crypto-policies-scripts-20230920.570ea89-150600.3.3.1 < > , ] g p9|9 #}#"QQ09bȝKQؔvom1#
,o$٭ s F|opeEQb)}ړ1LLCH '
@V9OYј'tH#gr`BT@XȗKYYYhCC @ ~,If7䠈
YŬt<>S79>1h7- `. IrU iJ?0+Rgf
%9 > C S ? S d + 8 _ ( > _ 6 | 6 6
T 6 , 6 6
6 6 6 D 6 4 X ( 8 8 @ 9 : F D G D 6 H E 6 I F\ 6 X F Y F \ F 6 ] G 6 ^ K_ b MV c M d N e N f N l N u N 6 v O w Q< 6 x R 6 y R z S S SW S` Sd St Sx S| S S C crypto-policies-scripts 20230920.570ea89 150600.3.3.1 Tool to switch between crypto policies This package provides a tool update-crypto-policies, which applies
the policies provided by the crypto-policies package. These can be
either the pre-built policies from the base package or custom policies
defined in simple policy definition files.
The package also provides a tool fips-mode-setup, which can be used
to enable or disable the system FIPS mode. g h01-ch4c *%SUSE Linux Enterprise 15 SUSE LLC LGPL-2.1-or-later https://www.suse.com/ Productivity/Networking/Security https://gitlab.com/redhat-crypto/fedora-crypto-policies linux noarch A W S , [ B2 G< I T o
s U 9 ! u #
( U /k ! 7Z :AA큤A큤A큤A큤A큤A큤A큤큤 g g e
g g g g e
g e
g g g g e
gg e
g g g g g g e
e
e
e
g gg g g g g g g g g g g e
e
e
e
e
e
ggge
g g g 10ddabec37e763480bcd544f648da77c44f7a6b8381e6467b5a136d2462747a7 bfb0bdb095e6b1cdbeca4be2ed1b03bb7d9424c4020a46e7cd68a32160a6189f 6addb83218c406dc7f789cd90b7f230feac4938419570cff45d9f0ae00710dd3 57ed66106a661d46e0ca53eb7268cbc5722d2cefbc38d8211801e9697987b4c7 a24ba9cf38df7b87821f2f1c11a08407e2fd2c510dc8e7bcd0f79b1e9577b467 9d86f5c7b39e3f5cccc995689848bb2673becd15689273efdfe7f07974c83504 401e0a6bac35a9f506f80475c7b1bbbb909cfc732c157b660d26c7bb7111e07c 9d0820bc57d1ce4477916ffe6226077fa20cb9e54bcbaadc23afe62a2f9297ab 398f3ef6bf84821949cec505b249f11deade3f9f4e4fb311800ca96826a749e5 7bd32bca6441716e9961d6978baf205b3b546a6add61e323cce9fd8265390260 408d51945c1b6e1cfa95748e1834693f3060351315ab4015ad8a97e68f40b1e4 444b988051a22e25607e13dede952fcdbd3399927bb1bea270ec08f7a262d0c5 0fb780dae62ad275c76855277255693573603b125e8fd316c217ba99969df98c c9f19df1ce4e7bc7af298365a1245bfa8aa1e32a7719149542bb40054b0f1055 7bba47dde5308e136f835d6c8a844d9706188e2969477d15fe629cd2cd9d7c78 519b936d8551163117f459658e6a617d4446154f92eeba66b071d20e7fecae52 dcba60a792e62e882f1e57ee4d54d4c62453b3fa5304b60cad0db48c0eefc2d9 15174b4806ff60398a994266a8b447339291f11e842526ba2c83b04e5ce8f383 b270384e11867a2d932f49a9eaa785c435314c51257ec25963eeb76198ac02a2 b604380985c865e148d6091dc11fb82b99c2730706b25414c7c7a45b08b0ede8 fddc5cf9fae69bda28d611ac5aa5bee6bc1903e328506dc7826cdd6ae37bde42 aa7a3b3fd79089d6a2e89382ab730165db06aeb6e2b56f538df8d40a15f86a6a 02ae5f8c1e12d3560c94486d0af13a5ea6bfde9565f876558e50c2e49da58ade 698ded0489cd93fbbd5e0b20901bf8de79d85f45424f8cbb3765801cc4de96ba afbc885eed18f2288f2db93c5493dc3b39690c93f461a649b5e110ce83683f43 f2f5ce680f81b60d1307beea19079cd3aa669a59fc2f2cfe7c596bba50c4fab3 ad5dbef569911c0b24b3fce1544edecbbb7669a148c510c963b5c0dedc418b8d dd8b12275ef88f9fa136796d7c4a09b9b0009e08276141680f4d846bee859b11 c19c35eec32475466b6a0d7cc7c3271bb26e2a65cb869cc23f2eafe13637abda 8f7f423382cd9124f63e50c808520f47369da33a3dce3c46762da6b10e7e580f 9abec771bbfaf7c4659f3b0102ca0ca8728f017beb7406ccecac870bb81e4354 c5028dbe19d98d3d4c5a4da47c7a45e5cb9b47e44675ba1cfde23c424c706f82 a90bb6b7fdf25add1c0431240c4fc4bc750a624996d5a5e8d0aad162fb73a768 4609461078f3c438130085493a49ac06d3f7a42e89bcdcb3a2c12cd42ecb902c 30c42a7b489730b2ed63585735c6de6197b6b1b58974f121e5b0ffb8f9a53f44 18b55a7aac44aa155f76e0e4fa6a02975918117b1bb267ccbe5aa4124b72384c 92459e451431b3e76b0916d5381c584af433bdf414a9e6a4cf464aa4faad72e6 06b429ecbdb3c3659052539f117325cbcf4d25b92a99e1356df8170102f808ec 39032dd789b9b5701d06bd03248ca3123b57ba449e696647b9381c3d7e4e0fee 1135bc9ba911077d30ace3c374671d0738e52d03c6bd65781dfa29215c90ab2a 99e72be95d89c2b2c46bf783eb3908b275939e110155a84b716b8cc1908d223c 7b4ed2d8085affea8c4de60021bc4b89ea456ead2bdb713c055ff00bff0238e0 4e67c0f4a1eff6fa8a0480f3e69dd02eb151304a036ab189ab4174662b175014 af99d2b749bd8276adcf4579a71411b7c028031e0c68d13702b7ef19bced7e89 67c8f9d38bcfdf2ecc265245d88138c46444bee5883a14fb2c7d520af6c0078e aeca399e889653394e5016ad57333c55a9a2cb0ed4ae2e7538700ffea5b7089b root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root crypto-policies-20230920.570ea89-150600.3.3.1.src.rpm crypto-policies-scripts @ @ @
/bin/bash /bin/sh /usr/bin/python3 /usr/bin/sh crypto-policies rpmlib(CompressedFileNames) rpmlib(FileDigests) rpmlib(PayloadFilesHavePrefix) rpmlib(PayloadIsXz) 20230920.570ea89-150600.3.3.1 3.0.4-1 4.6.0-1 4.0-1 5.2-1 4.14.3 ge@e
eG@ddd8d@doMdm@dX@dX@cʂ@aMaM`7@`7@`6?`-@`"y@`!'`!'` 3@`>`>` l` l` l__#scabrero@suse.de pmonreal@suse.com pmonreal@suse.com pmonreal@suse.com pmonreal@suse.com pmonreal@suse.com meissner@suse.com pmonreal@suse.com pmonreal@suse.com pmonreal@suse.com pmonreal@suse.com pmonreal@suse.com pmonreal@suse.com pmonreal@suse.com pmonreal@suse.com pmonreal@suse.com pmonreal@suse.com pmonreal@suse.com pmonreal@suse.com dimstar@opensuse.org pmonreal@suse.com pmonreal@suse.com pmonreal@suse.com dimstar@opensuse.org pmonreal@suse.com pmonreal@suse.com pmonreal@suse.com pmonreal@suse.com pmonreal@suse.com vcizek@suse.com - krb5: disallow aes256-cts-hmac-sha1-96 and aes128-cts-hmac-sha1-96
kerberos encryption types from RFC3961 in FIPS mode, as its key
derivation function is not certified; (jsc#PED-12018);
- Update AD-SUPPORT and add AD-SUPPORT-LEGACY subpolicies; (jsc#PED-12018);
The AD-SUPPORT subpolicy will enable the aes256-cts-hmac-sha1-96
and aes128-cts-hmac-sha1-96 encryption types necessary for AD.
The Kerberos libraries will tell OpenSSL provider to bypass FIPS
restrictions when loading the KRB5KDF module.
The AD-SUPPORT-LEGACY will allow the use of RC4 encryption types
in environments where either accounts or trusted domains objects
were not yet migrated to AES.
- Add patch 0008-policies-modules-update-AD-SUPPORT-add-AD-SUP.patch - nss: Skip the NSS policy check if the mozilla-nss-tools package
is not installed. This avoids adding more dependencies in ring0.
* Add crypto-policies-nss.patch [bsc#1211301] - Update to version 20230920.570ea89:
* fips-mode-setup: more thorough --disable, still unsupported
* FIPS:OSPP: tighten beyond reason for OSPP 4.3
* krb5: sort enctypes mac-first, cipher-second, prioritize SHA-2 ones
* openssl: implement relaxing EMS in FIPS (NO-ENFORCE-EMS)
* gnutls: prepare for tls-session-hash option coming
* nss: prepare for TLS-REQUIRE-EMS option coming
* NO-ENFORCE-EMS: add subpolicy
* FIPS: set __ems = ENFORCE
* cryptopolicies: add enums and __ems tri-state
* docs: replace `FIPS 140-2` with just `FIPS 140`
* .gitlab-ci: remove forcing OPENSSH_MIN_RSA_SIZE
* cryptopolicies: add comments on dunder options
* nss: retire NSS_OLD and replace with NSS_LAX 3.80 check
* BSI: start a BSI TR 02102 policy [jsc#PED-4933]
* Rebase patches:
- crypto-policies-policygenerators.patch
- crypto-policies-revert-rh-allow-sha1-signatures.patch
- crypto-policies-FIPS.patch - Conditionally recommend the crypto-policies-scripts package
when python is not installed in the system [bsc#1215201] - Tests: Fix pylint versioning for TW and fix the parsing of the
policygenerators to account for the commented lines correctly.
* Add crypto-policies-pylint.patch
* Rebase crypto-policies-policygenerators.patch - FIPS: Adapt the fips-mode-setup script to use the pbl command
from the perl-Bootloader package to replace grubby. Add a note
for transactional systems [jsc#PED-5041].
* Rebase crypto-policies-FIPS.patch - BSI.pol: Added a new BSI policy for BSI TR 02102* (jsc#PED-4933)
derived from NEXT.pol - Update to version 20230614.5f3458e:
* policies: impose old OpenSSL groups order for all back-ends
* Rebase patches:
- crypto-policies-revert-rh-allow-sha1-signatures.patch
- crypto-policies-supported.patch - FIPS: Enable to set the kernel FIPS mode with fips-mode-setup
and fips-finish-install commands, add also the man pages. The
required FIPS modules are left to be installed by the user.
* Rebase crypto-policies-FIPS.patch - Revert a breaking change that introduces the config option
rh-allow-sha1-signatures that is unkown to OpenSSL and fails
on startup. We will consider adding this option to openssl.
* https://gitlab.com/redhat-crypto/fedora-crypto-policies/-/commit/97fe4494
* Add crypto-policies-revert-rh-allow-sha1-signatures.patch - Update the update-crypto-policies(8) man pages and README.SUSE
to mention the supported back-end policies. [bsc#1209998]
* Add crypto-policies-supported.patch - Update to version 20230420.3d08ae7:
* openssl, alg_lists: add brainpool support
* openssl: set Groups explicitly
* codespell: ignore aNULL
* rpm-sequoia: allow 1024 bit DSA and SHA-1 per FeSCO decision 2960
* sequoia: add separate rpm-sequoia backend
* crypto-policies.7: state upfront that FUTURE is not so interoperable
* Makefile: update for asciidoc 10
* Skip not needed LibreswanGenerator and SequoiaGenerator:
- Add crypto-policies-policygenerators.patch
* Remove crypto-policies-test_supported_modules_only.patch
* Rebase crypto-policies-no-build-manpages.patch - Update to version 20221214.a4c31a3:
* bind: expand the list of disableable algorithms
* libssh: Add support for openssh fido keys
* .gitlab-ci.yml: install krb5-devel for krb5-config
* sequoia: check using sequoia-policy-config-check
* sequoia: introduce new back-end
* Makefile: support overriding asciidoc executable name
* openssh: make none and auto explicit and different
* openssh: autodetect and allow forcing RequiredRSASize presence/name
* openssh: remove _pre_8_5_ssh
* pylintrc: update
* Revert "disable SHA-1 further for a Fedora 38 Rawhide "jump scare"..."
* disable SHA-1 further for a Fedora 38 Rawhide "jump scare"...
* Makefile: exclude built manpages from codespell
* add openssh HostbasedAcceptedAlgorithms
* openssh: add RSAMinSize option following min_rsa_size
* Revert ".gitlab-ci.yml: skip pylint (bz2069837)"
* docs: add customization recommendation
* tests/java: fix java.security.disableSystemPropertiesFile=true
* policies: add FEDORA38 and TEST-FEDORA39
* bind: control ED25519/ED448
* openssl: disable SHA-1 signatures in FUTURE/NO-SHA1
* .gitlab-ci.yml: skip pylint (bz2069837)
* openssh: add support for sntrup761x25519-sha512@openssh.com
* fips-mode-setup: fix one unrelated check to intended state
* fips-mode-setup, fips-finish-install: abandon /etc/system-fips
* Makefile: fix alt-policy test of LEGACY:AD-SUPPORT
* fips-mode-setup: catch more inconsistencies, clarify --check
* fips-mode-setup: improve handling FIPS plus subpolicies
* .gitlab-ci.yml: use rawhide so that we get gnutls 3.7.3
* gnutls: enable SHAKE, needed for Ed448
* gnutls: use allowlisting
* openssl: add newlines at the end of the output
* FIPS:OSPP: relax -ECDSA-SHA2-512, -FFDHE-*
* fips-mode-setup, fips-finish-install: call zipl more often
* Add crypto-policies-rpmlintrc file to avoid files-duplicate,
zero-length and non-conffile-in-etc warnings.
* Rebase patches:
- crypto-policies-FIPS.patch
- crypto-policies-no-build-manpages.patch
* Update README.SUSE - Remove the scripts and documentation regarding
fips-finish-install and test-fips-setup
* Add crypto-policies-FIPS.patch - Update to version 20210917.c9d86d1:
* openssl: fix disabling ChaCha20
* pacify pylint 2.11: use format strings
* pacify pylint 2.11: specify explicit encoding
* fix minor things found by new pylint
* update-crypto-policies: --check against regenerated
* update-crypto-policies: fix --check's walking order
* policygenerators/gnutls: revert disabling DTLS0.9...
* policygenerators/java: add javasystem backend
* LEGACY: bump 1023 key size to 1024
* cryptopolicies: fix 'and' in deprecation warnings
* *ssh: condition ecdh-sha2-nistp384 on SECP384R1
* nss: hopefully the last fix for nss sigalgs check
* cryptopolicies: Python 3.10 compatibility
* nss: postponing check + testing at least something
* Rename 'policy modules' to 'subpolicies'
* validation.rules: fix a missing word in error
* cryptopolicies: raise errors right after warnings
* update-crypto-policies: capitalize warnings
* cryptopolicies: syntax-precheck scope errors
* .gitlab-ci.yml, Makefile: enable codespell
* all: fix several typos
* docs: don't leave zero TLS/DTLS protocols on
* openssl: separate TLS/DTLS MinProtocol/MaxProtocol
* alg_lists: order protocols new-to-old for consistency
* alg_lists: max_{d,}tls_version
* update-crypto-policies: fix pregenerated + local.d
* openssh: allow validation with pre-8.5
* .gitlab-ci.yml: run commit-range against upstream
* openssh: Use the new name for PubkeyAcceptedKeyTypes
* sha1_in_dnssec: deprecate
* .gitlab-ci.yml: test commit ranges
* FIPS:OSPP: sign = -*-SHA2-224
* scoped policies: documentation update
* scoped policies: use new features to the fullest...
* scoped policies: rewrite + minimal policy changes
* scoped policies: rewrite preparations
* nss: postponing the version check again, to 3.64
- Remove patches fixed upstream: crypto-policies-typos.patch
- Rebase: crypto-policies-test_supported_modules_only.patch
- Merge crypto-policies-asciidoc.patch into
crypto-policies-no-build-manpages.patch - Update to version 20210225.05203d2:
* Disable DTLS0.9 protocol in the DEFAULT policy.
* policies/FIPS: insignificant reformatting
* policygenerators/libssh: respect ssh_certs
* policies/modules/OSPP: tighten to follow RHEL 8
* crypto-policies(7): drop not-reenableable comment
* follow up on disabling RC4 - Remove not needed scripts: fips-finish-install fips-mode-setup - Disable DTLS0.9 protocol in GnuTLS DEFAULT policy. [bsc#1180938]
* The minimum DTLS protocol version in the DEFAULT and FUTURE
policies is DTLS1.2.
* Fixed upstream: 05203d21f6d0ea9bbdb351e4600f1e273720bb8e - Update to version 20210213.5c710c0: [bsc#1180938]
* setup_directories(): perform safer creation of directories
* save_config(): avoid re-opening output file for each iteration
* save_config(): break after first match to avoid unnecessary stat() calls
* CryptoPolicy.parse(): actually stop parsing line on syntax error
* ProfileConfig.parse_string(): correctly extended subpolicies
* Exclude RC4 from LEGACY
* Introduce rc4_md5_in_krb5 to narrow AD_SUPPORT
* code style: fix 'not in' membership testing
* pylintrc: tighten up a bit
* formatting: avoid long lines
* formatting: use f-strings instead of format()
* formatting: reformat all python code with autopep8
* nss: postponing the version check again, to 3.61
* Revert "Unfortunately we have to keep ignoring the openssh check for sk-" - Use tar_scm service, not obs_scm: With crypto-policies entering
Ring0 (distro bootstrap) we want to be sure to keep the buildtime
deps as low as possible.
- Add python3-base BuildRequires: previously, OBS' tar service
pulled this in for us. - Add a BuildIgnore for crypto-policies - Use gzip instead of xz in obscpio and sources - Do not build the manpages to avoid build cycles
- Add crypto-policies-no-build-manpages.patch - Convert to use a proper git source _service:
+ To update, one just needs to update the commit/revision in the
_service file and run `osc service dr`.
+ The version of the package is defined by the commit date of the
revision, followed by the abbreviated git hash (The same
revision used before results thus in a downgrade to 20210118,
but as this is a alltime new package, this is acceptable. - Update to git version 20210127
* Bump Python requirement to 3.6
* Output sigalgs required by nss >=3.59
* Do not require bind during build
* Break build cycles with openssl and gnutls - Update to git version 20210118
* Output sigalgs required by nss >=3.59
* Bump Python requirement to 3.6
* Kerberos 5: Fix policy generator to account for macs
* Add AES-192 support (non-TLS scenarios)
* Add documentation of the --check option - Fix the man pages generation
- Add crypto-policies-asciidoc.patch - Test only supported modules
- Add crypto-policies-test_supported_modules_only.patch - Add crypto-policies-typos.patch to fix some typos - Initial packaging, git version 20200918 (jsc#SLE-15832) h01-ch4c 1737624521
! " # $ % & ' ( ) * + , - . / 0 1 2 3 4 5 6 20230920.570ea89-150600.3.3.1
fips-finish-install fips-mode-setup update-crypto-policies python __pycache__ build-crypto-policies.cpython-36.pyc update-crypto-policies.cpython-36.pyc build-crypto-policies.py cryptopolicies __init__.py __pycache__ __init__.cpython-36.pyc alg_lists.cpython-36.pyc cryptopolicies.cpython-36.pyc alg_lists.py cryptopolicies.py validation __init__.py __pycache__ __init__.cpython-36.pyc alg_lists.cpython-36.pyc general.cpython-36.pyc rules.cpython-36.pyc scope.cpython-36.pyc alg_lists.py general.py rules.py scope.py policygenerators __init__.py __pycache__ __init__.cpython-36.pyc bind.cpython-36.pyc configgenerator.cpython-36.pyc gnutls.cpython-36.pyc java.cpython-36.pyc krb5.cpython-36.pyc libssh.cpython-36.pyc nss.cpython-36.pyc openssh.cpython-36.pyc openssl.cpython-36.pyc bind.py configgenerator.py gnutls.py java.py krb5.py libssh.py nss.py openssh.py openssl.py update-crypto-policies.py fips-finish-install.8.gz fips-mode-setup.8.gz update-crypto-policies.8.gz /usr/bin/ /usr/share/crypto-policies/ /usr/share/crypto-policies/python/ /usr/share/crypto-policies/python/__pycache__/ /usr/share/crypto-policies/python/cryptopolicies/ /usr/share/crypto-policies/python/cryptopolicies/__pycache__/ /usr/share/crypto-policies/python/cryptopolicies/validation/ /usr/share/crypto-policies/python/cryptopolicies/validation/__pycache__/ /usr/share/crypto-policies/python/policygenerators/ /usr/share/crypto-policies/python/policygenerators/__pycache__/ /usr/share/man/man8/ -fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -g obs://build.suse.de/SUSE:Maintenance:37150/SUSE_SLE-15-SP6_Update/0664cca0ebd60151c1284b522f8e5c59-crypto-policies.SUSE_SLE-15-SP6_Update drpm xz 5 noarch-suse-linux Bourne-Again shell script, ASCII text executable a /usr/bin/sh script, ASCII text executable directory python 3.6 byte-compiled Python script, UTF-8 Unicode text executable Python script, ASCII text executable troff or preprocessor input, UTF-8 Unicode text, with very long lines (gzip compressed data, max compression, from Unix) troff or preprocessor input, ASCII text, with very long lines (gzip compressed data, max compression, from Unix) R R R R R hD ۴zG^\䀲/usr/bin/update-crypto-policies --no-check >/dev/null 2>/dev/null || : /bin/sh perl-Bootloader utf-8 a5ae84bf3fcfa6b0f235d10be025e43033c2a539c41fa7a70f3619ce032e0fc8 ? 7zXZ
! t/] "k%*6l"3ג_iu/)/R>~tmKY,w>mX[>&E,+For=}߽ %
c|냜-pB۷٬}BaҨ h\ŝzv،܇8jiBJ l` 3EV ãI䔼?xG)^/<MpzpX u?|rV-AR~`* ^}4Nӕ6_Q bvC;j 7Fdŏ)ŴBͪER2K_~tfv~k??ҩeQP sn U#yyob 4 hȄ88le^hNޔXsI XNF\[LG,h<6|s53w+p!v2t v3Zr!Z@<#_b>[G>7#㜝H^䁭zY16:Q1L\ vH6v c%TuW b2