[packit] 3.7.6 upstream release

Upstream tag: 3.7.6
Upstream commit: 1f8b1ff2

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>

.fmf/version

@@ -1 +0,0 @@
-1

.gitignore

@@ -139,37 +139,3 @@ gnutls-2.10.1-nosrp.tar.bz2
 /gnutls-3.7.4.tar.xz
 /gnutls-3.7.5.tar.xz
 /gnutls-3.7.6.tar.xz
-/gnutls-3.7.7.tar.xz
-/gnutls-3.7.8.tar.xz
-/gnutls-3.8.0.tar.xz
-/gnutls-3.8.0.tar.xz.sig
-/gnutls-release-keyring.gpg
-/gnutls-3.8.1.tar.xz
-/gnutls-3.8.1.tar.xz.sig
-/gnutls-3.8.2.tar.xz
-/gnutls-3.8.2.tar.xz.sig
-/gnutls-3.8.3.tar.xz
-/gnutls-3.8.3.tar.xz.sig
-/gnutls-3.8.4.tar.xz
-/gnutls-3.8.4.tar.xz.sig
-/gnutls-3.8.5.tar.xz
-/gnutls-3.8.5.tar.xz.sig
-/gnutls-3.8.6.tar.xz
-/gnutls-3.8.6.tar.xz.sig
-/gmp-6.2.1.tar.xz
-/gnutls-3.8.7.tar.xz
-/gnutls-3.8.7.tar.xz.sig
-/gnutls-3.8.7.1.tar.xz
-/gnutls-3.8.7.1.tar.xz.sig
-/gnutls-3.8.8.tar.xz
-/gnutls-3.8.8.tar.xz.sig
-/gnutls-3.8.9.tar.xz
-/gnutls-3.8.9.tar.xz.sig
-/leancrypto-1.2.0.tar.gz
-/leancrypto-1.3.0.tar.gz
-/gnutls-3.8.10.tar.xz
-/gnutls-3.8.10.tar.xz.sig
-/leancrypto-1.5.0.tar.gz
-/gnutls-3.8.11.tar.xz
-/gnutls-3.8.11.tar.xz.sig
-/leancrypto-1.6.0.tar.gz

.packit.yaml

@@ -15,6 +15,7 @@ actions:
   post-upstream-clone:
     - "wget https://src.fedoraproject.org/rpms/gnutls/raw/main/f/gnutls.spec"
     - "wget https://src.fedoraproject.org/rpms/gnutls/raw/main/f/gnutls-3.2.7-rpath.patch"
+    - "wget https://src.fedoraproject.org/rpms/gnutls/raw/main/f/gnutls-3.6.7-no-now-guile.patch"
   get-current-version:
     - "git describe --abbrev=0"
   create-archive:
@@ -28,4 +29,5 @@ actions:
 jobs:
   - job: propose_downstream
     trigger: release
-    dist_git_branches: fedora-all
+    metadata:
+      dist_git_branches: fedora-all

README.packit

@@ -1,3 +1,3 @@
 This repository is maintained by packit.
 https://packit.dev/
-The file was generated using packit 1.12.0.
+The file was generated using packit 0.51.0.

changelog

@@ -1,13 +1,5 @@
-* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 3.7.3-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
-
-* Tue Jan 18 2022 Daiki Ueno <dueno@redhat.com> - 3.7.3-1
-- Update to upstream 3.7.3 release
-- Remove dependency on autogen
-- Add build-time conditionals for TPM 1.2 and GOST cryptography
-
-* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 3.7.2-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+* Thu Feb 24 2022 Zoltan Fridrich <zfridric@redhat.com> - 3.7.2-2
+- Fix race condition in gnutls_x509_trust_list_verify_crt2 (#2050164)
 
 * Sat May 29 2021 Daiki Ueno <dueno@redhat.com> - 3.7.2-1
 - Update to upstream 3.7.2 release

ci.fmf

@@ -1 +0,0 @@
-resultsdb-testcase: separate

gating.yml

@@ -1,14 +0,0 @@
---- !Policy
-product_versions:
-  - fedora-*
-decision_context: bodhi_update_push_testing
-subject_type: koji_build
-rules:
-  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}
---- !Policy
-product_versions:
-  - fedora-*
-decision_context: bodhi_update_push_stable
-subject_type: koji_build
-rules:
-  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}

gmp-6.2.1-c23.patch

@@ -1,13 +0,0 @@
-diff --git a/acinclude.m4 b/acinclude.m4
-index 906071c..a466b7c 100644
---- a/acinclude.m4
-+++ b/acinclude.m4
-@@ -609,7 +609,7 @@ GMP_PROG_CC_WORKS_PART([$1], [long long reliability test 1],
- 
- #if defined (__GNUC__) && ! defined (__cplusplus)
- typedef unsigned long long t1;typedef t1*t2;
--void g(){}
-+void g(int, t2, t1, t2, t2, int){}
- void h(){}
- static __inline__ t1 e(t2 rp,t2 up,int n,t1 v0)
- {t1 c,x,r;int i;if(v0){c=1;for(i=1;i<n;i++){x=up[i];r=x+1;rp[i]=r;}}return c;}

gnutls-3.6.7-no-now-guile.patch

@@ -0,0 +1,11 @@
+--- a/guile/src/Makefile.in	2019-03-27 11:51:55.984398001 +0100
++++ b/guile/src/Makefile.in	2019-03-27 11:52:27.259626076 +0100
+@@ -1472,7 +1472,7 @@
+ # Use '-module' to build a "dlopenable module", in Libtool terms.
+ # Use '-undefined' to placate Libtool on Windows; see
+ # <https://lists.gnutls.org/pipermail/gnutls-devel/2014-December/007294.html>.
+-guile_gnutls_v_2_la_LDFLAGS = -module -no-undefined
++guile_gnutls_v_2_la_LDFLAGS = -module -no-undefined -Wl,-z,lazy
+ 
+ # Linking against GnuTLS.
+ GNUTLS_CORE_LIBS = $(top_builddir)/lib/libgnutls.la

gnutls-3.7.3-fix-race-condition.patch

@@ -0,0 +1,45 @@
+From 22f837ba0bc7d13c3d738a8583566368fc12aee1 Mon Sep 17 00:00:00 2001
+From: Daiki Ueno <ueno@gnu.org>
+Date: Sat, 30 Oct 2021 08:56:07 +0200
+Subject: [PATCH] x509: fix thread-safety in gnutls_x509_trust_list_verify_crt2
+
+This function previously used gnutls_x509_trust_list_get_issuer
+without GNUTLS_TL_GET_COPY flag, which is required when the function
+is called from multi-threaded application and PKCS #11 trust store is
+in use.
+
+Reported and the change suggested by Remi Gacogne in:
+https://gitlab.com/gnutls/gnutls/-/issues/1277
+
+Signed-off-by: Daiki Ueno <ueno@gnu.org>
+---
+ lib/x509/verify-high.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/lib/x509/verify-high.c b/lib/x509/verify-high.c
+index ab8e006ca7..5698d4f372 100644
+--- a/lib/x509/verify-high.c
++++ b/lib/x509/verify-high.c
+@@ -1102,7 +1102,8 @@ int trust_list_get_issuer_by_dn(gnutls_x509_trust_list_t list,
+  * gnutls_x509_trust_list_get_issuer:
+  * @list: The list
+  * @cert: is the certificate to find issuer for
+- * @issuer: Will hold the issuer if any. Should be treated as constant.
++ * @issuer: Will hold the issuer if any. Should be treated as constant
++ *   unless %GNUTLS_TL_GET_COPY is set in @flags.
+  * @flags: flags from %gnutls_trust_list_flags_t (%GNUTLS_TL_GET_COPY is applicable)
+  *
+  * This function will find the issuer of the given certificate.
+@@ -1521,7 +1522,8 @@ gnutls_x509_trust_list_verify_crt2(gnutls_x509_trust_list_t list,
+ 		if (gnutls_x509_trust_list_get_issuer(list,
+ 						      cert_list[i - 1],
+ 						      &issuer,
+-						      0) == 0) {
++						      GNUTLS_TL_GET_COPY) == 0) {
++			gnutls_x509_crt_deinit(issuer);
+ 			cert_list_size = i;
+ 			break;
+ 		}
+-- 
+GitLab
+

gnutls-3.8.10-tests-ktls.patch

@@ -1,114 +0,0 @@
-From e0eb2bbb212a5c9d72311c59e7235832a0075dcc Mon Sep 17 00:00:00 2001
-From: rpm-build <rpm-build>
-Date: Wed, 9 Jul 2025 18:54:48 +0900
-Subject: [PATCH] add tests/ktls_utils.h
-
-Signed-off-by: rpm-build <rpm-build>
----
- tests/ktls_utils.h | 94 ++++++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 94 insertions(+)
- create mode 100644 tests/ktls_utils.h
-
-diff --git a/tests/ktls_utils.h b/tests/ktls_utils.h
-new file mode 100644
-index 0000000..231618d
---- /dev/null
-+++ b/tests/ktls_utils.h
-@@ -0,0 +1,94 @@
-+#ifndef GNUTLS_TESTS_KTLS_UTILS_H
-+#define GNUTLS_TESTS_KTLS_UTILS_H
-+
-+#include <fcntl.h>
-+#include <signal.h>
-+
-+#include <netinet/in.h>
-+
-+#include <sys/socket.h>
-+#include <sys/wait.h>
-+
-+/* Sets the NONBLOCK flag on the socket(fd) */
-+inline static int set_nonblocking(int fd)
-+{
-+	int flags = fcntl(fd, F_GETFL, 0);
-+	if (flags == -1) {
-+		return 1;
-+	}
-+
-+	if (fcntl(fd, F_SETFL, flags | O_NONBLOCK) == -1) {
-+		return 2;
-+	}
-+
-+	return 0;
-+}
-+
-+/* Creates a pair of TCP connected sockets */
-+static int create_socket_pair(int *client_fd, int *server_fd)
-+{
-+	int ret;
-+	struct sockaddr_in saddr;
-+	socklen_t addrlen;
-+	int listener;
-+
-+	listener = socket(AF_INET, SOCK_STREAM, 0);
-+	if (listener == -1) {
-+		fail("error in listener(): %s\n", strerror(errno));
-+		return 1;
-+	}
-+
-+	int opt = 0;
-+	setsockopt(listener, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof(opt));
-+
-+	memset(&saddr, 0, sizeof(saddr));
-+	saddr.sin_family = AF_INET;
-+	saddr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
-+	saddr.sin_port = 0;
-+
-+	ret = bind(listener, (struct sockaddr *)&saddr, sizeof(saddr));
-+	if (ret == -1) {
-+		fail("error in bind(): %s\n", strerror(errno));
-+		return 1;
-+	}
-+
-+	addrlen = sizeof(saddr);
-+	ret = getsockname(listener, (struct sockaddr *)&saddr, &addrlen);
-+	if (ret == -1) {
-+		fail("error in getsockname(): %s\n", strerror(errno));
-+		return 1;
-+	}
-+
-+	ret = listen(listener, 1);
-+	if (ret == -1) {
-+		fail("error in listen(): %s\n", strerror(errno));
-+		close(listener);
-+		return 1;
-+	}
-+
-+	*client_fd = socket(AF_INET, SOCK_STREAM, 0);
-+	if (*client_fd < 0) {
-+		fail("error in socket(): %s\n", strerror(errno));
-+		return 1;
-+	}
-+
-+	ret = connect(*client_fd, (struct sockaddr *)&saddr, addrlen);
-+	if (ret < 0) {
-+		fail("error in connect(): %s\n", strerror(errno));
-+		close(listener);
-+		close(*client_fd);
-+		return 1;
-+	}
-+
-+	*server_fd = accept(listener, NULL, NULL);
-+	if (*server_fd < 0) {
-+		fail("error in accept(): %s\n", strerror(errno));
-+		close(listener);
-+		close(*client_fd);
-+		return 1;
-+	}
-+
-+	return 0;
-+}
-+
-+#endif //GNUTLS_TESTS_KTLS_UTILS_H
--- 
-2.49.0
-

gnutls-3.8.10-tests-mldsa.patch

@@ -1,58 +0,0 @@
-From 15fb5ad536c375a74cc0d87859c9fc919d924c9d Mon Sep 17 00:00:00 2001
-From: rpm-build <rpm-build>
-Date: Thu, 10 Jul 2025 05:45:06 +0900
-Subject: [PATCH] support VPATH build for mldsa tests
-
-Signed-off-by: rpm-build <rpm-build>
----
- tests/cert-tests/mldsa.sh | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/tests/cert-tests/mldsa.sh b/tests/cert-tests/mldsa.sh
-index 7e31e11..55e31ce 100644
---- a/tests/cert-tests/mldsa.sh
-+++ b/tests/cert-tests/mldsa.sh
-@@ -130,7 +130,7 @@ for variant in 44 65 87; do
- 	# Check default
- 	TMPKEYDEFAULT=$testdir/key-$algo-$format-default
- 	TMPKEY=$testdir/key-$algo-$format
--	${VALGRIND} "${CERTTOOL}" -k --no-text --infile "data/key-$algo-$format.pem" >"$TMPKEYDEFAULT"
-+	${VALGRIND} "${CERTTOOL}" -k --no-text --infile "$srcdir/data/key-$algo-$format.pem" >"$TMPKEYDEFAULT"
- 	if [ $? != 0 ]; then
- 	    cat "$TMPKEYDEFAULT"
- 	    exit 1
-@@ -138,19 +138,19 @@ for variant in 44 65 87; do
- 
- 	# The "expandedKey" format doesn't have public key part
- 	if [ "$format" = seed ] || [ "$format" = both ]; then
--	    if ! "${DIFF}" "$TMPKEYDEFAULT" "data/key-$algo-both.pem"; then
-+	    if ! "${DIFF}" "$TMPKEYDEFAULT" "$srcdir/data/key-$algo-both.pem"; then
- 		exit 1
- 	    fi
- 	fi
- 
- 	# Check roundtrip with --key-format
--	${VALGRIND} "${CERTTOOL}" -k --no-text --key-format "$format" --infile "data/key-$algo-$format.pem" >"$TMPKEY"
-+	${VALGRIND} "${CERTTOOL}" -k --no-text --key-format "$format" --infile "$srcdir/data/key-$algo-$format.pem" >"$TMPKEY"
- 	if [ $? != 0 ]; then
- 	    cat "$TMPKEY"
- 	    exit 1
- 	fi
- 
--	if ! "${DIFF}" "$TMPKEY" "data/key-$algo-$format.pem"; then
-+	if ! "${DIFF}" "$TMPKEY" "$srcdir/data/key-$algo-$format.pem"; then
- 	    exit 1
- 	fi
-     done
-@@ -164,7 +164,7 @@ for n in 1; do
-     fi
- 
-     echo "Testing inconsistent ML-DSA key ($n)"
--    if "${CERTTOOL}" -k --infile "data/key-mldsa-inconsistent$n.pem"; then
-+    if "${CERTTOOL}" -k --infile "$srcdir/data/key-mldsa-inconsistent$n.pem"; then
- 	exit 1
-     fi
- done
--- 
-2.49.0
-

gnutls-3.8.6-nettle-rsa-oaep.patch

@@ -1,27 +0,0 @@
-From a9800309197fe5aef913944b2fc77164946f0689 Mon Sep 17 00:00:00 2001
-From: Daiki Ueno <ueno@gnu.org>
-Date: Tue, 23 Jul 2024 16:04:56 +0900
-Subject: [PATCH] build: link against libhogweed when checking
- nettle_rsa_oaep_*
-
-Signed-off-by: Daiki Ueno <ueno@gnu.org>
----
- configure.ac | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/configure.ac b/configure.ac
-index fb0aefe1f4..8b55808bd7 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -795,7 +795,7 @@ AM_CONDITIONAL([NEED_SIV_GCM], [test "$ac_cv_func_nettle_siv_gcm_encrypt_message
- 
- # Check for RSA-OAEP
- save_LIBS=$LIBS
--LIBS="$LIBS $NETTLE_LIBS"
-+LIBS="$LIBS $HOGWEED_LIBS $NETTLE_LIBS $GMP_LIBS"
- AC_CHECK_FUNCS(nettle_rsa_oaep_sha256_encrypt)
- LIBS=$save_LIBS
- AM_CONDITIONAL([NEED_RSA_OAEP], [test "$ac_cv_func_nettle_rsa_oaep_sha256_encrypt" != yes])
--- 
-2.45.2
-

gnutls-3.8.8-tests-ktls-skip-tls12-chachapoly.patch

@@ -1,29 +0,0 @@
-From a36b73a21e4b5b6e051b23192a645dea34c9d6af Mon Sep 17 00:00:00 2001
-From: Daiki Ueno <ueno@gnu.org>
-Date: Tue, 5 Nov 2024 14:45:46 +0900
-Subject: [PATCH] tests: skip CHACHA20-POLY1305 in TLS 1.2 when KTLS is enabled
-
-Signed-off-by: Daiki Ueno <ueno@gnu.org>
----
- tests/gnutls_ktls.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/tests/gnutls_ktls.c b/tests/gnutls_ktls.c
-index 90d3e9af91..d5ac4efecc 100644
---- a/tests/gnutls_ktls.c
-+++ b/tests/gnutls_ktls.c
-@@ -347,9 +347,11 @@ void doit(void)
- {
- 	run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+AES-128-GCM");
- 	run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+AES-256-GCM");
-+#if 0
- 	if (!gnutls_fips140_mode_enabled()) {
- 		run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+CHACHA20-POLY1305");
- 	}
-+#endif
- 	run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-128-GCM");
- 	run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-256-GCM");
- 	if (!gnutls_fips140_mode_enabled()) {
--- 
-2.47.0
-

gnutls.spec

@@ -1,94 +1,39 @@
-%define srpmhash() %{lua:
-local files = rpm.expand("%_specdir/gnutls.spec")
-for i, p in ipairs(patches) do
-   files = files.." "..p
-end
-for i, p in ipairs(sources) do
-   files = files.." "..p
-end
-local sha256sum = assert(io.popen("cat "..files.."| sha256sum"))
-local hash = sha256sum:read("*a")
-sha256sum:close()
-print(string.sub(hash, 0, 16))
-}
-
-Version: 3.8.11
-Release: %{?autorelease}%{!?autorelease:1%{?dist}}
-Patch: gnutls-3.2.7-rpath.patch
-
-# follow https://gitlab.com/gnutls/gnutls/-/issues/1443
-Patch: gnutls-3.8.8-tests-ktls-skip-tls12-chachapoly.patch
-
-%bcond_without bootstrap
+# This spec file has been automatically updated
+Version: 3.7.6
+Release: %{?autorel}%{!?autorel:1}%{?dist}
+Patch1:	gnutls-3.6.7-no-now-guile.patch
+Patch2:	gnutls-3.2.7-rpath.patch
+%bcond_with bootstrap
 %bcond_without dane
+%if 0%{?rhel}
+%bcond_with guile
 %bcond_without fips
+%else
+%bcond_without guile
+%bcond_without fips
+%endif
 %bcond_with tpm12
-%bcond_without tpm2
-%if 0%{?rhel} >= 9
-%bcond_with gost
-%else
 %bcond_without gost
-%endif
-%bcond_without certificate_compression
-%bcond_without leancrypto
-%bcond_without crypto_auditing
-%bcond_without tests
-
-%if 0%{?fedora} && 0%{?fedora} < 38
-%bcond_without srp
-%else
-%bcond_with srp
-%endif
-
-%if 0%{?fedora}
-%bcond_without mingw
-%else
-%bcond_with mingw
-%endif
-
-%if 0%{?rhel} >= 9 && %{with fips}
-%bcond_without bundled_gmp
-%else
-%bcond_with bundled_gmp
-%endif
-
-
-%define fips_requires() %{lua:
-local f = assert(io.popen("rpm -q --queryformat '%{EVR}' --whatprovides "..rpm.expand("'%1%{?_isa}'")))
-local v = f:read("*all")
-f:close()
-print("Requires: "..rpm.expand("%1%{?_isa}").." = "..v.."\\n")
-}
 
 Summary: A TLS protocol implementation
 Name: gnutls
 # The libraries are LGPLv2.1+, utilities are GPLv3+
-License: GPL-3.0-or-later AND LGPL-2.1-or-later
+License: GPLv3+ and LGPLv2+
 BuildRequires: p11-kit-devel >= 0.21.3, gettext-devel
-BuildRequires: readline-devel, libtasn1-devel >= 4.3
-%if %{with certificate_compression}
-BuildRequires: zlib-devel, brotli-devel, libzstd-devel
-%endif
+BuildRequires: zlib-devel, readline-devel, libtasn1-devel >= 4.3
 %if %{with bootstrap}
 BuildRequires: automake, autoconf, gperf, libtool, texinfo
 %endif
-BuildRequires: nettle-devel >= 3.10.1
-%if %{with leancrypto}
-BuildRequires: meson
-%endif
+BuildRequires: nettle-devel >= 3.5.1
 %if %{with tpm12}
 BuildRequires: trousers-devel >= 0.3.11.2
 %endif
-%if %{with tpm2}
-BuildRequires: tpm2-tss-devel >= 3.0.3
-%endif
 BuildRequires: libidn2-devel
 BuildRequires: libunistring-devel
-BuildRequires: net-tools, softhsm, gcc, gcc-c++
+BuildRequires: net-tools, datefudge, softhsm, gcc, gcc-c++
 BuildRequires: gnupg2
-BuildRequires: git-core
-%if %{with crypto_auditing}
-BuildRequires: systemtap-sdt-devel
+%if %{with fips}
+BuildRequires: fipscheck
 %endif
 
 # for a sanity check on cert loading
@@ -96,8 +41,7 @@ BuildRequires: p11-kit-trust, ca-certificates
 Requires: crypto-policies
 Requires: p11-kit-trust
 Requires: libtasn1 >= 4.3
-# always bump when a nettle release is packaged
-Requires: nettle >= 3.10.1
+Requires: nettle >= 3.4.1
 %if %{with tpm12}
 Recommends: trousers >= 0.3.11.2
 %endif
@@ -105,45 +49,15 @@ Recommends: trousers >= 0.3.11.2
 %if %{with dane}
 BuildRequires: unbound-devel unbound-libs
 %endif
-BuildRequires: make gtk-doc
-
-%if %{with mingw}
-BuildRequires:  mingw32-cpp
-BuildRequires:  mingw32-filesystem >= 95
-BuildRequires:  mingw32-gcc
-BuildRequires:  mingw32-gcc-c++
-BuildRequires:  mingw32-libtasn1 >= 4.3
-BuildRequires:  mingw32-readline
-BuildRequires:  mingw32-zlib
-BuildRequires:  mingw32-nettle >= 3.6
-BuildRequires:  mingw64-cpp
-BuildRequires:  mingw64-filesystem >= 95
-BuildRequires:  mingw64-gcc
-BuildRequires:  mingw64-gcc-c++
-BuildRequires:  mingw64-libtasn1 >= 4.3
-BuildRequires:  mingw64-readline
-BuildRequires:  mingw64-zlib
-BuildRequires:  mingw64-nettle >= 3.6
+%if %{with guile}
+BuildRequires: guile22-devel
 %endif
-
+BuildRequires: make
 URL: http://www.gnutls.org/
 %define short_version %(echo %{version} | grep -m1 -o "[0-9]*\.[0-9]*" | head -1)
 Source0: https://www.gnupg.org/ftp/gcrypt/gnutls/v%{short_version}/%{name}-%{version}.tar.xz
 Source1: https://www.gnupg.org/ftp/gcrypt/gnutls/v%{short_version}/%{name}-%{version}.tar.xz.sig
-Source2: https://gnutls.org/gnutls-release-keyring.gpg
-
-%if %{with bundled_gmp}
-Provides:	bundled(gmp) = 6.2.1
-Source100:	gmp-6.2.1.tar.xz
-# Taken from the main gmp package
-Source101:	gmp-6.2.1-intel-cet.patch
-Source102:	gmp-6.2.1-c23.patch
-%endif
-
-%if %{with leancrypto}
-Provides:	bundled(leancrypto) = 1.6.0
-Source300:	leancrypto-1.6.0.tar.gz
-%endif
+Source2: gnutls-release-keyring.gpg
 
 # Wildcard bundling exception https://fedorahosted.org/fpc/ticket/174
 Provides: bundled(gnulib) = 20130424
@@ -162,7 +76,7 @@ Requires: %{name}-dane%{?_isa} = %{version}-%{release}
 Requires: pkgconfig
 
 %package utils
-License: GPL-3.0-or-later
+License: GPLv3+
 Summary: Command line tools for TLS protocol
 Requires: %{name}%{?_isa} = %{version}-%{release}
 %if %{with dane}
@@ -175,14 +89,11 @@ Summary: A DANE protocol implementation for GnuTLS
 Requires: %{name}%{?_isa} = %{version}-%{release}
 %endif
 
-%if %{with fips}
-%package fips
-Summary: Virtual package to install packages required to use %{name} under FIPS mode
+%if %{with guile}
+%package guile
+Summary: Guile bindings for the GNUTLS library
 Requires: %{name}%{?_isa} = %{version}-%{release}
-%{fips_requires nettle}
-%if !%{with bundled_gmp}
-%{fips_requires gmp}
-%endif
+Requires: guile22
 %endif
 
 %description
@@ -228,114 +139,22 @@ This package contains library that implements the DANE protocol for verifying
 TLS certificates through DNSSEC.
 %endif
 
-%if %{with fips}
-%description fips
+%if %{with guile}
+%description guile
 GnuTLS is a secure communications library implementing the SSL, TLS and DTLS 
 protocols and technologies around them. It provides a simple C language 
 application programming interface (API) to access the secure communications 
 protocols as well as APIs to parse and write X.509, PKCS #12, OpenPGP and 
-other required structures.
-This package does not contain any file, but installs required packages
-to use GnuTLS under FIPS mode.
-%endif
-
-%if %{with mingw}
-%package -n mingw32-%{name}
-Summary:        MinGW GnuTLS TLS/SSL encryption library
-Requires:       pkgconfig
-Requires:       mingw32-libtasn1 >= 4.3
-BuildArch:      noarch
-
-%description -n mingw32-gnutls
-GnuTLS TLS/SSL encryption library.  This library is cross-compiled
-for MinGW.
-
-%package -n mingw64-%{name}
-Summary:        MinGW GnuTLS TLS/SSL encryption library
-Requires:       pkgconfig
-Requires:       mingw64-libtasn1 >= 4.3
-BuildArch:      noarch
-
-%description -n mingw64-gnutls
-GnuTLS TLS/SSL encryption library.  This library is cross-compiled
-for MinGW.
-
-%{?mingw_debug_package}
+other required structures. 
+This package contains Guile bindings for the library.
 %endif
 
 %prep
 %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
 
-%autosetup -p1 -S git
-
-%if %{with bundled_gmp}
-mkdir -p bundled_gmp
-pushd bundled_gmp
-tar --strip-components=1 -xf %{SOURCE100}
-patch -p1 < %{SOURCE101}
-patch -p1 < %{SOURCE102}
-popd
-%endif
-
-%build
-%define _lto_cflags %{nil}
-
-%if %{with leancrypto}
-mkdir -p bundled_leancrypto
-pushd bundled_leancrypto
-tar --strip-components=1 -xf %{SOURCE300}
-popd
-%endif
-
-%if %{with bundled_gmp}
-pushd bundled_gmp
-autoreconf -ifv
-%configure --disable-cxx --disable-shared --enable-fat --with-pic
-%make_build
-popd
-
-export GMP_CFLAGS="-I$PWD/bundled_gmp"
-export GMP_LIBS="$PWD/bundled_gmp/.libs/libgmp.a"
-%endif
-
-%if %{with leancrypto}
-pushd bundled_leancrypto
-%set_build_flags
-meson setup -Dprefix="$PWD/install" -Dlibdir="$PWD/install/lib" \
-        -Ddefault_library=static \
-        -Dascon=disabled -Dascon_keccak=disabled \
-        -Dbike_5=disabled -Dbike_3=disabled -Dbike_1=disabled \
-        -Dkyber_x25519=disabled -Ddilithium_ed25519=disabled \
-        -Dx509_parser=disabled -Dx509_generator=disabled \
-        -Dpkcs7_parser=disabled -Dpkcs7_generator=disabled \
-        -Dsha2-256=disabled \
-        -Daes_gcm=disabled -Daes_cbc=disabled -Daes_ctr=disabled -Daes_xts=disabled \
-        -Dchacha20=disabled -Dchacha20poly1305=disabled -Dchacha20_drng=disabled \
-        -Ddrbg_hash=disabled -Ddrbg_hmac=disabled \
-        -Dhash_crypt=disabled \
-        -Dhmac=disabled -Dhkdf=disabled \
-        -Dkdf_ctr=disabled -Dkdf_fb=disabled -Dkdf_dpi=disabled \
-        -Dpbkdf2=disabled \
-        -Dkmac_drng=disabled -Dcshake_drng=disabled \
-        -Dhotp=disabled -Dtotp=disabled \
-        -Daes_block=disabled -Daes_cbc=disabled -Daes_ctr=disabled \
-        -Daes_kw=disabled -Dapps=disabled \
-        -Ddisable-asm=true \
-        _build
-# the reason for -Ddisable-asm=true being bz2416812
-# revert once the root cause is fixed
-meson compile -C _build
-meson install -C _build
-
-popd
-
-export LEANCRYPTO_DIR="$PWD/bundled_leancrypto/install"
-
-export LEANCRYPTO_CFLAGS="-I$LEANCRYPTO_DIR/include"
-export LEANCRYPTO_LIBS="$LEANCRYPTO_DIR/lib/libleancrypto.a"
-%endif
-
+%autosetup -p1
 %if %{with bootstrap}
+rm -f src/libopts/*.c src/libopts/*.h src/libopts/compat/*.c src/libopts/compat/*.h
 autoreconf -fi
 %endif
 
@@ -344,34 +163,32 @@ rm -f lib/minitasn1/*.c lib/minitasn1/*.h
 
 echo "SYSTEM=NORMAL" >> tests/system.prio
 
+# Note that we explicitly enable SHA1, as SHA1 deprecation is handled
+# via the crypto policies
+
+%build
+%define _lto_cflags %{nil}
+
 CCASFLAGS="$CCASFLAGS -Wa,--generate-missing-build-notes=yes"
 export CCASFLAGS
 
-%if %{with fips}
-eval $(sed -n 's/^\(\(NAME\|VERSION_ID\)=.*\)/OS_\1/p' /etc/os-release)
-export FIPS_MODULE_NAME="$OS_NAME ${OS_VERSION_ID%%.*} %name"
+%if %{with guile}
+# These should be checked by m4/guile.m4 instead of configure.ac
+# taking into account of _guile_suffix
+guile_snarf=%{_bindir}/guile-snarf2.2
+export guile_snarf
+GUILD=%{_bindir}/guild2.2
+export GUILD
 %endif
 
-mkdir native_build
-pushd native_build
-
-%global _configure ../configure
 %configure \
 %if %{with fips}
            --enable-fips140-mode \
-           --with-fips140-module-name="$FIPS_MODULE_NAME" \
-           --with-fips140-module-version=%{version}-%{srpmhash} \
 %endif
 %if %{with gost}
     	   --enable-gost \
 %else
 	   --disable-gost \
-%endif
-%if %{with srp}
-           --enable-srp-authentication \
-%endif
-%ifarch %{ix86}
-           --disable-year2038 \
 %endif
 	   --enable-sha1-support \
            --disable-static \
@@ -384,73 +201,31 @@ pushd native_build
 %else
            --without-tpm \
 %endif
-%if %{with tpm2}
-           --with-tpm2 \
-%else
-           --without-tpm2 \
-%endif
-           --enable-ktls \
            --htmldir=%{_docdir}/manual \
+%if %{with guile}
+           --enable-guile \
+           --with-guile-extension-dir=%{_libdir}/guile/2.2 \
+%else
+           --disable-guile \
+%endif
 %if %{with dane}
            --with-unbound-root-key-file=/var/lib/unbound/root.key \
            --enable-libdane \
 %else
            --disable-libdane \
-%endif
-%if %{with certificate_compression}
-	   --with-zlib --with-brotli --with-zstd \
-%else
-	   --without-zlib --without-brotli --without-zstd \
-%endif
-%if %{with leancrypto}
-           --with-leancrypto \
-%else
-           --without-leancrypto \
-%endif
-%if %{with crypto_auditing}
-           --enable-crypto-auditing \
-%else
-           --disable-crypto-auditing \
 %endif
            --disable-rpath \
            --with-default-priority-string="@SYSTEM"
 
-%make_build
-%if %{with leancrypto}
-sed -i '/^Requires.private:/s/leancrypto[ ,]*//g' lib/gnutls.pc
-%endif
-popd
-
-%if %{with mingw}
-# MinGW does not support CCASFLAGS
-export CCASFLAGS=""
-%mingw_configure \
-%if %{with srp}
-    --enable-srp-authentication \
-%endif
-    --enable-sha1-support \
-    --disable-static \
-    --disable-openssl-compatibility \
-    --disable-non-suiteb-curves \
-    --disable-libdane \
-    --disable-rpath \
-    --disable-nls \
-    --disable-cxx \
-    --enable-shared \
-    --without-tpm \
-    --with-included-unistring \
-    --disable-doc \
-    --with-default-priority-string="@SYSTEM" \
-    --without-p11-kit
-%mingw_make %{?_smp_mflags}
-%endif
+make %{?_smp_mflags} V=1
 
 %install
-%make_install -C native_build
-pushd native_build
+make install DESTDIR=$RPM_BUILD_ROOT
 make -C doc install-html DESTDIR=$RPM_BUILD_ROOT
 rm -f $RPM_BUILD_ROOT%{_infodir}/dir
 rm -f $RPM_BUILD_ROOT%{_libdir}/*.la
+rm -f $RPM_BUILD_ROOT%{_libdir}/guile/2.2/guile-gnutls*.a
+rm -f $RPM_BUILD_ROOT%{_libdir}/guile/2.2/guile-gnutls*.la
 %if %{without dane}
 rm -f $RPM_BUILD_ROOT%{_libdir}/pkgconfig/gnutls-dane.pc
 %endif
@@ -458,12 +233,9 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/pkgconfig/gnutls-dane.pc
 %if %{with fips}
 # doing it twice should be a no-op the second time,
 # and this way we avoid redefining it and missing a future change
-%global __debug_package 1
 %{__spec_install_post}
-fname=`basename $RPM_BUILD_ROOT%{_libdir}/libgnutls.so.30.*.*`
-./lib/fipshmac "$RPM_BUILD_ROOT%{_libdir}/libgnutls.so.30" > "$RPM_BUILD_ROOT%{_libdir}/.$fname.hmac"
-sed -i "s^$RPM_BUILD_ROOT/usr^^" "$RPM_BUILD_ROOT%{_libdir}/.$fname.hmac"
-ln -s ".$fname.hmac" "$RPM_BUILD_ROOT%{_libdir}/.libgnutls.so.30.hmac"
+./lib/fipshmac "$RPM_BUILD_ROOT%{_libdir}/libgnutls.so.30" > $RPM_BUILD_ROOT%{_libdir}/.gnutls.hmac
+sed -i "s^$RPM_BUILD_ROOT/usr^^" $RPM_BUILD_ROOT%{_libdir}/.gnutls.hmac
 %endif
 
 %if %{with fips}
@@ -475,51 +247,17 @@ ln -s ".$fname.hmac" "$RPM_BUILD_ROOT%{_libdir}/.libgnutls.so.30.hmac"
 %endif
 
 %find_lang gnutls
-popd
-
-%if %{with mingw}
-%mingw_make_install
-
-# Remove .la files
-rm -f $RPM_BUILD_ROOT%{mingw32_libdir}/*.la
-rm -f $RPM_BUILD_ROOT%{mingw64_libdir}/*.la
-
-# The .def files aren't interesting for other binaries
-rm -f $RPM_BUILD_ROOT%{mingw32_bindir}/*.def
-rm -f $RPM_BUILD_ROOT%{mingw64_bindir}/*.def
-
-# Remove info and man pages which duplicate stuff in Fedora already.
-rm -rf $RPM_BUILD_ROOT%{mingw32_infodir}
-rm -rf $RPM_BUILD_ROOT%{mingw32_mandir}
-rm -rf $RPM_BUILD_ROOT%{mingw32_docdir}/gnutls
-
-rm -rf $RPM_BUILD_ROOT%{mingw64_infodir}
-rm -rf $RPM_BUILD_ROOT%{mingw64_mandir}
-rm -rf $RPM_BUILD_ROOT%{mingw64_docdir}/gnutls
-
-# Remove test libraries
-rm -f $RPM_BUILD_ROOT%{mingw32_libdir}/crypt32.dll*
-rm -f $RPM_BUILD_ROOT%{mingw32_libdir}/ncrypt.dll*
-rm -f $RPM_BUILD_ROOT%{mingw64_libdir}/crypt32.dll*
-rm -f $RPM_BUILD_ROOT%{mingw64_libdir}/ncrypt.dll*
-
-%mingw_debug_install_post
-%endif
 
 %check
-%if %{with tests}
-pushd native_build
-make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null || { cat tests/test-suite.log tests/cert-tests/test-suite.log tests/slow/test-suite.log src/gl/tests/test-suite.log; exit 1; }
-popd
-%endif
+make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null
 
-%files -f native_build/gnutls.lang
+%files -f gnutls.lang
 %{_libdir}/libgnutls.so.30*
 %if %{with fips}
-%{_libdir}/.libgnutls.so.30*.hmac
+%{_libdir}/.gnutls.hmac
 %endif
 %doc README.md AUTHORS NEWS THANKS
-%license COPYING COPYING.LESSERv2
+%license LICENSE doc/COPYING doc/COPYING.LESSER
 
 %files c++
 %{_libdir}/libgnutlsxx.so.*
@@ -542,9 +280,7 @@ popd
 %{_bindir}/ocsptool
 %{_bindir}/psktool
 %{_bindir}/p11tool
-%if %{with srp}
 %{_bindir}/srptool
-%endif
 %if %{with dane}
 %{_bindir}/danetool
 %endif
@@ -557,46 +293,13 @@ popd
 %{_libdir}/libgnutls-dane.so.*
 %endif
 
-%if %{with fips}
-%files fips
-%endif
-
-%if %{with mingw}
-%files -n mingw32-%{name}
-%license COPYING COPYING.LESSERv2
-%{mingw32_bindir}/certtool.exe
-%{mingw32_bindir}/gnutls-cli-debug.exe
-%{mingw32_bindir}/gnutls-cli.exe
-%{mingw32_bindir}/gnutls-serv.exe
-%{mingw32_bindir}/libgnutls-30.dll
-%{mingw32_bindir}/ocsptool.exe
-#%%{mingw32_bindir}/p11tool.exe
-%{mingw32_bindir}/psktool.exe
-%if %{with srp}
-%{mingw32_bindir}/srptool.exe
-%endif
-%{mingw32_libdir}/libgnutls.dll.a
-%{mingw32_libdir}/libgnutls-30.def
-%{mingw32_libdir}/pkgconfig/gnutls.pc
-%{mingw32_includedir}/gnutls/
-
-%files -n mingw64-%{name}
-%license COPYING COPYING.LESSERv2
-%{mingw64_bindir}/certtool.exe
-%{mingw64_bindir}/gnutls-cli-debug.exe
-%{mingw64_bindir}/gnutls-cli.exe
-%{mingw64_bindir}/gnutls-serv.exe
-%{mingw64_bindir}/libgnutls-30.dll
-%{mingw64_bindir}/ocsptool.exe
-#%%{mingw64_bindir}/p11tool.exe
-%{mingw64_bindir}/psktool.exe
-%if %{with srp}
-%{mingw64_bindir}/srptool.exe
-%endif
-%{mingw64_libdir}/libgnutls.dll.a
-%{mingw64_libdir}/libgnutls-30.def
-%{mingw64_libdir}/pkgconfig/gnutls.pc
-%{mingw64_includedir}/gnutls/
+%if %{with guile}
+%files guile
+%{_libdir}/guile/2.2/guile-gnutls*.so*
+%{_libdir}/guile/2.2/site-ccache/gnutls.go
+%{_libdir}/guile/2.2/site-ccache/gnutls/extra.go
+%{_datadir}/guile/site/2.2/gnutls.scm
+%{_datadir}/guile/site/2.2/gnutls/extra.scm
 %endif
 
 %changelog

plans/fips-smoke.fmf

@@ -1,4 +0,0 @@
-summary: Runs FIPS library integrity checks.
-name: fips-smoke
-execute:
-    script: if [[ $(GNUTLS_DEBUG_LEVEL=99 GNUTLS_FORCE_FIPS_MODE=1 certtool 2>&1 | grep "Error") ]]; then exit 1; else exit 0; fi;

plans/nss-2way.fmf

@@ -1,10 +0,0 @@
-summary: Upstreamed gnutls-openssl interop-2way tests
-contact: Stanislav Zidek <szidek@redhat.com>
-discover:
-  # upstreamed tests (public)
-  - name: interop-nss-2way
-    how: fmf
-    url: https://gitlab.com/redhat-crypto/tests/interop.git
-    filter: 'tag: interop-gnutls & tag: interop-nss & tag: interop-2way'
-execute:
-    how: tmt

plans/openssl-2way.fmf

@@ -1,10 +0,0 @@
-summary: Upstreamed gnutls-openssl interop-2way tests
-contact: Stanislav Zidek <szidek@redhat.com>
-discover:
-  # upstreamed tests (public)
-  - name: interop-openssl-2way
-    how: fmf
-    url: https://gitlab.com/redhat-crypto/tests/interop.git
-    filter: 'tag: interop-gnutls & tag: interop-openssl & tag: interop-2way'
-execute:
-    how: tmt

plans/short-interop-tests.fmf

@@ -1,10 +0,0 @@
-summary: Upstreamed gnutls interop tests - short tests which do not need to run in parallel
-contact: Stanislav Zidek <szidek@redhat.com>
-discover:
-  # upstreamed tests (public)
-  - name: interop-gnutls-short
-    how: fmf
-    url: https://gitlab.com/redhat-crypto/tests/interop.git
-    filter: 'tag: interop-gnutls & tag: -interop-slow'
-execute:
-    how: tmt

sources

@@ -1,5 +1 @@
-SHA512 (gnutls-3.8.11.tar.xz) = 68f9e5bec3aa6686fd3319cc9c88a5cc44e2a75144049fc9de5fb55fef2241b4e16996af4be5dd48308abbee8cfaed6c862903f6bb89aff5dfa5410075bd7386
-SHA512 (gnutls-3.8.11.tar.xz.sig) = 90883e5736299b103844ca42b85d371969ef66b50b60cb185e814ad9978598796e9ed07a590245ff28ac6ac084b1dee93fae0845576464583a5941835990957d
-SHA512 (gnutls-release-keyring.gpg) = 8c2b39239d1d8c5319757fcf669f28a11de7f8ec4a726f9904c57ba8105bea80240083c0de71b747115907bab46569f10cf58004137cc7884ac5c20f8319ae0a
-SHA512 (gmp-6.2.1.tar.xz) = c99be0950a1d05a0297d65641dd35b75b74466f7bf03c9e8a99895a3b2f9a0856cd17887738fa51cf7499781b65c049769271cbcb77d057d2e9f1ec52e07dd84
-SHA512 (leancrypto-1.6.0.tar.gz) = cb6ace4a1642208dd7656b62a48e99d6261f471aa7967b738057745a4534abfa11d380dd5de98a737c0c13b1e1cb37ce780e02297eefc1cf839581629d34e100
+SHA512 (gnutls-3.7.6.tar.xz) = f872339df80ec31d292821ff00eaafbe50e0bd4cdbb86e21e4f78541cd0a26d843596d5e69c91de4db8ce7d027fc639ae6462b57d89fb116162ae63c5a97486a