From 822bd1377153e15b8ee5190c8be76b880d23aa37 Mon Sep 17 00:00:00 2001
From: Simo Sorce <simo@redhat.com>
Date: Tue, 16 Apr 2024 15:34:21 -0400
Subject: [PATCH] Rework how this special package works

To work around harcoded paths in rpmbuild we had to change the package
name in the spec file so that all of the packages we produce are
technically subpackages of the main "openssl-fips" package.

This is due to rpmbuild otherwise intefering with the contents of the
"main" debuginfo package. By changing the name of the "package" to
openssl-fips we can then create "provider" subpackages so that rpmbuild
does not interfere with the contents of the
openssl-fips-provider-debuginfo package.

Changes:
- name macro change and disablement of debug_package variable

- Change tarball source contents
  Replace custom tarball with one generated by the following steps:
  $ brew download-build --debuginfo 2788361
  $ tar cvzf openssl-fips-provider-3.0.7.tar.gz --owner=openssl --group=openssl *

- Rework file extraction process
  Extracts files directly from the original rpms using cpio

- Fixes debug packages
  Copy the correct debug files as shiped in the original debuginfo rpm
  Use a debuginfo subpackage because rpmbuild interferes if the
  package is "%{name}-debuginfo package making assumptions that do not
  hold in our case.

Resolves: RHEL-32123

Signed-off-by: Simo Sorce <simo@redhat.com>
---
 .gitignore                 |  2 +-
 extract-fips.sh            | 72 +++++++++++++++++++++++++++++++++
 openssl-fips-provider.spec | 83 ++++++++++++++++++++++----------------
 sources                    |  2 +-
 4 files changed, 122 insertions(+), 37 deletions(-)
 create mode 100755 extract-fips.sh

diff --git a/.gitignore b/.gitignore
index 3f71ecf..adfbd53 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,2 @@
-/fips_module-3.0.7-18.el9_2.tar.gz
 /openssl-3.0.7-hobbled.tar.gz
+/openssl-fips-provider-3.0.7.tar.gz
diff --git a/extract-fips.sh b/extract-fips.sh
new file mode 100755
index 0000000..c981240
--- /dev/null
+++ b/extract-fips.sh
@@ -0,0 +1,72 @@
+#!/usr/bin/bash -e
+
+# args: build-V-R arch
+
+if [ -z "${RPM_BUILD_ROOT}" ]; then
+    echo >&2 "RPM_BUILD_ROOT is not set"
+    exit 1
+fi
+if [ -z "${ORIGINAL_PACKAGE_VERSION}" ]; then
+    echo >&2 "ORIGINAL_PACKAGE_VERSION is not set"
+    exit 1
+fi
+if [ -z "${ORIGINAL_PACKAGE_RELEASE}" ]; then
+    echo >&2 "ORIGINAL_PACKAGE_RELEASE is not set"
+    exit 1
+fi
+
+PKG_ARCH=${RPM_ARCH}
+if [ "${PKG_ARCH}" = "i386" ]; then
+    PKG_ARCH=i686
+fi
+
+OVR=${ORIGINAL_PACKAGE_VERSION}-${ORIGINAL_PACKAGE_RELEASE}
+BUILDDIR=${RPM_BUILD_DIR}/openssl-${ORIGINAL_PACKAGE_VERSION}
+DBGDIR=usr/lib/debug
+DBGSRCDIR=usr/src/debug/openssl-${OVR}.${RPM_ARCH}
+DEBUGINFO=${BUILDDIR}/debuginfo.list
+DEBUGSOURCE=${BUILDDIR}/debugsourcefiles.list
+
+# Remove existing files if any
+rm -fr ${RPM_BUILD_ROOT}/${DBGDIR}
+rm -fr ${RPM_BUILD_ROOT}/usr/src/debug/*
+> ${DEBUGINFO}
+> ${DEBUGSOURCE}
+
+# fips.so
+mkdir extract
+pushd extract
+
+rpm2cpio ${BUILDDIR}/openssl-libs-${OVR}.${PKG_ARCH}.rpm |cpio -id --quiet
+rpm2cpio ${BUILDDIR}/openssl-libs-debuginfo-${OVR}.${PKG_ARCH}.rpm |cpio -id --quiet
+rpm2cpio ${BUILDDIR}/openssl-debuginfo-${OVR}.${PKG_ARCH}.rpm |cpio -id --quiet
+rpm2cpio ${BUILDDIR}/openssl-debugsource-${OVR}.${PKG_ARCH}.rpm |cpio -id --quiet
+FIPS_SO=$(find usr -name fips.so)
+cp -adt ${RPM_BUILD_ROOT} --parents ${FIPS_SO}
+FIPS_SO_DBG=$(find usr -name fips.so-${OVR}.${RPM_ARCH}.debug)
+cp -adt ${RPM_BUILD_ROOT} --parents ${FIPS_SO_DBG}
+
+FIPS_DBG_ID=$(find -L usr -samefile ${FIPS_SO_DBG} -xtype l)
+FIPS_DBG_ID_DIR=$(dirname ${FIPS_DBG_ID})
+cp -adt ${RPM_BUILD_ROOT} --parents ${FIPS_DBG_ID_DIR}
+cp -adt ${RPM_BUILD_ROOT} --parents ${DBGDIR}/.dwz
+
+#remove unnecessary parts
+rm -fr ${DBGSRCDIR}/apps
+rm -fr ${DBGSRCDIR}/engines
+rm -fr ${DBGSRCDIR}/ssl
+cp -adt ${RPM_BUILD_ROOT} --parents usr/src/debug
+
+popd
+
+pushd ${RPM_BUILD_ROOT}
+
+find ${DBGDIR} -type d | sed -e "s#^#%dir /#" >> ${DEBUGINFO}
+find ${DBGDIR} -type f | sed -e "s#^#/#">> ${DEBUGINFO}
+find ${DBGDIR} -type l | sed -e "s#^#/#">> ${DEBUGINFO}
+
+find ${DBGSRCDIR} -type d | sed -e "s#^#%dir /#" >> ${DEBUGSOURCE}
+find ${DBGSRCDIR} -type f | sed -e "s#^#/#">> ${DEBUGSOURCE}
+find ${DBGSRCDIR} -type l | sed -e "s#^#/#">> ${DEBUGSOURCE}
+
+popd
diff --git a/openssl-fips-provider.spec b/openssl-fips-provider.spec
index 7c58a9c..16decd2 100644
--- a/openssl-fips-provider.spec
+++ b/openssl-fips-provider.spec
@@ -10,12 +10,13 @@
 # also be handled in opensslconf-new.h.
 %define multilib_arches %{ix86} ia64 %{mips} ppc ppc64 s390 s390x sparcv9 sparc64 x86_64
 
-%global _performance_build 1
+%global debug_package %{nil}
+%define orig_release 18.el9_2
 
 Summary: FIPS module for OpenSSL
-Name: openssl-fips-provider
+Name: openssl-fips
 Version: 3.0.7
-Release: 2%{?dist}
+Release: 3%{?dist}
 
 # We have to remove certain patented algorithms from the openssl source
 # tarball with the hobble-openssl script which is included below.
@@ -31,7 +32,8 @@ Source10: configuration-prefix.h
 Source12: ec_curve.c
 Source13: ectest.c
 Source14: 0025-for-tests.patch
-Source15: fips_module-3.0.7-18.el9_2.tar.gz
+Source15: %{name}-provider-%{version}.tar.gz
+Source16: extract-fips.sh
 
 # Patches exported from source git
 # Aarch64 and ppc64le use lib64
@@ -197,13 +199,41 @@ BuildRequires: perl(Module::Load::Conditional), perl(File::Temp)
 BuildRequires: perl(Time::HiRes), perl(IPC::Cmd), perl(Pod::Html), perl(Digest::SHA)
 BuildRequires: perl(FindBin), perl(lib), perl(File::Compare), perl(File::Copy), perl(bigint)
 BuildRequires: git-core
+
+%description
+This package provides a custom build of the OpenSSL FIPS module that has been
+submitted to NIST for certification.
+
+%package provider
+Summary: FIPS module for OpenSSL
 Requires: coreutils
 Conflicts: openssl-libs < 1:3.0.7-26
 
-%description
+%description provider
 This package provides a custom build of the OpenSSL FIPS module that has been
 submitted to NIST for certification.
 
+%files provider
+%attr(0755,root,root) %{_libdir}/ossl-modules/fips.so
+
+%package provider-debuginfo
+Summary: Debug information for package %{name}
+Group: Development/Debug
+%description provider-debuginfo
+This package provides debug information for package %{name}.
+Debug information is useful when developing applications that use this
+package or when debugging this package.
+%files provider-debuginfo -f debuginfo.list
+
+%package provider-debugsource
+Summary: Debug sources for package %{name}
+Group: Development/Debug
+%description provider-debugsource
+This package provides debug sources for package %{name}.
+Debug sources are useful when developing applications that use this
+package or when debugging this package.
+%files provider-debugsource -f debugsourcefiles.list
+
 %prep
 %autosetup -S git -n openssl-%{version}
 
@@ -213,7 +243,6 @@ submitted to NIST for certification.
 
 cp %{SOURCE12} crypto/ec/
 cp %{SOURCE13} test/
-tar xf %{SOURCE15}
 
 ## NOTE: we do a full build every time to endure our ability to build
 ## from source as needed, but in RHEL we ultimately throw away all
@@ -286,7 +315,7 @@ RPM_OPT_FLAGS="$RPM_OPT_FLAGS -Wa,--noexecstack -Wa,--generate-missing-build-not
 
 export HASHBANGPERL=/usr/bin/perl
 
-%define fips %{version}-395c1a240fbfffd8
+%define fips %{version}-nevership
 # ia64, x86_64, ppc are OK by default
 # Configure the build tree.  Override OpenSSL defaults with known-good defaults
 # usable on all platforms.  The Configure script already knows to use -fPIC and
@@ -308,37 +337,21 @@ make %{?_smp_mflags} all
 %check
 #We re not using the actual built bits, so skip any checks on those binaries.
 
-
-# Replace the binary after all debugging info is extracted so we can ship
-# working debuginfo files
-%define __spec_install_post \
-    %{?__debug_package:%{__debug_install_post}} \
-    %{__arch_install_post} \
-    %{__os_install_post} \
-    cp fips_module/fips.so.%{_arch} $RPM_BUILD_ROOT%{_libdir}/ossl-modules/fips.so \
-%{nil}
-
-%define __provides_exclude_from %{_libdir}/openssl
-
 %install
-install -d $RPM_BUILD_ROOT{%{_bindir},%{_includedir},%{_libdir},%{_mandir},%{_libdir}/openssl,%{_pkgdocdir}}
-%make_install
-rm -fr $RPM_BUILD_ROOT%{_bindir}
-rm -fr $RPM_BUILD_ROOT%{_includedir}
-rm -fr $RPM_BUILD_ROOT%{_libdir}/engines-3
-rm -fr $RPM_BUILD_ROOT%{_libdir}/libcrypto.*
-rm -fr $RPM_BUILD_ROOT%{_libdir}/libssl.*
-rm -fr $RPM_BUILD_ROOT%{_libdir}/openssl
-rm -fr $RPM_BUILD_ROOT%{_libdir}/ossl-modules/legacy.so
-rm -fr $RPM_BUILD_ROOT%{_libdir}/pkgconfig
-rm -fr $RPM_BUILD_ROOT%{_mandir}
-rm -fr $RPM_BUILD_ROOT%{_pkgdocdir}
-rm -fr $RPM_BUILD_ROOT%{_sysconfdir}
-
-%files
-%attr(0755,root,root) %{_libdir}/ossl-modules/fips.so
+#we are not actually installing the build, as we replace all contents with the
+#content from the original rpms
+tar xf %{SOURCE15}
+export ORIGINAL_PACKAGE_VERSION=%{version}
+export ORIGINAL_PACKAGE_RELEASE=%{orig_release}
+%{SOURCE16}
 
 %changelog
+* Tue Apr 16 2024 Simo Sorce <ssorce@redhat.com> - 3.0.7-3
+- Change tarball source contents
+- Rework file extraction process
+- Fixes debug packages
+  Resolves: RHEL-32123
+
 * Wed Feb 21 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 3.0.7-2
 - Denote conflict with old versions of openssl-libs package
   Related: RHEL-23474
diff --git a/sources b/sources
index 3031017..d554662 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (fips_module-3.0.7-18.el9_2.tar.gz) = 6f991583c0fb6333e30faa6b89142567a3e2b214bbc582f01a4a77fdda7823f159469413025fff4ffbfc805be4c78d209e35c726153e4503088a5a0348a328bd
+SHA512 (openssl-fips-provider-3.0.7.tar.gz) = 25005f989ba1973769d3d57a0ecd1d0a3006f48212c189fedd6b5813dc72f0e8f5c3ba7609cb160d652fddf69db4e67ba2d4f9448da71763fbed28712d99a38b
 SHA512 (openssl-3.0.7-hobbled.tar.gz) = 1aea183b0b6650d9d5e7ba87b613bb1692c71720b0e75377b40db336b40bad780f7e8ae8dfb9f60841eeb4381f4b79c4c5043210c96e7cb51f90791b80c8285e
-- 
2.44.0

