Update to 3.8.10 upstream release

Also update the bundled leancrypto to 1.5.0.

Signed-off-by: Daiki Ueno <dueno@redhat.com>

.gitignore

@@ -170,6 +170,3 @@ gnutls-2.10.1-nosrp.tar.bz2
 /gnutls-3.8.10.tar.xz
 /gnutls-3.8.10.tar.xz.sig
 /leancrypto-1.5.0.tar.gz
-/gnutls-3.8.11.tar.xz
-/gnutls-3.8.11.tar.xz.sig
-/leancrypto-1.6.0.tar.gz

.packit.yaml

@@ -28,4 +28,5 @@ actions:
 jobs:
   - job: propose_downstream
     trigger: release
-    dist_git_branches: fedora-all
+    metadata:
+      dist_git_branches: fedora-all

README.packit

@@ -1,3 +1,3 @@
 This repository is maintained by packit.
 https://packit.dev/
-The file was generated using packit 1.12.0.
+The file was generated using packit 0.102.2.

gmp-6.2.1-c23.patch

@@ -1,13 +0,0 @@
-diff --git a/acinclude.m4 b/acinclude.m4
-index 906071c..a466b7c 100644
---- a/acinclude.m4
-+++ b/acinclude.m4
-@@ -609,7 +609,7 @@ GMP_PROG_CC_WORKS_PART([$1], [long long reliability test 1],
- 
- #if defined (__GNUC__) && ! defined (__cplusplus)
- typedef unsigned long long t1;typedef t1*t2;
--void g(){}
-+void g(int, t2, t1, t2, t2, int){}
- void h(){}
- static __inline__ t1 e(t2 rp,t2 up,int n,t1 v0)
- {t1 c,x,r;int i;if(v0){c=1;for(i=1;i<n;i++){x=up[i];r=x+1;rp[i]=r;}}return c;}

gnutls.spec

@@ -12,28 +12,32 @@ sha256sum:close()
 print(string.sub(hash, 0, 16))
 }
 
-Version: 3.8.11
+Version: 3.8.10
 Release: %{?autorelease}%{!?autorelease:1%{?dist}}
 Patch: gnutls-3.2.7-rpath.patch
 
 # follow https://gitlab.com/gnutls/gnutls/-/issues/1443
 Patch: gnutls-3.8.8-tests-ktls-skip-tls12-chachapoly.patch
+# add tests/ktls_utils.h missing in the distribution
+Patch: gnutls-3.8.10-tests-ktls.patch
+# run tests/cert-test/mldsa.sh in VPATH build
+Patch: gnutls-3.8.10-tests-mldsa.patch
 
 %bcond_without bootstrap
 %bcond_without dane
 %bcond_without fips
 %bcond_with tpm12
 %bcond_without tpm2
-%if 0%{?rhel} >= 9
-%bcond_with gost
-%else
 %bcond_without gost
-%endif
 %bcond_without certificate_compression
-%bcond_without leancrypto
-%bcond_without crypto_auditing
 %bcond_without tests
 
+%if 0%{?fedora} >= 41 || 0%{?rhel} >= 10
+%bcond_without leancrypto
+%else
+%bcond_with leancrypto
+%endif
+
 %if 0%{?fedora} && 0%{?fedora} < 38
 %bcond_without srp
 %else
@@ -72,7 +76,7 @@ BuildRequires: zlib-devel, brotli-devel, libzstd-devel
 %if %{with bootstrap}
 BuildRequires: automake, autoconf, gperf, libtool, texinfo
 %endif
-BuildRequires: nettle-devel >= 3.10.1
+BuildRequires: nettle-devel >= 3.10
 %if %{with leancrypto}
 BuildRequires: meson
 %endif
@@ -87,9 +91,6 @@ BuildRequires: libunistring-devel
 BuildRequires: net-tools, softhsm, gcc, gcc-c++
 BuildRequires: gnupg2
 BuildRequires: git-core
-%if %{with crypto_auditing}
-BuildRequires: systemtap-sdt-devel
-%endif
 
 # for a sanity check on cert loading
 BuildRequires: p11-kit-trust, ca-certificates
@@ -97,7 +98,7 @@ Requires: crypto-policies
 Requires: p11-kit-trust
 Requires: libtasn1 >= 4.3
 # always bump when a nettle release is packaged
-Requires: nettle >= 3.10.1
+Requires: nettle >= 3.10
 %if %{with tpm12}
 Recommends: trousers >= 0.3.11.2
 %endif
@@ -133,16 +134,13 @@ Source1: https://www.gnupg.org/ftp/gcrypt/gnutls/v%{short_version}/%{name}-%{ver
 Source2: https://gnutls.org/gnutls-release-keyring.gpg
 
 %if %{with bundled_gmp}
-Provides:	bundled(gmp) = 6.2.1
 Source100:	gmp-6.2.1.tar.xz
 # Taken from the main gmp package
 Source101:	gmp-6.2.1-intel-cet.patch
-Source102:	gmp-6.2.1-c23.patch
 %endif
 
 %if %{with leancrypto}
-Provides:	bundled(leancrypto) = 1.6.0
-Source300:	leancrypto-1.6.0.tar.gz
+Source300:	leancrypto-1.5.0.tar.gz
 %endif
 
 # Wildcard bundling exception https://fedorahosted.org/fpc/ticket/174
@@ -273,7 +271,6 @@ mkdir -p bundled_gmp
 pushd bundled_gmp
 tar --strip-components=1 -xf %{SOURCE100}
 patch -p1 < %{SOURCE101}
-patch -p1 < %{SOURCE102}
 popd
 %endif
 
@@ -309,8 +306,7 @@ meson setup -Dprefix="$PWD/install" -Dlibdir="$PWD/install/lib" \
         -Dx509_parser=disabled -Dx509_generator=disabled \
         -Dpkcs7_parser=disabled -Dpkcs7_generator=disabled \
         -Dsha2-256=disabled \
-        -Daes_gcm=disabled -Daes_cbc=disabled -Daes_ctr=disabled -Daes_xts=disabled \
-        -Dchacha20=disabled -Dchacha20poly1305=disabled -Dchacha20_drng=disabled \
+        -Dchacha20=disabled -Dchacha20_drng=disabled \
         -Ddrbg_hash=disabled -Ddrbg_hmac=disabled \
         -Dhash_crypt=disabled \
         -Dhmac=disabled -Dhkdf=disabled \
@@ -320,10 +316,7 @@ meson setup -Dprefix="$PWD/install" -Dlibdir="$PWD/install/lib" \
         -Dhotp=disabled -Dtotp=disabled \
         -Daes_block=disabled -Daes_cbc=disabled -Daes_ctr=disabled \
         -Daes_kw=disabled -Dapps=disabled \
-        -Ddisable-asm=true \
         _build
-# the reason for -Ddisable-asm=true being bz2416812
-# revert once the root cause is fixed
 meson compile -C _build
 meson install -C _build
 
@@ -406,11 +399,6 @@ pushd native_build
            --with-leancrypto \
 %else
            --without-leancrypto \
-%endif
-%if %{with crypto_auditing}
-           --enable-crypto-auditing \
-%else
-           --disable-crypto-auditing \
 %endif
            --disable-rpath \
            --with-default-priority-string="@SYSTEM"

sources

@@ -1,5 +1,5 @@
-SHA512 (gnutls-3.8.11.tar.xz) = 68f9e5bec3aa6686fd3319cc9c88a5cc44e2a75144049fc9de5fb55fef2241b4e16996af4be5dd48308abbee8cfaed6c862903f6bb89aff5dfa5410075bd7386
-SHA512 (gnutls-3.8.11.tar.xz.sig) = 90883e5736299b103844ca42b85d371969ef66b50b60cb185e814ad9978598796e9ed07a590245ff28ac6ac084b1dee93fae0845576464583a5941835990957d
+SHA512 (gnutls-3.8.10.tar.xz) = d453bd4527af95cb3905ce8753ceafd969e3f442ad1d148544a233ebf13285b999930553a805a0511293cc25390bb6a040260df5544a7c55019640f920ad3d92
+SHA512 (gnutls-3.8.10.tar.xz.sig) = 72d6dd2c23f768f5041c3dca0f49b3f60cd01fc960ce77f097094a2aae6d76fddeb6295c425e3750c711d5f700957a62268aecc4873e53c31abb60eecf0fd4a8
 SHA512 (gnutls-release-keyring.gpg) = 8c2b39239d1d8c5319757fcf669f28a11de7f8ec4a726f9904c57ba8105bea80240083c0de71b747115907bab46569f10cf58004137cc7884ac5c20f8319ae0a
 SHA512 (gmp-6.2.1.tar.xz) = c99be0950a1d05a0297d65641dd35b75b74466f7bf03c9e8a99895a3b2f9a0856cd17887738fa51cf7499781b65c049769271cbcb77d057d2e9f1ec52e07dd84
-SHA512 (leancrypto-1.6.0.tar.gz) = cb6ace4a1642208dd7656b62a48e99d6261f471aa7967b738057745a4534abfa11d380dd5de98a737c0c13b1e1cb37ce780e02297eefc1cf839581629d34e100
+SHA512 (leancrypto-1.5.0.tar.gz) = 1170a502f58c9bce424578cece64a3ebf856620adc02f390b8877981bccf0c2bf35e64b1628094a06c069ec38a3be5889be22516d45d85f4e75b40085d9001c9