diff --git a/.gitignore b/.gitignore index acb937a..d250992 100644 --- a/.gitignore +++ b/.gitignore @@ -92,3 +92,13 @@ gnutls-2.10.1-nosrp.tar.bz2 /gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg /gnutls-3.6.2.tar.xz.sig /gnutls-3.6.2.tar.xz +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/gnutls-3.6.2.tar.xz.sig +/gnutls-3.6.2.tar.xz +/gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg +/gnutls-3.6.3.tar.xz.sig +/gnutls-3.6.3.tar.xz +/gnutls-3.6.4.tar.xz +/gnutls-3.6.4.tar.xz.sig +/gnutls-3.6.5.tar.xz +/gnutls-3.6.5.tar.xz.sig diff --git a/gnutls-3.6.1-disable-pss-tests.patch b/gnutls-3.6.1-disable-pss-tests.patch deleted file mode 100644 index 2f3fc42..0000000 --- a/gnutls-3.6.1-disable-pss-tests.patch +++ /dev/null @@ -1,20 +0,0 @@ -diff --git a/tests/pkcs11/tls-neg-pkcs11-key.c b/tests/pkcs11/tls-neg-pkcs11-key.c -index c85d878..614fcea 100644 ---- a/tests/pkcs11/tls-neg-pkcs11-key.c -+++ b/tests/pkcs11/tls-neg-pkcs11-key.c -@@ -261,6 +261,7 @@ static const test_st tests[] = { - .key = &server_ca3_key, - .exp_kx = GNUTLS_KX_ECDHE_RSA - }, -+#if 0 - {.name = "tls1.2: rsa-sign key with rsa-pss sigs prioritized", - .pk = GNUTLS_PK_RSA, - .prio = "NORMAL:+ECDHE-RSA:+ECDHE-ECDSA:-SIGN-ALL:+SIGN-RSA-PSS-SHA256:+SIGN-RSA-PSS-SHA384:+SIGN-RSA-PSS-SHA512:+SIGN-RSA-SHA256:+SIGN-RSA-SHA384:+SIGN-RSA-SHA512:-VERS-TLS-ALL:+VERS-TLS1.2", -@@ -292,6 +293,7 @@ static const test_st tests[] = { - .exp_kx = GNUTLS_KX_ECDHE_RSA, - .exp_serv_err = GNUTLS_E_NO_CIPHER_SUITES - }, -+#endif - {.name = "tls1.2: ed25519 cert, ed25519 key", /* we cannot import that key */ - .pk = GNUTLS_PK_EDDSA_ED25519, - .prio = "NORMAL:+ECDHE-RSA:+ECDHE-ECDSA", diff --git a/gnutls-3.6.4-disable-tls13.patch b/gnutls-3.6.4-disable-tls13.patch new file mode 100644 index 0000000..a78f3a0 --- /dev/null +++ b/gnutls-3.6.4-disable-tls13.patch @@ -0,0 +1,118 @@ +diff --git a/lib/priority.c b/lib/priority.c +index 53c0d552d..6a4ccc2f4 100644 +--- a/lib/priority.c ++++ b/lib/priority.c +@@ -179,7 +179,9 @@ static const int _supported_groups_secure192[] = { + static const int* supported_groups_secure192 = _supported_groups_secure192; + + static const int protocol_priority[] = { ++#ifdef ENABLE_TLS13 + GNUTLS_TLS1_3, ++#endif + GNUTLS_TLS1_2, + GNUTLS_TLS1_1, + GNUTLS_TLS1_0, +diff --git a/tests/mini-x509.c b/tests/mini-x509.c +index 52c650aa7..9b6bbcc00 100644 +--- a/tests/mini-x509.c ++++ b/tests/mini-x509.c +@@ -258,5 +258,9 @@ void doit(void) + { + start("NORMAL:-VERS-ALL:+VERS-TLS1.2", 0); + start("NORMAL:-VERS-ALL:+VERS-TLS1.3", 0); ++#ifndef ENABLE_TLS13 ++ start("NORMAL", 0); ++#else + start("NORMAL", 1); ++#endif + } +diff --git a/tests/priorities.c b/tests/priorities.c +index 6daef59ab..c5d44ea33 100644 +--- a/tests/priorities.c ++++ b/tests/priorities.c +@@ -114,19 +114,27 @@ try_prio_err(const char *prio, int err) + void doit(void) + { + const int null = 3; ++#ifdef ENABLE_TLS13 + int sec128_cs = 29; + int sec256_cs = 12; + int normal_cs = 29; + int pfs_cs = 23; + int null_normal_cs = 28; /* disables TLS1.3 CS */ ++#else ++ int sec128_cs = 25; ++ int sec256_cs = 10; ++ int pfs_cs = 19; ++ int normal_cs = 25; ++ int null_normal_cs = normal_cs + null; ++#endif + int normal_ciphers = 7; + + if (gnutls_fips140_mode_enabled()) { +- normal_cs = 25; ++ normal_cs = 22; + normal_ciphers = 6; +- pfs_cs = 25; +- sec256_cs = 8; +- sec128_cs = 25; ++ pfs_cs = 22; ++ sec256_cs = 7; ++ sec128_cs = 22; + } + + try_prio("NORMAL", normal_cs, normal_ciphers, __LINE__); +diff --git a/tests/psk-file.c b/tests/psk-file.c +index 2512086e0..28d45560b 100644 +--- a/tests/psk-file.c ++++ b/tests/psk-file.c +@@ -377,8 +377,13 @@ void doit(void) + + run_test_ok("NORMAL:-VERS-ALL:+VERS-TLS1.2:-KX-ALL:+PSK", "jas", &key, 1, 0); + run_test_ok("NORMAL:-KX-ALL:+PSK", "jas", &key, 0, 0); ++#ifdef ENABLE_TLS13 + run_test2("NORMAL:+PSK", NULL, "unknown", &key, 1, 0, GNUTLS_E_FATAL_ALERT_RECEIVED, GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER); + run_test2("NORMAL:+PSK", NULL, "jas", &wrong_key, 1, 0, GNUTLS_E_FATAL_ALERT_RECEIVED, GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER); ++#else ++ run_test2("NORMAL:+PSK", NULL, "unknown", &key, 1, 0, GNUTLS_E_FATAL_ALERT_RECEIVED, GNUTLS_E_DECRYPTION_FAILED); ++ run_test2("NORMAL:+PSK", NULL, "jas", &wrong_key, 1, 0, GNUTLS_E_FATAL_ALERT_RECEIVED, GNUTLS_E_DECRYPTION_FAILED); ++#endif + run_test2("NORMAL:-KX-ALL:+PSK", NULL, "non-hex", &key, 1, 0, GNUTLS_E_FATAL_ALERT_RECEIVED, GNUTLS_E_KEYFILE_ERROR); + + run_dhtest_ok("NORMAL:-VERS-ALL:+VERS-TLS1.3:+DHE-PSK:-GROUP-EC-ALL", "jas", &key, 0, 0); +diff --git a/tests/pskself.c b/tests/pskself.c +index f3cc88217..65aceb252 100644 +--- a/tests/pskself.c ++++ b/tests/pskself.c +@@ -326,9 +326,15 @@ void doit(void) + /* the following should work once we support PSK without DH */ + run_test("NORMAL:-VERS-ALL:+VERS-TLS1.3:-GROUP-ALL:+PSK", 0); + ++#ifdef ENABLE_TLS13 + run_test("NORMAL:-KX-ALL:+PSK", 0); + run_test("NORMAL:-KX-ALL:+ECDHE-PSK", 0); + run_test("NORMAL:-KX-ALL:+DHE-PSK", 0); ++#else ++ run_test("NORMAL:-KX-ALL:+PSK", 1); ++ run_test("NORMAL:-KX-ALL:+ECDHE-PSK", 1); ++ run_test("NORMAL:-KX-ALL:+DHE-PSK", 1); ++#endif + + gnutls_dh_params_deinit(dh_params); + } +diff --git a/tests/session-tickets-missing.c b/tests/session-tickets-missing.c +index 35c9045b4..69f16cf64 100644 +--- a/tests/session-tickets-missing.c ++++ b/tests/session-tickets-missing.c +@@ -316,7 +316,11 @@ void doit(void) + start("NORMAL:-VERS-ALL:+VERS-TLS1.3", GNUTLS_NO_TICKETS); + /* ...or there is no overlap between PSK key exchange modes */ + start2("NORMAL:-VERS-ALL:+VERS-TLS1.3:+PSK:-DHE-PSK", "NORMAL:-VERS-ALL:+VERS-TLS1.3", 0, 0); ++#ifdef ENABLE_TLS13 + start("NORMAL", GNUTLS_NO_TICKETS); ++#else ++ start("NORMAL", 0); ++#endif + } + + #endif /* _WIN32 */ diff --git a/gnutls-3.4.2-no-now-guile.patch b/gnutls-3.6.4-no-now-guile.patch similarity index 57% rename from gnutls-3.4.2-no-now-guile.patch rename to gnutls-3.6.4-no-now-guile.patch index 35c7699..d4edff0 100644 --- a/gnutls-3.4.2-no-now-guile.patch +++ b/gnutls-3.6.4-no-now-guile.patch @@ -1,7 +1,8 @@ -diff -up gnutls-3.4.2/guile/src/Makefile.in.jx gnutls-3.4.2/guile/src/Makefile.in ---- gnutls-3.4.2/guile/src/Makefile.in.jx 2015-06-16 12:23:31.000000000 -0400 -+++ gnutls-3.4.2/guile/src/Makefile.in 2015-07-02 14:01:19.415060204 -0400 -@@ -1316,7 +1316,7 @@ guileextension_LTLIBRARIES = guile-gnutl +diff --git a/guile/src/Makefile.in b/guile/src/Makefile.in +index 3e4f547..6ffec0e 100644 +--- a/guile/src/Makefile.in ++++ b/guile/src/Makefile.in +@@ -1430,7 +1430,7 @@ guileextension_LTLIBRARIES = guile-gnutls-v-2.la # Use '-module' to build a "dlopenable module", in Libtool terms. # Use '-undefined' to placate Libtool on Windows; see # . diff --git a/gnutls-3.6.5-disable-tls13-tests.patch b/gnutls-3.6.5-disable-tls13-tests.patch new file mode 100644 index 0000000..a77fe13 --- /dev/null +++ b/gnutls-3.6.5-disable-tls13-tests.patch @@ -0,0 +1,51 @@ +--- a/tests/tls-neg-ext4-key.c 2018-11-20 20:10:57.000000000 +0100 ++++ b/tests/tls-neg-ext4-key.c 2019-01-02 10:42:55.628102624 +0100 +@@ -419,6 +419,7 @@ + .cert = &server_ca3_localhost_cert, + .key = &server_ca3_key, + .exp_kx = GNUTLS_KX_RSA ++#ifdef ENABLE_TLS13 + }, + {.name = "tls1.3 ecc key", + .pk = GNUTLS_PK_ECDSA, +@@ -459,6 +460,7 @@ + .key = &server_ca3_eddsa_key, + .sig = GNUTLS_SIGN_EDDSA_ED25519, + .exp_kx = GNUTLS_KX_ECDHE_RSA, ++#endif + } + }; + +--- a/tests/post-client-hello-change-prio.c 2018-11-18 19:53:49.000000000 +0100 ++++ b/tests/post-client-hello-change-prio.c 2019-01-02 10:38:47.643311094 +0100 +@@ -125,8 +125,12 @@ + { + override_prio = "NORMAL"; + start("tls1.2-only", "NORMAL:-VERS-ALL:+VERS-TLS1.2", GNUTLS_TLS1_2); ++#ifdef ENABLE_TLS13 + start("tls1.3-only", "NORMAL:-VERS-ALL:+VERS-TLS1.3", GNUTLS_TLS1_3); + start("default", "NORMAL", GNUTLS_TLS1_3); ++#else ++ start("default", "NORMAL", GNUTLS_TLS1_2); ++#endif + override_prio = "NORMAL:-VERS-ALL:+VERS-TLS1.2"; + start("default overriden to TLS1.2-only", "NORMAL", GNUTLS_TLS1_2); + } +--- a/tests/pkcs11/tls-neg-pkcs11-key.c 2018-12-01 06:21:11.000000000 +0100 ++++ b/tests/pkcs11/tls-neg-pkcs11-key.c 2019-01-02 10:54:33.378087822 +0100 +@@ -332,6 +332,7 @@ + .cert = &server_ca3_eddsa_cert, + .key = &server_ca3_eddsa_key, + .exp_kx = GNUTLS_KX_ECDHE_RSA, ++#ifdef ENABLE_TLS13 + }, + {.name = "tls1.3: ecc key", + .pk = GNUTLS_PK_ECDSA, +@@ -385,6 +386,7 @@ + .cert = &server_ca3_eddsa_cert, + .key = &server_ca3_eddsa_key, + .exp_kx = GNUTLS_KX_ECDHE_RSA ++#endif + } + }; + diff --git a/gnutls-3.6.5-fix-cve-2019-3829.patch b/gnutls-3.6.5-fix-cve-2019-3829.patch new file mode 100644 index 0000000..11c09b2 --- /dev/null +++ b/gnutls-3.6.5-fix-cve-2019-3829.patch @@ -0,0 +1,11 @@ +--- a/lib/x509/common.c 2019-03-20 17:02:12.587726308 +0100 ++++ b/lib/x509/common.c 2019-03-20 17:03:14.832169994 +0100 +@@ -1366,6 +1366,8 @@ + + cleanup: + gnutls_free(signature->data); ++ signature->data = NULL; ++ signature->size = 0; + return result; + } + diff --git a/gnutls-3.6.5-fix-cve-2019-3836.patch b/gnutls-3.6.5-fix-cve-2019-3836.patch new file mode 100644 index 0000000..4731e28 --- /dev/null +++ b/gnutls-3.6.5-fix-cve-2019-3836.patch @@ -0,0 +1,29 @@ +From 96e07075e8f105b13e76b11e493d5aa2dd937226 Mon Sep 17 00:00:00 2001 +From: Daiki Ueno +Date: Mon, 25 Mar 2019 16:06:39 +0100 +Subject: [PATCH] handshake: add missing initialization of local variable + +Resolves: #704 + +Signed-off-by: Daiki Ueno +Signed-off-by: Nikos Mavrogiannopoulos +--- + lib/handshake-tls13.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/lib/handshake-tls13.c b/lib/handshake-tls13.c +index 33ed3afa3..60f8030eb 100644 +--- a/lib/handshake-tls13.c ++++ b/lib/handshake-tls13.c +@@ -605,6 +605,8 @@ _gnutls13_recv_async_handshake(gnutls_session_t session) + return gnutls_assert_val(GNUTLS_E_UNEXPECTED_PACKET); + + do { ++ _gnutls_handshake_buffer_init(&hsk); ++ + /* the received handshake message has already been pushed into + * handshake buffers. As we do not need to use the handshake hash + * buffers we call the lower level receive functions */ +-- +2.20.1 + diff --git a/gnutls.spec b/gnutls.spec index f8dbac5..f6ffefb 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -1,11 +1,21 @@ # This spec file has been automatically updated -Version: 3.6.2 -Release: 1%{?dist} +Version: 3.6.5 +Release: 3%{?dist} Patch1: gnutls-3.2.7-rpath.patch -Patch2: gnutls-3.4.2-no-now-guile.patch -Patch3: gnutls-3.6.1-disable-pss-tests.patch +Patch2: gnutls-3.6.4-no-now-guile.patch +Patch3: gnutls-3.6.4-disable-tls13.patch +Patch4: gnutls-3.6.5-disable-tls13-tests.patch +Patch5: gnutls-3.6.5-fix-cve-2019-3829.patch +Patch6: gnutls-3.6.5-fix-cve-2019-3836.patch %bcond_without dane +%if 0%{?rhel} +%bcond_with guile +%bcond_without fips +%else %bcond_without guile +%bcond_without fips +%endif + Summary: A TLS protocol implementation Name: gnutls # The libraries are LGPLv2.1+, utilities are GPLv3+ @@ -15,16 +25,22 @@ BuildRequires: p11-kit-devel >= 0.21.3, gettext-devel BuildRequires: zlib-devel, readline-devel, libtasn1-devel >= 4.3 BuildRequires: libtool, automake, autoconf, texinfo BuildRequires: autogen-libopts-devel >= 5.18 autogen -BuildRequires: nettle-devel >= 3.1.1 +BuildRequires: nettle-devel >= 3.4.1 BuildRequires: trousers-devel >= 0.3.11.2 BuildRequires: libidn2-devel BuildRequires: libunistring-devel BuildRequires: gperf, net-tools, datefudge, softhsm +BuildRequires: gnupg2 +%if %{with fips} +BuildRequires: fipscheck +%endif + # for a sanity check on cert loading BuildRequires: p11-kit-trust, ca-certificates Requires: crypto-policies Requires: p11-kit-trust Requires: libtasn1 >= 4.3 +Requires: nettle >= 3.4.1 Recommends: trousers >= 0.3.11.2 %if %{with dane} @@ -34,8 +50,8 @@ BuildRequires: unbound-devel unbound-libs BuildRequires: guile-devel %endif URL: http://www.gnutls.org/ -Source0: ftp://ftp.gnutls.org/gcrypt/gnutls/%{name}-%{version}.tar.xz -Source1: ftp://ftp.gnutls.org/gcrypt/gnutls/%{name}-%{version}.tar.xz.sig +Source0: ftp://ftp.gnutls.org/gcrypt/gnutls/v3.6/%{name}-%{version}.tar.xz +Source1: ftp://ftp.gnutls.org/gcrypt/gnutls/v3.6/%{name}-%{version}.tar.xz.sig Source2: gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg # Wildcard bundling exception https://fedorahosted.org/fpc/ticket/174 @@ -136,10 +152,7 @@ This package contains Guile bindings for the library. %prep gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0} -%setup -q -%patch1 -p1 -%patch2 -p1 -%patch3 -p1 +%autosetup -p1 sed -i -e 's|sys_lib_dlsearch_path_spec="/lib /usr/lib|sys_lib_dlsearch_path_spec="/lib /usr/lib %{_libdir}|g' configure rm -f lib/minitasn1/*.c lib/minitasn1/*.h @@ -147,8 +160,15 @@ rm -f src/libopts/*.c src/libopts/*.h src/libopts/compat/*.c src/libopts/compat/ echo "SYSTEM=NORMAL" >> tests/system.prio +# Note that we explicitly enable SHA1, as SHA1 deprecation is handled +# via the crypto policies + %build %configure --with-libtasn1-prefix=%{_prefix} \ +%if %{with fips} + --enable-fips140-mode \ +%endif + --enable-sha1-support \ --disable-static \ --disable-openssl-compatibility \ --disable-non-suiteb-curves \ @@ -172,6 +192,16 @@ echo "SYSTEM=NORMAL" >> tests/system.prio make %{?_smp_mflags} V=1 +%if %{with fips} +%define __spec_install_post \ + %{?__debug_package:%{__debug_install_post}} \ + %{__arch_install_post} \ + %{__os_install_post} \ + fipshmac -d $RPM_BUILD_ROOT%{_libdir} $RPM_BUILD_ROOT%{_libdir}/libgnutls.so.30.*.* \ + file=`basename $RPM_BUILD_ROOT%{_libdir}/libgnutls.so.30.*.hmac` && mv $RPM_BUILD_ROOT%{_libdir}/$file $RPM_BUILD_ROOT%{_libdir}/.$file && ln -s .$file $RPM_BUILD_ROOT%{_libdir}/.libgnutls.so.30.hmac \ +%{nil} +%endif + %install make install DESTDIR=$RPM_BUILD_ROOT make -C doc install-html DESTDIR=$RPM_BUILD_ROOT @@ -189,14 +219,6 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/pkgconfig/gnutls-dane.pc %check make check %{?_smp_mflags} -%post -p /sbin/ldconfig - -%postun -p /sbin/ldconfig - -%post c++ -p /sbin/ldconfig - -%postun c++ -p /sbin/ldconfig - %post devel if [ -f %{_infodir}/gnutls.info.gz ]; then /sbin/install-info %{_infodir}/gnutls.info.gz %{_infodir}/dir || : @@ -207,21 +229,12 @@ if [ $1 = 0 -a -f %{_infodir}/gnutls.info.gz ]; then /sbin/install-info --delete %{_infodir}/gnutls.info.gz %{_infodir}/dir || : fi -%if %{with dane} -%post dane -p /sbin/ldconfig - -%postun dane -p /sbin/ldconfig -%endif - -%if %{with guile} -%post guile -p /sbin/ldconfig - -%postun guile -p /sbin/ldconfig -%endif - %files -f gnutls.lang %defattr(-,root,root,-) %{_libdir}/libgnutls.so.30* +%if %{with fips} +%{_libdir}/.libgnutls.so.30*.hmac +%endif %doc README.md AUTHORS NEWS THANKS %license LICENSE doc/COPYING doc/COPYING.LESSER @@ -232,6 +245,10 @@ fi %defattr(-,root,root,-) %{_includedir}/* %{_libdir}/libgnutls*.so +%if %{with fips} +%{_libdir}/.libgnutls.so.*.hmac +%endif + %{_libdir}/pkgconfig/*.pc %{_mandir}/man3/* %{_infodir}/gnutls* @@ -270,6 +287,47 @@ fi %endif %changelog +* Wed Mar 27 2019 Anderson Sasaki - 3.6.5-3 +- Fixed CVE-2019-3829 (#1693210) +- Fixed CVE-2019-3836 (#1693214) + +* Fri Jan 11 2019 Anderson Sasaki - 3.6.5-2 +- Add explicit Requires for nettle >= 3.4.1 + +* Wed Jan 02 2019 Anderson Sasaki - 3.6.5-1 +- Updated to upstream 3.6.5 release +- Fixed CVE-2018-16868 (#1659095) + +* Tue Sep 25 2018 Nikos Mavrogiannopoulos - 3.6.4-1 +- Updated to upstream 3.6.4 release +- Added support for the latest version of the TLS1.3 protocol +- The TLS1.3 protocol remains disabled by default +- Enabled SHA1 support as SHA1 deprecation is handled via the + fedora crypto policies. + +* Thu Aug 16 2018 Nikos Mavrogiannopoulos - 3.6.3-4 +- Fixed gnutls-cli input reading +- Ensure that we do not cause issues with version rollback detection + and TLS1.3. + +* Tue Aug 07 2018 Nikos Mavrogiannopoulos - 3.6.3-3 +- Fixed ECDSA public key import (#1612803) + +* Thu Jul 26 2018 Nikos Mavrogiannopoulos - 3.6.3-2 +- Backported regression fixes from 3.6.2 + +* Mon Jul 16 2018 Nikos Mavrogiannopoulos - 3.6.3-1 +- Update to upstream 3.6.3 release + +* Wed Jun 13 2018 Nikos Mavrogiannopoulos - 3.6.2-4 +- Enable FIPS140-2 mode in Fedora + +* Wed Jun 06 2018 Nikos Mavrogiannopoulos - 3.6.2-3 +- Update to upstream 3.6.2 release + +* Fri May 25 2018 David Abdurachmanov - 3.6.2-2 +- Add missing BuildRequires: gnupg2 for gpgv2 in %%prep + * Fri Feb 16 2018 Nikos Mavrogiannopoulos - 3.6.2-1 - Update to upstream 3.6.2 release diff --git a/sources b/sources index 622c52d..39a34fa 100644 --- a/sources +++ b/sources @@ -1,3 +1,2 @@ -SHA512 (gpgkey-1F42418905D8206AA754CCDC29EE58B996865171.gpg) = 3b1989dc6a64d1140f83a2af0773da2adb03c50d97b6da7357cf09525050651aafa21131f1e3180baa540a8af922119a256f5ff5bcd6602996a806e8e1816bad -SHA512 (gnutls-3.6.2.tar.xz.sig) = a1fc8acd0b48d046eda505b774e5e1a85dce8c8b2122069e6d257a50436e989cfdbc68aa294d14f98e3fec1ade129e8bd9b67b1d02f93a7a3fde5f5acb4b70d3 -SHA512 (gnutls-3.6.2.tar.xz) = 6a574d355226bdff6198ab3f70633ff2a3cff4b5d06793bdaf19d007063bd4dd515d1bd3f331a9eb1a9ad01f83007801cfa55e5fd16c1cd3461ac33d1813fb06 +SHA512 (gnutls-3.6.5.tar.xz) = 127f053ce45c63cd745fa5a654a2d8e4fbc322f5e17dcc3740fb2e7b376dd18dad59318d66e6e93e37d6a179fca4b35cf2ae62d13be5645cd2d06badd79d4dce +SHA512 (gnutls-3.6.5.tar.xz.sig) = 91c51442dd661bf827e7547ab88c61fb4c6683d9f90f3df7e6bab3f1b7218b69126702cfbe12d26647b477bda0746e2cfd6e5a3c10899860a42314a8a8ac15d5