From 330d52f8da47038d72f2c1ca6e9d6e5a226311eb Mon Sep 17 00:00:00 2001 From: Krenzelok Frantisek Date: Wed, 23 Jul 2025 13:19:57 +0200 Subject: [PATCH 01/10] Enable kTLS by default Resolves: rhbz#2130000 - https://fedoraproject.org/wiki/Changes/KTLSSupportForGnuTLS. - kTLS is now enabled by default if all requirements are met. - Modify the docs to reflect the change of defaults. - Picked-up a patch that fixes state transition in the KTLS code path. --- gnutls-3.8.10-ktls-enable-by-default.patch | 45 +++++++++++++++++++ gnutls-3.8.10-ktls-fix-state-transition.patch | 24 ++++++++++ gnutls.spec | 4 ++ 3 files changed, 73 insertions(+) create mode 100644 gnutls-3.8.10-ktls-enable-by-default.patch create mode 100644 gnutls-3.8.10-ktls-fix-state-transition.patch diff --git a/gnutls-3.8.10-ktls-enable-by-default.patch b/gnutls-3.8.10-ktls-enable-by-default.patch new file mode 100644 index 0000000..5fac77d --- /dev/null +++ b/gnutls-3.8.10-ktls-enable-by-default.patch @@ -0,0 +1,45 @@ +diff --git a/lib/priority.c b/lib/priority.c +index 25a2de9..e864314 100644 +--- a/lib/priority.c ++++ b/lib/priority.c +@@ -1033,6 +1033,7 @@ static inline void cfg_init(struct cfg *cfg) + { + memset(cfg, 0, sizeof(*cfg)); + cfg->allow_rsa_pkcs1_encrypt = true; ++ cfg->ktls_enabled = true; + } + + static inline void cfg_deinit(struct cfg *cfg) +diff --git a/doc/cha-config.texi b/doc/cha-config.texi +index 25ff0ed..c93dcb2 100644 +--- a/doc/cha-config.texi ++++ b/doc/cha-config.texi +@@ -282,13 +282,13 @@ cert-compression-alg = zlib + The following options can overwrite default behavior of protocols system-wide. + @example + [global] +-ktls = true ++ktls = false + + @end example +-@node Enabling kTLS +-@subsection Enabling kTLS +-When GnuTLS is build with -–enable-ktls configuration, KTLS is disabled by default. +-This can be enabled by setting @code{ktls = true} in @code{[global]} section. ++@node Enabling/Disabling kTLS ++@subsection Enabling/Disabling kTLS ++When GnuTLS is build with -–enable-ktls configuration, KTLS is enabled by default. ++This can be disabled by setting @code{ktls = false} in @code{[global]} section. + + kTLS requires that the system support kTLS @ref{kTLS (Kernel TLS)}. + +diff -up ./doc/cha-features.texi.ktls_default ./doc/cha-features.texi +--- ./doc/cha-features.texi.ktls_default 2025-08-21 17:13:57.610330316 +0200 ++++ ./doc/cha-features.texi 2025-08-21 17:14:00.806352803 +0200 +@@ -21,5 +21,5 @@ The following table shows how to enable + @caption{kTLS system enable} + @end float + +-To enable ktls in GnuTLS @ref{Enabling kTLS}. ++To enable ktls in GnuTLS @ref{Enabling/Disabling kTLS}. + diff --git a/gnutls-3.8.10-ktls-fix-state-transition.patch b/gnutls-3.8.10-ktls-fix-state-transition.patch new file mode 100644 index 0000000..fc9d490 --- /dev/null +++ b/gnutls-3.8.10-ktls-fix-state-transition.patch @@ -0,0 +1,24 @@ +From 5376a0cabf94314316005e6bf411ffcc7628b386 Mon Sep 17 00:00:00 2001 +From: Daiki Ueno +Date: Tue, 22 Jul 2025 10:49:33 +0900 +Subject: [PATCH 1/3] key_update: fix state transition in KTLS code path + +Signed-off-by: Daiki Ueno +--- + lib/record.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/record.c b/lib/record.c +index d37f79a550..ebc75addec 100644 +--- a/lib/record.c ++++ b/lib/record.c +@@ -2045,7 +2045,7 @@ ssize_t gnutls_record_send2(gnutls_session_t session, const void *data, + FALLTHROUGH; + case RECORD_SEND_KEY_UPDATE_3: + if (IS_KTLS_ENABLED(session, GNUTLS_KTLS_SEND)) { +- return _gnutls_ktls_send( ++ ret = _gnutls_ktls_send( + session, + session->internals.record_key_update_buffer.data, + session->internals.record_key_update_buffer +-- diff --git a/gnutls.spec b/gnutls.spec index 4475882..abe6bbf 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -20,6 +20,10 @@ Patch: gnutls-3.2.7-rpath.patch Patch: gnutls-3.8.8-tests-ktls-skip-tls12-chachapoly.patch # add tests/ktls_utils.h missing in the distribution Patch: gnutls-3.8.10-tests-ktls.patch +# Enable ktls by default +Patch: gnutls-3.8.10-ktls-enable-by-default.patch +# Fix state transition in the KTLS code path. +Patch: gnutls-3.8.10-ktls-fix-state-transition.patch # run tests/cert-test/mldsa.sh in VPATH build Patch: gnutls-3.8.10-tests-mldsa.patch From 92cc61b5313a6652cf83ea1080e6c838a2596c45 Mon Sep 17 00:00:00 2001 From: Krenzelok Frantisek Date: Tue, 26 Aug 2025 17:33:12 +0200 Subject: [PATCH 02/10] Revert "Enable kTLS by default" This reverts commit 330d52f8da47038d72f2c1ca6e9d6e5a226311eb. --- gnutls-3.8.10-ktls-enable-by-default.patch | 45 ------------------- gnutls-3.8.10-ktls-fix-state-transition.patch | 24 ---------- gnutls.spec | 4 -- 3 files changed, 73 deletions(-) delete mode 100644 gnutls-3.8.10-ktls-enable-by-default.patch delete mode 100644 gnutls-3.8.10-ktls-fix-state-transition.patch diff --git a/gnutls-3.8.10-ktls-enable-by-default.patch b/gnutls-3.8.10-ktls-enable-by-default.patch deleted file mode 100644 index 5fac77d..0000000 --- a/gnutls-3.8.10-ktls-enable-by-default.patch +++ /dev/null @@ -1,45 +0,0 @@ -diff --git a/lib/priority.c b/lib/priority.c -index 25a2de9..e864314 100644 ---- a/lib/priority.c -+++ b/lib/priority.c -@@ -1033,6 +1033,7 @@ static inline void cfg_init(struct cfg *cfg) - { - memset(cfg, 0, sizeof(*cfg)); - cfg->allow_rsa_pkcs1_encrypt = true; -+ cfg->ktls_enabled = true; - } - - static inline void cfg_deinit(struct cfg *cfg) -diff --git a/doc/cha-config.texi b/doc/cha-config.texi -index 25ff0ed..c93dcb2 100644 ---- a/doc/cha-config.texi -+++ b/doc/cha-config.texi -@@ -282,13 +282,13 @@ cert-compression-alg = zlib - The following options can overwrite default behavior of protocols system-wide. - @example - [global] --ktls = true -+ktls = false - - @end example --@node Enabling kTLS --@subsection Enabling kTLS --When GnuTLS is build with -–enable-ktls configuration, KTLS is disabled by default. --This can be enabled by setting @code{ktls = true} in @code{[global]} section. -+@node Enabling/Disabling kTLS -+@subsection Enabling/Disabling kTLS -+When GnuTLS is build with -–enable-ktls configuration, KTLS is enabled by default. -+This can be disabled by setting @code{ktls = false} in @code{[global]} section. - - kTLS requires that the system support kTLS @ref{kTLS (Kernel TLS)}. - -diff -up ./doc/cha-features.texi.ktls_default ./doc/cha-features.texi ---- ./doc/cha-features.texi.ktls_default 2025-08-21 17:13:57.610330316 +0200 -+++ ./doc/cha-features.texi 2025-08-21 17:14:00.806352803 +0200 -@@ -21,5 +21,5 @@ The following table shows how to enable - @caption{kTLS system enable} - @end float - --To enable ktls in GnuTLS @ref{Enabling kTLS}. -+To enable ktls in GnuTLS @ref{Enabling/Disabling kTLS}. - diff --git a/gnutls-3.8.10-ktls-fix-state-transition.patch b/gnutls-3.8.10-ktls-fix-state-transition.patch deleted file mode 100644 index fc9d490..0000000 --- a/gnutls-3.8.10-ktls-fix-state-transition.patch +++ /dev/null @@ -1,24 +0,0 @@ -From 5376a0cabf94314316005e6bf411ffcc7628b386 Mon Sep 17 00:00:00 2001 -From: Daiki Ueno -Date: Tue, 22 Jul 2025 10:49:33 +0900 -Subject: [PATCH 1/3] key_update: fix state transition in KTLS code path - -Signed-off-by: Daiki Ueno ---- - lib/record.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/lib/record.c b/lib/record.c -index d37f79a550..ebc75addec 100644 ---- a/lib/record.c -+++ b/lib/record.c -@@ -2045,7 +2045,7 @@ ssize_t gnutls_record_send2(gnutls_session_t session, const void *data, - FALLTHROUGH; - case RECORD_SEND_KEY_UPDATE_3: - if (IS_KTLS_ENABLED(session, GNUTLS_KTLS_SEND)) { -- return _gnutls_ktls_send( -+ ret = _gnutls_ktls_send( - session, - session->internals.record_key_update_buffer.data, - session->internals.record_key_update_buffer --- diff --git a/gnutls.spec b/gnutls.spec index abe6bbf..4475882 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -20,10 +20,6 @@ Patch: gnutls-3.2.7-rpath.patch Patch: gnutls-3.8.8-tests-ktls-skip-tls12-chachapoly.patch # add tests/ktls_utils.h missing in the distribution Patch: gnutls-3.8.10-tests-ktls.patch -# Enable ktls by default -Patch: gnutls-3.8.10-ktls-enable-by-default.patch -# Fix state transition in the KTLS code path. -Patch: gnutls-3.8.10-ktls-fix-state-transition.patch # run tests/cert-test/mldsa.sh in VPATH build Patch: gnutls-3.8.10-tests-mldsa.patch From 000d285047d7fa5eebf2b159e3890882a51ef80e Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Thu, 20 Nov 2025 17:03:07 +0900 Subject: [PATCH 03/10] Update to 3.8.11 upstream release - Resolves: rhbz#2416041 Upstream tag: 3.8.11 Upstream commit: b841c70e Commit authored by Packit automation (https://packit.dev/) --- .gitignore | 3 +++ README.packit | 2 +- gnutls.spec | 11 ++++------- sources | 7 +++---- 4 files changed, 11 insertions(+), 12 deletions(-) diff --git a/.gitignore b/.gitignore index f859c71..1e793de 100644 --- a/.gitignore +++ b/.gitignore @@ -170,3 +170,6 @@ gnutls-2.10.1-nosrp.tar.bz2 /gnutls-3.8.10.tar.xz /gnutls-3.8.10.tar.xz.sig /leancrypto-1.5.0.tar.gz +/gnutls-3.8.11.tar.xz +/gnutls-3.8.11.tar.xz.sig +/leancrypto-1.6.0.tar.gz diff --git a/README.packit b/README.packit index 72e3769..2511bf4 100644 --- a/README.packit +++ b/README.packit @@ -1,3 +1,3 @@ This repository is maintained by packit. https://packit.dev/ -The file was generated using packit 0.102.2. +The file was generated using packit 1.12.0. diff --git a/gnutls.spec b/gnutls.spec index 4475882..c3b0d28 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -12,16 +12,12 @@ sha256sum:close() print(string.sub(hash, 0, 16)) } -Version: 3.8.10 +Version: 3.8.11 Release: %{?autorelease}%{!?autorelease:1%{?dist}} Patch: gnutls-3.2.7-rpath.patch # follow https://gitlab.com/gnutls/gnutls/-/issues/1443 Patch: gnutls-3.8.8-tests-ktls-skip-tls12-chachapoly.patch -# add tests/ktls_utils.h missing in the distribution -Patch: gnutls-3.8.10-tests-ktls.patch -# run tests/cert-test/mldsa.sh in VPATH build -Patch: gnutls-3.8.10-tests-mldsa.patch %bcond_without bootstrap %bcond_without dane @@ -144,7 +140,7 @@ Source201: gnutls-3.8.8-tests-rsa-default.patch %endif %if %{with leancrypto} -Source300: leancrypto-1.5.0.tar.gz +Source300: leancrypto-1.6.0.tar.gz %endif # Wildcard bundling exception https://fedorahosted.org/fpc/ticket/174 @@ -315,7 +311,8 @@ meson setup -Dprefix="$PWD/install" -Dlibdir="$PWD/install/lib" \ -Dx509_parser=disabled -Dx509_generator=disabled \ -Dpkcs7_parser=disabled -Dpkcs7_generator=disabled \ -Dsha2-256=disabled \ - -Dchacha20=disabled -Dchacha20_drng=disabled \ + -Daes_gcm=disabled -Daes_cbc=disabled -Daes_ctr=disabled -Daes_xts=disabled \ + -Dchacha20=disabled -Dchacha20poly1305=disabled -Dchacha20_drng=disabled \ -Ddrbg_hash=disabled -Ddrbg_hmac=disabled \ -Dhash_crypt=disabled \ -Dhmac=disabled -Dhkdf=disabled \ diff --git a/sources b/sources index 6114eb9..b7486bf 100644 --- a/sources +++ b/sources @@ -1,5 +1,4 @@ -SHA512 (gnutls-3.8.10.tar.xz) = d453bd4527af95cb3905ce8753ceafd969e3f442ad1d148544a233ebf13285b999930553a805a0511293cc25390bb6a040260df5544a7c55019640f920ad3d92 -SHA512 (gnutls-3.8.10.tar.xz.sig) = 72d6dd2c23f768f5041c3dca0f49b3f60cd01fc960ce77f097094a2aae6d76fddeb6295c425e3750c711d5f700957a62268aecc4873e53c31abb60eecf0fd4a8 +SHA512 (gnutls-3.8.11.tar.xz) = 68f9e5bec3aa6686fd3319cc9c88a5cc44e2a75144049fc9de5fb55fef2241b4e16996af4be5dd48308abbee8cfaed6c862903f6bb89aff5dfa5410075bd7386 +SHA512 (gnutls-3.8.11.tar.xz.sig) = 90883e5736299b103844ca42b85d371969ef66b50b60cb185e814ad9978598796e9ed07a590245ff28ac6ac084b1dee93fae0845576464583a5941835990957d SHA512 (gnutls-release-keyring.gpg) = 8c2b39239d1d8c5319757fcf669f28a11de7f8ec4a726f9904c57ba8105bea80240083c0de71b747115907bab46569f10cf58004137cc7884ac5c20f8319ae0a -SHA512 (gmp-6.2.1.tar.xz) = c99be0950a1d05a0297d65641dd35b75b74466f7bf03c9e8a99895a3b2f9a0856cd17887738fa51cf7499781b65c049769271cbcb77d057d2e9f1ec52e07dd84 -SHA512 (leancrypto-1.5.0.tar.gz) = 1170a502f58c9bce424578cece64a3ebf856620adc02f390b8877981bccf0c2bf35e64b1628094a06c069ec38a3be5889be22516d45d85f4e75b40085d9001c9 +SHA512 (leancrypto-1.6.0.tar.gz) = cb6ace4a1642208dd7656b62a48e99d6261f471aa7967b738057745a4534abfa11d380dd5de98a737c0c13b1e1cb37ce780e02297eefc1cf839581629d34e100 From 7441432f8caf08b73c3df007e74726a86f816fc9 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Fri, 21 Nov 2025 11:33:15 +0900 Subject: [PATCH 04/10] Minor fixes to spec file and packit configuration Signed-off-by: Daiki Ueno --- .packit.yaml | 3 +-- gnutls.spec | 3 ++- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.packit.yaml b/.packit.yaml index 2a7dee2..31a01eb 100644 --- a/.packit.yaml +++ b/.packit.yaml @@ -28,5 +28,4 @@ actions: jobs: - job: propose_downstream trigger: release - metadata: - dist_git_branches: fedora-all + dist_git_branches: fedora-all diff --git a/gnutls.spec b/gnutls.spec index c3b0d28..e1fa19b 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -311,7 +311,7 @@ meson setup -Dprefix="$PWD/install" -Dlibdir="$PWD/install/lib" \ -Dx509_parser=disabled -Dx509_generator=disabled \ -Dpkcs7_parser=disabled -Dpkcs7_generator=disabled \ -Dsha2-256=disabled \ - -Daes_gcm=disabled -Daes_cbc=disabled -Daes_ctr=disabled -Daes_xts=disabled \ + -Daes_gcm=disabled -Daes_cbc=disabled -Daes_ctr=disabled -Daes_xts=disabled \ -Dchacha20=disabled -Dchacha20poly1305=disabled -Dchacha20_drng=disabled \ -Ddrbg_hash=disabled -Ddrbg_hmac=disabled \ -Dhash_crypt=disabled \ @@ -332,6 +332,7 @@ export LEANCRYPTO_DIR="$PWD/bundled_leancrypto/install" export LEANCRYPTO_CFLAGS="-I$LEANCRYPTO_DIR/include" export LEANCRYPTO_LIBS="$LEANCRYPTO_DIR/lib/libleancrypto.a" +export PKG_CONFIG_PATH="$LEANCRYPTO_DIR/lib/pkgconfig" %endif %if %{with bootstrap} From 3078b09e4174f92151f3a3993d3c26e313c5fc13 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Fri, 21 Nov 2025 11:36:21 +0900 Subject: [PATCH 05/10] Enable crypto-auditing probes Signed-off-by: Daiki Ueno --- gnutls.spec | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/gnutls.spec b/gnutls.spec index e1fa19b..0f37dbe 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -31,6 +31,7 @@ Patch: gnutls-3.8.8-tests-ktls-skip-tls12-chachapoly.patch %endif %bcond_without certificate_compression %bcond_without leancrypto +%bcond_without crypto_auditing %bcond_without tests %if 0%{?fedora} && 0%{?fedora} < 38 @@ -86,6 +87,9 @@ BuildRequires: libunistring-devel BuildRequires: net-tools, softhsm, gcc, gcc-c++ BuildRequires: gnupg2 BuildRequires: git-core +%if %{with crypto_auditing} +BuildRequires: systemtap-sdt-devel +%endif # for a sanity check on cert loading BuildRequires: p11-kit-trust, ca-certificates @@ -406,6 +410,11 @@ pushd native_build --with-leancrypto \ %else --without-leancrypto \ +%endif +%if %{with crypto_auditing} + --enable-crypto-auditing \ +%else + --disable-crypto-auditing \ %endif --disable-rpath \ --with-default-priority-string="@SYSTEM" From 9f95ff6e693753acfb40a77e48a79ab4bd37a01b Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Fri, 21 Nov 2025 16:12:20 +0900 Subject: [PATCH 06/10] Remove unnecessary PKG_CONFIG_PATH setting Signed-off-by: Daiki Ueno --- gnutls.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/gnutls.spec b/gnutls.spec index 0f37dbe..a3583a9 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -336,7 +336,6 @@ export LEANCRYPTO_DIR="$PWD/bundled_leancrypto/install" export LEANCRYPTO_CFLAGS="-I$LEANCRYPTO_DIR/include" export LEANCRYPTO_LIBS="$LEANCRYPTO_DIR/lib/libleancrypto.a" -export PKG_CONFIG_PATH="$LEANCRYPTO_DIR/lib/pkgconfig" %endif %if %{with bootstrap} From c5fcada2f38bb7e2e614fa74fb088d627b819ecb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Wed, 11 Jun 2025 10:46:40 +0000 Subject: [PATCH 07/10] Add missing Provides: bundled(..) for gmp & leancrypto MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Daniel P. Berrangé --- gnutls.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/gnutls.spec b/gnutls.spec index a3583a9..058f0fe 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -133,6 +133,7 @@ Source1: https://www.gnupg.org/ftp/gcrypt/gnutls/v%{short_version}/%{name}-%{ver Source2: https://gnutls.org/gnutls-release-keyring.gpg %if %{with bundled_gmp} +Provides: bundled(gmp) = 6.2.1 Source100: gmp-6.2.1.tar.xz # Taken from the main gmp package Source101: gmp-6.2.1-intel-cet.patch @@ -144,6 +145,7 @@ Source201: gnutls-3.8.8-tests-rsa-default.patch %endif %if %{with leancrypto} +Provides: bundled(leancrypto) = 1.6.0 Source300: leancrypto-1.6.0.tar.gz %endif From 98206a06fe602662410bfd0eefb90790867a4b0d Mon Sep 17 00:00:00 2001 From: Alexander Sosedkin Date: Tue, 25 Nov 2025 10:30:02 +0100 Subject: [PATCH 08/10] Disable native assembly to work around bz2416812 --- gnutls.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/gnutls.spec b/gnutls.spec index 058f0fe..77883fc 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -328,7 +328,10 @@ meson setup -Dprefix="$PWD/install" -Dlibdir="$PWD/install/lib" \ -Dhotp=disabled -Dtotp=disabled \ -Daes_block=disabled -Daes_cbc=disabled -Daes_ctr=disabled \ -Daes_kw=disabled -Dapps=disabled \ + -Ddisable-asm=true \ _build +# the reason for -Ddisable-asm=true being bz2416812 +# revert once the root cause is fixed meson compile -C _build meson install -C _build From 33160d08cb92c310e71aecf7e80b8f083fadedad Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Sun, 23 Nov 2025 23:21:09 -0500 Subject: [PATCH 09/10] Drop RHEL10-specific patch The test was fixed to be FIPS-compliant: https://gitlab.com/gnutls/gnutls/-/merge_requests/1932 --- gnutls-3.8.8-tests-rsa-default.patch | 22 ---------------------- gnutls.spec | 8 -------- 2 files changed, 30 deletions(-) delete mode 100644 gnutls-3.8.8-tests-rsa-default.patch diff --git a/gnutls-3.8.8-tests-rsa-default.patch b/gnutls-3.8.8-tests-rsa-default.patch deleted file mode 100644 index 5b32f76..0000000 --- a/gnutls-3.8.8-tests-rsa-default.patch +++ /dev/null @@ -1,22 +0,0 @@ -As of RHEL 10, DEFAULT crypto policy rejects TLS ciphers with RSA key exchange: - -https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10-beta/html/considerations_in_adopting_rhel_10/security#security - -diff --git a/tests/system-override-allow-rsa-pkcs1-encrypt.sh b/tests/system-override-allow-rsa-pkcs1-encrypt.sh -index 714d0af..bd141f3 100755 ---- a/tests/system-override-allow-rsa-pkcs1-encrypt.sh -+++ b/tests/system-override-allow-rsa-pkcs1-encrypt.sh -@@ -60,10 +60,10 @@ unset GNUTLS_SYSTEM_PRIORITY_FILE - unset GNUTLS_SYSTEM_PRIORITY_FAIL_ON_INVALID - - ${TEST} --if [ $? != 0 ]; then -- echo "${TEST} expected to succeed by default" -+if [ $? = 0 ]; then -+ echo "${TEST} expected to fail by default" - exit 1 - fi --echo "RSAES-PKCS1-v1_5 successfully enabled by default" -+echo "RSAES-PKCS1-v1_5 correctly failed by default" - - exit 0 diff --git a/gnutls.spec b/gnutls.spec index 77883fc..c705e2d 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -140,10 +140,6 @@ Source101: gmp-6.2.1-intel-cet.patch Source102: gmp-6.2.1-c23.patch %endif -%if 0%{?rhel} >= 10 -Source201: gnutls-3.8.8-tests-rsa-default.patch -%endif - %if %{with leancrypto} Provides: bundled(leancrypto) = 1.6.0 Source300: leancrypto-1.6.0.tar.gz @@ -281,10 +277,6 @@ patch -p1 < %{SOURCE102} popd %endif -%if 0%{?rhel} >= 10 -patch -p1 < %{SOURCE201} -%endif - %build %define _lto_cflags %{nil} From cbe66ee3a7ed9f212234affb5c13bb6db66103f0 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Tue, 25 Nov 2025 09:54:16 -0500 Subject: [PATCH 10/10] Restore gmp tarball to sources --- sources | 1 + 1 file changed, 1 insertion(+) diff --git a/sources b/sources index b7486bf..c383c9e 100644 --- a/sources +++ b/sources @@ -1,4 +1,5 @@ SHA512 (gnutls-3.8.11.tar.xz) = 68f9e5bec3aa6686fd3319cc9c88a5cc44e2a75144049fc9de5fb55fef2241b4e16996af4be5dd48308abbee8cfaed6c862903f6bb89aff5dfa5410075bd7386 SHA512 (gnutls-3.8.11.tar.xz.sig) = 90883e5736299b103844ca42b85d371969ef66b50b60cb185e814ad9978598796e9ed07a590245ff28ac6ac084b1dee93fae0845576464583a5941835990957d SHA512 (gnutls-release-keyring.gpg) = 8c2b39239d1d8c5319757fcf669f28a11de7f8ec4a726f9904c57ba8105bea80240083c0de71b747115907bab46569f10cf58004137cc7884ac5c20f8319ae0a +SHA512 (gmp-6.2.1.tar.xz) = c99be0950a1d05a0297d65641dd35b75b74466f7bf03c9e8a99895a3b2f9a0856cd17887738fa51cf7499781b65c049769271cbcb77d057d2e9f1ec52e07dd84 SHA512 (leancrypto-1.6.0.tar.gz) = cb6ace4a1642208dd7656b62a48e99d6261f471aa7967b738057745a4534abfa11d380dd5de98a737c0c13b1e1cb37ce780e02297eefc1cf839581629d34e100