[packit] 3.8.5 upstream release

Upstream tag: 3.8.5
Upstream commit: 49f4ae21

.fmf/version

@@ -1 +0,0 @@
-1

.gitignore

@@ -154,22 +154,3 @@ gnutls-2.10.1-nosrp.tar.bz2
 /gnutls-3.8.4.tar.xz.sig
 /gnutls-3.8.5.tar.xz
 /gnutls-3.8.5.tar.xz.sig
-/gnutls-3.8.6.tar.xz
-/gnutls-3.8.6.tar.xz.sig
-/gmp-6.2.1.tar.xz
-/gnutls-3.8.7.tar.xz
-/gnutls-3.8.7.tar.xz.sig
-/gnutls-3.8.7.1.tar.xz
-/gnutls-3.8.7.1.tar.xz.sig
-/gnutls-3.8.8.tar.xz
-/gnutls-3.8.8.tar.xz.sig
-/gnutls-3.8.9.tar.xz
-/gnutls-3.8.9.tar.xz.sig
-/leancrypto-1.2.0.tar.gz
-/leancrypto-1.3.0.tar.gz
-/gnutls-3.8.10.tar.xz
-/gnutls-3.8.10.tar.xz.sig
-/leancrypto-1.5.0.tar.gz
-/gnutls-3.8.11.tar.xz
-/gnutls-3.8.11.tar.xz.sig
-/leancrypto-1.6.0.tar.gz

.packit.yaml

@@ -28,4 +28,5 @@ actions:
 jobs:
   - job: propose_downstream
     trigger: release
-    dist_git_branches: fedora-all
+    metadata:
+      dist_git_branches: fedora-all

README.packit

@@ -1,3 +1,3 @@
 This repository is maintained by packit.
 https://packit.dev/
-The file was generated using packit 1.12.0.
+The file was generated using packit 0.94.0.

ci.fmf

@@ -1 +0,0 @@
-resultsdb-testcase: separate

gmp-6.2.1-c23.patch

@@ -1,13 +0,0 @@
-diff --git a/acinclude.m4 b/acinclude.m4
-index 906071c..a466b7c 100644
---- a/acinclude.m4
-+++ b/acinclude.m4
-@@ -609,7 +609,7 @@ GMP_PROG_CC_WORKS_PART([$1], [long long reliability test 1],
- 
- #if defined (__GNUC__) && ! defined (__cplusplus)
- typedef unsigned long long t1;typedef t1*t2;
--void g(){}
-+void g(int, t2, t1, t2, t2, int){}
- void h(){}
- static __inline__ t1 e(t2 rp,t2 up,int n,t1 v0)
- {t1 c,x,r;int i;if(v0){c=1;for(i=1;i<n;i++){x=up[i];r=x+1;rp[i]=r;}}return c;}

gnutls-3.7.8-ktls_skip_tls12_chachapoly_test.patch

@@ -0,0 +1,25 @@
+From 18c555b4d2461ad202996398609552b9c4ecd43b Mon Sep 17 00:00:00 2001
+From: rpm-build <rpm-build>
+Date: Wed, 22 Nov 2023 15:21:49 +0900
+Subject: [PATCH] gnutls-3.7.8-ktls_skip_tls12_chachapoly_test.patch
+
+Signed-off-by: rpm-build <rpm-build>
+---
+ tests/gnutls_ktls.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/tests/gnutls_ktls.c b/tests/gnutls_ktls.c
+index ccbe566..049c888 100644
+--- a/tests/gnutls_ktls.c
++++ b/tests/gnutls_ktls.c
+@@ -347,7 +347,6 @@ void doit(void)
+ {
+ 	run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+AES-128-GCM");
+ 	run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+AES-256-GCM");
+-	run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+CHACHA20-POLY1305");
+ 	run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-128-GCM");
+ 	run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-256-GCM");
+ 	run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+CHACHA20-POLY1305");
+-- 
+2.41.0
+

gnutls-3.8.10-tests-ktls.patch

@@ -1,114 +0,0 @@
-From e0eb2bbb212a5c9d72311c59e7235832a0075dcc Mon Sep 17 00:00:00 2001
-From: rpm-build <rpm-build>
-Date: Wed, 9 Jul 2025 18:54:48 +0900
-Subject: [PATCH] add tests/ktls_utils.h
-
-Signed-off-by: rpm-build <rpm-build>
----
- tests/ktls_utils.h | 94 ++++++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 94 insertions(+)
- create mode 100644 tests/ktls_utils.h
-
-diff --git a/tests/ktls_utils.h b/tests/ktls_utils.h
-new file mode 100644
-index 0000000..231618d
---- /dev/null
-+++ b/tests/ktls_utils.h
-@@ -0,0 +1,94 @@
-+#ifndef GNUTLS_TESTS_KTLS_UTILS_H
-+#define GNUTLS_TESTS_KTLS_UTILS_H
-+
-+#include <fcntl.h>
-+#include <signal.h>
-+
-+#include <netinet/in.h>
-+
-+#include <sys/socket.h>
-+#include <sys/wait.h>
-+
-+/* Sets the NONBLOCK flag on the socket(fd) */
-+inline static int set_nonblocking(int fd)
-+{
-+	int flags = fcntl(fd, F_GETFL, 0);
-+	if (flags == -1) {
-+		return 1;
-+	}
-+
-+	if (fcntl(fd, F_SETFL, flags | O_NONBLOCK) == -1) {
-+		return 2;
-+	}
-+
-+	return 0;
-+}
-+
-+/* Creates a pair of TCP connected sockets */
-+static int create_socket_pair(int *client_fd, int *server_fd)
-+{
-+	int ret;
-+	struct sockaddr_in saddr;
-+	socklen_t addrlen;
-+	int listener;
-+
-+	listener = socket(AF_INET, SOCK_STREAM, 0);
-+	if (listener == -1) {
-+		fail("error in listener(): %s\n", strerror(errno));
-+		return 1;
-+	}
-+
-+	int opt = 0;
-+	setsockopt(listener, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof(opt));
-+
-+	memset(&saddr, 0, sizeof(saddr));
-+	saddr.sin_family = AF_INET;
-+	saddr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
-+	saddr.sin_port = 0;
-+
-+	ret = bind(listener, (struct sockaddr *)&saddr, sizeof(saddr));
-+	if (ret == -1) {
-+		fail("error in bind(): %s\n", strerror(errno));
-+		return 1;
-+	}
-+
-+	addrlen = sizeof(saddr);
-+	ret = getsockname(listener, (struct sockaddr *)&saddr, &addrlen);
-+	if (ret == -1) {
-+		fail("error in getsockname(): %s\n", strerror(errno));
-+		return 1;
-+	}
-+
-+	ret = listen(listener, 1);
-+	if (ret == -1) {
-+		fail("error in listen(): %s\n", strerror(errno));
-+		close(listener);
-+		return 1;
-+	}
-+
-+	*client_fd = socket(AF_INET, SOCK_STREAM, 0);
-+	if (*client_fd < 0) {
-+		fail("error in socket(): %s\n", strerror(errno));
-+		return 1;
-+	}
-+
-+	ret = connect(*client_fd, (struct sockaddr *)&saddr, addrlen);
-+	if (ret < 0) {
-+		fail("error in connect(): %s\n", strerror(errno));
-+		close(listener);
-+		close(*client_fd);
-+		return 1;
-+	}
-+
-+	*server_fd = accept(listener, NULL, NULL);
-+	if (*server_fd < 0) {
-+		fail("error in accept(): %s\n", strerror(errno));
-+		close(listener);
-+		close(*client_fd);
-+		return 1;
-+	}
-+
-+	return 0;
-+}
-+
-+#endif //GNUTLS_TESTS_KTLS_UTILS_H
--- 
-2.49.0
-

gnutls-3.8.10-tests-mldsa.patch

@@ -1,58 +0,0 @@
-From 15fb5ad536c375a74cc0d87859c9fc919d924c9d Mon Sep 17 00:00:00 2001
-From: rpm-build <rpm-build>
-Date: Thu, 10 Jul 2025 05:45:06 +0900
-Subject: [PATCH] support VPATH build for mldsa tests
-
-Signed-off-by: rpm-build <rpm-build>
----
- tests/cert-tests/mldsa.sh | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/tests/cert-tests/mldsa.sh b/tests/cert-tests/mldsa.sh
-index 7e31e11..55e31ce 100644
---- a/tests/cert-tests/mldsa.sh
-+++ b/tests/cert-tests/mldsa.sh
-@@ -130,7 +130,7 @@ for variant in 44 65 87; do
- 	# Check default
- 	TMPKEYDEFAULT=$testdir/key-$algo-$format-default
- 	TMPKEY=$testdir/key-$algo-$format
--	${VALGRIND} "${CERTTOOL}" -k --no-text --infile "data/key-$algo-$format.pem" >"$TMPKEYDEFAULT"
-+	${VALGRIND} "${CERTTOOL}" -k --no-text --infile "$srcdir/data/key-$algo-$format.pem" >"$TMPKEYDEFAULT"
- 	if [ $? != 0 ]; then
- 	    cat "$TMPKEYDEFAULT"
- 	    exit 1
-@@ -138,19 +138,19 @@ for variant in 44 65 87; do
- 
- 	# The "expandedKey" format doesn't have public key part
- 	if [ "$format" = seed ] || [ "$format" = both ]; then
--	    if ! "${DIFF}" "$TMPKEYDEFAULT" "data/key-$algo-both.pem"; then
-+	    if ! "${DIFF}" "$TMPKEYDEFAULT" "$srcdir/data/key-$algo-both.pem"; then
- 		exit 1
- 	    fi
- 	fi
- 
- 	# Check roundtrip with --key-format
--	${VALGRIND} "${CERTTOOL}" -k --no-text --key-format "$format" --infile "data/key-$algo-$format.pem" >"$TMPKEY"
-+	${VALGRIND} "${CERTTOOL}" -k --no-text --key-format "$format" --infile "$srcdir/data/key-$algo-$format.pem" >"$TMPKEY"
- 	if [ $? != 0 ]; then
- 	    cat "$TMPKEY"
- 	    exit 1
- 	fi
- 
--	if ! "${DIFF}" "$TMPKEY" "data/key-$algo-$format.pem"; then
-+	if ! "${DIFF}" "$TMPKEY" "$srcdir/data/key-$algo-$format.pem"; then
- 	    exit 1
- 	fi
-     done
-@@ -164,7 +164,7 @@ for n in 1; do
-     fi
- 
-     echo "Testing inconsistent ML-DSA key ($n)"
--    if "${CERTTOOL}" -k --infile "data/key-mldsa-inconsistent$n.pem"; then
-+    if "${CERTTOOL}" -k --infile "$srcdir/data/key-mldsa-inconsistent$n.pem"; then
- 	exit 1
-     fi
- done
--- 
-2.49.0
-

gnutls-3.8.6-nettle-rsa-oaep.patch

@@ -1,27 +0,0 @@
-From a9800309197fe5aef913944b2fc77164946f0689 Mon Sep 17 00:00:00 2001
-From: Daiki Ueno <ueno@gnu.org>
-Date: Tue, 23 Jul 2024 16:04:56 +0900
-Subject: [PATCH] build: link against libhogweed when checking
- nettle_rsa_oaep_*
-
-Signed-off-by: Daiki Ueno <ueno@gnu.org>
----
- configure.ac | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/configure.ac b/configure.ac
-index fb0aefe1f4..8b55808bd7 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -795,7 +795,7 @@ AM_CONDITIONAL([NEED_SIV_GCM], [test "$ac_cv_func_nettle_siv_gcm_encrypt_message
- 
- # Check for RSA-OAEP
- save_LIBS=$LIBS
--LIBS="$LIBS $NETTLE_LIBS"
-+LIBS="$LIBS $HOGWEED_LIBS $NETTLE_LIBS $GMP_LIBS"
- AC_CHECK_FUNCS(nettle_rsa_oaep_sha256_encrypt)
- LIBS=$save_LIBS
- AM_CONDITIONAL([NEED_RSA_OAEP], [test "$ac_cv_func_nettle_rsa_oaep_sha256_encrypt" != yes])
--- 
-2.45.2
-

gnutls-3.8.8-tests-ktls-skip-tls12-chachapoly.patch

@@ -1,29 +0,0 @@
-From a36b73a21e4b5b6e051b23192a645dea34c9d6af Mon Sep 17 00:00:00 2001
-From: Daiki Ueno <ueno@gnu.org>
-Date: Tue, 5 Nov 2024 14:45:46 +0900
-Subject: [PATCH] tests: skip CHACHA20-POLY1305 in TLS 1.2 when KTLS is enabled
-
-Signed-off-by: Daiki Ueno <ueno@gnu.org>
----
- tests/gnutls_ktls.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/tests/gnutls_ktls.c b/tests/gnutls_ktls.c
-index 90d3e9af91..d5ac4efecc 100644
---- a/tests/gnutls_ktls.c
-+++ b/tests/gnutls_ktls.c
-@@ -347,9 +347,11 @@ void doit(void)
- {
- 	run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+AES-128-GCM");
- 	run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+AES-256-GCM");
-+#if 0
- 	if (!gnutls_fips140_mode_enabled()) {
- 		run("NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+CHACHA20-POLY1305");
- 	}
-+#endif
- 	run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-128-GCM");
- 	run("NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-256-GCM");
- 	if (!gnutls_fips140_mode_enabled()) {
--- 
-2.47.0
-

gnutls.spec

@@ -12,26 +12,20 @@ sha256sum:close()
 print(string.sub(hash, 0, 16))
 }
 
-Version: 3.8.11
+Version: 3.8.5
 Release: %{?autorelease}%{!?autorelease:1%{?dist}}
 Patch: gnutls-3.2.7-rpath.patch
 
 # follow https://gitlab.com/gnutls/gnutls/-/issues/1443
-Patch: gnutls-3.8.8-tests-ktls-skip-tls12-chachapoly.patch
+Patch: gnutls-3.7.8-ktls_skip_tls12_chachapoly_test.patch
 
 %bcond_without bootstrap
 %bcond_without dane
 %bcond_without fips
 %bcond_with tpm12
 %bcond_without tpm2
-%if 0%{?rhel} >= 9
-%bcond_with gost
-%else
 %bcond_without gost
-%endif
-%bcond_without certificate_compression
-%bcond_without leancrypto
-%bcond_without crypto_auditing
+%bcond_with certificate_compression
 %bcond_without tests
 
 %if 0%{?fedora} && 0%{?fedora} < 38
@@ -46,19 +40,6 @@ Patch: gnutls-3.8.8-tests-ktls-skip-tls12-chachapoly.patch
 %bcond_with mingw
 %endif
 
-%if 0%{?rhel} >= 9 && %{with fips}
-%bcond_without bundled_gmp
-%else
-%bcond_with bundled_gmp
-%endif
-
-
-%define fips_requires() %{lua:
-local f = assert(io.popen("rpm -q --queryformat '%{EVR}' --whatprovides "..rpm.expand("'%1%{?_isa}'")))
-local v = f:read("*all")
-f:close()
-print("Requires: "..rpm.expand("%1%{?_isa}").." = "..v.."\\n")
-}
 
 Summary: A TLS protocol implementation
 Name: gnutls
@@ -72,10 +53,7 @@ BuildRequires: zlib-devel, brotli-devel, libzstd-devel
 %if %{with bootstrap}
 BuildRequires: automake, autoconf, gperf, libtool, texinfo
 %endif
-BuildRequires: nettle-devel >= 3.10.1
-%if %{with leancrypto}
-BuildRequires: meson
-%endif
+BuildRequires: nettle-devel >= 3.8
 %if %{with tpm12}
 BuildRequires: trousers-devel >= 0.3.11.2
 %endif
@@ -87,17 +65,13 @@ BuildRequires: libunistring-devel
 BuildRequires: net-tools, softhsm, gcc, gcc-c++
 BuildRequires: gnupg2
 BuildRequires: git-core
-%if %{with crypto_auditing}
-BuildRequires: systemtap-sdt-devel
-%endif
 
 # for a sanity check on cert loading
 BuildRequires: p11-kit-trust, ca-certificates
 Requires: crypto-policies
 Requires: p11-kit-trust
 Requires: libtasn1 >= 4.3
-# always bump when a nettle release is packaged
-Requires: nettle >= 3.10.1
+Requires: nettle >= 3.8
 %if %{with tpm12}
 Recommends: trousers >= 0.3.11.2
 %endif
@@ -108,21 +82,21 @@ BuildRequires: unbound-devel unbound-libs
 BuildRequires: make gtk-doc
 
 %if %{with mingw}
-BuildRequires:  mingw32-cpp
 BuildRequires:  mingw32-filesystem >= 95
 BuildRequires:  mingw32-gcc
 BuildRequires:  mingw32-gcc-c++
 BuildRequires:  mingw32-libtasn1 >= 4.3
 BuildRequires:  mingw32-readline
 BuildRequires:  mingw32-zlib
+BuildRequires:  mingw32-p11-kit >= 0.23.1
 BuildRequires:  mingw32-nettle >= 3.6
-BuildRequires:  mingw64-cpp
 BuildRequires:  mingw64-filesystem >= 95
 BuildRequires:  mingw64-gcc
 BuildRequires:  mingw64-gcc-c++
 BuildRequires:  mingw64-libtasn1 >= 4.3
 BuildRequires:  mingw64-readline
 BuildRequires:  mingw64-zlib
+BuildRequires:  mingw64-p11-kit >= 0.23.1
 BuildRequires:  mingw64-nettle >= 3.6
 %endif
 
@@ -132,19 +106,6 @@ Source0: https://www.gnupg.org/ftp/gcrypt/gnutls/v%{short_version}/%{name}-%{ver
 Source1: https://www.gnupg.org/ftp/gcrypt/gnutls/v%{short_version}/%{name}-%{version}.tar.xz.sig
 Source2: https://gnutls.org/gnutls-release-keyring.gpg
 
-%if %{with bundled_gmp}
-Provides:	bundled(gmp) = 6.2.1
-Source100:	gmp-6.2.1.tar.xz
-# Taken from the main gmp package
-Source101:	gmp-6.2.1-intel-cet.patch
-Source102:	gmp-6.2.1-c23.patch
-%endif
-
-%if %{with leancrypto}
-Provides:	bundled(leancrypto) = 1.6.0
-Source300:	leancrypto-1.6.0.tar.gz
-%endif
-
 # Wildcard bundling exception https://fedorahosted.org/fpc/ticket/174
 Provides: bundled(gnulib) = 20130424
 
@@ -175,16 +136,6 @@ Summary: A DANE protocol implementation for GnuTLS
 Requires: %{name}%{?_isa} = %{version}-%{release}
 %endif
 
-%if %{with fips}
-%package fips
-Summary: Virtual package to install packages required to use %{name} under FIPS mode
-Requires: %{name}%{?_isa} = %{version}-%{release}
-%{fips_requires nettle}
-%if !%{with bundled_gmp}
-%{fips_requires gmp}
-%endif
-%endif
-
 %description
 GnuTLS is a secure communications library implementing the SSL, TLS and DTLS 
 protocols and technologies around them. It provides a simple C language 
@@ -228,17 +179,6 @@ This package contains library that implements the DANE protocol for verifying
 TLS certificates through DNSSEC.
 %endif
 
-%if %{with fips}
-%description fips
-GnuTLS is a secure communications library implementing the SSL, TLS and DTLS 
-protocols and technologies around them. It provides a simple C language 
-application programming interface (API) to access the secure communications 
-protocols as well as APIs to parse and write X.509, PKCS #12, OpenPGP and 
-other required structures.
-This package does not contain any file, but installs required packages
-to use GnuTLS under FIPS mode.
-%endif
-
 %if %{with mingw}
 %package -n mingw32-%{name}
 Summary:        MinGW GnuTLS TLS/SSL encryption library
@@ -268,73 +208,9 @@ for MinGW.
 
 %autosetup -p1 -S git
 
-%if %{with bundled_gmp}
-mkdir -p bundled_gmp
-pushd bundled_gmp
-tar --strip-components=1 -xf %{SOURCE100}
-patch -p1 < %{SOURCE101}
-patch -p1 < %{SOURCE102}
-popd
-%endif
-
 %build
 %define _lto_cflags %{nil}
 
-%if %{with leancrypto}
-mkdir -p bundled_leancrypto
-pushd bundled_leancrypto
-tar --strip-components=1 -xf %{SOURCE300}
-popd
-%endif
-
-%if %{with bundled_gmp}
-pushd bundled_gmp
-autoreconf -ifv
-%configure --disable-cxx --disable-shared --enable-fat --with-pic
-%make_build
-popd
-
-export GMP_CFLAGS="-I$PWD/bundled_gmp"
-export GMP_LIBS="$PWD/bundled_gmp/.libs/libgmp.a"
-%endif
-
-%if %{with leancrypto}
-pushd bundled_leancrypto
-%set_build_flags
-meson setup -Dprefix="$PWD/install" -Dlibdir="$PWD/install/lib" \
-        -Ddefault_library=static \
-        -Dascon=disabled -Dascon_keccak=disabled \
-        -Dbike_5=disabled -Dbike_3=disabled -Dbike_1=disabled \
-        -Dkyber_x25519=disabled -Ddilithium_ed25519=disabled \
-        -Dx509_parser=disabled -Dx509_generator=disabled \
-        -Dpkcs7_parser=disabled -Dpkcs7_generator=disabled \
-        -Dsha2-256=disabled \
-        -Daes_gcm=disabled -Daes_cbc=disabled -Daes_ctr=disabled -Daes_xts=disabled \
-        -Dchacha20=disabled -Dchacha20poly1305=disabled -Dchacha20_drng=disabled \
-        -Ddrbg_hash=disabled -Ddrbg_hmac=disabled \
-        -Dhash_crypt=disabled \
-        -Dhmac=disabled -Dhkdf=disabled \
-        -Dkdf_ctr=disabled -Dkdf_fb=disabled -Dkdf_dpi=disabled \
-        -Dpbkdf2=disabled \
-        -Dkmac_drng=disabled -Dcshake_drng=disabled \
-        -Dhotp=disabled -Dtotp=disabled \
-        -Daes_block=disabled -Daes_cbc=disabled -Daes_ctr=disabled \
-        -Daes_kw=disabled -Dapps=disabled \
-        -Ddisable-asm=true \
-        _build
-# the reason for -Ddisable-asm=true being bz2416812
-# revert once the root cause is fixed
-meson compile -C _build
-meson install -C _build
-
-popd
-
-export LEANCRYPTO_DIR="$PWD/bundled_leancrypto/install"
-
-export LEANCRYPTO_CFLAGS="-I$LEANCRYPTO_DIR/include"
-export LEANCRYPTO_LIBS="$LEANCRYPTO_DIR/lib/libleancrypto.a"
-%endif
-
 %if %{with bootstrap}
 autoreconf -fi
 %endif
@@ -354,7 +230,6 @@ export FIPS_MODULE_NAME="$OS_NAME ${OS_VERSION_ID%%.*} %name"
 
 mkdir native_build
 pushd native_build
-
 %global _configure ../configure
 %configure \
 %if %{with fips}
@@ -401,24 +276,11 @@ pushd native_build
 	   --with-zlib --with-brotli --with-zstd \
 %else
 	   --without-zlib --without-brotli --without-zstd \
-%endif
-%if %{with leancrypto}
-           --with-leancrypto \
-%else
-           --without-leancrypto \
-%endif
-%if %{with crypto_auditing}
-           --enable-crypto-auditing \
-%else
-           --disable-crypto-auditing \
 %endif
            --disable-rpath \
            --with-default-priority-string="@SYSTEM"
 
 %make_build
-%if %{with leancrypto}
-sed -i '/^Requires.private:/s/leancrypto[ ,]*//g' lib/gnutls.pc
-%endif
 popd
 
 %if %{with mingw}
@@ -436,12 +298,12 @@ export CCASFLAGS=""
     --disable-rpath \
     --disable-nls \
     --disable-cxx \
+    --enable-local-libopts \
     --enable-shared \
     --without-tpm \
     --with-included-unistring \
     --disable-doc \
-    --with-default-priority-string="@SYSTEM" \
-    --without-p11-kit
+    --with-default-priority-string="@SYSTEM"
 %mingw_make %{?_smp_mflags}
 %endif
 
@@ -458,7 +320,6 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/pkgconfig/gnutls-dane.pc
 %if %{with fips}
 # doing it twice should be a no-op the second time,
 # and this way we avoid redefining it and missing a future change
-%global __debug_package 1
 %{__spec_install_post}
 fname=`basename $RPM_BUILD_ROOT%{_libdir}/libgnutls.so.30.*.*`
 ./lib/fipshmac "$RPM_BUILD_ROOT%{_libdir}/libgnutls.so.30" > "$RPM_BUILD_ROOT%{_libdir}/.$fname.hmac"
@@ -509,7 +370,22 @@ rm -f $RPM_BUILD_ROOT%{mingw64_libdir}/ncrypt.dll*
 %check
 %if %{with tests}
 pushd native_build
-make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null || { cat tests/test-suite.log tests/cert-tests/test-suite.log tests/slow/test-suite.log src/gl/tests/test-suite.log; exit 1; }
+
+# KeyUpdate is not yet supported in the kernel.
+xfail_tests=ktls_keyupdate.sh
+
+# The ktls.sh test currently only supports kernel 5.11+.  This needs to
+# be checked at run time, as the koji builder might be using a different
+# version of kernel on the host than the one indicated by the
+# kernel-devel package.
+
+case "$(uname -r)" in
+  4.* | 5.[0-9].* | 5.10.* )
+    xfail_tests="$xfail_tests ktls.sh"
+    ;;
+esac
+
+make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null XFAIL_TESTS="$xfail_tests"
 popd
 %endif
 
@@ -519,7 +395,7 @@ popd
 %{_libdir}/.libgnutls.so.30*.hmac
 %endif
 %doc README.md AUTHORS NEWS THANKS
-%license COPYING COPYING.LESSERv2
+%license LICENSE doc/COPYING doc/COPYING.LESSER
 
 %files c++
 %{_libdir}/libgnutlsxx.so.*
@@ -557,20 +433,16 @@ popd
 %{_libdir}/libgnutls-dane.so.*
 %endif
 
-%if %{with fips}
-%files fips
-%endif
-
 %if %{with mingw}
 %files -n mingw32-%{name}
-%license COPYING COPYING.LESSERv2
+%license LICENSE doc/COPYING doc/COPYING.LESSER
 %{mingw32_bindir}/certtool.exe
 %{mingw32_bindir}/gnutls-cli-debug.exe
 %{mingw32_bindir}/gnutls-cli.exe
 %{mingw32_bindir}/gnutls-serv.exe
 %{mingw32_bindir}/libgnutls-30.dll
 %{mingw32_bindir}/ocsptool.exe
-#%%{mingw32_bindir}/p11tool.exe
+%{mingw32_bindir}/p11tool.exe
 %{mingw32_bindir}/psktool.exe
 %if %{with srp}
 %{mingw32_bindir}/srptool.exe
@@ -581,14 +453,14 @@ popd
 %{mingw32_includedir}/gnutls/
 
 %files -n mingw64-%{name}
-%license COPYING COPYING.LESSERv2
+%license LICENSE doc/COPYING doc/COPYING.LESSER
 %{mingw64_bindir}/certtool.exe
 %{mingw64_bindir}/gnutls-cli-debug.exe
 %{mingw64_bindir}/gnutls-cli.exe
 %{mingw64_bindir}/gnutls-serv.exe
 %{mingw64_bindir}/libgnutls-30.dll
 %{mingw64_bindir}/ocsptool.exe
-#%%{mingw64_bindir}/p11tool.exe
+%{mingw64_bindir}/p11tool.exe
 %{mingw64_bindir}/psktool.exe
 %if %{with srp}
 %{mingw64_bindir}/srptool.exe

plans/fips-smoke.fmf

@@ -1,4 +0,0 @@
-summary: Runs FIPS library integrity checks.
-name: fips-smoke
-execute:
-    script: if [[ $(GNUTLS_DEBUG_LEVEL=99 GNUTLS_FORCE_FIPS_MODE=1 certtool 2>&1 | grep "Error") ]]; then exit 1; else exit 0; fi;

plans/nss-2way.fmf

@@ -1,10 +0,0 @@
-summary: Upstreamed gnutls-openssl interop-2way tests
-contact: Stanislav Zidek <szidek@redhat.com>
-discover:
-  # upstreamed tests (public)
-  - name: interop-nss-2way
-    how: fmf
-    url: https://gitlab.com/redhat-crypto/tests/interop.git
-    filter: 'tag: interop-gnutls & tag: interop-nss & tag: interop-2way'
-execute:
-    how: tmt

plans/openssl-2way.fmf

@@ -1,10 +0,0 @@
-summary: Upstreamed gnutls-openssl interop-2way tests
-contact: Stanislav Zidek <szidek@redhat.com>
-discover:
-  # upstreamed tests (public)
-  - name: interop-openssl-2way
-    how: fmf
-    url: https://gitlab.com/redhat-crypto/tests/interop.git
-    filter: 'tag: interop-gnutls & tag: interop-openssl & tag: interop-2way'
-execute:
-    how: tmt

plans/short-interop-tests.fmf

@@ -1,10 +0,0 @@
-summary: Upstreamed gnutls interop tests - short tests which do not need to run in parallel
-contact: Stanislav Zidek <szidek@redhat.com>
-discover:
-  # upstreamed tests (public)
-  - name: interop-gnutls-short
-    how: fmf
-    url: https://gitlab.com/redhat-crypto/tests/interop.git
-    filter: 'tag: interop-gnutls & tag: -interop-slow'
-execute:
-    how: tmt

sources

@@ -1,5 +1,3 @@
-SHA512 (gnutls-3.8.11.tar.xz) = 68f9e5bec3aa6686fd3319cc9c88a5cc44e2a75144049fc9de5fb55fef2241b4e16996af4be5dd48308abbee8cfaed6c862903f6bb89aff5dfa5410075bd7386
-SHA512 (gnutls-3.8.11.tar.xz.sig) = 90883e5736299b103844ca42b85d371969ef66b50b60cb185e814ad9978598796e9ed07a590245ff28ac6ac084b1dee93fae0845576464583a5941835990957d
+SHA512 (gnutls-3.8.5.tar.xz) = 4bac1aa7ec1dce9b3445cc515cc287a5af032d34c207399aa9722e3dc53ed652f8a57cfbc9c5e40ccc4a2631245d89ab676e3ba2be9563f60ba855aaacb8e23c
+SHA512 (gnutls-3.8.5.tar.xz.sig) = b0f7a8ec348765112cac75fd732e066adaa1595bb83024cfeff6633aba35277d8aceda145c733c3d95f1e0eb4d34fead2479abdb08d6041362094a235460fa67
 SHA512 (gnutls-release-keyring.gpg) = 8c2b39239d1d8c5319757fcf669f28a11de7f8ec4a726f9904c57ba8105bea80240083c0de71b747115907bab46569f10cf58004137cc7884ac5c20f8319ae0a
-SHA512 (gmp-6.2.1.tar.xz) = c99be0950a1d05a0297d65641dd35b75b74466f7bf03c9e8a99895a3b2f9a0856cd17887738fa51cf7499781b65c049769271cbcb77d057d2e9f1ec52e07dd84
-SHA512 (leancrypto-1.6.0.tar.gz) = cb6ace4a1642208dd7656b62a48e99d6261f471aa7967b738057745a4534abfa11d380dd5de98a737c0c13b1e1cb37ce780e02297eefc1cf839581629d34e100

tests/tests.yml

@@ -0,0 +1,13 @@
+---
+- hosts: localhost
+  roles:
+  - role: standard-test-basic
+    tags:
+    - classic
+    tests:
+    - smoke-fips:
+        dir: .
+        run: if [[ $(GNUTLS_DEBUG_LEVEL=99 GNUTLS_FORCE_FIPS_MODE=1 certtool 2>&1 | grep "Error") ]]; then exit 1; else exit 0; fi;
+    required_packages:
+    - gnutls
+    - gnutls-utils