import openssl-ibmca-2.3.0-1.el9

.gitignore

-SOURCES/openssl-ibmca-2.2.2.tar.gz
+SOURCES/openssl-ibmca-2.3.0.tar.gz

.openssl-ibmca.metadata

-6521a8e6e7cb41cc621bc7a8942543e979423ae7 SOURCES/openssl-ibmca-2.2.2.tar.gz
+826976fdb0a4de24affe6b7c6678665bea8cdda0 SOURCES/openssl-ibmca-2.3.0.tar.gz

SPECS/openssl-ibmca.spec

 %global enginesdir %(pkg-config --variable=enginesdir libcrypto)
+%global modulesdir %(openssl version -m | grep -o '".*"' | tr -d '"')
+# Above can be replaced by the following once OpenSSL commit
+# https://github.com/openssl/openssl/commit/7fde39de848f062d6db45bf9e69439db2100b9bb
+# has been included into the distribution:
+# %%global modulesdir %%(pkg-config --variable=modulesdir libcrypto)
+
+%if 0%{?fedora} >= 36 || 0%{?rhel} >= 9
+%global with_openssl3 1
+%endif
+
 
 Summary: A dynamic OpenSSL engine for IBMCA
 Name: openssl-ibmca
-Version: 2.2.2
-Release: 1%{?dist}.1
+Version: 2.3.0
+Release: 1%{?dist}
 License: ASL 2.0
 URL: https://github.com/opencryptoki
 Source0: https://github.com/opencryptoki/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz
-# https://bugzilla.redhat.com/show_bug.cgi?id=2069683
-# https://github.com/opencryptoki/openssl-ibmca/commit/e91e17901e0398b9a55850123ffe2cc4a0d04f34
-Patch0: %{name}-2.2.2-fix-ecx-keys.patch
-# https://github.com/opencryptoki/openssl-ibmca/commit/e59cce5af547cc4cbda2a1bce1eb2b89e959ae99
-Patch1: %{name}-2.2.2-openssl3.patch
+# post GA fixes
+Patch0: %{name}-%{version}-fixes.patch
 Requires: libica >= 4.0.0
 BuildRequires: make
 BuildRequires: gcc
 BuildRequires: libica-devel >= 4.0.0
 BuildRequires: automake libtool
 BuildRequires: openssl
+BuildRequires: perl(FindBin)
 ExclusiveArch: s390 s390x
 
 
@@ -40,8 +48,14 @@ A dynamic OpenSSL engine for IBMCA crypto hardware on IBM z Systems machines.
 %make_install
 rm -f %{buildroot}%{enginesdir}/*.la
 
-pushd src
-sed -e 's|/usr/local/lib|%{enginesdir}|' openssl.cnf.sample > openssl.cnf.sample.%{_arch}
+%if 0%{?with_openssl3}
+# provider is built when openssl3 is available, fix its location
+mkdir -p %{buildroot}%{modulesdir}
+mv %{buildroot}%{enginesdir}/ibmca-provider.so %{buildroot}%{modulesdir}/ibmca-provider.so
+%endif
+
+pushd src/engine
+sed -i -e 's|/usr/local/lib|%{enginesdir}|' openssl.cnf.sample
 popd
 
 # remove generated sample configs
@@ -54,15 +68,22 @@ make check
 
 %files
 %license LICENSE
-%doc ChangeLog README.md src/openssl.cnf.sample.%{_arch} src/ibmca-engine-opensslconfig
+%doc ChangeLog README.md src/engine/openssl.cnf.sample
+%doc src/engine/ibmca-engine-opensslconfig
+%doc src/provider/ibmca-provider-opensslconfig
 %{enginesdir}/ibmca.so
 %{_mandir}/man5/ibmca.5*
+%if 0%{?with_openssl3}
+%{modulesdir}/ibmca-provider.so
+%{_mandir}/man5/ibmca-provider.5*
+%endif
 
 
 %changelog
-* Wed Mar 30 2022 Dan Horák <dhorak@redhat.com> - 2.2.2-1.1
-- fix crash with ECX keys (#2069683)
-- Resolves: #2069683
+* Thu May 19 2022 Dan Horák <dhorak@redhat.com> - 2.3.0-1
+- updated to 2.3.0 (#2044177)
+- add provider for openssl 3.x (#2044185)
+- Resolves: #2044177 #2044185
 
 * Wed Feb 02 2022 Dan Horák <dan@danny.cz> - 2.2.2-1
 - updated to 2.2.2 (#2016989)