Restore gmp tarball to sources

Drop RHEL10-specific patch
The test was fixed to be FIPS-compliant: https://gitlab.com/gnutls/gnutls/-/merge_requests/1932
2025-11-25 09:54:16 -05:00 · 2025-11-25 14:42:39 +00:00 · 2025-11-25 10:30:27 +01:00 · 2025-11-21 16:14:40 +09:00 · 2025-11-21 16:12:20 +09:00 · 2025-11-21 11:48:31 +09:00
6 changed files with 26 additions and 43 deletions
--- a/.gitignore
+++ b/.gitignore
@ -170,3 +170,6 @@ gnutls-2.10.1-nosrp.tar.bz2
 /gnutls-3.8.10.tar.xz
 /gnutls-3.8.10.tar.xz.sig
 /leancrypto-1.5.0.tar.gz
+/gnutls-3.8.11.tar.xz
+/gnutls-3.8.11.tar.xz.sig
+/leancrypto-1.6.0.tar.gz
--- a/.packit.yaml
+++ b/.packit.yaml
@ -28,5 +28,4 @@ actions:
 jobs:
  - job: propose_downstream
    trigger: release
-    metadata:
-      dist_git_branches: fedora-all
+    dist_git_branches: fedora-all
--- a/README.packit
+++ b/README.packit
@ -1,3 +1,3 @@
 This repository is maintained by packit.
 https://packit.dev/
-The file was generated using packit 0.102.2.
+The file was generated using packit 1.12.0.
--- a/gnutls-3.8.8-tests-rsa-default.patch
+++ b/gnutls-3.8.8-tests-rsa-default.patch
@ -1,22 +0,0 @@
-As of RHEL 10, DEFAULT crypto policy rejects TLS ciphers with RSA key exchange:
-
-https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10-beta/html/considerations_in_adopting_rhel_10/security#security
-
-diff --git a/tests/system-override-allow-rsa-pkcs1-encrypt.sh b/tests/system-override-allow-rsa-pkcs1-encrypt.sh
-index 714d0af..bd141f3 100755
--- a/tests/system-override-allow-rsa-pkcs1-encrypt.sh
-+++ b/tests/system-override-allow-rsa-pkcs1-encrypt.sh
-@@ -60,10 +60,10 @@ unset GNUTLS_SYSTEM_PRIORITY_FILE
- unset GNUTLS_SYSTEM_PRIORITY_FAIL_ON_INVALID
- 
- ${TEST}
-if [ $? != 0 ]; then
-	echo "${TEST} expected to succeed by default"
-+if [ $? = 0 ]; then
-+	echo "${TEST} expected to fail by default"
- 	exit 1
- fi
-echo "RSAES-PKCS1-v1_5 successfully enabled by default"
-+echo "RSAES-PKCS1-v1_5 correctly failed by default"
- 
- exit 0
--- a/gnutls.spec
+++ b/gnutls.spec
@ -12,16 +12,12 @@ sha256sum:close()
 print(string.sub(hash, 0, 16))
 }

-Version: 3.8.10
+Version: 3.8.11
 Release: %{?autorelease}%{!?autorelease:1%{?dist}}
 Patch: gnutls-3.2.7-rpath.patch

 # follow https://gitlab.com/gnutls/gnutls/-/issues/1443
 Patch: gnutls-3.8.8-tests-ktls-skip-tls12-chachapoly.patch
-# add tests/ktls_utils.h missing in the distribution
-Patch: gnutls-3.8.10-tests-ktls.patch
-# run tests/cert-test/mldsa.sh in VPATH build
-Patch: gnutls-3.8.10-tests-mldsa.patch

 %bcond_without bootstrap
 %bcond_without dane
@ -35,6 +31,7 @@ Patch: gnutls-3.8.10-tests-mldsa.patch
 %endif
 %bcond_without certificate_compression
 %bcond_without leancrypto
+%bcond_without crypto_auditing
 %bcond_without tests

 %if 0%{?fedora} && 0%{?fedora} < 38
@ -90,6 +87,9 @@ BuildRequires: libunistring-devel
 BuildRequires: net-tools, softhsm, gcc, gcc-c++
 BuildRequires: gnupg2
 BuildRequires: git-core
+%if %{with crypto_auditing}
+BuildRequires: systemtap-sdt-devel
+%endif

 # for a sanity check on cert loading
 BuildRequires: p11-kit-trust, ca-certificates
@ -133,18 +133,16 @@ Source1: https://www.gnupg.org/ftp/gcrypt/gnutls/v%{short_version}/%{name}-%{ver
 Source2: https://gnutls.org/gnutls-release-keyring.gpg

 %if %{with bundled_gmp}
+Provides:	bundled(gmp) = 6.2.1
 Source100:	gmp-6.2.1.tar.xz
 # Taken from the main gmp package
 Source101:	gmp-6.2.1-intel-cet.patch
 Source102:	gmp-6.2.1-c23.patch
 %endif

-%if 0%{?rhel} >= 10
-Source201:	gnutls-3.8.8-tests-rsa-default.patch
-%endif
-
 %if %{with leancrypto}
-Source300:	leancrypto-1.5.0.tar.gz
+Provides:	bundled(leancrypto) = 1.6.0
+Source300:	leancrypto-1.6.0.tar.gz
 %endif

 # Wildcard bundling exception https://fedorahosted.org/fpc/ticket/174
@ -279,10 +277,6 @@ patch -p1 < %{SOURCE102}
 popd
 %endif

-%if 0%{?rhel} >= 10
-patch -p1 < %{SOURCE201}
-%endif
-
 %build
 %define _lto_cflags %{nil}

@ -315,7 +309,8 @@ meson setup -Dprefix="$PWD/install" -Dlibdir="$PWD/install/lib" \
        -Dx509_parser=disabled -Dx509_generator=disabled \
        -Dpkcs7_parser=disabled -Dpkcs7_generator=disabled \
        -Dsha2-256=disabled \
-        -Dchacha20=disabled -Dchacha20_drng=disabled \
+        -Daes_gcm=disabled -Daes_cbc=disabled -Daes_ctr=disabled -Daes_xts=disabled \
+        -Dchacha20=disabled -Dchacha20poly1305=disabled -Dchacha20_drng=disabled \
        -Ddrbg_hash=disabled -Ddrbg_hmac=disabled \
        -Dhash_crypt=disabled \
        -Dhmac=disabled -Dhkdf=disabled \
@ -325,7 +320,10 @@ meson setup -Dprefix="$PWD/install" -Dlibdir="$PWD/install/lib" \
        -Dhotp=disabled -Dtotp=disabled \
        -Daes_block=disabled -Daes_cbc=disabled -Daes_ctr=disabled \
        -Daes_kw=disabled -Dapps=disabled \
+        -Ddisable-asm=true \
        _build
+# the reason for -Ddisable-asm=true being bz2416812
+# revert once the root cause is fixed
 meson compile -C _build
 meson install -C _build

@ -408,6 +406,11 @@ pushd native_build
           --with-leancrypto \
 %else
           --without-leancrypto \
+%endif
+%if %{with crypto_auditing}
+           --enable-crypto-auditing \
+%else
+           --disable-crypto-auditing \
 %endif
           --disable-rpath \
           --with-default-priority-string="@SYSTEM"
--- a/6
+++ b/6
@ -1,5 +1,5 @@
-SHA512 (gnutls-3.8.10.tar.xz) = d453bd4527af95cb3905ce8753ceafd969e3f442ad1d148544a233ebf13285b999930553a805a0511293cc25390bb6a040260df5544a7c55019640f920ad3d92
-SHA512 (gnutls-3.8.10.tar.xz.sig) = 72d6dd2c23f768f5041c3dca0f49b3f60cd01fc960ce77f097094a2aae6d76fddeb6295c425e3750c711d5f700957a62268aecc4873e53c31abb60eecf0fd4a8
+SHA512 (gnutls-3.8.11.tar.xz) = 68f9e5bec3aa6686fd3319cc9c88a5cc44e2a75144049fc9de5fb55fef2241b4e16996af4be5dd48308abbee8cfaed6c862903f6bb89aff5dfa5410075bd7386
+SHA512 (gnutls-3.8.11.tar.xz.sig) = 90883e5736299b103844ca42b85d371969ef66b50b60cb185e814ad9978598796e9ed07a590245ff28ac6ac084b1dee93fae0845576464583a5941835990957d
 SHA512 (gnutls-release-keyring.gpg) = 8c2b39239d1d8c5319757fcf669f28a11de7f8ec4a726f9904c57ba8105bea80240083c0de71b747115907bab46569f10cf58004137cc7884ac5c20f8319ae0a
 SHA512 (gmp-6.2.1.tar.xz) = c99be0950a1d05a0297d65641dd35b75b74466f7bf03c9e8a99895a3b2f9a0856cd17887738fa51cf7499781b65c049769271cbcb77d057d2e9f1ec52e07dd84
-SHA512 (leancrypto-1.5.0.tar.gz) = 1170a502f58c9bce424578cece64a3ebf856620adc02f390b8877981bccf0c2bf35e64b1628094a06c069ec38a3be5889be22516d45d85f4e75b40085d9001c9
+SHA512 (leancrypto-1.6.0.tar.gz) = cb6ace4a1642208dd7656b62a48e99d6261f471aa7967b738057745a4534abfa11d380dd5de98a737c0c13b1e1cb37ce780e02297eefc1cf839581629d34e100
Author	SHA1	Message	Date
Yaakov Selkowitz	cbe66ee3a7	Restore gmp tarball to sources	2025-11-25 09:54:16 -05:00
Yaakov Selkowitz	33160d08cb	Drop RHEL10-specific patch The test was fixed to be FIPS-compliant: https://gitlab.com/gnutls/gnutls/-/merge_requests/1932	2025-11-25 14:42:39 +00:00
Alexander Sosedkin	98206a06fe	Disable native assembly to work around bz2416812	2025-11-25 10:30:27 +01:00
Daniel P. Berrangé	c5fcada2f3	Add missing Provides: bundled(..) for gmp & leancrypto Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>	2025-11-21 16:14:40 +09:00
Daiki Ueno	9f95ff6e69	Remove unnecessary PKG_CONFIG_PATH setting Signed-off-by: Daiki Ueno <dueno@redhat.com>	2025-11-21 16:12:20 +09:00
Daiki Ueno	3078b09e41	Enable crypto-auditing probes Signed-off-by: Daiki Ueno <dueno@redhat.com>	2025-11-21 11:48:31 +09:00
Daiki Ueno	7441432f8c	Minor fixes to spec file and packit configuration Signed-off-by: Daiki Ueno <dueno@redhat.com>	2025-11-21 11:48:21 +09:00
Daiki Ueno	000d285047	Update to 3.8.11 upstream release - Resolves: rhbz#2416041 Upstream tag: 3.8.11 Upstream commit: b841c70e Commit authored by Packit automation (https://packit.dev/)	2025-11-20 19:40:16 +09:00
Krenzelok Frantisek	92cc61b531	Revert "Enable kTLS by default" This reverts commit `330d52f8da`.	2025-08-26 17:33:12 +02:00
Krenzelok Frantisek	330d52f8da	Enable kTLS by default Resolves: rhbz#2130000 - https://fedoraproject.org/wiki/Changes/KTLSSupportForGnuTLS. - kTLS is now enabled by default if all requirements are met. - Modify the docs to reflect the change of defaults. - Picked-up a patch that fixes state transition in the KTLS code path.	2025-08-25 17:39:12 +02:00