix86} - qdox ExclusiveArch: %{java_arches} noarch - qemu-sanity-check ExclusiveArch: %{kernel_arches} ExcludeArch: %{power64} - qevercloud ExclusiveArch: %{qt5_qtwebengine_arches} - qflipper ExcludeArch: %{ix86} - qmapshack ExclusiveArch: %{qt5_qtwebengine_arches} - qmplay2 ExcludeArch: %{ix86} - qoauth ExcludeArch: ppc64 - qownnotes ExcludeArch: %{ix86} - qpdfview ExcludeArch: s390x - qperf ExcludeArch: %{arm} - qsopt-ex ExcludeArch: %{ix86} - qt4pas ExclusiveArch: %{fpc_arches} - qt5-qtwebengine ExclusiveArch: %{qt5_qtwebengine_arches} - qt6-qtquick3dphysics ExclusiveArch: aarch64 i686 x86_64 - qt6-qtwebengine ExclusiveArch: aarch64 x86_64 - qt6-qtwebview ExclusiveArch: aarch64 x86_64 - qt6ct ExcludeArch: s390x - qtile ExcludeArch: %{ix86} - quantum-espresso ExclusiveArch: x86_64 aarch64 %{power64} - quentier ExclusiveArch: %{qt5_qtwebengine_arches} - rEFInd ExclusiveArch: %{efi} ExcludeArch: %{arm32} - rasdaemon ExcludeArch: s390 s390x - rccl ExclusiveArch: x86_64 - rdma-core ExcludeArch: %{arm} - realtime-tests ExcludeArch: %{arm} - rear ExclusiveArch: %ix86 x86_64 ppc ppc64 ppc64le ia64 s390x - redeclipse ExcludeArch: %{ix86} - redict ExcludeArch: %{ix86} - reflections ExclusiveArch: %{java_arches} noarch - reg ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 aarch64 %{arm}} - regexp ExclusiveArch: %{java_arches} noarch - relaxng-datatype-java ExclusiveArch: %{java_arches} noarch - remake ExcludeArch: %{ix86} - renderdoc ExclusiveArch: x86_64 aarch64 - replacer ExclusiveArch: %{java_arches} noarch - reptyr ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 - rescene ExclusiveArch: %{mono_arches} - resteasy ExclusiveArch: %{java_arches} noarch - restool ExclusiveArch: aarch64 - restsharp ExclusiveArch: %{mono_arches} ExcludeArch: armv7hl - retroarch ExcludeArch: %{ix86} ExcludeArch: s390x - retsnoop ExclusiveArch: %{rust_arches} ExcludeArch: armv7hl - rhino ExclusiveArch: %{java_arches} noarch ExcludeArch: %{ix86} - rhythmbox ExcludeArch: s390 s390x - rhythmbox-alternative-toolbar ExcludeArch: s390 s390x - rhythmbox-ampache ExcludeArch: s390 s390x - river ExclusiveArch: %{zig_arches} - rkcommon ExclusiveArch: x86_64 aarch64 - rocalution ExclusiveArch: x86_64 - rocblas ExclusiveArch: x86_64 - rocclr ExclusiveArch: x86_64 - rocfft ExclusiveArch: x86_64 - rocm-compilersupport ExclusiveArch: x86_64 aarch64 ppc64le - rocm-core ExclusiveArch: x86_64 - rocm-rpm-macros ExclusiveArch: x86_64 - rocm-runtime ExclusiveArch: x86_64 - rocm-smi ExclusiveArch: x86_64 aarch64 ppc64le riscv64 - rocminfo ExclusiveArch: x86_64 - rocprim ExclusiveArch: x86_64 - rocrand ExclusiveArch: x86_64 - rocsolver ExclusiveArch: x86_64 - rocsparse ExclusiveArch: x86_64 - rocthrust ExclusiveArch: x86_64 - roctracer ExclusiveArch: x86_64 - rpi-imager ExcludeArch: s390x - rpm-ostree ExclusiveArch: %{rust_arches} ExcludeArch: %{ix86} - rpy ExcludeArch: %{ix86} - rr ExclusiveArch: %{ix86} x86_64 aarch64 - rssguard ExclusiveArch: %{qt6_qtwebengine_arches} - rstudio ExclusiveArch: %{java_arches} - rsyntaxtextarea ExclusiveArch: %{java_arches} noarch - rubiks ExcludeArch: %{ix86} - rubygem-childprocess ExclusiveArch: %{ix86} x86_64 noarch - ruff ExcludeArch: %{ix86} - ruff-lsp ExcludeArch: %{ix86} - runc ExclusiveArch: %{golang_arches_future} - rundoc ExclusiveArch: %{java_arches} noarch - rust ExclusiveArch: %{rust_arches} - rust-bankstown-lv2 ExcludeArch: ppc64le s390x - rust-below ExcludeArch: %{arm32} %{ix86} - rust-below-btrfs ExcludeArch: %{arm32} %{ix86} - rust-below-config ExcludeArch: %{arm32} %{ix86} - rust-below-dump ExcludeArch: %{arm32} %{ix86} - rust-below-ethtool ExcludeArch: %{arm32} %{ix86} - rust-below-model ExcludeArch: %{arm32} %{ix86} - rust-below-render ExcludeArch: %{arm32} %{ix86} - rust-below-store ExcludeArch: %{arm32} %{ix86} - rust-below-view ExcludeArch: %{arm32} %{ix86} - rust-cgroupfs ExcludeArch: %{arm32} %{ix86} - rust-compress-tools ExclusiveArch: %{rust_arches} - rust-crypto-auditing-agent ExcludeArch: i386 i686 - rust-ct-logs ExcludeArch: ppc64le s390x - rust-ctr ExclusiveArch: %{rust_arches} - rust-dashmap4 ExclusiveArch: %{rust_arches} - rust-deflate ExclusiveArch: %{rust_arches} - rust-deflate0.8 ExclusiveArch: %{rust_arches} - rust-getch ExclusiveArch: %{rust_arches} - rust-gzip-header ExclusiveArch: %{rust_arches} - rust-hamming ExclusiveArch: %{rust_arches} - rust-hidapi ExclusiveArch: %{rust_arches} - rust-humantime-serde ExclusiveArch: %{rust_arches} - rust-hyperlocal ExclusiveArch: %{rust_arches} - rust-inflate ExclusiveArch: %{rust_arches} - rust-k9 ExclusiveArch: %{rust_arches} - rust-krunvm ExclusiveArch: x86_64 aarch64 - rust-kstring ExclusiveArch: %{rust_arches} - rust-kvm-bindings ExcludeArch: %{ix86} - rust-kvm-ioctls ExclusiveArch: x86_64 aarch64 - rust-lebe ExclusiveArch: %{rust_arches} - rust-lv2 ExcludeArch: ppc64le s390x - rust-lv2-atom ExcludeArch: ppc64le s390x - rust-lv2-core ExcludeArch: ppc64le s390x - rust-lv2-midi ExcludeArch: ppc64le s390x - rust-lv2-state ExcludeArch: ppc64le s390x - rust-lv2-sys ExcludeArch: ppc64le s390x - rust-lv2-time ExcludeArch: ppc64le s390x - rust-lv2-units ExcludeArch: ppc64le s390x - rust-lv2-urid ExcludeArch: ppc64le s390x - rust-lv2-worker ExcludeArch: ppc64le s390x - rust-msru ExclusiveArch: x86_64 - rust-netstat2 ExclusiveArch: %{rust_arches} - rust-nu ExcludeArch: %{ix86} - rust-oci-spec ExcludeArch: %{ix86} ExcludeArch: %{ix86} ExcludeArch: %{ix86} ExcludeArch: %{ix86} ExcludeArch: %{ix86} ExcludeArch: %{ix86} ExcludeArch: %{ix86} - rust-onig ExclusiveArch: %{rust_arches} - rust-openat-ext ExclusiveArch: %{rust_arches} - rust-os_type ExclusiveArch: %{rust_arches} - rust-pager ExclusiveArch: %{rust_arches} - rust-pathsearch ExclusiveArch: %{rust_arches} - rust-prefixdevname ExcludeArch: %{ix86} - rust-pretty-bytes ExclusiveArch: %{rust_arches} - rust-probe ExcludeArch: ppc64le s390x - rust-psl-types ExclusiveArch: %{rust_arches} - rust-psm ExclusiveArch: %{rust_arches} - rust-pwd ExclusiveArch: %{rust_arches} - rust-rand_core ExclusiveArch: %{rust_arches} - rust-resctrlfs ExcludeArch: %{arm32} %{ix86} - rust-schemafy_core ExclusiveArch: %{rust_arches} - rust-schemafy_lib ExclusiveArch: %{rust_arches} - rust-scx_layered ExcludeArch: %{ix86} - rust-scx_rustland ExcludeArch: %{ix86} - rust-scx_rusty ExcludeArch: %{ix86} - rust-scx_utils ExcludeArch: %{ix86} - rust-seahash ExclusiveArch: %{rust_arches} - rust-sequoia-octopus-librnp ExcludeArch: %{ix86} %{arm} s390x - rust-serde_yaml0.8 ExclusiveArch: %{rust_arches} - rust-sev ExclusiveArch: x86_64 - rust-sevctl ExclusiveArch: x86_64 - rust-sinit ExclusiveArch: %{rust_arches} - rust-snphost ExclusiveArch: x86_64 - rust-ssh-key-dir ExclusiveArch: %{rust_arches} - rust-stacker ExclusiveArch: %{rust_arches} - rust-structopt ExclusiveArch: %{rust_arches} - rust-tiny-dfr ExcludeArch: %{ix86} - rust-totp-lite ExclusiveArch: %{rust_arches} - rust-tower-layer ExclusiveArch: %{rust_arches} - rust-tpm2-policy ExclusiveArch: %{rust_arches} - rust-unicode-xid ExclusiveArch: %{rust_arches} - rust-uriparse ExclusiveArch: %{rust_arches} - rust-varlink_generator ExclusiveArch: %{rust_arches} - rust-varlink_parser ExclusiveArch: %{rust_arches} - rust-vhost-device-scmi ExcludeArch: s390x - rust-vhost-device-sound ExcludeArch: %{ix86} s390x - rust-virtio-bindings ExclusiveArch: x86_64 aarch64 ppc64le riscv64 - rust-virtio-queue ExcludeArch: i686 - rust-vm-memory ExcludeArch: %{ix86} - rust-vmm-sys-util ExclusiveArch: x86_64 aarch64 ppc64le riscv64 - rust-vtparse ExclusiveArch: %{rust_arches} - rust-web-ext-native-messaging ExclusiveArch: %{rust_arches} - rust-wezterm-color-types ExclusiveArch: %{rust_arches} - rust-wezterm-dynamic ExclusiveArch: %{rust_arches} - rust-wezterm-dynamic-derive ExclusiveArch: %{rust_arches} - rust-zbus1 ExclusiveArch: %{rust_arches} - rust-zbus_macros1 ExclusiveArch: %{rust_arches} - rust-zincati ExcludeArch: armv7hl i686 - rust-zvariant2 ExclusiveArch: %{rust_arches} - rust-zvariant_derive2 ExclusiveArch: %{rust_arches} - rustup ExclusiveArch: x86_64 aarch64 - rutabaga-gfx-ffi ExclusiveArch: x86_64 aarch64 - s2n-tls ExcludeArch: %{ix86} ExcludeArch: s390x - s390utils ExcludeArch: %{ix86} - sac ExclusiveArch: %{java_arches} noarch - safeint ExcludeArch: %{ix86} - safetyblanket ExclusiveArch: %{arm} %{ix86} x86_64 aarch64 ppc64le - sandia-omega-h ExcludeArch: %{ix86} s390x - sat4j ExclusiveArch: %{java_arches} noarch - sayonara ExcludeArch: %{ix86} - sbcl ExclusiveArch: %{ix86} x86_64 aarch64 %{power64} - sbd ExclusiveArch: i686 x86_64 s390x aarch64 ppc64le - sblim-cim-client ExclusiveArch: %{java_arches} noarch - sblim-cim-client2 ExclusiveArch: %{java_arches} noarch - sbsigntools ExclusiveArch: x86_64 aarch64 %{arm} %{ix86} - scala ExclusiveArch: %{java_arches} noarch - scalasca ExcludeArch: s390 s390x armv7hl i686 - scannotation ExclusiveArch: %{java_arches} noarch - scip ExcludeArch: %{ix86} - scorep ExcludeArch: s390 s390x armv7hl i686 - scx_c_schedulers ExcludeArch: %{ix86} - sdljava ExclusiveArch: %{java_arches} - sdrangel ExclusiveArch: %{qt5_qtwebengine_arches} - sdsl-lite ExclusiveArch: %{power64} x86_64 aarch64 - sdubby ExclusiveArch: %{efi} - seabios ExclusiveArch: x86_64 - seadrive-gui ExclusiveArch: %{qt5_qtwebengine_arches} - seafile-client ExclusiveArch: %{qt6_qtwebengine_arches} - seamonkey ExclusiveArch: x86_64 - sedutil ExcludeArch: ppc ppc64 s390 s390x - sentencepiece ExcludeArch: s390x - seqan3 ExclusiveArch: %{power64} x86_64 aarch64 - sequeler ExcludeArch: %{ix86} - sequence-library ExclusiveArch: %{java_arches} noarch - servicelog ExclusiveArch: ppc %{power64} - setserial ExcludeArch: s390 s390x - sfnt2woff-zopfli ExcludeArch: %{ix86} - sharedmeataxe ExcludeArch: %{ix86} - sharpfont ExclusiveArch: %mono_arches - sharpziplib ExclusiveArch: %{mono_arches} - shim ExclusiveArch: %{efi} ExcludeArch: %{ix86} ExcludeArch: %{arm} - shim-unsigned-aarch64 ExclusiveArch: aarch64 - shim-unsigned-x64 ExclusiveArch: x86_64 - sigil ExclusiveArch: %{qt5_qtwebengine_arches} ExcludeArch: %{ix86} - sigul ExclusiveArch: x86_64 ExcludeArch: %{ix86} - simdutf ExcludeArch: s390 s390x - singularity-ce ExclusiveArch: %{go_arches} ExcludeArch: %{ix86} - sirocco ExcludeArch: %{ix86} - sisu ExclusiveArch: %{java_arches} noarch - sisu-mojos ExclusiveArch: %{java_arches} noarch - skanpage ExclusiveArch: %{qt6_qtwebengine_arches} - ski ExcludeArch: %{ix86} ExcludeArch: aarch64 - skopeo ExclusiveArch: %{golang_arches_future} ExclusiveArch: aarch64 ppc64le s390x x86_64 - skychart ExclusiveArch: %{fpc_arches} ExcludeArch: %{ix86} - slapi-nis ExcludeArch: %{ix86} - sleef ExcludeArch: %{ix86} - slf4j ExclusiveArch: %{java_arches} noarch - slic3r ExcludeArch: %{ix86} ExcludeArch: ppc ppc64 s390 s390x %{ix86} ExcludeArch: ppc ppc64 s390 s390x - slick-greeter ExcludeArch: %{ix86} - slimdata ExcludeArch: ppc64 ppc sparcv9 sparc64 - slirp4netns ExclusiveArch: %{golang_arches_future} - slurm ExcludeArch: armv7hl ExcludeArch: i686 - smartmontools ExcludeArch: %{ix86} - snakeyaml ExclusiveArch: %{java_arches} noarch - snapd ExclusiveArch: %{?golang_arches}%{!?golang_arches:%{ix86} x86_64 %{arm} aarch64 ppc64le s390x} - snapshot ExcludeArch: %{ix86} - snip ExclusiveArch: %{java_arches} noarch - softnet-stat ExclusiveArch: %{rust_arches} - soplex ExcludeArch: %{ix86} - sound-juicer ExcludeArch: s390 s390x - soup-sharp ExclusiveArch: %{mono_arches} - sourcextractor++ ExcludeArch: %{ix86} - spacebar ExclusiveArch: %{java_arches} - sparkleshare ExclusiveArch: %{mono_arches} ExcludeArch: %{ix86} - spasm ExcludeArch: %{ix86} - spec-version-maven-plugin ExclusiveArch: %{java_arches} noarch - speed-dreams ExcludeArch: s390x - spicctrl ExclusiveArch: %{ix86} x86_64 - spice ExclusiveArch: x86_64 ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 riscv64 - spice-parent ExclusiveArch: %{java_arches} noarch - springlobby ExclusiveArch: %{ix86} x86_64 - spyder ExcludeArch: %{ix86} ExclusiveArch: %{qt5_qtwebengine_arches} noarch - squeekboard ExclusiveArch: %{rust_arches} ExcludeArch: ppc64le ExcludeArch: s390x - squirrel ExcludeArch: %{ix86} - startdde ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 %{arm}} - stats-collect ExclusiveArch: %{ix86} x86_64 noarch - statsd ExclusiveArch: %{nodejs_arches} noarch - statserial ExcludeArch: s390 s390x - steinberg-bravura-fonts ExcludeArch: %{ix86} - steinberg-petaluma-fonts ExcludeArch: %{ix86} - stellarium ExcludeArch: armv7hl - stlsplit ExcludeArch: %{ix86} - stp ExcludeArch: %{ix86} - stratis-cli ExclusiveArch: %{rust_arches} noarch ExcludeArch: i686 - stratisd ExclusiveArch: %{rust_arches} ExcludeArch: i686 ExclusiveArch: %{rust_arches} ExcludeArch: i686 ExclusiveArch: %{rust_arches} ExcludeArch: i686 - string-template-maven-plugin ExclusiveArch: %{java_arches} noarch - stringtemplate ExclusiveArch: %{java_arches} noarch - stringtemplate4 ExclusiveArch: %{java_arches} noarch - stripesnoop ExclusiveArch: %{ix86} x86_64 - subscription-manager-cockpit ExclusiveArch: %{nodejs_arches} noarch - supercollider ExclusiveArch: %{qt5_qtwebengine_arches} - supermin ExcludeArch: %{ix86} ExclusiveArch: %{kernel_arches} ExcludeArch: %{power64} - supertux ExcludeArch: s390x - suricata ExcludeArch: ppc64le i686 - svt-vp9 ExclusiveArch: x86_64 - swift-lang ExclusiveArch: x86_64 aarch64 - swiftlint ExclusiveArch: x86_64 aarch64 - swing-layout ExclusiveArch: %{java_arches} noarch - symfpu ExcludeArch: %{ix86} - symmetrica ExcludeArch: %{ix86} - sympol ExcludeArch: %{ix86} - sympow ExcludeArch: %{ix86} - synfig ExcludeArch: ppc64le - synfigstudio ExcludeArch: ppc64le - sysbench ExclusiveArch: %{arm} %{ix86} x86_64 %{mips} ExclusiveArch: %{arm} %{ix86} x86_64 %{mips} aarch64 ExclusiveArch: %{arm} %{ix86} x86_64 %{mips} aarch64 ppc64le s390x - syslinux ExclusiveArch: %{ix86} x86_64 ExclusiveArch: %{ix86} x86_64 - system-rules ExclusiveArch: %{java_arches} noarch - systemd-boot ExclusiveArch: %efi - t-digest ExclusiveArch: %{java_arches} noarch - taglib-sharp ExclusiveArch: %{mono_arches} - tagsoup ExclusiveArch: %{java_arches} noarch - tarantool ExclusiveArch: %{ix86} x86_64 - tboot ExclusiveArch: %{ix86} x86_64 - tcmu-runner ExcludeArch: i686 armv7hl - tdlib ExclusiveArch: x86_64 aarch64 - teem ExcludeArch: %{ix86} - templates_parser ExclusiveArch: %GPRbuild_arches - terminology ExcludeArch: s390x - terminus-fonts ExcludeArch: %{grub2_exclude_arches} - ternimal ExclusiveArch: %{rust_arches} - testcloud ExclusiveArch: %{kernel_arches} noarch - testng ExclusiveArch: %{java_arches} noarch - texlive ExclusiveArch: %{java_arches} noarch - texmaker ExclusiveArch: %{qt6_qtwebengine_arches} ExcludeArch: ppc64 ppc64le s390x - thermald ExclusiveArch: %{ix86} x86_64 - thunderbird ExcludeArch: armv7hl ExcludeArch: s390x - tiled ExcludeArch: %{ix86} - tilix ExclusiveArch: %{ldc_arches} - tinygo ExcludeArch: ppc64le s390x ExcludeArch: %{ix86} - tokodon ExclusiveArch: %{qt6_qtwebengine_arches} - tomboy ExclusiveArch: %{mono_arches} - tomcat ExclusiveArch: %{java_arches} noarch - tomcat-jakartaee-migration ExclusiveArch: %{java_arches} noarch - tomcat-native ExclusiveArch: %{java_arches} - tomcat-taglibs-parent ExclusiveArch: %{java_arches} noarch - torbrowser-launcher ExclusiveArch: %{ix86} x86_64 - trace-cmd ExcludeArch: %{ix86} %{arm} - trafficserver ExcludeArch: %{arm} %{ix86} s390x - treelayout ExclusiveArch: %{java_arches} noarch - trilead-ssh2 ExclusiveArch: %{java_arches} noarch - trojita ExcludeArch: ppc64 ppc64le s390x - trunk ExcludeArch: %{ix86} - truth ExclusiveArch: %{java_arches} noarch - tth ExcludeArch: %{ix86} - tuned-profiles-nfv-host-bin ExclusiveArch: %{ix86} x86_64 - tuxguitar ExcludeArch: s390 %{arm} %{ix86} - tvtime ExcludeArch: s390 s390x - typescript ExclusiveArch: %{nodejs_arches} noarch - tzdata ExcludeArch: i686 - uClibc ExclusiveArch: %{arm} %{ix86} x86_64 %{mips} - uboot-tools ExcludeArch: s390x - ucx ExclusiveArch: aarch64 ppc64le x86_64 - uglify-js ExclusiveArch: %{nodejs_arches} noarch - ugrep ExcludeArch: %{ix86} - umr ExclusiveArch: x86_64 aarch64 ppc64le - unetbootin ExclusiveArch: %{ix86} x86_64 - unicorn ExcludeArch: s390x - unison ExcludeArch: %{ix86} - univocity-parsers ExclusiveArch: %{java_arches} noarch - ursa-major ExclusiveArch: noarch aarch64 ppc64le s390x x86_64 - usbip ExcludeArch: s390x - usd ExclusiveArch: aarch64 x86_64 - usnic-tools ExcludeArch: %{arm} - utop ExcludeArch: %{ix86} - uwsgi ExcludeArch: %{ix86} - v-hacd ExcludeArch: %{ix86} - v8-314 ExclusiveArch: %{ix86} x86_64 %{arm} mips mipsel ppc ppc64 - vakzination ExclusiveArch: %{java_arches} - valgrind ExclusiveArch: %{ix86} x86_64 ppc ppc64 ppc64le s390x armv7hl aarch64 - valkey ExcludeArch: %{ix86} - vboot-utils ExclusiveArch: %{arm} aarch64 %{ix86} x86_64 - vdo ExcludeArch: %{ix86} - vdr-tvscraper ExcludeArch: armv7hl - vecmath1.2 ExclusiveArch: %{java_arches} noarch - vectorscan ExcludeArch: s390x - velocity ExclusiveArch: %{java_arches} noarch - viking ExcludeArch: s390 s390x - vim-go ExclusiveArch: %{?golang_arches}%{!?golang_arches:%{ix86} x86_64 %{arm}} - vim-perl-support ExcludeArch: %{ix86} - vim-syntastic ExclusiveArch: %{java_arches} noarch - vinci ExcludeArch: %{ix86} - virt-p2v ExclusiveArch: x86_64 - virt-top ExcludeArch: %{ix86} ExcludeArch: %{power64} - virt-v2v ExcludeArch: %{ix86} ExclusiveArch: x86_64 - virtiofsd ExclusiveArch: %{rust_arches} ExcludeArch: i686 - virtualbox-guest-additions ExclusiveArch: i686 x86_64 - visidata ExcludeArch: %{ix86} - visualboyadvance-m ExcludeArch: %{ix86} - vkd3d ExclusiveArch: %{ix86} x86_64 %{arm} ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 - vkmark ExcludeArch: s390x - vmaf ExclusiveArch: x86_64 - voms-api-java ExclusiveArch: %{java_arches} noarch - voms-clients-java ExclusiveArch: %{java_arches} noarch - votca ExcludeArch: %{ix86} - vrq ExclusiveArch: %{ix86} x86_64 - wangle ExclusiveArch: x86_64 aarch64 ppc64le riscv64 - warsow ExclusiveArch: %{ix86} x86_64 %{arm} - warsow-data ExclusiveArch: %{ix86} x86_64 %{arm} noarch ExclusiveArch: %{ix86} x86_64 %{arm} - warzone2100 ExcludeArch: %{ix86} - wasmedge ExclusiveArch: x86_64 aarch64 - watchman ExclusiveArch: x86_64 aarch64 ppc64le riscv64 - wdt ExclusiveArch: x86_64 aarch64 ppc64le - webkit2-sharp ExclusiveArch: %mono_arches - weld-parent ExclusiveArch: %{java_arches} noarch - whatip ExcludeArch: s390x - whipper ExcludeArch: s390x - whisper-cpp ExclusiveArch: x86_64 aarch64 ppc64le - why3 ExclusiveArch: %{ocaml_native_compiler} - widevine-installer ExclusiveArch: aarch64 - wildcard ExcludeArch: %{ix86} s390x - wine ExclusiveArch: %{ix86} x86_64 aarch64 ExclusiveArch: %{ix86} x86_64 ExclusiveArch: %{ix86} - wine-dxvk ExclusiveArch: %{ix86} x86_64 - wine-mono ExcludeArch: %{power64} s390x s390 - winetricks ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 ExcludeArch: ppc64 ppc64le - wlmaker ExcludeArch: %{ix86} ppc64le - woff ExcludeArch: %{ix86} - workrave ExcludeArch: %{ix86} - ws-commons-util ExclusiveArch: %{java_arches} noarch - wsdl4j ExclusiveArch: %{java_arches} noarch - wult ExclusiveArch: x86_64 - wxMaxima ExclusiveArch: %{arm} %{ix86} x86_64 aarch64 ppc sparcv9 - x2goclient ExclusiveArch: x86_64 - x2gokdrive ExcludeArch: %{ix86} - x86-simd-sort ExclusiveArch: x86_64 - xalan-j2 ExclusiveArch: %{java_arches} noarch - xapps ExcludeArch: %{ix86} - xbean ExclusiveArch: %{java_arches} noarch - xbyak ExclusiveArch: x86_64 - xbyak_aarch64 ExclusiveArch: aarch64 - xdg-desktop-portal ExcludeArch: %{ix86} - xdg-desktop-portal-gnome ExcludeArch: %{ix86} - xdg-desktop-portal-gtk ExcludeArch: %{ix86} - xdg-desktop-portal-hyprland ExcludeArch: %{ix86} - xe-guest-utilities-latest ExclusiveArch: %{ix86} x86_64 - xed ExcludeArch: %{ix86} - xen ExclusiveArch: x86_64 aarch64 - xephem ExcludeArch: %{ix86} - xerces-j2 ExclusiveArch: %{java_arches} noarch - xeus ExcludeArch: %{ix86} - xeus-zmq ExcludeArch: %{ix86} - xfce4-sensors-plugin ExcludeArch: s390 s390x - xgap ExcludeArch: %{ix86} - xiphos ExcludeArch: ppc64 - xml-commons-apis ExclusiveArch: %{java_arches} noarch - xml-commons-resolver ExclusiveArch: %{java_arches} noarch - xml-maven-plugin ExclusiveArch: %{java_arches} noarch - xmlada ExclusiveArch: %{GPRbuild_arches} - xmlgraphics-commons ExclusiveArch: %{java_arches} noarch - xmlpull ExclusiveArch: %{java_arches} noarch - xmlstreambuffer ExclusiveArch: %{java_arches} noarch - xmlunit ExclusiveArch: %{java_arches} noarch - xmvn ExclusiveArch: %{java_arches} noarch - xmvn-connector-ivy ExclusiveArch: %{java_arches} noarch - xmvn-generator ExclusiveArch: %{java_arches} - xnnpack ExclusiveArch: x86_64 aarch64 - xnvme ExcludeArch: %{ix86} - xorg-x11-drv-amdgpu ExcludeArch: s390 s390x - xorg-x11-drv-armsoc ExclusiveArch: %{arm} aarch64 - xorg-x11-drv-ati ExcludeArch: s390 s390x - xorg-x11-drv-fbdev ExcludeArch: s390 s390x - xorg-x11-drv-intel ExclusiveArch: %{ix86} x86_64 - xorg-x11-drv-nouveau ExcludeArch: s390 s390x - xorg-x11-drv-openchrome ExclusiveArch: %{ix86} x86_64 - xorg-x11-drv-qxl ExcludeArch: s390 s390x - xorg-x11-drv-synaptics ExcludeArch: s390 s390x - xorg-x11-drv-vesa ExclusiveArch: %{ix86} x86_64 - xorg-x11-drv-vmware ExclusiveArch: %{ix86} x86_64 ia64 - xreader ExcludeArch: %{ix86} - xrgears ExcludeArch: %{ix86} - xsensors ExcludeArch: %{ix86} - xsp ExclusiveArch: %mono_arches - xstream ExclusiveArch: %{java_arches} noarch - xtb ExcludeArch: s390x - xtensor-python ExcludeArch: armv7hl ppc64le s390x - xz-java ExclusiveArch: %{java_arches} noarch - yarnpkg ExclusiveArch: %{nodejs_arches} - yices ExcludeArch: %{ix86} - yle-dl ExcludeArch: %{ix86} - yosys ExcludeArch: %{ix86} ExcludeArch: s390x - zcfan ExclusiveArch: x86_64 - zeal ExclusiveArch: aarch64 x86_64 - zenon ExclusiveArch: %{ocaml_native_compiler} - zeromq-ada ExclusiveArch: %{GPRbuild_arches} - zfs-fuse ExcludeArch: s390 s390x aarch64 - zig ExclusiveArch: %{zig_arches} - zile ExcludeArch: ppc64le - zimpl ExcludeArch: %{ix86} - zlib-ada ExclusiveArch: %{GPRbuild_arches} - zola ExclusiveArch: %{rust_arches} - zstr ExcludeArch: %{ix86} - zxcvbn-c ExcludeArch: %{ix86} - zycore-c ExcludeArch: s390x - zydis ExcludeArch: s390x

1 0

Architecture specific change in rpms/python-torch.git
by githook-noreply＠fedoraproject.org 11 Jun '24

11 Jun '24

The package rpms/python-torch.git has added or updated architecture specific content in its spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s): https://src.fedoraproject.org/cgit/rpms/python-torch.git/commit/?id=d4bfc26…. Change: +%ifarch x86_64 Thanks. Full change: ============ commit 93593886f97b2ce3a13b7a777402918456d61160 Author: Tom Rix <trix(a)redhat.com> Date: Tue Jun 11 05:27:49 2024 -0600 Reduce amd gpu list on F40 Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/python-torch.spec b/python-torch.spec index 6f102ca..ea60d27 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -33,7 +33,12 @@ # hipblaslt is in development %bcond_with hipblaslt # Which families gpu build for +%if 0%{?fedora} > 40 %global rocm_gpu_list gfx8 gfx9 gfx10 gfx11 gfx90a gfx942 gfx1100 +%else +# F40 +%global rocm_gpu_list gfx8 gfx9 gfx10 gfx11 +%endif %global rocm_default_gpu default %bcond_without rocm_loop @@ -436,6 +441,7 @@ Summary: %{name} for ROCm gfx11 %description -n python3-%{pypi_name}-rocm-gfx11 %{summary} +%if 0%{?fedora} > 40 %package -n python3-%{pypi_name}-rocm-gfx90a Summary: %{name} for ROCm MI200 %description -n python3-%{pypi_name}-rocm-gfx90a @@ -450,6 +456,7 @@ Summary: %{name} for ROCm MI300 Summary: %{name} for W7900 %description -n python3-%{pypi_name}-rocm-gfx1100 %{summary} +%endif %endif @@ -985,6 +992,7 @@ done %{_libdir}/rocm/gfx11/bin/* %{_libdir}/rocm/gfx11/lib64/* +%if 0%{?fedora} > 40 %files -n python3-%{pypi_name}-rocm-gfx90a %{_libdir}/rocm/gfx90a/bin/* %{_libdir}/rocm/gfx90a/lib64/* @@ -996,6 +1004,7 @@ done %files -n python3-%{pypi_name}-rocm-gfx1100 %{_libdir}/rocm/gfx1100/bin/* %{_libdir}/rocm/gfx1100/lib64/* +%endif %endif commit e492aac4994aba4a86514dc5e3bdc875b457ff66 Merge: 7afc241 4189bb9 Author: Tom Rix <trix(a)redhat.com> Date: Tue Jun 11 05:22:31 2024 -0600 Merge branch 'rawhide' into f40 Update to 2.3.1 Signed-off-by: Tom Rix <trix(a)redhat.com> commit 7afc241f032444774c4313810c5f069b94cfec61 Author: Tom Rix <trix(a)redhat.com> Date: Tue Jun 11 05:22:14 2024 -0600 Revert "Provide pytorch as a convience" This reverts commit 4d6bb6e14ab10a171dd2b5d07f7511e607d0aa88. diff --git a/python-torch.spec b/python-torch.spec index 5cd6d3c..5f4e2e0 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -179,9 +179,6 @@ BuildRequires: google-benchmark-devel Provides: bundled(miniz) = 2.1.0 -# For convience -Provides: pytorch - %description PyTorch is a Python package that provides two high-level features: commit 6f71567388e73c5e62eee8db4eab26de33359092 Author: Tom Rix <trix(a)redhat.com> Date: Tue Jun 11 05:21:43 2024 -0600 Revert "Add a few missing files to install" This reverts commit f75a38ed41cfa465f486bf56ad53969aa221e432. diff --git a/python-torch.spec b/python-torch.spec index ed7b039..5cd6d3c 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -443,10 +443,10 @@ sed -i -f br.sed devel.files %{python3_sitearch}/torch/utils/model_dump/{*.js,*.mjs,*.html} %{python3_sitearch}/torchgen/packaged/ATen/native/*.yaml %{python3_sitearch}/torchgen/packaged/autograd/{*.md,*.yaml} -%{python3_sitearch}/torch/distributed/pipeline/sync/_balance/py.typed -%{python3_sitearch}/torch/distributed/pipeline/sync/py.typed %if %{with gitcommit} %{python3_sitearch}/torch/_export/serde/schema.yaml +%{python3_sitearch}/torch/distributed/pipeline/sync/_balance/py.typed +%{python3_sitearch}/torch/distributed/pipeline/sync/py.typed %endif # egg commit 11bcbe02b2110b1f197f5c05db4fa1c237d1b505 Author: Tom Rix <trix(a)redhat.com> Date: Tue Jun 11 05:21:07 2024 -0600 Revert "Rebuild for libonnx" This reverts commit 4f4ba3564bd04c7bf591d119a9ddfc46da8f5873. diff --git a/python-torch.spec b/python-torch.spec index 540a467..ed7b039 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -845,9 +845,6 @@ sed -i -f br.sed devel.files # aten/src/ATen/native/cpu/avx_mathfun.h %changelog -* Mon Apr 15 2024 Tom Rix <trix(a)redhat.com> - 2.1.2-4 -- Rebuilt for libonnx - * Fri Jan 26 2024 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.1.2-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild commit 4189bb90d9bd37f635d7edf6ecff9e6f50ce96ff Author: Tom Rix <trix(a)redhat.com> Date: Mon Jun 10 14:04:38 2024 -0400 Start a readme for NVIDIA For brave folks that will build manually their own rpms, here is some help. Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/README.NVIDIA b/README.NVIDIA new file mode 100644 index 0000000..b927f47 --- /dev/null +++ b/README.NVIDIA @@ -0,0 +1,15 @@ +Some help for building this package for NVIDIA/CUDA + +Review NVIDIA's documenation +https://docs.nvidia.com/cuda/cuda-installation-guide-linux/index.html + +Review PyTorch documentation +https://github.com/pytorch/pytorch#from-source + +Some convience strings to cut-n-paste + +F39 +dnf config-manager --add-repo https://developer.download.nvidia.com/compute/cuda/repos/fedora39/x86_64/cu… + +Building is local. +Build machine has a supported GPU, the drivers are loaded and CUDA SDK is installed. commit 0073eb52605fbe5f40b61887f925530bdcba6599 Author: Tom Rix <trix(a)redhat.com> Date: Mon Jun 10 14:03:07 2024 -0400 Fix the normal build. Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/python-torch.spec b/python-torch.spec index e066b5d..6f102ca 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -181,6 +181,7 @@ Source40: https://github.com/Maratyszcza/pthreadpool/archive/%{pt_commit}/ Source50: https://github.com/mreineck/pocketfft/archive/%{pf_commit}/pocketfft-%{pf_s… %endif +%if %{with gitcommit} %if %{without opentelemetry} %global ot_ver 1.14.2 Source60: https://github.com/open-telemetry/opentelemetry-cpp/archive/refs/tags/v%{ot… @@ -197,6 +198,7 @@ Source70: https://github.com/yhirose/cpp-httplib/archive/%{hl_commit}/cpp- %global ki_scommit %(c=%{ki_commit}; echo ${c:0:7}) Source80: https://github.com/pytorch/kineto/archive/%{ki_commit}/kineto-%{ki_scommit}… %endif +%endif Patch0: 0001-no-third_party-foxi.patch @@ -530,6 +532,7 @@ rm -rf third_party/pocketfft/* cp -r pocketfft-*/* third_party/pocketfft/ %endif +%if %{with gitcommit} %if %{without opentelemtry} tar xf %{SOURCE60} rm -rf third_party/opentelemetry-cpp/* @@ -547,6 +550,7 @@ tar xf %{SOURCE80} rm -rf third_party/kineto/* cp -r kineto-*/* third_party/kineto/ %endif +%endif %if %{with opencv} %if %{without gitcommit} commit 81b0cc6197554b7249e1b1235371914313422b0d Author: Tom Rix <trix(a)redhat.com> Date: Sun Jun 9 14:26:28 2024 -0400 Update gitcommit Fixup CUDA build on F39 Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/python-torch.spec b/python-torch.spec index acd8726..e066b5d 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -7,9 +7,9 @@ %bcond_with gitcommit %if %{with gitcommit} # ToT -%global commit0 6e545392cd27b9ee14a86cf6189c71211e79205d +%global commit0 75b0720a97ac5d82e8a7a1a6ae7c5f7a87d7183d %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) -%global date0 20240605 +%global date0 20240609 %global pypi_version 2.4.0 %else %global pypi_version 2.3.1 @@ -96,6 +96,23 @@ %define _find_debuginfo_dwz_opts %{nil} %endif +%if %{with cuda} +# workaround problems with -pie +%global build_cxxflags %{nil} +%global build_ldflags %{nil} +%endif + +# These came in 2.4 and not yet in Fedora +%if %{with gitcommit} +%bcond_with opentelemetry +%bcond_with httplib +%bcond_with kineto +%else +%bcond_without opentelemetry +%bcond_without httplib +%bcond_without kineto +%endif + Name: python-%{pypi_name} %if %{with gitcommit} Version: %{pypi_version}^git%{date0}.%{shortcommit0} @@ -110,7 +127,7 @@ License: BSD-3-Clause AND BSD-2-Clause AND 0BSD AND Apache-2.0 AND MIT AN URL: https://pytorch.org/ %if %{with gitcommit} Source0: %{forgeurl}/archive/%{commit0}/pytorch-%{shortcommit0}.tar.gz -Source100: pyproject.toml +Source1000: pyproject.toml %else Source0: %{forgeurl}/releases/download/v%{version}/pytorch-v%{version}.tar.gz %endif @@ -164,8 +181,28 @@ Source40: https://github.com/Maratyszcza/pthreadpool/archive/%{pt_commit}/ Source50: https://github.com/mreineck/pocketfft/archive/%{pf_commit}/pocketfft-%{pf_s… %endif +%if %{without opentelemetry} +%global ot_ver 1.14.2 +Source60: https://github.com/open-telemetry/opentelemetry-cpp/archive/refs/tags/v%{ot… +%endif + +%if %{without httplib} +%global hl_commit 3b6597bba913d51161383657829b7e644e59c006 +%global hl_scommit %(c=%{hl_commit}; echo ${c:0:7}) +Source70: https://github.com/yhirose/cpp-httplib/archive/%{hl_commit}/cpp-httplib-%{h… +%endif + +%if %{without kineto} +%global ki_commit be1317644c68b4bfc4646024a6b221066e430031 +%global ki_scommit %(c=%{ki_commit}; echo ${c:0:7}) +Source80: https://github.com/pytorch/kineto/archive/%{ki_commit}/kineto-%{ki_scommit}… +%endif + Patch0: 0001-no-third_party-foxi.patch + +%if %{without gitcommit} Patch3: 0001-Stub-in-kineto-ActivityType.patch +%endif %if %{with caffe2} Patch6: 0001-reenable-foxi-linking.patch @@ -182,8 +219,11 @@ Patch7: 0001-Reenable-dim-for-python-3.12.patch %endif # ROCm patches -# https://github.com/pytorch/pytorch/pull/120551 +# Patches need to be refactored for ToT +%if %{without gitcommit} +# These are ROCm packages %if %{without cuda} +# https://github.com/pytorch/pytorch/pull/120551 Patch100: 0001-Optionally-use-hipblaslt.patch Patch101: 0001-cuda-hip-signatures.patch Patch102: 0001-silence-an-assert.patch @@ -191,6 +231,7 @@ Patch103: 0001-can-not-use-with-c-files.patch Patch104: 0001-use-any-hip.patch Patch105: 0001-disable-use-of-aotriton.patch %endif +%endif ExclusiveArch: x86_64 aarch64 %global toolchain gcc @@ -425,7 +466,7 @@ Requires: python3-%{pypi_name}%{?_isa} = %{version}-%{release} %if %{with gitcommit} %autosetup -p1 -n pytorch-%{commit0} # Overwrite with a git checkout of the pyproject.toml -cp %{SOURCE100} . +cp %{SOURCE1000} . %else %autosetup -p1 -n pytorch-v%{version} %endif @@ -489,6 +530,24 @@ rm -rf third_party/pocketfft/* cp -r pocketfft-*/* third_party/pocketfft/ %endif +%if %{without opentelemtry} +tar xf %{SOURCE60} +rm -rf third_party/opentelemetry-cpp/* +cp -r opentelemetry-cpp-*/* third_party/opentelemetry-cpp/ +%endif + +%if %{without httplib} +tar xf %{SOURCE70} +rm -rf third_party/cpp-httplib/* +cp -r cpp-httplib-*/* third_party/cpp-httplib/ +%endif + +%if %{without kineto} +tar xf %{SOURCE80} +rm -rf third_party/kineto/* +cp -r kineto-*/* third_party/kineto/ +%endif + %if %{with opencv} %if %{without gitcommit} # Reduce requirements, *FOUND is not set @@ -570,6 +629,18 @@ mv third_party/pthreadpool . mv third_party/pocketfft . %endif +%if %{without opentelemetry} +mv third_party/opentelemetry-cpp . +%endif + +%if %{without httplib} +mv third_party/cpp-httplib . +%endif + +%if %{without kineto} +mv third_party/kineto . +%endif + %if %{with test} mv third_party/googletest . %endif @@ -606,6 +677,18 @@ mv pthreadpool third_party mv pocketfft third_party %endif +%if %{without opentelemetry} +mv opentelemetry-cpp third_party +%endif + +%if %{without httplib} +mv cpp-httplib third_party +%endif + +%if %{without kineto} +mv kineto third_party +%endif + %if %{with test} mv googletest third_party %endif @@ -636,8 +719,9 @@ sed -i -e 's@rocm-core/rocm_version.h@rocm_version.h@' aten/src/ATen/hip/tunable %endif %if %{with cuda} -# build complains about not being able to build -pie without -fPIC -sed -i -e 's@string(APPEND CMAKE_CUDA_FLAGS " -D_GLIBCXX_USE_CXX11_ABI=${GLIBCXX_USE_CXX11_ABI}")@string(APPEND CMAKE_CUDA_FLAGS " -fPIC -D_GLIBCXX_USE_CXX11_ABI=${GLIBCXX_USE_CXX11_ABI}")@' CMakeLists.txt + +# TBD + %endif %build @@ -684,7 +768,10 @@ export FC=%{_bindir}/gfortran%{compat_gcc_major} # export CMAKE_SHARED_LINKER_FLAGS=-Wl,--verbose # Manually set this hardening flag +# CUDA is unhappy with pie, so do not use it +%if %{without cuda} export CMAKE_EXE_LINKER_FLAGS=-pie +%endif export BUILD_CUSTOM_PROTOBUF=OFF export BUILD_NVFUSER=OFF @@ -712,7 +799,9 @@ export USE_NNPACK=OFF export USE_NUMPY=ON export USE_OPENMP=ON export USE_PYTORCH_QNNPACK=OFF +%if %{without gitcommit} export USE_QNNPACK=OFF +%endif export USE_ROCM=OFF export USE_SYSTEM_CPUINFO=ON export USE_SYSTEM_SLEEF=ON commit 4f7937aa0d9322d4078305e9789bc61a07fdb27f Author: Tom Rix <trix(a)redhat.com> Date: Sun Jun 9 09:46:55 2024 -0600 Update to 2.3.1 Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/.gitignore b/.gitignore index 5038800..315fe1c 100644 --- a/.gitignore +++ b/.gitignore @@ -11,3 +11,4 @@ /libnop-910b558.tar.gz /pytorch-97ff6cf.tar.gz /pytorch-v2.3.0.tar.gz +/pytorch-v2.3.1.tar.gz diff --git a/python-torch.spec b/python-torch.spec index 5cef39a..acd8726 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -12,7 +12,7 @@ %global date0 20240605 %global pypi_version 2.4.0 %else -%global pypi_version 2.3.0 +%global pypi_version 2.3.1 %endif # For -test subpackage @@ -177,7 +177,8 @@ Patch6: 0001-reenable-foxi-linking.patch Patch7: 0001-Reenable-dim-for-python-3.12.patch # Dynamo/Inductor on 3.12 -Patch8: 0001-dynamo-3.12-enable-dynamo-on-3.12-enable-most-dynamo.patch +# Fails to apply on 2.3.1 +# Patch8: 0001-dynamo-3.12-enable-dynamo-on-3.12-enable-most-dynamo.patch %endif # ROCm patches diff --git a/sources b/sources index 10cd24e..60cce58 100644 --- a/sources +++ b/sources @@ -11,3 +11,4 @@ SHA512 (v1.41.0.tar.gz) = bb08a1970a10e8d9571ffea3d021643de30ec212cd51317b98d6cf SHA512 (libnop-910b558.tar.gz) = 74c5324eaa1b6b2ac8dfef94c835b5c5b044625f8e5efe3522470b1ecc4798ff43d344a013cee2f6901e83267c6167072947b754e63f1552ae7044cffe234c36 SHA512 (pytorch-97ff6cf.tar.gz) = 105ebcba298558fe833f90e7e40b003d35a74609e777f9dc4c47f5668c884f603455113ac0ff252a62b83c81137ae66ceb1a862d351203925dcfc3dcf9f73580 SHA512 (pytorch-v2.3.0.tar.gz) = 0c2ffc7bf2fd86070e9958c34eca1f03a0248a011ac6ffaeb69f65306ff856edd5359986f02af25888433187e6d7f29b60edded092e2ac30c8cec49023166eda +SHA512 (pytorch-v2.3.1.tar.gz) = fe132251b2bae87b70ba3d95dc32f6a4545970d11893118b0ebe6ca129732e516ef4d6cc4f380b3db9bb2277d1db8ce78a401c40149bb1dfbab76eab9e3992c4 commit f33a5cb176d270753e02d6162f55f3f6f34886b2 Author: Tom Rix <trix(a)redhat.com> Date: Sat Jun 8 13:43:02 2024 -0600 Add --with compat_gcc Experimental gcc 13 on rawhide. Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/python-torch.spec b/python-torch.spec index 38c70c9..5cef39a 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -87,6 +87,10 @@ %bcond_with cuda %endif +# For testing compat-gcc +%global compat_gcc_major 13 +%bcond_with compat_gcc + # Disable dwz with rocm because memory can be exhausted %if %{with rocm} %define _find_debuginfo_dwz_opts %{nil} @@ -198,8 +202,15 @@ BuildRequires: fmt-devel %if %{with caffe2} BuildRequires: foxi-devel %endif + +%if %{with compat_gcc} +BuildRequires: compat-gcc-%{compat_gcc_major}-c++ +BuildRequires: compat-gcc-%{compat_gcc_major}-gfortran +%else BuildRequires: gcc-c++ BuildRequires: gcc-gfortran +%endif + %if %{with distributed} %if %{with gloo} BuildRequires: gloo-devel @@ -657,6 +668,12 @@ if [ "$COMPILE_JOBS_MEM" -lt "$COMPILE_JOBS" ]; then fi export MAX_JOBS=$COMPILE_JOBS +%if %{with compat_gcc} +export CC=%{_bindir}/gcc%{compat_gcc_major} +export CXX=%{_bindir}/g++%{compat_gcc_major} +export FC=%{_bindir}/gfortran%{compat_gcc_major} +%endif + # For debugging setup.py # export SETUPTOOLS_SCM_DEBUG=1 @@ -799,8 +816,13 @@ done %install -%if %{with rocm} +%if %{with compat_gcc} +export CC=%{_bindir}/gcc%{compat_gcc_major} +export CXX=%{_bindir}/g++%{compat_gcc_major} +export FC=%{_bindir}/gfortran%{compat_gcc_major} +%endif +%if %{with rocm} export USE_ROCM=ON export HIP_PATH=`hipconfig -p` export ROCM_PATH=`hipconfig -R` commit cefcc3d9e05c487b92c8e89157a3a79f74660a49 Author: Tom Rix <trix(a)redhat.com> Date: Sat Jun 8 12:04:20 2024 -0400 Do not apply ROCm patches with CUDA build Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/python-torch.spec b/python-torch.spec index 20eaf4c..38c70c9 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -178,12 +178,14 @@ Patch8: 0001-dynamo-3.12-enable-dynamo-on-3.12-enable-most-dynamo.patch # ROCm patches # https://github.com/pytorch/pytorch/pull/120551 +%if %{without cuda} Patch100: 0001-Optionally-use-hipblaslt.patch Patch101: 0001-cuda-hip-signatures.patch Patch102: 0001-silence-an-assert.patch Patch103: 0001-can-not-use-with-c-files.patch Patch104: 0001-use-any-hip.patch Patch105: 0001-disable-use-of-aotriton.patch +%endif ExclusiveArch: x86_64 aarch64 %global toolchain gcc commit a4bcccda6053d05eb1d5697ae9923ec086b79e7b Author: Tom Rix <trix(a)redhat.com> Date: Thu Jun 6 18:17:37 2024 -0600 Do not conditionally patch Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/python-torch.spec b/python-torch.spec index dd642eb..20eaf4c 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -176,7 +176,6 @@ Patch7: 0001-Reenable-dim-for-python-3.12.patch Patch8: 0001-dynamo-3.12-enable-dynamo-on-3.12-enable-most-dynamo.patch %endif -%if %{with rocm} # ROCm patches # https://github.com/pytorch/pytorch/pull/120551 Patch100: 0001-Optionally-use-hipblaslt.patch @@ -185,7 +184,6 @@ Patch102: 0001-silence-an-assert.patch Patch103: 0001-can-not-use-with-c-files.patch Patch104: 0001-use-any-hip.patch Patch105: 0001-disable-use-of-aotriton.patch -%endif ExclusiveArch: x86_64 aarch64 %global toolchain gcc commit abd06324b23d5f508a00d3f368a3de0324876ee7 Author: Tom Rix <trix(a)redhat.com> Date: Thu Jun 6 15:54:22 2024 -0600 Update for ROCm 6.1.1 Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/python-torch.spec b/python-torch.spec index d50687a..dd642eb 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -33,7 +33,7 @@ # hipblaslt is in development %bcond_with hipblaslt # Which families gpu build for -%global rocm_gpu_list gfx8 gfx9 gfx10 gfx11 +%global rocm_gpu_list gfx8 gfx9 gfx10 gfx11 gfx90a gfx942 gfx1100 %global rocm_default_gpu default %bcond_without rocm_loop @@ -381,6 +381,21 @@ Summary: %{name} for ROCm gfx11 %description -n python3-%{pypi_name}-rocm-gfx11 %{summary} +%package -n python3-%{pypi_name}-rocm-gfx90a +Summary: %{name} for ROCm MI200 +%description -n python3-%{pypi_name}-rocm-gfx90a +%{summary} + +%package -n python3-%{pypi_name}-rocm-gfx942 +Summary: %{name} for ROCm MI300 +%description -n python3-%{pypi_name}-rocm-gfx942 +%{summary} + +%package -n python3-%{pypi_name}-rocm-gfx1100 +Summary: %{name} for W7900 +%description -n python3-%{pypi_name}-rocm-gfx1100 +%{summary} + %endif %if %{with test} @@ -853,6 +868,19 @@ done %files -n python3-%{pypi_name}-rocm-gfx11 %{_libdir}/rocm/gfx11/bin/* %{_libdir}/rocm/gfx11/lib64/* + +%files -n python3-%{pypi_name}-rocm-gfx90a +%{_libdir}/rocm/gfx90a/bin/* +%{_libdir}/rocm/gfx90a/lib64/* + +%files -n python3-%{pypi_name}-rocm-gfx942 +%{_libdir}/rocm/gfx942/bin/* +%{_libdir}/rocm/gfx942/lib64/* + +%files -n python3-%{pypi_name}-rocm-gfx1100 +%{_libdir}/rocm/gfx1100/bin/* +%{_libdir}/rocm/gfx1100/lib64/* + %endif %changelog commit 511c020e436c5fb852151f714418f10645609072 Author: Tom Rix <trix(a)redhat.com> Date: Wed Jun 5 14:07:59 2024 -0600 Update the ToT git commit This broke the 0001-disable-submodule-serach.patch. So convert patch into a sed command. Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/0001-disable-submodule-search.patch b/0001-disable-submodule-search.patch deleted file mode 100644 index b830fa6..0000000 --- a/0001-disable-submodule-search.patch +++ /dev/null @@ -1,25 +0,0 @@ -From e0b0ea90ecc0dbefc6aef2650e88ba88260935b9 Mon Sep 17 00:00:00 2001 -From: Tom Rix <trix(a)redhat.com> -Date: Fri, 29 Sep 2023 17:21:13 -0700 -Subject: [PATCH] disable submodule search - ---- - setup.py | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/setup.py b/setup.py -index 0fd886d945..e397df8fb6 100644 ---- a/setup.py -+++ b/setup.py -@@ -458,7 +458,7 @@ def mirror_files_into_torchgen(): - def build_deps(): - report("-- Building version " + version) - -- check_submodules() -+ # check_submodules() - check_pydep("yaml", "pyyaml") - - build_caffe2( --- -2.43.0 - diff --git a/python-torch.spec b/python-torch.spec index 29dd8c0..d50687a 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -7,9 +7,9 @@ %bcond_with gitcommit %if %{with gitcommit} # ToT -%global commit0 b36e01801b89a516f4271f796773d5f4b43f1186 +%global commit0 6e545392cd27b9ee14a86cf6189c71211e79205d %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) -%global date0 20240521 +%global date0 20240605 %global pypi_version 2.4.0 %else %global pypi_version 2.3.0 @@ -162,7 +162,6 @@ Source50: https://github.com/mreineck/pocketfft/archive/%{pf_commit}/pocke Patch0: 0001-no-third_party-foxi.patch Patch3: 0001-Stub-in-kineto-ActivityType.patch -Patch5: 0001-disable-submodule-search.patch %if %{with caffe2} Patch6: 0001-reenable-foxi-linking.patch @@ -499,6 +498,9 @@ sed -i -e 's@if(NOT TARGET fxdiv)@if(MSVC AND USE_XNNPACK)@' caffe2/CMakeLists.t sed -i -e 's@TARGET_LINK_LIBRARIES(torch_cpu PRIVATE fxdiv)@#TARGET_LINK_LIBRARIES(torch_cpu PRIVATE fxdiv)@' caffe2/CMakeLists.txt %endif +# Disable the use of check_submodule's in the setup.py, we are a tarball, not a git repo +sed -i -e 's@check_submodules()$@#check_submodules()@' setup.py + # Release comes fully loaded with third party src # Remove what we can # commit 8f0c68e4dda59fe95b0d9947825ca08101b01195 Author: Tom Rix <trix(a)redhat.com> Date: Tue May 21 06:36:59 2024 -0600 Start tracking upstream 2.4 Replace fmt and FXdiv patches with sed These patches do not apply to gitcommit. Some other changes that do not exist in ToT commented out. Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/python-torch.spec b/python-torch.spec index b65a11c..29dd8c0 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -6,12 +6,14 @@ # So pre releases can be tried %bcond_with gitcommit %if %{with gitcommit} -# git tag v2.3.0-rc12 -%global commit0 97ff6cfd9c86c5c09d7ce775ab64ec5c99230f5d +# ToT +%global commit0 b36e01801b89a516f4271f796773d5f4b43f1186 %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) -%global date0 20240408 -%endif +%global date0 20240521 +%global pypi_version 2.4.0 +%else %global pypi_version 2.3.0 +%endif # For -test subpackage # suitable only for local testing @@ -159,8 +161,6 @@ Source50: https://github.com/mreineck/pocketfft/archive/%{pf_commit}/pocke %endif Patch0: 0001-no-third_party-foxi.patch -Patch1: 0001-no-third_party-fmt.patch -Patch2: 0001-no-third_party-FXdiv.patch Patch3: 0001-Stub-in-kineto-ActivityType.patch Patch5: 0001-disable-submodule-search.patch @@ -168,12 +168,16 @@ Patch5: 0001-disable-submodule-search.patch Patch6: 0001-reenable-foxi-linking.patch %endif +# Bring some patches forward +%if %{without gitcommit} # https://github.com/pytorch/pytorch/pull/123384 Patch7: 0001-Reenable-dim-for-python-3.12.patch # Dynamo/Inductor on 3.12 Patch8: 0001-dynamo-3.12-enable-dynamo-on-3.12-enable-most-dynamo.patch +%endif +%if %{with rocm} # ROCm patches # https://github.com/pytorch/pytorch/pull/120551 Patch100: 0001-Optionally-use-hipblaslt.patch @@ -182,6 +186,7 @@ Patch102: 0001-silence-an-assert.patch Patch103: 0001-can-not-use-with-c-files.patch Patch104: 0001-use-any-hip.patch Patch105: 0001-disable-use-of-aotriton.patch +%endif ExclusiveArch: x86_64 aarch64 %global toolchain gcc @@ -328,6 +333,9 @@ Provides: bundled(pthreadpool) Provides: bundled(pocketfft) %endif +# For convience +Provides: pytorch + %description PyTorch is a Python package that provides two high-level features: @@ -456,11 +464,13 @@ cp -r pocketfft-*/* third_party/pocketfft/ %endif %if %{with opencv} +%if %{without gitcommit} # Reduce requirements, *FOUND is not set sed -i -e 's/USE_OPENCV AND OpenCV_FOUND AND USE_FFMPEG AND FFMPEG_FOUND/USE_OPENCV AND USE_FFMPEG/' caffe2/video/CMakeLists.txt sed -i -e 's/USE_OPENCV AND OpenCV_FOUND/USE_OPENCV/' caffe2/image/CMakeLists.txt sed -i -e 's/STATUS/FATAL/' caffe2/image/CMakeLists.txt %endif +%endif %if 0%{?rhel} # In RHEL but too old @@ -474,6 +484,21 @@ sed -i -e '/fsspec/d' setup.py # Connected to USE_FLASH_ATTENTION, since this is off, do not need it sed -i -e '/aotriton.cmake/d' cmake/Dependencies.cmake +# No third_party fmt, use system +sed -i -e 's@fmt::fmt-header-only@fmt@' CMakeLists.txt +sed -i -e 's@fmt::fmt-header-only@fmt@' c10/CMakeLists.txt +sed -i -e 's@fmt::fmt-header-only@fmt@' torch/CMakeLists.txt +sed -i -e 's@fmt::fmt-header-only@fmt@' cmake/Dependencies.cmake +sed -i -e 's@add_subdirectory(${PROJECT_SOURCE_DIR}/third_party/fmt)@#add_subdirectory(${PROJECT_SOURCE_DIR}/third_party/fmt)@' cmake/Dependencies.cmake +sed -i -e 's@set_target_properties(fmt-header-only PROPERTIES INTERFACE_COMPILE_FEATURES "")@#set_target_properties(fmt-header-only PROPERTIES INTERFACE_COMPILE_FEATURES "")@' cmake/Dependencies.cmake +sed -i -e 's@list(APPEND Caffe2_DEPENDENCY_LIBS fmt::fmt-header-only)@#list(APPEND Caffe2_DEPENDENCY_LIBS fmt::fmt-header-only)@' cmake/Dependencies.cmake + +# No third_party FXdiv +%if %{with xnnpack} +sed -i -e 's@if(NOT TARGET fxdiv)@if(MSVC AND USE_XNNPACK)@' caffe2/CMakeLists.txt +sed -i -e 's@TARGET_LINK_LIBRARIES(torch_cpu PRIVATE fxdiv)@#TARGET_LINK_LIBRARIES(torch_cpu PRIVATE fxdiv)@' caffe2/CMakeLists.txt +%endif + # Release comes fully loaded with third party src # Remove what we can # @@ -567,10 +592,12 @@ mkdir third_party/pocketfft mkdir third_party/valgrind-headers cp %{_includedir}/valgrind/* third_party/valgrind-headers +%if %{without gitcommit} # Remove unneeded OpenCL files that confuse the lincense scanner rm caffe2/contrib/opencl/OpenCL/cl.hpp rm caffe2/mobile/contrib/libopencl-stub/include/CL/*.h rm caffe2/mobile/contrib/libopencl-stub/include/CL/*.hpp +%endif %if %{with rocm} # hipify commit aa3ab781d0d5e5207e056945805716e6b1e707a9 Author: Tom Rix <trix(a)redhat.com> Date: Sat May 18 13:05:15 2024 -0400 Roll ROCm support claim back to f40 Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/python-torch.spec b/python-torch.spec index e8f451b..b65a11c 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -21,8 +21,8 @@ %bcond_with test %ifarch x86_64 -# ROCm support came in F41 -%if 0%{?fedora} > 40 +# ROCm support came in F40 +%if 0%{?fedora} > 39 %bcond_without rocm %else %bcond_with rocm commit 64cda83196afabe324dff36e3b601735f49d92dd Author: Tom Rix <trix(a)redhat.com> Date: Thu May 16 14:07:10 2024 -0600 Add cuda arches to build for Suggested-by: Steve Royer <sroyer(a)redhat.com> Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/python-torch.spec b/python-torch.spec index c371814..e8f451b 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -681,6 +681,8 @@ export BUILD_CAFFE2=ON export CUDACXX=/usr/local/cuda/bin/nvcc export CPLUS_INCLUDE_PATH=/usr/local/cuda/include export USE_CUDA=ON +# The arches to build for +export TORCH_CUDA_ARCH_LIST="8.0 8.6 8.9 9.0" %endif %endif commit 34c6e67d31fed7c8844b1c9591c07747c299c9e4 Author: Tom Rix <trix(a)redhat.com> Date: Mon May 6 19:28:22 2024 -0600 Fill in missing packages on F40 and F39 with third_party. These packages are in Fedora, just not in the old releases. Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/python-torch.spec b/python-torch.spec index f9e4c70..c371814 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -68,6 +68,18 @@ %bcond_with xnnpack %endif +%if 0%{?fedora} > 39 +%bcond_without pthreadpool +%else +%bcond_with pthreadpool +%endif + +%if 0%{?fedora} > 39 +%bcond_without pocketfft +%else +%bcond_with pocketfft +%endif + # For testing cuda %ifarch x86_64 %bcond_with cuda @@ -119,6 +131,33 @@ Source21: https://github.com/libuv/libuv/archive/refs/tags/v1.41.0.tar.gz Source22: https://github.com/google/libnop/archive/%{nop_commit}/libnop-%{nop_scommit… %endif +%if %{without xnnpack} +%global xnn_commit fcbf55af6cf28a4627bcd1f703ab7ad843f0f3a2 +%global xnn_scommit %(c=%{xnn_commit}; echo ${c:0:7}) +Source30: https://github.com/google/xnnpack/archive/%{xnn_commit}/xnnpack-%{xnn_scomm… +%global fx_commit 63058eff77e11aa15bf531df5dd34395ec3017c8 +%global fx_scommit %(c=%{fx_commit}; echo ${c:0:7}) +Source31: https://github.com/Maratyszcza/fxdiv/archive/%{fx_commit}/FXdiv-%{fx_scommi… +%global fp_commit 0a92994d729ff76a58f692d3028ca1b64b145d91 +%global fp_scommit %(c=%{fp_commit}; echo ${c:0:7}) +Source32: https://github.com/Maratyszcza/FP16/archive/%{fp_commit}/FP16-%{fp_scommit}… +%global ps_commit 072586a71b55b7f8c584153d223e95687148a900 +%global ps_scommit %(c=%{ps_commit}; echo ${c:0:7}) +Source33: https://github.com/Maratyszcza/psimd/archive/%{ps_commit}/psimd-%{ps_scommi… +%endif + +%if %{without pthreadpool} +%global pt_commit 4fe0e1e183925bf8cfa6aae24237e724a96479b8 +%global pt_scommit %(c=%{pt_commit}; echo ${c:0:7}) +Source40: https://github.com/Maratyszcza/pthreadpool/archive/%{pt_commit}/pthreadpool… +%endif + +%if %{without pocketfft} +%global pf_commit 076cb3d2536b7c5d0629093ad886e10ac05f3623 +%global pf_scommit %(c=%{pf_commit}; echo ${c:0:7}) +Source50: https://github.com/mreineck/pocketfft/archive/%{pf_commit}/pocketfft-%{pf_s… +%endif + Patch0: 0001-no-third_party-foxi.patch Patch1: 0001-no-third_party-fmt.patch Patch2: 0001-no-third_party-FXdiv.patch @@ -175,16 +214,18 @@ BuildRequires: protobuf-devel BuildRequires: sleef-devel BuildRequires: valgrind-devel -# These packages came in F40 -%if 0%{?fedora} > 39 -BuildRequires: FP16-devel -BuildRequires: fxdiv-devel +%if %{with pocketfft} BuildRequires: pocketfft-devel -BuildRequires: psimd-devel +%endif + +%if %{with pthreadpool} BuildRequires: pthreadpool-devel %endif %if %{with xnnpack} +BuildRequires: FP16-devel +BuildRequires: fxdiv-devel +BuildRequires: psimd-devel BuildRequires: xnnpack-devel = 0.0^git20240229.fcbf55a %endif @@ -265,7 +306,27 @@ Provides: bundled(libnop) Provides: bundled(libuv) = 1.41.0 %endif +# These are already in Fedora +%if %{without xnnpack} +# BSD-3-Clause +Provides: bundled(xnnpack) +# MIT +Provides: bundled(FP16) +# MIT +Provides: bundled(fxdiv) +# MIT +Provides: bundled(psimd) +%endif + +%if %{without pthreadpool} +# BSD-2-Clause +Provides: bundled(pthreadpool) +%endif +%if %{without pocketfft} +# BSD-3-Clause +Provides: bundled(pocketfft) +%endif %description PyTorch is a Python package that provides two high-level features: @@ -339,27 +400,61 @@ cp %{SOURCE100} . rm -rf %{pypi_name}.egg-info tar xf %{SOURCE1} +rm -rf third_party/flatbuffers/* cp -r flatbuffers-23.3.3/* third_party/flatbuffers/ tar xf %{SOURCE2} +rm -rf third_party/pybind11/* cp -r pybind11-2.11.1/* third_party/pybind11/ %if %{with cuda} tar xf %{SOURCE10} +rm -rf third_party/cudnn_frontend/* cp -r cudnn-frontend-%{cuf_ver}/* third_party/cudnn_frontend/ tar xf %{SOURCE11} +rm -rf third_party/cutlass/* cp -r cutlass-%{cul_ver}/* third_party/cutlass/ %endif %if %{with tensorpipe} tar xf %{SOURCE20} +rm -rf third_party/tensorpipe/* cp -r tensorpipe-*/* third_party/tensorpipe/ tar xf %{SOURCE21} +rm -rf third_party/tensorpipe/third_party/libuv/* cp -r libuv-*/* third_party/tensorpipe/third_party/libuv/ tar xf %{SOURCE22} +rm -rf third_party/tensorpipe/third_party/libnop/* cp -r libnop-*/* third_party/tensorpipe/third_party/libnop/ %endif +%if %{without xnnpack} +tar xf %{SOURCE30} +rm -rf third_party/XNNPACK/* +cp -r XNNPACK-*/* third_party/XNNPACK/ +tar xf %{SOURCE31} +rm -rf third_party/FXdiv/* +cp -r FXdiv-*/* third_party/FXdiv/ +tar xf %{SOURCE32} +rm -rf third_party/FP16/* +cp -r FP16-*/* third_party/FP16/ +tar xf %{SOURCE33} +rm -rf third_party/psimd/* +cp -r psimd-*/* third_party/psimd/ +%endif + +%if %{without pthreadpool} +tar xf %{SOURCE40} +rm -rf third_party/pthreadpool/* +cp -r pthreadpool-*/* third_party/pthreadpool/ +%endif + +%if %{without pocketfft} +tar xf %{SOURCE50} +rm -rf third_party/pocketfft/* +cp -r pocketfft-*/* third_party/pocketfft/ +%endif + %if %{with opencv} # Reduce requirements, *FOUND is not set sed -i -e 's/USE_OPENCV AND OpenCV_FOUND AND USE_FFMPEG AND FFMPEG_FOUND/USE_OPENCV AND USE_FFMPEG/' caffe2/video/CMakeLists.txt @@ -406,6 +501,21 @@ mv third_party/cutlass . mv third_party/tensorpipe . %endif +%if %{without xnnpack} +mv third_party/XNNPACK . +mv third_party/FXdiv . +mv third_party/FP16 . +mv third_party/psimd . +%endif + +%if %{without pthreadpool} +mv third_party/pthreadpool . +%endif + +%if %{without pocketfft} +mv third_party/pocketfft . +%endif + %if %{with test} mv third_party/googletest . %endif @@ -427,13 +537,31 @@ mv cutlass third_party mv tensorpipe third_party %endif +%if %{without xnnpack} +mv XNNPACK third_party +mv FXdiv third_party +mv FP16 third_party +mv psimd third_party +%endif + +%if %{without pthreadpool} +mv pthreadpool third_party +%endif + +%if %{without pocketfft} +mv pocketfft third_party +%endif + %if %{with test} mv googletest third_party %endif +%if %{with pocketfft} # # Fake out pocketfft, and system header will be used mkdir third_party/pocketfft +%endif + # # Use the system valgrind headers mkdir third_party/valgrind-headers @@ -527,18 +655,21 @@ export USE_ROCM=OFF export USE_SYSTEM_CPUINFO=ON export USE_SYSTEM_SLEEF=ON export USE_SYSTEM_EIGEN_INSTALL=ON -export USE_SYSTEM_FP16=ON -export USE_SYSTEM_PTHREADPOOL=ON -export USE_SYSTEM_PSIMD=ON -export USE_SYSTEM_FXDIV=ON export USE_SYSTEM_ONNX=ON export USE_SYSTEM_PYBIND11=OFF export USE_SYSTEM_LIBS=OFF export USE_TENSORPIPE=OFF +export USE_XNNPACK=ON + +%if %{with pthreadpool} +export USE_SYSTEM_PTHREADPOOL=ON +%endif %if %{with xnnpack} +export USE_SYSTEM_FP16=ON +export USE_SYSTEM_FXDIV=ON +export USE_SYSTEM_PSIMD=ON export USE_SYSTEM_XNNPACK=ON -export USE_XNNPACK=ON %endif %if %{with caffe2} commit 5d1bd21efdaaa70acf3190c4779bd7d5eb844f65 Author: Tom Rix <trix(a)redhat.com> Date: Sun May 5 15:43:38 2024 -0400 Collect the buildrequires that depend on F40 together. Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/python-torch.spec b/python-torch.spec index 02bdeff..f9e4c70 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -155,8 +155,6 @@ BuildRequires: fmt-devel %if %{with caffe2} BuildRequires: foxi-devel %endif -BuildRequires: FP16-devel -BuildRequires: fxdiv-devel BuildRequires: gcc-c++ BuildRequires: gcc-gfortran %if %{with distributed} @@ -173,12 +171,19 @@ BuildRequires: openmpi-devel %endif %endif BuildRequires: openblas-devel -BuildRequires: pocketfft-devel BuildRequires: protobuf-devel -BuildRequires: pthreadpool-devel -BuildRequires: psimd-devel BuildRequires: sleef-devel BuildRequires: valgrind-devel + +# These packages came in F40 +%if 0%{?fedora} > 39 +BuildRequires: FP16-devel +BuildRequires: fxdiv-devel +BuildRequires: pocketfft-devel +BuildRequires: psimd-devel +BuildRequires: pthreadpool-devel +%endif + %if %{with xnnpack} BuildRequires: xnnpack-devel = 0.0^git20240229.fcbf55a %endif commit c3a7e33a0692497dde38161763fa84e82cf4b8b4 Author: Tom Rix <trix(a)redhat.com> Date: Sun May 5 15:29:24 2024 -0400 Improve fedora conditional use versions. Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/python-torch.spec b/python-torch.spec index da0f59e..02bdeff 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -21,7 +21,8 @@ %bcond_with test %ifarch x86_64 -%if 0%{?fedora} +# ROCm support came in F41 +%if 0%{?fedora} > 40 %bcond_without rocm %else %bcond_with rocm @@ -34,28 +35,39 @@ %global rocm_default_gpu default %bcond_without rocm_loop -# For testing caffe2 -%if 0%{?fedora} +# Caffe2 support came in F41 +%if 0%{?fedora} > 40 %bcond_without caffe2 %else %bcond_with caffe2 %endif -# For testing distributed +# Distributed support came in F41 +%if 0%{?fedora} > 40 %bcond_without distributed # For testing distributed+rccl etc. %bcond_without rccl %bcond_with gloo %bcond_without mpi %bcond_without tensorpipe +%else +%bcond_with distributed +%endif -# For testing openvs -%if 0%{?fedora} +# OpenCV support came in F41 +%if 0%{?fedora} > 40 %bcond_without opencv %else %bcond_with opencv %endif +# Do no confuse xnnpack versions +%if 0%{?fedora} > 40 +%bcond_without xnnpack +%else +%bcond_with xnnpack +%endif + # For testing cuda %ifarch x86_64 %bcond_with cuda @@ -105,7 +117,6 @@ Source21: https://github.com/libuv/libuv/archive/refs/tags/v1.41.0.tar.gz %global nop_commit 910b55815be16109f04f4180e9adee14fb4ce281 %global nop_scommit %(c=%{nop_commit}; echo ${c:0:7}) Source22: https://github.com/google/libnop/archive/%{nop_commit}/libnop-%{nop_scommit… - %endif Patch0: 0001-no-third_party-foxi.patch @@ -141,7 +152,9 @@ BuildRequires: cmake BuildRequires: cpuinfo-devel BuildRequires: eigen3-devel BuildRequires: fmt-devel +%if %{with caffe2} BuildRequires: foxi-devel +%endif BuildRequires: FP16-devel BuildRequires: fxdiv-devel BuildRequires: gcc-c++ @@ -166,7 +179,9 @@ BuildRequires: pthreadpool-devel BuildRequires: psimd-devel BuildRequires: sleef-devel BuildRequires: valgrind-devel +%if %{with xnnpack} BuildRequires: xnnpack-devel = 0.0^git20240229.fcbf55a +%endif BuildRequires: python3-devel BuildRequires: python3dist(filelock) @@ -512,11 +527,14 @@ export USE_SYSTEM_PTHREADPOOL=ON export USE_SYSTEM_PSIMD=ON export USE_SYSTEM_FXDIV=ON export USE_SYSTEM_ONNX=ON -export USE_SYSTEM_XNNPACK=ON export USE_SYSTEM_PYBIND11=OFF export USE_SYSTEM_LIBS=OFF export USE_TENSORPIPE=OFF + +%if %{with xnnpack} +export USE_SYSTEM_XNNPACK=ON export USE_XNNPACK=ON +%endif %if %{with caffe2} export BUILD_CAFFE2=ON commit 237cc5742ff4de6a98917b38ace95f1ec5824fa0 Author: Tom Rix <trix(a)redhat.com> Date: Thu May 2 18:07:56 2024 -0600 Enable dynamo on 3.12 Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/0001-dynamo-3.12-enable-dynamo-on-3.12-enable-most-dynamo.patch b/0001-dynamo-3.12-enable-dynamo-on-3.12-enable-most-dynamo.patch new file mode 100644 index 0000000..0ce5b1f --- /dev/null +++ b/0001-dynamo-3.12-enable-dynamo-on-3.12-enable-most-dynamo.patch @@ -0,0 +1,226 @@ +From b9d45eb1cc90696a4de76676221219e24423c709 Mon Sep 17 00:00:00 2001 +From: William Wen <williamwen(a)meta.com> +Date: Wed, 3 Apr 2024 17:58:46 -0700 +Subject: [PATCH] [dynamo, 3.12] enable dynamo on 3.12, enable most dynamo + unittests on 3.12 (#123216) + +Pull Request resolved: https://github.com/pytorch/pytorch/pull/123216 +Approved by: https://github.com/jansel, https://github.com/malfet +--- + test/dynamo/test_autograd_function.py | 3 ++ + test/dynamo/test_misc.py | 63 +++++++++++++++++++++++++ + test/functorch/test_eager_transforms.py | 7 ++- + test/run_test.py | 3 -- + torch/__init__.py | 5 +- + torch/_dynamo/eval_frame.py | 4 +- + torch/_dynamo/test_case.py | 8 +--- + 7 files changed, 74 insertions(+), 19 deletions(-) + +diff --git a/test/dynamo/test_autograd_function.py b/test/dynamo/test_autograd_function.py +index d23fec607afa..bc5ebc767038 100644 +--- a/test/dynamo/test_autograd_function.py ++++ b/test/dynamo/test_autograd_function.py +@@ -2,6 +2,8 @@ + + import copy + import math ++import sys ++import unittest + + import torch + +@@ -528,6 +530,7 @@ class AutogradFunctionTests(torch._dynamo.test_case.TestCase): + # I pulled all of these test cases from test_autograd.py + # In the future, we should make the Dynamo test suite actually + # run on test_autograd.py (it's disabled right now) and delete these. ++ @unittest.skipIf(sys.version_info >= (3, 12), "invalid free in 3.12+") + def test_smoke_from_test_autograd(self): + class Func(torch.autograd.Function): + @staticmethod +diff --git a/test/dynamo/test_misc.py b/test/dynamo/test_misc.py +index a73de8b1c7e9..8f54e0564e6b 100644 +--- a/test/dynamo/test_misc.py ++++ b/test/dynamo/test_misc.py +@@ -9760,6 +9760,69 @@ fn + lambda mod: mod, + ) + ++ @xfailIfPy311 ++ def test_outside_linear_module_free(self): ++ # Compared to test_linear_module_free, the linear ++ # layer is not the code object that is directly compiled. ++ def model_inp_ctr(): ++ fc = torch.nn.Linear(100, 100) ++ ++ class Mod(torch.nn.Module): ++ def __init__(self): ++ super().__init__() ++ self.fc_ref = fc ++ ++ def forward(self, x): ++ return fc(x[0]) ++ ++ # return fc to keep it alive in _test_compile_model_free ++ return Mod(), (torch.randn(100, 100), fc) ++ ++ self._test_compile_model_free(model_inp_ctr, lambda mod: mod.fc_ref) ++ ++ @unittest.skipIf(sys.version_info >= (3, 12), "leaks in 3.12+") ++ def test_parameter_free(self): ++ def model_inp_ctr(): ++ param = torch.nn.Parameter(torch.randn(100, 100)) ++ ++ class Mod(torch.nn.Module): ++ def __init__(self): ++ super().__init__() ++ self.param = param ++ ++ def forward(self, x): ++ return self.param * x[0] ++ ++ # return param to keep it alive in _test_compile_model_free ++ return Mod(), (torch.randn(100, 100), param) ++ ++ self._test_compile_model_free(model_inp_ctr, lambda mod: mod.param) ++ ++ def test_raises_importerror1(self): ++ @torch.compile(backend="eager") ++ def fn(x): ++ try: ++ import some_module_that_surely_does_not_exist ++ ++ return ++ except ImportError: ++ pass ++ return x.sin() ++ ++ x = torch.randn(8) ++ self.assertEqual(fn(x), x.sin()) ++ ++ def test_raises_importerror2(self): ++ @torch.compile(backend="eager") ++ def fn(x): ++ import some_module_that_surely_does_not_exist ++ ++ return x + 1 ++ ++ x = torch.randn(8) ++ with self.assertRaises(ImportError): ++ fn(x) ++ + def test_dynamo_cache_move_to_front(self): + class Mod(torch.nn.Module): + def __init__(self): +diff --git a/test/functorch/test_eager_transforms.py b/test/functorch/test_eager_transforms.py +index 09415cf8f48e..60790ec06059 100644 +--- a/test/functorch/test_eager_transforms.py ++++ b/test/functorch/test_eager_transforms.py +@@ -4762,8 +4762,7 @@ class TestCompileTransforms(TestCase): + # Triton only supports GPU with SM70 or later. + @expectedFailureIf((IS_ARM64 and not IS_MACOS) or + IS_WINDOWS or +- (TEST_CUDA and not SM70OrLater) or +- (sys.version_info >= (3, 12))) ++ (TEST_CUDA and not SM70OrLater)) + def test_compile_vmap_hessian(self, device): + # The model and inputs are a smaller version + # of code at benchmark repo: +@@ -4792,8 +4791,8 @@ class TestCompileTransforms(TestCase): + actual = opt_fn(params_and_buffers, x) + self.assertEqual(actual, expected) + +- # torch.compile is not supported on Windows or on Python 3.12+ +- @expectedFailureIf(IS_WINDOWS or (sys.version_info >= (3, 12))) ++ # torch.compile is not supported on Windows ++ @expectedFailureIf(IS_WINDOWS) + @torch._dynamo.config.patch(suppress_errors=False) + @torch._dynamo.config.patch(capture_func_transforms=True) + @skipIfTorchDynamo("Do not test torch.compile on top of torch.compile") +diff --git a/test/run_test.py b/test/run_test.py +index e86af9623042..ebb14df4167d 100755 +--- a/test/run_test.py ++++ b/test/run_test.py +@@ -74,7 +74,6 @@ sys.path.remove(str(REPO_ROOT)) + RERUN_DISABLED_TESTS = os.getenv("PYTORCH_TEST_RERUN_DISABLED_TESTS", "0") == "1" + DISTRIBUTED_TEST_PREFIX = "distributed" + INDUCTOR_TEST_PREFIX = "inductor" +-DYNAMO_TEST_PREFIX = "dynamo" + + + # Note [ROCm parallel CI testing] +@@ -324,7 +323,6 @@ JIT_EXECUTOR_TESTS = [ + ] + + INDUCTOR_TESTS = [test for test in TESTS if test.startswith(INDUCTOR_TEST_PREFIX)] +-DYNAMO_TESTS = [test for test in TESTS if test.startswith(DYNAMO_TEST_PREFIX)] + DISTRIBUTED_TESTS = [test for test in TESTS if test.startswith(DISTRIBUTED_TEST_PREFIX)] + TORCH_EXPORT_TESTS = [test for test in TESTS if test.startswith("export")] + FUNCTORCH_TESTS = [test for test in TESTS if test.startswith("functorch")] +@@ -1361,7 +1359,6 @@ def get_selected_tests(options) -> List[str]: + # these tests failing in Python 3.12 temporarily disabling + if sys.version_info >= (3, 12): + options.exclude.extend(INDUCTOR_TESTS) +- options.exclude.extend(DYNAMO_TESTS) + options.exclude.extend( + [ + "functorch/test_dims", +diff --git a/torch/__init__.py b/torch/__init__.py +index d381712b4a35..26cdffe81d29 100644 +--- a/torch/__init__.py ++++ b/torch/__init__.py +@@ -1861,9 +1861,8 @@ def compile(model: Optional[Callable] = None, *, + + """ + _C._log_api_usage_once("torch.compile") +- # Temporary until we get proper support for python 3.12 +- if sys.version_info >= (3, 12): +- raise RuntimeError("Dynamo is not supported on Python 3.12+") ++ if sys.version_info >= (3, 13): ++ raise RuntimeError("Dynamo is not supported on Python 3.13+") + + # Decorator mode + if model is None: +diff --git a/torch/_dynamo/eval_frame.py b/torch/_dynamo/eval_frame.py +index 53ab0df3a947..0a80eeea99ed 100644 +--- a/torch/_dynamo/eval_frame.py ++++ b/torch/_dynamo/eval_frame.py +@@ -589,8 +589,8 @@ class _NullDecorator(contextlib.nullcontext): # type: ignore[type-arg] + + + def check_if_dynamo_supported(): +- if sys.version_info >= (3, 12): +- raise RuntimeError("Python 3.12+ not yet supported for torch.compile") ++ if sys.version_info >= (3, 13): ++ raise RuntimeError("Python 3.13+ not yet supported for torch.compile") + + + def is_dynamo_supported(): +diff --git a/torch/_dynamo/test_case.py b/torch/_dynamo/test_case.py +index e3cbef09eaae..297ea6e2bc2a 100644 +--- a/torch/_dynamo/test_case.py ++++ b/torch/_dynamo/test_case.py +@@ -1,7 +1,6 @@ + import contextlib + import importlib + import logging +-import sys + + import torch + import torch.testing +@@ -20,12 +19,7 @@ log = logging.getLogger(__name__) + def run_tests(needs=()): + from torch.testing._internal.common_utils import run_tests + +- if ( +- TEST_WITH_TORCHDYNAMO +- or IS_WINDOWS +- or TEST_WITH_CROSSREF +- or sys.version_info >= (3, 12) +- ): ++ if TEST_WITH_TORCHDYNAMO or IS_WINDOWS or TEST_WITH_CROSSREF: + return # skip testing + + if isinstance(needs, str): +-- +2.44.0 + diff --git a/python-torch.spec b/python-torch.spec index 5c4640f..da0f59e 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -121,6 +121,9 @@ Patch6: 0001-reenable-foxi-linking.patch # https://github.com/pytorch/pytorch/pull/123384 Patch7: 0001-Reenable-dim-for-python-3.12.patch +# Dynamo/Inductor on 3.12 +Patch8: 0001-dynamo-3.12-enable-dynamo-on-3.12-enable-most-dynamo.patch + # ROCm patches # https://github.com/pytorch/pytorch/pull/120551 Patch100: 0001-Optionally-use-hipblaslt.patch commit f28581bb0c0c8183df95efab7f6c73256386ff74 Author: Tom Rix <trix(a)redhat.com> Date: Thu May 2 11:07:50 2024 -0400 Disable dwz with ROCm Work around a problem with running out of memory and thrashing the build machine. Eanble opencv for Fedora Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/python-torch.spec b/python-torch.spec index a490e36..5c4640f 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -50,13 +50,22 @@ %bcond_without tensorpipe # For testing openvs +%if 0%{?fedora} +%bcond_without opencv +%else %bcond_with opencv +%endif # For testing cuda %ifarch x86_64 %bcond_with cuda %endif +# Disable dwz with rocm because memory can be exhausted +%if %{with rocm} +%define _find_debuginfo_dwz_opts %{nil} +%endif + Name: python-%{pypi_name} %if %{with gitcommit} Version: %{pypi_version}^git%{date0}.%{shortcommit0} commit 89597ed77ceb6d3639d7a19b41ae96b024038585 Author: Tom Rix <trix(a)redhat.com> Date: Tue Apr 30 12:42:36 2024 -0600 Update sources Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/.gitignore b/.gitignore index 6c78a8d..5038800 100644 --- a/.gitignore +++ b/.gitignore @@ -10,3 +10,4 @@ /v1.41.0.tar.gz /libnop-910b558.tar.gz /pytorch-97ff6cf.tar.gz +/pytorch-v2.3.0.tar.gz diff --git a/sources b/sources index b9570c2..10cd24e 100644 --- a/sources +++ b/sources @@ -10,3 +10,4 @@ SHA512 (tensorpipe-52791a2.tar.gz) = 1e5faf17a7236c5506c08cb28be16069b11bb929bbc SHA512 (v1.41.0.tar.gz) = bb08a1970a10e8d9571ffea3d021643de30ec212cd51317b98d6cf0cfe55d6877992921fb01d1188a6d466687335b77885685d924f8cb7200a0bec30eee05c65 SHA512 (libnop-910b558.tar.gz) = 74c5324eaa1b6b2ac8dfef94c835b5c5b044625f8e5efe3522470b1ecc4798ff43d344a013cee2f6901e83267c6167072947b754e63f1552ae7044cffe234c36 SHA512 (pytorch-97ff6cf.tar.gz) = 105ebcba298558fe833f90e7e40b003d35a74609e777f9dc4c47f5668c884f603455113ac0ff252a62b83c81137ae66ceb1a862d351203925dcfc3dcf9f73580 +SHA512 (pytorch-v2.3.0.tar.gz) = 0c2ffc7bf2fd86070e9958c34eca1f03a0248a011ac6ffaeb69f65306ff856edd5359986f02af25888433187e6d7f29b60edded092e2ac30c8cec49023166eda commit bc28f10c5b9bf98d19d2c56f7d740d3cab008297 Author: Tom Rix <trix(a)redhat.com> Date: Tue Apr 30 12:02:09 2024 -0600 Initial 2.3 release Also enable rccl Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/python-torch.spec b/python-torch.spec index 96a34f7..a490e36 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -4,16 +4,12 @@ %global forgeurl https://github.com/pytorch/pytorch # So pre releases can be tried -%bcond_without gitcommit +%bcond_with gitcommit %if %{with gitcommit} # git tag v2.3.0-rc12 %global commit0 97ff6cfd9c86c5c09d7ce775ab64ec5c99230f5d %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) %global date0 20240408 -%else -%global commit0 975d4284250170602db60adfda5eb1664a3b8acc -%global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) -%global date0 20240307 %endif %global pypi_version 2.3.0 @@ -48,7 +44,7 @@ # For testing distributed %bcond_without distributed # For testing distributed+rccl etc. -%bcond_with rccl +%bcond_without rccl %bcond_with gloo %bcond_without mpi %bcond_without tensorpipe @@ -62,7 +58,11 @@ %endif Name: python-%{pypi_name} +%if %{with gitcommit} Version: %{pypi_version}^git%{date0}.%{shortcommit0} +%else +Version: %{pypi_version} +%endif Release: %autorelease Summary: PyTorch AI/ML framework # See license.txt for license details @@ -73,8 +73,7 @@ URL: https://pytorch.org/ Source0: %{forgeurl}/archive/%{commit0}/pytorch-%{shortcommit0}.tar.gz Source100: pyproject.toml %else -Source0: %{forgeurl}/archive/%{commit0}/pytorch-%{shortcommit0}.tar.gz -Source100: pyproject.toml +Source0: %{forgeurl}/releases/download/v%{version}/pytorch-v%{version}.tar.gz %endif Source1: https://github.com/google/flatbuffers/archive/refs/tags/v23.3.3.tar.gz Source2: https://github.com/pybind/pybind11/archive/refs/tags/v2.11.1.tar.gz @@ -296,12 +295,16 @@ Requires: python3-%{pypi_name}%{?_isa} = %{version}-%{release} %prep +%if %{with gitcommit} %autosetup -p1 -n pytorch-%{commit0} +# Overwrite with a git checkout of the pyproject.toml +cp %{SOURCE100} . +%else +%autosetup -p1 -n pytorch-v%{version} +%endif # Remove bundled egg-info rm -rf %{pypi_name}.egg-info -# Overwrite with a git checkout of the pyproject.toml -cp %{SOURCE100} . tar xf %{SOURCE1} cp -r flatbuffers-23.3.3/* third_party/flatbuffers/ commit df5f2eac43b3205fb00e414ff39a542c3a86b311 Author: Tom Rix <trix(a)redhat.com> Date: Mon Apr 15 12:17:47 2024 -0600 Use the system gloo Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/python-torch.spec b/python-torch.spec index da7915b..96a34f7 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -524,6 +524,7 @@ export TP_BUILD_LIBUV=OFF %if %{with gloo} export USE_GLOO=ON +export USE_SYSTEM_GLOO=ON %endif %if %{with mpi} export USE_MPI=ON commit fad8e2643a347823475385584fa9aeae0505282c Author: Tom Rix <trix(a)redhat.com> Date: Wed Apr 10 18:20:02 2024 -0600 v2.3.0-rc12 And turn on distributed parts that work. Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/.gitignore b/.gitignore index cad15bf..6c78a8d 100644 --- a/.gitignore +++ b/.gitignore @@ -9,3 +9,4 @@ /tensorpipe-52791a2.tar.gz /v1.41.0.tar.gz /libnop-910b558.tar.gz +/pytorch-97ff6cf.tar.gz diff --git a/python-torch.spec b/python-torch.spec index 1b83697..da7915b 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -6,10 +6,10 @@ # So pre releases can be tried %bcond_without gitcommit %if %{with gitcommit} -# git tag v2.3.0-rc7 -%global commit0 4bb5cb51e6ceeb4b0b70b439c7b92168855f146f +# git tag v2.3.0-rc12 +%global commit0 97ff6cfd9c86c5c09d7ce775ab64ec5c99230f5d %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) -%global date0 20240402 +%global date0 20240408 %else %global commit0 975d4284250170602db60adfda5eb1664a3b8acc %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) @@ -46,12 +46,12 @@ %endif # For testing distributed -%bcond_with distributed +%bcond_without distributed # For testing distributed+rccl etc. %bcond_with rccl %bcond_with gloo -%bcond_with mpi -%bcond_with tensorpipe +%bcond_without mpi +%bcond_without tensorpipe # For testing openvs %bcond_with opencv diff --git a/sources b/sources index 72835ff..b9570c2 100644 --- a/sources +++ b/sources @@ -9,3 +9,4 @@ SHA512 (pytorch-4bb5cb5.tar.gz) = 430ae996ddee560537787646ae9f7aa01498f37c99c2e3 SHA512 (tensorpipe-52791a2.tar.gz) = 1e5faf17a7236c5506c08cb28be16069b11bb929bbca64ed9745ce4277d46739186ab7d6597da7437d90ed2d166d4c37ef2f3bceabe8083ef3adbb0e8e5f227e SHA512 (v1.41.0.tar.gz) = bb08a1970a10e8d9571ffea3d021643de30ec212cd51317b98d6cf0cfe55d6877992921fb01d1188a6d466687335b77885685d924f8cb7200a0bec30eee05c65 SHA512 (libnop-910b558.tar.gz) = 74c5324eaa1b6b2ac8dfef94c835b5c5b044625f8e5efe3522470b1ecc4798ff43d344a013cee2f6901e83267c6167072947b754e63f1552ae7044cffe234c36 +SHA512 (pytorch-97ff6cf.tar.gz) = 105ebcba298558fe833f90e7e40b003d35a74609e777f9dc4c47f5668c884f603455113ac0ff252a62b83c81137ae66ceb1a862d351203925dcfc3dcf9f73580 commit 3d98ae877ea611631645e8fb89df726da704c10a Author: Tom Rix <trix(a)redhat.com> Date: Sat Apr 6 07:08:52 2024 -0600 Update to 2.3-rc7 Patch the dim issue needed for torchrl Stage tensorpipe thirdparty needed for distributed. Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/.gitignore b/.gitignore index 96d43c4..cad15bf 100644 --- a/.gitignore +++ b/.gitignore @@ -5,3 +5,7 @@ /v2.11.1.tar.gz /pytorch-6a89a75.tar.gz /pytorch-74832f1.tar.gz +/pytorch-4bb5cb5.tar.gz +/tensorpipe-52791a2.tar.gz +/v1.41.0.tar.gz +/libnop-910b558.tar.gz diff --git a/0001-Reenable-dim-for-python-3.12.patch b/0001-Reenable-dim-for-python-3.12.patch new file mode 100644 index 0000000..138b5d4 --- /dev/null +++ b/0001-Reenable-dim-for-python-3.12.patch @@ -0,0 +1,115 @@ +From ee3fb343a376cdba6f4ce188cac90023f13e2aea Mon Sep 17 00:00:00 2001 +From: Tom Rix <trix(a)redhat.com> +Date: Thu, 4 Apr 2024 14:21:38 -0600 +Subject: [PATCH] Reenable dim for python 3.12 + +In 3.12: + +_PyArg_Parser added an element to the start of the structure. +So existing positional initialization is off. Switch to element +initialization. + +_Py_CODEUNIT changed to from an int to a union, but relevant_op +is passed an int for the return of decoder.opcode, so the parameter +type is wrong, switch it to int. + +The opcode PRECALL was removed, so reduce its handling to 3.11 + +Signed-off-by: Tom Rix <trix(a)redhat.com> +--- + functorch/csrc/dim/dim.cpp | 24 +++++------------------- + functorch/csrc/dim/minpybind.h | 4 ++-- + 2 files changed, 7 insertions(+), 21 deletions(-) + +diff --git a/functorch/csrc/dim/dim.cpp b/functorch/csrc/dim/dim.cpp +index 4cc027504c77..e48b0d58081f 100644 +--- a/functorch/csrc/dim/dim.cpp ++++ b/functorch/csrc/dim/dim.cpp +@@ -6,20 +6,6 @@ + + #include <torch/csrc/utils/python_compat.h> + +- +-// Many APIs have changed/don't exist anymore +-#if IS_PYTHON_3_12_PLUS +- +-#include "dim.h" +- +-// Re-enable this some day +-PyObject* Dim_init() { +- PyErr_SetString(PyExc_RuntimeError, "First class dim doesn't work with python 3.12"); +- return nullptr; +-} +- +-#else +- + #include "minpybind.h" + #include <frameobject.h> + #include <opcode.h> +@@ -441,7 +427,7 @@ static PyObject* DimList_bind(DimList *self, + PY_BEGIN + mpy::handle sizes; + static const char * const _keywords[] = {"sizes", nullptr}; +- static _PyArg_Parser parser = {"O", _keywords, 0}; ++ static _PyArg_Parser parser = { .format = "O", .keywords = _keywords}; + if (!_PyArg_ParseStackAndKeywords(args, nargs, kwnames, &parser, &sizes)) { + return nullptr; + } +@@ -465,7 +451,7 @@ static PyObject* DimList_bind_len(DimList *self, + PY_BEGIN + int size; + static const char * const _keywords[] = {"N", nullptr}; +- static _PyArg_Parser parser = {"i", _keywords, 0}; ++ static _PyArg_Parser parser = { .format = "i", .keywords = _keywords}; + if (!_PyArg_ParseStackAndKeywords(args, nargs, kwnames, &parser, &size)) { + return nullptr; + } +@@ -1468,7 +1454,7 @@ PyTypeObject Tensor::Type = { + + // dim() -------------------- + +-static bool relevant_op(_Py_CODEUNIT c) { ++static bool relevant_op(int c) { + switch(c) { + case STORE_NAME: + case STORE_GLOBAL: +@@ -1587,7 +1573,7 @@ static PyObject* _dims(PyObject *self, + auto c = mpy::obj<PyCodeObject>::steal(PyFrame_GetCode(f.ptr())); + auto lasti = PyFrame_GetLasti(f.ptr()); + auto decoder = PyInstDecoder(c.ptr(), lasti); +- #if IS_PYTHON_3_11_PLUS ++ #if IS_PYTHON_3_11 + // When py3.11 adapts bytecode lasti points to the precall + // rather than the call instruction after it + if (decoder.opcode() == PRECALL) { +@@ -3268,4 +3254,4 @@ PyObject* Dim_init() { + } + } + +-#endif ++ +diff --git a/functorch/csrc/dim/minpybind.h b/functorch/csrc/dim/minpybind.h +index de82b5af95a4..d76d4828bf80 100644 +--- a/functorch/csrc/dim/minpybind.h ++++ b/functorch/csrc/dim/minpybind.h +@@ -621,7 +621,7 @@ struct vector_args { + PyObject *dummy = NULL; + _PyArg_ParseStackAndKeywords((PyObject*const*)args, nargs, kwnames.ptr(), _parser, &dummy, &dummy, &dummy, &dummy, &dummy); + #else +- _PyArg_Parser* _parser = new _PyArg_Parser{NULL, &names_buf[0], fname_cstr, 0}; ++ _PyArg_Parser* _parser = new _PyArg_Parser{ .keywords = &names_buf[0], .fname = fname_cstr}; + std::unique_ptr<PyObject*[]> buf(new PyObject*[names.size()]); + _PyArg_UnpackKeywords((PyObject*const*)args, nargs, NULL, kwnames.ptr(), _parser, required, (Py_ssize_t)values.size() - kwonly, 0, &buf[0]); + #endif +@@ -706,7 +706,7 @@ inline object handle::call_vector(vector_args args) { + #define MPY_PARSE_ARGS_KWNAMES(fmt, FORALL_ARGS) \ + static const char * const kwlist[] = { FORALL_ARGS(MPY_ARGS_NAME) nullptr}; \ + FORALL_ARGS(MPY_ARGS_DECLARE) \ +- static _PyArg_Parser parser = {fmt, kwlist, 0}; \ ++ static _PyArg_Parser parser = { .format = fmt, .keywords = kwlist}; \ + if (!_PyArg_ParseStackAndKeywords(args, nargs, kwnames, &parser, FORALL_ARGS(MPY_ARGS_POINTER) nullptr)) { \ + throw mpy::exception_set(); \ + } +-- +2.44.0 + diff --git a/python-torch.spec b/python-torch.spec index f26f395..1b83697 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -6,10 +6,10 @@ # So pre releases can be tried %bcond_without gitcommit %if %{with gitcommit} -# git tag v2.3.0-rc6 -%global commit0 74832f12fae2e1bc51bf1f9971dcd12c90a971f5 +# git tag v2.3.0-rc7 +%global commit0 4bb5cb51e6ceeb4b0b70b439c7b92168855f146f %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) -%global date0 20242213 +%global date0 20240402 %else %global commit0 975d4284250170602db60adfda5eb1664a3b8acc %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) @@ -47,6 +47,11 @@ # For testing distributed %bcond_with distributed +# For testing distributed+rccl etc. +%bcond_with rccl +%bcond_with gloo +%bcond_with mpi +%bcond_with tensorpipe # For testing openvs %bcond_with opencv @@ -81,6 +86,20 @@ Source10: https://github.com/NVIDIA/cudnn-frontend/archive/refs/tags/v%{cu Source11: https://github.com/NVIDIA/cutlass/archive/refs/tags/v%{cul_ver}.tar.gz %endif +%if %{with tensorpipe} +# Developement on tensorpipe has stopped, repo made read only July 1, 2023, this is the last commit +%global tp_commit 52791a2fd214b2a9dc5759d36725909c1daa7f2e +%global tp_scommit %(c=%{tp_commit}; echo ${c:0:7}) +Source20: https://github.com/pytorch/tensorpipe/archive/%{tp_commit}/tensorpipe-%{tp_… +# The old libuv tensorpipe uses +Source21: https://github.com/libuv/libuv/archive/refs/tags/v1.41.0.tar.gz +# Developement afaik on libnop has stopped, this is the last commit +%global nop_commit 910b55815be16109f04f4180e9adee14fb4ce281 +%global nop_scommit %(c=%{nop_commit}; echo ${c:0:7}) +Source22: https://github.com/google/libnop/archive/%{nop_commit}/libnop-%{nop_scommit… + +%endif + Patch0: 0001-no-third_party-foxi.patch Patch1: 0001-no-third_party-fmt.patch Patch2: 0001-no-third_party-FXdiv.patch @@ -91,6 +110,9 @@ Patch5: 0001-disable-submodule-search.patch Patch6: 0001-reenable-foxi-linking.patch %endif +# https://github.com/pytorch/pytorch/pull/123384 +Patch7: 0001-Reenable-dim-for-python-3.12.patch + # ROCm patches # https://github.com/pytorch/pytorch/pull/120551 Patch100: 0001-Optionally-use-hipblaslt.patch @@ -114,19 +136,23 @@ BuildRequires: fxdiv-devel BuildRequires: gcc-c++ BuildRequires: gcc-gfortran %if %{with distributed} +%if %{with gloo} BuildRequires: gloo-devel %endif +%endif BuildRequires: ninja-build BuildRequires: onnx-devel BuildRequires: libomp-devel +%if %{with distributed} +%if %{with mpi} +BuildRequires: openmpi-devel +%endif +%endif BuildRequires: openblas-devel BuildRequires: pocketfft-devel BuildRequires: protobuf-devel BuildRequires: pthreadpool-devel BuildRequires: psimd-devel -BuildRequires: python3-numpy -BuildRequires: python3-pyyaml -BuildRequires: python3-typing-extensions BuildRequires: sleef-devel BuildRequires: valgrind-devel BuildRequires: xnnpack-devel = 0.0^git20240229.fcbf55a @@ -135,9 +161,11 @@ BuildRequires: python3-devel BuildRequires: python3dist(filelock) BuildRequires: python3dist(jinja2) BuildRequires: python3dist(networkx) +BuildRequires: python3dist(numpy) +BuildRequires: python3dist(pyyaml) BuildRequires: python3dist(setuptools) -BuildRequires: python3dist(typing-extensions) BuildRequires: python3dist(sphinx) +BuildRequires: python3dist(typing-extensions) %if 0%{?fedora} BuildRequires: python3-pybind11 @@ -160,8 +188,10 @@ BuildRequires: rocblas-devel BuildRequires: rocrand-devel BuildRequires: rocfft-devel %if %{with distributed} +%if %{with rccl} BuildRequires: rccl-devel %endif +%endif BuildRequires: rocprim-devel BuildRequires: rocm-cmake BuildRequires: rocm-comgr-devel @@ -186,13 +216,23 @@ BuildRequires: google-benchmark-devel Requires: python3dist(dill) +# For convience +Provides: pytorch + # Apache-2.0 Provides: bundled(flatbuffers) = 22.3.3 # MIT Provides: bundled(miniz) = 2.1.0 Provides: bundled(pybind11) = 2.11.1 -# For convience -Provides: pytorch + +%if %{with tensorpipe} +# BSD-3-Clause +Provides: bundled(tensorpipe) +# Apache-2.0 +Provides: bundled(libnop) +# MIT AND CC-BY-4.0 AND ISC AND BSD-2-Clause +Provides: bundled(libuv) = 1.41.0 +%endif @@ -276,6 +316,15 @@ tar xf %{SOURCE11} cp -r cutlass-%{cul_ver}/* third_party/cutlass/ %endif +%if %{with tensorpipe} +tar xf %{SOURCE20} +cp -r tensorpipe-*/* third_party/tensorpipe/ +tar xf %{SOURCE21} +cp -r libuv-*/* third_party/tensorpipe/third_party/libuv/ +tar xf %{SOURCE22} +cp -r libnop-*/* third_party/tensorpipe/third_party/libnop/ +%endif + %if %{with opencv} # Reduce requirements, *FOUND is not set sed -i -e 's/USE_OPENCV AND OpenCV_FOUND AND USE_FFMPEG AND FFMPEG_FOUND/USE_OPENCV AND USE_FFMPEG/' caffe2/video/CMakeLists.txt @@ -318,6 +367,10 @@ mv third_party/cudnn_frontend . mv third_party/cutlass . %endif +%if %{with tensorpipe} +mv third_party/tensorpipe . +%endif + %if %{with test} mv third_party/googletest . %endif @@ -335,6 +388,10 @@ mv cudnn_frontend third_party mv cutlass third_party %endif +%if %{with tensorpipe} +mv tensorpipe third_party +%endif + %if %{with test} mv googletest third_party %endif @@ -417,11 +474,14 @@ export USE_CUDA=OFF export USE_FBGEMM=OFF export USE_FLASH_ATTENTION=OFF export USE_GOLD_LINKER=OFF +export USE_GLOO=OFF export USE_ITT=OFF export USE_KINETO=OFF export USE_LITE_INTERPRETER_PROFILER=OFF export USE_LITE_PROTO=OFF +export USE_MAGMA=OFF export USE_MKLDNN=OFF +export USE_MPI=OFF export USE_NCCL=OFF export USE_NNPACK=OFF export USE_NUMPY=ON @@ -457,6 +517,17 @@ export USE_CUDA=ON %if %{with distributed} export USE_DISTRIBUTED=ON +%if %{with tensorpipe} +export USE_TENSORPIPE=ON +export TP_BUILD_LIBUV=OFF +%endif + +%if %{with gloo} +export USE_GLOO=ON +%endif +%if %{with mpi} +export USE_MPI=ON +%endif %endif %if %{with opencv} diff --git a/sources b/sources index 0c21ff2..72835ff 100644 --- a/sources +++ b/sources @@ -5,3 +5,7 @@ SHA512 (v23.3.3.tar.gz) = 4066c94f2473c7ea16917d29a613e16f840a329089c88e0bdbdb99 SHA512 (v2.11.1.tar.gz) = ed1512ff0bca3bc0a45edc2eb8c77f8286ab9389f6ff1d5cb309be24bc608abbe0df6a7f5cb18c8f80a3bfa509058547c13551c3cd6a759af708fd0cdcdd9e95 SHA512 (pytorch-6a89a75.tar.gz) = 6978acc6f37d7c5adc71517a6f379c7133b2bbd040189deddba7753acde41f6ddba2e9f2e397928e89c776d6a5458b8a74f8e04beb312d71fd30b072687ba98f SHA512 (pytorch-74832f1.tar.gz) = bd553bfbbb422d353bbbf616c201251b2517b905e2621fa05bfe3d97726b078caad377583adccdc0cca234235a11fcb4730a93e834907b2ca4c06d552b2a2683 +SHA512 (pytorch-4bb5cb5.tar.gz) = 430ae996ddee560537787646ae9f7aa01498f37c99c2e3fe4c5f66ee732ee3fe4ecf337fdf857bc0c7fe27634af75cee3ce576bbe2576463b81e27dbbfacf6ef +SHA512 (tensorpipe-52791a2.tar.gz) = 1e5faf17a7236c5506c08cb28be16069b11bb929bbca64ed9745ce4277d46739186ab7d6597da7437d90ed2d166d4c37ef2f3bceabe8083ef3adbb0e8e5f227e +SHA512 (v1.41.0.tar.gz) = bb08a1970a10e8d9571ffea3d021643de30ec212cd51317b98d6cf0cfe55d6877992921fb01d1188a6d466687335b77885685d924f8cb7200a0bec30eee05c65 +SHA512 (libnop-910b558.tar.gz) = 74c5324eaa1b6b2ac8dfef94c835b5c5b044625f8e5efe3522470b1ecc4798ff43d344a013cee2f6901e83267c6167072947b754e63f1552ae7044cffe234c36 commit b131897b0f68746765808d958184eaa05dee4dc0 Author: Tom Rix <trix(a)redhat.com> Date: Sun Mar 31 13:55:42 2024 -0600 Provide pytorch as a convience Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/python-torch.spec b/python-torch.spec index 568e7b3..f26f395 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -186,12 +186,14 @@ BuildRequires: google-benchmark-devel Requires: python3dist(dill) - # Apache-2.0 Provides: bundled(flatbuffers) = 22.3.3 # MIT Provides: bundled(miniz) = 2.1.0 Provides: bundled(pybind11) = 2.11.1 +# For convience +Provides: pytorch + %description commit f35f3f7fe84a920dc9bd9ac4afbbe4cfe4413d66 Author: Tom Rix <trix(a)redhat.com> Date: Wed Mar 27 16:08:38 2024 -0600 Update to 2.3-rc6 Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/.gitignore b/.gitignore index 7a720eb..96d43c4 100644 --- a/.gitignore +++ b/.gitignore @@ -4,3 +4,4 @@ /v23.3.3.tar.gz /v2.11.1.tar.gz /pytorch-6a89a75.tar.gz +/pytorch-74832f1.tar.gz diff --git a/python-torch.spec b/python-torch.spec index 4807121..568e7b3 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -6,10 +6,10 @@ # So pre releases can be tried %bcond_without gitcommit %if %{with gitcommit} -# git tag v2.3.0-rc2 -%global commit0 6a89a753b1556fe8558582c452fdba083f6ec01a +# git tag v2.3.0-rc6 +%global commit0 74832f12fae2e1bc51bf1f9971dcd12c90a971f5 %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) -%global date0 20240313 +%global date0 20242213 %else %global commit0 975d4284250170602db60adfda5eb1664a3b8acc %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) @@ -180,11 +180,13 @@ Requires: rocm-rpm-macros-modules BuildRequires: opencv-devel %endif - %if %{with test} BuildRequires: google-benchmark-devel %endif +Requires: python3dist(dill) + + # Apache-2.0 Provides: bundled(flatbuffers) = 22.3.3 # MIT diff --git a/sources b/sources index c12deda..0c21ff2 100644 --- a/sources +++ b/sources @@ -4,3 +4,4 @@ SHA512 (pytorch-975d428.tar.gz) = a02195b18d832db9a739c3eeecd0cd0c8868d8b92e4a2f SHA512 (v23.3.3.tar.gz) = 4066c94f2473c7ea16917d29a613e16f840a329089c88e0bdbdb999aef3442ba00abfd2aa92266fa9c067e399dc88e6f0ccac40dc151378857e665638e78bbf0 SHA512 (v2.11.1.tar.gz) = ed1512ff0bca3bc0a45edc2eb8c77f8286ab9389f6ff1d5cb309be24bc608abbe0df6a7f5cb18c8f80a3bfa509058547c13551c3cd6a759af708fd0cdcdd9e95 SHA512 (pytorch-6a89a75.tar.gz) = 6978acc6f37d7c5adc71517a6f379c7133b2bbd040189deddba7753acde41f6ddba2e9f2e397928e89c776d6a5458b8a74f8e04beb312d71fd30b072687ba98f +SHA512 (pytorch-74832f1.tar.gz) = bd553bfbbb422d353bbbf616c201251b2517b905e2621fa05bfe3d97726b078caad377583adccdc0cca234235a11fcb4730a93e834907b2ca4c06d552b2a2683 commit a0fd504b6acada38f189d560a52787ad6edeecc9 Author: Tom Rix <trix(a)redhat.com> Date: Fri Mar 22 15:43:54 2024 -0600 Remove conditional around the rocm patches Suggested-by: Tim Flink <tflink(a)redhat.com> Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/python-torch.spec b/python-torch.spec index f43e5e5..4807121 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -91,7 +91,7 @@ Patch5: 0001-disable-submodule-search.patch Patch6: 0001-reenable-foxi-linking.patch %endif -%if %{with rocm} +# ROCm patches # https://github.com/pytorch/pytorch/pull/120551 Patch100: 0001-Optionally-use-hipblaslt.patch Patch101: 0001-cuda-hip-signatures.patch @@ -99,7 +99,6 @@ Patch102: 0001-silence-an-assert.patch Patch103: 0001-can-not-use-with-c-files.patch Patch104: 0001-use-any-hip.patch Patch105: 0001-disable-use-of-aotriton.patch -%endif ExclusiveArch: x86_64 aarch64 %global toolchain gcc commit 307001f4812a70c50e4124234580e414abe4d83e Author: Tom Rix <trix(a)redhat.com> Date: Fri Mar 22 13:43:35 2024 -0600 Split the ROCm gpu families out into subpackages. The main package was getting too big. Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/python-torch.spec b/python-torch.spec index 07a47eb..f43e5e5 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -214,20 +214,31 @@ PyTorch is a Python package that provides two high-level features: You can reuse your favorite Python packages such as NumPy, SciPy, and Cython to extend PyTorch when needed. -%package -n python3-%{pypi_name}-devel -Summary: Libraries and headers for %{name} -Requires: python3-%{pypi_name}%{?_isa} = %{version}-%{release} +%if %{with rocm} +%package -n python3-%{pypi_name}-rocm-gfx8 +Summary: %{name} for ROCm gfx8 -%description -n python3-%{pypi_name}-devel +%description -n python3-%{pypi_name}-rocm-gfx8 %{summary} -%if %{with rocm} -%package -n python3-%{pypi_name}-rocm -Summary: %{name} for ROCm -Requires: python3-%{pypi_name}%{?_isa} = %{version}-%{release} +%package -n python3-%{pypi_name}-rocm-gfx9 +Summary: %{name} for ROCm gfx9 -%description -n python3-%{pypi_name}-rocm +%description -n python3-%{pypi_name}-rocm-gfx9 %{summary} + +%package -n python3-%{pypi_name}-rocm-gfx10 +Summary: %{name} for ROCm gfx10 + +%description -n python3-%{pypi_name}-rocm-gfx10 +%{summary} + +%package -n python3-%{pypi_name}-rocm-gfx11 +Summary: %{name} for ROCm gfx11 + +%description -n python3-%{pypi_name}-rocm-gfx11 +%{summary} + %endif %if %{with test} @@ -550,11 +561,23 @@ done %if %{with caffe2} %{python3_sitearch}/caffe2 %endif + %if %{with rocm} -%if %{with rocm_loop} -%{_libdir}/rocm/gfx*/bin/* -%{_libdir}/rocm/gfx*/lib64/* -%endif +%files -n python3-%{pypi_name}-rocm-gfx8 +%{_libdir}/rocm/gfx8/bin/* +%{_libdir}/rocm/gfx8/lib64/* + +%files -n python3-%{pypi_name}-rocm-gfx9 +%{_libdir}/rocm/gfx9/bin/* +%{_libdir}/rocm/gfx9/lib64/* + +%files -n python3-%{pypi_name}-rocm-gfx10 +%{_libdir}/rocm/gfx10/bin/* +%{_libdir}/rocm/gfx10/lib64/* + +%files -n python3-%{pypi_name}-rocm-gfx11 +%{_libdir}/rocm/gfx11/bin/* +%{_libdir}/rocm/gfx11/lib64/* %endif %changelog commit c12477f1bc0e921fcb8100958daf4f2bebee081f Author: Tom Rix <trix(a)redhat.com> Date: Thu Mar 21 04:52:35 2024 -0600 Update the source to 2.3-rc2 Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/.gitignore b/.gitignore index 612c3df..7a720eb 100644 --- a/.gitignore +++ b/.gitignore @@ -3,3 +3,4 @@ /pytorch-975d428.tar.gz /v23.3.3.tar.gz /v2.11.1.tar.gz +/pytorch-6a89a75.tar.gz diff --git a/sources b/sources index 37652db..c12deda 100644 --- a/sources +++ b/sources @@ -3,3 +3,4 @@ SHA512 (pytorch-v2.1.2.tar.gz) = b7305407ad9dda877d277a0e7009f65f6d69f39370f2231 SHA512 (pytorch-975d428.tar.gz) = a02195b18d832db9a739c3eeecd0cd0c8868d8b92e4a2fca42e4bdd20735f0745d84573df28d9ae1db014cf79ffd005a8409b3e8bb92f9db2a446f784ef46ff4 SHA512 (v23.3.3.tar.gz) = 4066c94f2473c7ea16917d29a613e16f840a329089c88e0bdbdb999aef3442ba00abfd2aa92266fa9c067e399dc88e6f0ccac40dc151378857e665638e78bbf0 SHA512 (v2.11.1.tar.gz) = ed1512ff0bca3bc0a45edc2eb8c77f8286ab9389f6ff1d5cb309be24bc608abbe0df6a7f5cb18c8f80a3bfa509058547c13551c3cd6a759af708fd0cdcdd9e95 +SHA512 (pytorch-6a89a75.tar.gz) = 6978acc6f37d7c5adc71517a6f379c7133b2bbd040189deddba7753acde41f6ddba2e9f2e397928e89c776d6a5458b8a74f8e04beb312d71fd30b072687ba98f commit 94fcbda00f37584b812d03f7e6735ec14410c68a Merge: d95ea06 cc26884 Author: Tom Rix <trix(a)redhat.com> Date: Thu Mar 21 04:39:57 2024 -0600 Merge branch 'rhel-test' of ssh://pkgs.fedoraproject.org/rpms/python-torch into rawhide Enable ROCm Signed-off-by: Tom Rix <trix(a)redhat.com> commit cc2688494a77a3e3a05f66d5728a34f736a5c1d8 Author: Tom Rix <trix(a)redhat.com> Date: Tue Mar 19 20:00:51 2024 -0600 Add roctracer Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/python-torch.spec b/python-torch.spec index 181382d..07a47eb 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -35,8 +35,8 @@ %bcond_with hipblaslt # Which families gpu build for %global rocm_gpu_list gfx8 gfx9 gfx10 gfx11 -%global rocm_default_gpu gfx9 -%bcond_with rocm_loop +%global rocm_default_gpu default +%bcond_without rocm_loop # For testing caffe2 %if 0%{?fedora} @@ -172,6 +172,7 @@ BuildRequires: rocm-runtime-devel BuildRequires: rocm-rpm-macros BuildRequires: rocm-rpm-macros-modules BuildRequires: rocthrust-devel +BuildRequires: roctracer-devel Requires: rocm-rpm-macros-modules %endif commit 74a2fd1d898282cee4274fffef1c5a738c253af6 Author: Tom Rix <trix(a)redhat.com> Date: Tue Mar 19 14:53:39 2024 -0400 Better disabling of aotriton Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/0001-disable-use-of-aotriton.patch b/0001-disable-use-of-aotriton.patch new file mode 100644 index 0000000..34a1704 --- /dev/null +++ b/0001-disable-use-of-aotriton.patch @@ -0,0 +1,46 @@ +From 33d48f71db7530f00dbd8cff281b65aa8b355b2a Mon Sep 17 00:00:00 2001 +From: Tom Rix <trix(a)redhat.com> +Date: Tue, 19 Mar 2024 11:32:37 -0400 +Subject: [PATCH] disable use of aotriton + +--- + aten/src/ATen/native/transformers/cuda/sdp_utils.cpp | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/aten/src/ATen/native/transformers/cuda/sdp_utils.cpp b/aten/src/ATen/native/transformers/cuda/sdp_utils.cpp +index 96b839820efd..2d3dd0cb4b0f 100644 +--- a/aten/src/ATen/native/transformers/cuda/sdp_utils.cpp ++++ b/aten/src/ATen/native/transformers/cuda/sdp_utils.cpp +@@ -21,9 +21,11 @@ + #include <cmath> + #include <functional> + ++#ifdef USE_FLASH_ATTENTION + #if USE_ROCM + #include <aotriton/flash.h> + #endif ++#endif + + /** + * Note [SDPA Runtime Dispatch] +@@ -183,6 +185,7 @@ bool check_sm_version(cudaDeviceProp * dprops) { + } + + bool check_flash_attention_hardware_support(sdp_params const& params, bool debug) { ++#ifdef USE_FLASH_ATTENTION + // Check that the gpu is capable of running flash attention + using sm80 = SMVersion<8, 0>; + using sm90 = SMVersion<9, 0>; +@@ -211,6 +214,9 @@ bool check_flash_attention_hardware_support(sdp_params const& params, bool debug + } + #endif + return true; ++#else ++ return false; ++#endif + } + + bool check_mem_efficient_hardware_support(sdp_params const& params, bool debug) { +-- +2.44.0 + diff --git a/python-torch.spec b/python-torch.spec index 7f9c596..181382d 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -98,6 +98,7 @@ Patch101: 0001-cuda-hip-signatures.patch Patch102: 0001-silence-an-assert.patch Patch103: 0001-can-not-use-with-c-files.patch Patch104: 0001-use-any-hip.patch +Patch105: 0001-disable-use-of-aotriton.patch %endif ExclusiveArch: x86_64 aarch64 @@ -278,8 +279,6 @@ sed -i -e '/fsspec/d' setup.py # A new dependency # Connected to USE_FLASH_ATTENTION, since this is off, do not need it sed -i -e '/aotriton.cmake/d' cmake/Dependencies.cmake -# sed -i -e '/aotriton/d' aten/src/ATen/native/transformers/cuda/sdp_utils.cpp -rm aten/src/ATen/native/transformers/cuda/sdp_utils.cpp # Release comes fully loaded with third party src # Remove what we can commit 5a5c58f298c41ccb079d81d7fb25407586445723 Author: Tom Rix <trix(a)redhat.com> Date: Tue Mar 19 08:14:22 2024 -0400 Fix ROCm build Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/python-torch.spec b/python-torch.spec index 313f013..7f9c596 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -26,7 +26,7 @@ %ifarch x86_64 %if 0%{?fedora} -%bcond_with rocm +%bcond_without rocm %else %bcond_with rocm %endif @@ -35,8 +35,8 @@ %bcond_with hipblaslt # Which families gpu build for %global rocm_gpu_list gfx8 gfx9 gfx10 gfx11 -%global rocm_default_gpu default -%bcond_without rocm_loop +%global rocm_default_gpu gfx9 +%bcond_with rocm_loop # For testing caffe2 %if 0%{?fedora} @@ -49,7 +49,7 @@ %bcond_with distributed # For testing openvs -%bcond_without opencv +%bcond_with opencv # For testing cuda %ifarch x86_64 @@ -265,7 +265,6 @@ cp -r cutlass-%{cul_ver}/* third_party/cutlass/ sed -i -e 's/USE_OPENCV AND OpenCV_FOUND AND USE_FFMPEG AND FFMPEG_FOUND/USE_OPENCV AND USE_FFMPEG/' caffe2/video/CMakeLists.txt sed -i -e 's/USE_OPENCV AND OpenCV_FOUND/USE_OPENCV/' caffe2/image/CMakeLists.txt sed -i -e 's/STATUS/FATAL/' caffe2/image/CMakeLists.txt -cat caffe2/image/CMakeLists.txt %endif %if 0%{?rhel} @@ -276,6 +275,12 @@ sed -i -e '/sympy/d' setup.py sed -i -e '/fsspec/d' setup.py %endif +# A new dependency +# Connected to USE_FLASH_ATTENTION, since this is off, do not need it +sed -i -e '/aotriton.cmake/d' cmake/Dependencies.cmake +# sed -i -e '/aotriton/d' aten/src/ATen/native/transformers/cuda/sdp_utils.cpp +rm aten/src/ATen/native/transformers/cuda/sdp_utils.cpp + # Release comes fully loaded with third party src # Remove what we can # @@ -396,6 +401,7 @@ export INTERN_BUILD_MOBILE=OFF export USE_DISTRIBUTED=OFF export USE_CUDA=OFF export USE_FBGEMM=OFF +export USE_FLASH_ATTENTION=OFF export USE_GOLD_LINKER=OFF export USE_ITT=OFF export USE_KINETO=OFF @@ -460,9 +466,11 @@ export BUILD_TEST=ON %if %{with rocm} export USE_ROCM=ON -export HIP_PATH=%{_prefix} -export ROCM_PATH=%{_prefix} -export DEVICE_LIB_PATH=%{clang_resource_dir}/amdgcn/bitcode +export HIP_PATH=`hipconfig -p` +export ROCM_PATH=`hipconfig -R` +export HIP_CLANG_PATH=`hipconfig -l` +RESOURCE_DIR=`${HIP_CLANG_PATH}/clang -print-resource-dir` +export DEVICE_LIB_PATH=${RESOURCE_DIR}/amdgcn/bitcode gpu=%{rocm_default_gpu} module load rocm/$gpu @@ -493,9 +501,11 @@ done %if %{with rocm} export USE_ROCM=ON -export HIP_PATH=%{_prefix} -export ROCM_PATH=%{_prefix} -export DEVICE_LIB_PATH=%{clang_resource_dir}/amdgcn/bitcode +export HIP_PATH=`hipconfig -p` +export ROCM_PATH=`hipconfig -R` +export HIP_CLANG_PATH=`hipconfig -l` +RESOURCE_DIR=`${HIP_CLANG_PATH}/clang -print-resource-dir` +export DEVICE_LIB_PATH=${RESOURCE_DIR}/amdgcn/bitcode gpu=%{rocm_default_gpu} module load rocm/$gpu @@ -541,9 +551,11 @@ done %{python3_sitearch}/caffe2 %endif %if %{with rocm} +%if %{with rocm_loop} %{_libdir}/rocm/gfx*/bin/* %{_libdir}/rocm/gfx*/lib64/* %endif +%endif %changelog %autochangelog commit d95ea061ca1fa120587c7496cea1e815e7e4cbc1 Author: Tom Rix <trix(a)redhat.com> Date: Sat Mar 16 16:16:44 2024 -0400 Disable opencv Linking problem with gdal Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/python-torch.spec b/python-torch.spec index 3fbab79..5975969 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -48,7 +48,7 @@ %bcond_with distributed # For testing openvs -%bcond_without opencv +%bcond_with opencv # For testing cuda %ifarch x86_64 commit 6989951b26a6532106a941846464a8d6fa28e073 Author: Tom Rix <trix(a)redhat.com> Date: Sat Mar 16 15:39:58 2024 -0400 Update to 2.3.0-rc2 Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/python-torch.spec b/python-torch.spec index 3fbab79..313f013 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -4,11 +4,12 @@ %global forgeurl https://github.com/pytorch/pytorch # So pre releases can be tried -%bcond_with gitcommit +%bcond_without gitcommit %if %{with gitcommit} -%global commit0 975d4284250170602db60adfda5eb1664a3b8acc +# git tag v2.3.0-rc2 +%global commit0 6a89a753b1556fe8558582c452fdba083f6ec01a %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) -%global date0 20240307 +%global date0 20240313 %else %global commit0 975d4284250170602db60adfda5eb1664a3b8acc %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) commit 78b817618e9093f96987517e22b7868363a9e6c5 Author: Tom Rix <trix(a)redhat.com> Date: Sat Mar 16 07:38:18 2024 -0400 Sources for pybind11 Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/.gitignore b/.gitignore index 5f41933..612c3df 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,4 @@ /pytorch-v2.1.2.tar.gz /pytorch-975d428.tar.gz /v23.3.3.tar.gz +/v2.11.1.tar.gz diff --git a/sources b/sources index 8264585..37652db 100644 --- a/sources +++ b/sources @@ -2,3 +2,4 @@ SHA512 (pytorch-v2.1.0.tar.gz) = 59421bf6cea6661d61ed66ab16526e3a07162e70e53381c SHA512 (pytorch-v2.1.2.tar.gz) = b7305407ad9dda877d277a0e7009f65f6d69f39370f2231b8bb8c6a9b711022d2129febdb00f5c83751b6664e01000fe2d30c5e5c13757de89fb8b2b99197a28 SHA512 (pytorch-975d428.tar.gz) = a02195b18d832db9a739c3eeecd0cd0c8868d8b92e4a2fca42e4bdd20735f0745d84573df28d9ae1db014cf79ffd005a8409b3e8bb92f9db2a446f784ef46ff4 SHA512 (v23.3.3.tar.gz) = 4066c94f2473c7ea16917d29a613e16f840a329089c88e0bdbdb999aef3442ba00abfd2aa92266fa9c067e399dc88e6f0ccac40dc151378857e665638e78bbf0 +SHA512 (v2.11.1.tar.gz) = ed1512ff0bca3bc0a45edc2eb8c77f8286ab9389f6ff1d5cb309be24bc608abbe0df6a7f5cb18c8f80a3bfa509058547c13551c3cd6a759af708fd0cdcdd9e95 commit 650e5d21514606770c1f6910e83912d41eff5bf9 Author: Tom Rix <trix(a)redhat.com> Date: Sat Mar 16 07:37:39 2024 -0400 Sources for flatbuffers Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/.gitignore b/.gitignore index b7ab044..5f41933 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,4 @@ /pytorch-v2.1.0.tar.gz /pytorch-v2.1.2.tar.gz /pytorch-975d428.tar.gz +/v23.3.3.tar.gz diff --git a/sources b/sources index 6f96f49..8264585 100644 --- a/sources +++ b/sources @@ -1,3 +1,4 @@ SHA512 (pytorch-v2.1.0.tar.gz) = 59421bf6cea6661d61ed66ab16526e3a07162e70e53381cbd5987042917610ec993d2f151fb086f0f98e5a396fe69e82bbc76f840bebffe4ebe7f50458c3aa44 SHA512 (pytorch-v2.1.2.tar.gz) = b7305407ad9dda877d277a0e7009f65f6d69f39370f2231b8bb8c6a9b711022d2129febdb00f5c83751b6664e01000fe2d30c5e5c13757de89fb8b2b99197a28 SHA512 (pytorch-975d428.tar.gz) = a02195b18d832db9a739c3eeecd0cd0c8868d8b92e4a2fca42e4bdd20735f0745d84573df28d9ae1db014cf79ffd005a8409b3e8bb92f9db2a446f784ef46ff4 +SHA512 (v23.3.3.tar.gz) = 4066c94f2473c7ea16917d29a613e16f840a329089c88e0bdbdb999aef3442ba00abfd2aa92266fa9c067e399dc88e6f0ccac40dc151378857e665638e78bbf0 commit 013c9ee8e6163f486844bc0efbb86748be4c3158 Author: Tom Rix <trix(a)redhat.com> Date: Sat Mar 16 07:35:56 2024 -0400 Source for 2.3 Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/.gitignore b/.gitignore index 3f2501f..b7ab044 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,3 @@ /pytorch-v2.1.0.tar.gz /pytorch-v2.1.2.tar.gz +/pytorch-975d428.tar.gz diff --git a/sources b/sources index 90b1128..6f96f49 100644 --- a/sources +++ b/sources @@ -1,2 +1,3 @@ SHA512 (pytorch-v2.1.0.tar.gz) = 59421bf6cea6661d61ed66ab16526e3a07162e70e53381cbd5987042917610ec993d2f151fb086f0f98e5a396fe69e82bbc76f840bebffe4ebe7f50458c3aa44 SHA512 (pytorch-v2.1.2.tar.gz) = b7305407ad9dda877d277a0e7009f65f6d69f39370f2231b8bb8c6a9b711022d2129febdb00f5c83751b6664e01000fe2d30c5e5c13757de89fb8b2b99197a28 +SHA512 (pytorch-975d428.tar.gz) = a02195b18d832db9a739c3eeecd0cd0c8868d8b92e4a2fca42e4bdd20735f0745d84573df28d9ae1db014cf79ffd005a8409b3e8bb92f9db2a446f784ef46ff4 commit 9c54f7253139fd48b3e243ab223d1dea9e1e4d0e Author: Tom Rix <trix(a)redhat.com> Date: Sat Mar 16 07:34:21 2024 -0400 Update to 2.3 beta Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/next/pyproject.toml b/pyproject.toml similarity index 100% rename from next/pyproject.toml rename to pyproject.toml commit a2a745f76669f491ca2975e1dec7dc8ca7c51458 Author: Tom Rix <trix(a)redhat.com> Date: Fri Mar 15 12:02:53 2024 -0400 Enable caffe2 Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/python-torch.spec b/python-torch.spec index 5c6b771..3fbab79 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -37,22 +37,19 @@ %global rocm_default_gpu default %bcond_without rocm_loop -%bcond_with foxi # For testing caffe2 %if 0%{?fedora} -# need foxi-devel -%if %{with foxi} %bcond_without caffe2 %else %bcond_with caffe2 %endif -%else -%bcond_with caffe2 -%endif # For testing distributed %bcond_with distributed +# For testing openvs +%bcond_without opencv + # For testing cuda %ifarch x86_64 %bcond_with cuda @@ -102,19 +99,15 @@ Patch103: 0001-can-not-use-with-c-files.patch Patch104: 0001-use-any-hip.patch %endif -# Limit to these because they are well behaved with clang ExclusiveArch: x86_64 aarch64 -%if 0%{?fedora} -%global toolchain clang -%else -# RHEL does not do clang well, nor lto +%global toolchain gcc %global _lto_cflags %nil -%endif BuildRequires: cmake BuildRequires: cpuinfo-devel BuildRequires: eigen3-devel BuildRequires: fmt-devel +BuildRequires: foxi-devel BuildRequires: FP16-devel BuildRequires: fxdiv-devel BuildRequires: gcc-c++ @@ -181,12 +174,11 @@ BuildRequires: rocthrust-devel Requires: rocm-rpm-macros-modules %endif -%if %{with foxi} -%if %{with caffe2} -BuildRequires: foxi-devel -%endif +%if %{with opencv} +BuildRequires: opencv-devel %endif + %if %{with test} BuildRequires: google-benchmark-devel %endif @@ -446,6 +438,10 @@ export USE_CUDA=ON export USE_DISTRIBUTED=ON %endif +%if %{with opencv} +export USE_OPENCV=ON +%endif + %if %{with test} export BUILD_TEST=ON %endif commit dc89ef898a61f95864cc1cf6db28df680d3b03f6 Author: Tom Rix <trix(a)redhat.com> Date: Tue Mar 12 10:05:39 2024 -0400 Prep for 2.3 changeover Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/next/0001-Optionally-use-hipblaslt.patch b/0001-Optionally-use-hipblaslt.patch similarity index 100% rename from next/0001-Optionally-use-hipblaslt.patch rename to 0001-Optionally-use-hipblaslt.patch diff --git a/0001-Prepare-pytorch-cmake-for-fedora.patch b/0001-Prepare-pytorch-cmake-for-fedora.patch deleted file mode 100644 index cf1e843..0000000 --- a/0001-Prepare-pytorch-cmake-for-fedora.patch +++ /dev/null @@ -1,169 +0,0 @@ -From 24cf0294a67d89ad70367940eea872162b44482c Mon Sep 17 00:00:00 2001 -From: Tom Rix <trix(a)redhat.com> -Date: Sat, 23 Sep 2023 10:18:52 -0700 -Subject: [PATCH] Prepare pytorch cmake for fedora - -Use the system fmt -Remove foxi use -Remove warnings/errors for clang 17 -fxdiv is not a library -build type is RelWithDebInfo -use system pthreadpool - -Signed-off-by: Tom Rix <trix(a)redhat.com> ---- - CMakeLists.txt | 6 +++--- - .../native/quantized/cpu/qnnpack/CMakeLists.txt | 3 --- - c10/CMakeLists.txt | 2 +- - caffe2/CMakeLists.txt | 6 +----- - cmake/Dependencies.cmake | 16 +--------------- - test/cpp/tensorexpr/CMakeLists.txt | 2 +- - torch/CMakeLists.txt | 2 +- - 7 files changed, 8 insertions(+), 29 deletions(-) - -diff --git a/CMakeLists.txt b/CMakeLists.txt -index 3a48eaf4e2..902ee70fd1 100644 ---- a/CMakeLists.txt -+++ b/CMakeLists.txt -@@ -682,7 +682,7 @@ set(CAFFE2_ALLOWLIST "" CACHE STRING "A allowlist file of files that one should - # Set default build type - if(NOT CMAKE_BUILD_TYPE) - message(STATUS "Build type not set - defaulting to Release") -- set(CMAKE_BUILD_TYPE "Release" CACHE STRING "Choose the type of build from: Debug Release RelWithDebInfo MinSizeRel Coverage." FORCE) -+ set(CMAKE_BUILD_TYPE "RelWithDebInfo" CACHE STRING "Choose the type of build from: Debug Release RelWithDebInfo MinSizeRel Coverage." FORCE) - endif() - - # The below means we are cross compiling for arm64 or x86_64 on MacOSX -@@ -917,8 +917,8 @@ if(NOT MSVC) - string(APPEND CMAKE_LINKER_FLAGS_DEBUG " -fno-omit-frame-pointer -O0") - append_cxx_flag_if_supported("-fno-math-errno" CMAKE_CXX_FLAGS) - append_cxx_flag_if_supported("-fno-trapping-math" CMAKE_CXX_FLAGS) -- append_cxx_flag_if_supported("-Werror=format" CMAKE_CXX_FLAGS) -- append_cxx_flag_if_supported("-Werror=cast-function-type" CMAKE_CXX_FLAGS) -+# append_cxx_flag_if_supported("-Werror=format" CMAKE_CXX_FLAGS) -+# append_cxx_flag_if_supported("-Werror=cast-function-type" CMAKE_CXX_FLAGS) - else() - # skip unwanted includes from windows.h - add_compile_definitions(WIN32_LEAN_AND_MEAN) -diff --git a/aten/src/ATen/native/quantized/cpu/qnnpack/CMakeLists.txt b/aten/src/ATen/native/quantized/cpu/qnnpack/CMakeLists.txt -index fd6b7ff551..218c8e9b2a 100644 ---- a/aten/src/ATen/native/quantized/cpu/qnnpack/CMakeLists.txt -+++ b/aten/src/ATen/native/quantized/cpu/qnnpack/CMakeLists.txt -@@ -393,10 +393,7 @@ elseif(NOT TARGET fxdiv AND USE_SYSTEM_FXDIV) - if(NOT FXDIV_HDR) - message(FATAL_ERROR "Cannot find fxdiv") - endif() -- add_library(fxdiv STATIC "${FXDIV_HDR}") -- set_property(TARGET fxdiv PROPERTY LINKER_LANGUAGE C) - endif() --target_link_libraries(pytorch_qnnpack PRIVATE fxdiv) - - # ---[ Configure psimd - if(NOT TARGET psimd AND NOT USE_SYSTEM_PSIMD) -diff --git a/c10/CMakeLists.txt b/c10/CMakeLists.txt -index feebad7cbb..7c029cd88d 100644 ---- a/c10/CMakeLists.txt -+++ b/c10/CMakeLists.txt -@@ -87,7 +87,7 @@ endif() - if(${USE_GLOG}) - target_link_libraries(c10 PUBLIC glog::glog) - endif() --target_link_libraries(c10 PRIVATE fmt::fmt-header-only) -+target_link_libraries(c10 PRIVATE fmt) - - find_package(Backtrace) - if(Backtrace_FOUND) -diff --git a/caffe2/CMakeLists.txt b/caffe2/CMakeLists.txt -index 74d0d55719..b975d388a7 100644 ---- a/caffe2/CMakeLists.txt -+++ b/caffe2/CMakeLists.txt -@@ -107,7 +107,7 @@ endif() - # Note: the folders that are being commented out have not been properly - # addressed yet. - --if(NOT MSVC AND USE_XNNPACK) -+if(NOT MSVC AND USE_XNNPACK AND NOT USE_SYSTEM_FXDIV) - if(NOT TARGET fxdiv) - set(FXDIV_BUILD_TESTS OFF CACHE BOOL "") - set(FXDIV_BUILD_BENCHMARKS OFF CACHE BOOL "") -@@ -1022,10 +1022,6 @@ elseif(USE_CUDA) - endif() - endif() - --if(NOT MSVC AND USE_XNNPACK) -- TARGET_LINK_LIBRARIES(torch_cpu PRIVATE fxdiv) --endif() -- - # ========================================================== - # formerly-libtorch flags - # ========================================================== -diff --git a/cmake/Dependencies.cmake b/cmake/Dependencies.cmake -index c3abce52e4..21b40f3a88 100644 ---- a/cmake/Dependencies.cmake -+++ b/cmake/Dependencies.cmake -@@ -1555,7 +1555,6 @@ if(CAFFE2_CMAKE_BUILDING_WITH_MAIN_REPO AND NOT INTERN_DISABLE_ONNX) - set_target_properties(onnx_proto PROPERTIES CXX_STANDARD 17) - endif() - endif() -- add_subdirectory(${CMAKE_CURRENT_LIST_DIR}/../third_party/foxi EXCLUDE_FROM_ALL) - - add_definitions(-DONNX_NAMESPACE=${ONNX_NAMESPACE}) - if(NOT USE_SYSTEM_ONNX) -@@ -1588,8 +1587,6 @@ if(CAFFE2_CMAKE_BUILDING_WITH_MAIN_REPO AND NOT INTERN_DISABLE_ONNX) - message("-- Found onnx: ${ONNX_LIBRARY} ${ONNX_PROTO_LIBRARY}") - list(APPEND Caffe2_DEPENDENCY_LIBS onnx_proto onnx) - endif() -- include_directories(${FOXI_INCLUDE_DIRS}) -- list(APPEND Caffe2_DEPENDENCY_LIBS foxi_loader) - # Recover the build shared libs option. - set(BUILD_SHARED_LIBS ${TEMP_BUILD_SHARED_LIBS}) - endif() -@@ -1834,18 +1831,7 @@ endif() - # - set(TEMP_BUILD_SHARED_LIBS ${BUILD_SHARED_LIBS}) - set(BUILD_SHARED_LIBS OFF CACHE BOOL "Build shared libs" FORCE) --add_subdirectory(${PROJECT_SOURCE_DIR}/third_party/fmt) -- --# Disable compiler feature checks for `fmt`. --# --# CMake compiles a little program to check compiler features. Some of our build --# configurations (notably the mobile build analyzer) will populate --# CMAKE_CXX_FLAGS in ways that break feature checks. Since we already know --# `fmt` is compatible with a superset of the compilers that PyTorch is, it --# shouldn't be too bad to just disable the checks. --set_target_properties(fmt-header-only PROPERTIES INTERFACE_COMPILE_FEATURES "") -- --list(APPEND Caffe2_DEPENDENCY_LIBS fmt::fmt-header-only) -+list(APPEND Caffe2_DEPENDENCY_LIBS fmt) - set(BUILD_SHARED_LIBS ${TEMP_BUILD_SHARED_LIBS} CACHE BOOL "Build shared libs" FORCE) - - # ---[ Kineto -diff --git a/test/cpp/tensorexpr/CMakeLists.txt b/test/cpp/tensorexpr/CMakeLists.txt -index 7dff70630d..90b1003591 100644 ---- a/test/cpp/tensorexpr/CMakeLists.txt -+++ b/test/cpp/tensorexpr/CMakeLists.txt -@@ -54,7 +54,7 @@ target_include_directories(tutorial_tensorexpr PRIVATE ${ATen_CPU_INCLUDE}) - # pthreadpool header. For some build environment we need add the dependency - # explicitly. - if(USE_PTHREADPOOL) -- target_link_libraries(test_tensorexpr PRIVATE pthreadpool_interface) -+ target_link_libraries(test_tensorexpr PRIVATE pthreadpool) - endif() - if(USE_CUDA) - target_link_libraries(test_tensorexpr PRIVATE -diff --git a/torch/CMakeLists.txt b/torch/CMakeLists.txt -index 62ee4c12a9..8d5375f320 100644 ---- a/torch/CMakeLists.txt -+++ b/torch/CMakeLists.txt -@@ -84,7 +84,7 @@ set(TORCH_PYTHON_LINK_LIBRARIES - python::python - pybind::pybind11 - shm -- fmt::fmt-header-only -+ fmt - ATEN_CPU_FILES_GEN_LIB) - - if(USE_ASAN AND TARGET Sanitizer::address) --- -2.42.1 - diff --git a/next/0001-Regenerate-flatbuffer-header.patch b/0001-Regenerate-flatbuffer-header.patch similarity index 100% rename from next/0001-Regenerate-flatbuffer-header.patch rename to 0001-Regenerate-flatbuffer-header.patch diff --git a/next/0001-Stub-in-kineto-ActivityType.patch b/0001-Stub-in-kineto-ActivityType.patch similarity index 100% rename from next/0001-Stub-in-kineto-ActivityType.patch rename to 0001-Stub-in-kineto-ActivityType.patch diff --git a/0001-add-rocm_version-fallback.patch b/0001-add-rocm_version-fallback.patch deleted file mode 100644 index 25a0c67..0000000 --- a/0001-add-rocm_version-fallback.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 1d35a0b1f5cb39fd0c44a486157dc739a02c71b6 Mon Sep 17 00:00:00 2001 -From: Tom Rix <trix(a)redhat.com> -Date: Wed, 20 Dec 2023 11:23:18 -0500 -Subject: [PATCH] add rocm_version fallback - -Signed-off-by: Tom Rix <trix(a)redhat.com> ---- - torch/utils/hipify/cuda_to_hip_mappings.py | 12 ++++++++++++ - 1 file changed, 12 insertions(+) - -diff --git a/torch/utils/hipify/cuda_to_hip_mappings.py b/torch/utils/hipify/cuda_to_hip_mappings.py -index 73586440e7..9354057a39 100644 ---- a/torch/utils/hipify/cuda_to_hip_mappings.py -+++ b/torch/utils/hipify/cuda_to_hip_mappings.py -@@ -57,6 +57,18 @@ if os.path.isfile(rocm_version_h): - if match: - patch = int(match.group(1)) - rocm_version = (major, minor, patch) -+else: -+ try: -+ hip_version = subprocess.check_output(["hipconfig", "--version"]).decode("utf-8") -+ hip_split = hip_version.split('.') -+ rocm_version = (int(hip_split[0]), int(hip_split[1]), 0) -+ except subprocess.CalledProcessError: -+ print(f"Warning: hipconfig --version failed") -+ except (FileNotFoundError, PermissionError, NotADirectoryError): -+ # Do not print warning. This is okay. This file can also be imported for non-ROCm builds. -+ pass -+ -+ - - # List of math functions that should be replaced inside device code only. - MATH_TRANSPILATIONS = collections.OrderedDict( --- -2.43.0 - diff --git a/next/0001-can-not-use-with-c-files.patch b/0001-can-not-use-with-c-files.patch similarity index 100% rename from next/0001-can-not-use-with-c-files.patch rename to 0001-can-not-use-with-c-files.patch diff --git a/next/0001-cuda-hip-signatures.patch b/0001-cuda-hip-signatures.patch similarity index 100% rename from next/0001-cuda-hip-signatures.patch rename to 0001-cuda-hip-signatures.patch diff --git a/0001-disable-as-needed-for-libtorch.patch b/0001-disable-as-needed-for-libtorch.patch deleted file mode 100644 index 392140a..0000000 --- a/0001-disable-as-needed-for-libtorch.patch +++ /dev/null @@ -1,28 +0,0 @@ -From 06499575b177a218846f0e43ff4bc77d245f207f Mon Sep 17 00:00:00 2001 -From: Tom Rix <trix(a)redhat.com> -Date: Fri, 1 Dec 2023 09:38:05 -0500 -Subject: [PATCH] disable as-needed for libtorch - -Signed-off-by: Tom Rix <trix(a)redhat.com> ---- - caffe2/CMakeLists.txt | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/caffe2/CMakeLists.txt b/caffe2/CMakeLists.txt -index b975d388a7..5e9fd3b3f3 100644 ---- a/caffe2/CMakeLists.txt -+++ b/caffe2/CMakeLists.txt -@@ -914,6 +914,10 @@ if(HAVE_SOVERSION) - VERSION ${TORCH_VERSION} SOVERSION ${TORCH_SOVERSION}) - endif() - -+# Disable global as-needed -+set_target_properties(torch PROPERTIES LINK_FLAGS -Wl,--no-as-needed) -+ -+ - if(USE_ROCM) - filter_list(__caffe2_hip_srcs_cpp Caffe2_HIP_SRCS "\\.(cu|hip)$") - set_source_files_properties(${__caffe2_hip_srcs_cpp} PROPERTIES HIP_SOURCE_PROPERTY_FORMAT 1) --- -2.42.1 - diff --git a/next/0001-disable-submodule-search.patch b/0001-disable-submodule-search.patch similarity index 100% rename from next/0001-disable-submodule-search.patch rename to 0001-disable-submodule-search.patch diff --git a/next/0001-no-third_party-FXdiv.patch b/0001-no-third_party-FXdiv.patch similarity index 100% rename from next/0001-no-third_party-FXdiv.patch rename to 0001-no-third_party-FXdiv.patch diff --git a/next/0001-no-third_party-fmt.patch b/0001-no-third_party-fmt.patch similarity index 100% rename from next/0001-no-third_party-fmt.patch rename to 0001-no-third_party-fmt.patch diff --git a/next/0001-no-third_party-foxi.patch b/0001-no-third_party-foxi.patch similarity index 100% rename from next/0001-no-third_party-foxi.patch rename to 0001-no-third_party-foxi.patch diff --git a/0001-python-torch-link-with-python.patch b/0001-python-torch-link-with-python.patch deleted file mode 100644 index d52f034..0000000 --- a/0001-python-torch-link-with-python.patch +++ /dev/null @@ -1,27 +0,0 @@ -From cef92207b79ad53e3fcc1b0e22ba91cb9422968c Mon Sep 17 00:00:00 2001 -From: Tom Rix <trix(a)redhat.com> -Date: Sat, 18 Nov 2023 09:38:52 -0500 -Subject: [PATCH] python-torch link with python - -Signed-off-by: Tom Rix <trix(a)redhat.com> ---- - torch/CMakeLists.txt | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/torch/CMakeLists.txt b/torch/CMakeLists.txt -index 8d5375f320..6f8c7b65c4 100644 ---- a/torch/CMakeLists.txt -+++ b/torch/CMakeLists.txt -@@ -312,6 +312,9 @@ add_dependencies(torch_python torch_python_stubs) - add_dependencies(torch_python flatbuffers) - - -+# Unresolved syms in -lpython -+target_link_libraries(torch_python PUBLIC ${PYTHON_LIBRARIES}) -+ - if(USE_PRECOMPILED_HEADERS) - target_precompile_headers(torch_python PRIVATE - "$<$<COMPILE_LANGUAGE:CXX>:ATen/ATen.h>") --- -2.42.1 - diff --git a/0001-python-torch-remove-ubuntu-specific-linking.patch b/0001-python-torch-remove-ubuntu-specific-linking.patch deleted file mode 100644 index 6d9bd24..0000000 --- a/0001-python-torch-remove-ubuntu-specific-linking.patch +++ /dev/null @@ -1,33 +0,0 @@ -From f70ef37d0b3c780fd17be199e66a81ffa679f93e Mon Sep 17 00:00:00 2001 -From: Tom Rix <trix(a)redhat.com> -Date: Sat, 18 Nov 2023 12:05:43 -0500 -Subject: [PATCH] python-torch remove ubuntu specific linking - -Signed-off-by: Tom Rix <trix(a)redhat.com> ---- - CMakeLists.txt | 9 ++++++--- - 1 file changed, 6 insertions(+), 3 deletions(-) - -diff --git a/CMakeLists.txt b/CMakeLists.txt -index 86c34984b2..f7c4a7b05f 100644 ---- a/CMakeLists.txt -+++ b/CMakeLists.txt -@@ -479,9 +479,12 @@ option(BUILD_EXECUTORCH "Master flag to build Executorch" ON) - # This is a fix for a rare build issue on Ubuntu: - # symbol lookup error: miniconda3/envs/pytorch-py3.7/lib/libmkl_intel_lp64.so: undefined symbol: mkl_blas_dsyrk - # https://software.intel.com/en-us/articles/symbol-lookup-error-when-linking-… --if(LINUX) -- set(CMAKE_SHARED_LINKER_FLAGS "${CMAKE_SHARED_LINKER_FLAGS} -Wl,--no-as-needed") --endif() -+ -+# This is not ubuntu! -+# if(LINUX) -+# set(CMAKE_SHARED_LINKER_FLAGS "${CMAKE_SHARED_LINKER_FLAGS} -Wl,--no-as-needed") -+# endif() -+set(CMAKE_SHARED_LINKER_FLAGS "${CMAKE_SHARED_LINKER_FLAGS} -Wl,--as-needed") - - if(MSVC) - set(CMAKE_NINJA_CMCLDEPS_RC OFF) --- -2.42.1 - diff --git a/0001-pytorch-use-SO-version-by-default.patch b/0001-pytorch-use-SO-version-by-default.patch deleted file mode 100644 index b70d6ec..0000000 --- a/0001-pytorch-use-SO-version-by-default.patch +++ /dev/null @@ -1,26 +0,0 @@ -From 527d1ce24a06a14788ca5fc2411985d7c1cb2923 Mon Sep 17 00:00:00 2001 -From: Tom Rix <trix(a)redhat.com> -Date: Fri, 13 Oct 2023 05:35:19 -0700 -Subject: [PATCH] pytorch use SO version by default - -Signed-off-by: Tom Rix <trix(a)redhat.com> ---- - CMakeLists.txt | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/CMakeLists.txt b/CMakeLists.txt -index 902ee70fd1..86c34984b2 100644 ---- a/CMakeLists.txt -+++ b/CMakeLists.txt -@@ -340,7 +340,7 @@ option(USE_TBB "Use TBB (Deprecated)" OFF) - cmake_dependent_option( - USE_SYSTEM_TBB "Use system-provided Intel TBB." OFF "USE_TBB" OFF) - option(ONNX_ML "Enable traditional ONNX ML API." ON) --option(HAVE_SOVERSION "Whether to add SOVERSION to the shared objects" OFF) -+option(HAVE_SOVERSION "Whether to add SOVERSION to the shared objects" ON) - option(BUILD_LIBTORCH_CPU_WITH_DEBUG "Enable RelWithDebInfo for libtorch_cpu target only" OFF) - cmake_dependent_option(USE_CCACHE "Attempt using CCache to wrap the compilation" ON "UNIX" OFF) - option(WERROR "Build with -Werror supported by the compiler" OFF) --- -2.42.1 - diff --git a/next/0001-reenable-foxi-linking.patch b/0001-reenable-foxi-linking.patch similarity index 100% rename from next/0001-reenable-foxi-linking.patch rename to 0001-reenable-foxi-linking.patch diff --git a/next/0001-silence-an-assert.patch b/0001-silence-an-assert.patch similarity index 100% rename from next/0001-silence-an-assert.patch rename to 0001-silence-an-assert.patch diff --git a/0001-torch-sane-version.patch b/0001-torch-sane-version.patch deleted file mode 100644 index cb1211a..0000000 --- a/0001-torch-sane-version.patch +++ /dev/null @@ -1,32 +0,0 @@ -From c47c6e202d60ccac15aa36698bd4788415a9416b Mon Sep 17 00:00:00 2001 -From: Tom Rix <trix(a)redhat.com> -Date: Sat, 25 Nov 2023 16:46:17 -0500 -Subject: [PATCH] torch sane version - ---- - tools/generate_torch_version.py | 1 + - version.txt | 2 +- - 2 files changed, 2 insertions(+), 1 deletion(-) - -diff --git a/tools/generate_torch_version.py b/tools/generate_torch_version.py -index d90d3646ab..11d5bbeba5 100644 ---- a/tools/generate_torch_version.py -+++ b/tools/generate_torch_version.py -@@ -42,6 +42,7 @@ def get_tag(pytorch_root: Union[str, Path]) -> str: - def get_torch_version(sha: Optional[str] = None) -> str: - pytorch_root = Path(__file__).parent.parent - version = open(pytorch_root / "version.txt").read().strip() -+ return version - - if os.getenv("PYTORCH_BUILD_VERSION"): - assert os.getenv("PYTORCH_BUILD_NUMBER") is not None -diff --git a/version.txt b/version.txt -index ecaf4eea7c..7ec1d6db40 100644 ---- a/version.txt -+++ b/version.txt -@@ -1,1 +1,1 @@ --2.1.0a0 -+2.1.2 --- -2.42.1 - diff --git a/next/0001-use-any-hip.patch b/0001-use-any-hip.patch similarity index 100% rename from next/0001-use-any-hip.patch rename to 0001-use-any-hip.patch diff --git a/0002-Regenerate-flatbuffer-header.patch b/0002-Regenerate-flatbuffer-header.patch deleted file mode 100644 index 662a7c5..0000000 --- a/0002-Regenerate-flatbuffer-header.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 587a8b10bd3f7a68275356ee6eb6bb43ed711ba2 Mon Sep 17 00:00:00 2001 -From: Tom Rix <trix(a)redhat.com> -Date: Fri, 29 Sep 2023 06:19:29 -0700 -Subject: [PATCH 2/6] Regenerate flatbuffer header - -For this error -torch/csrc/jit/serialization/mobile_bytecode_generated.h:12:41: -error: static assertion failed: Non-compatible flatbuffers version included - 12 | FLATBUFFERS_VERSION_MINOR == 3 && - -PyTorch is expecting 23.3.3, what f38 has -Rawhide is at 23.5.26 - -Regenerate with -flatc --cpp --gen-mutable --no-prefix --scoped-enums mobile_bytecode.fbs - -Signed-off-by: Tom Rix <trix(a)redhat.com> ---- - torch/csrc/jit/serialization/mobile_bytecode_generated.h | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/torch/csrc/jit/serialization/mobile_bytecode_generated.h b/torch/csrc/jit/serialization/mobile_bytecode_generated.h -index cffe8bc7a6..83575e4c19 100644 ---- a/torch/csrc/jit/serialization/mobile_bytecode_generated.h -+++ b/torch/csrc/jit/serialization/mobile_bytecode_generated.h -@@ -9,8 +9,8 @@ - // Ensure the included flatbuffers.h is the same version as when this file was - // generated, otherwise it may not be compatible. - static_assert(FLATBUFFERS_VERSION_MAJOR == 23 && -- FLATBUFFERS_VERSION_MINOR == 3 && -- FLATBUFFERS_VERSION_REVISION == 3, -+ FLATBUFFERS_VERSION_MINOR == 5 && -+ FLATBUFFERS_VERSION_REVISION == 26, - "Non-compatible flatbuffers version included"); - - namespace torch { --- -2.41.0 - diff --git a/0003-Stub-in-kineto-ActivityType.patch b/0003-Stub-in-kineto-ActivityType.patch deleted file mode 100644 index 0823acb..0000000 --- a/0003-Stub-in-kineto-ActivityType.patch +++ /dev/null @@ -1,73 +0,0 @@ -From bb52aeacc6dfab2355249b7b5beb72c2761ec319 Mon Sep 17 00:00:00 2001 -From: Tom Rix <trix(a)redhat.com> -Date: Fri, 29 Sep 2023 06:25:23 -0700 -Subject: [PATCH 3/6] Stub in kineto ActivityType - -There is an error with kineto is not used, the shim still -requires the ActivityTYpe.h header to get the enum Activity type. -So cut-n-paste just enough of the header in to do this. - -Signed-off-by: Tom Rix <trix(a)redhat.com> ---- - torch/csrc/profiler/kineto_shim.h | 44 +++++++++++++++++++++++++++++++ - 1 file changed, 44 insertions(+) - -diff --git a/torch/csrc/profiler/kineto_shim.h b/torch/csrc/profiler/kineto_shim.h -index 2a410719a1..7d6525befd 100644 ---- a/torch/csrc/profiler/kineto_shim.h -+++ b/torch/csrc/profiler/kineto_shim.h -@@ -12,7 +12,51 @@ - #undef USE_KINETO - #endif - -+#ifdef USE_KINETO - #include <ActivityType.h> -+#else -+namespace libkineto { -+// copied from header -+/* -+ * Copyright (c) Meta Platforms, Inc. and affiliates. -+ * All rights reserved. -+ * -+ * This source code is licensed under the BSD-style license found in the -+ * LICENSE file in the root directory of this source tree. -+ */ -+ -+// Note : All activity types are not enabled by default. Please add them -+// at correct position in the enum -+enum class ActivityType { -+ // Activity types enabled by default -+ CPU_OP = 0, // cpu side ops -+ USER_ANNOTATION, -+ GPU_USER_ANNOTATION, -+ GPU_MEMCPY, -+ GPU_MEMSET, -+ CONCURRENT_KERNEL, // on-device kernels -+ EXTERNAL_CORRELATION, -+ CUDA_RUNTIME, // host side cuda runtime events -+ CUDA_DRIVER, // host side cuda driver events -+ CPU_INSTANT_EVENT, // host side point-like events -+ PYTHON_FUNCTION, -+ OVERHEAD, // CUPTI induced overhead events sampled from its overhead API. -+ -+ // Optional Activity types -+ CUDA_SYNC, // synchronization events between runtime and kernels -+ GLOW_RUNTIME, // host side glow runtime events -+ MTIA_RUNTIME, // host side MTIA runtime events -+ CUDA_PROFILER_RANGE, // CUPTI Profiler range for performance metrics -+ MTIA_CCP_EVENTS, // MTIA ondevice CCP events -+ HPU_OP, // HPU host side runtime event -+ XPU_RUNTIME, // host side xpu runtime events -+ -+ ENUM_COUNT, // This is to add buffer and not used for any profiling logic. Add your new type before it. -+ OPTIONAL_ACTIVITY_TYPE_START = CUDA_SYNC, -+}; -+} -+ -+#endif - - #include <torch/csrc/Export.h> - #include <torch/csrc/profiler/api.h> --- -2.41.0 - diff --git a/0004-torch-python-3.12-changes.patch b/0004-torch-python-3.12-changes.patch deleted file mode 100644 index bdcec7f..0000000 --- a/0004-torch-python-3.12-changes.patch +++ /dev/null @@ -1,45 +0,0 @@ -From fcf3cd70229cdc729d05ddab081ac886c9db6bd7 Mon Sep 17 00:00:00 2001 -From: Tom Rix <trix(a)redhat.com> -Date: Fri, 29 Sep 2023 13:58:28 -0700 -Subject: [PATCH] torch python 3.12 changes - -Signed-off-by: Tom Rix <trix(a)redhat.com> ---- - functorch/csrc/dim/dim.cpp | 6 ++++++ - torch/csrc/dynamo/cpython_defs.h | 2 +- - 2 files changed, 7 insertions(+), 1 deletion(-) - -diff --git a/functorch/csrc/dim/dim.cpp b/functorch/csrc/dim/dim.cpp -index b611dc3e8c2..c7009478aee 100644 ---- a/functorch/csrc/dim/dim.cpp -+++ b/functorch/csrc/dim/dim.cpp -@@ -10,7 +10,13 @@ - // Many APIs have changed/don't exist anymore - #if IS_PYTHON_3_12_PLUS - -+#include "dim.h" -+ - // Re-enable this some day -+PyObject* Dim_init() { -+ PyErr_SetString(PyExc_RuntimeError, "First class dim doesn't work with python 3.12"); -+ return nullptr; -+} - - #else - -diff --git a/torch/csrc/dynamo/cpython_defs.h b/torch/csrc/dynamo/cpython_defs.h -index f0a0e1a88e2..f58becd246e 100644 ---- a/torch/csrc/dynamo/cpython_defs.h -+++ b/torch/csrc/dynamo/cpython_defs.h -@@ -6,7 +6,7 @@ - // should go in cpython_defs.c. Copying is required when, e.g., - // we need to call internal CPython functions that are not exposed. - --#if IS_PYTHON_3_11_PLUS && !(IS_PYTHON_3_12_PLUS) -+#if IS_PYTHON_3_11_PLUS - - #include <internal/pycore_frame.h> - --- -2.43.0 - diff --git a/0005-disable-submodule-search.patch b/0005-disable-submodule-search.patch deleted file mode 100644 index 1b5509f..0000000 --- a/0005-disable-submodule-search.patch +++ /dev/null @@ -1,25 +0,0 @@ -From fc0d4ce06fecbd2bcd10fb13c515dc6625260870 Mon Sep 17 00:00:00 2001 -From: Tom Rix <trix(a)redhat.com> -Date: Fri, 29 Sep 2023 17:21:13 -0700 -Subject: [PATCH 5/6] disable submodule search - ---- - setup.py | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/setup.py b/setup.py -index 17bf16b89a..b8c8ae5506 100644 ---- a/setup.py -+++ b/setup.py -@@ -452,7 +452,7 @@ def mirror_files_into_torchgen(): - def build_deps(): - report("-- Building version " + version) - -- check_submodules() -+ # check_submodules() - check_pydep("yaml", "pyyaml") - - build_caffe2( --- -2.41.0 - diff --git a/python-torch.spec b/python-torch.spec index e989c16..5c6b771 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -4,17 +4,17 @@ %global forgeurl https://github.com/pytorch/pytorch # So pre releases can be tried -%bcond_without gitcommit +%bcond_with gitcommit %if %{with gitcommit} -# The top of tree ~3/7/24 %global commit0 975d4284250170602db60adfda5eb1664a3b8acc %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) - -%global pypi_version 2.3.0 +%global date0 20240307 %else -%global pypi_version 2.1.2 - +%global commit0 975d4284250170602db60adfda5eb1664a3b8acc +%global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) +%global date0 20240307 %endif +%global pypi_version 2.3.0 # For -test subpackage # suitable only for local testing @@ -37,9 +37,6 @@ %global rocm_default_gpu default %bcond_without rocm_loop -# For testing openmp -%bcond_without openmp - %bcond_with foxi # For testing caffe2 %if 0%{?fedora} @@ -62,7 +59,7 @@ %endif Name: python-%{pypi_name} -Version: %{pypi_version} +Version: %{pypi_version}^git%{date0}.%{shortcommit0} Release: %autorelease Summary: PyTorch AI/ML framework # See license.txt for license details @@ -73,7 +70,8 @@ URL: https://pytorch.org/ Source0: %{forgeurl}/archive/%{commit0}/pytorch-%{shortcommit0}.tar.gz Source100: pyproject.toml %else -Source0: %{forgeurl}/releases/download/v%{version}/pytorch-v%{version}.tar.gz +Source0: %{forgeurl}/archive/%{commit0}/pytorch-%{shortcommit0}.tar.gz +Source100: pyproject.toml %endif Source1: https://github.com/google/flatbuffers/archive/refs/tags/v23.3.3.tar.gz Source2: https://github.com/pybind/pybind11/archive/refs/tags/v2.11.1.tar.gz @@ -85,8 +83,6 @@ Source10: https://github.com/NVIDIA/cudnn-frontend/archive/refs/tags/v%{cu Source11: https://github.com/NVIDIA/cutlass/archive/refs/tags/v%{cul_ver}.tar.gz %endif -%if %{with gitcommit} - Patch0: 0001-no-third_party-foxi.patch Patch1: 0001-no-third_party-fmt.patch Patch2: 0001-no-third_party-FXdiv.patch @@ -104,37 +100,6 @@ Patch101: 0001-cuda-hip-signatures.patch Patch102: 0001-silence-an-assert.patch Patch103: 0001-can-not-use-with-c-files.patch Patch104: 0001-use-any-hip.patch - -%endif - -%else -# Misc cmake changes that would be difficult to upstream -# * Use the system fmt -# * Remove foxi use -# * Remove warnings/errors for clang 17 -# * fxdiv is not a library on Fedora -Patch0: 0001-Prepare-pytorch-cmake-for-fedora.patch -# https://github.com/pytorch/pytorch/pull/111048 -Patch2: 0003-Stub-in-kineto-ActivityType.patch -# PyTorch has not fully baked 3.12 support because 3.12 is so new -Patch3: 0004-torch-python-3.12-changes.patch -# Short circuit looking for things that can not be downloade by mock -Patch4: 0005-disable-submodule-search.patch -# libtorch_python.so: undefined symbols: Py* -Patch6: 0001-python-torch-link-with-python.patch -# E: unused-direct-shlib-dependency libshm.so.2.1.0 libtorch.so.2.1 -# turn on as-needed globally -Patch7: 0001-python-torch-remove-ubuntu-specific-linking.patch -# Tries to use git and is confused by tarball -Patch8: 0001-torch-sane-version.patch -# libtorch is a wrapper so turn off as-needed locally -# resolves this rpmlint -# E: shared-library-without-dependency-information libtorch.so.2.1.0 -# causes these -# E: unused-direct-shlib-dependency libtorch.so.2.1.0 libtorch_cpu.so.2.1 -# etc. -# As a wrapper library, this should be the expected behavior. -Patch9: 0001-disable-as-needed-for-libtorch.patch %endif # Limit to these because they are well behaved with clang @@ -159,6 +124,7 @@ BuildRequires: gloo-devel %endif BuildRequires: ninja-build BuildRequires: onnx-devel +BuildRequires: libomp-devel BuildRequires: openblas-devel BuildRequires: pocketfft-devel BuildRequires: protobuf-devel @@ -169,11 +135,7 @@ BuildRequires: python3-pyyaml BuildRequires: python3-typing-extensions BuildRequires: sleef-devel BuildRequires: valgrind-devel -%if %{with gitcommit} BuildRequires: xnnpack-devel = 0.0^git20240229.fcbf55a -%else -BuildRequires: xnnpack-devel = 0.0^git20221221.51a9875 -%endif BuildRequires: python3-devel BuildRequires: python3dist(filelock) @@ -189,12 +151,7 @@ BuildRequires: python3dist(fsspec) BuildRequires: python3dist(sympy) %endif -%if %{with openmp} -BuildRequires: libomp-devel -%endif - %if %{with rocm} -BuildRequires: compiler-rt BuildRequires: hipblas-devel %if %{with hipblaslt} BuildRequires: hipblaslt-devel @@ -204,7 +161,6 @@ BuildRequires: hipfft-devel BuildRequires: hiprand-devel BuildRequires: hipsparse-devel BuildRequires: hipsolver-devel -BuildRequires: lld BuildRequires: miopen-devel BuildRequires: rocblas-devel BuildRequires: rocrand-devel @@ -291,7 +247,6 @@ Requires: python3-%{pypi_name}%{?_isa} = %{version}-%{release} %prep -%if %{with gitcommit} %autosetup -p1 -n pytorch-%{commit0} # Remove bundled egg-info @@ -299,11 +254,6 @@ rm -rf %{pypi_name}.egg-info # Overwrite with a git checkout of the pyproject.toml cp %{SOURCE100} . -%else -%autosetup -p1 -n pytorch-v%{version} - -%endif - tar xf %{SOURCE1} cp -r flatbuffers-23.3.3/* third_party/flatbuffers/ @@ -462,7 +412,7 @@ export USE_MKLDNN=OFF export USE_NCCL=OFF export USE_NNPACK=OFF export USE_NUMPY=ON -export USE_OPENMP=OFF +export USE_OPENMP=ON export USE_PYTORCH_QNNPACK=OFF export USE_QNNPACK=OFF export USE_ROCM=OFF @@ -496,10 +446,6 @@ export USE_CUDA=ON export USE_DISTRIBUTED=ON %endif -%if %{with openmp} -export USE_OPENMP=ON -%endif - %if %{with test} export BUILD_TEST=ON %endif @@ -602,8 +548,6 @@ done %{_libdir}/rocm/gfx*/lib64/* %endif - - %changelog %autochangelog commit 61a50519621a39c782767c149f40ae591e5ca2ed Author: Tom Rix <trix(a)redhat.com> Date: Sun Mar 10 06:00:00 2024 -0700 Do not remove the empty files py.typed files are supposed to be empty. Keep the install simple, just use it. Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/python-torch.spec b/python-torch.spec index 2ce32ff..e989c16 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -581,8 +581,7 @@ done %endif -# rm empty files -find %{buildroot} -type f -empty -delete +# Do not remote the empty files %files -n python3-%{pypi_name} commit a8493742cfa47561f896c49d4e846f35402f19eb Author: Tom Rix <trix(a)redhat.com> Date: Sat Mar 9 10:16:50 2024 -0800 Update RHEL CUDA diff --git a/python-torch.spec b/python-torch.spec index b9f4860..2ce32ff 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -79,8 +79,10 @@ Source1: https://github.com/google/flatbuffers/archive/refs/tags/v23.3.3. Source2: https://github.com/pybind/pybind11/archive/refs/tags/v2.11.1.tar.gz %if %{with cuda} -Source10: https://github.com/NVIDIA/cudnn-frontend/archive/refs/tags/v1.0.3.tar.gz -Source11: https://github.com/NVIDIA/cutlass/archive/refs/tags/v3.3.0.tar.gz +%global cuf_ver 1.1.2 +Source10: https://github.com/NVIDIA/cudnn-frontend/archive/refs/tags/v%{cuf_ver}.tar.… +%global cul_ver 3.4.1 +Source11: https://github.com/NVIDIA/cutlass/archive/refs/tags/v%{cul_ver}.tar.gz %endif %if %{with gitcommit} @@ -310,9 +312,9 @@ cp -r pybind11-2.11.1/* third_party/pybind11/ %if %{with cuda} tar xf %{SOURCE10} -cp -r cudnn-frontend-1.0.3/* third_party/cudnn_frontend/ +cp -r cudnn-frontend-%{cuf_ver}/* third_party/cudnn_frontend/ tar xf %{SOURCE11} -cp -r cutlass-3.3.0/* third_party/cutlass/ +cp -r cutlass-%{cul_ver}/* third_party/cutlass/ %endif %if %{with opencv} commit edfbfff0d91fd1bc053ab579b553b651d5b52441 Author: Tom Rix <trix(a)redhat.com> Date: Fri Mar 8 10:29:29 2024 -0500 Update to ToT ROCm is broken in fedora, disable it use. xnnpack needs updating Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/python-torch.spec b/python-torch.spec index 4529d29..b9f4860 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -6,8 +6,8 @@ # So pre releases can be tried %bcond_without gitcommit %if %{with gitcommit} -# The top of tree ~2/28/24 -%global commit0 3cfed0122829540444911c271ce5480832ea3526 +# The top of tree ~3/7/24 +%global commit0 975d4284250170602db60adfda5eb1664a3b8acc %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) %global pypi_version 2.3.0 @@ -25,7 +25,7 @@ %ifarch x86_64 %if 0%{?fedora} -%bcond_without rocm +%bcond_with rocm %else %bcond_with rocm %endif @@ -144,7 +144,6 @@ ExclusiveArch: x86_64 aarch64 %global _lto_cflags %nil %endif -BuildRequires: clang-devel BuildRequires: cmake BuildRequires: cpuinfo-devel BuildRequires: eigen3-devel @@ -169,7 +168,7 @@ BuildRequires: python3-typing-extensions BuildRequires: sleef-devel BuildRequires: valgrind-devel %if %{with gitcommit} -BuildRequires: xnnpack-devel = 0.0^git20231127.d9cce34 +BuildRequires: xnnpack-devel = 0.0^git20240229.fcbf55a %else BuildRequires: xnnpack-devel = 0.0^git20221221.51a9875 %endif commit 5f5921382a44f1c72eca8cadeadb7b01c6fd0916 Author: Tom Rix <trix(a)redhat.com> Date: Tue Mar 5 09:02:32 2024 -0500 Remove empty files diff --git a/python-torch.spec b/python-torch.spec index 67da9de..4529d29 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -65,7 +65,7 @@ Name: python-%{pypi_name} Version: %{pypi_version} Release: %autorelease Summary: PyTorch AI/ML framework -# See below for details +# See license.txt for license details License: BSD-3-Clause AND BSD-2-Clause AND 0BSD AND Apache-2.0 AND MIT AND BSL-1.0 AND GPL-3.0-or-later AND Zlib URL: https://pytorch.org/ @@ -580,6 +580,10 @@ done %endif +# rm empty files +find %{buildroot} -type f -empty -delete + + %files -n python3-%{pypi_name} %license LICENSE %doc README.md @@ -599,7 +603,6 @@ done %endif -# See license.txt for license details %changelog %autochangelog commit 525a349094797df60a2d049c8c5320d5e7026e9d Author: Tom Rix <trix(a)redhat.com> Date: Mon Mar 4 09:42:28 2024 -0500 Switch to autochangelog Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/python-torch.spec b/python-torch.spec index e98624c..67da9de 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -602,67 +602,5 @@ done # See license.txt for license details %changelog -* Fri Jan 26 2024 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.1.2-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Mon Jan 22 2024 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.1.2-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Wed Dec 27 2023 Tom Rix <trix(a)redhat.com> - 2.1.2-1 -- Update to 2.1.2 -- Stop versioning *.so's - 2.1.2's version is wrong -- Stub in caffe2 to test in flight package - -* Wed Dec 27 2023 Tom Rix <trix(a)redhat.com> - 2.1.0-13 -- Stub in openmp to test in openmp - -* Wed Dec 20 2023 Tom Rix <trix(a)redhat.com> - 2.1.0-12 -- Stub in rocm to test in flight packages - -* Wed Dec 13 2023 Tom Rix <trix(a)redhat.com> - 2.1.0-11 -- Move unversioned *.so's to main package - -* Fri Dec 1 2023 Tom Rix <trix(a)redhat.com> - 2.1.0-10 -- Disable gold linker -- Remove python requires -- Change to openblas, remove -lgfortran fixes -- Manually add -pie to linking options - -* Fri Nov 24 2023 Tom Rix <trix(a)redhat.com> - 2.1.0-9 -- Enable debug build -- Remove Khronos licensed files from source -- Use 0BSD license identifier -- Generate lists directories, python and header files -- Add a -test subpackage - -* Wed Nov 15 2023 Tom Rix <trix(a)redhat.com> - 2.1.0-8 -- Address review comments - -* Thu Nov 2 2023 Tom Rix <trix(a)redhat.com> - 2.1.0-7 -- Address review comments -- remove pyproject option - -* Thu Oct 19 2023 Tom Rix <trix(a)redhat.com> - 2.1.0-6 -- Address review comments - -* Wed Oct 18 2023 Tom Rix <trix(a)redhat.com> - 2.1.0-5 -- Address review comments - -* Sat Oct 14 2023 Tom Rix <trix(a)redhat.com> - 2.1.0-4 -- Use gloo, xnnpack -- Find missing build_bundled.py -- Add pyproject option - -* Thu Oct 12 2023 Tom Rix <trix(a)redhat.com> - 2.1.0-3 -- Address review comments -- Force so versioning on - -* Mon Oct 9 2023 Tom Rix <trix(a)redhat.com> - 2.1.0-2 -- Use the 2.1 release -- Reduce USE_SYSTEM_LIBS to parts -- Remove almost all of third_party/ -- Remove py2rpm generated noise - -* Sat Sep 30 2023 Tom Rix <trix(a)redhat.com> - 2.1.0-1 -- Initial package. +%autochangelog commit b2eaedd0c2a55f49b33fcbe78822ece22d1fd4bd Author: Tom Rix <trix(a)redhat.com> Date: Sun Mar 3 07:31:08 2024 -0500 Update hipblaslt patch Upstream add some more things to change Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/next/0001-Optionally-use-hipblaslt.patch b/next/0001-Optionally-use-hipblaslt.patch index 029d98c..56434a7 100644 --- a/next/0001-Optionally-use-hipblaslt.patch +++ b/next/0001-Optionally-use-hipblaslt.patch @@ -1,4 +1,4 @@ -From 186728c9f4de720547fa3d1b7951c7d5563ad3c7 Mon Sep 17 00:00:00 2001 +From d77e05d90df006322cda021f1a8affdcc2c7eaef Mon Sep 17 00:00:00 2001 From: Tom Rix <trix(a)redhat.com> Date: Fri, 23 Feb 2024 08:27:30 -0500 Subject: [PATCH] Optionally use hipblaslt @@ -10,21 +10,30 @@ Convert the checks for ROCM_VERSION >= 507000 to HIPBLASLT checks Signed-off-by: Tom Rix <trix(a)redhat.com> --- - aten/src/ATen/cuda/CUDABlas.cpp | 5 +++-- + aten/src/ATen/cuda/CUDABlas.cpp | 7 ++++--- aten/src/ATen/cuda/CUDABlas.h | 2 +- aten/src/ATen/cuda/CUDAContextLight.h | 4 ++-- aten/src/ATen/cuda/CublasHandlePool.cpp | 4 ++-- aten/src/ATen/cuda/tunable/TunableGemm.h | 6 +++--- - aten/src/ATen/native/cuda/Blas.cpp | 10 ++++++---- + aten/src/ATen/native/cuda/Blas.cpp | 14 ++++++++------ cmake/Dependencies.cmake | 3 +++ cmake/public/LoadHIP.cmake | 4 ++-- - 8 files changed, 22 insertions(+), 16 deletions(-) + 8 files changed, 25 insertions(+), 19 deletions(-) diff --git a/aten/src/ATen/cuda/CUDABlas.cpp b/aten/src/ATen/cuda/CUDABlas.cpp -index 0a3de5f9d77..b67031e88a7 100644 +index d534ec5a178..e815463f630 100644 --- a/aten/src/ATen/cuda/CUDABlas.cpp +++ b/aten/src/ATen/cuda/CUDABlas.cpp -@@ -778,7 +778,7 @@ void gemm<at::BFloat16>(CUDABLAS_GEMM_ARGTYPES(at::BFloat16)) { +@@ -14,7 +14,7 @@ + #include <c10/util/irange.h> + + #ifdef USE_ROCM +-#if ROCM_VERSION >= 60000 ++#ifdef HIPBLASLT + #include <hipblaslt/hipblaslt-ext.hpp> + #endif + // until hipblas has an API to accept flags, we must use rocblas here +@@ -781,7 +781,7 @@ void gemm<at::BFloat16>(CUDABLAS_GEMM_ARGTYPES(at::BFloat16)) { } } @@ -33,7 +42,7 @@ index 0a3de5f9d77..b67031e88a7 100644 #if defined(USE_ROCM) && ROCM_VERSION >= 50700 && ROCM_VERSION < 60000 // only for rocm 5.7 where we first supported hipblaslt, it was difficult -@@ -909,6 +909,7 @@ class CuBlasLtMatmulPreference : public CuBlasLtDescriptor< +@@ -912,6 +912,7 @@ class CuBlasLtMatmulPreference : public CuBlasLtDescriptor< }; } // namespace @@ -41,7 +50,7 @@ index 0a3de5f9d77..b67031e88a7 100644 template <typename Dtype> void gemm_and_bias( bool transpose_mat1, -@@ -1121,7 +1122,7 @@ template void gemm_and_bias( +@@ -1124,7 +1125,7 @@ template void gemm_and_bias( at::BFloat16* result_ptr, int64_t result_ld, GEMMAndBiasActivationEpilogue activation); @@ -86,10 +95,10 @@ index 4ec35f59a21..e28dc42034f 100644 #endif diff --git a/aten/src/ATen/cuda/CublasHandlePool.cpp b/aten/src/ATen/cuda/CublasHandlePool.cpp -index d8ee09b1486..4510193a5cc 100644 +index 6913d2cd95e..3d4276be372 100644 --- a/aten/src/ATen/cuda/CublasHandlePool.cpp +++ b/aten/src/ATen/cuda/CublasHandlePool.cpp -@@ -28,7 +28,7 @@ namespace at::cuda { +@@ -29,7 +29,7 @@ namespace at::cuda { namespace { @@ -98,7 +107,7 @@ index d8ee09b1486..4510193a5cc 100644 void createCublasLtHandle(cublasLtHandle_t *handle) { TORCH_CUDABLAS_CHECK(cublasLtCreate(handle)); } -@@ -177,7 +177,7 @@ cublasHandle_t getCurrentCUDABlasHandle() { +@@ -190,7 +190,7 @@ cublasHandle_t getCurrentCUDABlasHandle() { return handle; } @@ -139,10 +148,10 @@ index 3ba0d761277..dde1870cfbf 100644 if (env == nullptr || strcmp(env, "1") == 0) { // disallow tuning of hipblaslt with c10::complex diff --git a/aten/src/ATen/native/cuda/Blas.cpp b/aten/src/ATen/native/cuda/Blas.cpp -index 2b7ff1b502b..9ae2ccbd16d 100644 +index 29e5c5e3cf1..df56f3d7f1d 100644 --- a/aten/src/ATen/native/cuda/Blas.cpp +++ b/aten/src/ATen/native/cuda/Blas.cpp -@@ -153,7 +153,7 @@ enum class Activation { +@@ -155,7 +155,7 @@ enum class Activation { GELU, }; @@ -151,7 +160,7 @@ index 2b7ff1b502b..9ae2ccbd16d 100644 cuda::blas::GEMMAndBiasActivationEpilogue activation_to_gemm_and_blas_arg(Activation a) { switch (a) { case Activation::None: -@@ -191,6 +191,7 @@ static bool getDisableAddmmCudaLt() { +@@ -193,6 +193,7 @@ static bool getDisableAddmmCudaLt() { #ifdef USE_ROCM static bool isSupportedHipLtROCmArch(int index) { @@ -159,7 +168,7 @@ index 2b7ff1b502b..9ae2ccbd16d 100644 hipDeviceProp_t* prop = at::cuda::getDeviceProperties(index); std::string device_arch = prop->gcnArchName; static const std::vector<std::string> archs = {"gfx90a", "gfx940", "gfx941", "gfx942"}; -@@ -201,6 +202,7 @@ static bool isSupportedHipLtROCmArch(int index) { +@@ -203,6 +204,7 @@ static bool isSupportedHipLtROCmArch(int index) { } } TORCH_CHECK(false, "Attempting to use hipBLASLt on a unsupported architecture!"); @@ -167,7 +176,7 @@ index 2b7ff1b502b..9ae2ccbd16d 100644 return false; } #endif -@@ -226,7 +228,7 @@ Tensor& addmm_out_cuda_impl(Tensor& result, const Tensor& self, const Tensor& ma +@@ -228,7 +230,7 @@ Tensor& addmm_out_cuda_impl(Tensor& result, const Tensor& self, const Tensor& ma at::ScalarType scalar_type = self.scalar_type(); c10::MaybeOwned<Tensor> self_; if (&result != &self) { @@ -176,7 +185,7 @@ index 2b7ff1b502b..9ae2ccbd16d 100644 // Strangely, if mat2 has only 1 row or column, we get // CUBLAS_STATUS_INVALID_VALUE error from cublasLtMatmulAlgoGetHeuristic. // self.dim() == 1 && result.dim() == 2 && self.sizes()[0] == mat2_sizes[1] -@@ -269,7 +271,7 @@ Tensor& addmm_out_cuda_impl(Tensor& result, const Tensor& self, const Tensor& ma +@@ -271,7 +273,7 @@ Tensor& addmm_out_cuda_impl(Tensor& result, const Tensor& self, const Tensor& ma } self__sizes = self_->sizes(); } else { @@ -185,7 +194,7 @@ index 2b7ff1b502b..9ae2ccbd16d 100644 useLtInterface = !disable_addmm_cuda_lt && result.dim() == 2 && result.is_contiguous() && isSupportedHipLtROCmArch(self.device().index()) && -@@ -320,7 +322,7 @@ Tensor& addmm_out_cuda_impl(Tensor& result, const Tensor& self, const Tensor& ma +@@ -322,7 +324,7 @@ Tensor& addmm_out_cuda_impl(Tensor& result, const Tensor& self, const Tensor& ma TORCH_INTERNAL_ASSERT_DEBUG_ONLY(!args.result->is_conj()); @@ -194,6 +203,24 @@ index 2b7ff1b502b..9ae2ccbd16d 100644 if (useLtInterface) { AT_DISPATCH_FLOATING_TYPES_AND2( at::ScalarType::Half, +@@ -876,7 +878,7 @@ _scaled_mm_out_cuda(const Tensor& mat1, const Tensor& mat2, + at::native::resize_output(out, {mat1_sizes[0], mat2_sizes[1]}); + at::native::resize_output(amax, {}); + +-#if !defined(USE_ROCM) && !defined(_MSC_VER) || (defined(USE_ROCM) && ROCM_VERSION >= 60000) ++#if !defined(USE_ROCM) && !defined(_MSC_VER) || (defined(USE_ROCM) && defined(HIPBLASLT)) + cublasCommonArgs args(mat1, mat2, out); + const auto out_dtype_ = args.result->scalar_type(); + TORCH_CHECK(args.transa == 't' && args.transb == 'n', "Only multiplication of row-major and column-major matrices is supported by cuBLASLt"); +@@ -906,7 +908,7 @@ _scaled_mm_out_cuda(const Tensor& mat1, const Tensor& mat2, + TORCH_CHECK(false, "_scaled_mm_out_cuda is not compiled for this platform."); + #endif + +-#if defined(USE_ROCM) && ROCM_VERSION >= 60000 ++#if defined(USE_ROCM) && defined(HIPBLASLT) + // rocm's hipblaslt does not yet support amax, so calculate separately + auto out_float32 = out.to(kFloat); + out_float32.abs_(); diff --git a/cmake/Dependencies.cmake b/cmake/Dependencies.cmake index b7ffbeb07dc..2b6c3678984 100644 --- a/cmake/Dependencies.cmake diff --git a/python-torch.spec b/python-torch.spec index 5272677..e98624c 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -6,8 +6,8 @@ # So pre releases can be tried %bcond_without gitcommit %if %{with gitcommit} -# The top of tree ~2/22/24 -%global commit0 5c5b71b6eebae76d744261715231093e62f0d090 +# The top of tree ~2/28/24 +%global commit0 3cfed0122829540444911c271ce5480832ea3526 %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) %global pypi_version 2.3.0 @@ -40,12 +40,18 @@ # For testing openmp %bcond_without openmp +%bcond_with foxi # For testing caffe2 %if 0%{?fedora} +# need foxi-devel +%if %{with foxi} %bcond_without caffe2 %else %bcond_with caffe2 %endif +%else +%bcond_with caffe2 +%endif # For testing distributed %bcond_with distributed @@ -182,23 +188,33 @@ BuildRequires: python3dist(fsspec) BuildRequires: python3dist(sympy) %endif +%if %{with openmp} +BuildRequires: libomp-devel +%endif + %if %{with rocm} +BuildRequires: compiler-rt BuildRequires: hipblas-devel %if %{with hipblaslt} BuildRequires: hipblaslt-devel %endif BuildRequires: hipcub-devel BuildRequires: hipfft-devel +BuildRequires: hiprand-devel BuildRequires: hipsparse-devel BuildRequires: hipsolver-devel +BuildRequires: lld BuildRequires: miopen-devel BuildRequires: rocblas-devel +BuildRequires: rocrand-devel +BuildRequires: rocfft-devel %if %{with distributed} BuildRequires: rccl-devel %endif BuildRequires: rocprim-devel BuildRequires: rocm-cmake BuildRequires: rocm-comgr-devel +BuildRequires: rocm-core-devel BuildRequires: rocm-hip-devel BuildRequires: rocm-runtime-devel BuildRequires: rocm-rpm-macros @@ -208,9 +224,11 @@ BuildRequires: rocthrust-devel Requires: rocm-rpm-macros-modules %endif +%if %{with foxi} %if %{with caffe2} BuildRequires: foxi-devel %endif +%endif %if %{with test} BuildRequires: google-benchmark-devel commit bbdb0aa112c49d8b84cbcd2b5fbcddbc09a0113b Author: Tom Rix <trix(a)redhat.com> Date: Thu Feb 29 11:07:25 2024 -0500 Generalize rocm build diff --git a/license.txt b/license.txt new file mode 100644 index 0000000..0503793 --- /dev/null +++ b/license.txt @@ -0,0 +1,350 @@ +# +# License Details +# Main license BSD 3-Clause +# +# Apache-2.0 +# android/libs/fbjni/LICENSE +# android/libs/fbjni/CMakeLists.txt +# android/libs/fbjni/build.gradle +# android/libs/fbjni/cxx/fbjni/ByteBuffer.cpp +# android/libs/fbjni/cxx/fbjni/ByteBuffer.h +# android/libs/fbjni/cxx/fbjni/Context.h +# android/libs/fbjni/cxx/fbjni/File.h +# android/libs/fbjni/cxx/fbjni/JThread.h +# android/libs/fbjni/cxx/fbjni/NativeRunnable.h +# android/libs/fbjni/cxx/fbjni/OnLoad.cpp +# android/libs/fbjni/cxx/fbjni/ReadableByteChannel.cpp +# android/libs/fbjni/cxx/fbjni/ReadableByteChannel.h +# android/libs/fbjni/cxx/fbjni/detail/Boxed.h +# android/libs/fbjni/cxx/fbjni/detail/Common.h +# android/libs/fbjni/cxx/fbjni/detail/CoreClasses-inl.h +# android/libs/fbjni/cxx/fbjni/detail/CoreClasses.h +# android/libs/fbjni/cxx/fbjni/detail/Environment.cpp +# android/libs/fbjni/cxx/fbjni/detail/Environment.h +# android/libs/fbjni/cxx/fbjni/detail/Exceptions.cpp +# android/libs/fbjni/cxx/fbjni/detail/Exceptions.h +# android/libs/fbjni/cxx/fbjni/detail/FbjniApi.h +# android/libs/fbjni/cxx/fbjni/detail/Hybrid.cpp +# android/libs/fbjni/cxx/fbjni/detail/Hybrid.h +# android/libs/fbjni/cxx/fbjni/detail/Iterator-inl.h +# android/libs/fbjni/cxx/fbjni/detail/Iterator.h +# android/libs/fbjni/cxx/fbjni/detail/JWeakReference.h +# android/libs/fbjni/cxx/fbjni/detail/Log.h +# android/libs/fbjni/cxx/fbjni/detail/Meta-forward.h +# android/libs/fbjni/cxx/fbjni/detail/Meta-inl.h +# android/libs/fbjni/cxx/fbjni/detail/Meta.cpp +# android/libs/fbjni/cxx/fbjni/detail/Meta.h +# android/libs/fbjni/cxx/fbjni/detail/MetaConvert.h +# android/libs/fbjni/cxx/fbjni/detail/ReferenceAllocators-inl.h +# android/libs/fbjni/cxx/fbjni/detail/ReferenceAllocators.h +# android/libs/fbjni/cxx/fbjni/detail/References-forward.h +# android/libs/fbjni/cxx/fbjni/detail/References-inl.h +# android/libs/fbjni/cxx/fbjni/detail/References.cpp +# android/libs/fbjni/cxx/fbjni/detail/References.h +# android/libs/fbjni/cxx/fbjni/detail/Registration-inl.h +# android/libs/fbjni/cxx/fbjni/detail/Registration.h +# android/libs/fbjni/cxx/fbjni/detail/SimpleFixedString.h +# android/libs/fbjni/cxx/fbjni/detail/TypeTraits.h +# android/libs/fbjni/cxx/fbjni/detail/utf8.cpp +# android/libs/fbjni/cxx/fbjni/detail/utf8.h +# android/libs/fbjni/cxx/fbjni/fbjni.cpp +# android/libs/fbjni/cxx/fbjni/fbjni.h +# android/libs/fbjni/cxx/lyra/cxa_throw.cpp +# android/libs/fbjni/cxx/lyra/lyra.cpp +# android/libs/fbjni/cxx/lyra/lyra.h +# android/libs/fbjni/cxx/lyra/lyra_breakpad.cpp +# android/libs/fbjni/cxx/lyra/lyra_exceptions.cpp +# android/libs/fbjni/cxx/lyra/lyra_exceptions.h +# android/libs/fbjni/gradle.properties +# android/libs/fbjni/gradle/android-tasks.gradle +# android/libs/fbjni/gradle/release.gradle +# android/libs/fbjni/gradlew +# android/libs/fbjni/gradlew.bat +# android/libs/fbjni/host.gradle +# android/libs/fbjni/java/com/facebook/jni/CppException.java +# android/libs/fbjni/java/com/facebook/jni/CppSystemErrorException.java +# android/libs/fbjni/java/com/facebook/jni/DestructorThread.java +# android/libs/fbjni/java/com/facebook/jni/HybridClassBase.java +# android/libs/fbjni/java/com/facebook/jni/HybridData.java +# android/libs/fbjni/java/com/facebook/jni/IteratorHelper.java +# android/libs/fbjni/java/com/facebook/jni/MapIteratorHelper.java +# android/libs/fbjni/java/com/facebook/jni/NativeRunnable.java +# android/libs/fbjni/java/com/facebook/jni/ThreadScopeSupport.java +# android/libs/fbjni/java/com/facebook/jni/UnknownCppException.java +# android/libs/fbjni/java/com/facebook/jni/annotations/DoNotStrip.java +# android/libs/fbjni/scripts/android-setup.sh +# android/libs/fbjni/scripts/run-host-tests.sh +# android/libs/fbjni/settings.gradle +# android/libs/fbjni/test/BaseFBJniTests.java +# android/libs/fbjni/test/ByteBufferTests.java +# android/libs/fbjni/test/DocTests.java +# android/libs/fbjni/test/FBJniTests.java +# android/libs/fbjni/test/HybridTests.java +# android/libs/fbjni/test/IteratorTests.java +# android/libs/fbjni/test/PrimitiveArrayTests.java +# android/libs/fbjni/test/ReadableByteChannelTests.java +# android/libs/fbjni/test/jni/CMakeLists.txt +# android/libs/fbjni/test/jni/byte_buffer_tests.cpp +# android/libs/fbjni/test/jni/doc_tests.cpp +# android/libs/fbjni/test/jni/expect.h +# android/libs/fbjni/test/jni/fbjni_onload.cpp +# android/libs/fbjni/test/jni/fbjni_tests.cpp +# android/libs/fbjni/test/jni/hybrid_tests.cpp +# android/libs/fbjni/test/jni/inter_dso_exception_test_1/Test.cpp +# android/libs/fbjni/test/jni/inter_dso_exception_test_1/Test.h +# android/libs/fbjni/test/jni/inter_dso_exception_test_2/Test.cpp +# android/libs/fbjni/test/jni/inter_dso_exception_test_2/Test.h +# android/libs/fbjni/test/jni/iterator_tests.cpp +# android/libs/fbjni/test/jni/modified_utf8_test.cpp +# android/libs/fbjni/test/jni/no_rtti.cpp +# android/libs/fbjni/test/jni/no_rtti.h +# android/libs/fbjni/test/jni/primitive_array_tests.cpp +# android/libs/fbjni/test/jni/readable_byte_channel_tests.cpp +# android/libs/fbjni/test/jni/simple_fixed_string_tests.cpp +# android/libs/fbjni/test/jni/utf16toUTF8_test.cpp +# android/pytorch_android/host/build.gradle +# aten/src/ATen/cuda/llvm_basic.cpp +# aten/src/ATen/cuda/llvm_complex.cpp +# aten/src/ATen/native/quantized/cpu/qnnpack/confu.yaml +# aten/src/ATen/native/quantized/cpu/qnnpack/src/requantization/gemmlowp-neon.c +# aten/src/ATen/native/quantized/cpu/qnnpack/src/requantization/gemmlowp-scalar.h +# aten/src/ATen/native/quantized/cpu/qnnpack/src/requantization/gemmlowp-sse.h +# aten/src/ATen/nnapi/codegen.py +# aten/src/ATen/nnapi/NeuralNetworks.h +# aten/src/ATen/nnapi/nnapi_wrapper.cpp +# aten/src/ATen/nnapi/nnapi_wrapper.h +# binaries/benchmark_args.h +# binaries/benchmark_helper.cc +# binaries/benchmark_helper.h +# binaries/compare_models_torch.cc +# binaries/convert_and_benchmark.cc +# binaries/convert_caffe_image_db.cc +# binaries/convert_db.cc +# binaries/convert_encoded_to_raw_leveldb.cc +# binaries/convert_image_to_tensor.cc +# binaries/core_overhead_benchmark.cc +# binaries/core_overhead_benchmark_gpu.cc +# binaries/db_throughput.cc +# binaries/dump_operator_names.cc +# binaries/inspect_gpu.cc +# binaries/load_benchmark_torch.cc +# binaries/make_cifar_db.cc +# binaries/make_image_db.cc +# binaries/make_mnist_db.cc +# binaries/optimize_for_mobile.cc +# binaries/parallel_info.cc +# binaries/predictor_verifier.cc +# binaries/print_core_object_sizes_gpu.cc +# binaries/print_registered_core_operators.cc +# binaries/run_plan.cc +# binaries/run_plan_mpi.cc +# binaries/speed_benchmark.cc +# binaries/speed_benchmark_torch.cc +# binaries/split_db.cc +# binaries/tsv_2_proto.cc +# binaries/tutorial_blob.cc +# binaries/zmq_feeder.cc +# c10/test/util/small_vector_test.cpp +# c10/util/FunctionRef.h +# c10/util/SmallVector.cpp +# c10/util/SmallVector.h +# c10/util/llvmMathExtras.h +# c10/util/sparse_bitset.h +# caffe2/contrib/aten/gen_op.py +# caffe2/contrib/fakelowp/fp16_fc_acc_op.cc +# caffe2/contrib/fakelowp/fp16_fc_acc_op.h +# caffe2/contrib/gloo/allgather_ops.cc +# caffe2/contrib/gloo/allgather_ops.h +# caffe2/contrib/gloo/reduce_scatter_ops.cc +# caffe2/contrib/gloo/reduce_scatter_ops.h +# caffe2/core/hip/common_miopen.h +# caffe2/core/hip/common_miopen.hip +# caffe2/core/net_async_tracing.cc +# caffe2/core/net_async_tracing.h +# caffe2/core/net_async_tracing_test.cc +# caffe2/experiments/operators/fully_connected_op_decomposition.cc +# caffe2/experiments/operators/fully_connected_op_decomposition.h +# caffe2/experiments/operators/fully_connected_op_decomposition_gpu.cc +# caffe2/experiments/operators/fully_connected_op_prune.cc +# caffe2/experiments/operators/fully_connected_op_prune.h +# caffe2/experiments/operators/fully_connected_op_sparse.cc +# caffe2/experiments/operators/fully_connected_op_sparse.h +# caffe2/experiments/operators/funhash_op.cc +# caffe2/experiments/operators/funhash_op.h +# caffe2/experiments/operators/sparse_funhash_op.cc +# caffe2/experiments/operators/sparse_funhash_op.h +# caffe2/experiments/operators/sparse_matrix_reshape_op.cc +# caffe2/experiments/operators/sparse_matrix_reshape_op.h +# caffe2/experiments/operators/tt_contraction_op.cc +# caffe2/experiments/operators/tt_contraction_op.h +# caffe2/experiments/operators/tt_contraction_op_gpu.cc +# caffe2/experiments/operators/tt_pad_op.cc +# caffe2/experiments/operators/tt_pad_op.h +# caffe2/experiments/python/SparseTransformer.py +# caffe2/experiments/python/convnet_benchmarks.py +# caffe2/experiments/python/device_reduce_sum_bench.py +# caffe2/experiments/python/funhash_op_test.py +# caffe2/experiments/python/net_construct_bench.py +# caffe2/experiments/python/sparse_funhash_op_test.py +# caffe2/experiments/python/sparse_reshape_op_test.py +# caffe2/experiments/python/tt_contraction_op_test.py +# caffe2/experiments/python/tt_pad_op_test.py +# caffe2/mobile/contrib/libvulkan-stub/include/vulkan/vk_platform.h +# caffe2/mobile/contrib/libvulkan-stub/include/vulkan/vulkan.h +# caffe2/mobile/contrib/nnapi/NeuralNetworks.h +# caffe2/mobile/contrib/nnapi/dlnnapi.c +# caffe2/mobile/contrib/nnapi/nnapi_benchmark.cc +# caffe2/observers/profile_observer.cc +# caffe2/observers/profile_observer.h +# caffe2/operators/hip/conv_op_miopen.hip +# caffe2/operators/hip/local_response_normalization_op_miopen.hip +# caffe2/operators/hip/pool_op_miopen.hip +# caffe2/operators/hip/spatial_batch_norm_op_miopen.hip +# caffe2/operators/quantized/int8_utils.h +# caffe2/operators/stump_func_op.cc +# caffe2/operators/stump_func_op.cu +# caffe2/operators/stump_func_op.h +# caffe2/operators/unique_ops.cc +# caffe2/operators/unique_ops.cu +# caffe2/operators/unique_ops.h +# caffe2/operators/upsample_op.cc +# caffe2/operators/upsample_op.h +# caffe2/opt/fusion.h +# caffe2/python/layers/label_smooth.py +# caffe2/python/mint/static/css/simple-sidebar.css +# caffe2/python/modeling/get_entry_from_blobs.py +# caffe2/python/modeling/get_entry_from_blobs_test.py +# caffe2/python/modeling/gradient_clipping_test.py +# caffe2/python/operator_test/unique_ops_test.py +# caffe2/python/operator_test/upsample_op_test.py +# caffe2/python/operator_test/weight_scale_test.py +# caffe2/python/pybind_state_int8.cc +# caffe2/python/transformations.py +# caffe2/python/transformations_test.py +# caffe2/quantization/server/batch_matmul_dnnlowp_op.cc +# caffe2/quantization/server/batch_matmul_dnnlowp_op.h +# caffe2/quantization/server/compute_equalization_scale_test.py +# caffe2/quantization/server/elementwise_linear_dnnlowp_op.cc +# caffe2/quantization/server/elementwise_linear_dnnlowp_op.h +# caffe2/quantization/server/elementwise_sum_relu_op.cc +# caffe2/quantization/server/fb_fc_packed_op.cc +# caffe2/quantization/server/fb_fc_packed_op.h +# caffe2/quantization/server/fbgemm_fp16_pack_op.cc +# caffe2/quantization/server/fbgemm_fp16_pack_op.h +# caffe2/quantization/server/fully_connected_fake_lowp_op.cc +# caffe2/quantization/server/fully_connected_fake_lowp_op.h +# caffe2/quantization/server/int8_gen_quant_params_min_max_test.py +# caffe2/quantization/server/int8_gen_quant_params_test.py +# caffe2/quantization/server/int8_quant_scheme_blob_fill_test.py +# caffe2/quantization/server/spatial_batch_norm_relu_op.cc +# caffe2/sgd/weight_scale_op.cc +# caffe2/sgd/weight_scale_op.h +# caffe2/utils/bench_utils.h +# functorch/examples/maml_omniglot/maml-omniglot-higher.py +# functorch/examples/maml_omniglot/maml-omniglot-ptonly.py +# functorch/examples/maml_omniglot/maml-omniglot-transforms.py +# functorch/examples/maml_omniglot/support/omniglot_loaders.py +# modules/detectron/group_spatial_softmax_op.cc +# modules/detectron/group_spatial_softmax_op.cu +# modules/detectron/group_spatial_softmax_op.h +# modules/detectron/ps_roi_pool_op.cc +# modules/detectron/ps_roi_pool_op.h +# modules/detectron/roi_pool_f_op.cc +# modules/detectron/roi_pool_f_op.cu +# modules/detectron/roi_pool_f_op.h +# modules/detectron/sample_as_op.cc +# modules/detectron/sample_as_op.cu +# modules/detectron/sample_as_op.h +# modules/detectron/select_smooth_l1_loss_op.cc +# modules/detectron/select_smooth_l1_loss_op.cu +# modules/detectron/select_smooth_l1_loss_op.h +# modules/detectron/sigmoid_cross_entropy_loss_op.cc +# modules/detectron/sigmoid_cross_entropy_loss_op.cu +# modules/detectron/sigmoid_cross_entropy_loss_op.h +# modules/detectron/sigmoid_focal_loss_op.cc +# modules/detectron/sigmoid_focal_loss_op.cu +# modules/detectron/sigmoid_focal_loss_op.h +# modules/detectron/smooth_l1_loss_op.cc +# modules/detectron/smooth_l1_loss_op.cu +# modules/detectron/smooth_l1_loss_op.h +# modules/detectron/softmax_focal_loss_op.cc +# modules/detectron/softmax_focal_loss_op.cu +# modules/detectron/softmax_focal_loss_op.h +# modules/detectron/spatial_narrow_as_op.cc +# modules/detectron/spatial_narrow_as_op.cu +# modules/detectron/spatial_narrow_as_op.h +# modules/detectron/upsample_nearest_op.cc +# modules/detectron/upsample_nearest_op.h +# modules/module_test/module_test_dynamic.cc +# modules/rocksdb/rocksdb.cc +# scripts/apache_header.txt +# scripts/apache_python.txt +# torch/distributions/lkj_cholesky.py +# +# Apache 2.0 AND BSD 2-Clause +# caffe2/operators/deform_conv_op.cu +# +# Apache 2.0 AND BSD 2-Clause AND MIT +# modules/detectron/ps_roi_pool_op.cu +# +# Apache 2.0 AND BSD 2-Clause +# modules/detectron/upsample_nearest_op.cu +# +# BSD 0-Clause +# torch/csrc/utils/pythoncapi_compat.h +# +# BSD 2-Clause +# aten/src/ATen/native/quantized/cpu/qnnpack/deps/clog/LICENSE +# caffe2/image/transform_gpu.cu +# caffe2/image/transform_gpu.h +# +# BSL-1.0 +# c10/util/flat_hash_map.h +# c10/util/hash.h +# c10/util/Optional.h +# c10/util/order_preserving_flat_hash_map.h +# c10/util/strong_type.h +# c10/util/variant.h +# +# GPL-3.0-or-later AND MIT +# c10/util/reverse_iterator.h +# +# Khronos +# These files are for OpenCL, an unused option +# Replace them later, as-needed with the opencl-headers.rpm +# +# caffe2/contrib/opencl/OpenCL/cl.hpp +# caffe2/mobile/contrib/libopencl-stub/include/CL/cl.h +# caffe2/mobile/contrib/libopencl-stub/include/CL/cl.hpp +# caffe2/mobile/contrib/libopencl-stub/include/CL/cl_ext.h +# caffe2/mobile/contrib/libopencl-stub/include/CL/cl_gl.h +# caffe2/mobile/contrib/libopencl-stub/include/CL/cl_gl_ext.h +# caffe2/mobile/contrib/libopencl-stub/include/CL/cl_platform.h +# caffe2/mobile/contrib/libopencl-stub/include/CL/opencl.h +# +# MIT +# android/libs/fbjni/googletest-CMakeLists.txt.in +# c10/util/BFloat16-math.h +# caffe2/mobile/contrib/libvulkan-stub/include/libvulkan-stub.h +# caffe2/mobile/contrib/libvulkan-stub/src/libvulkan-stub.c +# caffe2/onnx/torch_ops/defs.cc +# cmake/Modules_CUDA_fix/upstream/FindCUDA/make2cmake.cmake +# cmake/Modules_CUDA_fix/upstream/FindCUDA/parse_cubin.cmake +# cmake/Modules_CUDA_fix/upstream/FindCUDA/run_nvcc.cmake +# functorch/einops/_parsing.py +# test/functorch/test_parsing.py +# test/functorch/test_rearrange.py +# third_party/miniz-2.1.0/LICENSE +# third_party/miniz-2.1.0/miniz.c +# tools/coverage_plugins_package/setup.py +# torch/_appdirs.py +# torch/utils/hipify/hipify_python.py +# +# Public Domain +# caffe2/mobile/contrib/libopencl-stub/LICENSE +# caffe2/utils/murmur_hash3.cc +# caffe2/utils/murmur_hash3.h +# +# Zlib +# aten/src/ATen/native/cpu/avx_mathfun.h + diff --git a/python-torch.spec b/python-torch.spec index 6c71ba6..5272677 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -32,12 +32,20 @@ %endif # hipblaslt is in development %bcond_with hipblaslt +# Which families gpu build for +%global rocm_gpu_list gfx8 gfx9 gfx10 gfx11 +%global rocm_default_gpu default +%bcond_without rocm_loop # For testing openmp %bcond_without openmp # For testing caffe2 +%if 0%{?fedora} +%bcond_without caffe2 +%else %bcond_with caffe2 +%endif # For testing distributed %bcond_with distributed @@ -243,6 +251,15 @@ Requires: python3-%{pypi_name}%{?_isa} = %{version}-%{release} %description -n python3-%{pypi_name}-devel %{summary} +%if %{with rocm} +%package -n python3-%{pypi_name}-rocm +Summary: %{name} for ROCm +Requires: python3-%{pypi_name}%{?_isa} = %{version}-%{release} + +%description -n python3-%{pypi_name}-rocm +%{summary} +%endif + %if %{with test} %package -n python3-%{pypi_name}-test Summary: Tests for %{name} @@ -254,6 +271,7 @@ Requires: python3-%{pypi_name}%{?_isa} = %{version}-%{release} %prep + %if %{with gitcommit} %autosetup -p1 -n pytorch-%{commit0} @@ -262,13 +280,6 @@ rm -rf %{pypi_name}.egg-info # Overwrite with a git checkout of the pyproject.toml cp %{SOURCE100} . -%if %{with rocm} -# hipify -./tools/amd_build/build_amd.py -# Fedora installs to /usr/include, not /usr/include/rocm-core -sed -i -e 's@rocm-core/rocm_version.h@rocm_version.h@' aten/src/ATen/hip/tunable/TunableGemm.h -%endif - %else %autosetup -p1 -n pytorch-v%{version} @@ -360,6 +371,13 @@ rm caffe2/contrib/opencl/OpenCL/cl.hpp rm caffe2/mobile/contrib/libopencl-stub/include/CL/*.h rm caffe2/mobile/contrib/libopencl-stub/include/CL/*.hpp +%if %{with rocm} +# hipify +./tools/amd_build/build_amd.py +# Fedora installs to /usr/include, not /usr/include/rocm-core +sed -i -e 's@rocm-core/rocm_version.h@rocm_version.h@' aten/src/ATen/hip/tunable/TunableGemm.h +%endif + %if %{with cuda} # build complains about not being able to build -pie without -fPIC sed -i -e 's@string(APPEND CMAKE_CUDA_FLAGS " -D_GLIBCXX_USE_CXX11_ABI=${GLIBCXX_USE_CXX11_ABI}")@string(APPEND CMAKE_CUDA_FLAGS " -fPIC -D_GLIBCXX_USE_CXX11_ABI=${GLIBCXX_USE_CXX11_ABI}")@' CMakeLists.txt @@ -406,20 +424,29 @@ export MAX_JOBS=$COMPILE_JOBS export CMAKE_EXE_LINKER_FLAGS=-pie export BUILD_CUSTOM_PROTOBUF=OFF +export BUILD_NVFUSER=OFF export BUILD_SHARED_LIBS=ON +export BUILD_TEST=OFF export CMAKE_BUILD_TYPE=RelWithDebInfo export CMAKE_FIND_PACKAGE_PREFER_CONFIG=ON export CAFFE2_LINK_LOCAL_PROTOBUF=OFF +export INTERN_BUILD_MOBILE=OFF +export USE_DISTRIBUTED=OFF +export USE_CUDA=OFF export USE_FBGEMM=OFF export USE_GOLD_LINKER=OFF export USE_ITT=OFF export USE_KINETO=OFF export USE_LITE_INTERPRETER_PROFILER=OFF +export USE_LITE_PROTO=OFF export USE_MKLDNN=OFF +export USE_NCCL=OFF export USE_NNPACK=OFF export USE_NUMPY=ON +export USE_OPENMP=OFF export USE_PYTORCH_QNNPACK=OFF export USE_QNNPACK=OFF +export USE_ROCM=OFF export USE_SYSTEM_CPUINFO=ON export USE_SYSTEM_SLEEF=ON export USE_SYSTEM_EIGEN_INSTALL=ON @@ -436,47 +463,26 @@ export USE_XNNPACK=ON %if %{with caffe2} export BUILD_CAFFE2=ON -export INTERN_BUILD_MOBILE=OFF -export USE_LITE_PROTO=OFF +%endif + +%if %{with cuda} +%if %{without rocm} +export CUDACXX=/usr/local/cuda/bin/nvcc +export CPLUS_INCLUDE_PATH=/usr/local/cuda/include +export USE_CUDA=ON +%endif %endif %if %{with distributed} export USE_DISTRIBUTED=ON -%else -export USE_DISTRIBUTED=OFF %endif - %if %{with openmp} export USE_OPENMP=ON -%else -export USE_OPENMP=OFF -%endif - -%if %{with rocm} -export USE_ROCM=ON -export USE_NCCL=OFF -export BUILD_NVFUSER=OFF -export HIP_PATH=%{_prefix} -export ROCM_PATH=%{_prefix} -export DEVICE_LIB_PATH=/usr/lib/clang/17/amdgcn/bitcode -%else -export USE_ROCM=OFF -%endif - -%if %{with cuda} -export CUDACXX=/usr/local/cuda/bin/nvcc -export CPLUS_INCLUDE_PATH=/usr/local/cuda/include -export USE_CUDA=ON -export USE_NCCL=OFF -%else -export USE_CUDA=OFF %endif %if %{with test} export BUILD_TEST=ON -%else -export BUILD_TEST=OFF %endif # Why we are using py3_ vs pyproject_ @@ -487,509 +493,95 @@ export BUILD_TEST=OFF # Adding pip to build requires does not fix # # See BZ 2244862 -%py3_build -%install + %if %{with rocm} + export USE_ROCM=ON export HIP_PATH=%{_prefix} export ROCM_PATH=%{_prefix} -export DEVICE_LIB_PATH=/usr/lib/clang/17/amdgcn/bitcode +export DEVICE_LIB_PATH=%{clang_resource_dir}/amdgcn/bitcode + +gpu=%{rocm_default_gpu} +module load rocm/$gpu +export PYTORCH_ROCM_ARCH=$ROCM_GPUS +%py3_build +mv build build-${gpu} +module purge + +%if %{with rocm_loop} +for gpu in %{rocm_gpu_list} +do + module load rocm/$gpu + export PYTORCH_ROCM_ARCH=$ROCM_GPUS + %py3_build + mv build build-${gpu} + module purge +done %endif -%py3_install +%else -# empty files -rm %{buildroot}%{python3_sitearch}/torch/py.typed -rm %{buildroot}%{python3_sitearch}/torch/ao/quantization/backend_config/observation_type.py -rm %{buildroot}%{python3_sitearch}/torch/ao/quantization/backend_config/__pycache__/observation_type.*.pyc -rm %{buildroot}%{python3_sitearch}/torch/cuda/error.py -rm %{buildroot}%{python3_sitearch}/torch/cuda/__pycache__/error.*.pyc -rm %{buildroot}%{python3_sitearch}/torch/include/ATen/cudnn/Exceptions.h +%py3_build -%if %{with caffe2} -# Remove test data -rm -rf %{buildroot}%{python3_sitearch}/caffe2/python/serialized_test/data/* %endif -# exec permission -for f in `find %{buildroot}%{python3_sitearch} -name '*.py'`; do - if [ ! -x $f ]; then - sed -i '1{\@^#!/usr/bin@d}' $f - fi -done - -# shebangs -%py3_shebang_fix %{buildroot}%{python3_sitearch} - -# Programatically create the list of dirs -echo "s|%{buildroot}%{python3_sitearch}|%%dir %%{python3_sitearch}|g" > br.sed -find %{buildroot}%{python3_sitearch} -mindepth 1 -type d > dirs.files -sed -i -f br.sed dirs.files -cat dirs.files > main.files +%install -# Similar for the python files -find %{buildroot}%{python3_sitearch} -type f -name "*.py" -o -name "*.pyc" -o -name "*.pyi" > py.files -echo "s|%{buildroot}%{python3_sitearch}|%%{python3_sitearch}|g" > br.sed -sed -i -f br.sed py.files -cat py.files >> main.files +%if %{with rocm} -# devel files, headers and such -find %{buildroot}%{python3_sitearch} -type f -name "*.h" -o -name "*.hpp" -o -name "*.cuh" -o -name "*.cpp" -o -name "*.cu" > devel.files -sed -i -f br.sed devel.files +export USE_ROCM=ON +export HIP_PATH=%{_prefix} +export ROCM_PATH=%{_prefix} +export DEVICE_LIB_PATH=%{clang_resource_dir}/amdgcn/bitcode + +gpu=%{rocm_default_gpu} +module load rocm/$gpu +export PYTORCH_ROCM_ARCH=$ROCM_GPUS +mv build-${gpu} build +%py3_install +mv build build-${gpu} +module purge + +%if %{with rocm_loop} +for gpu in %{rocm_gpu_list} +do + module load rocm/$gpu + export PYTORCH_ROCM_ARCH=$ROCM_GPUS + mv build-${gpu} build + # need to customize the install location, so replace py3_install + %{__python3} %{py_setup} %{?py_setup_args} install -O1 --skip-build --root %{buildroot} --prefix /usr/lib64/rocm/${gpu} %{?*} + rm -rfv %{buildroot}/usr/lib/rocm/${gpu}/bin/__pycache__ + mv build build-${gpu} + module purge +done +%endif -# -# Main package -##% dir % {python3_sitearch}/torch*.egg-info +%else +%py3_install -%files -n python3-%{pypi_name} -f main.files +%endif +%files -n python3-%{pypi_name} %license LICENSE -%doc README.md - -# bins +%doc README.md %{_bindir}/convert-caffe2-to-onnx %{_bindir}/convert-onnx-to-caffe2 %{_bindir}/torchrun -%{python3_sitearch}/torch/bin/torch_shm_manager - -# libs -%{python3_sitearch}/functorch/_C.cpython*.so -%{python3_sitearch}/torch/_C.cpython*.so -%{python3_sitearch}/torch/lib/libc10.so -%{python3_sitearch}/torch/lib/libshm.so -%{python3_sitearch}/torch/lib/libtorch.so -%{python3_sitearch}/torch/lib/libtorch_cpu.so -%{python3_sitearch}/torch/lib/libtorch_global_deps.so -%{python3_sitearch}/torch/lib/libtorch_python.so -%if %{with rocm} -%{python3_sitearch}/torch/lib/libc10_hip.so -%{python3_sitearch}/torch/lib/libcaffe2_nvrtc.so -%{python3_sitearch}/torch/lib/libtorch_hip.so -%endif -%if %{with cuda} -%{python3_sitearch}/torch/lib/libc10_cuda.so -%{python3_sitearch}/torch/lib/libcaffe2_nvrtc.so -%{python3_sitearch}/torch/lib/libtorch_cuda.so -%{python3_sitearch}/torch/lib/libtorch_cuda_linalg.so -%endif +%{python3_sitearch}/%{pypi_name} +%{python3_sitearch}/%{pypi_name}-*.egg-info +%{python3_sitearch}/functorch +%{python3_sitearch}/torchgen %if %{with caffe2} -%{python3_sitearch}/torch/lib/libcaffe2_observers.so -%{python3_sitearch}/caffe2/python/caffe2_pybind11_state.cpython*.so -%if %{without rocm} -%{python3_sitearch}/torch/lib/libcaffe2_detectron_ops.so -%else -%{python3_sitearch}/torch/lib/libcaffe2_detectron_ops_hip.so -%{python3_sitearch}/caffe2/python/caffe2_pybind11_state_hip.cpython*.so -%endif -%endif - -# misc -%{python3_sitearch}/torch/utils/model_dump/{*.js,*.mjs,*.html} -%{python3_sitearch}/torchgen/packaged/ATen/native/*.yaml -%{python3_sitearch}/torchgen/packaged/autograd/{*.md,*.yaml} -%if %{with gitcommit} -%{python3_sitearch}/torch/_export/serde/schema.yaml -%if 0%{?fedora} -%{python3_sitearch}/torch/distributed/pipeline/sync/_balance/py.typed -%{python3_sitearch}/torch/distributed/pipeline/sync/py.typed +%{python3_sitearch}/caffe2 %endif +%if %{with rocm} +%{_libdir}/rocm/gfx*/bin/* +%{_libdir}/rocm/gfx*/lib64/* %endif -# egg -%{python3_sitearch}/torch*.egg-info/* - -# excludes -# bazel build cruft -%exclude %{python3_sitearch}/torchgen/packaged/autograd/{BUILD.bazel,build.bzl} - -# -# devel package -# -%files -n python3-%{pypi_name}-devel -f devel.files - -# devel cmake -%{python3_sitearch}/torch/share/cmake/{ATen,Caffe2,Torch}/*.cmake -%{python3_sitearch}/torch/share/cmake/Caffe2/public/*.cmake -%{python3_sitearch}/torch/share/cmake/Caffe2/Modules_CUDA_fix/*.cmake -%{python3_sitearch}/torch/share/cmake/Caffe2/Modules_CUDA_fix/upstream/*.cmake -%{python3_sitearch}/torch/share/cmake/Caffe2/Modules_CUDA_fix/upstream/FindCUDA/*.cmake - -# devel misc -%{python3_sitearch}/torchgen/packaged/ATen/templates/RegisterDispatchDefinitions.ini -%{python3_sitearch}/torchgen/packaged/autograd/templates/annotated_fn_args.py.in - -%if %{with test} -%files -n python3-%{pypi_name}-test - -# test bins -%{python3_sitearch}/torch/bin/test_api -%{python3_sitearch}/torch/bin/test_edge_op_registration -%{python3_sitearch}/torch/bin/test_jit -%{python3_sitearch}/torch/bin/test_lazy -%{python3_sitearch}/torch/bin/test_tensorexpr -%{python3_sitearch}/torch/bin/tutorial_tensorexpr - -# test libs -# Unversioned - not ment for release -%{python3_sitearch}/torch/lib/libbackend_with_compiler.so -%{python3_sitearch}/torch/lib/libjitbackend_test.so -%{python3_sitearch}/torch/lib/libtorchbind_test.so - -# tests -%{python3_sitearch}/torch/test/* - -%endif -# -# License Details -# Main license BSD 3-Clause -# -# Apache-2.0 -# android/libs/fbjni/LICENSE -# android/libs/fbjni/CMakeLists.txt -# android/libs/fbjni/build.gradle -# android/libs/fbjni/cxx/fbjni/ByteBuffer.cpp -# android/libs/fbjni/cxx/fbjni/ByteBuffer.h -# android/libs/fbjni/cxx/fbjni/Context.h -# android/libs/fbjni/cxx/fbjni/File.h -# android/libs/fbjni/cxx/fbjni/JThread.h -# android/libs/fbjni/cxx/fbjni/NativeRunnable.h -# android/libs/fbjni/cxx/fbjni/OnLoad.cpp -# android/libs/fbjni/cxx/fbjni/ReadableByteChannel.cpp -# android/libs/fbjni/cxx/fbjni/ReadableByteChannel.h -# android/libs/fbjni/cxx/fbjni/detail/Boxed.h -# android/libs/fbjni/cxx/fbjni/detail/Common.h -# android/libs/fbjni/cxx/fbjni/detail/CoreClasses-inl.h -# android/libs/fbjni/cxx/fbjni/detail/CoreClasses.h -# android/libs/fbjni/cxx/fbjni/detail/Environment.cpp -# android/libs/fbjni/cxx/fbjni/detail/Environment.h -# android/libs/fbjni/cxx/fbjni/detail/Exceptions.cpp -# android/libs/fbjni/cxx/fbjni/detail/Exceptions.h -# android/libs/fbjni/cxx/fbjni/detail/FbjniApi.h -# android/libs/fbjni/cxx/fbjni/detail/Hybrid.cpp -# android/libs/fbjni/cxx/fbjni/detail/Hybrid.h -# android/libs/fbjni/cxx/fbjni/detail/Iterator-inl.h -# android/libs/fbjni/cxx/fbjni/detail/Iterator.h -# android/libs/fbjni/cxx/fbjni/detail/JWeakReference.h -# android/libs/fbjni/cxx/fbjni/detail/Log.h -# android/libs/fbjni/cxx/fbjni/detail/Meta-forward.h -# android/libs/fbjni/cxx/fbjni/detail/Meta-inl.h -# android/libs/fbjni/cxx/fbjni/detail/Meta.cpp -# android/libs/fbjni/cxx/fbjni/detail/Meta.h -# android/libs/fbjni/cxx/fbjni/detail/MetaConvert.h -# android/libs/fbjni/cxx/fbjni/detail/ReferenceAllocators-inl.h -# android/libs/fbjni/cxx/fbjni/detail/ReferenceAllocators.h -# android/libs/fbjni/cxx/fbjni/detail/References-forward.h -# android/libs/fbjni/cxx/fbjni/detail/References-inl.h -# android/libs/fbjni/cxx/fbjni/detail/References.cpp -# android/libs/fbjni/cxx/fbjni/detail/References.h -# android/libs/fbjni/cxx/fbjni/detail/Registration-inl.h -# android/libs/fbjni/cxx/fbjni/detail/Registration.h -# android/libs/fbjni/cxx/fbjni/detail/SimpleFixedString.h -# android/libs/fbjni/cxx/fbjni/detail/TypeTraits.h -# android/libs/fbjni/cxx/fbjni/detail/utf8.cpp -# android/libs/fbjni/cxx/fbjni/detail/utf8.h -# android/libs/fbjni/cxx/fbjni/fbjni.cpp -# android/libs/fbjni/cxx/fbjni/fbjni.h -# android/libs/fbjni/cxx/lyra/cxa_throw.cpp -# android/libs/fbjni/cxx/lyra/lyra.cpp -# android/libs/fbjni/cxx/lyra/lyra.h -# android/libs/fbjni/cxx/lyra/lyra_breakpad.cpp -# android/libs/fbjni/cxx/lyra/lyra_exceptions.cpp -# android/libs/fbjni/cxx/lyra/lyra_exceptions.h -# android/libs/fbjni/gradle.properties -# android/libs/fbjni/gradle/android-tasks.gradle -# android/libs/fbjni/gradle/release.gradle -# android/libs/fbjni/gradlew -# android/libs/fbjni/gradlew.bat -# android/libs/fbjni/host.gradle -# android/libs/fbjni/java/com/facebook/jni/CppException.java -# android/libs/fbjni/java/com/facebook/jni/CppSystemErrorException.java -# android/libs/fbjni/java/com/facebook/jni/DestructorThread.java -# android/libs/fbjni/java/com/facebook/jni/HybridClassBase.java -# android/libs/fbjni/java/com/facebook/jni/HybridData.java -# android/libs/fbjni/java/com/facebook/jni/IteratorHelper.java -# android/libs/fbjni/java/com/facebook/jni/MapIteratorHelper.java -# android/libs/fbjni/java/com/facebook/jni/NativeRunnable.java -# android/libs/fbjni/java/com/facebook/jni/ThreadScopeSupport.java -# android/libs/fbjni/java/com/facebook/jni/UnknownCppException.java -# android/libs/fbjni/java/com/facebook/jni/annotations/DoNotStrip.java -# android/libs/fbjni/scripts/android-setup.sh -# android/libs/fbjni/scripts/run-host-tests.sh -# android/libs/fbjni/settings.gradle -# android/libs/fbjni/test/BaseFBJniTests.java -# android/libs/fbjni/test/ByteBufferTests.java -# android/libs/fbjni/test/DocTests.java -# android/libs/fbjni/test/FBJniTests.java -# android/libs/fbjni/test/HybridTests.java -# android/libs/fbjni/test/IteratorTests.java -# android/libs/fbjni/test/PrimitiveArrayTests.java -# android/libs/fbjni/test/ReadableByteChannelTests.java -# android/libs/fbjni/test/jni/CMakeLists.txt -# android/libs/fbjni/test/jni/byte_buffer_tests.cpp -# android/libs/fbjni/test/jni/doc_tests.cpp -# android/libs/fbjni/test/jni/expect.h -# android/libs/fbjni/test/jni/fbjni_onload.cpp -# android/libs/fbjni/test/jni/fbjni_tests.cpp -# android/libs/fbjni/test/jni/hybrid_tests.cpp -# android/libs/fbjni/test/jni/inter_dso_exception_test_1/Test.cpp -# android/libs/fbjni/test/jni/inter_dso_exception_test_1/Test.h -# android/libs/fbjni/test/jni/inter_dso_exception_test_2/Test.cpp -# android/libs/fbjni/test/jni/inter_dso_exception_test_2/Test.h -# android/libs/fbjni/test/jni/iterator_tests.cpp -# android/libs/fbjni/test/jni/modified_utf8_test.cpp -# android/libs/fbjni/test/jni/no_rtti.cpp -# android/libs/fbjni/test/jni/no_rtti.h -# android/libs/fbjni/test/jni/primitive_array_tests.cpp -# android/libs/fbjni/test/jni/readable_byte_channel_tests.cpp -# android/libs/fbjni/test/jni/simple_fixed_string_tests.cpp -# android/libs/fbjni/test/jni/utf16toUTF8_test.cpp -# android/pytorch_android/host/build.gradle -# aten/src/ATen/cuda/llvm_basic.cpp -# aten/src/ATen/cuda/llvm_complex.cpp -# aten/src/ATen/native/quantized/cpu/qnnpack/confu.yaml -# aten/src/ATen/native/quantized/cpu/qnnpack/src/requantization/gemmlowp-neon.c -# aten/src/ATen/native/quantized/cpu/qnnpack/src/requantization/gemmlowp-scalar.h -# aten/src/ATen/native/quantized/cpu/qnnpack/src/requantization/gemmlowp-sse.h -# aten/src/ATen/nnapi/codegen.py -# aten/src/ATen/nnapi/NeuralNetworks.h -# aten/src/ATen/nnapi/nnapi_wrapper.cpp -# aten/src/ATen/nnapi/nnapi_wrapper.h -# binaries/benchmark_args.h -# binaries/benchmark_helper.cc -# binaries/benchmark_helper.h -# binaries/compare_models_torch.cc -# binaries/convert_and_benchmark.cc -# binaries/convert_caffe_image_db.cc -# binaries/convert_db.cc -# binaries/convert_encoded_to_raw_leveldb.cc -# binaries/convert_image_to_tensor.cc -# binaries/core_overhead_benchmark.cc -# binaries/core_overhead_benchmark_gpu.cc -# binaries/db_throughput.cc -# binaries/dump_operator_names.cc -# binaries/inspect_gpu.cc -# binaries/load_benchmark_torch.cc -# binaries/make_cifar_db.cc -# binaries/make_image_db.cc -# binaries/make_mnist_db.cc -# binaries/optimize_for_mobile.cc -# binaries/parallel_info.cc -# binaries/predictor_verifier.cc -# binaries/print_core_object_sizes_gpu.cc -# binaries/print_registered_core_operators.cc -# binaries/run_plan.cc -# binaries/run_plan_mpi.cc -# binaries/speed_benchmark.cc -# binaries/speed_benchmark_torch.cc -# binaries/split_db.cc -# binaries/tsv_2_proto.cc -# binaries/tutorial_blob.cc -# binaries/zmq_feeder.cc -# c10/test/util/small_vector_test.cpp -# c10/util/FunctionRef.h -# c10/util/SmallVector.cpp -# c10/util/SmallVector.h -# c10/util/llvmMathExtras.h -# c10/util/sparse_bitset.h -# caffe2/contrib/aten/gen_op.py -# caffe2/contrib/fakelowp/fp16_fc_acc_op.cc -# caffe2/contrib/fakelowp/fp16_fc_acc_op.h -# caffe2/contrib/gloo/allgather_ops.cc -# caffe2/contrib/gloo/allgather_ops.h -# caffe2/contrib/gloo/reduce_scatter_ops.cc -# caffe2/contrib/gloo/reduce_scatter_ops.h -# caffe2/core/hip/common_miopen.h -# caffe2/core/hip/common_miopen.hip -# caffe2/core/net_async_tracing.cc -# caffe2/core/net_async_tracing.h -# caffe2/core/net_async_tracing_test.cc -# caffe2/experiments/operators/fully_connected_op_decomposition.cc -# caffe2/experiments/operators/fully_connected_op_decomposition.h -# caffe2/experiments/operators/fully_connected_op_decomposition_gpu.cc -# caffe2/experiments/operators/fully_connected_op_prune.cc -# caffe2/experiments/operators/fully_connected_op_prune.h -# caffe2/experiments/operators/fully_connected_op_sparse.cc -# caffe2/experiments/operators/fully_connected_op_sparse.h -# caffe2/experiments/operators/funhash_op.cc -# caffe2/experiments/operators/funhash_op.h -# caffe2/experiments/operators/sparse_funhash_op.cc -# caffe2/experiments/operators/sparse_funhash_op.h -# caffe2/experiments/operators/sparse_matrix_reshape_op.cc -# caffe2/experiments/operators/sparse_matrix_reshape_op.h -# caffe2/experiments/operators/tt_contraction_op.cc -# caffe2/experiments/operators/tt_contraction_op.h -# caffe2/experiments/operators/tt_contraction_op_gpu.cc -# caffe2/experiments/operators/tt_pad_op.cc -# caffe2/experiments/operators/tt_pad_op.h -# caffe2/experiments/python/SparseTransformer.py -# caffe2/experiments/python/convnet_benchmarks.py -# caffe2/experiments/python/device_reduce_sum_bench.py -# caffe2/experiments/python/funhash_op_test.py -# caffe2/experiments/python/net_construct_bench.py -# caffe2/experiments/python/sparse_funhash_op_test.py -# caffe2/experiments/python/sparse_reshape_op_test.py -# caffe2/experiments/python/tt_contraction_op_test.py -# caffe2/experiments/python/tt_pad_op_test.py -# caffe2/mobile/contrib/libvulkan-stub/include/vulkan/vk_platform.h -# caffe2/mobile/contrib/libvulkan-stub/include/vulkan/vulkan.h -# caffe2/mobile/contrib/nnapi/NeuralNetworks.h -# caffe2/mobile/contrib/nnapi/dlnnapi.c -# caffe2/mobile/contrib/nnapi/nnapi_benchmark.cc -# caffe2/observers/profile_observer.cc -# caffe2/observers/profile_observer.h -# caffe2/operators/hip/conv_op_miopen.hip -# caffe2/operators/hip/local_response_normalization_op_miopen.hip -# caffe2/operators/hip/pool_op_miopen.hip -# caffe2/operators/hip/spatial_batch_norm_op_miopen.hip -# caffe2/operators/quantized/int8_utils.h -# caffe2/operators/stump_func_op.cc -# caffe2/operators/stump_func_op.cu -# caffe2/operators/stump_func_op.h -# caffe2/operators/unique_ops.cc -# caffe2/operators/unique_ops.cu -# caffe2/operators/unique_ops.h -# caffe2/operators/upsample_op.cc -# caffe2/operators/upsample_op.h -# caffe2/opt/fusion.h -# caffe2/python/layers/label_smooth.py -# caffe2/python/mint/static/css/simple-sidebar.css -# caffe2/python/modeling/get_entry_from_blobs.py -# caffe2/python/modeling/get_entry_from_blobs_test.py -# caffe2/python/modeling/gradient_clipping_test.py -# caffe2/python/operator_test/unique_ops_test.py -# caffe2/python/operator_test/upsample_op_test.py -# caffe2/python/operator_test/weight_scale_test.py -# caffe2/python/pybind_state_int8.cc -# caffe2/python/transformations.py -# caffe2/python/transformations_test.py -# caffe2/quantization/server/batch_matmul_dnnlowp_op.cc -# caffe2/quantization/server/batch_matmul_dnnlowp_op.h -# caffe2/quantization/server/compute_equalization_scale_test.py -# caffe2/quantization/server/elementwise_linear_dnnlowp_op.cc -# caffe2/quantization/server/elementwise_linear_dnnlowp_op.h -# caffe2/quantization/server/elementwise_sum_relu_op.cc -# caffe2/quantization/server/fb_fc_packed_op.cc -# caffe2/quantization/server/fb_fc_packed_op.h -# caffe2/quantization/server/fbgemm_fp16_pack_op.cc -# caffe2/quantization/server/fbgemm_fp16_pack_op.h -# caffe2/quantization/server/fully_connected_fake_lowp_op.cc -# caffe2/quantization/server/fully_connected_fake_lowp_op.h -# caffe2/quantization/server/int8_gen_quant_params_min_max_test.py -# caffe2/quantization/server/int8_gen_quant_params_test.py -# caffe2/quantization/server/int8_quant_scheme_blob_fill_test.py -# caffe2/quantization/server/spatial_batch_norm_relu_op.cc -# caffe2/sgd/weight_scale_op.cc -# caffe2/sgd/weight_scale_op.h -# caffe2/utils/bench_utils.h -# functorch/examples/maml_omniglot/maml-omniglot-higher.py -# functorch/examples/maml_omniglot/maml-omniglot-ptonly.py -# functorch/examples/maml_omniglot/maml-omniglot-transforms.py -# functorch/examples/maml_omniglot/support/omniglot_loaders.py -# modules/detectron/group_spatial_softmax_op.cc -# modules/detectron/group_spatial_softmax_op.cu -# modules/detectron/group_spatial_softmax_op.h -# modules/detectron/ps_roi_pool_op.cc -# modules/detectron/ps_roi_pool_op.h -# modules/detectron/roi_pool_f_op.cc -# modules/detectron/roi_pool_f_op.cu -# modules/detectron/roi_pool_f_op.h -# modules/detectron/sample_as_op.cc -# modules/detectron/sample_as_op.cu -# modules/detectron/sample_as_op.h -# modules/detectron/select_smooth_l1_loss_op.cc -# modules/detectron/select_smooth_l1_loss_op.cu -# modules/detectron/select_smooth_l1_loss_op.h -# modules/detectron/sigmoid_cross_entropy_loss_op.cc -# modules/detectron/sigmoid_cross_entropy_loss_op.cu -# modules/detectron/sigmoid_cross_entropy_loss_op.h -# modules/detectron/sigmoid_focal_loss_op.cc -# modules/detectron/sigmoid_focal_loss_op.cu -# modules/detectron/sigmoid_focal_loss_op.h -# modules/detectron/smooth_l1_loss_op.cc -# modules/detectron/smooth_l1_loss_op.cu -# modules/detectron/smooth_l1_loss_op.h -# modules/detectron/softmax_focal_loss_op.cc -# modules/detectron/softmax_focal_loss_op.cu -# modules/detectron/softmax_focal_loss_op.h -# modules/detectron/spatial_narrow_as_op.cc -# modules/detectron/spatial_narrow_as_op.cu -# modules/detectron/spatial_narrow_as_op.h -# modules/detectron/upsample_nearest_op.cc -# modules/detectron/upsample_nearest_op.h -# modules/module_test/module_test_dynamic.cc -# modules/rocksdb/rocksdb.cc -# scripts/apache_header.txt -# scripts/apache_python.txt -# torch/distributions/lkj_cholesky.py -# -# Apache 2.0 AND BSD 2-Clause -# caffe2/operators/deform_conv_op.cu -# -# Apache 2.0 AND BSD 2-Clause AND MIT -# modules/detectron/ps_roi_pool_op.cu -# -# Apache 2.0 AND BSD 2-Clause -# modules/detectron/upsample_nearest_op.cu -# -# BSD 0-Clause -# torch/csrc/utils/pythoncapi_compat.h -# -# BSD 2-Clause -# aten/src/ATen/native/quantized/cpu/qnnpack/deps/clog/LICENSE -# caffe2/image/transform_gpu.cu -# caffe2/image/transform_gpu.h -# -# BSL-1.0 -# c10/util/flat_hash_map.h -# c10/util/hash.h -# c10/util/Optional.h -# c10/util/order_preserving_flat_hash_map.h -# c10/util/strong_type.h -# c10/util/variant.h -# -# GPL-3.0-or-later AND MIT -# c10/util/reverse_iterator.h -# -# Khronos -# These files are for OpenCL, an unused option -# Replace them later, as-needed with the opencl-headers.rpm -# -# caffe2/contrib/opencl/OpenCL/cl.hpp -# caffe2/mobile/contrib/libopencl-stub/include/CL/cl.h -# caffe2/mobile/contrib/libopencl-stub/include/CL/cl.hpp -# caffe2/mobile/contrib/libopencl-stub/include/CL/cl_ext.h -# caffe2/mobile/contrib/libopencl-stub/include/CL/cl_gl.h -# caffe2/mobile/contrib/libopencl-stub/include/CL/cl_gl_ext.h -# caffe2/mobile/contrib/libopencl-stub/include/CL/cl_platform.h -# caffe2/mobile/contrib/libopencl-stub/include/CL/opencl.h -# -# MIT -# android/libs/fbjni/googletest-CMakeLists.txt.in -# c10/util/BFloat16-math.h -# caffe2/mobile/contrib/libvulkan-stub/include/libvulkan-stub.h -# caffe2/mobile/contrib/libvulkan-stub/src/libvulkan-stub.c -# caffe2/onnx/torch_ops/defs.cc -# cmake/Modules_CUDA_fix/upstream/FindCUDA/make2cmake.cmake -# cmake/Modules_CUDA_fix/upstream/FindCUDA/parse_cubin.cmake -# cmake/Modules_CUDA_fix/upstream/FindCUDA/run_nvcc.cmake -# functorch/einops/_parsing.py -# test/functorch/test_parsing.py -# test/functorch/test_rearrange.py -# third_party/miniz-2.1.0/LICENSE -# third_party/miniz-2.1.0/miniz.c -# tools/coverage_plugins_package/setup.py -# torch/_appdirs.py -# torch/utils/hipify/hipify_python.py -# -# Public Domain -# caffe2/mobile/contrib/libopencl-stub/LICENSE -# caffe2/utils/murmur_hash3.cc -# caffe2/utils/murmur_hash3.h -# -# Zlib -# aten/src/ATen/native/cpu/avx_mathfun.h +# See license.txt for license details %changelog * Fri Jan 26 2024 Fedora Release Engineering <releng(a)fedoraproject.org> - 2.1.2-3 commit d1b282f7c4b12c80f02ffbedb497e67a643f878f Author: Tom Rix <trix(a)redhat.com> Date: Mon Feb 26 07:14:51 2024 -0500 optional hipblaslt diff --git a/python-torch.spec b/python-torch.spec index d1dbbd4..6c71ba6 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -30,6 +30,8 @@ %bcond_with rocm %endif %endif +# hipblaslt is in development +%bcond_with hipblaslt # For testing openmp %bcond_without openmp @@ -80,10 +82,13 @@ Patch6: 0001-reenable-foxi-linking.patch %endif %if %{with rocm} -Patch100: 0001-cuda-hip-signatures.patch -Patch101: 0001-silence-an-assert.patch -Patch102: 0001-can-not-use-with-c-files.patch -Patch103: 0001-use-any-hip.patch +# https://github.com/pytorch/pytorch/pull/120551 +Patch100: 0001-Optionally-use-hipblaslt.patch +Patch101: 0001-cuda-hip-signatures.patch +Patch102: 0001-silence-an-assert.patch +Patch103: 0001-can-not-use-with-c-files.patch +Patch104: 0001-use-any-hip.patch + %endif %else @@ -171,7 +176,9 @@ BuildRequires: python3dist(sympy) %if %{with rocm} BuildRequires: hipblas-devel +%if %{with hipblaslt} BuildRequires: hipblaslt-devel +%endif BuildRequires: hipcub-devel BuildRequires: hipfft-devel BuildRequires: hipsparse-devel @@ -480,7 +487,7 @@ export BUILD_TEST=OFF # Adding pip to build requires does not fix # # See BZ 2244862 -%py3_build +%py3_build %install %if %{with rocm} @@ -490,7 +497,7 @@ export ROCM_PATH=%{_prefix} export DEVICE_LIB_PATH=/usr/lib/clang/17/amdgcn/bitcode %endif -%py3_install +%py3_install # empty files rm %{buildroot}%{python3_sitearch}/torch/py.typed commit 7a89201199c27b37e89b3931efa283526db909c6 Author: Tom Rix <trix(a)redhat.com> Date: Sat Feb 24 07:39:48 2024 -0500 add --with hipblaslt option diff --git a/next/0001-Optionally-use-hipblaslt.patch b/next/0001-Optionally-use-hipblaslt.patch new file mode 100644 index 0000000..029d98c --- /dev/null +++ b/next/0001-Optionally-use-hipblaslt.patch @@ -0,0 +1,235 @@ +From 186728c9f4de720547fa3d1b7951c7d5563ad3c7 Mon Sep 17 00:00:00 2001 +From: Tom Rix <trix(a)redhat.com> +Date: Fri, 23 Feb 2024 08:27:30 -0500 +Subject: [PATCH] Optionally use hipblaslt + +The hipblaslt package is not available on Fedora. +Instead of requiring the package, make it optional. +If it is found, define the preprocessor variable HIPBLASLT +Convert the checks for ROCM_VERSION >= 507000 to HIPBLASLT checks + +Signed-off-by: Tom Rix <trix(a)redhat.com> +--- + aten/src/ATen/cuda/CUDABlas.cpp | 5 +++-- + aten/src/ATen/cuda/CUDABlas.h | 2 +- + aten/src/ATen/cuda/CUDAContextLight.h | 4 ++-- + aten/src/ATen/cuda/CublasHandlePool.cpp | 4 ++-- + aten/src/ATen/cuda/tunable/TunableGemm.h | 6 +++--- + aten/src/ATen/native/cuda/Blas.cpp | 10 ++++++---- + cmake/Dependencies.cmake | 3 +++ + cmake/public/LoadHIP.cmake | 4 ++-- + 8 files changed, 22 insertions(+), 16 deletions(-) + +diff --git a/aten/src/ATen/cuda/CUDABlas.cpp b/aten/src/ATen/cuda/CUDABlas.cpp +index 0a3de5f9d77..b67031e88a7 100644 +--- a/aten/src/ATen/cuda/CUDABlas.cpp ++++ b/aten/src/ATen/cuda/CUDABlas.cpp +@@ -778,7 +778,7 @@ void gemm<at::BFloat16>(CUDABLAS_GEMM_ARGTYPES(at::BFloat16)) { + } + } + +-#if (!defined(USE_ROCM) && !defined(_MSC_VER)) || (defined(USE_ROCM) && ROCM_VERSION >= 50700) ++#if (!defined(USE_ROCM) && !defined(_MSC_VER)) || (defined(USE_ROCM) && defined(HIPBLASLT)) + + #if defined(USE_ROCM) && ROCM_VERSION >= 50700 && ROCM_VERSION < 60000 + // only for rocm 5.7 where we first supported hipblaslt, it was difficult +@@ -909,6 +909,7 @@ class CuBlasLtMatmulPreference : public CuBlasLtDescriptor< + }; + } // namespace + ++#if (!defined(USE_ROCM) && !defined(_MSC_VER)) || (defined(USE_ROCM) && defined(HIPBLASLT)) + template <typename Dtype> + void gemm_and_bias( + bool transpose_mat1, +@@ -1121,7 +1122,7 @@ template void gemm_and_bias( + at::BFloat16* result_ptr, + int64_t result_ld, + GEMMAndBiasActivationEpilogue activation); +- ++#endif + void scaled_gemm( + char transa, + char transb, +diff --git a/aten/src/ATen/cuda/CUDABlas.h b/aten/src/ATen/cuda/CUDABlas.h +index eb12bb350c5..068607467dd 100644 +--- a/aten/src/ATen/cuda/CUDABlas.h ++++ b/aten/src/ATen/cuda/CUDABlas.h +@@ -82,7 +82,7 @@ void gemm_internal<at::Half>(CUDABLAS_GEMM_ARGTYPES(at::Half)); + template <> + void gemm_internal<at::BFloat16>(CUDABLAS_GEMM_ARGTYPES(at::BFloat16)); + +-#if (!defined(USE_ROCM) && !defined(_MSC_VER)) || (defined(USE_ROCM) && ROCM_VERSION >= 50700) ++#if (!defined(USE_ROCM) && !defined(_MSC_VER)) || (defined(USE_ROCM) && defined(HIPBLASLT)) + enum GEMMAndBiasActivationEpilogue { + None, + RELU, +diff --git a/aten/src/ATen/cuda/CUDAContextLight.h b/aten/src/ATen/cuda/CUDAContextLight.h +index 4ec35f59a21..e28dc42034f 100644 +--- a/aten/src/ATen/cuda/CUDAContextLight.h ++++ b/aten/src/ATen/cuda/CUDAContextLight.h +@@ -9,7 +9,7 @@ + + // cublasLT was introduced in CUDA 10.1 but we enable only for 11.1 that also + // added bf16 support +-#if (!defined(USE_ROCM) && !defined(_MSC_VER)) || (defined(USE_ROCM) && ROCM_VERSION >= 50700) ++#if (!defined(USE_ROCM) && !defined(_MSC_VER)) || (defined(USE_ROCM) && defined(HIPBLASLT)) + #include <cublasLt.h> + #endif + +@@ -82,7 +82,7 @@ TORCH_CUDA_CPP_API c10::Allocator* getCUDADeviceAllocator(); + /* Handles */ + TORCH_CUDA_CPP_API cusparseHandle_t getCurrentCUDASparseHandle(); + TORCH_CUDA_CPP_API cublasHandle_t getCurrentCUDABlasHandle(); +-#if (!defined(USE_ROCM) && !defined(_MSC_VER)) || (defined(USE_ROCM) && ROCM_VERSION >= 50700) ++#if (!defined(USE_ROCM) && !defined(_MSC_VER)) || (defined(USE_ROCM) && defined(HIPBLASLT)) + TORCH_CUDA_CPP_API cublasLtHandle_t getCurrentCUDABlasLtHandle(); + #endif + +diff --git a/aten/src/ATen/cuda/CublasHandlePool.cpp b/aten/src/ATen/cuda/CublasHandlePool.cpp +index d8ee09b1486..4510193a5cc 100644 +--- a/aten/src/ATen/cuda/CublasHandlePool.cpp ++++ b/aten/src/ATen/cuda/CublasHandlePool.cpp +@@ -28,7 +28,7 @@ namespace at::cuda { + + namespace { + +-#if defined(USE_ROCM) && ROCM_VERSION >= 50700 ++#if defined(USE_ROCM) && defined(HIPBLASLT) + void createCublasLtHandle(cublasLtHandle_t *handle) { + TORCH_CUDABLAS_CHECK(cublasLtCreate(handle)); + } +@@ -177,7 +177,7 @@ cublasHandle_t getCurrentCUDABlasHandle() { + return handle; + } + +-#if (!defined(USE_ROCM) && !defined(_MSC_VER)) || (defined(USE_ROCM) && ROCM_VERSION >= 50700) ++#if (!defined(USE_ROCM) && !defined(_MSC_VER)) || (defined(USE_ROCM) && defined(HIPBLASLT)) + cublasLtHandle_t getCurrentCUDABlasLtHandle() { + #ifdef USE_ROCM + c10::DeviceIndex device = 0; +diff --git a/aten/src/ATen/cuda/tunable/TunableGemm.h b/aten/src/ATen/cuda/tunable/TunableGemm.h +index 3ba0d761277..dde1870cfbf 100644 +--- a/aten/src/ATen/cuda/tunable/TunableGemm.h ++++ b/aten/src/ATen/cuda/tunable/TunableGemm.h +@@ -11,7 +11,7 @@ + + #include <ATen/cuda/tunable/GemmCommon.h> + #ifdef USE_ROCM +-#if ROCM_VERSION >= 50700 ++#ifdef HIPBLASLT + #include <ATen/cuda/tunable/GemmHipblaslt.h> + #endif + #include <ATen/cuda/tunable/GemmRocblas.h> +@@ -166,7 +166,7 @@ class GemmTunableOp : public TunableOp<GemmParams<T>, StreamTimer> { + } + #endif + +-#if defined(USE_ROCM) && ROCM_VERSION >= 50700 ++#if defined(USE_ROCM) && defined(HIPBLASLT) + static const char *env = std::getenv("PYTORCH_TUNABLEOP_HIPBLASLT_ENABLED"); + if (env == nullptr || strcmp(env, "1") == 0) { + // disallow tuning of hipblaslt with c10::complex +@@ -240,7 +240,7 @@ class GemmStridedBatchedTunableOp : public TunableOp<GemmStridedBatchedParams<T> + } + #endif + +-#if defined(USE_ROCM) && ROCM_VERSION >= 50700 ++#if defined(USE_ROCM) && defined(HIPBLASLT) + static const char *env = std::getenv("PYTORCH_TUNABLEOP_HIPBLASLT_ENABLED"); + if (env == nullptr || strcmp(env, "1") == 0) { + // disallow tuning of hipblaslt with c10::complex +diff --git a/aten/src/ATen/native/cuda/Blas.cpp b/aten/src/ATen/native/cuda/Blas.cpp +index 2b7ff1b502b..9ae2ccbd16d 100644 +--- a/aten/src/ATen/native/cuda/Blas.cpp ++++ b/aten/src/ATen/native/cuda/Blas.cpp +@@ -153,7 +153,7 @@ enum class Activation { + GELU, + }; + +-#if (!defined(USE_ROCM) && !defined(_MSC_VER)) || (defined(USE_ROCM) && ROCM_VERSION >= 50700) ++#if (!defined(USE_ROCM) && !defined(_MSC_VER)) || (defined(USE_ROCM) && defined(HIPBLASLT)) + cuda::blas::GEMMAndBiasActivationEpilogue activation_to_gemm_and_blas_arg(Activation a) { + switch (a) { + case Activation::None: +@@ -191,6 +191,7 @@ static bool getDisableAddmmCudaLt() { + + #ifdef USE_ROCM + static bool isSupportedHipLtROCmArch(int index) { ++#if defined(HIPBLASLT) + hipDeviceProp_t* prop = at::cuda::getDeviceProperties(index); + std::string device_arch = prop->gcnArchName; + static const std::vector<std::string> archs = {"gfx90a", "gfx940", "gfx941", "gfx942"}; +@@ -201,6 +202,7 @@ static bool isSupportedHipLtROCmArch(int index) { + } + } + TORCH_CHECK(false, "Attempting to use hipBLASLt on a unsupported architecture!"); ++#endif + return false; + } + #endif +@@ -226,7 +228,7 @@ Tensor& addmm_out_cuda_impl(Tensor& result, const Tensor& self, const Tensor& ma + at::ScalarType scalar_type = self.scalar_type(); + c10::MaybeOwned<Tensor> self_; + if (&result != &self) { +-#if (defined(CUDA_VERSION) && CUDA_VERSION >= 11040 && !defined(_MSC_VER)) || defined(USE_ROCM) && ROCM_VERSION >= 50700 ++#if (defined(CUDA_VERSION) && CUDA_VERSION >= 11040 && !defined(_MSC_VER)) || defined(USE_ROCM) && defined(HIPBLASLT) + // Strangely, if mat2 has only 1 row or column, we get + // CUBLAS_STATUS_INVALID_VALUE error from cublasLtMatmulAlgoGetHeuristic. + // self.dim() == 1 && result.dim() == 2 && self.sizes()[0] == mat2_sizes[1] +@@ -269,7 +271,7 @@ Tensor& addmm_out_cuda_impl(Tensor& result, const Tensor& self, const Tensor& ma + } + self__sizes = self_->sizes(); + } else { +-#if defined(USE_ROCM) && ROCM_VERSION >= 50700 ++#if defined(USE_ROCM) && defined(HIPBLASLT) + useLtInterface = !disable_addmm_cuda_lt && + result.dim() == 2 && result.is_contiguous() && + isSupportedHipLtROCmArch(self.device().index()) && +@@ -320,7 +322,7 @@ Tensor& addmm_out_cuda_impl(Tensor& result, const Tensor& self, const Tensor& ma + + TORCH_INTERNAL_ASSERT_DEBUG_ONLY(!args.result->is_conj()); + +-#if (!defined(USE_ROCM) && !defined(_MSC_VER)) || (defined(USE_ROCM) && ROCM_VERSION >= 50700) ++#if (!defined(USE_ROCM) && !defined(_MSC_VER)) || (defined(USE_ROCM) && defined(HIPBLASLT)) + if (useLtInterface) { + AT_DISPATCH_FLOATING_TYPES_AND2( + at::ScalarType::Half, +diff --git a/cmake/Dependencies.cmake b/cmake/Dependencies.cmake +index b7ffbeb07dc..2b6c3678984 100644 +--- a/cmake/Dependencies.cmake ++++ b/cmake/Dependencies.cmake +@@ -1273,6 +1273,9 @@ if(USE_ROCM) + if(ROCM_VERSION_DEV VERSION_GREATER_EQUAL "6.0.0") + list(APPEND HIP_CXX_FLAGS -DHIPBLAS_V2) + endif() ++ if(hipblast_FOUND) ++ list(APPEND HIP_CXX_FLAGS -DHIPBLASLT) ++ endif() + if(HIPBLASLT_CUSTOM_DATA_TYPE) + list(APPEND HIP_CXX_FLAGS -DHIPBLASLT_CUSTOM_DATA_TYPE) + endif() +diff --git a/cmake/public/LoadHIP.cmake b/cmake/public/LoadHIP.cmake +index f6ca263c5e5..53eb0b63c1a 100644 +--- a/cmake/public/LoadHIP.cmake ++++ b/cmake/public/LoadHIP.cmake +@@ -156,7 +156,7 @@ if(HIP_FOUND) + find_package_and_print_version(rocblas REQUIRED) + find_package_and_print_version(hipblas REQUIRED) + if(ROCM_VERSION_DEV VERSION_GREATER_EQUAL "5.7.0") +- find_package_and_print_version(hipblaslt REQUIRED) ++ find_package_and_print_version(hipblaslt) + endif() + find_package_and_print_version(miopen REQUIRED) + if(ROCM_VERSION_DEV VERSION_GREATER_EQUAL "4.1.0") +@@ -191,7 +191,7 @@ if(HIP_FOUND) + # roctx is part of roctracer + find_library(ROCM_ROCTX_LIB roctx64 HINTS ${ROCM_PATH}/lib) + +- if(ROCM_VERSION_DEV VERSION_GREATER_EQUAL "5.7.0") ++ if(hipblastlt_FOUND) + # check whether hipblaslt is using its own datatype + set(file "${PROJECT_BINARY_DIR}/hipblaslt_test_data_type.cc") + file(WRITE ${file} "" +-- +2.43.2 + commit 2752e0ea1d222eb60a7ef6806613837bb7a1001e Author: Tom Rix <trix(a)redhat.com> Date: Fri Feb 23 07:33:39 2024 -0500 Cleanup combo of rocm and caffe2 Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/python-torch.spec b/python-torch.spec index 626ca0a..d1dbbd4 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -567,9 +567,14 @@ sed -i -f br.sed devel.files %{python3_sitearch}/torch/lib/libtorch_cuda_linalg.so %endif %if %{with caffe2} -%{python3_sitearch}/torch/lib/libcaffe2_detectron_ops.so %{python3_sitearch}/torch/lib/libcaffe2_observers.so %{python3_sitearch}/caffe2/python/caffe2_pybind11_state.cpython*.so +%if %{without rocm} +%{python3_sitearch}/torch/lib/libcaffe2_detectron_ops.so +%else +%{python3_sitearch}/torch/lib/libcaffe2_detectron_ops_hip.so +%{python3_sitearch}/caffe2/python/caffe2_pybind11_state_hip.cpython*.so +%endif %endif # misc commit d4bfc263df0f1a472fa9167fe01e9ce5188d25b8 Author: Tom Rix <trix(a)redhat.com> Date: Thu Feb 22 12:04:15 2024 -0500 get caffe2 building diff --git a/next/0001-reenable-foxi-linking.patch b/next/0001-reenable-foxi-linking.patch new file mode 100644 index 0000000..8e39795 --- /dev/null +++ b/next/0001-reenable-foxi-linking.patch @@ -0,0 +1,25 @@ +From 58ccda271e8f51c3fa5b7518cf6ee52ce204fd37 Mon Sep 17 00:00:00 2001 +From: Tom Rix <trix(a)redhat.com> +Date: Thu, 22 Feb 2024 09:28:11 -0500 +Subject: [PATCH] reenable foxi linking + +--- + cmake/Dependencies.cmake | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/cmake/Dependencies.cmake b/cmake/Dependencies.cmake +index 42fbf80f6e8..bc3a2dc6fee 100644 +--- a/cmake/Dependencies.cmake ++++ b/cmake/Dependencies.cmake +@@ -1604,7 +1604,7 @@ if(CAFFE2_CMAKE_BUILDING_WITH_MAIN_REPO AND NOT INTERN_DISABLE_ONNX) + list(APPEND Caffe2_DEPENDENCY_LIBS onnx_proto onnx) + endif() + # include_directories(${FOXI_INCLUDE_DIRS}) +-# list(APPEND Caffe2_DEPENDENCY_LIBS foxi_loader) ++ list(APPEND Caffe2_DEPENDENCY_LIBS foxi_loader) + # Recover the build shared libs option. + set(BUILD_SHARED_LIBS ${TEMP_BUILD_SHARED_LIBS}) + endif() +-- +2.43.2 + diff --git a/python-torch.spec b/python-torch.spec index b5eaef4..626ca0a 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -6,8 +6,8 @@ # So pre releases can be tried %bcond_without gitcommit %if %{with gitcommit} -# The top of tree ~2/18/24 -%global commit0 372d078f361e726bb4ac0884ac334b04c58179ef +# The top of tree ~2/22/24 +%global commit0 5c5b71b6eebae76d744261715231093e62f0d090 %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) %global pypi_version 2.3.0 @@ -23,9 +23,13 @@ # /usr/lib64/python3.12/site-packages/torch/bin/test_api, test_lazy %bcond_with test -# For testing rocm -# Not viable on 2.1.2, use --with gitcommit +%ifarch x86_64 +%if 0%{?fedora} +%bcond_without rocm +%else %bcond_with rocm +%endif +%endif # For testing openmp %bcond_without openmp @@ -37,13 +41,9 @@ %bcond_with distributed # For testing cuda +%ifarch x86_64 %bcond_with cuda -# Which cuda ? Look at your /usr/local/cuda-<ver>, this is mine -# Which has problems with 2.1.2 .. -%global cuda_ver 12.3 -# Which arch ? Who knows, pick something yourself or go with native -%global cuda_arch native - +%endif Name: python-%{pypi_name} Version: %{pypi_version} @@ -75,6 +75,10 @@ Patch2: 0001-no-third_party-FXdiv.patch Patch3: 0001-Stub-in-kineto-ActivityType.patch Patch5: 0001-disable-submodule-search.patch +%if %{with caffe2} +Patch6: 0001-reenable-foxi-linking.patch +%endif + %if %{with rocm} Patch100: 0001-cuda-hip-signatures.patch Patch101: 0001-silence-an-assert.patch @@ -137,11 +141,7 @@ BuildRequires: ninja-build BuildRequires: onnx-devel BuildRequires: openblas-devel BuildRequires: pocketfft-devel -%if %{with caffe2} -BuildRequires: protobuf-lite-devel -%else BuildRequires: protobuf-devel -%endif BuildRequires: pthreadpool-devel BuildRequires: psimd-devel BuildRequires: python3-numpy @@ -430,7 +430,7 @@ export USE_XNNPACK=ON %if %{with caffe2} export BUILD_CAFFE2=ON export INTERN_BUILD_MOBILE=OFF -export USE_LITE_PROTO=ON +export USE_LITE_PROTO=OFF %endif %if %{with distributed} @@ -500,6 +500,11 @@ rm %{buildroot}%{python3_sitearch}/torch/cuda/error.py rm %{buildroot}%{python3_sitearch}/torch/cuda/__pycache__/error.*.pyc rm %{buildroot}%{python3_sitearch}/torch/include/ATen/cudnn/Exceptions.h +%if %{with caffe2} +# Remove test data +rm -rf %{buildroot}%{python3_sitearch}/caffe2/python/serialized_test/data/* +%endif + # exec permission for f in `find %{buildroot}%{python3_sitearch} -name '*.py'`; do if [ ! -x $f ]; then @@ -561,6 +566,11 @@ sed -i -f br.sed devel.files %{python3_sitearch}/torch/lib/libtorch_cuda.so %{python3_sitearch}/torch/lib/libtorch_cuda_linalg.so %endif +%if %{with caffe2} +%{python3_sitearch}/torch/lib/libcaffe2_detectron_ops.so +%{python3_sitearch}/torch/lib/libcaffe2_observers.so +%{python3_sitearch}/caffe2/python/caffe2_pybind11_state.cpython*.so +%endif # misc %{python3_sitearch}/torch/utils/model_dump/{*.js,*.mjs,*.html} commit aca80a52c146ed5e9efff0c12033c218276f8073 Author: Tom Rix <trix(a)redhat.com> Date: Tue Feb 20 11:07:12 2024 -0800 add a --with cuda option diff --git a/next/pyproject.toml b/next/pyproject.toml new file mode 100644 index 0000000..9508ad0 --- /dev/null +++ b/next/pyproject.toml @@ -0,0 +1,154 @@ +[build-system] +requires = [ + "setuptools", + "wheel", + "astunparse", + "numpy", + "ninja", + "pyyaml", + "cmake", + "typing-extensions", + "requests", +] +# Use legacy backend to import local packages in setup.py +build-backend = "setuptools.build_meta:__legacy__" + + +[tool.black] +# Uncomment if pyproject.toml worked fine to ensure consistency with flake8 +# line-length = 120 +target-version = ["py38", "py39", "py310", "py311"] + + +[tool.ruff] +target-version = "py38" + +# NOTE: Synchoronize the ignores with .flake8 +ignore = [ + # these ignores are from flake8-bugbear; please fix! + "B007", "B008", "B017", + "B018", # Useless expression + "B019", + "B023", + "B028", # No explicit `stacklevel` keyword argument found + "B904", + "E402", + "C408", # C408 ignored because we like the dict keyword argument syntax + "E501", # E501 is not flexible enough, we're using B950 instead + "E721", + "E731", # Assign lambda expression + "E741", + "EXE001", + "F405", + "F841", + # these ignores are from flake8-logging-format; please fix! + "G101", + # these ignores are from ruff NPY; please fix! + "NPY002", + # these ignores are from ruff PERF; please fix! + "PERF203", + "PERF401", + "PERF403", + # these ignores are from PYI; please fix! + "PYI019", + "PYI024", + "PYI036", + "PYI041", + "PYI056", + "SIM102", "SIM103", "SIM112", # flake8-simplify code styles + "SIM105", # these ignores are from flake8-simplify. please fix or ignore with commented reason + "SIM108", + "SIM110", + "SIM114", # Combine `if` branches using logical `or` operator + "SIM115", + "SIM116", # Disable Use a dictionary instead of consecutive `if` statements + "SIM117", + "SIM118", + "UP006", # keep-runtime-typing + "UP007", # keep-runtime-typing +] +line-length = 120 +select = [ + "B", + "C4", + "G", + "E", + "EXE", + "F", + "SIM1", + "W", + # Not included in flake8 + "NPY", + "PERF", + "PGH004", + "PIE794", + "PIE800", + "PIE804", + "PIE807", + "PIE810", + "PLC0131", # type bivariance + "PLC0132", # type param mismatch + "PLC0205", # string as __slots__ + "PLE", + "PLR0133", # constant comparison + "PLR0206", # property with params + "PLR1722", # use sys exit + "PLW0129", # assert on string literal + "PLW0406", # import self + "PLW0711", # binary op exception + "PLW1509", # preexec_fn not safe with threads + "PLW3301", # nested min max + "PT006", # TODO: enable more PT rules + "PT022", + "PT023", + "PT024", + "PT025", + "PT026", + "PYI", + "RUF008", # mutable dataclass default + "RUF015", # access first ele in constant time + "RUF016", # type error non-integer index + "RUF017", + "TRY200", + "TRY302", + "UP", +] + +[tool.ruff.per-file-ignores] +"__init__.py" = [ + "F401", +] +"test/typing/reveal/**" = [ + "F821", +] +"test/torch_np/numpy_tests/**" = [ + "F821", +] +"test/jit/**" = [ + "PLR0133", # tests require this for JIT + "PYI", + "RUF015", + "UP", # We don't want to modify the jit test as they test specify syntax +] +"test/test_jit.py" = [ + "PLR0133", # tests require this for JIT + "PYI", + "RUF015", + "UP", # We don't want to modify the jit test as they test specify syntax +] + +"torch/onnx/**" = [ + "UP037", # ONNX does runtime type checking +] + +"torchgen/api/types/__init__.py" = [ + "F401", + "F403", +] +"torchgen/executorch/api/types/__init__.py" = [ + "F401", + "F403", +] +"torch/utils/collect_env.py" = [ + "UP", # collect_env.py needs to work with older versions of Python +] diff --git a/python-torch.spec b/python-torch.spec index 8758035..b5eaef4 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -4,7 +4,7 @@ %global forgeurl https://github.com/pytorch/pytorch # So pre releases can be tried -%bcond_with gitcommit +%bcond_without gitcommit %if %{with gitcommit} # The top of tree ~2/18/24 %global commit0 372d078f361e726bb4ac0884ac334b04c58179ef @@ -28,7 +28,7 @@ %bcond_with rocm # For testing openmp -%bcond_with openmp +%bcond_without openmp # For testing caffe2 %bcond_with caffe2 @@ -62,6 +62,11 @@ Source0: %{forgeurl}/releases/download/v%{version}/pytorch-v%{version}.ta Source1: https://github.com/google/flatbuffers/archive/refs/tags/v23.3.3.tar.gz Source2: https://github.com/pybind/pybind11/archive/refs/tags/v2.11.1.tar.gz +%if %{with cuda} +Source10: https://github.com/NVIDIA/cudnn-frontend/archive/refs/tags/v1.0.3.tar.gz +Source11: https://github.com/NVIDIA/cutlass/archive/refs/tags/v3.3.0.tar.gz +%endif + %if %{with gitcommit} Patch0: 0001-no-third_party-foxi.patch @@ -144,7 +149,11 @@ BuildRequires: python3-pyyaml BuildRequires: python3-typing-extensions BuildRequires: sleef-devel BuildRequires: valgrind-devel +%if %{with gitcommit} +BuildRequires: xnnpack-devel = 0.0^git20231127.d9cce34 +%else BuildRequires: xnnpack-devel = 0.0^git20221221.51a9875 +%endif BuildRequires: python3-devel BuildRequires: python3dist(filelock) @@ -264,6 +273,13 @@ cp -r flatbuffers-23.3.3/* third_party/flatbuffers/ tar xf %{SOURCE2} cp -r pybind11-2.11.1/* third_party/pybind11/ +%if %{with cuda} +tar xf %{SOURCE10} +cp -r cudnn-frontend-1.0.3/* third_party/cudnn_frontend/ +tar xf %{SOURCE11} +cp -r cutlass-3.3.0/* third_party/cutlass/ +%endif + %if %{with opencv} # Reduce requirements, *FOUND is not set sed -i -e 's/USE_OPENCV AND OpenCV_FOUND AND USE_FFMPEG AND FFMPEG_FOUND/USE_OPENCV AND USE_FFMPEG/' caffe2/video/CMakeLists.txt @@ -272,6 +288,14 @@ sed -i -e 's/STATUS/FATAL/' caffe2/image/CMakeLists.txt cat caffe2/image/CMakeLists.txt %endif +%if 0%{?rhel} +# In RHEL but too old +sed -i -e '/typing-extensions/d' setup.py +# Need to pip these +sed -i -e '/sympy/d' setup.py +sed -i -e '/fsspec/d' setup.py +%endif + # Release comes fully loaded with third party src # Remove what we can # @@ -291,8 +315,8 @@ mv third_party/flatbuffers . mv third_party/pybind11 . %if %{with cuda} -mv third_party/nvfuser . mv third_party/cudnn_frontend . +mv third_party/cutlass . %endif %if %{with test} @@ -308,8 +332,8 @@ mv flatbuffers third_party mv pybind11 third_party %if %{with cuda} -mv nvfuser third_party mv cudnn_frontend third_party +mv cutlass third_party %endif %if %{with test} @@ -336,6 +360,33 @@ sed -i -e 's@string(APPEND CMAKE_CUDA_FLAGS " -D_GLIBCXX_USE_CXX11_ABI=${GLIBCXX %build +# +# Control the number of jobs +# +# The build can fail if too many threads exceed the physical memory +# So count core and and memory and increase the build memory util the build succeeds +# +# Real cores, No hyperthreading +COMPILE_JOBS=`cat /proc/cpuinfo | grep -m 1 'cpu cores' | awk '{ print $4 }'` +if [ ${COMPILE_JOBS}x = x ]; then + COMPILE_JOBS=1 +fi +# Take into account memmory usage per core, do not thrash real memory +%if %{with cuda} +BUILD_MEM=4 +%else +BUILD_MEM=2 +%endif +MEM_KB=0 +MEM_KB=`cat /proc/meminfo | grep MemTotal | awk '{ print $2 }'` +MEM_MB=`eval "expr ${MEM_KB} / 1024"` +MEM_GB=`eval "expr ${MEM_MB} / 1024"` +COMPILE_JOBS_MEM=`eval "expr 1 + ${MEM_GB} / ${BUILD_MEM}"` +if [ "$COMPILE_JOBS_MEM" -lt "$COMPILE_JOBS" ]; then + COMPILE_JOBS=$COMPILE_JOBS_MEM +fi +export MAX_JOBS=$COMPILE_JOBS + # For debugging setup.py # export SETUPTOOLS_SCM_DEBUG=1 @@ -408,6 +459,7 @@ export USE_ROCM=OFF %if %{with cuda} export CUDACXX=/usr/local/cuda/bin/nvcc +export CPLUS_INCLUDE_PATH=/usr/local/cuda/include export USE_CUDA=ON export USE_NCCL=OFF %else @@ -503,6 +555,12 @@ sed -i -f br.sed devel.files %{python3_sitearch}/torch/lib/libcaffe2_nvrtc.so %{python3_sitearch}/torch/lib/libtorch_hip.so %endif +%if %{with cuda} +%{python3_sitearch}/torch/lib/libc10_cuda.so +%{python3_sitearch}/torch/lib/libcaffe2_nvrtc.so +%{python3_sitearch}/torch/lib/libtorch_cuda.so +%{python3_sitearch}/torch/lib/libtorch_cuda_linalg.so +%endif # misc %{python3_sitearch}/torch/utils/model_dump/{*.js,*.mjs,*.html} @@ -510,9 +568,11 @@ sed -i -f br.sed devel.files %{python3_sitearch}/torchgen/packaged/autograd/{*.md,*.yaml} %if %{with gitcommit} %{python3_sitearch}/torch/_export/serde/schema.yaml +%if 0%{?fedora} %{python3_sitearch}/torch/distributed/pipeline/sync/_balance/py.typed %{python3_sitearch}/torch/distributed/pipeline/sync/py.typed %endif +%endif # egg %{python3_sitearch}/torch*.egg-info/* commit b8381c9f2de47146c2e1ec0c2be66cf7841158d5 Author: Tom Rix <trix(a)redhat.com> Date: Mon Feb 19 14:59:29 2024 -0500 use third party pybind11 diff --git a/python-torch.spec b/python-torch.spec index 4939a2c..8758035 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -55,11 +55,12 @@ License: BSD-3-Clause AND BSD-2-Clause AND 0BSD AND Apache-2.0 AND MIT AN URL: https://pytorch.org/ %if %{with gitcommit} Source0: %{forgeurl}/archive/%{commit0}/pytorch-%{shortcommit0}.tar.gz -Source2: pyproject.toml +Source100: pyproject.toml %else Source0: %{forgeurl}/releases/download/v%{version}/pytorch-v%{version}.tar.gz %endif Source1: https://github.com/google/flatbuffers/archive/refs/tags/v23.3.3.tar.gz +Source2: https://github.com/pybind/pybind11/archive/refs/tags/v2.11.1.tar.gz %if %{with gitcommit} @@ -243,7 +244,7 @@ Requires: python3-%{pypi_name}%{?_isa} = %{version}-%{release} # Remove bundled egg-info rm -rf %{pypi_name}.egg-info # Overwrite with a git checkout of the pyproject.toml -cp %{SOURCE2} . +cp %{SOURCE100} . %if %{with rocm} # hipify @@ -260,6 +261,9 @@ sed -i -e 's@rocm-core/rocm_version.h@rocm_version.h@' aten/src/ATen/hip/tunable tar xf %{SOURCE1} cp -r flatbuffers-23.3.3/* third_party/flatbuffers/ +tar xf %{SOURCE2} +cp -r pybind11-2.11.1/* third_party/pybind11/ + %if %{with opencv} # Reduce requirements, *FOUND is not set sed -i -e 's/USE_OPENCV AND OpenCV_FOUND AND USE_FFMPEG AND FFMPEG_FOUND/USE_OPENCV AND USE_FFMPEG/' caffe2/video/CMakeLists.txt @@ -312,10 +316,6 @@ mv cudnn_frontend third_party mv googletest third_party %endif - - - - # # Fake out pocketfft, and system header will be used mkdir third_party/pocketfft commit e0659660cdb6bb31b56bb12f71a88fc2ba0b3ca3 Author: Tom Rix <trix(a)redhat.com> Date: Mon Feb 19 07:27:26 2024 -0800 Try to get cuda going on rhel Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/python-torch.spec b/python-torch.spec index 3c7fdc2..4939a2c 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -36,6 +36,15 @@ # For testing distributed %bcond_with distributed +# For testing cuda +%bcond_with cuda +# Which cuda ? Look at your /usr/local/cuda-<ver>, this is mine +# Which has problems with 2.1.2 .. +%global cuda_ver 12.3 +# Which arch ? Who knows, pick something yourself or go with native +%global cuda_arch native + + Name: python-%{pypi_name} Version: %{pypi_version} Release: %autorelease @@ -99,9 +108,11 @@ Patch9: 0001-disable-as-needed-for-libtorch.patch # Limit to these because they are well behaved with clang ExclusiveArch: x86_64 aarch64 -# RHEL does not do clang well %if 0%{?fedora} %global toolchain clang +%else +# RHEL does not do clang well, nor lto +%global _lto_cflags %nil %endif BuildRequires: clang-devel @@ -275,6 +286,11 @@ mv third_party/flatbuffers . mv third_party/pybind11 . +%if %{with cuda} +mv third_party/nvfuser . +mv third_party/cudnn_frontend . +%endif + %if %{with test} mv third_party/googletest . %endif @@ -287,6 +303,11 @@ mv miniz-2.1.0 third_party mv flatbuffers third_party mv pybind11 third_party +%if %{with cuda} +mv nvfuser third_party +mv cudnn_frontend third_party +%endif + %if %{with test} mv googletest third_party %endif @@ -308,6 +329,11 @@ rm caffe2/contrib/opencl/OpenCL/cl.hpp rm caffe2/mobile/contrib/libopencl-stub/include/CL/*.h rm caffe2/mobile/contrib/libopencl-stub/include/CL/*.hpp +%if %{with cuda} +# build complains about not being able to build -pie without -fPIC +sed -i -e 's@string(APPEND CMAKE_CUDA_FLAGS " -D_GLIBCXX_USE_CXX11_ABI=${GLIBCXX_USE_CXX11_ABI}")@string(APPEND CMAKE_CUDA_FLAGS " -fPIC -D_GLIBCXX_USE_CXX11_ABI=${GLIBCXX_USE_CXX11_ABI}")@' CMakeLists.txt +%endif + %build # For debugging setup.py @@ -326,7 +352,6 @@ export BUILD_SHARED_LIBS=ON export CMAKE_BUILD_TYPE=RelWithDebInfo export CMAKE_FIND_PACKAGE_PREFER_CONFIG=ON export CAFFE2_LINK_LOCAL_PROTOBUF=OFF -export USE_CUDA=OFF export USE_FBGEMM=OFF export USE_GOLD_LINKER=OFF export USE_ITT=OFF @@ -381,6 +406,14 @@ export DEVICE_LIB_PATH=/usr/lib/clang/17/amdgcn/bitcode export USE_ROCM=OFF %endif +%if %{with cuda} +export CUDACXX=/usr/local/cuda/bin/nvcc +export USE_CUDA=ON +export USE_NCCL=OFF +%else +export USE_CUDA=OFF +%endif + %if %{with test} export BUILD_TEST=ON %else commit 22dc36f37e6bdcbefebbca187413ae89f2393702 Author: Tom Rix <trix(a)redhat.com> Date: Sun Feb 18 13:02:05 2024 -0800 Start building for RHEL Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/python-torch.spec b/python-torch.spec index 2ca5f0f..3c7fdc2 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -46,11 +46,11 @@ License: BSD-3-Clause AND BSD-2-Clause AND 0BSD AND Apache-2.0 AND MIT AN URL: https://pytorch.org/ %if %{with gitcommit} Source0: %{forgeurl}/archive/%{commit0}/pytorch-%{shortcommit0}.tar.gz -Source1: pyproject.toml -Source2: https://github.com/google/flatbuffers/archive/refs/tags/v23.3.3.tar.gz +Source2: pyproject.toml %else Source0: %{forgeurl}/releases/download/v%{version}/pytorch-v%{version}.tar.gz %endif +Source1: https://github.com/google/flatbuffers/archive/refs/tags/v23.3.3.tar.gz %if %{with gitcommit} @@ -74,8 +74,6 @@ Patch103: 0001-use-any-hip.patch # * Remove warnings/errors for clang 17 # * fxdiv is not a library on Fedora Patch0: 0001-Prepare-pytorch-cmake-for-fedora.patch -# Use Fedora's fmt -Patch1: 0002-Regenerate-flatbuffer-header.patch # https://github.com/pytorch/pytorch/pull/111048 Patch2: 0003-Stub-in-kineto-ActivityType.patch # PyTorch has not fully baked 3.12 support because 3.12 is so new @@ -101,16 +99,16 @@ Patch9: 0001-disable-as-needed-for-libtorch.patch # Limit to these because they are well behaved with clang ExclusiveArch: x86_64 aarch64 +# RHEL does not do clang well +%if 0%{?fedora} %global toolchain clang +%endif BuildRequires: clang-devel BuildRequires: cmake BuildRequires: cpuinfo-devel BuildRequires: eigen3-devel BuildRequires: fmt-devel -%if %{without gitcommit} -BuildRequires: flatbuffers-devel -%endif BuildRequires: FP16-devel BuildRequires: fxdiv-devel BuildRequires: gcc-c++ @@ -130,7 +128,6 @@ BuildRequires: protobuf-devel BuildRequires: pthreadpool-devel BuildRequires: psimd-devel BuildRequires: python3-numpy -BuildRequires: python3-pybind11 BuildRequires: python3-pyyaml BuildRequires: python3-typing-extensions BuildRequires: sleef-devel @@ -139,14 +136,18 @@ BuildRequires: xnnpack-devel = 0.0^git20221221.51a9875 BuildRequires: python3-devel BuildRequires: python3dist(filelock) -BuildRequires: python3dist(fsspec) BuildRequires: python3dist(jinja2) BuildRequires: python3dist(networkx) BuildRequires: python3dist(setuptools) -BuildRequires: python3dist(sympy) BuildRequires: python3dist(typing-extensions) BuildRequires: python3dist(sphinx) +%if 0%{?fedora} +BuildRequires: python3-pybind11 +BuildRequires: python3dist(fsspec) +BuildRequires: python3dist(sympy) +%endif + %if %{with rocm} BuildRequires: hipblas-devel BuildRequires: hipblaslt-devel @@ -181,7 +182,9 @@ BuildRequires: google-benchmark-devel # Apache-2.0 Provides: bundled(flatbuffers) = 22.3.3 +# MIT Provides: bundled(miniz) = 2.1.0 +Provides: bundled(pybind11) = 2.11.1 %description @@ -229,10 +232,7 @@ Requires: python3-%{pypi_name}%{?_isa} = %{version}-%{release} # Remove bundled egg-info rm -rf %{pypi_name}.egg-info # Overwrite with a git checkout of the pyproject.toml -cp %{SOURCE1} . - -tar xf %{SOURCE2} -cp -r flatbuffers-23.3.3/* third_party/flatbuffers/ +cp %{SOURCE2} . %if %{with rocm} # hipify @@ -246,6 +246,8 @@ sed -i -e 's@rocm-core/rocm_version.h@rocm_version.h@' aten/src/ATen/hip/tunable %endif +tar xf %{SOURCE1} +cp -r flatbuffers-23.3.3/* third_party/flatbuffers/ %if %{with opencv} # Reduce requirements, *FOUND is not set @@ -268,25 +270,29 @@ mv third_party/miniz-2.1.0 . # setup.py depends on this script mv third_party/build_bundled.py . +# Need the just untarred flatbuffers/flatbuffers.h +mv third_party/flatbuffers . + +mv third_party/pybind11 . + %if %{with test} mv third_party/googletest . %endif -%if %{with gitcommit} -mv third_party/flatbuffers . -%endif - # Remove everything rm -rf third_party/* # Put stuff back mv build_bundled.py third_party mv miniz-2.1.0 third_party +mv flatbuffers third_party +mv pybind11 third_party + %if %{with test} mv googletest third_party %endif -%if %{with gitcommit} -mv flatbuffers third_party -%endif + + + # @@ -329,10 +335,19 @@ export USE_LITE_INTERPRETER_PROFILER=OFF export USE_MKLDNN=OFF export USE_NNPACK=OFF export USE_NUMPY=ON - export USE_PYTORCH_QNNPACK=OFF export USE_QNNPACK=OFF -export USE_SYSTEM_LIBS=ON +export USE_SYSTEM_CPUINFO=ON +export USE_SYSTEM_SLEEF=ON +export USE_SYSTEM_EIGEN_INSTALL=ON +export USE_SYSTEM_FP16=ON +export USE_SYSTEM_PTHREADPOOL=ON +export USE_SYSTEM_PSIMD=ON +export USE_SYSTEM_FXDIV=ON +export USE_SYSTEM_ONNX=ON +export USE_SYSTEM_XNNPACK=ON +export USE_SYSTEM_PYBIND11=OFF +export USE_SYSTEM_LIBS=OFF export USE_TENSORPIPE=OFF export USE_XNNPACK=ON commit 177874e18b4ddbd6b728ec6172a7afb71dfbd38f Author: Tom Rix <trix(a)redhat.com> Date: Sun Feb 18 11:41:24 2024 -0500 Update the next patchset Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/next/0001-no-third_party-fmt.patch b/next/0001-no-third_party-fmt.patch index f2a82f8..6e82af2 100644 --- a/next/0001-no-third_party-fmt.patch +++ b/next/0001-no-third_party-fmt.patch @@ -1,4 +1,4 @@ -From c46146dc31ed3dc0ebb6ca28c01330db8ba5d4f2 Mon Sep 17 00:00:00 2001 +From 2ce255b75760a0a513fb1706629b416f76a5c822 Mon Sep 17 00:00:00 2001 From: Tom Rix <trix(a)redhat.com> Date: Sat, 3 Feb 2024 08:16:04 -0500 Subject: [PATCH] no third_party fmt @@ -10,23 +10,23 @@ Subject: [PATCH] no third_party fmt 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/c10/CMakeLists.txt b/c10/CMakeLists.txt -index cb81556ff2..7529b2aec9 100644 +index 1f742f4c176..4fa08913bdd 100644 --- a/c10/CMakeLists.txt +++ b/c10/CMakeLists.txt @@ -87,7 +87,7 @@ endif() if(C10_USE_GLOG) - target_link_libraries(c10 PUBLIC glog::glog) + target_link_libraries(c10 PUBLIC glog::glog) endif() -target_link_libraries(c10 PRIVATE fmt::fmt-header-only) +target_link_libraries(c10 PRIVATE fmt) if(C10_USE_NUMA) - target_include_directories(c10 PRIVATE ${Numa_INCLUDE_DIR}) + message(STATUS "NUMA paths:") diff --git a/cmake/Dependencies.cmake b/cmake/Dependencies.cmake -index 8310f29e01..c99d0d762a 100644 +index 6f5a2d5feff..42fbf80f6e8 100644 --- a/cmake/Dependencies.cmake +++ b/cmake/Dependencies.cmake -@@ -1834,7 +1834,7 @@ endif() +@@ -1837,7 +1837,7 @@ endif() # set(TEMP_BUILD_SHARED_LIBS ${BUILD_SHARED_LIBS}) set(BUILD_SHARED_LIBS OFF CACHE BOOL "Build shared libs" FORCE) @@ -35,7 +35,7 @@ index 8310f29e01..c99d0d762a 100644 # Disable compiler feature checks for `fmt`. # -@@ -1843,9 +1843,9 @@ add_subdirectory(${PROJECT_SOURCE_DIR}/third_party/fmt) +@@ -1846,9 +1846,9 @@ add_subdirectory(${PROJECT_SOURCE_DIR}/third_party/fmt) # CMAKE_CXX_FLAGS in ways that break feature checks. Since we already know # `fmt` is compatible with a superset of the compilers that PyTorch is, it # shouldn't be too bad to just disable the checks. @@ -48,7 +48,7 @@ index 8310f29e01..c99d0d762a 100644 # ---[ Kineto diff --git a/torch/CMakeLists.txt b/torch/CMakeLists.txt -index 24903a207e..3a7751dc00 100644 +index 97a72eed55b..9e5014d1980 100644 --- a/torch/CMakeLists.txt +++ b/torch/CMakeLists.txt @@ -80,7 +80,7 @@ set(TORCH_PYTHON_LINK_LIBRARIES @@ -61,5 +61,5 @@ index 24903a207e..3a7751dc00 100644 if(USE_ASAN AND TARGET Sanitizer::address) -- -2.43.0 +2.43.2 commit 63a004872ddf0b3da36480d2e6a3d41d75cc7136 Author: Tom Rix <trix(a)redhat.com> Date: Sun Feb 18 11:27:33 2024 -0500 Update gitcommit to 2/18/24 Fix a rocm_version.h error Try bundling flatbuffers Signed-off-by: Tom Rix <trix(a)redhat.com> diff --git a/python-torch.spec b/python-torch.spec index 5f4e2e0..2ca5f0f 100644 --- a/python-torch.spec +++ b/python-torch.spec @@ -6,8 +6,8 @@ # So pre releases can be tried %bcond_with gitcommit %if %{with gitcommit} -# The top of tree ~2/6/24 -%global commit0 064610d8ac53f3f5916a1dc8b43acbeeb2469c11 +# The top of tree ~2/18/24 +%global commit0 372d078f361e726bb4ac0884ac334b04c58179ef %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) %global pypi_version 2.3.0 @@ -47,6 +47,7 @@ URL: https://pytorch.org/ %if %{with gitcommit} Source0: %{forgeurl}/archive/%{commit0}/pytorch-%{shortcommit0}.tar.gz Source1: pyproject.toml +Source2: https://github.com/google/flatbuffers/archive/refs/tags/v23.3.3.tar.gz %else Source0: %{forgeurl}/releases/download/v%{version}/pytorch-v%{version}.tar.gz %endif @@ -57,7 +58,6 @@ Patch0: 0001-no-third_party-foxi.patch Patch1: 0001-no-third_party-fmt.patch Patch2: 0001-no-third_party-FXdiv.patch Patch3: 0001-Stub-in-kineto-ActivityType.patch -Patch4: 0001-Regenerate-flatbuffer-header.patch Patch5: 0001-disable-submodule-search.patch %if %{with rocm} @@ -108,7 +108,9 @@ BuildRequires: cmake BuildRequires: cpuinfo-devel BuildRequires: eigen3-devel BuildRequires: fmt-devel +%if %{without gitcommit} BuildRequires: flatbuffers-devel +%endif BuildRequires: FP16-devel BuildRequires: fxdiv-devel BuildRequires: gcc-c++ @@ -177,8 +179,11 @@ BuildRequires: foxi-devel BuildRequires: google-benchmark-devel %endif +# Apache-2.0 +Provides: bundled(flatbuffers) = 22.3.3 Provides: bundled(miniz) = 2.1.0 + %description PyTorch is a Python package that provides two high-level features: @@ -226,14 +231,22 @@ rm -rf %{pypi_name}.egg-info # Overwrite with a git checkout of the pyproject.toml cp %{SOURCE1} . +tar xf %{SOURCE2} +cp -r flatbuffers-23.3.3/* third_party/flatbuffers/ + %if %{with rocm} # hipify ./tools/amd_build/build_amd.py +# Fedora installs to /usr/include, not /usr/include/rocm-core +sed -i -e 's@rocm-core/rocm_version.h@rocm_version.h@' aten/src/ATen/hip/tunable/TunableGemm.h %endif %else %autosetup -p1 -n pytorch-v%{version} +%endif + + %if %{with opencv} # Reduce requirements, *FOUND is not set sed -i -e 's/USE_OPENCV AND OpenCV_FOUND AND USE_FFMPEG AND FFMPEG_FOUND/USE_OPENCV AND USE_FFMPEG/' caffe2/video/CMakeLists.txt @@ -259,6 +272,10 @@ mv third_party/build_bundled.py . mv third_party/googletest . %endif +%if %{with gitcommit} +mv third_party/flatbuffers . +%endif + # Remove everything rm -rf third_party/* # Put stuff back @@ -267,6 +284,11 @@ mv miniz-2.1.0 third_party %if %{with test} mv googletest third_party %endif +%if %{with gitcommit} +mv flatbuffers third_party +%endif + + # # Fake out pocketfft, and system header will be used mkdir third_party/pocketfft @@ -280,8 +302,6 @@ rm caffe2/contrib/opencl/OpenCL/cl.hpp rm caffe2/mobile/contrib/libopencl-stub/include/CL/*.h rm caffe2/mobile/contrib/libopencl-stub/include/CL/*.hpp -%endif - %build # For debugging setup.py

1 0

Architecture specific change in rpms/openssl.git
by githook-noreply＠fedoraproject.org 11 Jun '24

11 Jun '24

The package rpms/openssl.git has added or updated architecture specific content in its spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s): https://src.fedoraproject.org/cgit/rpms/openssl.git/commit/?id=48ec32a3c7d7…. Change: +%ifarch riscv64 Thanks. Full change: ============ commit 892d8e1abb3cd458aae76570c04eb8ae4cf49873 Author: Dmitry Belyavskiy <dbelyavs(a)redhat.com> Date: Thu Jun 6 10:40:23 2024 +0200 Rebasing OpenSSL to 3.2.2 diff --git a/.gitignore b/.gitignore index 91919c1..31ec31d 100644 --- a/.gitignore +++ b/.gitignore @@ -61,3 +61,4 @@ openssl-1.0.0a-usa.tar.bz2 /openssl-3.1.1.tar.gz /openssl-3.1.4.tar.gz /openssl-3.2.1.tar.gz +/openssl-3.2.2.tar.gz diff --git a/0033-FIPS-embed-hmac.patch b/0033-FIPS-embed-hmac.patch index 4e11f02..0bf3b2d 100644 --- a/0033-FIPS-embed-hmac.patch +++ b/0033-FIPS-embed-hmac.patch @@ -383,81 +383,14 @@ index 18d9f3d204..71780d8caa 100644 --- a/test/recipes/90-test_sslapi.t +++ b/test/recipes/90-test_sslapi.t @@ -17,7 +17,7 @@ setup("test_sslapi"); - use lib srctop_dir('Configurations'); - use lib bldtop_dir('.'); + setup("test_sslapi"); + } -my $no_fips = disabled('fips') || ($ENV{NO_FIPS} // 0); +my $no_fips = 1; #disabled('fips') || ($ENV{NO_FIPS} // 0); my $fipsmodcfg_filename = "fipsmodule.cnf"; my $fipsmodcfg = bldtop_file("test", $fipsmodcfg_filename); -diff -up openssl-3.2.1/providers/fips/self_test.c.0033-patch-new openssl-3.2.1/providers/fips/self_test.c ---- openssl-3.2.1/providers/fips/self_test.c.0033-patch-new 2024-06-04 14:42:03.748284524 +0200 -+++ openssl-3.2.1/providers/fips/self_test.c 2024-06-04 14:47:19.589758324 +0200 -@@ -369,23 +369,12 @@ static int verify_integrity(OSSL_CORE_BI - EVP_MAC *mac = NULL; - EVP_MAC_CTX *ctx = NULL; - OSSL_PARAM params[2], *p = params; -- Dl_info info; -- void *extra_info = NULL; -- struct link_map *lm = NULL; -- unsigned long paddr; -- unsigned long off = 0; - - if (!integrity_self_test(ev, libctx)) - goto err; - - OSSL_SELF_TEST_onbegin(ev, event_type, OSSL_SELF_TEST_DESC_INTEGRITY_HMAC); - -- if (!dladdr1 ((const void *)fips_hmac_container, -- &info, &extra_info, RTLD_DL_LINKMAP)) -- goto err; -- lm = extra_info; -- paddr = (unsigned long)fips_hmac_container - lm->l_addr; -- - mac = EVP_MAC_fetch(libctx, MAC_NAME, NULL); - if (mac == NULL) - goto err; -@@ -399,40 +388,12 @@ static int verify_integrity(OSSL_CORE_BI - if (!EVP_MAC_init(ctx, fixed_key, sizeof(fixed_key), params)) - goto err; - -- while ((off + INTEGRITY_BUF_SIZE) <= paddr) { -- status = read_ex_cb(bio, buf, INTEGRITY_BUF_SIZE, &bytes_read); -- if (status != 1) -- break; -- if (!EVP_MAC_update(ctx, buf, bytes_read)) -- goto err; -- off += bytes_read; -- } -- -- if (off + INTEGRITY_BUF_SIZE > paddr) { -- int delta = paddr - off; -- status = read_ex_cb(bio, buf, delta, &bytes_read); -- if (status != 1) -- goto err; -- if (!EVP_MAC_update(ctx, buf, bytes_read)) -- goto err; -- off += bytes_read; -- -- status = read_ex_cb(bio, buf, HMAC_LEN, &bytes_read); -- memset(buf, 0, HMAC_LEN); -- if (status != 1) -- goto err; -- if (!EVP_MAC_update(ctx, buf, bytes_read)) -- goto err; -- off += bytes_read; -- } -- -- while (bytes_read > 0) { -- status = read_ex_cb(bio, buf, INTEGRITY_BUF_SIZE, &bytes_read); -+ while (1) { -+ status = read_ex_cb(bio, buf, sizeof(buf), &bytes_read); - if (status != 1) - break; - if (!EVP_MAC_update(ctx, buf, bytes_read)) - goto err; -- off += bytes_read; - } - - if (!EVP_MAC_final(ctx, out, &out_len, sizeof(out))) +-- +2.44.0 + diff --git a/0078-Add-FIPS-indicator-parameter-to-HKDF.patch b/0078-KDF-Add-FIPS-indicators.patch similarity index 87% rename from 0078-Add-FIPS-indicator-parameter-to-HKDF.patch rename to 0078-KDF-Add-FIPS-indicators.patch index 3867e06..17ff63e 100644 --- a/0078-Add-FIPS-indicator-parameter-to-HKDF.patch +++ b/0078-KDF-Add-FIPS-indicators.patch @@ -1,13 +1,45 @@ -From c503fa302490f76f191af6259e4199572280298a Mon Sep 17 00:00:00 2001 -From: rpm-build <rpm-build> -Date: Wed, 6 Mar 2024 19:17:16 +0100 -Subject: [PATCH 32/49] 0078-Add-FIPS-indicator-parameter-to-HKDF.patch +From 2290280617183863eb15425b8925765966723725 Mon Sep 17 00:00:00 2001 +From: Clemens Lang <cllang(a)redhat.com> +Date: Thu, 11 Aug 2022 09:27:12 +0200 +Subject: KDF: Add FIPS indicators -Patch-name: 0078-Add-FIPS-indicator-parameter-to-HKDF.patch -Patch-id: 78 -Patch-status: | - # # https://bugzilla.redhat.com/show_bug.cgi?id=2114772 -From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce +FIPS requires a number of restrictions on the parameters of the various +key derivation functions implemented in OpenSSL. The KDFs that use +digest algorithms usually should not allow SHAKE (due to FIPS 140-3 IG +C.C). Additionally, some application-specific KDFs have further +restrictions defined in SP 800-135r1. + +Generally, all KDFs shall use a key-derivation key length of at least +112 bits due to SP 800-131Ar2 section 8. Additionally any use of a KDF +to generate and output length of less than 112 bits will also set the +indicator to unapproved. + +Add explicit indicators to all KDFs usable in FIPS mode except for +PBKDF2 (which has its specific FIPS limits already implemented). The +indicator can be queried using EVP_KDF_CTX_get_params() after setting +the required parameters and keys for the KDF. + +Our FIPS provider implements SHA1, SHA2 (both -256 and -512, and the +truncated variants -224 and -384) and SHA3 (-256 and -512, and the +truncated versions -224 and -384), as well as SHAKE-128 and -256. + +The SHAKE functions are generally not allowed in KDFs. For the rest, the +support matrix is: + + KDF | SHA-1 | SHA-2 | SHA-2 truncated | SHA-3 | SHA-3 truncated +========================================================================== +KBKDF | x | x | x | x | x +HKDF | x | x | x | x | x +TLS1PRF | | SHA-{256,384,512} only | | +SSHKDF | x | x | x | | +SSKDF | x | x | x | x | x +X9.63KDF | | x | x | x | x +X9.42-ASN1 | x | x | x | x | x +TLS1.3PRF | | SHA-{256,384} only | | + +Signed-off-by: Clemens Lang <cllang(a)redhat.com> +Resolves: rhbz#2160733 rhbz#2164763 +Related: rhbz#2114772 rhbz#2141695 --- include/crypto/evp.h | 7 ++ include/openssl/kdf.h | 4 + @@ -21,10 +53,10 @@ From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce 9 files changed, 487 insertions(+), 22 deletions(-) diff --git a/include/crypto/evp.h b/include/crypto/evp.h -index 34cea2f9f4..1e4895959b 100644 +index e70d8e9e84..76fb990de4 100644 --- a/include/crypto/evp.h +++ b/include/crypto/evp.h -@@ -228,6 +228,13 @@ struct evp_mac_st { +@@ -219,6 +219,13 @@ struct evp_mac_st { OSSL_FUNC_mac_set_ctx_params_fn *set_ctx_params; }; @@ -54,10 +86,10 @@ index 0983230a48..86171635ea 100644 #define EVP_KDF_SSHKDF_TYPE_INITIAL_IV_SRV_TO_CLI 66 #define EVP_KDF_SSHKDF_TYPE_ENCRYPTION_KEY_CLI_TO_SRV 67 diff --git a/providers/implementations/kdfs/hkdf.c b/providers/implementations/kdfs/hkdf.c -index 78425fbb42..0ff3433074 100644 +index dfa7786bde..f01e40ff5a 100644 --- a/providers/implementations/kdfs/hkdf.c +++ b/providers/implementations/kdfs/hkdf.c -@@ -44,6 +44,7 @@ static OSSL_FUNC_kdf_settable_ctx_params_fn kdf_hkdf_settable_ctx_params; +@@ -42,6 +42,7 @@ static OSSL_FUNC_kdf_settable_ctx_params_fn kdf_hkdf_settable_ctx_params; static OSSL_FUNC_kdf_set_ctx_params_fn kdf_hkdf_set_ctx_params; static OSSL_FUNC_kdf_gettable_ctx_params_fn kdf_hkdf_gettable_ctx_params; static OSSL_FUNC_kdf_get_ctx_params_fn kdf_hkdf_get_ctx_params; @@ -65,7 +97,7 @@ index 78425fbb42..0ff3433074 100644 static OSSL_FUNC_kdf_derive_fn kdf_tls1_3_derive; static OSSL_FUNC_kdf_settable_ctx_params_fn kdf_tls1_3_settable_ctx_params; static OSSL_FUNC_kdf_set_ctx_params_fn kdf_tls1_3_set_ctx_params; -@@ -87,6 +88,10 @@ typedef struct { +@@ -85,6 +86,10 @@ typedef struct { size_t data_len; unsigned char *info; size_t info_len; @@ -76,7 +108,7 @@ index 78425fbb42..0ff3433074 100644 } KDF_HKDF; static void *kdf_hkdf_new(void *provctx) -@@ -200,6 +205,11 @@ static int kdf_hkdf_derive(void *vctx, unsigned char *key, size_t keylen, +@@ -170,6 +175,11 @@ static int kdf_hkdf_derive(void *vctx, unsigned char *key, size_t keylen, return 0; } @@ -88,7 +120,7 @@ index 78425fbb42..0ff3433074 100644 switch (ctx->mode) { case EVP_KDF_HKDF_MODE_EXTRACT_AND_EXPAND: default: -@@ -308,15 +318,78 @@ static int kdf_hkdf_get_ctx_params(void *vctx, OSSL_PARAM params[]) +@@ -318,22 +318,85 @@ static int kdf_hkdf_get_ctx_params(void { KDF_HKDF *ctx = (KDF_HKDF *)vctx; OSSL_PARAM *p; @@ -97,13 +129,20 @@ index 78425fbb42..0ff3433074 100644 if ((p = OSSL_PARAM_locate(params, OSSL_KDF_PARAM_SIZE)) != NULL) { size_t sz = kdf_hkdf_size(ctx); -- if (sz == 0) + any_valid = 1; -+ -+ if (sz == 0 || !OSSL_PARAM_set_size_t(p, sz)) -+ return 0; -+ } -+ + if (sz == 0) + return 0; + return OSSL_PARAM_set_size_t(p, sz); + } + if ((p = OSSL_PARAM_locate(params, OSSL_KDF_PARAM_INFO)) != NULL) { ++ any_valid = 1; + if (ctx->info == NULL || ctx->info_len == 0) { + p->return_size = 0; + return 1; + } + return OSSL_PARAM_set_octet_string(p, ctx->info, ctx->info_len); + } +- return -2; +#ifdef FIPS_MODULE + if ((p = OSSL_PARAM_locate(params, OSSL_KDF_PARAM_REDHAT_FIPS_INDICATOR)) + != NULL) { @@ -157,10 +196,8 @@ index 78425fbb42..0ff3433074 100644 + } + } + if (!OSSL_PARAM_set_int(p, fips_indicator)) - return 0; -- return OSSL_PARAM_set_size_t(p, sz); - } -- return -2; ++ return 0; ++ } +#endif /* defined(FIPS_MODULE) */ + + if (!any_valid) @@ -170,17 +207,17 @@ index 78425fbb42..0ff3433074 100644 } static const OSSL_PARAM *kdf_hkdf_gettable_ctx_params(ossl_unused void *ctx, -@@ -324,6 +397,9 @@ static const OSSL_PARAM *kdf_hkdf_gettable_ctx_params(ossl_unused void *ctx, - { +@@ -348,6 +421,9 @@ static const OSSL_PARAM *kdf_hkdf_gettable_ctx_params(ossl_unused void *ctx, static const OSSL_PARAM known_gettable_ctx_params[] = { OSSL_PARAM_size_t(OSSL_KDF_PARAM_SIZE, NULL), + OSSL_PARAM_octet_string(OSSL_KDF_PARAM_INFO, NULL, 0), +#ifdef FIPS_MODULE + OSSL_PARAM_int(OSSL_KDF_PARAM_REDHAT_FIPS_INDICATOR, NULL), +#endif /* defined(FIPS_MODULE) */ OSSL_PARAM_END }; return known_gettable_ctx_params; -@@ -654,6 +730,17 @@ static int prov_tls13_hkdf_generate_secret(OSSL_LIB_CTX *libctx, +@@ -677,6 +753,17 @@ static int prov_tls13_hkdf_generate_secret(OSSL_LIB_CTX *libctx, return ret; } @@ -198,7 +235,7 @@ index 78425fbb42..0ff3433074 100644 static int kdf_tls1_3_derive(void *vctx, unsigned char *key, size_t keylen, const OSSL_PARAM params[]) { -@@ -669,6 +756,11 @@ static int kdf_tls1_3_derive(void *vctx, unsigned char *key, size_t keylen, +@@ -692,6 +779,11 @@ static int kdf_tls1_3_derive(void *vctx, unsigned char *key, size_t keylen, return 0; } @@ -210,7 +247,7 @@ index 78425fbb42..0ff3433074 100644 switch (ctx->mode) { default: return 0; -@@ -746,7 +838,7 @@ static const OSSL_PARAM *kdf_tls1_3_settable_ctx_params(ossl_unused void *ctx, +@@ -769,7 +861,7 @@ static const OSSL_PARAM *kdf_tls1_3_settable_ctx_params(ossl_unused void *ctx, } const OSSL_DISPATCH ossl_kdf_tls1_3_kdf_functions[] = { @@ -220,10 +257,10 @@ index 78425fbb42..0ff3433074 100644 { OSSL_FUNC_KDF_FREECTX, (void(*)(void))kdf_hkdf_free }, { OSSL_FUNC_KDF_RESET, (void(*)(void))kdf_hkdf_reset }, diff --git a/providers/implementations/kdfs/kbkdf.c b/providers/implementations/kdfs/kbkdf.c -index e6855d5732..ebd9d648a6 100644 +index a542f84dfa..6b6dfb94ac 100644 --- a/providers/implementations/kdfs/kbkdf.c +++ b/providers/implementations/kdfs/kbkdf.c -@@ -60,6 +60,9 @@ typedef struct { +@@ -59,6 +59,9 @@ typedef struct { kbkdf_mode mode; EVP_MAC_CTX *ctx_init; @@ -243,7 +280,7 @@ index e6855d5732..ebd9d648a6 100644 } KBKDF; /* Definitions needed for typechecking. */ -@@ -142,6 +148,7 @@ static void kbkdf_reset(void *vctx) +@@ -138,6 +144,7 @@ static void kbkdf_reset(void *vctx) void *provctx = ctx->provctx; EVP_MAC_CTX_free(ctx->ctx_init); @@ -251,7 +288,7 @@ index e6855d5732..ebd9d648a6 100644 OPENSSL_clear_free(ctx->context, ctx->context_len); OPENSSL_clear_free(ctx->label, ctx->label_len); OPENSSL_clear_free(ctx->ki, ctx->ki_len); -@@ -307,6 +314,11 @@ static int kbkdf_derive(void *vctx, unsigned char *key, size_t keylen, +@@ -240,6 +247,11 @@ static int kbkdf_derive(void *vctx, unsigned char *key, size_t keylen, goto done; } @@ -263,7 +300,7 @@ index e6855d5732..ebd9d648a6 100644 h = EVP_MAC_CTX_get_mac_size(ctx->ctx_init); if (h == 0) goto done; -@@ -369,6 +381,9 @@ static int kbkdf_set_ctx_params(void *vctx, const OSSL_PARAM params[]) +@@ -297,6 +309,9 @@ static int kbkdf_set_ctx_params(void *vctx, const OSSL_PARAM params[]) } } @@ -273,7 +310,7 @@ index e6855d5732..ebd9d648a6 100644 p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_MODE); if (p != NULL && OPENSSL_strncasecmp("counter", p->data, p->data_size) == 0) { -@@ -450,20 +465,77 @@ static const OSSL_PARAM *kbkdf_settable_ctx_params(ossl_unused void *ctx, +@@ -363,20 +378,77 @@ static const OSSL_PARAM *kbkdf_settable_ctx_params(ossl_unused void *ctx, static int kbkdf_get_ctx_params(void *vctx, OSSL_PARAM params[]) { OSSL_PARAM *p; @@ -357,10 +394,10 @@ index e6855d5732..ebd9d648a6 100644 } diff --git a/providers/implementations/kdfs/sshkdf.c b/providers/implementations/kdfs/sshkdf.c -index 90986bc762..27cd7f8bdf 100644 +index c592ba72f1..4a52b38266 100644 --- a/providers/implementations/kdfs/sshkdf.c +++ b/providers/implementations/kdfs/sshkdf.c -@@ -49,6 +49,9 @@ typedef struct { +@@ -48,6 +48,9 @@ typedef struct { char type; /* X */ unsigned char *session_id; size_t session_id_len; @@ -370,7 +407,7 @@ index 90986bc762..27cd7f8bdf 100644 } KDF_SSHKDF; static void *kdf_sshkdf_new(void *provctx) -@@ -149,6 +152,12 @@ static int kdf_sshkdf_derive(void *vctx, unsigned char *key, size_t keylen, +@@ -126,6 +129,12 @@ static int kdf_sshkdf_derive(void *vctx, unsigned char *key, size_t keylen, ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_TYPE); return 0; } @@ -383,7 +420,7 @@ index 90986bc762..27cd7f8bdf 100644 return SSHKDF(md, ctx->key, ctx->key_len, ctx->xcghash, ctx->xcghash_len, ctx->session_id, ctx->session_id_len, -@@ -217,10 +226,67 @@ static const OSSL_PARAM *kdf_sshkdf_settable_ctx_params(ossl_unused void *ctx, +@@ -194,10 +203,67 @@ static const OSSL_PARAM *kdf_sshkdf_settable_ctx_params(ossl_unused void *ctx, static int kdf_sshkdf_get_ctx_params(void *vctx, OSSL_PARAM params[]) { OSSL_PARAM *p; @@ -454,7 +491,7 @@ index 90986bc762..27cd7f8bdf 100644 } static const OSSL_PARAM *kdf_sshkdf_gettable_ctx_params(ossl_unused void *ctx, -@@ -228,6 +294,9 @@ static const OSSL_PARAM *kdf_sshkdf_gettable_ctx_params(ossl_unused void *ctx, +@@ -205,6 +271,9 @@ static const OSSL_PARAM *kdf_sshkdf_gettable_ctx_params(ossl_unused void *ctx, { static const OSSL_PARAM known_gettable_ctx_params[] = { OSSL_PARAM_size_t(OSSL_KDF_PARAM_SIZE, NULL), @@ -465,7 +502,7 @@ index 90986bc762..27cd7f8bdf 100644 }; return known_gettable_ctx_params; diff --git a/providers/implementations/kdfs/sskdf.c b/providers/implementations/kdfs/sskdf.c -index db750a4f23..175fd30327 100644 +index eb54972e1c..23865cd70f 100644 --- a/providers/implementations/kdfs/sskdf.c +++ b/providers/implementations/kdfs/sskdf.c @@ -64,6 +64,10 @@ typedef struct { @@ -479,7 +516,7 @@ index db750a4f23..175fd30327 100644 } KDF_SSKDF; #define SSKDF_MAX_INLEN (1<<30) -@@ -74,6 +78,7 @@ typedef struct { +@@ -73,6 +77,7 @@ typedef struct { static const unsigned char kmac_custom_str[] = { 0x4B, 0x44, 0x46 }; static OSSL_FUNC_kdf_newctx_fn sskdf_new; @@ -487,7 +524,7 @@ index db750a4f23..175fd30327 100644 static OSSL_FUNC_kdf_dupctx_fn sskdf_dup; static OSSL_FUNC_kdf_freectx_fn sskdf_free; static OSSL_FUNC_kdf_reset_fn sskdf_reset; -@@ -297,6 +302,16 @@ static void *sskdf_new(void *provctx) +@@ -296,6 +301,16 @@ static void *sskdf_new(void *provctx) return ctx; } @@ -504,7 +541,7 @@ index db750a4f23..175fd30327 100644 static void sskdf_reset(void *vctx) { KDF_SSKDF *ctx = (KDF_SSKDF *)vctx; -@@ -382,6 +397,11 @@ static int sskdf_derive(void *vctx, unsigned char *key, size_t keylen, +@@ -361,6 +376,11 @@ static int sskdf_derive(void *vctx, unsigned char *key, size_t keylen, } md = ossl_prov_digest_md(&ctx->digest); @@ -516,7 +553,7 @@ index db750a4f23..175fd30327 100644 if (ctx->macctx != NULL) { /* H(x) = KMAC or H(x) = HMAC */ int ret; -@@ -461,6 +481,11 @@ static int x963kdf_derive(void *vctx, unsigned char *key, size_t keylen, +@@ -442,6 +462,11 @@ static int x963kdf_derive(void *vctx, unsigned char *key, size_t keylen, return 0; } @@ -528,7 +565,7 @@ index db750a4f23..175fd30327 100644 return SSKDF_hash_kdm(md, ctx->secret, ctx->secret_len, ctx->info, ctx->info_len, 1, key, keylen); } -@@ -537,10 +562,74 @@ static int sskdf_get_ctx_params(void *vctx, OSSL_PARAM params[]) +@@ -514,10 +539,74 @@ static int sskdf_get_ctx_params(void *vctx, OSSL_PARAM params[]) { KDF_SSKDF *ctx = (KDF_SSKDF *)vctx; OSSL_PARAM *p; @@ -606,7 +643,7 @@ index db750a4f23..175fd30327 100644 } static const OSSL_PARAM *sskdf_gettable_ctx_params(ossl_unused void *ctx, -@@ -548,6 +637,9 @@ static const OSSL_PARAM *sskdf_gettable_ctx_params(ossl_unused void *ctx, +@@ -525,6 +614,9 @@ static const OSSL_PARAM *sskdf_gettable_ctx_params(ossl_unused void *ctx, { static const OSSL_PARAM known_gettable_ctx_params[] = { OSSL_PARAM_size_t(OSSL_KDF_PARAM_SIZE, NULL), @@ -616,7 +653,7 @@ index db750a4f23..175fd30327 100644 OSSL_PARAM_END }; return known_gettable_ctx_params; -@@ -569,7 +661,7 @@ const OSSL_DISPATCH ossl_kdf_sskdf_functions[] = { +@@ -545,7 +637,7 @@ const OSSL_DISPATCH ossl_kdf_sskdf_functions[] = { }; const OSSL_DISPATCH ossl_kdf_x963_kdf_functions[] = { @@ -626,10 +663,10 @@ index db750a4f23..175fd30327 100644 { OSSL_FUNC_KDF_FREECTX, (void(*)(void))sskdf_free }, { OSSL_FUNC_KDF_RESET, (void(*)(void))sskdf_reset }, diff --git a/providers/implementations/kdfs/tls1_prf.c b/providers/implementations/kdfs/tls1_prf.c -index ff305579c3..e6f41020a4 100644 +index a4d64b9352..f6782a6ca2 100644 --- a/providers/implementations/kdfs/tls1_prf.c +++ b/providers/implementations/kdfs/tls1_prf.c -@@ -104,6 +104,13 @@ typedef struct { +@@ -93,6 +93,13 @@ typedef struct { /* Buffer of concatenated seed data */ unsigned char seed[TLS1_PRF_MAXBUF]; size_t seedlen; @@ -643,7 +680,7 @@ index ff305579c3..e6f41020a4 100644 } TLS1_PRF; static void *kdf_tls1_prf_new(void *provctx) -@@ -137,6 +144,7 @@ static void kdf_tls1_prf_reset(void *vctx) +@@ -129,6 +136,7 @@ static void kdf_tls1_prf_reset(void *vctx) EVP_MAC_CTX_free(ctx->P_sha1); OPENSSL_clear_free(ctx->sec, ctx->seclen); OPENSSL_cleanse(ctx->seed, ctx->seedlen); @@ -651,7 +688,7 @@ index ff305579c3..e6f41020a4 100644 memset(ctx, 0, sizeof(*ctx)); ctx->provctx = provctx; } -@@ -191,6 +199,10 @@ static int kdf_tls1_prf_derive(void *vctx, unsigned char *key, size_t keylen, +@@ -157,6 +165,10 @@ static int kdf_tls1_prf_derive(void *vctx, unsigned char *key, size_t keylen, ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH); return 0; } @@ -662,7 +699,7 @@ index ff305579c3..e6f41020a4 100644 /* * The seed buffer is prepended with a label. -@@ -240,6 +252,9 @@ static int kdf_tls1_prf_set_ctx_params(void *vctx, const OSSL_PARAM params[]) +@@ -191,6 +203,9 @@ static int kdf_tls1_prf_set_ctx_params(void *vctx, const OSSL_PARAM params[]) } } @@ -672,7 +709,7 @@ index ff305579c3..e6f41020a4 100644 if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_SECRET)) != NULL) { OPENSSL_clear_free(ctx->sec, ctx->seclen); ctx->sec = NULL; -@@ -281,10 +296,60 @@ static const OSSL_PARAM *kdf_tls1_prf_settable_ctx_params( +@@ -232,10 +247,60 @@ static const OSSL_PARAM *kdf_tls1_prf_settable_ctx_params( static int kdf_tls1_prf_get_ctx_params(void *vctx, OSSL_PARAM params[]) { OSSL_PARAM *p; @@ -736,7 +773,7 @@ index ff305579c3..e6f41020a4 100644 } static const OSSL_PARAM *kdf_tls1_prf_gettable_ctx_params( -@@ -292,6 +357,9 @@ static const OSSL_PARAM *kdf_tls1_prf_gettable_ctx_params( +@@ -243,6 +308,9 @@ static const OSSL_PARAM *kdf_tls1_prf_gettable_ctx_params( { static const OSSL_PARAM known_gettable_ctx_params[] = { OSSL_PARAM_size_t(OSSL_KDF_PARAM_SIZE, NULL), @@ -747,7 +784,7 @@ index ff305579c3..e6f41020a4 100644 }; return known_gettable_ctx_params; diff --git a/providers/implementations/kdfs/x942kdf.c b/providers/implementations/kdfs/x942kdf.c -index 19b54493ef..77a6210184 100644 +index b1bc6f7e1b..8173fc2cc7 100644 --- a/providers/implementations/kdfs/x942kdf.c +++ b/providers/implementations/kdfs/x942kdf.c @@ -13,11 +13,13 @@ @@ -764,7 +801,7 @@ index 19b54493ef..77a6210184 100644 #include "prov/provider_ctx.h" #include "prov/providercommon.h" #include "prov/implementations.h" -@@ -49,6 +51,9 @@ typedef struct { +@@ -47,6 +50,9 @@ typedef struct { const unsigned char *cek_oid; size_t cek_oid_len; int use_keybits; @@ -774,7 +811,7 @@ index 19b54493ef..77a6210184 100644 } KDF_X942; /* -@@ -495,6 +500,10 @@ static int x942kdf_derive(void *vctx, unsigned char *key, size_t keylen, +@@ -460,6 +466,10 @@ static int x942kdf_derive(void *vctx, unsigned char *key, size_t keylen, ERR_raise(ERR_LIB_PROV, PROV_R_BAD_ENCODING); return 0; } @@ -785,7 +822,7 @@ index 19b54493ef..77a6210184 100644 ret = x942kdf_hash_kdm(md, ctx->secret, ctx->secret_len, der, der_len, ctr, key, keylen); OPENSSL_free(der); -@@ -598,10 +607,58 @@ static int x942kdf_get_ctx_params(void *vctx, OSSL_PARAM params[]) +@@ -563,10 +573,58 @@ static int x942kdf_get_ctx_params(void *vctx, OSSL_PARAM params[]) { KDF_X942 *ctx = (KDF_X942 *)vctx; OSSL_PARAM *p; @@ -847,7 +884,7 @@ index 19b54493ef..77a6210184 100644 } static const OSSL_PARAM *x942kdf_gettable_ctx_params(ossl_unused void *ctx, -@@ -609,6 +666,9 @@ static const OSSL_PARAM *x942kdf_gettable_ctx_params(ossl_unused void *ctx, +@@ -574,6 +632,9 @@ static const OSSL_PARAM *x942kdf_gettable_ctx_params(ossl_unused void *ctx, { static const OSSL_PARAM known_gettable_ctx_params[] = { OSSL_PARAM_size_t(OSSL_KDF_PARAM_SIZE, NULL), @@ -870,5 +907,5 @@ index 70f7c50fe4..6618122417 100644 'KDF_PARAM_HMACDRBG_NONCE' => "nonce", 'KDF_PARAM_THREADS' => "threads", # uint32_t -- -2.44.0 +2.39.2 diff --git a/0117-ignore-unknown-sigalgorithms-groups.patch b/0117-ignore-unknown-sigalgorithms-groups.patch index 3c52277..dd40e11 100644 --- a/0117-ignore-unknown-sigalgorithms-groups.patch +++ b/0117-ignore-unknown-sigalgorithms-groups.patch @@ -111,7 +111,7 @@ index 056aae3863..fe680449c5 100644 + } if (garg->gidcnt == garg->gidmax) { uint16_t *tmp = - OPENSSL_realloc(garg->gid_arr, garg->gidmax + GROUPLIST_INCREMENT); + OPENSSL_realloc(garg->gid_arr, @@ -1070,13 +1076,14 @@ static int gid_cb(const char *elem, int len, void *arg) gid = tls1_group_name2id(garg->ctx, etmp); @@ -161,18 +161,18 @@ index 056aae3863..fe680449c5 100644 return 0; if (len > (int)(sizeof(etmp) - 1)) @@ -2931,8 +2950,10 @@ static int sig_cb(const char *elem, int len, void *arg) - break; + break; + } } +- if (i == OSSL_NELEM(sigalg_lookup_tbl)) +- return 0; ++ if (i == OSSL_NELEM(sigalg_lookup_tbl)) { ++ /* Ignore unknown algorithms if ignore_unknown */ ++ return ignore_unknown; ++ } } -- if (i == OSSL_NELEM(sigalg_lookup_tbl)) -- return 0; -+ if (i == OSSL_NELEM(sigalg_lookup_tbl)) { -+ /* Ignore unknown algorithms if ignore_unknown */ -+ return ignore_unknown; -+ } } else { *p = 0; - p++; @@ -2940,8 +2961,10 @@ static int sig_cb(const char *elem, int len, void *arg) return 0; get_sigorhash(&sig_alg, &hash_alg, etmp); @@ -209,7 +209,7 @@ index 056aae3863..fe680449c5 100644 } return 1; @@ -2973,6 +2998,11 @@ int tls1_set_sigalgs_list(CERT *c, const char *str, int client) - sig.sigalgcnt = 0; + } if (!CONF_parse_list(str, ':', 1, sig_cb, &sig)) return 0; + if (sig.sigalgcnt == 0) { diff --git a/0118-no-crl-memleak.patch b/0118-no-crl-memleak.patch deleted file mode 100644 index ee7e745..0000000 --- a/0118-no-crl-memleak.patch +++ /dev/null @@ -1,80 +0,0 @@ -From 105217c7d58c726f4e646177e0aaefb6115aad3e Mon Sep 17 00:00:00 2001 -From: Dmitry Belyavskiy <beldmit(a)gmail.com> -Date: Tue, 27 Feb 2024 15:22:58 +0100 -Subject: [PATCH 48/49] 0118-no-crl-memleak.patch - -Patch-name: 0118-no-crl-memleak.patch -Patch-id: 118 -Patch-status: | - # https://github.com/openssl/openssl/issues/23770 ---- - crypto/x509/by_file.c | 2 ++ - test/recipes/60-test_x509_load_cert_file.t | 3 ++- - test/x509_load_cert_file_test.c | 8 +++++++- - 3 files changed, 11 insertions(+), 2 deletions(-) - -diff --git a/crypto/x509/by_file.c b/crypto/x509/by_file.c -index 5073c137a2..85923804ac 100644 ---- a/crypto/x509/by_file.c -+++ b/crypto/x509/by_file.c -@@ -198,6 +198,8 @@ int X509_load_crl_file(X509_LOOKUP *ctx, const char *file, int type) - goto err; - } - count++; -+ X509_CRL_free(x); -+ x = NULL; - } - } else if (type == X509_FILETYPE_ASN1) { - x = d2i_X509_CRL_bio(in, NULL); -diff --git a/test/recipes/60-test_x509_load_cert_file.t b/test/recipes/60-test_x509_load_cert_file.t -index 75aeac362c..e329d7675c 100644 ---- a/test/recipes/60-test_x509_load_cert_file.t -+++ b/test/recipes/60-test_x509_load_cert_file.t -@@ -12,4 +12,5 @@ setup("test_load_cert_file"); - - plan tests => 1; - --ok(run(test(["x509_load_cert_file_test", srctop_file("test", "certs", "leaf-chain.pem")]))); -+ok(run(test(["x509_load_cert_file_test", srctop_file("test", "certs", "leaf-chain.pem"), -+ srctop_file("test", "certs", "cyrillic_crl.pem")]))); -diff --git a/test/x509_load_cert_file_test.c b/test/x509_load_cert_file_test.c -index 4a736071ae..c07d329915 100644 ---- a/test/x509_load_cert_file_test.c -+++ b/test/x509_load_cert_file_test.c -@@ -12,6 +12,7 @@ - #include "testutil.h" - - static const char *chain; -+static const char *crl; - - static int test_load_cert_file(void) - { -@@ -27,12 +28,15 @@ static int test_load_cert_file(void) - && TEST_int_eq(sk_X509_num(certs), 4)) - ret = 1; - -+ if (crl != NULL && !TEST_true(X509_load_crl_file(lookup, crl, X509_FILETYPE_PEM))) -+ ret = 0; -+ - OSSL_STACK_OF_X509_free(certs); - X509_STORE_free(store); - return ret; - } - --OPT_TEST_DECLARE_USAGE("cert.pem...\n") -+OPT_TEST_DECLARE_USAGE("cert.pem [crl.pem]\n") - - int setup_tests(void) - { -@@ -45,6 +49,8 @@ int setup_tests(void) - if (chain == NULL) - return 0; - -+ crl = test_get_argument(1); -+ - ADD_TEST(test_load_cert_file); - return 1; - } --- -2.44.0 - diff --git a/0119-provider-sigalgs-in-signaturealgorithms-conf.patch b/0119-provider-sigalgs-in-signaturealgorithms-conf.patch deleted file mode 100644 index c363223..0000000 --- a/0119-provider-sigalgs-in-signaturealgorithms-conf.patch +++ /dev/null @@ -1,170 +0,0 @@ -From f5b48604779362c91a22080b6905413fbba28b74 Mon Sep 17 00:00:00 2001 -From: Dmitry Belyavskiy <dbelyavs(a)redhat.com> -Date: Fri, 8 Mar 2024 11:18:12 +0100 -Subject: [PATCH 49/49] 0119-provider-sigalgs-in-signaturealgorithms-conf.patch - -Patch-name: 0119-provider-sigalgs-in-signaturealgorithms-conf.patch -Patch-id: 119 -Patch-status: | - # https://github.com/openssl/openssl/issues/22779 ---- - ssl/s3_lib.c | 8 ++++---- - ssl/ssl_lib.c | 2 +- - ssl/ssl_local.h | 2 +- - ssl/t1_lib.c | 45 ++++++++++++++++++++++++++++++++++----------- - 4 files changed, 40 insertions(+), 17 deletions(-) - -diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c -index e8ec98c221..48a1aa0e61 100644 ---- a/ssl/s3_lib.c -+++ b/ssl/s3_lib.c -@@ -3685,13 +3685,13 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg) - return tls1_set_sigalgs(sc->cert, parg, larg, 0); - - case SSL_CTRL_SET_SIGALGS_LIST: -- return tls1_set_sigalgs_list(sc->cert, parg, 0); -+ return tls1_set_sigalgs_list(s->ctx, sc->cert, parg, 0); - - case SSL_CTRL_SET_CLIENT_SIGALGS: - return tls1_set_sigalgs(sc->cert, parg, larg, 1); - - case SSL_CTRL_SET_CLIENT_SIGALGS_LIST: -- return tls1_set_sigalgs_list(sc->cert, parg, 1); -+ return tls1_set_sigalgs_list(s->ctx, sc->cert, parg, 1); - - case SSL_CTRL_GET_CLIENT_CERT_TYPES: - { -@@ -3968,13 +3968,13 @@ long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg) - return tls1_set_sigalgs(ctx->cert, parg, larg, 0); - - case SSL_CTRL_SET_SIGALGS_LIST: -- return tls1_set_sigalgs_list(ctx->cert, parg, 0); -+ return tls1_set_sigalgs_list(ctx, ctx->cert, parg, 0); - - case SSL_CTRL_SET_CLIENT_SIGALGS: - return tls1_set_sigalgs(ctx->cert, parg, larg, 1); - - case SSL_CTRL_SET_CLIENT_SIGALGS_LIST: -- return tls1_set_sigalgs_list(ctx->cert, parg, 1); -+ return tls1_set_sigalgs_list(ctx, ctx->cert, parg, 1); - - case SSL_CTRL_SET_CLIENT_CERT_TYPES: - return ssl3_set_req_cert_type(ctx->cert, parg, larg); -diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c -index 1329841aaf..4d95ab71cd 100644 ---- a/ssl/ssl_lib.c -+++ b/ssl/ssl_lib.c -@@ -3078,7 +3078,7 @@ long SSL_CTX_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg) - return tls1_set_groups_list(ctx, NULL, NULL, parg); - case SSL_CTRL_SET_SIGALGS_LIST: - case SSL_CTRL_SET_CLIENT_SIGALGS_LIST: -- return tls1_set_sigalgs_list(NULL, parg, 0); -+ return tls1_set_sigalgs_list(ctx, NULL, parg, 0); - default: - return 0; - } -diff --git a/ssl/ssl_local.h b/ssl/ssl_local.h -index 0d3acfbe66..a73b2c4770 100644 ---- a/ssl/ssl_local.h -+++ b/ssl/ssl_local.h -@@ -2796,7 +2796,7 @@ __owur int tls_use_ticket(SSL_CONNECTION *s); - - void ssl_set_sig_mask(uint32_t *pmask_a, SSL_CONNECTION *s, int op); - --__owur int tls1_set_sigalgs_list(CERT *c, const char *str, int client); -+__owur int tls1_set_sigalgs_list(SSL_CTX *ctx, CERT *c, const char *str, int client); - __owur int tls1_set_raw_sigalgs(CERT *c, const uint16_t *psigs, size_t salglen, - int client); - __owur int tls1_set_sigalgs(CERT *c, const int *salg, size_t salglen, -diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c -index fe680449c5..87f2ae7000 100644 ---- a/ssl/t1_lib.c -+++ b/ssl/t1_lib.c -@@ -716,6 +716,7 @@ int ssl_load_sigalgs(SSL_CTX *ctx) - - /* now populate ctx->ssl_cert_info */ - if (ctx->sigalg_list_len > 0) { -+ OPENSSL_free(ctx->ssl_cert_info); - ctx->ssl_cert_info = OPENSSL_zalloc(sizeof(lu) * ctx->sigalg_list_len); - if (ctx->ssl_cert_info == NULL) - return 0; -@@ -2889,6 +2890,7 @@ typedef struct { - size_t sigalgcnt; - /* TLSEXT_SIGALG_XXX values */ - uint16_t sigalgs[TLS_MAX_SIGALGCNT]; -+ SSL_CTX *ctx; - } sig_cb_st; - - static void get_sigorhash(int *psig, int *phash, const char *str) -@@ -2913,7 +2915,8 @@ static void get_sigorhash(int *psig, int *phash, const char *str) - static int sig_cb(const char *elem, int len, void *arg) - { - sig_cb_st *sarg = arg; -- size_t i; -+ size_t i = 0; -+ int load_success = 0; - const SIGALG_LOOKUP *s; - char etmp[TLS_MAX_SIGSTRING_LEN], *p; - int sig_alg = NID_undef, hash_alg = NID_undef; -@@ -2943,17 +2946,36 @@ static int sig_cb(const char *elem, int len, void *arg) - * in the table. - */ - if (p == NULL) { -- for (i = 0, s = sigalg_lookup_tbl; i < OSSL_NELEM(sigalg_lookup_tbl); -- i++, s++) { -- if (s->name != NULL && strcmp(etmp, s->name) == 0) { -- sarg->sigalgs[sarg->sigalgcnt++] = s->sigalg; -- break; -- } -+ /* Load provider sigalgs */ -+ if (sarg->ctx) { -+ load_success = ssl_load_sigalgs(sarg->ctx); - } -- if (i == OSSL_NELEM(sigalg_lookup_tbl)) { -- /* Ignore unknown algorithms if ignore_unknown */ -- return ignore_unknown; -+ if (load_success) { -+ /* Check if a provider supports the sigalg */ -+ for (i = 0; i < sarg->ctx->sigalg_list_len; i++) { -+ if (sarg->ctx->sigalg_list[i].sigalg_name != NULL -+ && strcmp(etmp, -+ sarg->ctx->sigalg_list[i].sigalg_name) == 0) { -+ sarg->sigalgs[sarg->sigalgcnt++] = -+ sarg->ctx->sigalg_list[i].code_point; -+ break; -+ } -+ } - } -+ /* Check the built-in sigalgs */ -+ if (!sarg->ctx || !load_success || i == sarg->ctx->sigalg_list_len) { -+ for (i = 0, s = sigalg_lookup_tbl; -+ i < OSSL_NELEM(sigalg_lookup_tbl); i++, s++) { -+ if (s->name != NULL && strcmp(etmp, s->name) == 0) { -+ sarg->sigalgs[sarg->sigalgcnt++] = s->sigalg; -+ break; -+ } -+ } -+ if (i == OSSL_NELEM(sigalg_lookup_tbl)) { -+ /* Ignore unknown algorithms if ignore_unknown */ -+ return ignore_unknown; -+ } -+ } - } else { - *p = 0; - p++; -@@ -2992,10 +3014,11 @@ static int sig_cb(const char *elem, int len, void *arg) - * Set supported signature algorithms based on a colon separated list of the - * form sig+hash e.g. RSA+SHA512:DSA+SHA512 - */ --int tls1_set_sigalgs_list(CERT *c, const char *str, int client) -+int tls1_set_sigalgs_list(SSL_CTX *ctx, CERT *c, const char *str, int client) - { - sig_cb_st sig; - sig.sigalgcnt = 0; -+ sig.ctx = ctx; - if (!CONF_parse_list(str, ':', 1, sig_cb, &sig)) - return 0; - if (sig.sigalgcnt == 0) { --- -2.44.0 - diff --git a/openssl.spec b/openssl.spec index fada88f..1055099 100644 --- a/openssl.spec +++ b/openssl.spec @@ -28,8 +28,8 @@ print(string.sub(hash, 0, 16)) Summary: Utilities from the general purpose cryptography library with TLS implementation Name: openssl -Version: 3.2.1 -Release: 10%{?dist} +Version: 3.2.2 +Release: 1%{?dist} Epoch: 1 Source: openssl-%{version}.tar.gz Source2: Makefile.certificate @@ -115,7 +115,7 @@ Patch76: 0076-FIPS-140-3-DRBG.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2102542 Patch77: 0077-FIPS-140-3-zeroization.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2114772 -Patch78: 0078-Add-FIPS-indicator-parameter-to-HKDF.patch +Patch78: 0078-KDF-Add-FIPS-indicators.patch # We believe that some changes present in CentOS are not necessary # because ustream has a check for FIPS version Patch80: 0080-rand-Forbid-truncated-hashes-SHA-3-in-FIPS-prov.patch @@ -149,10 +149,6 @@ Patch115: 0115-skip-quic-pairwise.patch Patch116: 0116-version-aliasing.patch # https://github.com/openssl/openssl/issues/23050 Patch117: 0117-ignore-unknown-sigalgorithms-groups.patch -# https://github.com/openssl/openssl/issues/23770 -Patch118: 0118-no-crl-memleak.patch -# https://github.com/openssl/openssl/issues/22779 -Patch119: 0119-provider-sigalgs-in-signaturealgorithms-conf.patch # https://fedoraproject.org/wiki/Changes/OpenSSLDistrustSHA1SigVer Patch120: 0120-Allow-disabling-of-SHA1-signatures.patch # From CentOS 9 @@ -509,6 +505,9 @@ ln -s /etc/crypto-policies/back-ends/openssl_fips.config $RPM_BUILD_ROOT%{_sysco %ldconfig_scriptlets libs %changelog +* Thu Jun 06 2024 Dmitry Belyavskiy <dbelyavs(a)redhat.com> - 1:3.2.2-1 +- Rebase to 3.2.2 + * Wed Jun 05 2024 Yaakov Selkowitz <yselkowi(a)redhat.com> - 1:3.2.1-10 - Do not require openssl-fips-provider on ELN diff --git a/sources b/sources index 21d66d1..6d3dc96 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (openssl-3.2.1.tar.gz) = 29ea75964f78ef5bbe5783ed60d32917408ae4cb7d4aecdbbf2280bfdbc260c7cbabbc03bd179fc994fbee85cebc7213eeb5bfcde5c22db5e83edf2cebe7113f +SHA512 (openssl-3.2.2.tar.gz) = ebc945065f62a8a2ea4e2f136a2afaea4d38a03bb07a148f7fb73c34a64475a4069de122ebee11a66e421dbd58756ad7ab2d3f905dc90acee72d62757d8c0a2d commit 0a2e8bc0fc7083b610023e9e544d687bcd19400f Author: Yaakov Selkowitz <yselkowi(a)redhat.com> Date: Wed Jun 5 07:34:17 2024 -0400 Do not require openssl-fips-provider on ELN diff --git a/openssl.spec b/openssl.spec index 4169f7d..fada88f 100644 --- a/openssl.spec +++ b/openssl.spec @@ -29,7 +29,7 @@ print(string.sub(hash, 0, 16)) Summary: Utilities from the general purpose cryptography library with TLS implementation Name: openssl Version: 3.2.1 -Release: 9%{?dist} +Release: 10%{?dist} Epoch: 1 Source: openssl-%{version}.tar.gz Source2: Makefile.certificate @@ -190,7 +190,7 @@ Recommends: pkcs11-provider%{?_isa} %else Recommends: openssl-pkcs11%{?_isa} %endif -%if ( %{defined rhel} && (! %{defined centos}) ) +%if ( %{defined rhel} && (! %{defined centos}) && (! %{defined eln}) ) Requires: openssl-fips-provider %endif @@ -352,7 +352,7 @@ make test HARNESS_JOBS=8 # Add generation of HMAC checksum of the final stripped library # We manually copy standard definition of __spec_install_post # and add hmac calculation/embedding to fips.so -%if ( %{defined rhel} && (! %{defined centos}) ) +%if ( %{defined rhel} && (! %{defined centos}) && (! %{defined eln}) ) %define __spec_install_post \ rm -rf $RPM_BUILD_ROOT/%{_libdir}/ossl-modules/fips.so \ %{?__debug_package:%{__debug_install_post}} \ @@ -509,6 +509,9 @@ ln -s /etc/crypto-policies/back-ends/openssl_fips.config $RPM_BUILD_ROOT%{_sysco %ldconfig_scriptlets libs %changelog +* Wed Jun 05 2024 Yaakov Selkowitz <yselkowi(a)redhat.com> - 1:3.2.1-10 +- Do not require openssl-fips-provider on ELN + * Mon Jun 03 2024 Sahana Prasad <sahana(a)redhat.com> - 1:3.2.1-9 - Synchronize patches from CentOS 9 that had additional fixes required for rebase to 3.2.1 commit e5834712e5d68736e75ba1dce4dc85dfd38e4c9c Author: Sahana Prasad <sahana(a)redhat.com> Date: Mon Jun 3 12:09:44 2024 +0200 Synchronize patches from CentOS 9 that had additional fixes required for rebase to 3.2.1 Signed-off-by: Sahana Prasad <sahana(a)redhat.com> diff --git a/0004-Override-default-paths-for-the-CA-directory-tree.patch b/0004-Override-default-paths-for-the-CA-directory-tree.patch index 7f20774..9ba7947 100644 --- a/0004-Override-default-paths-for-the-CA-directory-tree.patch +++ b/0004-Override-default-paths-for-the-CA-directory-tree.patch @@ -11,11 +11,11 @@ Patch-status: | From-dist-git-commit: 9409bc7044cf4b5773639cce20f51399888c45fd --- apps/CA.pl.in | 2 +- - apps/openssl.cnf | 13 +++++++++++-- - 2 files changed, 12 insertions(+), 3 deletions(-) + apps/openssl.cnf | 20 ++++++++++++++++++-- + 2 files changed, 19 insertions(+), 3 deletions(-) diff --git a/apps/CA.pl.in b/apps/CA.pl.in -index f029470005..729f104a7e 100644 +index c0afb96716..d6a5fabd16 100644 --- a/apps/CA.pl.in +++ b/apps/CA.pl.in @@ -29,7 +29,7 @@ my $X509 = "$openssl x509"; @@ -27,20 +27,24 @@ index f029470005..729f104a7e 100644 my $CAKEY = "cakey.pem"; my $CAREQ = "careq.pem"; my $CACERT = "cacert.pem"; -diff --git a/apps/openssl.cnf b/apps/openssl.cnf -index 8141ab20cd..3956235fda 100644 ---- a/apps/openssl.cnf -+++ b/apps/openssl.cnf -@@ -52,6 +52,8 @@ tsa_policy3 = 1.2.3.4.5.7 +diff -up openssl-3.0.0-alpha16/apps/openssl.cnf.default-tls openssl-3.0.0-alpha16/apps/openssl.cnf +--- openssl-3.0.0-alpha16/apps/openssl.cnf.default-tls 2021-07-06 13:41:39.204978272 +0200 ++++ openssl-3.0.0-alpha16/apps/openssl.cnf 2021-07-06 13:49:50.362857683 +0200 +@@ -53,6 +53,13 @@ tsa_policy3 = 1.2.3.4.5.7 [openssl_init] providers = provider_sect +# Load default TLS policy configuration +ssl_conf = ssl_module ++alg_section = evp_properties ++ ++[ evp_properties ] ++#This section is intentionally added empty here ++#to be tuned on particular systems # List of providers to load [provider_sect] -@@ -71,6 +73,13 @@ default = default_sect +@@ -64,6 +66,13 @@ default = default_sect [default_sect] # activate = 1 @@ -54,7 +58,7 @@ index 8141ab20cd..3956235fda 100644 #################################################################### [ ca ] -@@ -79,7 +88,7 @@ default_ca = CA_default # The default ca section +@@ -72,7 +81,7 @@ default_ca = CA_default # The default c #################################################################### [ CA_default ] @@ -63,7 +67,7 @@ index 8141ab20cd..3956235fda 100644 certs = $dir/certs # Where the issued certs are kept crl_dir = $dir/crl # Where the issued crl are kept database = $dir/index.txt # database index file. -@@ -311,7 +320,7 @@ default_tsa = tsa_config1 # the default TSA section +@@ -304,7 +313,7 @@ default_tsa = tsa_config1 # the default [ tsa_config1 ] # These are used by the TSA reply generation only. @@ -72,6 +76,3 @@ index 8141ab20cd..3956235fda 100644 serial = $dir/tsaserial # The current serial number (mandatory) crypto_device = builtin # OpenSSL engine to use for signing signer_cert = $dir/tsacert.pem # The TSA signing certificate --- -2.41.0 - diff --git a/0024-load-legacy-prov.patch b/0024-load-legacy-prov.patch index 2997d1e..1a65417 100644 --- a/0024-load-legacy-prov.patch +++ b/0024-load-legacy-prov.patch @@ -13,11 +13,10 @@ From-dist-git-commit: 9409bc7044cf4b5773639cce20f51399888c45fd doc/man5/config.pod | 8 ++++++++ 2 files changed, 23 insertions(+), 22 deletions(-) -diff --git a/apps/openssl.cnf b/apps/openssl.cnf -index 3956235fda..bddb6bc029 100644 ---- a/apps/openssl.cnf -+++ b/apps/openssl.cnf -@@ -42,36 +42,29 @@ tsa_policy1 = 1.2.3.4.1 +diff -up openssl-3.0.0/apps/openssl.cnf.legacy-prov openssl-3.0.0/apps/openssl.cnf +--- openssl-3.0.0/apps/openssl.cnf.legacy-prov 2021-09-09 12:06:40.895793297 +0200 ++++ openssl-3.0.0/apps/openssl.cnf 2021-09-09 12:12:33.947482500 +0200 +@@ -42,14 +42,6 @@ tsa_policy1 = 1.2.3.4.1 tsa_policy2 = 1.2.3.4.5.6 tsa_policy3 = 1.2.3.4.5.7 @@ -32,9 +31,16 @@ index 3956235fda..bddb6bc029 100644 [openssl_init] providers = provider_sect # Load default TLS policy configuration - ssl_conf = ssl_module +@@ -42,23 +42,27 @@ [ evp_properties ] + #This section is intentionally added empty here + #to be tuned on particular systems -# List of providers to load +-[provider_sect] +-default = default_sect +-# The fips section name should match the section name inside the +-# included fipsmodule.cnf. +-# fips = fips_sect +# Uncomment the sections that start with ## below to enable the legacy provider. +# Loading the legacy provider enables support for the following algorithms: +# Hashing Algorithms / Message Digests: MD2, MD4, MDC2, WHIRLPOOL, RIPEMD160 @@ -43,13 +49,7 @@ index 3956235fda..bddb6bc029 100644 +# In general it is not recommended to use the above mentioned algorithms for +# security critical operations, as they are cryptographically weak or vulnerable +# to side-channel attacks and as such have been deprecated. -+ - [provider_sect] - default = default_sect --# The fips section name should match the section name inside the --# included fipsmodule.cnf. --# fips = fips_sect -- + -# If no providers are activated explicitly, the default one is activated implicitly. -# See man 7 OSSL_PROVIDER-default for more details. -# @@ -58,21 +58,26 @@ index 3956235fda..bddb6bc029 100644 -# becomes unavailable in openssl. As a consequence applications depending on -# OpenSSL may not work correctly which could lead to significant system -# problems including inability to remotely access the system. +-[default_sect] +-# activate = 1 ++[provider_sect] ++default = default_sect +##legacy = legacy_sect +## - [default_sect] --# activate = 1 ++[default_sect] +activate = 1 + +##[legacy_sect] +##activate = 1 ++ ++#Place the third party provider configuration files into this folder ++.include /etc/pki/tls/openssl.d [ ssl_module ] -diff --git a/doc/man5/config.pod b/doc/man5/config.pod -index 8d312c661f..714a10437b 100644 ---- a/doc/man5/config.pod -+++ b/doc/man5/config.pod +diff -up openssl-3.0.0/doc/man5/config.pod.legacy-prov openssl-3.0.0/doc/man5/config.pod +--- openssl-3.0.0/doc/man5/config.pod.legacy-prov 2021-09-09 12:09:38.079040853 +0200 ++++ openssl-3.0.0/doc/man5/config.pod 2021-09-09 12:11:56.646224876 +0200 @@ -273,6 +273,14 @@ significant. All parameters in the section as well as sub-sections are made available to the provider. @@ -88,6 +93,3 @@ index 8d312c661f..714a10437b 100644 =head3 Default provider and its activation If no providers are activated explicitly, the default one is activated implicitly. --- -2.41.0 - diff --git a/0032-Force-fips.patch b/0032-Force-fips.patch index 02abc6b..985fadf 100644 --- a/0032-Force-fips.patch +++ b/0032-Force-fips.patch @@ -33,7 +33,16 @@ index 058fb58837..5274265a70 100644 if (ok == 1) { if (!ossl_provider_activate(prov, 1, 0)) { -@@ -309,6 +311,30 @@ static int provider_conf_init(CONF_IMODULE *md, const CONF *cnf) +@@ -268,6 +268,8 @@ static int provider_conf_activate(OSSL_L + + if (ok <= 0) + ossl_provider_free(prov); ++ } else { ++ ok = 1; + } + CRYPTO_THREAD_unlock(pcgbl->lock); + +@@ -309,6 +311,33 @@ static int provider_conf_init(CONF_IMODULE *md, const CONF *cnf) return 0; } @@ -55,6 +64,9 @@ index 058fb58837..5274265a70 100644 + if (provider_conf_activate(libctx, "fips", NULL, NULL, 0, NULL) != 1) + return 0; + } ++ /* provider_conf_load can return 1 even when the test is failed so check explicitly */ ++ if (OSSL_PROVIDER_available(libctx, "fips") != 1) ++ return 0; + if (provider_conf_activate(libctx, "base", NULL, NULL, 0, NULL) != 1) + return 0; + if (EVP_default_properties_enable_fips(libctx, 1) != 1) diff --git a/0033-FIPS-embed-hmac.patch b/0033-FIPS-embed-hmac.patch index 6738304..4e11f02 100644 --- a/0033-FIPS-embed-hmac.patch +++ b/0033-FIPS-embed-hmac.patch @@ -391,6 +391,73 @@ index 18d9f3d204..71780d8caa 100644 my $fipsmodcfg_filename = "fipsmodule.cnf"; my $fipsmodcfg = bldtop_file("test", $fipsmodcfg_filename); --- -2.44.0 - +diff -up openssl-3.2.1/providers/fips/self_test.c.0033-patch-new openssl-3.2.1/providers/fips/self_test.c +--- openssl-3.2.1/providers/fips/self_test.c.0033-patch-new 2024-06-04 14:42:03.748284524 +0200 ++++ openssl-3.2.1/providers/fips/self_test.c 2024-06-04 14:47:19.589758324 +0200 +@@ -369,23 +369,12 @@ static int verify_integrity(OSSL_CORE_BI + EVP_MAC *mac = NULL; + EVP_MAC_CTX *ctx = NULL; + OSSL_PARAM params[2], *p = params; +- Dl_info info; +- void *extra_info = NULL; +- struct link_map *lm = NULL; +- unsigned long paddr; +- unsigned long off = 0; + + if (!integrity_self_test(ev, libctx)) + goto err; + + OSSL_SELF_TEST_onbegin(ev, event_type, OSSL_SELF_TEST_DESC_INTEGRITY_HMAC); + +- if (!dladdr1 ((const void *)fips_hmac_container, +- &info, &extra_info, RTLD_DL_LINKMAP)) +- goto err; +- lm = extra_info; +- paddr = (unsigned long)fips_hmac_container - lm->l_addr; +- + mac = EVP_MAC_fetch(libctx, MAC_NAME, NULL); + if (mac == NULL) + goto err; +@@ -399,40 +388,12 @@ static int verify_integrity(OSSL_CORE_BI + if (!EVP_MAC_init(ctx, fixed_key, sizeof(fixed_key), params)) + goto err; + +- while ((off + INTEGRITY_BUF_SIZE) <= paddr) { +- status = read_ex_cb(bio, buf, INTEGRITY_BUF_SIZE, &bytes_read); +- if (status != 1) +- break; +- if (!EVP_MAC_update(ctx, buf, bytes_read)) +- goto err; +- off += bytes_read; +- } +- +- if (off + INTEGRITY_BUF_SIZE > paddr) { +- int delta = paddr - off; +- status = read_ex_cb(bio, buf, delta, &bytes_read); +- if (status != 1) +- goto err; +- if (!EVP_MAC_update(ctx, buf, bytes_read)) +- goto err; +- off += bytes_read; +- +- status = read_ex_cb(bio, buf, HMAC_LEN, &bytes_read); +- memset(buf, 0, HMAC_LEN); +- if (status != 1) +- goto err; +- if (!EVP_MAC_update(ctx, buf, bytes_read)) +- goto err; +- off += bytes_read; +- } +- +- while (bytes_read > 0) { +- status = read_ex_cb(bio, buf, INTEGRITY_BUF_SIZE, &bytes_read); ++ while (1) { ++ status = read_ex_cb(bio, buf, sizeof(buf), &bytes_read); + if (status != 1) + break; + if (!EVP_MAC_update(ctx, buf, bytes_read)) + goto err; +- off += bytes_read; + } + + if (!EVP_MAC_final(ctx, out, &out_len, sizeof(out))) diff --git a/0049-Allow-disabling-of-SHA1-signatures.patch b/0049-Allow-disabling-of-SHA1-signatures.patch index 655691b..c5774c2 100644 --- a/0049-Allow-disabling-of-SHA1-signatures.patch +++ b/0049-Allow-disabling-of-SHA1-signatures.patch @@ -323,22 +323,6 @@ index 0d3acdbe56..fe694c4e96 100644 return mdnid; } -@@ -252,5 +262,15 @@ int ossl_digest_is_allowed(OSSL_LIB_CTX *ctx, const EVP_MD *md) - if (ossl_securitycheck_enabled(ctx)) - return ossl_digest_get_approved_nid(md) != NID_undef; - # endif /* OPENSSL_NO_FIPS_SECURITYCHECKS */ -+ -+#ifndef FIPS_MODULE -+ { -+ int mdnid = EVP_MD_nid(md); -+ if ((mdnid == NID_sha1 || mdnid == NID_md5_sha1) -+ && !ossl_ctx_legacy_digest_signatures_allowed(ctx, 0)) -+ return 0; -+ } -+#endif -+ - return 1; - } diff --git a/providers/common/securitycheck_default.c b/providers/common/securitycheck_default.c index 246323493e..2ca7a59f39 100644 --- a/providers/common/securitycheck_default.c diff --git a/0056-strcasecmp.patch b/0056-strcasecmp.patch new file mode 100644 index 0000000..6b740ce --- /dev/null +++ b/0056-strcasecmp.patch @@ -0,0 +1,53 @@ +diff -up openssl-3.0.3/util/libcrypto.num.locale openssl-3.0.3/util/libcrypto.num +--- openssl-3.0.3/util/libcrypto.num.locale 2022-06-01 12:35:52.667498724 +0200 ++++ openssl-3.0.3/util/libcrypto.num 2022-06-01 12:36:08.112633093 +0200 +@@ -5425,5 +5425,7 @@ ASN1_item_d2i_ex + X509_STORE_CTX_set_current_reasons 5664 3_2_0 EXIST::FUNCTION: + OSSL_STORE_delete 5665 3_2_0 EXIST::FUNCTION: + BIO_ADDR_copy 5666 3_2_0 EXIST::FUNCTION:SOCK ++OPENSSL_strcasecmp ? 3_0_1 EXIST::FUNCTION: ++OPENSSL_strncasecmp ? 3_0_1 EXIST::FUNCTION: + ossl_ctx_legacy_digest_signatures_allowed ? 3_0_1 EXIST::FUNCTION: + ossl_ctx_legacy_digest_signatures_allowed_set ? 3_0_1 EXIST::FUNCTION: +diff -up openssl-3.0.7/crypto/o_str.c.cmp openssl-3.0.7/crypto/o_str.c +--- openssl-3.0.7/crypto/o_str.c.cmp 2022-11-25 12:50:22.449760653 +0100 ++++ openssl-3.0.7/crypto/o_str.c 2022-11-25 12:51:19.416350584 +0100 +@@ -342,7 +342,12 @@ int openssl_strerror_r(int errnum, char + #endif + } + +-int OPENSSL_strcasecmp(const char *s1, const char *s2) ++int ++#if !defined(FIPS_MODULE) && !defined(OPENSSL_SYS_UEFI) ++__attribute__ ((symver ("OPENSSL_strcasecmp@@OPENSSL_3.0.3"), ++ symver ("OPENSSL_strcasecmp(a)OPENSSL_3.0.1"))) ++#endif ++OPENSSL_strcasecmp(const char *s1, const char *s2) + { + int t; + +@@ -352,7 +354,12 @@ int OPENSSL_strcasecmp(const char *s1, c + return t; + } + +-int OPENSSL_strncasecmp(const char *s1, const char *s2, size_t n) ++int ++#if !defined(FIPS_MODULE) && !defined(OPENSSL_SYS_UEFI) ++__attribute__ ((symver ("OPENSSL_strncasecmp@@OPENSSL_3.0.3"), ++ symver ("OPENSSL_strncasecmp(a)OPENSSL_3.0.1"))) ++#endif ++OPENSSL_strncasecmp(const char *s1, const char *s2, size_t n) + { + int t; + size_t i; +diff -up openssl-3.0.7/test/recipes/01-test_symbol_presence.t.cmp openssl-3.0.7/test/recipes/01-test_symbol_presence.t +--- openssl-3.0.7/test/recipes/01-test_symbol_presence.t.cmp 2022-11-25 18:19:05.669769076 +0100 ++++ openssl-3.0.7/test/recipes/01-test_symbol_presence.t 2022-11-25 18:31:20.993392678 +0100 +@@ -77,6 +80,7 @@ foreach my $libname (@libnames) { + s| .*||; + # Drop OpenSSL dynamic version information if there is any + s|\@\@.+$||; ++ s|\@.+$||; + # Return the result + $_ + } diff --git a/0076-FIPS-140-3-DRBG.patch b/0076-FIPS-140-3-DRBG.patch index 92495f8..7376d02 100644 --- a/0076-FIPS-140-3-DRBG.patch +++ b/0076-FIPS-140-3-DRBG.patch @@ -17,11 +17,10 @@ From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce .../implementations/rands/seeding/rand_unix.c | 68 ++----------------- 5 files changed, 28 insertions(+), 68 deletions(-) -diff --git a/crypto/rand/prov_seed.c b/crypto/rand/prov_seed.c -index 2985c7f2d8..3202a28226 100644 ---- a/crypto/rand/prov_seed.c -+++ b/crypto/rand/prov_seed.c -@@ -23,7 +23,14 @@ size_t ossl_rand_get_entropy(ossl_unused OSSL_LIB_CTX *ctx, +diff -up openssl-3.0.1/crypto/rand/prov_seed.c.fipsrand openssl-3.0.1/crypto/rand/prov_seed.c +--- openssl-3.0.1/crypto/rand/prov_seed.c.fipsrand 2022-08-04 12:17:52.148556301 +0200 ++++ openssl-3.0.1/crypto/rand/prov_seed.c 2022-08-04 12:19:41.783533552 +0200 +@@ -20,7 +20,14 @@ size_t ossl_rand_get_entropy(ossl_unused size_t entropy_available; RAND_POOL *pool; @@ -37,11 +36,10 @@ index 2985c7f2d8..3202a28226 100644 if (pool == NULL) { ERR_raise(ERR_LIB_RAND, ERR_R_RAND_LIB); return 0; -diff --git a/providers/implementations/rands/crngt.c b/providers/implementations/rands/crngt.c -index fa4a2db14a..1f13fc759e 100644 ---- a/providers/implementations/rands/crngt.c -+++ b/providers/implementations/rands/crngt.c -@@ -133,7 +133,11 @@ size_t ossl_crngt_get_entropy(PROV_DRBG *drbg, +diff -up openssl-3.0.1/providers/implementations/rands/crngt.c.fipsrand openssl-3.0.1/providers/implementations/rands/crngt.c +--- openssl-3.0.1/providers/implementations/rands/crngt.c.fipsrand 2022-08-04 11:56:10.100950299 +0200 ++++ openssl-3.0.1/providers/implementations/rands/crngt.c 2022-08-04 11:59:11.241564925 +0200 +@@ -139,7 +139,11 @@ size_t ossl_crngt_get_entropy(PROV_DRBG * to the nearest byte. If the entropy is of less than full quality, * the amount required should be scaled up appropriately here. */ @@ -54,11 +52,10 @@ index fa4a2db14a..1f13fc759e 100644 if (bytes_needed < min_len) bytes_needed = min_len; if (bytes_needed > max_len) -diff --git a/providers/implementations/rands/drbg.c b/providers/implementations/rands/drbg.c -index 1586288692..e6de65a23d 100644 ---- a/providers/implementations/rands/drbg.c -+++ b/providers/implementations/rands/drbg.c -@@ -564,6 +564,9 @@ static int ossl_prov_drbg_reseed_unlocked(PROV_DRBG *drbg, +diff -up openssl-3.0.1/providers/implementations/rands/drbg.c.fipsrand openssl-3.0.1/providers/implementations/rands/drbg.c +--- openssl-3.0.1/providers/implementations/rands/drbg.c.fipsrand 2022-08-03 12:14:39.409370134 +0200 ++++ openssl-3.0.1/providers/implementations/rands/drbg.c 2022-08-03 12:19:06.320700346 +0200 +@@ -575,6 +575,9 @@ int ossl_prov_drbg_reseed(PROV_DRBG *drb #endif } @@ -68,7 +65,7 @@ index 1586288692..e6de65a23d 100644 /* Reseed using our sources in addition */ entropylen = get_entropy(drbg, &entropy, drbg->strength, drbg->min_entropylen, drbg->max_entropylen, -@@ -685,8 +688,14 @@ int ossl_prov_drbg_generate(PROV_DRBG *drbg, unsigned char *out, size_t outlen, +@@ -669,8 +669,14 @@ int ossl_prov_drbg_generate(PROV_DRBG *d reseed_required = 1; } if (drbg->parent != NULL @@ -84,10 +81,9 @@ index 1586288692..e6de65a23d 100644 if (reseed_required || prediction_resistance) { if (!ossl_prov_drbg_reseed_unlocked(drbg, prediction_resistance, NULL, -diff --git a/providers/implementations/rands/drbg_local.h b/providers/implementations/rands/drbg_local.h -index 50f98a0b61..53d99c8c84 100644 ---- a/providers/implementations/rands/drbg_local.h -+++ b/providers/implementations/rands/drbg_local.h +diff -up openssl-3.0.7/providers/implementations/rands/drbg_local.h.drbg openssl-3.0.7/providers/implementations/rands/drbg_local.h +--- openssl-3.0.7/providers/implementations/rands/drbg_local.h.drbg 2023-03-13 12:17:47.705538612 +0100 ++++ openssl-3.0.7/providers/implementations/rands/drbg_local.h 2023-03-13 12:18:03.060702092 +0100 @@ -38,7 +38,7 @@ * * The value is in bytes. @@ -97,10 +93,9 @@ index 50f98a0b61..53d99c8c84 100644 /* * Maximum input size for the DRBG (entropy, nonce, personalization string) -diff --git a/providers/implementations/rands/seeding/rand_unix.c b/providers/implementations/rands/seeding/rand_unix.c -index 9a936d800d..61d720efa9 100644 ---- a/providers/implementations/rands/seeding/rand_unix.c -+++ b/providers/implementations/rands/seeding/rand_unix.c +diff -up openssl-3.0.1/providers/implementations/rands/seeding/rand_unix.c.fipsrand openssl-3.0.1/providers/implementations/rands/seeding/rand_unix.c +--- openssl-3.0.1/providers/implementations/rands/seeding/rand_unix.c.fipsrand 2022-08-03 11:09:01.301637515 +0200 ++++ openssl-3.0.1/providers/implementations/rands/seeding/rand_unix.c 2022-08-03 11:13:00.058688605 +0200 @@ -48,6 +48,8 @@ # include <fcntl.h> # include <unistd.h> @@ -178,11 +173,64 @@ index 9a936d800d..61d720efa9 100644 - errno = ENOSYS; - return -1; -# endif -+ /* Red Hat uses downstream patch to always seed from getrandom() */ -+ return EVP_default_properties_is_fips_enabled(NULL) ? getrandom(buf, buflen, GRND_RANDOM) : getrandom(buf, buflen, 0); ++ int realbuflen = buflen > 32 ? 32 : buflen; /* Red Hat uses downstream patch to always seed from getrandom() */ ++ return EVP_default_properties_is_fips_enabled(NULL) ? getrandom(buf, realbuflen, GRND_RANDOM) : getrandom(buf, buflen, 0); } # endif /* defined(OPENSSL_RAND_SEED_GETRANDOM) */ --- -2.44.0 - +diff -up openssl-3.2.1/providers/implementations/rands/seed_src.c.xxx openssl-3.2.1/providers/implementations/rands/seed_src.c +--- openssl-3.2.1/providers/implementations/rands/seed_src.c.xxx 2024-04-10 13:14:38.984033920 +0200 ++++ openssl-3.2.1/providers/implementations/rands/seed_src.c 2024-04-10 13:15:20.565045748 +0200 +@@ -102,7 +102,14 @@ static int seed_src_generate(void *vseed + return 0; + } + +- pool = ossl_rand_pool_new(strength, 1, outlen, outlen); ++ /* ++ * OpenSSL still implements an internal entropy pool of ++ * some size that is hashed to get seed data. ++ * Note that this is a conditioning step for which SP800-90C requires ++ * 64 additional bits from the entropy source to claim the requested ++ * amount of entropy. ++ */ ++ pool = ossl_rand_pool_new(strength + 64, 1, outlen, outlen); + if (pool == NULL) { + ERR_raise(ERR_LIB_PROV, ERR_R_RAND_LIB); + return 0; +@@ -189,7 +189,14 @@ static size_t seed_get_seed(void *vseed, + size_t i; + RAND_POOL *pool; + +- pool = ossl_rand_pool_new(entropy, 1, min_len, max_len); ++ /* ++ * OpenSSL still implements an internal entropy pool of ++ * some size that is hashed to get seed data. ++ * Note that this is a conditioning step for which SP800-90C requires ++ * 64 additional bits from the entropy source to claim the requested ++ * amount of entropy. ++ */ ++ pool = ossl_rand_pool_new(entropy + 64, 1, min_len, max_len); + if (pool == NULL) { + ERR_raise(ERR_LIB_PROV, ERR_R_RAND_LIB); + return 0; +diff --git a/crypto/rand/rand_lib.c b/crypto/rand/rand_lib.c +index 14999540ab..b05b84717b 100644 +--- a/crypto/rand/rand_lib.c ++++ b/crypto/rand/rand_lib.c +@@ -723,15 +723,7 @@ EVP_RAND_CTX *RAND_get0_primary(OSSL_LIB_CTX *ctx) + return ret; + } + +-#ifndef FIPS_MODULE +- if (dgbl->seed == NULL) { +- ERR_set_mark(); +- dgbl->seed = rand_new_seed(ctx); +- ERR_pop_to_mark(); +- } +-#endif +- +- ret = dgbl->primary = rand_new_drbg(ctx, dgbl->seed, ++ ret = dgbl->primary = rand_new_drbg(ctx, NULL, + PRIMARY_RESEED_INTERVAL, + PRIMARY_RESEED_TIME_INTERVAL, 1); + /* diff --git a/0115-skip-quic-pairwise.patch b/0115-skip-quic-pairwise.patch index fccb8dd..98bfae5 100644 --- a/0115-skip-quic-pairwise.patch +++ b/0115-skip-quic-pairwise.patch @@ -28,18 +28,6 @@ index 41cf0fc7a8..0fb7492700 100644 #endif ADD_TEST(test_quic_forbidden_apis_ctx); ADD_TEST(test_quic_forbidden_apis); -diff --git a/test/recipes/01-test_symbol_presence.t b/test/recipes/01-test_symbol_presence.t -index 222b1886ae..7e2f65cccb 100644 ---- a/test/recipes/01-test_symbol_presence.t -+++ b/test/recipes/01-test_symbol_presence.t -@@ -185,6 +185,7 @@ foreach (sort keys %stlibname) { - } - } - my @duplicates = sort grep { $symbols{$_} > 1 } keys %symbols; -+@duplicates = grep {($_ ne "OPENSSL_ia32cap_P") && ($_ ne "EVP_CIPHER_CTX_dup") && ($_ ne "EVP_MD_CTX_dup") } @duplicates; - if (@duplicates) { - note "Duplicates:"; - note join('\n', @duplicates); diff --git a/test/recipes/30-test_pairwise_fail.t b/test/recipes/30-test_pairwise_fail.t index c837d48fb4..f06ef04b1a 100644 --- a/test/recipes/30-test_pairwise_fail.t diff --git a/0116-version-aliasing.patch b/0116-version-aliasing.patch index 67d632d..73f7981 100644 --- a/0116-version-aliasing.patch +++ b/0116-version-aliasing.patch @@ -53,17 +53,18 @@ index e9faf31057..5a29b8dbb7 100644 EVP_CIPHER_CTX *out = EVP_CIPHER_CTX_new(); diff --git a/test/recipes/01-test_symbol_presence.t b/test/recipes/01-test_symbol_presence.t -index 7e2f65cccb..cc947d4821 100644 +index 222b1886ae..7e2f65cccb 100644 --- a/test/recipes/01-test_symbol_presence.t +++ b/test/recipes/01-test_symbol_presence.t -@@ -131,6 +131,7 @@ foreach (sort keys %stlibname) { - s| .*||; - # Drop OpenSSL dynamic version information if there is any - s|\@\@.+$||; -+ s|\@.+$||; - # Return the result - $_ - } +@@ -185,6 +185,8 @@ foreach (sort keys %stlibname) { + } + } + my @duplicates = sort grep { $symbols{$_} > 1 } keys %symbols; ++@duplicates = grep {($_ ne "OPENSSL_ia32cap_P") && ($_ ne "EVP_CIPHER_CTX_dup") && ($_ ne "EVP_MD_CTX_dup") } @duplicates; ++@duplicates = grep {($_ ne "OPENSSL_strcasecmp") && ($_ ne "OPENSSL_strncasecmp") } @duplicates; + if (@duplicates) { + note "Duplicates:"; + note join('\n', @duplicates); diff --git a/util/libcrypto.num b/util/libcrypto.num index 8046454025..068e9904e2 100644 --- a/util/libcrypto.num diff --git a/0120-Allow-disabling-of-SHA1-signatures.patch b/0120-Allow-disabling-of-SHA1-signatures.patch index 01ad338..a4fc66f 100644 --- a/0120-Allow-disabling-of-SHA1-signatures.patch +++ b/0120-Allow-disabling-of-SHA1-signatures.patch @@ -147,22 +147,6 @@ index f635b5aec8..b061125291 100644 #endif return mdnid; -@@ -267,9 +272,12 @@ int ossl_digest_is_allowed(OSSL_LIB_CTX *ctx, const EVP_MD *md) - #ifndef FIPS_MODULE - { - int mdnid = EVP_MD_nid(md); -- if ((mdnid == NID_sha1 || mdnid == NID_md5_sha1) -- && !ossl_ctx_legacy_digest_signatures_allowed(ctx, 0)) -- return 0; -+ if (mdnid == NID_sha1 || mdnid == NID_md5_sha1) { -+ if (!ossl_ctx_legacy_digest_signatures_allowed(ctx, 0)) -+ return 0; -+ else -+ DTRACE_PROBE1(libcrypto, fedora_ossl_digest_is_allowed_1, mdnid); -+ } - } - #endif - diff --git a/providers/common/securitycheck_default.c b/providers/common/securitycheck_default.c index 2ca7a59f39..13993b5eb1 100644 --- a/providers/common/securitycheck_default.c diff --git a/openssl.spec b/openssl.spec index b8f7ac7..4169f7d 100644 --- a/openssl.spec +++ b/openssl.spec @@ -29,7 +29,7 @@ print(string.sub(hash, 0, 16)) Summary: Utilities from the general purpose cryptography library with TLS implementation Name: openssl Version: 3.2.1 -Release: 8%{?dist} +Release: 9%{?dist} Epoch: 1 Source: openssl-%{version}.tar.gz Source2: Makefile.certificate @@ -91,6 +91,12 @@ Patch47: 0047-FIPS-early-KATS.patch Patch49: 0049-Allow-disabling-of-SHA1-signatures.patch # Support SHA1 in TLS in LEGACY crypto-policy (which is SECLEVEL=1) Patch52: 0052-Allow-SHA1-in-seclevel-1-if-rh-allow-sha1-signatures.patch +# Originally from https://github.com/openssl/openssl/pull/18103 +# As we rebased to 3.0.7 and used the version of the function +# not matching the upstream one, we have to use aliasing. +# When we eliminate this patch, the `-Wl,--allow-multiple-definition` +# should also be removed +Patch56: 0056-strcasecmp.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2053289 Patch58: 0058-FIPS-limit-rsa-encrypt.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2087147 @@ -184,6 +190,9 @@ Recommends: pkcs11-provider%{?_isa} %else Recommends: openssl-pkcs11%{?_isa} %endif +%if ( %{defined rhel} && (! %{defined centos}) ) +Requires: openssl-fips-provider +%endif %description libs OpenSSL is a toolkit for supporting cryptography. The openssl-libs @@ -297,7 +306,7 @@ export HASHBANGPERL=/usr/bin/perl %endif --system-ciphers-file=%{_sysconfdir}/crypto-policies/back-ends/openssl.config \ zlib enable-camellia enable-seed enable-rfc3779 enable-sctp \ - enable-cms enable-md2 enable-rc5 ${ktlsopt} enable-fips -D_GNU_SOURCE \ + enable-cms enable-md2 enable-rc5 ${ktlsopt} enable-fips -D_GNU_SOURCE\ no-mdc2 no-ec2m no-sm2 no-sm4 enable-buildtest-c++\ shared ${sslarch} $RPM_OPT_FLAGS '-DDEVRANDOM="\"/dev/urandom\"" -DREDHAT_FIPS_VERSION="\"%{fips}\""'\ -Wl,--allow-multiple-definition @@ -329,14 +338,12 @@ patch -p1 < %{SOURCE14} OPENSSL_ENABLE_MD5_VERIFY= export OPENSSL_ENABLE_MD5_VERIFY -%if 0%{?rhel} OPENSSL_ENABLE_SHA1_SIGNATURES= export OPENSSL_ENABLE_SHA1_SIGNATURES -%endif OPENSSL_SYSTEM_CIPHERS_OVERRIDE=xyz_nonexistent_file export OPENSSL_SYSTEM_CIPHERS_OVERRIDE #embed HMAC into fips provider for test run -OPENSSL_CONF=/dev/null LD_LIBRARY_PATH=. apps/openssl dgst -binary -sha256 -mac HMAC -macopt hexkey:f4556650ac31d35461610bac4ed81b1a181b2d8a43ea2854cbae22ca74560813 < providers/fips.so > providers/fips.so.hmac +LD_LIBRARY_PATH=. apps/openssl dgst -binary -sha256 -mac HMAC -macopt hexkey:f4556650ac31d35461610bac4ed81b1a181b2d8a43ea2854cbae22ca74560813 < providers/fips.so > providers/fips.so.hmac objcopy --update-section .rodata1=providers/fips.so.hmac providers/fips.so providers/fips.so.mac mv providers/fips.so.mac providers/fips.so #run tests itself @@ -345,6 +352,14 @@ make test HARNESS_JOBS=8 # Add generation of HMAC checksum of the final stripped library # We manually copy standard definition of __spec_install_post # and add hmac calculation/embedding to fips.so +%if ( %{defined rhel} && (! %{defined centos}) ) +%define __spec_install_post \ + rm -rf $RPM_BUILD_ROOT/%{_libdir}/ossl-modules/fips.so \ + %{?__debug_package:%{__debug_install_post}} \ + %{__arch_install_post} \ + %{__os_install_post} \ +%{nil} +%else %define __spec_install_post \ %{?__debug_package:%{__debug_install_post}} \ %{__arch_install_post} \ @@ -354,6 +369,7 @@ make test HARNESS_JOBS=8 mv $RPM_BUILD_ROOT%{_libdir}/ossl-modules/fips.so.mac $RPM_BUILD_ROOT%{_libdir}/ossl-modules/fips.so \ rm $RPM_BUILD_ROOT%{_libdir}/ossl-modules/fips.so.hmac \ %{nil} +%endif %define __provides_exclude_from %{_libdir}/openssl @@ -377,6 +393,7 @@ done # Install a makefile for generating keys and self-signed certs, and a script # for generating them on the fly. mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/certs +mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/openssl.d install -m644 %{SOURCE2} $RPM_BUILD_ROOT%{_pkgdocdir}/Makefile.certificate install -m755 %{SOURCE6} $RPM_BUILD_ROOT%{_bindir}/make-dummy-cert install -m755 %{SOURCE7} $RPM_BUILD_ROOT%{_bindir}/renew-dummy-cert @@ -436,6 +453,7 @@ cat $RPM_BUILD_ROOT/%{_prefix}/include/openssl/configuration.h >> \ install -m644 %{SOURCE9} \ $RPM_BUILD_ROOT/%{_prefix}/include/openssl/configuration.h %endif +ln -s /etc/crypto-policies/back-ends/openssl_fips.config $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/fips_local.cnf %files %{!?_licensedir:%global license %%doc} @@ -458,8 +476,10 @@ install -m644 %{SOURCE9} \ %dir %{_sysconfdir}/pki/tls/certs %dir %{_sysconfdir}/pki/tls/misc %dir %{_sysconfdir}/pki/tls/private +%dir %{_sysconfdir}/pki/tls/openssl.d %config(noreplace) %{_sysconfdir}/pki/tls/openssl.cnf %config(noreplace) %{_sysconfdir}/pki/tls/ct_log_list.cnf +%config %{_sysconfdir}/pki/tls/fips_local.cnf %attr(0755,root,root) %{_libdir}/libcrypto.so.%{version} %{_libdir}/libcrypto.so.%{soversion} %attr(0755,root,root) %{_libdir}/libssl.so.%{version} @@ -489,6 +509,10 @@ install -m644 %{SOURCE9} \ %ldconfig_scriptlets libs %changelog +* Mon Jun 03 2024 Sahana Prasad <sahana(a)redhat.com> - 1:3.2.1-9 +- Synchronize patches from CentOS 9 that had additional fixes required + for rebase to 3.2.1 + * Tue May 28 2024 Alexander Sosedkin <asosedkin(a)redhat.com> - 1:3.2.1-8 - Instrument with USDT probes related to SHA-1 deprecation commit 52331659e91ec7a474c4b616fa0b4b7b2fa624aa Author: Alexander Sosedkin <asosedkin(a)redhat.com> Date: Thu May 9 13:31:50 2024 +0200 Instrument with USDT probes related to SHA-1 deprecation The current attempt is for https://fedoraproject.org/wiki/Changes/OpenSSLDistrustSHA1SigVer diff --git a/0120-Allow-disabling-of-SHA1-signatures.patch b/0120-Allow-disabling-of-SHA1-signatures.patch new file mode 100644 index 0000000..01ad338 --- /dev/null +++ b/0120-Allow-disabling-of-SHA1-signatures.patch @@ -0,0 +1,244 @@ +From e30ce86ca436f042559c2228724b40cf43985314 Mon Sep 17 00:00:00 2001 +From: Clemens Lang <cllang(a)redhat.com> +Date: Thu, 21 Mar 2024 19:10:57 +0100 +Subject: [PATCH] Instrument with USDT probes related to SHA-1 deprecation + +In order to discover remaining uses of SHA-1 in signatures without +forcefully breaking the code paths, add USDT probes that can be queried +with systemtap at runtime. + +This should allow identifying components that still use SHA-1 signatures +in production so that they can be transitioned to more modern hash +algorithms. + +Patch-name: 0120-Allow-disabling-of-SHA1-signatures.patch +Patch-id: 120 +Patch-status: | + # https://fedoraproject.org/wiki/Changes/OpenSSLDistrustSHA1SigVer +Submitted-by: Alexander Sosedkin <asosedkin(a)redhat.com> +--- + crypto/evp/m_sigver.c | 13 +++++++++---- + crypto/evp/pmeth_lib.c | 13 +++++++++---- + crypto/x509/x509_vfy.c | 6 +++++- + providers/common/securitycheck.c | 22 +++++++++++++++------- + providers/common/securitycheck_default.c | 13 +++++++++++-- + ssl/t1_lib.c | 8 +++++++- + 7 files changed, 60 insertions(+), 20 deletions(-) + +diff --git a/crypto/evp/m_sigver.c b/crypto/evp/m_sigver.c +index 3e9f33c26c..bebea9c5f6 100644 +--- a/crypto/evp/m_sigver.c ++++ b/crypto/evp/m_sigver.c +@@ -17,6 +17,8 @@ + #include "evp_local.h" + #include "crypto/context.h" + ++#include <sys/sdt.h> ++ + typedef struct ossl_legacy_digest_signatures_st { + int allowed; + } OSSL_LEGACY_DIGEST_SIGNATURES; +@@ -335,10 +337,13 @@ static int do_sigver_init(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, + && !EVP_PKEY_is_a(locpctx->pkey, SN_tls1_prf) + && !EVP_PKEY_is_a(locpctx->pkey, SN_hkdf)) { + int mdnid = EVP_MD_nid(ctx->reqdigest); +- if (!ossl_ctx_legacy_digest_signatures_allowed(locpctx->libctx, 0) +- && (mdnid == NID_sha1 || mdnid == NID_md5_sha1)) { +- ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_DIGEST); +- goto err; ++ if (mdnid == NID_sha1 || mdnid == NID_md5_sha1) { ++ if (!ossl_ctx_legacy_digest_signatures_allowed(locpctx->libctx, 0)) { ++ ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_DIGEST); ++ goto err; ++ } else { ++ DTRACE_PROBE1(libcrypto, fedora_do_sigver_init_1, mdnid); ++ } + } + } + #endif /* !defined(FIPS_MODULE) */ +diff --git a/crypto/evp/pmeth_lib.c b/crypto/evp/pmeth_lib.c +index 248f655d0f..92f98c4c21 100644 +--- a/crypto/evp/pmeth_lib.c ++++ b/crypto/evp/pmeth_lib.c +@@ -36,6 +36,8 @@ + #include "internal/sslconf.h" + #include "evp_local.h" + ++#include <sys/sdt.h> ++ + #ifndef FIPS_MODULE + + static int evp_pkey_ctx_store_cached_data(EVP_PKEY_CTX *ctx, +@@ -959,10 +961,13 @@ static int evp_pkey_ctx_set_md(EVP_PKEY_CTX *ctx, const EVP_MD *md, + && !EVP_PKEY_is_a(ctx->pkey, SN_tls1_prf) + && !EVP_PKEY_is_a(ctx->pkey, SN_hkdf)) { + int mdnid = EVP_MD_nid(md); +- if ((mdnid == NID_sha1 || mdnid == NID_md5_sha1) +- && !ossl_ctx_legacy_digest_signatures_allowed(ctx->libctx, 0)) { +- ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_DIGEST); +- return -1; ++ if (mdnid == NID_sha1 || mdnid == NID_md5_sha1) { ++ if (!ossl_ctx_legacy_digest_signatures_allowed(ctx->libctx, 0)) { ++ ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_DIGEST); ++ return -1; ++ } else { ++ DTRACE_PROBE1(libcrypto, fedora_evp_pkey_ctx_set_md_1, mdnid); ++ } + } + } + +diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c +index 1dfbe58a4a..6ef83792f8 100644 +--- a/crypto/x509/x509_vfy.c ++++ b/crypto/x509/x509_vfy.c +@@ -29,6 +29,8 @@ + #include "crypto/x509.h" + #include "x509_local.h" + ++#include <sys/sdt.h> ++ + /* CRL score values */ + + #define CRL_SCORE_NOCRITICAL 0x100 /* No unhandled critical extensions */ +@@ -3689,11 +3691,13 @@ static int check_sig_level(X509_STORE_CTX *ctx, X509 *cert) + + if ((nid == NID_sha1 || nid == NID_md5_sha1) + && ossl_ctx_legacy_digest_signatures_allowed(libctx, 0) +- && ctx->param->auth_level < 2) ++ && ctx->param->auth_level < 2) { ++ DTRACE_PROBE1(libcrypto, fedora_check_sig_level_1, nid); + /* When rh-allow-sha1-signatures = yes and security level <= 1, + * explicitly allow SHA1 for backwards compatibility. Also allow + * MD5-SHA1 because TLS 1.0 is still supported, which uses it. */ + return 1; ++ } + + return secbits >= minbits_table[level - 1]; + } +diff --git a/providers/common/securitycheck.c b/providers/common/securitycheck.c +index f635b5aec8..b061125291 100644 +--- a/providers/common/securitycheck.c ++++ b/providers/common/securitycheck.c +@@ -21,6 +21,8 @@ + #include "prov/securitycheck.h" + #include "internal/sslconf.h" + ++#include <sys/sdt.h> ++ + /* + * FIPS requires a minimum security strength of 112 bits (for encryption or + * signing), and for legacy purposes 80 bits (for decryption or verifying). +@@ -247,11 +249,14 @@ int ossl_digest_get_approved_nid_with_sha1(OSSL_LIB_CTX *ctx, const EVP_MD *md, + # endif /* OPENSSL_NO_FIPS_SECURITYCHECKS */ + + #ifndef FIPS_MODULE +- if (!ossl_ctx_legacy_digest_signatures_allowed(ctx, 0)) +- /* SHA1 is globally disabled, check whether we want to locally allow +- * it. */ +- if (mdnid == NID_sha1 && !sha1_allowed) ++ if (mdnid == NID_sha1 && !sha1_allowed) { ++ if (!ossl_ctx_legacy_digest_signatures_allowed(ctx, 0)) ++ /* SHA1 is globally disabled, check whether we want to locally allow ++ * it. */ + mdnid = -1; ++ else ++ DTRACE_PROBE1(libcrypto, fedora_ossl_digest_get_approved_nid_with_sha1_1, mdnid); ++ } + #endif + + return mdnid; +@@ -267,9 +272,12 @@ int ossl_digest_is_allowed(OSSL_LIB_CTX *ctx, const EVP_MD *md) + #ifndef FIPS_MODULE + { + int mdnid = EVP_MD_nid(md); +- if ((mdnid == NID_sha1 || mdnid == NID_md5_sha1) +- && !ossl_ctx_legacy_digest_signatures_allowed(ctx, 0)) +- return 0; ++ if (mdnid == NID_sha1 || mdnid == NID_md5_sha1) { ++ if (!ossl_ctx_legacy_digest_signatures_allowed(ctx, 0)) ++ return 0; ++ else ++ DTRACE_PROBE1(libcrypto, fedora_ossl_digest_is_allowed_1, mdnid); ++ } + } + #endif + +diff --git a/providers/common/securitycheck_default.c b/providers/common/securitycheck_default.c +index 2ca7a59f39..13993b5eb1 100644 +--- a/providers/common/securitycheck_default.c ++++ b/providers/common/securitycheck_default.c +@@ -17,6 +17,8 @@ + #include "internal/nelem.h" + #include "internal/sslconf.h" + ++#include <sys/sdt.h> ++ + /* Disable the security checks in the default provider */ + int ossl_securitycheck_enabled(OSSL_LIB_CTX *libctx) + { +@@ -46,9 +48,16 @@ int ossl_digest_rsa_sign_get_md_nid(OSSL_LIB_CTX *ctx, const EVP_MD *md, + + ldsigs_allowed = ossl_ctx_legacy_digest_signatures_allowed(ctx, 0); + mdnid = ossl_digest_get_approved_nid_with_sha1(ctx, md, sha1_allowed || ldsigs_allowed); ++ if (mdnid == NID_sha1) ++ /* This will only happen if SHA1 is allowed, otherwise mdnid is -1. */ ++ DTRACE_PROBE1(libcrypto, fedora_ossl_digest_rsa_sign_get_md_nid_1, mdnid); + if (mdnid == NID_undef) + mdnid = ossl_digest_md_to_nid(md, name_to_nid, OSSL_NELEM(name_to_nid)); +- if (mdnid == NID_md5_sha1 && !ldsigs_allowed) +- mdnid = -1; ++ if (mdnid == NID_md5_sha1) { ++ if (ldsigs_allowed) ++ DTRACE_PROBE1(libcrypto, fedora_ossl_digest_rsa_sign_get_md_nid_2, mdnid); ++ else ++ mdnid = -1; ++ } + return mdnid; + } +diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c +index 87f2ae7000..19ed7b6265 100644 +--- a/ssl/t1_lib.c ++++ b/ssl/t1_lib.c +@@ -29,6 +29,8 @@ + #include "quic/quic_local.h" + #include <openssl/ct.h> + ++#include <sys/sdt.h> ++ + static const SIGALG_LOOKUP *find_sig_alg(SSL_CONNECTION *s, X509 *x, EVP_PKEY *pkey); + static int tls12_sigalg_allowed(const SSL_CONNECTION *s, int op, const SIGALG_LOOKUP *lu); + +@@ -1998,6 +2000,7 @@ int tls12_check_peer_sigalg(SSL_CONNECTION *s, uint16_t sig, EVP_PKEY *pkey) + /* When rh-allow-sha1-signatures = yes and security level <= 1, + * explicitly allow SHA1 for backwards compatibility. Also allow + * MD5-SHA1 because TLS 1.0 is still supported, which uses it. */ ++ DTRACE_PROBE1(libssl, fedora_tls12_check_peer_sigalg_1, lu->hash); + } else { + /* + * Make sure security callback allows algorithm. For historical +@@ -2592,6 +2595,7 @@ static int tls12_sigalg_allowed(const SSL_CONNECTION *s, int op, + /* When rh-allow-sha1-signatures = yes and security level <= 1, + * explicitly allow SHA1 for backwards compatibility. Also allow + * MD5-SHA1 because TLS 1.0 is still supported, which uses it. */ ++ DTRACE_PROBE1(libssl, fedora_tls12_sigalg_allowed_1, lu->hash); + return 1; + } + +@@ -3564,11 +3568,13 @@ static int ssl_security_cert_sig(SSL_CONNECTION *s, SSL_CTX *ctx, X509 *x, + && ossl_ctx_legacy_digest_signatures_allowed(libctx, 0) + && ((s != NULL && SSL_get_security_level(SSL_CONNECTION_GET_SSL(s)) < 2) + || (ctx != NULL && SSL_CTX_get_security_level(ctx) < 2) +- )) ++ )) { + /* When rh-allow-sha1-signatures = yes and security level <= 1, + * explicitly allow SHA1 for backwards compatibility. Also allow + * MD5-SHA1 because TLS 1.0 is still supported, which uses it. */ ++ DTRACE_PROBE1(libssl, fedora_ssl_security_cert_sig_1, nid); + return 1; ++ } + + if (s != NULL) + return ssl_security(s, op, secbits, nid, x); +-- +GitLab + diff --git a/openssl.spec b/openssl.spec index 913164b..b8f7ac7 100644 --- a/openssl.spec +++ b/openssl.spec @@ -29,7 +29,7 @@ print(string.sub(hash, 0, 16)) Summary: Utilities from the general purpose cryptography library with TLS implementation Name: openssl Version: 3.2.1 -Release: 7%{?dist} +Release: 8%{?dist} Epoch: 1 Source: openssl-%{version}.tar.gz Source2: Makefile.certificate @@ -147,6 +147,8 @@ Patch117: 0117-ignore-unknown-sigalgorithms-groups.patch Patch118: 0118-no-crl-memleak.patch # https://github.com/openssl/openssl/issues/22779 Patch119: 0119-provider-sigalgs-in-signaturealgorithms-conf.patch +# https://fedoraproject.org/wiki/Changes/OpenSSLDistrustSHA1SigVer +Patch120: 0120-Allow-disabling-of-SHA1-signatures.patch # From CentOS 9 Patch121: 0121-FIPS-cms-defaults.patch @@ -487,6 +489,9 @@ install -m644 %{SOURCE9} \ %ldconfig_scriptlets libs %changelog +* Tue May 28 2024 Alexander Sosedkin <asosedkin(a)redhat.com> - 1:3.2.1-8 +- Instrument with USDT probes related to SHA-1 deprecation + * Tue May 14 2024 David Abdurachmanov <davidlt(a)rivosinc.com> - 1:3.2.1-7 - Add --libdir=%{_lib} for riscv64 (uses linux-generic64) commit 48ec32a3c7d7ce0c2353a2b67d03a748066bca85 Author: Jasen Chao <JasenChao(a)gmail.com> Date: Thu May 16 07:29:31 2024 -0400 Add --libdir=%{_lib} for riscv64 diff --git a/openssl.spec b/openssl.spec index ed1d95b..913164b 100644 --- a/openssl.spec +++ b/openssl.spec @@ -29,7 +29,7 @@ print(string.sub(hash, 0, 16)) Summary: Utilities from the general purpose cryptography library with TLS implementation Name: openssl Version: 3.2.1 -Release: 6%{?dist} +Release: 7%{?dist} Epoch: 1 Source: openssl-%{version}.tar.gz Source2: Makefile.certificate @@ -268,7 +268,7 @@ sslarch="linux64-mips64 -mips64r2" sslflags=enable-ec_nistp_64_gcc_128 %endif %ifarch riscv64 -sslarch=linux-generic64 +sslarch=linux64-riscv64 %endif ktlsopt=enable-ktls %ifarch armv7hl @@ -290,6 +290,9 @@ export HASHBANGPERL=/usr/bin/perl # RPM_OPT_FLAGS, so we can skip specifiying them here. ./Configure \ --prefix=%{_prefix} --openssldir=%{_sysconfdir}/pki/tls ${sslflags} \ +%ifarch riscv64 + --libdir=%{_lib} \ +%endif --system-ciphers-file=%{_sysconfdir}/crypto-policies/back-ends/openssl.config \ zlib enable-camellia enable-seed enable-rfc3779 enable-sctp \ enable-cms enable-md2 enable-rc5 ${ktlsopt} enable-fips -D_GNU_SOURCE \ @@ -484,6 +487,9 @@ install -m644 %{SOURCE9} \ %ldconfig_scriptlets libs %changelog +* Tue May 14 2024 David Abdurachmanov <davidlt(a)rivosinc.com> - 1:3.2.1-7 +- Add --libdir=%{_lib} for riscv64 (uses linux-generic64) + * Thu Apr 04 2024 Dmitry Belyavskiy <dbelyavs(a)redhat.com> - 1:3.2.1-6 - Restoring missing part of 0044- - Backporting CMS FIPS defaults from CentOS 9 commit 701734f5faef54e01b0fc9e9b7776fa06b4949be Author: Dmitry Belyavskiy <dbelyavs(a)redhat.com> Date: Thu Apr 4 13:21:38 2024 +0200 Amending changelog diff --git a/openssl.spec b/openssl.spec index d0a1e41..ed1d95b 100644 --- a/openssl.spec +++ b/openssl.spec @@ -29,7 +29,7 @@ print(string.sub(hash, 0, 16)) Summary: Utilities from the general purpose cryptography library with TLS implementation Name: openssl Version: 3.2.1 -Release: 5%{?dist} +Release: 6%{?dist} Epoch: 1 Source: openssl-%{version}.tar.gz Source2: Makefile.certificate @@ -484,11 +484,11 @@ install -m644 %{SOURCE9} \ %ldconfig_scriptlets libs %changelog -* Thu Apr 04 2024 Dmitry Belyavskiy <dbelyavs(a)redhat.com> - 1:3.2.1-5 +* Thu Apr 04 2024 Dmitry Belyavskiy <dbelyavs(a)redhat.com> - 1:3.2.1-6 - Restoring missing part of 0044- - Backporting CMS FIPS defaults from CentOS 9 -* Mon Mar 25 2024 Sahana Prasad <sahana(a)redhat.com> - 1:3.2.1-4 +* Mon Mar 25 2024 Sahana Prasad <sahana(a)redhat.com> - 1:3.2.1-5 - Add no-engine support. The previous commit was a mistake. * Mon Mar 25 2024 Sahana Prasad <sahana(a)redhat.com> - 1:3.2.1-4 commit 5f6b768be7292599484898f90de07ddeb50cb82c Author: Dmitry Belyavskiy <dbelyavs(a)redhat.com> Date: Thu Apr 4 13:16:44 2024 +0200 Synchronizing patches from CentOS diff --git a/0044-FIPS-140-3-keychecks.patch b/0044-FIPS-140-3-keychecks.patch index 13a61b3..02c4031 100644 --- a/0044-FIPS-140-3-keychecks.patch +++ b/0044-FIPS-140-3-keychecks.patch @@ -1,23 +1,25 @@ -From b300beb172d5813b01b93bfd62fe191f8187fe1e Mon Sep 17 00:00:00 2001 +From 4512f620199126e6b87433ef184f0450652ee28a Mon Sep 17 00:00:00 2001 From: Dmitry Belyavskiy <dbelyavs(a)redhat.com> -Date: Mon, 21 Aug 2023 12:05:23 +0200 -Subject: [PATCH 20/48] 0044-FIPS-140-3-keychecks.patch +Date: Thu, 4 Apr 2024 11:42:18 +0200 +Subject: [PATCH 19/50] 0044-FIPS-140-3-keychecks.patch Patch-name: 0044-FIPS-140-3-keychecks.patch Patch-id: 44 Patch-status: | # Extra public/private key checks required by FIPS-140-3 +From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce --- crypto/dh/dh_key.c | 26 ++++++++++ + crypto/rsa/rsa_gen.c | 3 ++ .../implementations/exchange/ecdh_exch.c | 19 ++++++++ providers/implementations/keymgmt/ec_kmgmt.c | 24 +++++++++- providers/implementations/keymgmt/rsa_kmgmt.c | 18 +++++++ .../implementations/signature/ecdsa_sig.c | 37 +++++++++++++-- providers/implementations/signature/rsa_sig.c | 47 +++++++++++++++++-- - 6 files changed, 162 insertions(+), 9 deletions(-) + 7 files changed, 165 insertions(+), 9 deletions(-) diff --git a/crypto/dh/dh_key.c b/crypto/dh/dh_key.c -index 4e9705beef..83773cceea 100644 +index 7132b9b68e..189bfc3e8b 100644 --- a/crypto/dh/dh_key.c +++ b/crypto/dh/dh_key.c @@ -43,6 +43,9 @@ int ossl_dh_compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh) @@ -30,7 +32,7 @@ index 4e9705beef..83773cceea 100644 if (BN_num_bits(dh->params.p) > OPENSSL_DH_MAX_MODULUS_BITS) { ERR_raise(ERR_LIB_DH, DH_R_MODULUS_TOO_LARGE); -@@ -54,6 +57,13 @@ int ossl_dh_compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh) +@@ -60,6 +63,13 @@ int ossl_dh_compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh) return 0; } @@ -44,7 +46,7 @@ index 4e9705beef..83773cceea 100644 ctx = BN_CTX_new_ex(dh->libctx); if (ctx == NULL) goto err; -@@ -262,6 +272,9 @@ static int generate_key(DH *dh) +@@ -271,6 +281,9 @@ static int generate_key(DH *dh) #endif BN_CTX *ctx = NULL; BIGNUM *pub_key = NULL, *priv_key = NULL; @@ -54,7 +56,7 @@ index 4e9705beef..83773cceea 100644 if (BN_num_bits(dh->params.p) > OPENSSL_DH_MAX_MODULUS_BITS) { ERR_raise(ERR_LIB_DH, DH_R_MODULUS_TOO_LARGE); -@@ -354,8 +367,21 @@ static int generate_key(DH *dh) +@@ -369,8 +382,21 @@ static int generate_key(DH *dh) if (!ossl_dh_generate_public_key(ctx, dh, priv_key, pub_key)) goto err; @@ -76,8 +78,22 @@ index 4e9705beef..83773cceea 100644 dh->dirty_cnt++; ok = 1; err: +diff --git a/crypto/rsa/rsa_gen.c b/crypto/rsa/rsa_gen.c +index 0cdbb3fde2..65ff9d2d47 100644 +--- a/crypto/rsa/rsa_gen.c ++++ b/crypto/rsa/rsa_gen.c +@@ -464,6 +464,9 @@ static int rsa_keygen(OSSL_LIB_CTX *libctx, RSA *rsa, int bits, int primes, + rsa->dmp1 = NULL; + rsa->dmq1 = NULL; + rsa->iqmp = NULL; ++#ifdef FIPS_MODULE ++ abort(); ++#endif /* defined(FIPS_MODULE) */ + } + } + return ok; diff --git a/providers/implementations/exchange/ecdh_exch.c b/providers/implementations/exchange/ecdh_exch.c -index 43caedb6df..73873f9758 100644 +index 5b8412aba1..1d98eba132 100644 --- a/providers/implementations/exchange/ecdh_exch.c +++ b/providers/implementations/exchange/ecdh_exch.c @@ -489,6 +489,25 @@ int ecdh_plain_derive(void *vpecdhctx, unsigned char *secret, @@ -107,10 +123,10 @@ index 43caedb6df..73873f9758 100644 retlen = ECDH_compute_key(secret, size, ppubkey, privk, NULL); diff --git a/providers/implementations/keymgmt/ec_kmgmt.c b/providers/implementations/keymgmt/ec_kmgmt.c -index a37cbbdba8..bca3f3c674 100644 +index 9390935394..1399be1751 100644 --- a/providers/implementations/keymgmt/ec_kmgmt.c +++ b/providers/implementations/keymgmt/ec_kmgmt.c -@@ -989,8 +989,17 @@ struct ec_gen_ctx { +@@ -991,8 +991,17 @@ struct ec_gen_ctx { EC_GROUP *gen_group; unsigned char *dhkem_ikm; size_t dhkem_ikmlen; @@ -128,7 +144,7 @@ index a37cbbdba8..bca3f3c674 100644 static void *ec_gen_init(void *provctx, int selection, const OSSL_PARAM params[]) { -@@ -1009,6 +1018,10 @@ static void *ec_gen_init(void *provctx, int selection, +@@ -1011,6 +1020,10 @@ static void *ec_gen_init(void *provctx, int selection, gctx = NULL; } } @@ -139,7 +155,7 @@ index a37cbbdba8..bca3f3c674 100644 return gctx; } -@@ -1279,6 +1292,12 @@ static void *ec_gen(void *genctx, OSSL_CALLBACK *osslcb, void *cbarg) +@@ -1291,6 +1304,12 @@ static void *ec_gen(void *genctx, OSSL_CALLBACK *osslcb, void *cbarg) if (gctx->ecdh_mode != -1) ret = ret && ossl_ec_set_ecdh_cofactor_mode(ec, gctx->ecdh_mode); @@ -152,7 +168,7 @@ index a37cbbdba8..bca3f3c674 100644 if (gctx->group_check != NULL) ret = ret && ossl_ec_set_check_group_type_from_name(ec, -@@ -1348,7 +1367,10 @@ static void ec_gen_cleanup(void *genctx) +@@ -1361,7 +1380,10 @@ static void ec_gen_cleanup(void *genctx) if (gctx == NULL) return; @@ -165,7 +181,7 @@ index a37cbbdba8..bca3f3c674 100644 EC_GROUP_free(gctx->gen_group); BN_free(gctx->p); diff --git a/providers/implementations/keymgmt/rsa_kmgmt.c b/providers/implementations/keymgmt/rsa_kmgmt.c -index 3ba12c4889..ff49f8fcd8 100644 +index c24cb8da88..4462afa041 100644 --- a/providers/implementations/keymgmt/rsa_kmgmt.c +++ b/providers/implementations/keymgmt/rsa_kmgmt.c @@ -434,6 +434,7 @@ struct rsa_gen_ctx { @@ -222,10 +238,10 @@ index 3ba12c4889..ff49f8fcd8 100644 BN_clear_free(gctx->pub_exp); OPENSSL_free(gctx); diff --git a/providers/implementations/signature/ecdsa_sig.c b/providers/implementations/signature/ecdsa_sig.c -index 865d49d100..ebeb30e002 100644 +index fe65ed8dc6..f158105e71 100644 --- a/providers/implementations/signature/ecdsa_sig.c +++ b/providers/implementations/signature/ecdsa_sig.c -@@ -32,7 +32,7 @@ +@@ -33,7 +33,7 @@ #include "crypto/ec.h" #include "prov/der_ec.h" @@ -234,7 +250,7 @@ index 865d49d100..ebeb30e002 100644 static OSSL_FUNC_signature_sign_init_fn ecdsa_sign_init; static OSSL_FUNC_signature_verify_init_fn ecdsa_verify_init; static OSSL_FUNC_signature_sign_fn ecdsa_sign; -@@ -43,7 +43,7 @@ static OSSL_FUNC_signature_digest_sign_final_fn ecdsa_digest_sign_final; +@@ -44,7 +44,7 @@ static OSSL_FUNC_signature_digest_sign_final_fn ecdsa_digest_sign_final; static OSSL_FUNC_signature_digest_verify_init_fn ecdsa_digest_verify_init; static OSSL_FUNC_signature_digest_verify_update_fn ecdsa_digest_signverify_update; static OSSL_FUNC_signature_digest_verify_final_fn ecdsa_digest_verify_final; @@ -243,7 +259,7 @@ index 865d49d100..ebeb30e002 100644 static OSSL_FUNC_signature_dupctx_fn ecdsa_dupctx; static OSSL_FUNC_signature_get_ctx_params_fn ecdsa_get_ctx_params; static OSSL_FUNC_signature_gettable_ctx_params_fn ecdsa_gettable_ctx_params; -@@ -104,7 +104,7 @@ typedef struct { +@@ -107,7 +107,7 @@ typedef struct { unsigned int nonce_type; } PROV_ECDSA_CTX; @@ -252,7 +268,7 @@ index 865d49d100..ebeb30e002 100644 { PROV_ECDSA_CTX *ctx; -@@ -370,7 +370,7 @@ int ecdsa_digest_verify_final(void *vctx, const unsigned char *sig, +@@ -380,7 +380,7 @@ int ecdsa_digest_verify_final(void *vctx, const unsigned char *sig, return ecdsa_verify(ctx, sig, siglen, digest, (size_t)dlen); } @@ -261,7 +277,7 @@ index 865d49d100..ebeb30e002 100644 { PROV_ECDSA_CTX *ctx = (PROV_ECDSA_CTX *)vctx; -@@ -581,6 +581,35 @@ static const OSSL_PARAM *ecdsa_settable_ctx_md_params(void *vctx) +@@ -601,6 +601,35 @@ static const OSSL_PARAM *ecdsa_settable_ctx_md_params(void *vctx) return EVP_MD_settable_ctx_params(ctx->md); } @@ -298,7 +314,7 @@ index 865d49d100..ebeb30e002 100644 { OSSL_FUNC_SIGNATURE_NEWCTX, (void (*)(void))ecdsa_newctx }, { OSSL_FUNC_SIGNATURE_SIGN_INIT, (void (*)(void))ecdsa_sign_init }, diff --git a/providers/implementations/signature/rsa_sig.c b/providers/implementations/signature/rsa_sig.c -index cd5de6bd51..d4261e8f7d 100644 +index 76db37dd02..22d93ead53 100644 --- a/providers/implementations/signature/rsa_sig.c +++ b/providers/implementations/signature/rsa_sig.c @@ -34,7 +34,7 @@ @@ -328,7 +344,7 @@ index cd5de6bd51..d4261e8f7d 100644 { PROV_RSA_CTX *prsactx = NULL; char *propq_copy = NULL; -@@ -977,7 +977,7 @@ int rsa_digest_verify_final(void *vprsactx, const unsigned char *sig, +@@ -974,7 +974,7 @@ int rsa_digest_verify_final(void *vprsactx, const unsigned char *sig, return rsa_verify(vprsactx, sig, siglen, digest, (size_t)dlen); } @@ -337,7 +353,7 @@ index cd5de6bd51..d4261e8f7d 100644 { PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx; -@@ -1455,6 +1455,45 @@ static const OSSL_PARAM *rsa_settable_ctx_md_params(void *vprsactx) +@@ -1451,6 +1451,45 @@ static const OSSL_PARAM *rsa_settable_ctx_md_params(void *vprsactx) return EVP_MD_settable_ctx_params(prsactx->md); } @@ -384,5 +400,5 @@ index cd5de6bd51..d4261e8f7d 100644 { OSSL_FUNC_SIGNATURE_NEWCTX, (void (*)(void))rsa_newctx }, { OSSL_FUNC_SIGNATURE_SIGN_INIT, (void (*)(void))rsa_sign_init }, -- -2.41.0 +2.44.0 diff --git a/0115-skip-quic-pairwise.patch b/0115-skip-quic-pairwise.patch index 0d96f4d..fccb8dd 100644 --- a/0115-skip-quic-pairwise.patch +++ b/0115-skip-quic-pairwise.patch @@ -1,17 +1,17 @@ -From ec8e4e25cc5e5c67313c5fd6af94fa248685c3d1 Mon Sep 17 00:00:00 2001 +From 42ed594a3a905830374fb65cced431748f8c639c Mon Sep 17 00:00:00 2001 From: Dmitry Belyavskiy <dbelyavs(a)redhat.com> -Date: Thu, 7 Mar 2024 17:37:09 +0100 -Subject: [PATCH 45/49] 0115-skip-quic-pairwise.patch +Date: Thu, 4 Apr 2024 11:50:58 +0200 +Subject: [PATCH 45/50] 0115-skip-quic-pairwise.patch Patch-name: 0115-skip-quic-pairwise.patch Patch-id: 115 Patch-status: | - # skip quic and pairwise tests temporarily + # Amend tests according to Fedora/RHEL code --- test/quicapitest.c | 4 +++- test/recipes/01-test_symbol_presence.t | 1 + - test/recipes/30-test_pairwise_fail.t | 10 ++++++++-- - 3 files changed, 12 insertions(+), 3 deletions(-) + test/recipes/30-test_pairwise_fail.t | 13 +++++++++++-- + 3 files changed, 15 insertions(+), 3 deletions(-) diff --git a/test/quicapitest.c b/test/quicapitest.c index 41cf0fc7a8..0fb7492700 100644 @@ -41,7 +41,7 @@ index 222b1886ae..7e2f65cccb 100644 note "Duplicates:"; note join('\n', @duplicates); diff --git a/test/recipes/30-test_pairwise_fail.t b/test/recipes/30-test_pairwise_fail.t -index c837d48fb4..6291c08c49 100644 +index c837d48fb4..f06ef04b1a 100644 --- a/test/recipes/30-test_pairwise_fail.t +++ b/test/recipes/30-test_pairwise_fail.t @@ -9,7 +9,7 @@ @@ -53,7 +53,18 @@ index c837d48fb4..6291c08c49 100644 use OpenSSL::Test::Utils; BEGIN { -@@ -39,20 +39,26 @@ SKIP: { +@@ -31,28 +31,37 @@ run(test(["fips_version_test", "-config", $provconf, ">=3.1.0"]), + SKIP: { + skip "Skip RSA test because of no rsa in this build", 1 + if disabled("rsa"); ++ with({ exit_checker => sub {my $val = shift; return $val == 134; } }, ++ sub { + ok(run(test(["pairwise_fail_test", "-config", $provconf, + "-pairwise", "rsa"])), + "fips provider rsa keygen pairwise failure test"); ++ }); + } + SKIP: { skip "Skip EC test because of no ec in this build", 2 if disabled("ec"); diff --git a/0121-FIPS-cms-defaults.patch b/0121-FIPS-cms-defaults.patch new file mode 100644 index 0000000..7add39d --- /dev/null +++ b/0121-FIPS-cms-defaults.patch @@ -0,0 +1,84 @@ +From 097bcf136d444ee2383569e296b21ffc85f46e48 Mon Sep 17 00:00:00 2001 +From: Dmitry Belyavskiy <dbelyavs(a)redhat.com> +Date: Thu, 4 Apr 2024 11:54:14 +0200 +Subject: [PATCH 50/50] 0121-FIPS-cms-defaults.patch + +Patch-name: 0121-FIPS-cms-defaults.patch +Patch-id: 121 +Patch-status: | + # From CentOS 9 +--- + apps/cms.c | 11 ++++++++--- + crypto/cms/cms_env.c | 10 ++++++++++ + 2 files changed, 18 insertions(+), 3 deletions(-) + +diff --git a/apps/cms.c b/apps/cms.c +index f93c98ac92..cd8dafe14f 100644 +--- a/apps/cms.c ++++ b/apps/cms.c +@@ -20,6 +20,7 @@ + #include <openssl/x509_vfy.h> + #include <openssl/x509v3.h> + #include <openssl/cms.h> ++#include <openssl/fips.h> + + static int save_certs(char *signerfile, STACK_OF(X509) *signers); + static int cms_cb(int ok, X509_STORE_CTX *ctx); +@@ -820,12 +821,16 @@ int cms_main(int argc, char **argv) + + if (operation == SMIME_ENCRYPT) { + if (!cipher) { ++ if (FIPS_mode()) { ++ cipher = (EVP_CIPHER *)EVP_aes_128_cbc(); ++ } else { + #ifndef OPENSSL_NO_DES +- cipher = (EVP_CIPHER *)EVP_des_ede3_cbc(); ++ cipher = (EVP_CIPHER *)EVP_des_ede3_cbc(); + #else +- BIO_printf(bio_err, "No cipher selected\n"); +- goto end; ++ BIO_printf(bio_err, "No cipher selected\n"); ++ goto end; + #endif ++ } + } + + if (secret_key && !secret_keyid) { +diff --git a/crypto/cms/cms_env.c b/crypto/cms/cms_env.c +index b877e10619..f50f930ec2 100644 +--- a/crypto/cms/cms_env.c ++++ b/crypto/cms/cms_env.c +@@ -14,6 +14,7 @@ + #include <openssl/err.h> + #include <openssl/cms.h> + #include <openssl/evp.h> ++#include <openssl/fips.h> + #include "internal/sizes.h" + #include "crypto/asn1.h" + #include "crypto/evp.h" +@@ -378,6 +379,10 @@ static int cms_RecipientInfo_ktri_init(CMS_RecipientInfo *ri, X509 *recip, + return 0; + if (EVP_PKEY_encrypt_init(ktri->pctx) <= 0) + return 0; ++ if (FIPS_mode()) { ++ if (EVP_PKEY_CTX_ctrl_str(ktri->pctx, "rsa_padding_mode", "oaep") <= 0) ++ return 0; ++ } + } else if (!ossl_cms_env_asn1_ctrl(ri, 0)) + return 0; + return 1; +@@ -543,6 +548,11 @@ static int cms_RecipientInfo_ktri_encrypt(const CMS_ContentInfo *cms, + + if (EVP_PKEY_encrypt_init(pctx) <= 0) + goto err; ++ ++ if (FIPS_mode()) { ++ if (EVP_PKEY_CTX_ctrl_str(pctx, "rsa_padding_mode", "oaep") <= 0) ++ goto err; ++ } + } + + if (EVP_PKEY_encrypt(pctx, NULL, &eklen, ec->key, ec->keylen) <= 0) +-- +2.44.0 + diff --git a/openssl.spec b/openssl.spec index 504e052..d0a1e41 100644 --- a/openssl.spec +++ b/openssl.spec @@ -29,7 +29,7 @@ print(string.sub(hash, 0, 16)) Summary: Utilities from the general purpose cryptography library with TLS implementation Name: openssl Version: 3.2.1 -Release: 4%{?dist} +Release: 5%{?dist} Epoch: 1 Source: openssl-%{version}.tar.gz Source2: Makefile.certificate @@ -99,7 +99,6 @@ Patch61: 0061-Deny-SHA-1-signature-verification-in-FIPS-provider.patch Patch62: 0062-fips-Expose-a-FIPS-indicator.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2102535 Patch73: 0073-FIPS-Use-OAEP-in-KATs-support-fixed-OAEP-seed.patch -# [PATCH 29/46] # 0074-FIPS-Use-digest_sign-digest_verify-in-self-test.patch Patch74: 0074-FIPS-Use-digest_sign-digest_verify-in-self-test.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2102535 @@ -114,13 +113,10 @@ Patch78: 0078-Add-FIPS-indicator-parameter-to-HKDF.patch # We believe that some changes present in CentOS are not necessary # because ustream has a check for FIPS version Patch80: 0080-rand-Forbid-truncated-hashes-SHA-3-in-FIPS-prov.patch -# [PATCH 36/46] # 0081-signature-Remove-X9.31-padding-from-FIPS-prov.patch Patch81: 0081-signature-Remove-X9.31-padding-from-FIPS-prov.patch -# [PATCH 37/46] # 0083-hmac-Add-explicit-FIPS-indicator-for-key-length.patch Patch83: 0083-hmac-Add-explicit-FIPS-indicator-for-key-length.patch -# [PATCH 38/46] # 0084-pbkdf2-Set-minimum-password-length-of-8-bytes.patch Patch84: 0084-pbkdf2-Set-minimum-password-length-of-8-bytes.patch # 0085-FIPS-RSA-disable-shake.patch @@ -129,13 +125,10 @@ Patch85: 0085-FIPS-RSA-disable-shake.patch Patch88: 0088-signature-Add-indicator-for-PSS-salt-length.patch # 0091-FIPS-RSA-encapsulate.patch Patch91: 0091-FIPS-RSA-encapsulate.patch -# [PATCH 42/46] # 0093-DH-Disable-FIPS-186-4-type-parameters-in-FIPS-mode.patch Patch93: 0093-DH-Disable-FIPS-186-4-type-parameters-in-FIPS-mode.patch -# [PATCH 43/46] # 0110-GCM-Implement-explicit-FIPS-indicator-for-IV-gen.patch Patch110: 0110-GCM-Implement-explicit-FIPS-indicator-for-IV-gen.patch -# [PATCH 44/46] # 0112-pbdkf2-Set-indicator-if-pkcs5-param-disabled-checks.patch Patch112: 0112-pbdkf2-Set-indicator-if-pkcs5-param-disabled-checks.patch # 0113-asymciphers-kem-Add-explicit-FIPS-indicator.patch @@ -143,7 +136,7 @@ Patch113: 0113-asymciphers-kem-Add-explicit-FIPS-indicator.patch # We believe that some changes present in CentOS are not necessary # because ustream has a check for FIPS version Patch114: 0114-FIPS-enforce-EMS-support.patch -# skip quic and pairwise tests temporarily +# Amend tests according to Fedora/RHEL code Patch115: 0115-skip-quic-pairwise.patch # Add version aliasing due to # https://github.com/openssl/openssl/issues/23534 @@ -154,6 +147,8 @@ Patch117: 0117-ignore-unknown-sigalgorithms-groups.patch Patch118: 0118-no-crl-memleak.patch # https://github.com/openssl/openssl/issues/22779 Patch119: 0119-provider-sigalgs-in-signaturealgorithms-conf.patch +# From CentOS 9 +Patch121: 0121-FIPS-cms-defaults.patch License: Apache-2.0 URL: http://www.openssl.org/ @@ -298,7 +293,7 @@ export HASHBANGPERL=/usr/bin/perl --system-ciphers-file=%{_sysconfdir}/crypto-policies/back-ends/openssl.config \ zlib enable-camellia enable-seed enable-rfc3779 enable-sctp \ enable-cms enable-md2 enable-rc5 ${ktlsopt} enable-fips -D_GNU_SOURCE \ - no-mdc2 no-ec2m no-sm2 no-sm4 enable-buildtest-c++ \ + no-mdc2 no-ec2m no-sm2 no-sm4 enable-buildtest-c++\ shared ${sslarch} $RPM_OPT_FLAGS '-DDEVRANDOM="\"/dev/urandom\"" -DREDHAT_FIPS_VERSION="\"%{fips}\""'\ -Wl,--allow-multiple-definition @@ -489,6 +484,10 @@ install -m644 %{SOURCE9} \ %ldconfig_scriptlets libs %changelog +* Thu Apr 04 2024 Dmitry Belyavskiy <dbelyavs(a)redhat.com> - 1:3.2.1-5 +- Restoring missing part of 0044- +- Backporting CMS FIPS defaults from CentOS 9 + * Mon Mar 25 2024 Sahana Prasad <sahana(a)redhat.com> - 1:3.2.1-4 - Add no-engine support. The previous commit was a mistake. commit b807fe8a6c2a140a4b3fd501c928c6b110679757 Author: Sahana Prasad <sahana(a)redhat.com> Date: Mon Mar 25 18:01:01 2024 +0100 Add no-engine support. The previous commit was a mistake Signed-off-by: Sahana Prasad <sahana(a)redhat.com> diff --git a/openssl.spec b/openssl.spec index 25293a9..504e052 100644 --- a/openssl.spec +++ b/openssl.spec @@ -29,7 +29,7 @@ print(string.sub(hash, 0, 16)) Summary: Utilities from the general purpose cryptography library with TLS implementation Name: openssl Version: 3.2.1 -Release: 4%{?dist}~no_engine +Release: 4%{?dist} Epoch: 1 Source: openssl-%{version}.tar.gz Source2: Makefile.certificate @@ -298,7 +298,7 @@ export HASHBANGPERL=/usr/bin/perl --system-ciphers-file=%{_sysconfdir}/crypto-policies/back-ends/openssl.config \ zlib enable-camellia enable-seed enable-rfc3779 enable-sctp \ enable-cms enable-md2 enable-rc5 ${ktlsopt} enable-fips -D_GNU_SOURCE \ - no-mdc2 no-ec2m no-sm2 no-sm4 enable-buildtest-c++ no-engine\ + no-mdc2 no-ec2m no-sm2 no-sm4 enable-buildtest-c++ \ shared ${sslarch} $RPM_OPT_FLAGS '-DDEVRANDOM="\"/dev/urandom\"" -DREDHAT_FIPS_VERSION="\"%{fips}\""'\ -Wl,--allow-multiple-definition @@ -489,6 +489,9 @@ install -m644 %{SOURCE9} \ %ldconfig_scriptlets libs %changelog +* Mon Mar 25 2024 Sahana Prasad <sahana(a)redhat.com> - 1:3.2.1-4 +- Add no-engine support. The previous commit was a mistake. + * Mon Mar 25 2024 Sahana Prasad <sahana(a)redhat.com> - 1:3.2.1-4 - Build OpenSSL with no-engine support commit 6f582b87ecc27b81d570ded4abcb07e3aae9e55c Author: Sahana Prasad <sahana(a)redhat.com> Date: Mon Mar 25 17:50:50 2024 +0100 Build OpenSSL with no-engine support Signed-off-by: Sahana Prasad <sahana(a)redhat.com> diff --git a/openssl.spec b/openssl.spec index 69c44ed..25293a9 100644 --- a/openssl.spec +++ b/openssl.spec @@ -29,7 +29,7 @@ print(string.sub(hash, 0, 16)) Summary: Utilities from the general purpose cryptography library with TLS implementation Name: openssl Version: 3.2.1 -Release: 3%{?dist} +Release: 4%{?dist}~no_engine Epoch: 1 Source: openssl-%{version}.tar.gz Source2: Makefile.certificate @@ -298,7 +298,7 @@ export HASHBANGPERL=/usr/bin/perl --system-ciphers-file=%{_sysconfdir}/crypto-policies/back-ends/openssl.config \ zlib enable-camellia enable-seed enable-rfc3779 enable-sctp \ enable-cms enable-md2 enable-rc5 ${ktlsopt} enable-fips -D_GNU_SOURCE \ - no-mdc2 no-ec2m no-sm2 no-sm4 enable-buildtest-c++\ + no-mdc2 no-ec2m no-sm2 no-sm4 enable-buildtest-c++ no-engine\ shared ${sslarch} $RPM_OPT_FLAGS '-DDEVRANDOM="\"/dev/urandom\"" -DREDHAT_FIPS_VERSION="\"%{fips}\""'\ -Wl,--allow-multiple-definition @@ -489,6 +489,9 @@ install -m644 %{SOURCE9} \ %ldconfig_scriptlets libs %changelog +* Mon Mar 25 2024 Sahana Prasad <sahana(a)redhat.com> - 1:3.2.1-4 +- Build OpenSSL with no-engine support + * Thu Mar 07 2024 Dmitry Belyavskiy <dbelyavs(a)redhat.com> - 1:3.2.1-3 - Minimize skipping tests - Allow ignoring unknown signature algorithms and groups (upstream #23050) commit b85bfec02173b16d9187f4ccf9bb47b662494c2b Author: Dmitry Belyavskiy <dbelyavs(a)redhat.com> Date: Fri Mar 8 13:46:42 2024 +0100 Regenerated patches from src-git diff --git a/0007-Add-support-for-PROFILE-SYSTEM-system-default-cipher.patch b/0007-Add-support-for-PROFILE-SYSTEM-system-default-cipher.patch index 425c158..3b3a772 100644 --- a/0007-Add-support-for-PROFILE-SYSTEM-system-default-cipher.patch +++ b/0007-Add-support-for-PROFILE-SYSTEM-system-default-cipher.patch @@ -1,30 +1,29 @@ -From 66b728801f141c9db8e647ab02421c83694ade79 Mon Sep 17 00:00:00 2001 +From 8be4ef77c64fcada41041c00e02c34b07658ba66 Mon Sep 17 00:00:00 2001 From: rpm-build <rpm-build> -Date: Mon, 31 Jul 2023 09:41:27 +0200 -Subject: [PATCH 07/35] +Date: Wed, 6 Mar 2024 19:17:14 +0100 +Subject: [PATCH 07/49] 0007-Add-support-for-PROFILE-SYSTEM-system-default-cipher.patch Patch-name: 0007-Add-support-for-PROFILE-SYSTEM-system-default-cipher.patch Patch-id: 7 Patch-status: | - # Add support for PROFILE=SYSTEM system default cipherlist -From-dist-git-commit: 9409bc7044cf4b5773639cce20f51399888c45fd + # # Add support for PROFILE=SYSTEM system default cipherlist +From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce --- Configurations/unix-Makefile.tmpl | 5 ++ Configure | 11 +++- doc/man1/openssl-ciphers.pod.in | 9 ++++ include/openssl/ssl.h.in | 5 ++ - ssl/ssl_ciph.c | 87 +++++++++++++++++++++++++++---- + ssl/ssl_ciph.c | 86 +++++++++++++++++++++++++++---- ssl/ssl_lib.c | 4 +- test/cipherlist_test.c | 2 + - util/libcrypto.num | 1 + - 8 files changed, 110 insertions(+), 14 deletions(-) + 7 files changed, 109 insertions(+), 13 deletions(-) diff --git a/Configurations/unix-Makefile.tmpl b/Configurations/unix-Makefile.tmpl -index f29cdc7f38..c0df026de3 100644 +index 5d61ce9550..e9fba957f1 100644 --- a/Configurations/unix-Makefile.tmpl +++ b/Configurations/unix-Makefile.tmpl -@@ -315,6 +315,10 @@ MANDIR=$(INSTALLTOP)/share/man +@@ -324,6 +324,10 @@ MANDIR=$(INSTALLTOP)/share/man DOCDIR=$(INSTALLTOP)/share/doc/$(BASENAME) HTMLDIR=$(DOCDIR)/html @@ -35,7 +34,7 @@ index f29cdc7f38..c0df026de3 100644 # MANSUFFIX is for the benefit of anyone who may want to have a suffix # appended after the manpage file section number. "ssl" is popular, # resulting in files such as config.5ssl rather than config.5. -@@ -338,6 +342,7 @@ CC=$(CROSS_COMPILE){- $config{CC} -} +@@ -347,6 +351,7 @@ CC=$(CROSS_COMPILE){- $config{CC} -} CXX={- $config{CXX} ? "\$(CROSS_COMPILE)$config{CXX}" : '' -} CPPFLAGS={- our $cppflags1 = join(" ", (map { "-D".$_} @{$config{CPPDEFINES}}), @@ -44,7 +43,7 @@ index f29cdc7f38..c0df026de3 100644 @{$config{CPPFLAGS}}) -} CFLAGS={- join(' ', @{$config{CFLAGS}}) -} diff --git a/Configure b/Configure -index 456995240b..93be83be94 100755 +index cca1ac8d16..2ae1cd0bc2 100755 --- a/Configure +++ b/Configure @@ -27,7 +27,7 @@ use OpenSSL::config; @@ -67,7 +66,7 @@ index 456995240b..93be83be94 100755 # --banner=".." Output specified text instead of default completion banner # # -w Don't wait after showing a Configure warning -@@ -387,6 +391,7 @@ $config{prefix}=""; +@@ -394,6 +398,7 @@ $config{prefix}=""; $config{openssldir}=""; $config{processor}=""; $config{libdir}=""; @@ -75,7 +74,7 @@ index 456995240b..93be83be94 100755 my $auto_threads=1; # enable threads automatically? true by default my $default_ranlib; -@@ -989,6 +994,10 @@ while (@argvcopy) +@@ -1047,6 +1052,10 @@ while (@argvcopy) die "FIPS key too long (64 bytes max)\n" if length $1 > 64; } @@ -87,10 +86,10 @@ index 456995240b..93be83be94 100755 { $banner = $1 . "\n"; diff --git a/doc/man1/openssl-ciphers.pod.in b/doc/man1/openssl-ciphers.pod.in -index 658730ec53..04e66bcebe 100644 +index d4df30686f..cec4835268 100644 --- a/doc/man1/openssl-ciphers.pod.in +++ b/doc/man1/openssl-ciphers.pod.in -@@ -186,6 +186,15 @@ As of OpenSSL 1.0.0, the B<ALL> cipher suites are sensibly ordered by default. +@@ -190,6 +190,15 @@ As of OpenSSL 1.0.0, the B<ALL> cipher suites are sensibly ordered by default. The cipher suites not enabled by B<ALL>, currently B<eNULL>. @@ -107,10 +106,10 @@ index 658730ec53..04e66bcebe 100644 "High" encryption cipher suites. This currently means those with key lengths diff --git a/include/openssl/ssl.h.in b/include/openssl/ssl.h.in -index f03f52fbd8..0b6de603e2 100644 +index 9f91039f8a..fc34d4ca61 100644 --- a/include/openssl/ssl.h.in +++ b/include/openssl/ssl.h.in -@@ -208,6 +208,11 @@ extern "C" { +@@ -209,6 +209,11 @@ extern "C" { * throwing out anonymous and unencrypted ciphersuites! (The latter are not * actually enabled by ALL, but "ALL:RSA" would enable some of them.) */ @@ -123,10 +122,10 @@ index f03f52fbd8..0b6de603e2 100644 /* Used in SSL_set_shutdown()/SSL_get_shutdown(); */ # define SSL_SENT_SHUTDOWN 1 diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c -index 93de9cf8fd..a5e60e8839 100644 +index 8360991ce4..33c23efb0d 100644 --- a/ssl/ssl_ciph.c +++ b/ssl/ssl_ciph.c -@@ -1443,6 +1443,53 @@ int SSL_set_ciphersuites(SSL *s, const char *str) +@@ -1455,6 +1455,53 @@ int SSL_set_ciphersuites(SSL *s, const char *str) return ret; } @@ -180,7 +179,7 @@ index 93de9cf8fd..a5e60e8839 100644 STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx, STACK_OF(SSL_CIPHER) *tls13_ciphersuites, STACK_OF(SSL_CIPHER) **cipher_list, -@@ -1457,15 +1504,25 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx, +@@ -1469,15 +1516,25 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx, CIPHER_ORDER *co_list = NULL, *head = NULL, *tail = NULL, *curr; const SSL_CIPHER **ca_list = NULL; const SSL_METHOD *ssl_method = ctx->method; @@ -208,7 +207,16 @@ index 93de9cf8fd..a5e60e8839 100644 /* * To reduce the work to do we only want to process the compiled -@@ -1553,8 +1610,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx, +@@ -1499,7 +1556,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx, + if (num_of_ciphers > 0) { + co_list = OPENSSL_malloc(sizeof(*co_list) * num_of_ciphers); + if (co_list == NULL) +- return NULL; /* Failure */ ++ goto err; + } + + ssl_cipher_collect_ciphers(ssl_method, num_of_ciphers, +@@ -1565,8 +1622,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx, * in force within each class */ if (!ssl_cipher_strength_sort(&head, &tail)) { @@ -218,7 +226,16 @@ index 93de9cf8fd..a5e60e8839 100644 } /* -@@ -1626,8 +1681,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx, +@@ -1611,7 +1667,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx, + ca_list = OPENSSL_malloc(sizeof(*ca_list) * num_of_alias_max); + if (ca_list == NULL) { + OPENSSL_free(co_list); +- return NULL; /* Failure */ ++ goto err; + } + ssl_cipher_collect_aliases(ca_list, num_of_group_aliases, + disabled_mkey, disabled_auth, disabled_enc, +@@ -1637,8 +1693,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx, OPENSSL_free(ca_list); /* Not needed anymore */ if (!ok) { /* Rule processing failure */ @@ -228,7 +245,7 @@ index 93de9cf8fd..a5e60e8839 100644 } /* -@@ -1635,10 +1689,13 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx, +@@ -1646,10 +1701,13 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx, * if we cannot get one. */ if ((cipherstack = sk_SSL_CIPHER_new_null()) == NULL) { @@ -244,7 +261,7 @@ index 93de9cf8fd..a5e60e8839 100644 /* Add TLSv1.3 ciphers first - we always prefer those if possible */ for (i = 0; i < sk_SSL_CIPHER_num(tls13_ciphersuites); i++) { const SSL_CIPHER *sslc = sk_SSL_CIPHER_value(tls13_ciphersuites, i); -@@ -1690,6 +1747,14 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx, +@@ -1701,6 +1759,14 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(SSL_CTX *ctx, *cipher_list = cipherstack; return cipherstack; @@ -260,10 +277,10 @@ index 93de9cf8fd..a5e60e8839 100644 char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len) diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c -index f12ad6d034..a059bcd83b 100644 +index cf59d2dfa5..1329841aaf 100644 --- a/ssl/ssl_lib.c +++ b/ssl/ssl_lib.c -@@ -661,7 +661,7 @@ int SSL_CTX_set_ssl_version(SSL_CTX *ctx, const SSL_METHOD *meth) +@@ -700,7 +700,7 @@ int SSL_CTX_set_ssl_version(SSL_CTX *ctx, const SSL_METHOD *meth) ctx->tls13_ciphersuites, &(ctx->cipher_list), &(ctx->cipher_list_by_id), @@ -272,7 +289,7 @@ index f12ad6d034..a059bcd83b 100644 if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= 0)) { ERR_raise(ERR_LIB_SSL, SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS); return 0; -@@ -3286,7 +3286,7 @@ SSL_CTX *SSL_CTX_new_ex(OSSL_LIB_CTX *libctx, const char *propq, +@@ -3966,7 +3966,7 @@ SSL_CTX *SSL_CTX_new_ex(OSSL_LIB_CTX *libctx, const char *propq, if (!ssl_create_cipher_list(ret, ret->tls13_ciphersuites, &ret->cipher_list, &ret->cipher_list_by_id, @@ -282,10 +299,10 @@ index f12ad6d034..a059bcd83b 100644 ERR_raise(ERR_LIB_SSL, SSL_R_LIBRARY_HAS_NO_CIPHERS); goto err; diff --git a/test/cipherlist_test.c b/test/cipherlist_test.c -index 2d166e2b46..4ff2aa12d6 100644 +index c46e431b00..19d05e860b 100644 --- a/test/cipherlist_test.c +++ b/test/cipherlist_test.c -@@ -246,7 +246,9 @@ end: +@@ -261,7 +261,9 @@ end: int setup_tests(void) { @@ -296,26 +313,5 @@ index 2d166e2b46..4ff2aa12d6 100644 ADD_TEST(test_default_cipherlist_clear); ADD_TEST(test_stdname_cipherlist); -- -2.41.0 +2.44.0 -diff -up openssl-3.2.0/ssl/ssl_ciph.c.7patch openssl-3.2.0/ssl/ssl_ciph.c ---- openssl-3.2.0/ssl/ssl_ciph.c.7patch 2023-11-30 13:43:03.510620566 +0100 -+++ openssl-3.2.0/ssl/ssl_ciph.c 2023-11-30 13:44:21.275313230 +0100 -@@ -1556,7 +1556,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_ - if (num_of_ciphers > 0) { - co_list = OPENSSL_malloc(sizeof(*co_list) * num_of_ciphers); - if (co_list == NULL) -- return NULL; /* Failure */ -+ goto err; - } - - ssl_cipher_collect_ciphers(ssl_method, num_of_ciphers, -@@ -1667,7 +1667,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_ - ca_list = OPENSSL_malloc(sizeof(*ca_list) * num_of_alias_max); - if (ca_list == NULL) { - OPENSSL_free(co_list); -- return NULL; /* Failure */ -+ goto err; - } - ssl_cipher_collect_aliases(ca_list, num_of_group_aliases, - disabled_mkey, disabled_auth, disabled_enc, diff --git a/0033-FIPS-embed-hmac.patch b/0033-FIPS-embed-hmac.patch index b5ebe99..6738304 100644 --- a/0033-FIPS-embed-hmac.patch +++ b/0033-FIPS-embed-hmac.patch @@ -1,30 +1,32 @@ -From e364a858262c8f563954544cc81e66f1b3b8db8c Mon Sep 17 00:00:00 2001 +From 831d0025257fd3746ab3fe30c05dbbfc0043f78e Mon Sep 17 00:00:00 2001 From: rpm-build <rpm-build> -Date: Thu, 19 Oct 2023 13:12:40 +0200 -Subject: [PATCH 16/46] 0033-FIPS-embed-hmac.patch +Date: Wed, 6 Mar 2024 19:17:15 +0100 +Subject: [PATCH 16/49] 0033-FIPS-embed-hmac.patch Patch-name: 0033-FIPS-embed-hmac.patch Patch-id: 33 Patch-status: | # # Embed HMAC into the fips.so -From-dist-git-commit: 5c67b5adc311af297f425c09e3e1ac7ca8483911 + # Modify fips self test as per + # https://github.com/simo5/openssl/commit/9b95ef8bd2f5ac862e5eee74c724b535f1a… +From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce --- - providers/fips/self_test.c | 70 ++++++++++++++++++++++++--- - test/fipsmodule.cnf | 2 + - test/recipes/00-prep_fipsmodule_cnf.t | 2 +- - test/recipes/01-test_fipsmodule_cnf.t | 2 +- - test/recipes/03-test_fipsinstall.t | 2 +- - test/recipes/30-test_defltfips.t | 2 +- - test/recipes/80-test_ssl_new.t | 2 +- - test/recipes/90-test_sslapi.t | 2 +- - 8 files changed, 71 insertions(+), 13 deletions(-) + providers/fips/self_test.c | 204 ++++++++++++++++++++++++-- + test/fipsmodule.cnf | 2 + + test/recipes/00-prep_fipsmodule_cnf.t | 2 +- + test/recipes/01-test_fipsmodule_cnf.t | 2 +- + test/recipes/03-test_fipsinstall.t | 2 +- + test/recipes/30-test_defltfips.t | 2 +- + test/recipes/80-test_ssl_new.t | 2 +- + test/recipes/90-test_sslapi.t | 2 +- + 8 files changed, 200 insertions(+), 18 deletions(-) create mode 100644 test/fipsmodule.cnf diff --git a/providers/fips/self_test.c b/providers/fips/self_test.c -index b8dc9817b2..e3a629018a 100644 +index b8dc9817b2..28f536d13c 100644 --- a/providers/fips/self_test.c +++ b/providers/fips/self_test.c -@@ -230,11 +230,27 @@ err: +@@ -230,11 +230,133 @@ err: return ok; } @@ -40,6 +42,7 @@ index b8dc9817b2..e3a629018a 100644 * the result matches the expected value. * Return 1 if verified, or 0 if it fails. */ ++ +#ifndef __USE_GNU +#define __USE_GNU +#include <dlfcn.h> @@ -48,11 +51,116 @@ index b8dc9817b2..e3a629018a 100644 +#include <dlfcn.h> +#endif +#include <link.h> ++ ++static int verify_integrity_rodata(OSSL_CORE_BIO *bio, ++ OSSL_FUNC_BIO_read_ex_fn read_ex_cb, ++ unsigned char *expected, size_t expected_len, ++ OSSL_LIB_CTX *libctx, OSSL_SELF_TEST *ev, ++ const char *event_type) ++{ ++ int ret = 0, status; ++ unsigned char out[MAX_MD_SIZE]; ++ unsigned char buf[INTEGRITY_BUF_SIZE]; ++ size_t bytes_read = 0, out_len = 0; ++ EVP_MAC *mac = NULL; ++ EVP_MAC_CTX *ctx = NULL; ++ OSSL_PARAM params[2], *p = params; ++ Dl_info info; ++ void *extra_info = NULL; ++ struct link_map *lm = NULL; ++ unsigned long paddr; ++ unsigned long off = 0; ++ ++ if (expected_len != HMAC_LEN) ++ goto err; ++ ++ if (!integrity_self_test(ev, libctx)) ++ goto err; ++ ++ OSSL_SELF_TEST_onbegin(ev, event_type, OSSL_SELF_TEST_DESC_INTEGRITY_HMAC); ++ ++ if (!dladdr1 ((const void *)fips_hmac_container, ++ &info, &extra_info, RTLD_DL_LINKMAP)) ++ goto err; ++ lm = extra_info; ++ paddr = (unsigned long)fips_hmac_container - lm->l_addr; ++ ++ mac = EVP_MAC_fetch(libctx, MAC_NAME, NULL); ++ if (mac == NULL) ++ goto err; ++ ctx = EVP_MAC_CTX_new(mac); ++ if (ctx == NULL) ++ goto err; ++ ++ *p++ = OSSL_PARAM_construct_utf8_string("digest", DIGEST_NAME, 0); ++ *p = OSSL_PARAM_construct_end(); ++ ++ if (!EVP_MAC_init(ctx, fixed_key, sizeof(fixed_key), params)) ++ goto err; ++ ++ while ((off + INTEGRITY_BUF_SIZE) <= paddr) { ++ status = read_ex_cb(bio, buf, INTEGRITY_BUF_SIZE, &bytes_read); ++ if (status != 1) ++ break; ++ if (!EVP_MAC_update(ctx, buf, bytes_read)) ++ goto err; ++ off += bytes_read; ++ } ++ ++ if (off < paddr) { ++ int delta = paddr - off; ++ status = read_ex_cb(bio, buf, delta, &bytes_read); ++ if (status != 1) ++ goto err; ++ if (!EVP_MAC_update(ctx, buf, bytes_read)) ++ goto err; ++ off += bytes_read; ++ } ++ ++ /* read away the buffer */ ++ status = read_ex_cb(bio, buf, HMAC_LEN, &bytes_read); ++ if (status != 1) ++ goto err; ++ ++ /* check that it is the expect bytes, no point in continuing otherwise */ ++ if (memcmp(expected, buf, HMAC_LEN) != 0) ++ goto err; ++ ++ /* replace in-file HMAC buffer with the original zeros */ ++ memset(buf, 0, HMAC_LEN); ++ if (!EVP_MAC_update(ctx, buf, HMAC_LEN)) ++ goto err; ++ off += HMAC_LEN; ++ ++ while (bytes_read > 0) { ++ status = read_ex_cb(bio, buf, INTEGRITY_BUF_SIZE, &bytes_read); ++ if (status != 1) ++ break; ++ if (!EVP_MAC_update(ctx, buf, bytes_read)) ++ goto err; ++ off += bytes_read; ++ } ++ ++ if (!EVP_MAC_final(ctx, out, &out_len, sizeof(out))) ++ goto err; ++ ++ OSSL_SELF_TEST_oncorrupt_byte(ev, out); ++ if (expected_len != out_len ++ || memcmp(expected, out, out_len) != 0) ++ goto err; ++ ret = 1; ++err: ++ OPENSSL_cleanse(out, MAX_MD_SIZE); ++ OSSL_SELF_TEST_onend(ev, ret); ++ EVP_MAC_CTX_free(ctx); ++ EVP_MAC_free(mac); ++ return ret; ++} + static int verify_integrity(OSSL_CORE_BIO *bio, OSSL_FUNC_BIO_read_ex_fn read_ex_cb, unsigned char *expected, size_t expected_len, OSSL_LIB_CTX *libctx, OSSL_SELF_TEST *ev, -@@ -247,12 +263,23 @@ static int verify_integrity(OSSL_CORE_BIO *bio, OSSL_FUNC_BIO_read_ex_fn read_ex +@@ -247,12 +369,23 @@ static int verify_integrity(OSSL_CORE_BIO *bio, OSSL_FUNC_BIO_read_ex_fn read_ex EVP_MAC *mac = NULL; EVP_MAC_CTX *ctx = NULL; OSSL_PARAM params[2], *p = params; @@ -76,7 +184,7 @@ index b8dc9817b2..e3a629018a 100644 mac = EVP_MAC_fetch(libctx, MAC_NAME, NULL); if (mac == NULL) goto err; -@@ -266,13 +293,42 @@ static int verify_integrity(OSSL_CORE_BIO *bio, OSSL_FUNC_BIO_read_ex_fn read_ex +@@ -266,13 +399,42 @@ static int verify_integrity(OSSL_CORE_BIO *bio, OSSL_FUNC_BIO_read_ex_fn read_ex if (!EVP_MAC_init(ctx, fixed_key, sizeof(fixed_key), params)) goto err; @@ -84,12 +192,12 @@ index b8dc9817b2..e3a629018a 100644 - status = read_ex_cb(bio, buf, sizeof(buf), &bytes_read); + while ((off + INTEGRITY_BUF_SIZE) <= paddr) { + status = read_ex_cb(bio, buf, INTEGRITY_BUF_SIZE, &bytes_read); -+ if (status != 1) -+ break; -+ if (!EVP_MAC_update(ctx, buf, bytes_read)) -+ goto err; + if (status != 1) + break; + if (!EVP_MAC_update(ctx, buf, bytes_read)) + goto err; + off += bytes_read; -+ } + } + + if (off + INTEGRITY_BUF_SIZE > paddr) { + int delta = paddr - off; @@ -111,17 +219,17 @@ index b8dc9817b2..e3a629018a 100644 + + while (bytes_read > 0) { + status = read_ex_cb(bio, buf, INTEGRITY_BUF_SIZE, &bytes_read); - if (status != 1) - break; - if (!EVP_MAC_update(ctx, buf, bytes_read)) - goto err; ++ if (status != 1) ++ break; ++ if (!EVP_MAC_update(ctx, buf, bytes_read)) ++ goto err; + off += bytes_read; - } ++ } + if (!EVP_MAC_final(ctx, out, &out_len, sizeof(out))) goto err; -@@ -282,6 +338,7 @@ static int verify_integrity(OSSL_CORE_BIO *bio, OSSL_FUNC_BIO_read_ex_fn read_ex +@@ -282,6 +444,7 @@ static int verify_integrity(OSSL_CORE_BIO *bio, OSSL_FUNC_BIO_read_ex_fn read_ex goto err; ret = 1; err: @@ -129,7 +237,7 @@ index b8dc9817b2..e3a629018a 100644 OSSL_SELF_TEST_onend(ev, ret); EVP_MAC_CTX_free(ctx); EVP_MAC_free(mac); -@@ -335,8 +392,7 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, int on_demand_test) +@@ -335,8 +498,7 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, int on_demand_test) return 0; } @@ -139,19 +247,57 @@ index b8dc9817b2..e3a629018a 100644 ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_CONFIG_DATA); goto end; } -@@ -345,8 +401,9 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, int on_demand_test) +@@ -345,8 +507,14 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, int on_demand_test) if (ev == NULL) goto end; - module_checksum = OPENSSL_hexstr2buf(st->module_checksum_data, - &checksum_len); -+ module_checksum = fips_hmac_container; -+ checksum_len = sizeof(fips_hmac_container); ++ if (st->module_checksum_data == NULL) { ++ module_checksum = fips_hmac_container; ++ checksum_len = sizeof(fips_hmac_container); ++ } else { ++ module_checksum = OPENSSL_hexstr2buf(st->module_checksum_data, ++ &checksum_len); ++ } + if (module_checksum == NULL) { ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_CONFIG_DATA); goto end; -@@ -420,7 +477,6 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, int on_demand_test) +@@ -354,14 +522,27 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, int on_demand_test) + bio_module = (*st->bio_new_file_cb)(st->module_filename, "rb"); + + /* Always check the integrity of the fips module */ +- if (bio_module == NULL +- || !verify_integrity(bio_module, st->bio_read_ex_cb, +- module_checksum, checksum_len, st->libctx, +- ev, OSSL_SELF_TEST_TYPE_MODULE_INTEGRITY)) { ++ if (bio_module == NULL) { + ERR_raise(ERR_LIB_PROV, PROV_R_MODULE_INTEGRITY_FAILURE); + goto end; + } +- ++ if (st->module_checksum_data == NULL) { ++ if (!verify_integrity_rodata(bio_module, st->bio_read_ex_cb, ++ module_checksum, checksum_len, ++ st->libctx, ev, ++ OSSL_SELF_TEST_TYPE_MODULE_INTEGRITY)) { ++ ERR_raise(ERR_LIB_PROV, PROV_R_MODULE_INTEGRITY_FAILURE); ++ goto end; ++ } ++ } else { ++ if (!verify_integrity(bio_module, st->bio_read_ex_cb, ++ module_checksum, checksum_len, ++ st->libctx, ev, ++ OSSL_SELF_TEST_TYPE_MODULE_INTEGRITY)) { ++ ERR_raise(ERR_LIB_PROV, PROV_R_MODULE_INTEGRITY_FAILURE); ++ goto end; ++ } ++ } + /* This will be NULL during installation - so the self test KATS will run */ + if (st->indicator_data != NULL) { + /* +@@ -420,7 +601,6 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS *st, int on_demand_test) end: EVP_RAND_free(testrand); OSSL_SELF_TEST_free(ev); @@ -220,7 +366,7 @@ index c8f145405b..56a2ec5dc4 100644 plan tests => ($no_fips ? 1 : 5); diff --git a/test/recipes/80-test_ssl_new.t b/test/recipes/80-test_ssl_new.t -index 0c6d6402d9..e45f9cb560 100644 +index 195b85ea8c..92d48dbf7d 100644 --- a/test/recipes/80-test_ssl_new.t +++ b/test/recipes/80-test_ssl_new.t @@ -27,7 +27,7 @@ setup("test_ssl_new"); @@ -233,7 +379,7 @@ index 0c6d6402d9..e45f9cb560 100644 $ENV{TEST_CERTS_DIR} = srctop_dir("test", "certs"); diff --git a/test/recipes/90-test_sslapi.t b/test/recipes/90-test_sslapi.t -index 9e9e32b51e..1a1a7159b5 100644 +index 18d9f3d204..71780d8caa 100644 --- a/test/recipes/90-test_sslapi.t +++ b/test/recipes/90-test_sslapi.t @@ -17,7 +17,7 @@ setup("test_sslapi"); @@ -246,183 +392,5 @@ index 9e9e32b51e..1a1a7159b5 100644 my $fipsmodcfg = bldtop_file("test", $fipsmodcfg_filename); -- -2.41.0 +2.44.0 -diff -up openssl-3.2.0/providers/fips/self_test.c.fix-self-test openssl-3.2.0/providers/fips/self_test.c ---- openssl-3.2.0/providers/fips/self_test.c.fix-self-test 2024-02-01 17:36:27.970983419 +0100 -+++ openssl-3.2.0/providers/fips/self_test.c 2024-02-01 17:39:19.788685051 +0100 -@@ -242,6 +242,7 @@ static const unsigned char __attribute__ - * the result matches the expected value. - * Return 1 if verified, or 0 if it fails. - */ -+ - #ifndef __USE_GNU - #define __USE_GNU - #include <dlfcn.h> -@@ -251,6 +252,111 @@ static const unsigned char __attribute__ - #endif - #include <link.h> - -+static int verify_integrity_rodata(OSSL_CORE_BIO *bio, -+ OSSL_FUNC_BIO_read_ex_fn read_ex_cb, -+ unsigned char *expected, size_t expected_len, -+ OSSL_LIB_CTX *libctx, OSSL_SELF_TEST *ev, -+ const char *event_type) -+{ -+ int ret = 0, status; -+ unsigned char out[MAX_MD_SIZE]; -+ unsigned char buf[INTEGRITY_BUF_SIZE]; -+ size_t bytes_read = 0, out_len = 0; -+ EVP_MAC *mac = NULL; -+ EVP_MAC_CTX *ctx = NULL; -+ OSSL_PARAM params[2], *p = params; -+ Dl_info info; -+ void *extra_info = NULL; -+ struct link_map *lm = NULL; -+ unsigned long paddr; -+ unsigned long off = 0; -+ -+ if (expected_len != HMAC_LEN) -+ goto err; -+ -+ if (!integrity_self_test(ev, libctx)) -+ goto err; -+ -+ OSSL_SELF_TEST_onbegin(ev, event_type, OSSL_SELF_TEST_DESC_INTEGRITY_HMAC); -+ -+ if (!dladdr1 ((const void *)fips_hmac_container, -+ &info, &extra_info, RTLD_DL_LINKMAP)) -+ goto err; -+ lm = extra_info; -+ paddr = (unsigned long)fips_hmac_container - lm->l_addr; -+ -+ mac = EVP_MAC_fetch(libctx, MAC_NAME, NULL); -+ if (mac == NULL) -+ goto err; -+ ctx = EVP_MAC_CTX_new(mac); -+ if (ctx == NULL) -+ goto err; -+ -+ *p++ = OSSL_PARAM_construct_utf8_string("digest", DIGEST_NAME, 0); -+ *p = OSSL_PARAM_construct_end(); -+ -+ if (!EVP_MAC_init(ctx, fixed_key, sizeof(fixed_key), params)) -+ goto err; -+ -+ while ((off + INTEGRITY_BUF_SIZE) <= paddr) { -+ status = read_ex_cb(bio, buf, INTEGRITY_BUF_SIZE, &bytes_read); -+ if (status != 1) -+ break; -+ if (!EVP_MAC_update(ctx, buf, bytes_read)) -+ goto err; -+ off += bytes_read; -+ } -+ -+ if (off < paddr) { -+ int delta = paddr - off; -+ status = read_ex_cb(bio, buf, delta, &bytes_read); -+ if (status != 1) -+ goto err; -+ if (!EVP_MAC_update(ctx, buf, bytes_read)) -+ goto err; -+ off += bytes_read; -+ } -+ -+ /* read away the buffer */ -+ status = read_ex_cb(bio, buf, HMAC_LEN, &bytes_read); -+ if (status != 1) -+ goto err; -+ -+ /* check that it is the expect bytes, no point in continuing otherwise */ -+ if (memcmp(expected, buf, HMAC_LEN) != 0) -+ goto err; -+ -+ /* replace in-file HMAC buffer with the original zeros */ -+ memset(buf, 0, HMAC_LEN); -+ if (!EVP_MAC_update(ctx, buf, HMAC_LEN)) -+ goto err; -+ off += HMAC_LEN; -+ -+ while (bytes_read > 0) { -+ status = read_ex_cb(bio, buf, INTEGRITY_BUF_SIZE, &bytes_read); -+ if (status != 1) -+ break; -+ if (!EVP_MAC_update(ctx, buf, bytes_read)) -+ goto err; -+ off += bytes_read; -+ } -+ -+ if (!EVP_MAC_final(ctx, out, &out_len, sizeof(out))) -+ goto err; -+ -+ OSSL_SELF_TEST_oncorrupt_byte(ev, out); -+ if (expected_len != out_len -+ || memcmp(expected, out, out_len) != 0) -+ goto err; -+ ret = 1; -+err: -+ OPENSSL_cleanse(out, MAX_MD_SIZE); -+ OSSL_SELF_TEST_onend(ev, ret); -+ EVP_MAC_CTX_free(ctx); -+ EVP_MAC_free(mac); -+ return ret; -+} -+ - static int verify_integrity(OSSL_CORE_BIO *bio, OSSL_FUNC_BIO_read_ex_fn read_ex_cb, - unsigned char *expected, size_t expected_len, - OSSL_LIB_CTX *libctx, OSSL_SELF_TEST *ev, -diff -up openssl-3.2.0/providers/fips/self_test.c.fix-self-test openssl-3.2.0/providers/fips/self_test.c ---- openssl-3.2.0/providers/fips/self_test.c.fix-self-test 2024-02-01 17:40:54.926627242 +0100 -+++ openssl-3.2.0/providers/fips/self_test.c 2024-02-01 17:45:58.939636676 +0100 -@@ -527,14 +527,27 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS - bio_module = (*st->bio_new_file_cb)(st->module_filename, "rb"); - - /* Always check the integrity of the fips module */ -- if (bio_module == NULL -- || !verify_integrity(bio_module, st->bio_read_ex_cb, -- module_checksum, checksum_len, st->libctx, -- ev, OSSL_SELF_TEST_TYPE_MODULE_INTEGRITY)) { -+ if (bio_module == NULL) { - ERR_raise(ERR_LIB_PROV, PROV_R_MODULE_INTEGRITY_FAILURE); - goto end; - } -- -+ if (st->module_checksum_data == NULL) { -+ if (!verify_integrity_rodata(bio_module, st->bio_read_ex_cb, -+ module_checksum, checksum_len, -+ st->libctx, ev, -+ OSSL_SELF_TEST_TYPE_MODULE_INTEGRITY)) { -+ ERR_raise(ERR_LIB_PROV, PROV_R_MODULE_INTEGRITY_FAILURE); -+ goto end; -+ } -+ } else { -+ if (!verify_integrity(bio_module, st->bio_read_ex_cb, -+ module_checksum, checksum_len, -+ st->libctx, ev, -+ OSSL_SELF_TEST_TYPE_MODULE_INTEGRITY)) { -+ ERR_raise(ERR_LIB_PROV, PROV_R_MODULE_INTEGRITY_FAILURE); -+ goto end; -+ } -+ } - /* This will be NULL during installation - so the self test KATS will run */ - if (st->indicator_data != NULL) { - /* -diff -up openssl-3.2.0/providers/fips/self_test.c.fips-self openssl-3.2.0/providers/fips/self_test.c ---- openssl-3.2.0/providers/fips/self_test.c.fips-self 2024-02-06 12:20:56.963719115 +0100 -+++ openssl-3.2.0/providers/fips/self_test.c 2024-02-06 12:22:23.705604045 +0100 -@@ -517,8 +517,13 @@ int SELF_TEST_post(SELF_TEST_POST_PARAMS - if (ev == NULL) - goto end; - -- module_checksum = fips_hmac_container; -- checksum_len = sizeof(fips_hmac_container); -+ if (st->module_checksum_data == NULL) { -+ module_checksum = fips_hmac_container; -+ checksum_len = sizeof(fips_hmac_container); -+ } else { -+ module_checksum = OPENSSL_hexstr2buf(st->module_checksum_data, -+ &checksum_len); -+ } - - if (module_checksum == NULL) { - ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_CONFIG_DATA); diff --git a/0045-FIPS-services-minimize.patch b/0045-FIPS-services-minimize.patch index befa23b..117e6b2 100644 --- a/0045-FIPS-services-minimize.patch +++ b/0045-FIPS-services-minimize.patch @@ -1,12 +1,13 @@ -From a9dc983f82cabe29d6b48f3af3e30e26074ce5cf Mon Sep 17 00:00:00 2001 -From: Dmitry Belyavskiy <dbelyavs(a)redhat.com> -Date: Mon, 21 Aug 2023 12:55:57 +0200 -Subject: [PATCH 21/48] 0045-FIPS-services-minimize.patch +From e25b25227043a2b2cf156527c31d7686a4265bf3 Mon Sep 17 00:00:00 2001 +From: rpm-build <rpm-build> +Date: Wed, 6 Mar 2024 19:17:15 +0100 +Subject: [PATCH 20/49] 0045-FIPS-services-minimize.patch Patch-name: 0045-FIPS-services-minimize.patch Patch-id: 45 Patch-status: | - # Minimize fips services + # # Minimize fips services +From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce --- apps/ecparam.c | 7 +++ apps/req.c | 2 +- @@ -20,14 +21,14 @@ Patch-status: | test/evp_libctx_test.c | 9 +++- test/recipes/15-test_gendsa.t | 2 +- test/recipes/20-test_cli_fips.t | 3 +- - test/recipes/30-test_evp.t | 16 +++---- + test/recipes/30-test_evp.t | 20 ++++----- .../30-test_evp_data/evpmac_common.txt | 22 ++++++++++ test/recipes/80-test_cms.t | 22 +++++----- test/recipes/80-test_ssl_old.t | 2 +- - 16 files changed, 128 insertions(+), 47 deletions(-) + 16 files changed, 128 insertions(+), 51 deletions(-) diff --git a/apps/ecparam.c b/apps/ecparam.c -index 9e9ad13683..9c66cf2434 100644 +index 71f93c4ca5..347bf62d5c 100644 --- a/apps/ecparam.c +++ b/apps/ecparam.c @@ -79,6 +79,13 @@ static int list_builtin_curves(BIO *out) @@ -45,10 +46,10 @@ index 9e9ad13683..9c66cf2434 100644 comment = "CURVE DESCRIPTION NOT AVAILABLE"; if (sname == NULL) diff --git a/apps/req.c b/apps/req.c -index 23757044ab..5916914978 100644 +index 8995453dca..cb38e6aa64 100644 --- a/apps/req.c +++ b/apps/req.c -@@ -266,7 +266,7 @@ int req_main(int argc, char **argv) +@@ -268,7 +268,7 @@ int req_main(int argc, char **argv) unsigned long chtype = MBSTRING_ASC, reqflag = 0; #ifndef OPENSSL_NO_DES @@ -58,10 +59,10 @@ index 23757044ab..5916914978 100644 opt_set_unknown_name("digest"); diff --git a/providers/common/capabilities.c b/providers/common/capabilities.c -index ed37e76969..eb836dfa6a 100644 +index f7234615e4..0d4c0e3388 100644 --- a/providers/common/capabilities.c +++ b/providers/common/capabilities.c -@@ -186,9 +186,9 @@ static const OSSL_PARAM param_group_list[][10] = { +@@ -189,9 +189,9 @@ static const OSSL_PARAM param_group_list[][10] = { TLS_GROUP_ENTRY("brainpoolP256r1", "brainpoolP256r1", "EC", 25), TLS_GROUP_ENTRY("brainpoolP384r1", "brainpoolP384r1", "EC", 26), TLS_GROUP_ENTRY("brainpoolP512r1", "brainpoolP512r1", "EC", 27), @@ -73,7 +74,7 @@ index ed37e76969..eb836dfa6a 100644 TLS_GROUP_ENTRY("brainpoolP256r1tls13", "brainpoolP256r1", "EC", 30), TLS_GROUP_ENTRY("brainpoolP384r1tls13", "brainpoolP384r1", "EC", 31), diff --git a/providers/fips/fipsprov.c b/providers/fips/fipsprov.c -index 518226dfc6..29438faea8 100644 +index 7ec409710b..ec5bdd5a69 100644 --- a/providers/fips/fipsprov.c +++ b/providers/fips/fipsprov.c @@ -199,13 +199,13 @@ static int fips_get_params(void *provctx, OSSL_PARAM params[]) @@ -131,7 +132,7 @@ index 518226dfc6..29438faea8 100644 { NULL, NULL, NULL } }; -@@ -409,8 +412,9 @@ static const OSSL_ALGORITHM fips_keyexch[] = { +@@ -410,8 +413,9 @@ static const OSSL_ALGORITHM fips_keyexch[] = { #ifndef OPENSSL_NO_EC { PROV_NAMES_ECDH, FIPS_DEFAULT_PROPERTIES, ossl_ecdh_keyexch_functions }, # ifndef OPENSSL_NO_ECX @@ -143,7 +144,27 @@ index 518226dfc6..29438faea8 100644 # endif #endif { PROV_NAMES_TLS1_PRF, FIPS_DEFAULT_PROPERTIES, -@@ -456,8 +462,9 @@ static const OSSL_ALGORITHM fips_keymgmt[] = { +@@ -422,14 +426,16 @@ static const OSSL_ALGORITHM fips_keyexch[] = { + + static const OSSL_ALGORITHM fips_signature[] = { + #ifndef OPENSSL_NO_DSA +- { PROV_NAMES_DSA, FIPS_DEFAULT_PROPERTIES, ossl_dsa_signature_functions }, ++ /* We don't certify DSA in our FIPS provider */ ++ /* { PROV_NAMES_DSA, FIPS_DEFAULT_PROPERTIES, ossl_dsa_signature_functions },*/ + #endif + { PROV_NAMES_RSA, FIPS_DEFAULT_PROPERTIES, ossl_rsa_signature_functions }, + #ifndef OPENSSL_NO_EC + # ifndef OPENSSL_NO_ECX +- { PROV_NAMES_ED25519, FIPS_UNAPPROVED_PROPERTIES, ++ /* We don't certify Edwards curves in our FIPS provider */ ++ /* { PROV_NAMES_ED25519, FIPS_UNAPPROVED_PROPERTIES, + ossl_ed25519_signature_functions }, +- { PROV_NAMES_ED448, FIPS_UNAPPROVED_PROPERTIES, ossl_ed448_signature_functions }, ++ { PROV_NAMES_ED448, FIPS_UNAPPROVED_PROPERTIES, ossl_ed448_signature_functions },*/ + # endif + { PROV_NAMES_ECDSA, FIPS_DEFAULT_PROPERTIES, ossl_ecdsa_signature_functions }, + #endif +@@ -460,8 +466,9 @@ static const OSSL_ALGORITHM fips_keymgmt[] = { PROV_DESCS_DHX }, #endif #ifndef OPENSSL_NO_DSA @@ -155,7 +176,7 @@ index 518226dfc6..29438faea8 100644 #endif { PROV_NAMES_RSA, FIPS_DEFAULT_PROPERTIES, ossl_rsa_keymgmt_functions, PROV_DESCS_RSA }, -@@ -466,14 +473,15 @@ static const OSSL_ALGORITHM fips_keymgmt[] = { +@@ -471,14 +478,15 @@ static const OSSL_ALGORITHM fips_keymgmt[] = { { PROV_NAMES_EC, FIPS_DEFAULT_PROPERTIES, ossl_ec_keymgmt_functions, PROV_DESCS_EC }, # ifndef OPENSSL_NO_ECX @@ -230,10 +251,10 @@ index 2057378d3d..4b80bb70b9 100644 static const ST_KAT_ASYM_CIPHER st_kat_asym_cipher_tests[] = { diff --git a/providers/implementations/signature/rsa_sig.c b/providers/implementations/signature/rsa_sig.c -index d4261e8f7d..2a5504d104 100644 +index 22d93ead53..c1405f47ea 100644 --- a/providers/implementations/signature/rsa_sig.c +++ b/providers/implementations/signature/rsa_sig.c -@@ -689,6 +689,19 @@ static int rsa_verify_recover(void *vprsactx, +@@ -686,6 +686,19 @@ static int rsa_verify_recover(void *vprsactx, { PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx; int ret; @@ -253,7 +274,7 @@ index d4261e8f7d..2a5504d104 100644 if (!ossl_prov_is_running()) return 0; -@@ -777,6 +790,19 @@ static int rsa_verify(void *vprsactx, const unsigned char *sig, size_t siglen, +@@ -774,6 +787,19 @@ static int rsa_verify(void *vprsactx, const unsigned char *sig, size_t siglen, { PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx; size_t rslen; @@ -274,7 +295,7 @@ index d4261e8f7d..2a5504d104 100644 if (!ossl_prov_is_running()) return 0; diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c -index a5e60e8839..f9af07d12b 100644 +index 33c23efb0d..113c204716 100644 --- a/ssl/ssl_ciph.c +++ b/ssl/ssl_ciph.c @@ -356,6 +356,9 @@ int ssl_load_ciphers(SSL_CTX *ctx) @@ -288,10 +309,10 @@ index a5e60e8839..f9af07d12b 100644 * We ignore any errors from the fetches below. They are expected to fail * if these algorithms are not available. diff --git a/test/acvp_test.c b/test/acvp_test.c -index fee880d441..13d7a0ea8b 100644 +index 45509095af..4a67519bb4 100644 --- a/test/acvp_test.c +++ b/test/acvp_test.c -@@ -1476,6 +1476,7 @@ int setup_tests(void) +@@ -1478,6 +1478,7 @@ int setup_tests(void) OSSL_NELEM(dh_safe_prime_keyver_data)); #endif /* OPENSSL_NO_DH */ @@ -299,7 +320,7 @@ index fee880d441..13d7a0ea8b 100644 #ifndef OPENSSL_NO_DSA ADD_ALL_TESTS(dsa_keygen_test, OSSL_NELEM(dsa_keygen_data)); ADD_ALL_TESTS(dsa_paramgen_test, OSSL_NELEM(dsa_paramgen_data)); -@@ -1483,6 +1484,7 @@ int setup_tests(void) +@@ -1485,6 +1486,7 @@ int setup_tests(void) ADD_ALL_TESTS(dsa_siggen_test, OSSL_NELEM(dsa_siggen_data)); ADD_ALL_TESTS(dsa_sigver_test, OSSL_NELEM(dsa_sigver_data)); #endif /* OPENSSL_NO_DSA */ @@ -308,10 +329,10 @@ index fee880d441..13d7a0ea8b 100644 #ifndef OPENSSL_NO_EC ADD_ALL_TESTS(ecdsa_keygen_test, OSSL_NELEM(ecdsa_keygen_data)); diff --git a/test/endecode_test.c b/test/endecode_test.c -index 9a437d8c64..53385028fc 100644 +index b53b7b715b..885e49a47c 100644 --- a/test/endecode_test.c +++ b/test/endecode_test.c -@@ -1407,6 +1407,7 @@ int setup_tests(void) +@@ -1419,6 +1419,7 @@ int setup_tests(void) * so no legacy tests. */ #endif @@ -319,7 +340,7 @@ index 9a437d8c64..53385028fc 100644 #ifndef OPENSSL_NO_DSA ADD_TEST_SUITE(DSA); ADD_TEST_SUITE_PARAMS(DSA); -@@ -1417,6 +1418,7 @@ int setup_tests(void) +@@ -1429,6 +1430,7 @@ int setup_tests(void) ADD_TEST_SUITE_PROTECTED_PVK(DSA); # endif #endif @@ -327,7 +348,7 @@ index 9a437d8c64..53385028fc 100644 #ifndef OPENSSL_NO_EC ADD_TEST_SUITE(EC); ADD_TEST_SUITE_PARAMS(EC); -@@ -1431,10 +1433,12 @@ int setup_tests(void) +@@ -1443,10 +1445,12 @@ int setup_tests(void) ADD_TEST_SUITE(ECExplicitTri2G); ADD_TEST_SUITE_LEGACY(ECExplicitTri2G); # endif @@ -375,7 +396,7 @@ index 2448c35a14..a7913cda4c 100644 return 1; } diff --git a/test/recipes/15-test_gendsa.t b/test/recipes/15-test_gendsa.t -index b495b08bda..69bd299521 100644 +index 4bc460784b..93052eb3e7 100644 --- a/test/recipes/15-test_gendsa.t +++ b/test/recipes/15-test_gendsa.t @@ -24,7 +24,7 @@ use lib bldtop_dir('.'); @@ -388,10 +409,10 @@ index b495b08bda..69bd299521 100644 plan tests => ($no_fips ? 0 : 2) # FIPS related tests diff --git a/test/recipes/20-test_cli_fips.t b/test/recipes/20-test_cli_fips.t -index 6d3c5ba1bb..2ba47b5fca 100644 +index d4b4d4ca51..031814e8ff 100644 --- a/test/recipes/20-test_cli_fips.t +++ b/test/recipes/20-test_cli_fips.t -@@ -273,8 +273,7 @@ SKIP: { +@@ -278,8 +278,7 @@ SKIP: { } SKIP : { @@ -402,10 +423,10 @@ index 6d3c5ba1bb..2ba47b5fca 100644 subtest DSA => sub { my $testtext_prefix = 'DSA'; diff --git a/test/recipes/30-test_evp.t b/test/recipes/30-test_evp.t -index 9d7040ced2..f8beb538d4 100644 +index eddca5c58e..36a192d041 100644 --- a/test/recipes/30-test_evp.t +++ b/test/recipes/30-test_evp.t -@@ -42,10 +42,8 @@ my @files = qw( +@@ -46,10 +46,8 @@ my @files = qw( evpciph_aes_cts.txt evpciph_aes_wrap.txt evpciph_aes_stitched.txt @@ -416,7 +437,23 @@ index 9d7040ced2..f8beb538d4 100644 evpkdf_pbkdf1.txt evpkdf_pbkdf2.txt evpkdf_ss.txt -@@ -91,6 +83,7 @@ my @defltfiles = qw( +@@ -69,15 +67,6 @@ push @files, qw( + evppkey_ffdhe.txt + evppkey_dh.txt + ) unless $no_dh; +-push @files, qw( +- evpkdf_x942_des.txt +- evpmac_cmac_des.txt +- ) unless $no_des; +-push @files, qw(evppkey_dsa.txt) unless $no_dsa; +-push @files, qw( +- evppkey_ecx.txt +- evppkey_mismatch_ecx.txt +- ) unless $no_ecx; + push @files, qw( + evppkey_ecc.txt + evppkey_ecdh.txt +@@ -97,6 +86,7 @@ my @defltfiles = qw( evpciph_cast5.txt evpciph_chacha.txt evpciph_des.txt @@ -424,7 +461,7 @@ index 9d7040ced2..f8beb538d4 100644 evpciph_idea.txt evpciph_rc2.txt evpciph_rc4.txt -@@ -114,10 +107,17 @@ my @defltfiles = qw( +@@ -121,13 +111,19 @@ my @defltfiles = qw( evpmd_whirlpool.txt evppbe_scrypt.txt evppbe_pkcs12.txt @@ -441,12 +478,15 @@ index 9d7040ced2..f8beb538d4 100644 + ) unless $no_des; push @defltfiles, qw(evppkey_brainpool.txt) unless $no_ec; push @defltfiles, qw(evppkey_ecdsa_rfc6979.txt) unless $no_ec; - push @defltfiles, qw(evppkey_dsa_rfc6979.txt) unless $no_dsa; +-push @defltfiles, qw(evppkey_dsa_rfc6979.txt) unless $no_dsa; + push @defltfiles, qw(evppkey_sm2.txt) unless $no_sm2; + push @defltfiles, qw(evpciph_aes_gcm_siv.txt) unless $no_siv; + push @defltfiles, qw(evpciph_aes_siv.txt) unless $no_siv; diff --git a/test/recipes/30-test_evp_data/evpmac_common.txt b/test/recipes/30-test_evp_data/evpmac_common.txt -index 93195df97c..315413cd9b 100644 +index e47023aae6..96a8febeef 100644 --- a/test/recipes/30-test_evp_data/evpmac_common.txt +++ b/test/recipes/30-test_evp_data/evpmac_common.txt -@@ -340,6 +340,7 @@ IV = 7AE8E2CA4EC500012E58495C +@@ -363,6 +363,7 @@ IV = 7AE8E2CA4EC500012E58495C Input = 68F2E77696CE7AE8E2CA4EC588E541002E58495C08000F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D0007 Result = MAC_INIT_ERROR @@ -454,7 +494,7 @@ index 93195df97c..315413cd9b 100644 Title = KMAC Tests (From NIST) MAC = KMAC128 Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F -@@ -350,12 +351,14 @@ Ctrl = xof:0 +@@ -373,12 +374,14 @@ Ctrl = xof:0 OutputSize = 32 BlockSize = 168 @@ -469,7 +509,7 @@ index 93195df97c..315413cd9b 100644 MAC = KMAC128 Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F Input = 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7 -@@ -363,6 +366,7 @@ Custom = "My Tagged Application" +@@ -386,6 +389,7 @@ Custom = "My Tagged Application" Output = 1F5B4E6CCA02209E0DCB5CA635B89A15E271ECC760071DFD805FAA38F9729230 Ctrl = size:32 @@ -477,7 +517,7 @@ index 93195df97c..315413cd9b 100644 MAC = KMAC256 Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F Input = 00010203 -@@ -371,12 +375,14 @@ Output = 20C570C31346F703C9AC36C61C03CB64C3970D0CFC787E9B79599D273A68D2F7F69D4CC +@@ -394,12 +398,14 @@ Output = 20C570C31346F703C9AC36C61C03CB64C3970D0CFC787E9B79599D273A68D2F7F69D4CC OutputSize = 64 BlockSize = 136 @@ -492,7 +532,7 @@ index 93195df97c..315413cd9b 100644 MAC = KMAC256 Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F Input = 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7 -@@ -386,12 +392,14 @@ Ctrl = size:64 +@@ -409,12 +415,14 @@ Ctrl = size:64 Title = KMAC XOF Tests (From NIST) @@ -507,7 +547,7 @@ index 93195df97c..315413cd9b 100644 MAC = KMAC128 Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F Input = 00010203 -@@ -399,6 +407,7 @@ Custom = "My Tagged Application" +@@ -422,6 +430,7 @@ Custom = "My Tagged Application" Output = 31A44527B4ED9F5C6101D11DE6D26F0620AA5C341DEF41299657FE9DF1A3B16C XOF = 1 @@ -515,7 +555,7 @@ index 93195df97c..315413cd9b 100644 MAC = KMAC128 Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F Input = 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7 -@@ -407,6 +416,7 @@ Output = 47026C7CD793084AA0283C253EF658490C0DB61438B8326FE9BDDF281B83AE0F +@@ -430,6 +439,7 @@ Output = 47026C7CD793084AA0283C253EF658490C0DB61438B8326FE9BDDF281B83AE0F XOF = 1 Ctrl = size:32 @@ -523,7 +563,7 @@ index 93195df97c..315413cd9b 100644 MAC = KMAC256 Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F Input = 00010203 -@@ -414,6 +424,7 @@ Custom = "My Tagged Application" +@@ -437,6 +447,7 @@ Custom = "My Tagged Application" Output = 1755133F1534752AAD0748F2C706FB5C784512CAB835CD15676B16C0C6647FA96FAA7AF634A0BF8FF6DF39374FA00FAD9A39E322A7C92065A64EB1FB0801EB2B XOF = 1 @@ -531,7 +571,7 @@ index 93195df97c..315413cd9b 100644 MAC = KMAC256 Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F Input = 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7 -@@ -421,6 +432,7 @@ Custom = "" +@@ -444,6 +455,7 @@ Custom = "" Output = FF7B171F1E8A2B24683EED37830EE797538BA8DC563F6DA1E667391A75EDC02CA633079F81CE12A25F45615EC89972031D18337331D24CEB8F8CA8E6A19FD98B XOF = 1 @@ -539,7 +579,7 @@ index 93195df97c..315413cd9b 100644 MAC = KMAC256 Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F Input = 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7 -@@ -431,6 +443,7 @@ XOF = 1 +@@ -454,6 +466,7 @@ XOF = 1 Title = KMAC long customisation string (from NIST ACVP) @@ -547,7 +587,7 @@ index 93195df97c..315413cd9b 100644 MAC = KMAC256 Key = 9743DBF93102FAF11227B154B8ACD16CF142671F7AA16C559A393A38B4CEF461ED29A6A328D7379C99718790E38B54CA25E9E831CBEA463EE704D1689F94629AB795DF0C77F756DA743309C0E054596BA2D9CC1768ACF7CD351D9A7EB1ABD0A3 Input = BA63AC9C711F143CCE7FF92D0322649D1BE437D805FD225C0A2879A008373EC3BCCDB09971FAD2BCE5F4347AF7E5238EF01A90ED34193D6AFC1D -@@ -441,12 +454,14 @@ XOF = 1 +@@ -464,12 +477,14 @@ XOF = 1 Title = KMAC XOF Tests via ctrl (From NIST) @@ -562,7 +602,7 @@ index 93195df97c..315413cd9b 100644 MAC = KMAC128 Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F Input = 00010203 -@@ -454,6 +469,7 @@ Custom = "My Tagged Application" +@@ -477,6 +492,7 @@ Custom = "My Tagged Application" Output = 31A44527B4ED9F5C6101D11DE6D26F0620AA5C341DEF41299657FE9DF1A3B16C Ctrl = xof:1 @@ -570,7 +610,7 @@ index 93195df97c..315413cd9b 100644 MAC = KMAC128 Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F Input = 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7 -@@ -462,6 +478,7 @@ Output = 47026C7CD793084AA0283C253EF658490C0DB61438B8326FE9BDDF281B83AE0F +@@ -485,6 +501,7 @@ Output = 47026C7CD793084AA0283C253EF658490C0DB61438B8326FE9BDDF281B83AE0F Ctrl = xof:1 Ctrl = size:32 @@ -578,7 +618,7 @@ index 93195df97c..315413cd9b 100644 MAC = KMAC256 Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F Input = 00010203 -@@ -469,6 +486,7 @@ Custom = "My Tagged Application" +@@ -492,6 +509,7 @@ Custom = "My Tagged Application" Output = 1755133F1534752AAD0748F2C706FB5C784512CAB835CD15676B16C0C6647FA96FAA7AF634A0BF8FF6DF39374FA00FAD9A39E322A7C92065A64EB1FB0801EB2B Ctrl = xof:1 @@ -586,7 +626,7 @@ index 93195df97c..315413cd9b 100644 MAC = KMAC256 Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F Input = 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7 -@@ -476,6 +494,7 @@ Custom = "" +@@ -499,6 +517,7 @@ Custom = "" Output = FF7B171F1E8A2B24683EED37830EE797538BA8DC563F6DA1E667391A75EDC02CA633079F81CE12A25F45615EC89972031D18337331D24CEB8F8CA8E6A19FD98B Ctrl = xof:1 @@ -594,7 +634,7 @@ index 93195df97c..315413cd9b 100644 MAC = KMAC256 Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F Input = 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7 -@@ -486,6 +505,7 @@ Ctrl = xof:1 +@@ -509,6 +528,7 @@ Ctrl = xof:1 Title = KMAC long customisation string via ctrl (from NIST ACVP) @@ -602,7 +642,7 @@ index 93195df97c..315413cd9b 100644 MAC = KMAC256 Key = 9743DBF93102FAF11227B154B8ACD16CF142671F7AA16C559A393A38B4CEF461ED29A6A328D7379C99718790E38B54CA25E9E831CBEA463EE704D1689F94629AB795DF0C77F756DA743309C0E054596BA2D9CC1768ACF7CD351D9A7EB1ABD0A3 Input = BA63AC9C711F143CCE7FF92D0322649D1BE437D805FD225C0A2879A008373EC3BCCDB09971FAD2BCE5F4347AF7E5238EF01A90ED34193D6AFC1D -@@ -496,6 +516,7 @@ Ctrl = xof:1 +@@ -519,6 +539,7 @@ Ctrl = xof:1 Title = KMAC long customisation string negative test @@ -610,7 +650,7 @@ index 93195df97c..315413cd9b 100644 MAC = KMAC128 Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F Input = 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7 -@@ -504,6 +525,7 @@ Result = MAC_INIT_ERROR +@@ -527,6 +548,7 @@ Result = MAC_INIT_ERROR Title = KMAC output is too large @@ -619,7 +659,7 @@ index 93195df97c..315413cd9b 100644 Key = 404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F Input = 000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7 diff --git a/test/recipes/80-test_cms.t b/test/recipes/80-test_cms.t -index 40dd585c18..cbec426137 100644 +index 6a9792128b..4e368c730b 100644 --- a/test/recipes/80-test_cms.t +++ b/test/recipes/80-test_cms.t @@ -96,7 +96,7 @@ my @smime_pkcs7_tests = ( @@ -694,7 +734,7 @@ index 40dd585c18..cbec426137 100644 [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-signer", $smrsa1, "-signer", catfile($smdir, "smrsa2.pem"), -@@ -248,7 +248,7 @@ my @smime_pkcs7_tests = ( +@@ -250,7 +250,7 @@ my @smime_pkcs7_tests = ( my @smime_cms_tests = ( @@ -703,7 +743,7 @@ index 40dd585c18..cbec426137 100644 [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "DER", "-nodetach", "-keyid", "-signer", $smrsa1, -@@ -261,7 +261,7 @@ my @smime_cms_tests = ( +@@ -263,7 +263,7 @@ my @smime_cms_tests = ( \&final_compare ], @@ -712,7 +752,7 @@ index 40dd585c18..cbec426137 100644 [ "{cmd1}", @prov, "-sign", "-in", $smcont, "-outform", "PEM", "-nodetach", "-signer", $smrsa1, "-signer", catfile($smdir, "smrsa2.pem"), -@@ -371,7 +371,7 @@ my @smime_cms_tests = ( +@@ -373,7 +373,7 @@ my @smime_cms_tests = ( \&final_compare ], @@ -735,58 +775,5 @@ index 50b74a1e29..e2dcb68fb5 100644 } -- -2.41.0 +2.44.0 -diff -up openssl-3.2.0/test/recipes/30-test_evp.t.patch openssl-3.2.0/test/recipes/30-test_evp.t ---- openssl-3.2.0/test/recipes/30-test_evp.t.patch 2023-12-06 15:33:27.843751147 +0100 -+++ openssl-3.2.0/test/recipes/30-test_evp.t 2023-12-06 15:34:27.585351920 +0100 -@@ -70,15 +70,6 @@ push @files, qw( - evppkey_dh.txt - ) unless $no_dh; - push @files, qw( -- evpkdf_x942_des.txt -- evpmac_cmac_des.txt -- ) unless $no_des; --push @files, qw(evppkey_dsa.txt) unless $no_dsa; --push @files, qw( -- evppkey_ecx.txt -- evppkey_mismatch_ecx.txt -- ) unless $no_ecx; --push @files, qw( - evppkey_ecc.txt - evppkey_ecdh.txt - evppkey_ecdsa.txt -diff -up openssl-3.2.0/providers/fips/fipsprov.c.patch-fips openssl-3.2.0/providers/fips/fipsprov.c ---- openssl-3.2.0/providers/fips/fipsprov.c.patch-fips 2023-12-06 15:49:08.711198219 +0100 -+++ openssl-3.2.0/providers/fips/fipsprov.c 2023-12-06 15:55:42.362078721 +0100 -@@ -426,14 +426,16 @@ static const OSSL_ALGORITHM fips_keyexch - - static const OSSL_ALGORITHM fips_signature[] = { - #ifndef OPENSSL_NO_DSA -- { PROV_NAMES_DSA, FIPS_DEFAULT_PROPERTIES, ossl_dsa_signature_functions }, -+ /* We don't certify DSA in our FIPS provider */ -+ /* { PROV_NAMES_DSA, FIPS_DEFAULT_PROPERTIES, ossl_dsa_signature_functions },*/ - #endif - { PROV_NAMES_RSA, FIPS_DEFAULT_PROPERTIES, ossl_rsa_signature_functions }, - #ifndef OPENSSL_NO_EC - # ifndef OPENSSL_NO_ECX -- { PROV_NAMES_ED25519, FIPS_UNAPPROVED_PROPERTIES, -+ /* We don't certify Edwards curves in our FIPS provider */ -+ /* { PROV_NAMES_ED25519, FIPS_UNAPPROVED_PROPERTIES, - ossl_ed25519_signature_functions }, -- { PROV_NAMES_ED448, FIPS_UNAPPROVED_PROPERTIES, ossl_ed448_signature_functions }, -+ { PROV_NAMES_ED448, FIPS_UNAPPROVED_PROPERTIES, ossl_ed448_signature_functions },*/ - # endif - { PROV_NAMES_ECDSA, FIPS_DEFAULT_PROPERTIES, ossl_ecdsa_signature_functions }, - #endif -diff -up openssl-3.2.0/test/recipes/30-test_evp.t.fips-min openssl-3.2.0/test/recipes/30-test_evp.t ---- openssl-3.2.0/test/recipes/30-test_evp.t.fips-min 2024-02-01 11:00:56.823687618 +0100 -+++ openssl-3.2.0/test/recipes/30-test_evp.t 2024-02-01 11:01:20.131934678 +0100 -@@ -124,7 +124,6 @@ push @defltfiles, qw( - ) unless $no_des; - push @defltfiles, qw(evppkey_brainpool.txt) unless $no_ec; - push @defltfiles, qw(evppkey_ecdsa_rfc6979.txt) unless $no_ec; --push @defltfiles, qw(evppkey_dsa_rfc6979.txt) unless $no_dsa; - push @defltfiles, qw(evppkey_sm2.txt) unless $no_sm2; - push @defltfiles, qw(evpciph_aes_gcm_siv.txt) unless $no_siv; - push @defltfiles, qw(evpciph_aes_siv.txt) unless $no_siv; diff --git a/0049-Allow-disabling-of-SHA1-signatures.patch b/0049-Allow-disabling-of-SHA1-signatures.patch index 7aa410e..655691b 100644 --- a/0049-Allow-disabling-of-SHA1-signatures.patch +++ b/0049-Allow-disabling-of-SHA1-signatures.patch @@ -1,13 +1,13 @@ -From 2e8388e06eafb703aeb315498915bf079561bdb5 Mon Sep 17 00:00:00 2001 -From: Dmitry Belyavskiy <dbelyavs(a)redhat.com> -Date: Mon, 21 Aug 2023 13:07:07 +0200 -Subject: [PATCH 23/48] 0049-Allow-disabling-of-SHA1-signatures.patch +From 4f9167db05cade673f98f1a00efd57136e97b460 Mon Sep 17 00:00:00 2001 +From: rpm-build <rpm-build> +Date: Wed, 6 Mar 2024 19:17:15 +0100 +Subject: [PATCH 22/49] 0049-Allow-disabling-of-SHA1-signatures.patch Patch-name: 0049-Allow-disabling-of-SHA1-signatures.patch Patch-id: 49 Patch-status: | - # Selectively disallow SHA1 signatures rhbz#2070977 -From-dist-git-commit: 9409bc7044cf4b5773639cce20f51399888c45fd + # # Selectively disallow SHA1 signatures rhbz#2070977 +From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce --- crypto/context.c | 14 ++++ crypto/evp/evp_cnf.c | 13 +++ @@ -27,10 +27,10 @@ From-dist-git-commit: 9409bc7044cf4b5773639cce20f51399888c45fd 15 files changed, 209 insertions(+), 9 deletions(-) diff --git a/crypto/context.c b/crypto/context.c -index 51002ba79a..e697974c9d 100644 +index fb4816d89b..c04920fe14 100644 --- a/crypto/context.c +++ b/crypto/context.c -@@ -78,6 +78,8 @@ struct ossl_lib_ctx_st { +@@ -83,6 +83,8 @@ struct ossl_lib_ctx_st { void *fips_prov; #endif @@ -39,7 +39,7 @@ index 51002ba79a..e697974c9d 100644 unsigned int ischild:1; }; -@@ -206,6 +208,10 @@ static int context_init(OSSL_LIB_CTX *ctx) +@@ -223,6 +225,10 @@ static int context_init(OSSL_LIB_CTX *ctx) goto err; #endif @@ -50,7 +50,7 @@ index 51002ba79a..e697974c9d 100644 /* Low priority. */ #ifndef FIPS_MODULE ctx->child_provider = ossl_child_prov_ctx_new(ctx); -@@ -334,6 +340,11 @@ static void context_deinit_objs(OSSL_LIB_CTX *ctx) +@@ -366,6 +372,11 @@ static void context_deinit_objs(OSSL_LIB_CTX *ctx) } #endif @@ -62,7 +62,7 @@ index 51002ba79a..e697974c9d 100644 /* Low priority. */ #ifndef FIPS_MODULE if (ctx->child_provider != NULL) { -@@ -625,6 +636,9 @@ void *ossl_lib_ctx_get_data(OSSL_LIB_CTX *ctx, int index) +@@ -663,6 +674,9 @@ void *ossl_lib_ctx_get_data(OSSL_LIB_CTX *ctx, int index) return ctx->fips_prov; #endif @@ -104,7 +104,7 @@ index 0e7fe64cf9..b9d3b6d226 100644 ERR_raise_data(ERR_LIB_EVP, EVP_R_UNKNOWN_OPTION, "name=%s, value=%s", oval->name, oval->value); diff --git a/crypto/evp/m_sigver.c b/crypto/evp/m_sigver.c -index 630d339c35..6e4e9f5ae7 100644 +index 3a979f4bd4..fd3a4b79df 100644 --- a/crypto/evp/m_sigver.c +++ b/crypto/evp/m_sigver.c @@ -15,6 +15,73 @@ @@ -181,7 +181,7 @@ index 630d339c35..6e4e9f5ae7 100644 #ifndef FIPS_MODULE -@@ -251,6 +318,18 @@ static int do_sigver_init(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, +@@ -253,6 +320,18 @@ static int do_sigver_init(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, } } @@ -201,7 +201,7 @@ index 630d339c35..6e4e9f5ae7 100644 if (signature->digest_verify_init == NULL) { ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR); diff --git a/crypto/evp/pmeth_lib.c b/crypto/evp/pmeth_lib.c -index ce6e1a1ccb..003926247b 100644 +index 268b1617e3..248f655d0f 100644 --- a/crypto/evp/pmeth_lib.c +++ b/crypto/evp/pmeth_lib.c @@ -33,6 +33,7 @@ @@ -212,7 +212,7 @@ index ce6e1a1ccb..003926247b 100644 #include "evp_local.h" #ifndef FIPS_MODULE -@@ -958,6 +959,20 @@ static int evp_pkey_ctx_set_md(EVP_PKEY_CTX *ctx, const EVP_MD *md, +@@ -951,6 +952,20 @@ static int evp_pkey_ctx_set_md(EVP_PKEY_CTX *ctx, const EVP_MD *md, return -2; } @@ -258,10 +258,10 @@ index bd05736220..ed34ff4b9c 100644 The value is a boolean that can be B<yes> or B<no>. If the value is diff --git a/include/crypto/context.h b/include/crypto/context.h -index cc06c71be8..e9f74a414d 100644 +index 7369a730fb..55b74238c8 100644 --- a/include/crypto/context.h +++ b/include/crypto/context.h -@@ -39,3 +39,6 @@ void ossl_rand_crng_ctx_free(void *); +@@ -46,3 +46,6 @@ void ossl_release_default_drbg_ctx(void); #if defined(OPENSSL_THREADS) void ossl_threads_ctx_free(void *); #endif @@ -269,10 +269,10 @@ index cc06c71be8..e9f74a414d 100644 +void *ossl_ctx_legacy_digest_signatures_new(OSSL_LIB_CTX *); +void ossl_ctx_legacy_digest_signatures_free(void *); diff --git a/include/internal/cryptlib.h b/include/internal/cryptlib.h -index ac50eb3bbd..3b115cc7df 100644 +index 64851fd8ed..8e01a77ddc 100644 --- a/include/internal/cryptlib.h +++ b/include/internal/cryptlib.h -@@ -168,7 +168,8 @@ typedef struct ossl_ex_data_global_st { +@@ -117,7 +117,8 @@ typedef struct ossl_ex_data_global_st { # define OSSL_LIB_CTX_CHILD_PROVIDER_INDEX 18 # define OSSL_LIB_CTX_THREAD_INDEX 19 # define OSSL_LIB_CTX_DECODER_CACHE_INDEX 20 @@ -296,7 +296,7 @@ index fd7f7e3331..05464b0655 100644 + int loadconfig); #endif diff --git a/providers/common/securitycheck.c b/providers/common/securitycheck.c -index 699ada7c52..e534ad0a5f 100644 +index 0d3acdbe56..fe694c4e96 100644 --- a/providers/common/securitycheck.c +++ b/providers/common/securitycheck.c @@ -19,6 +19,7 @@ @@ -307,7 +307,7 @@ index 699ada7c52..e534ad0a5f 100644 /* * FIPS requires a minimum security strength of 112 bits (for encryption or -@@ -235,6 +236,15 @@ int ossl_digest_get_approved_nid_with_sha1(OSSL_LIB_CTX *ctx, const EVP_MD *md, +@@ -243,6 +244,15 @@ int ossl_digest_get_approved_nid_with_sha1(OSSL_LIB_CTX *ctx, const EVP_MD *md, mdnid = -1; /* disallowed by security checks */ } # endif /* OPENSSL_NO_FIPS_SECURITYCHECKS */ @@ -323,7 +323,7 @@ index 699ada7c52..e534ad0a5f 100644 return mdnid; } -@@ -244,5 +254,15 @@ int ossl_digest_is_allowed(OSSL_LIB_CTX *ctx, const EVP_MD *md) +@@ -252,5 +262,15 @@ int ossl_digest_is_allowed(OSSL_LIB_CTX *ctx, const EVP_MD *md) if (ossl_securitycheck_enabled(ctx)) return ossl_digest_get_approved_nid(md) != NID_undef; # endif /* OPENSSL_NO_FIPS_SECURITYCHECKS */ @@ -377,10 +377,10 @@ index 246323493e..2ca7a59f39 100644 return mdnid; } diff --git a/providers/implementations/signature/dsa_sig.c b/providers/implementations/signature/dsa_sig.c -index 70d0ea5d24..3c482e0181 100644 +index b89a0f6836..e0c26a13e4 100644 --- a/providers/implementations/signature/dsa_sig.c +++ b/providers/implementations/signature/dsa_sig.c -@@ -123,12 +123,17 @@ static int dsa_setup_md(PROV_DSA_CTX *ctx, +@@ -125,12 +125,17 @@ static int dsa_setup_md(PROV_DSA_CTX *ctx, mdprops = ctx->propq; if (mdname != NULL) { @@ -402,10 +402,10 @@ index 70d0ea5d24..3c482e0181 100644 if (md == NULL || md_nid < 0) { if (md == NULL) diff --git a/providers/implementations/signature/ecdsa_sig.c b/providers/implementations/signature/ecdsa_sig.c -index ebeb30e002..c874f87bd5 100644 +index f158105e71..62355b89fe 100644 --- a/providers/implementations/signature/ecdsa_sig.c +++ b/providers/implementations/signature/ecdsa_sig.c -@@ -237,7 +237,11 @@ static int ecdsa_setup_md(PROV_ECDSA_CTX *ctx, const char *mdname, +@@ -247,7 +247,11 @@ static int ecdsa_setup_md(PROV_ECDSA_CTX *ctx, const char *mdname, "%s could not be fetched", mdname); return 0; } @@ -418,7 +418,7 @@ index ebeb30e002..c874f87bd5 100644 sha1_allowed); if (md_nid < 0) { diff --git a/providers/implementations/signature/rsa_sig.c b/providers/implementations/signature/rsa_sig.c -index 2a5504d104..5f3a029566 100644 +index c1405f47ea..aeda1a7758 100644 --- a/providers/implementations/signature/rsa_sig.c +++ b/providers/implementations/signature/rsa_sig.c @@ -25,6 +25,7 @@ @@ -437,7 +437,7 @@ index 2a5504d104..5f3a029566 100644 OSSL_FUNC_signature_newctx_fn rsa_newctx; static OSSL_FUNC_signature_sign_init_fn rsa_sign_init; -@@ -302,10 +304,15 @@ static int rsa_setup_md(PROV_RSA_CTX *ctx, const char *mdname, +@@ -301,10 +303,15 @@ static int rsa_setup_md(PROV_RSA_CTX *ctx, const char *mdname, if (mdname != NULL) { EVP_MD *md = EVP_MD_fetch(ctx->libctx, mdname, mdprops); @@ -455,7 +455,7 @@ index 2a5504d104..5f3a029566 100644 if (md == NULL || md_nid <= 0 -@@ -1396,8 +1403,15 @@ static int rsa_set_ctx_params(void *vprsactx, const OSSL_PARAM params[]) +@@ -1392,8 +1399,15 @@ static int rsa_set_ctx_params(void *vprsactx, const OSSL_PARAM params[]) prsactx->pad_mode = pad_mode; if (prsactx->md == NULL && pmdname == NULL @@ -472,22 +472,10 @@ index 2a5504d104..5f3a029566 100644 if (pmgf1mdname != NULL && !rsa_setup_mgf1_md(prsactx, pmgf1mdname, pmgf1mdprops)) -diff --git a/util/libcrypto.num b/util/libcrypto.num -index 9cb8a4dda2..feb660d030 100644 ---- a/util/libcrypto.num -+++ b/util/libcrypto.num -@@ -5436,3 +5436,5 @@ EVP_CIPHER_CTX_dup 5563 3_1_0 EXIST::FUNCTION: - X509_STORE_CTX_set_current_reasons 5664 3_2_0 EXIST::FUNCTION: - OSSL_STORE_delete 5665 3_2_0 EXIST::FUNCTION: - BIO_ADDR_copy 5666 3_2_0 EXIST::FUNCTION:SOCK -+ossl_ctx_legacy_digest_signatures_allowed ? 3_0_1 EXIST::FUNCTION: -+ossl_ctx_legacy_digest_signatures_allowed_set ? 3_0_1 EXIST::FUNCTION: --- -2.41.0 - -diff -up openssl-3.2.0/ssl/t1_lib.c.patch-sha1 openssl-3.2.0/ssl/t1_lib.c ---- openssl-3.2.0/ssl/t1_lib.c.patch-sha1 2023-12-08 13:01:44.752501257 +0100 -+++ openssl-3.2.0/ssl/t1_lib.c 2023-12-08 13:04:18.969899853 +0100 +diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c +index 631e1fdef9..05dd7c5595 100644 +--- a/ssl/t1_lib.c ++++ b/ssl/t1_lib.c @@ -20,6 +20,7 @@ #include <openssl/bn.h> #include <openssl/provider.h> @@ -524,3 +512,16 @@ diff -up openssl-3.2.0/ssl/t1_lib.c.patch-sha1 openssl-3.2.0/ssl/t1_lib.c if (!EVP_PKEY_set_type(tmpkey, lu->sig)) { cache[i].enabled = 0; +diff --git a/util/libcrypto.num b/util/libcrypto.num +index ef97803327..8046454025 100644 +--- a/util/libcrypto.num ++++ b/util/libcrypto.num +@@ -5536,3 +5536,5 @@ X509_STORE_CTX_set_get_crl 5663 3_2_0 EXIST::FUNCTION: + X509_STORE_CTX_set_current_reasons 5664 3_2_0 EXIST::FUNCTION: + OSSL_STORE_delete 5665 3_2_0 EXIST::FUNCTION: + BIO_ADDR_copy 5666 3_2_0 EXIST::FUNCTION:SOCK ++ossl_ctx_legacy_digest_signatures_allowed ? 3_0_1 EXIST::FUNCTION: ++ossl_ctx_legacy_digest_signatures_allowed_set ? 3_0_1 EXIST::FUNCTION: +-- +2.44.0 + diff --git a/0052-Allow-SHA1-in-seclevel-1-if-rh-allow-sha1-signatures.patch b/0052-Allow-SHA1-in-seclevel-1-if-rh-allow-sha1-signatures.patch index a147d8e..33f79ce 100644 --- a/0052-Allow-SHA1-in-seclevel-1-if-rh-allow-sha1-signatures.patch +++ b/0052-Allow-SHA1-in-seclevel-1-if-rh-allow-sha1-signatures.patch @@ -1,30 +1,14 @@ -From f470b130139919f32926b3f5a75ba4d161cbcf88 Mon Sep 17 00:00:00 2001 -From: Clemens Lang <cllang(a)redhat.com> -Date: Tue, 1 Mar 2022 15:44:18 +0100 -Subject: [PATCH 2/2] Allow SHA1 in seclevel 1 if rh-allow-sha1-signatures = - yes +From 1fba75a6203d3ea2037d2fc2e1846f1b514c3d1d Mon Sep 17 00:00:00 2001 +From: rpm-build <rpm-build> +Date: Wed, 6 Mar 2024 19:17:15 +0100 +Subject: [PATCH 23/49] + 0052-Allow-SHA1-in-seclevel-1-if-rh-allow-sha1-signatures.patch -NOTE: This patch is ported from CentOS 9 / RHEL 9, where it allows SHA1 -in seclevel 2 if rh-allow-sha1-signatures = yes. This was chosen because -on CentOS 9 and RHEL 9, the LEGACY crypto policy sets the security level -to 2. - -On Fedora 35 (with OpenSSL 1.1) the legacy crypto policy uses security -level 1. Because Fedora 36 supports both OpenSSL 1.1 and OpenSSL 3, and -we want the legacy crypto policy to allow SHA-1 in TLS, the only option -to make this happen consistently in both OpenSSL 1.1 and OpenSSL 3 is -SECLEVEL=1 (which will allow SHA-1 in OpenSSL 1.1) and this change to -allow SHA-1 in SECLEVEL=1 with rh-allow-sha1-signatures = yes (which -will allow SHA-1 in OpenSSL 3). - -The change from CentOS 9 / RHEL 9 cannot be applied unmodified, because -rh-allow-sha1-signatures will default to yes in Fedora (according to our -current plans including until F38), and the security level in the -DEFAULT crypto policy is 2, i.e., the unmodified change would weaken the -default configuration. - -Related: rhbz#2055796 -Related: rhbz#2070977 +Patch-name: 0052-Allow-SHA1-in-seclevel-1-if-rh-allow-sha1-signatures.patch +Patch-id: 52 +Patch-status: | + # # Support SHA1 in TLS in LEGACY crypto-policy (which is SECLEVEL=1) +From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce --- crypto/x509/x509_vfy.c | 20 ++++++++++- doc/man5/config.pod | 7 ++++ @@ -33,7 +17,7 @@ Related: rhbz#2070977 4 files changed, 82 insertions(+), 16 deletions(-) diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c -index 2f175ca517..bf0c608839 100644 +index 1794c14e99..1dfbe58a4a 100644 --- a/crypto/x509/x509_vfy.c +++ b/crypto/x509/x509_vfy.c @@ -25,6 +25,7 @@ @@ -44,7 +28,7 @@ index 2f175ca517..bf0c608839 100644 #include "crypto/x509.h" #include "x509_local.h" -@@ -3441,14 +3442,31 @@ static int check_sig_level(X509_STORE_CTX *ctx, X509 *cert) +@@ -3668,14 +3669,31 @@ static int check_sig_level(X509_STORE_CTX *ctx, X509 *cert) { int secbits = -1; int level = ctx->param->auth_level; @@ -78,10 +62,10 @@ index 2f175ca517..bf0c608839 100644 return secbits >= minbits_table[level - 1]; } diff --git a/doc/man5/config.pod b/doc/man5/config.pod -index 0c9110d28a..e0516d20b8 100644 +index ed34ff4b9c..8ab5456c99 100644 --- a/doc/man5/config.pod +++ b/doc/man5/config.pod -@@ -309,6 +309,13 @@ this option is set to B<no>. Because TLS 1.1 or lower use MD5-SHA1 as +@@ -317,6 +317,13 @@ this option is set to B<no>. Because TLS 1.1 or lower use MD5-SHA1 as pseudorandom function (PRF) to derive key material, disabling B<rh-allow-sha1-signatures> requires the use of TLS 1.2 or newer. @@ -96,7 +80,7 @@ index 0c9110d28a..e0516d20b8 100644 The value is a boolean that can be B<yes> or B<no>. If the value is diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c -index dcd487ec2e..0b50266b69 100644 +index 05dd7c5595..056aae3863 100644 --- a/ssl/t1_lib.c +++ b/ssl/t1_lib.c @@ -20,6 +20,7 @@ @@ -107,7 +91,7 @@ index dcd487ec2e..0b50266b69 100644 #include "internal/sslconf.h" #include "internal/nelem.h" #include "internal/sizes.h" -@@ -1561,19 +1562,28 @@ int tls12_check_peer_sigalg(SSL *s, uint16_t sig, EVP_PKEY *pkey) +@@ -1977,19 +1978,28 @@ int tls12_check_peer_sigalg(SSL_CONNECTION *s, uint16_t sig, EVP_PKEY *pkey) SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_UNKNOWN_DIGEST); return 0; } @@ -149,7 +133,7 @@ index dcd487ec2e..0b50266b69 100644 } /* Store the sigalg the peer uses */ s->s3.tmp.peer_sigalg = lu; -@@ -2106,6 +2116,15 @@ static int tls12_sigalg_allowed(const SSL *s, int op, const SIGALG_LOOKUP *lu) +@@ -2563,6 +2573,15 @@ static int tls12_sigalg_allowed(const SSL_CONNECTION *s, int op, } } @@ -165,16 +149,16 @@ index dcd487ec2e..0b50266b69 100644 /* Finally see if security callback allows it */ secbits = sigalg_security_bits(SSL_CONNECTION_GET_CTX(s), lu); sigalgstr[0] = (lu->sigalg >> 8) & 0xff; -@@ -2977,6 +2996,8 @@ static int ssl_security_cert_sig(SSL *s, SSL_CTX *ctx, X509 *x, +@@ -3467,6 +3486,8 @@ static int ssl_security_cert_sig(SSL_CONNECTION *s, SSL_CTX *ctx, X509 *x, { /* Lookup signature algorithm digest */ int secbits, nid, pknid; + OSSL_LIB_CTX *libctx = NULL; + - + /* Don't check signature if self signed */ if ((X509_get_extension_flags(x) & EXFLAG_SS) != 0) -@@ -2985,6 +3006,26 @@ static int ssl_security_cert_sig(SSL *s, SSL_CTX *ctx, X509 *x, +@@ -3476,6 +3497,26 @@ static int ssl_security_cert_sig(SSL_CONNECTION *s, SSL_CTX *ctx, X509 *x, /* If digest NID not defined use signature NID */ if (nid == NID_undef) nid = pknid; @@ -202,10 +186,10 @@ index dcd487ec2e..0b50266b69 100644 return ssl_security(s, op, secbits, nid, x); else diff --git a/test/recipes/25-test_verify.t b/test/recipes/25-test_verify.t -index 700bbd849c..280477bc9d 100644 +index 1c8fce86fd..a584629062 100644 --- a/test/recipes/25-test_verify.t +++ b/test/recipes/25-test_verify.t -@@ -387,8 +387,8 @@ ok(verify("ee-pss-sha1-cert", "", ["root-cert"], ["ca-cert"], "-auth_level", "0" +@@ -481,8 +481,8 @@ ok(verify("ee-pss-sha1-cert", "", ["root-cert"], ["ca-cert"], "-auth_level", "0" ok(verify("ee-pss-sha256-cert", "", ["root-cert"], ["ca-cert"], ), "CA with PSS signature using SHA256"); @@ -217,5 +201,5 @@ index 700bbd849c..280477bc9d 100644 ok(verify("ee-pss-sha256-cert", "", ["root-cert"], ["ca-cert"], "-auth_level", "2"), "PSS signature using SHA256 and auth level 2"); -- -2.35.1 +2.44.0 diff --git a/0058-FIPS-limit-rsa-encrypt.patch b/0058-FIPS-limit-rsa-encrypt.patch index 5d3ef9c..c4f952b 100644 --- a/0058-FIPS-limit-rsa-encrypt.patch +++ b/0058-FIPS-limit-rsa-encrypt.patch @@ -1,23 +1,23 @@ -From 56511d480823bedafce604374fa3b15d3b3ffd6b Mon Sep 17 00:00:00 2001 +From 012e319b3d5b936a9208b1c75c13d9c4a2d0cc04 Mon Sep 17 00:00:00 2001 From: rpm-build <rpm-build> -Date: Mon, 31 Jul 2023 09:41:28 +0200 -Subject: [PATCH 26/48] 0058-FIPS-limit-rsa-encrypt.patch +Date: Wed, 6 Mar 2024 19:17:15 +0100 +Subject: [PATCH 24/49] 0058-FIPS-limit-rsa-encrypt.patch Patch-name: 0058-FIPS-limit-rsa-encrypt.patch Patch-id: 58 Patch-status: | - # https://bugzilla.redhat.com/show_bug.cgi?id=2053289 -From-dist-git-commit: 9409bc7044cf4b5773639cce20f51399888c45fd + # # https://bugzilla.redhat.com/show_bug.cgi?id=2053289 +From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce --- - providers/common/securitycheck.c | 1 + - .../implementations/asymciphers/rsa_enc.c | 35 +++++++++++ - .../30-test_evp_data/evppkey_rsa_common.txt | 58 ++++++++++++++++++- - test/recipes/80-test_cms.t | 5 +- - test/recipes/80-test_ssl_old.t | 27 +++++++-- - 5 files changed, 118 insertions(+), 8 deletions(-) + providers/common/securitycheck.c | 1 + + .../implementations/asymciphers/rsa_enc.c | 35 +++++ + .../30-test_evp_data/evppkey_rsa_common.txt | 140 +++++++++++++----- + test/recipes/80-test_cms.t | 5 +- + test/recipes/80-test_ssl_old.t | 27 +++- + 5 files changed, 168 insertions(+), 40 deletions(-) diff --git a/providers/common/securitycheck.c b/providers/common/securitycheck.c -index e534ad0a5f..c017c658e5 100644 +index fe694c4e96..f635b5aec8 100644 --- a/providers/common/securitycheck.c +++ b/providers/common/securitycheck.c @@ -27,6 +27,7 @@ @@ -29,10 +29,10 @@ index e534ad0a5f..c017c658e5 100644 { int protect = 0; diff --git a/providers/implementations/asymciphers/rsa_enc.c b/providers/implementations/asymciphers/rsa_enc.c -index d865968058..872967bcb3 100644 +index 71bfa344d4..d548560f1f 100644 --- a/providers/implementations/asymciphers/rsa_enc.c +++ b/providers/implementations/asymciphers/rsa_enc.c -@@ -132,6 +132,17 @@ static int rsa_decrypt_init(void *vprsactx, void *vrsa, +@@ -135,6 +135,17 @@ static int rsa_decrypt_init(void *vprsactx, void *vrsa, return rsa_init(vprsactx, vrsa, params, EVP_PKEY_OP_DECRYPT); } @@ -50,7 +50,7 @@ index d865968058..872967bcb3 100644 static int rsa_encrypt(void *vprsactx, unsigned char *out, size_t *outlen, size_t outsize, const unsigned char *in, size_t inlen) { -@@ -141,6 +152,18 @@ static int rsa_encrypt(void *vprsactx, unsigned char *out, size_t *outlen, +@@ -144,6 +155,18 @@ static int rsa_encrypt(void *vprsactx, unsigned char *out, size_t *outlen, if (!ossl_prov_is_running()) return 0; @@ -69,7 +69,7 @@ index d865968058..872967bcb3 100644 if (out == NULL) { size_t len = RSA_size(prsactx->rsa); -@@ -204,6 +227,18 @@ static int rsa_decrypt(void *vprsactx, unsigned char *out, size_t *outlen, +@@ -206,6 +229,18 @@ static int rsa_decrypt(void *vprsactx, unsigned char *out, size_t *outlen, if (!ossl_prov_is_running()) return 0; @@ -89,877 +89,861 @@ index d865968058..872967bcb3 100644 if (out == NULL) { *outlen = SSL_MAX_MASTER_KEY_LENGTH; diff --git a/test/recipes/30-test_evp_data/evppkey_rsa_common.txt b/test/recipes/30-test_evp_data/evppkey_rsa_common.txt -index 8680797b90..95d5d51102 100644 +index 76ddc1ec60..62d55308b0 100644 --- a/test/recipes/30-test_evp_data/evppkey_rsa_common.txt +++ b/test/recipes/30-test_evp_data/evppkey_rsa_common.txt -@@ -619,36 +619,42 @@ vcDtKrdWo6btTWc1Kml9QhbpMhKxJ6Y9VBHOb6mNXb79cyY+NygUJ0OBgWbtfdY2 - h90qjKHS9PvY4Q== - -----END PRIVATE KEY----- +@@ -248,13 +248,13 @@ Input = 64b0e9f9892371110c40ba5739dc0974002aa6e6160b481447c6819947c2d3b537a6e377 + Output = 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef + # RSA decrypt +- +Availablein = default - Decrypt=RSA-OAEP-1 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=354fe67b4a126d5d35fe36c777791a3f7ba13def484e2d3908aff722fad468fb21696de95d0be911c2d3174f8afcc201035f7b6d8e69402de5451618c21a535fa9d7bfc5b8dd9fc243f8cf927db31322d6e881eaa91a996170e657a05a266426d98c88003f8477c1227094a0d9fa1e8c4024309ce1ecccb5210035d47ac72e8a - Output=6628194e12073db03ba94cda9ef9532397d50dba79b987004afefe34 + Decrypt = RSA-2048 + Input = 550AF55A2904E7B9762352F8FB7FA235A9CB053AACB2D5FCB8CA48453CB2EE3619746C701ABF2D4CC67003471A187900B05AA812BD25ED05C675DFC8C97A24A7BF49BD6214992CAD766D05A9A2B57B74F26A737E0237B8B76C45F1F226A836D7CFBC75BA999BDBE48DBC09227AA46C88F21DCCBA7840141AD5A5D71FD122E6BD6AC3E564780DFE623FC1CA9B995A6037BF0BBD43B205A84AC5444F34202C05CE9113087176432476576DE6FFFF9A52EA57C08BE3EC2F49676CB8E12F762AC71FA3C321E00AC988910C85FF52F93825666CE0D40FFAA0592078919D4493F46D95CCF76364C6D57760DD0B64805F9AFC76A2365A5575CA301D5103F0EA76CB9A78 + Output = "Hello World" + # The old FIPS provider doesn't include the workaround (#13817) +-FIPSversion = >=3.2.0 +Availablein = default - Decrypt=RSA-OAEP-1 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=640db1acc58e0568fe5407e5f9b701dff8c3c91e716c536fc7fcec6cb5b71c1165988d4a279e1577d730fc7a29932e3f00c81515236d8d8e31017a7a09df4352d904cdeb79aa583adcc31ea698a4c05283daba9089be5491f67c1a4ee48dc74bbbe6643aef846679b4cb395a352d5ed115912df696ffe0702932946d71492b44 - Output=750c4047f547e8e41411856523298ac9bae245efaf1397fbe56f9dd5 + # Note: disable the Bleichenbacher workaround to see if it passes + Decrypt = RSA-2048 + Ctrl = rsa_pkcs1_implicit_rejection:0 +@@ -262,7 +262,7 @@ Input = 550AF55A2904E7B9762352F8FB7FA235A9CB053AACB2D5FCB8CA48453CB2EE3619746C70 + Output = "Hello World" + # The old FIPS provider doesn't include the workaround (#13817) +-FIPSversion = >=3.2.0 +Availablein = default - Decrypt=RSA-OAEP-1 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=423736ed035f6026af276c35c0b3741b365e5f76ca091b4e8c29e2f0befee603595aa8322d602d2e625e95eb81b2f1c9724e822eca76db8618cf09c5343503a4360835b5903bc637e3879fb05e0ef32685d5aec5067cd7cc96fe4b2670b6eac3066b1fcf5686b68589aafb7d629b02d8f8625ca3833624d4800fb081b1cf94eb - Output=d94ae0832e6445ce42331cb06d531a82b1db4baad30f746dc916df24d4e3c2451fff59a6423eb0e1d02d4fe646cf699dfd818c6e97b051 + # Corrupted ciphertext + # Note: output is generated synthethically by the Bleichenbacher workaround + Decrypt = RSA-2048 +@@ -270,7 +270,7 @@ Input = 550AF55A2904E7B9762352F8FB7FA235A9CB053AACB2D5FCB8CA48453CB2EE3619746C70 + Output = 4cbb988d6a46228379132b0b5f8c249b3860043848c93632fb982c807c7c82fffc7a9ef83f4908f890373ac181ffea6381e103bcaa27e65638b6ecebef38b59ed4226a9d12af675cfcb634d8c40e7a7aff + # The old FIPS provider doesn't include the workaround (#13817) +-FIPSversion = >=3.2.0 +Availablein = default - Decrypt=RSA-OAEP-1 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=45ead4ca551e662c9800f1aca8283b0525e6abae30be4b4aba762fa40fd3d38e22abefc69794f6ebbbc05ddbb11216247d2f412fd0fba87c6e3acd888813646fd0e48e785204f9c3f73d6d8239562722dddd8771fec48b83a31ee6f592c4cfd4bc88174f3b13a112aae3b9f7b80e0fc6f7255ba880dc7d8021e22ad6a85f0755 - Output=52e650d98e7f2a048b4f86852153b97e01dd316f346a19f67a85 + # Corrupted ciphertext + # Note: disable the Bleichenbacher workaround to see if it fails + Decrypt = RSA-2048 +@@ -345,82 +345,90 @@ PrivPubKeyPair = RSA-2048-2:RSA-2048-2-PUBLIC + # RSA decrypt + # a random positive test case +Availablein = default - Decrypt=RSA-OAEP-1 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=36f6e34d94a8d34daacba33a2139d00ad85a9345a86051e73071620056b920e219005855a213a0f23897cdcd731b45257c777fe908202befdd0b58386b1244ea0cf539a05d5d10329da44e13030fd760dcd644cfef2094d1910d3f433e1c7c6dd18bc1f2df7f643d662fb9dd37ead9059190f4fa66ca39e869c4eb449cbdc439 - Output=8da89fd9e5f974a29feffb462b49180f6cf9e802 + Decrypt = RSA-2048-2 + Input = 8bfe264e85d3bdeaa6b8851b8e3b956ee3d226fd3f69063a86880173a273d9f283b2eebdd1ed35f7e02d91c571981b6737d5320bd8396b0f3ad5b019daec1b0aab3cbbc026395f4fd14f13673f2dfc81f9b660ec26ac381e6db3299b4e460b43fab9955df2b3cfaa20e900e19c856238fd371899c2bf2ce8c868b76754e5db3b036533fd603746be13c10d4e3e6022ebc905d20c2a7f32b215a4cd53b3f44ca1c327d2c2b651145821c08396c89071f665349c25e44d2733cd9305985ceef6430c3cf57af5fa224089221218fa34737c79c446d28a94c41c96e4e92ac53fbcf384dea8419ea089f8784445a492c812eb0d409467f75afd7d4d1078886205a066 + Output = "lorem ipsum dolor sit amet" + # The old FIPS provider doesn't include the workaround (#13817) +-FIPSversion = >=3.2.0 +Availablein = default - Decrypt=RSA-OAEP-1 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 -@@ -673,36 +679,42 @@ SwGNdhGLJDiac1Dsg2sAY6IXISNv2O222JtR5+64e2EbcTLLfqc1bCMVHB53UVB8 - eG2e4XlBcKjI6A== - -----END PRIVATE KEY----- + # a random negative test case decrypting to empty + Decrypt = RSA-2048-2 + Input = 20aaa8adbbc593a924ba1c5c7990b5c2242ae4b99d0fe636a19a4cf754edbcee774e472fe028160ed42634f8864900cb514006da642cae6ae8c7d087caebcfa6dad1551301e130344989a1d462d4164505f6393933450c67bc6d39d8f5160907cabc251b737925a1cf21e5c6aa5781b7769f6a2a583d97cce008c0f8b6add5f0b2bd80bee60237aa39bb20719fe75749f4bc4e42466ef5a861ae3a92395c7d858d430bfe38040f445ea93fa2958b503539800ffa5ce5f8cf51fa8171a91f36cb4f4575e8de6b4d3f096ee140b938fd2f50ee13f0d050222e2a72b0a3069ff3a6738e82c87090caa5aed4fcbe882c49646aa250b98f12f83c8d528113614a29e7 + Output = + # The old FIPS provider doesn't include the workaround (#13817) +-FIPSversion = >=3.2.0 +Availablein = default - Decrypt=RSA-OAEP-2 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=0181af8922b9fcb4d79d92ebe19815992fc0c1439d8bcd491398a0f4ad3a329a5bd9385560db532683c8b7da04e4b12aed6aacdf471c34c9cda891addcc2df3456653aa6382e9ae59b54455257eb099d562bbe10453f2b6d13c59c02e10f1f8abb5da0d0570932dacf2d0901db729d0fefcc054e70968ea540c81b04bcaefe720e - Output=8ff00caa605c702830634d9a6c3d42c652b58cf1d92fec570beee7 + # invalid decrypting to max length message + Decrypt = RSA-2048-2 + Input = 48cceab10f39a4db32f60074feea473cbcdb7accf92e150417f76b44756b190e843e79ec12aa85083a21f5437e7bad0a60482e601198f9d86923239c8786ee728285afd0937f7dde12717f28389843d7375912b07b991f4fdb0190fced8ba665314367e8c5f9d2981d0f5128feeb46cb50fc237e64438a86df198dd0209364ae3a842d77532b66b7ef263b83b1541ed671b120dfd660462e2107a4ee7b964e734a7bd68d90dda61770658a3c242948532da32648687e0318286473f675b412d6468f013f14d760a358dfcad3cda2afeec5e268a37d250c37f722f468a70dfd92d7294c3c1ee1e7f8843b7d16f9f37ef35748c3ae93aa155cdcdfeb4e78567303 + Output = 22d850137b9eebe092b24f602dc5bb7918c16bd89ddbf20467b119d205f9c2e4bd7d2592cf1e532106e0f33557565923c73a02d4f09c0c22bea89148183e60317f7028b3aa1f261f91c979393101d7e15f4067e63979b32751658ef769610fe97cf9cef3278b3117d384051c3b1d82c251c2305418c8f6840530e631aad63e70e20e025bcd8efb54c92ec6d3b106a2f8e64eeff7d38495b0fc50c97138af4b1c0a67a1c4e27b077b8439332edfa8608dfeae653cd6a628ac550395f7e74390e42c11682234870925eeaa1fa71b76cf1f2ee3bda69f6717033ff8b7c95c9799e7a3bea5e7e4a1c359772fb6b1c6e6c516661dfe30c3 + # The old FIPS provider doesn't include the workaround (#13817) +-FIPSversion = >=3.2.0 + # invalid decrypting to message with length specified by second to last value from PRF +Availablein = default - Decrypt=RSA-OAEP-2 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=018759ff1df63b2792410562314416a8aeaf2ac634b46f940ab82d64dbf165eee33011da749d4bab6e2fcd18129c9e49277d8453112b429a222a8471b070993998e758861c4d3f6d749d91c4290d332c7a4ab3f7ea35ff3a07d497c955ff0ffc95006b62c6d296810d9bfab024196c7934012c2df978ef299aba239940cba10245 - Output=2d + Decrypt = RSA-2048-2 + Input = 1439e08c3f84c1a7fec74ce07614b20e01f6fa4e8c2a6cffdc3520d8889e5d9a950c6425798f85d4be38d300ea5695f13ecd4cb389d1ff5b82484b494d6280ab7fa78e645933981cb934cce8bfcd114cc0e6811eefa47aae20af638a1cd163d2d3366186d0a07df0c81f6c9f3171cf3561472e98a6006bf75ddb457bed036dcce199369de7d94ef2c68e8467ee0604eea2b3009479162a7891ba5c40cab17f49e1c438cb6eaea4f76ce23cce0e483ff0e96fa790ea15be67671814342d0a23f4a20262b6182e72f3a67cd289711503c85516a9ed225422f98b116f1ab080a80abd6f0216df88d8cfd67c139243be8dd78502a7aaf6bc99d7da71bcdf627e7354 + Output = 0f9b + # The old FIPS provider doesn't include the workaround (#13817) +-FIPSversion = >=3.2.0 +Availablein = default - Decrypt=RSA-OAEP-2 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=018802bab04c60325e81c4962311f2be7c2adce93041a00719c88f957575f2c79f1b7bc8ced115c706b311c08a2d986ca3b6a9336b147c29c6f229409ddec651bd1fdd5a0b7f610c9937fdb4a3a762364b8b3206b4ea485fd098d08f63d4aa8bb2697d027b750c32d7f74eaf5180d2e9b66b17cb2fa55523bc280da10d14be2053 - Output=74fc88c51bc90f77af9d5e9a4a70133d4b4e0b34da3c37c7ef8e + # invalid decrypting to message with length specified by third to last value from PRF + Decrypt = RSA-2048-2 + Input = 1690ebcceece2ce024f382e467cf8510e74514120937978576caf684d4a02ad569e8d76cbe365a060e00779de2f0865ccf0d923de3b4783a4e2c74f422e2f326086c390b658ba47f31ab013aa80f468c71256e5fa5679b24e83cd82c3d1e05e398208155de2212993cd2b8bab6987cf4cc1293f19909219439d74127545e9ed8a706961b8ee2119f6bfacafbef91b75a789ba65b8b833bc6149cf49b5c4d2c6359f62808659ba6541e1cd24bf7f7410486b5103f6c0ea29334ea6f4975b17387474fe920710ea61568d7b7c0a7916acf21665ad5a31c4eabcde44f8fb6120d8457afa1f3c85d517cda364af620113ae5a3c52a048821731922737307f77a1081 + Output = 4f02 + # positive test with 11 byte long value +Availablein = default - Decrypt=RSA-OAEP-2 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=00a4578cbc176318a638fba7d01df15746af44d4f6cd96d7e7c495cbf425b09c649d32bf886da48fbaf989a2117187cafb1fb580317690e3ccd446920b7af82b31db5804d87d01514acbfa9156e782f867f6bed9449e0e9a2c09bcecc6aa087636965e34b3ec766f2fe2e43018a2fddeb140616a0e9d82e5331024ee0652fc7641 - Output=a7eb2a5036931d27d4e891326d99692ffadda9bf7efd3e34e622c4adc085f721dfe885072c78a203b151739be540fa8c153a10f00a + Decrypt = RSA-2048-2 + Input = 6213634593332c485cef783ea2846e3d6e8b0e005cd8293eaebbaa5079712fd681579bdfbbda138ae4d9d952917a03c92398ec0cb2bb0c6b5a8d55061fed0d0d8d72473563152648cfe640b335dc95331c21cb133a91790fa93ae44497c128708970d2beeb77e8721b061b1c44034143734a77be8220877415a6dba073c3871605380542a9f25252a4babe8331cdd53cf828423f3cc70b560624d0581fb126b2ed4f4ed358f0eb8065cf176399ac1a846a31055f9ae8c9c24a1ba050bc20842125bc1753158f8065f3adb9cc16bfdf83816bdf38b624f12022c5a6fbfe29bc91542be8c0208a770bcd677dc597f5557dc2ce28a11bf3e3857f158717a33f6592 + Output = "lorem ipsum" + # positive test with 11 byte long value and zero padded ciphertext +Availablein = default - Decrypt=RSA-OAEP-2 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=00ebc5f5fda77cfdad3c83641a9025e77d72d8a6fb33a810f5950f8d74c73e8d931e8634d86ab1246256ae07b6005b71b7f2fb98351218331ce69b8ffbdc9da08bbc9c704f876deb9df9fc2ec065cad87f9090b07acc17aa7f997b27aca48806e897f771d95141fe4526d8a5301b678627efab707fd40fbebd6e792a25613e7aec - Output=2ef2b066f854c33f3bdcbb5994a435e73d6c6c + Decrypt = RSA-2048-2 + Input = 00a2e8f114ea8d05d12dc843e3cc3b2edc8229ff2a028bda29ba9d55e3cd02911902fef1f42a075bf05e8016e8567213d6f260fa49e360779dd81aeea3e04c2cb567e0d72b98bf754014561b7511e083d20e0bfb9cd23f8a0d3c88900c49d2fcd5843ff0765607b2026f28202a87aa94678aed22a0c20724541394cd8f44e373eba1d2bae98f516c1e2ba3d86852d064f856b1daf24795e767a2b90396e50743e3150664afab131fe40ea405dcf572dd1079af1d3f0392ccadcca0a12740dbb213b925ca2a06b1bc1383e83a658c82ba2e7427342379084d5f66b544579f07664cb26edd4f10fd913fdbc0de05ef887d4d1ec1ac95652397ea7fd4e4759fda8b + Output = "lorem ipsum" + # positive test with 11 byte long value and zero truncated ciphertext +Availablein = default - Decrypt=RSA-OAEP-2 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 -@@ -727,36 +739,42 @@ iUGx07dw5a0x7jc7KKzaaf+bb0D+V4ufGvuFg2+WJ9N6z/c8J3nmNLsmARwsj38z - Ya4qnqZe1onjY5o= - -----END PRIVATE KEY----- + Decrypt = RSA-2048-2 + Input = a2e8f114ea8d05d12dc843e3cc3b2edc8229ff2a028bda29ba9d55e3cd02911902fef1f42a075bf05e8016e8567213d6f260fa49e360779dd81aeea3e04c2cb567e0d72b98bf754014561b7511e083d20e0bfb9cd23f8a0d3c88900c49d2fcd5843ff0765607b2026f28202a87aa94678aed22a0c20724541394cd8f44e373eba1d2bae98f516c1e2ba3d86852d064f856b1daf24795e767a2b90396e50743e3150664afab131fe40ea405dcf572dd1079af1d3f0392ccadcca0a12740dbb213b925ca2a06b1bc1383e83a658c82ba2e7427342379084d5f66b544579f07664cb26edd4f10fd913fdbc0de05ef887d4d1ec1ac95652397ea7fd4e4759fda8b + Output = "lorem ipsum" + # positive test with 11 byte long value and double zero padded ciphertext +Availablein = default - Decrypt=RSA-OAEP-3 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=026a0485d96aebd96b4382085099b962e6a2bdec3d90c8db625e14372de85e2d5b7baab65c8faf91bb5504fb495afce5c988b3f6a52e20e1d6cbd3566c5cd1f2b8318bb542cc0ea25c4aab9932afa20760eaddec784396a07ea0ef24d4e6f4d37e5052a7a31e146aa480a111bbe926401307e00f410033842b6d82fe5ce4dfae80 - Output=087820b569e8fa8d + Decrypt = RSA-2048-2 + Input = 00001f71879b426127f7dead621f7380a7098cf7d22173aa27991b143c46d53383c209bd0c9c00d84078037e715f6b98c65005a77120070522ede51d472c87ef94b94ead4c5428ee108a345561658301911ec5a8f7dd43ed4a3957fd29fb02a3529bf63f8040d3953490939bd8f78b2a3404b6fb5ff70a4bfdaac5c541d6bcce49c9778cc390be24cbef1d1eca7e870457241d3ff72ca44f9f56bdf31a890fa5eb3a9107b603ccc9d06a5dd911a664c82b6abd4fe036f8db8d5a070c2d86386ae18d97adc1847640c211d91ff5c3387574a26f8ef27ca7f48d2dd1f0c7f14b81cc9d33ee6853031d3ecf10a914ffd90947909c8011fd30249219348ebff76bfc + Output = "lorem ipsum" + # positive test with 11 byte long value and double zero truncated ciphertext +Availablein = default - Decrypt=RSA-OAEP-3 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=024db89c7802989be0783847863084941bf209d761987e38f97cb5f6f1bc88da72a50b73ebaf11c879c4f95df37b850b8f65d7622e25b1b889e80fe80baca2069d6e0e1d829953fc459069de98ea9798b451e557e99abf8fe3d9ccf9096ebbf3e5255d3b4e1c6d2ecadf067a359eea86405acd47d5e165517ccafd47d6dbee4bf5 - Output=4653acaf171960b01f52a7be63a3ab21dc368ec43b50d82ec3781e04 + Decrypt = RSA-2048-2 + Input = 1f71879b426127f7dead621f7380a7098cf7d22173aa27991b143c46d53383c209bd0c9c00d84078037e715f6b98c65005a77120070522ede51d472c87ef94b94ead4c5428ee108a345561658301911ec5a8f7dd43ed4a3957fd29fb02a3529bf63f8040d3953490939bd8f78b2a3404b6fb5ff70a4bfdaac5c541d6bcce49c9778cc390be24cbef1d1eca7e870457241d3ff72ca44f9f56bdf31a890fa5eb3a9107b603ccc9d06a5dd911a664c82b6abd4fe036f8db8d5a070c2d86386ae18d97adc1847640c211d91ff5c3387574a26f8ef27ca7f48d2dd1f0c7f14b81cc9d33ee6853031d3ecf10a914ffd90947909c8011fd30249219348ebff76bfc + Output = "lorem ipsum" + # positive that generates a 0 byte long synthetic message internally +Availablein = default - Decrypt=RSA-OAEP-3 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=0239bce681032441528877d6d1c8bb28aa3bc97f1df584563618995797683844ca86664732f4bed7a0aab083aaabfb7238f582e30958c2024e44e57043b97950fd543da977c90cdde5337d618442f99e60d7783ab59ce6dd9d69c47ad1e962bec22d05895cff8d3f64ed5261d92b2678510393484990ba3f7f06818ae6ffce8a3a - Output=d94cd0e08fa404ed89 + Decrypt = RSA-2048-2 + Input = b5e49308f6e9590014ffaffc5b8560755739dd501f1d4e9227a7d291408cf4b753f292322ff8bead613bf2caa181b221bc38caf6392deafb28eb21ad60930841ed02fd6225cc9c463409adbe7d8f32440212fbe3881c51375bb09565efb22e62b071472fb38676e5b4e23a0617db5d14d93519ac0007a30a9c822eb31c38b57fcb1be29608fcf1ca2abdcaf5d5752bbc2b5ac7dba5afcff4a5641da360dd01f7112539b1ed46cdb550a3b1006559b9fe1891030ec80f0727c42401ddd6cbb5e3c80f312df6ec89394c5a7118f573105e7ab00fe57833c126141b50a935224842addfb479f75160659ba28877b512bb9a93084ad8bec540f92640f63a11a010e0 + Output = "lorem ipsum" + # positive that generates a 245 byte long synthetic message internally +Availablein = default - Decrypt=RSA-OAEP-3 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=02994c62afd76f498ba1fd2cf642857fca81f4373cb08f1cbaee6f025c3b512b42c3e8779113476648039dbe0493f9246292fac28950600e7c0f32edf9c81b9dec45c3bde0cc8d8847590169907b7dc5991ceb29bb0714d613d96df0f12ec5d8d3507c8ee7ae78dd83f216fa61de100363aca48a7e914ae9f42ddfbe943b09d9a0 - Output=6cc641b6b61e6f963974dad23a9013284ef1 + Decrypt = RSA-2048-2 + Input = 1ea0b50ca65203d0a09280d39704b24fe6e47800189db5033f202761a78bafb270c5e25abd1f7ecc6e7abc4f26d1b0cd9b8c648d529416ee64ccbdd7aa72a771d0353262b543f0e436076f40a1095f5c7dfd10dcf0059ccb30e92dfa5e0156618215f1c3ff3aa997a9d999e506924f5289e3ac72e5e2086cc7b499d71583ed561028671155db4005bee01800a7cdbdae781dd32199b8914b5d4011dd6ff11cd26d46aad54934d293b0bc403dd211bf13b5a5c6836a5e769930f437ffd8634fb7371776f4bc88fa6c271d8aa6013df89ae6470154497c4ac861be2a1c65ebffec139bf7aaba3a81c7c5cdd84da9af5d3edfb957848074686b5837ecbcb6a41c50 + Output = "lorem ipsum" + # The old FIPS provider doesn't include the workaround (#13817) +-FIPSversion = >=3.2.0 +Availablein = default - Decrypt=RSA-OAEP-3 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=0162042ff6969592a6167031811a239834ce638abf54fec8b99478122afe2ee67f8c5b18b0339805bfdbc5a4e6720b37c59cfba942464c597ff532a119821545fd2e59b114e61daf71820529f5029cf524954327c34ec5e6f5ba7efcc4de943ab8ad4ed787b1454329f70db798a3a8f4d92f8274e2b2948ade627ce8ee33e43c60 - Output=df5151832b61f4f25891fb4172f328d2eddf8371ffcfdbe997939295f30eca6918017cfda1153bf7a6af87593223 + # a random negative test that generates an 11 byte long message + Decrypt = RSA-2048-2 + Input = 5f02f4b1f46935c742ebe62b6f05aa0a3286aab91a49b34780adde6410ab46f7386e05748331864ac98e1da63686e4babe3a19ed40a7f5ceefb89179596aab07ab1015e03b8f825084dab028b6731288f2e511a4b314b6ea3997d2e8fe2825cef8897cbbdfb6c939d441d6e04948414bb69e682927ef8576c9a7090d4aad0e74c520d6d5ce63a154720f00b76de8cc550b1aa14f016d63a7b6d6eaa1f7dbe9e50200d3159b3d099c900116bf4eba3b94204f18b1317b07529751abf64a26b0a0bf1c8ce757333b3d673211b67cc0653f2fe2620d57c8b6ee574a0323a167eab1106d9bc7fd90d415be5f1e9891a0e6c709f4fc0404e8226f8477b4e939b36eb2 + Output = af9ac70191c92413cb9f2d + # The old FIPS provider doesn't include the workaround (#13817) +-FIPSversion = >=3.2.0 +Availablein = default - Decrypt=RSA-OAEP-3 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 -@@ -781,36 +799,42 @@ s/XkIiO6MDAcQabYfLtw4wy308Z9JUc9sfbL8D4/kSbj6XloJ5qGWywrQmUkz8Uq - aD0x7TDrmEvkEro= - -----END PRIVATE KEY----- + # an otherwise correct plaintext, but with wrong first byte + # (0x01 instead of 0x00), generates a random 11 byte long plaintext + Decrypt = RSA-2048-2 +@@ -428,7 +436,7 @@ Input = 9b2ec9c0c917c98f1ad3d0119aec6be51ae3106e9af1914d48600ab6a2c0c0c8ae02a2dc + Output = a1f8c9255c35cfba403ccc + # The old FIPS provider doesn't include the workaround (#13817) +-FIPSversion = >=3.2.0 +Availablein = default - Decrypt=RSA-OAEP-4 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=04cce19614845e094152a3fe18e54e3330c44e5efbc64ae16886cb1869014cc5781b1f8f9e045384d0112a135ca0d12e9c88a8e4063416deaae3844f60d6e96fe155145f4525b9a34431ca3766180f70e15a5e5d8e8b1a516ff870609f13f896935ced188279a58ed13d07114277d75c6568607e0ab092fd803a223e4a8ee0b1a8 - Output=4a86609534ee434a6cbca3f7e962e76d455e3264c19f605f6e5ff6137c65c56d7fb344cd52bc93374f3d166c9f0c6f9c506bad19330972d2 + # an otherwise correct plaintext, but with wrong second byte + # (0x01 instead of 0x02), generates a random 11 byte long plaintext + Decrypt = RSA-2048-2 +@@ -436,7 +444,7 @@ Input = 782c2b59a21a511243820acedd567c136f6d3090c115232a82a5efb0b178285f55b5ec2d + Output = e6d700309ca0ed62452254 + # The old FIPS provider doesn't include the workaround (#13817) +-FIPSversion = >=3.2.0 +Availablein = default - Decrypt=RSA-OAEP-4 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=0097b698c6165645b303486fbf5a2a4479c0ee85889b541a6f0b858d6b6597b13b854eb4f839af03399a80d79bda6578c841f90d645715b280d37143992dd186c80b949b775cae97370e4ec97443136c6da484e970ffdb1323a20847821d3b18381de13bb49aaea66530c4a4b8271f3eae172cd366e07e6636f1019d2a28aed15e - Output=b0adc4f3fe11da59ce992773d9059943c03046497ee9d9f9a06df1166db46d98f58d27ec074c02eee6cbe2449c8b9fc5080c5c3f4433092512ec46aa793743c8 + # an invalid ciphertext, with a zero byte in first byte of + # ciphertext, decrypts to a random 11 byte long synthetic + # plaintext +@@ -445,7 +453,7 @@ Input = 0096136621faf36d5290b16bd26295de27f895d1faa51c800dafce73d001d60796cd4e2a + Output = ba27b1842e7c21c0e7ef6a + # The old FIPS provider doesn't include the workaround (#13817) +-FIPSversion = >=3.2.0 +Availablein = default - Decrypt=RSA-OAEP-4 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=0301f935e9c47abcb48acbbe09895d9f5971af14839da4ff95417ee453d1fd77319072bb7297e1b55d7561cd9d1bb24c1a9a37c619864308242804879d86ebd001dce5183975e1506989b70e5a83434154d5cbfd6a24787e60eb0c658d2ac193302d1192c6e622d4a12ad4b53923bca246df31c6395e37702c6a78ae081fb9d065 - Output=bf6d42e701707b1d0206b0c8b45a1c72641ff12889219a82bdea965b5e79a96b0d0163ed9d578ec9ada20f2fbcf1ea3c4089d83419ba81b0c60f3606da99 + # an invalid ciphertext, with a zero byte removed from first byte of + # ciphertext, decrypts to a random 11 byte long synthetic + # plaintext +@@ -454,7 +462,7 @@ Input = 96136621faf36d5290b16bd26295de27f895d1faa51c800dafce73d001d60796cd4e2ac3 + Output = ba27b1842e7c21c0e7ef6a + # The old FIPS provider doesn't include the workaround (#13817) +-FIPSversion = >=3.2.0 +Availablein = default - Decrypt=RSA-OAEP-4 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=02d110ad30afb727beb691dd0cf17d0af1a1e7fa0cc040ec1a4ba26a42c59d0a796a2e22c8f357ccc98b6519aceb682e945e62cb734614a529407cd452bee3e44fece8423cc19e55548b8b994b849c7ecde4933e76037e1d0ce44275b08710c68e430130b929730ed77e09b015642c5593f04e4ffb9410798102a8e96ffdfe11e4 - Output=fb2ef112f5e766eb94019297934794f7be2f6fc1c58e + # an invalid ciphertext, with two zero bytes in first bytes of + # ciphertext, decrypts to a random 11 byte long synthetic + # plaintext +@@ -463,7 +471,7 @@ Input = 0000587cccc6b264bdfe0dc2149a988047fa921801f3502ea64624c510c6033d2f427e3f + Output = d5cf555b1d6151029a429a + # The old FIPS provider doesn't include the workaround (#13817) +-FIPSversion = >=3.2.0 +Availablein = default - Decrypt=RSA-OAEP-4 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=00dbb8a7439d90efd919a377c54fae8fe11ec58c3b858362e23ad1b8a44310799066b99347aa525691d2adc58d9b06e34f288c170390c5f0e11c0aa3645959f18ee79e8f2be8d7ac5c23d061f18dd74b8c5f2a58fcb5eb0c54f99f01a83247568292536583340948d7a8c97c4acd1e98d1e29dc320e97a260532a8aa7a758a1ec2 - Output=28ccd447bb9e85166dabb9e5b7d1adadc4b9d39f204e96d5e440ce9ad928bc1c2284 + # an invalid ciphertext, with two zero bytes removed from first bytes of + # ciphertext, decrypts to a random 11 byte long synthetic + # plaintext +@@ -472,7 +480,7 @@ Input = 587cccc6b264bdfe0dc2149a988047fa921801f3502ea64624c510c6033d2f427e3f136c + Output = d5cf555b1d6151029a429a + # The old FIPS provider doesn't include the workaround (#13817) +-FIPSversion = >=3.2.0 +Availablein = default - Decrypt=RSA-OAEP-4 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 -@@ -835,36 +859,42 @@ OPlAQGLrhaQpJFILOPW7iGoBlvSLuNzqYP2SzAJ/GOeBWKNKXF1fhgoPbAQHGn0B - MSwGUGLx60i3nRyDyw== - -----END PRIVATE KEY----- + # and invalid ciphertext, otherwise valid but starting with 000002, decrypts + # to random 11 byte long synthetic plaintext + Decrypt = RSA-2048-2 +@@ -480,7 +488,7 @@ Input = 1786550ce8d8433052e01ecba8b76d3019f1355b212ac9d0f5191b023325a7e7714b7802 + Output = 3d4a054d9358209e9cbbb9 + # The old FIPS provider doesn't include the workaround (#13817) +-FIPSversion = >=3.2.0 +Availablein = default - Decrypt=RSA-OAEP-5 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=036046a4a47d9ed3ba9a89139c105038eb7492b05a5d68bfd53accff4597f7a68651b47b4a4627d927e485eed7b4566420e8b409879e5d606eae251d22a5df799f7920bfc117b992572a53b1263146bcea03385cc5e853c9a101c8c3e1bda31a519807496c6cb5e5efb408823a352b8fa0661fb664efadd593deb99fff5ed000e5 - Output=af71a901e3a61d3132f0fc1fdb474f9ea6579257ffc24d164170145b3dbde8 + # negative test with otherwise valid padding but a zero byte in first byte + # of padding + Decrypt = RSA-2048-2 +@@ -488,7 +496,7 @@ Input = 179598823812d2c58a7eb50521150a48bcca8b4eb53414018b6bca19f4801456c5e36a94 + Output = 1f037dd717b07d3e7f7359 + # The old FIPS provider doesn't include the workaround (#13817) +-FIPSversion = >=3.2.0 +Availablein = default - Decrypt=RSA-OAEP-5 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=03d6eb654edce615bc59f455265ed4e5a18223cbb9be4e4069b473804d5de96f54dcaaa603d049c5d94aa1470dfcd2254066b7c7b61ff1f6f6770e3215c51399fd4e34ec5082bc48f089840ad04354ae66dc0f1bd18e461a33cc1258b443a2837a6df26759aa2302334986f87380c9cc9d53be9f99605d2c9a97da7b0915a4a7ad - Output=a3b844a08239a8ac41605af17a6cfda4d350136585903a417a79268760519a4b4ac3303ec73f0f87cfb32399 + # negative test with otherwise valid padding but a zero byte at the eighth + # byte of padding + Decrypt = RSA-2048-2 +@@ -496,7 +504,7 @@ Input = a7a340675a82c30e22219a55bc07cdf36d47d01834c1834f917f18b517419ce9de2a9646 + Output = 63cb0bf65fc8255dd29e17 + # The old FIPS provider doesn't include the workaround (#13817) +-FIPSversion = >=3.2.0 +Availablein = default - Decrypt=RSA-OAEP-5 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=0770952181649f9f9f07ff626ff3a22c35c462443d905d456a9fd0bff43cac2ca7a9f554e9478b9acc3ac838b02040ffd3e1847de2e4253929f9dd9ee4044325a9b05cabb808b2ee840d34e15d105a3f1f7b27695a1a07a2d73fe08ecaaa3c9c9d4d5a89ff890d54727d7ae40c0ec1a8dd86165d8ee2c6368141016a48b55b6967 - Output=308b0ecbd2c76cb77fc6f70c5edd233fd2f20929d629f026953bb62a8f4a3a314bde195de85b5f816da2aab074d26cb6acddf323ae3b9c678ac3cf12fbdde7 + # negative test with an otherwise valid plaintext but with missing separator + # byte + Decrypt = RSA-2048-2 +@@ -551,53 +559,58 @@ PrivPubKeyPair = RSA-2049:RSA-2049-PUBLIC + # RSA decrypt + # The old FIPS provider doesn't include the workaround (#13817) +-FIPSversion = >=3.2.0 +Availablein = default - Decrypt=RSA-OAEP-5 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=0812b76768ebcb642d040258e5f4441a018521bd96687e6c5e899fcd6c17588ff59a82cc8ae03a4b45b31299af1788c329f7dcd285f8cf4ced82606b97612671a45bedca133442144d1617d114f802857f0f9d739751c57a3f9ee400912c61e2e6992be031a43dd48fa6ba14eef7c422b5edc4e7afa04fdd38f402d1c8bb719abf - Output=15c5b9ee1185 + # malformed that generates length specified by 3rd last value from PRF + Decrypt = RSA-2049 + Input = 00b26f6404b82649629f2704494282443776929122e279a9cf30b0c6fe8122a0a9042870d97cc8ef65490fe58f031eb2442352191f5fbc311026b5147d32df914599f38b825ebb824af0d63f2d541a245c5775d1c4b78630e4996cc5fe413d38455a776cf4edcc0aa7fccb31c584d60502ed2b77398f536e137ff7ba6430e9258e21c2db5b82f5380f566876110ac4c759178900fbad7ab70ea07b1daf7a1639cbb4196543a6cbe8271f35dddb8120304f6eef83059e1c5c5678710f904a6d760c4d1d8ad076be17904b9e69910040b47914a0176fb7eea0c06444a6c4b86d674d19a556a1de5490373cb01ce31bbd15a5633362d3d2cd7d4af1b4c5121288b894 + Output = 42 + # simple positive test case +Availablein = default - Decrypt=RSA-OAEP-5 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=07b60e14ec954bfd29e60d0047e789f51d57186c63589903306793ced3f68241c743529aba6a6374f92e19e0163efa33697e196f7661dfaaa47aac6bde5e51deb507c72c589a2ca1693d96b1460381249b2cdb9eac44769f2489c5d3d2f99f0ee3c7ee5bf64a5ac79c42bd433f149be8cb59548361640595513c97af7bc2509723 - Output=21026e6800c7fa728fcaaba0d196ae28d7a2ac4ffd8abce794f0985f60c8a6737277365d3fea11db8923a2029a + Decrypt = RSA-2049 + Input = 013300edbf0bb3571e59889f7ed76970bf6d57e1c89bbb6d1c3991d9df8e65ed54b556d928da7d768facb395bbcc81e9f8573b45cf8195dbd85d83a59281cddf4163aec11b53b4140053e3bd109f787a7c3cec31d535af1f50e0598d85d96d91ea01913d07097d25af99c67464ebf2bb396fb28a9233e56f31f7e105d71a23e9ef3b736d1e80e713d1691713df97334779552fc94b40dd733c7251bc522b673d3ec9354af3dd4ad44fa71c0662213a57ada1d75149697d0eb55c053aaed5ffd0b815832f454179519d3736fb4faf808416071db0d0f801aca8548311ee708c131f4be658b15f6b54256872c2903ac708bd43b017b073b5707bc84c2cd9da70e967 + Output = "lorem ipsum" + # positive test case with null padded ciphertext +Availablein = default - Decrypt=RSA-OAEP-5 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 -@@ -889,36 +919,42 @@ xT1F29tenZbQ/s9Cdd8JdLxKBza0p0wyaQU++2hqziQG4iyeBY3bSuVAYnri/bCC - Yejn5Ly8mU2q+jBcRQ== - -----END PRIVATE KEY----- + Decrypt = RSA-2049 + Input = 0002aadf846a329fadc6760980303dbd87bfadfa78c2015ce4d6c5782fd9d3f1078bd3c0a2c5bfbdd1c024552e5054d98b5bcdc94e476dd280e64d650089326542ce7c61d4f1ab40004c2e6a88a883613568556a10f3f9edeab67ae8dddc1e6b0831c2793d2715de943f7ce34c5c05d1b09f14431fde566d17e76c9feee90d86a2c158616ec81dda0c642f58c0ba8fa4495843124a7235d46fb4069715a51bf710fd024259131ba94da73597ace494856c94e7a3ec261545793b0990279b15fa91c7fd13dbfb1df2f221dab9fa9f7c1d21e48aa49f6aaecbabf5ee76dc6c2af2317ffb4e303115386a97f8729afc3d0c89419669235f1a3a69570e0836c79fc162 + Output = "lorem ipsum" + # positive test case with null truncated ciphertext +Availablein = default - Decrypt=RSA-OAEP-6 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=0630eebcd2856c24f798806e41f9e67345eda9ceda386acc9facaea1eeed06ace583709718d9d169fadf414d5c76f92996833ef305b75b1e4b95f662a20faedc3bae0c4827a8bf8a88edbd57ec203a27a841f02e43a615bab1a8cac0701de34debdef62a088089b55ec36ea7522fd3ec8d06b6a073e6df833153bc0aefd93bd1a3 - Output=4046ca8baa3347ca27f49e0d81f9cc1d71be9ba517d4 + Decrypt = RSA-2049 + Input = 02aadf846a329fadc6760980303dbd87bfadfa78c2015ce4d6c5782fd9d3f1078bd3c0a2c5bfbdd1c024552e5054d98b5bcdc94e476dd280e64d650089326542ce7c61d4f1ab40004c2e6a88a883613568556a10f3f9edeab67ae8dddc1e6b0831c2793d2715de943f7ce34c5c05d1b09f14431fde566d17e76c9feee90d86a2c158616ec81dda0c642f58c0ba8fa4495843124a7235d46fb4069715a51bf710fd024259131ba94da73597ace494856c94e7a3ec261545793b0990279b15fa91c7fd13dbfb1df2f221dab9fa9f7c1d21e48aa49f6aaecbabf5ee76dc6c2af2317ffb4e303115386a97f8729afc3d0c89419669235f1a3a69570e0836c79fc162 + Output = "lorem ipsum" + # positive test case with double null padded ciphertext +Availablein = default - Decrypt=RSA-OAEP-6 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=0ebc37376173a4fd2f89cc55c2ca62b26b11d51c3c7ce49e8845f74e7607317c436bc8d23b9667dfeb9d087234b47bc6837175ae5c0559f6b81d7d22416d3e50f4ac533d8f0812f2db9e791fe9c775ac8b6ad0f535ad9ceb23a4a02014c58ab3f8d3161499a260f39348e714ae2a1d3443208fd8b722ccfdfb393e98011f99e63f - Output=5cc72c60231df03b3d40f9b57931bc31109f972527f28b19e7480c7288cb3c92b22512214e4be6c914792ddabdf57faa8aa7 + Decrypt = RSA-2049 + Input = 0000f36da3b72d8ff6ded74e7efd08c01908f3f5f0de7b55eab92b5f875190809c39d4162e1e6649618f854fd84aeab03970d16bb814e999852c06de38d82b95c0f32e2a7b5714021fe303389be9c0eac24c90a6b7210f929d390fabf903d44e04110bb7a7fd6c383c275804721efa6d7c93aa64c0bb2b18d97c5220a846c66a4895ae52adddbe2a9996825e013585adcec4b32ba61d782737bd343e5fabd68e8a95b8b1340318559860792dd70dffbe05a1052b54cbfb48cfa7bb3c19cea52076bddac5c25ee276f153a610f6d06ed696d192d8ae4507ffae4e5bdda10a625d6b67f32f7cffcd48dee2431fe66f6105f9d17e611cdcc674868e81692a360f4052 + Output = "lorem ipsum" + # positive test case with double null truncated ciphertext +Availablein = default - Decrypt=RSA-OAEP-6 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=0a98bf1093619394436cf68d8f38e2f158fde8ea54f3435f239b8d06b8321844202476aeed96009492480ce3a8d705498c4c8c68f01501dc81db608f60087350c8c3b0bd2e9ef6a81458b7c801b89f2e4fe99d4900ba6a4b5e5a96d865dc676c7755928794130d6280a8160a190f2df3ea7cf9aa0271d88e9e6905ecf1c5152d65 - Output=b20e651303092f4bccb43070c0f86d23049362ed96642fc5632c27db4a52e3d831f2ab068b23b149879c002f6bf3feee97591112562c + Decrypt = RSA-2049 + Input = f36da3b72d8ff6ded74e7efd08c01908f3f5f0de7b55eab92b5f875190809c39d4162e1e6649618f854fd84aeab03970d16bb814e999852c06de38d82b95c0f32e2a7b5714021fe303389be9c0eac24c90a6b7210f929d390fabf903d44e04110bb7a7fd6c383c275804721efa6d7c93aa64c0bb2b18d97c5220a846c66a4895ae52adddbe2a9996825e013585adcec4b32ba61d782737bd343e5fabd68e8a95b8b1340318559860792dd70dffbe05a1052b54cbfb48cfa7bb3c19cea52076bddac5c25ee276f153a610f6d06ed696d192d8ae4507ffae4e5bdda10a625d6b67f32f7cffcd48dee2431fe66f6105f9d17e611cdcc674868e81692a360f4052 + Output = "lorem ipsum" + # The old FIPS provider doesn't include the workaround (#13817) +-FIPSversion = >=3.2.0 +Availablein = default - Decrypt=RSA-OAEP-6 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=008e7a67cacfb5c4e24bec7dee149117f19598ce8c45808fef88c608ff9cd6e695263b9a3c0ad4b8ba4c95238e96a8422b8535629c8d5382374479ad13fa39974b242f9a759eeaf9c83ad5a8ca18940a0162ba755876df263f4bd50c6525c56090267c1f0e09ce0899a0cf359e88120abd9bf893445b3cae77d3607359ae9a52f8 - Output=684e3038c5c041f7 + # a random negative test case that generates an 11 byte long message + Decrypt = RSA-2049 + Input = 00f910200830fc8fff478e99e145f1474b312e2512d0f90b8cef77f8001d09861688c156d1cbaf8a8957f7ebf35f724466952d0524cad48aad4fba1e45ce8ea27e8f3ba44131b7831b62d60c0762661f4c1d1a88cd06263a259abf1ba9e6b0b172069afb86a7e88387726f8ab3adb30bfd6b3f6be6d85d5dfd044e7ef052395474a9cbb1c3667a92780b43a22693015af6c513041bdaf87d43b24ddd244e791eeaea1066e1f4917117b3a468e22e0f7358852bb981248de4d720add2d15dccba6280355935b67c96f9dcb6c419cc38ab9f6fba2d649ef2066e0c34c9f788ae49babd9025fa85b21113e56ce4f43aa134c512b030dd7ac7ce82e76f0be9ce09ebca + Output = 1189b6f5498fd6df532b00 + # The old FIPS provider doesn't include the workaround (#13817) +-FIPSversion = >=3.2.0 +Availablein = default - Decrypt=RSA-OAEP-6 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=00003474416c7b68bdf961c385737944d7f1f40cb395343c693cc0b4fe63b31fedf1eaeeac9ccc0678b31dc32e0977489514c4f09085f6298a9653f01aea4045ff582ee887be26ae575b73eef7f3774921e375a3d19adda0ca31aa1849887c1f42cac9677f7a2f4e923f6e5a868b38c084ef187594dc9f7f048fea2e02955384ab - Output=32488cb262d041d6e4dd35f987bf3ca696db1f06ac29a44693 + # otherwise correct plaintext, but with wrong first byte (0x01 instead of 0x00) + Decrypt = RSA-2049 + Input = 002c9ddc36ba4cf0038692b2d3a1c61a4bb3786a97ce2e46a3ba74d03158aeef456ce0f4db04dda3fe062268a1711250a18c69778a6280d88e133a16254e1f0e30ce8dac9b57d2e39a2f7d7be3ee4e08aec2fdbe8dadad7fdbf442a29a8fb40857407bf6be35596b8eefb5c2b3f58b894452c2dc54a6123a1a38d642e23751746597e08d71ac92704adc17803b19e131b4d1927881f43b0200e6f95658f559f912c889b4cd51862784364896cd6e8618f485a992f82997ad6a0917e32ae5872eaf850092b2d6c782ad35f487b79682333c1750c685d7d32ab3e1538f31dcaa5e7d5d2825875242c83947308dcf63ba4bfff20334c9c140c837dbdbae7a8dee72ff + Output = f6d0f5b78082fe61c04674 + # The old FIPS provider doesn't include the workaround (#13817) +-FIPSversion = >=3.2.0 +Availablein = default - Decrypt=RSA-OAEP-6 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 -@@ -943,36 +979,42 @@ tu4XIedy0DiaVZw9PN+VUNRXxGsDe3RkGx1SFmr4ohPIOWIGzfukQi8Y1vYdvLXS - FMlxv0gq65dqc3DC - -----END PRIVATE KEY----- + # otherwise correct plaintext, but with wrong second byte (0x01 instead of 0x02) + Decrypt = RSA-2049 + Input = 00c5d77826c1ab7a34d6390f9d342d5dbe848942e2618287952ba0350d7de6726112e9cebc391a0fae1839e2bf168229e3e0d71d4161801509f1f28f6e1487ca52df05c466b6b0a6fbbe57a3268a970610ec0beac39ec0fa67babce1ef2a86bf77466dc127d7d0d2962c20e66593126f276863cd38dc6351428f884c1384f67cad0a0ffdbc2af16711fb68dc559b96b37b4f04cd133ffc7d79c43c42ca4948fa895b9daeb853150c8a5169849b730cc77d68b0217d6c0e3dbf38d751a1998186633418367e7576530566c23d6d4e0da9b038d0bb5169ce40133ea076472d055001f0135645940fd08ea44269af2604c8b1ba225053d6db9ab43577689401bdc0f3 +@@ -661,14 +674,14 @@ ooCElYcob01/JWzoXl61Z5sdrMH5CVZJty5foHKusAN5AgMBAAE= + PrivPubKeyPair = RSA-3072:RSA-3072-PUBLIC + # The old FIPS provider doesn't include the workaround (#13817) +-FIPSversion = >=3.2.0 +Availablein = default - Decrypt=RSA-OAEP-7 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=1688e4ce7794bba6cb7014169ecd559cede2a30b56a52b68d9fe18cf1973ef97b2a03153951c755f6294aa49adbdb55845ab6875fb3986c93ecf927962840d282f9e54ce8b690f7c0cb8bbd73440d9571d1b16cd9260f9eab4783cc482e5223dc60973871783ec27b0ae0fd47732cbc286a173fc92b00fb4ba6824647cd93c85c1 - Output=47aae909 + # a random invalid ciphertext that generates an empty synthetic one + Decrypt = RSA-3072 + Input = 5e956cd9652f4a2ece902931013e09662b6a9257ad1e987fb75f73a0606df2a4b04789770820c2e02322c4e826f767bd895734a01e20609c3be4517a7a2a589ea1cdc137beb73eb38dac781b52e863de9620f79f9b90fd5b953651fcbfef4a9f1cc07421d511a87dd6942caab6a5a0f4df473e62defb529a7de1509ab99c596e1dff1320402298d8be73a896cc86c38ae3f2f576e9ea70cc28ad575cb0f854f0be43186baa9c18e29c47c6ca77135db79c811231b7c1730955887d321fdc06568382b86643cf089b10e35ab23e827d2e5aa7b4e99ff2e914f302351819eb4d1693243b35f8bf1d42d08f8ec4acafa35f747a4a975a28643ec630d8e4fa5be59d81995660a14bb64c1fea5146d6b11f92da6a3956dd5cb5e0d747cf2ea23f81617769185336263d46ef4c144b754de62a6337342d6c85a95f19f015724546ee3fc4823eca603dbc1dc01c2d5ed50bd72d8e96df2dc048edde0081284068283fc5e73a6139851abf2f29977d0b3d160c883a42a37efba1be05c1a0b1741d7ddf59 + Output = + # The old FIPS provider doesn't include the workaround (#13817) +-FIPSversion = >=3.2.0 +Availablein = default - Decrypt=RSA-OAEP-7 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=1052ed397b2e01e1d0ee1c50bf24363f95e504f4a03434a08fd822574ed6b9736edbb5f390db10321479a8a139350e2bd4977c3778ef331f3e78ae118b268451f20a2f01d471f5d53c566937171b2dbc2d4bde459a5799f0372d6574239b2323d245d0bb81c286b63c89a361017337e4902f88a467f4c7f244bfd5ab46437ff3b6 - Output=1d9b2e2223d9bc13bfb9f162ce735db48ba7c68f6822a0a1a7b6ae165834e7 + # a random invalid that has PRF output with a length one byte too long + # in the last value + Decrypt = RSA-3072 +@@ -676,46 +689,51 @@ Input = 7db0390d75fcf9d4c59cf27b264190d856da9abd11e92334d0e5f71005cfed865a711dfa + Output = 56a3bea054e01338be9b7d7957539c + # The old FIPS provider doesn't include the workaround (#13817) +-FIPSversion = >=3.2.0 +Availablein = default - Decrypt=RSA-OAEP-7 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=2155cd843ff24a4ee8badb7694260028a490813ba8b369a4cbf106ec148e5298707f5965be7d101c1049ea8584c24cd63455ad9c104d686282d3fb803a4c11c1c2e9b91c7178801d1b6640f003f5728df007b8a4ccc92bce05e41a27278d7c85018c52414313a5077789001d4f01910b72aad05d220aa14a58733a7489bc54556b - Output=d976fc + # a random invalid that generates a synthetic of maximum size + Decrypt = RSA-3072 + Input = 1715065322522dff85049800f6a29ab5f98c465020467414b2a44127fe9446da47fa18047900f99afe67c2df6f50160bb8e90bff296610fde632b3859d4d0d2e644f23835028c46cca01b84b88231d7e03154edec6627bcba23de76740d839851fa12d74c8f92e540c73fe837b91b7d699b311997d5f0f7864c486d499c3a79c111faaacbe4799597a25066c6200215c3d158f3817c1aa57f18bdaad0be1658da9da93f5cc6c3c4dd72788af57adbb6a0c26f42d32d95b8a4f95e8c6feb2f8a5d53b19a50a0b7cbc25e055ad03e5ace8f3f7db13e57759f67b65d143f08cca15992c6b2aae643390483de111c2988d4e76b42596266005103c8de6044fb7398eb3c28a864fa672de5fd8774510ff45e05969a11a4c7d3f343e331190d2dcf24fb9154ba904dc94af98afc5774a9617d0418fe6d13f8245c7d7626c176138dd698a23547c25f27c2b98ea4d8a45c7842b81888e4cc14e5b72e9cf91f56956c93dbf2e5f44a8282a7813157fc481ff1371a0f66b31797e81ebdb09a673d4db96d6 + Output = 7b036fcd6243900e4236c894e2462c17738acc87e01a76f4d95cb9a328d9acde81650283b8e8f60a217e3bdee835c7b222ad4c85d0acdb9a309bd2a754609a65dec50f3aa04c6d5891034566b9563d42668ede1f8992b17753a2132e28970584e255efc8b45a41c5dbd7567f014acec5fe6fdb6d484790360a913ebb9defcd74ff377f2a8ba46d2ed85f733c9a3da08eb57ecedfafda806778f03c66b2c5d2874cec1c291b2d49eb194c7b5d0dd2908ae90f4843268a2c45563092ade08acb6ab481a08176102fc803fbb2f8ad11b0e1531bd37df543498daf180b12017f4d4d426ca29b4161075534bfb914968088a9d13785d0adc0e2580d3548494b2a9e91605f2b27e6cc701c796f0de7c6f471f6ab6cb9272a1ed637ca32a60d117505d82af3c1336104afb537d01a8f70b510e1eebf4869cb976c419473795a66c7f5e6e20a8094b1bb603a74330c537c5c0698c31538bd2e138c1275a1bdf24c5fa8ab3b7b526324e7918a382d1363b3d463764222150e04 + # a positive test case that decrypts to 9 byte long value +Availablein = default - Decrypt=RSA-OAEP-7 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=0ab14c373aeb7d4328d0aaad8c094d88b9eb098b95f21054a29082522be7c27a312878b637917e3d819e6c3c568db5d843802b06d51d9e98a2be0bf40c031423b00edfbff8320efb9171bd2044653a4cb9c5122f6c65e83cda2ec3c126027a9c1a56ba874d0fea23f380b82cf240b8cf540004758c4c77d934157a74f3fc12bfac - Output=d4738623df223aa43843df8467534c41d013e0c803c624e263666b239bde40a5f29aeb8de79e3daa61dd0370f49bd4b013834b98212aef6b1c5ee373b3cb + Decrypt = RSA-3072 + Input = 6c60845a854b4571f678941ae35a2ac03f67c21e21146f9db1f2306be9f136453b86ad55647d4f7b5c9e62197aaff0c0e40a3b54c4cde14e774b1c5959b6c2a2302896ffae1f73b00b862a20ff4304fe06cea7ff30ecb3773ca9af27a0b54547350d7c07dfb0a39629c7e71e83fc5af9b2adbaf898e037f1de696a3f328cf45af7ec9aff7173854087fb8fbf34be981efbd8493f9438d1b2ba2a86af082662aa46ae9adfbec51e5f3d9550a4dd1dcb7c8969c9587a6edc82a8cabbc785c40d9fbd12064559fb769450ac3e47e87bc046148130d7eaa843e4b3ccef3675d0630500803cb7ffee3882378c1a404e850c3e20707bb745e42b13c18786c4976076ed9fa8fd0ff15e571bef02cbbe2f90c908ac3734a433b73e778d4d17fcc28f49185ebc6e8536a06d293202d94496453bfdf1c2c7833a3f99fa38ca8a81f42eaa529d603b890308a319c0ab63a35ff8ebac965f6278f5a7e5d622be5d5fe55f0ca3ec993d55430d2bf59c5d3e860e90c16d91a04596f6fdf60d89ed95d88c036dde + Output = "forty two" + # a positive test case with null padded ciphertext +Availablein = default - Decrypt=RSA-OAEP-7 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=028387a318277434798b4d97f460068df5298faba5041ba11761a1cb7316b24184114ec500257e2589ed3b607a1ebbe97a6cc2e02bf1b681f42312a33b7a77d8e7855c4a6de03e3c04643f786b91a264a0d6805e2cea91e68177eb7a64d9255e4f27e713b7ccec00dc200ebd21c2ea2bb890feae4942df941dc3f97890ed347478 - Output=bb47231ca5ea1d3ad46c99345d9a8a61 + Decrypt = RSA-3072 + Input = 00f4d565a3286784dbb85327db8807ae557ead229f92aba945cecda5225f606a7d6130edeeb6f26724d1eff1110f9eb18dc3248140ee3837e6688391e78796c526791384f045e21b6b853fb6342a11f309eb77962f37ce23925af600847fbd30e6e07e57de50b606e6b7f288cc777c1a6834f27e6edace508452128916eef7788c8bb227e3548c6a761cc4e9dd1a3584176dc053ba3500adb1d5e1611291654f12dfc5722832f635db3002d73f9defc310ace62c63868d341619c7ee15b20243b3371e05078e11219770c701d9f341af35df1bc729de294825ff2e416aa11526612852777eb131f9c45151eb144980d70608d2fc4043477368369aa0fe487a48bd57e66b00c3c58f941549f5ec050fca64449debe7a0c4ac51e55cb71620a70312aa4bd85fac1410c9c7f9d6ec610b7d11bf8faeffa20255d1a1bead9297d0aa8765cd2805847d639bc439f4a6c896e2008f746f9590ff4596de5ddde000ed666c452c978043ff4298461eb5a26d5e63d821438627f91201924bf7f2aeee1727 + Output = "forty two" + # a positive test case with null truncated ciphertext +Availablein = default - Decrypt=RSA-OAEP-7 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 -@@ -997,36 +1039,42 @@ njraT2MgdSwJ2AX/fR8a4NAXru7pzvoNfdf/d15EtXgyL2QF1iEdoZUZZmqof9xM - 2MiPa249Z+lh3Luj0A== - -----END PRIVATE KEY----- + Decrypt = RSA-3072 + Input = f4d565a3286784dbb85327db8807ae557ead229f92aba945cecda5225f606a7d6130edeeb6f26724d1eff1110f9eb18dc3248140ee3837e6688391e78796c526791384f045e21b6b853fb6342a11f309eb77962f37ce23925af600847fbd30e6e07e57de50b606e6b7f288cc777c1a6834f27e6edace508452128916eef7788c8bb227e3548c6a761cc4e9dd1a3584176dc053ba3500adb1d5e1611291654f12dfc5722832f635db3002d73f9defc310ace62c63868d341619c7ee15b20243b3371e05078e11219770c701d9f341af35df1bc729de294825ff2e416aa11526612852777eb131f9c45151eb144980d70608d2fc4043477368369aa0fe487a48bd57e66b00c3c58f941549f5ec050fca64449debe7a0c4ac51e55cb71620a70312aa4bd85fac1410c9c7f9d6ec610b7d11bf8faeffa20255d1a1bead9297d0aa8765cd2805847d639bc439f4a6c896e2008f746f9590ff4596de5ddde000ed666c452c978043ff4298461eb5a26d5e63d821438627f91201924bf7f2aeee1727 + Output = "forty two" + # a positive test case with double null padded ciphertext +Availablein = default - Decrypt=RSA-OAEP-8 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=09b3683d8a2eb0fb295b62ed1fb9290b714457b7825319f4647872af889b30409472020ad12912bf19b11d4819f49614824ffd84d09c0a17e7d17309d12919790410aa2995699f6a86dbe3242b5acc23af45691080d6b1ae810fb3e3057087f0970092ce00be9562ff4053b6262ce0caa93e13723d2e3a5ba075d45f0d61b54b61 - Output=050b755e5e6880f7b9e9d692a74c37aae449b31bfea6deff83747a897f6c2c825bb1adbf850a3c96994b5de5b33cbc7d4a17913a7967 + Decrypt = RSA-3072 + Input = 00001ec97ac981dfd9dcc7a7389fdfa9d361141dac80c23a060410d472c16094e6cdffc0c3684d84aa402d7051dfccb2f6da33f66985d2a259f5b7fbf39ac537e95c5b7050eb18844a0513abef812cc8e74a3c5240009e6e805dcadf532bc1a2702d5acc9e585fad5b89d461fcc1397351cdce35171523758b171dc041f412e42966de7f94856477356d06f2a6b40e3ff0547562a4d91bbf1338e9e049facbee8b20171164505468cd308997447d3dc4b0acb49e7d368fedd8c734251f30a83491d2506f3f87318cc118823244a393dc7c5c739a2733d93e1b13db6840a9429947357f47b23fbe39b7d2d61e5ee26f9946c4632f6c4699e452f412a26641d4751135400713cd56ec66f0370423d55d2af70f5e7ad0adea8e4a0d904a01e4ac272eba4af1a029dd53eb71f115bf31f7a6c8b19a6523adeecc0d4c3c107575e38572a8f8474ccad163e46e2e8b08111132aa97a16fb588c9b7e37b3b3d7490381f3c55d1a9869a0fd42cd86fed59ecec78cb6b2dfd06a497f5afe3419691314ba0 + Output = "forty two" + # a positive test case with double null truncated ciphertext +Availablein = default - Decrypt=RSA-OAEP-8 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=2ecf15c97c5a15b1476ae986b371b57a24284f4a162a8d0c8182e7905e792256f1812ba5f83f1f7a130e42dcc02232844edc14a31a68ee97ae564a383a3411656424c5f62ddb646093c367be1fcda426cf00a06d8acb7e57776fbbd855ac3df506fc16b1d7c3f2110f3d8068e91e186363831c8409680d8da9ecd8cf1fa20ee39d - Output=4eb68dcd93ca9b19df111bd43608f557026fe4aa1d5cfac227a3eb5ab9548c18a06dded23f81825986b2fcd71109ecef7eff88873f075c2aa0c469f69c92bc + Decrypt = RSA-3072 + Input = 1ec97ac981dfd9dcc7a7389fdfa9d361141dac80c23a060410d472c16094e6cdffc0c3684d84aa402d7051dfccb2f6da33f66985d2a259f5b7fbf39ac537e95c5b7050eb18844a0513abef812cc8e74a3c5240009e6e805dcadf532bc1a2702d5acc9e585fad5b89d461fcc1397351cdce35171523758b171dc041f412e42966de7f94856477356d06f2a6b40e3ff0547562a4d91bbf1338e9e049facbee8b20171164505468cd308997447d3dc4b0acb49e7d368fedd8c734251f30a83491d2506f3f87318cc118823244a393dc7c5c739a2733d93e1b13db6840a9429947357f47b23fbe39b7d2d61e5ee26f9946c4632f6c4699e452f412a26641d4751135400713cd56ec66f0370423d55d2af70f5e7ad0adea8e4a0d904a01e4ac272eba4af1a029dd53eb71f115bf31f7a6c8b19a6523adeecc0d4c3c107575e38572a8f8474ccad163e46e2e8b08111132aa97a16fb588c9b7e37b3b3d7490381f3c55d1a9869a0fd42cd86fed59ecec78cb6b2dfd06a497f5afe3419691314ba0 + Output = "forty two" + # The old FIPS provider doesn't include the workaround (#13817) +-FIPSversion = >=3.2.0 +Availablein = default - Decrypt=RSA-OAEP-8 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=4bc89130a5b2dabb7c2fcf90eb5d0eaf9e681b7146a38f3173a3d9cfec52ea9e0a41932e648a9d69344c50da763f51a03c95762131e8052254dcd2248cba40fd31667786ce05a2b7b531ac9dac9ed584a59b677c1a8aed8c5d15d68c05569e2be780bf7db638fd2bfd2a85ab276860f3777338fca989ffd743d13ee08e0ca9893f - Output=8604ac56328c1ab5ad917861 + # a random negative test case that generates a 9 byte long message + Decrypt = RSA-3072 + Input = 5c8555f5cef627c15d37f85c7f5fd6e499264ea4b8e3f9112023aeb722eb38d8eac2be3751fd5a3785ab7f2d59fa3728e5be8c3de78a67464e30b21ee23b5484bb3cd06d0e1c6ad25649c8518165653eb80488bfb491b20c04897a6772f69292222fc5ef50b5cf9efc6d60426a449b6c489569d48c83488df629d695653d409ce49a795447fcec2c58a1a672e4a391401d428baaf781516e11e323d302fcf20f6eab2b2dbe53a48c987e407c4d7e1cb41131329138313d330204173a4f3ff06c6fadf970f0ed1005d0b27e35c3d11693e0429e272d583e57b2c58d24315c397856b34485dcb077665592b747f889d34febf2be8fce66c265fd9fc3575a6286a5ce88b4b413a08efc57a07a8f57a999605a837b0542695c0d189e678b53662ecf7c3d37d9dbeea585eebfaf79141118e06762c2381fe27ca6288edddc19fd67cd64f16b46e06d8a59ac530f22cd83cc0bc4e37feb52015cbb2283043ccf5e78a4eb7146827d7a466b66c8a4a4826c1bad68123a7f2d00fc1736525ff90c058f56 + Output = 257906ca6de8307728 + # The old FIPS provider doesn't include the workaround (#13817) +-FIPSversion = >=3.2.0 +Availablein = default - Decrypt=RSA-OAEP-8 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=2e456847d8fc36ff0147d6993594b9397227d577752c79d0f904fcb039d4d812fea605a7b574dd82ca786f93752348438ee9f5b5454985d5f0e1699e3e7ad175a32e15f03deb042ab9fe1dd9db1bb86f8c089ccb45e7ef0c5ee7ca9b7290ca6b15bed47039788a8a93ff83e0e8d6244c71006362deef69b6f416fb3c684383fbd0 - Output=fdda5fbf6ec361a9d9a4ac68af216a0686f438b1e0e5c36b955f74e107f39c0dddcc + # a random negative test case that generates a 9 byte long message based on + # second to last value from PRF + Decrypt = RSA-3072 +@@ -723,7 +741,7 @@ Input = 758c215aa6acd61248062b88284bf43c13cb3b3d02410be4238607442f1c0216706e21a0 + Output = 043383c929060374ed + # The old FIPS provider doesn't include the workaround (#13817) +-FIPSversion = >=3.2.0 +Availablein = default - Decrypt=RSA-OAEP-8 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=1fb9356fd5c4b1796db2ebf7d0d393cc810adf6145defc2fce714f79d93800d5e2ac211ea8bbecca4b654b94c3b18b30dd576ce34dc95436ef57a09415645923359a5d7b4171ef22c24670f1b229d3603e91f76671b7df97e7317c97734476d5f3d17d21cf82b5ba9f83df2e588d36984fd1b584468bd23b2e875f32f68953f7b2 - Output=4a5f4914bee25de3c69341de07 + # a random negative test that generates message based on 3rd last value from + # PRF + Decrypt = RSA-3072 +@@ -731,35 +749,35 @@ Input = 7b22d5e62d287968c6622171a1f75db4b0fd15cdf3134a1895d235d56f8d8fe619f2bf48 + Output = 70263fa6050534b9e0 + # The old FIPS provider doesn't include the workaround (#13817) +-FIPSversion = >=3.2.0 +Availablein = default - Decrypt=RSA-OAEP-8 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 -@@ -1057,36 +1105,42 @@ Z7CDuaemy2HkLbNiuMmJbbcGTgKtWuYVh9oVtGSckFlJCf6zfby2VL63Jo7IAeWo - tKo5Eb69iFQvBb4= - -----END PRIVATE KEY----- + # an otherwise valid plaintext, but with wrong first byte (0x01 instead of 0x00) + Decrypt = RSA-3072 + Input = 6db80adb5ff0a768caf1378ecc382a694e7d1bde2eff4ba12c48aaf794ded7a994a5b2b57acec20dbec4ae385c9dd531945c0f197a5496908725fc99d88601a17d3bb0b2d38d2c1c3100f39955a4cb3dbed5a38bf900f23d91e173640e4ec655c84fdfe71fcdb12a386108fcf718c9b7af37d39703e882436224c877a2235e8344fba6c951eb7e2a4d1d1de81fb463ac1b880f6cc0e59ade05c8ce35179ecd09546731fc07b141d3d6b342a97ae747e61a9130f72d37ac5a2c30215b6cbd66c7db893810df58b4c457b4b54f34428247d584e0fa71062446210db08254fb9ead1ba1a393c724bd291f0cf1a7143f32df849051dc896d7d176fef3b57ab6dffd626d0c3044e9edb2e3d012ace202d2581df01bec7e9aa0727a6650dd373d374f0bc0f4a611f8139dfe97d63e70c6188f4df5b672e47c51d8aa567097293fbff127c75ec690b43407578b73c85451710a0cece58fd497d7f7bd36a8a92783ef7dc6265dff52aac8b70340b996508d39217f2783ce6fc91a1cc94bb2ac487b84f62 + Output = 6d8d3a094ff3afff4c + # The old FIPS provider doesn't include the workaround (#13817) +-FIPSversion = >=3.2.0 +Availablein = default - Decrypt=RSA-OAEP-9 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=267bcd118acab1fc8ba81c85d73003cb8610fa55c1d97da8d48a7c7f06896a4db751aa284255b9d36ad65f37653d829f1b37f97b8001942545b2fc2c55a7376ca7a1be4b1760c8e05a33e5aa2526b8d98e317088e7834c755b2a59b12631a182c05d5d43ab1779264f8456f515ce57dfdf512d5493dab7b7338dc4b7d78db9c091ac3baf537a69fc7f549d979f0eff9a94fda4169bd4d1d19a69c99e33c3b55490d501b39b1edae118ff6793a153261584d3a5f39f6e682e3d17c8cd1261fa72 - Output=f735fd55ba92592c3b52b8f9c4f69aaa1cbef8fe88add095595412467f9cf4ec0b896c59eda16210e7549c8abb10cdbc21a12ec9b6b5b8fd2f10399eb6 + # an otherwise valid plaintext, but with wrong second byte (0x01 instead of 0x02) + Decrypt = RSA-3072 + Input = 417328c034458563079a4024817d0150340c34e25ae16dcad690623f702e5c748a6ebb3419ff48f486f83ba9df35c05efbd7f40613f0fc996c53706c30df6bba6dcd4a40825f96133f3c21638a342bd4663dffbd0073980dac47f8c1dd8e97ce1412e4f91f2a8adb1ac2b1071066efe8d718bbb88ca4a59bd61500e826f2365255a409bece0f972df97c3a55e09289ef5fa815a2353ef393fd1aecfc888d611c16aec532e5148be15ef1bf2834b8f75bb26db08b66d2baad6464f8439d1986b533813321dbb180080910f233bcc4dd784fb21871aef41be08b7bfad4ecc3b68f228cb5317ac6ec1227bc7d0e452037ba918ee1da9fdb8393ae93b1e937a8d4691a17871d5092d2384b6190a53df888f65b951b05ed4ad57fe4b0c6a47b5b22f32a7f23c1a234c9feb5d8713d949686760680da4db454f4acad972470033472b9864d63e8d23eefc87ebcf464ecf33f67fbcdd48eab38c5292586b36aef5981ed2fa07b2f9e23fc57d9eb71bfff4111c857e9fff23ceb31e72592e70c874b4936 + Output = c6ae80ffa80bc184b0 + # The old FIPS provider doesn't include the workaround (#13817) +-FIPSversion = >=3.2.0 +Availablein = default - Decrypt=RSA-OAEP-9 - Ctrl = rsa_padding_mode:oaep - Ctrl = rsa_mgf1_md:sha1 - Input=93ac9f0671ec29acbb444effc1a5741351d60fdb0e393fbf754acf0de49761a14841df7772e9bc82773966a1584c4d72baea00118f83f35cca6e537cbd4d811f5583b29783d8a6d94cd31be70d6f526c10ff09c6fa7ce069795a3fcd0511fd5fcb564bcc80ea9c78f38b80012539d8a4ddf6fe81e9cddb7f50dbbbbcc7e5d86097ccf4ec49189fb8bf318be6d5a0715d516b49af191258cd32dc833ce6eb4673c03a19bbace88cc54895f636cc0c1ec89096d11ce235a265ca1764232a689ae8 - Output=81b906605015a63aabe42ddf11e1978912f5404c7474b26dce3ed482bf961ecc818bf420c54659 + # an otherwise valid plaintext, but with zero byte in first byte of padding + Decrypt = RSA-3072 + Input = 8542c626fe533467acffcd4e617692244c9b5a3bf0a215c5d64891ced4bf4f9591b4b2aedff9843057986d81631b0acb3704ec2180e5696e8bd15b217a0ec36d2061b0e2182faa3d1c59bd3f9086a10077a3337a3f5da503ec3753535ffd25b837a12f2541afefd0cffb0224b8f874e4bed13949e105c075ed44e287c5ae03b155e06b90ed247d2c07f1ef3323e3508cce4e4074606c54172ad74d12f8c3a47f654ad671104bf7681e5b061862747d9afd37e07d8e0e2291e01f14a95a1bb4cbb47c304ef067595a3947ee2d722067e38a0f046f43ec29cac6a8801c6e3e9a2331b1d45a7aa2c6af3205be382dd026e389614ee095665a611ab2e8dced2ee1c9d08ac9de11aef5b3803fc9a9ce8231ec87b5fed386fb92ee3db995a89307bcba844bd0a691c29ae51216e949dfc813133cb06a07265fd807bcb3377f6adb0a481d9b7f442003115895939773e6b95371c4febef29edae946fa245e7c50729e2e558cfaad773d1fd5f67b457a6d9d17a847c6fcbdb103a86f35f228cefc06cea0 + Output = a8a9301daa01bb25c7 + # The old FIPS provider doesn't include the workaround (#13817) +-FIPSversion = >=3.2.0 +Availablein = default - Decrypt=RSA-OAEP-9 + # an otherwise valid plaintext, but with zero byte in eight byte of padding + Decrypt = RSA-3072 + Input = 449dfa237a70a99cb0351793ec8677882021c2aa743580bf6a0ea672055cffe8303ac42855b1d1f3373aae6af09cb9074180fc963e9d1478a4f98b3b4861d3e7f0aa8560cf603711f139db77667ca14ba3a1acdedfca9ef4603d6d7eb0645bfc805304f9ad9d77d34762ce5cd84bd3ec9d35c30e3be72a1e8d355d5674a141b5530659ad64ebb6082e6f73a80832ab6388912538914654d34602f4b3b1c78589b4a5d964b2efcca1dc7004c41f6cafcb5a7159a7fc7c0398604d0edbd4c8f4f04067da6a153a05e7cbeea13b5ee412400ef7d4f3106f4798da707ec37a11286df2b7a204856d5ff773613fd1e453a7114b78e347d3e8078e1cb3276b3562486ba630bf719697e0073a123c3e60ebb5c7a1ccff4279faffa2402bc1109f8d559d6766e73591943dfcf25ba10c3762f02af85187799b8b4b135c3990793a6fd32642f1557405ba55cc7cf7336a0e967073c5fa50743f9cc5e3017c172d9898d2af83345e71b3e0c22ab791eacb6484a32ec60ebc226ec9deaee91b1a0560c2b571 + Output = 6c716fe01d44398018 + + # The old FIPS provider doesn't include the workaround (#13817) +-FIPSversion = >=3.2.0 ++Availablein = default + # an otherwise valid plaintext, but with null separator missing + Decrypt = RSA-3072 + Input = a7a5c99e50da48769ecb779d9abe86ef9ec8c38c6f43f17c7f2d7af608a4a1bd6cf695b47e97c191c61fb5a27318d02f495a176b9fae5a55b5d3fabd1d8aae4957e3879cb0c60f037724e11be5f30f08fc51c033731f14b44b414d11278cd3dba7e1c8bfe208d2b2bb7ec36366dacb6c88b24cd79ab394adf19dbbc21dfa5788bacbadc6a62f79cf54fd8cf585c615b5c0eb94c35aa9de25321c8ffefb8916bbaa2697cb2dd82ee98939df9b6704cee77793edd2b4947d82e00e5749664970736c59a84197bd72b5c71e36aae29cd39af6ac73a368edbc1ca792e1309f442aafcd77c992c88f8e4863149f221695cb7b0236e75b2339a02c4ea114854372c306b9412d8eedb600a31532002f2cea07b4df963a093185e4607732e46d753b540974fb5a5c3f9432df22e85bb17611370966c5522fd23f2ad3484341ba7fd8885fc8e6d379a611d13a2aca784fba2073208faad2137bf1979a0fa146c1880d4337db3274269493bab44a1bcd0681f7227ffdf589c2e925ed9d36302509d1109ba4 +@@ -1106,36 +1124,42 @@ vcDtKrdWo6btTWc1Kml9QhbpMhKxJ6Y9VBHOb6mNXb79cyY+NygUJ0OBgWbtfdY2 + h90qjKHS9PvY4Q== + -----END PRIVATE KEY----- + ++Availablein = default + Decrypt=RSA-OAEP-1 Ctrl = rsa_padding_mode:oaep Ctrl = rsa_mgf1_md:sha1 - Input=81ebdd95054b0c822ef9ad7693f5a87adfb4b4c4ce70df2df84ed49c04da58ba5fc20a19e1a6e8b7a3900b22796dc4e869ee6b42792d15a8eceb56c09c69914e813cea8f6931e4b8ed6f421af298d595c97f4789c7caa612c7ef360984c21b93edc5401068b5af4c78a8771b984d53b8ea8adf2f6a7d4a0ba76c75e1dd9f658f20ded4a46071d46d7791b56803d8fea7f0b0f8e41ae3f09383a6f9585fe7753eaaffd2bf94563108beecc207bbb535f5fcc705f0dde9f708c62f49a9c90371d3 - Output=fd326429df9b890e09b54b18b8f34f1e24 + Input=354fe67b4a126d5d35fe36c777791a3f7ba13def484e2d3908aff722fad468fb21696de95d0be911c2d3174f8afcc201035f7b6d8e69402de5451618c21a535fa9d7bfc5b8dd9fc243f8cf927db31322d6e881eaa91a996170e657a05a266426d98c88003f8477c1227094a0d9fa1e8c4024309ce1ecccb5210035d47ac72e8a + Output=6628194e12073db03ba94cda9ef9532397d50dba79b987004afefe34 +Availablein = default - Decrypt=RSA-OAEP-9 + Decrypt=RSA-OAEP-1 Ctrl = rsa_padding_mode:oaep Ctrl = rsa_mgf1_md:sha1 - Input=bcc35f94cde66cb1136625d625b94432a35b22f3d2fa11a613ff0fca5bd57f87b902ccdc1cd0aebcb0715ee869d1d1fe395f6793003f5eca465059c88660d446ff5f0818552022557e38c08a67ead991262254f10682975ec56397768537f4977af6d5f6aaceb7fb25dec5937230231fd8978af49119a29f29e424ab8272b47562792d5c94f774b8829d0b0d9f1a8c9eddf37574d5fa248eefa9c5271fc5ec2579c81bdd61b410fa61fe36e424221c113addb275664c801d34ca8c6351e4a858 - Output=f1459b5f0c92f01a0f723a2e5662484d8f8c0a20fc29dad6acd43bb5f3effdf4e1b63e07fdfe6628d0d74ca19bf2d69e4a0abf86d293925a796772f8088e + Input=640db1acc58e0568fe5407e5f9b701dff8c3c91e716c536fc7fcec6cb5b71c1165988d4a279e1577d730fc7a29932e3f00c81515236d8d8e31017a7a09df4352d904cdeb79aa583adcc31ea698a4c05283daba9089be5491f67c1a4ee48dc74bbbe6643aef846679b4cb395a352d5ed115912df696ffe0702932946d71492b44 + Output=750c4047f547e8e41411856523298ac9bae245efaf1397fbe56f9dd5 +Availablein = default - Decrypt=RSA-OAEP-9 + Decrypt=RSA-OAEP-1 Ctrl = rsa_padding_mode:oaep Ctrl = rsa_mgf1_md:sha1 - Input=232afbc927fa08c2f6a27b87d4a5cb09c07dc26fae73d73a90558839f4fd66d281b87ec734bce237ba166698ed829106a7de6942cd6cdce78fed8d2e4d81428e66490d036264cef92af941d3e35055fe3981e14d29cbb9a4f67473063baec79a1179f5a17c9c1832f2838fd7d5e59bb9659d56dce8a019edef1bb3accc697cc6cc7a778f60a064c7f6f5d529c6210262e003de583e81e3167b89971fb8c0e15d44fffef89b53d8d64dd797d159b56d2b08ea5307ea12c241bd58d4ee278a1f2e - Output=53e6e8c729d6f9c319dd317e74b0db8e4ccca25f3c8305746e137ac63a63ef3739e7b595abb96e8d55e54f7bd41ab433378ffb911d + Input=423736ed035f6026af276c35c0b3741b365e5f76ca091b4e8c29e2f0befee603595aa8322d602d2e625e95eb81b2f1c9724e822eca76db8618cf09c5343503a4360835b5903bc637e3879fb05e0ef32685d5aec5067cd7cc96fe4b2670b6eac3066b1fcf5686b68589aafb7d629b02d8f8625ca3833624d4800fb081b1cf94eb + Output=d94ae0832e6445ce42331cb06d531a82b1db4baad30f746dc916df24d4e3c2451fff59a6423eb0e1d02d4fe646cf699dfd818c6e97b051 +Availablein = default - Decrypt=RSA-OAEP-9 + Decrypt=RSA-OAEP-1 Ctrl = rsa_padding_mode:oaep Ctrl = rsa_mgf1_md:sha1 -diff --git a/test/recipes/80-test_cms.t b/test/recipes/80-test_cms.t -index cbec426137..9ba7fbeed2 100644 ---- a/test/recipes/80-test_cms.t -+++ b/test/recipes/80-test_cms.t -@@ -233,7 +233,7 @@ my @smime_pkcs7_tests = ( - \&final_compare - ], - -- [ "enveloped content test streaming S/MIME format, AES-256 cipher, 3 recipients", -+ [ "enveloped content test streaming S/MIME format, AES-256 cipher, 3 recipients, no Red Hat FIPS", - [ "{cmd1}", @prov, "-encrypt", "-in", $smcont, - "-aes256", "-stream", "-out", "{output}.cms", - $smrsa1, -@@ -1022,6 +1022,9 @@ sub check_availability { - return "$tnam: skipped, DSA disabled\n" - if ($no_dsa && $tnam =~ / DSA/); - -+ return "$tnam: skipped, Red Hat FIPS\n" -+ if ($tnam =~ /no Red Hat FIPS/); -+ - return ""; - } - -diff --git a/test/recipes/80-test_ssl_old.t b/test/recipes/80-test_ssl_old.t -index e2dcb68fb5..0775112b40 100644 ---- a/test/recipes/80-test_ssl_old.t -+++ b/test/recipes/80-test_ssl_old.t -@@ -493,6 +493,18 @@ sub testssl { - # the default choice if TLSv1.3 enabled - my $flag = $protocol eq "-tls1_3" ? "" : $protocol; - my $ciphersuites = ""; -+ my %redhat_skip_cipher = map {$_ => 1} qw( -+AES256-GCM-SHA384:@SECLEVEL=0 -+AES256-CCM8:@SECLEVEL=0 -+AES256-CCM:@SECLEVEL=0 -+AES128-GCM-SHA256:@SECLEVEL=0 -+AES128-CCM8:@SECLEVEL=0 -+AES128-CCM:@SECLEVEL=0 -+AES256-SHA256:@SECLEVEL=0 -+AES128-SHA256:@SECLEVEL=0 -+AES256-SHA:@SECLEVEL=0 -+AES128-SHA:@SECLEVEL=0 -+ ); - foreach my $cipher (@{$ciphersuites{$protocol}}) { - if ($protocol eq "-ssl3" && $cipher =~ /ECDH/ ) { - note "*****SKIPPING $protocol $cipher"; -@@ -504,11 +516,16 @@ sub testssl { - } else { - $cipher = $cipher.':@SECLEVEL=0'; - } -- ok(run(test([@ssltest, @exkeys, "-cipher", -- $cipher, -- "-ciphersuites", $ciphersuites, -- $flag || ()])), -- "Testing $cipher"); -+ if ($provider eq "fips" && exists $redhat_skip_cipher{$cipher}) { -+ note "*****SKIPPING $cipher in Red Hat FIPS mode"; -+ ok(1); -+ } else { -+ ok(run(test([@ssltest, @exkeys, "-cipher", -+ $cipher, -+ "-ciphersuites", $ciphersuites, -+ $flag || ()])), -+ "Testing $cipher"); -+ } - } - } - next if $protocol eq "-tls1_3"; --- -2.41.0 - -diff -up openssl-3.2.0/test/recipes/30-test_evp_data/evppkey_rsa_common.txt.patch-58 openssl-3.2.0/test/recipes/30-test_evp_data/evppkey_rsa_common.txt ---- openssl-3.2.0/test/recipes/30-test_evp_data/evppkey_rsa_common.txt.patch-58 2023-12-11 19:15:32.167790754 +0100 -+++ openssl-3.2.0/test/recipes/30-test_evp_data/evppkey_rsa_common.txt 2023-12-11 21:16:08.390089120 +0100 -@@ -248,7 +248,7 @@ Input = 64b0e9f9892371110c40ba5739dc0974 - Output = 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef + Input=45ead4ca551e662c9800f1aca8283b0525e6abae30be4b4aba762fa40fd3d38e22abefc69794f6ebbbc05ddbb11216247d2f412fd0fba87c6e3acd888813646fd0e48e785204f9c3f73d6d8239562722dddd8771fec48b83a31ee6f592c4cfd4bc88174f3b13a112aae3b9f7b80e0fc6f7255ba880dc7d8021e22ad6a85f0755 + Output=52e650d98e7f2a048b4f86852153b97e01dd316f346a19f67a85 - # RSA decrypt -- +Availablein = default - Decrypt = RSA-2048 - Input = 550AF55A2904E7B9762352F8FB7FA235A9CB053AACB2D5FCB8CA48453CB2EE3619746C701ABF2D4CC67003471A187900B05AA812BD25ED05C675DFC8C97A24A7BF49BD6214992CAD766D05A9A2B57B74F26A737E0237B8B76C45F1F226A836D7CFBC75BA999BDBE48DBC09227AA46C88F21DCCBA7840141AD5A5D71FD122E6BD6AC3E564780DFE623FC1CA9B995A6037BF0BBD43B205A84AC5444F34202C05CE9113087176432476576DE6FFFF9A52EA57C08BE3EC2F49676CB8E12F762AC71FA3C321E00AC988910C85FF52F93825666CE0D40FFAA0592078919D4493F46D95CCF76364C6D57760DD0B64805F9AFC76A2365A5575CA301D5103F0EA76CB9A78 - Output = "Hello World" -@@ -270,7 +270,7 @@ Input = 550AF55A2904E7B9762352F8FB7FA235 - Output = 4cbb988d6a46228379132b0b5f8c249b3860043848c93632fb982c807c7c82fffc7a9ef83f4908f890373ac181ffea6381e103bcaa27e65638b6ecebef38b59ed4226a9d12af675cfcb634d8c40e7a7aff + Decrypt=RSA-OAEP-1 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=36f6e34d94a8d34daacba33a2139d00ad85a9345a86051e73071620056b920e219005855a213a0f23897cdcd731b45257c777fe908202befdd0b58386b1244ea0cf539a05d5d10329da44e13030fd760dcd644cfef2094d1910d3f433e1c7c6dd18bc1f2df7f643d662fb9dd37ead9059190f4fa66ca39e869c4eb449cbdc439 + Output=8da89fd9e5f974a29feffb462b49180f6cf9e802 - # The old FIPS provider doesn't include the workaround (#13817) --FIPSversion = >=3.2.0 +Availablein = default - # Corrupted ciphertext - # Note: disable the Bleichenbacher workaround to see if it fails - Decrypt = RSA-2048 -diff -up openssl-3.2.0/test/recipes/30-test_evp_data/evppkey_rsa_common.txt.only-default openssl-3.2.0/test/recipes/30-test_evp_data/evppkey_rsa_common.txt ---- openssl-3.2.0/test/recipes/30-test_evp_data/evppkey_rsa_common.txt.only-default 2024-02-01 15:09:31.498568631 +0100 -+++ openssl-3.2.0/test/recipes/30-test_evp_data/evppkey_rsa_common.txt 2024-02-01 15:14:45.858384004 +0100 -@@ -365,28 +365,28 @@ Input = 8bfe264e85d3bdeaa6b8851b8e3b956e - Output = "lorem ipsum dolor sit amet" + Decrypt=RSA-OAEP-1 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 +@@ -1160,36 +1184,42 @@ SwGNdhGLJDiac1Dsg2sAY6IXISNv2O222JtR5+64e2EbcTLLfqc1bCMVHB53UVB8 + eG2e4XlBcKjI6A== + -----END PRIVATE KEY----- - # The old FIPS provider doesn't include the workaround (#13817) --FIPSversion = >=3.2.0 +Availablein = default - # a random negative test case decrypting to empty - Decrypt = RSA-2048-2 - Input = 20aaa8adbbc593a924ba1c5c7990b5c2242ae4b99d0fe636a19a4cf754edbcee774e472fe028160ed42634f8864900cb514006da642cae6ae8c7d087caebcfa6dad1551301e130344989a1d462d4164505f6393933450c67bc6d39d8f5160907cabc251b737925a1cf21e5c6aa5781b7769f6a2a583d97cce008c0f8b6add5f0b2bd80bee60237aa39bb20719fe75749f4bc4e42466ef5a861ae3a92395c7d858d430bfe38040f445ea93fa2958b503539800ffa5ce5f8cf51fa8171a91f36cb4f4575e8de6b4d3f096ee140b938fd2f50ee13f0d050222e2a72b0a3069ff3a6738e82c87090caa5aed4fcbe882c49646aa250b98f12f83c8d528113614a29e7 - Output = + Decrypt=RSA-OAEP-2 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=0181af8922b9fcb4d79d92ebe19815992fc0c1439d8bcd491398a0f4ad3a329a5bd9385560db532683c8b7da04e4b12aed6aacdf471c34c9cda891addcc2df3456653aa6382e9ae59b54455257eb099d562bbe10453f2b6d13c59c02e10f1f8abb5da0d0570932dacf2d0901db729d0fefcc054e70968ea540c81b04bcaefe720e + Output=8ff00caa605c702830634d9a6c3d42c652b58cf1d92fec570beee7 - # The old FIPS provider doesn't include the workaround (#13817) --FIPSversion = >=3.2.0 +Availablein = default - # invalid decrypting to max length message - Decrypt = RSA-2048-2 - Input = 48cceab10f39a4db32f60074feea473cbcdb7accf92e150417f76b44756b190e843e79ec12aa85083a21f5437e7bad0a60482e601198f9d86923239c8786ee728285afd0937f7dde12717f28389843d7375912b07b991f4fdb0190fced8ba665314367e8c5f9d2981d0f5128feeb46cb50fc237e64438a86df198dd0209364ae3a842d77532b66b7ef263b83b1541ed671b120dfd660462e2107a4ee7b964e734a7bd68d90dda61770658a3c242948532da32648687e0318286473f675b412d6468f013f14d760a358dfcad3cda2afeec5e268a37d250c37f722f468a70dfd92d7294c3c1ee1e7f8843b7d16f9f37ef35748c3ae93aa155cdcdfeb4e78567303 - Output = 22d850137b9eebe092b24f602dc5bb7918c16bd89ddbf20467b119d205f9c2e4bd7d2592cf1e532106e0f33557565923c73a02d4f09c0c22bea89148183e60317f7028b3aa1f261f91c979393101d7e15f4067e63979b32751658ef769610fe97cf9cef3278b3117d384051c3b1d82c251c2305418c8f6840530e631aad63e70e20e025bcd8efb54c92ec6d3b106a2f8e64eeff7d38495b0fc50c97138af4b1c0a67a1c4e27b077b8439332edfa8608dfeae653cd6a628ac550395f7e74390e42c11682234870925eeaa1fa71b76cf1f2ee3bda69f6717033ff8b7c95c9799e7a3bea5e7e4a1c359772fb6b1c6e6c516661dfe30c3 + Decrypt=RSA-OAEP-2 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=018759ff1df63b2792410562314416a8aeaf2ac634b46f940ab82d64dbf165eee33011da749d4bab6e2fcd18129c9e49277d8453112b429a222a8471b070993998e758861c4d3f6d749d91c4290d332c7a4ab3f7ea35ff3a07d497c955ff0ffc95006b62c6d296810d9bfab024196c7934012c2df978ef299aba239940cba10245 + Output=2d - # The old FIPS provider doesn't include the workaround (#13817) --FIPSversion = >=3.2.0 - # invalid decrypting to message with length specified by second to last value from PRF +Availablein = default - Decrypt = RSA-2048-2 - Input = 1439e08c3f84c1a7fec74ce07614b20e01f6fa4e8c2a6cffdc3520d8889e5d9a950c6425798f85d4be38d300ea5695f13ecd4cb389d1ff5b82484b494d6280ab7fa78e645933981cb934cce8bfcd114cc0e6811eefa47aae20af638a1cd163d2d3366186d0a07df0c81f6c9f3171cf3561472e98a6006bf75ddb457bed036dcce199369de7d94ef2c68e8467ee0604eea2b3009479162a7891ba5c40cab17f49e1c438cb6eaea4f76ce23cce0e483ff0e96fa790ea15be67671814342d0a23f4a20262b6182e72f3a67cd289711503c85516a9ed225422f98b116f1ab080a80abd6f0216df88d8cfd67c139243be8dd78502a7aaf6bc99d7da71bcdf627e7354 - Output = 0f9b + Decrypt=RSA-OAEP-2 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=018802bab04c60325e81c4962311f2be7c2adce93041a00719c88f957575f2c79f1b7bc8ced115c706b311c08a2d986ca3b6a9336b147c29c6f229409ddec651bd1fdd5a0b7f610c9937fdb4a3a762364b8b3206b4ea485fd098d08f63d4aa8bb2697d027b750c32d7f74eaf5180d2e9b66b17cb2fa55523bc280da10d14be2053 + Output=74fc88c51bc90f77af9d5e9a4a70133d4b4e0b34da3c37c7ef8e - # The old FIPS provider doesn't include the workaround (#13817) --FIPSversion = >=3.2.0 +Availablein = default - # invalid decrypting to message with length specified by third to last value from PRF - Decrypt = RSA-2048-2 - Input = 1690ebcceece2ce024f382e467cf8510e74514120937978576caf684d4a02ad569e8d76cbe365a060e00779de2f0865ccf0d923de3b4783a4e2c74f422e2f326086c390b658ba47f31ab013aa80f468c71256e5fa5679b24e83cd82c3d1e05e398208155de2212993cd2b8bab6987cf4cc1293f19909219439d74127545e9ed8a706961b8ee2119f6bfacafbef91b75a789ba65b8b833bc6149cf49b5c4d2c6359f62808659ba6541e1cd24bf7f7410486b5103f6c0ea29334ea6f4975b17387474fe920710ea61568d7b7c0a7916acf21665ad5a31c4eabcde44f8fb6120d8457afa1f3c85d517cda364af620113ae5a3c52a048821731922737307f77a1081 -@@ -428,14 +428,14 @@ Input = 1ea0b50ca65203d0a09280d39704b24f - Output = "lorem ipsum" + Decrypt=RSA-OAEP-2 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=00a4578cbc176318a638fba7d01df15746af44d4f6cd96d7e7c495cbf425b09c649d32bf886da48fbaf989a2117187cafb1fb580317690e3ccd446920b7af82b31db5804d87d01514acbfa9156e782f867f6bed9449e0e9a2c09bcecc6aa087636965e34b3ec766f2fe2e43018a2fddeb140616a0e9d82e5331024ee0652fc7641 + Output=a7eb2a5036931d27d4e891326d99692ffadda9bf7efd3e34e622c4adc085f721dfe885072c78a203b151739be540fa8c153a10f00a - # The old FIPS provider doesn't include the workaround (#13817) --FIPSversion = >=3.2.0 +Availablein = default - # a random negative test that generates an 11 byte long message - Decrypt = RSA-2048-2 - Input = 5f02f4b1f46935c742ebe62b6f05aa0a3286aab91a49b34780adde6410ab46f7386e05748331864ac98e1da63686e4babe3a19ed40a7f5ceefb89179596aab07ab1015e03b8f825084dab028b6731288f2e511a4b314b6ea3997d2e8fe2825cef8897cbbdfb6c939d441d6e04948414bb69e682927ef8576c9a7090d4aad0e74c520d6d5ce63a154720f00b76de8cc550b1aa14f016d63a7b6d6eaa1f7dbe9e50200d3159b3d099c900116bf4eba3b94204f18b1317b07529751abf64a26b0a0bf1c8ce757333b3d673211b67cc0653f2fe2620d57c8b6ee574a0323a167eab1106d9bc7fd90d415be5f1e9891a0e6c709f4fc0404e8226f8477b4e939b36eb2 - Output = af9ac70191c92413cb9f2d + Decrypt=RSA-OAEP-2 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=00ebc5f5fda77cfdad3c83641a9025e77d72d8a6fb33a810f5950f8d74c73e8d931e8634d86ab1246256ae07b6005b71b7f2fb98351218331ce69b8ffbdc9da08bbc9c704f876deb9df9fc2ec065cad87f9090b07acc17aa7f997b27aca48806e897f771d95141fe4526d8a5301b678627efab707fd40fbebd6e792a25613e7aec + Output=2ef2b066f854c33f3bdcbb5994a435e73d6c6c - # The old FIPS provider doesn't include the workaround (#13817) --FIPSversion = >=3.2.0 +Availablein = default - # an otherwise correct plaintext, but with wrong first byte - # (0x01 instead of 0x00), generates a random 11 byte long plaintext - Decrypt = RSA-2048-2 -@@ -443,7 +443,7 @@ Input = 9b2ec9c0c917c98f1ad3d0119aec6be5 - Output = a1f8c9255c35cfba403ccc + Decrypt=RSA-OAEP-2 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 +@@ -1214,36 +1244,42 @@ iUGx07dw5a0x7jc7KKzaaf+bb0D+V4ufGvuFg2+WJ9N6z/c8J3nmNLsmARwsj38z + Ya4qnqZe1onjY5o= + -----END PRIVATE KEY----- - # The old FIPS provider doesn't include the workaround (#13817) --FIPSversion = >=3.2.0 +Availablein = default - # an otherwise correct plaintext, but with wrong second byte - # (0x01 instead of 0x02), generates a random 11 byte long plaintext - Decrypt = RSA-2048-2 -@@ -451,7 +451,7 @@ Input = 782c2b59a21a511243820acedd567c13 - Output = e6d700309ca0ed62452254 + Decrypt=RSA-OAEP-3 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=026a0485d96aebd96b4382085099b962e6a2bdec3d90c8db625e14372de85e2d5b7baab65c8faf91bb5504fb495afce5c988b3f6a52e20e1d6cbd3566c5cd1f2b8318bb542cc0ea25c4aab9932afa20760eaddec784396a07ea0ef24d4e6f4d37e5052a7a31e146aa480a111bbe926401307e00f410033842b6d82fe5ce4dfae80 + Output=087820b569e8fa8d - # The old FIPS provider doesn't include the workaround (#13817) --FIPSversion = >=3.2.0 +Availablein = default - # an invalid ciphertext, with a zero byte in first byte of - # ciphertext, decrypts to a random 11 byte long synthetic - # plaintext -@@ -460,7 +460,7 @@ Input = 0096136621faf36d5290b16bd26295de - Output = ba27b1842e7c21c0e7ef6a + Decrypt=RSA-OAEP-3 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=024db89c7802989be0783847863084941bf209d761987e38f97cb5f6f1bc88da72a50b73ebaf11c879c4f95df37b850b8f65d7622e25b1b889e80fe80baca2069d6e0e1d829953fc459069de98ea9798b451e557e99abf8fe3d9ccf9096ebbf3e5255d3b4e1c6d2ecadf067a359eea86405acd47d5e165517ccafd47d6dbee4bf5 + Output=4653acaf171960b01f52a7be63a3ab21dc368ec43b50d82ec3781e04 - # The old FIPS provider doesn't include the workaround (#13817) --FIPSversion = >=3.2.0 +Availablein = default - # an invalid ciphertext, with a zero byte removed from first byte of - # ciphertext, decrypts to a random 11 byte long synthetic - # plaintext -@@ -469,7 +469,7 @@ Input = 96136621faf36d5290b16bd26295de27 - Output = ba27b1842e7c21c0e7ef6a + Decrypt=RSA-OAEP-3 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=0239bce681032441528877d6d1c8bb28aa3bc97f1df584563618995797683844ca86664732f4bed7a0aab083aaabfb7238f582e30958c2024e44e57043b97950fd543da977c90cdde5337d618442f99e60d7783ab59ce6dd9d69c47ad1e962bec22d05895cff8d3f64ed5261d92b2678510393484990ba3f7f06818ae6ffce8a3a + Output=d94cd0e08fa404ed89 - # The old FIPS provider doesn't include the workaround (#13817) --FIPSversion = >=3.2.0 +Availablein = default - # an invalid ciphertext, with two zero bytes in first bytes of - # ciphertext, decrypts to a random 11 byte long synthetic - # plaintext -@@ -478,7 +478,7 @@ Input = 0000587cccc6b264bdfe0dc2149a9880 - Output = d5cf555b1d6151029a429a + Decrypt=RSA-OAEP-3 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=02994c62afd76f498ba1fd2cf642857fca81f4373cb08f1cbaee6f025c3b512b42c3e8779113476648039dbe0493f9246292fac28950600e7c0f32edf9c81b9dec45c3bde0cc8d8847590169907b7dc5991ceb29bb0714d613d96df0f12ec5d8d3507c8ee7ae78dd83f216fa61de100363aca48a7e914ae9f42ddfbe943b09d9a0 + Output=6cc641b6b61e6f963974dad23a9013284ef1 - # The old FIPS provider doesn't include the workaround (#13817) --FIPSversion = >=3.2.0 +Availablein = default - # an invalid ciphertext, with two zero bytes removed from first bytes of - # ciphertext, decrypts to a random 11 byte long synthetic - # plaintext -@@ -487,7 +487,7 @@ Input = 587cccc6b264bdfe0dc2149a988047fa - Output = d5cf555b1d6151029a429a + Decrypt=RSA-OAEP-3 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=0162042ff6969592a6167031811a239834ce638abf54fec8b99478122afe2ee67f8c5b18b0339805bfdbc5a4e6720b37c59cfba942464c597ff532a119821545fd2e59b114e61daf71820529f5029cf524954327c34ec5e6f5ba7efcc4de943ab8ad4ed787b1454329f70db798a3a8f4d92f8274e2b2948ade627ce8ee33e43c60 + Output=df5151832b61f4f25891fb4172f328d2eddf8371ffcfdbe997939295f30eca6918017cfda1153bf7a6af87593223 - # The old FIPS provider doesn't include the workaround (#13817) --FIPSversion = >=3.2.0 +Availablein = default - # and invalid ciphertext, otherwise valid but starting with 000002, decrypts - # to random 11 byte long synthetic plaintext - Decrypt = RSA-2048-2 -@@ -495,7 +495,7 @@ Input = 1786550ce8d8433052e01ecba8b76d30 - Output = 3d4a054d9358209e9cbbb9 + Decrypt=RSA-OAEP-3 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 +@@ -1268,36 +1304,42 @@ s/XkIiO6MDAcQabYfLtw4wy308Z9JUc9sfbL8D4/kSbj6XloJ5qGWywrQmUkz8Uq + aD0x7TDrmEvkEro= + -----END PRIVATE KEY----- - # The old FIPS provider doesn't include the workaround (#13817) --FIPSversion = >=3.2.0 +Availablein = default - # negative test with otherwise valid padding but a zero byte in first byte - # of padding - Decrypt = RSA-2048-2 -@@ -503,7 +503,7 @@ Input = 179598823812d2c58a7eb50521150a48 - Output = 1f037dd717b07d3e7f7359 + Decrypt=RSA-OAEP-4 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=04cce19614845e094152a3fe18e54e3330c44e5efbc64ae16886cb1869014cc5781b1f8f9e045384d0112a135ca0d12e9c88a8e4063416deaae3844f60d6e96fe155145f4525b9a34431ca3766180f70e15a5e5d8e8b1a516ff870609f13f896935ced188279a58ed13d07114277d75c6568607e0ab092fd803a223e4a8ee0b1a8 + Output=4a86609534ee434a6cbca3f7e962e76d455e3264c19f605f6e5ff6137c65c56d7fb344cd52bc93374f3d166c9f0c6f9c506bad19330972d2 - # The old FIPS provider doesn't include the workaround (#13817) --FIPSversion = >=3.2.0 +Availablein = default - # negative test with otherwise valid padding but a zero byte at the eighth - # byte of padding - Decrypt = RSA-2048-2 -@@ -511,7 +511,7 @@ Input = a7a340675a82c30e22219a55bc07cdf3 - Output = 63cb0bf65fc8255dd29e17 + Decrypt=RSA-OAEP-4 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=0097b698c6165645b303486fbf5a2a4479c0ee85889b541a6f0b858d6b6597b13b854eb4f839af03399a80d79bda6578c841f90d645715b280d37143992dd186c80b949b775cae97370e4ec97443136c6da484e970ffdb1323a20847821d3b18381de13bb49aaea66530c4a4b8271f3eae172cd366e07e6636f1019d2a28aed15e + Output=b0adc4f3fe11da59ce992773d9059943c03046497ee9d9f9a06df1166db46d98f58d27ec074c02eee6cbe2449c8b9fc5080c5c3f4433092512ec46aa793743c8 - # The old FIPS provider doesn't include the workaround (#13817) --FIPSversion = >=3.2.0 +Availablein = default - # negative test with an otherwise valid plaintext but with missing separator - # byte - Decrypt = RSA-2048-2 -@@ -566,53 +566,58 @@ PrivPubKeyPair = RSA-2049:RSA-2049-PUBLI - # RSA decrypt + Decrypt=RSA-OAEP-4 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=0301f935e9c47abcb48acbbe09895d9f5971af14839da4ff95417ee453d1fd77319072bb7297e1b55d7561cd9d1bb24c1a9a37c619864308242804879d86ebd001dce5183975e1506989b70e5a83434154d5cbfd6a24787e60eb0c658d2ac193302d1192c6e622d4a12ad4b53923bca246df31c6395e37702c6a78ae081fb9d065 + Output=bf6d42e701707b1d0206b0c8b45a1c72641ff12889219a82bdea965b5e79a96b0d0163ed9d578ec9ada20f2fbcf1ea3c4089d83419ba81b0c60f3606da99 - # The old FIPS provider doesn't include the workaround (#13817) --FIPSversion = >=3.2.0 +Availablein = default - # malformed that generates length specified by 3rd last value from PRF - Decrypt = RSA-2049 - Input = 00b26f6404b82649629f2704494282443776929122e279a9cf30b0c6fe8122a0a9042870d97cc8ef65490fe58f031eb2442352191f5fbc311026b5147d32df914599f38b825ebb824af0d63f2d541a245c5775d1c4b78630e4996cc5fe413d38455a776cf4edcc0aa7fccb31c584d60502ed2b77398f536e137ff7ba6430e9258e21c2db5b82f5380f566876110ac4c759178900fbad7ab70ea07b1daf7a1639cbb4196543a6cbe8271f35dddb8120304f6eef83059e1c5c5678710f904a6d760c4d1d8ad076be17904b9e69910040b47914a0176fb7eea0c06444a6c4b86d674d19a556a1de5490373cb01ce31bbd15a5633362d3d2cd7d4af1b4c5121288b894 - Output = 42 + Decrypt=RSA-OAEP-4 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=02d110ad30afb727beb691dd0cf17d0af1a1e7fa0cc040ec1a4ba26a42c59d0a796a2e22c8f357ccc98b6519aceb682e945e62cb734614a529407cd452bee3e44fece8423cc19e55548b8b994b849c7ecde4933e76037e1d0ce44275b08710c68e430130b929730ed77e09b015642c5593f04e4ffb9410798102a8e96ffdfe11e4 + Output=fb2ef112f5e766eb94019297934794f7be2f6fc1c58e - # simple positive test case +Availablein = default - Decrypt = RSA-2049 - Input = 013300edbf0bb3571e59889f7ed76970bf6d57e1c89bbb6d1c3991d9df8e65ed54b556d928da7d768facb395bbcc81e9f8573b45cf8195dbd85d83a59281cddf4163aec11b53b4140053e3bd109f787a7c3cec31d535af1f50e0598d85d96d91ea01913d07097d25af99c67464ebf2bb396fb28a9233e56f31f7e105d71a23e9ef3b736d1e80e713d1691713df97334779552fc94b40dd733c7251bc522b673d3ec9354af3dd4ad44fa71c0662213a57ada1d75149697d0eb55c053aaed5ffd0b815832f454179519d3736fb4faf808416071db0d0f801aca8548311ee708c131f4be658b15f6b54256872c2903ac708bd43b017b073b5707bc84c2cd9da70e967 - Output = "lorem ipsum" + Decrypt=RSA-OAEP-4 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=00dbb8a7439d90efd919a377c54fae8fe11ec58c3b858362e23ad1b8a44310799066b99347aa525691d2adc58d9b06e34f288c170390c5f0e11c0aa3645959f18ee79e8f2be8d7ac5c23d061f18dd74b8c5f2a58fcb5eb0c54f99f01a83247568292536583340948d7a8c97c4acd1e98d1e29dc320e97a260532a8aa7a758a1ec2 + Output=28ccd447bb9e85166dabb9e5b7d1adadc4b9d39f204e96d5e440ce9ad928bc1c2284 - # positive test case with null padded ciphertext +Availablein = default - Decrypt = RSA-2049 - Input = 0002aadf846a329fadc6760980303dbd87bfadfa78c2015ce4d6c5782fd9d3f1078bd3c0a2c5bfbdd1c024552e5054d98b5bcdc94e476dd280e64d650089326542ce7c61d4f1ab40004c2e6a88a883613568556a10f3f9edeab67ae8dddc1e6b0831c2793d2715de943f7ce34c5c05d1b09f14431fde566d17e76c9feee90d86a2c158616ec81dda0c642f58c0ba8fa4495843124a7235d46fb4069715a51bf710fd024259131ba94da73597ace494856c94e7a3ec261545793b0990279b15fa91c7fd13dbfb1df2f221dab9fa9f7c1d21e48aa49f6aaecbabf5ee76dc6c2af2317ffb4e303115386a97f8729afc3d0c89419669235f1a3a69570e0836c79fc162 - Output = "lorem ipsum" + Decrypt=RSA-OAEP-4 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 +@@ -1322,36 +1364,42 @@ OPlAQGLrhaQpJFILOPW7iGoBlvSLuNzqYP2SzAJ/GOeBWKNKXF1fhgoPbAQHGn0B + MSwGUGLx60i3nRyDyw== + -----END PRIVATE KEY----- - # positive test case with null truncated ciphertext +Availablein = default - Decrypt = RSA-2049 - Input = 02aadf846a329fadc6760980303dbd87bfadfa78c2015ce4d6c5782fd9d3f1078bd3c0a2c5bfbdd1c024552e5054d98b5bcdc94e476dd280e64d650089326542ce7c61d4f1ab40004c2e6a88a883613568556a10f3f9edeab67ae8dddc1e6b0831c2793d2715de943f7ce34c5c05d1b09f14431fde566d17e76c9feee90d86a2c158616ec81dda0c642f58c0ba8fa4495843124a7235d46fb4069715a51bf710fd024259131ba94da73597ace494856c94e7a3ec261545793b0990279b15fa91c7fd13dbfb1df2f221dab9fa9f7c1d21e48aa49f6aaecbabf5ee76dc6c2af2317ffb4e303115386a97f8729afc3d0c89419669235f1a3a69570e0836c79fc162 - Output = "lorem ipsum" + Decrypt=RSA-OAEP-5 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=036046a4a47d9ed3ba9a89139c105038eb7492b05a5d68bfd53accff4597f7a68651b47b4a4627d927e485eed7b4566420e8b409879e5d606eae251d22a5df799f7920bfc117b992572a53b1263146bcea03385cc5e853c9a101c8c3e1bda31a519807496c6cb5e5efb408823a352b8fa0661fb664efadd593deb99fff5ed000e5 + Output=af71a901e3a61d3132f0fc1fdb474f9ea6579257ffc24d164170145b3dbde8 - # positive test case with double null padded ciphertext +Availablein = default - Decrypt = RSA-2049 - Input = 0000f36da3b72d8ff6ded74e7efd08c01908f3f5f0de7b55eab92b5f875190809c39d4162e1e6649618f854fd84aeab03970d16bb814e999852c06de38d82b95c0f32e2a7b5714021fe303389be9c0eac24c90a6b7210f929d390fabf903d44e04110bb7a7fd6c383c275804721efa6d7c93aa64c0bb2b18d97c5220a846c66a4895ae52adddbe2a9996825e013585adcec4b32ba61d782737bd343e5fabd68e8a95b8b1340318559860792dd70dffbe05a1052b54cbfb48cfa7bb3c19cea52076bddac5c25ee276f153a610f6d06ed696d192d8ae4507ffae4e5bdda10a625d6b67f32f7cffcd48dee2431fe66f6105f9d17e611cdcc674868e81692a360f4052 - Output = "lorem ipsum" + Decrypt=RSA-OAEP-5 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=03d6eb654edce615bc59f455265ed4e5a18223cbb9be4e4069b473804d5de96f54dcaaa603d049c5d94aa1470dfcd2254066b7c7b61ff1f6f6770e3215c51399fd4e34ec5082bc48f089840ad04354ae66dc0f1bd18e461a33cc1258b443a2837a6df26759aa2302334986f87380c9cc9d53be9f99605d2c9a97da7b0915a4a7ad + Output=a3b844a08239a8ac41605af17a6cfda4d350136585903a417a79268760519a4b4ac3303ec73f0f87cfb32399 - # positive test case with double null truncated ciphertext +Availablein = default - Decrypt = RSA-2049 - Input = f36da3b72d8ff6ded74e7efd08c01908f3f5f0de7b55eab92b5f875190809c39d4162e1e6649618f854fd84aeab03970d16bb814e999852c06de38d82b95c0f32e2a7b5714021fe303389be9c0eac24c90a6b7210f929d390fabf903d44e04110bb7a7fd6c383c275804721efa6d7c93aa64c0bb2b18d97c5220a846c66a4895ae52adddbe2a9996825e013585adcec4b32ba61d782737bd343e5fabd68e8a95b8b1340318559860792dd70dffbe05a1052b54cbfb48cfa7bb3c19cea52076bddac5c25ee276f153a610f6d06ed696d192d8ae4507ffae4e5bdda10a625d6b67f32f7cffcd48dee2431fe66f6105f9d17e611cdcc674868e81692a360f4052 - Output = "lorem ipsum" + Decrypt=RSA-OAEP-5 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=0770952181649f9f9f07ff626ff3a22c35c462443d905d456a9fd0bff43cac2ca7a9f554e9478b9acc3ac838b02040ffd3e1847de2e4253929f9dd9ee4044325a9b05cabb808b2ee840d34e15d105a3f1f7b27695a1a07a2d73fe08ecaaa3c9c9d4d5a89ff890d54727d7ae40c0ec1a8dd86165d8ee2c6368141016a48b55b6967 + Output=308b0ecbd2c76cb77fc6f70c5edd233fd2f20929d629f026953bb62a8f4a3a314bde195de85b5f816da2aab074d26cb6acddf323ae3b9c678ac3cf12fbdde7 - # The old FIPS provider doesn't include the workaround (#13817) --FIPSversion = >=3.2.0 +Availablein = default - # a random negative test case that generates an 11 byte long message - Decrypt = RSA-2049 - Input = 00f910200830fc8fff478e99e145f1474b312e2512d0f90b8cef77f8001d09861688c156d1cbaf8a8957f7ebf35f724466952d0524cad48aad4fba1e45ce8ea27e8f3ba44131b7831b62d60c0762661f4c1d1a88cd06263a259abf1ba9e6b0b172069afb86a7e88387726f8ab3adb30bfd6b3f6be6d85d5dfd044e7ef052395474a9cbb1c3667a92780b43a22693015af6c513041bdaf87d43b24ddd244e791eeaea1066e1f4917117b3a468e22e0f7358852bb981248de4d720add2d15dccba6280355935b67c96f9dcb6c419cc38ab9f6fba2d649ef2066e0c34c9f788ae49babd9025fa85b21113e56ce4f43aa134c512b030dd7ac7ce82e76f0be9ce09ebca - Output = 1189b6f5498fd6df532b00 + Decrypt=RSA-OAEP-5 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=0812b76768ebcb642d040258e5f4441a018521bd96687e6c5e899fcd6c17588ff59a82cc8ae03a4b45b31299af1788c329f7dcd285f8cf4ced82606b97612671a45bedca133442144d1617d114f802857f0f9d739751c57a3f9ee400912c61e2e6992be031a43dd48fa6ba14eef7c422b5edc4e7afa04fdd38f402d1c8bb719abf + Output=15c5b9ee1185 - # The old FIPS provider doesn't include the workaround (#13817) --FIPSversion = >=3.2.0 +Availablein = default - # otherwise correct plaintext, but with wrong first byte (0x01 instead of 0x00) - Decrypt = RSA-2049 - Input = 002c9ddc36ba4cf0038692b2d3a1c61a4bb3786a97ce2e46a3ba74d03158aeef456ce0f4db04dda3fe062268a1711250a18c69778a6280d88e133a16254e1f0e30ce8dac9b57d2e39a2f7d7be3ee4e08aec2fdbe8dadad7fdbf442a29a8fb40857407bf6be35596b8eefb5c2b3f58b894452c2dc54a6123a1a38d642e23751746597e08d71ac92704adc17803b19e131b4d1927881f43b0200e6f95658f559f912c889b4cd51862784364896cd6e8618f485a992f82997ad6a0917e32ae5872eaf850092b2d6c782ad35f487b79682333c1750c685d7d32ab3e1538f31dcaa5e7d5d2825875242c83947308dcf63ba4bfff20334c9c140c837dbdbae7a8dee72ff - Output = f6d0f5b78082fe61c04674 + Decrypt=RSA-OAEP-5 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=07b60e14ec954bfd29e60d0047e789f51d57186c63589903306793ced3f68241c743529aba6a6374f92e19e0163efa33697e196f7661dfaaa47aac6bde5e51deb507c72c589a2ca1693d96b1460381249b2cdb9eac44769f2489c5d3d2f99f0ee3c7ee5bf64a5ac79c42bd433f149be8cb59548361640595513c97af7bc2509723 + Output=21026e6800c7fa728fcaaba0d196ae28d7a2ac4ffd8abce794f0985f60c8a6737277365d3fea11db8923a2029a - # The old FIPS provider doesn't include the workaround (#13817) --FIPSversion = >=3.2.0 +Availablein = default - # otherwise correct plaintext, but with wrong second byte (0x01 instead of 0x02) - Decrypt = RSA-2049 - Input = 00c5d77826c1ab7a34d6390f9d342d5dbe848942e2618287952ba0350d7de6726112e9cebc391a0fae1839e2bf168229e3e0d71d4161801509f1f28f6e1487ca52df05c466b6b0a6fbbe57a3268a970610ec0beac39ec0fa67babce1ef2a86bf77466dc127d7d0d2962c20e66593126f276863cd38dc6351428f884c1384f67cad0a0ffdbc2af16711fb68dc559b96b37b4f04cd133ffc7d79c43c42ca4948fa895b9daeb853150c8a5169849b730cc77d68b0217d6c0e3dbf38d751a1998186633418367e7576530566c23d6d4e0da9b038d0bb5169ce40133ea076472d055001f0135645940fd08ea44269af2604c8b1ba225053d6db9ab43577689401bdc0f3 -diff -up openssl-3.2.0/test/recipes/30-test_evp_data/evppkey_rsa_common.txt.only-default openssl-3.2.0/test/recipes/30-test_evp_data/evppkey_rsa_common.txt ---- openssl-3.2.0/test/recipes/30-test_evp_data/evppkey_rsa_common.txt.only-default 2024-02-01 15:22:09.981463726 +0100 -+++ openssl-3.2.0/test/recipes/30-test_evp_data/evppkey_rsa_common.txt 2024-02-01 15:28:41.789966051 +0100 -@@ -269,7 +269,7 @@ Input = 550AF55A2904E7B9762352F8FB7FA235 - Output = "Hello World" + Decrypt=RSA-OAEP-5 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 +@@ -1376,36 +1424,42 @@ xT1F29tenZbQ/s9Cdd8JdLxKBza0p0wyaQU++2hqziQG4iyeBY3bSuVAYnri/bCC + Yejn5Ly8mU2q+jBcRQ== + -----END PRIVATE KEY----- - # The old FIPS provider doesn't include the workaround (#13817) --FIPSversion = >=3.2.0 +Availablein = default - # Note: disable the Bleichenbacher workaround to see if it passes - Decrypt = RSA-2048 - Ctrl = rsa_pkcs1_implicit_rejection:0 -@@ -277,7 +277,7 @@ Input = 550AF55A2904E7B9762352F8FB7FA235 - Output = "Hello World" + Decrypt=RSA-OAEP-6 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=0630eebcd2856c24f798806e41f9e67345eda9ceda386acc9facaea1eeed06ace583709718d9d169fadf414d5c76f92996833ef305b75b1e4b95f662a20faedc3bae0c4827a8bf8a88edbd57ec203a27a841f02e43a615bab1a8cac0701de34debdef62a088089b55ec36ea7522fd3ec8d06b6a073e6df833153bc0aefd93bd1a3 + Output=4046ca8baa3347ca27f49e0d81f9cc1d71be9ba517d4 - # The old FIPS provider doesn't include the workaround (#13817) --FIPSversion = >=3.2.0 +Availablein = default - # Corrupted ciphertext - # Note: output is generated synthethically by the Bleichenbacher workaround - Decrypt = RSA-2048 -@@ -360,6 +360,7 @@ PrivPubKeyPair = RSA-2048-2:RSA-2048-2-P - # RSA decrypt + Decrypt=RSA-OAEP-6 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=0ebc37376173a4fd2f89cc55c2ca62b26b11d51c3c7ce49e8845f74e7607317c436bc8d23b9667dfeb9d087234b47bc6837175ae5c0559f6b81d7d22416d3e50f4ac533d8f0812f2db9e791fe9c775ac8b6ad0f535ad9ceb23a4a02014c58ab3f8d3161499a260f39348e714ae2a1d3443208fd8b722ccfdfb393e98011f99e63f + Output=5cc72c60231df03b3d40f9b57931bc31109f972527f28b19e7480c7288cb3c92b22512214e4be6c914792ddabdf57faa8aa7 - # a random positive test case +Availablein = default - Decrypt = RSA-2048-2 - Input = 8bfe264e85d3bdeaa6b8851b8e3b956ee3d226fd3f69063a86880173a273d9f283b2eebdd1ed35f7e02d91c571981b6737d5320bd8396b0f3ad5b019daec1b0aab3cbbc026395f4fd14f13673f2dfc81f9b660ec26ac381e6db3299b4e460b43fab9955df2b3cfaa20e900e19c856238fd371899c2bf2ce8c868b76754e5db3b036533fd603746be13c10d4e3e6022ebc905d20c2a7f32b215a4cd53b3f44ca1c327d2c2b651145821c08396c89071f665349c25e44d2733cd9305985ceef6430c3cf57af5fa224089221218fa34737c79c446d28a94c41c96e4e92ac53fbcf384dea8419ea089f8784445a492c812eb0d409467f75afd7d4d1078886205a066 - Output = "lorem ipsum dolor sit amet" -@@ -393,36 +394,43 @@ Input = 1690ebcceece2ce024f382e467cf8510 - Output = 4f02 + Decrypt=RSA-OAEP-6 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=0a98bf1093619394436cf68d8f38e2f158fde8ea54f3435f239b8d06b8321844202476aeed96009492480ce3a8d705498c4c8c68f01501dc81db608f60087350c8c3b0bd2e9ef6a81458b7c801b89f2e4fe99d4900ba6a4b5e5a96d865dc676c7755928794130d6280a8160a190f2df3ea7cf9aa0271d88e9e6905ecf1c5152d65 + Output=b20e651303092f4bccb43070c0f86d23049362ed96642fc5632c27db4a52e3d831f2ab068b23b149879c002f6bf3feee97591112562c - # positive test with 11 byte long value +Availablein = default - Decrypt = RSA-2048-2 - Input = 6213634593332c485cef783ea2846e3d6e8b0e005cd8293eaebbaa5079712fd681579bdfbbda138ae4d9d952917a03c92398ec0cb2bb0c6b5a8d55061fed0d0d8d72473563152648cfe640b335dc95331c21cb133a91790fa93ae44497c128708970d2beeb77e8721b061b1c44034143734a77be8220877415a6dba073c3871605380542a9f25252a4babe8331cdd53cf828423f3cc70b560624d0581fb126b2ed4f4ed358f0eb8065cf176399ac1a846a31055f9ae8c9c24a1ba050bc20842125bc1753158f8065f3adb9cc16bfdf83816bdf38b624f12022c5a6fbfe29bc91542be8c0208a770bcd677dc597f5557dc2ce28a11bf3e3857f158717a33f6592 - Output = "lorem ipsum" + Decrypt=RSA-OAEP-6 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=008e7a67cacfb5c4e24bec7dee149117f19598ce8c45808fef88c608ff9cd6e695263b9a3c0ad4b8ba4c95238e96a8422b8535629c8d5382374479ad13fa39974b242f9a759eeaf9c83ad5a8ca18940a0162ba755876df263f4bd50c6525c56090267c1f0e09ce0899a0cf359e88120abd9bf893445b3cae77d3607359ae9a52f8 + Output=684e3038c5c041f7 - # positive test with 11 byte long value and zero padded ciphertext +Availablein = default - Decrypt = RSA-2048-2 - Input = 00a2e8f114ea8d05d12dc843e3cc3b2edc8229ff2a028bda29ba9d55e3cd02911902fef1f42a075bf05e8016e8567213d6f260fa49e360779dd81aeea3e04c2cb567e0d72b98bf754014561b7511e083d20e0bfb9cd23f8a0d3c88900c49d2fcd5843ff0765607b2026f28202a87aa94678aed22a0c20724541394cd8f44e373eba1d2bae98f516c1e2ba3d86852d064f856b1daf24795e767a2b90396e50743e3150664afab131fe40ea405dcf572dd1079af1d3f0392ccadcca0a12740dbb213b925ca2a06b1bc1383e83a658c82ba2e7427342379084d5f66b544579f07664cb26edd4f10fd913fdbc0de05ef887d4d1ec1ac95652397ea7fd4e4759fda8b - Output = "lorem ipsum" + Decrypt=RSA-OAEP-6 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=00003474416c7b68bdf961c385737944d7f1f40cb395343c693cc0b4fe63b31fedf1eaeeac9ccc0678b31dc32e0977489514c4f09085f6298a9653f01aea4045ff582ee887be26ae575b73eef7f3774921e375a3d19adda0ca31aa1849887c1f42cac9677f7a2f4e923f6e5a868b38c084ef187594dc9f7f048fea2e02955384ab + Output=32488cb262d041d6e4dd35f987bf3ca696db1f06ac29a44693 - # positive test with 11 byte long value and zero truncated ciphertext +Availablein = default - Decrypt = RSA-2048-2 - Input = a2e8f114ea8d05d12dc843e3cc3b2edc8229ff2a028bda29ba9d55e3cd02911902fef1f42a075bf05e8016e8567213d6f260fa49e360779dd81aeea3e04c2cb567e0d72b98bf754014561b7511e083d20e0bfb9cd23f8a0d3c88900c49d2fcd5843ff0765607b2026f28202a87aa94678aed22a0c20724541394cd8f44e373eba1d2bae98f516c1e2ba3d86852d064f856b1daf24795e767a2b90396e50743e3150664afab131fe40ea405dcf572dd1079af1d3f0392ccadcca0a12740dbb213b925ca2a06b1bc1383e83a658c82ba2e7427342379084d5f66b544579f07664cb26edd4f10fd913fdbc0de05ef887d4d1ec1ac95652397ea7fd4e4759fda8b - Output = "lorem ipsum" + Decrypt=RSA-OAEP-6 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 +@@ -1430,36 +1484,42 @@ tu4XIedy0DiaVZw9PN+VUNRXxGsDe3RkGx1SFmr4ohPIOWIGzfukQi8Y1vYdvLXS + FMlxv0gq65dqc3DC + -----END PRIVATE KEY----- - # positive test with 11 byte long value and double zero padded ciphertext +Availablein = default - Decrypt = RSA-2048-2 - Input = 00001f71879b426127f7dead621f7380a7098cf7d22173aa27991b143c46d53383c209bd0c9c00d84078037e715f6b98c65005a77120070522ede51d472c87ef94b94ead4c5428ee108a345561658301911ec5a8f7dd43ed4a3957fd29fb02a3529bf63f8040d3953490939bd8f78b2a3404b6fb5ff70a4bfdaac5c541d6bcce49c9778cc390be24cbef1d1eca7e870457241d3ff72ca44f9f56bdf31a890fa5eb3a9107b603ccc9d06a5dd911a664c82b6abd4fe036f8db8d5a070c2d86386ae18d97adc1847640c211d91ff5c3387574a26f8ef27ca7f48d2dd1f0c7f14b81cc9d33ee6853031d3ecf10a914ffd90947909c8011fd30249219348ebff76bfc - Output = "lorem ipsum" + Decrypt=RSA-OAEP-7 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=1688e4ce7794bba6cb7014169ecd559cede2a30b56a52b68d9fe18cf1973ef97b2a03153951c755f6294aa49adbdb55845ab6875fb3986c93ecf927962840d282f9e54ce8b690f7c0cb8bbd73440d9571d1b16cd9260f9eab4783cc482e5223dc60973871783ec27b0ae0fd47732cbc286a173fc92b00fb4ba6824647cd93c85c1 + Output=47aae909 - # positive test with 11 byte long value and double zero truncated ciphertext +Availablein = default - Decrypt = RSA-2048-2 - Input = 1f71879b426127f7dead621f7380a7098cf7d22173aa27991b143c46d53383c209bd0c9c00d84078037e715f6b98c65005a77120070522ede51d472c87ef94b94ead4c5428ee108a345561658301911ec5a8f7dd43ed4a3957fd29fb02a3529bf63f8040d3953490939bd8f78b2a3404b6fb5ff70a4bfdaac5c541d6bcce49c9778cc390be24cbef1d1eca7e870457241d3ff72ca44f9f56bdf31a890fa5eb3a9107b603ccc9d06a5dd911a664c82b6abd4fe036f8db8d5a070c2d86386ae18d97adc1847640c211d91ff5c3387574a26f8ef27ca7f48d2dd1f0c7f14b81cc9d33ee6853031d3ecf10a914ffd90947909c8011fd30249219348ebff76bfc - Output = "lorem ipsum" + Decrypt=RSA-OAEP-7 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=1052ed397b2e01e1d0ee1c50bf24363f95e504f4a03434a08fd822574ed6b9736edbb5f390db10321479a8a139350e2bd4977c3778ef331f3e78ae118b268451f20a2f01d471f5d53c566937171b2dbc2d4bde459a5799f0372d6574239b2323d245d0bb81c286b63c89a361017337e4902f88a467f4c7f244bfd5ab46437ff3b6 + Output=1d9b2e2223d9bc13bfb9f162ce735db48ba7c68f6822a0a1a7b6ae165834e7 - # positive that generates a 0 byte long synthetic message internally +Availablein = default - Decrypt = RSA-2048-2 - Input = b5e49308f6e9590014ffaffc5b8560755739dd501f1d4e9227a7d291408cf4b753f292322ff8bead613bf2caa181b221bc38caf6392deafb28eb21ad60930841ed02fd6225cc9c463409adbe7d8f32440212fbe3881c51375bb09565efb22e62b071472fb38676e5b4e23a0617db5d14d93519ac0007a30a9c822eb31c38b57fcb1be29608fcf1ca2abdcaf5d5752bbc2b5ac7dba5afcff4a5641da360dd01f7112539b1ed46cdb550a3b1006559b9fe1891030ec80f0727c42401ddd6cbb5e3c80f312df6ec89394c5a7118f573105e7ab00fe57833c126141b50a935224842addfb479f75160659ba28877b512bb9a93084ad8bec540f92640f63a11a010e0 - Output = "lorem ipsum" + Decrypt=RSA-OAEP-7 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=2155cd843ff24a4ee8badb7694260028a490813ba8b369a4cbf106ec148e5298707f5965be7d101c1049ea8584c24cd63455ad9c104d686282d3fb803a4c11c1c2e9b91c7178801d1b6640f003f5728df007b8a4ccc92bce05e41a27278d7c85018c52414313a5077789001d4f01910b72aad05d220aa14a58733a7489bc54556b + Output=d976fc - # positive that generates a 245 byte long synthetic message internally +Availablein = default - Decrypt = RSA-2048-2 - Input = 1ea0b50ca65203d0a09280d39704b24fe6e47800189db5033f202761a78bafb270c5e25abd1f7ecc6e7abc4f26d1b0cd9b8c648d529416ee64ccbdd7aa72a771d0353262b543f0e436076f40a1095f5c7dfd10dcf0059ccb30e92dfa5e0156618215f1c3ff3aa997a9d999e506924f5289e3ac72e5e2086cc7b499d71583ed561028671155db4005bee01800a7cdbdae781dd32199b8914b5d4011dd6ff11cd26d46aad54934d293b0bc403dd211bf13b5a5c6836a5e769930f437ffd8634fb7371776f4bc88fa6c271d8aa6013df89ae6470154497c4ac861be2a1c65ebffec139bf7aaba3a81c7c5cdd84da9af5d3edfb957848074686b5837ecbcb6a41c50 - Output = "lorem ipsum" -@@ -681,14 +690,14 @@ ooCElYcob01/JWzoXl61Z5sdrMH5CVZJty5foHKu - PrivPubKeyPair = RSA-3072:RSA-3072-PUBLIC + Decrypt=RSA-OAEP-7 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=0ab14c373aeb7d4328d0aaad8c094d88b9eb098b95f21054a29082522be7c27a312878b637917e3d819e6c3c568db5d843802b06d51d9e98a2be0bf40c031423b00edfbff8320efb9171bd2044653a4cb9c5122f6c65e83cda2ec3c126027a9c1a56ba874d0fea23f380b82cf240b8cf540004758c4c77d934157a74f3fc12bfac + Output=d4738623df223aa43843df8467534c41d013e0c803c624e263666b239bde40a5f29aeb8de79e3daa61dd0370f49bd4b013834b98212aef6b1c5ee373b3cb - # The old FIPS provider doesn't include the workaround (#13817) --FIPSversion = >=3.2.0 +Availablein = default - # a random invalid ciphertext that generates an empty synthetic one - Decrypt = RSA-3072 - Input = 5e956cd9652f4a2ece902931013e09662b6a9257ad1e987fb75f73a0606df2a4b04789770820c2e02322c4e826f767bd895734a01e20609c3be4517a7a2a589ea1cdc137beb73eb38dac781b52e863de9620f79f9b90fd5b953651fcbfef4a9f1cc07421d511a87dd6942caab6a5a0f4df473e62defb529a7de1509ab99c596e1dff1320402298d8be73a896cc86c38ae3f2f576e9ea70cc28ad575cb0f854f0be43186baa9c18e29c47c6ca77135db79c811231b7c1730955887d321fdc06568382b86643cf089b10e35ab23e827d2e5aa7b4e99ff2e914f302351819eb4d1693243b35f8bf1d42d08f8ec4acafa35f747a4a975a28643ec630d8e4fa5be59d81995660a14bb64c1fea5146d6b11f92da6a3956dd5cb5e0d747cf2ea23f81617769185336263d46ef4c144b754de62a6337342d6c85a95f19f015724546ee3fc4823eca603dbc1dc01c2d5ed50bd72d8e96df2dc048edde0081284068283fc5e73a6139851abf2f29977d0b3d160c883a42a37efba1be05c1a0b1741d7ddf59 - Output = + Decrypt=RSA-OAEP-7 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=028387a318277434798b4d97f460068df5298faba5041ba11761a1cb7316b24184114ec500257e2589ed3b607a1ebbe97a6cc2e02bf1b681f42312a33b7a77d8e7855c4a6de03e3c04643f786b91a264a0d6805e2cea91e68177eb7a64d9255e4f27e713b7ccec00dc200ebd21c2ea2bb890feae4942df941dc3f97890ed347478 + Output=bb47231ca5ea1d3ad46c99345d9a8a61 - # The old FIPS provider doesn't include the workaround (#13817) --FIPSversion = >=3.2.0 +Availablein = default - # a random invalid that has PRF output with a length one byte too long - # in the last value - Decrypt = RSA-3072 -@@ -696,46 +705,51 @@ Input = 7db0390d75fcf9d4c59cf27b264190d8 - Output = 56a3bea054e01338be9b7d7957539c + Decrypt=RSA-OAEP-7 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 +@@ -1484,36 +1544,42 @@ njraT2MgdSwJ2AX/fR8a4NAXru7pzvoNfdf/d15EtXgyL2QF1iEdoZUZZmqof9xM + 2MiPa249Z+lh3Luj0A== + -----END PRIVATE KEY----- - # The old FIPS provider doesn't include the workaround (#13817) --FIPSversion = >=3.2.0 +Availablein = default - # a random invalid that generates a synthetic of maximum size - Decrypt = RSA-3072 - Input = 1715065322522dff85049800f6a29ab5f98c465020467414b2a44127fe9446da47fa18047900f99afe67c2df6f50160bb8e90bff296610fde632b3859d4d0d2e644f23835028c46cca01b84b88231d7e03154edec6627bcba23de76740d839851fa12d74c8f92e540c73fe837b91b7d699b311997d5f0f7864c486d499c3a79c111faaacbe4799597a25066c6200215c3d158f3817c1aa57f18bdaad0be1658da9da93f5cc6c3c4dd72788af57adbb6a0c26f42d32d95b8a4f95e8c6feb2f8a5d53b19a50a0b7cbc25e055ad03e5ace8f3f7db13e57759f67b65d143f08cca15992c6b2aae643390483de111c2988d4e76b42596266005103c8de6044fb7398eb3c28a864fa672de5fd8774510ff45e05969a11a4c7d3f343e331190d2dcf24fb9154ba904dc94af98afc5774a9617d0418fe6d13f8245c7d7626c176138dd698a23547c25f27c2b98ea4d8a45c7842b81888e4cc14e5b72e9cf91f56956c93dbf2e5f44a8282a7813157fc481ff1371a0f66b31797e81ebdb09a673d4db96d6 - Output = 7b036fcd6243900e4236c894e2462c17738acc87e01a76f4d95cb9a328d9acde81650283b8e8f60a217e3bdee835c7b222ad4c85d0acdb9a309bd2a754609a65dec50f3aa04c6d5891034566b9563d42668ede1f8992b17753a2132e28970584e255efc8b45a41c5dbd7567f014acec5fe6fdb6d484790360a913ebb9defcd74ff377f2a8ba46d2ed85f733c9a3da08eb57ecedfafda806778f03c66b2c5d2874cec1c291b2d49eb194c7b5d0dd2908ae90f4843268a2c45563092ade08acb6ab481a08176102fc803fbb2f8ad11b0e1531bd37df543498daf180b12017f4d4d426ca29b4161075534bfb914968088a9d13785d0adc0e2580d3548494b2a9e91605f2b27e6cc701c796f0de7c6f471f6ab6cb9272a1ed637ca32a60d117505d82af3c1336104afb537d01a8f70b510e1eebf4869cb976c419473795a66c7f5e6e20a8094b1bb603a74330c537c5c0698c31538bd2e138c1275a1bdf24c5fa8ab3b7b526324e7918a382d1363b3d463764222150e04 + Decrypt=RSA-OAEP-8 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=09b3683d8a2eb0fb295b62ed1fb9290b714457b7825319f4647872af889b30409472020ad12912bf19b11d4819f49614824ffd84d09c0a17e7d17309d12919790410aa2995699f6a86dbe3242b5acc23af45691080d6b1ae810fb3e3057087f0970092ce00be9562ff4053b6262ce0caa93e13723d2e3a5ba075d45f0d61b54b61 + Output=050b755e5e6880f7b9e9d692a74c37aae449b31bfea6deff83747a897f6c2c825bb1adbf850a3c96994b5de5b33cbc7d4a17913a7967 - # a positive test case that decrypts to 9 byte long value +Availablein = default - Decrypt = RSA-3072 - Input = 6c60845a854b4571f678941ae35a2ac03f67c21e21146f9db1f2306be9f136453b86ad55647d4f7b5c9e62197aaff0c0e40a3b54c4cde14e774b1c5959b6c2a2302896ffae1f73b00b862a20ff4304fe06cea7ff30ecb3773ca9af27a0b54547350d7c07dfb0a39629c7e71e83fc5af9b2adbaf898e037f1de696a3f328cf45af7ec9aff7173854087fb8fbf34be981efbd8493f9438d1b2ba2a86af082662aa46ae9adfbec51e5f3d9550a4dd1dcb7c8969c9587a6edc82a8cabbc785c40d9fbd12064559fb769450ac3e47e87bc046148130d7eaa843e4b3ccef3675d0630500803cb7ffee3882378c1a404e850c3e20707bb745e42b13c18786c4976076ed9fa8fd0ff15e571bef02cbbe2f90c908ac3734a433b73e778d4d17fcc28f49185ebc6e8536a06d293202d94496453bfdf1c2c7833a3f99fa38ca8a81f42eaa529d603b890308a319c0ab63a35ff8ebac965f6278f5a7e5d622be5d5fe55f0ca3ec993d55430d2bf59c5d3e860e90c16d91a04596f6fdf60d89ed95d88c036dde - Output = "forty two" + Decrypt=RSA-OAEP-8 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=2ecf15c97c5a15b1476ae986b371b57a24284f4a162a8d0c8182e7905e792256f1812ba5f83f1f7a130e42dcc02232844edc14a31a68ee97ae564a383a3411656424c5f62ddb646093c367be1fcda426cf00a06d8acb7e57776fbbd855ac3df506fc16b1d7c3f2110f3d8068e91e186363831c8409680d8da9ecd8cf1fa20ee39d + Output=4eb68dcd93ca9b19df111bd43608f557026fe4aa1d5cfac227a3eb5ab9548c18a06dded23f81825986b2fcd71109ecef7eff88873f075c2aa0c469f69c92bc - # a positive test case with null padded ciphertext +Availablein = default - Decrypt = RSA-3072 - Input = 00f4d565a3286784dbb85327db8807ae557ead229f92aba945cecda5225f606a7d6130edeeb6f26724d1eff1110f9eb18dc3248140ee3837e6688391e78796c526791384f045e21b6b853fb6342a11f309eb77962f37ce23925af600847fbd30e6e07e57de50b606e6b7f288cc777c1a6834f27e6edace508452128916eef7788c8bb227e3548c6a761cc4e9dd1a3584176dc053ba3500adb1d5e1611291654f12dfc5722832f635db3002d73f9defc310ace62c63868d341619c7ee15b20243b3371e05078e11219770c701d9f341af35df1bc729de294825ff2e416aa11526612852777eb131f9c45151eb144980d70608d2fc4043477368369aa0fe487a48bd57e66b00c3c58f941549f5ec050fca64449debe7a0c4ac51e55cb71620a70312aa4bd85fac1410c9c7f9d6ec610b7d11bf8faeffa20255d1a1bead9297d0aa8765cd2805847d639bc439f4a6c896e2008f746f9590ff4596de5ddde000ed666c452c978043ff4298461eb5a26d5e63d821438627f91201924bf7f2aeee1727 - Output = "forty two" + Decrypt=RSA-OAEP-8 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=4bc89130a5b2dabb7c2fcf90eb5d0eaf9e681b7146a38f3173a3d9cfec52ea9e0a41932e648a9d69344c50da763f51a03c95762131e8052254dcd2248cba40fd31667786ce05a2b7b531ac9dac9ed584a59b677c1a8aed8c5d15d68c05569e2be780bf7db638fd2bfd2a85ab276860f3777338fca989ffd743d13ee08e0ca9893f + Output=8604ac56328c1ab5ad917861 - # a positive test case with null truncated ciphertext +Availablein = default - Decrypt = RSA-3072 - Input = f4d565a3286784dbb85327db8807ae557ead229f92aba945cecda5225f606a7d6130edeeb6f26724d1eff1110f9eb18dc3248140ee3837e6688391e78796c526791384f045e21b6b853fb6342a11f309eb77962f37ce23925af600847fbd30e6e07e57de50b606e6b7f288cc777c1a6834f27e6edace508452128916eef7788c8bb227e3548c6a761cc4e9dd1a3584176dc053ba3500adb1d5e1611291654f12dfc5722832f635db3002d73f9defc310ace62c63868d341619c7ee15b20243b3371e05078e11219770c701d9f341af35df1bc729de294825ff2e416aa11526612852777eb131f9c45151eb144980d70608d2fc4043477368369aa0fe487a48bd57e66b00c3c58f941549f5ec050fca64449debe7a0c4ac51e55cb71620a70312aa4bd85fac1410c9c7f9d6ec610b7d11bf8faeffa20255d1a1bead9297d0aa8765cd2805847d639bc439f4a6c896e2008f746f9590ff4596de5ddde000ed666c452c978043ff4298461eb5a26d5e63d821438627f91201924bf7f2aeee1727 - Output = "forty two" + Decrypt=RSA-OAEP-8 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=2e456847d8fc36ff0147d6993594b9397227d577752c79d0f904fcb039d4d812fea605a7b574dd82ca786f93752348438ee9f5b5454985d5f0e1699e3e7ad175a32e15f03deb042ab9fe1dd9db1bb86f8c089ccb45e7ef0c5ee7ca9b7290ca6b15bed47039788a8a93ff83e0e8d6244c71006362deef69b6f416fb3c684383fbd0 + Output=fdda5fbf6ec361a9d9a4ac68af216a0686f438b1e0e5c36b955f74e107f39c0dddcc - # a positive test case with double null padded ciphertext +Availablein = default - Decrypt = RSA-3072 - Input = 00001ec97ac981dfd9dcc7a7389fdfa9d361141dac80c23a060410d472c16094e6cdffc0c3684d84aa402d7051dfccb2f6da33f66985d2a259f5b7fbf39ac537e95c5b7050eb18844a0513abef812cc8e74a3c5240009e6e805dcadf532bc1a2702d5acc9e585fad5b89d461fcc1397351cdce35171523758b171dc041f412e42966de7f94856477356d06f2a6b40e3ff0547562a4d91bbf1338e9e049facbee8b20171164505468cd308997447d3dc4b0acb49e7d368fedd8c734251f30a83491d2506f3f87318cc118823244a393dc7c5c739a2733d93e1b13db6840a9429947357f47b23fbe39b7d2d61e5ee26f9946c4632f6c4699e452f412a26641d4751135400713cd56ec66f0370423d55d2af70f5e7ad0adea8e4a0d904a01e4ac272eba4af1a029dd53eb71f115bf31f7a6c8b19a6523adeecc0d4c3c107575e38572a8f8474ccad163e46e2e8b08111132aa97a16fb588c9b7e37b3b3d7490381f3c55d1a9869a0fd42cd86fed59ecec78cb6b2dfd06a497f5afe3419691314ba0 - Output = "forty two" + Decrypt=RSA-OAEP-8 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=1fb9356fd5c4b1796db2ebf7d0d393cc810adf6145defc2fce714f79d93800d5e2ac211ea8bbecca4b654b94c3b18b30dd576ce34dc95436ef57a09415645923359a5d7b4171ef22c24670f1b229d3603e91f76671b7df97e7317c97734476d5f3d17d21cf82b5ba9f83df2e588d36984fd1b584468bd23b2e875f32f68953f7b2 + Output=4a5f4914bee25de3c69341de07 - # a positive test case with double null truncated ciphertext +Availablein = default - Decrypt = RSA-3072 - Input = 1ec97ac981dfd9dcc7a7389fdfa9d361141dac80c23a060410d472c16094e6cdffc0c3684d84aa402d7051dfccb2f6da33f66985d2a259f5b7fbf39ac537e95c5b7050eb18844a0513abef812cc8e74a3c5240009e6e805dcadf532bc1a2702d5acc9e585fad5b89d461fcc1397351cdce35171523758b171dc041f412e42966de7f94856477356d06f2a6b40e3ff0547562a4d91bbf1338e9e049facbee8b20171164505468cd308997447d3dc4b0acb49e7d368fedd8c734251f30a83491d2506f3f87318cc118823244a393dc7c5c739a2733d93e1b13db6840a9429947357f47b23fbe39b7d2d61e5ee26f9946c4632f6c4699e452f412a26641d4751135400713cd56ec66f0370423d55d2af70f5e7ad0adea8e4a0d904a01e4ac272eba4af1a029dd53eb71f115bf31f7a6c8b19a6523adeecc0d4c3c107575e38572a8f8474ccad163e46e2e8b08111132aa97a16fb588c9b7e37b3b3d7490381f3c55d1a9869a0fd42cd86fed59ecec78cb6b2dfd06a497f5afe3419691314ba0 - Output = "forty two" + Decrypt=RSA-OAEP-8 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 +@@ -1544,36 +1610,42 @@ Z7CDuaemy2HkLbNiuMmJbbcGTgKtWuYVh9oVtGSckFlJCf6zfby2VL63Jo7IAeWo + tKo5Eb69iFQvBb4= + -----END PRIVATE KEY----- - # The old FIPS provider doesn't include the workaround (#13817) --FIPSversion = >=3.2.0 +Availablein = default - # a random negative test case that generates a 9 byte long message - Decrypt = RSA-3072 - Input = 5c8555f5cef627c15d37f85c7f5fd6e499264ea4b8e3f9112023aeb722eb38d8eac2be3751fd5a3785ab7f2d59fa3728e5be8c3de78a67464e30b21ee23b5484bb3cd06d0e1c6ad25649c8518165653eb80488bfb491b20c04897a6772f69292222fc5ef50b5cf9efc6d60426a449b6c489569d48c83488df629d695653d409ce49a795447fcec2c58a1a672e4a391401d428baaf781516e11e323d302fcf20f6eab2b2dbe53a48c987e407c4d7e1cb41131329138313d330204173a4f3ff06c6fadf970f0ed1005d0b27e35c3d11693e0429e272d583e57b2c58d24315c397856b34485dcb077665592b747f889d34febf2be8fce66c265fd9fc3575a6286a5ce88b4b413a08efc57a07a8f57a999605a837b0542695c0d189e678b53662ecf7c3d37d9dbeea585eebfaf79141118e06762c2381fe27ca6288edddc19fd67cd64f16b46e06d8a59ac530f22cd83cc0bc4e37feb52015cbb2283043ccf5e78a4eb7146827d7a466b66c8a4a4826c1bad68123a7f2d00fc1736525ff90c058f56 - Output = 257906ca6de8307728 + Decrypt=RSA-OAEP-9 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=267bcd118acab1fc8ba81c85d73003cb8610fa55c1d97da8d48a7c7f06896a4db751aa284255b9d36ad65f37653d829f1b37f97b8001942545b2fc2c55a7376ca7a1be4b1760c8e05a33e5aa2526b8d98e317088e7834c755b2a59b12631a182c05d5d43ab1779264f8456f515ce57dfdf512d5493dab7b7338dc4b7d78db9c091ac3baf537a69fc7f549d979f0eff9a94fda4169bd4d1d19a69c99e33c3b55490d501b39b1edae118ff6793a153261584d3a5f39f6e682e3d17c8cd1261fa72 + Output=f735fd55ba92592c3b52b8f9c4f69aaa1cbef8fe88add095595412467f9cf4ec0b896c59eda16210e7549c8abb10cdbc21a12ec9b6b5b8fd2f10399eb6 - # The old FIPS provider doesn't include the workaround (#13817) --FIPSversion = >=3.2.0 +Availablein = default - # a random negative test case that generates a 9 byte long message based on - # second to last value from PRF - Decrypt = RSA-3072 -@@ -743,7 +757,7 @@ Input = 758c215aa6acd61248062b88284bf43c - Output = 043383c929060374ed + Decrypt=RSA-OAEP-9 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=93ac9f0671ec29acbb444effc1a5741351d60fdb0e393fbf754acf0de49761a14841df7772e9bc82773966a1584c4d72baea00118f83f35cca6e537cbd4d811f5583b29783d8a6d94cd31be70d6f526c10ff09c6fa7ce069795a3fcd0511fd5fcb564bcc80ea9c78f38b80012539d8a4ddf6fe81e9cddb7f50dbbbbcc7e5d86097ccf4ec49189fb8bf318be6d5a0715d516b49af191258cd32dc833ce6eb4673c03a19bbace88cc54895f636cc0c1ec89096d11ce235a265ca1764232a689ae8 + Output=81b906605015a63aabe42ddf11e1978912f5404c7474b26dce3ed482bf961ecc818bf420c54659 - # The old FIPS provider doesn't include the workaround (#13817) --FIPSversion = >=3.2.0 +Availablein = default - # a random negative test that generates message based on 3rd last value from - # PRF - Decrypt = RSA-3072 -@@ -751,35 +765,35 @@ Input = 7b22d5e62d287968c6622171a1f75db4 - Output = 70263fa6050534b9e0 + Decrypt=RSA-OAEP-9 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=81ebdd95054b0c822ef9ad7693f5a87adfb4b4c4ce70df2df84ed49c04da58ba5fc20a19e1a6e8b7a3900b22796dc4e869ee6b42792d15a8eceb56c09c69914e813cea8f6931e4b8ed6f421af298d595c97f4789c7caa612c7ef360984c21b93edc5401068b5af4c78a8771b984d53b8ea8adf2f6a7d4a0ba76c75e1dd9f658f20ded4a46071d46d7791b56803d8fea7f0b0f8e41ae3f09383a6f9585fe7753eaaffd2bf94563108beecc207bbb535f5fcc705f0dde9f708c62f49a9c90371d3 + Output=fd326429df9b890e09b54b18b8f34f1e24 - # The old FIPS provider doesn't include the workaround (#13817) --FIPSversion = >=3.2.0 +Availablein = default - # an otherwise valid plaintext, but with wrong first byte (0x01 instead of 0x00) - Decrypt = RSA-3072 - Input = 6db80adb5ff0a768caf1378ecc382a694e7d1bde2eff4ba12c48aaf794ded7a994a5b2b57acec20dbec4ae385c9dd531945c0f197a5496908725fc99d88601a17d3bb0b2d38d2c1c3100f39955a4cb3dbed5a38bf900f23d91e173640e4ec655c84fdfe71fcdb12a386108fcf718c9b7af37d39703e882436224c877a2235e8344fba6c951eb7e2a4d1d1de81fb463ac1b880f6cc0e59ade05c8ce35179ecd09546731fc07b141d3d6b342a97ae747e61a9130f72d37ac5a2c30215b6cbd66c7db893810df58b4c457b4b54f34428247d584e0fa71062446210db08254fb9ead1ba1a393c724bd291f0cf1a7143f32df849051dc896d7d176fef3b57ab6dffd626d0c3044e9edb2e3d012ace202d2581df01bec7e9aa0727a6650dd373d374f0bc0f4a611f8139dfe97d63e70c6188f4df5b672e47c51d8aa567097293fbff127c75ec690b43407578b73c85451710a0cece58fd497d7f7bd36a8a92783ef7dc6265dff52aac8b70340b996508d39217f2783ce6fc91a1cc94bb2ac487b84f62 - Output = 6d8d3a094ff3afff4c + Decrypt=RSA-OAEP-9 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=bcc35f94cde66cb1136625d625b94432a35b22f3d2fa11a613ff0fca5bd57f87b902ccdc1cd0aebcb0715ee869d1d1fe395f6793003f5eca465059c88660d446ff5f0818552022557e38c08a67ead991262254f10682975ec56397768537f4977af6d5f6aaceb7fb25dec5937230231fd8978af49119a29f29e424ab8272b47562792d5c94f774b8829d0b0d9f1a8c9eddf37574d5fa248eefa9c5271fc5ec2579c81bdd61b410fa61fe36e424221c113addb275664c801d34ca8c6351e4a858 + Output=f1459b5f0c92f01a0f723a2e5662484d8f8c0a20fc29dad6acd43bb5f3effdf4e1b63e07fdfe6628d0d74ca19bf2d69e4a0abf86d293925a796772f8088e - # The old FIPS provider doesn't include the workaround (#13817) --FIPSversion = >=3.2.0 +Availablein = default - # an otherwise valid plaintext, but with wrong second byte (0x01 instead of 0x02) - Decrypt = RSA-3072 - Input = 417328c034458563079a4024817d0150340c34e25ae16dcad690623f702e5c748a6ebb3419ff48f486f83ba9df35c05efbd7f40613f0fc996c53706c30df6bba6dcd4a40825f96133f3c21638a342bd4663dffbd0073980dac47f8c1dd8e97ce1412e4f91f2a8adb1ac2b1071066efe8d718bbb88ca4a59bd61500e826f2365255a409bece0f972df97c3a55e09289ef5fa815a2353ef393fd1aecfc888d611c16aec532e5148be15ef1bf2834b8f75bb26db08b66d2baad6464f8439d1986b533813321dbb180080910f233bcc4dd784fb21871aef41be08b7bfad4ecc3b68f228cb5317ac6ec1227bc7d0e452037ba918ee1da9fdb8393ae93b1e937a8d4691a17871d5092d2384b6190a53df888f65b951b05ed4ad57fe4b0c6a47b5b22f32a7f23c1a234c9feb5d8713d949686760680da4db454f4acad972470033472b9864d63e8d23eefc87ebcf464ecf33f67fbcdd48eab38c5292586b36aef5981ed2fa07b2f9e23fc57d9eb71bfff4111c857e9fff23ceb31e72592e70c874b4936 - Output = c6ae80ffa80bc184b0 + Decrypt=RSA-OAEP-9 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 + Input=232afbc927fa08c2f6a27b87d4a5cb09c07dc26fae73d73a90558839f4fd66d281b87ec734bce237ba166698ed829106a7de6942cd6cdce78fed8d2e4d81428e66490d036264cef92af941d3e35055fe3981e14d29cbb9a4f67473063baec79a1179f5a17c9c1832f2838fd7d5e59bb9659d56dce8a019edef1bb3accc697cc6cc7a778f60a064c7f6f5d529c6210262e003de583e81e3167b89971fb8c0e15d44fffef89b53d8d64dd797d159b56d2b08ea5307ea12c241bd58d4ee278a1f2e + Output=53e6e8c729d6f9c319dd317e74b0db8e4ccca25f3c8305746e137ac63a63ef3739e7b595abb96e8d55e54f7bd41ab433378ffb911d - # The old FIPS provider doesn't include the workaround (#13817) --FIPSversion = >=3.2.0 +Availablein = default - # an otherwise valid plaintext, but with zero byte in first byte of padding - Decrypt = RSA-3072 - Input = 8542c626fe533467acffcd4e617692244c9b5a3bf0a215c5d64891ced4bf4f9591b4b2aedff9843057986d81631b0acb3704ec2180e5696e8bd15b217a0ec36d2061b0e2182faa3d1c59bd3f9086a10077a3337a3f5da503ec3753535ffd25b837a12f2541afefd0cffb0224b8f874e4bed13949e105c075ed44e287c5ae03b155e06b90ed247d2c07f1ef3323e3508cce4e4074606c54172ad74d12f8c3a47f654ad671104bf7681e5b061862747d9afd37e07d8e0e2291e01f14a95a1bb4cbb47c304ef067595a3947ee2d722067e38a0f046f43ec29cac6a8801c6e3e9a2331b1d45a7aa2c6af3205be382dd026e389614ee095665a611ab2e8dced2ee1c9d08ac9de11aef5b3803fc9a9ce8231ec87b5fed386fb92ee3db995a89307bcba844bd0a691c29ae51216e949dfc813133cb06a07265fd807bcb3377f6adb0a481d9b7f442003115895939773e6b95371c4febef29edae946fa245e7c50729e2e558cfaad773d1fd5f67b457a6d9d17a847c6fcbdb103a86f35f228cefc06cea0 - Output = a8a9301daa01bb25c7 + Decrypt=RSA-OAEP-9 + Ctrl = rsa_padding_mode:oaep + Ctrl = rsa_mgf1_md:sha1 +diff --git a/test/recipes/80-test_cms.t b/test/recipes/80-test_cms.t +index 4e368c730b..879d5d76eb 100644 +--- a/test/recipes/80-test_cms.t ++++ b/test/recipes/80-test_cms.t +@@ -235,7 +235,7 @@ my @smime_pkcs7_tests = ( + \&final_compare + ], - # The old FIPS provider doesn't include the workaround (#13817) --FIPSversion = >=3.2.0 -+Availablein = default - # an otherwise valid plaintext, but with zero byte in eight byte of padding - Decrypt = RSA-3072 - Input = 449dfa237a70a99cb0351793ec8677882021c2aa743580bf6a0ea672055cffe8303ac42855b1d1f3373aae6af09cb9074180fc963e9d1478a4f98b3b4861d3e7f0aa8560cf603711f139db77667ca14ba3a1acdedfca9ef4603d6d7eb0645bfc805304f9ad9d77d34762ce5cd84bd3ec9d35c30e3be72a1e8d355d5674a141b5530659ad64ebb6082e6f73a80832ab6388912538914654d34602f4b3b1c78589b4a5d964b2efcca1dc7004c41f6cafcb5a7159a7fc7c0398604d0edbd4c8f4f04067da6a153a05e7cbeea13b5ee412400ef7d4f3106f4798da707ec37a11286df2b7a204856d5ff773613fd1e453a7114b78e347d3e8078e1cb3276b3562486ba630bf719697e0073a123c3e60ebb5c7a1ccff4279faffa2402bc1109f8d559d6766e73591943dfcf25ba10c3762f02af85187799b8b4b135c3990793a6fd32642f1557405ba55cc7cf7336a0e967073c5fa50743f9cc5e3017c172d9898d2af83345e71b3e0c22ab791eacb6484a32ec60ebc226ec9deaee91b1a0560c2b571 - Output = 6c716fe01d44398018 +- [ "enveloped content test streaming S/MIME format, AES-256 cipher, 3 recipients", ++ [ "enveloped content test streaming S/MIME format, AES-256 cipher, 3 recipients, no Red Hat FIPS", + [ "{cmd1}", @prov, "-encrypt", "-in", $smcont, + "-aes256", "-stream", "-out", "{output}.cms", + $smrsa1, +@@ -1118,6 +1118,9 @@ sub check_availability { + return "$tnam: skipped, DSA disabled\n" + if ($no_dsa && $tnam =~ / DSA/); - # The old FIPS provider doesn't include the workaround (#13817) --FIPSversion = >=3.2.0 -+Availablein = default - # an otherwise valid plaintext, but with null separator missing - Decrypt = RSA-3072 - Input = a7a5c99e50da48769ecb779d9abe86ef9ec8c38c6f43f17c7f2d7af608a4a1bd6cf695b47e97c191c61fb5a27318d02f495a176b9fae5a55b5d3fabd1d8aae4957e3879cb0c60f037724e11be5f30f08fc51c033731f14b44b414d11278cd3dba7e1c8bfe208d2b2bb7ec36366dacb6c88b24cd79ab394adf19dbbc21dfa5788bacbadc6a62f79cf54fd8cf585c615b5c0eb94c35aa9de25321c8ffefb8916bbaa2697cb2dd82ee98939df9b6704cee77793edd2b4947d82e00e5749664970736c59a84197bd72b5c71e36aae29cd39af6ac73a368edbc1ca792e1309f442aafcd77c992c88f8e4863149f221695cb7b0236e75b2339a02c4ea114854372c306b9412d8eedb600a31532002f2cea07b4df963a093185e4607732e46d753b540974fb5a5c3f9432df22e85bb17611370966c5522fd23f2ad3484341ba7fd8885fc8e6d379a611d13a2aca784fba2073208faad2137bf1979a0fa146c1880d4337db3274269493bab44a1bcd0681f7227ffdf589c2e925ed9d36302509d1109ba4 ++ return "$tnam: skipped, Red Hat FIPS\n" ++ if ($tnam =~ /no Red Hat FIPS/); ++ + return ""; + } + +diff --git a/test/recipes/80-test_ssl_old.t b/test/recipes/80-test_ssl_old.t +index e2dcb68fb5..0775112b40 100644 +--- a/test/recipes/80-test_ssl_old.t ++++ b/test/recipes/80-test_ssl_old.t +@@ -493,6 +493,18 @@ sub testssl { + # the default choice if TLSv1.3 enabled + my $flag = $protocol eq "-tls1_3" ? "" : $protocol; + my $ciphersuites = ""; ++ my %redhat_skip_cipher = map {$_ => 1} qw( ++AES256-GCM-SHA384:@SECLEVEL=0 ++AES256-CCM8:@SECLEVEL=0 ++AES256-CCM:@SECLEVEL=0 ++AES128-GCM-SHA256:@SECLEVEL=0 ++AES128-CCM8:@SECLEVEL=0 ++AES128-CCM:@SECLEVEL=0 ++AES256-SHA256:@SECLEVEL=0 ++AES128-SHA256:@SECLEVEL=0 ++AES256-SHA:@SECLEVEL=0 ++AES128-SHA:@SECLEVEL=0 ++ ); + foreach my $cipher (@{$ciphersuites{$protocol}}) { + if ($protocol eq "-ssl3" && $cipher =~ /ECDH/ ) { + note "*****SKIPPING $protocol $cipher"; +@@ -504,11 +516,16 @@ sub testssl { + } else { + $cipher = $cipher.':@SECLEVEL=0'; + } +- ok(run(test([@ssltest, @exkeys, "-cipher", +- $cipher, +- "-ciphersuites", $ciphersuites, +- $flag || ()])), +- "Testing $cipher"); ++ if ($provider eq "fips" && exists $redhat_skip_cipher{$cipher}) { ++ note "*****SKIPPING $cipher in Red Hat FIPS mode"; ++ ok(1); ++ } else { ++ ok(run(test([@ssltest, @exkeys, "-cipher", ++ $cipher, ++ "-ciphersuites", $ciphersuites, ++ $flag || ()])), ++ "Testing $cipher"); ++ } + } + } + next if $protocol eq "-tls1_3"; +-- +2.44.0 + diff --git a/0073-FIPS-Use-OAEP-in-KATs-support-fixed-OAEP-seed.patch b/0073-FIPS-Use-OAEP-in-KATs-support-fixed-OAEP-seed.patch index 6f5fef2..fe4ca7c 100644 --- a/0073-FIPS-Use-OAEP-in-KATs-support-fixed-OAEP-seed.patch +++ b/0073-FIPS-Use-OAEP-in-KATs-support-fixed-OAEP-seed.patch @@ -1,22 +1,22 @@ -From abeda0b0475adb0d4f89b0c97cfc349779915bbf Mon Sep 17 00:00:00 2001 +From 62721a92ebec8746888d94bea0082c8d8763219e Mon Sep 17 00:00:00 2001 From: rpm-build <rpm-build> -Date: Mon, 31 Jul 2023 09:41:28 +0200 -Subject: [PATCH 29/35] +Date: Wed, 6 Mar 2024 19:17:15 +0100 +Subject: [PATCH 27/49] 0073-FIPS-Use-OAEP-in-KATs-support-fixed-OAEP-seed.patch Patch-name: 0073-FIPS-Use-OAEP-in-KATs-support-fixed-OAEP-seed.patch Patch-id: 73 Patch-status: | - # https://bugzilla.redhat.com/show_bug.cgi?id=2102535 -From-dist-git-commit: 9409bc7044cf4b5773639cce20f51399888c45fd + # # https://bugzilla.redhat.com/show_bug.cgi?id=2102535 +From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce --- crypto/rsa/rsa_local.h | 8 ++ crypto/rsa/rsa_oaep.c | 34 ++++++-- - include/openssl/core_names.h | 3 + providers/fips/self_test_data.inc | 79 ++++++++++--------- providers/fips/self_test_kats.c | 7 ++ .../implementations/asymciphers/rsa_enc.c | 41 +++++++++- - 6 files changed, 128 insertions(+), 44 deletions(-) + util/perl/OpenSSL/paramnames.pm | 1 + + 6 files changed, 126 insertions(+), 44 deletions(-) diff --git a/crypto/rsa/rsa_local.h b/crypto/rsa/rsa_local.h index ea70da05ad..dde57a1a0e 100644 @@ -36,7 +36,7 @@ index ea70da05ad..dde57a1a0e 100644 + #endif /* OSSL_CRYPTO_RSA_LOCAL_H */ diff --git a/crypto/rsa/rsa_oaep.c b/crypto/rsa/rsa_oaep.c -index d9be1a4f98..b2f7f7dc4b 100644 +index b9030440c4..3d665c3860 100644 --- a/crypto/rsa/rsa_oaep.c +++ b/crypto/rsa/rsa_oaep.c @@ -44,6 +44,10 @@ int RSA_padding_add_PKCS1_OAEP(unsigned char *to, int tlen, @@ -82,7 +82,7 @@ index d9be1a4f98..b2f7f7dc4b 100644 if (RAND_bytes_ex(libctx, seed, mdlen, 0) <= 0) goto err; -@@ -138,6 +148,18 @@ int ossl_rsa_padding_add_PKCS1_OAEP_mgf1_ex(OSSL_LIB_CTX *libctx, +@@ -136,6 +146,18 @@ int ossl_rsa_padding_add_PKCS1_OAEP_mgf1_ex(OSSL_LIB_CTX *libctx, return rv; } @@ -102,7 +102,7 @@ index d9be1a4f98..b2f7f7dc4b 100644 const unsigned char *from, int flen, const unsigned char *param, int plen, diff --git a/providers/fips/self_test_data.inc b/providers/fips/self_test_data.inc -index e0fdc0daa4..aa2012c04a 100644 +index 4b80bb70b9..c33ecd0791 100644 --- a/providers/fips/self_test_data.inc +++ b/providers/fips/self_test_data.inc @@ -1296,14 +1296,21 @@ static const ST_KAT_PARAM rsa_priv_key[] = { @@ -208,10 +208,10 @@ index e0fdc0daa4..aa2012c04a 100644 #ifndef OPENSSL_NO_EC diff --git a/providers/fips/self_test_kats.c b/providers/fips/self_test_kats.c -index 74ee25dcb6..a9bc8be7fa 100644 +index f13c41abd6..4ea10670c0 100644 --- a/providers/fips/self_test_kats.c +++ b/providers/fips/self_test_kats.c -@@ -641,14 +641,21 @@ static int self_test_ciphers(OSSL_SELF_TEST *st, OSSL_LIB_CTX *libctx) +@@ -642,14 +642,21 @@ static int self_test_ciphers(OSSL_SELF_TEST *st, OSSL_LIB_CTX *libctx) return ret; } @@ -234,7 +234,7 @@ index 74ee25dcb6..a9bc8be7fa 100644 } diff --git a/providers/implementations/asymciphers/rsa_enc.c b/providers/implementations/asymciphers/rsa_enc.c -index 9cd8904131..40de5ce8fa 100644 +index d548560f1f..f3443b0c66 100644 --- a/providers/implementations/asymciphers/rsa_enc.c +++ b/providers/implementations/asymciphers/rsa_enc.c @@ -30,6 +30,9 @@ @@ -257,7 +257,7 @@ index 9cd8904131..40de5ce8fa 100644 /* PKCS#1 v1.5 decryption mode */ unsigned int implicit_rejection; } PROV_RSA_CTX; -@@ -192,12 +198,21 @@ static int rsa_encrypt(void *vprsactx, unsigned char *out, size_t *outlen, +@@ -193,12 +199,21 @@ static int rsa_encrypt(void *vprsactx, unsigned char *out, size_t *outlen, } } ret = @@ -281,7 +281,7 @@ index 9cd8904131..40de5ce8fa 100644 if (!ret) { OPENSSL_free(tbuf); -@@ -328,6 +343,9 @@ static void rsa_freectx(void *vprsactx) +@@ -332,6 +347,9 @@ static void rsa_freectx(void *vprsactx) EVP_MD_free(prsactx->oaep_md); EVP_MD_free(prsactx->mgf1_md); OPENSSL_free(prsactx->oaep_label); @@ -291,7 +291,7 @@ index 9cd8904131..40de5ce8fa 100644 OPENSSL_free(prsactx); } -@@ -447,6 +465,9 @@ static const OSSL_PARAM known_gettable_ctx_params[] = { +@@ -455,6 +473,9 @@ static const OSSL_PARAM known_gettable_ctx_params[] = { NULL, 0), OSSL_PARAM_uint(OSSL_ASYM_CIPHER_PARAM_TLS_CLIENT_VERSION, NULL), OSSL_PARAM_uint(OSSL_ASYM_CIPHER_PARAM_TLS_NEGOTIATED_VERSION, NULL), @@ -301,7 +301,7 @@ index 9cd8904131..40de5ce8fa 100644 OSSL_PARAM_uint(OSSL_ASYM_CIPHER_PARAM_IMPLICIT_REJECTION, NULL), OSSL_PARAM_END }; -@@ -456,6 +477,10 @@ static const OSSL_PARAM *rsa_gettable_ctx_params(ossl_unused void *vprsactx, +@@ -465,6 +486,10 @@ static const OSSL_PARAM *rsa_gettable_ctx_params(ossl_unused void *vprsactx, return known_gettable_ctx_params; } @@ -312,7 +312,7 @@ index 9cd8904131..40de5ce8fa 100644 static int rsa_set_ctx_params(void *vprsactx, const OSSL_PARAM params[]) { PROV_RSA_CTX *prsactx = (PROV_RSA_CTX *)vprsactx; -@@ -567,6 +592,18 @@ static int rsa_set_ctx_params(void *vprsactx, const OSSL_PARAM params[]) +@@ -576,6 +601,18 @@ static int rsa_set_ctx_params(void *vprsactx, const OSSL_PARAM params[]) prsactx->oaep_labellen = tmp_labellen; } @@ -331,12 +331,10 @@ index 9cd8904131..40de5ce8fa 100644 p = OSSL_PARAM_locate_const(params, OSSL_ASYM_CIPHER_PARAM_TLS_CLIENT_VERSION); if (p != NULL) { unsigned int client_version; --- -2.41.0 - -diff -up openssl-3.2.0/util/perl/OpenSSL/paramnames.pm.patch-config openssl-3.2.0/util/perl/OpenSSL/paramnames.pm ---- openssl-3.2.0/util/perl/OpenSSL/paramnames.pm.patch-config 2023-12-14 13:48:23.398025507 +0100 -+++ openssl-3.2.0/util/perl/OpenSSL/paramnames.pm 2023-12-14 14:24:49.519488385 +0100 +diff --git a/util/perl/OpenSSL/paramnames.pm b/util/perl/OpenSSL/paramnames.pm +index c37ed7815f..70f7c50fe4 100644 +--- a/util/perl/OpenSSL/paramnames.pm ++++ b/util/perl/OpenSSL/paramnames.pm @@ -401,6 +401,7 @@ my %params = ( 'ASYM_CIPHER_PARAM_TLS_CLIENT_VERSION' => "tls-client-version", 'ASYM_CIPHER_PARAM_TLS_NEGOTIATED_VERSION' => "tls-negotiated-version", @@ -345,3 +343,6 @@ diff -up openssl-3.2.0/util/perl/OpenSSL/paramnames.pm.patch-config openssl-3.2. # Encoder / decoder parameters +-- +2.44.0 + diff --git a/0074-FIPS-Use-digest_sign-digest_verify-in-self-test.patch b/0074-FIPS-Use-digest_sign-digest_verify-in-self-test.patch index e41fadd..7751f05 100644 --- a/0074-FIPS-Use-digest_sign-digest_verify-in-self-test.patch +++ b/0074-FIPS-Use-digest_sign-digest_verify-in-self-test.patch @@ -1,32 +1,25 @@ -From 97ac06e5a8e3a8699279c06eeb64c8e958bad7bd Mon Sep 17 00:00:00 2001 -From: Clemens Lang <cllang(a)redhat.com> -Date: Fri, 15 Jul 2022 17:45:40 +0200 -Subject: [PATCH] FIPS: Use digest_sign & digest_verify in self test +From dc41625dc4a793f0e21188165711181ca085339b Mon Sep 17 00:00:00 2001 +From: rpm-build <rpm-build> +Date: Wed, 6 Mar 2024 19:17:16 +0100 +Subject: [PATCH 28/49] + 0074-FIPS-Use-digest_sign-digest_verify-in-self-test.patch -In review for FIPS 140-3, the lack of a self-test for the digest_sign -and digest_verify provider functions was highlighted as a problem. NIST -no longer provides ACVP tests for the RSA SigVer primitive (see -https://github.com/usnistgov/ACVP/issues/1347). Because FIPS 140-3 -recommends the use of functions that compute the digest and signature -within the module, we have been advised in our module review that the -self tests should also use the combined digest and signature APIs, i.e. -the digest_sign and digest_verify provider functions. - -Modify the signature self-test to use these instead by switching to -EVP_DigestSign and EVP_DigestVerify. This requires adding more ifdefs to -crypto/evp/m_sigver.c to make these functions usable in the FIPS module. - -Signed-off-by: Clemens Lang <cllang(a)redhat.com> +Patch-name: 0074-FIPS-Use-digest_sign-digest_verify-in-self-test.patch +Patch-id: 74 +Patch-status: | + # [PATCH 29/46] + # 0074-FIPS-Use-digest_sign-digest_verify-in-self-test.patch +From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce --- - crypto/evp/m_sigver.c | 43 +++++++++++++++++++++++++++------ - providers/fips/self_test_kats.c | 37 +++++++++++++++------------- - 2 files changed, 56 insertions(+), 24 deletions(-) + crypto/evp/m_sigver.c | 54 ++++++++++++++++++++++++++++----- + providers/fips/self_test_kats.c | 43 +++++++++++++++----------- + 2 files changed, 73 insertions(+), 24 deletions(-) diff --git a/crypto/evp/m_sigver.c b/crypto/evp/m_sigver.c -index db1a1d7bc3..c94c3c53bd 100644 +index fd3a4b79df..3e9f33c26c 100644 --- a/crypto/evp/m_sigver.c +++ b/crypto/evp/m_sigver.c -@@ -88,6 +88,7 @@ static int update(EVP_MD_CTX *ctx, const void *data, size_t datalen) +@@ -90,6 +90,7 @@ static int update(EVP_MD_CTX *ctx, const void *data, size_t datalen) ERR_raise(ERR_LIB_EVP, EVP_R_ONLY_ONESHOT_SUPPORTED); return 0; } @@ -34,7 +27,7 @@ index db1a1d7bc3..c94c3c53bd 100644 /* * If we get the "NULL" md then the name comes back as "UNDEF". We want to use -@@ -130,8 +131,10 @@ static int do_sigver_init(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, +@@ -125,8 +126,10 @@ static int do_sigver_init(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, reinit = 0; if (e == NULL) ctx->pctx = EVP_PKEY_CTX_new_from_pkey(libctx, pkey, props); @@ -45,7 +38,7 @@ index db1a1d7bc3..c94c3c53bd 100644 } if (ctx->pctx == NULL) return 0; -@@ -139,8 +142,10 @@ static int do_sigver_init(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, +@@ -136,8 +139,10 @@ static int do_sigver_init(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, locpctx = ctx->pctx; ERR_set_mark(); @@ -56,7 +49,7 @@ index db1a1d7bc3..c94c3c53bd 100644 /* do not reinitialize if pkey is set or operation is different */ if (reinit -@@ -225,8 +230,10 @@ static int do_sigver_init(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, +@@ -222,8 +227,10 @@ static int do_sigver_init(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, signature = evp_signature_fetch_from_prov((OSSL_PROVIDER *)tmp_prov, supported_sig, locpctx->propquery); @@ -67,7 +60,7 @@ index db1a1d7bc3..c94c3c53bd 100644 break; } if (signature == NULL) -@@ -310,6 +317,7 @@ static int do_sigver_init(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, +@@ -307,6 +314,7 @@ static int do_sigver_init(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, ctx->fetched_digest = EVP_MD_fetch(locpctx->libctx, mdname, props); if (ctx->fetched_digest != NULL) { ctx->digest = ctx->reqdigest = ctx->fetched_digest; @@ -75,7 +68,7 @@ index db1a1d7bc3..c94c3c53bd 100644 } else { /* legacy engine support : remove the mark when this is deleted */ ctx->reqdigest = ctx->digest = EVP_get_digestbyname(mdname); -@@ -318,11 +326,13 @@ static int do_sigver_init(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, +@@ -315,11 +323,13 @@ static int do_sigver_init(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR); goto err; } @@ -89,7 +82,7 @@ index db1a1d7bc3..c94c3c53bd 100644 if (ctx->reqdigest != NULL && !EVP_PKEY_is_a(locpctx->pkey, SN_hmac) && !EVP_PKEY_is_a(locpctx->pkey, SN_tls1_prf) -@@ -334,6 +344,7 @@ static int do_sigver_init(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, +@@ -331,6 +341,7 @@ static int do_sigver_init(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, goto err; } } @@ -97,7 +90,7 @@ index db1a1d7bc3..c94c3c53bd 100644 if (ver) { if (signature->digest_verify_init == NULL) { -@@ -366,6 +377,7 @@ static int do_sigver_init(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, +@@ -363,6 +374,7 @@ static int do_sigver_init(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, EVP_KEYMGMT_free(tmp_keymgmt); return 0; @@ -105,7 +98,7 @@ index db1a1d7bc3..c94c3c53bd 100644 legacy: /* * If we don't have the full support we need with provided methods, -@@ -437,6 +449,7 @@ static int do_sigver_init(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, +@@ -434,6 +446,7 @@ static int do_sigver_init(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, ctx->pctx->flag_call_digest_custom = 1; ret = 1; @@ -113,7 +106,7 @@ index db1a1d7bc3..c94c3c53bd 100644 end: #ifndef FIPS_MODULE -@@ -479,7 +492,6 @@ int EVP_DigestVerifyInit(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, +@@ -476,7 +489,6 @@ int EVP_DigestVerifyInit(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx, return do_sigver_init(ctx, pctx, type, NULL, NULL, NULL, e, pkey, 1, NULL); } @@ -121,7 +114,57 @@ index db1a1d7bc3..c94c3c53bd 100644 int EVP_DigestSignUpdate(EVP_MD_CTX *ctx, const void *data, size_t dsize) { -@@ -639,6 +659,7 @@ int EVP_DigestSignFinal(EVP_MD_CTX *ctx, unsigned char *sigret, +@@ -548,24 +560,31 @@ int EVP_DigestVerifyUpdate(EVP_MD_CTX *ctx, const void *data, size_t dsize) + return EVP_DigestUpdate(ctx, data, dsize); + } + +-#ifndef FIPS_MODULE + int EVP_DigestSignFinal(EVP_MD_CTX *ctx, unsigned char *sigret, + size_t *siglen) + { +- int sctx = 0, r = 0; +- EVP_PKEY_CTX *dctx = NULL, *pctx = ctx->pctx; ++ int r = 0; ++#ifndef FIPS_MODULE ++ int sctx = 0; ++ EVP_PKEY_CTX *dctx = NULL; ++#endif /* !defined(FIPS_MODULE) */ ++ EVP_PKEY_CTX *pctx = ctx->pctx; ++ + + if ((ctx->flags & EVP_MD_CTX_FLAG_FINALISED) != 0) { + ERR_raise(ERR_LIB_EVP, EVP_R_FINAL_ERROR); + return 0; + } + ++#ifndef FIPS_MODULE + if (pctx == NULL + || pctx->operation != EVP_PKEY_OP_SIGNCTX + || pctx->op.sig.algctx == NULL + || pctx->op.sig.signature == NULL) + goto legacy; ++#endif /* !defined(FIPS_MODULE) */ + ++#ifndef FIPS_MODULE + if (sigret != NULL && (ctx->flags & EVP_MD_CTX_FLAG_FINALISE) == 0) { + /* try dup */ + dctx = EVP_PKEY_CTX_dup(pctx); +@@ -580,7 +599,14 @@ int EVP_DigestSignFinal(EVP_MD_CTX *ctx, unsigned char *sigret, + else + EVP_PKEY_CTX_free(dctx); + return r; ++#else ++ r = pctx->op.sig.signature->digest_sign_final(pctx->op.sig.algctx, ++ sigret, siglen, ++ sigret == NULL ? 0 : *siglen); ++ return r; ++#endif /* !defined(FIPS_MODULE) */ + ++#ifndef FIPS_MODULE + legacy: + if (pctx == NULL || pctx->pmeth == NULL) { + ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR); +@@ -653,6 +679,7 @@ int EVP_DigestSignFinal(EVP_MD_CTX *ctx, unsigned char *sigret, } } return 1; @@ -129,7 +172,54 @@ index db1a1d7bc3..c94c3c53bd 100644 } int EVP_DigestSign(EVP_MD_CTX *ctx, unsigned char *sigret, size_t *siglen, -@@ -732,6 +761,7 @@ int EVP_DigestVerifyFinal(EVP_MD_CTX *ctx, const unsigned char *sig, +@@ -691,23 +718,30 @@ int EVP_DigestSign(EVP_MD_CTX *ctx, unsigned char *sigret, size_t *siglen, + int EVP_DigestVerifyFinal(EVP_MD_CTX *ctx, const unsigned char *sig, + size_t siglen) + { +- unsigned char md[EVP_MAX_MD_SIZE]; + int r = 0; ++#ifndef FIPS_MODULE ++ unsigned char md[EVP_MAX_MD_SIZE]; + unsigned int mdlen = 0; + int vctx = 0; +- EVP_PKEY_CTX *dctx = NULL, *pctx = ctx->pctx; ++ EVP_PKEY_CTX *dctx = NULL; ++#endif /* !defined(FIPS_MODULE) */ ++ EVP_PKEY_CTX *pctx = ctx->pctx; ++ + + if ((ctx->flags & EVP_MD_CTX_FLAG_FINALISED) != 0) { + ERR_raise(ERR_LIB_EVP, EVP_R_FINAL_ERROR); + return 0; + } + ++#ifndef FIPS_MODULE + if (pctx == NULL + || pctx->operation != EVP_PKEY_OP_VERIFYCTX + || pctx->op.sig.algctx == NULL + || pctx->op.sig.signature == NULL) + goto legacy; ++#endif /* !defined(FIPS_MODULE) */ + ++#ifndef FIPS_MODULE + if ((ctx->flags & EVP_MD_CTX_FLAG_FINALISE) == 0) { + /* try dup */ + dctx = EVP_PKEY_CTX_dup(pctx); +@@ -721,7 +755,13 @@ int EVP_DigestVerifyFinal(EVP_MD_CTX *ctx, const unsigned char *sig, + else + EVP_PKEY_CTX_free(dctx); + return r; ++#else ++ r = pctx->op.sig.signature->digest_verify_final(pctx->op.sig.algctx, ++ sig, siglen); ++ return r; ++#endif /* !defined(FIPS_MODULE) */ + ++#ifndef FIPS_MODULE + legacy: + if (pctx == NULL || pctx->pmeth == NULL) { + ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR); +@@ -762,6 +802,7 @@ int EVP_DigestVerifyFinal(EVP_MD_CTX *ctx, const unsigned char *sig, if (vctx || !r) return r; return EVP_PKEY_verify(pctx, sig, siglen, md, mdlen); @@ -137,16 +227,16 @@ index db1a1d7bc3..c94c3c53bd 100644 } int EVP_DigestVerify(EVP_MD_CTX *ctx, const unsigned char *sigret, -@@ -757,4 +787,3 @@ int EVP_DigestVerify(EVP_MD_CTX *ctx, const unsigned char *sigret, +@@ -794,4 +835,3 @@ int EVP_DigestVerify(EVP_MD_CTX *ctx, const unsigned char *sigret, return -1; return EVP_DigestVerifyFinal(ctx, sigret, siglen); } -#endif /* FIPS_MODULE */ diff --git a/providers/fips/self_test_kats.c b/providers/fips/self_test_kats.c -index b6d5e8e134..77eec075e6 100644 +index 4ea10670c0..5eb27c8ed2 100644 --- a/providers/fips/self_test_kats.c +++ b/providers/fips/self_test_kats.c -@@ -444,10 +444,13 @@ static int self_test_sign(const ST_KAT_SIGN *t, +@@ -450,10 +450,13 @@ static int self_test_sign(const ST_KAT_SIGN *t, int ret = 0; OSSL_PARAM *params = NULL, *params_sig = NULL; OSSL_PARAM_BLD *bld = NULL; @@ -161,7 +251,7 @@ index b6d5e8e134..77eec075e6 100644 size_t siglen = sizeof(sig); static const unsigned char dgst[] = { 0x7f, 0x83, 0xb1, 0x65, 0x7f, 0xf1, 0xfc, 0x53, 0xb9, 0x2d, 0xc1, 0x81, -@@ -488,23 +491,26 @@ static int self_test_sign(const ST_KAT_SIGN *t, +@@ -487,23 +490,26 @@ static int self_test_sign(const ST_KAT_SIGN *t, || EVP_PKEY_fromdata(kctx, &pkey, EVP_PKEY_KEYPAIR, params) <= 0) goto err; @@ -202,7 +292,7 @@ index b6d5e8e134..77eec075e6 100644 || EVP_PKEY_CTX_set_params(sctx, params_sig) <= 0) goto err; -@@ -509,14 +510,17 @@ static int self_test_sign(const ST_KAT_SIGN *t, +@@ -513,14 +519,17 @@ static int self_test_sign(const ST_KAT_SIGN *t, goto err; OSSL_SELF_TEST_oncorrupt_byte(st, sig); @@ -223,186 +313,5 @@ index b6d5e8e134..77eec075e6 100644 OSSL_PARAM_free(params_sig); OSSL_PARAM_BLD_free(bld); -- -2.37.1 +2.44.0 -diff -up openssl-3.2.0/crypto/evp/m_sigver.c.digest-sign-patch openssl-3.2.0/crypto/evp/m_sigver.c ---- openssl-3.2.0/crypto/evp/m_sigver.c.digest-sign-patch 2024-01-04 11:44:18.761559765 +0100 -+++ openssl-3.2.0/crypto/evp/m_sigver.c 2024-01-04 11:51:18.297195401 +0100 -@@ -560,26 +560,33 @@ int EVP_DigestVerifyUpdate(EVP_MD_CTX *c - return EVP_DigestUpdate(ctx, data, dsize); - } - --#ifndef FIPS_MODULE - int EVP_DigestSignFinal(EVP_MD_CTX *ctx, unsigned char *sigret, - size_t *siglen) - { -- int sctx = 0, r = 0; -- EVP_PKEY_CTX *dctx = NULL, *pctx = ctx->pctx; -+ int r = 0; -+#ifndef FIPS_MODULE -+ int sctx = 0; -+ EVP_PKEY_CTX *dctx = NULL; -+#endif /* !defined(FIPS_MODULE) */ -+ EVP_PKEY_CTX *pctx = ctx->pctx; -+ - - if ((ctx->flags & EVP_MD_CTX_FLAG_FINALISED) != 0) { - ERR_raise(ERR_LIB_EVP, EVP_R_FINAL_ERROR); - return 0; - } - -+#ifndef FIPS_MODULE - if (pctx == NULL - || pctx->operation != EVP_PKEY_OP_SIGNCTX - || pctx->op.sig.algctx == NULL - || pctx->op.sig.signature == NULL) - goto legacy; -+#endif /* !defined(FIPS_MODULE) */ - - if (sigret != NULL && (ctx->flags & EVP_MD_CTX_FLAG_FINALISE) == 0) { - /* try dup */ -+#ifndef FIPS_MODULE - dctx = EVP_PKEY_CTX_dup(pctx); - if (dctx != NULL) - pctx = dctx; -@@ -591,8 +598,10 @@ int EVP_DigestSignFinal(EVP_MD_CTX *ctx, - ctx->flags |= EVP_MD_CTX_FLAG_FINALISED; - else - EVP_PKEY_CTX_free(dctx); -+#endif /* !defined(FIPS_MODULE) */ - return r; - -+#ifndef FIPS_MODULE - legacy: - if (pctx == NULL || pctx->pmeth == NULL) { - ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR); -@@ -704,25 +713,32 @@ int EVP_DigestSign(EVP_MD_CTX *ctx, unsi - int EVP_DigestVerifyFinal(EVP_MD_CTX *ctx, const unsigned char *sig, - size_t siglen) - { -- unsigned char md[EVP_MAX_MD_SIZE]; - int r = 0; -+#ifndef FIPS_MODULE -+ unsigned char md[EVP_MAX_MD_SIZE]; - unsigned int mdlen = 0; - int vctx = 0; -- EVP_PKEY_CTX *dctx = NULL, *pctx = ctx->pctx; -+ EVP_PKEY_CTX *dctx = NULL; -+#endif /* !defined(FIPS_MODULE) */ -+ EVP_PKEY_CTX *pctx = ctx->pctx; -+ - - if ((ctx->flags & EVP_MD_CTX_FLAG_FINALISED) != 0) { - ERR_raise(ERR_LIB_EVP, EVP_R_FINAL_ERROR); - return 0; - } - -+#ifndef FIPS_MODULE - if (pctx == NULL - || pctx->operation != EVP_PKEY_OP_VERIFYCTX - || pctx->op.sig.algctx == NULL - || pctx->op.sig.signature == NULL) - goto legacy; -+#endif /* !defined(FIPS_MODULE) */ - - if ((ctx->flags & EVP_MD_CTX_FLAG_FINALISE) == 0) { - /* try dup */ -+#ifndef FIPS_MODULE - dctx = EVP_PKEY_CTX_dup(pctx); - if (dctx != NULL) - pctx = dctx; -@@ -733,8 +749,10 @@ int EVP_DigestVerifyFinal(EVP_MD_CTX *ct - ctx->flags |= EVP_MD_CTX_FLAG_FINALISED; - else - EVP_PKEY_CTX_free(dctx); -+#endif /* !defined(FIPS_MODULE) */ - return r; - -+#ifndef FIPS_MODULE - legacy: - if (pctx == NULL || pctx->pmeth == NULL) { - ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR); -diff -up openssl-3.2.0/crypto/evp/m_sigver.c.digest-sign-patch openssl-3.2.0/crypto/evp/m_sigver.c ---- openssl-3.2.0/crypto/evp/m_sigver.c.digest-sign-patch 2024-01-04 12:39:26.858137284 +0100 -+++ openssl-3.2.0/crypto/evp/m_sigver.c 2024-01-04 12:40:28.201680446 +0100 -@@ -736,9 +736,9 @@ int EVP_DigestVerifyFinal(EVP_MD_CTX *ct - goto legacy; - #endif /* !defined(FIPS_MODULE) */ - -+#ifndef FIPS_MODULE - if ((ctx->flags & EVP_MD_CTX_FLAG_FINALISE) == 0) { - /* try dup */ --#ifndef FIPS_MODULE - dctx = EVP_PKEY_CTX_dup(pctx); - if (dctx != NULL) - pctx = dctx; -diff -up openssl-3.2.0/crypto/evp/m_sigver.c.digest-sign-patch openssl-3.2.0/crypto/evp/m_sigver.c ---- openssl-3.2.0/crypto/evp/m_sigver.c.digest-sign-patch 2024-01-04 12:55:41.172653897 +0100 -+++ openssl-3.2.0/crypto/evp/m_sigver.c 2024-01-04 12:56:23.562017396 +0100 -@@ -584,9 +584,9 @@ int EVP_DigestSignFinal(EVP_MD_CTX *ctx, - goto legacy; - #endif /* !defined(FIPS_MODULE) */ - -+#ifndef FIPS_MODULE - if (sigret != NULL && (ctx->flags & EVP_MD_CTX_FLAG_FINALISE) == 0) { - /* try dup */ --#ifndef FIPS_MODULE - dctx = EVP_PKEY_CTX_dup(pctx); - if (dctx != NULL) - pctx = dctx; -diff -up openssl-3.2.0/crypto/evp/m_sigver.c.fips-new openssl-3.2.0/crypto/evp/m_sigver.c ---- openssl-3.2.0/crypto/evp/m_sigver.c.fips-new 2024-01-30 23:50:10.115710238 +0100 -+++ openssl-3.2.0/crypto/evp/m_sigver.c 2024-01-31 00:04:31.448164500 +0100 -@@ -598,7 +598,11 @@ int EVP_DigestSignFinal(EVP_MD_CTX *ctx, - ctx->flags |= EVP_MD_CTX_FLAG_FINALISED; - else - EVP_PKEY_CTX_free(dctx); -+ return r; - #endif /* !defined(FIPS_MODULE) */ -+ r = pctx->op.sig.signature->digest_sign_final(pctx->op.sig.algctx, -+ sigret, siglen, -+ sigret == NULL ? 0 : *siglen); - return r; - - #ifndef FIPS_MODULE -@@ -749,7 +753,10 @@ int EVP_DigestVerifyFinal(EVP_MD_CTX *ct - ctx->flags |= EVP_MD_CTX_FLAG_FINALISED; - else - EVP_PKEY_CTX_free(dctx); -+ return r; - #endif /* !defined(FIPS_MODULE) */ -+ r = pctx->op.sig.signature->digest_verify_final(pctx->op.sig.algctx, -+ sig, siglen); - return r; - - #ifndef FIPS_MODULE -diff -up openssl-3.2.0/crypto/evp/m_sigver.c.fix-ifdef openssl-3.2.0/crypto/evp/m_sigver.c ---- openssl-3.2.0/crypto/evp/m_sigver.c.fix-ifdef 2024-02-01 09:23:07.877696442 +0100 -+++ openssl-3.2.0/crypto/evp/m_sigver.c 2024-02-01 09:25:30.857169997 +0100 -@@ -599,11 +599,12 @@ int EVP_DigestSignFinal(EVP_MD_CTX *ctx, - else - EVP_PKEY_CTX_free(dctx); - return r; --#endif /* !defined(FIPS_MODULE) */ -+#else - r = pctx->op.sig.signature->digest_sign_final(pctx->op.sig.algctx, - sigret, siglen, - sigret == NULL ? 0 : *siglen); - return r; -+#endif /* !defined(FIPS_MODULE) */ - - #ifndef FIPS_MODULE - legacy: -@@ -754,10 +755,11 @@ int EVP_DigestVerifyFinal(EVP_MD_CTX *ct - else - EVP_PKEY_CTX_free(dctx); - return r; --#endif /* !defined(FIPS_MODULE) */ -+#else - r = pctx->op.sig.signature->digest_verify_final(pctx->op.sig.algctx, - sig, siglen); - return r; -+#endif /* !defined(FIPS_MODULE) */ - - #ifndef FIPS_MODULE - legacy: diff --git a/0076-FIPS-140-3-DRBG.patch b/0076-FIPS-140-3-DRBG.patch index 42899c3..92495f8 100644 --- a/0076-FIPS-140-3-DRBG.patch +++ b/0076-FIPS-140-3-DRBG.patch @@ -1,27 +1,27 @@ -From 89c00cc67b9b34bc94f9dc3a9fce9374bbaade03 Mon Sep 17 00:00:00 2001 +From 0329eb6523363705946887d4f145dd77c741ae4a Mon Sep 17 00:00:00 2001 From: rpm-build <rpm-build> -Date: Mon, 31 Jul 2023 09:41:29 +0200 -Subject: [PATCH 32/48] 0076-FIPS-140-3-DRBG.patch +Date: Wed, 6 Mar 2024 19:17:16 +0100 +Subject: [PATCH 30/49] 0076-FIPS-140-3-DRBG.patch Patch-name: 0076-FIPS-140-3-DRBG.patch Patch-id: 76 Patch-status: | - # Downstream only. Reseed DRBG using getrandom(GRND_RANDOM) - # https://bugzilla.redhat.com/show_bug.cgi?id=2102541 -From-dist-git-commit: 9409bc7044cf4b5773639cce20f51399888c45fd + # # Downstream only. Reseed DRBG using getrandom(GRND_RANDOM) + # # https://bugzilla.redhat.com/show_bug.cgi?id=2102541 +From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce --- crypto/rand/prov_seed.c | 9 ++- providers/implementations/rands/crngt.c | 6 +- - providers/implementations/rands/drbg.c | 11 +++- + providers/implementations/rands/drbg.c | 11 ++- providers/implementations/rands/drbg_local.h | 2 +- - .../implementations/rands/seeding/rand_unix.c | 64 ++----------------- - 5 files changed, 28 insertions(+), 64 deletions(-) + .../implementations/rands/seeding/rand_unix.c | 68 ++----------------- + 5 files changed, 28 insertions(+), 68 deletions(-) diff --git a/crypto/rand/prov_seed.c b/crypto/rand/prov_seed.c -index 96c499c957..61c4cd8779 100644 +index 2985c7f2d8..3202a28226 100644 --- a/crypto/rand/prov_seed.c +++ b/crypto/rand/prov_seed.c -@@ -20,7 +20,14 @@ size_t ossl_rand_get_entropy(ossl_unused const OSSL_CORE_HANDLE *handle, +@@ -23,7 +23,14 @@ size_t ossl_rand_get_entropy(ossl_unused OSSL_LIB_CTX *ctx, size_t entropy_available; RAND_POOL *pool; @@ -55,10 +55,10 @@ index fa4a2db14a..1f13fc759e 100644 bytes_needed = min_len; if (bytes_needed > max_len) diff --git a/providers/implementations/rands/drbg.c b/providers/implementations/rands/drbg.c -index ea55363bf8..1b2410b3db 100644 +index 1586288692..e6de65a23d 100644 --- a/providers/implementations/rands/drbg.c +++ b/providers/implementations/rands/drbg.c -@@ -570,6 +570,9 @@ int ossl_prov_drbg_reseed(PROV_DRBG *drbg, int prediction_resistance, +@@ -564,6 +564,9 @@ static int ossl_prov_drbg_reseed_unlocked(PROV_DRBG *drbg, #endif } @@ -68,7 +68,7 @@ index ea55363bf8..1b2410b3db 100644 /* Reseed using our sources in addition */ entropylen = get_entropy(drbg, &entropy, drbg->strength, drbg->min_entropylen, drbg->max_entropylen, -@@ -662,8 +665,14 @@ int ossl_prov_drbg_generate(PROV_DRBG *drbg, unsigned char *out, size_t outlen, +@@ -685,8 +688,14 @@ int ossl_prov_drbg_generate(PROV_DRBG *drbg, unsigned char *out, size_t outlen, reseed_required = 1; } if (drbg->parent != NULL @@ -85,7 +85,7 @@ index ea55363bf8..1b2410b3db 100644 if (reseed_required || prediction_resistance) { if (!ossl_prov_drbg_reseed_unlocked(drbg, prediction_resistance, NULL, diff --git a/providers/implementations/rands/drbg_local.h b/providers/implementations/rands/drbg_local.h -index 3b5417b43b..d27c50950b 100644 +index 50f98a0b61..53d99c8c84 100644 --- a/providers/implementations/rands/drbg_local.h +++ b/providers/implementations/rands/drbg_local.h @@ -38,7 +38,7 @@ @@ -98,7 +98,7 @@ index 3b5417b43b..d27c50950b 100644 /* * Maximum input size for the DRBG (entropy, nonce, personalization string) diff --git a/providers/implementations/rands/seeding/rand_unix.c b/providers/implementations/rands/seeding/rand_unix.c -index cd02a0236d..98c917b6d8 100644 +index 9a936d800d..61d720efa9 100644 --- a/providers/implementations/rands/seeding/rand_unix.c +++ b/providers/implementations/rands/seeding/rand_unix.c @@ -48,6 +48,8 @@ @@ -110,10 +110,7 @@ index cd02a0236d..98c917b6d8 100644 static uint64_t get_time_stamp(void); -diff -up openssl-3.2.0/providers/implementations/rands/seeding/rand_unix.c.rand-patch openssl-3.2.0/providers/implementations/rands/seeding/rand_unix.c ---- openssl-3.2.0/providers/implementations/rands/seeding/rand_unix.c.rand-patch 2024-01-02 11:52:21.837712036 +0100 -+++ openssl-3.2.0/providers/implementations/rands/seeding/rand_unix.c 2024-01-02 11:54:40.576083169 +0100 -@@ -339,70 +339,8 @@ static ssize_t syscall_random(void *buf, +@@ -339,70 +341,8 @@ static ssize_t syscall_random(void *buf, size_t buflen) * which is way below the OSSL_SSIZE_MAX limit. Therefore sign conversion * between size_t and ssize_t is safe even without a range check. */ @@ -186,3 +183,6 @@ diff -up openssl-3.2.0/providers/implementations/rands/seeding/rand_unix.c.rand- } # endif /* defined(OPENSSL_RAND_SEED_GETRANDOM) */ +-- +2.44.0 + diff --git a/0078-Add-FIPS-indicator-parameter-to-HKDF.patch b/0078-Add-FIPS-indicator-parameter-to-HKDF.patch index f2bb087..3867e06 100644 --- a/0078-Add-FIPS-indicator-parameter-to-HKDF.patch +++ b/0078-Add-FIPS-indicator-parameter-to-HKDF.patch @@ -1,13 +1,13 @@ -From 2000eaead63732669283e6b54c8ef02e268eaeb8 Mon Sep 17 00:00:00 2001 +From c503fa302490f76f191af6259e4199572280298a Mon Sep 17 00:00:00 2001 From: rpm-build <rpm-build> -Date: Mon, 31 Jul 2023 09:41:29 +0200 -Subject: [PATCH 34/48] 0078-Add-FIPS-indicator-parameter-to-HKDF.patch +Date: Wed, 6 Mar 2024 19:17:16 +0100 +Subject: [PATCH 32/49] 0078-Add-FIPS-indicator-parameter-to-HKDF.patch Patch-name: 0078-Add-FIPS-indicator-parameter-to-HKDF.patch Patch-id: 78 Patch-status: | - # https://bugzilla.redhat.com/show_bug.cgi?id=2114772 -From-dist-git-commit: 9409bc7044cf4b5773639cce20f51399888c45fd + # # https://bugzilla.redhat.com/show_bug.cgi?id=2114772 +From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce --- include/crypto/evp.h | 7 ++ include/openssl/kdf.h | 4 + @@ -17,13 +17,14 @@ From-dist-git-commit: 9409bc7044cf4b5773639cce20f51399888c45fd providers/implementations/kdfs/sskdf.c | 100 +++++++++++++++++++++- providers/implementations/kdfs/tls1_prf.c | 74 +++++++++++++++- providers/implementations/kdfs/x942kdf.c | 66 +++++++++++++- + util/perl/OpenSSL/paramnames.pm | 1 + 9 files changed, 487 insertions(+), 22 deletions(-) diff --git a/include/crypto/evp.h b/include/crypto/evp.h -index dbbdcccbda..aa07153441 100644 +index 34cea2f9f4..1e4895959b 100644 --- a/include/crypto/evp.h +++ b/include/crypto/evp.h -@@ -219,6 +219,13 @@ struct evp_mac_st { +@@ -228,6 +228,13 @@ struct evp_mac_st { OSSL_FUNC_mac_set_ctx_params_fn *set_ctx_params; }; @@ -53,10 +54,10 @@ index 0983230a48..86171635ea 100644 #define EVP_KDF_SSHKDF_TYPE_INITIAL_IV_SRV_TO_CLI 66 #define EVP_KDF_SSHKDF_TYPE_ENCRYPTION_KEY_CLI_TO_SRV 67 diff --git a/providers/implementations/kdfs/hkdf.c b/providers/implementations/kdfs/hkdf.c -index 5304baa6c9..f9c77f4236 100644 +index 78425fbb42..0ff3433074 100644 --- a/providers/implementations/kdfs/hkdf.c +++ b/providers/implementations/kdfs/hkdf.c -@@ -43,6 +43,7 @@ static OSSL_FUNC_kdf_settable_ctx_params_fn kdf_hkdf_settable_ctx_params; +@@ -44,6 +44,7 @@ static OSSL_FUNC_kdf_settable_ctx_params_fn kdf_hkdf_settable_ctx_params; static OSSL_FUNC_kdf_set_ctx_params_fn kdf_hkdf_set_ctx_params; static OSSL_FUNC_kdf_gettable_ctx_params_fn kdf_hkdf_gettable_ctx_params; static OSSL_FUNC_kdf_get_ctx_params_fn kdf_hkdf_get_ctx_params; @@ -64,7 +65,7 @@ index 5304baa6c9..f9c77f4236 100644 static OSSL_FUNC_kdf_derive_fn kdf_tls1_3_derive; static OSSL_FUNC_kdf_settable_ctx_params_fn kdf_tls1_3_settable_ctx_params; static OSSL_FUNC_kdf_set_ctx_params_fn kdf_tls1_3_set_ctx_params; -@@ -86,6 +87,10 @@ typedef struct { +@@ -87,6 +88,10 @@ typedef struct { size_t data_len; unsigned char *info; size_t info_len; @@ -75,7 +76,7 @@ index 5304baa6c9..f9c77f4236 100644 } KDF_HKDF; static void *kdf_hkdf_new(void *provctx) -@@ -201,6 +206,11 @@ static int kdf_hkdf_derive(void *vctx, unsigned char *key, size_t keylen, +@@ -200,6 +205,11 @@ static int kdf_hkdf_derive(void *vctx, unsigned char *key, size_t keylen, return 0; } @@ -87,7 +88,7 @@ index 5304baa6c9..f9c77f4236 100644 switch (ctx->mode) { case EVP_KDF_HKDF_MODE_EXTRACT_AND_EXPAND: default: -@@ -363,15 +373,78 @@ static int kdf_hkdf_get_ctx_params(void *vctx, OSSL_PARAM params[]) +@@ -308,15 +318,78 @@ static int kdf_hkdf_get_ctx_params(void *vctx, OSSL_PARAM params[]) { KDF_HKDF *ctx = (KDF_HKDF *)vctx; OSSL_PARAM *p; @@ -100,10 +101,8 @@ index 5304baa6c9..f9c77f4236 100644 + any_valid = 1; + + if (sz == 0 || !OSSL_PARAM_set_size_t(p, sz)) - return 0; -- return OSSL_PARAM_set_size_t(p, sz); - } -- return -2; ++ return 0; ++ } + +#ifdef FIPS_MODULE + if ((p = OSSL_PARAM_locate(params, OSSL_KDF_PARAM_REDHAT_FIPS_INDICATOR)) @@ -158,8 +157,10 @@ index 5304baa6c9..f9c77f4236 100644 + } + } + if (!OSSL_PARAM_set_int(p, fips_indicator)) -+ return 0; -+ } + return 0; +- return OSSL_PARAM_set_size_t(p, sz); + } +- return -2; +#endif /* defined(FIPS_MODULE) */ + + if (!any_valid) @@ -169,7 +170,7 @@ index 5304baa6c9..f9c77f4236 100644 } static const OSSL_PARAM *kdf_hkdf_gettable_ctx_params(ossl_unused void *ctx, -@@ -379,6 +452,9 @@ static const OSSL_PARAM *kdf_hkdf_gettable_ctx_params(ossl_unused void *ctx, +@@ -324,6 +397,9 @@ static const OSSL_PARAM *kdf_hkdf_gettable_ctx_params(ossl_unused void *ctx, { static const OSSL_PARAM known_gettable_ctx_params[] = { OSSL_PARAM_size_t(OSSL_KDF_PARAM_SIZE, NULL), @@ -179,7 +180,7 @@ index 5304baa6c9..f9c77f4236 100644 OSSL_PARAM_END }; return known_gettable_ctx_params; -@@ -709,6 +785,17 @@ static int prov_tls13_hkdf_generate_secret(OSSL_LIB_CTX *libctx, +@@ -654,6 +730,17 @@ static int prov_tls13_hkdf_generate_secret(OSSL_LIB_CTX *libctx, return ret; } @@ -197,7 +198,7 @@ index 5304baa6c9..f9c77f4236 100644 static int kdf_tls1_3_derive(void *vctx, unsigned char *key, size_t keylen, const OSSL_PARAM params[]) { -@@ -724,6 +811,11 @@ static int kdf_tls1_3_derive(void *vctx, unsigned char *key, size_t keylen, +@@ -669,6 +756,11 @@ static int kdf_tls1_3_derive(void *vctx, unsigned char *key, size_t keylen, return 0; } @@ -209,7 +210,7 @@ index 5304baa6c9..f9c77f4236 100644 switch (ctx->mode) { default: return 0; -@@ -801,7 +893,7 @@ static const OSSL_PARAM *kdf_tls1_3_settable_ctx_params(ossl_unused void *ctx, +@@ -746,7 +838,7 @@ static const OSSL_PARAM *kdf_tls1_3_settable_ctx_params(ossl_unused void *ctx, } const OSSL_DISPATCH ossl_kdf_tls1_3_kdf_functions[] = { @@ -219,10 +220,10 @@ index 5304baa6c9..f9c77f4236 100644 { OSSL_FUNC_KDF_FREECTX, (void(*)(void))kdf_hkdf_free }, { OSSL_FUNC_KDF_RESET, (void(*)(void))kdf_hkdf_reset }, diff --git a/providers/implementations/kdfs/kbkdf.c b/providers/implementations/kdfs/kbkdf.c -index aa3df15bc7..3f82710061 100644 +index e6855d5732..ebd9d648a6 100644 --- a/providers/implementations/kdfs/kbkdf.c +++ b/providers/implementations/kdfs/kbkdf.c -@@ -59,6 +59,9 @@ typedef struct { +@@ -60,6 +60,9 @@ typedef struct { kbkdf_mode mode; EVP_MAC_CTX *ctx_init; @@ -232,7 +233,7 @@ index aa3df15bc7..3f82710061 100644 /* Names are lowercased versions of those found in SP800-108. */ int r; unsigned char *ki; -@@ -72,6 +75,9 @@ typedef struct { +@@ -73,6 +76,9 @@ typedef struct { int use_l; int is_kmac; int use_separator; @@ -242,7 +243,7 @@ index aa3df15bc7..3f82710061 100644 } KBKDF; /* Definitions needed for typechecking. */ -@@ -143,6 +149,7 @@ static void kbkdf_reset(void *vctx) +@@ -142,6 +148,7 @@ static void kbkdf_reset(void *vctx) void *provctx = ctx->provctx; EVP_MAC_CTX_free(ctx->ctx_init); @@ -250,7 +251,7 @@ index aa3df15bc7..3f82710061 100644 OPENSSL_clear_free(ctx->context, ctx->context_len); OPENSSL_clear_free(ctx->label, ctx->label_len); OPENSSL_clear_free(ctx->ki, ctx->ki_len); -@@ -308,6 +315,11 @@ static int kbkdf_derive(void *vctx, unsigned char *key, size_t keylen, +@@ -307,6 +314,11 @@ static int kbkdf_derive(void *vctx, unsigned char *key, size_t keylen, goto done; } @@ -262,7 +263,7 @@ index aa3df15bc7..3f82710061 100644 h = EVP_MAC_CTX_get_mac_size(ctx->ctx_init); if (h == 0) goto done; -@@ -381,6 +393,9 @@ static int kbkdf_set_ctx_params(void *vctx, const OSSL_PARAM params[]) +@@ -369,6 +381,9 @@ static int kbkdf_set_ctx_params(void *vctx, const OSSL_PARAM params[]) } } @@ -272,7 +273,7 @@ index aa3df15bc7..3f82710061 100644 p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_MODE); if (p != NULL && OPENSSL_strncasecmp("counter", p->data, p->data_size) == 0) { -@@ -461,20 +476,77 @@ static const OSSL_PARAM *kbkdf_settable_ctx_params(ossl_unused void *ctx, +@@ -450,20 +465,77 @@ static const OSSL_PARAM *kbkdf_settable_ctx_params(ossl_unused void *ctx, static int kbkdf_get_ctx_params(void *vctx, OSSL_PARAM params[]) { OSSL_PARAM *p; @@ -356,7 +357,7 @@ index aa3df15bc7..3f82710061 100644 } diff --git a/providers/implementations/kdfs/sshkdf.c b/providers/implementations/kdfs/sshkdf.c -index 1afac4e477..389b82b714 100644 +index 90986bc762..27cd7f8bdf 100644 --- a/providers/implementations/kdfs/sshkdf.c +++ b/providers/implementations/kdfs/sshkdf.c @@ -49,6 +49,9 @@ typedef struct { @@ -369,7 +370,7 @@ index 1afac4e477..389b82b714 100644 } KDF_SSHKDF; static void *kdf_sshkdf_new(void *provctx) -@@ -151,6 +154,12 @@ static int kdf_sshkdf_derive(void *vctx, unsigned char *key, size_t keylen, +@@ -149,6 +152,12 @@ static int kdf_sshkdf_derive(void *vctx, unsigned char *key, size_t keylen, ERR_raise(ERR_LIB_PROV, PROV_R_MISSING_TYPE); return 0; } @@ -382,7 +383,7 @@ index 1afac4e477..389b82b714 100644 return SSHKDF(md, ctx->key, ctx->key_len, ctx->xcghash, ctx->xcghash_len, ctx->session_id, ctx->session_id_len, -@@ -219,10 +228,67 @@ static const OSSL_PARAM *kdf_sshkdf_settable_ctx_params(ossl_unused void *ctx, +@@ -217,10 +226,67 @@ static const OSSL_PARAM *kdf_sshkdf_settable_ctx_params(ossl_unused void *ctx, static int kdf_sshkdf_get_ctx_params(void *vctx, OSSL_PARAM params[]) { OSSL_PARAM *p; @@ -453,7 +454,7 @@ index 1afac4e477..389b82b714 100644 } static const OSSL_PARAM *kdf_sshkdf_gettable_ctx_params(ossl_unused void *ctx, -@@ -230,6 +296,9 @@ static const OSSL_PARAM *kdf_sshkdf_gettable_ctx_params(ossl_unused void *ctx, +@@ -228,6 +294,9 @@ static const OSSL_PARAM *kdf_sshkdf_gettable_ctx_params(ossl_unused void *ctx, { static const OSSL_PARAM known_gettable_ctx_params[] = { OSSL_PARAM_size_t(OSSL_KDF_PARAM_SIZE, NULL), @@ -464,10 +465,10 @@ index 1afac4e477..389b82b714 100644 }; return known_gettable_ctx_params; diff --git a/providers/implementations/kdfs/sskdf.c b/providers/implementations/kdfs/sskdf.c -index ecb98de6fd..98fcc583d8 100644 +index db750a4f23..175fd30327 100644 --- a/providers/implementations/kdfs/sskdf.c +++ b/providers/implementations/kdfs/sskdf.c -@@ -63,6 +63,10 @@ typedef struct { +@@ -64,6 +64,10 @@ typedef struct { size_t salt_len; size_t out_len; /* optional KMAC parameter */ int is_kmac; @@ -478,7 +479,7 @@ index ecb98de6fd..98fcc583d8 100644 } KDF_SSKDF; #define SSKDF_MAX_INLEN (1<<30) -@@ -73,6 +77,7 @@ typedef struct { +@@ -74,6 +78,7 @@ typedef struct { static const unsigned char kmac_custom_str[] = { 0x4B, 0x44, 0x46 }; static OSSL_FUNC_kdf_newctx_fn sskdf_new; @@ -503,7 +504,7 @@ index ecb98de6fd..98fcc583d8 100644 static void sskdf_reset(void *vctx) { KDF_SSKDF *ctx = (KDF_SSKDF *)vctx; -@@ -392,6 +407,11 @@ static int sskdf_derive(void *vctx, unsigned char *key, size_t keylen, +@@ -382,6 +397,11 @@ static int sskdf_derive(void *vctx, unsigned char *key, size_t keylen, } md = ossl_prov_digest_md(&ctx->digest); @@ -515,7 +516,7 @@ index ecb98de6fd..98fcc583d8 100644 if (ctx->macctx != NULL) { /* H(x) = KMAC or H(x) = HMAC */ int ret; -@@ -473,6 +493,11 @@ static int x963kdf_derive(void *vctx, unsigned char *key, size_t keylen, +@@ -461,6 +481,11 @@ static int x963kdf_derive(void *vctx, unsigned char *key, size_t keylen, return 0; } @@ -527,7 +528,7 @@ index ecb98de6fd..98fcc583d8 100644 return SSKDF_hash_kdm(md, ctx->secret, ctx->secret_len, ctx->info, ctx->info_len, 1, key, keylen); } -@@ -545,10 +570,74 @@ static int sskdf_get_ctx_params(void *vctx, OSSL_PARAM params[]) +@@ -537,10 +562,74 @@ static int sskdf_get_ctx_params(void *vctx, OSSL_PARAM params[]) { KDF_SSKDF *ctx = (KDF_SSKDF *)vctx; OSSL_PARAM *p; @@ -605,7 +606,7 @@ index ecb98de6fd..98fcc583d8 100644 } static const OSSL_PARAM *sskdf_gettable_ctx_params(ossl_unused void *ctx, -@@ -556,6 +645,9 @@ static const OSSL_PARAM *sskdf_gettable_ctx_params(ossl_unused void *ctx, +@@ -548,6 +637,9 @@ static const OSSL_PARAM *sskdf_gettable_ctx_params(ossl_unused void *ctx, { static const OSSL_PARAM known_gettable_ctx_params[] = { OSSL_PARAM_size_t(OSSL_KDF_PARAM_SIZE, NULL), @@ -615,7 +616,7 @@ index ecb98de6fd..98fcc583d8 100644 OSSL_PARAM_END }; return known_gettable_ctx_params; -@@ -577,7 +669,7 @@ const OSSL_DISPATCH ossl_kdf_sskdf_functions[] = { +@@ -569,7 +661,7 @@ const OSSL_DISPATCH ossl_kdf_sskdf_functions[] = { }; const OSSL_DISPATCH ossl_kdf_x963_kdf_functions[] = { @@ -625,7 +626,7 @@ index ecb98de6fd..98fcc583d8 100644 { OSSL_FUNC_KDF_FREECTX, (void(*)(void))sskdf_free }, { OSSL_FUNC_KDF_RESET, (void(*)(void))sskdf_reset }, diff --git a/providers/implementations/kdfs/tls1_prf.c b/providers/implementations/kdfs/tls1_prf.c -index 54124ad4cb..25a6c79a2e 100644 +index ff305579c3..e6f41020a4 100644 --- a/providers/implementations/kdfs/tls1_prf.c +++ b/providers/implementations/kdfs/tls1_prf.c @@ -104,6 +104,13 @@ typedef struct { @@ -642,7 +643,7 @@ index 54124ad4cb..25a6c79a2e 100644 } TLS1_PRF; static void *kdf_tls1_prf_new(void *provctx) -@@ -140,6 +147,7 @@ static void kdf_tls1_prf_reset(void *vctx) +@@ -137,6 +144,7 @@ static void kdf_tls1_prf_reset(void *vctx) EVP_MAC_CTX_free(ctx->P_sha1); OPENSSL_clear_free(ctx->sec, ctx->seclen); OPENSSL_cleanse(ctx->seed, ctx->seedlen); @@ -650,7 +651,7 @@ index 54124ad4cb..25a6c79a2e 100644 memset(ctx, 0, sizeof(*ctx)); ctx->provctx = provctx; } -@@ -194,6 +202,10 @@ static int kdf_tls1_prf_derive(void *vctx, unsigned char *key, size_t keylen, +@@ -191,6 +199,10 @@ static int kdf_tls1_prf_derive(void *vctx, unsigned char *key, size_t keylen, ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH); return 0; } @@ -661,7 +662,7 @@ index 54124ad4cb..25a6c79a2e 100644 /* * The seed buffer is prepended with a label. -@@ -243,6 +255,9 @@ static int kdf_tls1_prf_set_ctx_params(void *vctx, const OSSL_PARAM params[]) +@@ -240,6 +252,9 @@ static int kdf_tls1_prf_set_ctx_params(void *vctx, const OSSL_PARAM params[]) } } @@ -671,7 +672,7 @@ index 54124ad4cb..25a6c79a2e 100644 if ((p = OSSL_PARAM_locate_const(params, OSSL_KDF_PARAM_SECRET)) != NULL) { OPENSSL_clear_free(ctx->sec, ctx->seclen); ctx->sec = NULL; -@@ -284,10 +299,60 @@ static const OSSL_PARAM *kdf_tls1_prf_settable_ctx_params( +@@ -281,10 +296,60 @@ static const OSSL_PARAM *kdf_tls1_prf_settable_ctx_params( static int kdf_tls1_prf_get_ctx_params(void *vctx, OSSL_PARAM params[]) { OSSL_PARAM *p; @@ -735,7 +736,7 @@ index 54124ad4cb..25a6c79a2e 100644 } static const OSSL_PARAM *kdf_tls1_prf_gettable_ctx_params( -@@ -295,6 +360,9 @@ static const OSSL_PARAM *kdf_tls1_prf_gettable_ctx_params( +@@ -292,6 +357,9 @@ static const OSSL_PARAM *kdf_tls1_prf_gettable_ctx_params( { static const OSSL_PARAM known_gettable_ctx_params[] = { OSSL_PARAM_size_t(OSSL_KDF_PARAM_SIZE, NULL), @@ -746,7 +747,7 @@ index 54124ad4cb..25a6c79a2e 100644 }; return known_gettable_ctx_params; diff --git a/providers/implementations/kdfs/x942kdf.c b/providers/implementations/kdfs/x942kdf.c -index 4c274fe27a..5ce23c8eb9 100644 +index 19b54493ef..77a6210184 100644 --- a/providers/implementations/kdfs/x942kdf.c +++ b/providers/implementations/kdfs/x942kdf.c @@ -13,11 +13,13 @@ @@ -773,7 +774,7 @@ index 4c274fe27a..5ce23c8eb9 100644 } KDF_X942; /* -@@ -497,6 +502,10 @@ static int x942kdf_derive(void *vctx, unsigned char *key, size_t keylen, +@@ -495,6 +500,10 @@ static int x942kdf_derive(void *vctx, unsigned char *key, size_t keylen, ERR_raise(ERR_LIB_PROV, PROV_R_BAD_ENCODING); return 0; } @@ -784,7 +785,7 @@ index 4c274fe27a..5ce23c8eb9 100644 ret = x942kdf_hash_kdm(md, ctx->secret, ctx->secret_len, der, der_len, ctr, key, keylen); OPENSSL_free(der); -@@ -600,10 +609,58 @@ static int x942kdf_get_ctx_params(void *vctx, OSSL_PARAM params[]) +@@ -598,10 +607,58 @@ static int x942kdf_get_ctx_params(void *vctx, OSSL_PARAM params[]) { KDF_X942 *ctx = (KDF_X942 *)vctx; OSSL_PARAM *p; @@ -846,7 +847,7 @@ index 4c274fe27a..5ce23c8eb9 100644 } static const OSSL_PARAM *x942kdf_gettable_ctx_params(ossl_unused void *ctx, -@@ -611,6 +668,9 @@ static const OSSL_PARAM *x942kdf_gettable_ctx_params(ossl_unused void *ctx, +@@ -609,6 +666,9 @@ static const OSSL_PARAM *x942kdf_gettable_ctx_params(ossl_unused void *ctx, { static const OSSL_PARAM known_gettable_ctx_params[] = { OSSL_PARAM_size_t(OSSL_KDF_PARAM_SIZE, NULL), @@ -856,12 +857,10 @@ index 4c274fe27a..5ce23c8eb9 100644 OSSL_PARAM_END }; return known_gettable_ctx_params; --- -2.41.0 - -diff -up openssl-3.2.0/util/perl/OpenSSL/paramnames.pm.fips-indicators-patch openssl-3.2.0/util/perl/OpenSSL/paramnames.pm ---- openssl-3.2.0/util/perl/OpenSSL/paramnames.pm.fips-indicators-patch 2024-01-02 12:11:36.633033731 +0100 -+++ openssl-3.2.0/util/perl/OpenSSL/paramnames.pm 2024-01-02 12:12:54.022901822 +0100 +diff --git a/util/perl/OpenSSL/paramnames.pm b/util/perl/OpenSSL/paramnames.pm +index 70f7c50fe4..6618122417 100644 +--- a/util/perl/OpenSSL/paramnames.pm ++++ b/util/perl/OpenSSL/paramnames.pm @@ -183,6 +183,7 @@ my %params = ( 'KDF_PARAM_X942_SUPP_PUBINFO' => "supp-pubinfo", 'KDF_PARAM_X942_SUPP_PRIVINFO' => "supp-privinfo", @@ -870,3 +869,6 @@ diff -up openssl-3.2.0/util/perl/OpenSSL/paramnames.pm.fips-indicators-patch ope 'KDF_PARAM_HMACDRBG_ENTROPY' => "entropy", 'KDF_PARAM_HMACDRBG_NONCE' => "nonce", 'KDF_PARAM_THREADS' => "threads", # uint32_t +-- +2.44.0 + diff --git a/0083-hmac-Add-explicit-FIPS-indicator-for-key-length.patch b/0083-hmac-Add-explicit-FIPS-indicator-for-key-length.patch index 68953fb..1a5ddb7 100644 --- a/0083-hmac-Add-explicit-FIPS-indicator-for-key-length.patch +++ b/0083-hmac-Add-explicit-FIPS-indicator-for-key-length.patch @@ -1,22 +1,27 @@ -From 8e388e194e665286a8996d7d5926bab5c1a6b4f9 Mon Sep 17 00:00:00 2001 -From: Dmitry Belyavskiy <dbelyavs(a)redhat.com> -Date: Mon, 21 Aug 2023 15:46:40 +0200 -Subject: [PATCH 38/48] +From a061dba4f6bb52b647aa8f411d32f0c8898a9cb2 Mon Sep 17 00:00:00 2001 +From: rpm-build <rpm-build> +Date: Wed, 6 Mar 2024 19:17:17 +0100 +Subject: [PATCH 35/49] 0083-hmac-Add-explicit-FIPS-indicator-for-key-length.patch Patch-name: 0083-hmac-Add-explicit-FIPS-indicator-for-key-length.patch Patch-id: 83 +Patch-status: | + # [PATCH 37/46] + # 0083-hmac-Add-explicit-FIPS-indicator-for-key-length.patch +From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce --- include/crypto/evp.h | 7 +++++++ include/openssl/evp.h | 3 +++ providers/implementations/macs/hmac_prov.c | 17 +++++++++++++++++ - 4 files changed, 28 insertions(+) + util/perl/OpenSSL/paramnames.pm | 13 +++++++------ + 4 files changed, 34 insertions(+), 6 deletions(-) diff --git a/include/crypto/evp.h b/include/crypto/evp.h -index aa07153441..a13127bd59 100644 +index 1e4895959b..5a2b324762 100644 --- a/include/crypto/evp.h +++ b/include/crypto/evp.h -@@ -196,6 +196,13 @@ const EVP_PKEY_METHOD *ossl_ed448_pkey_method(void); +@@ -206,6 +206,13 @@ const EVP_PKEY_METHOD *ossl_ed448_pkey_method(void); const EVP_PKEY_METHOD *ossl_rsa_pkey_method(void); const EVP_PKEY_METHOD *ossl_rsa_pss_pkey_method(void); @@ -31,10 +36,10 @@ index aa07153441..a13127bd59 100644 OSSL_PROVIDER *prov; int name_id; diff --git a/include/openssl/evp.h b/include/openssl/evp.h -index 86f4e22c70..615857caf5 100644 +index ea7620d631..48d5886d1e 100644 --- a/include/openssl/evp.h +++ b/include/openssl/evp.h -@@ -1194,6 +1194,9 @@ void EVP_MD_do_all_provided(OSSL_LIB_CTX *libctx, +@@ -1199,6 +1199,9 @@ void EVP_MD_do_all_provided(OSSL_LIB_CTX *libctx, void *arg); /* MAC stuff */ @@ -45,7 +50,7 @@ index 86f4e22c70..615857caf5 100644 EVP_MAC *EVP_MAC_fetch(OSSL_LIB_CTX *libctx, const char *algorithm, const char *properties); diff --git a/providers/implementations/macs/hmac_prov.c b/providers/implementations/macs/hmac_prov.c -index 52ebb08b8f..cf5c3ecbe7 100644 +index a1f3c2db84..f65215f532 100644 --- a/providers/implementations/macs/hmac_prov.c +++ b/providers/implementations/macs/hmac_prov.c @@ -21,6 +21,8 @@ @@ -55,9 +60,9 @@ index 52ebb08b8f..cf5c3ecbe7 100644 +#include "crypto/evp.h" + #include "internal/ssl3_cbc.h" - + #include "prov/implementations.h" -@@ -244,6 +246,9 @@ static int hmac_final(void *vmacctx, unsigned char *out, size_t *outl, +@@ -235,6 +237,9 @@ static int hmac_final(void *vmacctx, unsigned char *out, size_t *outl, static const OSSL_PARAM known_gettable_ctx_params[] = { OSSL_PARAM_size_t(OSSL_MAC_PARAM_SIZE, NULL), OSSL_PARAM_size_t(OSSL_MAC_PARAM_BLOCK_SIZE, NULL), @@ -67,7 +72,7 @@ index 52ebb08b8f..cf5c3ecbe7 100644 OSSL_PARAM_END }; static const OSSL_PARAM *hmac_gettable_ctx_params(ossl_unused void *ctx, -@@ -265,6 +270,18 @@ static int hmac_get_ctx_params(void *vmacctx, OSSL_PARAM params[]) +@@ -256,6 +261,18 @@ static int hmac_get_ctx_params(void *vmacctx, OSSL_PARAM params[]) && !OSSL_PARAM_set_int(p, hmac_block_size(macctx))) return 0; @@ -86,12 +91,10 @@ index 52ebb08b8f..cf5c3ecbe7 100644 return 1; } --- -2.41.0 - -diff -up openssl-3.2.0/util/perl/OpenSSL/paramnames.pm.hmac-patch openssl-3.2.0/util/perl/OpenSSL/paramnames.pm ---- openssl-3.2.0/util/perl/OpenSSL/paramnames.pm.hmac-patch 2024-01-02 12:18:16.909596613 +0100 -+++ openssl-3.2.0/util/perl/OpenSSL/paramnames.pm 2024-01-02 12:20:18.465886160 +0100 +diff --git a/util/perl/OpenSSL/paramnames.pm b/util/perl/OpenSSL/paramnames.pm +index 6618122417..8b2d430f17 100644 +--- a/util/perl/OpenSSL/paramnames.pm ++++ b/util/perl/OpenSSL/paramnames.pm @@ -137,12 +137,13 @@ my %params = ( # If "engine",or "properties",are specified, they should always be paired # with "cipher",or "digest". @@ -112,3 +115,6 @@ diff -up openssl-3.2.0/util/perl/OpenSSL/paramnames.pm.hmac-patch openssl-3.2.0/ # KDF / PRF parameters 'KDF_PARAM_SECRET' => "secret", # octet string +-- +2.44.0 + diff --git a/0088-signature-Add-indicator-for-PSS-salt-length.patch b/0088-signature-Add-indicator-for-PSS-salt-length.patch index 9cef315..63dc019 100644 --- a/0088-signature-Add-indicator-for-PSS-salt-length.patch +++ b/0088-signature-Add-indicator-for-PSS-salt-length.patch @@ -1,20 +1,24 @@ -From 98ee6faef3da1439c04f11cd2796132d27d1e607 Mon Sep 17 00:00:00 2001 -From: Dmitry Belyavskiy <dbelyavs(a)redhat.com> -Date: Mon, 21 Aug 2023 15:58:07 +0200 -Subject: [PATCH 41/48] 0088-signature-Add-indicator-for-PSS-salt-length.patch +From 9134fadd6544be82f96e3d5ce9c1f489de6a1745 Mon Sep 17 00:00:00 2001 +From: rpm-build <rpm-build> +Date: Wed, 6 Mar 2024 19:17:17 +0100 +Subject: [PATCH 38/49] 0088-signature-Add-indicator-for-PSS-salt-length.patch Patch-name: 0088-signature-Add-indicator-for-PSS-salt-length.patch Patch-id: 88 +Patch-status: | + # 0088-signature-Add-indicator-for-PSS-salt-length.patch +From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce --- include/openssl/evp.h | 4 ++++ - providers/implementations/signature/rsa_sig.c | 21 +++++++++++++++++++ - 3 files changed, 26 insertions(+) + providers/implementations/signature/rsa_sig.c | 21 +++++++++++++++++ + util/perl/OpenSSL/paramnames.pm | 23 ++++++++++--------- + 3 files changed, 37 insertions(+), 11 deletions(-) diff --git a/include/openssl/evp.h b/include/openssl/evp.h -index 615857caf5..05f2d0f75a 100644 +index 48d5886d1e..e3fa4a8043 100644 --- a/include/openssl/evp.h +++ b/include/openssl/evp.h -@@ -799,6 +799,10 @@ __owur int EVP_CipherFinal(EVP_CIPHER_CTX *ctx, unsigned char *outm, +@@ -804,6 +804,10 @@ __owur int EVP_CipherFinal(EVP_CIPHER_CTX *ctx, unsigned char *outm, __owur int EVP_CipherFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *outm, int *outl); @@ -26,10 +30,10 @@ index 615857caf5..05f2d0f75a 100644 EVP_PKEY *pkey); __owur int EVP_SignFinal_ex(EVP_MD_CTX *ctx, unsigned char *md, unsigned int *s, diff --git a/providers/implementations/signature/rsa_sig.c b/providers/implementations/signature/rsa_sig.c -index cfaa4841cb..851671cfb1 100644 +index b0f32f0b57..1e56d673ee 100644 --- a/providers/implementations/signature/rsa_sig.c +++ b/providers/implementations/signature/rsa_sig.c -@@ -1173,6 +1173,24 @@ static int rsa_get_ctx_params(void *vprsactx, OSSL_PARAM *params) +@@ -1169,6 +1169,24 @@ static int rsa_get_ctx_params(void *vprsactx, OSSL_PARAM *params) } } @@ -54,7 +58,7 @@ index cfaa4841cb..851671cfb1 100644 return 1; } -@@ -1182,6 +1200,9 @@ static const OSSL_PARAM known_gettable_ctx_params[] = { +@@ -1178,6 +1196,9 @@ static const OSSL_PARAM known_gettable_ctx_params[] = { OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_DIGEST, NULL, 0), OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_MGF1_DIGEST, NULL, 0), OSSL_PARAM_utf8_string(OSSL_SIGNATURE_PARAM_PSS_SALTLEN, NULL, 0), @@ -64,12 +68,10 @@ index cfaa4841cb..851671cfb1 100644 OSSL_PARAM_END }; --- -2.41.0 - -diff -up openssl-3.2.0/util/perl/OpenSSL/paramnames.pm.salt-patch openssl-3.2.0/util/perl/OpenSSL/paramnames.pm ---- openssl-3.2.0/util/perl/OpenSSL/paramnames.pm.salt-patch 2024-01-02 12:23:57.106998142 +0100 -+++ openssl-3.2.0/util/perl/OpenSSL/paramnames.pm 2024-01-02 12:26:29.687472015 +0100 +diff --git a/util/perl/OpenSSL/paramnames.pm b/util/perl/OpenSSL/paramnames.pm +index 8b2d430f17..a109e44521 100644 +--- a/util/perl/OpenSSL/paramnames.pm ++++ b/util/perl/OpenSSL/paramnames.pm @@ -377,17 +377,18 @@ my %params = ( 'EXCHANGE_PARAM_KDF_UKM' => "kdf-ukm", @@ -100,3 +102,6 @@ diff -up openssl-3.2.0/util/perl/OpenSSL/paramnames.pm.salt-patch openssl-3.2.0/ # Asym cipher parameters 'ASYM_CIPHER_PARAM_DIGEST' => '*PKEY_PARAM_DIGEST', +-- +2.44.0 + diff --git a/0110-GCM-Implement-explicit-FIPS-indicator-for-IV-gen.patch b/0110-GCM-Implement-explicit-FIPS-indicator-for-IV-gen.patch index fcd53e6..9a65e22 100644 --- a/0110-GCM-Implement-explicit-FIPS-indicator-for-IV-gen.patch +++ b/0110-GCM-Implement-explicit-FIPS-indicator-for-IV-gen.patch @@ -1,22 +1,27 @@ -From 5db03a4d024f1e396ff54d38ac70d9890b034074 Mon Sep 17 00:00:00 2001 -From: Dmitry Belyavskiy <dbelyavs(a)redhat.com> -Date: Mon, 21 Aug 2023 16:10:11 +0200 -Subject: [PATCH 45/48] +From bfe2412d6d41c8d2299bf40e24f23d4abcfb68e9 Mon Sep 17 00:00:00 2001 +From: rpm-build <rpm-build> +Date: Wed, 6 Mar 2024 19:17:17 +0100 +Subject: [PATCH 41/49] 0110-GCM-Implement-explicit-FIPS-indicator-for-IV-gen.patch Patch-name: 0110-GCM-Implement-explicit-FIPS-indicator-for-IV-gen.patch Patch-id: 110 +Patch-status: | + # [PATCH 43/46] + # 0110-GCM-Implement-explicit-FIPS-indicator-for-IV-gen.patch +From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce --- include/openssl/evp.h | 4 +++ .../implementations/ciphers/ciphercommon.c | 4 +++ .../ciphers/ciphercommon_gcm.c | 25 +++++++++++++++++++ - 4 files changed, 34 insertions(+) + util/perl/OpenSSL/paramnames.pm | 5 ++-- + 4 files changed, 36 insertions(+), 2 deletions(-) diff --git a/include/openssl/evp.h b/include/openssl/evp.h -index 05f2d0f75a..f1a33ff6f2 100644 +index e3fa4a8043..dc42140932 100644 --- a/include/openssl/evp.h +++ b/include/openssl/evp.h -@@ -748,6 +748,10 @@ void EVP_CIPHER_CTX_set_flags(EVP_CIPHER_CTX *ctx, int flags); +@@ -753,6 +753,10 @@ void EVP_CIPHER_CTX_set_flags(EVP_CIPHER_CTX *ctx, int flags); void EVP_CIPHER_CTX_clear_flags(EVP_CIPHER_CTX *ctx, int flags); int EVP_CIPHER_CTX_test_flags(const EVP_CIPHER_CTX *ctx, int flags); @@ -28,10 +33,10 @@ index 05f2d0f75a..f1a33ff6f2 100644 const unsigned char *key, const unsigned char *iv); __owur int EVP_EncryptInit_ex(EVP_CIPHER_CTX *ctx, diff --git a/providers/implementations/ciphers/ciphercommon.c b/providers/implementations/ciphers/ciphercommon.c -index fa383165d8..716add7339 100644 +index db81af5401..ae66521827 100644 --- a/providers/implementations/ciphers/ciphercommon.c +++ b/providers/implementations/ciphers/ciphercommon.c -@@ -149,6 +149,10 @@ static const OSSL_PARAM cipher_aead_known_gettable_ctx_params[] = { +@@ -152,6 +152,10 @@ static const OSSL_PARAM cipher_aead_known_gettable_ctx_params[] = { OSSL_PARAM_octet_string(OSSL_CIPHER_PARAM_AEAD_TAG, NULL, 0), OSSL_PARAM_size_t(OSSL_CIPHER_PARAM_AEAD_TLS1_AAD_PAD, NULL), OSSL_PARAM_octet_string(OSSL_CIPHER_PARAM_AEAD_TLS1_GET_IV_GEN, NULL, 0), @@ -43,10 +48,10 @@ index fa383165d8..716add7339 100644 }; const OSSL_PARAM *ossl_cipher_aead_gettable_ctx_params( diff --git a/providers/implementations/ciphers/ciphercommon_gcm.c b/providers/implementations/ciphers/ciphercommon_gcm.c -index ed95c97ff4..db7910eb0e 100644 +index fe24b450a5..b39d8d562c 100644 --- a/providers/implementations/ciphers/ciphercommon_gcm.c +++ b/providers/implementations/ciphers/ciphercommon_gcm.c -@@ -224,6 +224,31 @@ int ossl_gcm_get_ctx_params(void *vctx, OSSL_PARAM params[]) +@@ -238,6 +238,31 @@ int ossl_gcm_get_ctx_params(void *vctx, OSSL_PARAM params[]) break; } } @@ -78,12 +83,10 @@ index ed95c97ff4..db7910eb0e 100644 return 1; } --- -2.41.0 - -diff -up openssl-3.2.0/util/perl/OpenSSL/paramnames.pm.ivgen-patch openssl-3.2.0/util/perl/OpenSSL/paramnames.pm ---- openssl-3.2.0/util/perl/OpenSSL/paramnames.pm.ivgen-patch 2024-01-02 12:29:45.119433637 +0100 -+++ openssl-3.2.0/util/perl/OpenSSL/paramnames.pm 2024-01-02 12:33:09.146723045 +0100 +diff --git a/util/perl/OpenSSL/paramnames.pm b/util/perl/OpenSSL/paramnames.pm +index a109e44521..64e9809387 100644 +--- a/util/perl/OpenSSL/paramnames.pm ++++ b/util/perl/OpenSSL/paramnames.pm @@ -101,8 +101,9 @@ my %params = ( 'CIPHER_PARAM_SPEED' => "speed", # uint 'CIPHER_PARAM_CTS_MODE' => "cts_mode", # utf8_string @@ -96,3 +99,6 @@ diff -up openssl-3.2.0/util/perl/OpenSSL/paramnames.pm.ivgen-patch openssl-3.2.0 'CIPHER_PARAM_TLS1_MULTIBLOCK_MAX_SEND_FRAGMENT' => "tls1multi_maxsndfrag",# uint 'CIPHER_PARAM_TLS1_MULTIBLOCK_MAX_BUFSIZE' => "tls1multi_maxbufsz", # size_t +-- +2.44.0 + diff --git a/0113-asymciphers-kem-Add-explicit-FIPS-indicator.patch b/0113-asymciphers-kem-Add-explicit-FIPS-indicator.patch index 7a2e1f3..fd073bd 100644 --- a/0113-asymciphers-kem-Add-explicit-FIPS-indicator.patch +++ b/0113-asymciphers-kem-Add-explicit-FIPS-indicator.patch @@ -1,22 +1,25 @@ -From 136988155862ce2b45683ef8045e7a8cdd11e215 Mon Sep 17 00:00:00 2001 -From: Dmitry Belyavskiy <dbelyavs(a)redhat.com> -Date: Mon, 21 Aug 2023 16:13:46 +0200 -Subject: [PATCH 47/48] 0113-asymciphers-kem-Add-explicit-FIPS-indicator.patch +From 72a137b3f51ef8aeb2747bbc102ea5c98b6daa05 Mon Sep 17 00:00:00 2001 +From: rpm-build <rpm-build> +Date: Wed, 6 Mar 2024 19:17:17 +0100 +Subject: [PATCH 43/49] 0113-asymciphers-kem-Add-explicit-FIPS-indicator.patch Patch-name: 0113-asymciphers-kem-Add-explicit-FIPS-indicator.patch Patch-id: 113 +Patch-status: | + # 0113-asymciphers-kem-Add-explicit-FIPS-indicator.patch +From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce --- - include/openssl/core_names.h | 2 ++ include/openssl/evp.h | 4 +++ .../implementations/asymciphers/rsa_enc.c | 22 ++++++++++++++ providers/implementations/kem/rsa_kem.c | 30 ++++++++++++++++++- - 4 files changed, 57 insertions(+), 1 deletion(-) + util/perl/OpenSSL/paramnames.pm | 6 ++-- + 4 files changed, 59 insertions(+), 3 deletions(-) diff --git a/include/openssl/evp.h b/include/openssl/evp.h -index f1a33ff6f2..dadbf46a5a 100644 +index dc42140932..3a6345d71e 100644 --- a/include/openssl/evp.h +++ b/include/openssl/evp.h -@@ -1767,6 +1767,10 @@ OSSL_DEPRECATEDIN_3_0 size_t EVP_PKEY_meth_get_count(void); +@@ -1772,6 +1772,10 @@ OSSL_DEPRECATEDIN_3_0 size_t EVP_PKEY_meth_get_count(void); OSSL_DEPRECATEDIN_3_0 const EVP_PKEY_METHOD *EVP_PKEY_meth_get0(size_t idx); # endif @@ -28,10 +31,10 @@ index f1a33ff6f2..dadbf46a5a 100644 const char *properties); int EVP_KEYMGMT_up_ref(EVP_KEYMGMT *keymgmt); diff --git a/providers/implementations/asymciphers/rsa_enc.c b/providers/implementations/asymciphers/rsa_enc.c -index d169bfd396..bd4dcb4e27 100644 +index f3443b0c66..b2c239c03b 100644 --- a/providers/implementations/asymciphers/rsa_enc.c +++ b/providers/implementations/asymciphers/rsa_enc.c -@@ -466,6 +466,27 @@ static int rsa_get_ctx_params(void *vprsactx, OSSL_PARAM *params) +@@ -462,6 +462,27 @@ static int rsa_get_ctx_params(void *vprsactx, OSSL_PARAM *params) if (p != NULL && !OSSL_PARAM_set_uint(p, prsactx->implicit_rejection)) return 0; @@ -59,7 +62,7 @@ index d169bfd396..bd4dcb4e27 100644 return 1; } -@@ -480,6 +501,7 @@ static const OSSL_PARAM known_gettable_ctx_params[] = { +@@ -475,6 +496,7 @@ static const OSSL_PARAM known_gettable_ctx_params[] = { OSSL_PARAM_uint(OSSL_ASYM_CIPHER_PARAM_TLS_NEGOTIATED_VERSION, NULL), #ifdef FIPS_MODULE OSSL_PARAM_octet_string(OSSL_ASYM_CIPHER_PARAM_REDHAT_KAT_OEAP_SEED, NULL, 0), @@ -68,7 +71,7 @@ index d169bfd396..bd4dcb4e27 100644 OSSL_PARAM_uint(OSSL_ASYM_CIPHER_PARAM_IMPLICIT_REJECTION, NULL), OSSL_PARAM_END diff --git a/providers/implementations/kem/rsa_kem.c b/providers/implementations/kem/rsa_kem.c -index 8a6f585d0b..f4b7415074 100644 +index 0824c6bdd6..2e637bdf30 100644 --- a/providers/implementations/kem/rsa_kem.c +++ b/providers/implementations/kem/rsa_kem.c @@ -152,11 +152,39 @@ static int rsakem_decapsulate_init(void *vprsactx, void *vrsa, @@ -112,12 +115,10 @@ index 8a6f585d0b..f4b7415074 100644 OSSL_PARAM_END }; --- -2.41.0 - -diff -up openssl-3.2.0/util/perl/OpenSSL/paramnames.pm.kem-patch openssl-3.2.0/util/perl/OpenSSL/paramnames.pm ---- openssl-3.2.0/util/perl/OpenSSL/paramnames.pm.kem-patch 2024-01-02 12:49:04.598756268 +0100 -+++ openssl-3.2.0/util/perl/OpenSSL/paramnames.pm 2024-01-02 12:53:16.466464414 +0100 +diff --git a/util/perl/OpenSSL/paramnames.pm b/util/perl/OpenSSL/paramnames.pm +index 64e9809387..45ab0c8dc4 100644 +--- a/util/perl/OpenSSL/paramnames.pm ++++ b/util/perl/OpenSSL/paramnames.pm @@ -406,6 +406,7 @@ my %params = ( 'ASYM_CIPHER_PARAM_TLS_NEGOTIATED_VERSION' => "tls-negotiated-version", 'ASYM_CIPHER_PARAM_IMPLICIT_REJECTION' => "implicit-rejection", @@ -138,3 +139,6 @@ diff -up openssl-3.2.0/util/perl/OpenSSL/paramnames.pm.kem-patch openssl-3.2.0/u # Capabilities +-- +2.44.0 + diff --git a/0115-skip-quic-pairwise.patch b/0115-skip-quic-pairwise.patch index 9a35acd..0d96f4d 100644 --- a/0115-skip-quic-pairwise.patch +++ b/0115-skip-quic-pairwise.patch @@ -1,50 +1,86 @@ -diff -up openssl-3.2.0/test/recipes/30-test_pairwise_fail.t.skip-test openssl-3.2.0/test/recipes/30-test_pairwise_fail.t ---- openssl-3.2.0/test/recipes/30-test_pairwise_fail.t.skip-test 2024-02-01 16:09:31.250757364 +0100 -+++ openssl-3.2.0/test/recipes/30-test_pairwise_fail.t 2024-02-01 16:09:43.243887179 +0100 -@@ -22,7 +22,7 @@ use lib bldtop_dir('.'); - plan skip_all => "These tests are unsupported in a non fips build" - if disabled("fips"); +From ec8e4e25cc5e5c67313c5fd6af94fa248685c3d1 Mon Sep 17 00:00:00 2001 +From: Dmitry Belyavskiy <dbelyavs(a)redhat.com> +Date: Thu, 7 Mar 2024 17:37:09 +0100 +Subject: [PATCH 45/49] 0115-skip-quic-pairwise.patch + +Patch-name: 0115-skip-quic-pairwise.patch +Patch-id: 115 +Patch-status: | + # skip quic and pairwise tests temporarily +--- + test/quicapitest.c | 4 +++- + test/recipes/01-test_symbol_presence.t | 1 + + test/recipes/30-test_pairwise_fail.t | 10 ++++++++-- + 3 files changed, 12 insertions(+), 3 deletions(-) + +diff --git a/test/quicapitest.c b/test/quicapitest.c +index 41cf0fc7a8..0fb7492700 100644 +--- a/test/quicapitest.c ++++ b/test/quicapitest.c +@@ -2139,7 +2139,9 @@ int setup_tests(void) + ADD_TEST(test_cipher_find); + ADD_TEST(test_version); + #if defined(DO_SSL_TRACE_TEST) +- ADD_TEST(test_ssl_trace); ++ if (is_fips == 0) { ++ ADD_TEST(test_ssl_trace); ++ } + #endif + ADD_TEST(test_quic_forbidden_apis_ctx); + ADD_TEST(test_quic_forbidden_apis); +diff --git a/test/recipes/01-test_symbol_presence.t b/test/recipes/01-test_symbol_presence.t +index 222b1886ae..7e2f65cccb 100644 +--- a/test/recipes/01-test_symbol_presence.t ++++ b/test/recipes/01-test_symbol_presence.t +@@ -185,6 +185,7 @@ foreach (sort keys %stlibname) { + } + } + my @duplicates = sort grep { $symbols{$_} > 1 } keys %symbols; ++@duplicates = grep {($_ ne "OPENSSL_ia32cap_P") && ($_ ne "EVP_CIPHER_CTX_dup") && ($_ ne "EVP_MD_CTX_dup") } @duplicates; + if (@duplicates) { + note "Duplicates:"; + note join('\n', @duplicates); +diff --git a/test/recipes/30-test_pairwise_fail.t b/test/recipes/30-test_pairwise_fail.t +index c837d48fb4..6291c08c49 100644 +--- a/test/recipes/30-test_pairwise_fail.t ++++ b/test/recipes/30-test_pairwise_fail.t +@@ -9,7 +9,7 @@ + use strict; + use warnings; --plan tests => 5; -+plan skip_all => 5; - my $provconf = srctop_file("test", "fips-and-base.cnf"); +-use OpenSSL::Test qw(:DEFAULT bldtop_dir srctop_file srctop_dir data_file); ++use OpenSSL::Test qw(:DEFAULT bldtop_dir srctop_file srctop_dir data_file with); + use OpenSSL::Test::Utils; - run(test(["fips_version_test", "-config", $provconf, ">=3.1.0"]), -diff -up openssl-3.2.0/test/recipes/75-test_quicapi.t.skip-test-quic openssl-3.2.0/test/recipes/75-test_quicapi.t ---- openssl-3.2.0/test/recipes/75-test_quicapi.t.skip-test-quic 2024-02-01 16:13:37.974733154 +0100 -+++ openssl-3.2.0/test/recipes/75-test_quicapi.t 2024-02-01 16:14:13.450183541 +0100 -@@ -25,7 +25,7 @@ plan skip_all => "QUIC protocol is not s - plan skip_all => "These tests are not supported in a fuzz build" - if config('options') =~ /-DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION|enable-fuzz-afl/; + BEGIN { +@@ -39,20 +39,26 @@ SKIP: { + SKIP: { + skip "Skip EC test because of no ec in this build", 2 + if disabled("ec"); ++ with({ exit_checker => sub {my $val = shift; return $val == 134; } }, ++ sub { + ok(run(test(["pairwise_fail_test", "-config", $provconf, + "-pairwise", "ec"])), + "fips provider ec keygen pairwise failure test"); ++ }); --plan tests => -+plan skip_all => - ($no_fips ? 0 : 1) # quicapitest with fips - + 1; # quicapitest with default provider + skip "FIPS provider version is too old", 1 + if !$fips_exit; ++ with({ exit_checker => sub {my $val = shift; return $val == 134; } }, ++ sub { + ok(run(test(["pairwise_fail_test", "-config", $provconf, + "-pairwise", "eckat"])), + "fips provider ec keygen kat failure test"); ++ }); + } -diff -up openssl-3.2.0/test/recipes/70-test_quic_record.t.disable-quic-record openssl-3.2.0/test/recipes/70-test_quic_record.t ---- openssl-3.2.0/test/recipes/70-test_quic_record.t.disable-quic-record 2024-02-06 13:25:09.081772272 +0100 -+++ openssl-3.2.0/test/recipes/70-test_quic_record.t 2024-02-06 13:25:47.469243950 +0100 -@@ -17,6 +17,6 @@ plan skip_all => "QUIC protocol is not s - plan skip_all => "These tests are not supported in a fuzz build" - if config('options') =~ /-DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION|enable-fuzz-afl/; - --plan tests => 1; -+plan skip_all => 1; - - ok(run(test(["quic_record_test"]))); -diff -up openssl-3.2.0/test/recipes/01-test_symbol_presence.t.skip-fail-686 openssl-3.2.0/test/recipes/01-test_symbol_presence.t ---- openssl-3.2.0/test/recipes/01-test_symbol_presence.t.skip-fail-686 2024-02-06 13:55:48.981028882 +0100 -+++ openssl-3.2.0/test/recipes/01-test_symbol_presence.t 2024-02-06 13:56:56.896819560 +0100 -@@ -53,8 +53,9 @@ my $testcount - $testcount - += (scalar keys %shlibpath) # Check for missing symbols in shared lib - unless disabled('shared'); -- --plan tests => $testcount; -+#Fix later, skipping this test as it fails in i686 due to duplicate -+#symbol OPENSSL_ia32cap_P -+plan skip_all => $testcount; - - ###################################################################### - # Collect symbols + SKIP: { + skip "Skip DSA tests because of no dsa in this build", 2 +- if disabled("dsa"); ++ if 1; #if disabled("dsa"); + ok(run(test(["pairwise_fail_test", "-config", $provconf, + "-pairwise", "dsa", "-dsaparam", data_file("dsaparam.pem")])), + "fips provider dsa keygen pairwise failure test"); +-- +2.44.0 + diff --git a/0116-version-aliasing.patch b/0116-version-aliasing.patch index 401252b..67d632d 100644 --- a/0116-version-aliasing.patch +++ b/0116-version-aliasing.patch @@ -1,37 +1,62 @@ -diff -up openssl-3.2.1/crypto/evp/digest.c.dup-patch openssl-3.2.1/crypto/evp/digest.c ---- openssl-3.2.1/crypto/evp/digest.c.dup-patch 2024-02-09 20:41:56.277567514 +0100 -+++ openssl-3.2.1/crypto/evp/digest.c 2024-02-09 20:42:59.317767764 +0100 -@@ -553,7 +554,10 @@ legacy: +From a2673b5e2e95bcf54a1746bfd409cca688275e75 Mon Sep 17 00:00:00 2001 +From: rpm-build <rpm-build> +Date: Wed, 6 Mar 2024 19:17:17 +0100 +Subject: [PATCH 46/49] 0116-version-aliasing.patch + +Patch-name: 0116-version-aliasing.patch +Patch-id: 116 +Patch-status: | + # Add version aliasing due to + # https://github.com/openssl/openssl/issues/23534 +From-dist-git-commit: 4334bc837fbc64d14890fdc51679a80770d498ce +--- + crypto/evp/digest.c | 7 ++++++- + crypto/evp/evp_enc.c | 7 ++++++- + test/recipes/01-test_symbol_presence.t | 1 + + util/libcrypto.num | 2 ++ + 4 files changed, 15 insertions(+), 2 deletions(-) + +diff --git a/crypto/evp/digest.c b/crypto/evp/digest.c +index 42331703da..3a280acc0e 100644 +--- a/crypto/evp/digest.c ++++ b/crypto/evp/digest.c +@@ -553,7 +553,12 @@ legacy: return ret; } -EVP_MD_CTX *EVP_MD_CTX_dup(const EVP_MD_CTX *in) +EVP_MD_CTX ++#if !defined(FIPS_MODULE) +__attribute__ ((symver ("EVP_MD_CTX_dup@@OPENSSL_3.1.0"), + symver ("EVP_MD_CTX_dup(a)OPENSSL_3.2.0"))) ++#endif +*EVP_MD_CTX_dup(const EVP_MD_CTX *in) { EVP_MD_CTX *out = EVP_MD_CTX_new(); -diff -up openssl-3.2.1/crypto/evp/evp_enc.c.dup-patch openssl-3.2.1/crypto/evp/evp_enc.c ---- openssl-3.2.1/crypto/evp/evp_enc.c.dup-patch 2024-02-09 18:47:04.054258303 +0100 -+++ openssl-3.2.1/crypto/evp/evp_enc.c 2024-02-09 20:43:00.926772711 +0100 -@@ -1444,7 +1445,10 @@ int EVP_CIPHER_CTX_rand_key(EVP_CIPHER_C +diff --git a/crypto/evp/evp_enc.c b/crypto/evp/evp_enc.c +index e9faf31057..5a29b8dbb7 100644 +--- a/crypto/evp/evp_enc.c ++++ b/crypto/evp/evp_enc.c +@@ -1444,7 +1444,12 @@ int EVP_CIPHER_CTX_rand_key(EVP_CIPHER_CTX *ctx, unsigned char *key) #endif /* FIPS_MODULE */ } -EVP_CIPHER_CTX *EVP_CIPHER_CTX_dup(const EVP_CIPHER_CTX *in) +EVP_CIPHER_CTX ++#if !defined(FIPS_MODULE) +__attribute__ ((symver ("EVP_CIPHER_CTX_dup@@OPENSSL_3.1.0"), + symver ("EVP_CIPHER_CTX_dup(a)OPENSSL_3.2.0"))) ++#endif +*EVP_CIPHER_CTX_dup(const EVP_CIPHER_CTX *in) { EVP_CIPHER_CTX *out = EVP_CIPHER_CTX_new(); -diff -up openssl-3.2.1/test/recipes/01-test_symbol_presence.t.dup-patch openssl-3.2.1/test/recipes/01-test_symbol_presence.t ---- openssl-3.2.1/test/recipes/01-test_symbol_presence.t.dup-patch 2024-02-09 20:44:10.860756724 +0100 -+++ openssl-3.2.1/test/recipes/01-test_symbol_presence.t 2024-02-09 20:45:14.981136289 +0100 -@@ -132,6 +132,7 @@ foreach (sort keys %stlibname) { +diff --git a/test/recipes/01-test_symbol_presence.t b/test/recipes/01-test_symbol_presence.t +index 7e2f65cccb..cc947d4821 100644 +--- a/test/recipes/01-test_symbol_presence.t ++++ b/test/recipes/01-test_symbol_presence.t +@@ -131,6 +131,7 @@ foreach (sort keys %stlibname) { s| .*||; # Drop OpenSSL dynamic version information if there is any s|\@\@.+$||; @@ -39,10 +64,11 @@ diff -up openssl-3.2.1/test/recipes/01-test_symbol_presence.t.dup-patch openssl- # Return the result $_ } -diff -up openssl-3.2.1/util/libcrypto.num.dup-patch openssl-3.2.1/util/libcrypto.num ---- openssl-3.2.1/util/libcrypto.num.dup-patch 2024-02-09 18:16:43.006553105 +0100 -+++ openssl-3.2.1/util/libcrypto.num 2024-02-09 18:19:17.554159687 +0100 -@@ -5435,7 +5435,9 @@ X509_PUBKEY_set0_public_key +diff --git a/util/libcrypto.num b/util/libcrypto.num +index 8046454025..068e9904e2 100644 +--- a/util/libcrypto.num ++++ b/util/libcrypto.num +@@ -5435,7 +5435,9 @@ X509_PUBKEY_set0_public_key 5562 3_2_0 EXIST::FUNCTION: OSSL_STACK_OF_X509_free 5563 3_2_0 EXIST::FUNCTION: OSSL_trace_string 5564 3_2_0 EXIST::FUNCTION: EVP_MD_CTX_dup 5565 3_2_0 EXIST::FUNCTION: @@ -52,31 +78,6 @@ diff -up openssl-3.2.1/util/libcrypto.num.dup-patch openssl-3.2.1/util/libcrypto BN_signed_bin2bn 5567 3_2_0 EXIST::FUNCTION: BN_signed_bn2bin 5568 3_2_0 EXIST::FUNCTION: BN_signed_lebin2bn 5569 3_2_0 EXIST::FUNCTION: -diff -up openssl-3.2.1/crypto/evp/evp_enc.c.fips-dup openssl-3.2.1/crypto/evp/evp_enc.c ---- openssl-3.2.1/crypto/evp/evp_enc.c.fips-dup 2024-02-09 21:03:46.662261648 +0100 -+++ openssl-3.2.1/crypto/evp/evp_enc.c 2024-02-09 21:04:33.427691451 +0100 -@@ -1445,8 +1445,10 @@ int EVP_CIPHER_CTX_rand_key(EVP_CIPHER_C - } - - EVP_CIPHER_CTX -+#if !defined(FIPS_MODULE) - __attribute__ ((symver ("EVP_CIPHER_CTX_dup@@OPENSSL_3.1.0"), - symver ("EVP_CIPHER_CTX_dup(a)OPENSSL_3.2.0"))) -+#endif - *EVP_CIPHER_CTX_dup(const EVP_CIPHER_CTX *in) - { - EVP_CIPHER_CTX *out = EVP_CIPHER_CTX_new(); -diff -up openssl-3.2.1/crypto/evp/digest.c.new-fips-dup openssl-3.2.1/crypto/evp/digest.c ---- openssl-3.2.1/crypto/evp/digest.c.new-fips-dup 2024-02-09 21:08:11.605474971 +0100 -+++ openssl-3.2.1/crypto/evp/digest.c 2024-02-09 21:08:47.095723742 +0100 -@@ -554,8 +554,10 @@ legacy: - } - - EVP_MD_CTX -+#if !defined(FIPS_MODULE) - __attribute__ ((symver ("EVP_MD_CTX_dup@@OPENSSL_3.1.0"), - symver ("EVP_MD_CTX_dup(a)OPENSSL_3.2.0"))) -+#endif - *EVP_MD_CTX_dup(const EVP_MD_CTX *in) - { - EVP_MD_CTX *out = EVP_MD_CTX_new(); +-- +2.44.0 + diff --git a/0117-ignore-unknown-sigalgorithms-groups.patch b/0117-ignore-unknown-sigalgorithms-groups.patch new file mode 100644 index 0000000..3c52277 --- /dev/null +++ b/0117-ignore-unknown-sigalgorithms-groups.patch @@ -0,0 +1,318 @@ +From 242c746690dd1d0e500fa554c60536877d77776d Mon Sep 17 00:00:00 2001 +From: Tomas Mraz <tomas(a)openssl.org> +Date: Thu, 14 Dec 2023 17:08:56 +0100 +Subject: [PATCH 47/49] 0117-ignore-unknown-sigalgorithms-groups.patch + +Patch-name: 0117-ignore-unknown-sigalgorithms-groups.patch +Patch-id: 117 +Patch-status: | + # https://github.com/openssl/openssl/issues/23050 +--- + CHANGES.md | 13 +++++++ + doc/man3/SSL_CTX_set1_curves.pod | 6 ++- + doc/man3/SSL_CTX_set1_sigalgs.pod | 11 +++++- + ssl/t1_lib.c | 56 +++++++++++++++++++++------- + test/sslapitest.c | 61 +++++++++++++++++++++++++++++++ + 5 files changed, 132 insertions(+), 15 deletions(-) + +diff --git a/CHANGES.md b/CHANGES.md +index ca29762ac2..4e21d0ddf9 100644 +--- a/CHANGES.md ++++ b/CHANGES.md +@@ -27,6 +27,19 @@ OpenSSL 3.2 + + ### Changes between 3.2.0 and 3.2.1 [30 Jan 2024] + ++ * Unknown entries in TLS SignatureAlgorithms, ClientSignatureAlgorithms ++ config options and the respective calls to SSL[_CTX]_set1_sigalgs() and ++ SSL[_CTX]_set1_client_sigalgs() that start with `?` character are ++ ignored and the configuration will still be used. ++ ++ Similarly unknown entries that start with `?` character in a TLS ++ Groups config option or set with SSL[_CTX]_set1_groups_list() are ignored ++ and the configuration will still be used. ++ ++ In both cases if the resulting list is empty, an error is returned. ++ ++ *Tomáš Mráz* ++ + * A file in PKCS12 format can contain certificates and keys and may come from + an untrusted source. The PKCS12 specification allows certain fields to be + NULL, but OpenSSL did not correctly check for this case. A fix has been +diff --git a/doc/man3/SSL_CTX_set1_curves.pod b/doc/man3/SSL_CTX_set1_curves.pod +index c26ef00306..f0566e148e 100644 +--- a/doc/man3/SSL_CTX_set1_curves.pod ++++ b/doc/man3/SSL_CTX_set1_curves.pod +@@ -58,7 +58,8 @@ string B<list>. The string is a colon separated list of group names, for example + are B<P-256>, B<P-384>, B<P-521>, B<X25519>, B<X448>, B<brainpoolP256r1tls13>, + B<brainpoolP384r1tls13>, B<brainpoolP512r1tls13>, B<ffdhe2048>, B<ffdhe3072>, + B<ffdhe4096>, B<ffdhe6144> and B<ffdhe8192>. Support for other groups may be +-added by external providers. ++added by external providers. If a group name is preceded with the C<?> ++character, it will be ignored if an implementation is missing. + + SSL_set1_groups() and SSL_set1_groups_list() are similar except they set + supported groups for the SSL structure B<ssl>. +@@ -142,6 +143,9 @@ The curve functions were added in OpenSSL 1.0.2. The equivalent group + functions were added in OpenSSL 1.1.1. The SSL_get_negotiated_group() function + was added in OpenSSL 3.0.0. + ++Support for ignoring unknown groups in SSL_CTX_set1_groups_list() and ++SSL_set1_groups_list() was added in OpenSSL 3.3. ++ + =head1 COPYRIGHT + + Copyright 2013-2022 The OpenSSL Project Authors. All Rights Reserved. +diff --git a/doc/man3/SSL_CTX_set1_sigalgs.pod b/doc/man3/SSL_CTX_set1_sigalgs.pod +index eb31006346..5b7de7d956 100644 +--- a/doc/man3/SSL_CTX_set1_sigalgs.pod ++++ b/doc/man3/SSL_CTX_set1_sigalgs.pod +@@ -33,7 +33,9 @@ signature algorithms for B<ctx> or B<ssl>. The B<str> parameter + must be a null terminated string consisting of a colon separated list of + elements, where each element is either a combination of a public key + algorithm and a digest separated by B<+>, or a TLS 1.3-style named +-SignatureScheme such as rsa_pss_pss_sha256. ++SignatureScheme such as rsa_pss_pss_sha256. If a list entry is preceded ++with the C<?> character, it will be ignored if an implementation is missing. ++ + + SSL_CTX_set1_client_sigalgs(), SSL_set1_client_sigalgs(), + SSL_CTX_set1_client_sigalgs_list() and SSL_set1_client_sigalgs_list() set +@@ -106,6 +108,13 @@ using a string: + L<ssl(7)>, L<SSL_get_shared_sigalgs(3)>, + L<SSL_CONF_CTX_new(3)> + ++=head1 HISTORY ++ ++Support for ignoring unknown signature algorithms in ++SSL_CTX_set1_sigalgs_list(), SSL_set1_sigalgs_list(), ++SSL_CTX_set1_client_sigalgs_list() and SSL_set1_client_sigalgs_list() ++was added in OpenSSL 3.3. ++ + =head1 COPYRIGHT + + Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved. +diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c +index 056aae3863..fe680449c5 100644 +--- a/ssl/t1_lib.c ++++ b/ssl/t1_lib.c +@@ -1052,9 +1052,15 @@ static int gid_cb(const char *elem, int len, void *arg) + size_t i; + uint16_t gid = 0; + char etmp[GROUP_NAME_BUFFER_LENGTH]; ++ int ignore_unknown = 0; + + if (elem == NULL) + return 0; ++ if (elem[0] == '?') { ++ ignore_unknown = 1; ++ ++elem; ++ --len; ++ } + if (garg->gidcnt == garg->gidmax) { + uint16_t *tmp = + OPENSSL_realloc(garg->gid_arr, garg->gidmax + GROUPLIST_INCREMENT); +@@ -1070,13 +1076,14 @@ static int gid_cb(const char *elem, int len, void *arg) + + gid = tls1_group_name2id(garg->ctx, etmp); + if (gid == 0) { +- ERR_raise_data(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT, +- "group '%s' cannot be set", etmp); +- return 0; ++ /* Unknown group - ignore, if ignore_unknown */ ++ return ignore_unknown; + } + for (i = 0; i < garg->gidcnt; i++) +- if (garg->gid_arr[i] == gid) +- return 0; ++ if (garg->gid_arr[i] == gid) { ++ /* Duplicate group - ignore */ ++ return 1; ++ } + garg->gid_arr[garg->gidcnt++] = gid; + return 1; + } +@@ -1097,6 +1104,11 @@ int tls1_set_groups_list(SSL_CTX *ctx, uint16_t **pext, size_t *pextlen, + gcb.ctx = ctx; + if (!CONF_parse_list(str, ':', 1, gid_cb, &gcb)) + goto end; ++ if (gcb.gidcnt == 0) { ++ ERR_raise_data(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT, ++ "No valid groups in '%s'", str); ++ goto end; ++ } + if (pext == NULL) { + ret = 1; + goto end; +@@ -2905,8 +2917,15 @@ static int sig_cb(const char *elem, int len, void *arg) + const SIGALG_LOOKUP *s; + char etmp[TLS_MAX_SIGSTRING_LEN], *p; + int sig_alg = NID_undef, hash_alg = NID_undef; ++ int ignore_unknown = 0; ++ + if (elem == NULL) + return 0; ++ if (elem[0] == '?') { ++ ignore_unknown = 1; ++ ++elem; ++ --len; ++ } + if (sarg->sigalgcnt == TLS_MAX_SIGALGCNT) + return 0; + if (len > (int)(sizeof(etmp) - 1)) +@@ -2931,8 +2950,10 @@ static int sig_cb(const char *elem, int len, void *arg) + break; + } + } +- if (i == OSSL_NELEM(sigalg_lookup_tbl)) +- return 0; ++ if (i == OSSL_NELEM(sigalg_lookup_tbl)) { ++ /* Ignore unknown algorithms if ignore_unknown */ ++ return ignore_unknown; ++ } + } else { + *p = 0; + p++; +@@ -2940,8 +2961,10 @@ static int sig_cb(const char *elem, int len, void *arg) + return 0; + get_sigorhash(&sig_alg, &hash_alg, etmp); + get_sigorhash(&sig_alg, &hash_alg, p); +- if (sig_alg == NID_undef || hash_alg == NID_undef) +- return 0; ++ if (sig_alg == NID_undef || hash_alg == NID_undef) { ++ /* Ignore unknown algorithms if ignore_unknown */ ++ return ignore_unknown; ++ } + for (i = 0, s = sigalg_lookup_tbl; i < OSSL_NELEM(sigalg_lookup_tbl); + i++, s++) { + if (s->hash == hash_alg && s->sig == sig_alg) { +@@ -2949,15 +2972,17 @@ static int sig_cb(const char *elem, int len, void *arg) + break; + } + } +- if (i == OSSL_NELEM(sigalg_lookup_tbl)) +- return 0; ++ if (i == OSSL_NELEM(sigalg_lookup_tbl)) { ++ /* Ignore unknown algorithms if ignore_unknown */ ++ return ignore_unknown; ++ } + } + +- /* Reject duplicates */ ++ /* Ignore duplicates */ + for (i = 0; i < sarg->sigalgcnt - 1; i++) { + if (sarg->sigalgs[i] == sarg->sigalgs[sarg->sigalgcnt - 1]) { + sarg->sigalgcnt--; +- return 0; ++ return 1; + } + } + return 1; +@@ -2973,6 +2998,11 @@ int tls1_set_sigalgs_list(CERT *c, const char *str, int client) + sig.sigalgcnt = 0; + if (!CONF_parse_list(str, ':', 1, sig_cb, &sig)) + return 0; ++ if (sig.sigalgcnt == 0) { ++ ERR_raise_data(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT, ++ "No valid signature algorithms in '%s'", str); ++ return 0; ++ } + if (c == NULL) + return 1; + return tls1_set_raw_sigalgs(c, sig.sigalgs, sig.sigalgcnt, client); +diff --git a/test/sslapitest.c b/test/sslapitest.c +index 1c14f93ed1..184a0f1055 100644 +--- a/test/sslapitest.c ++++ b/test/sslapitest.c +@@ -39,6 +39,7 @@ + #include "testutil.h" + #include "testutil/output.h" + #include "internal/nelem.h" ++#include "internal/tlsgroups.h" + #include "internal/ktls.h" + #include "../ssl/ssl_local.h" + #include "../ssl/record/methods/recmethod_local.h" +@@ -3147,6 +3148,7 @@ static const sigalgs_list testsigalgs[] = { + {validlist3, OSSL_NELEM(validlist3), NULL, 1, 0}, + # endif + {NULL, 0, "RSA+SHA256", 1, 1}, ++ {NULL, 0, "RSA+SHA256:?Invalid", 1, 1}, + # ifndef OPENSSL_NO_EC + {NULL, 0, "RSA+SHA256:ECDSA+SHA512", 1, 1}, + {NULL, 0, "ECDSA+SHA512", 1, 0}, +@@ -9276,6 +9278,64 @@ static int test_servername(int tst) + return testresult; + } + ++static int test_unknown_sigalgs_groups(void) ++{ ++ int ret = 0; ++ SSL_CTX *ctx = NULL; ++ ++ if (!TEST_ptr(ctx = SSL_CTX_new_ex(libctx, NULL, TLS_server_method()))) ++ goto end; ++ ++ if (!TEST_int_gt(SSL_CTX_set1_sigalgs_list(ctx, ++ "RSA+SHA256:?nonexistent:?RSA+SHA512"), ++ 0)) ++ goto end; ++ if (!TEST_size_t_eq(ctx->cert->conf_sigalgslen, 2) ++ || !TEST_int_eq(ctx->cert->conf_sigalgs[0], TLSEXT_SIGALG_rsa_pkcs1_sha256) ++ || !TEST_int_eq(ctx->cert->conf_sigalgs[1], TLSEXT_SIGALG_rsa_pkcs1_sha512)) ++ goto end; ++ ++ if (!TEST_int_gt(SSL_CTX_set1_client_sigalgs_list(ctx, ++ "RSA+SHA256:?nonexistent:?RSA+SHA512"), ++ 0)) ++ goto end; ++ if (!TEST_size_t_eq(ctx->cert->client_sigalgslen, 2) ++ || !TEST_int_eq(ctx->cert->client_sigalgs[0], TLSEXT_SIGALG_rsa_pkcs1_sha256) ++ || !TEST_int_eq(ctx->cert->client_sigalgs[1], TLSEXT_SIGALG_rsa_pkcs1_sha512)) ++ goto end; ++ ++ if (!TEST_int_le(SSL_CTX_set1_groups_list(ctx, ++ "nonexistent"), ++ 0)) ++ goto end; ++ ++ if (!TEST_int_le(SSL_CTX_set1_groups_list(ctx, ++ "?nonexistent1:?nonexistent2:?nonexistent3"), ++ 0)) ++ goto end; ++ ++#ifndef OPENSSL_NO_EC ++ if (!TEST_int_le(SSL_CTX_set1_groups_list(ctx, ++ "P-256:nonexistent"), ++ 0)) ++ goto end; ++ ++ if (!TEST_int_gt(SSL_CTX_set1_groups_list(ctx, ++ "P-384:?nonexistent:?P-521"), ++ 0)) ++ goto end; ++ if (!TEST_size_t_eq(ctx->ext.supportedgroups_len, 2) ++ || !TEST_int_eq(ctx->ext.supportedgroups[0], OSSL_TLS_GROUP_ID_secp384r1) ++ || !TEST_int_eq(ctx->ext.supportedgroups[1], OSSL_TLS_GROUP_ID_secp521r1)) ++ goto end; ++#endif ++ ++ ret = 1; ++ end: ++ SSL_CTX_free(ctx); ++ return ret; ++} ++ + #if !defined(OPENSSL_NO_EC) \ + && (!defined(OSSL_NO_USABLE_TLS1_3) || !defined(OPENSSL_NO_TLS1_2)) + /* +@@ -11519,6 +11579,7 @@ int setup_tests(void) + ADD_ALL_TESTS(test_multiblock_write, OSSL_NELEM(multiblock_cipherlist_data)); + #endif + ADD_ALL_TESTS(test_servername, 10); ++ ADD_TEST(test_unknown_sigalgs_groups); + #if !defined(OPENSSL_NO_EC) \ + && (!defined(OSSL_NO_USABLE_TLS1_3) || !defined(OPENSSL_NO_TLS1_2)) + ADD_ALL_TESTS(test_sigalgs_available, 6); +-- +2.44.0 + diff --git a/0118-no-crl-memleak.patch b/0118-no-crl-memleak.patch new file mode 100644 index 0000000..ee7e745 --- /dev/null +++ b/0118-no-crl-memleak.patch @@ -0,0 +1,80 @@ +From 105217c7d58c726f4e646177e0aaefb6115aad3e Mon Sep 17 00:00:00 2001 +From: Dmitry Belyavskiy <beldmit(a)gmail.com> +Date: Tue, 27 Feb 2024 15:22:58 +0100 +Subject: [PATCH 48/49] 0118-no-crl-memleak.patch + +Patch-name: 0118-no-crl-memleak.patch +Patch-id: 118 +Patch-status: | + # https://github.com/openssl/openssl/issues/23770 +--- + crypto/x509/by_file.c | 2 ++ + test/recipes/60-test_x509_load_cert_file.t | 3 ++- + test/x509_load_cert_file_test.c | 8 +++++++- + 3 files changed, 11 insertions(+), 2 deletions(-) + +diff --git a/crypto/x509/by_file.c b/crypto/x509/by_file.c +index 5073c137a2..85923804ac 100644 +--- a/crypto/x509/by_file.c ++++ b/crypto/x509/by_file.c +@@ -198,6 +198,8 @@ int X509_load_crl_file(X509_LOOKUP *ctx, const char *file, int type) + goto err; + } + count++; ++ X509_CRL_free(x); ++ x = NULL; + } + } else if (type == X509_FILETYPE_ASN1) { + x = d2i_X509_CRL_bio(in, NULL); +diff --git a/test/recipes/60-test_x509_load_cert_file.t b/test/recipes/60-test_x509_load_cert_file.t +index 75aeac362c..e329d7675c 100644 +--- a/test/recipes/60-test_x509_load_cert_file.t ++++ b/test/recipes/60-test_x509_load_cert_file.t +@@ -12,4 +12,5 @@ setup("test_load_cert_file"); + + plan tests => 1; + +-ok(run(test(["x509_load_cert_file_test", srctop_file("test", "certs", "leaf-chain.pem")]))); ++ok(run(test(["x509_load_cert_file_test", srctop_file("test", "certs", "leaf-chain.pem"), ++ srctop_file("test", "certs", "cyrillic_crl.pem")]))); +diff --git a/test/x509_load_cert_file_test.c b/test/x509_load_cert_file_test.c +index 4a736071ae..c07d329915 100644 +--- a/test/x509_load_cert_file_test.c ++++ b/test/x509_load_cert_file_test.c +@@ -12,6 +12,7 @@ + #include "testutil.h" + + static const char *chain; ++static const char *crl; + + static int test_load_cert_file(void) + { +@@ -27,12 +28,15 @@ static int test_load_cert_file(void) + && TEST_int_eq(sk_X509_num(certs), 4)) + ret = 1; + ++ if (crl != NULL && !TEST_true(X509_load_crl_file(lookup, crl, X509_FILETYPE_PEM))) ++ ret = 0; ++ + OSSL_STACK_OF_X509_free(certs); + X509_STORE_free(store); + return ret; + } + +-OPT_TEST_DECLARE_USAGE("cert.pem...\n") ++OPT_TEST_DECLARE_USAGE("cert.pem [crl.pem]\n") + + int setup_tests(void) + { +@@ -45,6 +49,8 @@ int setup_tests(void) + if (chain == NULL) + return 0; + ++ crl = test_get_argument(1); ++ + ADD_TEST(test_load_cert_file); + return 1; + } +-- +2.44.0 + diff --git a/0119-provider-sigalgs-in-signaturealgorithms-conf.patch b/0119-provider-sigalgs-in-signaturealgorithms-conf.patch new file mode 100644 index 0000000..c363223 --- /dev/null +++ b/0119-provider-sigalgs-in-signaturealgorithms-conf.patch @@ -0,0 +1,170 @@ +From f5b48604779362c91a22080b6905413fbba28b74 Mon Sep 17 00:00:00 2001 +From: Dmitry Belyavskiy <dbelyavs(a)redhat.com> +Date: Fri, 8 Mar 2024 11:18:12 +0100 +Subject: [PATCH 49/49] 0119-provider-sigalgs-in-signaturealgorithms-conf.patch + +Patch-name: 0119-provider-sigalgs-in-signaturealgorithms-conf.patch +Patch-id: 119 +Patch-status: | + # https://github.com/openssl/openssl/issues/22779 +--- + ssl/s3_lib.c | 8 ++++---- + ssl/ssl_lib.c | 2 +- + ssl/ssl_local.h | 2 +- + ssl/t1_lib.c | 45 ++++++++++++++++++++++++++++++++++----------- + 4 files changed, 40 insertions(+), 17 deletions(-) + +diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c +index e8ec98c221..48a1aa0e61 100644 +--- a/ssl/s3_lib.c ++++ b/ssl/s3_lib.c +@@ -3685,13 +3685,13 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg) + return tls1_set_sigalgs(sc->cert, parg, larg, 0); + + case SSL_CTRL_SET_SIGALGS_LIST: +- return tls1_set_sigalgs_list(sc->cert, parg, 0); ++ return tls1_set_sigalgs_list(s->ctx, sc->cert, parg, 0); + + case SSL_CTRL_SET_CLIENT_SIGALGS: + return tls1_set_sigalgs(sc->cert, parg, larg, 1); + + case SSL_CTRL_SET_CLIENT_SIGALGS_LIST: +- return tls1_set_sigalgs_list(sc->cert, parg, 1); ++ return tls1_set_sigalgs_list(s->ctx, sc->cert, parg, 1); + + case SSL_CTRL_GET_CLIENT_CERT_TYPES: + { +@@ -3968,13 +3968,13 @@ long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg) + return tls1_set_sigalgs(ctx->cert, parg, larg, 0); + + case SSL_CTRL_SET_SIGALGS_LIST: +- return tls1_set_sigalgs_list(ctx->cert, parg, 0); ++ return tls1_set_sigalgs_list(ctx, ctx->cert, parg, 0); + + case SSL_CTRL_SET_CLIENT_SIGALGS: + return tls1_set_sigalgs(ctx->cert, parg, larg, 1); + + case SSL_CTRL_SET_CLIENT_SIGALGS_LIST: +- return tls1_set_sigalgs_list(ctx->cert, parg, 1); ++ return tls1_set_sigalgs_list(ctx, ctx->cert, parg, 1); + + case SSL_CTRL_SET_CLIENT_CERT_TYPES: + return ssl3_set_req_cert_type(ctx->cert, parg, larg); +diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c +index 1329841aaf..4d95ab71cd 100644 +--- a/ssl/ssl_lib.c ++++ b/ssl/ssl_lib.c +@@ -3078,7 +3078,7 @@ long SSL_CTX_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg) + return tls1_set_groups_list(ctx, NULL, NULL, parg); + case SSL_CTRL_SET_SIGALGS_LIST: + case SSL_CTRL_SET_CLIENT_SIGALGS_LIST: +- return tls1_set_sigalgs_list(NULL, parg, 0); ++ return tls1_set_sigalgs_list(ctx, NULL, parg, 0); + default: + return 0; + } +diff --git a/ssl/ssl_local.h b/ssl/ssl_local.h +index 0d3acfbe66..a73b2c4770 100644 +--- a/ssl/ssl_local.h ++++ b/ssl/ssl_local.h +@@ -2796,7 +2796,7 @@ __owur int tls_use_ticket(SSL_CONNECTION *s); + + void ssl_set_sig_mask(uint32_t *pmask_a, SSL_CONNECTION *s, int op); + +-__owur int tls1_set_sigalgs_list(CERT *c, const char *str, int client); ++__owur int tls1_set_sigalgs_list(SSL_CTX *ctx, CERT *c, const char *str, int client); + __owur int tls1_set_raw_sigalgs(CERT *c, const uint16_t *psigs, size_t salglen, + int client); + __owur int tls1_set_sigalgs(CERT *c, const int *salg, size_t salglen, +diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c +index fe680449c5..87f2ae7000 100644 +--- a/ssl/t1_lib.c ++++ b/ssl/t1_lib.c +@@ -716,6 +716,7 @@ int ssl_load_sigalgs(SSL_CTX *ctx) + + /* now populate ctx->ssl_cert_info */ + if (ctx->sigalg_list_len > 0) { ++ OPENSSL_free(ctx->ssl_cert_info); + ctx->ssl_cert_info = OPENSSL_zalloc(sizeof(lu) * ctx->sigalg_list_len); + if (ctx->ssl_cert_info == NULL) + return 0; +@@ -2889,6 +2890,7 @@ typedef struct { + size_t sigalgcnt; + /* TLSEXT_SIGALG_XXX values */ + uint16_t sigalgs[TLS_MAX_SIGALGCNT]; ++ SSL_CTX *ctx; + } sig_cb_st; + + static void get_sigorhash(int *psig, int *phash, const char *str) +@@ -2913,7 +2915,8 @@ static void get_sigorhash(int *psig, int *phash, const char *str) + static int sig_cb(const char *elem, int len, void *arg) + { + sig_cb_st *sarg = arg; +- size_t i; ++ size_t i = 0; ++ int load_success = 0; + const SIGALG_LOOKUP *s; + char etmp[TLS_MAX_SIGSTRING_LEN], *p; + int sig_alg = NID_undef, hash_alg = NID_undef; +@@ -2943,17 +2946,36 @@ static int sig_cb(const char *elem, int len, void *arg) + * in the table. + */ + if (p == NULL) { +- for (i = 0, s = sigalg_lookup_tbl; i < OSSL_NELEM(sigalg_lookup_tbl); +- i++, s++) { +- if (s->name != NULL && strcmp(etmp, s->name) == 0) { +- sarg->sigalgs[sarg->sigalgcnt++] = s->sigalg; +- break; +- } ++ /* Load provider sigalgs */ ++ if (sarg->ctx) { ++ load_success = ssl_load_sigalgs(sarg->ctx); + } +- if (i == OSSL_NELEM(sigalg_lookup_tbl)) { +- /* Ignore unknown algorithms if ignore_unknown */ +- return ignore_unknown; ++ if (load_success) { ++ /* Check if a provider supports the sigalg */ ++ for (i = 0; i < sarg->ctx->sigalg_list_len; i++) { ++ if (sarg->ctx->sigalg_list[i].sigalg_name != NULL ++ && strcmp(etmp, ++ sarg->ctx->sigalg_list[i].sigalg_name) == 0) { ++ sarg->sigalgs[sarg->sigalgcnt++] = ++ sarg->ctx->sigalg_list[i].code_point; ++ break; ++ } ++ } + } ++ /* Check the built-in sigalgs */ ++ if (!sarg->ctx || !load_success || i == sarg->ctx->sigalg_list_len) { ++ for (i = 0, s = sigalg_lookup_tbl; ++ i < OSSL_NELEM(sigalg_lookup_tbl); i++, s++) { ++ if (s->name != NULL && strcmp(etmp, s->name) == 0) { ++ sarg->sigalgs[sarg->sigalgcnt++] = s->sigalg; ++ break; ++ } ++ } ++ if (i == OSSL_NELEM(sigalg_lookup_tbl)) { ++ /* Ignore unknown algorithms if ignore_unknown */ ++ return ignore_unknown; ++ } ++ } + } else { + *p = 0; + p++; +@@ -2992,10 +3014,11 @@ static int sig_cb(const char *elem, int len, void *arg) + * Set supported signature algorithms based on a colon separated list of the + * form sig+hash e.g. RSA+SHA512:DSA+SHA512 + */ +-int tls1_set_sigalgs_list(CERT *c, const char *str, int client) ++int tls1_set_sigalgs_list(SSL_CTX *ctx, CERT *c, const char *str, int client) + { + sig_cb_st sig; + sig.sigalgcnt = 0; ++ sig.ctx = ctx; + if (!CONF_parse_list(str, ':', 1, sig_cb, &sig)) + return 0; + if (sig.sigalgcnt == 0) { +-- +2.44.0 + diff --git a/openssl.spec b/openssl.spec index a70fa4b..69c44ed 100644 --- a/openssl.spec +++ b/openssl.spec @@ -29,7 +29,7 @@ print(string.sub(hash, 0, 16)) Summary: Utilities from the general purpose cryptography library with TLS implementation Name: openssl Version: 3.2.1 -Release: 2%{?dist} +Release: 3%{?dist} Epoch: 1 Source: openssl-%{version}.tar.gz Source2: Makefile.certificate @@ -40,88 +40,88 @@ Source7: renew-dummy-cert Source9: configuration-switch.h Source10: configuration-prefix.h Source14: 0025-for-tests.patch -# # Patches exported from source git -# # Aarch64 and ppc64le use lib64 +# Patches exported from source git +# Aarch64 and ppc64le use lib64 Patch1: 0001-Aarch64-and-ppc64le-use-lib64.patch -# # Use more general default values in openssl.cnf +# Use more general default values in openssl.cnf Patch2: 0002-Use-more-general-default-values-in-openssl.cnf.patch -# # Do not install html docs +# Do not install html docs Patch3: 0003-Do-not-install-html-docs.patch -# # Override default paths for the CA directory tree +# Override default paths for the CA directory tree Patch4: 0004-Override-default-paths-for-the-CA-directory-tree.patch -# # apps/ca: fix md option help text +# apps/ca: fix md option help text Patch5: 0005-apps-ca-fix-md-option-help-text.patch -# # Disable signature verification with totally unsafe hash algorithms +# Disable signature verification with totally unsafe hash algorithms Patch6: 0006-Disable-signature-verification-with-totally-unsafe-h.patch -# # Add support for PROFILE=SYSTEM system default cipherlist +# Add support for PROFILE=SYSTEM system default cipherlist Patch7: 0007-Add-support-for-PROFILE-SYSTEM-system-default-cipher.patch -# # Add FIPS_mode() compatibility macro +# Add FIPS_mode() compatibility macro Patch8: 0008-Add-FIPS_mode-compatibility-macro.patch -# # Add check to see if fips flag is enabled in kernel +# Add check to see if fips flag is enabled in kernel Patch9: 0009-Add-Kernel-FIPS-mode-flag-support.patch -# # Instead of replacing ectest.c and ec_curve.c, add the changes as a patch so -# # that new modifications made to these files by upstream are not lost. +# Instead of replacing ectest.c and ec_curve.c, add the changes as a patch so +# that new modifications made to these files by upstream are not lost. Patch10: 0010-Add-changes-to-ectest-and-eccurve.patch -# # remove unsupported EC curves +# remove unsupported EC curves Patch11: 0011-Remove-EC-curves.patch -# # Disable explicit EC curves -# # https://bugzilla.redhat.com/show_bug.cgi?id=2066412 +# Disable explicit EC curves +# https://bugzilla.redhat.com/show_bug.cgi?id=2066412 Patch12: 0012-Disable-explicit-ec.patch -# # Skipped tests from former 0011-Remove-EC-curves.patch +# Skipped tests from former 0011-Remove-EC-curves.patch Patch13: 0013-skipped-tests-EC-curves.patch -# # Instructions to load legacy provider in openssl.cnf +# Instructions to load legacy provider in openssl.cnf Patch24: 0024-load-legacy-prov.patch -# # We load FIPS provider and set FIPS properties implicitly +# We load FIPS provider and set FIPS properties implicitly Patch32: 0032-Force-fips.patch -# # Embed HMAC into the fips.so +# Embed HMAC into the fips.so # Modify fips self test as per # https://github.com/simo5/openssl/commit/9b95ef8bd2f5ac862e5eee74c724b535f1a… Patch33: 0033-FIPS-embed-hmac.patch -# # Comment out fipsinstall command-line utility +# Comment out fipsinstall command-line utility Patch34: 0034.fipsinstall_disable.patch -# # Skip unavailable algorithms running `openssl speed` +# Skip unavailable algorithms running `openssl speed` Patch35: 0035-speed-skip-unavailable-dgst.patch -# # Extra public/private key checks required by FIPS-140-3 +# Extra public/private key checks required by FIPS-140-3 Patch44: 0044-FIPS-140-3-keychecks.patch -# # Minimize fips services +# Minimize fips services Patch45: 0045-FIPS-services-minimize.patch -# # Execute KATS before HMAC verification +# Execute KATS before HMAC verification Patch47: 0047-FIPS-early-KATS.patch -# # Selectively disallow SHA1 signatures rhbz#2070977 +# Selectively disallow SHA1 signatures rhbz#2070977 Patch49: 0049-Allow-disabling-of-SHA1-signatures.patch -# # Support SHA1 in TLS in LEGACY crypto-policy (which is SECLEVEL=1) +# Support SHA1 in TLS in LEGACY crypto-policy (which is SECLEVEL=1) Patch52: 0052-Allow-SHA1-in-seclevel-1-if-rh-allow-sha1-signatures.patch -# # https://bugzilla.redhat.com/show_bug.cgi?id=2053289 +# https://bugzilla.redhat.com/show_bug.cgi?id=2053289 Patch58: 0058-FIPS-limit-rsa-encrypt.patch -# # https://bugzilla.redhat.com/show_bug.cgi?id=2087147 +# https://bugzilla.redhat.com/show_bug.cgi?id=2087147 Patch61: 0061-Deny-SHA-1-signature-verification-in-FIPS-provider.patch # 0062-fips-Expose-a-FIPS-indicator.patch Patch62: 0062-fips-Expose-a-FIPS-indicator.patch -# # https://bugzilla.redhat.com/show_bug.cgi?id=2102535 +# https://bugzilla.redhat.com/show_bug.cgi?id=2102535 Patch73: 0073-FIPS-Use-OAEP-in-KATs-support-fixed-OAEP-seed.patch -# [PATCH 29/46] -# 0074-FIPS-Use-digest_sign-digest_verify-in-self-test.patch +# [PATCH 29/46] +# 0074-FIPS-Use-digest_sign-digest_verify-in-self-test.patch Patch74: 0074-FIPS-Use-digest_sign-digest_verify-in-self-test.patch -# # https://bugzilla.redhat.com/show_bug.cgi?id=2102535 +# https://bugzilla.redhat.com/show_bug.cgi?id=2102535 Patch75: 0075-FIPS-Use-FFDHE2048-in-self-test.patch -# # Downstream only. Reseed DRBG using getrandom(GRND_RANDOM) -# # https://bugzilla.redhat.com/show_bug.cgi?id=2102541 +# Downstream only. Reseed DRBG using getrandom(GRND_RANDOM) +# https://bugzilla.redhat.com/show_bug.cgi?id=2102541 Patch76: 0076-FIPS-140-3-DRBG.patch -# # https://bugzilla.redhat.com/show_bug.cgi?id=2102542 +# https://bugzilla.redhat.com/show_bug.cgi?id=2102542 Patch77: 0077-FIPS-140-3-zeroization.patch -# # https://bugzilla.redhat.com/show_bug.cgi?id=2114772 +# https://bugzilla.redhat.com/show_bug.cgi?id=2114772 Patch78: 0078-Add-FIPS-indicator-parameter-to-HKDF.patch -# # We believe that some changes present in CentOS are not necessary -# # because ustream has a check for FIPS version +# We believe that some changes present in CentOS are not necessary +# because ustream has a check for FIPS version Patch80: 0080-rand-Forbid-truncated-hashes-SHA-3-in-FIPS-prov.patch -# [PATCH 36/46] -# 0081-signature-Remove-X9.31-padding-from-FIPS-prov.patch +# [PATCH 36/46] +# 0081-signature-Remove-X9.31-padding-from-FIPS-prov.patch Patch81: 0081-signature-Remove-X9.31-padding-from-FIPS-prov.patch -# [PATCH 37/46] -# 0083-hmac-Add-explicit-FIPS-indicator-for-key-length.patch +# [PATCH 37/46] +# 0083-hmac-Add-explicit-FIPS-indicator-for-key-length.patch Patch83: 0083-hmac-Add-explicit-FIPS-indicator-for-key-length.patch -# [PATCH 38/46] -# 0084-pbkdf2-Set-minimum-password-length-of-8-bytes.patch +# [PATCH 38/46] +# 0084-pbkdf2-Set-minimum-password-length-of-8-bytes.patch Patch84: 0084-pbkdf2-Set-minimum-password-length-of-8-bytes.patch # 0085-FIPS-RSA-disable-shake.patch Patch85: 0085-FIPS-RSA-disable-shake.patch @@ -129,25 +129,31 @@ Patch85: 0085-FIPS-RSA-disable-shake.patch Patch88: 0088-signature-Add-indicator-for-PSS-salt-length.patch # 0091-FIPS-RSA-encapsulate.patch Patch91: 0091-FIPS-RSA-encapsulate.patch -# [PATCH 42/46] -# 0093-DH-Disable-FIPS-186-4-type-parameters-in-FIPS-mode.patch +# [PATCH 42/46] +# 0093-DH-Disable-FIPS-186-4-type-parameters-in-FIPS-mode.patch Patch93: 0093-DH-Disable-FIPS-186-4-type-parameters-in-FIPS-mode.patch -# [PATCH 43/46] -# 0110-GCM-Implement-explicit-FIPS-indicator-for-IV-gen.patch +# [PATCH 43/46] +# 0110-GCM-Implement-explicit-FIPS-indicator-for-IV-gen.patch Patch110: 0110-GCM-Implement-explicit-FIPS-indicator-for-IV-gen.patch -# [PATCH 44/46] -# 0112-pbdkf2-Set-indicator-if-pkcs5-param-disabled-checks.patch +# [PATCH 44/46] +# 0112-pbdkf2-Set-indicator-if-pkcs5-param-disabled-checks.patch Patch112: 0112-pbdkf2-Set-indicator-if-pkcs5-param-disabled-checks.patch # 0113-asymciphers-kem-Add-explicit-FIPS-indicator.patch Patch113: 0113-asymciphers-kem-Add-explicit-FIPS-indicator.patch -# # We believe that some changes present in CentOS are not necessary -# # because ustream has a check for FIPS version +# We believe that some changes present in CentOS are not necessary +# because ustream has a check for FIPS version Patch114: 0114-FIPS-enforce-EMS-support.patch # skip quic and pairwise tests temporarily Patch115: 0115-skip-quic-pairwise.patch # Add version aliasing due to # https://github.com/openssl/openssl/issues/23534 Patch116: 0116-version-aliasing.patch +# https://github.com/openssl/openssl/issues/23050 +Patch117: 0117-ignore-unknown-sigalgorithms-groups.patch +# https://github.com/openssl/openssl/issues/23770 +Patch118: 0118-no-crl-memleak.patch +# https://github.com/openssl/openssl/issues/22779 +Patch119: 0119-provider-sigalgs-in-signaturealgorithms-conf.patch License: Apache-2.0 URL: http://www.openssl.org/ @@ -483,6 +489,11 @@ install -m644 %{SOURCE9} \ %ldconfig_scriptlets libs %changelog +* Thu Mar 07 2024 Dmitry Belyavskiy <dbelyavs(a)redhat.com> - 1:3.2.1-3 +- Minimize skipping tests +- Allow ignoring unknown signature algorithms and groups (upstream #23050) +- Allow specifying provider algorithms in SignatureAlgorithms (upstream #22779) + * Fri Feb 09 2024 Sahana Prasad <sahana(a)redhat.com> - 1:3.2.1-2 - Fix version aliasing issue - https://github.com/openssl/openssl/issues/23534

1 0

[Report] Packages Restricting Arches
by root 11 Jun '24

11 Jun '24

New package excluding arches (1) ============================ - hyprutils ExcludeArch: %{ix86} Package no longer excluding arches (5) ================================== - rust-httparse - rust-nanorand - rust-primal-bit - rust-primal-check - rust-primal-estimate List of packages currently excluding arches (2255) =========================================== - 0ad ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 ppc64le - 389-ds-base ExcludeArch: i686 - 4ti2 ExcludeArch: %{ix86} - 90-Second-Portraits ExclusiveArch: %{arm} %{ix86} x86_64 aarch64 ppc64le riscv64 - AcetoneISO ExcludeArch: ppc %{power64} s390x - Agda ExcludeArch: %{ix86} armv7hl - Agda-stdlib ExcludeArch: armv7hl %{ix86} - BareBonesBrowserLaunch ExclusiveArch: %{java_arches} noarch - CFR ExclusiveArch: %{java_arches} noarch - COPASI ExcludeArch: %{ix86} - CardManager ExclusiveArch: %{java_arches} noarch - CuraEngine ExcludeArch: %{ix86} - E ExcludeArch: %{ix86} - GAPDoc ExcludeArch: %{ix86} - GoldenCheetah ExclusiveArch: %{qt5_qtwebengine_arches} - GtkAda ExclusiveArch: %{GPRbuild_arches} - GtkAda3 ExclusiveArch: %{GPRbuild_arches} - HPCombi ExclusiveArch: x86_64 %{arm64} - IPAddress ExclusiveArch: %{java_arches} noarch - IQmol ExcludeArch: %{ix86} - JUnitParams ExclusiveArch: %{java_arches} noarch - L-function ExcludeArch: %{ix86} - LabPlot ExcludeArch: sparc64 s390 s390x - MUSIC ExcludeArch: %{ix86} - Macaulay2 ExcludeArch: %{ix86} ppc64le - Maelstrom ExcludeArch: %{ix86} - Mars ExclusiveArch: %{java_arches} noarch - NiaAML-GUI ExcludeArch: %{ix86} - OpenColorIO ExcludeArch: i686 ExclusiveArch: x86_64 ppc64le - OpenImageIO ExcludeArch: i686 ExclusiveArch: x86_64 ppc64le - OpenMolcas ExclusiveArch: x86_64 aarch64 ppc64le s390x - OpenStego ExclusiveArch: %{java_arches} noarch - Pencil2D ExcludeArch: %{ix86} - PragmARC ExclusiveArch: %{GPRbuild_arches} - ProDy ExcludeArch: ppc64 s390x - R-IRkernel ExcludeArch: %{ix86} - R-V8 ExclusiveArch: %{nodejs_arches} - R-ape ExcludeArch: %{ix86} - R-igraph ExcludeArch: %{ix86} - R-kernlab ExcludeArch: %{ix86} s390x - R-rJava ExclusiveArch: %{java_arches} - Random123 ExcludeArch: mips64r2 mips32r2 s390 - RdRand ExclusiveArch: %{ix86} x86_64 - RediSearch ExclusiveArch: x86_64 - SLOF ExclusiveArch: ppc64le - Singular ExcludeArch: %{ix86} - TOPCOM ExcludeArch: %{ix86} - VulkanMemoryAllocator ExcludeArch: %{ix86} - WoeUSB ExcludeArch: s390x - YafaRay ExclusiveArch: %{ix86} x86_64 - Zim ExcludeArch: %{ix86} - aardvark-dns ExclusiveArch: %{golang_arches_future} ExclusiveArch: aarch64 ppc64le s390x x86_64 - abiword ExcludeArch: %{ix86} - abrt-java-connector ExcludeArch: %{ix86} - accel-config ExclusiveArch: %{ix86} x86_64 - acpica-tools ExcludeArch: i686 armv7hl - acpid ExclusiveArch: ia64 x86_64 %{ix86} %{arm} aarch64 riscv64 - act ExcludeArch: %{ix86} - admeshgui ExcludeArch: %{ix86} - aemu ExcludeArch: %{ix86} %{power64} s390x - agenda ExcludeArch: %{ix86} - ahven ExclusiveArch: %{GPRbuild_arches} - algobox ExclusiveArch: %{qt5_qtwebengine_arches} - alienarena ExcludeArch: s390x - alizams ExcludeArch: %{power64} %{ix86} s390x - alt-ergo ExcludeArch: %{ix86} - american-fuzzy-lop ExclusiveArch: x86_64 - amg4psblas ExcludeArch: %{ix86} - android-tools ExcludeArch: ppc ppc64 s390x ppc64le - anet ExclusiveArch: %{GPRbuild_arches} - ansible-collection-microsoft-sql ExcludeArch: i686 - ant ExclusiveArch: %{java_arches} noarch - ant-antunit ExclusiveArch: %{java_arches} noarch - ant-contrib ExclusiveArch: %{java_arches} noarch - antlr ExclusiveArch: %{java_arches} - antlr3 ExclusiveArch: %{java_arches} - antlr4-project ExclusiveArch: %{java_arches} - antlrworks ExclusiveArch: %{java_arches} noarch - aopalliance ExclusiveArch: %{java_arches} noarch - apache-commons-beanutils ExclusiveArch: %{java_arches} noarch - apache-commons-cli ExclusiveArch: %{java_arches} noarch - apache-commons-codec ExclusiveArch: %{java_arches} noarch - apache-commons-collections ExclusiveArch: %{java_arches} noarch - apache-commons-collections4 ExclusiveArch: %{java_arches} noarch - apache-commons-compress ExclusiveArch: %{java_arches} noarch - apache-commons-configuration ExclusiveArch: %{java_arches} noarch - apache-commons-digester ExclusiveArch: %{java_arches} noarch - apache-commons-exec ExclusiveArch: %{java_arches} noarch - apache-commons-io ExclusiveArch: %{java_arches} noarch - apache-commons-jexl ExclusiveArch: %{java_arches} noarch - apache-commons-jxpath ExclusiveArch: %{java_arches} noarch - apache-commons-lang3 ExclusiveArch: %{java_arches} noarch - apache-commons-logging ExclusiveArch: %{java_arches} noarch - apache-commons-math ExclusiveArch: %{java_arches} noarch - apache-commons-modeler ExclusiveArch: %{java_arches} noarch - apache-commons-net ExclusiveArch: %{java_arches} noarch - apache-commons-parent ExclusiveArch: %{java_arches} noarch - apache-commons-pool ExclusiveArch: %{java_arches} noarch - apache-commons-vfs ExclusiveArch: %{java_arches} noarch - apache-ivy ExclusiveArch: %{java_arches} noarch - apache-logging-parent ExclusiveArch: %{java_arches} noarch - apache-parent ExclusiveArch: %{java_arches} noarch - apache-resource-bundles ExclusiveArch: %{java_arches} noarch - apache-sshd ExclusiveArch: %{java_arches} noarch - apiguardian ExclusiveArch: %{java_arches} noarch - apmd ExclusiveArch: %{ix86} - appeditor ExcludeArch: %{ix86} - appstream-generator ExclusiveArch: %{ldc_arches} - apricots ExcludeArch: ppc64le aarch64 - apron ExcludeArch: %{ix86} - aqute-bnd ExclusiveArch: %{java_arches} noarch - arbor ExcludeArch: mips64r2 mips32r2 s390x %{ix86} - arc-theme ExcludeArch: %{ix86} - args4j ExclusiveArch: %{java_arches} noarch - arianna ExclusiveArch: %{qt6_qtwebengine_arches} - arm-none-eabi-binutils-cs ExcludeArch: %{ix86} - arm-none-eabi-gcc-cs ExcludeArch: %{ix86} - arpwatch ExcludeArch: %{ix86} - asahi-installer ExcludeArch: s390x - asdcplib ExcludeArch: %{ix86} %{arm} - asmjit ExclusiveArch: aarch64 x86_64 - assertj-core ExclusiveArch: %{java_arches} noarch - astromenace ExcludeArch: ppc64 s390x - astrometry-tycho2 ExcludeArch: s390x - asv ExcludeArch: %{ix86} - atinject ExclusiveArch: %{java_arches} noarch - atlantik ExcludeArch: %{ix86} - atomic-queue ExcludeArch: %{ix86} - aubit4gl ExcludeArch: i686 s390x ppc64le - audacity ExcludeArch: %{ix86} s390x - audiocd-kio ExclusiveArch: x86_64 ppc64le aarch64 %{arm} - aunit ExclusiveArch: %{GPRbuild_arches} - auryn ExcludeArch: %{ix86} - auto ExclusiveArch: %{java_arches} noarch - autolink-java ExclusiveArch: noarch %{java_arches} - avgtime ExclusiveArch: %{ldc_arches} - avr-gcc ExcludeArch: %{ix86} - aws ExclusiveArch: %GPRbuild_arches - aws-c-cal ExcludeArch: s390x - aws-c-common ExcludeArch: s390x - aws-c-compression ExcludeArch: s390x - aws-c-io ExcludeArch: %{ix86} ExcludeArch: s390x - aws-c-sdkutils ExcludeArch: s390x - aws-checksums ExcludeArch: s390x - awscli2 ExcludeArch: s390x - azove ExcludeArch: %{ix86} - azure-cli ExclusiveArch: %{java_arches} noarch - batik ExclusiveArch: %{java_arches} noarch - bcal ExclusiveArch: x86_64 aarch64 ia64 ppc64 ppc64le s390x riscv64 - bcc ExclusiveArch: x86_64 %{power64} aarch64 s390x armv7hl riscv64 - bcel ExclusiveArch: %{java_arches} noarch - bcftools ExcludeArch: s390x - bcm283x-firmware ExclusiveArch: aarch64 - beansbinding ExclusiveArch: %{java_arches} noarch - bear ExcludeArch: %{ix86} - bear-factory ExcludeArch: ppc64le - berusky2 ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 %{mips} riscv64 - beust-jcommander ExclusiveArch: %{java_arches} noarch - bibletime ExclusiveArch: %{java_arches} - bigloo ExcludeArch: %{ix86} - binaryen ExcludeArch: ppc64 s390x - binutils ExcludeArch: aarch64-linux-gnu aarch64-redhat-linux ExcludeArch: ppc64le-linux-gnu ppc64le-redhat-linux ExcludeArch: s390x-linux-gnu s390x-redhat-linux ExcludeArch: x86_64-linux-gnu x86_64-redhat-linux i686-linux-gnu i686-redhat-linux - biosdevname ExclusiveArch: %{ix86} x86_64 - biosig4c++ ExcludeArch: %{ix86} - blake3 ExcludeArch: %{ix86} - blender ExcludeArch: %{ix86} %{arm} - bless ExclusiveArch: %mono_arches - bliss ExcludeArch: %{ix86} - blueprint-compiler ExcludeArch: s390x - bluez-hcidump ExcludeArch: s390 s390x - bochs ExcludeArch: s390x i686 - bodhi-server ExclusiveArch: %{golang_arches_future} - boinc-client ExcludeArch: s390x - bolzplatz2006 ExclusiveArch: %{java_arches} - bootc ExcludeArch: %{ix86} - bottles ExcludeArch: s390x - bouncycastle ExclusiveArch: %{java_arches} noarch - bout++ ExcludeArch: %{ix86} - bowtie ExcludeArch: i686 armv7hl - bowtie2 ExcludeArch: %{ix86} %{arm} s390x - box64 ExclusiveArch: aarch64 riscv64 ppc64le x86_64 - boxes ExcludeArch: %{ix86} - bpftrace ExclusiveArch: x86_64 %{power64} aarch64 s390x - brazil ExclusiveArch: %{java_arches} noarch - breakid ExcludeArch: %{ix86} - brewtarget ExcludeArch: %{ix86} - brial ExcludeArch: %{ix86} - bsf ExclusiveArch: %{java_arches} noarch - bsh ExclusiveArch: %{java_arches} noarch - build-helper-maven-plugin ExclusiveArch: %{java_arches} noarch - buildah ExclusiveArch: %{golang_arches_future} ExclusiveArch: aarch64 ppc64le s390x x86_64 - busybox ExcludeArch: i686 s390x - bwping ExcludeArch: %{ix86} - byebyebios ExclusiveArch: x86_64 - byte-buddy ExclusiveArch: %{java_arches} noarch - byteman ExclusiveArch: %{java_arches} noarch - cachelib ExclusiveArch: x86_64 aarch64 ppc64le - caddy ExclusiveArch: %{golang_arches} ExclusiveArch: %{golang_arches_future} - cadical ExcludeArch: %{ix86} - caffe ExclusiveArch: x86_64 aarch64 ppc64le - calamares ExclusiveArch: %{ix86} x86_64 aarch64 riscv64 - calceph ExcludeArch: %{ix86} - calibre ExclusiveArch: aarch64 x86_64 - calligra ExcludeArch: %{ix86} - cambozola ExclusiveArch: %{java_arches} noarch - canl-java ExclusiveArch: %{java_arches} noarch - cantera ExcludeArch: %{ix86} - carat ExcludeArch: %{ix86} - casc ExcludeArch: %{ix86} - cataclysm-dda ExcludeArch: i686 - catatonit ExclusiveArch: %{golang_arches_future} ExclusiveArch: aarch64 ppc64le s390x x86_64 - ccdciel ExclusiveArch: %{fpc_arches} ExcludeArch: %{ix86} - ccluster ExcludeArch: %{ix86} - cdcollect ExclusiveArch: %{mono_arches} - cdi-api ExclusiveArch: %{java_arches} noarch - cdrdao ExcludeArch: s390 s390x - ceph ExcludeArch: i686 armv7hl ExclusiveArch: x86_64 aarch64 ppc64le s390x - ceres-solver ExcludeArch: ppc64 - cfn-lint ExcludeArch: %{ix86} - cglib ExclusiveArch: %{java_arches} noarch - cgreen ExcludeArch: s390x - chatterino2 ExcludeArch: %{ix86} - chatty ExcludeArch: i686 - checkpointctl ExclusiveArch: %{golang_arches_future} - chromium ExclusiveArch: x86_64 ExclusiveArch: x86_64 aarch64 ppc64le ExclusiveArch: x86_64 aarch64 - cinnamon ExcludeArch: %{ix86} - cinnamon-control-center ExcludeArch: %{ix86} - cinnamon-desktop ExcludeArch: %{ix86} - cinnamon-menus ExcludeArch: %{ix86} - cinnamon-screensaver ExcludeArch: %{ix86} - cinnamon-session ExcludeArch: %{ix86} - cinnamon-settings-daemon ExcludeArch: %{ix86} - cjdns ExclusiveArch: %{nodejs_arches} - cjs ExcludeArch: %{ix86} - classloader-leak-test-framework ExclusiveArch: %{java_arches} noarch - classpathless-compiler ExclusiveArch: %{java_arches} noarch - cld2 ExcludeArch: ppc64 s390x - clibs-list ExcludeArch: %{ix86} - clojure ExclusiveArch: %{java_arches} noarch - clojure-core-specs-alpha ExclusiveArch: %{java_arches} noarch - clojure-maven-plugin ExclusiveArch: %{java_arches} noarch - clojure-spec-alpha ExclusiveArch: %{java_arches} noarch - cloudcompare ExcludeArch: %{ix86} - clover2 ExcludeArch: armv7hl - cmospwd ExclusiveArch: %{ix86} x86_64 - cmrt ExclusiveArch: %{ix86} x86_64 ia64 - coan ExcludeArch: ppc64 s390x - coccinelle ExcludeArch: %{ix86} - cocoalib ExcludeArch: %{ix86} - codeblocks ExcludeArch: %{ix86} - codehaus-parent ExclusiveArch: %{java_arches} noarch - cohomCalg ExcludeArch: %{ix86} - coin-or-Alps ExcludeArch: %{ix86} - coin-or-Bcp ExcludeArch: %{ix86} - coin-or-Bcps ExcludeArch: %{ix86} - coin-or-Blis ExcludeArch: %{ix86} - coin-or-Bonmin ExcludeArch: %{ix86} - coin-or-CoinMP ExcludeArch: %{ix86} - coin-or-Couenne ExcludeArch: %{ix86} - coin-or-Dip ExcludeArch: %{ix86} - coin-or-FlopC++ ExcludeArch: %{ix86} - coin-or-HiGHS ExcludeArch: %{ix86} - coin-or-Ipopt ExcludeArch: %{ix86} - coin-or-OS ExcludeArch: %{ix86} - coin-or-SYMPHONY ExcludeArch: %{ix86} - coin-or-lemon ExcludeArch: %{ix86} - colorful ExclusiveArch: %{fpc_arches} - colossus ExclusiveArch: %{java_arches} noarch - compiz-plugins-experimental ExcludeArch: s390 s390x - conmon ExclusiveArch: %{golang_arches_future} - console-image-viewer ExclusiveArch: %{java_arches} noarch - containernetworking-plugins ExclusiveArch: %{golang_arches} - containers-common ExclusiveArch: %{golang_arches} noarch - contour-terminal ExclusiveArch: x86_64 aarch64 - contractor ExcludeArch: %{ix86} - conu ExcludeArch: ppc64 - coolreader ExcludeArch: %{ix86} - coq ExclusiveArch: %{ocaml_native_compiler} - corectrl ExcludeArch: %{ix86} - cortado ExclusiveArch: %{java_arches} noarch - cosmic-comp ExcludeArch: %{ix86} - coxeter ExcludeArch: %{ix86} - cp2k ExcludeArch: s390x - cpp-hocon ExcludeArch: %{ix86} - cpu-x ExclusiveArch: i686 x86_64 - cpufetch ExclusiveArch: %{arm} aarch64 x86_64 ppc ppc64 ppc64le - cpuid ExclusiveArch: %{ix86} x86_64 - cpuinfo ExclusiveArch: x86_64 aarch64 - cqrlog ExclusiveArch: %{fpc_arches} - cramjam-cli ExcludeArch: %{ix86} - crash ExclusiveArch: %{ix86} ia64 x86_64 ppc ppc64 s390 s390x %{arm} aarch64 ppc64le - crash-gcore-command ExclusiveArch: aarch64 ppc64le x86_64 - crash-trace-command ExclusiveArch: aarch64 ppc64le s390x x86_64 - credentials-fetcher ExclusiveArch: x86_64 aarch64 s390x - crest ExcludeArch: s390x - cri-o ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 aarch64 %{arm}} - cri-tools ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 aarch64 %{arm}} - criu ExclusiveArch: x86_64 %{arm} ppc64le aarch64 s390x - crun ExclusiveArch: %{golang_arches_future} ExclusiveArch: aarch64 ppc64le riscv64 s390x x86_64 - cryfs ExcludeArch: i686 - cryptlib ExclusiveArch: x86_64 aarch64 ppc64le - crypto-policies ExclusiveArch: %{java_arches} noarch - cryptobone ExclusiveArch: x86_64 ppc64le aarch64 - cryptominisat ExcludeArch: %{ix86} - csdp ExcludeArch: %{ix86} - csslint ExclusiveArch: %{nodejs_arches} noarch - cura ExcludeArch: %{ix86} - cura-fdm-materials ExcludeArch: %{ix86} - cvc5 ExcludeArch: %{ix86} - cxsc ExcludeArch: %{ix86} - daggy ExcludeArch: s390x - dapl ExcludeArch: s390, armv7hl - daq ExclusiveArch: x86_64 aarch64 - darktable ExcludeArch: armv7hl i686 s390x - dbus-parsec ExcludeArch: ppc64le s390x - dbus-sharp ExclusiveArch: %mono_arches - dbus-sharp-glib ExclusiveArch: %mono_arches - ddccontrol ExcludeArch: s390 s390x - ddcutil ExcludeArch: s390 s390x - ddd ExcludeArch: %{ix86} - ddnet ExcludeArch: s390x - decentxml ExclusiveArch: %{java_arches} noarch - deepin-daemon ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 aarch64 %{arm}} - deepin-desktop-schemas ExclusiveArch: %{go_arches} - dhall ExcludeArch: %{ix86} - dhall-json ExcludeArch: %{ix86} - dialect ExcludeArch: s390x - diffoscope ExcludeArch: %{ix86} - dippi ExcludeArch: %{ix86} - directory-maven-plugin ExclusiveArch: %{java_arches} noarch - dirgra ExclusiveArch: %{java_arches} noarch - disruptor ExclusiveArch: %{java_arches} noarch - ditaa ExclusiveArch: %{java_arches} noarch - dl_poly ExcludeArch: i686 - dlib ExcludeArch: %{ix86} s390x - dlm ExclusiveArch: i686 x86_64 - dmidecode ExclusiveArch: %{ix86} x86_64 ia64 aarch64 - dmtcp ExclusiveArch: x86_64 - dnsdist ExcludeArch: %{ix86} #1994125 ExcludeArch: armv7hl #1994125 - docker-distribution ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 %{arm}} - dogtag-pki ExclusiveArch: %{java_arches} ExcludeArch: i686 - dolfin ExcludeArch: %{ix86} - dolphin-emu ExclusiveArch: x86_64 aarch64 - dom4j ExclusiveArch: %{java_arches} noarch - dosbox-staging ExcludeArch: %{ix86} - dotnet6.0 ExclusiveArch: aarch64 x86_64 s390x ExclusiveArch: x86_64 - dotnet8.0 ExclusiveArch: aarch64 ppc64le s390x x86_64 - doublecmd ExclusiveArch: %{ix86} x86_64 - dovecot ExcludeArch: %{ix86} - dpdk ExclusiveArch: x86_64 i686 aarch64 ppc64le - dragonbox ExcludeArch: %{ix86} - drat-trim ExcludeArch: %{ix86} - drat2er ExcludeArch: %{ix86} - dub ExclusiveArch: %{ldc_arches} - duperemove ExcludeArch: %{ix86} - dvdauthor ExcludeArch: %{ix86} - dvgrab ExcludeArch: s390 s390x - dxvk-native ExclusiveArch: %{ix86} x86_64 - dyninst ExclusiveArch: %{ix86} x86_64 ppc64le aarch64 - e-antic ExcludeArch: %{ix86} - e00compr ExcludeArch: %{ix86} - e3 ExclusiveArch: %{ix86} x86_64 - easymock ExclusiveArch: %{java_arches} noarch - eccodes ExcludeArch: i686 - ecj ExclusiveArch: %{java_arches} noarch - eclib ExcludeArch: %{ix86} - eclipse-swt ExclusiveArch: %{java_arches} - ecryptfs-utils ExcludeArch: %{ix86} - ed25519-java ExclusiveArch: %{java_arches} noarch - edac-utils ExcludeArch: %{ix86} - edflib ExcludeArch: s390x %{ix86} - edk2 ExclusiveArch: x86_64 aarch64 riscv64 - edwin-fonts ExcludeArch: %{ix86} - eegdev ExcludeArch: %{ix86} - eegview ExcludeArch: %{ix86} - efax ExcludeArch: s390 s390x - efibootmgr ExclusiveArch: %{efi} - efifs ExclusiveArch: %{efi} - efitools ExclusiveArch: %{efi} - efivar ExclusiveArch: %{efi} - electron-cash ExcludeArch: %{ix86} - electrum ExcludeArch: %{ix86} - elk ExclusiveArch: x86_64 %{ix86} ExclusiveArch: x86_64 aarch64 %{arm} %{power64} ExclusiveArch: x86_64 %{ix86} aarch64 %{arm} %{power64} - emacs-common-proofgeneral ExcludeArch: %{ix86} - emacs-company-mode ExcludeArch: %{ix86} - emacs-iedit ExcludeArch: %{ix86} - emacs-slime ExclusiveArch: %{arm} %{ix86} x86_64 ppc sparcv9 aarch64 - embree ExclusiveArch: aarch64 x86_64 - embree3 ExclusiveArch: aarch64 x86_64 - enjarify ExclusiveArch: %{java_arches} noarch - enki ExclusiveArch: %{qt5_qtwebengine_arches} noarch - envytools ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 riscv64 - eot-utils ExcludeArch: %{ix86} - ergo ExcludeArch: %{ix86} - eric ExclusiveArch: %{qt6_qtwebengine_arches} noarch - erlang-corba ExclusiveArch: %{java_arches} - esmi_ib_library ExclusiveArch: x86_64 - espresso ExcludeArch: s390x i686 armv7hl - eth-tools ExclusiveArch: x86_64 - exec-maven-plugin ExclusiveArch: %{java_arches} noarch - external-editor-revived ExclusiveArch: %{rust_arches} - extra-enforcer-rules ExclusiveArch: %{java_arches} noarch - f3d ExcludeArch: %{ix86} - fasterxml-oss-parent ExclusiveArch: %{java_arches} noarch - fb303 ExclusiveArch: x86_64 aarch64 ppc64le riscv64 - fbreader ExcludeArch: %{ix86} ExcludeArch: armv7hl - fbthrift ExclusiveArch: x86_64 aarch64 ppc64le riscv64 - fcitx-libpinyin ExclusiveArch: %{qt5_qtwebengine_arches} - fcitx5-mozc ExcludeArch: ppc ppc64 sparcv9 sparc64 s390x - fcoe-utils ExcludeArch: ppc s390 ExcludeArch: %{ix86} - felix-parent ExclusiveArch: %{java_arches} noarch - felix-utils ExclusiveArch: %{java_arches} noarch - fernflower ExclusiveArch: %{java_arches} noarch - fes ExclusiveArch: %{ix86} x86_64 - fido-device-onboard ExcludeArch: %{ix86} - filedrop ExclusiveArch: %{java_arches} noarch - filezilla ExcludeArch: s390x - firecracker ExclusiveArch: aarch64 x86_64 - firefox ExcludeArch: i686 - fishbowl ExclusiveArch: %{java_arches} noarch - fizz ExclusiveArch: x86_64 aarch64 ppc64le riscv64 - flang ExcludeArch: i686 s390x - flashrom ExcludeArch: s390 s390x - flatbuffers ExcludeArch: %{ix86} - flatpak ExcludeArch: %{ix86} - flatpak-builder ExcludeArch: %{ix86} - flatpak-module-tools ExcludeArch: i386 i686 - flexmark-java ExclusiveArch: noarch %{java_arches} - flickcurl ExcludeArch: %{ix86} - flint ExcludeArch: %{ix86} - flocq ExclusiveArch: %{ocaml_native_compiler} - floppy-support ExcludeArch: %{arm} aarch64 s390x - florist ExclusiveArch: %{GPRbuild_arches} - flterm ExcludeArch: s390 s390x sparcv9 - fluent-bit ExclusiveArch: x86_64 aarch64 - flute ExclusiveArch: %{java_arches} noarch - fmidi ExcludeArch: %{ix86} - folly ExclusiveArch: x86_64 aarch64 ppc64le riscv64 - fop ExclusiveArch: %{java_arches} noarch - forge-parent ExclusiveArch: %{java_arches} noarch - fotocx ExcludeArch: %{ix86} - foxi ExclusiveArch: x86_64 aarch64 - fpc ExclusiveArch: %{arm} aarch64 %{ix86} x86_64 ppc64le - fprintd ExcludeArch: s390 s390x - fractal ExcludeArch: %{ix86} - fragments ExcludeArch: %{ix86} - frama-c ExclusiveArch: %{ocaml_native_compiler} - free42 ExcludeArch: %{ix86} - freecol ExclusiveArch: %{java_arches} noarch - freedink ExcludeArch: s390x - freedink-dfarc ExcludeArch: s390x - freefem++ ExcludeArch: %{ix86} - freemarker ExclusiveArch: %{java_arches} noarch - freerouting ExclusiveArch: %{java_arches} noarch - freetennis ExcludeArch: sparc64 s390 s390x %{ix86} - frescobaldi ExclusiveArch: %{qt5_qtwebengine_arches} - frysk ExclusiveArch: x86_64 ppc64 - fuse-overlayfs ExclusiveArch: %{arm64} ppc64le s390x x86_64 riscv64 - fusesource-pom ExclusiveArch: %{java_arches} noarch - fwts ExclusiveArch: x86_64 %{arm} aarch64 s390x riscv64 %{power64} - fwupd-efi ExclusiveArch: x86_64 aarch64 - ga ExcludeArch: %{ix86} ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 ppc64le riscv64 - galera ExcludeArch: %{ix86} - gambas3 ExcludeArch: i686 - gap ExcludeArch: %{ix86} - gap-pkg-ace ExcludeArch: %{ix86} - gap-pkg-aclib ExcludeArch: %{ix86} - gap-pkg-alnuth ExcludeArch: %{ix86} - gap-pkg-anupq ExcludeArch: %{ix86} - gap-pkg-atlasrep ExcludeArch: %{ix86} - gap-pkg-autodoc ExcludeArch: %{ix86} - gap-pkg-automata ExcludeArch: %{ix86} - gap-pkg-autpgrp ExcludeArch: %{ix86} - gap-pkg-browse ExcludeArch: %{ix86} - gap-pkg-caratinterface ExcludeArch: %{ix86} - gap-pkg-circle ExcludeArch: %{ix86} - gap-pkg-cohomolo ExcludeArch: %{ix86} - gap-pkg-congruence ExcludeArch: %{ix86} - gap-pkg-corelg ExcludeArch: %{ix86} - gap-pkg-crime ExcludeArch: %{ix86} - gap-pkg-crisp ExcludeArch: %{ix86} - gap-pkg-crypting ExcludeArch: %{ix86} - gap-pkg-cryst ExcludeArch: %{ix86} - gap-pkg-crystcat ExcludeArch: %{ix86} - gap-pkg-ctbllib ExcludeArch: %{ix86} - gap-pkg-curlinterface ExcludeArch: %{ix86} - gap-pkg-cvec ExcludeArch: %{ix86} - gap-pkg-datastructures ExcludeArch: %{ix86} - gap-pkg-design ExcludeArch: %{ix86} - gap-pkg-digraphs ExcludeArch: %{ix86} - gap-pkg-edim ExcludeArch: %{ix86} - gap-pkg-factint ExcludeArch: %{ix86} - gap-pkg-ferret ExcludeArch: %{ix86} - gap-pkg-fga ExcludeArch: %{ix86} - gap-pkg-fining ExcludeArch: %{ix86} - gap-pkg-float ExcludeArch: %{ix86} - gap-pkg-format ExcludeArch: %{ix86} - gap-pkg-forms ExcludeArch: %{ix86} - gap-pkg-fplsa ExcludeArch: %{ix86} - gap-pkg-fr ExcludeArch: %{ix86} - gap-pkg-francy ExcludeArch: %{ix86} - gap-pkg-gbnp ExcludeArch: %{ix86} - gap-pkg-genss ExcludeArch: %{ix86} - gap-pkg-grape ExcludeArch: %{ix86} - gap-pkg-groupoids ExcludeArch: %{ix86} - gap-pkg-grpconst ExcludeArch: %{ix86} - gap-pkg-guava ExcludeArch: %{ix86} - gap-pkg-hap ExcludeArch: %{ix86} - gap-pkg-hapcryst ExcludeArch: %{ix86} - gap-pkg-hecke ExcludeArch: %{ix86} - gap-pkg-images ExcludeArch: %{ix86} - gap-pkg-io ExcludeArch: %{ix86} - gap-pkg-irredsol ExcludeArch: %{ix86} - gap-pkg-json ExcludeArch: %{ix86} - gap-pkg-jupyterkernel ExcludeArch: %{ix86} - gap-pkg-jupyterviz ExcludeArch: %{ix86} - gap-pkg-laguna ExcludeArch: %{ix86} - gap-pkg-liealgdb ExcludeArch: %{ix86} - gap-pkg-liepring ExcludeArch: %{ix86} - gap-pkg-liering ExcludeArch: %{ix86} - gap-pkg-loops ExcludeArch: %{ix86} - gap-pkg-lpres ExcludeArch: %{ix86} - gap-pkg-mapclass ExcludeArch: %{ix86} - gap-pkg-nautytracesinterface ExcludeArch: %{ix86} - gap-pkg-nq ExcludeArch: %{ix86} - gap-pkg-openmath ExcludeArch: %{ix86} - gap-pkg-orb ExcludeArch: %{ix86} - gap-pkg-permut ExcludeArch: %{ix86} - gap-pkg-polenta ExcludeArch: %{ix86} - gap-pkg-polycyclic ExcludeArch: %{ix86} - gap-pkg-polymaking ExcludeArch: %{ix86} - gap-pkg-primgrp ExcludeArch: %{ix86} - gap-pkg-profiling ExcludeArch: %{ix86} - gap-pkg-qpa ExcludeArch: %{ix86} - gap-pkg-quagroup ExcludeArch: %{ix86} - gap-pkg-radiroot ExcludeArch: %{ix86} - gap-pkg-recog ExcludeArch: %{ix86} - gap-pkg-repsn ExcludeArch: %{ix86} - gap-pkg-resclasses ExcludeArch: %{ix86} - gap-pkg-scscp ExcludeArch: %{ix86} - gap-pkg-semigroups ExcludeArch: %{ix86} - gap-pkg-singular ExcludeArch: %{ix86} - gap-pkg-sla ExcludeArch: %{ix86} - gap-pkg-smallgrp ExcludeArch: %{ix86} - gap-pkg-smallsemi ExcludeArch: %{ix86} - gap-pkg-sonata ExcludeArch: %{ix86} - gap-pkg-sophus ExcludeArch: %{ix86} - gap-pkg-spinsym ExcludeArch: %{ix86} - gap-pkg-standardff ExcludeArch: %{ix86} - gap-pkg-tomlib ExcludeArch: %{ix86} - gap-pkg-toric ExcludeArch: %{ix86} - gap-pkg-transgrp ExcludeArch: %{ix86} - gap-pkg-utils ExcludeArch: %{ix86} - gap-pkg-uuid ExcludeArch: %{ix86} - gap-pkg-xmod ExcludeArch: %{ix86} - gap-pkg-zeromqinterface ExcludeArch: %{ix86} - gappa ExcludeArch: %{ix86} - gappalib-coq ExclusiveArch: %{ocaml_native_compiler} - gauche ExcludeArch: armv7hl - gbrainy ExclusiveArch: %mono_arches - gdb-exploitable ExclusiveArch: x86_64 i386 ExclusiveArch: x86_64 noarch - gdl ExcludeArch: %{ix86} - gearhead1 ExclusiveArch: %{fpc_arches} - gearhead2 ExclusiveArch: %{fpc_arches} - gearmand ExcludeArch: ppc - geeqie ExcludeArch: %{ix86} - gfan ExcludeArch: %{ix86} - gfs2-utils ExcludeArch: %{ix86} - gfxstream ExcludeArch: %{ix86} %{power64} s390x - ghc ExcludeArch: armv7hl - ghc-cborg ExcludeArch: %{ix86} - ghc-cborg-json ExcludeArch: %{ix86} - ghc-gi-gtk ExcludeArch: armv7hl - ghc-serialise ExcludeArch: %{ix86} - ghc9.10 ExcludeArch: armv7hl - ghc9.2 ExcludeArch: armv7hl - ghc9.4 ExcludeArch: armv7hl - ghc9.6 ExcludeArch: armv7hl - ghc9.8 ExcludeArch: armv7hl - ghdl ExclusiveArch: %{GNAT_arches} ExcludeArch: armv7hl %{ix86} - ghostwriter ExclusiveArch: %{qt5_qtwebengine_arches} - gimp-fourier-plugin ExcludeArch: %{ix86} - gio-sharp ExclusiveArch: %mono_arches - gir-to-d ExclusiveArch: %{ldc_arches} - git-lfs ExcludeArch: %{ix86} - git-octopus ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 aarch64 %{arm}} - gitqlient ExclusiveArch: %{qt5_qtwebengine_arches} - giver ExclusiveArch: %{mono_arches} - gkeyfile-sharp ExclusiveArch: %mono_arches - gkrellm-wifi ExcludeArch: s390 s390x - glava ExcludeArch: %{ix86} - glibd ExclusiveArch: %{ldc_arches} - gloo ExcludeArch: i686 - glycin-loaders ExcludeArch: %{ix86} - gmsh ExcludeArch: %{ix86} - gmult ExcludeArch: %{ix86} - gn ExcludeArch: %{ix86} - gnatcoll ExclusiveArch: %{GPRbuild_arches} - gnatcoll-bindings ExclusiveArch: %{GPRbuild_arches} - gnatcoll-db ExclusiveArch: %{GPRbuild_arches} - gnofract4d ExcludeArch: %{ix86} - gnome-applets ExcludeArch: %{ix86} - gnome-bluetooth ExcludeArch: s390 s390x - gnome-bluetooth3.34 ExcludeArch: s390 s390x - gnome-boxes ExclusiveArch: x86_64 - gnome-chemistry-utils ExcludeArch: %{ix86} - gnome-desktop-sharp ExclusiveArch: %mono_arches - gnome-do ExclusiveArch: %mono_arches ExcludeArch: armv7hl - gnome-flashback ExcludeArch: %{ix86} - gnome-hexgl ExcludeArch: i686 - gnome-initial-setup ExcludeArch: %{ix86} - gnome-keyring-sharp ExclusiveArch: %mono_arches - gnome-monitor-config ExcludeArch: %{ix86} - gnome-panel ExcludeArch: %{ix86} - gnome-rdp ExclusiveArch: %{mono_arches} ExcludeArch: %{ix86} - gnome-session ExcludeArch: %{ix86} - gnome-sharp ExclusiveArch: %mono_arches - gnome-shell ExcludeArch: %{ix86} - gnome-software ExcludeArch: %{ix86} - gnome-subtitles ExclusiveArch: %mono_arches - gnome-terminal ExcludeArch: %{ix86} - gnu-efi ExclusiveArch: %{efi} - gnucash ExcludeArch: %{ix86} ExcludeArch: ppc64 s390x - gnumeric ExcludeArch: %{ix86} - go-bindata ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 %{arm}} - godep ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 %{arm}} - godot ExcludeArch: s390x - godot3 ExcludeArch: ppc64 ppc64le s390x - goffice ExcludeArch: %{ix86} - golang ExclusiveArch: %{golang_arches} - golang-entgo-ent ExcludeArch: %{arm32} %{ix86} - golang-github-ebitengine-purego ExcludeArch: ppc64le s390x - golang-github-elliotchance-orderedmap ExcludeArch: aarch64 ExcludeArch: ppc64le ExcludeArch: s390x - golang-github-facebookincubator-nvdtools ExcludeArch: i686 armv7hl - golang-github-google-goterm ExcludeArch: ppc64le s390x - golang-helm-3 ExcludeArch: armv7hl aarch64 - golang-tinygo-x-llvm ExcludeArch: %{ix86} - goldendict-ng ExclusiveArch: aarch64 x86_64 - google-compute-engine-guest-configs ExcludeArch: %{ix86} - google-cpu_features ExcludeArch: s390x - google-gson ExclusiveArch: %{java_arches} noarch - google-guest-agent ExcludeArch: ppc64le s390x - google-guice ExclusiveArch: %{java_arches} noarch - google-osconfig-agent ExcludeArch: ppc64le s390x - gotcha ExcludeArch: %{ix86} - gotun ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 %{arm}} ExclusiveArch: x86_64 - gource ExcludeArch: ppc64le - goverlay ExclusiveArch: %{fpc_arches} - gpaste ExcludeArch: %{ix86} - gpaw ExcludeArch: ppc64 ExcludeArch: %{ix86} - gperftools ExcludeArch: s390 - gprbuild ExclusiveArch: %{GPRbuild_arches} - gprolog ExclusiveArch: x86_64 %{ix86} ppc alpha aarch64 - gr-air-modes ExcludeArch: %{ix86} - grafana ExclusiveArch: %{grafana_arches} - grafana-pcp ExclusiveArch: %{grafanapcp_arches} - greenboot ExcludeArch: s390x - gretl ExcludeArch: %{ix86} - gromacs ExcludeArch: i686 armv7hl s390x - grub-customizer ExcludeArch: s390 s390x %{arm} - grub2 ExcludeArch: s390 s390x %{ix86} - grub2-breeze-theme ExcludeArch: s390 s390x %{arm} - grubby ExcludeArch: %{ix86} - gsequencer ExcludeArch: i686 - gthree ExcludeArch: i686 - gthumb ExcludeArch: s390x - gtk-sharp-beans ExclusiveArch: %mono_arches - gtk-sharp2 ExclusiveArch: %mono_arches - gtk-sharp3 ExclusiveArch: %{mono_arches} - gtkd ExclusiveArch: %{ldc_arches} - gtkhash ExcludeArch: %{ix86} - gtkwave ExcludeArch: s390x - guava ExclusiveArch: %{java_arches} noarch - gudev-sharp ExclusiveArch: %mono_arches - guestfs-tools ExclusiveArch: %{kernel_arches} ExcludeArch: %{power64} - gvisor-tap-vsock ExclusiveArch: %{golang_arches_future} ExclusiveArch: aarch64 ppc64le s390x x86_64 - hamcrest ExclusiveArch: %{java_arches} noarch - harec ExclusiveArch: x86_64 aarch64 riscv64 - harmonyseq ExcludeArch: %{ix86} - harvey ExcludeArch: %{ix86} - hashcat ExcludeArch: ppc64 s390x - hawtjni ExclusiveArch: %{java_arches} noarch - haxe ExcludeArch: %{ix86} - hcloud ExcludeArch: %{ix86} - heaptrack ExcludeArch: s390 s390x - hedgewars ExclusiveArch: %{fpc_arches} ExcludeArch: ppc64le - helix ExcludeArch: %{ix86} - hevea ExcludeArch: %{ix86} - hibernate-jpa-2.0-api ExclusiveArch: %{java_arches} noarch - hid4java ExclusiveArch: %{java_arches} noarch - highfive ExcludeArch: %{ix86} - hipblas ExclusiveArch: x86_64 - hipcub ExclusiveArch: x86_64 - hipfft ExclusiveArch: x86_64 - hipify ExclusiveArch: x86_64 - hiprand ExclusiveArch: x86_64 - hipsolver ExclusiveArch: x86_64 - hipsparse ExclusiveArch: x86_64 - hmmer ExcludeArch: aarch64 ppc64le s390x - honggfuzz ExcludeArch: %{arm} %{power64} s390 s390x - howl ExcludeArch: ppc64le s390x ExcludeArch: %{ix86} - hpx ExcludeArch: i686 - hsakmt ExclusiveArch: x86_64 aarch64 ppc64le - httpcomponents-client ExclusiveArch: %{java_arches} noarch - httpcomponents-core ExclusiveArch: %{java_arches} noarch - httpcomponents-project ExclusiveArch: %{java_arches} noarch - hydrapaper ExcludeArch: s390x - hyperhdr ExcludeArch: %{ix86} - hyperrogue ExcludeArch: armv7hl - hyperscan ExclusiveArch: x86_64 - hyperv-daemons ExclusiveArch: i686 x86_64 aarch64 - hyprcursor ExcludeArch: %{ix86} - hypridle ExcludeArch: %{ix86} - hyprland ExcludeArch: %{ix86} - hyprlang ExcludeArch: %{ix86} - hyprlock ExcludeArch: %{ix86} - hyprpaper ExcludeArch: %{ix86} - hyprutils ExcludeArch: %{ix86} - hyprwayland-scanner ExcludeArch: %{ix86} - i2c-tools ExcludeArch: s390 s390x - ibsim ExcludeArch: s390 %{arm} - ibus-typing-booster ExcludeArch: ppc64 s390x - icecat ExcludeArch: %{ix86} %{arm} - icedtea-web ExclusiveArch: %{java_arches} - icu4j ExclusiveArch: %{java_arches} noarch - ignition ExcludeArch: %{ix86} - iir1 ExcludeArch: %{ix86} - ike-scan ExcludeArch: %{ix86} - ilua ExcludeArch: %{ix86} - imagej ExclusiveArch: %{java_arches} noarch - imhex ExclusiveArch: x86_64 %{arm64} - iml ExcludeArch: %{ix86} - imvirt ExclusiveArch: %{ix86} x86_64 ia64 - indi-3rdparty-drivers ExcludeArch: %{ix86} - indi-3rdparty-libraries ExcludeArch: %{ix86} - indistarter ExclusiveArch: %{fpc_arches} - infinipath-psm ExclusiveArch: x86_64 - intel-cm-compiler ExclusiveArch: i686 x86_64 - intel-cmt-cat ExclusiveArch: x86_64 - intel-compute-runtime ExclusiveArch: x86_64 - intel-gmmlib ExcludeArch: s390x ppc64le - intel-igc ExclusiveArch: x86_64 - intel-ipp-crypto-mb ExclusiveArch: x86_64 - intel-ipsec-mb ExclusiveArch: x86_64 - intel-lpmd ExclusiveArch: x86_64 - intel-media-driver-free ExclusiveArch: i686 x86_64 - intel-mediasdk ExclusiveArch: x86_64 - intel-metee ExclusiveArch: x86_64 - intel-undervolt ExclusiveArch: i386 x86_64 - intel-vpl-gpu-rt ExclusiveArch: x86_64 - ioport ExclusiveArch: %{ix86} x86_64 - ipe ExcludeArch: %{ix86} - ipmctl ExclusiveArch: x86_64 - irda-utils ExcludeArch: s390 s390x - irqbalance ExcludeArch: s390 s390x - isa-l ExcludeArch: %{ix86} - ispc ExclusiveArch: x86_64 aarch64 - iucode-tool ExclusiveArch: %{ix86} x86_64 - iyfct ExclusiveArch: %{arm} %{ix86} x86_64 aarch64 ppc64le - jFormatString ExclusiveArch: %{java_arches} noarch - jack-mixer ExcludeArch: armv7hl ExcludeArch: i686 - jackson-annotations ExclusiveArch: %{java_arches} noarch - jackson-bom ExclusiveArch: %{java_arches} noarch - jackson-core ExclusiveArch: %{java_arches} noarch - jackson-databind ExclusiveArch: %{java_arches} noarch - jackson-jaxrs-providers ExclusiveArch: %{java_arches} noarch - jackson-modules-base ExclusiveArch: %{java_arches} noarch - jackson-parent ExclusiveArch: %{java_arches} noarch - jacoco ExclusiveArch: %{java_arches} noarch - jacop ExclusiveArch: %{java_arches} noarch - jakarta-activation ExclusiveArch: %{java_arches} noarch - jakarta-activation1 ExclusiveArch: %{java_arches} noarch - jakarta-annotations ExclusiveArch: %{java_arches} noarch - jakarta-el ExclusiveArch: %{java_arches} noarch - jakarta-interceptors ExclusiveArch: %{java_arches} noarch - jakarta-json ExclusiveArch: %{java_arches} noarch - jakarta-mail ExclusiveArch: %{java_arches} noarch - jakarta-mail1 ExclusiveArch: %{java_arches} noarch - jakarta-oro ExclusiveArch: %{java_arches} noarch - jakarta-saaj ExclusiveArch: %{java_arches} noarch - jakarta-server-pages ExclusiveArch: %{java_arches} noarch - jakarta-servlet ExclusiveArch: %{java_arches} noarch - jakarta-xml-ws ExclusiveArch: %{java_arches} noarch - janino ExclusiveArch: %{java_arches} noarch - jansi ExclusiveArch: %{java_arches} - jansi-native ExclusiveArch: %{java_arches} - jansi1 ExclusiveArch: %{java_arches} noarch - java-1.8.0-openjdk ExclusiveArch: %{java_arches} ExcludeArch: %{ix86} - java-1.8.0-openjdk-portable ExclusiveArch: %{java_arches} ExcludeArch: %{ix86} - java-11-openjdk ExclusiveArch: %{java_arches} ExcludeArch: %{ix86} - java-11-openjdk-portable ExclusiveArch: %{java_arches} ExcludeArch: %{ix86} - java-17-openjdk ExclusiveArch: %{java_arches} ExcludeArch: %{ix86} - java-17-openjdk-portable ExclusiveArch: %{java_arches} ExcludeArch: %{ix86} - java-21-openjdk ExclusiveArch: %{java_arches} ExcludeArch: %{ix86} - java-21-openjdk-portable ExclusiveArch: %{java_arches} ExcludeArch: %{ix86} - java-diff-utils ExclusiveArch: %{java_arches} noarch - java-dirq ExclusiveArch: %{java_arches} noarch - java-jd-decompiler ExclusiveArch: %{java_arches} noarch - java-latest-openjdk ExclusiveArch: %{java_arches} ExcludeArch: %{ix86} - java-latest-openjdk-portable ExclusiveArch: %{java_arches} ExcludeArch: %{ix86} - java-runtime-decompiler ExclusiveArch: %{java_arches} noarch - java-scrypt ExclusiveArch: %{java_arches} noarch - java_cup ExclusiveArch: %{java_arches} noarch - javacc ExclusiveArch: %{java_arches} noarch - javacc-maven-plugin ExclusiveArch: %{java_arches} noarch - javaewah ExclusiveArch: %{java_arches} noarch - javapackages-bootstrap ExclusiveArch: %{java_arches} - javaparser ExclusiveArch: %{java_arches} noarch - javapoet ExclusiveArch: %{java_arches} noarch - javassist ExclusiveArch: %{java_arches} noarch - jaxb ExclusiveArch: %{java_arches} noarch - jaxb-api ExclusiveArch: %{java_arches} noarch - jaxb-api2 ExclusiveArch: %{java_arches} noarch - jaxb-dtd-parser ExclusiveArch: %{java_arches} noarch - jaxb-fi ExclusiveArch: %{java_arches} noarch - jaxb-istack-commons ExclusiveArch: %{java_arches} noarch - jaxb-stax-ex ExclusiveArch: %{java_arches} noarch - jaxen ExclusiveArch: %{java_arches} noarch - jblas ExcludeArch: %{ix86} - jboss-jaxrs-2.0-api ExclusiveArch: %{java_arches} noarch - jboss-logging ExclusiveArch: %{java_arches} noarch - jboss-logging-tools ExclusiveArch: %{java_arches} noarch - jboss-parent ExclusiveArch: %{java_arches} noarch - jchardet ExclusiveArch: %{java_arches} noarch - jcip-annotations ExclusiveArch: %{java_arches} noarch - jctools ExclusiveArch: %{java_arches} noarch - jcuber ExclusiveArch: %{java_arches} noarch - jdeparser ExclusiveArch: %{java_arches} noarch - jdepend ExclusiveArch: %{java_arches} noarch - jdependency ExclusiveArch: %{java_arches} noarch - jdom ExclusiveArch: %{java_arches} noarch - jdom2 ExclusiveArch: %{java_arches} noarch - jedit ExclusiveArch: %{java_arches} noarch - jericho-html ExclusiveArch: %{java_arches} noarch - jetbrains-annotations ExclusiveArch: noarch %{java_arches} - jetty ExclusiveArch: %{java_arches} noarch - jflex ExclusiveArch: %{java_arches} noarch - jfreechart ExclusiveArch: %{java_arches} noarch - jgit ExclusiveArch: %{java_arches} noarch - jglobus ExclusiveArch: %{java_arches} noarch - jgoodies-common ExclusiveArch: %{java_arches} noarch - jgoodies-forms ExclusiveArch: %{java_arches} noarch - jgoodies-looks ExclusiveArch: %{java_arches} noarch - jigawatts ExclusiveArch: x86_64 %{arm} ppc64le aarch64 s390x - jline ExclusiveArch: %{java_arches} - jline2 ExclusiveArch: %{java_arches} noarch - jmock ExclusiveArch: %{java_arches} noarch - jmol ExclusiveArch: %{java_arches} noarch - jna ExclusiveArch: %{java_arches} - jneuroml-core ExclusiveArch: %{java_arches} noarch - jni-inchi ExclusiveArch: %{java_arches} - jo ExcludeArch: %{ix86} - jol ExclusiveArch: %{java_arches} noarch - jolokia-jvm-agent ExclusiveArch: %{java_arches} noarch - jopt-simple ExclusiveArch: %{java_arches} noarch - jorbis ExclusiveArch: %{java_arches} noarch - jowl ExclusiveArch: %{nodejs_arches} noarch - jpanoramamaker ExclusiveArch: %{java_arches} noarch - jpilot ExcludeArch: s390, s390x - jpilot-backup ExcludeArch: s390 s390x - jsch ExclusiveArch: %{java_arches} noarch - jsch-agent-proxy ExclusiveArch: %{java_arches} noarch - json_simple ExclusiveArch: %{java_arches} noarch - jsoup ExclusiveArch: %{java_arches} noarch - jsr-305 ExclusiveArch: %{java_arches} noarch - jss ExclusiveArch: %{java_arches} ExcludeArch: i686 - jssc ExclusiveArch: %{java_arches} - jtidy ExclusiveArch: %{java_arches} noarch - julia ExclusiveArch: x86_64 - junit ExclusiveArch: %{java_arches} noarch - junit5 ExclusiveArch: %{java_arches} noarch - juniversalchardet ExclusiveArch: %{java_arches} noarch - jzlib ExclusiveArch: %{java_arches} noarch - kaffeine ExcludeArch: %{ix86} - kaidan ExclusiveArch: %{qt5_qtwebengine_arches} ExcludeArch: %{ix86} - kata-containers ExcludeArch: %{arm} %{ix86} s390 s390x ExcludeArch: ppc64le - kawa ExcludeArch: i686 - kchmviewer ExclusiveArch: %{qt5_qtwebengine_arches} - kcm_wacomtablet ExcludeArch: s390 s390x - kcov ExcludeArch: s390 s390x - kdenlive ExcludeArch: %{ix86} - keepass ExclusiveArch: %{mono_arches} ExcludeArch: armv7hl - keepassxc ExcludeArch: s390x - kernel ExclusiveArch: noarch x86_64 s390x aarch64 ppc64le ExclusiveArch: noarch i386 i686 x86_64 s390x aarch64 ppc64le - kernelshark ExcludeArch: %{ix86} %{arm} - keydb ExcludeArch: %{ix86} - keylime-agent-rust ExclusiveArch: %{rust_arches} - kf5-akonadi-search ExclusiveArch: x86_64 ppc64le aarch64 %{arm} - kf5-kblog ExclusiveArch: x86_64 ppc64le aarch64 %{arm} - kf5-kcalendarcore ExclusiveArch: x86_64 ppc64le aarch64 %{arm} - kf5-kcalendarutils ExclusiveArch: x86_64 ppc64le aarch64 %{arm} - kf5-kitinerary ExclusiveArch: x86_64 ppc64le aarch64 %{arm} - kf5-ktnef ExclusiveArch: x86_64 ppc64le aarch64 %{arm} - kf5-libkdcraw ExclusiveArch: x86_64 ppc64le %{arm} - khelpcenter ExclusiveArch: %{qt6_qtwebengine_arches} - kicad ExclusiveArch: x86_64 aarch64 ppc64le - kissat ExcludeArch: %{ix86} - kitty ExcludeArch: %{ix86} - kiwix-desktop ExclusiveArch: %{qt5_qtwebengine_arches} - knot-resolver ExclusiveArch: %{ix86} x86_64 ExclusiveArch: %{arm} aarch64 %{ix86} x86_64 - kokkos ExcludeArch: i686 armv7hl - kpilot ExcludeArch: s390 s390x - krita ExcludeArch: %{ix86} - ksensors ExcludeArch: s390 s390x - kubernetes ExclusiveArch: x86_64 aarch64 ppc64le s390x %{arm} - ladspa-autotalent-plugins ExcludeArch: %{ix86} - laf-plugin ExclusiveArch: %{java_arches} noarch - latte-integrale ExcludeArch: %{ix86} - lazarus ExclusiveArch: %{fpc_arches} - lazpaint ExclusiveArch: %{fpc_arches} - lcd4linux ExcludeArch: s390 s390x - ldapjdk ExclusiveArch: %{java_arches} noarch - ldc ExclusiveArch: %{ldc_arches} ppc64le - ledmon ExcludeArch: %{ix86} - leland-fonts ExcludeArch: %{ix86} - lfortran ExclusiveArch: x86_64 - lfsc ExcludeArch: %{ix86} - lib3mf ExcludeArch: %{ix86} - libCombine ExcludeArch: %{ix86} - libaiff ExcludeArch: %{ix86} - libarcus ExcludeArch: %{ix86} - libarrow ExcludeArch: %{ix86} %{arm} - libavc1394 ExcludeArch: s390 s390x - libbase ExclusiveArch: %{java_arches} noarch - libcamera ExcludeArch: s390x ppc64le - libcamera-apps ExcludeArch: %{power64} s390x - libcint ExcludeArch: %{power64} ExcludeArch: x86_64 - libcircle ExcludeArch: %{ix86} - libcpuid ExcludeArch: aarch64 %arm ppc64le ppc64 s390x - libcrystalhd ExcludeArch: s390 s390x - libcxx ExcludeArch: ppc64 ppc64le - libdc1394 ExcludeArch: s390 s390x - libdfp ExclusiveArch: ppc ppc64 ppc64le s390 s390x x86_64 - libdigidocpp ExcludeArch: %{ix86} - libdispatch ExclusiveArch: x86_64 aarch64 ppc64le - libffado ExcludeArch: s390 s390x - libfilezilla ExcludeArch: s390x - libfonts ExclusiveArch: %{java_arches} noarch - libformula ExclusiveArch: %{java_arches} noarch - libfprint ExcludeArch: s390 s390x - libguestfs ExcludeArch: %{ix86} ExclusiveArch: %{kernel_arches} ExcludeArch: %{power64} - libhomfly ExcludeArch: %{ix86} - libibcommon ExcludeArch: s390 s390x - libica ExclusiveArch: s390 s390x - libiec61883 ExcludeArch: s390 s390x - libinsane ExcludeArch: %{ix86} - libipt ExclusiveArch: %{ix86} x86_64 ExclusiveArch: %{ix86} x86_64 - libkrun ExclusiveArch: x86_64 aarch64 - libkrunfw ExclusiveArch: x86_64 aarch64 - liblayout ExclusiveArch: %{java_arches} noarch - libldac ExcludeArch: s390x - libloader ExclusiveArch: %{java_arches} noarch - libnuml ExcludeArch: %{ix86} - libnxz ExclusiveArch: ppc64le - libobjc2 ExcludeArch: armv7hl i686 ppc64le s390x - libocxl ExclusiveArch: ppc64le - libomp17 ExcludeArch: s390x - libopenshot ExcludeArch: ppc64le - libopenshot-audio ExcludeArch: ppc64le - liborc ExcludeArch: i686 armv7hl - libpoly ExcludeArch: %{ix86} - libpsm2 ExclusiveArch: x86_64 - libquentier ExclusiveArch: %{qt5_qtwebengine_arches} - libraw1394 ExcludeArch: s390 s390x - libreoffice ExcludeArch: %{ix86} - libreoffice-TexMaths ExclusiveArch: %{java_arches} ExcludeArch: aarch64 s390x - librepository ExclusiveArch: %{java_arches} noarch - libretro-desmume2015 ExclusiveArch: i686 x86_64 - libretro-pcsx-rearmed ExcludeArch: armv7hl - librtas ExclusiveArch: %{power64} - libsavitar ExcludeArch: %{ix86} - libsedml ExcludeArch: %{ix86} - libsemigroups ExcludeArch: %{ix86} - libserializer ExclusiveArch: %{java_arches} noarch - libservicelog ExclusiveArch: ppc %{power64} - libsmbios ExclusiveArch: x86_64 %{ix86} - libsonata ExcludeArch: %{ix86} - libstoragemgmt ExcludeArch: %{ix86} - libtracecmd ExcludeArch: %{ix86} %{arm} - libunibreak ExcludeArch: %{ix86} - libunicode ExclusiveArch: x86_64 aarch64 - libunifex ExcludeArch: i686 - libunwind ExclusiveArch: %{arm} aarch64 hppa ia64 mips ppc %{power64} s390x %{ix86} x86_64 riscv64 - libva-intel-hybrid-driver ExclusiveArch: %{ix86} x86_64 ia64 - libva-nvidia-driver ExclusiveArch: %{x86_64} %{ix86} %{arm64} ppc64le - libvirt-java ExclusiveArch: %{java_arches} noarch - libvma ExclusiveArch: x86_64 ppc64le ppc64 aarch64 - libvmi ExclusiveArch: x86_64 - libvpd ExclusiveArch: %{power64} - libvpl ExclusiveArch: x86_64 - libvpl-tools ExclusiveArch: x86_64 - libx86 ExcludeArch: ppc %{power64} s390 s390x %{sparc} aarch64 armv7hl - libxsmm ExclusiveArch: x86_64 - libzdnn ExclusiveArch: s390x - libzfcphbaapi ExclusiveArch: s390 s390x - libzpc ExclusiveArch: s390x - liferea ExcludeArch: %{ix86} - linbox ExcludeArch: %{ix86} - linux-system-roles ExcludeArch: i686 - liquidctl ExcludeArch: s390 s390x - lite-xl ExcludeArch: %{ix86} - llama-cpp ExclusiveArch: x86_64 aarch64 - lld13 ExcludeArch: s390x - lld15 ExcludeArch: s390x - lld16 ExcludeArch: s390x - lld17 ExcludeArch: s390x - llhttp ExclusiveArch: %{nodejs_arches} - llvm-bolt ExcludeArch: s390x ppc64le i686 - log4j ExclusiveArch: %{java_arches} noarch - log4net ExclusiveArch: %mono_arches - loguru ExcludeArch: %{ix86} - loupe ExcludeArch: %{ix86} - love ExcludeArch: ppc ppc64 s390x - lrmi ExclusiveArch: %{ix86} - lsp-plugins ExcludeArch: %{ix86} - lsvpd ExclusiveArch: %{power64} - luajit ExcludeArch: riscv64 ppc64 ppc64le - lucene ExclusiveArch: %{java_arches} noarch - luckybackup ExcludeArch: %{ix86} - lujavrite ExclusiveArch: %{java_arches} - luminance-hdr ExcludeArch: %{ix86} - lusol ExcludeArch: %{ix86} - luxcorerender ExclusiveArch: x86_64 - lzfse ExcludeArch: s390x - m4rie ExcludeArch: %{ix86} - mactel-boot ExclusiveArch: x86_64 - magicmirror ExclusiveArch: %{nodejs_arches} noarch - magicmirror-module-airnow ExclusiveArch: %{nodejs_arches} noarch - magicmirror-module-onthisday ExclusiveArch: %{nodejs_arches} noarch - magicmirror-module-singlestock ExclusiveArch: %{nodejs_arches} noarch - makemusic-finale-fonts ExcludeArch: %{ix86} - mame ExcludeArch: %{arm} %{ix86} - manifest-tool ExclusiveArch: x86_64 aarch64 ppc64le s390x - mapnik ExcludeArch: ppc ppc64 s390 s390x - marcsabatella-campania-fonts ExcludeArch: %{ix86} - mariadb-java-client ExclusiveArch: %{java_arches} noarch - marked ExclusiveArch: %{nodejs_arches} noarch ExclusiveArch: %{ix86} x86_64 %{arm} noarch - mate-applets ExcludeArch: i386 i686 - matrix-synapse ExclusiveArch: %{rust_arches} - maven ExclusiveArch: %{java_arches} noarch - maven-antrun-plugin ExclusiveArch: %{java_arches} noarch - maven-archetype ExclusiveArch: %{java_arches} noarch - maven-archiver ExclusiveArch: %{java_arches} noarch - maven-artifact-transfer ExclusiveArch: %{java_arches} noarch - maven-assembly-plugin ExclusiveArch: %{java_arches} noarch - maven-bundle-plugin ExclusiveArch: %{java_arches} noarch - maven-clean-plugin ExclusiveArch: %{java_arches} noarch - maven-common-artifact-filters ExclusiveArch: %{java_arches} noarch - maven-compiler-plugin ExclusiveArch: %{java_arches} noarch - maven-dependency-analyzer ExclusiveArch: %{java_arches} noarch - maven-dependency-plugin ExclusiveArch: %{java_arches} noarch - maven-dependency-tree ExclusiveArch: %{java_arches} noarch - maven-doxia ExclusiveArch: %{java_arches} noarch - maven-doxia-sitetools ExclusiveArch: %{java_arches} noarch - maven-enforcer ExclusiveArch: %{java_arches} noarch - maven-file-management ExclusiveArch: %{java_arches} noarch - maven-filtering ExclusiveArch: %{java_arches} noarch - maven-invoker ExclusiveArch: %{java_arches} noarch - maven-invoker-plugin ExclusiveArch: %{java_arches} noarch - maven-jar-plugin ExclusiveArch: %{java_arches} noarch - maven-mapping ExclusiveArch: %{java_arches} noarch - maven-native ExclusiveArch: %{java_arches} noarch - maven-parent ExclusiveArch: %{java_arches} noarch - maven-patch-plugin ExclusiveArch: %{java_arches} noarch - maven-plugin-testing ExclusiveArch: %{java_arches} noarch - maven-plugin-tools ExclusiveArch: %{java_arches} noarch - maven-remote-resources-plugin ExclusiveArch: %{java_arches} noarch - maven-reporting-api ExclusiveArch: %{java_arches} noarch - maven-reporting-impl ExclusiveArch: %{java_arches} noarch - maven-resolver ExclusiveArch: %{java_arches} noarch - maven-resources-plugin ExclusiveArch: %{java_arches} noarch - maven-script-interpreter ExclusiveArch: %{java_arches} noarch - maven-shade-plugin ExclusiveArch: %{java_arches} noarch - maven-shared-incremental ExclusiveArch: %{java_arches} noarch - maven-shared-io ExclusiveArch: %{java_arches} noarch - maven-shared-utils ExclusiveArch: %{java_arches} noarch - maven-source-plugin ExclusiveArch: %{java_arches} noarch - maven-surefire ExclusiveArch: %{java_arches} noarch - maven-verifier ExclusiveArch: %{java_arches} noarch - maven-verifier-plugin ExclusiveArch: %{java_arches} noarch - maven-wagon ExclusiveArch: %{java_arches} noarch - maxima ExclusiveArch: %{arm} %{ix86} x86_64 aarch64 ppc sparcv9 ExclusiveArch: %{ix86} x86_64 ppc sparcv9 - mbpfan ExclusiveArch: x86_64 - mcelog ExclusiveArch: i686 x86_64 - mcqd ExcludeArch: %{ix86} - mcrouter ExclusiveArch: x86_64 aarch64 ppc64le - mecab-java ExclusiveArch: %java_arches - mediaconch ExclusiveArch: %{qt5_qtwebengine_arches} - mellowplayer ExclusiveArch: %{qt5_qtwebengine_arches} - memkind ExclusiveArch: x86_64 ppc64 ppc64le s390x aarch64 - memtest86+ ExclusiveArch: x86_64 %{ix86} - merkuro ExclusiveArch: %{qt6_qtwebengine_arches} - meshlab ExclusiveArch: aarch64 x86_64 ExcludeArch: %{ix86} - metamath ExcludeArch: %{ix86} - mfem ExcludeArch: %{ix86} - microcode_ctl ExclusiveArch: %{ix86} x86_64 - micropython ExclusiveArch: %{arm} x86_64 riscv64 - miglayout ExclusiveArch: %{java_arches} noarch - mine_detector ExclusiveArch: %{GPRbuild_arches} - minetest ExclusiveArch: %{ix86} x86_64 ExclusiveArch: %{arm} %{ix86} x86_64 %{mips} aarch64 - mingw-libidn2 ExclusiveArch: %{ix86} x86_64 %{arm} - mingw-qt6-qtlocation ExcludeArch: s390x - mingw-wine-gecko ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 - miopen ExclusiveArch: x86_64 - mirrormanager2 ExcludeArch: %{ix86} - mkbootdisk ExclusiveArch: %{ix86} sparc sparc64 x86_64 - mlir ExcludeArch: i686 - mlir17 ExcludeArch: i686 - mlpack ExcludeArch: %{ix86} ExcludeArch: s390 - mmapper ExcludeArch: %{ix86} - mmlib ExcludeArch: %{ix86} - mmtests ExcludeArch: s390x - moby-engine ExclusiveArch: %{golang_arches} - mockito ExclusiveArch: %{java_arches} noarch - mod_gnutls ExcludeArch: %{ix86} %{arm} - mod_mono ExclusiveArch: %mono_arches - mod_proxy_cluster ExcludeArch: i686 i386 - modello ExclusiveArch: %{java_arches} noarch - moditect ExclusiveArch: %{java_arches} noarch - module-build-service ExclusiveArch: %{ix86} x86_64 noarch - modulemaker-maven-plugin ExclusiveArch: %{java_arches} noarch - mojo-executor ExclusiveArch: %{java_arches} noarch - mojo-parent ExclusiveArch: %{java_arches} noarch - mokutil ExclusiveArch: %{ix86} x86_64 aarch64 %{arm} - mold ExcludeArch: %{ix86} - mono ExclusiveArch: %mono_arches - mono-addins ExclusiveArch: %mono_arches - mono-basic ExclusiveArch: %{mono_arches} - mono-bouncycastle ExclusiveArch: %mono_arches ExcludeArch: armv7hl - mono-cecil ExclusiveArch: %mono_arches - mono-cecil-flowanalysis ExclusiveArch: %mono_arches - mono-reflection ExclusiveArch: %mono_arches - mono-tools ExclusiveArch: %mono_arches - mono-zeroconf ExclusiveArch: %mono_arches - monodevelop ExclusiveArch: %mono_arches ExcludeArch: armv7hl - monodevelop-debugger-gdb ExclusiveArch: %{mono_arches} ExcludeArch: armv7hl - moose ExcludeArch: s390x - morphio ExcludeArch: %{ix86} - mozc ExcludeArch: ppc ppc64 sparcv9 sparc64 s390x - mozilla-ublock-origin ExcludeArch: ppc64 s390x - mp ExcludeArch: %{ix86} - mpark-patterns ExcludeArch: %{ix86} - mpi4py ExcludeArch: %{ix86} - mpibash ExcludeArch: %{ix86} - mpsolve ExcludeArch: %{ix86} - mrchem ExcludeArch: s390x - mrcpp ExcludeArch: s390x - mrrescue ExclusiveArch: %{arm} %{ix86} x86_64 aarch64 ppc64le - msolve ExcludeArch: %{ix86} - msr-tools ExclusiveArch: %{ix86} x86_64 - mstflint ExcludeArch: s390 s390x %{arm} - msv ExclusiveArch: %{java_arches} noarch - mt32emu ExcludeArch: %{ix86} - muffin ExcludeArch: %{ix86} - mumble ExcludeArch: %{ix86} - mupen64plus ExcludeArch: s390x - musescore ExcludeArch: %{ix86} - musl ExcludeArch: s390 - mvfst ExclusiveArch: x86_64 aarch64 ppc64le riscv64 - mxparser ExclusiveArch: %{java_arches} noarch - mysql-connector-java ExclusiveArch: %{java_arches} noarch - mysql-connector-net ExclusiveArch: %{mono_arches} - naev ExclusiveArch: %{arm} %{ix86} x86_64 %{mips} aarch64 ExcludeArch: %{ix86} - naga ExclusiveArch: %{java_arches} noarch - nagios-plugins-check-updates ExcludeArch: %{ix86} - nant ExclusiveArch: %mono_arches ExcludeArch: armv7hl - nativejit ExclusiveArch: x86_64 - nbc ExclusiveArch: %{fpc_arches} - nbdkit ExcludeArch: i686 - ncl ExcludeArch: %{ix86} - ndesk-dbus ExclusiveArch: %{mono_arches} - ndesk-dbus-glib ExclusiveArch: %{mono_arches} - nekohtml ExclusiveArch: %{java_arches} noarch - nemo ExcludeArch: %{ix86} - nemo-extensions ExcludeArch: %{ix86} - nest ExcludeArch: %{ix86} - netatalk ExcludeArch: aarch64 s390x - netavark ExclusiveArch: %{golang_arches_future} ExclusiveArch: aarch64 ppc64le s390x x86_64 - netcdf-fortran ExcludeArch: %{ix86} - netdata ExcludeArch: s390x - netgen-mesher ExcludeArch: %{ix86} - neuron ExcludeArch: mips64r2 mips32r2 ExcludeArch: %{ix86} - newtonsoft-json ExclusiveArch: %{mono_arches} ExcludeArch: armv7hl - nextcloud-client ExcludeArch: %{ix86} ExcludeArch: ppc64 ppc64le s390x - nodejs-acorn-object-spread ExclusiveArch: %{nodejs_arches} noarch ExclusiveArch: %{ix86} x86_64 %{arm} noarch - nodejs-backbone ExclusiveArch: %{nodejs_arches} noarch - nodejs-bash-language-server ExclusiveArch: %{nodejs_arches} noarch - nodejs-buble ExclusiveArch: %{nodejs_arches} noarch - nodejs-cjs-module-lexer ExclusiveArch: %{nodejs_arches} noarch ExclusiveArch: %{ix86} x86_64 aarch64 ppc64le riscv64 noarch - nodejs-colors ExclusiveArch: %{nodejs_arches} noarch - nodejs-less ExclusiveArch: %{nodejs_arches} noarch - nodejs-linefix ExclusiveArch: %{nodejs_arches} noarch ExclusiveArch: %{ix86} x86_64 %{arm} noarch - nodejs-nodemon ExclusiveArch: %{nodejs_arches} noarch - nodejs-packaging ExclusiveArch: %{nodejs_arches} noarch - nodejs-replace-require-self ExclusiveArch: %{nodejs_arches} noarch - nodejs-underscore ExclusiveArch: %{nodejs_arches} noarch ExclusiveArch: %{ix86} x86_64 %{arm} noarch - nodejs-undici ExclusiveArch: %{ix86} x86_64 aarch64 ppc64le riscv64 noarch - nodejs18 ExclusiveArch: %{nodejs_arches} - nodejs20 ExclusiveArch: %{nodejs_arches} - nodejs22 ExclusiveArch: %{nodejs_arches} - nom-tam-fits ExclusiveArch: %{java_arches} noarch - normaliz ExcludeArch: %{ix86} - not-ocamlfind ExcludeArch: %{ix86} - notejot ExcludeArch: %{ix86} - notify-sharp ExclusiveArch: %{mono_arches} - notify-sharp3 ExclusiveArch: %{mono_arches} - ntfs2btrfs ExcludeArch: ppc64 s390x - nuget ExclusiveArch: %{mono_arches} - numactl ExcludeArch: s390 %{arm} - numatop ExclusiveArch: x86_64 ppc64le - numptyphysics ExcludeArch: ppc64le - nunit ExclusiveArch: %{mono_arches} - nunit2 ExclusiveArch: %{mono_arches} ExcludeArch: armv7hl - nut ExcludeArch: s390 s390x - nvml ExclusiveArch: x86_64 ppc64le - nwchem ExcludeArch: %{ix86} s390x ExcludeArch: s390x - objectweb-asm ExclusiveArch: %{java_arches} noarch - objenesis ExclusiveArch: %{java_arches} noarch - obs-cef ExclusiveArch: x86_64 aarch64 - obs-service-rust2rpm ExclusiveArch: %{rust_arches} noarch - obs-studio-plugin-vkcapture ExcludeArch: s390x - ocaml ExcludeArch: %{ix86} - ocaml-SDL ExcludeArch: %{ix86} - ocaml-alcotest ExcludeArch: %{ix86} - ocaml-astring ExcludeArch: %{ix86} - ocaml-atd ExcludeArch: %{ix86} - ocaml-augeas ExcludeArch: %{ix86} - ocaml-autoconf ExcludeArch: %{ix86} - ocaml-base ExcludeArch: %{ix86} - ocaml-base64 ExcludeArch: %{ix86} - ocaml-benchmark ExcludeArch: %{ix86} - ocaml-bigarray-compat ExcludeArch: %{ix86} - ocaml-bin-prot ExcludeArch: %{ix86} - ocaml-biniou ExcludeArch: %{ix86} - ocaml-bisect-ppx ExcludeArch: %{ix86} - ocaml-bos ExcludeArch: %{ix86} - ocaml-cairo ExcludeArch: %{ix86} - ocaml-calendar ExcludeArch: %{ix86} - ocaml-camlbz2 ExcludeArch: %{ix86} - ocaml-camlidl ExcludeArch: %{ix86} - ocaml-camlimages ExcludeArch: %{ix86} - ocaml-camlp-streams ExcludeArch: %{ix86} - ocaml-camlp5 ExcludeArch: %{ix86} - ocaml-camlp5-buildscripts ExcludeArch: %{ix86} - ocaml-camomile ExcludeArch: %{ix86} - ocaml-cinaps ExcludeArch: %{ix86} - ocaml-cmdliner ExcludeArch: %{ix86} - ocaml-compiler-libs-janestreet ExcludeArch: %{ix86} - ocaml-cppo ExcludeArch: %{ix86} - ocaml-crunch ExcludeArch: %{ix86} - ocaml-cryptokit ExcludeArch: %{ix86} - ocaml-csexp ExcludeArch: %{ix86} - ocaml-csv ExcludeArch: %{ix86} - ocaml-ctypes ExcludeArch: %{ix86} - ocaml-cudf ExcludeArch: %{ix86} - ocaml-curl ExcludeArch: %{ix86} - ocaml-curses ExcludeArch: %{ix86} - ocaml-dbus ExcludeArch: %{ix86} - ocaml-dose3 ExcludeArch: %{ix86} - ocaml-dune ExcludeArch: %{ix86} - ocaml-easy-format ExcludeArch: %{ix86} - ocaml-expat ExcludeArch: %{ix86} - ocaml-extlib ExcludeArch: %{ix86} - ocaml-facile ExcludeArch: %{ix86} - ocaml-fieldslib ExcludeArch: %{ix86} - ocaml-fileutils ExcludeArch: %{ix86} - ocaml-findlib ExcludeArch: %{ix86} - ocaml-fmt ExcludeArch: %{ix86} - ocaml-fpath ExcludeArch: %{ix86} - ocaml-gen ExcludeArch: %{ix86} - ocaml-gettext ExcludeArch: %{ix86} - ocaml-graphics ExcludeArch: %{ix86} - ocaml-gsl ExcludeArch: %{arm} %{ix86} - ocaml-integers ExcludeArch: %{ix86} - ocaml-jane-street-headers ExcludeArch: %{ix86} - ocaml-jst-config ExcludeArch: %{ix86} - ocaml-lablgl ExcludeArch: %{ix86} - ocaml-lablgtk ExcludeArch: %{ix86} - ocaml-lablgtk3 ExcludeArch: %{ix86} - ocaml-labltk ExcludeArch: %{ix86} - ocaml-lacaml ExcludeArch: %{ix86} - ocaml-lambda-term ExcludeArch: %{ix86} - ocaml-libvirt ExcludeArch: %{ix86} - ocaml-logs ExcludeArch: %{ix86} - ocaml-luv ExcludeArch: %{ix86} - ocaml-lwt ExcludeArch: %{ix86} - ocaml-markup ExcludeArch: %{ix86} - ocaml-mccs ExcludeArch: %{ix86} - ocaml-mdx ExcludeArch: %{ix86} - ocaml-menhir ExcludeArch: %{ix86} - ocaml-merlin ExcludeArch: %{ix86} - ocaml-mew ExcludeArch: %{ix86} - ocaml-mew-vi ExcludeArch: %{ix86} - ocaml-mlgmpidl ExcludeArch: %{ix86} - ocaml-mlmpfr ExcludeArch: %{ix86} - ocaml-mtime ExcludeArch: %{ix86} - ocaml-mysql ExcludeArch: %{ix86} - ocaml-num ExcludeArch: %{ix86} - ocaml-obuild ExcludeArch: %{ix86} - ocaml-ocamlbuild ExcludeArch: %{ix86} - ocaml-ocamlgraph ExcludeArch: %{ix86} - ocaml-ocamlnet ExcludeArch: %{ix86} - ocaml-ocp-indent ExcludeArch: %{ix86} - ocaml-ocplib-endian ExcludeArch: %{ix86} - ocaml-ocplib-simplex ExcludeArch: %{ix86} - ocaml-octavius ExcludeArch: %{ix86} - ocaml-odoc ExcludeArch: %{ix86} - ocaml-omake ExcludeArch: %{ix86} - ocaml-opam-file-format ExcludeArch: %{ix86} - ocaml-ounit ExcludeArch: %{ix86} - ocaml-parmap ExcludeArch: %{ix86} - ocaml-parsexp ExcludeArch: %{ix86} - ocaml-pcre ExcludeArch: %{ix86} - ocaml-pcre2 ExcludeArch: %{ix86} - ocaml-perl4caml ExcludeArch: %{ix86} - ocaml-postgresql ExcludeArch: %{ix86} - ocaml-pp ExcludeArch: %{ix86} - ocaml-ppx-assert ExcludeArch: %{ix86} - ocaml-ppx-base ExcludeArch: %{ix86} - ocaml-ppx-cold ExcludeArch: %{ix86} - ocaml-ppx-compare ExcludeArch: %{ix86} - ocaml-ppx-custom-printf ExcludeArch: %{ix86} - ocaml-ppx-derivers ExcludeArch: %{ix86} - ocaml-ppx-deriving ExcludeArch: %{ix86} - ocaml-ppx-deriving-yaml ExcludeArch: %{ix86} - ocaml-ppx-deriving-yojson ExcludeArch: %{ix86} - ocaml-ppx-enumerate ExcludeArch: %{ix86} - ocaml-ppx-expect ExcludeArch: %{ix86} - ocaml-ppx-fields-conv ExcludeArch: %{ix86} - ocaml-ppx-globalize ExcludeArch: %{ix86} - ocaml-ppx-hash ExcludeArch: %{ix86} - ocaml-ppx-here ExcludeArch: %{ix86} - ocaml-ppx-import ExcludeArch: %{ix86} - ocaml-ppx-inline-test ExcludeArch: %{ix86} - ocaml-ppx-js-style ExcludeArch: %{ix86} - ocaml-ppx-let ExcludeArch: %{ix86} - ocaml-ppx-optcomp ExcludeArch: %{ix86} - ocaml-ppx-sexp-conv ExcludeArch: %{ix86} - ocaml-ppx-stable-witness ExcludeArch: %{ix86} - ocaml-ppx-variants-conv ExcludeArch: %{ix86} - ocaml-ppxlib ExcludeArch: %{ix86} - ocaml-psmt2-frontend ExcludeArch: %{ix86} - ocaml-ptime ExcludeArch: %{ix86} - ocaml-ptmap ExcludeArch: %{ix86} - ocaml-pyml ExcludeArch: %{ix86} - ocaml-qcheck ExcludeArch: %{ix86} - ocaml-qtest ExcludeArch: %{ix86} - ocaml-re ExcludeArch: %{ix86} - ocaml-react ExcludeArch: %{ix86} - ocaml-res ExcludeArch: %{ix86} - ocaml-result ExcludeArch: %{ix86} - ocaml-rresult ExcludeArch: %{ix86} - ocaml-sedlex ExcludeArch: %{ix86} - ocaml-sexplib ExcludeArch: %{ix86} - ocaml-sexplib0 ExcludeArch: %{ix86} - ocaml-sha ExcludeArch: %{ix86} - ocaml-sqlite ExcludeArch: %{ix86} - ocaml-ssl ExcludeArch: %{ix86} - ocaml-stdcompat ExcludeArch: %{ix86} - ocaml-stdio ExcludeArch: %{ix86} - ocaml-stdlib-random ExcludeArch: %{ix86} - ocaml-time-now ExcludeArch: %{ix86} - ocaml-topkg ExcludeArch: %{ix86} - ocaml-trie ExcludeArch: %{ix86} - ocaml-tyxml ExcludeArch: %{ix86} - ocaml-unionfind ExcludeArch: %{ix86} - ocaml-uucd ExcludeArch: %{ix86} - ocaml-uucp ExcludeArch: %{ix86} - ocaml-uunf ExcludeArch: %{ix86} - ocaml-uuseg ExcludeArch: %{ix86} - ocaml-uutf ExcludeArch: %{ix86} - ocaml-variantslib ExcludeArch: %{ix86} - ocaml-version ExcludeArch: %{ix86} - ocaml-xml-light ExcludeArch: %{ix86} - ocaml-xmlm ExcludeArch: %{ix86} - ocaml-xmlrpc-light ExcludeArch: %{ix86} - ocaml-yaml ExcludeArch: %{ix86} - ocaml-yojson ExcludeArch: %{ix86} - ocaml-zarith ExcludeArch: %{ix86} - ocaml-zed ExcludeArch: %{ix86} - ocaml-zip ExcludeArch: %{ix86} - ocaml-zmq ExcludeArch: %{ix86} - ocamlify ExcludeArch: %{ix86} - ocamlmod ExcludeArch: %{ix86} - oci-seccomp-bpf-hook ExclusiveArch: x86_64 %{power64} aarch64 s390x armv7hl ExclusiveArch: %{golang_arches_future} - ocrmypdf ExcludeArch: %{ix86} - octave-communications ExcludeArch: s390x - octave-iso2mesh ExcludeArch: armv7hl - octave-signal ExcludeArch: s390x - oidc-agent ExcludeArch: %{ix86} - oidn ExclusiveArch: x86_64 - oneVPL ExclusiveArch: x86_64 - oneapi-level-zero ExclusiveArch: x86_64 - onednn ExclusiveArch: x86_64 aarch64 ppc64le s390x - onedrive ExclusiveArch: %{ldc_arches} - ongres-scram ExclusiveArch: %{java_arches} noarch - ongres-stringprep ExclusiveArch: %{java_arches} noarch - onnx ExcludeArch: s390x - onnxruntime ExcludeArch: s390x %{arm} %{ix86} - oomd ExcludeArch: i686 armv7hl - opae ExclusiveArch: x86_64 - opal-prd ExclusiveArch: ppc64le - opam ExcludeArch: %{ix86} - open-vm-tools ExclusiveArch: x86_64 aarch64 ExclusiveArch: %{ix86} x86_64 aarch64 ExclusiveArch: x86_64 - openblas ExclusiveArch: %{openblas_arches} - opencsg ExcludeArch: %{ix86} - opengrm-ngram ExcludeArch: %{ix86} - openjdk-asmtools ExclusiveArch: %{java_arches} noarch - openjdk-asmtools7 ExclusiveArch: %{java_arches} noarch - openjfx ExclusiveArch: %{java_arches} - openjfx8 ExclusiveArch: x86_64 - openlibm ExclusiveArch: %{arm} %{ix86} x86_64 aarch64 %{power64} - openmeeg ExcludeArch: s390x - openmpi ExcludeArch: %{ix86} - openms ExclusiveArch: %{qt5_qtwebengine_arches} ExcludeArch: %{ix86} - openni ExclusiveArch: x86_64 %{arm} - openni-primesense ExclusiveArch: x86_64 %{arm} - openobex ExcludeArch: s390 s390x - openoffice.org-diafilter ExclusiveArch: %{java_arches} - openpgl ExclusiveArch: aarch64 x86_64 - openrgb ExcludeArch: %{ix86} - openscad ExcludeArch: %{ix86} - openshadinglanguage ExcludeArch: %{ix86} %{arm} - openshot ExcludeArch: ppc64le - opensm ExcludeArch: s390 %{arm} - openssl-ibmca ExclusiveArch: s390 s390x - openstack-java-sdk ExclusiveArch: %{java_arches} noarch - opentest4j ExclusiveArch: %{java_arches} noarch - opentype-sanitizer ExcludeArch: %{ix86} - openvdb ExcludeArch: i686 - openvkl ExclusiveArch: aarch64 x86_64 - openxr-simple-playground ExcludeArch: %{ix86} - optee_client ExclusiveArch: aarch64 - optee_os ExclusiveArch: aarch64 - options ExclusiveArch: %{java_arches} noarch - orthorobot ExclusiveArch: %{arm} %{ix86} x86_64 aarch64 ppc64le - os-autoinst ExcludeArch: %{arm} - osbuild-composer ExcludeArch: i686 armv7hl - osgi-annotation ExclusiveArch: %{java_arches} noarch - osgi-compendium ExclusiveArch: %{java_arches} noarch - osgi-core ExclusiveArch: %{java_arches} noarch - osm2pgsql ExcludeArch: %{ix86} - osslsigncode ExcludeArch: i686 - ostree ExcludeArch: %{ix86} - otf2 ExcludeArch: i686 s390x - oz ExcludeArch: %{ix86} - pacemaker ExclusiveArch: aarch64 i686 ppc64le s390x x86_64 %{arm} ExclusiveArch: aarch64 i686 ppc64le s390x x86_64 - pageedit ExclusiveArch: %{qt5_qtwebengine_arches} - paperwork ExcludeArch: %{ix86} - papi ExcludeArch: s390 s390x - papilo ExcludeArch: %{ix86} - paraview ExcludeArch: %{ix86} - pari-nftables ExcludeArch: %{ix86} - parlaylib ExcludeArch: aarch64 s390x arm-hfp ppc64le i686 - parserng ExclusiveArch: %{java_arches} noarch - pasdoc ExclusiveArch: %{fpc_arches} - pcc ExclusiveArch: %{ix86} x86_64 - pcem ExcludeArch: armv7hl i686 ppc64le s390x - pcfi ExclusiveArch: %{java_arches} noarch - pcg-cpp ExcludeArch: %{ix86} - pcm ExclusiveArch: %{ix86} x86_64 - pcp ExcludeArch: %{ix86} - pcp2pdf ExcludeArch: %{ix86} - pdbg ExclusiveArch: ppc64le - pdfarranger ExcludeArch: %{ix86} - pdfbox ExclusiveArch: %{java_arches} noarch - pdftk-java ExclusiveArch: %{java_arches} noarch - pdns ExcludeArch: %{arm} %{ix86} - pdns-recursor ExcludeArch: %{arm} %{ix86} - pdqsort ExcludeArch: %{ix86} - pengupop ExcludeArch: s390x - pentaho-libxml ExclusiveArch: %{java_arches} noarch - pentaho-reporting-flow-engine ExclusiveArch: %{java_arches} noarch - perftest ExcludeArch: s390 %{arm} - perl-Dumbbench ExclusiveArch: %{ix86} x86_64 noarch - perl-LMDB_File ExcludeArch: armv7hl i686 - perl-Math-Int128 ExcludeArch: %{arm32} %{ix86} - perl-MaxMind-DB-Reader-XS ExcludeArch: %{arm} %{ix86} - perl-MongoDB ExcludeArch: ppc %{sparc} s390 - perl-Net-Works ExcludeArch: %{arm32} %{ix86} - perl-Parse-DMIDecode ExclusiveArch: %{ix86} x86_64 ia64 aarch64 - perl-Task-Catalyst ExcludeArch: %{ix86} - perl-threads-lite ExcludeArch: aarch64 ppc ppc64 ppc64le - permlib ExcludeArch: %{ix86} - pesign ExclusiveArch: %{ix86} x86_64 ia64 aarch64 %{arm} riscv64 - pesign-test-app ExclusiveArch: x86_64 - petpvc ExcludeArch: %{ix86} - pf-bb-config ExcludeArch: s390x - pgadmin4 ExcludeArch: i686 armv7hl s390x ppc64le - phd2 ExcludeArch: %{ix86} - phosh ExcludeArch: i686 - phosh-mobile-settings ExcludeArch: i686 - php ExcludeArch: %{ix86} - php-ast ExcludeArch: %{ix86} - php-facedetect ExcludeArch: %{ix86} - php-geos ExcludeArch: %{ix86} - php-libvirt ExcludeArch: %{ix86} - php-maxminddb ExcludeArch: %{ix86} - php-pecl-amqp ExcludeArch: %{ix86} - php-pecl-apcu ExcludeArch: %{ix86} - php-pecl-apfd ExcludeArch: %{ix86} - php-pecl-dio ExcludeArch: %{ix86} - php-pecl-ds ExcludeArch: %{ix86} - php-pecl-event ExcludeArch: %{ix86} - php-pecl-fann ExcludeArch: %{ix86} - php-pecl-gearman ExcludeArch: %{ix86} - php-pecl-geoip ExcludeArch: %{ix86} - php-pecl-gmagick ExcludeArch: %{ix86} - php-pecl-http ExcludeArch: %{ix86} - php-pecl-igbinary ExcludeArch: %{ix86} - php-pecl-imagick ExcludeArch: %{ix86} - php-pecl-inotify ExcludeArch: %{ix86} - php-pecl-ip2location ExcludeArch: %{ix86} - php-pecl-json-post ExcludeArch: %{ix86} - php-pecl-krb5 ExcludeArch: %{ix86} - php-pecl-lzf ExcludeArch: %{ix86} - php-pecl-mailparse ExcludeArch: %{ix86} - php-pecl-mcrypt ExcludeArch: %{ix86} - php-pecl-memcache ExcludeArch: %{ix86} - php-pecl-memcached ExcludeArch: %{ix86} - php-pecl-mongodb ExcludeArch: %{ix86} - php-pecl-msgpack ExcludeArch: %{ix86} - php-pecl-oauth ExcludeArch: %{ix86} - php-pecl-pcov ExcludeArch: %{ix86} - php-pecl-pq ExcludeArch: %{ix86} - php-pecl-raphf ExcludeArch: %{ix86} - php-pecl-redis5 ExcludeArch: %{ix86} - php-pecl-rpminfo ExcludeArch: %{ix86} - php-pecl-rrd ExcludeArch: %{ix86} - php-pecl-selinux ExcludeArch: %{ix86} - php-pecl-ssdeep ExcludeArch: %{ix86} - php-pecl-ssh2 ExcludeArch: %{ix86} - php-pecl-uopz ExcludeArch: %{ix86} - php-pecl-uuid ExcludeArch: %{ix86} - php-pecl-var-representation ExcludeArch: %{ix86} - php-pecl-xattr ExcludeArch: %{ix86} - php-pecl-xdebug3 ExcludeArch: %{ix86} - php-pecl-xmldiff ExcludeArch: %{ix86} - php-pecl-xmlrpc ExcludeArch: %{ix86} - php-pecl-yac ExcludeArch: %{ix86} - php-pecl-zip ExcludeArch: %{ix86} - php-phpiredis ExcludeArch: %{ix86} - php-smbclient ExcludeArch: %{ix86} - php-zmq ExcludeArch: %{ix86} - php-zstd ExcludeArch: %{ix86} - picard ExcludeArch: ppc64 - picocli ExclusiveArch: %{java_arches} noarch - pigeonascent ExcludeArch: ppc64le ExcludeArch: s390x - pilot-link ExcludeArch: s390 s390x - pinta ExclusiveArch: %mono_arches ExcludeArch: armv7hl - pioneer ExclusiveArch: %{ix86} x86_64 - pl ExcludeArch: %{ix86} - planets ExcludeArch: %{ix86} - plantri ExcludeArch: %{ix86} - plantuml ExclusiveArch: %{java_arches} noarch - plasma-dialer ExclusiveArch: %{java_arches} - plasma-disks ExcludeArch: %{ix86} - playonlinux ExclusiveArch: %{arm} aarch64 %{ix86} x86_64 - plee-the-bear ExcludeArch: %{power64} - plexus-archiver ExclusiveArch: %{java_arches} noarch - plexus-build-api ExclusiveArch: %{java_arches} noarch - plexus-build-api0 ExclusiveArch: %{java_arches} noarch - plexus-cipher ExclusiveArch: %{java_arches} noarch - plexus-classworlds ExclusiveArch: %{java_arches} noarch - plexus-compiler ExclusiveArch: %{java_arches} noarch - plexus-component-api ExclusiveArch: %{java_arches} noarch - plexus-components-pom ExclusiveArch: %{java_arches} noarch - plexus-containers ExclusiveArch: %{java_arches} noarch - plexus-i18n ExclusiveArch: %{java_arches} noarch - plexus-interpolation ExclusiveArch: %{java_arches} noarch - plexus-io ExclusiveArch: %{java_arches} noarch - plexus-languages ExclusiveArch: %{java_arches} noarch - plexus-pom ExclusiveArch: %{java_arches} noarch - plexus-resources ExclusiveArch: %{java_arches} noarch - plexus-sec-dispatcher ExclusiveArch: %{java_arches} noarch - plexus-testing ExclusiveArch: %{java_arches} noarch - plexus-utils ExclusiveArch: %{java_arches} noarch - plexus-velocity ExclusiveArch: %{java_arches} noarch - plexus-xml ExclusiveArch: %{java_arches} noarch - pmix ExcludeArch: %{ix86} - pngcheck ExcludeArch: %{ix86} - podman ExclusiveArch: %{golang_arches_future} ExclusiveArch: aarch64 ppc64le s390x x86_64 - polymake ExcludeArch: %{ix86} - polyml ExcludeArch: %{ix86} - poppler-sharp ExclusiveArch: %mono_arches - popub ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 %{arm}} - postgresql-jdbc ExclusiveArch: %{java_arches} noarch - postgresql-pgpool-II ExcludeArch: %{ix86} ExcludeArch: %{ix86} ExcludeArch: %{ix86} - powerpc-utils ExclusiveArch: ppc %{power64} - powerstat ExclusiveArch: %{ix86} x86_64 - ppc64-diag ExclusiveArch: ppc %{power64} - ppl ExcludeArch: %{ix86} - pplite ExcludeArch: %{ix86} - prestopalette ExcludeArch: i686 - printer-driver-brlaser ExcludeArch: %{ix86} - procdump ExcludeArch: ppc64le - procyon ExclusiveArch: %{java_arches} noarch ExclusiveArch: %{java_arches} noarch ExclusiveArch: %{java_arches} noarch ExclusiveArch: %{java_arches} noarch ExclusiveArch: %{java_arches} noarch ExclusiveArch: %{java_arches} noarch - proguard ExclusiveArch: %{java_arches} noarch - prometheus-jmx-exporter ExclusiveArch: %{java_arches} noarch - prometheus-simpleclient-java ExclusiveArch: %{java_arches} noarch - prooftree ExcludeArch: %{ix86} - proxmark3 ExcludeArch: ppc64le s390x - proxygen ExclusiveArch: x86_64 aarch64 ppc64le - proxysql ExcludeArch: %{power64} s390x %{ix86} - prrte ExcludeArch: %{ix86} - prusa-slicer ExcludeArch: %{ix86} - psblas3 ExcludeArch: %{ix86} - pveclib ExclusiveArch: ppc %{power64} - pygrib ExcludeArch: i686 ExcludeArch: armv7hl - pygsl ExcludeArch: %{ix86} - pyosmium ExcludeArch: %{ix86} - pypy ExcludeArch: %{ix86} - pypy3.10 ExcludeArch: %{ix86} - pypy3.9 ExcludeArch: %{ix86} - pyqtwebengine ExclusiveArch: %{qt5_qtwebengine_arches} - python-ZEO ExcludeArch: %{ix86} - python-ZODB3 ExcludeArch: %{ix86} - python-aioresponses ExcludeArch: s390x - python-annarchy ExcludeArch: %{ix86} ppc64le - python-ast-monitor ExclusiveArch: %{qt6_qtwebengine_arches} noarch - python-astroplan ExcludeArch: %{ix86} - python-astroscrappy ExcludeArch: %{ix86} - python-asyncmy ExcludeArch: %{ix86} - python-aws-sam-translator ExcludeArch: %{ix86} - python-awscrt ExcludeArch: s390x - python-bitstruct ExcludeArch: s390x - python-blosc2 ExcludeArch: %{ix86} - python-bluepyopt ExcludeArch: s390x %{ix86} %{power64} - python-calcephpy ExcludeArch: %{ix86} - python-colorthief ExcludeArch: %{ix86} - python-compreffor ExcludeArch: %{ix86} - python-contextualbandits ExcludeArch: %{ix86} - python-cradox ExcludeArch: i686 armv7hl - python-cryptography ExclusiveArch: %{rust_arches} - python-cvxopt ExcludeArch: %{ix86} - python-cyipopt ExcludeArch: %{ix86} - python-dask ExcludeArch: %{ix86} - python-databases ExcludeArch: %{ix86} - python-devicely ExcludeArch: s390x - python-dijitso ExcludeArch: i686 - python-dipy ExcludeArch: %{ix86} s390x - python-ducc0 ExcludeArch: %{ix86} - python-earthpy ExcludeArch: %{ix86} - python-eccodes ExcludeArch: i686 ExcludeArch: armv7hl - python-efel ExcludeArch: s390x - python-elephant ExcludeArch: s390x ExcludeArch: %{ix86} - python-ephyviewer ExcludeArch: s390x %{ix86} - python-etcd ExclusiveArch: noarch %{ix86} x86_64 %{arm} aarch64 ppc64le s390x riscv64 - python-fastavro ExcludeArch: %{arm32} %{ix86} - python-folium ExcludeArch: %{ix86} - python-formulaic ExcludeArch: %{ix86} - python-fsleyes ExcludeArch: %{ix86} - python-fsleyes-props ExcludeArch: %{ix86} - python-fslpy ExcludeArch: %{ix86} - python-gbinder ExcludeArch: %{ix86} - python-giacpy ExcludeArch: aarch64 %{power64} s390x - python-graph-tool ExcludeArch: %{ix86} - python-hdfs ExcludeArch: %{ix86} - python-healpy ExcludeArch: %{ix86} %{arm} - python-heapdict ExcludeArch: %{ix86} - python-imagecodecs ExcludeArch: %{ix86} - python-img2pdf ExcludeArch: s390x - python-javaobj ExclusiveArch: %{java_arches} noarch - python-jnius ExclusiveArch: %{java_arches} ExclusiveArch: %{java_arches} - python-json-minify ExcludeArch: %{ix86} - python-jupymake ExcludeArch: %{ix86} - python-jupyter-c-kernel ExcludeArch: %{ix86} - python-jupyter-kernel-singular ExcludeArch: %{ix86} - python-jupyter-polymake ExcludeArch: %{ix86} - python-jupyter-sphinx ExcludeArch: %{ix86} - python-jupytext ExcludeArch: s390x - python-lazy-ops ExcludeArch: %{ix86} - python-lfpy ExcludeArch: mips64r2 mips32r2 ExcludeArch: %{power64} %{ix86} armv7hl - python-llama-cpp-python ExclusiveArch: x86_64 aarch64 - python-mapnik ExcludeArch: ppc ppc64 s390 s390x - python-missingno ExcludeArch: %{ix86} - python-mne ExcludeArch: %{ix86} - python-mne-bids ExcludeArch: %{ix86} - python-mplcairo ExcludeArch: %{ix86} - python-mplcursors ExcludeArch: %{ix86} - python-music21 ExcludeArch: %{ix86} - python-ndindex ExcludeArch: %{ix86} - python-neatdend ExcludeArch: %{ix86} - python-neo ExcludeArch: s390x - python-netpyne ExcludeArch: %{ix86} - python-neurom ExcludeArch: %{ix86} - python-neurotune ExcludeArch: %{ix86} - python-nifti-mrs ExcludeArch: %{ix86} - python-nilearn ExcludeArch: %{ix86} - python-nipy ExcludeArch: %{ix86} - python-octave-kernel ExcludeArch: %{ix86} - python-openoffice ExclusiveArch: noarch x86_64 - python-openpaperwork-core ExcludeArch: %{ix86} - python-openpaperwork-gtk ExcludeArch: %{ix86} - python-opentype-sanitizer ExcludeArch: %{ix86} - python-pandas ExcludeArch: %{ix86} - python-pandas-flavor ExcludeArch: %{ix86} - python-papermill ExcludeArch: %{ix86} - python-paperwork-backend ExcludeArch: %{ix86} - python-pari-jupyter ExcludeArch: %{ix86} - python-phyghtmap ExcludeArch: %{ix86} - python-pingouin ExcludeArch: %{ix86} - python-plotnine ExcludeArch: %{ix86} - python-pplpy ExcludeArch: %{ix86} - python-primecountpy ExcludeArch: %{ix86} - python-psycopg3 ExcludeArch: %{ix86} - python-pyahocorasick ExclusiveArch: x86_64 %{arm64} ppc64le riscv64 - python-pybids ExcludeArch: %{ix86} - python-pybv ExcludeArch: %{ix86} - python-pyedflib ExcludeArch: s390x - python-pyfastnoisesimd ExcludeArch: %{ix86} - python-pyfiglet ExcludeArch: %{ix86} - python-pykdtree ExcludeArch: %{ix86} - python-pyliblzfse ExcludeArch: s390x - python-pymapvbvd ExcludeArch: s390x - python-pymatreader ExcludeArch: %{ix86} ExcludeArch: s390x - python-pynn ExcludeArch: mips64r2 mips32r2 s390x %{ix86} - python-pyocr ExcludeArch: %{ix86} - python-pypet ExcludeArch: %{ix86} ExcludeArch: s390x - python-pyphi ExcludeArch: %{ix86} s390x - python-pypillowfight ExcludeArch: %{ix86} - python-pyqt6-webengine ExclusiveArch: %{qt6_qtwebengine_arches} - python-pyriemann ExcludeArch: %{ix86} - python-pyroaring ExcludeArch: %{ix86} - python-pyscf ExcludeArch: %{power64} - python-pyshtools ExcludeArch: %{ix86} - python-pysingular ExcludeArch: %{ix86} - python-pyswarms ExcludeArch: %{ix86} - python-pyswip ExcludeArch: %{ix86} - python-pytest-arraydiff ExcludeArch: %{ix86} - python-pytest-tornado ExcludeArch: %{ix86} - python-python-fcl ExcludeArch: %{ix86} - python-pyunicorn ExcludeArch: %{ix86} - python-pyvat ExcludeArch: %{ix86} - python-ratinabox ExcludeArch: %{ix86} - python-recordclass ExcludeArch: %{ix86} - python-reproject ExcludeArch: %{ix86} - python-ruffus ExcludeArch: %{ix86} - python-scikit-learn ExcludeArch: %{ix86} - python-scikit-misc ExcludeArch: %{ix86} - python-sgp4 ExcludeArch: %{ix86} - python-simplebayes ExcludeArch: %{ix86} - python-sklearn-genetic-opt ExcludeArch: %{ix86} - python-statsmodels ExcludeArch: %{ix86} - python-steps ExcludeArch: %{ix86} - python-tables ExcludeArch: %{ix86} - python-tdlib ExcludeArch: %{ix86} - python-tensile ExclusiveArch: x86_64 - python-tensordict ExclusiveArch: x86_64 aarch64 - python-tkrzw ExcludeArch: i686 - python-torch ExclusiveArch: x86_64 aarch64 - python-torchaudio ExclusiveArch: x86_64 aarch64 - python-torchdata ExclusiveArch: x86_64 aarch64 - python-torchtext ExclusiveArch: x86_64 aarch64 - python-torchvision ExclusiveArch: x86_64 aarch64 - python-traitsui ExcludeArch: ppc64le - python-trimesh ExcludeArch: %{ix86} - python-uranium ExcludeArch: %{ix86} - python-willow ExcludeArch: %{ix86} - python-xattr ExcludeArch: %{ix86} - python-xbout ExcludeArch: %{ix86} - python-xmp-toolkit ExcludeArch: %{ix86} - python-zeep ExcludeArch: s390x - python-zict ExcludeArch: %{ix86} - q4wine ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 - qalculate-qt ExcludeArch: %{ix86} - qatengine ExclusiveArch: x86_64 - qatlib ExcludeArch: %{arm} aarch64 %{power64} s390x i686 - qatzip ExclusiveArch: x86_64 - qbe ExclusiveArch: x86_64 aarch64 riscv64 - qbittorrent ExcludeArch: %{ix86} - qbs ExcludeArch: i686 - qcas ExcludeArch: aarch64 %{power64} s390x - qcint ExclusiveArch: x86_64 - qclib ExclusiveArch: s390 s390x - qdigidoc ExcludeArch: %{ix86} - qdox ExclusiveArch: %{java_arches} noarch - qemu-sanity-check ExclusiveArch: %{kernel_arches} ExcludeArch: %{power64} - qevercloud ExclusiveArch: %{qt5_qtwebengine_arches} - qflipper ExcludeArch: %{ix86} - qmapshack ExclusiveArch: %{qt5_qtwebengine_arches} - qmplay2 ExcludeArch: %{ix86} - qoauth ExcludeArch: ppc64 - qownnotes ExcludeArch: %{ix86} - qpdfview ExcludeArch: s390x - qperf ExcludeArch: %{arm} - qsopt-ex ExcludeArch: %{ix86} - qt4pas ExclusiveArch: %{fpc_arches} - qt5-qtwebengine ExclusiveArch: %{qt5_qtwebengine_arches} - qt6-qtquick3dphysics ExclusiveArch: aarch64 i686 x86_64 - qt6-qtwebengine ExclusiveArch: aarch64 x86_64 - qt6-qtwebview ExclusiveArch: aarch64 x86_64 - qt6ct ExcludeArch: s390x - qtile ExcludeArch: %{ix86} - quantum-espresso ExclusiveArch: x86_64 aarch64 %{power64} - quentier ExclusiveArch: %{qt5_qtwebengine_arches} - rEFInd ExclusiveArch: %{efi} ExcludeArch: %{arm32} - rasdaemon ExcludeArch: s390 s390x - rccl ExclusiveArch: x86_64 - rdma-core ExcludeArch: %{arm} - realtime-tests ExcludeArch: %{arm} - rear ExclusiveArch: %ix86 x86_64 ppc ppc64 ppc64le ia64 s390x - redeclipse ExcludeArch: %{ix86} - redict ExcludeArch: %{ix86} - reflections ExclusiveArch: %{java_arches} noarch - reg ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 aarch64 %{arm}} - regexp ExclusiveArch: %{java_arches} noarch - relaxng-datatype-java ExclusiveArch: %{java_arches} noarch - remake ExcludeArch: %{ix86} - renderdoc ExclusiveArch: x86_64 aarch64 - replacer ExclusiveArch: %{java_arches} noarch - reptyr ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 - rescene ExclusiveArch: %{mono_arches} - resteasy ExclusiveArch: %{java_arches} noarch - restool ExclusiveArch: aarch64 - restsharp ExclusiveArch: %{mono_arches} ExcludeArch: armv7hl - retroarch ExcludeArch: %{ix86} ExcludeArch: s390x - retsnoop ExclusiveArch: %{rust_arches} ExcludeArch: armv7hl - rhino ExclusiveArch: %{java_arches} noarch ExcludeArch: %{ix86} - rhythmbox ExcludeArch: s390 s390x - rhythmbox-alternative-toolbar ExcludeArch: s390 s390x - rhythmbox-ampache ExcludeArch: s390 s390x - river ExclusiveArch: %{zig_arches} - rkcommon ExclusiveArch: x86_64 aarch64 - rocalution ExclusiveArch: x86_64 - rocblas ExclusiveArch: x86_64 - rocclr ExclusiveArch: x86_64 - rocfft ExclusiveArch: x86_64 - rocm-compilersupport ExclusiveArch: x86_64 aarch64 ppc64le - rocm-core ExclusiveArch: x86_64 - rocm-rpm-macros ExclusiveArch: x86_64 - rocm-runtime ExclusiveArch: x86_64 - rocm-smi ExclusiveArch: x86_64 aarch64 ppc64le riscv64 - rocminfo ExclusiveArch: x86_64 - rocprim ExclusiveArch: x86_64 - rocrand ExclusiveArch: x86_64 - rocsolver ExclusiveArch: x86_64 - rocsparse ExclusiveArch: x86_64 - rocthrust ExclusiveArch: x86_64 - roctracer ExclusiveArch: x86_64 - rpi-imager ExcludeArch: s390x - rpm-ostree ExclusiveArch: %{rust_arches} ExcludeArch: %{ix86} - rpy ExcludeArch: %{ix86} - rr ExclusiveArch: %{ix86} x86_64 aarch64 - rssguard ExclusiveArch: %{qt6_qtwebengine_arches} - rstudio ExclusiveArch: %{java_arches} - rsyntaxtextarea ExclusiveArch: %{java_arches} noarch - rubiks ExcludeArch: %{ix86} - rubygem-childprocess ExclusiveArch: %{ix86} x86_64 noarch - ruff ExcludeArch: %{ix86} - ruff-lsp ExcludeArch: %{ix86} - runc ExclusiveArch: %{golang_arches_future} - rundoc ExclusiveArch: %{java_arches} noarch - rust ExclusiveArch: %{rust_arches} - rust-bankstown-lv2 ExcludeArch: ppc64le s390x - rust-below ExcludeArch: %{arm32} %{ix86} - rust-below-btrfs ExcludeArch: %{arm32} %{ix86} - rust-below-config ExcludeArch: %{arm32} %{ix86} - rust-below-dump ExcludeArch: %{arm32} %{ix86} - rust-below-ethtool ExcludeArch: %{arm32} %{ix86} - rust-below-model ExcludeArch: %{arm32} %{ix86} - rust-below-render ExcludeArch: %{arm32} %{ix86} - rust-below-store ExcludeArch: %{arm32} %{ix86} - rust-below-view ExcludeArch: %{arm32} %{ix86} - rust-cgroupfs ExcludeArch: %{arm32} %{ix86} - rust-compress-tools ExclusiveArch: %{rust_arches} - rust-crypto-auditing-agent ExcludeArch: i386 i686 - rust-ct-logs ExcludeArch: ppc64le s390x - rust-ctr ExclusiveArch: %{rust_arches} - rust-dashmap4 ExclusiveArch: %{rust_arches} - rust-deflate ExclusiveArch: %{rust_arches} - rust-deflate0.8 ExclusiveArch: %{rust_arches} - rust-getch ExclusiveArch: %{rust_arches} - rust-gzip-header ExclusiveArch: %{rust_arches} - rust-hamming ExclusiveArch: %{rust_arches} - rust-hidapi ExclusiveArch: %{rust_arches} - rust-humantime-serde ExclusiveArch: %{rust_arches} - rust-hyperlocal ExclusiveArch: %{rust_arches} - rust-inflate ExclusiveArch: %{rust_arches} - rust-k9 ExclusiveArch: %{rust_arches} - rust-krunvm ExclusiveArch: x86_64 aarch64 - rust-kstring ExclusiveArch: %{rust_arches} - rust-kvm-bindings ExcludeArch: %{ix86} - rust-kvm-ioctls ExclusiveArch: x86_64 aarch64 - rust-lebe ExclusiveArch: %{rust_arches} - rust-lv2 ExcludeArch: ppc64le s390x - rust-lv2-atom ExcludeArch: ppc64le s390x - rust-lv2-core ExcludeArch: ppc64le s390x - rust-lv2-midi ExcludeArch: ppc64le s390x - rust-lv2-state ExcludeArch: ppc64le s390x - rust-lv2-sys ExcludeArch: ppc64le s390x - rust-lv2-time ExcludeArch: ppc64le s390x - rust-lv2-units ExcludeArch: ppc64le s390x - rust-lv2-urid ExcludeArch: ppc64le s390x - rust-lv2-worker ExcludeArch: ppc64le s390x - rust-msru ExclusiveArch: x86_64 - rust-netstat2 ExclusiveArch: %{rust_arches} - rust-nu ExcludeArch: %{ix86} - rust-oci-spec ExcludeArch: %{ix86} ExcludeArch: %{ix86} ExcludeArch: %{ix86} ExcludeArch: %{ix86} ExcludeArch: %{ix86} ExcludeArch: %{ix86} ExcludeArch: %{ix86} - rust-onig ExclusiveArch: %{rust_arches} - rust-openat-ext ExclusiveArch: %{rust_arches} - rust-os_type ExclusiveArch: %{rust_arches} - rust-pager ExclusiveArch: %{rust_arches} - rust-pathsearch ExclusiveArch: %{rust_arches} - rust-prefixdevname ExcludeArch: %{ix86} - rust-pretty-bytes ExclusiveArch: %{rust_arches} - rust-probe ExcludeArch: ppc64le s390x - rust-psl-types ExclusiveArch: %{rust_arches} - rust-psm ExclusiveArch: %{rust_arches} - rust-pwd ExclusiveArch: %{rust_arches} - rust-rand_core ExclusiveArch: %{rust_arches} - rust-resctrlfs ExcludeArch: %{arm32} %{ix86} - rust-schemafy_core ExclusiveArch: %{rust_arches} - rust-schemafy_lib ExclusiveArch: %{rust_arches} - rust-scx_layered ExcludeArch: %{ix86} - rust-scx_rustland ExcludeArch: %{ix86} - rust-scx_rusty ExcludeArch: %{ix86} - rust-scx_utils ExcludeArch: %{ix86} - rust-seahash ExclusiveArch: %{rust_arches} - rust-sequoia-octopus-librnp ExcludeArch: %{ix86} %{arm} s390x - rust-serde_yaml0.8 ExclusiveArch: %{rust_arches} - rust-sev ExclusiveArch: x86_64 - rust-sevctl ExclusiveArch: x86_64 - rust-sinit ExclusiveArch: %{rust_arches} - rust-snphost ExclusiveArch: x86_64 - rust-ssh-key-dir ExclusiveArch: %{rust_arches} - rust-stacker ExclusiveArch: %{rust_arches} - rust-structopt ExclusiveArch: %{rust_arches} - rust-tiny-dfr ExcludeArch: %{ix86} - rust-totp-lite ExclusiveArch: %{rust_arches} - rust-tower-layer ExclusiveArch: %{rust_arches} - rust-tpm2-policy ExclusiveArch: %{rust_arches} - rust-unicode-xid ExclusiveArch: %{rust_arches} - rust-uriparse ExclusiveArch: %{rust_arches} - rust-varlink_generator ExclusiveArch: %{rust_arches} - rust-varlink_parser ExclusiveArch: %{rust_arches} - rust-vhost-device-scmi ExcludeArch: s390x - rust-vhost-device-sound ExcludeArch: %{ix86} s390x - rust-virtio-bindings ExclusiveArch: x86_64 aarch64 ppc64le riscv64 - rust-virtio-queue ExcludeArch: i686 - rust-vm-memory ExcludeArch: %{ix86} - rust-vmm-sys-util ExclusiveArch: x86_64 aarch64 ppc64le riscv64 - rust-vtparse ExclusiveArch: %{rust_arches} - rust-web-ext-native-messaging ExclusiveArch: %{rust_arches} - rust-wezterm-color-types ExclusiveArch: %{rust_arches} - rust-wezterm-dynamic ExclusiveArch: %{rust_arches} - rust-wezterm-dynamic-derive ExclusiveArch: %{rust_arches} - rust-zbus1 ExclusiveArch: %{rust_arches} - rust-zbus_macros1 ExclusiveArch: %{rust_arches} - rust-zincati ExcludeArch: armv7hl i686 - rust-zvariant2 ExclusiveArch: %{rust_arches} - rust-zvariant_derive2 ExclusiveArch: %{rust_arches} - rustup ExclusiveArch: x86_64 aarch64 - rutabaga-gfx-ffi ExclusiveArch: x86_64 aarch64 - s2n-tls ExcludeArch: %{ix86} ExcludeArch: s390x - s390utils ExcludeArch: %{ix86} - sac ExclusiveArch: %{java_arches} noarch - safeint ExcludeArch: %{ix86} - safetyblanket ExclusiveArch: %{arm} %{ix86} x86_64 aarch64 ppc64le - sandia-omega-h ExcludeArch: %{ix86} s390x - sat4j ExclusiveArch: %{java_arches} noarch - sayonara ExcludeArch: %{ix86} - sbcl ExclusiveArch: %{ix86} x86_64 aarch64 %{power64} - sbd ExclusiveArch: i686 x86_64 s390x aarch64 ppc64le - sblim-cim-client ExclusiveArch: %{java_arches} noarch - sblim-cim-client2 ExclusiveArch: %{java_arches} noarch - sbsigntools ExclusiveArch: x86_64 aarch64 %{arm} %{ix86} - scala ExclusiveArch: %{java_arches} noarch - scalasca ExcludeArch: s390 s390x armv7hl i686 - scannotation ExclusiveArch: %{java_arches} noarch - scip ExcludeArch: %{ix86} - scorep ExcludeArch: s390 s390x armv7hl i686 - scx_c_schedulers ExcludeArch: %{ix86} - sdljava ExclusiveArch: %{java_arches} - sdrangel ExclusiveArch: %{qt5_qtwebengine_arches} - sdsl-lite ExclusiveArch: %{power64} x86_64 aarch64 - sdubby ExclusiveArch: %{efi} - seabios ExclusiveArch: x86_64 - seadrive-gui ExclusiveArch: %{qt5_qtwebengine_arches} - seafile-client ExclusiveArch: %{qt6_qtwebengine_arches} - seamonkey ExclusiveArch: x86_64 - sedutil ExcludeArch: ppc ppc64 s390 s390x - sentencepiece ExcludeArch: s390x - seqan3 ExclusiveArch: %{power64} x86_64 aarch64 - sequeler ExcludeArch: %{ix86} - sequence-library ExclusiveArch: %{java_arches} noarch - servicelog ExclusiveArch: ppc %{power64} - setserial ExcludeArch: s390 s390x - sfnt2woff-zopfli ExcludeArch: %{ix86} - sharedmeataxe ExcludeArch: %{ix86} - sharpfont ExclusiveArch: %mono_arches - sharpziplib ExclusiveArch: %{mono_arches} - shim ExclusiveArch: %{efi} ExcludeArch: %{ix86} ExcludeArch: %{arm} - shim-unsigned-aarch64 ExclusiveArch: aarch64 - shim-unsigned-x64 ExclusiveArch: x86_64 - sigil ExclusiveArch: %{qt5_qtwebengine_arches} ExcludeArch: %{ix86} - sigul ExclusiveArch: x86_64 ExcludeArch: %{ix86} - simdutf ExcludeArch: s390 s390x - singularity-ce ExclusiveArch: %{go_arches} ExcludeArch: %{ix86} - sirocco ExcludeArch: %{ix86} - sisu ExclusiveArch: %{java_arches} noarch - sisu-mojos ExclusiveArch: %{java_arches} noarch - skanpage ExclusiveArch: %{qt6_qtwebengine_arches} - ski ExcludeArch: %{ix86} ExcludeArch: aarch64 - skopeo ExclusiveArch: %{golang_arches_future} ExclusiveArch: aarch64 ppc64le s390x x86_64 - skychart ExclusiveArch: %{fpc_arches} ExcludeArch: %{ix86} - slapi-nis ExcludeArch: %{ix86} - sleef ExcludeArch: %{ix86} - slf4j ExclusiveArch: %{java_arches} noarch - slic3r ExcludeArch: %{ix86} ExcludeArch: ppc ppc64 s390 s390x %{ix86} ExcludeArch: ppc ppc64 s390 s390x - slick-greeter ExcludeArch: %{ix86} - slimdata ExcludeArch: ppc64 ppc sparcv9 sparc64 - slirp4netns ExclusiveArch: %{golang_arches_future} - slurm ExcludeArch: armv7hl ExcludeArch: i686 - smartmontools ExcludeArch: %{ix86} - snakeyaml ExclusiveArch: %{java_arches} noarch - snapd ExclusiveArch: %{?golang_arches}%{!?golang_arches:%{ix86} x86_64 %{arm} aarch64 ppc64le s390x} - snapshot ExcludeArch: %{ix86} - snip ExclusiveArch: %{java_arches} noarch - softnet-stat ExclusiveArch: %{rust_arches} - soplex ExcludeArch: %{ix86} - sound-juicer ExcludeArch: s390 s390x - soup-sharp ExclusiveArch: %{mono_arches} - sourcextractor++ ExcludeArch: %{ix86} - spacebar ExclusiveArch: %{java_arches} - sparkleshare ExclusiveArch: %{mono_arches} ExcludeArch: %{ix86} - spasm ExcludeArch: %{ix86} - spec-version-maven-plugin ExclusiveArch: %{java_arches} noarch - speed-dreams ExcludeArch: s390x - spicctrl ExclusiveArch: %{ix86} x86_64 - spice ExclusiveArch: x86_64 ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 riscv64 - spice-parent ExclusiveArch: %{java_arches} noarch - springlobby ExclusiveArch: %{ix86} x86_64 - spyder ExcludeArch: %{ix86} ExclusiveArch: %{qt5_qtwebengine_arches} noarch - squeekboard ExclusiveArch: %{rust_arches} ExcludeArch: ppc64le ExcludeArch: s390x - squirrel ExcludeArch: %{ix86} - startdde ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 %{arm}} - stats-collect ExclusiveArch: %{ix86} x86_64 noarch - statsd ExclusiveArch: %{nodejs_arches} noarch - statserial ExcludeArch: s390 s390x - steinberg-bravura-fonts ExcludeArch: %{ix86} - steinberg-petaluma-fonts ExcludeArch: %{ix86} - stellarium ExcludeArch: armv7hl - stlsplit ExcludeArch: %{ix86} - stp ExcludeArch: %{ix86} - stratis-cli ExclusiveArch: %{rust_arches} noarch ExcludeArch: i686 - stratisd ExclusiveArch: %{rust_arches} ExcludeArch: i686 ExclusiveArch: %{rust_arches} ExcludeArch: i686 ExclusiveArch: %{rust_arches} ExcludeArch: i686 - string-template-maven-plugin ExclusiveArch: %{java_arches} noarch - stringtemplate ExclusiveArch: %{java_arches} noarch - stringtemplate4 ExclusiveArch: %{java_arches} noarch - stripesnoop ExclusiveArch: %{ix86} x86_64 - subscription-manager-cockpit ExclusiveArch: %{nodejs_arches} noarch - supercollider ExclusiveArch: %{qt5_qtwebengine_arches} - supermin ExcludeArch: %{ix86} ExclusiveArch: %{kernel_arches} ExcludeArch: %{power64} - supertux ExcludeArch: s390x - suricata ExcludeArch: ppc64le i686 - svt-vp9 ExclusiveArch: x86_64 - swift-lang ExclusiveArch: x86_64 aarch64 - swiftlint ExclusiveArch: x86_64 aarch64 - swing-layout ExclusiveArch: %{java_arches} noarch - symfpu ExcludeArch: %{ix86} - symmetrica ExcludeArch: %{ix86} - sympol ExcludeArch: %{ix86} - sympow ExcludeArch: %{ix86} - synfig ExcludeArch: ppc64le - synfigstudio ExcludeArch: ppc64le - sysbench ExclusiveArch: %{arm} %{ix86} x86_64 %{mips} ExclusiveArch: %{arm} %{ix86} x86_64 %{mips} aarch64 ExclusiveArch: %{arm} %{ix86} x86_64 %{mips} aarch64 ppc64le s390x - syslinux ExclusiveArch: %{ix86} x86_64 ExclusiveArch: %{ix86} x86_64 - system-rules ExclusiveArch: %{java_arches} noarch - systemd-boot ExclusiveArch: %efi - t-digest ExclusiveArch: %{java_arches} noarch - taglib-sharp ExclusiveArch: %{mono_arches} - tagsoup ExclusiveArch: %{java_arches} noarch - tarantool ExclusiveArch: %{ix86} x86_64 - tboot ExclusiveArch: %{ix86} x86_64 - tcmu-runner ExcludeArch: i686 armv7hl - tdlib ExclusiveArch: x86_64 aarch64 - teem ExcludeArch: %{ix86} - templates_parser ExclusiveArch: %GPRbuild_arches - terminology ExcludeArch: s390x - terminus-fonts ExcludeArch: %{grub2_exclude_arches} - ternimal ExclusiveArch: %{rust_arches} - testcloud ExclusiveArch: %{kernel_arches} noarch - testng ExclusiveArch: %{java_arches} noarch - texlive ExclusiveArch: %{java_arches} noarch - texmaker ExclusiveArch: %{qt6_qtwebengine_arches} ExcludeArch: ppc64 ppc64le s390x - thermald ExclusiveArch: %{ix86} x86_64 - thunderbird ExcludeArch: armv7hl ExcludeArch: s390x - tiled ExcludeArch: %{ix86} - tilix ExclusiveArch: %{ldc_arches} - tinygo ExcludeArch: ppc64le s390x ExcludeArch: %{ix86} - tokodon ExclusiveArch: %{qt6_qtwebengine_arches} - tomboy ExclusiveArch: %{mono_arches} - tomcat ExclusiveArch: %{java_arches} noarch - tomcat-jakartaee-migration ExclusiveArch: %{java_arches} noarch - tomcat-native ExclusiveArch: %{java_arches} - tomcat-taglibs-parent ExclusiveArch: %{java_arches} noarch - torbrowser-launcher ExclusiveArch: %{ix86} x86_64 - trace-cmd ExcludeArch: %{ix86} %{arm} - trafficserver ExcludeArch: %{arm} %{ix86} s390x - treelayout ExclusiveArch: %{java_arches} noarch - trilead-ssh2 ExclusiveArch: %{java_arches} noarch - trojita ExcludeArch: ppc64 ppc64le s390x - trunk ExcludeArch: %{ix86} - truth ExclusiveArch: %{java_arches} noarch - tth ExcludeArch: %{ix86} - tuned-profiles-nfv-host-bin ExclusiveArch: %{ix86} x86_64 - tuxguitar ExcludeArch: s390 %{arm} %{ix86} - tvtime ExcludeArch: s390 s390x - typescript ExclusiveArch: %{nodejs_arches} noarch - tzdata ExcludeArch: i686 - uClibc ExclusiveArch: %{arm} %{ix86} x86_64 %{mips} - uboot-tools ExcludeArch: s390x - ucx ExclusiveArch: aarch64 ppc64le x86_64 - uglify-js ExclusiveArch: %{nodejs_arches} noarch - ugrep ExcludeArch: %{ix86} - umr ExclusiveArch: x86_64 aarch64 ppc64le - unetbootin ExclusiveArch: %{ix86} x86_64 - unicorn ExcludeArch: s390x - unison ExcludeArch: %{ix86} - univocity-parsers ExclusiveArch: %{java_arches} noarch - ursa-major ExclusiveArch: noarch aarch64 ppc64le s390x x86_64 - usbip ExcludeArch: s390x - usd ExclusiveArch: aarch64 x86_64 - usnic-tools ExcludeArch: %{arm} - utop ExcludeArch: %{ix86} - uwsgi ExcludeArch: %{ix86} - v-hacd ExcludeArch: %{ix86} - v8-314 ExclusiveArch: %{ix86} x86_64 %{arm} mips mipsel ppc ppc64 - vakzination ExclusiveArch: %{java_arches} - valgrind ExclusiveArch: %{ix86} x86_64 ppc ppc64 ppc64le s390x armv7hl aarch64 - valkey ExcludeArch: %{ix86} - vboot-utils ExclusiveArch: %{arm} aarch64 %{ix86} x86_64 - vdo ExcludeArch: %{ix86} - vdr-tvscraper ExcludeArch: armv7hl - vecmath1.2 ExclusiveArch: %{java_arches} noarch - vectorscan ExcludeArch: s390x - velocity ExclusiveArch: %{java_arches} noarch - viking ExcludeArch: s390 s390x - vim-go ExclusiveArch: %{?golang_arches}%{!?golang_arches:%{ix86} x86_64 %{arm}} - vim-perl-support ExcludeArch: %{ix86} - vim-syntastic ExclusiveArch: %{java_arches} noarch - vinci ExcludeArch: %{ix86} - virt-p2v ExclusiveArch: x86_64 - virt-top ExcludeArch: %{ix86} ExcludeArch: %{power64} - virt-v2v ExcludeArch: %{ix86} ExclusiveArch: x86_64 - virtiofsd ExclusiveArch: %{rust_arches} ExcludeArch: i686 - virtualbox-guest-additions ExclusiveArch: i686 x86_64 - visidata ExcludeArch: %{ix86} - visualboyadvance-m ExcludeArch: %{ix86} - vkd3d ExclusiveArch: %{ix86} x86_64 %{arm} ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 - vkmark ExcludeArch: s390x - vmaf ExclusiveArch: x86_64 - voms-api-java ExclusiveArch: %{java_arches} noarch - voms-clients-java ExclusiveArch: %{java_arches} noarch - votca ExcludeArch: %{ix86} - vrq ExclusiveArch: %{ix86} x86_64 - wangle ExclusiveArch: x86_64 aarch64 ppc64le riscv64 - warsow ExclusiveArch: %{ix86} x86_64 %{arm} - warsow-data ExclusiveArch: %{ix86} x86_64 %{arm} noarch ExclusiveArch: %{ix86} x86_64 %{arm} - warzone2100 ExcludeArch: %{ix86} - wasmedge ExclusiveArch: x86_64 aarch64 - watchman ExclusiveArch: x86_64 aarch64 ppc64le riscv64 - wdt ExclusiveArch: x86_64 aarch64 ppc64le - webkit2-sharp ExclusiveArch: %mono_arches - weld-parent ExclusiveArch: %{java_arches} noarch - whatip ExcludeArch: s390x - whipper ExcludeArch: s390x - whisper-cpp ExclusiveArch: x86_64 aarch64 ppc64le - why3 ExclusiveArch: %{ocaml_native_compiler} - widevine-installer ExclusiveArch: aarch64 - wildcard ExcludeArch: %{ix86} s390x - wine ExclusiveArch: %{ix86} x86_64 aarch64 ExclusiveArch: %{ix86} x86_64 ExclusiveArch: %{ix86} - wine-dxvk ExclusiveArch: %{ix86} x86_64 - wine-mono ExcludeArch: %{power64} s390x s390 - winetricks ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 ExcludeArch: ppc64 ppc64le - wlmaker ExcludeArch: %{ix86} ppc64le - woff ExcludeArch: %{ix86} - workrave ExcludeArch: %{ix86} - ws-commons-util ExclusiveArch: %{java_arches} noarch - wsdl4j ExclusiveArch: %{java_arches} noarch - wult ExclusiveArch: x86_64 - wxMaxima ExclusiveArch: %{arm} %{ix86} x86_64 aarch64 ppc sparcv9 - x2goclient ExclusiveArch: x86_64 - x2gokdrive ExcludeArch: %{ix86} - x86-simd-sort ExclusiveArch: x86_64 - xalan-j2 ExclusiveArch: %{java_arches} noarch - xapps ExcludeArch: %{ix86} - xbean ExclusiveArch: %{java_arches} noarch - xbyak ExclusiveArch: x86_64 - xbyak_aarch64 ExclusiveArch: aarch64 - xdg-desktop-portal ExcludeArch: %{ix86} - xdg-desktop-portal-gnome ExcludeArch: %{ix86} - xdg-desktop-portal-gtk ExcludeArch: %{ix86} - xdg-desktop-portal-hyprland ExcludeArch: %{ix86} - xe-guest-utilities-latest ExclusiveArch: %{ix86} x86_64 - xed ExcludeArch: %{ix86} - xen ExclusiveArch: x86_64 aarch64 - xephem ExcludeArch: %{ix86} - xerces-j2 ExclusiveArch: %{java_arches} noarch - xeus ExcludeArch: %{ix86} - xeus-zmq ExcludeArch: %{ix86} - xfce4-sensors-plugin ExcludeArch: s390 s390x - xgap ExcludeArch: %{ix86} - xiphos ExcludeArch: ppc64 - xml-commons-apis ExclusiveArch: %{java_arches} noarch - xml-commons-resolver ExclusiveArch: %{java_arches} noarch - xml-maven-plugin ExclusiveArch: %{java_arches} noarch - xmlada ExclusiveArch: %{GPRbuild_arches} - xmlgraphics-commons ExclusiveArch: %{java_arches} noarch - xmlpull ExclusiveArch: %{java_arches} noarch - xmlstreambuffer ExclusiveArch: %{java_arches} noarch - xmlunit ExclusiveArch: %{java_arches} noarch - xmvn ExclusiveArch: %{java_arches} noarch - xmvn-connector-ivy ExclusiveArch: %{java_arches} noarch - xmvn-generator ExclusiveArch: %{java_arches} - xnnpack ExclusiveArch: x86_64 aarch64 - xnvme ExcludeArch: %{ix86} - xorg-x11-drv-amdgpu ExcludeArch: s390 s390x - xorg-x11-drv-armsoc ExclusiveArch: %{arm} aarch64 - xorg-x11-drv-ati ExcludeArch: s390 s390x - xorg-x11-drv-fbdev ExcludeArch: s390 s390x - xorg-x11-drv-intel ExclusiveArch: %{ix86} x86_64 - xorg-x11-drv-nouveau ExcludeArch: s390 s390x - xorg-x11-drv-openchrome ExclusiveArch: %{ix86} x86_64 - xorg-x11-drv-qxl ExcludeArch: s390 s390x - xorg-x11-drv-synaptics ExcludeArch: s390 s390x - xorg-x11-drv-vesa ExclusiveArch: %{ix86} x86_64 - xorg-x11-drv-vmware ExclusiveArch: %{ix86} x86_64 ia64 - xreader ExcludeArch: %{ix86} - xrgears ExcludeArch: %{ix86} - xsensors ExcludeArch: %{ix86} - xsp ExclusiveArch: %mono_arches - xstream ExclusiveArch: %{java_arches} noarch - xtb ExcludeArch: s390x - xtensor-python ExcludeArch: armv7hl ppc64le s390x - xz-java ExclusiveArch: %{java_arches} noarch - yarnpkg ExclusiveArch: %{nodejs_arches} - yices ExcludeArch: %{ix86} - yle-dl ExcludeArch: %{ix86} - yosys ExcludeArch: %{ix86} ExcludeArch: s390x - zcfan ExclusiveArch: x86_64 - zeal ExclusiveArch: aarch64 x86_64 - zenon ExclusiveArch: %{ocaml_native_compiler} - zeromq-ada ExclusiveArch: %{GPRbuild_arches} - zfs-fuse ExcludeArch: s390 s390x aarch64 - zig ExclusiveArch: %{zig_arches} - zile ExcludeArch: ppc64le - zimpl ExcludeArch: %{ix86} - zlib-ada ExclusiveArch: %{GPRbuild_arches} - zola ExclusiveArch: %{rust_arches} - zstr ExcludeArch: %{ix86} - zxcvbn-c ExcludeArch: %{ix86} - zycore-c ExcludeArch: s390x - zydis ExcludeArch: s390x

1 0

Architecture specific change in rpms/rust-httparse.git
by githook-noreply＠fedoraproject.org 10 Jun '24

10 Jun '24

The package rpms/rust-httparse.git has added or updated architecture specific content in its spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s): https://src.fedoraproject.org/cgit/rpms/rust-httparse.git/commit/?id=bd328f…. Change: -ExclusiveArch: %{rust_arches} Thanks. Full change: ============ commit 130c88b8fe0f107a609521e1e698cead0144712b Author: Fabio Valentini <decathorpe(a)gmail.com> Date: Mon Jun 10 22:41:40 2024 +0200 Update to version 1.9.2 diff --git a/.gitignore b/.gitignore index 8a98daf..d97fe27 100644 --- a/.gitignore +++ b/.gitignore @@ -11,3 +11,4 @@ /httparse-1.7.1.crate /httparse-1.8.0.crate /httparse-1.9.1.crate +/httparse-1.9.2.crate diff --git a/httparse-fix-metadata.diff b/httparse-fix-metadata.diff index 551bbdc..f6ebb33 100644 --- a/httparse-fix-metadata.diff +++ b/httparse-fix-metadata.diff @@ -1,5 +1,5 @@ ---- httparse-1.9.1/Cargo.toml 1970-01-01T00:00:01+00:00 -+++ httparse-1.9.1/Cargo.toml 2024-06-10T15:25:04.101105+00:00 +--- httparse-1.9.2/Cargo.toml 1970-01-01T00:00:01+00:00 ++++ httparse-1.9.2/Cargo.toml 2024-06-10T20:34:13.651147+00:00 @@ -50,14 +50,6 @@ name = "uri" path = "tests/uri.rs" diff --git a/rust-httparse.spec b/rust-httparse.spec index 243197c..775eaf0 100644 --- a/rust-httparse.spec +++ b/rust-httparse.spec @@ -5,7 +5,7 @@ %global crate httparse Name: rust-httparse -Version: 1.9.1 +Version: 1.9.2 Release: %autorelease Summary: Tiny, safe, speedy, zero-copy HTTP/1.x parser diff --git a/sources b/sources index d32a57f..d489655 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (httparse-1.9.1.crate) = 9b85293bf0155715ff6ab8b70333bdf1277078485bbd3dd32f1928787ccd90b2fb22d3dfda1c1668b0bc87ad6ad28602e88e1c8cdbeea0a9c9891e573eed2e0e +SHA512 (httparse-1.9.2.crate) = a72eabbe0122c37393bbe93522e8484f996a38fbd11952dbbd02b098aecef8690121fb63d91302a428457c6b63eb33fded796970214d176356deedf36d9fcf31 commit bd328f69ba1dbb219c1c1123741c20f97b65cb1a Author: Fabio Valentini <decathorpe(a)gmail.com> Date: Mon Jun 10 17:27:19 2024 +0200 Update to version 1.9.1; Fixes RHBZ#2291174 diff --git a/.gitignore b/.gitignore index c1a5fc8..8a98daf 100644 --- a/.gitignore +++ b/.gitignore @@ -10,3 +10,4 @@ /httparse-1.6.0.crate /httparse-1.7.1.crate /httparse-1.8.0.crate +/httparse-1.9.1.crate diff --git a/README.md b/README.md deleted file mode 100644 index 33a6646..0000000 --- a/README.md +++ /dev/null @@ -1,3 +0,0 @@ -# rust-httparse - -The rust-httparse package \ No newline at end of file diff --git a/httparse-fix-metadata.diff b/httparse-fix-metadata.diff index 1ac3fbf..551bbdc 100644 --- a/httparse-fix-metadata.diff +++ b/httparse-fix-metadata.diff @@ -1,11 +1,12 @@ ---- httparse-1.8.0/Cargo.toml 1970-01-01T00:00:01+00:00 -+++ httparse-1.8.0/Cargo.toml 2022-09-02T13:17:46.983155+00:00 -@@ -40,13 +40,6 @@ - [lib] - bench = false +--- httparse-1.9.1/Cargo.toml 1970-01-01T00:00:01+00:00 ++++ httparse-1.9.1/Cargo.toml 2024-06-10T15:25:04.101105+00:00 +@@ -50,14 +50,6 @@ + name = "uri" + path = "tests/uri.rs" -[[bench]] -name = "parse" +-path = "benches/parse.rs" -harness = false - -[dev-dependencies.criterion] diff --git a/rust-httparse.spec b/rust-httparse.spec index d32ca13..243197c 100644 --- a/rust-httparse.spec +++ b/rust-httparse.spec @@ -1,28 +1,25 @@ -# Generated by rust2rpm 22 +# Generated by rust2rpm 26 %bcond_without check %global debug_package %{nil} %global crate httparse Name: rust-httparse -Version: 1.8.0 +Version: 1.9.1 Release: %autorelease Summary: Tiny, safe, speedy, zero-copy HTTP/1.x parser -# Upstream license specification: MIT/Apache-2.0 License: MIT OR Apache-2.0 URL: https://crates.io/crates/httparse Source: %{crates_source} # Manually created patch for downstream crate metadata changes -# * drop unused, benchmark-only criterion dev-dependency to speed up builds +# * drop unused, benchmark-only criterion dev-dependency Patch: httparse-fix-metadata.diff -ExclusiveArch: %{rust_arches} - -BuildRequires: rust-packaging >= 21 +BuildRequires: cargo-rpm-macros >= 24 %global _description %{expand: -Tiny, safe, speedy, zero-copy HTTP/1.x parser.} +A tiny, safe, speedy, zero-copy HTTP/1.x parser.} %description %{_description} @@ -66,7 +63,7 @@ use the "std" feature of the "%{crate}" crate. %ghost %{crate_instdir}/Cargo.toml %prep -%autosetup -n %{crate}-%{version_no_tilde} -p1 +%autosetup -n %{crate}-%{version} -p1 %cargo_prep %generate_buildrequires diff --git a/rust2rpm.toml b/rust2rpm.toml new file mode 100644 index 0000000..2cd7101 --- /dev/null +++ b/rust2rpm.toml @@ -0,0 +1,5 @@ +[package] +cargo-toml-patch-comments = [ + "drop unused, benchmark-only criterion dev-dependency", +] + diff --git a/sources b/sources index e42b85c..d32a57f 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (httparse-1.8.0.crate) = 849159d9876e0474c71f3c7aa3a7271699b807b293832d88d52e4326ed410b25f9d7b9ad75a143a51fb5c8ea5016c2513348edbc050d3b62dc9a6737ae98ee8f +SHA512 (httparse-1.9.1.crate) = 9b85293bf0155715ff6ab8b70333bdf1277078485bbd3dd32f1928787ccd90b2fb22d3dfda1c1668b0bc87ad6ad28602e88e1c8cdbeea0a9c9891e573eed2e0e commit b4d83ac5091555360991a2f955c25e421c934fd2 Author: Fedora Release Engineering <releng(a)fedoraproject.org> Date: Fri Jan 26 20:58:51 2024 +0000 Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

1 0

Architecture specific change in rpms/rust-httparse.git
by githook-noreply＠fedoraproject.org 10 Jun '24

10 Jun '24

The package rpms/rust-httparse.git has added or updated architecture specific content in its spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s): https://src.fedoraproject.org/cgit/rpms/rust-httparse.git/commit/?id=bd328f…. Change: -ExclusiveArch: %{rust_arches} Thanks. Full change: ============ commit 130c88b8fe0f107a609521e1e698cead0144712b Author: Fabio Valentini <decathorpe(a)gmail.com> Date: Mon Jun 10 22:41:40 2024 +0200 Update to version 1.9.2 diff --git a/.gitignore b/.gitignore index 8a98daf..d97fe27 100644 --- a/.gitignore +++ b/.gitignore @@ -11,3 +11,4 @@ /httparse-1.7.1.crate /httparse-1.8.0.crate /httparse-1.9.1.crate +/httparse-1.9.2.crate diff --git a/httparse-fix-metadata.diff b/httparse-fix-metadata.diff index 551bbdc..f6ebb33 100644 --- a/httparse-fix-metadata.diff +++ b/httparse-fix-metadata.diff @@ -1,5 +1,5 @@ ---- httparse-1.9.1/Cargo.toml 1970-01-01T00:00:01+00:00 -+++ httparse-1.9.1/Cargo.toml 2024-06-10T15:25:04.101105+00:00 +--- httparse-1.9.2/Cargo.toml 1970-01-01T00:00:01+00:00 ++++ httparse-1.9.2/Cargo.toml 2024-06-10T20:34:13.651147+00:00 @@ -50,14 +50,6 @@ name = "uri" path = "tests/uri.rs" diff --git a/rust-httparse.spec b/rust-httparse.spec index 243197c..775eaf0 100644 --- a/rust-httparse.spec +++ b/rust-httparse.spec @@ -5,7 +5,7 @@ %global crate httparse Name: rust-httparse -Version: 1.9.1 +Version: 1.9.2 Release: %autorelease Summary: Tiny, safe, speedy, zero-copy HTTP/1.x parser diff --git a/sources b/sources index d32a57f..d489655 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (httparse-1.9.1.crate) = 9b85293bf0155715ff6ab8b70333bdf1277078485bbd3dd32f1928787ccd90b2fb22d3dfda1c1668b0bc87ad6ad28602e88e1c8cdbeea0a9c9891e573eed2e0e +SHA512 (httparse-1.9.2.crate) = a72eabbe0122c37393bbe93522e8484f996a38fbd11952dbbd02b098aecef8690121fb63d91302a428457c6b63eb33fded796970214d176356deedf36d9fcf31 commit bd328f69ba1dbb219c1c1123741c20f97b65cb1a Author: Fabio Valentini <decathorpe(a)gmail.com> Date: Mon Jun 10 17:27:19 2024 +0200 Update to version 1.9.1; Fixes RHBZ#2291174 diff --git a/.gitignore b/.gitignore index c1a5fc8..8a98daf 100644 --- a/.gitignore +++ b/.gitignore @@ -10,3 +10,4 @@ /httparse-1.6.0.crate /httparse-1.7.1.crate /httparse-1.8.0.crate +/httparse-1.9.1.crate diff --git a/README.md b/README.md deleted file mode 100644 index 33a6646..0000000 --- a/README.md +++ /dev/null @@ -1,3 +0,0 @@ -# rust-httparse - -The rust-httparse package \ No newline at end of file diff --git a/httparse-fix-metadata.diff b/httparse-fix-metadata.diff index 1ac3fbf..551bbdc 100644 --- a/httparse-fix-metadata.diff +++ b/httparse-fix-metadata.diff @@ -1,11 +1,12 @@ ---- httparse-1.8.0/Cargo.toml 1970-01-01T00:00:01+00:00 -+++ httparse-1.8.0/Cargo.toml 2022-09-02T13:17:46.983155+00:00 -@@ -40,13 +40,6 @@ - [lib] - bench = false +--- httparse-1.9.1/Cargo.toml 1970-01-01T00:00:01+00:00 ++++ httparse-1.9.1/Cargo.toml 2024-06-10T15:25:04.101105+00:00 +@@ -50,14 +50,6 @@ + name = "uri" + path = "tests/uri.rs" -[[bench]] -name = "parse" +-path = "benches/parse.rs" -harness = false - -[dev-dependencies.criterion] diff --git a/rust-httparse.spec b/rust-httparse.spec index d32ca13..243197c 100644 --- a/rust-httparse.spec +++ b/rust-httparse.spec @@ -1,28 +1,25 @@ -# Generated by rust2rpm 22 +# Generated by rust2rpm 26 %bcond_without check %global debug_package %{nil} %global crate httparse Name: rust-httparse -Version: 1.8.0 +Version: 1.9.1 Release: %autorelease Summary: Tiny, safe, speedy, zero-copy HTTP/1.x parser -# Upstream license specification: MIT/Apache-2.0 License: MIT OR Apache-2.0 URL: https://crates.io/crates/httparse Source: %{crates_source} # Manually created patch for downstream crate metadata changes -# * drop unused, benchmark-only criterion dev-dependency to speed up builds +# * drop unused, benchmark-only criterion dev-dependency Patch: httparse-fix-metadata.diff -ExclusiveArch: %{rust_arches} - -BuildRequires: rust-packaging >= 21 +BuildRequires: cargo-rpm-macros >= 24 %global _description %{expand: -Tiny, safe, speedy, zero-copy HTTP/1.x parser.} +A tiny, safe, speedy, zero-copy HTTP/1.x parser.} %description %{_description} @@ -66,7 +63,7 @@ use the "std" feature of the "%{crate}" crate. %ghost %{crate_instdir}/Cargo.toml %prep -%autosetup -n %{crate}-%{version_no_tilde} -p1 +%autosetup -n %{crate}-%{version} -p1 %cargo_prep %generate_buildrequires diff --git a/rust2rpm.toml b/rust2rpm.toml new file mode 100644 index 0000000..2cd7101 --- /dev/null +++ b/rust2rpm.toml @@ -0,0 +1,5 @@ +[package] +cargo-toml-patch-comments = [ + "drop unused, benchmark-only criterion dev-dependency", +] + diff --git a/sources b/sources index e42b85c..d32a57f 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (httparse-1.8.0.crate) = 849159d9876e0474c71f3c7aa3a7271699b807b293832d88d52e4326ed410b25f9d7b9ad75a143a51fb5c8ea5016c2513348edbc050d3b62dc9a6737ae98ee8f +SHA512 (httparse-1.9.1.crate) = 9b85293bf0155715ff6ab8b70333bdf1277078485bbd3dd32f1928787ccd90b2fb22d3dfda1c1668b0bc87ad6ad28602e88e1c8cdbeea0a9c9891e573eed2e0e

1 0

Architecture specific change in rpms/rust-primal-bit.git
by githook-noreply＠fedoraproject.org 10 Jun '24

10 Jun '24

The package rpms/rust-primal-bit.git has added or updated architecture specific content in its spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s): https://src.fedoraproject.org/cgit/rpms/rust-primal-bit.git/commit/?id=ebe7…. Change: -ExclusiveArch: %{rust_arches} Thanks. Full change: ============ commit ebe7d6a84e0312ace033b3952ec4b6f1f6ba0098 Author: Fabio Valentini <decathorpe(a)gmail.com> Date: Mon Jun 10 20:00:58 2024 +0200 Update to version 0.3.2 diff --git a/.gitignore b/.gitignore index f487dea..fb2e4fb 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ /primal-bit-0.3.1.crate +/primal-bit-0.3.2.crate diff --git a/README.md b/README.md deleted file mode 100644 index e15d3cb..0000000 --- a/README.md +++ /dev/null @@ -1,3 +0,0 @@ -# rust-primal-bit - -The rust-primal-bit package diff --git a/rust-primal-bit.spec b/rust-primal-bit.spec index a9c2127..de8377b 100644 --- a/rust-primal-bit.spec +++ b/rust-primal-bit.spec @@ -1,22 +1,19 @@ -# Generated by rust2rpm 22 +# Generated by rust2rpm 26 %bcond_without check %global debug_package %{nil} %global crate primal-bit Name: rust-primal-bit -Version: 0.3.1 +Version: 0.3.2 Release: %autorelease -Summary: Bit-vector specialised to the prime-number-related needs of `primal` +Summary: Bit-vector specialised to the prime-number-related needs of primal -# Upstream license specification: MIT/Apache-2.0 License: MIT OR Apache-2.0 URL: https://crates.io/crates/primal-bit Source: %{crates_source} -ExclusiveArch: %{rust_arches} - -BuildRequires: rust-packaging >= 21 +BuildRequires: cargo-rpm-macros >= 24 %global _description %{expand: Bit-vector specialised to the prime-number-related needs of `primal`.} @@ -62,7 +59,7 @@ use the "unstable" feature of the "%{crate}" crate. %ghost %{crate_instdir}/Cargo.toml %prep -%autosetup -n %{crate}-%{version_no_tilde} -p1 +%autosetup -n %{crate}-%{version} -p1 %cargo_prep %generate_buildrequires diff --git a/sources b/sources index c435e45..6adfc23 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (primal-bit-0.3.1.crate) = 5e0f6a1743b2fac25d2dc1b834dc06a981c6cf2c44120b7e9b645ecae93672cb1618f57b62319462f1e186520229af6e38fcf4fdb05c3e18b920f9a4a03efbb7 +SHA512 (primal-bit-0.3.2.crate) = 103ea201292c45d4f65a60388ab8082197bf1f97a4173fe01c39541d3daf3bcac87c076d0cea6dbe9762b43c8f7e8d82fae9f5380a64eace930948b5e75118d0 commit 08ce6bddd1a7c90c52ff17b8baba6ec61a92373c Author: Fedora Release Engineering <releng(a)fedoraproject.org> Date: Fri Jan 26 23:05:21 2024 +0000 Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

1 0

Architecture specific change in rpms/rust-primal-estimate.git
by githook-noreply＠fedoraproject.org 10 Jun '24

10 Jun '24

The package rpms/rust-primal-estimate.git has added or updated architecture specific content in its spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s): https://src.fedoraproject.org/cgit/rpms/rust-primal-estimate.git/commit/?id…. Change: -ExclusiveArch: %{rust_arches} Thanks. Full change: ============ commit 35f150b14c9983c1be0f62fc2249002c11552d4b Author: Fabio Valentini <decathorpe(a)gmail.com> Date: Mon Jun 10 19:54:24 2024 +0200 Update to version 0.3.3 diff --git a/.gitignore b/.gitignore index fca8cc0..2404c7f 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ /primal-estimate-0.3.2.crate +/primal-estimate-0.3.3.crate diff --git a/README.md b/README.md deleted file mode 100644 index 984ca4a..0000000 --- a/README.md +++ /dev/null @@ -1,3 +0,0 @@ -# rust-primal-estimate - -The rust-primal-estimate package diff --git a/rust-primal-estimate.spec b/rust-primal-estimate.spec index 31ef936..36ebba6 100644 --- a/rust-primal-estimate.spec +++ b/rust-primal-estimate.spec @@ -1,25 +1,23 @@ -# Generated by rust2rpm 22 -%bcond_with check +# Generated by rust2rpm 26 +%bcond_without check %global debug_package %{nil} %global crate primal-estimate Name: rust-primal-estimate -Version: 0.3.2 +Version: 0.3.3 Release: %autorelease -Summary: Estimation of upper and lower bounds for π(n) and p_k +Summary: State-of-the-art estimation of upper and lower bounds for π(n) License: MIT OR Apache-2.0 URL: https://crates.io/crates/primal-estimate Source: %{crates_source} -ExclusiveArch: %{rust_arches} - -BuildRequires: rust-packaging >= 21 +BuildRequires: cargo-rpm-macros >= 24 %global _description %{expand: -State-of-the-art estimation of upper and lower bounds for π(n) (the number of -primes below n) and p_k (the k-th prime).} +State-of-the-art estimation of upper and lower bounds for π(n) (the +number of primes below n) and p_k (the k-th prime).} %description %{_description} @@ -62,7 +60,7 @@ use the "unstable" feature of the "%{crate}" crate. %ghost %{crate_instdir}/Cargo.toml %prep -%autosetup -n %{crate}-%{version_no_tilde} -p1 +%autosetup -n %{crate}-%{version} -p1 %cargo_prep %generate_buildrequires diff --git a/sources b/sources index 78fb03e..cec7940 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (primal-estimate-0.3.2.crate) = 95f0419c3b913108613b3d6a4e72fa842b3f56b826aeec11b488011b1f94d0d5f911380bdd8b01e53cc5c70ac528d38c5d752ca00628aef157d4f9ad57e03525 +SHA512 (primal-estimate-0.3.3.crate) = 3e9a0c71c4398c4c2d3a3dab8448e4c3f2ec519ed68bb45de2232dde5af6094fede032bb802b3d413fafaf5eea15eebd251d503b8027c193a443779fa314d298 commit ec361a46285badea37fc896337ba82beeb549aba Author: Fedora Release Engineering <releng(a)fedoraproject.org> Date: Fri Jan 26 23:05:41 2024 +0000 Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

1 0

Architecture specific change in rpms/rust-primal-bit.git
by githook-noreply＠fedoraproject.org 10 Jun '24

10 Jun '24

The package rpms/rust-primal-bit.git has added or updated architecture specific content in its spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s): https://src.fedoraproject.org/cgit/rpms/rust-primal-bit.git/commit/?id=ebe7…. Change: -ExclusiveArch: %{rust_arches} Thanks. Full change: ============ commit ebe7d6a84e0312ace033b3952ec4b6f1f6ba0098 Author: Fabio Valentini <decathorpe(a)gmail.com> Date: Mon Jun 10 20:00:58 2024 +0200 Update to version 0.3.2 diff --git a/.gitignore b/.gitignore index f487dea..fb2e4fb 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ /primal-bit-0.3.1.crate +/primal-bit-0.3.2.crate diff --git a/README.md b/README.md deleted file mode 100644 index e15d3cb..0000000 --- a/README.md +++ /dev/null @@ -1,3 +0,0 @@ -# rust-primal-bit - -The rust-primal-bit package diff --git a/rust-primal-bit.spec b/rust-primal-bit.spec index a9c2127..de8377b 100644 --- a/rust-primal-bit.spec +++ b/rust-primal-bit.spec @@ -1,22 +1,19 @@ -# Generated by rust2rpm 22 +# Generated by rust2rpm 26 %bcond_without check %global debug_package %{nil} %global crate primal-bit Name: rust-primal-bit -Version: 0.3.1 +Version: 0.3.2 Release: %autorelease -Summary: Bit-vector specialised to the prime-number-related needs of `primal` +Summary: Bit-vector specialised to the prime-number-related needs of primal -# Upstream license specification: MIT/Apache-2.0 License: MIT OR Apache-2.0 URL: https://crates.io/crates/primal-bit Source: %{crates_source} -ExclusiveArch: %{rust_arches} - -BuildRequires: rust-packaging >= 21 +BuildRequires: cargo-rpm-macros >= 24 %global _description %{expand: Bit-vector specialised to the prime-number-related needs of `primal`.} @@ -62,7 +59,7 @@ use the "unstable" feature of the "%{crate}" crate. %ghost %{crate_instdir}/Cargo.toml %prep -%autosetup -n %{crate}-%{version_no_tilde} -p1 +%autosetup -n %{crate}-%{version} -p1 %cargo_prep %generate_buildrequires diff --git a/sources b/sources index c435e45..6adfc23 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (primal-bit-0.3.1.crate) = 5e0f6a1743b2fac25d2dc1b834dc06a981c6cf2c44120b7e9b645ecae93672cb1618f57b62319462f1e186520229af6e38fcf4fdb05c3e18b920f9a4a03efbb7 +SHA512 (primal-bit-0.3.2.crate) = 103ea201292c45d4f65a60388ab8082197bf1f97a4173fe01c39541d3daf3bcac87c076d0cea6dbe9762b43c8f7e8d82fae9f5380a64eace930948b5e75118d0

1 0

Architecture specific change in rpms/rust-primal-estimate.git
by githook-noreply＠fedoraproject.org 10 Jun '24

10 Jun '24

The package rpms/rust-primal-estimate.git has added or updated architecture specific content in its spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s): https://src.fedoraproject.org/cgit/rpms/rust-primal-estimate.git/commit/?id…. Change: -ExclusiveArch: %{rust_arches} Thanks. Full change: ============ commit 35f150b14c9983c1be0f62fc2249002c11552d4b Author: Fabio Valentini <decathorpe(a)gmail.com> Date: Mon Jun 10 19:54:24 2024 +0200 Update to version 0.3.3 diff --git a/.gitignore b/.gitignore index fca8cc0..2404c7f 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ /primal-estimate-0.3.2.crate +/primal-estimate-0.3.3.crate diff --git a/README.md b/README.md deleted file mode 100644 index 984ca4a..0000000 --- a/README.md +++ /dev/null @@ -1,3 +0,0 @@ -# rust-primal-estimate - -The rust-primal-estimate package diff --git a/rust-primal-estimate.spec b/rust-primal-estimate.spec index 31ef936..36ebba6 100644 --- a/rust-primal-estimate.spec +++ b/rust-primal-estimate.spec @@ -1,25 +1,23 @@ -# Generated by rust2rpm 22 -%bcond_with check +# Generated by rust2rpm 26 +%bcond_without check %global debug_package %{nil} %global crate primal-estimate Name: rust-primal-estimate -Version: 0.3.2 +Version: 0.3.3 Release: %autorelease -Summary: Estimation of upper and lower bounds for π(n) and p_k +Summary: State-of-the-art estimation of upper and lower bounds for π(n) License: MIT OR Apache-2.0 URL: https://crates.io/crates/primal-estimate Source: %{crates_source} -ExclusiveArch: %{rust_arches} - -BuildRequires: rust-packaging >= 21 +BuildRequires: cargo-rpm-macros >= 24 %global _description %{expand: -State-of-the-art estimation of upper and lower bounds for π(n) (the number of -primes below n) and p_k (the k-th prime).} +State-of-the-art estimation of upper and lower bounds for π(n) (the +number of primes below n) and p_k (the k-th prime).} %description %{_description} @@ -62,7 +60,7 @@ use the "unstable" feature of the "%{crate}" crate. %ghost %{crate_instdir}/Cargo.toml %prep -%autosetup -n %{crate}-%{version_no_tilde} -p1 +%autosetup -n %{crate}-%{version} -p1 %cargo_prep %generate_buildrequires diff --git a/sources b/sources index 78fb03e..cec7940 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (primal-estimate-0.3.2.crate) = 95f0419c3b913108613b3d6a4e72fa842b3f56b826aeec11b488011b1f94d0d5f911380bdd8b01e53cc5c70ac528d38c5d752ca00628aef157d4f9ad57e03525 +SHA512 (primal-estimate-0.3.3.crate) = 3e9a0c71c4398c4c2d3a3dab8448e4c3f2ec519ed68bb45de2232dde5af6094fede032bb802b3d413fafaf5eea15eebd251d503b8027c193a443779fa314d298

1 0