Update to 3.8.10 upstream release

Also update the bundled leancrypto to 1.5.0.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

.gitignore

@@ -157,3 +157,16 @@ gnutls-2.10.1-nosrp.tar.bz2
 /gnutls-3.8.6.tar.xz
 /gnutls-3.8.6.tar.xz.sig
 /gmp-6.2.1.tar.xz
+/gnutls-3.8.7.tar.xz
+/gnutls-3.8.7.tar.xz.sig
+/gnutls-3.8.7.1.tar.xz
+/gnutls-3.8.7.1.tar.xz.sig
+/gnutls-3.8.8.tar.xz
+/gnutls-3.8.8.tar.xz.sig
+/gnutls-3.8.9.tar.xz
+/gnutls-3.8.9.tar.xz.sig
+/leancrypto-1.2.0.tar.gz
+/leancrypto-1.3.0.tar.gz
+/gnutls-3.8.10.tar.xz
+/gnutls-3.8.10.tar.xz.sig
+/leancrypto-1.5.0.tar.gz

README.packit

@@ -1,3 +1,3 @@
 This repository is maintained by packit.
 https://packit.dev/
-The file was generated using packit 0.97.3.
+The file was generated using packit 0.102.2.

gnutls-3.7.8-ktls_skip_tls12_chachapoly_test.patch

@@ -1,25 +0,0 @@
-From 18c555b4d2461ad202996398609552b9c4ecd43b Mon Sep 17 00:00:00 2001
-From: rpm-build <rpm-build>
-Date: Wed, 22 Nov 2023 15:21:49 +0900
-Subject: [PATCH] gnutls-3.7.8-ktls_skip_tls12_chachapoly_test.patch
-
-Signed-off-by: rpm-build <rpm-build>
----
- tests/gnutls_ktls.c | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/tests/gnutls_ktls.c b/tests/gnutls_ktls.c
-index ccbe566..049c888 100644
---- a/tests/gnutls_ktls.c
-+++ b/tests/gnutls_ktls.c
-@@ -347,7 +347,6 @@ void doit(void)
- {
- 	run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+AES-128-GCM");
- 	run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+AES-256-GCM");
--	run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+CHACHA20-POLY1305");
- 	run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-128-GCM");
- 	run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-256-GCM");
- 	run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+CHACHA20-POLY1305");
--- 
-2.41.0
-

gnutls-3.8.10-tests-ktls.patch

@@ -0,0 +1,114 @@
+From e0eb2bbb212a5c9d72311c59e7235832a0075dcc Mon Sep 17 00:00:00 2001
+From: rpm-build <rpm-build>
+Date: Wed, 9 Jul 2025 18:54:48 +0900
+Subject: [PATCH] add tests/ktls_utils.h
+
+Signed-off-by: rpm-build <rpm-build>
+---
+ tests/ktls_utils.h | 94 ++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 94 insertions(+)
+ create mode 100644 tests/ktls_utils.h
+
+diff --git a/tests/ktls_utils.h b/tests/ktls_utils.h
+new file mode 100644
+index 0000000..231618d
+--- /dev/null
++++ b/tests/ktls_utils.h
+@@ -0,0 +1,94 @@
++#ifndef GNUTLS_TESTS_KTLS_UTILS_H
++#define GNUTLS_TESTS_KTLS_UTILS_H
++
++#include <fcntl.h>
++#include <signal.h>
++
++#include <netinet/in.h>
++
++#include <sys/socket.h>
++#include <sys/wait.h>
++
++/* Sets the NONBLOCK flag on the socket(fd) */
++inline static int set_nonblocking(int fd)
++{
++	int flags = fcntl(fd, F_GETFL, 0);
++	if (flags == -1) {
++		return 1;
++	}
++
++	if (fcntl(fd, F_SETFL, flags | O_NONBLOCK) == -1) {
++		return 2;
++	}
++
++	return 0;
++}
++
++/* Creates a pair of TCP connected sockets */
++static int create_socket_pair(int *client_fd, int *server_fd)
++{
++	int ret;
++	struct sockaddr_in saddr;
++	socklen_t addrlen;
++	int listener;
++
++	listener = socket(AF_INET, SOCK_STREAM, 0);
++	if (listener == -1) {
++		fail("error in listener(): %s\n", strerror(errno));
++		return 1;
++	}
++
++	int opt = 0;
++	setsockopt(listener, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof(opt));
++
++	memset(&saddr, 0, sizeof(saddr));
++	saddr.sin_family = AF_INET;
++	saddr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
++	saddr.sin_port = 0;
++
++	ret = bind(listener, (struct sockaddr *)&saddr, sizeof(saddr));
++	if (ret == -1) {
++		fail("error in bind(): %s\n", strerror(errno));
++		return 1;
++	}
++
++	addrlen = sizeof(saddr);
++	ret = getsockname(listener, (struct sockaddr *)&saddr, &addrlen);
++	if (ret == -1) {
++		fail("error in getsockname(): %s\n", strerror(errno));
++		return 1;
++	}
++
++	ret = listen(listener, 1);
++	if (ret == -1) {
++		fail("error in listen(): %s\n", strerror(errno));
++		close(listener);
++		return 1;
++	}
++
++	*client_fd = socket(AF_INET, SOCK_STREAM, 0);
++	if (*client_fd < 0) {
++		fail("error in socket(): %s\n", strerror(errno));
++		return 1;
++	}
++
++	ret = connect(*client_fd, (struct sockaddr *)&saddr, addrlen);
++	if (ret < 0) {
++		fail("error in connect(): %s\n", strerror(errno));
++		close(listener);
++		close(*client_fd);
++		return 1;
++	}
++
++	*server_fd = accept(listener, NULL, NULL);
++	if (*server_fd < 0) {
++		fail("error in accept(): %s\n", strerror(errno));
++		close(listener);
++		close(*client_fd);
++		return 1;
++	}
++
++	return 0;
++}
++
++#endif //GNUTLS_TESTS_KTLS_UTILS_H
+-- 
+2.49.0
+

gnutls-3.8.10-tests-mldsa.patch

@@ -0,0 +1,58 @@
+From 15fb5ad536c375a74cc0d87859c9fc919d924c9d Mon Sep 17 00:00:00 2001
+From: rpm-build <rpm-build>
+Date: Thu, 10 Jul 2025 05:45:06 +0900
+Subject: [PATCH] support VPATH build for mldsa tests
+
+Signed-off-by: rpm-build <rpm-build>
+---
+ tests/cert-tests/mldsa.sh | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/tests/cert-tests/mldsa.sh b/tests/cert-tests/mldsa.sh
+index 7e31e11..55e31ce 100644
+--- a/tests/cert-tests/mldsa.sh
++++ b/tests/cert-tests/mldsa.sh
+@@ -130,7 +130,7 @@ for variant in 44 65 87; do
+ 	# Check default
+ 	TMPKEYDEFAULT=$testdir/key-$algo-$format-default
+ 	TMPKEY=$testdir/key-$algo-$format
+-	${VALGRIND} "${CERTTOOL}" -k --no-text --infile "data/key-$algo-$format.pem" >"$TMPKEYDEFAULT"
++	${VALGRIND} "${CERTTOOL}" -k --no-text --infile "$srcdir/data/key-$algo-$format.pem" >"$TMPKEYDEFAULT"
+ 	if [ $? != 0 ]; then
+ 	    cat "$TMPKEYDEFAULT"
+ 	    exit 1
+@@ -138,19 +138,19 @@ for variant in 44 65 87; do
+ 
+ 	# The "expandedKey" format doesn't have public key part
+ 	if [ "$format" = seed ] || [ "$format" = both ]; then
+-	    if ! "${DIFF}" "$TMPKEYDEFAULT" "data/key-$algo-both.pem"; then
++	    if ! "${DIFF}" "$TMPKEYDEFAULT" "$srcdir/data/key-$algo-both.pem"; then
+ 		exit 1
+ 	    fi
+ 	fi
+ 
+ 	# Check roundtrip with --key-format
+-	${VALGRIND} "${CERTTOOL}" -k --no-text --key-format "$format" --infile "data/key-$algo-$format.pem" >"$TMPKEY"
++	${VALGRIND} "${CERTTOOL}" -k --no-text --key-format "$format" --infile "$srcdir/data/key-$algo-$format.pem" >"$TMPKEY"
+ 	if [ $? != 0 ]; then
+ 	    cat "$TMPKEY"
+ 	    exit 1
+ 	fi
+ 
+-	if ! "${DIFF}" "$TMPKEY" "data/key-$algo-$format.pem"; then
++	if ! "${DIFF}" "$TMPKEY" "$srcdir/data/key-$algo-$format.pem"; then
+ 	    exit 1
+ 	fi
+     done
+@@ -164,7 +164,7 @@ for n in 1; do
+     fi
+ 
+     echo "Testing inconsistent ML-DSA key ($n)"
+-    if "${CERTTOOL}" -k --infile "data/key-mldsa-inconsistent$n.pem"; then
++    if "${CERTTOOL}" -k --infile "$srcdir/data/key-mldsa-inconsistent$n.pem"; then
+ 	exit 1
+     fi
+ done
+-- 
+2.49.0
+

gnutls-3.8.8-tests-ktls-skip-tls12-chachapoly.patch

@@ -0,0 +1,29 @@
+From a36b73a21e4b5b6e051b23192a645dea34c9d6af Mon Sep 17 00:00:00 2001
+From: Daiki Ueno <ueno@gnu.org>
+Date: Tue, 5 Nov 2024 14:45:46 +0900
+Subject: [PATCH] tests: skip CHACHA20-POLY1305 in TLS 1.2 when KTLS is enabled
+
+Signed-off-by: Daiki Ueno <ueno@gnu.org>
+---
+ tests/gnutls_ktls.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tests/gnutls_ktls.c b/tests/gnutls_ktls.c
+index 90d3e9af91..d5ac4efecc 100644
+--- a/tests/gnutls_ktls.c
++++ b/tests/gnutls_ktls.c
+@@ -347,9 +347,11 @@ void doit(void)
+ {
+ 	run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+AES-128-GCM");
+ 	run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+AES-256-GCM");
++#if 0
+ 	if (!gnutls_fips140_mode_enabled()) {
+ 		run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+CHACHA20-POLY1305");
+ 	}
++#endif
+ 	run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-128-GCM");
+ 	run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-256-GCM");
+ 	if (!gnutls_fips140_mode_enabled()) {
+-- 
+2.47.0
+

gnutls.spec

@@ -12,15 +12,16 @@ sha256sum:close()
 print(string.sub(hash, 0, 16))
 }
 
-Version: 3.8.6
+Version: 3.8.10
 Release: %{?autorelease}%{!?autorelease:1%{?dist}}
 Patch: gnutls-3.2.7-rpath.patch
 
 # follow https://gitlab.com/gnutls/gnutls/-/issues/1443
-Patch: gnutls-3.7.8-ktls_skip_tls12_chachapoly_test.patch
-Patch: gnutls-3.8.6-compression-dlwrap.patch
-Patch: gnutls-3.8.6-liboqs-x25519-kyber768d00.patch
-Patch: gnutls-3.8.6-nettle-rsa-oaep.patch
+Patch: gnutls-3.8.8-tests-ktls-skip-tls12-chachapoly.patch
+# add tests/ktls_utils.h missing in the distribution
+Patch: gnutls-3.8.10-tests-ktls.patch
+# run tests/cert-test/mldsa.sh in VPATH build
+Patch: gnutls-3.8.10-tests-mldsa.patch
 
 %bcond_without bootstrap
 %bcond_without dane
@@ -29,9 +30,14 @@ Patch: gnutls-3.8.6-nettle-rsa-oaep.patch
 %bcond_without tpm2
 %bcond_without gost
 %bcond_without certificate_compression
-%bcond_without liboqs
 %bcond_without tests
 
+%if 0%{?fedora} >= 41 || 0%{?rhel} >= 10
+%bcond_without leancrypto
+%else
+%bcond_with leancrypto
+%endif
+
 %if 0%{?fedora} && 0%{?fedora} < 38
 %bcond_without srp
 %else
@@ -67,13 +73,13 @@ BuildRequires: readline-devel, libtasn1-devel >= 4.3
 %if %{with certificate_compression}
 BuildRequires: zlib-devel, brotli-devel, libzstd-devel
 %endif
-%if %{with liboqs}
-BuildRequires: liboqs-devel
-%endif
 %if %{with bootstrap}
 BuildRequires: automake, autoconf, gperf, libtool, texinfo
 %endif
 BuildRequires: nettle-devel >= 3.10
+%if %{with leancrypto}
+BuildRequires: meson
+%endif
 %if %{with tpm12}
 BuildRequires: trousers-devel >= 0.3.11.2
 %endif
@@ -103,21 +109,21 @@ BuildRequires: unbound-devel unbound-libs
 BuildRequires: make gtk-doc
 
 %if %{with mingw}
+BuildRequires:  mingw32-cpp
 BuildRequires:  mingw32-filesystem >= 95
 BuildRequires:  mingw32-gcc
 BuildRequires:  mingw32-gcc-c++
 BuildRequires:  mingw32-libtasn1 >= 4.3
 BuildRequires:  mingw32-readline
 BuildRequires:  mingw32-zlib
-BuildRequires:  mingw32-p11-kit >= 0.23.1
 BuildRequires:  mingw32-nettle >= 3.6
+BuildRequires:  mingw64-cpp
 BuildRequires:  mingw64-filesystem >= 95
 BuildRequires:  mingw64-gcc
 BuildRequires:  mingw64-gcc-c++
 BuildRequires:  mingw64-libtasn1 >= 4.3
 BuildRequires:  mingw64-readline
 BuildRequires:  mingw64-zlib
-BuildRequires:  mingw64-p11-kit >= 0.23.1
 BuildRequires:  mingw64-nettle >= 3.6
 %endif
 
@@ -133,6 +139,10 @@ Source100:	gmp-6.2.1.tar.xz
 Source101:	gmp-6.2.1-intel-cet.patch
 %endif
 
+%if %{with leancrypto}
+Source300:	leancrypto-1.5.0.tar.gz
+%endif
+
 # Wildcard bundling exception https://fedorahosted.org/fpc/ticket/174
 Provides: bundled(gnulib) = 20130424
 
@@ -267,6 +277,13 @@ popd
 %build
 %define _lto_cflags %{nil}
 
+%if %{with leancrypto}
+mkdir -p bundled_leancrypto
+pushd bundled_leancrypto
+tar --strip-components=1 -xf %{SOURCE300}
+popd
+%endif
+
 %if %{with bundled_gmp}
 pushd bundled_gmp
 autoreconf -ifv
@@ -278,6 +295,39 @@ export GMP_CFLAGS="-I$PWD/bundled_gmp"
 export GMP_LIBS="$PWD/bundled_gmp/.libs/libgmp.a"
 %endif
 
+%if %{with leancrypto}
+pushd bundled_leancrypto
+%set_build_flags
+meson setup -Dprefix="$PWD/install" -Dlibdir="$PWD/install/lib" \
+        -Ddefault_library=static \
+        -Dascon=disabled -Dascon_keccak=disabled \
+        -Dbike_5=disabled -Dbike_3=disabled -Dbike_1=disabled \
+        -Dkyber_x25519=disabled -Ddilithium_ed25519=disabled \
+        -Dx509_parser=disabled -Dx509_generator=disabled \
+        -Dpkcs7_parser=disabled -Dpkcs7_generator=disabled \
+        -Dsha2-256=disabled \
+        -Dchacha20=disabled -Dchacha20_drng=disabled \
+        -Ddrbg_hash=disabled -Ddrbg_hmac=disabled \
+        -Dhash_crypt=disabled \
+        -Dhmac=disabled -Dhkdf=disabled \
+        -Dkdf_ctr=disabled -Dkdf_fb=disabled -Dkdf_dpi=disabled \
+        -Dpbkdf2=disabled \
+        -Dkmac_drng=disabled -Dcshake_drng=disabled \
+        -Dhotp=disabled -Dtotp=disabled \
+        -Daes_block=disabled -Daes_cbc=disabled -Daes_ctr=disabled \
+        -Daes_kw=disabled -Dapps=disabled \
+        _build
+meson compile -C _build
+meson install -C _build
+
+popd
+
+export LEANCRYPTO_DIR="$PWD/bundled_leancrypto/install"
+
+export LEANCRYPTO_CFLAGS="-I$LEANCRYPTO_DIR/include"
+export LEANCRYPTO_LIBS="$LEANCRYPTO_DIR/lib/libleancrypto.a"
+%endif
+
 %if %{with bootstrap}
 autoreconf -fi
 %endif
@@ -297,6 +347,7 @@ export FIPS_MODULE_NAME="$OS_NAME ${OS_VERSION_ID%%.*} %name"
 
 mkdir native_build
 pushd native_build
+
 %global _configure ../configure
 %configure \
 %if %{with fips}
@@ -344,15 +395,18 @@ pushd native_build
 %else
 	   --without-zlib --without-brotli --without-zstd \
 %endif
-%if %{with liboqs}
-           --with-liboqs \
+%if %{with leancrypto}
+           --with-leancrypto \
 %else
-           --without-liboqs \
+           --without-leancrypto \
 %endif
            --disable-rpath \
            --with-default-priority-string="@SYSTEM"
 
 %make_build
+%if %{with leancrypto}
+sed -i '/^Requires.private:/s/leancrypto[ ,]*//g' lib/gnutls.pc
+%endif
 popd
 
 %if %{with mingw}
@@ -370,12 +424,12 @@ export CCASFLAGS=""
     --disable-rpath \
     --disable-nls \
     --disable-cxx \
-    --enable-local-libopts \
     --enable-shared \
     --without-tpm \
     --with-included-unistring \
     --disable-doc \
-    --with-default-priority-string="@SYSTEM"
+    --with-default-priority-string="@SYSTEM" \
+    --without-p11-kit
 %mingw_make %{?_smp_mflags}
 %endif
 
@@ -443,22 +497,7 @@ rm -f $RPM_BUILD_ROOT%{mingw64_libdir}/ncrypt.dll*
 %check
 %if %{with tests}
 pushd native_build
-
-# KeyUpdate is not yet supported in the kernel.
-xfail_tests=ktls_keyupdate.sh
-
-# The ktls.sh test currently only supports kernel 5.11+.  This needs to
-# be checked at run time, as the koji builder might be using a different
-# version of kernel on the host than the one indicated by the
-# kernel-devel package.
-
-case "$(uname -r)" in
-  4.* | 5.[0-9].* | 5.10.* )
-    xfail_tests="$xfail_tests ktls.sh"
-    ;;
-esac
-
-make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null XFAIL_TESTS="$xfail_tests"
+make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null || { cat tests/test-suite.log tests/cert-tests/test-suite.log tests/slow/test-suite.log src/gl/tests/test-suite.log; exit 1; }
 popd
 %endif
 
@@ -468,7 +507,7 @@ popd
 %{_libdir}/.libgnutls.so.30*.hmac
 %endif
 %doc README.md AUTHORS NEWS THANKS
-%license LICENSE doc/COPYING doc/COPYING.LESSER
+%license COPYING COPYING.LESSERv2
 
 %files c++
 %{_libdir}/libgnutlsxx.so.*
@@ -512,14 +551,14 @@ popd
 
 %if %{with mingw}
 %files -n mingw32-%{name}
-%license LICENSE doc/COPYING doc/COPYING.LESSER
+%license COPYING COPYING.LESSERv2
 %{mingw32_bindir}/certtool.exe
 %{mingw32_bindir}/gnutls-cli-debug.exe
 %{mingw32_bindir}/gnutls-cli.exe
 %{mingw32_bindir}/gnutls-serv.exe
 %{mingw32_bindir}/libgnutls-30.dll
 %{mingw32_bindir}/ocsptool.exe
-%{mingw32_bindir}/p11tool.exe
+#%%{mingw32_bindir}/p11tool.exe
 %{mingw32_bindir}/psktool.exe
 %if %{with srp}
 %{mingw32_bindir}/srptool.exe
@@ -530,14 +569,14 @@ popd
 %{mingw32_includedir}/gnutls/
 
 %files -n mingw64-%{name}
-%license LICENSE doc/COPYING doc/COPYING.LESSER
+%license COPYING COPYING.LESSERv2
 %{mingw64_bindir}/certtool.exe
 %{mingw64_bindir}/gnutls-cli-debug.exe
 %{mingw64_bindir}/gnutls-cli.exe
 %{mingw64_bindir}/gnutls-serv.exe
 %{mingw64_bindir}/libgnutls-30.dll
 %{mingw64_bindir}/ocsptool.exe
-%{mingw64_bindir}/p11tool.exe
+#%%{mingw64_bindir}/p11tool.exe
 %{mingw64_bindir}/psktool.exe
 %if %{with srp}
 %{mingw64_bindir}/srptool.exe

sources

@@ -1,4 +1,5 @@
-SHA512 (gnutls-3.8.6.tar.xz) = 58631c456dfb43f8cb6a1703ffa91c593a33357f37dc146e808d88692e19c7ac10aeabea40bee9952205be97e00648879e9f0fa80e670e8e695f8633ba726513
-SHA512 (gnutls-3.8.6.tar.xz.sig) = 3f9552cdf5fa96184fbe394dd484fb55e6a3577d1e048aea373b82cda335ea0f174f2fb11926dc58532c1f950cd10a6a35bc36e9fe813a1259eae5c5364920b2
+SHA512 (gnutls-3.8.10.tar.xz) = d453bd4527af95cb3905ce8753ceafd969e3f442ad1d148544a233ebf13285b999930553a805a0511293cc25390bb6a040260df5544a7c55019640f920ad3d92
+SHA512 (gnutls-3.8.10.tar.xz.sig) = 72d6dd2c23f768f5041c3dca0f49b3f60cd01fc960ce77f097094a2aae6d76fddeb6295c425e3750c711d5f700957a62268aecc4873e53c31abb60eecf0fd4a8
 SHA512 (gnutls-release-keyring.gpg) = 8c2b39239d1d8c5319757fcf669f28a11de7f8ec4a726f9904c57ba8105bea80240083c0de71b747115907bab46569f10cf58004137cc7884ac5c20f8319ae0a
 SHA512 (gmp-6.2.1.tar.xz) = c99be0950a1d05a0297d65641dd35b75b74466f7bf03c9e8a99895a3b2f9a0856cd17887738fa51cf7499781b65c049769271cbcb77d057d2e9f1ec52e07dd84
+SHA512 (leancrypto-1.5.0.tar.gz) = 1170a502f58c9bce424578cece64a3ebf856620adc02f390b8877981bccf0c2bf35e64b1628094a06c069ec38a3be5889be22516d45d85f4e75b40085d9001c9