[rpms/tboot] rawhide: Update to v1.12.0 release

[rpms/tboot] rawhide: Update to v1.12.0 release

[Yaakov Selkowitz]

            A new commit has been pushed.

            Repo   : rpms/tboot
            Branch : rawhide
            Commit : 2ca75ff5abda69436b2843c8eef024fda5eaa799
            Author : Yaakov Selkowitz <yselkowi@redhat.com>
            Date   : 2026-07-20T14:42:50-04:00
            Stats  : +73/-70 in 5 file(s)
            URL    : https://src.fedoraproject.org/rpms/tboot/c/2ca75ff5abda69436b2843c8eef024fda5eaa799?branch=rawhide

            Log:
            Update to v1.12.0 release

Fix build with openssl 4.0

---
diff --git a/openssl-no-engine.patch b/openssl-no-engine.patch
deleted file mode 100644
index d5de8e0..0000000
--- a/openssl-no-engine.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-diff --git a/lcptools-v2/crtpol.c b/lcptools-v2/crtpol.c
-index 6227149..f30eb33 100644
---- a/lcptools-v2/crtpol.c
-+++ b/lcptools-v2/crtpol.c
-@@ -43,7 +43,6 @@
- #include <errno.h>
- #include <string.h>
- #include <openssl/rsa.h>
--#include <openssl/engine.h>
- #include <openssl/pem.h>
- #include <openssl/err.h>
- #include <openssl/bn.h>
-diff --git a/lcptools-v2/crtpollist.c b/lcptools-v2/crtpollist.c
-index 616b6d8..67a9a0f 100644
---- a/lcptools-v2/crtpollist.c
-+++ b/lcptools-v2/crtpollist.c
-@@ -44,7 +44,6 @@
- #include <errno.h>
- #include <string.h>
- #include <openssl/rsa.h>
--#include <openssl/engine.h>
- #include <openssl/pem.h>
- #include <openssl/err.h>
- #include <openssl/bn.h>
-diff --git a/lcptools-v2/lcputils.c b/lcptools-v2/lcputils.c
-index 4df78da..95c47b2 100644
---- a/lcptools-v2/lcputils.c
-+++ b/lcptools-v2/lcputils.c
-@@ -43,7 +43,6 @@
- #include <errno.h>
- #include <string.h>
- #include <openssl/rsa.h>
--#include <openssl/engine.h>
- #include <openssl/pem.h>
- #include <openssl/err.h>
- #include <openssl/bn.h>
-diff --git a/lcptools-v2/pollist2.c b/lcptools-v2/pollist2.c
-index 32daf4e..67fe71f 100644
---- a/lcptools-v2/pollist2.c
-+++ b/lcptools-v2/pollist2.c
-@@ -41,7 +41,6 @@
- #include <string.h>
- #include <safe_lib.h>
- #include <openssl/rsa.h>
--#include <openssl/engine.h>
- #include <openssl/pem.h>
- #include <openssl/err.h>
- #include <openssl/bn.h>

diff --git a/sources b/sources
index 13d7933..bbec5d6 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (tboot-1.11.7.tar.gz) = 7218a39e044563cd69707e0937a4124fa687022b5498cd5246a581d90dfdec2eedb2fd9de466b3ddb8230e558151b1eed7c5cd1ecb7fc02b82825d4fbbe132e1
+SHA512 (tboot-1.12.0.tar.gz) = 96b31b497cb94067ce9eddee4217853fab22c212a05bb8c9a74c1718e5b0e6c28df4bedca89b071bc5afe3e2e7d8c8dbc5cfb5f558ab4c33e8815df08e911fff

diff --git a/tboot-gcc14.patch b/tboot-gcc14.patch
deleted file mode 100644
index 9b6ff83..0000000
--- a/tboot-gcc14.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-Suppress GCC 14 allocation size warning in lcptools-v2/pconf_legacy.c
-
-Submitted upstream: <https://sourceforge.net/p/tboot/mailman/message/58730242/>
-
-diff --git a/lcptools-v2/pconf_legacy.c b/lcptools-v2/pconf_legacy.c
-index 443b5cd5525b9fe1..5ebc6c451f7008b1 100644
---- a/lcptools-v2/pconf_legacy.c
-+++ b/lcptools-v2/pconf_legacy.c
-@@ -324,7 +324,7 @@ static lcp_policy_element_t *create(void)
-             ERROR("Error: no pcrs were selected.\n");
-             return NULL;
-         }
--        digest = malloc(SHA1_DIGEST_SIZE);
-+        digest = malloc(sizeof(*digest));
-         if (digest == NULL) {
-             ERROR("Error: failed to allocate memory for digest buffer.\n");
-             return NULL;

diff --git a/tboot-sm3-optional.patch b/tboot-sm3-optional.patch
new file mode 100644
index 0000000..96606eb
--- /dev/null
+++ b/tboot-sm3-optional.patch
@@ -0,0 +1,65 @@
+Guard EVP_sm3() calls with OPENSSL_NO_SM3
+
+Fedora's OpenSSL build disables SM3 support. Without the guard, the build
+fails with "implicit declaration of function 'EVP_sm3'" wherever SM3/SM2
+is not compiled into libssl.
+
+Signed-off-by: Tony Camuso <tcamuso@redhat.com>
+
+--- tboot-1.12.0/lcptools-v2/crypto_OpenSSL.c.orig	2026-07-20 11:56:48.858157554 -0400
++++ tboot-1.12.0/lcptools-v2/crypto_OpenSSL.c	2026-07-20 11:56:42.012247758 -0400
+@@ -54,9 +54,11 @@ crypto_hash_buffer_internal (
+     case TB_HALG_SHA512:
+       md = EVP_sha512 ();
+       break;
++#ifndef OPENSSL_NO_SM3
+     case TB_HALG_SM3:
+       md = EVP_sm3 ();
+       break;
++#endif
+     default:
+       EVP_MD_CTX_free (ctx);
+       return crypto_unknown_hashalg;
+@@ -1055,11 +1057,15 @@ crypto_verify_ec_signature_internal (
+     return false;
+   }
+ 
++#ifndef OPENSSL_NO_SM3
+   if ( hashalg == TPM_ALG_SM3_256 ) {
+     curveId   = NID_sm2;
+     mdtype    = EVP_sm3 ();
+     curveName = SN_sm2;
+   } else if ( hashalg == TPM_ALG_SHA256 ) {
++#else
++  if ( hashalg == TPM_ALG_SHA256 ) {
++#endif
+     curveId   = NID_X9_62_prime256v1;
+     mdtype    = EVP_sha256 ();
+     curveName = SN_X9_62_prime256v1;
+@@ -1359,9 +1365,11 @@ crypto_ec_sign_data_internal (
+ 
+   EVP_MD_CTX_set_pkey_ctx (mctx, pctx);
+   switch (hashalg) {
++#ifndef OPENSSL_NO_SM3
+     case TPM_ALG_SM3_256:
+       result = EVP_DigestSignInit (mctx, &pctx, EVP_sm3 (), NULL, evp_key);
+       break;
++#endif
+     case TPM_ALG_SHA256:
+       result = EVP_DigestSignInit (mctx, &pctx, EVP_sha256 (), NULL, evp_key);
+       break;
+--- tboot-1.12.0/tb_polgen/hash.c.orig	2026-07-20 11:57:51.468681361 -0400
++++ tboot-1.12.0/tb_polgen/hash.c	2026-07-20 11:57:57.077090151 -0400
+@@ -106,10 +106,12 @@ bool hash_buffer(const unsigned char* bu
+             md = EVP_sha512();
+             hash_out = hash->sha512;
+             break;
++#ifndef OPENSSL_NO_SM3
+         case TB_HALG_SM3:
+             md = EVP_sm3();
+             hash_out = hash->sm3;
+             break;
++#endif
+         default:
+             error_msg("unsupported hash alg (%d)\n", hash_alg);
+             return false;

diff --git a/tboot.spec b/tboot.spec
index 2542871..bc35762 100644
--- a/tboot.spec
+++ b/tboot.spec
@@ -1,16 +1,15 @@
 Summary:       Performs a verified launch using Intel TXT
 Name:          tboot
-Version:       1.11.7
-Release:       17%{?dist}
+Version:       1.12.0
+Release:       1%{?dist}
 Epoch:         1
 
 License:       BSD-3-Clause
 URL:           http://sourceforge.net/projects/tboot/
 Source0:       https://sourceforge.net/projects/tboot/files/%{name}/%{name}-%{version}.tar.gz
-Patch0:        tboot-gcc14.patch
-Patch1:        openssl-no-engine.patch
 Patch2:        tboot-sbin.patch
 Patch3:        tboot-1.11.7-len.patch
+Patch4:        tboot-sm3-optional.patch
 
 BuildRequires: make
 BuildRequires: gcc
@@ -77,6 +76,10 @@ grub2-mkconfig -o /etc/grub2.cfg
 /boot/tboot-syms
 
 %changelog
+* Tue Jul 14 2026 Yaakov Selkowitz <yselkowi@redhat.com> - 1:1.12.0-1
+- Update to v1.12.0 release
+- Fix build with openssl 4.0
+
 * Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 1:1.11.7-17
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild