# ============================================================================= # nicko-su-openssl4 - OpenSSL 4.0.3 (FIPS-capable, post-quantum) in /opt/openssl4 # Generated by nicko-su-rpm-build.sh from templates-rpm/openssl/nicko-su-openssl4.spec. # Same idea as the Ubuntu package: a SEPARATE OpenSSL that never touches the system OpenSSL. # ============================================================================= %global ossl_prefix /opt/openssl4 # fips.so carries an integrity checksum (fipsmodule.cnf, made by "openssl fipsinstall" during # "make install_fips"). Stripping, debuginfo extraction or any other rewrite of the files AFTER that # would break the checksum, so every post-processing step of RPM is switched off for this package. %global debug_package %{nil} %global __strip /bin/true %global __os_install_post %{nil} %global _lto_cflags %{nil} %global _build_id_links none # A run path outside the standard library folders is the whole point of this package. %global __provides_exclude_from ^%{ossl_prefix}/lib/ossl-modules/.*$ %global __requires_exclude ^(libssl|libcrypto)\\.so\\.4.*$ # The test suite takes about 10 minutes. --without check skips it (local experiments only). %bcond_without check Name: nicko-su-openssl4 Version: 4.0.3 Release: 3.nicko_su%{?dist} Summary: OpenSSL 4 (FIPS-capable, post-quantum) installed in %{ossl_prefix} License: Apache-2.0 URL: https://openssl-library.org/ Source0: openssl-%{version}.tar.gz Source1: openssl-fips.cnf Source2: run-threads-test.sh BuildRequires: gcc BuildRequires: make BuildRequires: perl-interpreter BuildRequires: perl-lib BuildRequires: perl(lib) BuildRequires: perl(Time::Piece) BuildRequires: perl(File::Basename) BuildRequires: perl(File::Path) BuildRequires: perl(File::Spec) BuildRequires: perl(File::Find) BuildRequires: perl(Getopt::Std) BuildRequires: perl(Getopt::Long) BuildRequires: perl(Text::ParseWords) BuildRequires: perl(Data::Dumper) BuildRequires: perl(Storable) BuildRequires: perl(Symbol) BuildRequires: perl(Carp) BuildRequires: perl(POSIX) BuildRequires: perl(FindBin) BuildRequires: perl(IPC::Cmd) BuildRequires: perl(File::Compare) BuildRequires: perl(File::Copy) BuildRequires: perl(Module::Load) BuildRequires: perl(Pod::Html) BuildRequires: perl(Digest::SHA) BuildRequires: perl(Time::HiRes) BuildRequires: perl(File::Temp) BuildRequires: perl(Math::BigInt) BuildRequires: perl(Module::Load::Conditional) BuildRequires: perl(Test::Harness) BuildRequires: perl(Test::More) BuildRequires: perl(bignum) BuildRequires: hostname # SELinux: label %%{ossl_prefix} so that nginx (confined as httpd_t) may load the libraries. Requires(post): policycoreutils Requires(post): policycoreutils-python-utils Requires(postun): policycoreutils-python-utils Provides: bundled(openssl) = %{version} %description Separate build of OpenSSL %{version} with the FIPS provider and the built-in post-quantum algorithms (ML-KEM, ML-DSA, SLH-DSA). It is installed under %{ossl_prefix} and does not touch the system OpenSSL of CentOS / RHEL. The command is /usr/bin/openssl4. The FIPS provider is built from source; it is FIPS-capable, not FIPS-validated. This is the RPM counterpart of the Ubuntu package of the same name. %prep %setup -q -n openssl-%{version} cp -p %{SOURCE2} ./run-threads-test.sh %build # Hardening flags without -g: this package is never stripped, so debug information would only add size. ./Configure linux-x86_64 \ --prefix=%{ossl_prefix} --openssldir=%{ossl_prefix}/ssl --libdir=lib \ shared enable-fips enable-ec_nistp_64_gcc_128 \ -fstack-protector-strong -fstack-clash-protection -fcf-protection -Wp,-D_FORTIFY_SOURCE=3 \ -Wl,-z,relro -Wl,-z,now \ -Wl,-rpath,%{ossl_prefix}/lib -Wl,--enable-new-dtags make %{?_smp_mflags} %check %if %{with check} make test TESTS='-test_threads' sh ./run-threads-test.sh %endif %install # rpath outside the standard folders is intended here (the libraries are found through it). export QA_RPATHS=$(( 0x00ff )) make DESTDIR=%{buildroot} install_sw install_ssldirs install_fips install -m 0644 %{SOURCE1} %{buildroot}%{ossl_prefix}/ssl/openssl-fips.cnf # the command openssl4 (same as /usr/bin/openssl4 on Ubuntu) install -d %{buildroot}%{_bindir} ln -s %{ossl_prefix}/bin/openssl %{buildroot}%{_bindir}/openssl4 # trust store: the CentOS CA bundle, so that s_client and nginx "proxy_ssl_verify" find the usual CAs ln -sfn /etc/pki/tls/certs/ca-bundle.crt %{buildroot}%{ossl_prefix}/ssl/cert.pem # file list: every folder is owned, the configuration files are %%config(noreplace) ( cd %{buildroot} find .%{ossl_prefix} -type d | sed 's|^\.|%%dir |' find .%{ossl_prefix} ! -type d | sed 's|^\.||' \ | sed -E 's#^(.*/ssl/(openssl|openssl-fips|ct_log_list)\.cnf)$#%%config(noreplace) \1#' echo %{_bindir}/openssl4 ) > %{_builddir}/%{name}.files %files -f %{_builddir}/%{name}.files %license LICENSE.txt %doc README.md %post # SELinux. nginx runs confined (httpd_t) and may only execute / map libraries labelled lib_t. # Files in /opt are labelled usr_t by default, so the folders get their own rules. if command -v semanage >/dev/null 2>&1; then semanage fcontext -a -t bin_t '%{ossl_prefix}/bin(/.*)?' 2>/dev/null || semanage fcontext -m -t bin_t '%{ossl_prefix}/bin(/.*)?' 2>/dev/null || : semanage fcontext -a -t lib_t '%{ossl_prefix}/lib(/.*)?' 2>/dev/null || semanage fcontext -m -t lib_t '%{ossl_prefix}/lib(/.*)?' 2>/dev/null || : semanage fcontext -a -t etc_t '%{ossl_prefix}/ssl(/.*)?' 2>/dev/null || semanage fcontext -m -t etc_t '%{ossl_prefix}/ssl(/.*)?' 2>/dev/null || : fi if command -v selinuxenabled >/dev/null 2>&1 && selinuxenabled && command -v restorecon >/dev/null 2>&1; then restorecon -R %{ossl_prefix} >/dev/null 2>&1 || : fi exit 0 %postun if [ "$1" -eq 0 ] && command -v semanage >/dev/null 2>&1; then semanage fcontext -d '%{ossl_prefix}/bin(/.*)?' 2>/dev/null || : semanage fcontext -d '%{ossl_prefix}/lib(/.*)?' 2>/dev/null || : semanage fcontext -d '%{ossl_prefix}/ssl(/.*)?' 2>/dev/null || : fi exit 0 %posttrans # A running nginx keeps the OLD libraries in memory until it is restarted. if [ -d /run/systemd/system ]; then systemctl try-restart nginx.service >/dev/null 2>&1 || : fi exit 0 %changelog * Mon Oct 12 2026 Nicko SU - 4.0.3-3.nicko_su - OpenSSL 4.0.3 with FIPS provider and post-quantum support, in /opt/openssl4.