linux/poky.git/meta/recipes-support/gnutls, branch 5.2_M3

libtasn1: upgrade 4.19.0 -> 4.20.0

2025-03-06T11:16:46+00:00

* Noteworthy changes in release 4.20.0 (2025-02-01) [stable] - The release tarball is now reproducible. - We publish a minimal source-only tarball generated by 'git archive'. - Update gnulib files and various build/maintenance fixes. - Fix CVE-2024-12133: Potential DoS in handling of numerous SEQUENCE OF or SET OF elements License-Update: file COPYING.LESSER renamed to COPYING.LESSERv2 & Copyright year updated to 2025 (From OE-Core rev: 3a8633b9f522e0be31c08790a3f2050c6d052d93) Signed-off-by: Vijay Anusuri Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

gnutls: upgrade 3.8.8 -> 3.8.9

2025-02-18T22:53:45+00:00

Solves CVE-2024-12243 Refreshed patches License-Update: multiple changes * https://gitlab.com/gnutls/gnutls/-/commit/a8727cdb076287d0a2098ba49d76899b4e70160e COPYING.LESSER updated wording to latest FSF version * https://gitlab.com/gnutls/gnutls/-/commit/75f5ea80738156b81de30ae9b482a69cf4e77e9d LICENSE file merged to README.md COPYING and COPYING.LESSERv2 moved to top-level directory Release notes: https://gitlab.com/gnutls/gnutls/-/blob/3.8.9/NEWS?ref_type=tags * Version 3.8.9 (released 2025-02-07) ** libgnutls: leancrypto was added as an interim option for PQC The library can now be built with leancrypto instead of liboqs for post-quantum cryptography (PQC), when configured with --with-leancrypto option instead of --with-liboqs. ** libgnutls: Experimental support for ML-DSA signature algorithm The library and certtool now support ML-DSA signature algorithm as defined in FIPS 204 and based on draft-ietf-lamps-dilithium-certificates-04. This feature is currently marked as experimental and can only be enabled when compiled with --with-leancrypto or --with-liboqs. Contributed by David Dudas. ** libgnutls: Support for ML-KEM-1024 key encapsulation mechanism The support for ML-KEM post-quantum key encapsulation mechanisms has been extended to cover ML-KEM-1024, in addition to ML-KEM-768. MLKEM1024 is only offered as SecP384r1MLKEM1024 hybrid as per draft-kwiatkowski-tls-ecdhe-mlkem-03. ** libgnutls: Fix potential DoS in handling certificates with numerous name constraints, as a follow-up of CVE-2024-12133 in libtasn1. The bundled copy of libtasn1 has also been updated to the latest 4.20.0 release to complete the fix. Reported by Bing Shi (#1553). [GNUTLS-SA-2025-02-07, CVSS: medium] [CVE-2024-12243] ** API and ABI modifications: GNUTLS_PK_MLDSA44: New enum member of gnutls_pk_algorithm_t GNUTLS_PK_MLDSA65: New enum member of gnutls_pk_algorithm_t GNUTLS_PK_MLDSA87: New enum member of gnutls_pk_algorithm_t GNUTLS_SIGN_MLDSA44: New enum member of gnutls_sign_algorithm_t GNUTLS_SIGN_MLDSA65: New enum member of gnutls_sign_algorithm_t GNUTLS_SIGN_MLDSA87: New enum member of gnutls_sign_algorithm_t (From OE-Core rev: 4313d931673dd86aaf590c68f7b1fa364d752740) Signed-off-by: Peter Marko Signed-off-by: Richard Purdie

meta/meta-selftest: Fix variable assignment whitespace

2025-02-01T13:42:34+00:00

Recipes are much more readable with whitespace around the assignment operators. Fix various assignments in OE-Core to show this is definitely the preferred formatting. (From OE-Core rev: 30ea609d3357fb3de911f2f6a5e6856c151b976a) Signed-off-by: Richard Purdie

gnutls: Upgrade to 3.8.8

2024-11-25T22:23:25+00:00

In 3.8.7 is that the linkage to compression libraries were changed to use a new tool called dlwrap, this caused issues during the last upgrade but is resolved now with the update to 3.8.8. Remove the workarounds for the update hence. Changes in 3.8.8 include: * libgnutls: * Experimental support for X25519MLKEM768 and SecP256r1MLKEM768 key exchange in TLS 1.3 * All records included in an OCSP response are now checked in TLS * Handling of malformed compress_certificate extension is now more standard compliant * More flexible library linking options for compression libraries, TPM, and liboqs support. The configure options, --with-zstd, --with-brotli, --with-zlib, --with-tpm2, and --with-liboqs now take 4 states: yes/link/dlopen/no, to specify how the libraries are linked or loaded. Do not set a specific library linking option but use the default(yes). (From OE-Core rev: 6620623ce280d20c2430ba87ba276a0490b05080) Signed-off-by: Simone Weiß Signed-off-by: Richard Purdie

gnutls: upgrade to 3.8.7.1

2024-09-30T16:00:50+00:00

A notable change in 3.8.7 is that the linkage to compression libraries was changed to use a new tool called dlwrap, so these libraries should be loaded at runtime with dlopen() instead of dynamically linked at build time. However, the dlopen() detection fails in cross builds[1] and it falls back to dynamic linking so this isn't an issue we need to deal with at present. Also note that whilst dlwrap is a tool written in rust that needs the clang includes, it's a maintainer tool and the generated files are in git, so we should never need to rerun it. Backport a patch to fix AM_CONDITIONAL to resolve linkage problems. The 3.8.7.1 tarball is actually just a rebuild of 3.8.7 with the translations included (which were missing in 3.8.7), so set S explicitly for this release. [1] https://gitlab.com/gnutls/gnutls/-/issues/1583 (From OE-Core rev: d38f32f493192fa5965f7271ef6ba5aae33849f5) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

gnutls: upgrade 3.8.5 -> 3.8.6

2024-07-21T10:08:11+00:00

Changelog: ** libgnutls: PBMAC1 is now supported as a MAC mechanism for PKCS#12 To be compliant with FIPS 140-3, PKCS#12 files with MAC based on PBKDF2 (PBMAC1) is now supported, according to the specification proposed in draft-ietf-lamps-pkcs12-pbmac1. ** libgnutls: SHA3 extendable output functions (XOF) are now supported SHA3 XOF, SHAKE128 and SHAKE256, are now usable through a new public API gnutls_hash_squeeze. ** API and ABI modifications: gnutls_pkcs12_generate_mac3: New function gnutls_pkcs12_flags_t: New enum gnutls_hash_squeeze: New function (From OE-Core rev: 61e7888c8e31ac2adee9eb75ee2393125ef9b433) Signed-off-by: Simone Weiß Signed-off-by: Richard Purdie

gnutls: Fix failing ptests

2024-04-23T12:40:24+00:00

When upgrading gnutls to the newest version 3.8.5, some ptest failed. Backported a patch from upstream gnutls(not in any release yet) to fix this issue. (From OE-Core rev: 25135cd910e24117aa493abcb7f6aeee0b84ab82) Signed-off-by: Simone Weiß Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

gnutls: upgrade 3.8.4 -> 3.8.5

2024-04-23T12:40:24+00:00

Add-ptest-support.patch refreshed for 3.8.5 Changelog: ========== * libgnutls: Due to majority of usages and implementations of RSA decryption with PKCS#1 v1.5 padding being incorrect, leaving them vulnerable to Marvin attack, the RSAES-PKCS1-v1_5 is being deprecated (encryption and decryption) and will be disabled in the future. * libgnutls: Added support for RIPEMD160 and PBES1-DES-SHA1 for backward compatibility with GCR. * libgnutls: A couple of memory related issues have been fixed in RSA PKCS#1 v1.5 decryption error handling and deterministic ECDSA with earlier versions of GMP. * build: Fixed a bug where building gnutls statically failed due to a duplicate definition of nettle_rsa_compute_root_tr(). (From OE-Core rev: 594ef33f9d5bc6fba1c9b1393936f26920406826) Signed-off-by: Wang Mingyu Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

gnutls: upgrade 3.8.3 -> 3.8.4

2024-04-04T13:05:03+00:00

- Upgrade gnutls SRCREV for new version - Refresh patches for 3.8.4 Changelog: ========== ** libgnutls: RSA-OAEP encryption scheme is now supported To use it with an unrestricted RSA private key, one would need to initialize a gnutls_x509_spki_t object with necessary parameters for RSA-OAEP and attach it to the private key. It is also possible to import restricted private keys if they are stored in PKCS#8 format. ** libgnutls: Fix side-channel in the deterministic ECDSA. Reported by George Pantelakis (#1516). [GNUTLS-SA-2023-12-04, CVSS: medium] [CVE-2024-28834] ** libgnutls: Fixed a bug where certtool crashed when verifying a certificate chain with more than 16 certificates. Reported by William Woodruff (#1525) and yixiangzhike (#1527). [GNUTLS-SA-2024-01-23, CVSS: medium] [CVE-2024-28835] ** libgnutls: Compression libraries are now loaded dynamically as needed instead of all being loaded during gnutls library initialization. As a result, the library initialization should be faster. ** build: The gnutls library can now be linked with the static library of GMP. Note that in order for this to work libgmp.a needs to be compiled with -fPIC and libhogweed in Nettle also has to be linked to the static library of GMP. This can be used to prevent custom memory allocators from being overriden by other applications. ** API and ABI modifications: gnutls_x509_spki_get_rsa_oaep_params: New function. gnutls_x509_spki_set_rsa_oaep_params: New function. GNUTLS_PK_RSA_OAEP: New enum member of gnutls_pk_algorithm_t. (From OE-Core rev: feaa2b8065c7a02b52aa55954f05a3ee66260305) Signed-off-by: Simone Weiß Signed-off-by: Richard Purdie

gnutls: print log if ptest fails

2024-02-08T10:53:13+00:00

There are AB-INT issues with the gnutls tests and the test for naked-alerts is failing. Tweak the run-ptest script to save the error log to obtain more infos for debugging. Related to [YOCTO #15352]. (From OE-Core rev: 9665d272df34bcb2811a2f7a1afccabe4bebc9d1) Signed-off-by: Simone Weiß Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie