Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package libica for openSUSE:Factory checked in at 2026-03-07 20:09:06 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libica (Old) and /work/SRC/openSUSE:Factory/.libica.new.8177 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libica" Sat Mar 7 20:09:06 2026 rev:45 rq:1337339 version:4.4.1 Changes: -------- --- /work/SRC/openSUSE:Factory/libica/libica.changes 2025-08-21 16:56:20.634484067 +0200 +++ /work/SRC/openSUSE:Factory/.libica.new.8177/libica.changes 2026-03-07 20:13:59.593951722 +0100 @@ -1,0 +2,13 @@ +Fri Mar 6 10:04:14 UTC 2026 - Nikolay Gueorguiev <[email protected]> + +- Applied a patch for FIPS 140-3 project for SLES16.0 and SL Micro 6.2 + * libica-Fix-mutex-thread-lock-in-drbg_uninstantiate-function.patch +- Fix rpmlint buildroot error by moving __os_install_post override to the spec preamble. +- Fix rpmlint macro-in-comment warnings by properly escaping commented macros. +- Move unversioned libica.so from tools to libica4 subpackage to ensure openssl-ibmca + can reliably load it via DSO_load() in minimal environments (bsc#952871). +- Move legacy Obsoletes/Provides for older libica versions from tools to libica4. +- Scope sysconfig fillup_prereq dependency explicitly to the tools subpackage. +- Enforce strict %{version}-%{release} requirements for devel and devel-static subpackages. + +------------------------------------------------------------------- New: ---- libica-Fix-mutex-thread-lock-in-drbg_uninstantiate-function.patch ----------(New B)---------- New:- Applied a patch for FIPS 140-3 project for SLES16.0 and SL Micro 6.2 * libica-Fix-mutex-thread-lock-in-drbg_uninstantiate-function.patch - Fix rpmlint buildroot error by moving __os_install_post override to the spec preamble. ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libica.spec ++++++ --- /var/tmp/diff_new_pack.r2kbnI/_old 2026-03-07 20:14:00.257979191 +0100 +++ /var/tmp/diff_new_pack.r2kbnI/_new 2026-03-07 20:14:00.257979191 +0100 @@ -1,7 +1,7 @@ # # spec file for package libica # -# Copyright (c) 2025 SUSE LLC +# Copyright (c) 2026 SUSE LLC # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -39,6 +39,7 @@ Patch02: libica-sles15sp5-FIPS-hmac-key.patch ### Patch10: libica-CONFIGURE-Make-the-OpenSSL-FIPS-config-file-name-configurable.patch +Patch11: libica-Fix-mutex-thread-lock-in-drbg_uninstantiate-function.patch ### BuildRequires: autoconf @@ -48,9 +49,10 @@ BuildRequires: libtool BuildRequires: openssl BuildRequires: openssl-devel -Requires(post): %fillup_prereq ExclusiveArch: s390 s390x +%global __os_install_post %{__os_install_post} fipshmac %{buildroot}%{_libdir}/*.so.%{version} + %description This package contains the interface library routines used by IBM modules to interface with the IBM eServer Cryptographic Accelerator @@ -60,15 +62,6 @@ Summary: Library interface for the IBM Cryptographic Accelerator Group: System/Libraries Recommends: libica-tools - -%description -n libica4 -This package contains the interface library routines used by IBM -modules to interface with the IBM eServer Cryptographic Accelerator -(ICA). - -%package tools -Summary: Utilities for the IBM Cryptographic Accelerator -Group: Hardware/Other Obsoletes: libica < %{version}-%{release} Obsoletes: libica-2_3_0 < %{version}-%{release} Obsoletes: libica2 < %{version}-%{release} @@ -79,6 +72,16 @@ Provides: libica2 = %{version}-%{release} Provides: libica3 = %{version}-%{release} +%description -n libica4 +This package contains the interface library routines used by IBM +modules to interface with the IBM eServer Cryptographic Accelerator +(ICA). + +%package tools +Summary: Utilities for the IBM Cryptographic Accelerator +Group: Hardware/Other +Requires(post): %fillup_prereq + %description tools This package contains command-line utilities to inspect the IBM eServer Cryptographic Accelerator (ICA). @@ -86,7 +89,7 @@ %package devel Summary: Development files for the ICA device driver interface library Group: Development/Libraries/C and C++ -Requires: libica4 = %{version} +Requires: libica4 = %{version}-%{release} Requires: libopenssl-devel Obsoletes: libica-2_1_0-devel < %{version}-%{release} Provides: libica-2_1_0-devel = %{version}-%{release} @@ -104,7 +107,7 @@ %package devel-static Summary: Static Development files for the ICA device driver interface library Group: Development/Libraries/C and C++ -Requires: libica-devel +Requires: %{name}-devel = %{version}-%{release} %description devel-static This package contains the interface library routines used by IBM @@ -127,8 +130,6 @@ %define major %(echo %{version} | sed -e 's/[.].*//') -%{expand:%%global __os_install_post {%__os_install_post fipshmac %{buildroot}/%{_libdir}/*.so.%{version} }} - %install %make_install FIPSHMAC=fipshmac make fipsinstall FIPSHMAC=fipshmac DESTDIR=%{buildroot} @@ -140,7 +141,7 @@ install -D %{SOURCE3} %{buildroot}%{_prefix}/lib/systemd/scripts/z90crypt install -D -m 644 %{SOURCE4} %{buildroot}%{_prefix}/lib/systemd/system/z90crypt.service # It is installed 444 and then the __os_install_post cannot update it once the debuginfo is stripped -# We need it early because there is %{buildroot}/%{_libdir}/.*.so.%{major}.hmac symlink pointing at it +# We need it early because there is %%{buildroot}/%%{_libdir}/.*.so.%%{major}.hmac symlink pointing at it # and the dangling symlink test would fail chmod 644 %{buildroot}/%{_libdir}/.*.so.%{version}.hmac @@ -180,9 +181,11 @@ %{_libdir}/libica-cex.so.%{major} %{_libdir}/.libica-cex.so.%{version}.hmac %{_libdir}/.libica-cex.so.%{major}.hmac +# Moved to here, otherwise openssl-ibmca does not find it via DSO_load() bsc#952871 +%{_libdir}/libica.so ### Enable FIPS -### %dir %{_sysconfdir}/libica -### %{_sysconfdir}/libica/openssl3-fips.cnf +### %%dir %%{_sysconfdir}/libica +### %%{_sysconfdir}/libica/openssl3-fips.cnf ### %files tools @@ -199,8 +202,6 @@ %dir %{_prefix}/lib/systemd/scripts %{_prefix}/lib/systemd/scripts/z90crypt %{_prefix}/lib/systemd/system/z90crypt.service -# Must be in here, otherwise openssl-ibmca does not find it via DSO_load() bsc#952871 -%{_libdir}/libica.so %files devel %{_includedir}/ica_api.h ++++++ libica-Fix-mutex-thread-lock-in-drbg_uninstantiate-function.patch ++++++ >From 2658f070ae4ce26e9316510e57591a219e698ee1 Mon Sep 17 00:00:00 2001 From: Vishnudatha Kanjur <[email protected]> Date: Fri, 13 Feb 2026 14:01:24 +0100 Subject: [PATCH] Fix mutex thread lock in drbg_uninstantiate function. This commit is to unlock the thread mutex in the drbg_uninstantiate function after the mechanism specific uninstantiate call. Signed-off-by: Vishnudatha Kanjur <[email protected]> --- src/s390_drbg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/s390_drbg.c b/src/s390_drbg.c index 798b59c7..7e75fa1f 100644 --- a/src/s390_drbg.c +++ b/src/s390_drbg.c @@ -364,12 +364,12 @@ int drbg_uninstantiate(ica_drbg_t **sh, /* step 2 */ pthread_mutex_lock(&(*sh)->lock); status = (*sh)->mech->uninstantiate(&(*sh)->ws, test_mode); + pthread_mutex_unlock(&(*sh)->lock); if(status){ if(0 > status) set_error_state((*sh)->mech, status); return status; /* return uninstantiate status */ } - pthread_mutex_unlock(&(*sh)->lock); pthread_mutex_destroy(&(*sh)->lock); drbg_zmem(*sh, sizeof(ica_drbg_t)); if(test_mode) ++++++ libica-rpmlintrc ++++++ --- /var/tmp/diff_new_pack.r2kbnI/_old 2026-03-07 20:14:00.377984156 +0100 +++ /var/tmp/diff_new_pack.r2kbnI/_new 2026-03-07 20:14:00.389984652 +0100 @@ -1,4 +1,4 @@ -addFilter("libica-tools.* * devel-file-in-non-devel-package * /usr/lib64/libica.so") addFilter("libica*.* hidden-file-or-dir /usr/lib64/.libica.so.*.hmac") addFilter("libica*.* hidden-file-or-dir /usr/lib64/.libica-cex.so.*.hmac") +addFilter("libica*.* devel-file-in-non-devel-package .*/libica.so")
