From fe6e62c5280a9c87a992bc45377e4600741c3b22 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Thu, 20 Nov 2025 17:11:50 +0900 Subject: [PATCH 1/5] Update to 3.8.11 upstream release - Resolves: rhbz#2416041 Upstream tag: 3.8.11 Upstream commit: b841c70e Commit authored by Packit automation (https://packit.dev/) --- .gitignore | 3 +++ README.packit | 2 +- gnutls.spec | 11 ++++------- sources | 7 +++---- 4 files changed, 11 insertions(+), 12 deletions(-) diff --git a/.gitignore b/.gitignore index f859c71..1e793de 100644 --- a/.gitignore +++ b/.gitignore @@ -170,3 +170,6 @@ gnutls-2.10.1-nosrp.tar.bz2 /gnutls-3.8.10.tar.xz /gnutls-3.8.10.tar.xz.sig /leancrypto-1.5.0.tar.gz +/gnutls-3.8.11.tar.xz +/gnutls-3.8.11.tar.xz.sig +/leancrypto-1.6.0.tar.gz diff --git a/README.packit b/README.packit index 72e3769..2511bf4 100644 --- a/README.packit +++ b/README.packit @@ -1,3 +1,3 @@ This repository is maintained by packit. https://packit.dev/ -The file was generated using packit 0.102.2. +The file was generated using packit 1.12.0. diff --git a/gnutls.spec b/gnutls.spec index 4475882..c3b0d28 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -12,16 +12,12 @@ sha256sum:close() print(string.sub(hash, 0, 16)) } -Version: 3.8.10 +Version: 3.8.11 Release: %{?autorelease}%{!?autorelease:1%{?dist}} Patch: gnutls-3.2.7-rpath.patch # follow https://gitlab.com/gnutls/gnutls/-/issues/1443 Patch: gnutls-3.8.8-tests-ktls-skip-tls12-chachapoly.patch -# add tests/ktls_utils.h missing in the distribution -Patch: gnutls-3.8.10-tests-ktls.patch -# run tests/cert-test/mldsa.sh in VPATH build -Patch: gnutls-3.8.10-tests-mldsa.patch %bcond_without bootstrap %bcond_without dane @@ -144,7 +140,7 @@ Source201: gnutls-3.8.8-tests-rsa-default.patch %endif %if %{with leancrypto} -Source300: leancrypto-1.5.0.tar.gz +Source300: leancrypto-1.6.0.tar.gz %endif # Wildcard bundling exception https://fedorahosted.org/fpc/ticket/174 @@ -315,7 +311,8 @@ meson setup -Dprefix="$PWD/install" -Dlibdir="$PWD/install/lib" \ -Dx509_parser=disabled -Dx509_generator=disabled \ -Dpkcs7_parser=disabled -Dpkcs7_generator=disabled \ -Dsha2-256=disabled \ - -Dchacha20=disabled -Dchacha20_drng=disabled \ + -Daes_gcm=disabled -Daes_cbc=disabled -Daes_ctr=disabled -Daes_xts=disabled \ + -Dchacha20=disabled -Dchacha20poly1305=disabled -Dchacha20_drng=disabled \ -Ddrbg_hash=disabled -Ddrbg_hmac=disabled \ -Dhash_crypt=disabled \ -Dhmac=disabled -Dhkdf=disabled \ diff --git a/sources b/sources index 6114eb9..b7486bf 100644 --- a/sources +++ b/sources @@ -1,5 +1,4 @@ -SHA512 (gnutls-3.8.10.tar.xz) = d453bd4527af95cb3905ce8753ceafd969e3f442ad1d148544a233ebf13285b999930553a805a0511293cc25390bb6a040260df5544a7c55019640f920ad3d92 -SHA512 (gnutls-3.8.10.tar.xz.sig) = 72d6dd2c23f768f5041c3dca0f49b3f60cd01fc960ce77f097094a2aae6d76fddeb6295c425e3750c711d5f700957a62268aecc4873e53c31abb60eecf0fd4a8 +SHA512 (gnutls-3.8.11.tar.xz) = 68f9e5bec3aa6686fd3319cc9c88a5cc44e2a75144049fc9de5fb55fef2241b4e16996af4be5dd48308abbee8cfaed6c862903f6bb89aff5dfa5410075bd7386 +SHA512 (gnutls-3.8.11.tar.xz.sig) = 90883e5736299b103844ca42b85d371969ef66b50b60cb185e814ad9978598796e9ed07a590245ff28ac6ac084b1dee93fae0845576464583a5941835990957d SHA512 (gnutls-release-keyring.gpg) = 8c2b39239d1d8c5319757fcf669f28a11de7f8ec4a726f9904c57ba8105bea80240083c0de71b747115907bab46569f10cf58004137cc7884ac5c20f8319ae0a -SHA512 (gmp-6.2.1.tar.xz) = c99be0950a1d05a0297d65641dd35b75b74466f7bf03c9e8a99895a3b2f9a0856cd17887738fa51cf7499781b65c049769271cbcb77d057d2e9f1ec52e07dd84 -SHA512 (leancrypto-1.5.0.tar.gz) = 1170a502f58c9bce424578cece64a3ebf856620adc02f390b8877981bccf0c2bf35e64b1628094a06c069ec38a3be5889be22516d45d85f4e75b40085d9001c9 +SHA512 (leancrypto-1.6.0.tar.gz) = cb6ace4a1642208dd7656b62a48e99d6261f471aa7967b738057745a4534abfa11d380dd5de98a737c0c13b1e1cb37ce780e02297eefc1cf839581629d34e100 From 5d91dcb6c24e4d2c65059c69759e300002f983c7 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Fri, 21 Nov 2025 11:33:15 +0900 Subject: [PATCH 2/5] Minor fixes to spec file and packit configuration Signed-off-by: Daiki Ueno --- .packit.yaml | 3 +-- gnutls.spec | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/.packit.yaml b/.packit.yaml index 2a7dee2..31a01eb 100644 --- a/.packit.yaml +++ b/.packit.yaml @@ -28,5 +28,4 @@ actions: jobs: - job: propose_downstream trigger: release - metadata: - dist_git_branches: fedora-all + dist_git_branches: fedora-all diff --git a/gnutls.spec b/gnutls.spec index c3b0d28..c082be0 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -311,7 +311,7 @@ meson setup -Dprefix="$PWD/install" -Dlibdir="$PWD/install/lib" \ -Dx509_parser=disabled -Dx509_generator=disabled \ -Dpkcs7_parser=disabled -Dpkcs7_generator=disabled \ -Dsha2-256=disabled \ - -Daes_gcm=disabled -Daes_cbc=disabled -Daes_ctr=disabled -Daes_xts=disabled \ + -Daes_gcm=disabled -Daes_cbc=disabled -Daes_ctr=disabled -Daes_xts=disabled \ -Dchacha20=disabled -Dchacha20poly1305=disabled -Dchacha20_drng=disabled \ -Ddrbg_hash=disabled -Ddrbg_hmac=disabled \ -Dhash_crypt=disabled \ From 3edd13f1c96534df88cf1f8f63edbee8c769b591 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Fri, 21 Nov 2025 11:36:21 +0900 Subject: [PATCH 3/5] Enable crypto-auditing probes Signed-off-by: Daiki Ueno --- gnutls.spec | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/gnutls.spec b/gnutls.spec index c082be0..a3583a9 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -31,6 +31,7 @@ Patch: gnutls-3.8.8-tests-ktls-skip-tls12-chachapoly.patch %endif %bcond_without certificate_compression %bcond_without leancrypto +%bcond_without crypto_auditing %bcond_without tests %if 0%{?fedora} && 0%{?fedora} < 38 @@ -86,6 +87,9 @@ BuildRequires: libunistring-devel BuildRequires: net-tools, softhsm, gcc, gcc-c++ BuildRequires: gnupg2 BuildRequires: git-core +%if %{with crypto_auditing} +BuildRequires: systemtap-sdt-devel +%endif # for a sanity check on cert loading BuildRequires: p11-kit-trust, ca-certificates @@ -405,6 +409,11 @@ pushd native_build --with-leancrypto \ %else --without-leancrypto \ +%endif +%if %{with crypto_auditing} + --enable-crypto-auditing \ +%else + --disable-crypto-auditing \ %endif --disable-rpath \ --with-default-priority-string="@SYSTEM" From 317e073be2be146231b77986246a8144bbaa9b6a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Wed, 11 Jun 2025 10:46:40 +0000 Subject: [PATCH 4/5] Add missing Provides: bundled(..) for gmp & leancrypto MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Daniel P. Berrangé --- gnutls.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/gnutls.spec b/gnutls.spec index a3583a9..058f0fe 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -133,6 +133,7 @@ Source1: https://www.gnupg.org/ftp/gcrypt/gnutls/v%{short_version}/%{name}-%{ver Source2: https://gnutls.org/gnutls-release-keyring.gpg %if %{with bundled_gmp} +Provides: bundled(gmp) = 6.2.1 Source100: gmp-6.2.1.tar.xz # Taken from the main gmp package Source101: gmp-6.2.1-intel-cet.patch @@ -144,6 +145,7 @@ Source201: gnutls-3.8.8-tests-rsa-default.patch %endif %if %{with leancrypto} +Provides: bundled(leancrypto) = 1.6.0 Source300: leancrypto-1.6.0.tar.gz %endif From 4b7b61887d084c1d9b34d0ea8bd14069821b8e7a Mon Sep 17 00:00:00 2001 From: Alexander Sosedkin Date: Tue, 25 Nov 2025 10:30:02 +0100 Subject: [PATCH 5/5] Disable native assembly to work around bz2416812 --- gnutls.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/gnutls.spec b/gnutls.spec index 058f0fe..77883fc 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -328,7 +328,10 @@ meson setup -Dprefix="$PWD/install" -Dlibdir="$PWD/install/lib" \ -Dhotp=disabled -Dtotp=disabled \ -Daes_block=disabled -Daes_cbc=disabled -Daes_ctr=disabled \ -Daes_kw=disabled -Dapps=disabled \ + -Ddisable-asm=true \ _build +# the reason for -Ddisable-asm=true being bz2416812 +# revert once the root cause is fixed meson compile -C _build meson install -C _build