Update to 3.8.6 upstream release

Upstream tag: 3.8.6
Upstream commit: cd953cfa

Commit authored by Packit automation (https://packit.dev/)

.gitignore

@@ -144,3 +144,16 @@ gnutls-2.10.1-nosrp.tar.bz2
 /gnutls-3.8.0.tar.xz
 /gnutls-3.8.0.tar.xz.sig
 /gnutls-release-keyring.gpg
+/gnutls-3.8.1.tar.xz
+/gnutls-3.8.1.tar.xz.sig
+/gnutls-3.8.2.tar.xz
+/gnutls-3.8.2.tar.xz.sig
+/gnutls-3.8.3.tar.xz
+/gnutls-3.8.3.tar.xz.sig
+/gnutls-3.8.4.tar.xz
+/gnutls-3.8.4.tar.xz.sig
+/gnutls-3.8.5.tar.xz
+/gnutls-3.8.5.tar.xz.sig
+/gnutls-3.8.6.tar.xz
+/gnutls-3.8.6.tar.xz.sig
+/gmp-6.2.1.tar.xz

README.packit

@@ -1,3 +1,3 @@
 This repository is maintained by packit.
 https://packit.dev/
-The file was generated using packit 0.67.0.
+The file was generated using packit 0.97.3.

gnutls-3.7.8-ktls_disable_keyupdate_test.patch

@@ -1,13 +0,0 @@
-diff --git a/tests/Makefile.am b/tests/Makefile.am
-index 2872cb1aa..247dfd3d8 100644
---- a/tests/Makefile.am
-+++ b/tests/Makefile.am
-@@ -504,8 +504,6 @@ endif
- if ENABLE_KTLS
- indirect_tests += gnutls_ktls
- dist_check_SCRIPTS += ktls.sh
--indirect_tests += ktls_keyupdate
--dist_check_SCRIPTS += ktls_keyupdate.sh
- endif
- 
- if !WINDOWS

gnutls-3.7.8-ktls_skip_tls12_chachapoly_test.patch

@@ -1,12 +1,25 @@
+From 18c555b4d2461ad202996398609552b9c4ecd43b Mon Sep 17 00:00:00 2001
+From: rpm-build <rpm-build>
+Date: Wed, 22 Nov 2023 15:21:49 +0900
+Subject: [PATCH] gnutls-3.7.8-ktls_skip_tls12_chachapoly_test.patch
+
+Signed-off-by: rpm-build <rpm-build>
+---
+ tests/gnutls_ktls.c | 1 -
+ 1 file changed, 1 deletion(-)
+
 diff --git a/tests/gnutls_ktls.c b/tests/gnutls_ktls.c
-index 919270778..778a2f94a 100644
+index ccbe566..049c888 100644
 --- a/tests/gnutls_ktls.c
 +++ b/tests/gnutls_ktls.c
-@@ -351,7 +351,6 @@ void doit(void)
+@@ -347,7 +347,6 @@ void doit(void)
+ {
  	run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+AES-128-GCM");
  	run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+AES-256-GCM");
- 	run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+AES-128-CCM");
 -	run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+CHACHA20-POLY1305");
  	run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-128-GCM");
  	run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-256-GCM");
- 	run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-128-CCM");
+ 	run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+CHACHA20-POLY1305");
+-- 
+2.41.0
+

gnutls-3.8.0-ktls-Do-not-return-GNUTLS_E_INTERRUPTED-AGAIN-from-s.patch

@@ -1,52 +0,0 @@
-From 21c386860f1973344872eec4e4dd68644b1b48aa Mon Sep 17 00:00:00 2001
-From: "Richard W.M. Jones" <rjones@redhat.com>
-Date: Fri, 10 Mar 2023 11:15:19 +0000
-Subject: [PATCH] ktls: Do not return GNUTLS_E_INTERRUPTED/AGAIN from short
- writes
-
-If sendmsg returns a short write, we end up going around the loop with
-data_to_send being smaller.  However if sendmsg then returns -EAGAIN
-or -EINTR then we return an error.  But we have "forgotten" that we
-already sent some data.
-
-This causes the caller to retry gnutls_record_send with the full
-buffer (ie. with a buffer that has already been partially sent),
-causing desynchronization.
-
-Instead check if we sent some data in this case and return the number
-of bytes sent.
-
-Fixes: https://gitlab.com/gnutls/gnutls/-/issues/1470
-Thanks: Dan Berrange for suggesting a fix
-Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
----
- lib/system/ktls.c | 12 ++++++++++--
- 1 file changed, 10 insertions(+), 2 deletions(-)
-
-diff --git a/lib/system/ktls.c b/lib/system/ktls.c
-index fd57a9c30..bb59fab7c 100644
---- a/lib/system/ktls.c
-+++ b/lib/system/ktls.c
-@@ -604,9 +604,17 @@ int _gnutls_ktls_send_control_msg(gnutls_session_t session,
- 		if (ret == -1) {
- 			switch (errno) {
- 			case EINTR:
--				return GNUTLS_E_INTERRUPTED;
-+				if (data_to_send < data_size) {
-+					return data_size - data_to_send;
-+				} else {
-+					return GNUTLS_E_INTERRUPTED;
-+				}
- 			case EAGAIN:
--				return GNUTLS_E_AGAIN;
-+				if (data_to_send < data_size) {
-+					return data_size - data_to_send;
-+				} else {
-+					return GNUTLS_E_AGAIN;
-+				}
- 			default:
- 				return GNUTLS_E_PUSH_ERROR;
- 			}
--- 
-2.39.2
-

gnutls.spec

@@ -12,30 +12,23 @@ sha256sum:close()
 print(string.sub(hash, 0, 16))
 }
 
-Version: 3.8.0
+Version: 3.8.6
 Release: %{?autorelease}%{!?autorelease:1%{?dist}}
 Patch: gnutls-3.2.7-rpath.patch
 
-# Delete only after the kernel has been patched for thested systems
-Patch: gnutls-3.7.8-ktls_disable_keyupdate_test.patch
-
 # follow https://gitlab.com/gnutls/gnutls/-/issues/1443
 Patch: gnutls-3.7.8-ktls_skip_tls12_chachapoly_test.patch
 
-# Fix desychronisation with kTLS:
-# https://gitlab.com/gnutls/gnutls/-/issues/1470
-Patch: gnutls-3.8.0-ktls-Do-not-return-GNUTLS_E_INTERRUPTED-AGAIN-from-s.patch
-
 %bcond_without bootstrap
 %bcond_without dane
 %bcond_without fips
 %bcond_with tpm12
 %bcond_without tpm2
 %bcond_without gost
-%bcond_with certificate_compression
+%bcond_without certificate_compression
 %bcond_without tests
 
-%if 0%{?fedora} < 38
+%if 0%{?fedora} && 0%{?fedora} < 38
 %bcond_without srp
 %else
 %bcond_with srp
@@ -47,11 +40,24 @@ Patch: gnutls-3.8.0-ktls-Do-not-return-GNUTLS_E_INTERRUPTED-AGAIN-from-s.patch
 %bcond_with mingw
 %endif
 
+%if 0%{?rhel} >= 9 && %{with fips}
+%bcond_without bundled_gmp
+%else
+%bcond_with bundled_gmp
+%endif
+
+
+%define fips_requires() %{lua:
+local f = assert(io.popen("rpm -q --queryformat '%{EVR}' --whatprovides "..rpm.expand("'%1%{?_isa}'")))
+local v = f:read("*all")
+f:close()
+print("Requires: "..rpm.expand("%1%{?_isa}").." = "..v.."\\n")
+}
 
 Summary: A TLS protocol implementation
 Name: gnutls
 # The libraries are LGPLv2.1+, utilities are GPLv3+
-License: GPLv3+ and LGPLv2+
+License: GPL-3.0-or-later AND LGPL-2.1-or-later
 BuildRequires: p11-kit-devel >= 0.21.3, gettext-devel
 BuildRequires: readline-devel, libtasn1-devel >= 4.3
 %if %{with certificate_compression}
@@ -60,7 +66,7 @@ BuildRequires: zlib-devel, brotli-devel, libzstd-devel
 %if %{with bootstrap}
 BuildRequires: automake, autoconf, gperf, libtool, texinfo
 %endif
-BuildRequires: nettle-devel >= 3.5.1
+BuildRequires: nettle-devel >= 3.9.1
 %if %{with tpm12}
 BuildRequires: trousers-devel >= 0.3.11.2
 %endif
@@ -69,7 +75,7 @@ BuildRequires: tpm2-tss-devel >= 3.0.3
 %endif
 BuildRequires: libidn2-devel
 BuildRequires: libunistring-devel
-BuildRequires: net-tools, datefudge, softhsm, gcc, gcc-c++
+BuildRequires: net-tools, softhsm, gcc, gcc-c++
 BuildRequires: gnupg2
 BuildRequires: git-core
 
@@ -78,7 +84,8 @@ BuildRequires: p11-kit-trust, ca-certificates
 Requires: crypto-policies
 Requires: p11-kit-trust
 Requires: libtasn1 >= 4.3
-Requires: nettle >= 3.4.1
+# always bump when a nettle release is packaged
+Requires: nettle >= 3.9.1
 %if %{with tpm12}
 Recommends: trousers >= 0.3.11.2
 %endif
@@ -113,6 +120,12 @@ Source0: https://www.gnupg.org/ftp/gcrypt/gnutls/v%{short_version}/%{name}-%{ver
 Source1: https://www.gnupg.org/ftp/gcrypt/gnutls/v%{short_version}/%{name}-%{version}.tar.xz.sig
 Source2: https://gnutls.org/gnutls-release-keyring.gpg
 
+%if %{with bundled_gmp}
+Source100:	gmp-6.2.1.tar.xz
+# Taken from the main gmp package
+Source101:	gmp-6.2.1-intel-cet.patch
+%endif
+
 # Wildcard bundling exception https://fedorahosted.org/fpc/ticket/174
 Provides: bundled(gnulib) = 20130424
 
@@ -130,7 +143,7 @@ Requires: %{name}-dane%{?_isa} = %{version}-%{release}
 Requires: pkgconfig
 
 %package utils
-License: GPLv3+
+License: GPL-3.0-or-later
 Summary: Command line tools for TLS protocol
 Requires: %{name}%{?_isa} = %{version}-%{release}
 %if %{with dane}
@@ -143,6 +156,16 @@ Summary: A DANE protocol implementation for GnuTLS
 Requires: %{name}%{?_isa} = %{version}-%{release}
 %endif
 
+%if %{with fips}
+%package fips
+Summary: Virtual package to install packages required to use %{name} under FIPS mode
+Requires: %{name}%{?_isa} = %{version}-%{release}
+%{fips_requires nettle}
+%if !%{with bundled_gmp}
+%{fips_requires gmp}
+%endif
+%endif
+
 %description
 GnuTLS is a secure communications library implementing the SSL, TLS and DTLS 
 protocols and technologies around them. It provides a simple C language 
@@ -186,6 +209,17 @@ This package contains library that implements the DANE protocol for verifying
 TLS certificates through DNSSEC.
 %endif
 
+%if %{with fips}
+%description fips
+GnuTLS is a secure communications library implementing the SSL, TLS and DTLS 
+protocols and technologies around them. It provides a simple C language 
+application programming interface (API) to access the secure communications 
+protocols as well as APIs to parse and write X.509, PKCS #12, OpenPGP and 
+other required structures.
+This package does not contain any file, but installs required packages
+to use GnuTLS under FIPS mode.
+%endif
+
 %if %{with mingw}
 %package -n mingw32-%{name}
 Summary:        MinGW GnuTLS TLS/SSL encryption library
@@ -215,9 +249,28 @@ for MinGW.
 
 %autosetup -p1 -S git
 
+%if %{with bundled_gmp}
+mkdir -p bundled_gmp
+pushd bundled_gmp
+tar --strip-components=1 -xf %{SOURCE100}
+patch -p1 < %{SOURCE101}
+popd
+%endif
+
 %build
 %define _lto_cflags %{nil}
 
+%if %{with bundled_gmp}
+pushd bundled_gmp
+autoreconf -ifv
+%configure --disable-cxx --disable-shared --enable-fat --with-pic
+%make_build
+popd
+
+export GMP_CFLAGS="-I$PWD/bundled_gmp"
+export GMP_LIBS="$PWD/bundled_gmp/.libs/libgmp.a"
+%endif
+
 %if %{with bootstrap}
 autoreconf -fi
 %endif
@@ -377,7 +430,22 @@ rm -f $RPM_BUILD_ROOT%{mingw64_libdir}/ncrypt.dll*
 %check
 %if %{with tests}
 pushd native_build
-make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null
+
+# KeyUpdate is not yet supported in the kernel.
+xfail_tests=ktls_keyupdate.sh
+
+# The ktls.sh test currently only supports kernel 5.11+.  This needs to
+# be checked at run time, as the koji builder might be using a different
+# version of kernel on the host than the one indicated by the
+# kernel-devel package.
+
+case "$(uname -r)" in
+  4.* | 5.[0-9].* | 5.10.* )
+    xfail_tests="$xfail_tests ktls.sh"
+    ;;
+esac
+
+make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null XFAIL_TESTS="$xfail_tests"
 popd
 %endif
 
@@ -425,6 +493,10 @@ popd
 %{_libdir}/libgnutls-dane.so.*
 %endif
 
+%if %{with fips}
+%files fips
+%endif
+
 %if %{with mingw}
 %files -n mingw32-%{name}
 %license LICENSE doc/COPYING doc/COPYING.LESSER

sources

@@ -1,3 +1,4 @@
-SHA512 (gnutls-3.8.0.tar.xz) = 2507b3133423fdaf90fbd826ccb1142e9ff6fc90fcd5531720218f19ddf0e6bbb8267d23bad35c0954860e5a4179da74823e0c8357db56a14f252e6ec9d59629
-SHA512 (gnutls-3.8.0.tar.xz.sig) = 9db8db74aa0ebd871287b07b6a8a9f4ce90188633618e669fe07cb8bb314b624c14761f6fe1970e2fbffa87f7c0d6daa4b0fa838bd05f74b8b18cd1b5325c654
-SHA512 (gnutls-release-keyring.gpg) = 5c14d83f4f37bd319c652db0d76fc5bb04752fb461bbe853e25b20ffe41d6d14faae6c0bdd0193ac6242975bf1205ce606a9d0082261cc4581fd680abfcdbd4d
+SHA512 (gnutls-3.8.6.tar.xz) = 58631c456dfb43f8cb6a1703ffa91c593a33357f37dc146e808d88692e19c7ac10aeabea40bee9952205be97e00648879e9f0fa80e670e8e695f8633ba726513
+SHA512 (gnutls-3.8.6.tar.xz.sig) = 3f9552cdf5fa96184fbe394dd484fb55e6a3577d1e048aea373b82cda335ea0f174f2fb11926dc58532c1f950cd10a6a35bc36e9fe813a1259eae5c5364920b2
+SHA512 (gnutls-release-keyring.gpg) = 8c2b39239d1d8c5319757fcf669f28a11de7f8ec4a726f9904c57ba8105bea80240083c0de71b747115907bab46569f10cf58004137cc7884ac5c20f8319ae0a
+SHA512 (gmp-6.2.1.tar.xz) = c99be0950a1d05a0297d65641dd35b75b74466f7bf03c9e8a99895a3b2f9a0856cd17887738fa51cf7499781b65c049769271cbcb77d057d2e9f1ec52e07dd84