diff --git a/.gitignore b/.gitignore index f859c71..1e793de 100644 --- a/.gitignore +++ b/.gitignore @@ -170,3 +170,6 @@ gnutls-2.10.1-nosrp.tar.bz2 /gnutls-3.8.10.tar.xz /gnutls-3.8.10.tar.xz.sig /leancrypto-1.5.0.tar.gz +/gnutls-3.8.11.tar.xz +/gnutls-3.8.11.tar.xz.sig +/leancrypto-1.6.0.tar.gz diff --git a/.packit.yaml b/.packit.yaml index 2a7dee2..31a01eb 100644 --- a/.packit.yaml +++ b/.packit.yaml @@ -28,5 +28,4 @@ actions: jobs: - job: propose_downstream trigger: release - metadata: - dist_git_branches: fedora-all + dist_git_branches: fedora-all diff --git a/README.packit b/README.packit index 72e3769..2511bf4 100644 --- a/README.packit +++ b/README.packit @@ -1,3 +1,3 @@ This repository is maintained by packit. https://packit.dev/ -The file was generated using packit 0.102.2. +The file was generated using packit 1.12.0. diff --git a/gmp-6.2.1-c23.patch b/gmp-6.2.1-c23.patch new file mode 100644 index 0000000..778c62f --- /dev/null +++ b/gmp-6.2.1-c23.patch @@ -0,0 +1,13 @@ +diff --git a/acinclude.m4 b/acinclude.m4 +index 906071c..a466b7c 100644 +--- a/acinclude.m4 ++++ b/acinclude.m4 +@@ -609,7 +609,7 @@ GMP_PROG_CC_WORKS_PART([$1], [long long reliability test 1], + + #if defined (__GNUC__) && ! defined (__cplusplus) + typedef unsigned long long t1;typedef t1*t2; +-void g(){} ++void g(int, t2, t1, t2, t2, int){} + void h(){} + static __inline__ t1 e(t2 rp,t2 up,int n,t1 v0) + {t1 c,x,r;int i;if(v0){c=1;for(i=1;i= 41 || 0%{?rhel} >= 10 -%bcond_without leancrypto +%if 0%{?rhel} >= 9 +%bcond_with gost %else -%bcond_with leancrypto +%bcond_without gost %endif +%bcond_without certificate_compression +%bcond_without leancrypto +%bcond_without crypto_auditing +%bcond_without tests %if 0%{?fedora} && 0%{?fedora} < 38 %bcond_without srp @@ -76,7 +72,7 @@ BuildRequires: zlib-devel, brotli-devel, libzstd-devel %if %{with bootstrap} BuildRequires: automake, autoconf, gperf, libtool, texinfo %endif -BuildRequires: nettle-devel >= 3.10 +BuildRequires: nettle-devel >= 3.10.1 %if %{with leancrypto} BuildRequires: meson %endif @@ -91,6 +87,9 @@ BuildRequires: libunistring-devel BuildRequires: net-tools, softhsm, gcc, gcc-c++ BuildRequires: gnupg2 BuildRequires: git-core +%if %{with crypto_auditing} +BuildRequires: systemtap-sdt-devel +%endif # for a sanity check on cert loading BuildRequires: p11-kit-trust, ca-certificates @@ -98,7 +97,7 @@ Requires: crypto-policies Requires: p11-kit-trust Requires: libtasn1 >= 4.3 # always bump when a nettle release is packaged -Requires: nettle >= 3.10 +Requires: nettle >= 3.10.1 %if %{with tpm12} Recommends: trousers >= 0.3.11.2 %endif @@ -134,13 +133,16 @@ Source1: https://www.gnupg.org/ftp/gcrypt/gnutls/v%{short_version}/%{name}-%{ver Source2: https://gnutls.org/gnutls-release-keyring.gpg %if %{with bundled_gmp} +Provides: bundled(gmp) = 6.2.1 Source100: gmp-6.2.1.tar.xz # Taken from the main gmp package Source101: gmp-6.2.1-intel-cet.patch +Source102: gmp-6.2.1-c23.patch %endif %if %{with leancrypto} -Source300: leancrypto-1.5.0.tar.gz +Provides: bundled(leancrypto) = 1.6.0 +Source300: leancrypto-1.6.0.tar.gz %endif # Wildcard bundling exception https://fedorahosted.org/fpc/ticket/174 @@ -271,6 +273,7 @@ mkdir -p bundled_gmp pushd bundled_gmp tar --strip-components=1 -xf %{SOURCE100} patch -p1 < %{SOURCE101} +patch -p1 < %{SOURCE102} popd %endif @@ -306,7 +309,8 @@ meson setup -Dprefix="$PWD/install" -Dlibdir="$PWD/install/lib" \ -Dx509_parser=disabled -Dx509_generator=disabled \ -Dpkcs7_parser=disabled -Dpkcs7_generator=disabled \ -Dsha2-256=disabled \ - -Dchacha20=disabled -Dchacha20_drng=disabled \ + -Daes_gcm=disabled -Daes_cbc=disabled -Daes_ctr=disabled -Daes_xts=disabled \ + -Dchacha20=disabled -Dchacha20poly1305=disabled -Dchacha20_drng=disabled \ -Ddrbg_hash=disabled -Ddrbg_hmac=disabled \ -Dhash_crypt=disabled \ -Dhmac=disabled -Dhkdf=disabled \ @@ -316,7 +320,10 @@ meson setup -Dprefix="$PWD/install" -Dlibdir="$PWD/install/lib" \ -Dhotp=disabled -Dtotp=disabled \ -Daes_block=disabled -Daes_cbc=disabled -Daes_ctr=disabled \ -Daes_kw=disabled -Dapps=disabled \ + -Ddisable-asm=true \ _build +# the reason for -Ddisable-asm=true being bz2416812 +# revert once the root cause is fixed meson compile -C _build meson install -C _build @@ -399,6 +406,11 @@ pushd native_build --with-leancrypto \ %else --without-leancrypto \ +%endif +%if %{with crypto_auditing} + --enable-crypto-auditing \ +%else + --disable-crypto-auditing \ %endif --disable-rpath \ --with-default-priority-string="@SYSTEM" diff --git a/sources b/sources index 6114eb9..c383c9e 100644 --- a/sources +++ b/sources @@ -1,5 +1,5 @@ -SHA512 (gnutls-3.8.10.tar.xz) = d453bd4527af95cb3905ce8753ceafd969e3f442ad1d148544a233ebf13285b999930553a805a0511293cc25390bb6a040260df5544a7c55019640f920ad3d92 -SHA512 (gnutls-3.8.10.tar.xz.sig) = 72d6dd2c23f768f5041c3dca0f49b3f60cd01fc960ce77f097094a2aae6d76fddeb6295c425e3750c711d5f700957a62268aecc4873e53c31abb60eecf0fd4a8 +SHA512 (gnutls-3.8.11.tar.xz) = 68f9e5bec3aa6686fd3319cc9c88a5cc44e2a75144049fc9de5fb55fef2241b4e16996af4be5dd48308abbee8cfaed6c862903f6bb89aff5dfa5410075bd7386 +SHA512 (gnutls-3.8.11.tar.xz.sig) = 90883e5736299b103844ca42b85d371969ef66b50b60cb185e814ad9978598796e9ed07a590245ff28ac6ac084b1dee93fae0845576464583a5941835990957d SHA512 (gnutls-release-keyring.gpg) = 8c2b39239d1d8c5319757fcf669f28a11de7f8ec4a726f9904c57ba8105bea80240083c0de71b747115907bab46569f10cf58004137cc7884ac5c20f8319ae0a SHA512 (gmp-6.2.1.tar.xz) = c99be0950a1d05a0297d65641dd35b75b74466f7bf03c9e8a99895a3b2f9a0856cd17887738fa51cf7499781b65c049769271cbcb77d057d2e9f1ec52e07dd84 -SHA512 (leancrypto-1.5.0.tar.gz) = 1170a502f58c9bce424578cece64a3ebf856620adc02f390b8877981bccf0c2bf35e64b1628094a06c069ec38a3be5889be22516d45d85f4e75b40085d9001c9 +SHA512 (leancrypto-1.6.0.tar.gz) = cb6ace4a1642208dd7656b62a48e99d6261f471aa7967b738057745a4534abfa11d380dd5de98a737c0c13b1e1cb37ce780e02297eefc1cf839581629d34e100