diff --git a/.gitignore b/.gitignore index 35f93b3..368ba7b 100644 --- a/.gitignore +++ b/.gitignore @@ -150,3 +150,18 @@ gnutls-2.10.1-nosrp.tar.bz2 /gnutls-3.8.2.tar.xz.sig /gnutls-3.8.3.tar.xz /gnutls-3.8.3.tar.xz.sig +/gnutls-3.8.4.tar.xz +/gnutls-3.8.4.tar.xz.sig +/gnutls-3.8.5.tar.xz +/gnutls-3.8.5.tar.xz.sig +/gnutls-3.8.6.tar.xz +/gnutls-3.8.6.tar.xz.sig +/gmp-6.2.1.tar.xz +/gnutls-3.8.7.tar.xz +/gnutls-3.8.7.tar.xz.sig +/gnutls-3.8.7.1.tar.xz +/gnutls-3.8.7.1.tar.xz.sig +/gnutls-3.8.8.tar.xz +/gnutls-3.8.8.tar.xz.sig +/gnutls-3.8.9.tar.xz +/gnutls-3.8.9.tar.xz.sig diff --git a/README.packit b/README.packit index 8c508a5..3dfd179 100644 --- a/README.packit +++ b/README.packit @@ -1,3 +1,3 @@ This repository is maintained by packit. https://packit.dev/ -The file was generated using packit 0.88.0. +The file was generated using packit 0.97.3. diff --git a/gnutls-3.7.8-ktls_skip_tls12_chachapoly_test.patch b/gnutls-3.7.8-ktls_skip_tls12_chachapoly_test.patch deleted file mode 100644 index c3a5ace..0000000 --- a/gnutls-3.7.8-ktls_skip_tls12_chachapoly_test.patch +++ /dev/null @@ -1,25 +0,0 @@ -From 18c555b4d2461ad202996398609552b9c4ecd43b Mon Sep 17 00:00:00 2001 -From: rpm-build -Date: Wed, 22 Nov 2023 15:21:49 +0900 -Subject: [PATCH] gnutls-3.7.8-ktls_skip_tls12_chachapoly_test.patch - -Signed-off-by: rpm-build ---- - tests/gnutls_ktls.c | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/tests/gnutls_ktls.c b/tests/gnutls_ktls.c -index ccbe566..049c888 100644 ---- a/tests/gnutls_ktls.c -+++ b/tests/gnutls_ktls.c -@@ -347,7 +347,6 @@ void doit(void) - { - run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+AES-128-GCM"); - run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+AES-256-GCM"); -- run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+CHACHA20-POLY1305"); - run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-128-GCM"); - run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-256-GCM"); - run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+CHACHA20-POLY1305"); --- -2.41.0 - diff --git a/gnutls-3.8.3-kernel_version_check.patch b/gnutls-3.8.3-kernel_version_check.patch deleted file mode 100644 index e4495ed..0000000 --- a/gnutls-3.8.3-kernel_version_check.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 945c2f10eeda441f32404d1328761e311915add0 Mon Sep 17 00:00:00 2001 -From: Daiki Ueno -Date: Tue, 23 Jan 2024 11:54:32 +0900 -Subject: [PATCH] ktls: fix kernel version checking using utsname - -Signed-off-by: Daiki Ueno ---- - lib/system/ktls.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/lib/system/ktls.c b/lib/system/ktls.c -index 8efb913cda..432c70c5a2 100644 ---- a/lib/system/ktls.c -+++ b/lib/system/ktls.c -@@ -482,7 +482,7 @@ int _gnutls_ktls_set_keys(gnutls_session_t session, - return GNUTLS_E_INTERNAL_ERROR; - } - -- if (strcmp(utsname.sysname, "Linux") == 0) { -+ if (strcmp(utsname.sysname, "Linux") != 0) { - return GNUTLS_E_INTERNAL_ERROR; - } - -@@ -495,6 +495,9 @@ int _gnutls_ktls_set_keys(gnutls_session_t session, - return GNUTLS_E_INTERNAL_ERROR; - } - -+ _gnutls_debug_log("Linux kernel version %lu.%lu has been detected\n", -+ major, minor); -+ - /* setsockopt(SOL_TLS, TLS_RX) support added in 5.10 */ - if (major < 5 || (major == 5 && minor < 10)) { - return GNUTLS_E_UNIMPLEMENTED_FEATURE; --- -GitLab - diff --git a/gnutls-3.8.8-tests-ktls-skip-tls12-chachapoly.patch b/gnutls-3.8.8-tests-ktls-skip-tls12-chachapoly.patch new file mode 100644 index 0000000..d93dd28 --- /dev/null +++ b/gnutls-3.8.8-tests-ktls-skip-tls12-chachapoly.patch @@ -0,0 +1,29 @@ +From a36b73a21e4b5b6e051b23192a645dea34c9d6af Mon Sep 17 00:00:00 2001 +From: Daiki Ueno +Date: Tue, 5 Nov 2024 14:45:46 +0900 +Subject: [PATCH] tests: skip CHACHA20-POLY1305 in TLS 1.2 when KTLS is enabled + +Signed-off-by: Daiki Ueno +--- + tests/gnutls_ktls.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tests/gnutls_ktls.c b/tests/gnutls_ktls.c +index 90d3e9af91..d5ac4efecc 100644 +--- a/tests/gnutls_ktls.c ++++ b/tests/gnutls_ktls.c +@@ -347,9 +347,11 @@ void doit(void) + { + run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+AES-128-GCM"); + run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+AES-256-GCM"); ++#if 0 + if (!gnutls_fips140_mode_enabled()) { + run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+CHACHA20-POLY1305"); + } ++#endif + run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-128-GCM"); + run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-256-GCM"); + if (!gnutls_fips140_mode_enabled()) { +-- +2.47.0 + diff --git a/gnutls.spec b/gnutls.spec index 4508067..25b74fa 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -12,13 +12,12 @@ sha256sum:close() print(string.sub(hash, 0, 16)) } -Version: 3.8.3 +Version: 3.8.9 Release: %{?autorelease}%{!?autorelease:1%{?dist}} Patch: gnutls-3.2.7-rpath.patch # follow https://gitlab.com/gnutls/gnutls/-/issues/1443 -Patch: gnutls-3.7.8-ktls_skip_tls12_chachapoly_test.patch -Patch: gnutls-3.8.3-kernel_version_check.patch +Patch: gnutls-3.8.8-tests-ktls-skip-tls12-chachapoly.patch %bcond_without bootstrap %bcond_without dane @@ -26,7 +25,7 @@ Patch: gnutls-3.8.3-kernel_version_check.patch %bcond_with tpm12 %bcond_without tpm2 %bcond_without gost -%bcond_with certificate_compression +%bcond_without certificate_compression %bcond_without tests %if 0%{?fedora} && 0%{?fedora} < 38 @@ -41,6 +40,19 @@ Patch: gnutls-3.8.3-kernel_version_check.patch %bcond_with mingw %endif +%if 0%{?rhel} >= 9 && %{with fips} +%bcond_without bundled_gmp +%else +%bcond_with bundled_gmp +%endif + + +%define fips_requires() %{lua: +local f = assert(io.popen("rpm -q --queryformat '%{EVR}' --whatprovides "..rpm.expand("'%1%{?_isa}'"))) +local v = f:read("*all") +f:close() +print("Requires: "..rpm.expand("%1%{?_isa}").." = "..v.."\\n") +} Summary: A TLS protocol implementation Name: gnutls @@ -72,6 +84,7 @@ BuildRequires: p11-kit-trust, ca-certificates Requires: crypto-policies Requires: p11-kit-trust Requires: libtasn1 >= 4.3 +# always bump when a nettle release is packaged Requires: nettle >= 3.9.1 %if %{with tpm12} Recommends: trousers >= 0.3.11.2 @@ -107,6 +120,12 @@ Source0: https://www.gnupg.org/ftp/gcrypt/gnutls/v%{short_version}/%{name}-%{ver Source1: https://www.gnupg.org/ftp/gcrypt/gnutls/v%{short_version}/%{name}-%{version}.tar.xz.sig Source2: https://gnutls.org/gnutls-release-keyring.gpg +%if %{with bundled_gmp} +Source100: gmp-6.2.1.tar.xz +# Taken from the main gmp package +Source101: gmp-6.2.1-intel-cet.patch +%endif + # Wildcard bundling exception https://fedorahosted.org/fpc/ticket/174 Provides: bundled(gnulib) = 20130424 @@ -137,6 +156,16 @@ Summary: A DANE protocol implementation for GnuTLS Requires: %{name}%{?_isa} = %{version}-%{release} %endif +%if %{with fips} +%package fips +Summary: Virtual package to install packages required to use %{name} under FIPS mode +Requires: %{name}%{?_isa} = %{version}-%{release} +%{fips_requires nettle} +%if !%{with bundled_gmp} +%{fips_requires gmp} +%endif +%endif + %description GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language @@ -180,6 +209,17 @@ This package contains library that implements the DANE protocol for verifying TLS certificates through DNSSEC. %endif +%if %{with fips} +%description fips +GnuTLS is a secure communications library implementing the SSL, TLS and DTLS +protocols and technologies around them. It provides a simple C language +application programming interface (API) to access the secure communications +protocols as well as APIs to parse and write X.509, PKCS #12, OpenPGP and +other required structures. +This package does not contain any file, but installs required packages +to use GnuTLS under FIPS mode. +%endif + %if %{with mingw} %package -n mingw32-%{name} Summary: MinGW GnuTLS TLS/SSL encryption library @@ -209,9 +249,28 @@ for MinGW. %autosetup -p1 -S git +%if %{with bundled_gmp} +mkdir -p bundled_gmp +pushd bundled_gmp +tar --strip-components=1 -xf %{SOURCE100} +patch -p1 < %{SOURCE101} +popd +%endif + %build %define _lto_cflags %{nil} +%if %{with bundled_gmp} +pushd bundled_gmp +autoreconf -ifv +%configure --disable-cxx --disable-shared --enable-fat --with-pic +%make_build +popd + +export GMP_CFLAGS="-I$PWD/bundled_gmp" +export GMP_LIBS="$PWD/bundled_gmp/.libs/libgmp.a" +%endif + %if %{with bootstrap} autoreconf -fi %endif @@ -396,7 +455,7 @@ popd %{_libdir}/.libgnutls.so.30*.hmac %endif %doc README.md AUTHORS NEWS THANKS -%license LICENSE doc/COPYING doc/COPYING.LESSER +%license COPYING COPYING.LESSERv2 %files c++ %{_libdir}/libgnutlsxx.so.* @@ -434,9 +493,13 @@ popd %{_libdir}/libgnutls-dane.so.* %endif +%if %{with fips} +%files fips +%endif + %if %{with mingw} %files -n mingw32-%{name} -%license LICENSE doc/COPYING doc/COPYING.LESSER +%license COPYING COPYING.LESSERv2 %{mingw32_bindir}/certtool.exe %{mingw32_bindir}/gnutls-cli-debug.exe %{mingw32_bindir}/gnutls-cli.exe @@ -454,7 +517,7 @@ popd %{mingw32_includedir}/gnutls/ %files -n mingw64-%{name} -%license LICENSE doc/COPYING doc/COPYING.LESSER +%license COPYING COPYING.LESSERv2 %{mingw64_bindir}/certtool.exe %{mingw64_bindir}/gnutls-cli-debug.exe %{mingw64_bindir}/gnutls-cli.exe diff --git a/sources b/sources index b87713f..347a95e 100644 --- a/sources +++ b/sources @@ -1,3 +1,4 @@ -SHA512 (gnutls-3.8.3.tar.xz) = 74eddba01ce4c2ffdca781c85db3bb52c85f1db3c09813ee2b8ceea0608f92ca3912fd9266f55deb36a8ba4d01802895ca5d5d219e7d9caec45e1a8534e45a84 -SHA512 (gnutls-3.8.3.tar.xz.sig) = 5b2ca0648ca5feeda1de933de2bbaf71fadb70e830a8f0d494d2f0380b6d0d7b79445257cc79e59bba1a7ff639ab4573da3e3e124eb80c20ac6141e29a4827ff +SHA512 (gnutls-3.8.9.tar.xz) = b3b201671bf4e75325610a0291d4cd36a669718e22b3685246b64bde97b5bd94f463ab376ed817869869714115f4ff11bdc53c32604bb04a8ff8e10daa6d1fc7 +SHA512 (gnutls-3.8.9.tar.xz.sig) = 5a47a519ef35f21b59e2122528246d6109dd95667bfe5d01713b9a7efa2931f8523bf325b8824433f3117d63e0e50d66f8c467a7ee4bd2068ae039601a28441e SHA512 (gnutls-release-keyring.gpg) = 8c2b39239d1d8c5319757fcf669f28a11de7f8ec4a726f9904c57ba8105bea80240083c0de71b747115907bab46569f10cf58004137cc7884ac5c20f8319ae0a +SHA512 (gmp-6.2.1.tar.xz) = c99be0950a1d05a0297d65641dd35b75b74466f7bf03c9e8a99895a3b2f9a0856cd17887738fa51cf7499781b65c049769271cbcb77d057d2e9f1ec52e07dd84