Update to gnutls 3.8.9 release

Signed-off-by: Daiki Ueno <dueno@redhat.com>
Update to 3.8.6 upstream release
2025-02-18 17:06:09 +09:00 · 2024-07-03 16:00:31 +02:00 · 2024-04-04 14:16:13 +02:00 · 2024-03-20 12:52:35 +01:00 · 2024-02-22 17:52:21 +01:00
7 changed files with 118 additions and 71 deletions
--- a/.gitignore
+++ b/.gitignore
@ -150,3 +150,18 @@ gnutls-2.10.1-nosrp.tar.bz2
 /gnutls-3.8.2.tar.xz.sig
 /gnutls-3.8.3.tar.xz
 /gnutls-3.8.3.tar.xz.sig
+/gnutls-3.8.4.tar.xz
+/gnutls-3.8.4.tar.xz.sig
+/gnutls-3.8.5.tar.xz
+/gnutls-3.8.5.tar.xz.sig
+/gnutls-3.8.6.tar.xz
+/gnutls-3.8.6.tar.xz.sig
+/gmp-6.2.1.tar.xz
+/gnutls-3.8.7.tar.xz
+/gnutls-3.8.7.tar.xz.sig
+/gnutls-3.8.7.1.tar.xz
+/gnutls-3.8.7.1.tar.xz.sig
+/gnutls-3.8.8.tar.xz
+/gnutls-3.8.8.tar.xz.sig
+/gnutls-3.8.9.tar.xz
+/gnutls-3.8.9.tar.xz.sig
--- a/README.packit
+++ b/README.packit
@ -1,3 +1,3 @@
 This repository is maintained by packit.
 https://packit.dev/
-The file was generated using packit 0.88.0.
+The file was generated using packit 0.97.3.
--- a/gnutls-3.7.8-ktls_skip_tls12_chachapoly_test.patch
+++ b/gnutls-3.7.8-ktls_skip_tls12_chachapoly_test.patch
@ -1,25 +0,0 @@
-From 18c555b4d2461ad202996398609552b9c4ecd43b Mon Sep 17 00:00:00 2001
-From: rpm-build <rpm-build>
-Date: Wed, 22 Nov 2023 15:21:49 +0900
-Subject: [PATCH] gnutls-3.7.8-ktls_skip_tls12_chachapoly_test.patch
-
-Signed-off-by: rpm-build <rpm-build>
---
- tests/gnutls_ktls.c | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/tests/gnutls_ktls.c b/tests/gnutls_ktls.c
-index ccbe566..049c888 100644
--- a/tests/gnutls_ktls.c
-+++ b/tests/gnutls_ktls.c
-@@ -347,7 +347,6 @@ void doit(void)
- {
- 	run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+AES-128-GCM");
- 	run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+AES-256-GCM");
-	run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+CHACHA20-POLY1305");
- 	run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-128-GCM");
- 	run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-256-GCM");
- 	run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+CHACHA20-POLY1305");
-- 
-2.41.0
-
--- a/gnutls-3.8.3-kernel_version_check.patch
+++ b/gnutls-3.8.3-kernel_version_check.patch
@ -1,36 +0,0 @@
-From 945c2f10eeda441f32404d1328761e311915add0 Mon Sep 17 00:00:00 2001
-From: Daiki Ueno <ueno@gnu.org>
-Date: Tue, 23 Jan 2024 11:54:32 +0900
-Subject: [PATCH] ktls: fix kernel version checking using utsname
-
-Signed-off-by: Daiki Ueno <ueno@gnu.org>
---
- lib/system/ktls.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/lib/system/ktls.c b/lib/system/ktls.c
-index 8efb913cda..432c70c5a2 100644
--- a/lib/system/ktls.c
-+++ b/lib/system/ktls.c
-@@ -482,7 +482,7 @@ int _gnutls_ktls_set_keys(gnutls_session_t session,
- 		return GNUTLS_E_INTERNAL_ERROR;
- 	}
- 
-	if (strcmp(utsname.sysname, "Linux") == 0) {
-+	if (strcmp(utsname.sysname, "Linux") != 0) {
- 		return GNUTLS_E_INTERNAL_ERROR;
- 	}
- 
-@@ -495,6 +495,9 @@ int _gnutls_ktls_set_keys(gnutls_session_t session,
- 		return GNUTLS_E_INTERNAL_ERROR;
- 	}
- 
-+	_gnutls_debug_log("Linux kernel version %lu.%lu has been detected\n",
-+			  major, minor);
-+
- 	/* setsockopt(SOL_TLS, TLS_RX) support added in 5.10 */
- 	if (major < 5 || (major == 5 && minor < 10)) {
- 		return GNUTLS_E_UNIMPLEMENTED_FEATURE;
-- 
-GitLab
-
--- a/gnutls-3.8.8-tests-ktls-skip-tls12-chachapoly.patch
+++ b/gnutls-3.8.8-tests-ktls-skip-tls12-chachapoly.patch
@ -0,0 +1,29 @@
+From a36b73a21e4b5b6e051b23192a645dea34c9d6af Mon Sep 17 00:00:00 2001
+From: Daiki Ueno <ueno@gnu.org>
+Date: Tue, 5 Nov 2024 14:45:46 +0900
+Subject: [PATCH] tests: skip CHACHA20-POLY1305 in TLS 1.2 when KTLS is enabled
+
+Signed-off-by: Daiki Ueno <ueno@gnu.org>
+---
+ tests/gnutls_ktls.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tests/gnutls_ktls.c b/tests/gnutls_ktls.c
+index 90d3e9af91..d5ac4efecc 100644
+--- a/tests/gnutls_ktls.c
+++ b/tests/gnutls_ktls.c
+@@ -347,9 +347,11 @@ void doit(void)
+ {
+ 	run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+AES-128-GCM");
+ 	run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+AES-256-GCM");
+#if 0
+ 	if (!gnutls_fips140_mode_enabled()) {
+ 		run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+CHACHA20-POLY1305");
+ 	}
+#endif
+ 	run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-128-GCM");
+ 	run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-256-GCM");
+ 	if (!gnutls_fips140_mode_enabled()) {
+-- 
+2.47.0
+
--- a/gnutls.spec
+++ b/gnutls.spec
@ -12,13 +12,12 @@ sha256sum:close()
 print(string.sub(hash, 0, 16))
 }

-Version: 3.8.3
+Version: 3.8.9
 Release: %{?autorelease}%{!?autorelease:1%{?dist}}
 Patch: gnutls-3.2.7-rpath.patch

 # follow https://gitlab.com/gnutls/gnutls/-/issues/1443
-Patch: gnutls-3.7.8-ktls_skip_tls12_chachapoly_test.patch
-Patch: gnutls-3.8.3-kernel_version_check.patch
+Patch: gnutls-3.8.8-tests-ktls-skip-tls12-chachapoly.patch

 %bcond_without bootstrap
 %bcond_without dane
@ -26,7 +25,7 @@ Patch: gnutls-3.8.3-kernel_version_check.patch
 %bcond_with tpm12
 %bcond_without tpm2
 %bcond_without gost
-%bcond_with certificate_compression
+%bcond_without certificate_compression
 %bcond_without tests

 %if 0%{?fedora} && 0%{?fedora} < 38
@ -41,6 +40,19 @@ Patch: gnutls-3.8.3-kernel_version_check.patch
 %bcond_with mingw
 %endif

+%if 0%{?rhel} >= 9 && %{with fips}
+%bcond_without bundled_gmp
+%else
+%bcond_with bundled_gmp
+%endif
+
+
+%define fips_requires() %{lua:
+local f = assert(io.popen("rpm -q --queryformat '%{EVR}' --whatprovides "..rpm.expand("'%1%{?_isa}'")))
+local v = f:read("*all")
+f:close()
+print("Requires: "..rpm.expand("%1%{?_isa}").." = "..v.."\\n")
+}

 Summary: A TLS protocol implementation
 Name: gnutls
@ -72,6 +84,7 @@ BuildRequires: p11-kit-trust, ca-certificates
 Requires: crypto-policies
 Requires: p11-kit-trust
 Requires: libtasn1 >= 4.3
+# always bump when a nettle release is packaged
 Requires: nettle >= 3.9.1
 %if %{with tpm12}
 Recommends: trousers >= 0.3.11.2
@ -107,6 +120,12 @@ Source0: https://www.gnupg.org/ftp/gcrypt/gnutls/v%{short_version}/%{name}-%{ver
 Source1: https://www.gnupg.org/ftp/gcrypt/gnutls/v%{short_version}/%{name}-%{version}.tar.xz.sig
 Source2: https://gnutls.org/gnutls-release-keyring.gpg

+%if %{with bundled_gmp}
+Source100:	gmp-6.2.1.tar.xz
+# Taken from the main gmp package
+Source101:	gmp-6.2.1-intel-cet.patch
+%endif
+
 # Wildcard bundling exception https://fedorahosted.org/fpc/ticket/174
 Provides: bundled(gnulib) = 20130424

@ -137,6 +156,16 @@ Summary: A DANE protocol implementation for GnuTLS
 Requires: %{name}%{?_isa} = %{version}-%{release}
 %endif

+%if %{with fips}
+%package fips
+Summary: Virtual package to install packages required to use %{name} under FIPS mode
+Requires: %{name}%{?_isa} = %{version}-%{release}
+%{fips_requires nettle}
+%if !%{with bundled_gmp}
+%{fips_requires gmp}
+%endif
+%endif
+
 %description
 GnuTLS is a secure communications library implementing the SSL, TLS and DTLS 
 protocols and technologies around them. It provides a simple C language 
@ -180,6 +209,17 @@ This package contains library that implements the DANE protocol for verifying
 TLS certificates through DNSSEC.
 %endif

+%if %{with fips}
+%description fips
+GnuTLS is a secure communications library implementing the SSL, TLS and DTLS 
+protocols and technologies around them. It provides a simple C language 
+application programming interface (API) to access the secure communications 
+protocols as well as APIs to parse and write X.509, PKCS #12, OpenPGP and 
+other required structures.
+This package does not contain any file, but installs required packages
+to use GnuTLS under FIPS mode.
+%endif
+
 %if %{with mingw}
 %package -n mingw32-%{name}
 Summary:        MinGW GnuTLS TLS/SSL encryption library
@ -209,9 +249,28 @@ for MinGW.

 %autosetup -p1 -S git

+%if %{with bundled_gmp}
+mkdir -p bundled_gmp
+pushd bundled_gmp
+tar --strip-components=1 -xf %{SOURCE100}
+patch -p1 < %{SOURCE101}
+popd
+%endif
+
 %build
 %define _lto_cflags %{nil}

+%if %{with bundled_gmp}
+pushd bundled_gmp
+autoreconf -ifv
+%configure --disable-cxx --disable-shared --enable-fat --with-pic
+%make_build
+popd
+
+export GMP_CFLAGS="-I$PWD/bundled_gmp"
+export GMP_LIBS="$PWD/bundled_gmp/.libs/libgmp.a"
+%endif
+
 %if %{with bootstrap}
 autoreconf -fi
 %endif
@ -396,7 +455,7 @@ popd
 %{_libdir}/.libgnutls.so.30*.hmac
 %endif
 %doc README.md AUTHORS NEWS THANKS
-%license LICENSE doc/COPYING doc/COPYING.LESSER
+%license COPYING COPYING.LESSERv2

 %files c++
 %{_libdir}/libgnutlsxx.so.*
@ -434,9 +493,13 @@ popd
 %{_libdir}/libgnutls-dane.so.*
 %endif

+%if %{with fips}
+%files fips
+%endif
+
 %if %{with mingw}
 %files -n mingw32-%{name}
-%license LICENSE doc/COPYING doc/COPYING.LESSER
+%license COPYING COPYING.LESSERv2
 %{mingw32_bindir}/certtool.exe
 %{mingw32_bindir}/gnutls-cli-debug.exe
 %{mingw32_bindir}/gnutls-cli.exe
@ -454,7 +517,7 @@ popd
 %{mingw32_includedir}/gnutls/

 %files -n mingw64-%{name}
-%license LICENSE doc/COPYING doc/COPYING.LESSER
+%license COPYING COPYING.LESSERv2
 %{mingw64_bindir}/certtool.exe
 %{mingw64_bindir}/gnutls-cli-debug.exe
 %{mingw64_bindir}/gnutls-cli.exe
--- a/5
+++ b/5
@ -1,3 +1,4 @@
-SHA512 (gnutls-3.8.3.tar.xz) = 74eddba01ce4c2ffdca781c85db3bb52c85f1db3c09813ee2b8ceea0608f92ca3912fd9266f55deb36a8ba4d01802895ca5d5d219e7d9caec45e1a8534e45a84
-SHA512 (gnutls-3.8.3.tar.xz.sig) = 5b2ca0648ca5feeda1de933de2bbaf71fadb70e830a8f0d494d2f0380b6d0d7b79445257cc79e59bba1a7ff639ab4573da3e3e124eb80c20ac6141e29a4827ff
+SHA512 (gnutls-3.8.9.tar.xz) = b3b201671bf4e75325610a0291d4cd36a669718e22b3685246b64bde97b5bd94f463ab376ed817869869714115f4ff11bdc53c32604bb04a8ff8e10daa6d1fc7
+SHA512 (gnutls-3.8.9.tar.xz.sig) = 5a47a519ef35f21b59e2122528246d6109dd95667bfe5d01713b9a7efa2931f8523bf325b8824433f3117d63e0e50d66f8c467a7ee4bd2068ae039601a28441e
 SHA512 (gnutls-release-keyring.gpg) = 8c2b39239d1d8c5319757fcf669f28a11de7f8ec4a726f9904c57ba8105bea80240083c0de71b747115907bab46569f10cf58004137cc7884ac5c20f8319ae0a
+SHA512 (gmp-6.2.1.tar.xz) = c99be0950a1d05a0297d65641dd35b75b74466f7bf03c9e8a99895a3b2f9a0856cd17887738fa51cf7499781b65c049769271cbcb77d057d2e9f1ec52e07dd84
Author	SHA1	Message	Date
Daiki Ueno	f9095b6247	Update to gnutls 3.8.9 release Signed-off-by: Daiki Ueno <dueno@redhat.com>	2025-02-18 17:06:09 +09:00
Zoltan Fridrich	1203838c81	Update to 3.8.6 upstream release Upstream tag: 3.8.6 Upstream commit: cd953cfa Commit authored by Packit automation (https://packit.dev/)	2024-07-03 16:00:31 +02:00
Zoltan Fridrich	920eabe710	[packit] 3.8.5 upstream release Upstream tag: 3.8.5 Upstream commit: 49f4ae21	2024-04-04 14:16:13 +02:00
Zoltan Fridrich	5d624db816	[packit] 3.8.4 upstream release - Resolves rhbz#2270320 Upstream tag: 3.8.4 Upstream commit: 4a4cefef	2024-03-20 12:52:35 +01:00
Zoltan Fridrich	e9ade6a1aa	Fix mingw build failure Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>	2024-02-22 17:52:21 +01:00