Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package libzpc for openSUSE:Factory checked in at 2026-09-11 18:05:27 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libzpc (Old) and /work/SRC/openSUSE:Factory/.libzpc.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libzpc" Fri Sep 11 18:05:27 2026 rev:16 rq:1377383 version:2.0.1 Changes: -------- --- /work/SRC/openSUSE:Factory/libzpc/libzpc.changes 2026-06-30 15:12:54.558977179 +0200 +++ /work/SRC/openSUSE:Factory/.libzpc.new.1265/libzpc.changes 2026-09-11 18:08:25.291640622 +0200 @@ -1,0 +2,10 @@ +Fri Sep 11 09:12:05 UTC 2026 - Nikolay Gueorguiev <[email protected]> + +- Amended the .spec file to fix build and packaging issues (jsc#PED-16483): + * Added pre-generated man pages (hbkzpcprovider.7, hbkzpcprovider.conf.5, + zpckey.1) as sources to bypass missing pandoc dependency on SLES >= 16.0 + * Relocated OpenSSL configuration example from the specific path to + %{_docdir}/libzpc-provider/hbkzpcprovider.conf.example + * Fixed package directory ownership for %{_docdir}/libzpc-provider/ + +------------------------------------------------------------------- New: ---- hbkzpcprovider.7 hbkzpcprovider.conf.5 zpckey.1 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libzpc.spec ++++++ --- /var/tmp/diff_new_pack.vAmzds/_old 2026-09-11 18:08:26.354685127 +0200 +++ /var/tmp/diff_new_pack.vAmzds/_new 2026-09-11 18:08:26.357685253 +0200 @@ -25,6 +25,11 @@ URL: https://github.com/opencryptoki/libzpc Source0: https://github.com/opencryptoki/libzpc/archive/refs/tags/v%{version}.tar.gz#/libzpc-%{version}.tar.gz Source1: libzpc-rpmlintrc +### The man pages must be pre-generated in advance! +Source2: hbkzpcprovider.conf.5 +Source3: hbkzpcprovider.7 +Source4: zpckey.1 +### BuildRequires: clang BuildRequires: cmake >= 3.10 @@ -74,10 +79,10 @@ %install cd build -touch hbkzpcprovider.conf.5 hbkzpcprovider.7 zpckey.1 +cp %{SOURCE2} %{SOURCE3} %{SOURCE4} . %make_install -install -m644 hbkzpcprovider.conf \ - -D -t %{buildroot}%{_sysconfdir}/pki/tls/openssl.d/ +install -D -m 0644 hbkzpcprovider.conf \ + %{buildroot}%{_docdir}/libzpc-provider/hbkzpcprovider.conf.example %fdupes %{buildroot}%{_mandir} @@ -91,13 +96,10 @@ %ifarch s390x %files provider %license LICENSE +%{_docdir}/libzpc-provider/ %{modulesdir}/zpcprovider.so %{_mandir}/man5/hbkzpcprovider.conf.5* %{_mandir}/man7/hbkzpcprovider.7* -%dir %{_sysconfdir}/pki -%dir %{_sysconfdir}/pki/tls -%dir %{_sysconfdir}/pki/tls/openssl.d -%config(noreplace) %{_sysconfdir}/pki/tls/openssl.d/hbkzpcprovider.conf %endif %files tools ++++++ hbkzpcprovider.7 ++++++ .\" Automatically generated by Pandoc 2.18 .\" .\" Define V font for inline verbatim, using C font in formats .\" that render this, and otherwise B font. .ie "\f[CB]x\f[]"x" \{\ . ftr V B . ftr VI BI . ftr VB B . ftr VBI BI .\} .el \{\ . ftr V CR . ftr VI CI . ftr VB CB . ftr VBI CBI .\} .TH "HBKZPCPROVIDER" "7" "2026" "LIBZPC v2" "" .hy .SH NAME .PP \f[V]hbkzpc provider\f[R] - An OpenSSL provider that provides an interface to the hardware-backed key cryptographic operations, available on IBM Z and IBM LinuxONE. .SH DESCRIPTION .PP IBM Z and IBM LinuxONE systems offer several types of hardware assists with different features, including the CP Assist for Cryptographic Functions (\f[I]CPACF\f[R]) and the IBM Crypto Express (\f[I]CEX\f[R]) features. .PP The \f[V]hbkzpc provider\f[R] enables applications using the OpenSSL crypto library API to exploit the protected key cryptography (\f[I]ZPC\f[R]) functions, provided by CPACF on IBM Z and IBM LinuxONE. .PP To use the \f[V]hbkzpc provider\f[R] via the OpenSSL crypto library API, it must be referenced in the OpenSSL configuration. For more details, see hbkzpcprovider.conf(5). .SS Hardware-backed keys .PP Hardware-backed keys (\f[I]HBK\f[R]) are a generic concept, where the secret information of cryptographic keys is never exposed to the main memory, but cryptographic operations with such keys are still possible. Instead of the raw secret key information, opaque key objects are exposed to the applications. The internals of these opaque key objects (key slot reference, wrapped key blob, etc.) depends on the concrete implementation of the generic concept. It is essential, that the knowledge of the opaque key object does not expose any information about the real secret information of the key. .SS IBM Z protected key cryptography .PP The IBM Z protected key cryptography is the implementation of the generic hardware-backed key concept on IBM Z and IBM LinuxONE. The platform uses IBM Crypto Express (\f[I]CEX\f[R]) adapters (or often called: feature) or the IBM Secure Execution for Linux ultravisor to securely store secret key material and securely export them to the firmware. The \f[V]hbkzpc provider\f[R] can handle opaque key objects (protected key origins), which describe and reference these secure keys. .PP ZPC provides many cryptographic functions with protected keys. The \f[V]hbkzpc provider\f[R] supports ECDSA/EdDSA sign/verify operations for a list of ECC-curves. See section \f[I]Provider functions\f[R] for more details. .SS Protected key origins .PP A protected key origin for the \f[V]hbkzpc provider\f[R] is used to internally export the referenced secure key to the firmware. While the resulting protected keys are volatile and can become invalid at any time, the protected key origins are persistent and can be stored without exposing any secret information. .PP A protected key origin is specified by a HBKZPC unified resource identifier (URI). These URIs can be encoded to protected key origin files. The \f[V]hbkzpc provider\f[R] can handle either URIs directly or URIs which are encoded and stored in files (DER or PEM). See section \f[I]URI\f[R] for more details. .PP The \f[V]zpckey\f[R] tool supports composing such protected key origins. See zpckey(1) for more details. .PP The \f[V]hbkzpc provider\f[R] supports protected key origins for retrievable secrets in IBM Secure Execution for Linux (SEL) ultravisor. .SS Provider functions .PP The \f[V]hbkzpc provider\f[R] plugs into the OpenSSL provider API and provides the following functions: .IP \[bu] 2 signature-algorithms for ECDSA and EdDSA .IP \[bu] 2 key-manager for provider-specific keys .IP \[bu] 2 store-loader for provider-specific key URIs .IP \[bu] 2 decoder for DER/PEM encoded provider-specific key URI files .SS Supported ECC curves .PP The \f[V]hbkzpc provider\f[R] supports the following ECC-curves for ECDSA and EdDSA respectively: .IP \[bu] 2 prime256v1 .IP \[bu] 2 secp384r1 .IP \[bu] 2 secp521r1 .IP \[bu] 2 ED25519 .IP \[bu] 2 ED448 .SH URI .PP The HBKZPC unified resource identifier (URI) specifies all information of the protected key origins, which is required for the provider to derive the related protected key. The URI has the following syntax (ABNF representation): .IP .nf \f[C] hbkzpc-URI = \[dq]hbkzpc:\[dq] hbkzpc-param hbkzpc-param = [ hbkzpc-pattr *(\[dq];\[dq] hbkzpc-pattr) ] hbkzpc-pattr = origin-type / origin-alg / origin-blob / origin-pubkey / comment origin-type = \[dq]origin-type\[dq] \[dq]=\[dq] *pchar origin-alg = \[dq]origin-alg\[dq] \[dq]=\[dq] oid / *(pchar) origin-blob = \[dq]origin-blob\[dq] \[dq]=\[dq] hex-string origin-pubkey = \[dq]origin-pubkey\[dq] \[dq]=\[dq] hex-string comment = \[dq]comment\[dq] \[dq]=\[dq] *pchar-pct oid = DIGIT *(\[dq].\[dq] DIGIT) hex-byte = 2*HEXDIG hex-string = [ hex-byte *(hex-byte) ] pchar-pct = pchar / pct-encoded pchar = unreserved / res-avail res-avail = \[dq]:\[dq] / \[dq][\[dq] / \[dq]]\[dq] / \[dq]\[at]\[dq] / \[dq]!\[dq] / \[dq]$\[dq] / \[dq]\[aq]\[dq] / \[dq](\[dq] / \[dq])\[dq] / \[dq]*\[dq] / \[dq]+\[dq] / \[dq],\[dq] / \[dq]=\[dq] pct-encoded = [ \[dq]%\[dq] 2*HEXDIG ] unreserved = ALPHA / DIGIT / \[dq]-\[dq] / \[dq].\[dq] / \[dq]_\[dq] / \[dq]\[ti]\[dq] \f[R] .fi .SH ENCODING .PP The URI can also be encoded and stored to a file. Supported encoding formats are DER and PEM. .SS DER encoding .PP For the DER encoding, the HBKZPC URI is encapsulated with a ASN.1 structure. Each DER file contains one structure in binary form. The structure has the following syntax: .IP .nf \f[C] HardwareBackedKeyZPCFormat DEFINITIONS ::= BEGIN HBKZPC ::= SEQUENCE { desc [0] EXPLICIT VisibleString, uri [1] EXPLICIT UTF8String, } END \f[R] .fi .PP The DER decoder of the \f[V]hbkzpc provider\f[R] only handles DER files with a description (\f[I]desc\f[R]) of \f[I]HBKZPC Provider URI v1.0\f[R]. .SS PEM encoding .PP The PEM encoding is a base64-encoded DER structure. The encoded data is surrounded by a start and end tag. A PEM encoded file has the following form: .IP .nf \f[C] -----BEGIN HARDWARE BACKED KEY ZPC----- [... <BASE64-encoded data> ...] -----END HARDWARE BACKED KEY ZPC----- \f[R] .fi .PP The PEM decoder of the \f[V]hbkzpc provider\f[R] only handles PEM files with the label \f[I]HARDWARE BACKED KEY ZPC\f[R]. .SH GLOSSARY .TP CEX IBM Crypto Express .TP CPACF CP Assist for Cryptographic Functions .TP HBK hardware-backed key .TP SEL IBM Secure Execution for Linux .TP URI unified resource identifier .TP ZPC IBM Z protected key cryptography .SH SEE ALSO .PP zpckey(1), hbkzpcprovider.conf(5), provider(7SSL). ++++++ hbkzpcprovider.conf.5 ++++++ .\" Automatically generated by Pandoc 2.18 .\" .\" Define V font for inline verbatim, using C font in formats .\" that render this, and otherwise B font. .ie "\f[CB]x\f[]"x" \{\ . ftr V B . ftr VI BI . ftr VB B . ftr VBI BI .\} .el \{\ . ftr V CR . ftr VI CI . ftr VB CB . ftr VBI CBI .\} .TH "HBKZPCPROVIDER.CNF" "5" "2026" "LIBZPC v2" "" .hy .SH NAME .PP hbkzpcprovider.conf - Configuration syntax for the \f[V]hbkzpc provider\f[R] .SH DESCRIPTION .PP This page documents the syntax of the OpenSSL configuration file for the \f[V]hbkzpc provider\f[R]. It is a sub-set of the OpenSSL configuration file format, described in config(5SSL). .SH CONFIGURATION .SS OpenSSL Configuration .PP The \f[V]hbkzpc provider\f[R] can be configured application-specific or system-wide. In both cases, the configuration file needs to define and reference a section for the \f[V]hbkzpc provider\f[R], following the OpenSSL configuration syntax (config(5SSL)). .PP The provider section for the \f[V]hbkzpc provider\f[R] specifies the shared library of the provider (mandatory) and an activation flag (optional). .PP Since OpenSSL configuration supports drop-ins (keyword \f[V].inlcude\f[R]), the configuration for the \f[V]hbkzpc provider\f[R] can also be placed in a separate configuration file. .SS Provider Section .PP A provider section in the OpenSSL configuration defines generic parameters, as well as provider-specific parameters. Each provider section must be referenced in the global providers sections (\f[I]provider_sect\f[R]) of the OpenSSL configuration file. The \f[V]hbkzpc provider\f[R] supports no provider-specific parameters, but the provider section for the \f[V]hbkzpc provider\f[R] must specify at least the generic provider section parameter \f[I]module\f[R]. For more details about the generic provider parameters, see config(5SSL). .TP module (mandatory) This parameter takes a path to the provider shared object file. For the \f[V]hbkzpc provider\f[R], use the absolute path to the installation location of \f[V]zpcprovider.so\f[R] or the relative path to the OpenSSL modules directory. .TP activate (optional) If present and set to \f[V]1\f[R], then the associated provider is activated. Conversely, setting this value to \f[V]0\f[R] or not specifying the parameter at all prevents the provider from being activated (default: \f[V]0\f[R]). .PP The \f[I]identity\f[R] parameter may be used in the provider section, but it has no impact to the registration of the \f[V]hbkzpc provider\f[R]. It will always register itself with \[lq]provider=hbkzpc\[rq]. Multiple instances of this provider may work but are not supported. .SH EXAMPLES .PP The following drop-in example specifies the \f[V]hbkzpc provider\f[R] module and activates it. .IP .nf \f[C] [provider_sect] hbkzpc = hbkzpc_sect [hbkzpc_sect] module = zpcprovider.so activate = 1 \f[R] .fi .PP The drop-in file needs to be included in the main OpenSSL configuration, either by specifying the drop-in file or the drop-in directory (for example \f[V]/etc/pki/tls/openssl.d/\f[R] on Fedora). .IP .nf \f[C] \&.include /path/to/drop-in-directory \f[R] .fi .PP The following configuration example covers a complete minimal OpenSSL configuration. It can be used for example as a temporary replacement for the system-wide OpenSSL configuration. .IP .nf \f[C] HOME = . openssl_conf = openssl_init [openssl_init] providers = provider_sect alg_section = evp_properties [provider_sect] default = default_sect base = base_sect hbkzpc = hbkzpc_sect [evp_properties] [base_sect] activate = 1 [default_sect] activate = 1 [hbkzpc_sect] module = /path/to/zpcprovider.so activate = 1 \f[R] .fi .PP To use this configuration example for an application, store it to a file (e.g.\ my-openssl.conf) and reference this file in the environment variable \f[V]OPENSSL_CONF\f[R]. The following command lists all configured providers: base, default and hbkzpc. .IP .nf \f[C] $ env OPENSSL_CONF=my-openssl.conf openssl list -providers Providers: base name: OpenSSL Base Provider version: 4.0.0 status: active default name: OpenSSL Default Provider version: 4.0.0 status: active hbkzpc name: hbkzpc version: 2.0.0 status: active \f[R] .fi .SH SEE ALSO .PP hbkzpcprovider(7), config(5SSL). ++++++ zpckey.1 ++++++ .\" Automatically generated by Pandoc 2.18 .\" .\" Define V font for inline verbatim, using C font in formats .\" that render this, and otherwise B font. .ie "\f[CB]x\f[]"x" \{\ . ftr V B . ftr VI BI . ftr VB B . ftr VBI BI .\} .el \{\ . ftr V CR . ftr VI CI . ftr VB CB . ftr VBI CBI .\} .TH "ZPCKEY" "1" "2026" "LIBZPC v2" "" .hy .SH NAME .PP zpckey - A key management tooling for protected key origins, used by the OpenSSL provider for protected keys (\f[V]hbkzpc provider\f[R]). .SH SYNOPSIS .PP zpckey [-h|\[en]help] [-V|\[en]version] .PP zpckey compose <REQ-ARGS> [<OPT-ARGS>] <ORIGIN-ARGS> .PP zpckey show <REQ-ARGS> [<OPT-ARGS>] .SH DESCRIPTION .PP The zpckey command provides key management functions for protected key origins, used by the \f[V]hbkzpc provider\f[R] (hbkzpcprovider(7)). IBM Z and IBM LinuxONE offer different types of cryptographic hardware with different features, including the CP Assist for Cryptographic Functions (CPACF) and the IBM Crypto Express (CEX) features. .PP The CPACF provides functions to perform cryptographic operations with a kind of hardware-backed keys, the so called protected keys. .PP The CEX cards provide secure key generation and storage (secure keys), as well as cryptographic operations with these keys. .SH OPTIONS .TP -V, --version Show version .TP -h, --help Show short help .SH ZPCKEY COMPOSE .PP The \f[I]compose\f[R] command supports the composition of protected key origins, which can be used for the \f[V]hbkzpc provider\f[R]. .SS Required Arguments: .TP -t, --origin-type <otype> Protected key origin type .TP -a, --origin-alg <oalg> Protected key origin algorithm .SS Protected key origin types (<otype>): .IP \[bu] 2 uv: Ultravisor retrievable secrets .SS Protected key origin algorithms (<oalg>): .IP \[bu] 2 prime256v1 (alt.: 1.2.840.10045.3.1.7) .IP \[bu] 2 secp384r1 (alt.: 1.3.132.0.34) .IP \[bu] 2 secp521r1 (alt.: 1.3.132.0.35) .IP \[bu] 2 ED25519 (alt.: 1.3.101.112) .IP \[bu] 2 ED448 (alt.: 1.3.101.113) .IP \[bu] 2 AES-128 .IP \[bu] 2 AES-192 .IP \[bu] 2 AES-256 .IP \[bu] 2 AES-128-XTS .IP \[bu] 2 AES-256-XTS .SS Optional Arguments: .TP -p, --pubkey <file> Public key file .TP -o, --out <file> Output file .TP --outform <format> Output file format URI, DER or PEM (default: PEM) .TP -c, --comment <string> Comment (metadata) .TP -h, --help Show short help .SS Origin Arguments: .TP For <otype> = \f[I]uv\f[R], one out of the following must be specified: .TP --uv-secret-id <hexstring> UV secret ID .TP --uv-secret-name <string> UV secret name .SH ZPCKEY SHOW .PP The \f[I]show\f[R] command prints information about the key file to stdout. .SS Required Arguments: .TP -i, --in <file> Input file .SS Optional Arguments: .TP --inform <format> Input file format PEM or DER (default: PEM) .TP -h, --help Show short help .SH SEE ALSO .PP hbkzpcprovider.conf(5), hbkzpcprovider(7)
