Hello community,

here is the log from the commit of package dracut for openSUSE:Factory checked 
in at 2017-07-17 09:02:47
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/dracut (Old)
 and      /work/SRC/openSUSE:Factory/.dracut.new (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Package is "dracut"

Mon Jul 17 09:02:47 2017 rev:110 rq:510121 version:044.1

Changes:
--------
--- /work/SRC/openSUSE:Factory/dracut/dracut.changes    2017-06-20 
09:33:48.327815641 +0200
+++ /work/SRC/openSUSE:Factory/.dracut.new/dracut.changes       2017-07-17 
09:02:49.814309450 +0200
@@ -1,0 +2,18 @@
+Thu Jul 13 15:15:29 UTC 2017 - daniel.molken...@suse.com
+
+- switch fips checking to use the libkcapi based fipscheck toolset 
(bsc#1048565)
+ * adds 0527-switch-fips-checking-to-use-the-libkcapi-based-fipsc.patch
+
+-------------------------------------------------------------------
+Wed Jul 12 12:27:52 UTC 2017 - daniel.molken...@suse.com
+
+- iscsiroot: call handle_firmware only for non-iface invocations (bsc#1032284)
+ * adds 0526-iscsiroot-call-handle_firmware-only-for-non-iface-in.patch
+
+-------------------------------------------------------------------
+Tue Jul 11 09:55:00 UTC 2017 - daniel.molken...@suse.com
+
+- bail out if module directory does not exist (bsc#1043900)
+  * adds 0525-backport-bail-out-if-module-directory-does-not-exist.patch
+
+-------------------------------------------------------------------
@@ -5 +23 @@
-  adds 0524-Suppress-nonsensical-error-message-bsc-1032029.patch
+  * adds 0524-Suppress-nonsensical-error-message-bsc-1032029.patch

New:
----
  0525-backport-bail-out-if-module-directory-does-not-exist.patch
  0526-iscsiroot-call-handle_firmware-only-for-non-iface-in.patch
  0527-switch-fips-checking-to-use-the-libkcapi-based-fipsc.patch

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Other differences:
------------------
++++++ dracut.spec ++++++
--- /var/tmp/diff_new_pack.FKDQSf/_old  2017-07-17 09:02:52.365950132 +0200
+++ /var/tmp/diff_new_pack.FKDQSf/_new  2017-07-17 09:02:52.369949568 +0200
@@ -206,6 +206,9 @@
 Patch522:       0522-Fix-typo-from-commit-3f1cdb520.patch
 Patch523:       0523-98dracut-systemd-Fix-module-force-loading-with-syste.patch
 Patch524:       0524-Suppress-nonsensical-error-message-bsc-1032029.patch
+Patch525:       0525-backport-bail-out-if-module-directory-does-not-exist.patch
+Patch526:       0526-iscsiroot-call-handle_firmware-only-for-non-iface-in.patch
+Patch527:       0527-switch-fips-checking-to-use-the-libkcapi-based-fipsc.patch
 
 BuildRequires:  asciidoc
 BuildRequires:  bash
@@ -253,6 +256,7 @@
 Requires:       fipscheck
 Requires:       libcryptsetup4-hmac
 Requires:       libgcrypt20-hmac
+Requires:       libkcapi-tools
 
 %description fips
 This package requires everything which is needed to build an
@@ -436,6 +440,9 @@
 %patch522 -p1
 %patch523 -p1
 %patch524 -p1
+%patch525 -p1
+%patch526 -p1
+%patch527 -p1
 
 %build
 %configure\

++++++ 0524-Suppress-nonsensical-error-message-bsc-1032029.patch ++++++
--- /var/tmp/diff_new_pack.FKDQSf/_old  2017-07-17 09:02:52.785890996 +0200
+++ /var/tmp/diff_new_pack.FKDQSf/_new  2017-07-17 09:02:52.789890433 +0200
@@ -1,4 +1,4 @@
-From 33f374affcd65741dcef747c7cb57482d9ff3103 Mon Sep 17 00:00:00 2001
+From a651341debaf284101cb32c27373ed9a0dec7107 Mon Sep 17 00:00:00 2001
 From: Daniel Molkentin <dmolken...@suse.com>
 Date: Mon, 19 Jun 2017 13:42:43 +0200
 Subject: [PATCH] Suppress nonsensical error message (bsc#1032029)

++++++ 0525-backport-bail-out-if-module-directory-does-not-exist.patch ++++++
>From cb1c81fc7f6bc72a72de1f87847924572aa39b54 Mon Sep 17 00:00:00 2001
From: Daniel Molkentin <dmolken...@suse.com>
Date: Thu, 29 Jun 2017 17:18:37 +0200
Subject: [PATCH] backport: bail out if module directory does not exist

this basically reverts commit
05214a0bedc084a41c35a128609745ad04a0c6cf

if people want to build the initramfs without kernel modules,
then --no-kernel should be specified

Upstream-Commit: 106255afd46ea2be1d035aca0c5695186a3f2c41
---
 dracut.sh | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/dracut.sh b/dracut.sh
index 1016d5ae..492ecbf7 100755
--- a/dracut.sh
+++ b/dracut.sh
@@ -632,12 +632,6 @@ if ! [[ $kernel ]]; then
     kernel=$(uname -r)
 fi
 
-if [[ $kernel ]]; then
-    if ! [[ -d /lib/modules/$kernel ]] && [[ $no_kernel != yes ]]; then
-        printf -- "Kernel version $kernel has no module directory 
/lib/modules/$kernel\n" >&2
-    fi
-fi
-
 if ! [[ $outfile ]]; then
     [[ -f /etc/machine-id ]] && read MACHINE_ID < /etc/machine-id
 
@@ -892,6 +886,12 @@ else
     exit 1
 fi
 
+if [[ $no_kernel != yes ]] && ! [[ -d $srcmods ]]; then
+    printf "%s\n" "dracut: Cannot find module directory $srcmods" >&2
+    printf "%s\n" "dracut: and --no-kernel was not specified" >&2
+    exit 1
+fi
+
 if ! [[ $print_cmdline ]]; then
     inst /bin/sh
     if ! $DRACUT_INSTALL ${initdir:+-D "$initdir"} -R "$initdir/bin/sh" 
&>/dev/null; then
-- 
2.12.3

++++++ 0526-iscsiroot-call-handle_firmware-only-for-non-iface-in.patch ++++++
>From d9e0e5682daeda83e5b1096d2fe570f2d38e65a5 Mon Sep 17 00:00:00 2001
From: Daniel Molkentin <dmolken...@suse.com>
Date: Wed, 12 Jul 2017 11:46:50 +0200
Subject: [PATCH] iscsiroot: call handle_firmware only for non-iface
 invocations (bsc#1032284)

This partially reverts the "setup bnx2i offload connections properly"
patch to the original version from bsc#997598.

Patch-by: Martin Wilck <martin.wi...@suse.com>
---
 modules.d/95iscsi/iscsiroot.sh | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/modules.d/95iscsi/iscsiroot.sh b/modules.d/95iscsi/iscsiroot.sh
index 6ad279f2..3a2463f5 100755
--- a/modules.d/95iscsi/iscsiroot.sh
+++ b/modules.d/95iscsi/iscsiroot.sh
@@ -264,9 +264,11 @@ if [ "$netif" = "timeout" ] && all_ifaces_setup; then
 fi
 
 if getargbool 0 rd.iscsi.firmware -d -y iscsi_firmware ; then
-    [ -f /tmp/session-retry ] || echo 1 > /tmp/session-retry
-    handle_firmware
-    ret=$?
+    if [ "$netif" = "timeout" ] || [ "$netif" = "online" ] || [ "$netif" = 
"dummy" ]; then
+        [ -f /tmp/session-retry ] || echo 1 > /tmp/session-retry
+        handle_firmware
+        ret=$?
+    fi
 fi
 
 if ! [ "$netif" = "online" ]; then
-- 
2.12.3

++++++ 0527-switch-fips-checking-to-use-the-libkcapi-based-fipsc.patch ++++++
>From 3a1abe58f68fbdee31f7370314432ff903954daa Mon Sep 17 00:00:00 2001
From: Marcus Meissner <meiss...@suse.de>
Date: Thu, 13 Jul 2017 16:56:14 +0200
Subject: [PATCH] switch fips checking to use the libkcapi based fipscheck
 toolset.

---
 modules.d/01fips/fips.sh         | 19 ++++++++++++++++---
 modules.d/01fips/module-setup.sh | 10 ++++++++++
 suse/dracut.spec                 |  1 +
 3 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/modules.d/01fips/fips.sh b/modules.d/01fips/fips.sh
index ddf03994..081dba95 100755
--- a/modules.d/01fips/fips.sh
+++ b/modules.d/01fips/fips.sh
@@ -57,9 +57,15 @@ do_rhevh_check()
 {
     KERNEL=$(uname -r)
     kpath=${1}
-
+    FIPSCHECK=/usr/lib64/libkcapi/fipscheck
+    if [ ! -f $FIPSCHECK ]; then
+        FIPSCHECK=/usr/lib/libkcapi/fipscheck
+    fi
+    if [ ! -f $FIPSCHECK ]; then
+        FIPSCHECK=/usr/bin/fipscheck
+    fi
     # If we're on RHEV-H, the kernel is in /run/initramfs/live/vmlinuz0
-    if fipscheck $NEWROOT/boot/vmlinuz-${KERNEL} ; then
+    if $FIPSCHECK $NEWROOT/boot/vmlinuz-${KERNEL} ; then
         warn "HMAC sum mismatch"
         return 1
     fi
@@ -81,6 +87,13 @@ do_fips()
     fi
 
     KERNEL=$(uname -r)
+    FIPSCHECK=/usr/lib64/libkcapi/fipscheck
+    if [ ! -f $FIPSCHECK ]; then
+        FIPSCHECK=/usr/lib/libkcapi/fipscheck
+    fi
+    if [ ! -f $FIPSCHECK ]; then
+        FIPSCHECK=/usr/bin/fipscheck
+    fi
 
     if ! [ -e "/boot/.${_vmname}-${KERNEL}.hmac" ]; then
         warn "/boot/.${_vmname}-${KERNEL}.hmac does not exist"
@@ -134,7 +147,7 @@ do_fips()
     elif [ -e "/run/initramfs/live/isolinux/vmlinuz0" ]; then
         do_rhevh_check /run/initramfs/live/isolinux/vmlinuz0 || return 1
     else
-        fipscheck "/boot/${_vmname}-${KERNEL}" || return 1
+        $FIPSCHECK "/boot/${_vmname}-${KERNEL}" || return 1
     fi
 
     info "All initrd crypto checks done"
diff --git a/modules.d/01fips/module-setup.sh b/modules.d/01fips/module-setup.sh
index beeb2f6d..9e5eca4f 100755
--- a/modules.d/01fips/module-setup.sh
+++ b/modules.d/01fips/module-setup.sh
@@ -24,6 +24,7 @@ installkernel() {
     _fipsmodules+="cast6_generic cast5_generic cast_common sha512_ssse3 
serpent_sse2_x86_64 serpent_generic twofish_generic "
     _fipsmodules+="ablk_helper cryptd twofish_x86_64_3way lrw glue_helper 
twofish_x86_64 twofish_common blowfish_generic "
     _fipsmodules+="blowfish_x86_64 blowfish_common des_generic cbc "
+    _fipsmodules+="algif_hash af_alg crypto_user "
 
     mkdir -m 0755 -p "${initdir}/etc/modprobe.d"
 
@@ -54,9 +55,18 @@ install() {
         .libgcrypt.so.20.hmac \
         libfreeblpriv3.so libfreeblpriv3.chk
 
+    if [ -f /usr/lib64/libkcapi/.fipscheck.hmac ]; then
+        inst_simple /usr/lib64/libkcapi/.fipscheck.hmac
+        inst_simple /usr/lib64/libkcapi/fipscheck
+    else
+        inst_simple /usr/lib/libkcapi/.fipscheck.hmac
+        inst_simple /usr/lib/libkcapi/fipscheck
+    fi
+
     # we do not use prelink at SUSE
     #inst_multiple -o prelink
 
     inst_simple /etc/system-fips
+
 }
 
-- 
2.12.3


Reply via email to