diff --git a/.gitignore b/.gitignore index 690d3fe..8a210dd 100644 --- a/.gitignore +++ b/.gitignore @@ -144,3 +144,16 @@ gnutls-2.10.1-nosrp.tar.bz2 /gnutls-3.8.0.tar.xz /gnutls-3.8.0.tar.xz.sig /gnutls-release-keyring.gpg +/gnutls-3.8.1.tar.xz +/gnutls-3.8.1.tar.xz.sig +/gnutls-3.8.2.tar.xz +/gnutls-3.8.2.tar.xz.sig +/gnutls-3.8.3.tar.xz +/gnutls-3.8.3.tar.xz.sig +/gnutls-3.8.4.tar.xz +/gnutls-3.8.4.tar.xz.sig +/gnutls-3.8.5.tar.xz +/gnutls-3.8.5.tar.xz.sig +/gnutls-3.8.6.tar.xz +/gnutls-3.8.6.tar.xz.sig +/gmp-6.2.1.tar.xz diff --git a/README.packit b/README.packit index c83811d..3dfd179 100644 --- a/README.packit +++ b/README.packit @@ -1,3 +1,3 @@ This repository is maintained by packit. https://packit.dev/ -The file was generated using packit 0.67.0. +The file was generated using packit 0.97.3. diff --git a/gnutls-3.7.8-ktls_disable_keyupdate_test.patch b/gnutls-3.7.8-ktls_disable_keyupdate_test.patch deleted file mode 100644 index cab7547..0000000 --- a/gnutls-3.7.8-ktls_disable_keyupdate_test.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/tests/Makefile.am b/tests/Makefile.am -index 2872cb1aa..247dfd3d8 100644 ---- a/tests/Makefile.am -+++ b/tests/Makefile.am -@@ -504,8 +504,6 @@ endif - if ENABLE_KTLS - indirect_tests += gnutls_ktls - dist_check_SCRIPTS += ktls.sh --indirect_tests += ktls_keyupdate --dist_check_SCRIPTS += ktls_keyupdate.sh - endif - - if !WINDOWS diff --git a/gnutls-3.7.8-ktls_skip_tls12_chachapoly_test.patch b/gnutls-3.7.8-ktls_skip_tls12_chachapoly_test.patch index d986a36..c3a5ace 100644 --- a/gnutls-3.7.8-ktls_skip_tls12_chachapoly_test.patch +++ b/gnutls-3.7.8-ktls_skip_tls12_chachapoly_test.patch @@ -1,12 +1,25 @@ +From 18c555b4d2461ad202996398609552b9c4ecd43b Mon Sep 17 00:00:00 2001 +From: rpm-build +Date: Wed, 22 Nov 2023 15:21:49 +0900 +Subject: [PATCH] gnutls-3.7.8-ktls_skip_tls12_chachapoly_test.patch + +Signed-off-by: rpm-build +--- + tests/gnutls_ktls.c | 1 - + 1 file changed, 1 deletion(-) + diff --git a/tests/gnutls_ktls.c b/tests/gnutls_ktls.c -index 919270778..778a2f94a 100644 +index ccbe566..049c888 100644 --- a/tests/gnutls_ktls.c +++ b/tests/gnutls_ktls.c -@@ -351,7 +351,6 @@ void doit(void) +@@ -347,7 +347,6 @@ void doit(void) + { run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+AES-128-GCM"); run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+AES-256-GCM"); - run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+AES-128-CCM"); - run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+CHACHA20-POLY1305"); run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-128-GCM"); run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-256-GCM"); - run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-128-CCM"); + run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+CHACHA20-POLY1305"); +-- +2.41.0 + diff --git a/gnutls-3.8.0-ktls-Do-not-return-GNUTLS_E_INTERRUPTED-AGAIN-from-s.patch b/gnutls-3.8.0-ktls-Do-not-return-GNUTLS_E_INTERRUPTED-AGAIN-from-s.patch deleted file mode 100644 index 0390da3..0000000 --- a/gnutls-3.8.0-ktls-Do-not-return-GNUTLS_E_INTERRUPTED-AGAIN-from-s.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 21c386860f1973344872eec4e4dd68644b1b48aa Mon Sep 17 00:00:00 2001 -From: "Richard W.M. Jones" -Date: Fri, 10 Mar 2023 11:15:19 +0000 -Subject: [PATCH] ktls: Do not return GNUTLS_E_INTERRUPTED/AGAIN from short - writes - -If sendmsg returns a short write, we end up going around the loop with -data_to_send being smaller. However if sendmsg then returns -EAGAIN -or -EINTR then we return an error. But we have "forgotten" that we -already sent some data. - -This causes the caller to retry gnutls_record_send with the full -buffer (ie. with a buffer that has already been partially sent), -causing desynchronization. - -Instead check if we sent some data in this case and return the number -of bytes sent. - -Fixes: https://gitlab.com/gnutls/gnutls/-/issues/1470 -Thanks: Dan Berrange for suggesting a fix -Signed-off-by: Richard W.M. Jones ---- - lib/system/ktls.c | 12 ++++++++++-- - 1 file changed, 10 insertions(+), 2 deletions(-) - -diff --git a/lib/system/ktls.c b/lib/system/ktls.c -index fd57a9c30..bb59fab7c 100644 ---- a/lib/system/ktls.c -+++ b/lib/system/ktls.c -@@ -604,9 +604,17 @@ int _gnutls_ktls_send_control_msg(gnutls_session_t session, - if (ret == -1) { - switch (errno) { - case EINTR: -- return GNUTLS_E_INTERRUPTED; -+ if (data_to_send < data_size) { -+ return data_size - data_to_send; -+ } else { -+ return GNUTLS_E_INTERRUPTED; -+ } - case EAGAIN: -- return GNUTLS_E_AGAIN; -+ if (data_to_send < data_size) { -+ return data_size - data_to_send; -+ } else { -+ return GNUTLS_E_AGAIN; -+ } - default: - return GNUTLS_E_PUSH_ERROR; - } --- -2.39.2 - diff --git a/gnutls.spec b/gnutls.spec index eea2019..5442854 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -12,30 +12,23 @@ sha256sum:close() print(string.sub(hash, 0, 16)) } -Version: 3.8.0 +Version: 3.8.6 Release: %{?autorelease}%{!?autorelease:1%{?dist}} Patch: gnutls-3.2.7-rpath.patch -# Delete only after the kernel has been patched for thested systems -Patch: gnutls-3.7.8-ktls_disable_keyupdate_test.patch - # follow https://gitlab.com/gnutls/gnutls/-/issues/1443 Patch: gnutls-3.7.8-ktls_skip_tls12_chachapoly_test.patch -# Fix desychronisation with kTLS: -# https://gitlab.com/gnutls/gnutls/-/issues/1470 -Patch: gnutls-3.8.0-ktls-Do-not-return-GNUTLS_E_INTERRUPTED-AGAIN-from-s.patch - %bcond_without bootstrap %bcond_without dane %bcond_without fips %bcond_with tpm12 %bcond_without tpm2 %bcond_without gost -%bcond_with certificate_compression +%bcond_without certificate_compression %bcond_without tests -%if 0%{?fedora} < 38 +%if 0%{?fedora} && 0%{?fedora} < 38 %bcond_without srp %else %bcond_with srp @@ -47,11 +40,24 @@ Patch: gnutls-3.8.0-ktls-Do-not-return-GNUTLS_E_INTERRUPTED-AGAIN-from-s.patch %bcond_with mingw %endif +%if 0%{?rhel} >= 9 && %{with fips} +%bcond_without bundled_gmp +%else +%bcond_with bundled_gmp +%endif + + +%define fips_requires() %{lua: +local f = assert(io.popen("rpm -q --queryformat '%{EVR}' --whatprovides "..rpm.expand("'%1%{?_isa}'"))) +local v = f:read("*all") +f:close() +print("Requires: "..rpm.expand("%1%{?_isa}").." = "..v.."\\n") +} Summary: A TLS protocol implementation Name: gnutls # The libraries are LGPLv2.1+, utilities are GPLv3+ -License: GPLv3+ and LGPLv2+ +License: GPL-3.0-or-later AND LGPL-2.1-or-later BuildRequires: p11-kit-devel >= 0.21.3, gettext-devel BuildRequires: readline-devel, libtasn1-devel >= 4.3 %if %{with certificate_compression} @@ -60,7 +66,7 @@ BuildRequires: zlib-devel, brotli-devel, libzstd-devel %if %{with bootstrap} BuildRequires: automake, autoconf, gperf, libtool, texinfo %endif -BuildRequires: nettle-devel >= 3.5.1 +BuildRequires: nettle-devel >= 3.9.1 %if %{with tpm12} BuildRequires: trousers-devel >= 0.3.11.2 %endif @@ -69,7 +75,7 @@ BuildRequires: tpm2-tss-devel >= 3.0.3 %endif BuildRequires: libidn2-devel BuildRequires: libunistring-devel -BuildRequires: net-tools, datefudge, softhsm, gcc, gcc-c++ +BuildRequires: net-tools, softhsm, gcc, gcc-c++ BuildRequires: gnupg2 BuildRequires: git-core @@ -78,7 +84,8 @@ BuildRequires: p11-kit-trust, ca-certificates Requires: crypto-policies Requires: p11-kit-trust Requires: libtasn1 >= 4.3 -Requires: nettle >= 3.4.1 +# always bump when a nettle release is packaged +Requires: nettle >= 3.9.1 %if %{with tpm12} Recommends: trousers >= 0.3.11.2 %endif @@ -113,6 +120,12 @@ Source0: https://www.gnupg.org/ftp/gcrypt/gnutls/v%{short_version}/%{name}-%{ver Source1: https://www.gnupg.org/ftp/gcrypt/gnutls/v%{short_version}/%{name}-%{version}.tar.xz.sig Source2: https://gnutls.org/gnutls-release-keyring.gpg +%if %{with bundled_gmp} +Source100: gmp-6.2.1.tar.xz +# Taken from the main gmp package +Source101: gmp-6.2.1-intel-cet.patch +%endif + # Wildcard bundling exception https://fedorahosted.org/fpc/ticket/174 Provides: bundled(gnulib) = 20130424 @@ -130,7 +143,7 @@ Requires: %{name}-dane%{?_isa} = %{version}-%{release} Requires: pkgconfig %package utils -License: GPLv3+ +License: GPL-3.0-or-later Summary: Command line tools for TLS protocol Requires: %{name}%{?_isa} = %{version}-%{release} %if %{with dane} @@ -143,6 +156,16 @@ Summary: A DANE protocol implementation for GnuTLS Requires: %{name}%{?_isa} = %{version}-%{release} %endif +%if %{with fips} +%package fips +Summary: Virtual package to install packages required to use %{name} under FIPS mode +Requires: %{name}%{?_isa} = %{version}-%{release} +%{fips_requires nettle} +%if !%{with bundled_gmp} +%{fips_requires gmp} +%endif +%endif + %description GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language @@ -186,6 +209,17 @@ This package contains library that implements the DANE protocol for verifying TLS certificates through DNSSEC. %endif +%if %{with fips} +%description fips +GnuTLS is a secure communications library implementing the SSL, TLS and DTLS +protocols and technologies around them. It provides a simple C language +application programming interface (API) to access the secure communications +protocols as well as APIs to parse and write X.509, PKCS #12, OpenPGP and +other required structures. +This package does not contain any file, but installs required packages +to use GnuTLS under FIPS mode. +%endif + %if %{with mingw} %package -n mingw32-%{name} Summary: MinGW GnuTLS TLS/SSL encryption library @@ -215,9 +249,28 @@ for MinGW. %autosetup -p1 -S git +%if %{with bundled_gmp} +mkdir -p bundled_gmp +pushd bundled_gmp +tar --strip-components=1 -xf %{SOURCE100} +patch -p1 < %{SOURCE101} +popd +%endif + %build %define _lto_cflags %{nil} +%if %{with bundled_gmp} +pushd bundled_gmp +autoreconf -ifv +%configure --disable-cxx --disable-shared --enable-fat --with-pic +%make_build +popd + +export GMP_CFLAGS="-I$PWD/bundled_gmp" +export GMP_LIBS="$PWD/bundled_gmp/.libs/libgmp.a" +%endif + %if %{with bootstrap} autoreconf -fi %endif @@ -377,7 +430,22 @@ rm -f $RPM_BUILD_ROOT%{mingw64_libdir}/ncrypt.dll* %check %if %{with tests} pushd native_build -make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null + +# KeyUpdate is not yet supported in the kernel. +xfail_tests=ktls_keyupdate.sh + +# The ktls.sh test currently only supports kernel 5.11+. This needs to +# be checked at run time, as the koji builder might be using a different +# version of kernel on the host than the one indicated by the +# kernel-devel package. + +case "$(uname -r)" in + 4.* | 5.[0-9].* | 5.10.* ) + xfail_tests="$xfail_tests ktls.sh" + ;; +esac + +make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null XFAIL_TESTS="$xfail_tests" popd %endif @@ -425,6 +493,10 @@ popd %{_libdir}/libgnutls-dane.so.* %endif +%if %{with fips} +%files fips +%endif + %if %{with mingw} %files -n mingw32-%{name} %license LICENSE doc/COPYING doc/COPYING.LESSER diff --git a/sources b/sources index f6b15ed..cdafbdf 100644 --- a/sources +++ b/sources @@ -1,3 +1,4 @@ -SHA512 (gnutls-3.8.0.tar.xz) = 2507b3133423fdaf90fbd826ccb1142e9ff6fc90fcd5531720218f19ddf0e6bbb8267d23bad35c0954860e5a4179da74823e0c8357db56a14f252e6ec9d59629 -SHA512 (gnutls-3.8.0.tar.xz.sig) = 9db8db74aa0ebd871287b07b6a8a9f4ce90188633618e669fe07cb8bb314b624c14761f6fe1970e2fbffa87f7c0d6daa4b0fa838bd05f74b8b18cd1b5325c654 -SHA512 (gnutls-release-keyring.gpg) = 5c14d83f4f37bd319c652db0d76fc5bb04752fb461bbe853e25b20ffe41d6d14faae6c0bdd0193ac6242975bf1205ce606a9d0082261cc4581fd680abfcdbd4d +SHA512 (gnutls-3.8.6.tar.xz) = 58631c456dfb43f8cb6a1703ffa91c593a33357f37dc146e808d88692e19c7ac10aeabea40bee9952205be97e00648879e9f0fa80e670e8e695f8633ba726513 +SHA512 (gnutls-3.8.6.tar.xz.sig) = 3f9552cdf5fa96184fbe394dd484fb55e6a3577d1e048aea373b82cda335ea0f174f2fb11926dc58532c1f950cd10a6a35bc36e9fe813a1259eae5c5364920b2 +SHA512 (gnutls-release-keyring.gpg) = 8c2b39239d1d8c5319757fcf669f28a11de7f8ec4a726f9904c57ba8105bea80240083c0de71b747115907bab46569f10cf58004137cc7884ac5c20f8319ae0a +SHA512 (gmp-6.2.1.tar.xz) = c99be0950a1d05a0297d65641dd35b75b74466f7bf03c9e8a99895a3b2f9a0856cd17887738fa51cf7499781b65c049769271cbcb77d057d2e9f1ec52e07dd84