diff --git a/gnutls-3.5.15.tar.xz b/gnutls-3.5.15.tar.xz deleted file mode 100644 index d9d3392..0000000 --- a/gnutls-3.5.15.tar.xz +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:046081108b8b1fe455a13a4c5a4eaa0368e185b678f1670fe09a11a2d7ecfad5 -size 7238928 diff --git a/gnutls-3.5.15.tar.xz.sig b/gnutls-3.5.15.tar.xz.sig deleted file mode 100644 index b70a452..0000000 Binary files a/gnutls-3.5.15.tar.xz.sig and /dev/null differ diff --git a/gnutls-3.6.0-disable-flaky-dtls_resume-test.patch b/gnutls-3.6.0-disable-flaky-dtls_resume-test.patch new file mode 100644 index 0000000..753edb7 --- /dev/null +++ b/gnutls-3.6.0-disable-flaky-dtls_resume-test.patch @@ -0,0 +1,22 @@ +Index: gnutls-3.6.0/tests/dtls/Makefile.am +=================================================================== +--- gnutls-3.6.0.orig/tests/dtls/Makefile.am 2017-04-19 21:49:27.000000000 +0200 ++++ gnutls-3.6.0/tests/dtls/Makefile.am 2017-09-20 14:33:56.763416427 +0200 +@@ -19,7 +19,7 @@ + # along with this file; if not, write to the Free Software Foundation, + # Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. + +-dist_check_SCRIPTS = dtls dtls-nb dtls-resume ++dist_check_SCRIPTS = dtls dtls-nb + + AM_CFLAGS = $(WARN_CFLAGS) $(WERROR_CFLAGS) + AM_CPPFLAGS = \ +@@ -41,7 +41,7 @@ LDADD = ../../lib/libgnutls.la \ + if !WINDOWS + + check_PROGRAMS = dtls-stress +-TESTS = dtls dtls-resume ++TESTS = dtls + + endif + diff --git a/gnutls-3.6.0.tar.xz b/gnutls-3.6.0.tar.xz new file mode 100644 index 0000000..cf3c1bc --- /dev/null +++ b/gnutls-3.6.0.tar.xz @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:2ab9e3c0131fcd9142382f37ba9c6d20022b76cba83560cbcaa8e4002d71fb72 +size 8024972 diff --git a/gnutls-3.6.0.tar.xz.sig b/gnutls-3.6.0.tar.xz.sig new file mode 100644 index 0000000..86b5770 Binary files /dev/null and b/gnutls-3.6.0.tar.xz.sig differ diff --git a/gnutls-broken-openpgp-tests.patch b/gnutls-broken-openpgp-tests.patch deleted file mode 100644 index 7b2a7ef..0000000 --- a/gnutls-broken-openpgp-tests.patch +++ /dev/null @@ -1,39 +0,0 @@ -Index: gnutls-3.5.13/tests/Makefile.am -=================================================================== ---- gnutls-3.5.13.orig/tests/Makefile.am 2017-06-07 07:17:11.000000000 +0200 -+++ gnutls-3.5.13/tests/Makefile.am 2017-06-08 16:53:59.125158222 +0200 -@@ -19,7 +19,7 @@ - # along with this file; if not, write to the Free Software Foundation, - # Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. - --SUBDIRS = . cert-tests ocsp-tests key-tests slow dtls windows -+SUBDIRS = . cert-tests ocsp-tests key-tests slow windows - - if WANT_TEST_SUITE - SUBDIRS += suite -@@ -91,7 +91,7 @@ ctests = mini-record-2 simple gc set_pkc - crlverify mini-dtls-discard init_fds mini-record-failure \ - tls-rehandshake-cert-2 custom-urls set_x509_key_mem set_x509_key_file \ - mini-chain-unsorted x509-verify-with-crl mini-dtls-mtu privkey-verify-broken \ -- mini-dtls-record-asym openpgp-callback key-import-export \ -+ mini-dtls-record-asym key-import-export \ - mini-dtls-fork mini-dtls-pthread mini-key-material x509cert-invalid \ - tls-ext-register tls-supplemental mini-dtls0-9 \ - mini-record-retvals mini-server-name tls-etm x509-cert-callback \ -@@ -236,6 +236,7 @@ endif - endif - - if ENABLE_OPENPGP -+SUBDIRS += dtls - ctests += openpgp-auth openpgp-auth2 openpgp-keyring pgps2kgnu - endif - -@@ -244,7 +245,7 @@ ctests += x509self x509dn anonself pskse - setcredcrash resume-x509 resume-psk resume-anon - - if ENABLE_OPENPGP --ctests += openpgpself -+ctests += openpgpself openpgp-callback - endif - - endif diff --git a/gnutls.changes b/gnutls.changes index f911cdc..b306fbe 100644 --- a/gnutls.changes +++ b/gnutls.changes @@ -1,3 +1,97 @@ +------------------------------------------------------------------- +Wed Sep 20 12:36:16 UTC 2017 - vcizek@suse.com + +- Disable flaky dtls_resume test on Power + * add gnutls-3.6.0-disable-flaky-dtls_resume-test.patch + +------------------------------------------------------------------- +Mon Sep 18 11:47:23 UTC 2017 - astieger@suse.com + +- GnuTLS 3.6.0: + * Introduce a lock-free random generator which operates per- + thread and eliminates random-generator related bottlenecks in + multi-threaded operation. + * Replace the Salsa20 random generator with one based on CHACHA. + The goal is to reduce code needed in cache (CHACHA is also + used for TLS), and the number of primitives used by the + library. That does not affect the AES-DRBG random generator + used in FIPS140-2 mode. + * Add support for RSA-PSS key type as well as signatures in + certificates, and TLS key exchange + * Add support for Ed25519 signing in certificates and TLS key + exchange following draft-ietf-tls-rfc4492bis-17 + * Enable X25519 key exchange by default, following + draft-ietf-tls-rfc4492bis-17. + * Add support for Diffie-Hellman group negotiation following + RFC7919. + * Introduce various sanity checks on certificate import + * Introduce gnutls_x509_crt_set_flags(). This function can set + flags in the crt structure. The only flag supported at the + moment is GNUTLS_X509_CRT_FLAG_IGNORE_SANITY which skips the + certificate sanity checks on import. + * PKIX certificates with unknown critical extensions are rejected + on verification with status GNUTLS_CERT_UNKNOWN_CRIT_EXTENSIONS + * Refuse to generate a certificate with an illegal version, or an + illegal serial number. That is, gnutls_x509_crt_set_version() + and gnutls_x509_crt_set_serial(), will fail on input considered + to be invalid in RFC5280. + * Call to gnutls_record_send() and gnutls_record_recv() prior to + handshake being complete are now refused + * Add support for PKCS#12 files with no salt (zero length) in + their password encoding, and PKCS#12 files using SHA384 and + SHA512 as MAC. + * libgnutls: Exported functions to encode and decode DSA and ECDSA + r,s values. + * Add new callback setting function to gnutls_privkey_t for + external keys. The new function (gnutls_privkey_import_ext4), + allows signing in addition to previous algorithms (RSA PKCS#1 + 1.5, DSA, ECDSA), with RSA-PSS and Ed25519 keys. + * Introduce the %VERIFY_ALLOW_BROKEN and + %VERIFY_ALLOW_SIGN_WITH_SHA1 priority string options. These + allows enabling all broken and SHA1-based signature algorithms + in certificate verification, respectively. + * 3DES-CBC is no longer included in the default priorities list. + It has to be explicitly enabled, e.g., with a string like + "NORMAL:+3DES-CBC". + * SHA1 was marked as insecure for signing certificates. + Verification of certificates signed with SHA1 is now considered + insecure and will fail, unless flags intended to enable broken + algorithms are set. Other uses of SHA1 are still allowed. + * RIPEMD160 was marked as insecure for certificate signatures. + Verification of certificates signed with RIPEMD160 hash + algorithm is now considered insecure and will fail, unless + flags intended to enable broken algorithms are set. + * No longer enable SECP192R1 and SECP224R1 by default on TLS + handshakes. These curves were rarely used for that purpose, + provide no advantage over x25519 and were deprecated by TLS 1.3. + * Remove support for DEFLATE, or any other compression method. + * OpenPGP authentication was removed; the resulting library is ABI + compatible, with the openpgp related functions being stubs that + fail on invocation. + Drop gnutls-broken-openpgp-tests.patch, no longer required. + * Remove support for libidn (i.e., IDNA2003); gnutls can now be + compiled only with libidn2 which provides IDNA2008. + * certtool: The option '--load-ca-certificate' can now accept + PKCS#11 URLs in addition to files. + * certtool: The option '--load-crl' can now be used when + generating PKCS#12 files (i.e., in conjunction with '--to-p12' option). + * certtool: Keys with provable RSA and DSA parameters are now + only read and exported from PKCS#8 form, following + draft-mavrogiannopoulos-pkcs8-validated-parameters-00.txt. + This removes support for the previous a non-standard key format. + * certtool: Added support for generating, printing and handling + RSA-PSS and Ed25519 keys and certificates. + * certtool: the parameters --rsa, --dsa and --ecdsa to + --generate-privkey are now deprecated, replaced by the + --key-type option. + * p11tool: The --generate-rsa, --generate-ecc and --generate-dsa + options were replaced by the --generate-privkey option. + * psktool: Generate 256-bit keys by default. + * gnutls-server: Increase request buffer size to 16kb, and added + the --alpn and --alpn-fatal options, allowing testing of ALPN + negotiation. + * Enables FIPS 140-2 mode during build + ------------------------------------------------------------------- Mon Sep 11 10:37:44 UTC 2017 - dimstar@opensuse.org diff --git a/gnutls.spec b/gnutls.spec index c12ff10..ab73d69 100644 --- a/gnutls.spec +++ b/gnutls.spec @@ -23,18 +23,18 @@ %bcond_with tpm %bcond_without guile Name: gnutls -Version: 3.5.15 +Version: 3.6.0 Release: 0 Summary: The GNU Transport Layer Security Library License: LGPL-2.1+ AND GPL-3.0+ Group: Productivity/Networking/Security Url: http://www.gnutls.org/ -Source0: ftp://ftp.gnutls.org/gcrypt/gnutls/v3.5/%{name}-%{version}.tar.xz -Source1: ftp://ftp.gnutls.org/gcrypt/gnutls/v3.5/%{name}-%{version}.tar.xz.sig +Source0: ftp://ftp.gnutls.org/gcrypt/gnutls/v3.6/%{name}-%{version}.tar.xz +Source1: ftp://ftp.gnutls.org/gcrypt/gnutls/v3.6/%{name}-%{version}.tar.xz.sig Source2: %{name}.keyring Source3: baselibs.conf -Patch0: gnutls-broken-openpgp-tests.patch Patch1: gnutls-3.5.11-skip-trust-store-tests.patch +Patch2: gnutls-3.6.0-disable-flaky-dtls_resume-test.patch BuildRequires: autogen BuildRequires: automake BuildRequires: datefudge @@ -157,14 +157,17 @@ GnuTLS Wrappers for GNU Guile, a dialect of Scheme. %prep %setup -q -%patch0 -p1 %patch1 -p1 +# dtls-resume test fails on PPC +%ifarch ppc64 ppc64le ppc +%patch2 -p1 +%endif %build export LDFLAGS="-pie" export CFLAGS="%{optflags} -fPIE" export CXXFLAGS="%{optflags} -fPIE" -autoreconf -fvi +autoreconf -fiv %configure \ gl_cv_func_printf_directive_n=yes \ gl_cv_func_printf_infinite_long_double=yes \ @@ -174,7 +177,6 @@ autoreconf -fvi --with-default-trust-store-dir=%{_localstatedir}/lib/ca-certificates/pem \ --with-sysroot=/%{?_sysroot} \ --with-guile-site-dir=no \ - --disable-openpgp-authentication \ %if %{without tpm} --without-tpm \ %endif @@ -183,6 +185,7 @@ autoreconf -fvi %else --disable-libdane \ %endif + --enable-fips140-mode \ %{nil} make %{?_smp_mflags}