From f6642c22ebba486b81298e2671aef886c7d08f0f Mon Sep 17 00:00:00 2001
From: Brahmajit Das <listout@listout.xyz>
Date: Fri, 12 Dec 2025 18:23:59 +0530
Subject: [PATCH] app-crypt/swtpm: add 0.10.1

Also enable enable py3.14

Closes: https://bugs.gentoo.org/959729
Signed-off-by: Brahmajit Das <listout@listout.xyz>
Part-of: https://github.com/gentoo/gentoo/pull/44997
Closes: https://github.com/gentoo/gentoo/pull/44997
Signed-off-by: Sam James <sam@gentoo.org>
---
 app-crypt/swtpm/Manifest                      |  1 +
 ...-fix-test_tpm2_avoid_da_lockout-test.patch | 76 +++++++++++++++++++
 app-crypt/swtpm/swtpm-0.10.1.ebuild           | 76 +++++++++++++++++++
 3 files changed, 153 insertions(+)
 create mode 100644 app-crypt/swtpm/files/swtpm-0.10.1-fix-test_tpm2_avoid_da_lockout-test.patch
 create mode 100644 app-crypt/swtpm/swtpm-0.10.1.ebuild

diff --git a/app-crypt/swtpm/Manifest b/app-crypt/swtpm/Manifest
index b9fec7d251621..716156792990a 100644
--- a/app-crypt/swtpm/Manifest
+++ b/app-crypt/swtpm/Manifest
@@ -1,2 +1,3 @@
 DIST swtpm-0.10.0.tar.gz 414698 BLAKE2B 62ebc5638e7c0b6c2be42d8da5369dfce708339882b582b154aa46d5ae6ed4a59f4e6cc31a05b062190b98a461caed82281bf64b05e8941d3923d200cfde501c SHA512 6f1848b0514799417582c1a5bedf9b7110e3627ab14f02ea193ad76ce8a188eba596494f410405c5f7226e2daf7d9ee889983a2265285839e72de12e6368180d
+DIST swtpm-0.10.1.tar.gz 415992 BLAKE2B fa282338a975b4e3067e444ae5781744b3c153f482377a11b5c71072ed519709d561f6759e478a008813946da2f03c0650259d9f1ca17afd07892cd37f46529e SHA512 5711008866351b9408a5c6ade83157c55388617d499b7564daa83d640e9f81fa269bf54a40f6c4caa1c7186feefdfee76a05af1cc246c481708cb85d02a8c7e2
 DIST swtpm-0.9.0.tar.gz 370942 BLAKE2B bed63851dfdb94f463bbac962044114f75abd36f6558f173fd67be608f50c8954c6038d33bb6e3d2e88427238c7c06048beae23b84b2a1e186c0de98a9bd5ad8 SHA512 4f1723679b85218e80ea6aacdffa687e541ee309ddab9bcb8d8e5aa0b461ee431c880f2e300f1dcae112646f3636593005a342ee0cb762ec115aa599369e111c
diff --git a/app-crypt/swtpm/files/swtpm-0.10.1-fix-test_tpm2_avoid_da_lockout-test.patch b/app-crypt/swtpm/files/swtpm-0.10.1-fix-test_tpm2_avoid_da_lockout-test.patch
new file mode 100644
index 0000000000000..9af41fb38a5bc
--- /dev/null
+++ b/app-crypt/swtpm/files/swtpm-0.10.1-fix-test_tpm2_avoid_da_lockout-test.patch
@@ -0,0 +1,76 @@
+https://github.com/stefanberger/swtpm/commit/4da66c66f92438443e66b67555673c9cb898b0ae
+From: Stefan Berger <stefanb@linux.ibm.com>
+Date: Mon, 12 May 2025 18:25:48 -0400
+Subject: [PATCH] tests: Retry NVWrite command after 0x922 return code and inc
+ lockout counter
+
+When returncode 0x922 is received from NVWrite then retry the command so
+that it gets the expected error code from failing to provide a password.
+When checking the lockout counter, increase the numbers now.
+
+Patched versions of libtpms may not return 0x922 anymore, so write the code
+that it can test both cases.
+
+Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
+--- a/tests/_test_tpm2_avoid_da_lockout
++++ b/tests/_test_tpm2_avoid_da_lockout
+@@ -53,6 +53,11 @@ fi
+ cmd='\x80\x02\x00\x00\x00\x24\x00\x00\x01\x37\x01\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x09\x40\x00\x00\x09\x00\x00\x00\x00\x00\x00\x01\x41\x00\x00'
+ RES=$(swtpm_cmd_tx "${SWTPM_INTERFACE}" ${cmd})
+ exp=' 80 01 00 00 00 0a 00 00 09 22'
++if [ "$RES" == "$exp" ]; then
++	# 0x922 : retry command
++	RES=$(swtpm_cmd_tx "${SWTPM_INTERFACE}" ${cmd})
++fi
++exp=' 80 01 00 00 00 0a 00 00 09 8e'
+ if [ "$RES" != "$exp" ]; then
+ 	echo "Error: Did not get expected result from TPM2_NV_Write"
+ 	echo "expected: $exp"
+@@ -63,9 +68,9 @@ fi
+ # The TPM_PT_LOCKOUT_COUNTER must be 0 now: tssgetcapability -cap 6 -pr 0x20e -pc 1
+ cmd='\x80\x01\x00\x00\x00\x16\x00\x00\x01\x7a\x00\x00\x00\x06\x00\x00\x02\x0e\x00\x00\x00\x01'
+ RES=$(swtpm_cmd_tx "${SWTPM_INTERFACE}" ${cmd})
+-exp=' 80 01 00 00 00 1b 00 00 00 00 01 00 00 00 06 00 00 00 01 00 00 02 0e 00 00 00 00'
++exp=' 80 01 00 00 00 1b 00 00 00 00 01 00 00 00 06 00 00 00 01 00 00 02 0e 00 00 00 01'
+ if [ "$RES" != "$exp" ]; then
+-	echo "Error: Did not get expected result from TPM2_GetCapability(TPM_PT_LOCKOUT_COUNTER)"
++	echo "Error: Did not get expected result from 1st TPM2_GetCapability(TPM_PT_LOCKOUT_COUNTER)"
+ 	echo "expected: $exp"
+ 	echo "received: $RES"
+ 	exit 1
+@@ -92,9 +97,9 @@ fi
+ # Without swtpm sending TPM2_Shutdown, it would be '1' now
+ cmd='\x80\x01\x00\x00\x00\x16\x00\x00\x01\x7a\x00\x00\x00\x06\x00\x00\x02\x0e\x00\x00\x00\x01'
+ RES=$(swtpm_cmd_tx "${SWTPM_INTERFACE}" ${cmd})
+-exp=' 80 01 00 00 00 1b 00 00 00 00 01 00 00 00 06 00 00 00 01 00 00 02 0e 00 00 00 00'
++exp=' 80 01 00 00 00 1b 00 00 00 00 01 00 00 00 06 00 00 00 01 00 00 02 0e 00 00 00 01'
+ if [ "$RES" != "$exp" ]; then
+-	echo "Error: Did not get expected result from TPM2_GetCapability(TPM_PT_LOCKOUT_COUNTER)"
++	echo "Error: Did not get expected result from 2nd TPM2_GetCapability(TPM_PT_LOCKOUT_COUNTER)"
+ 	echo "expected: $exp"
+ 	echo "received: $RES"
+ 	exit 1
+@@ -104,6 +109,11 @@ fi
+ cmd='\x80\x02\x00\x00\x00\x24\x00\x00\x01\x37\x01\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x09\x40\x00\x00\x09\x00\x00\x00\x00\x00\x00\x01\x41\x00\x00'
+ RES=$(swtpm_cmd_tx "${SWTPM_INTERFACE}" ${cmd})
+ exp=' 80 01 00 00 00 0a 00 00 09 22'
++if [ "$RES" == "$exp" ]; then
++	# 0x922 : retry command
++	RES=$(swtpm_cmd_tx "${SWTPM_INTERFACE}" ${cmd})
++fi
++exp=' 80 01 00 00 00 0a 00 00 09 8e'
+ if [ "$RES" != "$exp" ]; then
+ 	echo "Error: Did not get expected result from TPM2_NV_Write"
+ 	echo "expected: $exp"
+@@ -136,9 +146,9 @@ fi
+ # Without swtpm sending TPM2_Shutdown, it would be '2' now
+ cmd='\x80\x01\x00\x00\x00\x16\x00\x00\x01\x7a\x00\x00\x00\x06\x00\x00\x02\x0e\x00\x00\x00\x01'
+ RES=$(swtpm_cmd_tx "${SWTPM_INTERFACE}" ${cmd})
+-exp=' 80 01 00 00 00 1b 00 00 00 00 01 00 00 00 06 00 00 00 01 00 00 02 0e 00 00 00 00'
++exp=' 80 01 00 00 00 1b 00 00 00 00 01 00 00 00 06 00 00 00 01 00 00 02 0e 00 00 00 02'
+ if [ "$RES" != "$exp" ]; then
+-	echo "Error: Did not get expected result from TPM2_GetCapability(TPM_PT_LOCKOUT_COUNTER)"
++	echo "Error: Did not get expected result from 3rd TPM2_GetCapability(TPM_PT_LOCKOUT_COUNTER)"
+ 	echo "expected: $exp"
+ 	echo "received: $RES"
+ 	exit 1
diff --git a/app-crypt/swtpm/swtpm-0.10.1.ebuild b/app-crypt/swtpm/swtpm-0.10.1.ebuild
new file mode 100644
index 0000000000000..1527d2fb7eed4
--- /dev/null
+++ b/app-crypt/swtpm/swtpm-0.10.1.ebuild
@@ -0,0 +1,76 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{11..14} )
+
+inherit autotools python-any-r1
+
+DESCRIPTION="Libtpms-based TPM emulator"
+HOMEPAGE="https://github.com/stefanberger/swtpm"
+SRC_URI="https://github.com/stefanberger/swtpm/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="BSD"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+IUSE="fuse seccomp test"
+RESTRICT="!test? ( test )"
+
+# net-libs/gnutls[pkcs11,tools] is required otherwsie it not possible to
+# provision new vTPMs. swtpm_cert spawns certttool, and upstream expects
+# pkcs11 in gnutls: https://github.com/stefanberger/swtpm/issues/477.
+
+RDEPEND="fuse? (
+		sys-fs/fuse:0
+	)
+	seccomp? ( sys-libs/libseccomp )
+	acct-group/tss
+	acct-user/tss
+	dev-libs/glib:2
+	dev-libs/gmp:=
+	dev-libs/openssl:=
+	dev-libs/json-glib
+	>=dev-libs/libtpms-0.10.0
+	dev-libs/libtasn1:=
+	net-libs/gnutls:=[pkcs11,tools]
+"
+
+DEPEND="${RDEPEND}
+	test?	(
+		net-misc/socat
+		dev-tcltk/expect
+		)"
+
+BDEPEND="${PYTHON_DEPS}"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-0.6.0-fix-localca-path.patch"
+	"${FILESDIR}/${PN}-0.10.0-build-sys-Remove-WError.patch"
+	"${FILESDIR}/${PN}-0.8.2-slibtool.patch"
+	"${FILESDIR}/${PN}-0.10.1-fix-test_tpm2_avoid_da_lockout-test.patch"
+)
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+src_configure() {
+	econf \
+		--with-openssl \
+		--with-gnutls \
+		--without-selinux \
+		$(use_with fuse cuse) \
+		$(use_with seccomp) \
+		$(use_enable test tests)
+}
+
+src_install() {
+	default
+	rm -fr "${ED}/usr/libexec/installed-tests/swtpm"
+	fowners -R tss:root /var/lib/swtpm-localca
+	fperms 750 /var/lib/swtpm-localca
+	keepdir /var/lib/swtpm-localca
+	find "${D}" -name '*.la' -delete || die
+}