https://bugzilla.redhat.com/show_bug.cgi?id=2214269
Bug ID: 2214269 Summary: openssl-pkcs11-sign-provider: OpenSSL 3.0 provider for pkcs#11 (private key operations only) Product: Fedora Version: rawhide OS: Linux Status: NEW Component: Package Review Assignee: nobody@fedoraproject.org Reporter: dengler@linux.ibm.com QA Contact: extras-qa@fedoraproject.org CC: package-review@lists.fedoraproject.org Target Milestone: --- Classification: Fedora
Created attachment 1970417 --> https://bugzilla.redhat.com/attachment.cgi?id=1970417&action=edit Specfile
Description: The openssl-pkcs11-sign-provider is a provider module for openssl v3.0, which uses the PKCS#11 API to perform operations (sign/decrypt) with private asymmetric keys. The main purpose of the openssl-pkcs11-sign-provider is to provide TLS applictions (e.g. web-servers) access to sensitive key material, which is stored in secure PKCS#11 tokens.
The openssl-pkcs11-sign-provider can be used on any architecture and with any implementation of the PKCS#11 standard (v3.0). At the moment, most of development and test has been done with opencryptoki.
Operations with public asymmetric keys are re-directed to a (configurable) built-in provider. Symmetric operations are not supported.
Fedora Account System Username: dengler
Version-Release number of selected component (if applicable): 1.0.0
Additional info: upstream project: https://github.com/opencryptoki/openssl-pkcs11-sign-provider
https://bugzilla.redhat.com/show_bug.cgi?id=2214269
--- Comment #1 from Holger Dengler dengler@linux.ibm.com --- Created attachment 1970418 --> https://bugzilla.redhat.com/attachment.cgi?id=1970418&action=edit Source RPM
https://bugzilla.redhat.com/show_bug.cgi?id=2214269
Holger Dengler dengler@linux.ibm.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |dan.horak@email.cz, | |jschmidb@de.ibm.com Doc Type|--- |If docs needed, set a value
https://bugzilla.redhat.com/show_bug.cgi?id=2214269
Holger Dengler dengler@linux.ibm.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Hardware|Unspecified |All
https://bugzilla.redhat.com/show_bug.cgi?id=2214269
Dan Horák dan@danny.cz changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags| |fedora-review? Assignee|nobody@fedoraproject.org |dan@danny.cz Status|NEW |ASSIGNED
https://bugzilla.redhat.com/show_bug.cgi?id=2214269
--- Comment #2 from Dan Horák dan@danny.cz --- I think it looks good (a formal review will follow), but I have a question about the tests. There are BuildRequires listed for tests, but the %check section is missing. If I understand it right, then the tests need the pkcsslotd service running, which can't be expected during the regular rpm build.
I think there are ~3 options - comment out (or remove) the test related BRs - add %check with commented out "make check" with some comment about running pkcsslotd in advance - hide both the test BRs and %check behind a "with_test" condition, again with comment about pkcsslotd I suppose starting pkcsslotd from the tests is not possible ...
Holger, what do you think?
https://bugzilla.redhat.com/show_bug.cgi?id=2214269
--- Comment #3 from Holger Dengler dengler@linux.ibm.com --- You're right, for executing the tests, pkcsslotd is (currently) required, as well as a working opencryptoki and p11-kit setup.
For the moment, I would like to go forward with option 2. As soon as there are other test-modules available (as the test-framework allow it), I can remove the comments and activate `make check` during package build.
https://bugzilla.redhat.com/show_bug.cgi?id=2214269
--- Comment #4 from Holger Dengler dengler@linux.ibm.com --- Created attachment 1970647 --> https://bugzilla.redhat.com/attachment.cgi?id=1970647&action=edit Specfile (with empty %check section)
https://bugzilla.redhat.com/show_bug.cgi?id=2214269
Holger Dengler dengler@linux.ibm.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Attachment|0 |1 #1970418 is| | obsolete| |
--- Comment #5 from Holger Dengler dengler@linux.ibm.com --- Created attachment 1970648 --> https://bugzilla.redhat.com/attachment.cgi?id=1970648&action=edit Source RPM
https://bugzilla.redhat.com/show_bug.cgi?id=2214269
Holger Dengler dengler@linux.ibm.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Attachment|0 |1 #1970417 is| | obsolete| |
https://bugzilla.redhat.com/show_bug.cgi?id=2214269
Dan Horák dan@danny.cz changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags|fedora-review? |fedora-review+
--- Comment #6 from Dan Horák dan@danny.cz --- formal review is here, see the notes explaining OK* and BAD statuses below:
OK source files match upstream: 4e28e1e21ee93bd15c8ae9fe6cad565d417bc0f2 openssl-pkcs11-sign-provider-1.0.0.tar.gz OK package meets naming and versioning guidelines. OK* specfile is properly named, is cleanly written and uses macros consistently. OK dist tag is present. OK license field matches the actual license. OK license is open source-compatible (Apache-2.0). License text included in package. OK latest version is being packaged. OK BuildRequires are proper. OK compiler flags are appropriate. OK package builds in mock (Rawhide/ppc64le). OK debuginfo package looks complete. OK rpmlint is silent. OK final provides and requires look sane. N/A %check is present and all tests pass. OK no shared libraries are added to the regular linker search paths. OK owns the directories it creates. OK doesn't own any directories it shouldn't. OK no duplicates in %files. OK file permissions are appropriate. OK no scriptlets present. OK code, not content. OK documentation is small, so no -docs subpackage is necessary. OK %docs are not necessary for the proper functioning of the package. OK no headers. OK no pkgconfig files. OK no libtool .la droppings. OK not a GUI app.
- I think you can switch to %autochangelog in addition to %autorelease before importing, see https://fedoraproject.org/wiki/Changes/rpmautospec for some details
The package is APPROVED and I will sponsor you into the packager group as well.
https://bugzilla.redhat.com/show_bug.cgi?id=2214269
Petr Menšík pemensik@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |pemensik@redhat.com
--- Comment #7 from Petr Menšík pemensik@redhat.com --- I would recommend using %bcond_with tests. That way it can enabled during build time. Makes it easy to do test local build by: fedpkg local --with tests
But will stay disabled by default, where it requires something extra to pass. I did something similar on cpp-httplib package with %bcond_with online: https://src.fedoraproject.org/rpms/cpp-httplib/blob/rawhide/f/cpp-httplib.sp...
That makes it possible to change behaviour slightly by defining --with parameter. fedpkg mockbuild allows it too, in case it can work even from chroot.
https://bugzilla.redhat.com/show_bug.cgi?id=2214269
Holger Dengler dengler@linux.ibm.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Summary|openssl-pkcs11-sign-provide |openssl-pkcs11-sign-provide |r: OpenSSL 3.0 provider for |r - OpenSSL 3.0 provider |pkcs#11 (private key |for pkcs#11 (private key |operations only) |operations only)
https://bugzilla.redhat.com/show_bug.cgi?id=2214269
Holger Dengler dengler@linux.ibm.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Summary|openssl-pkcs11-sign-provide |Review requested: |r - OpenSSL 3.0 provider |openssl-pkcs11-sign-provide |for pkcs#11 (private key |r - OpenSSL 3.0 provider |operations only) |for pkcs#11 (private key | |operations only)
https://bugzilla.redhat.com/show_bug.cgi?id=2214269
--- Comment #8 from Fedora Admin user for bugzilla script actions fedora-admin-xmlrpc@fedoraproject.org --- The Pagure repository was created at https://src.fedoraproject.org/rpms/openssl-pkcs11-sign-provider
https://bugzilla.redhat.com/show_bug.cgi?id=2214269
Fedora Update System updates@fedoraproject.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |MODIFIED
--- Comment #9 from Fedora Update System updates@fedoraproject.org --- FEDORA-2023-42193d9705 has been submitted as an update to Fedora 39. https://bodhi.fedoraproject.org/updates/FEDORA-2023-42193d9705
https://bugzilla.redhat.com/show_bug.cgi?id=2214269
Fedora Update System updates@fedoraproject.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|MODIFIED |CLOSED Resolution|--- |ERRATA Last Closed| |2023-06-13 15:07:01
--- Comment #10 from Fedora Update System updates@fedoraproject.org --- FEDORA-2023-42193d9705 has been pushed to the Fedora 39 stable repository. If problem still persists, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=2214269
--- Comment #11 from Fedora Update System updates@fedoraproject.org --- FEDORA-2023-76b638f02b has been submitted as an update to Fedora 38. https://bodhi.fedoraproject.org/updates/FEDORA-2023-76b638f02b
https://bugzilla.redhat.com/show_bug.cgi?id=2214269
--- Comment #12 from Fedora Update System updates@fedoraproject.org --- FEDORA-2023-128b5cecf0 has been submitted as an update to Fedora 37. https://bodhi.fedoraproject.org/updates/FEDORA-2023-128b5cecf0
https://bugzilla.redhat.com/show_bug.cgi?id=2214269
--- Comment #13 from Fedora Update System updates@fedoraproject.org --- FEDORA-2023-76b638f02b has been pushed to the Fedora 38 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf install --enablerepo=updates-testing --refresh --advisory=FEDORA-2023-76b638f02b *` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2023-76b638f02b
See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
https://bugzilla.redhat.com/show_bug.cgi?id=2214269
--- Comment #14 from Fedora Update System updates@fedoraproject.org --- FEDORA-2023-128b5cecf0 has been pushed to the Fedora 37 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf install --enablerepo=updates-testing --refresh --advisory=FEDORA-2023-128b5cecf0 *` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2023-128b5cecf0
See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
https://bugzilla.redhat.com/show_bug.cgi?id=2214269
--- Comment #15 from Fedora Update System updates@fedoraproject.org --- FEDORA-2023-128b5cecf0 has been pushed to the Fedora 37 stable repository. If problem still persists, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=2214269
--- Comment #16 from Fedora Update System updates@fedoraproject.org --- FEDORA-2023-76b638f02b has been pushed to the Fedora 38 stable repository. If problem still persists, please make note of it in this bug report.
package-review@lists.fedoraproject.org