Disable native assembly to work around bz2416812

Add missing Provides: bundled(..) for gmp & leancrypto
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2025-11-25 10:34:22 +01:00 · 2025-11-22 08:43:03 +09:00 · 2025-11-22 08:43:03 +09:00 · 2025-11-22 08:42:59 +09:00 · 2025-11-20 20:07:51 +09:00
3 changed files with 30 additions and 1 deletions
--- a/gnutls-3.8.8-tests-rsa-default.patch
+++ b/gnutls-3.8.8-tests-rsa-default.patch
@ -0,0 +1,22 @@
+As of RHEL 10, DEFAULT crypto policy rejects TLS ciphers with RSA key exchange:
+
+https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10-beta/html/considerations_in_adopting_rhel_10/security#security
+
+diff --git a/tests/system-override-allow-rsa-pkcs1-encrypt.sh b/tests/system-override-allow-rsa-pkcs1-encrypt.sh
+index 714d0af..bd141f3 100755
+--- a/tests/system-override-allow-rsa-pkcs1-encrypt.sh
+++ b/tests/system-override-allow-rsa-pkcs1-encrypt.sh
+@@ -60,10 +60,10 @@ unset GNUTLS_SYSTEM_PRIORITY_FILE
+ unset GNUTLS_SYSTEM_PRIORITY_FAIL_ON_INVALID
+ 
+ ${TEST}
+-if [ $? != 0 ]; then
+-	echo "${TEST} expected to succeed by default"
+if [ $? = 0 ]; then
+	echo "${TEST} expected to fail by default"
+ 	exit 1
+ fi
+-echo "RSAES-PKCS1-v1_5 successfully enabled by default"
+echo "RSAES-PKCS1-v1_5 correctly failed by default"
+ 
+ exit 0
--- a/gnutls.spec
+++ b/gnutls.spec
@ -140,6 +140,10 @@ Source101:	gmp-6.2.1-intel-cet.patch
 Source102:	gmp-6.2.1-c23.patch
 %endif

+%if 0%{?rhel} >= 10
+Source201:	gnutls-3.8.8-tests-rsa-default.patch
+%endif
+
 %if %{with leancrypto}
 Provides:	bundled(leancrypto) = 1.6.0
 Source300:	leancrypto-1.6.0.tar.gz
@ -277,6 +281,10 @@ patch -p1 < %{SOURCE102}
 popd
 %endif

+%if 0%{?rhel} >= 10
+patch -p1 < %{SOURCE201}
+%endif
+
 %build
 %define _lto_cflags %{nil}

--- a/1
+++ b/1
@ -1,5 +1,4 @@
 SHA512 (gnutls-3.8.11.tar.xz) = 68f9e5bec3aa6686fd3319cc9c88a5cc44e2a75144049fc9de5fb55fef2241b4e16996af4be5dd48308abbee8cfaed6c862903f6bb89aff5dfa5410075bd7386
 SHA512 (gnutls-3.8.11.tar.xz.sig) = 90883e5736299b103844ca42b85d371969ef66b50b60cb185e814ad9978598796e9ed07a590245ff28ac6ac084b1dee93fae0845576464583a5941835990957d
 SHA512 (gnutls-release-keyring.gpg) = 8c2b39239d1d8c5319757fcf669f28a11de7f8ec4a726f9904c57ba8105bea80240083c0de71b747115907bab46569f10cf58004137cc7884ac5c20f8319ae0a
-SHA512 (gmp-6.2.1.tar.xz) = c99be0950a1d05a0297d65641dd35b75b74466f7bf03c9e8a99895a3b2f9a0856cd17887738fa51cf7499781b65c049769271cbcb77d057d2e9f1ec52e07dd84
 SHA512 (leancrypto-1.6.0.tar.gz) = cb6ace4a1642208dd7656b62a48e99d6261f471aa7967b738057745a4534abfa11d380dd5de98a737c0c13b1e1cb37ce780e02297eefc1cf839581629d34e100
Author	SHA1	Message	Date
Alexander Sosedkin	4b7b61887d	Disable native assembly to work around bz2416812	2025-11-25 10:34:22 +01:00
Daniel P. Berrangé	317e073be2	Add missing Provides: bundled(..) for gmp & leancrypto Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>	2025-11-22 08:43:03 +09:00
Daiki Ueno	3edd13f1c9	Enable crypto-auditing probes Signed-off-by: Daiki Ueno <dueno@redhat.com>	2025-11-22 08:43:03 +09:00
Daiki Ueno	5d91dcb6c2	Minor fixes to spec file and packit configuration Signed-off-by: Daiki Ueno <dueno@redhat.com>	2025-11-22 08:42:59 +09:00
Daiki Ueno	fe6e62c528	Update to 3.8.11 upstream release - Resolves: rhbz#2416041 Upstream tag: 3.8.11 Upstream commit: b841c70e Commit authored by Packit automation (https://packit.dev/)	2025-11-20 20:07:51 +09:00