%define srpmhash() %{lua:

local files = rpm.expand("%_specdir/gnutls.spec")

for i, p in ipairs(patches) do

   files = files.." "..p

end

for i, p in ipairs(sources) do

   files = files.." "..p

end

local sha256sum = assert(io.popen("cat "..files.."| sha256sum"))

local hash = sha256sum:read("*a")

sha256sum:close()

print(string.sub(hash, 0, 16))

}

Version: 3.7.6

Release: 12%{?dist}

# not upstreamed

Patch: gnutls-3.6.7-no-now-guile.patch

Patch: gnutls-3.2.7-rpath.patch

Patch: gnutls-3.7.2-enable-intel-cet.patch

Patch: gnutls-3.7.2-no-explicit-init.patch

# upstreamed

Patch: gnutls-3.7.6-fips-run-selftests.patch

Patch: gnutls-3.7.6-ktls-disable-by-default.patch

Patch: gnutls-3.7.6-ktls-fixes.patch

Patch: gnutls-3.7.6-aes-gcm-pt-limit.patch

Patch: gnutls-3.7.6-pkcs7-verify.patch

Patch: gnutls-3.7.6-fips-pkcs12-des-cbc.patch

Patch: gnutls-3.7.6-fips-rsa-key-sizes.patch

Patch: gnutls-3.7.6-fips-symkey-limit.patch

Patch: gnutls-3.7.6-fips-ecdsa-hash-check.patch

# not upstreamed

Patch: gnutls-3.7.3-disable-config-reload.patch

Patch: gnutls-3.7.3-fips-dsa-post.patch

Patch: gnutls-3.7.6-drbg-reseed.patch

Patch: gnutls-3.7.6-cpuid-fixes.patch

Patch: gnutls-3.7.6-gmp-static.patch

%bcond_without bootstrap

%bcond_without dane

%if 0%{?rhel}

%bcond_with guile

%bcond_without fips

%else

%bcond_without guile

%bcond_without fips

%endif

%bcond_with tpm12

%bcond_without tpm2

%bcond_with gost

%bcond_with certificate_compression

%bcond_without tests

Summary: A TLS protocol implementation

Name: gnutls

# The libraries are LGPLv2.1+, utilities are GPLv3+

License: GPLv3+ and LGPLv2+

BuildRequires: p11-kit-devel >= 0.21.3, gettext-devel

BuildRequires: readline-devel, libtasn1-devel >= 4.3

%if %{with certificate_compression}

BuildRequires: zlib-devel, brotli-devel, libzstd-devel

%endif

%if %{with bootstrap}

BuildRequires: automake, autoconf, gperf, libtool

%endif

BuildRequires: texinfo

BuildRequires: nettle-devel >= 3.5.1

%if %{with tpm12}

BuildRequires: trousers-devel >= 0.3.11.2

%endif

%if %{with tpm2}

BuildRequires: tpm2-tss-devel >= 3.0.3

%endif

BuildRequires: libidn2-devel

BuildRequires: libunistring-devel

BuildRequires: net-tools, datefudge, softhsm, gcc, gcc-c++

BuildRequires: gnupg2

BuildRequires: git-core

# for a sanity check on cert loading

BuildRequires: p11-kit-trust, ca-certificates

Requires: crypto-policies

Requires: p11-kit-trust

Requires: libtasn1 >= 4.3

Requires: nettle >= 3.4.1

%if %{with tpm12}

Recommends: trousers >= 0.3.11.2

%endif

%if %{with dane}

BuildRequires: unbound-devel unbound-libs

%endif

%if %{with guile}

BuildRequires: guile22-devel

%endif

BuildRequires: make

URL: http://www.gnutls.org/

Source0: https://www.gnupg.org/ftp/gcrypt/gnutls/v3.7/%{name}-%{version}.tar.xz

Source1: https://www.gnupg.org/ftp/gcrypt/gnutls/v3.7/%{name}-%{version}.tar.xz.sig

Source2: gnutls-release-keyring.gpg

Source100:	gmp-6.2.1.tar.xz

# Taken from the main gmp package

Source101:	gmp-6.2.1-intel-cet.patch

# Wildcard bundling exception https://fedorahosted.org/fpc/ticket/174

Provides: bundled(gnulib) = 20130424

%package c++

Summary: The C++ interface to GnuTLS

Requires: %{name}%{?_isa} = %{version}-%{release}

%package devel

Summary: Development files for the %{name} package

Requires: %{name}%{?_isa} = %{version}-%{release}

Requires: %{name}-c++%{?_isa} = %{version}-%{release}

%if %{with dane}

Requires: %{name}-dane%{?_isa} = %{version}-%{release}

%endif

Requires: pkgconfig

%package utils

License: GPLv3+

Summary: Command line tools for TLS protocol

Requires: %{name}%{?_isa} = %{version}-%{release}

%if %{with dane}

Requires: %{name}-dane%{?_isa} = %{version}-%{release}

%endif

%if %{with dane}

%package dane

Summary: A DANE protocol implementation for GnuTLS

Requires: %{name}%{?_isa} = %{version}-%{release}

%endif

%if %{with guile}

%package guile

Summary: Guile bindings for the GNUTLS library

Requires: %{name}%{?_isa} = %{version}-%{release}

Requires: guile22

%endif

%description

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS 

protocols and technologies around them. It provides a simple C language 

application programming interface (API) to access the secure communications 

protocols as well as APIs to parse and write X.509, PKCS #12, OpenPGP and 

other required structures. 

%description c++

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS 

protocols and technologies around them. It provides a simple C language 

application programming interface (API) to access the secure communications 

protocols as well as APIs to parse and write X.509, PKCS #12, OpenPGP and 

other required structures. 

%description devel

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS 

protocols and technologies around them. It provides a simple C language 

application programming interface (API) to access the secure communications 

protocols as well as APIs to parse and write X.509, PKCS #12, OpenPGP and 

other required structures. 

This package contains files needed for developing applications with

the GnuTLS library.

%description utils

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS 

protocols and technologies around them. It provides a simple C language 

application programming interface (API) to access the secure communications 

protocols as well as APIs to parse and write X.509, PKCS #12, OpenPGP and 

other required structures. 

This package contains command line TLS client and server and certificate

manipulation tools.

%if %{with dane}

%description dane

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS 

protocols and technologies around them. It provides a simple C language 

application programming interface (API) to access the secure communications 

protocols as well as APIs to parse and write X.509, PKCS #12, OpenPGP and 

other required structures. 

This package contains library that implements the DANE protocol for verifying

TLS certificates through DNSSEC.

%endif

%if %{with guile}

%description guile

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS 

protocols and technologies around them. It provides a simple C language 

application programming interface (API) to access the secure communications 

protocols as well as APIs to parse and write X.509, PKCS #12, OpenPGP and 

other required structures. 

This package contains Guile bindings for the library.

%endif

%prep

# Workaround: to allow building the package under FIPS, do not treat

# errors in the GPG check as fatal, where EdDSA signature verification

# is not allowed:

%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}' || :

%autosetup -p1 -S git

%if %{with fips}

mkdir -p bundled_gmp

pushd bundled_gmp

tar --strip-components=1 -xf %{SOURCE100}

patch -p1 < %{SOURCE101}

popd

%endif

%build

%ifarch aarch64 ppc64le

%define _lto_cflags %{nil}

%endif

%if %{with fips}

pushd bundled_gmp

autoreconf -ifv

%configure --disable-cxx --disable-shared --enable-fat --with-pic

%make_build

popd

export GMP_CFLAGS="-I$PWD/bundled_gmp"

export GMP_LIBS="$PWD/bundled_gmp/.libs/libgmp.a"

%endif

%if %{with bootstrap}

autoreconf -fi

%endif

sed -i -e 's|sys_lib_dlsearch_path_spec="/lib /usr/lib|sys_lib_dlsearch_path_spec="/lib /usr/lib %{_libdir}|g' configure

rm -f lib/minitasn1/*.c lib/minitasn1/*.h

echo "SYSTEM=NORMAL" >> tests/system.prio

%if %{with guile}

# These should be checked by m4/guile.m4 instead of configure.ac

# taking into account of _guile_suffix

guile_snarf=%{_bindir}/guile-snarf2.2

export guile_snarf

GUILD=%{_bindir}/guild2.2

export GUILD

%endif

%if %{with fips}

eval $(sed -n 's/^\(\(NAME\|VERSION_ID\)=.*\)/OS_\1/p' /etc/os-release)

export FIPS_MODULE_NAME="$OS_NAME ${OS_VERSION_ID%%.*} %name"

%endif

%configure \

%if %{with fips}

           --enable-fips140-mode \

           --with-fips140-module-name="$FIPS_MODULE_NAME" \

           --with-fips140-module-version=%{version}-%{srpmhash} \

%endif

%if %{with gost}

    	   --enable-gost \

%else

	   --disable-gost \

%endif

	   --enable-sha1-support \

           --disable-static \

           --disable-openssl-compatibility \

           --disable-non-suiteb-curves \

           --with-system-priority-file=%{_sysconfdir}/crypto-policies/back-ends/gnutls.config \

           --with-default-trust-store-pkcs11="pkcs11:" \

%if %{with tpm12}

           --with-trousers-lib=%{_libdir}/libtspi.so.1 \

%else

           --without-tpm \

%endif

%if %{with tpm2}

           --with-tpm2 \

%else

           --without-tpm2 \

%endif

           --enable-ktls \

           --htmldir=%{_docdir}/manual \

%if %{with guile}

           --enable-guile \

           --with-guile-extension-dir=%{_libdir}/guile/2.2 \

%else

           --disable-guile \

%endif

%if %{with dane}

           --with-unbound-root-key-file=/var/lib/unbound/root.key \

           --enable-libdane \

%else

           --disable-libdane \

%endif

%if %{with certificate_compression}

	   --with-zlib --with-brotli --with-zstd \

%else

	   --without-zlib --without-brotli --without-zstd \

%endif

           --disable-rpath \

           --with-default-priority-string="@SYSTEM"

# build libgnutlsxx.so with older SONAME

make %{?_smp_mflags} V=1 CXX_LT_CURRENT=29 CXX_LT_REVISION=0 CXX_LT_AGE=1

%install

make install DESTDIR=$RPM_BUILD_ROOT

# build libgnutlsxx.so with newer SONAME

pushd lib

rm -f libgnutlsxx.la

make %{?_smp_mflags} V=1

make install DESTDIR=$RPM_BUILD_ROOT

popd

touch doc/examples/ex-cxx

make -C doc install-html DESTDIR=$RPM_BUILD_ROOT

rm -f $RPM_BUILD_ROOT%{_infodir}/dir

rm -f $RPM_BUILD_ROOT%{_libdir}/*.la

rm -f $RPM_BUILD_ROOT%{_libdir}/guile/2.2/guile-gnutls*.a

rm -f $RPM_BUILD_ROOT%{_libdir}/guile/2.2/guile-gnutls*.la

%if %{without dane}

rm -f $RPM_BUILD_ROOT%{_libdir}/pkgconfig/gnutls-dane.pc

%endif

%if %{with fips}

# doing it twice should be a no-op the second time,

# and this way we avoid redefining it and missing a future change

%{__spec_install_post}

./lib/fipshmac "$RPM_BUILD_ROOT%{_libdir}/libgnutls.so.30" > $RPM_BUILD_ROOT%{_libdir}/.gnutls.hmac

sed -i "s^$RPM_BUILD_ROOT/usr^^" $RPM_BUILD_ROOT%{_libdir}/.gnutls.hmac

%endif

%if %{with fips}

%define __spec_install_post \

	%{?__debug_package:%{__debug_install_post}} \

	%{__arch_install_post} \

	%{__os_install_post} \

%{nil}

%endif

%find_lang gnutls

%check

%if %{with tests}

make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null

%endif

%files -f gnutls.lang

%{_libdir}/libgnutls.so.30*

%if %{with fips}

%{_libdir}/.gnutls.hmac

%endif

%doc README.md AUTHORS NEWS THANKS

%license LICENSE doc/COPYING doc/COPYING.LESSER

%files c++

%{_libdir}/libgnutlsxx.so.*

%files devel

%{_includedir}/*

%{_libdir}/libgnutls*.so

%{_libdir}/pkgconfig/*.pc

%{_mandir}/man3/*

%{_infodir}/gnutls*

%{_infodir}/pkcs11-vision*

%{_docdir}/manual/*

%files utils

%{_bindir}/certtool

%if %{with tpm12}

%{_bindir}/tpmtool

%endif

%{_bindir}/ocsptool

%{_bindir}/psktool

%{_bindir}/p11tool

%{_bindir}/srptool

%if %{with dane}

%{_bindir}/danetool

%endif

%{_bindir}/gnutls*

%{_mandir}/man1/*

%doc doc/certtool.cfg

%if %{with dane}

%files dane

%{_libdir}/libgnutls-dane.so.*

%endif

%if %{with guile}

%files guile

%{_libdir}/guile/2.2/guile-gnutls*.so*

%{_libdir}/guile/2.2/site-ccache/gnutls.go

%{_libdir}/guile/2.2/site-ccache/gnutls/extra.go

%{_datadir}/guile/site/2.2/gnutls.scm

%{_datadir}/guile/site/2.2/gnutls/extra.scm

%endif

%changelog

* Tue Sep 27 2022 Daiki Ueno <dueno@redhat.com> - 3.7.6-12

- fips: mark PBKDF2 with short key and output sizes non-approved

- fips: only mark HMAC as approved in PBKDF2

- fips: mark gnutls_key_generate with short key sizes non-approved

- fips: fix checking on hash algorithm used in ECDSA

- fips: preserve operation context around FIPS selftests API

* Fri Aug 26 2022 Daiki Ueno <dueno@redhat.com> - 3.7.6-11

- Supply --with{,out}-{zlib,brotli,zstd} explicitly

* Thu Aug 25 2022 Daiki Ueno <dueno@redhat.com> - 3.7.6-10

- Revert nettle version pinning as it doesn't work well in side-tag

* Thu Aug 25 2022 Daiki Ueno <dueno@redhat.com> - 3.7.6-9

- Pin nettle version in Requires when compiled with FIPS

* Tue Aug 23 2022 Daiki Ueno <dueno@redhat.com> - 3.7.6-8

- Bundle GMP to privatize memory functions

- Disable certificate compression support by default

* Tue Aug 23 2022 Daiki Ueno <dueno@redhat.com> - 3.7.6-7

- Update gnutls-3.7.6-cpuid-fixes.patch

* Sat Aug 20 2022 Daiki Ueno <dueno@redhat.com> - 3.7.6-6

- Mark RSA SigVer operation approved for known modulus sizes (#2119770)

- accelerated: clear AVX bits if it cannot be queried through XSAVE

* Thu Aug  4 2022 Daiki Ueno <dueno@redhat.com> - 3.7.6-5

- Block DES-CBC usage in decrypting PKCS#12 bag under FIPS (#2115314)

- sysrng: reseed source DRBG for prediction resistance

* Fri Jul 29 2022 Daiki Ueno <dueno@redhat.com> - 3.7.6-4

- Make gnutls-cli work with KTLS for testing

- Fix double-free in gnutls_pkcs7_verify (#2109789)

* Mon Jul 25 2022 Daiki Ueno <dueno@redhat.com> - 3.7.6-3

- Limit input size for AES-GCM according to SP800-38D (#2108635)

- Do not treat GPG verification errors as fatal

- Remove gnutls-3.7.6-libgnutlsxx-const.patch

* Tue Jul 19 2022 Daiki Ueno <dueno@redhat.com> - 3.7.6-2

- Allow enabling KTLS with config file (#2108532)

* Fri Jul  1 2022 Daiki Ueno <dueno@redhat.com> - 3.7.6-1

- Update to gnutls 3.7.6 (#2102591)

* Thu Mar 31 2022 Daiki Ueno <dueno@redhat.com> - 3.7.3-10

- Use only the first component of VERSION from /etc/os-release (#2076626)

- Don't run power-on self-tests on DSA (#2076627)

* Fri Feb 25 2022 Daiki Ueno <dueno@redhat.com> - 3.7.3-9

- Stop using typeof keyword for tss2 function prototypes (#2057490)

- Ensure allowlist API is called before priority string construction (#1975421)

* Thu Feb 24 2022 Daiki Ueno <dueno@redhat.com> - 3.7.3-8

- Fix previous change for loading libtss2* (#2057490)

* Wed Feb 23 2022 Daiki Ueno <dueno@redhat.com> - 3.7.3-7

- Increase GNUTLS_MAX_ALGORITHM_NUM for allowlisting (#2033220)

- Ensure allowlisting API is called before priority string is constructed (#2042532)

- Use dlopen for loading libtss2* to avoid OpenSSL dependency (#2057490)

* Tue Feb 22 2022 Daiki Ueno <dueno@redhat.com> - 3.7.3-6

- Compile out GOST algorithm IDs (#1945292)

* Thu Feb 17 2022 Zoltan Fridrich <zfridric@redhat.com> - 3.7.3-5

- Fix upstream testsuite in fips mode (#2051637)

* Wed Feb 16 2022 Daiki Ueno <dueno@redhat.com> - 3.7.3-4

- Specify FIPS140-3 module name and version

- fips: allow a few more primes in RSA key generation

- fips: tighten PKCS#12 algorithm checks

- Correct return value of KTLS stub API

* Tue Feb 15 2022 Zoltan Fridrich <zfridric@redhat.com> - 3.7.3-3

- Disable config reload in order to not break allowlisting (#2042532)

* Wed Feb  2 2022 Daiki Ueno <dueno@redhat.com> - 3.7.3-2

- Build with TPM2 support, patch from Alexander Sosedkin (#2033220)

* Tue Jan 18 2022 Daiki Ueno <dueno@redhat.com> - 3.7.3-1

- Update to gnutls 3.7.3 (#2033220)

* Wed Dec 22 2021 Daiki Ueno <dueno@redhat.com> - 3.7.2-10

- Update gnutls_{hash,hmac}_copy man-pages as well (#1999639)

* Wed Dec 22 2021 Daiki Ueno <dueno@redhat.com> - 3.7.2-9

- Drop support for GNUTLS_NO_EXPLICIT_INIT envvar in favor of

  GNUTLS_NO_IMPLICIT_INIT (#1999639)

- Expand documentation of gnutls_{hash,hmac}_copy, mentioning that

  those do not always work (#1999639)

* Tue Dec 21 2021 Daiki Ueno <dueno@redhat.com> - 3.7.2-9

- Fix race condition when resolving SYSTEM priority in allowlisting mode (#2012249)

* Thu Oct 21 2021 Daiki Ueno <dueno@redhat.com> - 3.7.2-8

- Fix issues in bundled libopts, spotted by covscan (#1938730)

* Tue Oct 12 2021 Daiki Ueno <dueno@redhat.com> - 3.7.2-7

- Enable Intel CET

- Remove unnecessary CCASFLAGS setting for annocheck

* Thu Aug 19 2021 Daiki Ueno <dueno@redhat.com> - 3.7.2-6

- Reorder doc/invoke-*.texi generation (#1975482)

- Temporarily disable LTO for aarch64 and ppc64le

* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 3.7.2-5

- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags

  Related: rhbz#1991688

* Mon Aug  2 2021 Daiki Ueno <dueno@redhat.com> - 3.7.2-4

- Disable GOST cryptography by default (#1945292)

- Tighten timestamp adjustment when not bootstrapping (#1975482)

- Re-enable LTO (#1986143)

* Mon Jun 28 2021 Daiki Ueno <dueno@redhat.com> - 3.7.2-3

- Enable allowlisting configuration mode (#1975421)

* Sat Jun 26 2021 Daiki Ueno <dueno@redhat.com> - 3.7.2-2

- Remove %%defattr invocations which are no longer necessary

- libpkcs11mock1.* is not installed anymore

- hobble-gnutls: Remove SRP removal

- Use correct source URL

- Switch to using %%gpgverify macro

* Fri Jun 25 2021 Daiki Ueno <dueno@redhat.com> - 3.7.2-1

- Update to upstream 3.7.2 release (#1966479)

* Tue Jun 22 2021 Mohan Boddu <mboddu@redhat.com> - 3.7.1-6

- Rebuilt for RHEL 9 BETA for openssl 3.0

  Related: rhbz#1971065

* Thu Jun  3 2021 Daiki Ueno <dueno@redhat.com> - 3.7.1-5

- Fix typo in TPM 1.2 disablement (#1927370)

* Thu May 27 2021 Daiki Ueno <dueno@redhat.com> - 3.7.1-4

- Disable TPM support by default (#1927370)

* Thu Apr 15 2021 Mohan Boddu <mboddu@redhat.com> - 3.7.1-3

- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937

* Tue Mar 16 2021 Daiki Ueno <dueno@redhat.com> - 3.7.1-2

- Restore fipscheck dependency

* Sat Mar 13 2021 Daiki Ueno <dueno@redhat.com> - 3.7.1-1

- Update to upstream 3.7.1 release

- Remove fipscheck dependency, as it is now calculated with an

  internal tool

* Fri Mar  5 2021 Daiki Ueno <dueno@redhat.com> - 3.7.0-4

- Tolerate duplicate certs in the chain also with PKCS #11 trust store

* Tue Mar  2 2021 Daiki Ueno <dueno@redhat.com> - 3.7.0-3

- Reduce BRs for non-bootstrapping build

* Wed Feb 10 2021 Daiki Ueno <dueno@redhat.com> - 3.7.0-2

- Tolerate duplicate certs in the chain

* Mon Feb  8 2021 Daiki Ueno <dueno@redhat.com> - 3.7.0-1

- Update to upstream 3.7.0 release

- Temporarily disable LTO

* Tue Jan 26 2021 Daiki Ueno <dueno@redhat.com> - 3.6.15-4

- Fix broken tests on rawhide (#1908110)

- Add BuildRequires: make (by Tom Stellard)

* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.15-3

- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild

* Mon Sep 28 2020 Jeff Law <law@redhat.com> - 3.6.15-2

- Re-enable LTO now that upstream GCC bugs have been fixed

* Fri Sep  4 2020 Daiki Ueno <dueno@redhat.com> - 3.6.15-1

- Update to upstream 3.6.15 release

* Mon Aug 17 2020 Jeff Law <law@redhat.com> - 3.6.14-7

- Disable LTO on ppc64le

* Tue Aug  4 2020 Daiki Ueno <dueno@redhat.com> - 3.6.14-6

- Fix underlinking of libpthread

* Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.14-5

- Second attempt - Rebuilt for

  https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild

* Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.14-4

- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild

* Thu Jul 02 2020 Anderson Sasaki <ansasaki@redhat.com> - 3.6.14-3

- Rebuild with autogen built with guile-2.2 (#1852706)

* Tue Jun 09 2020 Anderson Sasaki <ansasaki@redhat.com> - 3.6.14-2

- Fix memory leak when serializing iovec_t (#1845083)

- Fix automatic libraries sonames detection (#1845806)

* Thu Jun  4 2020 Daiki Ueno <dueno@redhat.com> - 3.6.14-1

- Update to upstream 3.6.14 release

* Sun May 31 2020 Daiki Ueno <dueno@redhat.com> - 3.6.13-6

- Update gnutls-3.6.13-superseding-chain.patch

* Sun May 31 2020 Daiki Ueno <dueno@redhat.com> - 3.6.13-5

- Fix cert chain validation behavior if the last cert has expired (#1842178)

* Mon May 25 2020 Anderson Sasaki <ansasaki@redhat.com> - 3.6.13-4

- Add option to gnutls-cli to wait for resumption under TLS 1.3

* Tue May 19 2020 Anderson Sasaki <ansasaki@redhat.com> - 3.6.13-3

- Disable RSA blinding during FIPS self-tests

* Thu May 14 2020 Anderson Sasaki <ansasaki@redhat.com> - 3.6.13-2

- Bump linked libraries soname to fix FIPS selftests (#1835265)

* Tue Mar 31 2020 Daiki Ueno <dueno@redhat.com> - 3.6.13-1

- Update to upstream 3.6.13 release

* Thu Mar 26 2020 Anderson Sasaki <ansasaki@redhat.com> - 3.6.12-2

- Fix FIPS POST (#1813384)

- Fix gnutls-serv --echo to not exit when a message is received (#1816583)

* Sun Feb 02 2020 Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com> - 3.6.12-1

- Update to upstream 3.6.12 release

* Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.11-2

- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild

* Mon Dec 02 2019 Nikos Mavrogiannopoulos <nmav@gnutls.org> - 3.6.11-1

- Update to upstream 3.6.11 release

* Sun Sep 29 2019 Nikos Mavrogiannopoulos <nmav@gnutls.org> - 3.6.10-1

- Update to upstream 3.6.10 release

* Fri Jul 26 2019 Nikos Mavrogiannopoulos <nmav@gnutls.org> - 3.6.9-1

- Update to upstream 3.6.9 release

* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.8-3

- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild

* Mon Jul 15 2019 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.8-2

- Rebuilt with guile-2.2

* Tue May 28 2019 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.8-1

- Update to upstream 3.6.8 release

* Wed Mar 27 2019 Anderson Toshiyuki Sasaki <ansasaki@redhat.com> - 3.6.7-1

- Update to upstream 3.6.7 release

- Fixed CVE-2019-3836 (#1693214)

- Fixed CVE-2019-3829 (#1693210)

* Fri Feb  1 2019 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.6-1

- Update to upstream 3.6.6 release

* Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.5-3

- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild

* Fri Jan 11 2019 Anderson Toshiyuki Sasaki <ansasaki@redhat.com> - 3.6.5-2

- Added explicit Requires for nettle >= 3.4.1

* Tue Dec 11 2018 Anderson Toshiyuki Sasaki <ansasaki@redhat.com> - 3.6.5-1

- Update to upstream 3.6.5 release

* Mon Oct 29 2018 James Antill <james.antill@redhat.com> - 3.6.4-5

- Remove ldconfig scriptlet, now done via. transfiletrigger in glibc.

* Wed Oct 17 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.4-4

- Fix issue with rehandshake affecting glib-networking (#1634736)

* Tue Oct 16 2018 Tomáš Mráz <tmraz@redhat.com> - 3.6.4-3

- Add missing annobin notes for assembler sources

* Tue Oct 09 2018 Petr Menšík <pemensik@redhat.com> - 3.6.4-2

- Rebuilt for unbound 1.8

* Tue Sep 25 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.4-1

- Updated to upstream 3.6.4 release

- Added support for the latest version of the TLS1.3 protocol

- Enabled SHA1 support as SHA1 deprecation is handled via the

  fedora crypto policies.

* Thu Aug 16 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.3-4

- Fixed gnutls-cli input reading

- Ensure that we do not cause issues with version rollback detection

  and TLS1.3.

* Tue Aug 07 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.3-3

- Fixed ECDSA public key import (#1612803)

* Thu Jul 26 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.3-2

- Backported regression fixes from 3.6.2

* Mon Jul 16 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.3-1

- Update to upstream 3.6.3 release

* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.2-5

- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild

* Wed Jun 13 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.2-4

- Enable FIPS140-2 mode in Fedora

* Wed Jun 06 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.2-3

- Update to upstream 3.6.2 release

* Fri May 25 2018 David Abdurachmanov <david.abdurachmanov@gmail.com> - 3.6.2-2

- Add missing BuildRequires: gnupg2 for gpgv2 in %%prep

* Fri Feb 16 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.2-1

- Update to upstream 3.6.2 release

* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.1-5

- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

* Fri Feb  2 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.1-4

- Rebuilt to address incompatibility with new nettle

* Thu Nov 30 2017 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.1-3

- Corrected regression from 3.6.1-2 which prevented the loading of

  arbitrary p11-kit modules (#1507402)

* Mon Nov  6 2017 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.1-2

- Prevent the loading of all PKCS#11 modules on certificate verification