Initialize for cryptsetup

2024-02-09 19:00:34 +08:00 · 2024-02-09 19:00:34 +08:00 · 6578bbef65
commit 6578bbef65
10 changed files with 1872 additions and 0 deletions
--- a/.cryptsetup.metadata
+++ b/.cryptsetup.metadata
@ -0,0 +1,2 @@
+fd0c70523eb12542125078f236b8363db0ee5e31b9c4e67bfafccff85f34c710 cryptsetup-2.4.3.tar.sign
+ec49c9f3fa417859783f81b566e5fee2760f8be617f2675705457eecda55cd97 cryptsetup-2.4.3.tar.xz
--- a/.gitignore
+++ b/.gitignore
@ -0,0 +1,2 @@
+cryptsetup-2.4.3.tar.sign
+cryptsetup-2.4.3.tar.xz
--- a/baselibs.conf
+++ b/baselibs.conf
@ -0,0 +1,2 @@
+libcryptsetup12
+libcryptsetup12-hmac
--- a/cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch
+++ b/cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch
@ -0,0 +1,72 @@
+From 7893c33d71cde09e240234c484c6c468f22c2fe7 Mon Sep 17 00:00:00 2001
+From: Milan Broz <gmazyland@gmail.com>
+Date: Mon, 3 Apr 2023 13:31:16 +0200
+Subject: [PATCH] Check for physical memory available also in PBKDF benchmark.
+
+---
+ lib/internal.h        | 1 +
+ lib/utils_benchmark.c | 9 +++++++++
+ lib/utils_pbkdf.c     | 4 ++--
+ 3 files changed, 12 insertions(+), 2 deletions(-)
+
+Index: cryptsetup-2.4.3/lib/internal.h
+===================================================================
+--- cryptsetup-2.4.3.orig/lib/internal.h
+++ cryptsetup-2.4.3/lib/internal.h
+@@ -89,6 +89,7 @@ int crypt_benchmark_pbkdf_internal(struc
+ 				   struct crypt_pbkdf_type *pbkdf,
+ 				   size_t volume_key_size);
+ const char *crypt_get_cipher_spec(struct crypt_device *cd);
+uint32_t pbkdf_adjusted_phys_memory_kb(void);
+ 
+ /* Device backend */
+ struct device;
+Index: cryptsetup-2.4.3/lib/utils_benchmark.c
+===================================================================
+--- cryptsetup-2.4.3.orig/lib/utils_benchmark.c
+++ cryptsetup-2.4.3/lib/utils_benchmark.c
+@@ -100,6 +100,7 @@ int crypt_benchmark_pbkdf(struct crypt_d
+ {
+ 	int r;
+ 	const char *kdf_opt;
+	uint32_t memory_kb;
+ 
+ 	if (!pbkdf || (!password && password_size))
+ 		return -EINVAL;
+@@ -112,6 +113,14 @@ int crypt_benchmark_pbkdf(struct crypt_d
+ 
+ 	log_dbg(cd, "Running %s(%s) benchmark.", pbkdf->type, kdf_opt);
+ 
+	memory_kb = pbkdf_adjusted_phys_memory_kb();
+	if (memory_kb < pbkdf->max_memory_kb) {
+		log_dbg(cd, "Not enough physical memory detected, "
+			"PBKDF max memory decreased from %dkB to %dkB.",
+			pbkdf->max_memory_kb, memory_kb);
+		pbkdf->max_memory_kb = memory_kb;
+	}
+
+ 	r = crypt_pbkdf_perf(pbkdf->type, pbkdf->hash, password, password_size,
+ 			     salt, salt_size, volume_key_size, pbkdf->time_ms,
+ 			     pbkdf->max_memory_kb, pbkdf->parallel_threads,
+Index: cryptsetup-2.4.3/lib/utils_pbkdf.c
+===================================================================
+--- cryptsetup-2.4.3.orig/lib/utils_pbkdf.c
+++ cryptsetup-2.4.3/lib/utils_pbkdf.c
+@@ -61,7 +61,7 @@ const struct crypt_pbkdf_type *crypt_get
+ 	return NULL;
+ }
+ 
+-static uint32_t adjusted_phys_memory(void)
+uint32_t pbkdf_adjusted_phys_memory_kb(void)
+ {
+ 	uint64_t memory_kb = crypt_getphysmemory_kb();
+ 
+@@ -249,7 +249,7 @@ int init_pbkdf_type(struct crypt_device
+ 	}
+ 
+ 	if (cd_pbkdf->max_memory_kb) {
+-		memory_kb = adjusted_phys_memory();
+		memory_kb = pbkdf_adjusted_phys_memory_kb();
+ 		if (cd_pbkdf->max_memory_kb > memory_kb) {
+ 			log_dbg(cd, "Not enough physical memory detected, "
+ 				"PBKDF max memory decreased from %dkB to %dkB.",
--- a/cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch
+++ b/cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch
@ -0,0 +1,160 @@
+From 899bad8c06957a94a198d1eaa293ed8db205f1de Mon Sep 17 00:00:00 2001
+From: Milan Broz <gmazyland@gmail.com>
+Date: Mon, 20 Feb 2023 16:45:36 +0100
+Subject: [PATCH] Try to avoid OOM killer on low-memory systems without swap.
+
+Benchmark for memory-hard KDF is tricky, seems that relying
+on maximum half of physical memory is not enough.
+
+Let's allow only free physical available space if there is no swap.
+This should not cause changes on normal systems, at least.
+---
+ lib/internal.h     |  2 ++
+ lib/utils.c        | 47 ++++++++++++++++++++++++++++++++++++++++++++++
+ lib/utils_pbkdf.c  | 11 ++++++++++-
+ tests/api-test-2.c | 12 ++++++++----
+ 4 files changed, 67 insertions(+), 5 deletions(-)
+
+Index: cryptsetup-2.4.3/lib/internal.h
+===================================================================
+--- cryptsetup-2.4.3.orig/lib/internal.h
+++ cryptsetup-2.4.3/lib/internal.h
+@@ -169,6 +169,8 @@ int crypt_uuid_cmp(const char *dm_uuid,
+ size_t crypt_getpagesize(void);
+ unsigned crypt_cpusonline(void);
+ uint64_t crypt_getphysmemory_kb(void);
+uint64_t crypt_getphysmemoryfree_kb(void);
+bool crypt_swapavailable(void);
+ 
+ int init_crypto(struct crypt_device *ctx);
+ 
+Index: cryptsetup-2.4.3/lib/utils.c
+===================================================================
+--- cryptsetup-2.4.3.orig/lib/utils.c
+++ cryptsetup-2.4.3/lib/utils.c
+@@ -59,6 +59,53 @@ uint64_t crypt_getphysmemory_kb(void)
+ 	return phys_memory_kb;
+ }
+ 
+uint64_t crypt_getphysmemoryfree_kb(void)
+{
+	long pagesize, phys_pages;
+	uint64_t phys_memoryfree_kb;
+
+	pagesize = sysconf(_SC_PAGESIZE);
+	phys_pages = sysconf(_SC_AVPHYS_PAGES);
+
+	if (pagesize < 0 || phys_pages < 0)
+		return 0;
+
+	phys_memoryfree_kb = pagesize / 1024;
+	phys_memoryfree_kb *= phys_pages;
+
+	return phys_memoryfree_kb;
+}
+
+bool crypt_swapavailable(void)
+{
+	int fd;
+	ssize_t size;
+	char buf[4096], *p;
+	uint64_t total;
+
+	if ((fd = open("/proc/meminfo", O_RDONLY)) < 0)
+		return true;
+
+	size = read(fd, buf, sizeof(buf));
+	close(fd);
+	if (size < 1)
+		return true;
+
+	if (size < (ssize_t)sizeof(buf))
+		buf[size] = 0;
+	else
+		buf[sizeof(buf) - 1] = 0;
+
+	p = strstr(buf, "SwapTotal:");
+	if (!p)
+		return true;
+
+	if (sscanf(p, "SwapTotal: %" PRIu64 " kB", &total) != 1)
+		return true;
+
+	return total > 0;
+}
+
+ /* MEMLOCK */
+ #define DEFAULT_PROCESS_PRIORITY -18
+ 
+Index: cryptsetup-2.4.3/lib/utils_pbkdf.c
+===================================================================
+--- cryptsetup-2.4.3.orig/lib/utils_pbkdf.c
+++ cryptsetup-2.4.3/lib/utils_pbkdf.c
+@@ -63,7 +63,7 @@ const struct crypt_pbkdf_type *crypt_get
+ 
+ uint32_t pbkdf_adjusted_phys_memory_kb(void)
+ {
+-	uint64_t memory_kb = crypt_getphysmemory_kb();
+	uint64_t free_kb, memory_kb = crypt_getphysmemory_kb();
+ 
+ 	/* Ignore bogus value */
+ 	if (memory_kb < (128 * 1024) || memory_kb > UINT32_MAX)
+@@ -75,6 +75,15 @@ uint32_t pbkdf_adjusted_phys_memory_kb(v
+ 	 */
+ 	memory_kb /= 2;
+ 
+	/*
+	 * Never use more that available free space on system without swap.
+	 */
+	if (!crypt_swapavailable()) {
+		free_kb = crypt_getphysmemoryfree_kb();
+		if (free_kb > (64 * 1024) && free_kb < memory_kb)
+			return free_kb;
+	}
+
+ 	return memory_kb;
+ }
+ 
+Index: cryptsetup-2.4.3/tests/api-test-2.c
+===================================================================
+--- cryptsetup-2.4.3.orig/tests/api-test-2.c
+++ cryptsetup-2.4.3/tests/api-test-2.c
+@@ -2772,7 +2772,8 @@ static void Pbkdf(void)
+ 	OK_(strcmp(pbkdf->type, default_luks2_pbkdf));
+ 	OK_(strcmp(pbkdf->hash, default_luks1_hash));
+ 	EQ_(pbkdf->time_ms, default_luks2_iter_time);
+-	EQ_(pbkdf->max_memory_kb, adjusted_pbkdf_memory());
+	GE_(pbkdf->max_memory_kb, 64 * 1024);
+	GE_(adjusted_pbkdf_memory(), pbkdf->max_memory_kb);
+ 	EQ_(pbkdf->parallel_threads, _min(cpus_online(), default_luks2_parallel_threads));
+ 	// set and verify argon2 type
+ 	OK_(crypt_set_pbkdf_type(cd, &argon2));
+@@ -2797,7 +2798,8 @@ static void Pbkdf(void)
+ 	OK_(strcmp(pbkdf->type, default_luks2_pbkdf));
+ 	OK_(strcmp(pbkdf->hash, default_luks1_hash));
+ 	EQ_(pbkdf->time_ms, default_luks2_iter_time);
+-	EQ_(pbkdf->max_memory_kb, adjusted_pbkdf_memory());
+	GE_(pbkdf->max_memory_kb, 64 * 1024);
+	GE_(adjusted_pbkdf_memory(), pbkdf->max_memory_kb);
+ 	EQ_(pbkdf->parallel_threads, _min(cpus_online(), default_luks2_parallel_threads));
+ 	// try to pass illegal values
+ 	argon2.parallel_threads = 0;
+@@ -2828,14 +2830,16 @@ static void Pbkdf(void)
+ 	OK_(strcmp(pbkdf->type, default_luks2_pbkdf));
+ 	OK_(strcmp(pbkdf->hash, default_luks1_hash));
+ 	EQ_(pbkdf->time_ms, default_luks2_iter_time);
+-	EQ_(pbkdf->max_memory_kb, adjusted_pbkdf_memory());
+	GE_(pbkdf->max_memory_kb, 64 * 1024);
+	GE_(adjusted_pbkdf_memory(), pbkdf->max_memory_kb);
+ 	EQ_(pbkdf->parallel_threads, _min(cpus_online(), default_luks2_parallel_threads));
+ 	crypt_set_iteration_time(cd, 1);
+ 	OK_(crypt_load(cd, CRYPT_LUKS, NULL));
+ 	OK_(strcmp(pbkdf->type, default_luks2_pbkdf));
+ 	OK_(strcmp(pbkdf->hash, default_luks1_hash));
+ 	EQ_(pbkdf->time_ms, 1);
+-	EQ_(pbkdf->max_memory_kb, adjusted_pbkdf_memory());
+	GE_(pbkdf->max_memory_kb, 64 * 1024);
+	GE_(adjusted_pbkdf_memory(), pbkdf->max_memory_kb);
+ 	EQ_(pbkdf->parallel_threads, _min(cpus_online(), default_luks2_parallel_threads));
+ 	CRYPT_FREE(cd);
+ 
--- a/cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch
+++ b/cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch
@ -0,0 +1,41 @@
+From 6721d3a8b29b13fe88aeeaefe09d457e99d1c6fa Mon Sep 17 00:00:00 2001
+From: Milan Broz <gmazyland@gmail.com>
+Date: Mon, 17 Apr 2023 13:41:17 +0200
+Subject: [PATCH] Use only half of detected free memory on systems without
+ swap.
+
+As tests shows, limiting used Argon2 memory to free memory on
+systems without swap is still not enough.
+Use just half of it, this should bring needed margin while
+still use Argon2.
+
+Note, for very-low memory constrained systems user should
+avoid memory-hard PBKDF (IOW manually select PBKDF2), we
+do not do this automatically.
+---
+ lib/utils_pbkdf.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+Index: cryptsetup-2.4.3/lib/utils_pbkdf.c
+===================================================================
+--- cryptsetup-2.4.3.orig/lib/utils_pbkdf.c
+++ cryptsetup-2.4.3/lib/utils_pbkdf.c
+@@ -76,10 +76,17 @@ uint32_t pbkdf_adjusted_phys_memory_kb(v
+ 	memory_kb /= 2;
+ 
+ 	/*
+-	 * Never use more that available free space on system without swap.
+	 * Never use more that half of available free memory on system without swap.
+ 	 */
+ 	if (!crypt_swapavailable()) {
+ 		free_kb = crypt_getphysmemoryfree_kb();
+
+		/*
+		 * Using exactly free memory causes OOM too, use only half of the value.
+		 * Ignore small values (< 64MB), user should use PBKDF2 in such environment.
+		 */
+		free_kb /= 2;
+
+ 		if (free_kb > (64 * 1024) && free_kb < memory_kb)
+ 			return free_kb;
+ 	}
--- a/5
+++ b/5
@ -0,0 +1,5 @@
+# intentionally named
+addFilter("libcryptsetup.*hmac.* hidden-file-or-dir .*\.libcryptsetup\.so\..*\.hmac")
+# hmacs for identical files are identical
+addFilter("libcryptsetup.*hmac.* files-duplicate .*\.libcryptsetup\.so\..*\.hmac")
+
--- a/cryptsetup.changes
+++ b/cryptsetup.changes
--- a/cryptsetup.keyring
+++ b/cryptsetup.keyring
@ -0,0 +1,56 @@
+pub   4096R/D93E98FC 2012-04-01 [expires: 2022-03-30]
+uid                  Milan Broz <gmazyland@gmail.com>
+sub   4096R/4BBD6F43 2012-04-01 [expires: 2022-03-30]
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v2.0.19 (GNU/Linux)
+
+mQINBE94p38BEADZRET8y1gVxlfDk44/XwBbFjC7eM6EanyCuivUPMmPwYDo9qRe
+y0JdOGhWhAZeutGGxsKliozmeTL25Z6wWICu2oeY+ZfbgJQYHFeQ01NVwoYy57hh
+ytZw/6IMLFRcIaWSHd7oNdneQg6mVJcGdA/BOX68uo3RKSHj6Q8GoQ54F/NpCotz
+VcP1ORpVJ5ptyG0x6OZm5Esn61pKE979wcHsz7EzcDYl+3MS63gZm+O3D1u80bUM
+mBUlxyEiC5jo5ksTFheA8m/5CAPQtxzYvgezYlLLS3nkxaq2ERK5DhvMv0NktXSu
+tfWQsOI5WLjG7UWStwAnO2W+CVZLcnZV0K6OKDaFbCj4ovg5HV0FyQZknN2O5Qbx
+esNlNWkMOJAnnX6c/zowO7jq8GCpa3oJl3xxmwFbCZtH4z3fEVw0wAFc2JlnufR4
+dhaax9fhNoUJ4OSVTi9zqstxhEyywkazakEvAYwOlC5+1FKoc9UIvApAGvgcTJGT
+Op7MuHptHGwWvGZEaJqcsqoy7rsYPxtDQ7bJuJJblzGIUxWAl8qsUsF8M4ISxBkf
+fcUYiR0wh1luUhXFo2rRTKT+Ic/nJDE66Ee4Ecn9+BPlNODhlEG1vk62rhiYSnyz
+y5MAUhUlstDxuEjYK+NGd2aYH0VANZalqlUZFTEdOdA6NYROxkYZVsVtXQARAQAB
+tCBNaWxhbiBCcm96IDxnbWF6eWxhbmRAZ21haWwuY29tPokCPgQTAQIAKAUCT3in
+fwIbAwUJEswDAAYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AACgkQ2bBXe9k+mPxp
+bg//ZWDcQVNAKOWCviNnNvT315WbDrjsJ6FApF83hB52qQO9tvjb5ZY54794uwof
+idOqi0XFoLkoLyiJkkvc3Q9SnM89hyhzrxnh2ym4rUr4cL6F9e99uC656er4telM
+bg9OSPR2iNuqsAzyMhOGMEnnm97YQ2QWOnvbC8QgoQB5VvF3nZMgqTPTxctlUfc7
+t4BlGcIBLG0oINUNDf441KAXgMP05kVK0CDQd02CTPok2Qshbg6aw56eSSUTB4aq
+ZM8St1ySJ2ccMDRC9mCqcNFtuuPyAAJAJFmEvlxahd0BA0mwV3ce38JBbTqs5k0X
+2JVljHObgnfp3WDtuY8Lj0u8KvN0CAYJhRuhY40fARh8EPfkNvIx/740ueexsUBW
+3N1/lCeABaOKtu11kVUxvDxaFRQc2I5vl/sZMunSjJQQiwrWNbrwZgidwkHzvizm
+LjdgHgCJeEC+tu1qifTCOllufvXagjYmrH4hm/Qz6+91lLksrHooxp3nAcN78d5/
+E4reamx0+DleOJ2yD1UeP2wUDdB23OQU3ipVDYwIuIvDWiZSIVwXyDLhuc64ti4t
+ScUGfucEKMER1eLTJ+zILHZ9R4K7C2BhEGSAyxkeeX/Z8pLNOJ1RdU+B+ZFNXuIH
+LJbgrAiOOqr07WPbvRT1LvO/w/4m31D9Kalc4Jyqn9+pjtm5Ag0ET3infwEQAN6E
+dXyfw9xr56CJ1asnQ1PSxpzEGlUsEHvn4wcufyC8KN6VGUlR3WinlaGvOICzvYOi
+S06E6PqKDEgbbApBh2//6Ihk1OynS0y4hYepJi+pstdXoiud6NQSNQlcFjCfI8Wz
+AT3rensVLmwc3HgRW5qqt5Vc+EWdg9cylZ48QdPyo3WyOd2pyL+yqNZPjMGijE8z
+vzurwZiO9aBkJCjulqXMs1YyyIqfTxKQ1GCUQq4SoIQXjD8HvgJ7T/TpuDf9wFhe
+onGqxiJpxb02LMEdkPgugKIgG6iOFplzrsySyoiJsGa0mJ0n0O6rXQxl1mK/zdfg
+vm4CPDujbgINnIxRxPescCVYcmjM8kTlGYJuKp4GgbwbwkCISs4retaAXiP3a2f3
+eSaJc5SnWWa3JqH5ogkEWvuezjNxW5fMpBWszdQEsgnsdlK37V+aB5oWnnkZRlWk
+1YhGwL1ODz+EZzSsGlkIr7BYakK3xRYbxVfQkUr7EeqruXohSOnPAowePYAXCigC
+fWvIJMlrPLIOD2GOy9eV3UZ/JDn/7YPfFAjNb0gVdpqBCQNH/fP2ePC0FzW+3YL1
+UbR+qMAEbKbFepycg75LbC08jFuQVvauDQta4EAvBkF460PoskCzcMuREntjMxip
+B6IMSoOD74tcGYfUp6/kcgdEaqyK8214couO/u8HABEBAAGJAiUEGAECAA8FAk94
+p38CGwwFCRLMAwAACgkQ2bBXe9k+mPzIRA//bAf0Ng8dJ+IgydRtdT9X2xYKyukk
+A3HlrOImOoA4Thrv/HVe7U28AkiQt2DxOmNZYIV0BqvL+dWAD1HYCdQgsgVWVLpr
+sFfqOYHnAWKsdqyNZHtPC9J6drnwv0vcER0dtDJjMDP4MJMTa4JNjNJYb29WfbIm
+viDRtIcVujYFoZK2ZBa1Ec7yPfk4CsyE+Y3Qh9Gy8Z08NrrxIn+MVATBbocKs7j1
+JAvkFk+o1grGnw3NTXnB8gEygAKHHyUgzr5Nyn5qJ28EZr7Vc1FP2lUiKv0JBcHT
+/9vVXJ1Grd+VF2cwYftMWRKR66lTaUS2BX0ta6IQQSj8nSRsoKapRniCfTm1D4I1
+6j9bOoEfFdVsMkcrYFtfhq97qgR8gZtVCJkrX2CARZ+a1J+NP/erASd6M1A3n3aM
+F3xBFfFsotzPplmhzExCYwuOCWIBfPerUQh1MughvG/oT8ZapR6x/EVE+K90J10X
+pPi8VMi/3QRC5DpCin3Kc14WAE4uEbyUWLKb3PmfmZaS6qFaJNtf2TyZodT0ACgu
+v9Xs4el0j8FRaCqLvEZS4rKLNxb8EY3Z4LC61QfyAbg5P114muVZ4ro8dzhZ0zwk
+ZLGeEsYPsQpLo6XPT/32PP8aHn/KKX+KM7ouCEhVeWszR20BMK6sxTBR+4aNqSKC
+dgr42jrtvzRmJp4=
+=E79s
+-----END PGP PUBLIC KEY BLOCK-----
--- a/cryptsetup.spec
+++ b/cryptsetup.spec
@ -0,0 +1,223 @@
+#
+# spec file for package cryptsetup
+#
+# Copyright (c) 2022-2023 ZhuningOS
+#
+
+
+%define tar_version 2.4.3
+%define so_ver 12
+%if 0%{?is_backports}
+Name:           cryptsetup2
+%else
+Name:           cryptsetup
+%endif
+Version:        2.4.3
+Release:        150400.3.3.1
+Summary:        Setup program for dm-crypt Based Encrypted Block Devices
+License:        LGPL-2.0-or-later AND SUSE-GPL-2.0-with-openssl-exception
+Group:          System/Base
+URL:            https://gitlab.com/cryptsetup/cryptsetup/
+Source0:        https://www.kernel.org/pub/linux/utils/cryptsetup/v2.4/cryptsetup-%{tar_version}.tar.xz
+# GPG signature of the uncompressed tarball.
+Source1:        https://www.kernel.org/pub/linux/utils/cryptsetup/v2.4/cryptsetup-%{tar_version}.tar.sign
+Source2:        baselibs.conf
+Source3:        cryptsetup.keyring
+Source4:        %{name}-rpmlintrc
+#PATCH-FIX-UPSTREAM bsc#1211079 luksFormat: handle system with low memory and no swap space
+Patch0:         cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch
+Patch1:         cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch
+Patch2:         cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch
+BuildRequires:  device-mapper-devel
+BuildRequires:  fipscheck
+BuildRequires:  fipscheck-devel
+BuildRequires:  libjson-c-devel
+BuildRequires:  libpwquality-devel
+BuildRequires:  libselinux-devel
+BuildRequires:  libuuid-devel
+# 2.6.38 has the required if_alg.h
+BuildRequires:  linux-glibc-devel >= 2.6.38
+BuildRequires:  pkgconfig
+BuildRequires:  popt-devel
+BuildRequires:  suse-module-tools
+BuildRequires:  pkgconfig(blkid)
+BuildRequires:  pkgconfig(libargon2)
+BuildRequires:  pkgconfig(libssh)
+BuildRequires:  pkgconfig(openssl)
+Requires(post): coreutils
+Requires(postun):coreutils
+%if 0%{?is_backports}
+BuildRequires:  autoconf
+BuildRequires:  automake
+BuildRequires:  libtool
+%endif
+%if %{?suse_version} >= 1550
+# LUKS2 used as default format, which GRUB < 2.06 can't read
+Conflicts:      grub2 < 2.06
+%endif
+
+%lang_package(cryptsetup)
+
+%description
+cryptsetup is used to conveniently set up dm-crypt based device-mapper
+targets. It allows to set up targets to read cryptoloop compatible
+volumes as well as LUKS formatted ones. The package additionally
+includes support for automatically setting up encrypted volumes at boot
+time via the config file %{_sysconfdir}/crypttab.
+
+%package ssh
+Summary:        Cryptsetup LUKS2 SSH token
+Group:          System/Base
+
+%description ssh
+Experimental cryptsetup plugin for unlocking LUKS2 devices with
+token connected to an SSH server.
+
+%package -n libcryptsetup%{so_ver}
+Summary:        Library for setting up dm-crypt Based Encrypted Block Devices
+Group:          System/Libraries
+Suggests:       libcryptsetup%{so_ver}-hmac = %{version}-%{release}
+
+%description -n libcryptsetup%{so_ver}
+cryptsetup is used to conveniently set up dm-crypt based device-mapper
+targets. It allows to set up targets to read cryptoloop compatible
+volumes as well as LUKS formatted ones. The package additionally
+includes support for automatically setting up encrypted volumes at boot
+time via the config file %{_sysconfdir}/crypttab.
+
+%package -n libcryptsetup%{so_ver}-hmac
+Summary:        Checksums for libcryptsetup%{so_ver}
+Group:          System/Base
+Requires:       libcryptsetup%{so_ver} = %{version}-%{release}
+
+%description -n libcryptsetup%{so_ver}-hmac
+This package contains HMAC checksums for integrity checking of libcryptsetup4,
+used for FIPS.
+
+%package -n lib%{name}-devel
+Summary:        Header files for libcryptsetup
+Group:          Development/Libraries/C and C++
+Requires:       glibc-devel
+Requires:       libcryptsetup%{so_ver} = %{version}
+# cryptsetup-devel last used 11.1
+Provides:       cryptsetup-devel = %{version}
+Obsoletes:      cryptsetup-devel < %{version}
+%if 0%{?is_backports}
+# have to conflict with main package that is in SLE
+Conflicts:      cryptsetup-devel < %{version}
+%endif
+
+%description -n lib%{name}-devel
+cryptsetup is used to conveniently set up dm-crypt based device-mapper
+targets. It allows to set up targets to read cryptoloop compatible
+volumes as well as LUKS formatted ones. The package additionally
+includes support for automatically setting up encrypted volumes at boot
+time via the config file %{_sysconfdir}/crypttab.
+
+%prep
+%autosetup -p1 -n cryptsetup-%{tar_version}
+%if 0%{?is_backports}
+sed -i -e '/AC_INIT/s/cryptsetup/cryptsetup2/' configure.ac
+autoreconf -f -i
+%endif
+
+%build
+%configure \
+  --enable-cryptsetup-reencrypt \
+  --enable-selinux \
+  --enable-fips \
+  --enable-pwquality \
+  --enable-gcrypt-pbkdf2 \
+  --enable-libargon2 \
+%if %{?suse_version} < 1550
+  --with-default-luks-format=LUKS1 \
+%endif
+  --with-luks2-lock-path=/run/cryptsetup \
+  --with-tmpfilesdir='%{_tmpfilesdir}'
+%make_build
+
+%install
+# Generate HMAC checksums (FIPS)
+%define __spec_install_post \
+  %{?__debug_package:%{__debug_install_post}} \
+  %{__arch_install_post} \
+  %__os_install_post \
+  fipshmac %{buildroot}/%{_libdir}/libcryptsetup.so.* \
+%{nil}
+
+%make_install
+%if 0%{?is_backports}
+# need to rename a files to avoid file conflict
+for i in cryptsetup integritysetup veritysetup cryptsetup-reencrypt; do
+	mv %{buildroot}%{_sbindir}/$i %{buildroot}%{_sbindir}/${i}2
+	mv %{buildroot}%{_mandir}/man8/$i.8 %{buildroot}%{_mandir}/man8/${i}2.8
+done
+rm -f %{buildroot}%{_tmpfilesdir}/cryptsetup.conf
+%endif
+%if !0%{?usrmerged}
+install -dm 0755 %{buildroot}/sbin
+ln -s ..%{_sbindir}/cryptsetup%{?is_backports:2} %{buildroot}/sbin
+%endif
+# don't want this file in /lib (FHS compat check), and can't move it to /usr/lib
+find %{buildroot} -type f -name "*.la" -delete -print
+#
+%find_lang %{name} --all-name
+
+%if !0%{?is_backports}
+#
+%post
+%{?regenerate_initrd_post}
+%tmpfiles_create %{_tmpfilesdir}/cryptsetup.conf
+
+%postun
+%{?regenerate_initrd_post}
+
+%posttrans
+%{?regenerate_initrd_posttrans}
+#
+%endif
+
+%post -n libcryptsetup%{so_ver} -p /sbin/ldconfig
+%postun -n libcryptsetup%{so_ver} -p /sbin/ldconfig
+
+%files
+%license COPYING*
+%doc AUTHORS FAQ README.md docs/*ReleaseNotes
+%if !0%{?usrmerged}
+/sbin/cryptsetup%{?is_backports:2}
+%endif
+%{_sbindir}/cryptsetup%{?is_backports:2}
+%{_sbindir}/veritysetup%{?is_backports:2}
+%{_sbindir}/integritysetup%{?is_backports:2}
+%{_sbindir}/cryptsetup-reencrypt%{?is_backports:2}
+%{_mandir}/man8/cryptsetup%{?is_backports:2}.8%{?ext_man}
+%{_mandir}/man8/cryptsetup-reencrypt%{?is_backports:2}.8%{?ext_man}
+%{_mandir}/man8/veritysetup%{?is_backports:2}.8%{?ext_man}
+%{_mandir}/man8/integritysetup%{?is_backports:2}.8%{?ext_man}
+%if !0%{?is_backports}
+%{_tmpfilesdir}/cryptsetup.conf
+%ghost %dir /run/cryptsetup
+%endif
+
+%files lang -f %{name}.lang
+
+%files -n libcryptsetup%{so_ver}
+%{_libdir}/libcryptsetup.so.%{so_ver}*
+
+%files -n libcryptsetup%{so_ver}-hmac
+%{_libdir}/.libcryptsetup.so.%{so_ver}*hmac
+
+%files -n lib%{name}-devel
+%doc docs/examples/
+%{_includedir}/libcryptsetup.h
+%{_libdir}/libcryptsetup.so
+%{_libdir}/pkgconfig/*
+
+%files ssh
+%license COPYING COPYING.LGPL
+%dir %{_libdir}/%{name}
+%{_libdir}/%{name}/libcryptsetup-token-ssh.so
+%{_mandir}/man8/cryptsetup-ssh.8.gz
+%{_sbindir}/cryptsetup-ssh
+
+%changelog