From 1683bf17eaa20913aa4bab0411373d6edc5ad2a6f5fd83a1e93716da42825229 Mon Sep 17 00:00:00 2001
From: Dominique Leuenberger <dleuenberger@suse.com>
Date: Sat, 9 Jul 2016 07:21:14 +0000
Subject: [PATCH] Accepting request 405821 from Base:System

- Fix a problem with expired test certificate by using datefudge
  (boo#987139)
  * add 0001-tests-use-datefudge-in-name-constraints-test.patch (forwarded request 405618 from vitezslav_cizek)

OBS-URL: https://build.opensuse.org/request/show/405821
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/gnutls?expand=0&rev=92
---
 ...e-datefudge-in-name-constraints-test.patch |  28 +++++++++++++
 gnutls-3.4.11.tar.xz                          |   3 --
 gnutls-3.4.11.tar.xz.sig                      | Bin 287 -> 0 bytes
 gnutls-3.4.13.tar.xz                          |   3 ++
 gnutls-3.4.13.tar.xz.sig                      | Bin 0 -> 287 bytes
 gnutls.changes                                |  39 ++++++++++++++++++
 gnutls.spec                                   |   6 ++-
 7 files changed, 75 insertions(+), 4 deletions(-)
 create mode 100644 0001-tests-use-datefudge-in-name-constraints-test.patch
 delete mode 100644 gnutls-3.4.11.tar.xz
 delete mode 100644 gnutls-3.4.11.tar.xz.sig
 create mode 100644 gnutls-3.4.13.tar.xz
 create mode 100644 gnutls-3.4.13.tar.xz.sig

diff --git a/0001-tests-use-datefudge-in-name-constraints-test.patch b/0001-tests-use-datefudge-in-name-constraints-test.patch
new file mode 100644
index 0000000..bd6bc8e
--- /dev/null
+++ b/0001-tests-use-datefudge-in-name-constraints-test.patch
@@ -0,0 +1,28 @@
+From cc22a052f40ba800acde7d81fe0ab91b56e66921 Mon Sep 17 00:00:00 2001
+From: Nikos Mavrogiannopoulos <nmav@redhat.com>
+Date: Wed, 29 Jun 2016 17:25:06 +0200
+Subject: [PATCH] tests: use datefudge in name-constraints test
+
+This avoids the expiration of the used certificate to affect the test.
+---
+ tests/cert-tests/name-constraints | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+Index: gnutls-3.4.13/tests/cert-tests/name-constraints
+===================================================================
+--- gnutls-3.4.13.orig/tests/cert-tests/name-constraints	2016-06-30 11:11:35.920632613 +0200
++++ gnutls-3.4.13/tests/cert-tests/name-constraints	2016-06-30 11:13:06.633974903 +0200
+@@ -28,7 +28,12 @@ if ! test -z "${VALGRIND}"; then
+ fi
+ TMPFILE=tmp.$$.pem
+ 
+-${VALGRIND} "${CERTTOOL}" -e --infile "${srcdir}/name-constraints-ip.pem"
++. ${srcdir}/../scripts/common.sh
++
++check_for_datefudge
++
++datefudge -s "2016-04-22" \
++	${VALGRIND} "${CERTTOOL}" -e --infile "${srcdir}/name-constraints-ip.pem"
+ rc=$?
+ 
+ if test "${rc}" != "0"; then
diff --git a/gnutls-3.4.11.tar.xz b/gnutls-3.4.11.tar.xz
deleted file mode 100644
index 8510916..0000000
--- a/gnutls-3.4.11.tar.xz
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:70ef9c9f95822d363036c6e6b5479750e5b7fc34f50e750c3464a98ec65a9ab8
-size 6652224
diff --git a/gnutls-3.4.11.tar.xz.sig b/gnutls-3.4.11.tar.xz.sig
deleted file mode 100644
index d93fb9f5be32507a861537f7045c39e6b1c0e7600f74d2a44d8aab7fb186a155..0000000000000000000000000000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 287
zcmV+)0pR|L0UQJX0SEvF1p-$KPmur$2@suLs`ii*xI($X2m1u(p7cKO!)<>rP-k^+
za{<*#ZdgPAzNEW!+32e=O8nEHLxUsTrNWyZ?{;IhB(g-FpG<O^cdD0aoC+YM^b9(m
zJ7Qg+p3p&ctwPT5o9`;DqV}<-2at=vO904ZQe>+V+Ss#`#gmXn+EPu2PZjv@`yP!v
z4j%F^EBjY+*m7e|KIJskS;4%D7czRQdZizHr0u@|9_gUYegO1?{DNu)=8+~hRN~`p
z^>)F>BCxuOm1ZIYqC`|lq1x4NQ9zXlD9{m8l!VHbB*qs64z-!Z6nJVurAR{4($(+6
lJL9{aOLT4Y|I#R>A9UW$Ix(ctgbT=)?&xs-g03Mw)r*YPjZ^>t

diff --git a/gnutls-3.4.13.tar.xz b/gnutls-3.4.13.tar.xz
new file mode 100644
index 0000000..105635b
--- /dev/null
+++ b/gnutls-3.4.13.tar.xz
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:fd3386e8e72725980bcd7f40949aa0121dcb7650b5147c6490e794555ed25859
+size 6670508
diff --git a/gnutls-3.4.13.tar.xz.sig b/gnutls-3.4.13.tar.xz.sig
new file mode 100644
index 0000000000000000000000000000000000000000000000000000000000000000..01c0acb0737a82ec9661761e357891b65ec188a380db92b1f539ad6c5a0a4641
GIT binary patch
literal 287
zcmV+)0pR|L0UQJX0SEvF1p-%9ux9`Y2@suLs`ii*xI$<r2me6Tiueu?Aa=$_J$7W~
zuR58$KdiPOW=`wpaClm3l+c`gUX!r1(y(!rs~1&j?L2f_s#S{k2IZ6>@J@T~oumpM
z8jt-z;eQCf(t!_w_yMNUJ$tl~3PQwEGOwOUF<nlAhVKRYne=`syr<wP=HioZOK@f=
z9E2d;&)`h@+nMsSskFKc<AYfL%_#7y9Kcf|bwBhE_z;>Lipb)1at4>)h2(>k?|s>7
zOj+1lLt;C^C7)fBfb~u)CG`CSj<#RQ#x59k+GQ4|Pij<!S6`)Hn0x2&cZOYOKKG$B
lY}tJAbHqi=BG;N_W2{xqFxdZe6Mf!O8RDnB9w3xFw(SK^jXwYY

literal 0
HcmV?d00001

diff --git a/gnutls.changes b/gnutls.changes
index 96ca9a7..0fb14fd 100644
--- a/gnutls.changes
+++ b/gnutls.changes
@@ -1,3 +1,42 @@
+-------------------------------------------------------------------
+Thu Jun 30 08:38:05 UTC 2016 - vcizek@suse.com
+
+- Fix a problem with expired test certificate by using datefudge
+  (boo#987139)
+  * add 0001-tests-use-datefudge-in-name-constraints-test.patch
+
+-------------------------------------------------------------------
+Tue Jun  7 05:52:13 UTC 2016 - meissner@suse.com
+
+- Version 3.4.13 (released 2016-06-06)
+  * libgnutls: Consider the SSLKEYLOGFILE environment to be compatible with
+    NSS instead of using a separate variable; in addition append any keys to
+    the file instead of overwriting it.
+  * libgnutls: use secure_getenv() where available to obtain environment
+    variables. Addresses GNUTLS-SA-2016-1.
+- Version 3.4.12 (released 2016-05-20)
+  * libgnutls: The CHACHA20-POLY1305 ciphersuite is enabled by default. This
+    cipher is prioritized after AES-GCM.
+  * libgnutls: Fixes in gnutls_privkey_import_ecc_raw().
+  * libgnutls: Fixed gnutls_pkcs11_get_raw_issuer() usage with the
+    GNUTLS_PKCS11_OBJ_FLAG_OVERWRITE_TRUSTMOD_EXT flag. Previously that
+    operation could fail on certain PKCS#11 modules.
+  * libgnutls: gnutls_pkcs11_obj_import_url() and gnutls_x509_crt_import_url()
+    can accept the GNUTLS_PKCS11_OBJ_FLAG_OVERWRITE_TRUSTMOD_EXT flag.
+  * libgnutls: gnutls_certificate_set_key() was enhanced to import the DNS
+    name of the certificates if the provided names are NULL.
+  * libgnutls: when receiving SNI names, only save and expose to application
+    the supported DNS names.
+  * libgnutls: when importing the certificate names at the
+    gnutls_certificate_set* functions, only consider the CN as a fallback
+    if DNS names are provided via the alternative name extension.
+  * gnutls-cli: on OCSP verification do not fail if we have a single valid
+    reply. Report and reproducer by Thomas Klute.
+  * libgnutls: The GNUTLS_KEYLOGFILE environment variable can be used to
+    log session keys in client side. These session keys are compatible with
+    the NSS Key Log Format and can be used to decrypt the session for
+    debugging using wireshark.
+
 -------------------------------------------------------------------
 Sat Apr 23 16:58:53 UTC 2016 - sleep_walker@opensuse.org
 
diff --git a/gnutls.spec b/gnutls.spec
index 4463a73..35e42b7 100644
--- a/gnutls.spec
+++ b/gnutls.spec
@@ -30,7 +30,7 @@
 %bcond_without guile
 
 Name:           gnutls
-Version:        3.4.11
+Version:        3.4.13
 Release:        0
 Summary:        The GNU Transport Layer Security Library
 License:        LGPL-2.1+ and GPL-3.0+
@@ -41,15 +41,18 @@ Source0:        ftp://ftp.gnutls.org/gcrypt/gnutls/v3.4/%{name}-%{version}.tar.x
 Source1:        ftp://ftp.gnutls.org/gcrypt/gnutls/v3.4/%{name}-%{version}.tar.xz.sig
 Source2:        %name.keyring
 Source3:        baselibs.conf
+Patch:          0001-tests-use-datefudge-in-name-constraints-test.patch
 
 BuildRequires:  autogen
 BuildRequires:  automake
+BuildRequires:  datefudge
 BuildRequires:  fdupes
 BuildRequires:  gcc-c++
 BuildRequires:  libidn-devel
 BuildRequires:  libnettle-devel >= 3.1
 BuildRequires:  libtasn1-devel >= 4.3
 BuildRequires:  libtool
+BuildRequires:  net-tools-deprecated
 %if %{with tpm}
 BuildRequires:  trousers-devel
 %endif
@@ -188,6 +191,7 @@ GnuTLS Wrappers for GNU Guile - dialect of scheme.
 
 %prep
 %setup -q
+%patch -p1
 
 %build
 export LDFLAGS="-pie"