【commit】 [gnutls] commit 跟踪

该 issue 记录 rpm-tracker 工具爬取得到的社区 commit 信息，请对每个 commit 进行分析，具体操作如下：

1. 判断分类是否正确：
    - 正确：无需操作
    - 错误：评论 `/update_type` 更新 commit 分类
    - **支持类型**：CVE修复、Bug修复、性能优化、新增功能或删除功能、测试代码改进、文档改进、其他

2. 判断是否需要合入：
    - 合入：依次使用 `/pick`、`/recheck`、`/pr` 合入 commit，进行编译兼容性检查，创建 pr
    - 不需要合入-已存在：`/in_tarball` commit 已存在当前版本 source，不需要合入，隐藏 commit 不展示
    - 不需要合入-其他：`/hide` 基于其他原因，不需要合入，隐藏 commit 不展示

3. 反馈意见：
    - 对 commit 信息反馈：`/note` 针对 commit 信息进行反馈
    - 其他：若需要针对整体爬取过程进行反馈，请在 [tracker-feedback](https://gitee.com/OpenCloudOS/tracker-feedback/issues) 仓库中提交 issue

:loudspeaker:**commit_id 支持批量处理**：
- 要求使用 **英文单引号/双引号** 包起所有commit_id，使用空格分割；
- 请使用 commit 信息中展示的 **7位 commit id**，注意大小写敏感。
- Eg: `/update_type "ed96020 8c2782f" Bug修复`

---
详细命令说明：
| 命令 | 说明 |
|---|---|
| `/update_type "<commit_id>" <类型>` | 评论后 issue 页面刷新展示信息 |
| `/in_tarball "<commit_id>"` | 反馈后 issue 页面隐藏该 commit |
| `/hide "<commit_id>" <原因>` | 反馈后 issue 页面隐藏该 commit，原因记录于数据库 |
| `/pick "<commit_id>"` | 选择 commit 合入，进行编译、兼容性检查。|
| `/recheck` | 适配 commit 修改仓库，重新执行编译、兼容性检查 |
| `/pr "<commit_id>"` | 将 pick 后的 commit 提交 pr |
| `/note "<commit_id>" <反馈内容>` | 针对某条 commit 进行反馈，记录于 [tracker-feedback](https://gitee.com/OpenCloudOS/tracker-feedback/) 仓库 |

rpm-tracker 抓取数据如下：
| branch | id | date | message | type | 能否合入 |
| --- | --- | --- | --- | --- | --- |
| master | [d214cd4](https://gitlab.com/gnutls/gnutls/-/commit/d214cd4570fb1559a20e941bb7ceac7df52e96d3) | 2024-03-27 | Mangle/hide GNUTLS-built nettle_rsa_compute_root_tr() Since bfb326f6e ("nettle: plumb RSA-OAEP in the Nettle crypto backend"), building gnutls statically fails due to a duplicate definition of nettle_rsa_compute_root_tr (which comes from "rsa_compute_root_tr" being replaced by a preprocessor macro). This patch fixes this by renaming the GNUTLS version by redefining the value of the rsa_compute_root_tr macro. Signed-off-by: Alyssa Ross <hi@alyssa.is> | Bug修复 | False |
| master | [bc3b05c](https://gitlab.com/gnutls/gnutls/-/commit/bc3b05cd5f8bbb23cf2acb37453d8862efb4a905) | 2024-03-26 | x509: support PBES1-DES-SHA1 PBES1 with single DES backed by SHA-1 hash is used to parse legacy PKCS#8 file in GCR. Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | False |
| master | [0337521](https://gitlab.com/gnutls/gnutls/-/commit/0337521f88799f616faca089026c4c45a2ed3d76) | 2024-03-26 | nettle: avoid potential memleak with GMP older than 6.2.0 As GMP 6.1.0 or ealier eagerly allocates memory at mpz_init_set_str, if the operand is already initialized, it will cause a small leak. See also: https://gmplib.org/repo/gmp/rev/f049e75390fc Signed-off-by: Daiki Ueno <ueno@gnu.org> | Bug修复 | True |
| master | [5e8afe0](https://gitlab.com/gnutls/gnutls/-/commit/5e8afe0d6bf4e6980ed2fa7e50a773c2fad44ea9) | 2024-03-24 | gnutls_privkey_decrypt_data: don't free plaintext on failure As _wrap_nettle_pk_decrypt uses a locally allocated buffer for the plaintext, it doesn't need to free the plaintext given by the caller. Signed-off-by: Daiki Ueno <ueno@gnu.org> | Bug修复 | False |
| master | [afcfb06](https://gitlab.com/gnutls/gnutls/-/commit/afcfb06e56b0fbd0a381686771cf201f9d1cad80) | 2024-03-23 | nettle: plumb RIPEMD160 RIPEMD160 is still used by GnuTLS to calculate fingerprint for an OpenPGP key when displaying it: - https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=g10/keyid.c;h=7e4c50b59de8c25756c5ce890deecab233f19b53;hb=refs/heads/master#l800 - https://gitlab.gnome.org/GNOME/gcr/-/blob/f3c95db45099dff288986aa367007da1e855a3d0/gcr/gcr-openpgp.c#L268 Signed-off-by: Daiki Ueno <ueno@gnu.org> | Bug修复 | True |
| master | [1c4701f](https://gitlab.com/gnutls/gnutls/-/commit/1c4701ffc342259fc5965d5a0de90d87f780e3e5) | 2024-03-18 | nettle: avoid normalization of mpz_t in deterministic ECDSA This removes function calls that potentially leak bit-length of a private key used to calculate a nonce in deterministic ECDSA. Namely: - _gnutls_dsa_compute_k has been rewritten to work on always zero-padded mp_limb_t arrays instead of mpz_t - rnd_mpz_func has been replaced with rnd_datum_func, which is backed by a byte array instead of an mpz_t value Signed-off-by: Daiki Ueno <ueno@gnu.org> | CVE修复（引擎分类） CVE-2024-28834 | False |
| master | [e369e67](https://gitlab.com/gnutls/gnutls/-/commit/e369e67a62f44561d417cb233acc566cc696d82d) | 2024-03-18 | gnutls_x509_trust_list_verify_crt2: remove length limit of input Previously, if cert_list_size exceeded DEFAULT_MAX_VERIFY_DEPTH, the chain verification logic crashed with assertion failure. This patch removes the restriction while keeping the maximum number of retrieved certificates being DEFAULT_MAX_VERIFY_DEPTH. Signed-off-by: Daiki Ueno <ueno@gnu.org> | CVE修复（引擎分类） CVE-2024-28835 | False |
| master | [61babf3](https://gitlab.com/gnutls/gnutls/-/commit/61babf32c93718406c383fa7a99f30d41fd0cf69) | 2024-03-15 | TLS interoperability: test actual compiled master Previously, system (fedora) version of GnuTLS was used in TLS interoperability tests. fedora-ktls/build was repurposed for native (as similar as possible) fedora build and both unit- and interop- tests are running with this build. Signed-off-by: Stanislav Zidek <szidek@redhat.com> | 性能优化 | False |
| master | [81d3096](https://gitlab.com/gnutls/gnutls/-/commit/81d3096436cb3559c8142f673ad7b369200c92bb) | 2024-03-09 | x509: fix reading of MGF-1 OID asn1_read_value may return error code in a positive integer thus the previous code could lead to an access to uninitialized value. This is a regression in the RSA-OAEP support. Spotted by oss-fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67300 Signed-off-by: Daiki Ueno <ueno@gnu.org> | Bug修复 | False |
| master | [dc5dc4e](https://gitlab.com/gnutls/gnutls/-/commit/dc5dc4e5883d42dd5ff4e14fbf334e5a0236d570) | 2024-03-04 | Fix mingw build on fedora Signed-off-by: Zoltan Fridrich <zfridric@redhat.com> | Bug修复 | True |
| master | [801a4f1](https://gitlab.com/gnutls/gnutls/-/commit/801a4f104e42d69871d2bfc22a6d6beecb601215) | 2024-03-04 | Fix typo in fallback _gnutls_no_log macro alias in errors.h Previously, when C99_MACROS is not defined, _gnutls_no_log was expanded to _gnutle_null_log and thus caused a compilation error. Reported by Andrew Lilley Brinker in: https://gitlab.com/gnutls/gnutls/-/issues/1530 Signed-off-by: Ramesh <adhikari.resume@gmail.com> | Bug修复 | True |
| master | [860b709](https://gitlab.com/gnutls/gnutls/-/commit/860b709afdcf95a4a5cdeabea472ee418af2e445) | 2024-03-03 | Remove duplicate line in eagain-common.h HANDSHAKE(c, s) has already been defined on line 64. Hence, the macro on line 96 can be removed. Signed-off-by: Sahil Siddiq <icegambit91@gmail.com> | 性能优化 | True |
| master | [a6ad47e](https://gitlab.com/gnutls/gnutls/-/commit/a6ad47ec735a963c54d0eb587540b3cd74df9bf7) | 2024-03-03 | tests: rewrite 'hello_retry_request' as single process Part of issue #1472. https://gitlab.com/gnutls/gnutls/-/issues/1472 Signed-off-by: Sahil Siddiq <icegambit91@gmail.com> | 性能优化 | True |
| master | [ce913b7](https://gitlab.com/gnutls/gnutls/-/commit/ce913b7fe5c5424741355cbd894cd5c5871008c2) | 2024-03-03 | abstract: plumb RSA-OAEP in the abstract key types API Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | True |
| master | [de1b92f](https://gitlab.com/gnutls/gnutls/-/commit/de1b92f5d6a842c9eecde3d77fe6805521a97981) | 2024-03-03 | x509: plumb RSA-OAEP in X.509 interface Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | False |
| master | [3bc7fca](https://gitlab.com/gnutls/gnutls/-/commit/3bc7fca8829bc86f8c8621d5fae4f0a475764193) | 2024-03-03 | _gnutls_x509_decode_string: tolerate empty strings Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | True |
| master | [2270ef4](https://gitlab.com/gnutls/gnutls/-/commit/2270ef47536ee0df894f730ca4fc12001dc2ae74) | 2024-02-23 | tests: support KAT in (EC)DH tests While the logic existed, known answer tests were omitted in tests/dh-compute, tests/dh-compute2, tests/ecdh-compute, and tests/ecdh-compute2. This enables the support for it as well as fixes a couple of issues in the logic: avoid using `success` variable as it shadows the helper function with the same name defined in tests/utils.h, invert the memcmp condition, and properly use peer_x and peer_y in place of x and y in ecdh-compute2. Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | True |
| master | [b79e042](https://gitlab.com/gnutls/gnutls/-/commit/b79e04228bd998cd438cc13cc002e92ddbbba692) | 2024-02-18 | spki: support RSA-OAEP parameters This adds a new API gnutls_x509_spki_{get,set}_rsa_oaep_params to retrieve and store RSA-OAEP parameters embedded in SubjectPublicKeyInfo. As RSA-OAEP labels are allocated, this also adds copy and clear method on the gnutls_x509_spki_st struct and use them extensively instead of memcpy and memset. Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | False |
| master | [0fa63e6](https://gitlab.com/gnutls/gnutls/-/commit/0fa63e6cc2980ec1c5c85204092bc524a712ed86) | 2024-02-15 | build: allow GMP to be statically linked Even though we set the custom allocator[1] to zeroize sensitive data, it can be easily invalidated if the application sets its own custom allocator. An approach to prevent that is to link against a static library of GMP, so the use of GMP is privatized and the custom allocator configuration is not shared with other applications. This patch allows libgnutls to be linked with the static library of GMP. Note that, to this work libgmp.a needs to be compiled with -fPIC and libhogweed in Nettle is also linked to the static library of GMP. 1. https://gitlab.com/gnutls/gnutls/-/merge_requests/1554 Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | True |
| master | [b7cd1e9](https://gitlab.com/gnutls/gnutls/-/commit/b7cd1e93d900675a80fe0701475a3f947bc4039e) | 2024-02-13 | lib: fix a potential segfault in _gnutls13_recv_finished In _gnutls13_recv_finished(), 'buf' is not initialized or set when _gnutls13_compute_finished() returns an err, and goto cleanup may cause a segfault crash as it frees the uninitialized buf.allocd in _gnutls_buffer_clear(). So fix it by return if _gnutls13_compute_finished() returns an err in _gnutls13_recv_finished(). Signed-off-by: Xin Long <lucien.xin@gmail.com> | Bug修复 | True |
| master | [f979aa3](https://gitlab.com/gnutls/gnutls/-/commit/f979aa3d0fcf1c79accc038b6599382efc6e64da) | 2024-02-13 | lib: fix a segfault in _gnutls13_recv_end_of_early_data A crash occur in my app that uses gnutls13 early data, stack trace: #0 free (libc.so.6 + 0x97bf0) #1 _gnutls_buffer_clear (libgnutls.so.30 + 0x77c8c) #2 _gnutls13_recv_end_of_early_data (libgnutls.so.30 + 0xaf308) #3 _gnutls13_handshake_server (libgnutls.so.30 + 0x42d6c) #4 handshake_server (libgnutls.so.30 + 0x4ff6c) The root cause is that _gnutls_buffer_clear() was trying to free 'buf' that is not initialized or set if GNUTLS_NO_END_OF_EARLY_DATA flag is set on server side. This patch fixes it by simply initializing buf at the begginning of _gnutls13_recv_end_of_early_data(). Signed-off-by: Xin Long <lucien.xin@gmail.com> | Bug修复 | True |
| master | [7cea763](https://gitlab.com/gnutls/gnutls/-/commit/7cea7639f6c6781e7aa84ec9bdbf7ee81f2f6961) | 2024-02-13 | lib/mpi.c: extract flag correctly Signed-off-by: Avinash Sonawane <rootkea@gmail.com> | 性能优化 | True |
| master | [b5faada](https://gitlab.com/gnutls/gnutls/-/commit/b5faada34e63ca14657e72bebfa4a71f52000116) | 2024-01-27 | serv: fix memleak when a connected client disappears Reported by Hubert Kario. Signed-off-by: Daiki Ueno <ueno@gnu.org> | Bug修复 | True |
| master | [945c2f1](https://gitlab.com/gnutls/gnutls/-/commit/945c2f10eeda441f32404d1328761e311915add0) | 2024-01-23 | ktls: fix kernel version checking using utsname Signed-off-by: Daiki Ueno <ueno@gnu.org> | CVE修复 | False |
| master | [7f45a94](https://gitlab.com/gnutls/gnutls/-/commit/7f45a942ac8cbf299ca04dbf14c7e447f605209d) | 2024-01-22 | Make compression libraries dynamically loadable Signed-off-by: Zoltan Fridrich <zfridric@redhat.com> | 性能优化 | True |

rpm-tracker 抓取数据如下：
| branch | id | date | message | type | 能否合入 |
| --- | --- | --- | --- | --- | --- |
| master | [40dbbd8](https://gitlab.com/gnutls/gnutls/-/commit/40dbbd8de499668590e8af51a15799fbc430595e) | 2024-01-16 | rsa-psk: minimize branching after decryption This moves any non-trivial code between gnutls_privkey_decrypt_data2 and the function return in _gnutls_proc_rsa_psk_client_kx up until the decryption. This also avoids an extra memcpy to session->key.key. Signed-off-by: Daiki Ueno <ueno@gnu.org> | CVE修复（引擎分类） CVE-2024-0553 | False |
| master | [9edbdaa](https://gitlab.com/gnutls/gnutls/-/commit/9edbdaa84e38b1bfb53a7d72c1de44f8de373405) | 2024-01-16 | x509: detect loop in certificate chain There can be a loop in a certificate chain, when multiple CA certificates are cross-signed with each other, such as A → B, B → C, and C → A. Previously, the verification logic was not capable of handling this scenario while sorting the certificates in the chain in _gnutls_sort_clist, resulting in an assertion failure. This patch properly detects such loop and aborts further processing in a graceful manner. Signed-off-by: Daiki Ueno <ueno@gnu.org> | CVE修复（引擎分类） CVE-2024-0567 | False |
| master | [d76f43f](https://gitlab.com/gnutls/gnutls/-/commit/d76f43f2518f9167f868ab09db7b885459cca0b2) | 2024-01-15 | fips: Zeroize temporary values The standard says "temporary value(s) generated during the integrity test of the module's software […] shall be zeroised from the module upon completion of the integrity test". That includes the computed HMAC value, which is currently not zeroized after the test. Add explicit calls to gnutls_memset() to fix that. Signed-off-by: Clemens Lang <cllang@redhat.com> | Bug修复 | True |
| master | [7083602](https://gitlab.com/gnutls/gnutls/-/commit/70836025cb3d02e71b72538d843b0098478e8adc) | 2024-01-15 | .gitlab-ci.yml: bump cache version Signed-off-by: Daiki Ueno <ueno@gnu.org> | Bug修复 | False |
| master | [8797c11](https://gitlab.com/gnutls/gnutls/-/commit/8797c11a8cab4dc489c74d269e5b37332025aafb) | 2024-01-15 | .gitlab-ci.yml: Adjust to Alpine Linux' clang-format path change According to Alpine Linux' package database search functionality, the clang16-extra-tools package now installs clang-format in /usr/lib/llvm16/bin/clang-format. /usr/bin/clang-format is provided by clang17-extra-tools instead, but requires changes in formatting. Add /usr/lib/llvm16/bin to PATH for the formatting script to continue using the previous version. Signed-off-by: Clemens Lang <cllang@redhat.com> | Bug修复 | False |
| master | [48d21eb](https://gitlab.com/gnutls/gnutls/-/commit/48d21eb1fc7c7069018c60834f730ee6794941fa) | 2024-01-15 | tests/pkcs11-tool.sh: skip if neither p11tool nor certool is built When compiled with --disable-tools, we can't assume p11tool and certool are available. This also switches to using create_testdir and locate any intermediate files under a temporary directory which is cleaned up at exit. Signed-off-by: Daiki Ueno <ueno@gnu.org> | Bug修复 | False |

rpm-tracker 抓取数据如下：
| branch | id | date | message | type | 能否合入 |
| --- | --- | --- | --- | --- | --- |
| master | [6566f66](https://gitlab.com/gnutls/gnutls/-/commit/6566f66137f0daf72917b53a16857d61888aaa78) | 2024-06-20 | aarch64: no lint asm block For clang-format, have it ignore the asm block in the header. Fixes: clang-format --dry-run lib/accelerated/aarch64/aarch64-common.h lib/accelerated/aarch64/aarch64-common.h:109:13: warning: code should be clang-formatted [-Wclang-format-violations] .pushsection .note.gnu.property, "a"; Signed-off-by: Bill Roberts <bill.roberts@arm.com> | Bug修复 | False |
| master | [368da52](https://gitlab.com/gnutls/gnutls/-/commit/368da527219a3fe4b31a181fee74737e429da42f) | 2024-06-11 | tls-interoperability: workaround for openssl CCM8 CCM8 moved to SECLEVEL=0 in openssl Signed-off-by: Stanislav Zidek <szidek@redhat.com> | Bug修复 | False |
| master | [95a9aa9](https://gitlab.com/gnutls/gnutls/-/commit/95a9aa9dd6d4d6b2b9f87906dd06d5e9a69309e4) | 2024-06-07 | tls-fuzzer: move SSL3 specific tests to gnutls-nocert-ssl3.json Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | False |
| master | [60a901a](https://gitlab.com/gnutls/gnutls/-/commit/60a901aef0b54b4fac7c5413fc4b4f2d9ea01856) | 2024-06-05 | tests: testcompat-openssl-tls13: explicitly allow CCM8 ciphersuites Since OpenSSL 3.2, CCM8 is only allowed in security level 0. This tweaks test scripts to explicitly enable this level but only enable TLS 1.3 to exclude any TLS 1.2 ciphersuites. Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | False |
| master | [1a5db76](https://gitlab.com/gnutls/gnutls/-/commit/1a5db76f8273ad5f40187583905ebc297edc1a0c) | 2024-06-05 | build: indent code using Clang 18 Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | False |
| master | [450337d](https://gitlab.com/gnutls/gnutls/-/commit/450337d3c9221893588a2335908dfc4dd250d430) | 2024-06-05 | tests: mini-global-init: include <stdlib.h> for exit on Windows Signed-off-by: Daiki Ueno <ueno@gnu.org> | Bug修复 | False |
| master | [fa72e47](https://gitlab.com/gnutls/gnutls/-/commit/fa72e4718d2b9410c8ccc329ece24286f228fb36) | 2024-06-04 | .gitlab-ci.yml: restore MinGW tweaks Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | False |
| master | [0b5691d](https://gitlab.com/gnutls/gnutls/-/commit/0b5691de3b27ca1a44ac64c7bb3aac7a4b5668df) | 2024-06-04 | .gitlab-ci.yml: bump cache version Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | False |
| master | [0a97df5](https://gitlab.com/gnutls/gnutls/-/commit/0a97df525fa12ac19ca95462e5ebaecb66066721) | 2024-06-03 | lib/accellerated: update asm and enable PAC/BTI Update the asm sources generated from devel/openssl which have the BTI and PAC support. Add the -mbranch-protection=standard build flag to the generated sources. On older machines that don't have support, the options are in the NOP space and will be NOP'd, on architectures with support the instructions are executed as expected. Note that this updates the ELF GNU NOTES section to indicate that BTI and PAC are enabled. For BTI this must be in all the ELF files loaded and linked or the feature is disabled as all execution segments need it. After updating the asm sources via make asm-sources, you can build and get a PAC/BTI enabled binary and test via the testsuite to verify. readelf -n ./lib/.libs/libgnutls.so Displaying notes found in: .note.gnu.property Owner Data size 	Description GNU 0x00000010	NT_GNU_PROPERTY_TYPE_0 Properties: AArch64 feature: BTI, PAC Signed-off-by: Bill Roberts <bill.roberts@arm.com> | 性能优化 | True |
| master | [05f4062](https://gitlab.com/gnutls/gnutls/-/commit/05f406223431001b0b95200832e2f9078adef679) | 2024-06-03 | openssl: update 3.2.1 Signed-off-by: Bill Roberts <bill.roberts@arm.com> | Bug修复 | False |
| master | [1330e07](https://gitlab.com/gnutls/gnutls/-/commit/1330e07c1234d4e8841b4389d4fa3ceb25d3c6ef) | 2024-06-03 | ci: ignore parse errors from gcovr The documentation for gcovr suggests this as a work around to a bug in gcovr that cause negative hit values, which is impossible, and is not accepted by default and will cause the CI to fail: - https://gcovr.com/en/stable/guide/gcov_parser.html To correct this, add option: -gcov-ignore-parse-errors=negative_hits.warn_once_per_file Signed-off-by: Bill Roberts <bill.roberts@arm.com> | Bug修复 | False |
| master | [eced4c0](https://gitlab.com/gnutls/gnutls/-/commit/eced4c0c2b3d3ee6a35dab99616a25910b623f79) | 2024-06-03 | nettle: add a way to reset hash context This makes gnutls_hash_output just reset the hash context without calling out Nettle's hash digest function if DIGEST argument is NULL. That is particularly useful when used with SHAKE, as its _shake_output function marks ctx->index in a special way indicating incremental output is in progress. Signed-off-by: Daiki Ueno <ueno@gnu.org> | Bug修复 | False |
| master | [cc5b7ec](https://gitlab.com/gnutls/gnutls/-/commit/cc5b7ec9895f99e5f90b2961b45a4038fcfc678b) | 2024-06-02 | tests: update tlslite-ng submodule for Python asyncore deprecation Signed-off-by: Daiki Ueno <ueno@gnu.org> | Bug修复 | False |
| master | [8bf0351](https://gitlab.com/gnutls/gnutls/-/commit/8bf0351530232ce6611ee3fecabc3b919730ce8a) | 2024-06-02 | .gitlab-ci.yml: indent code using Clang 17 Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | False |
| master | [231939f](https://gitlab.com/gnutls/gnutls/-/commit/231939f16b9455ee3044244a53bb639db7c4cefc) | 2024-06-02 | .gitlab-ci.yml: temporarily disable implicit library init on MinGW64 This doesn't seem to work on the latest Wine 8.19. Signed-off-by: Daiki Ueno <ueno@gnu.org> | Bug修复 | False |
| master | [9ce4d03](https://gitlab.com/gnutls/gnutls/-/commit/9ce4d03cd8e00be853039a6817b70934f3b802eb) | 2024-06-02 | nettle: avoid symbol clash in sha3-shake.h Signed-off-by: Daiki Ueno <ueno@gnu.org> | Bug修复 | False |
| master | [a0616a0](https://gitlab.com/gnutls/gnutls/-/commit/a0616a06535dae5e3772567c3c6d87b31f1fdf74) | 2024-05-17 | load_dir_certs: avoid memleak Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | True |
| master | [d136ff1](https://gitlab.com/gnutls/gnutls/-/commit/d136ff1b906df2e6d21008d8f37537eddbf88a3a) | 2024-05-17 | shuffle_exts: avoid theoretical wrap around of unsigned integer Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | True |
| master | [654d9d3](https://gitlab.com/gnutls/gnutls/-/commit/654d9d3ae1d22348acb387a90dafc3931ce665fe) | 2024-05-15 | nettle: utilize nettle_cbc_aes*_encrypt for performance While CBC encryption is inherently slow for lack of parallelisim, Nettle >= 3.8 provides specialized AES-CBC encryption functions to improve performance by avoiding multiple calls to block cipher initialization. This patch makes GnuTLS use those functions if available. Here are the results of benchmark: * GNUTLS_CPUID_OVERRIDE=0x1, without nettle_cbc_aes*_encrypt: Checking cipher-MAC combinations, payload size: 16384 AES-128-CBC-SHA1 0.90 GB/sec AES-128-CBC-SHA256 0.88 GB/sec Checking ciphers, payload size: 16384 AES-128-CBC 1.56 GB/sec * GNUTLS_CPUID_OVERRIDE=0x1, with nettle_cbc_aes*_encrypt: Checking cipher-MAC combinations, payload size: 16384 AES-128-CBC-SHA1 1.08 GB/sec AES-128-CBC-SHA256 1.05 GB/sec Checking ciphers, payload size: 16384 AES-128-CBC 2.16 GB/sec * GNUTLS_CPUID_OVERRIDE unset: Checking cipher-MAC combinations, payload size: 16384 AES-128-CBC-SHA1 1.13 GB/sec AES-128-CBC-SHA256 1.05 GB/sec Checking ciphers, payload size: 16384 AES-128-CBC 2.24 GB/sec Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | False |
| master | [d86c246](https://gitlab.com/gnutls/gnutls/-/commit/d86c2467e977927b3b2e5d2a71e64f859191fd74) | 2024-05-14 | Support PBMAC1 usage in PKCS#12 This allows usage of PBMAC1 as the MAC to verify a PKCS#12 structure, following draft-ietf-lamps-pkcs12-pbmac1[1]. While the MAC verification is transparent, the generation requires a new API gnutls_pkcs12_generate_mac3 to be used with the GNUTLS_PKCS12_USE_PBMAC1 flag. certtool has also been extended with the --pbmac1 option, which can be used in combination with --to-p12. 1. https://datatracker.ietf.org/doc/draft-ietf-lamps-pkcs12-pbmac1/ Signed-off-by: Daiki Ueno <ueno@gnu.org> | Bug修复 | False |
| master | [beba3bd](https://gitlab.com/gnutls/gnutls/-/commit/beba3bd9e0e678c0b804d400af839a3538bf1e17) | 2024-05-14 | gnutls_pkcs12_generate_mac2: factor out mac generation logic This would allow us to easily implement PBMAC1 usage in PKCS#12. Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | True |
| master | [c84c10f](https://gitlab.com/gnutls/gnutls/-/commit/c84c10f8d6043b644bd993c77ecf66236d10c00e) | 2024-05-14 | pkcs7-crypt: output keyLength in PBKDF2 only if it is greater than 0 Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | True |
| master | [c003de4](https://gitlab.com/gnutls/gnutls/-/commit/c003de4a90574136643d3c72e738195066393a5b) | 2024-05-14 | pkcs7-crypt: use _gnutls_x509_write_uint32 as possible Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | True |
| master | [2c87dc3](https://gitlab.com/gnutls/gnutls/-/commit/2c87dc3ae4f9629830923560774fbf9f6b55e273) | 2024-05-14 | _gnutls_x509_read_uint: accept values greater than 0x7FFFFFFF _gnutls_x509_read_uint previously only accepted integer values encoded in 4 bytes without checking if the first byte indicates a negative integer in 2's complement format. This adds the check and also avoid unnecessary memory allocation. Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | True |
| master | [a30c5cd](https://gitlab.com/gnutls/gnutls/-/commit/a30c5cd8e94394c3d5805340db3c643cc000fca6) | 2024-05-10 | .gitlab-ci.yml: run fedora-threadsan/build without ASLR ThreadSanitizer doesn't cope well with newer kernel (>= 6.6.x) when ASLR is enabled: https://github.com/google/sanitizers/issues/1716 This disables ASLR locally around the fedora-threadsan tasks. Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | False |

rpm-tracker 抓取数据如下：
| branch | id | date | message | type | 能否合入 |
| --- | --- | --- | --- | --- | --- |
| master | [4c01077](https://gitlab.com/gnutls/gnutls/-/commit/4c010772cdd49007f85769c8cb2b992069694afa) | 2024-05-10 | .gitlab-ci.yml: Bump cache version Signed-off-by: Daiki Ueno <ueno@gnu.org> | Bug修复 | False |
| master | [642c39b](https://gitlab.com/gnutls/gnutls/-/commit/642c39ba9ae53ce427344d884eb3808f042b90e4) | 2024-05-09 | .gitlab-ci.yml: use correct tag for GitLab 1.70 deployment The "shared", "linux", and "docker" tags we use to select shared CI runners are consolidated into "saas-linux-small-amd64" in GitLab 1.70: https://docs.gitlab.com/ee/update/deprecations.html#removal-of-tags-from-small-saas-runners-on-linux Signed-off-by: Daiki Ueno <ueno@gnu.org> | Bug修复 | False |
| master | [f239942](https://gitlab.com/gnutls/gnutls/-/commit/f239942561e17c0bdbbc35f9bf1cf57391fd4027) | 2024-05-06 | build: fix confusions between libtasn1 and GnuTLS error codes libtasn1 error codes returned from asn1_{read,write}_value are always positive. Check against ASN1_SUCCESS instead. Signed-off-by: Daiki Ueno <ueno@gnu.org> | Bug修复 | False |
| master | [ab380ed](https://gitlab.com/gnutls/gnutls/-/commit/ab380eda17a225541f28ea2012a81ae7307e8023) | 2024-04-24 | Fix configuration with multi-word GMP_LIBS. Signed-off-by: Kai Pastor <dg0yt@darc.de> | Bug修复 | True |
| master | [8ecf5da](https://gitlab.com/gnutls/gnutls/-/commit/8ecf5da735687293ccd68e7c7d4f484b0d013a35) | 2024-04-11 | Prevent GCOVR from returning NegativeHits exception see https://gcc.gnu.org/bugzilla/show_bug.cgi?id=68080 Signed-off-by: Zoltan Fridrich <zfridric@redhat.com> | Bug修复 | False |
| master | [2d73d94](https://gitlab.com/gnutls/gnutls/-/commit/2d73d945c4b1dfcf8d2328c4d23187d62ffaab2d) | 2024-04-11 | Fix RSAES-PKCS1-v1_5 system-wide configuration Signed-off-by: Zoltan Fridrich <zfridric@redhat.com> | Bug修复 | False |

rpm-tracker 抓取数据如下：
| branch | id | date | message | type | 能否合入 |
| --- | --- | --- | --- | --- | --- |
| master | [cdc3aab](https://gitlab.com/gnutls/gnutls/-/commit/cdc3aab07653d429c38541cca14c1ed686e9a48d) | 2024-09-30 | tests/key-material-set-dtls: retry send/recv on E_AGAIN/E_INTERRUPTED Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com> | Bug修复 | True |
| master | [56c0490](https://gitlab.com/gnutls/gnutls/-/commit/56c0490b22eda29c8133c6b3d9697b803e499d04) | 2024-09-27 | Ignore unknown compression algs when using CLI Signed-off-by: Zoltan Fridrich <zfridric@redhat.com> | 性能优化 | True |
| master | [e8df774](https://gitlab.com/gnutls/gnutls/-/commit/e8df77460861a3da86ecf0ef23a9b40b16034d0b) | 2024-09-25 | tests/ktls: skip CHACHA20-POLY1305 in FIPS mode Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com> | 性能优化 | False |
| master | [566094a](https://gitlab.com/gnutls/gnutls/-/commit/566094a755a7348da8e88e923b522f4aea1ac402) | 2024-09-20 | nettle: fail OAEP decryption on unknown hash _rsa_oaep_decrypt() "returns 1 on success; 0 otherwise", but here we've returned non-zero on using an unsupported hash. This confused the error reporting into thinking gnutls_privkey_decrypt_data() has succeeded, while it hasn't. Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com> | Bug修复 | False |
| master | [5ae668f](https://gitlab.com/gnutls/gnutls/-/commit/5ae668f3e63f97fa61f858479ace7d2e2d9065ea) | 2024-08-29 | ocsp: gnutls_ocsp_status_request_is_checked: fix note on TLS 1.3 [ci skip] The previous note on limitation under TLS 1.3 was misleading, as it used "server-side" and "client-side" in a confusing manner. This rewords the sentence to be more consistent. Signed-off-by: Daiki Ueno <ueno@gnu.org> | Bug修复 | True |
| master | [d5b16bd](https://gitlab.com/gnutls/gnutls/-/commit/d5b16bd98fc384e6142c658fec54988f0c40c517) | 2024-08-29 | tools: fix memleak around getline Fixes: #1573 Signed-off-by: Ekaterina Zilotina <zilotina.ed@npc-ksb.ru> Signed-off-by: Daiki Ueno <ueno@gnu.org> | Bug修复 | True |
| master | [558cf23](https://gitlab.com/gnutls/gnutls/-/commit/558cf23853f6ad0537daff4613d316265857b7fd) | 2024-08-21 | fips: skip HMAC checks of nettle libraries when statically linked Since commit b6e9b10347ed577a9a37b7b28e1a039c5f6ccb16, it is possible to link Nettle libraries statically. In that case, FIPS integrity checks against the Nettle shared libraries should be skipped as they are not used by GnuTLS. Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | False |
| master | [5461531](https://gitlab.com/gnutls/gnutls/-/commit/546153198d2fb8fc4902f23de6254bb7988de534) | 2024-08-16 | build: don't emit Requires.private for dlopened libraries Signed-off-by: Daiki Ueno <ueno@gnu.org> | Bug修复 | False |
| master | [292f96f](https://gitlab.com/gnutls/gnutls/-/commit/292f96f26d7ce80e4a165c903c4fd569b85c1c1f) | 2024-08-16 | build: fix setting AM_CONDITIONAL for brotli and zstd As the with_{libbrotli,libzsttd} variables are unset if configured with --without-{brotli,zstd}, check the unequality to "no" doesn't work; use explicit matching with "yes" instead. Signed-off-by: Daiki Ueno <ueno@gnu.org> | Bug修复 | False |
| master | [f3e8eac](https://gitlab.com/gnutls/gnutls/-/commit/f3e8eac0586a19f4dafd89f68006a536b826e65a) | 2024-08-15 | revert back to datefudge for "openssl ocsp". openssl's -attime only changes the verification logic but not the generation. Broken by: d1bc7f644422c4d87edfcd9fafe7f292a1a3a6de Signed-off-by: Andreas Metzler <ametzler@bebt.de> | Bug修复 | False |
| master | [b64e8e1](https://gitlab.com/gnutls/gnutls/-/commit/b64e8e1f72a1c41d3df346c17efd49bcd65b1e8b) | 2024-08-15 | Also set ENABLE_DSA for tests in cert-tests subdirectory. Signed-off-by: Andreas Metzler <ametzler@bebt.de> | 性能优化 | True |
| master | [9409cf1](https://gitlab.com/gnutls/gnutls/-/commit/9409cf172b899b6695331e48a4498f53cf1bc26b) | 2024-08-15 | liboqs: avoid uninitialized value in pk_ops.verify_priv_params Signed-off-by: Daiki Ueno <ueno@gnu.org> | Bug修复 | False |
| master | [b6e9b10](https://gitlab.com/gnutls/gnutls/-/commit/b6e9b10347ed577a9a37b7b28e1a039c5f6ccb16) | 2024-08-14 | build: change Nettle library link order to support static linking As libhogweed uses libnettle functions such as nettle_cnd_memcpy, libhogweed should come before libnettle in $(LIBADD), when linked statically. Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | True |
| master | [6295cd2](https://gitlab.com/gnutls/gnutls/-/commit/6295cd2c317efc57acd943c97ffd950445341459) | 2024-08-13 | compress-cert: don't send bad_certificate alert manually The library API is not designed to proactively send alert by itself, but it is rather a responsibility of the application to decide to which alert to be sent when. This removes the manual call to gnutls_alert_send in the code handling TLS 1.3 Certificate message when a decompression error happens. Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | True |
| master | [d1bc7f6](https://gitlab.com/gnutls/gnutls/-/commit/d1bc7f644422c4d87edfcd9fafe7f292a1a3a6de) | 2024-08-12 | Use openssl's -attime option instead of faketime/datefudge Signed-off-by: Andreas Metzler <ametzler@bebt.de> | 性能优化 | True |
| master | [ef47ca1](https://gitlab.com/gnutls/gnutls/-/commit/ef47ca1eeb49187171c6294bd986857c498d650f) | 2024-08-11 | tests: testdane.sh: ignore torproject.org for now danetool --check returns an error when tested against the host. This temporarily disables it. Signed-off-by: Daiki Ueno <ueno@gnu.org> | Bug修复 | False |
| master | [64346bc](https://gitlab.com/gnutls/gnutls/-/commit/64346bce7a2ef7859ea53608a2438d5c730f2f35) | 2024-08-08 | dlwrap: don't assume dlopen/dlsym sets errno Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | False |
| master | [e52c7ca](https://gitlab.com/gnutls/gnutls/-/commit/e52c7ca885798c40efb4ed6505e0690fc38c7dde) | 2024-08-01 | pkcs12: enable PBMAC1 by default in FIPS mode Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | False |
| master | [38eee03](https://gitlab.com/gnutls/gnutls/-/commit/38eee03eca6564e86d714ab1cb1ed6ed2baee7a3) | 2024-08-01 | pkcs12: don't switch FIPS indicator upon export Now that we have a FIPS compliant MAC calculation using PBMAC1. Signed-off-by: Daiki Ueno <ueno@gnu.org> | Bug修复 | True |
| master | [dc4a8bd](https://gitlab.com/gnutls/gnutls/-/commit/dc4a8bd31aeb9b5c8b286b687592b549ca142947) | 2024-08-01 | pkcs12: use gnutls_hmac API for MAC calculation Instead of the internal _gnutls_mac API, this switches to using gnutls_hmac API, which has checks on whether the algorithm is FIPS approved. Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | False |
| master | [557b9f1](https://gitlab.com/gnutls/gnutls/-/commit/557b9f1dd055cafcfa3bd66a5a1a3a94a837d9d0) | 2024-07-31 | gnutls_group_list: take into account of public key algorithms Previously the function only checked if the ECC curves are supported. Now that hybrid key exchange with KEM is supported, it should also check public key systems. Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | False |
| master | [feae174](https://gitlab.com/gnutls/gnutls/-/commit/feae174755ece3b8527114a3c023a04815c099b8) | 2024-07-30 | tpm2: switch to using dlwrap for loading TSS2 libraries Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | False |
| master | [16aac30](https://gitlab.com/gnutls/gnutls/-/commit/16aac3057dbbbbe5ddf2fa0440904f375bb1a608) | 2024-07-30 | NEWS: mention 3.8.7 changes Signed-off-by: Daiki Ueno <ueno@gnu.org> | CVE修复 | False |
| master | [9721a69](https://gitlab.com/gnutls/gnutls/-/commit/9721a69fe3283e71e55a361705cddba97fe9f0ce) | 2024-07-30 | .gitlab-ci.yml: bump cache version To update the Debian CI image from bullseye to bookworm. Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | False |
| master | [b80770d](https://gitlab.com/gnutls/gnutls/-/commit/b80770d9998cde7561237d4bebd227fe2687d649) | 2024-07-30 | build: set CFLAGS as necessary When header files of optional libraries are installed on a non-default locations, e.g., with homebrew, CFLAGS must be set so the compiler can find them at build time for the definition of data types and macros. Signed-off-by: Daiki Ueno <dueno@redhat.com> | 性能优化 | False |

rpm-tracker 抓取数据如下：
| branch | id | date | message | type | 能否合入 |
| --- | --- | --- | --- | --- | --- |
| master | [f2b25c1](https://gitlab.com/gnutls/gnutls/-/commit/f2b25c142cf5ee313af4e9e00823fd982ed88cdc) | 2024-07-30 | tests: gnutls-cli-debug.sh: make timeout program configurable Signed-off-by: Daiki Ueno <dueno@redhat.com> | 性能优化 | True |
| master | [0e4e9d0](https://gitlab.com/gnutls/gnutls/-/commit/0e4e9d090b7630bc8f447cc1573ec4d57602b7e5) | 2024-07-30 | tests: pkgconfig.sh: respect LDFLAGS Signed-off-by: Daiki Ueno <dueno@redhat.com> | 性能优化 | True |
| master | [b7f430b](https://gitlab.com/gnutls/gnutls/-/commit/b7f430b60cd4746ec48ce795670d2060fdea344f) | 2024-07-29 | dlwrap: regenerate zlib wrapper Signed-off-by: Daiki Ueno <ueno@gnu.org> | CVE修复 | False |
| master | [dfac4bb](https://gitlab.com/gnutls/gnutls/-/commit/dfac4bb0d96507a409e3c3434c04bd8f79ac479f) | 2024-07-29 | liboqs: check whether Kyber768 is compiled in In the default build configuration of liboqs 0.10.1, Kyber768 is disabled. This adds a guard against it and skip tests if not available. Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | False |
| master | [1de25cb](https://gitlab.com/gnutls/gnutls/-/commit/1de25cb4149d284d50dffbffa486dab6c47ae05f) | 2024-07-27 | gnulib: update gnulib submodule Also make sure to include "config.h"; otherwise overriding headers from Gnulib will complain: In file included from inih/ini.c:14: ./../gl/stdio.h:71:3: error: #error "Please include config.h first." 71 \| #error "Please include config.h first." \| ^~~~~ Signed-off-by: Daiki Ueno <ueno@gnu.org> | Bug修复 | False |
| master | [50d9870](https://gitlab.com/gnutls/gnutls/-/commit/50d98704c8af32c7831c7e9e79ba00c35b336a60) | 2024-07-27 | build: ignore -Wmissing-variable-declarations for now Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | True |
| master | [e24b019](https://gitlab.com/gnutls/gnutls/-/commit/e24b019cdb187117e4ed64feb4447073a19a4da9) | 2024-07-26 | tests: sanity-cpp: don't use <minmax.h> from Gnulib Adding Gnulib include directory causes some conflict through indirect include of <pthread.h>. As sanity-cpp.cpp only uses MIN macro, we can simply define it by ourselves instead of including <minmax.h>. Signed-off-by: Daiki Ueno <ueno@gnu.org> | Bug修复 | True |
| master | [e18cd7c](https://gitlab.com/gnutls/gnutls/-/commit/e18cd7c37eb48e3c22b7a1871d01c0b929b49330) | 2024-07-26 | build: do not print liboqs enablement status Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | False |
| master | [1027981](https://gitlab.com/gnutls/gnutls/-/commit/1027981124844c42562200f59a232c0d8ee16ad3) | 2024-07-26 | build: update cligen submodule This is to respect SOURCE_DATE_EPOCH and to stop using the "error" function from <error.h>. Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | False |
| master | [acba735](https://gitlab.com/gnutls/gnutls/-/commit/acba7357c7274c3783dd9b70e054f062e937da93) | 2024-07-24 | liboqs: defer loading of liboqs at run-time Instead of loading liboqs at startup, this defers it until the liboqs functions are actually used. Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | False |
| master | [5c27695](https://gitlab.com/gnutls/gnutls/-/commit/5c276953c1536375fba96bc769e1cb5d3123b4a7) | 2024-07-24 | nettle: run pairwise consistency test only in FIPS mode Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | True |
| master | [ecc4119](https://gitlab.com/gnutls/gnutls/-/commit/ecc41197f2233494d066114e2747b17b24d24543) | 2024-07-23 | tests: pqc-hybrid-kx: use key and certificate in distribution The Ed25519 key and certificate in doc/credentials/x509/ are currently not included in the distribution. Use the ECDSA ones in the test to make the test work. Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | False |
| master | [ec65c64](https://gitlab.com/gnutls/gnutls/-/commit/ec65c64e6c904d5a408e2afb31ecacc2b52ed7dc) | 2024-07-23 | liboqs: manually load liboqs.so at startup Signed-off-by: Daiki Ueno <ueno@gnu.org> | Bug修复 | False |
| master | [baae5fc](https://gitlab.com/gnutls/gnutls/-/commit/baae5fca41567297ef3550bcbce6ac4c18984006) | 2024-07-23 | dlwrap: use different macro for library soname in generated code As GnuTLS opt in for manual initialization of dlopen'ed libraries, config.h shouldn't define the SONAME macro used in the generated code. Signed-off-by: Daiki Ueno <ueno@gnu.org> | Bug修复 | False |
| master | [bccd021](https://gitlab.com/gnutls/gnutls/-/commit/bccd021d94251a205fadacb5c434400b5338a721) | 2024-07-20 | .gitlab-ci.yml: use --with-liboqs in fedora/build Signed-off-by: Daiki Ueno <ueno@gnu.org> | Bug修复 | False |
| master | [1bc78c3](https://gitlab.com/gnutls/gnutls/-/commit/1bc78c387a9796e8248ffb644576074f8de4e6ad) | 2024-07-20 | key_share: support X25519Kyber768Draft00 This implements X25519Kyber768Draft00 hybrid post-quantum key exchange in TLS 1.3, based on the draft: https://datatracker.ietf.org/doc/draft-tls-westerbaan-xyber768d00/ Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | False |
| master | [0647139](https://gitlab.com/gnutls/gnutls/-/commit/0647139f50b6c14f2f2d22d40a42a8fdfaead5d5) | 2024-07-07 | build: check if dlopen(SONAME) works in configure Signed-off-by: Daiki Ueno <ueno@gnu.org> | Bug修复 | True |
| master | [dd7f8c3](https://gitlab.com/gnutls/gnutls/-/commit/dd7f8c30ca44695992bbb92146e385b4b700f285) | 2024-07-07 | m4: factor out soname check into a separate macro This moves the SONAME detection from configure.ac to m4/hooks.m4 as the LIBGNUTLS_CHECK_SONAME macro. The new macro doesn't implicitly set *_LIBRARY_SONAME to "none", so the callers need to adjust themselves depending on whether the macro is defined. Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | False |
| master | [297c83d](https://gitlab.com/gnutls/gnutls/-/commit/297c83d2830e44a675e8e52d65a66e0ba327f788) | 2024-07-07 | build: detect SONAME for compression libraries at configure Instead of hard-coding the SONAMEs for zlib, libzstd, libbrotlienc, and libbrotlidec, this checks the actual SONAMEs at configure time, so the first argument of dlopen is more acurate when a SONAME is bumped. Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | False |
| master | [3e5be13](https://gitlab.com/gnutls/gnutls/-/commit/3e5be1315a15ac6e1e33e08f28030b8215b6d234) | 2024-07-07 | build: switch to using dlwrap for loading compression libraries This switches the logic to load compression libraries from the hand-written code to the automatically generated code by the dlwrap tool[1], which enables to select whether to use dlopen or link to the library at build time. 1. https://crates.io/crates/dlwrap Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | False |

rpm-tracker 抓取数据如下：
| branch | id | date | message | type | 能否合入 |
| --- | --- | --- | --- | --- | --- |
| master | [08eae84](https://gitlab.com/gnutls/gnutls/-/commit/08eae846b19a013dfbe20487af9fa2d9b380a72c) | 2024-11-16 | fips: mark EdDSA as approved in FIPS mode FIPS 186-5 approves EdDSA. Signed-off-by: Po-Hsing Wu <pohsingwu@synology.com> | Bug修复 | False |
| master | [873b632](https://gitlab.com/gnutls/gnutls/-/commit/873b632f0312f266d1dc9cf913a4dc4c8947ef66) | 2024-11-15 | Changed from Dilithium to ML-DSA Signed-off-by: David Dudas <david.dudas03@e-uvt.ro> | 性能优化 | False |
| master | [11f8660](https://gitlab.com/gnutls/gnutls/-/commit/11f86603bdd09d4d5500c8bca41fed60a10aed96) | 2024-11-15 | Moved ML-DSA algorithms from the experimtental algorithms to non-exeperimental algorithms. Signed-off-by: David Dudas <david.dudas03@e-uvt.ro> | 性能优化 | False |
| master | [a9c16ed](https://gitlab.com/gnutls/gnutls/-/commit/a9c16eda017132d4999f78be79bfa9322b377f1c) | 2024-11-08 | liboqs: don't call OQS_destroy if the version is 0.11.0 OQS_destroy in liboqs 0.11.0 unconditionally calls OpenSSL functions for cleanup; see: https://github.com/open-quantum-safe/liboqs/pull/1982 As it doesn't do anything other than that so far, just skip it for now. Signed-off-by: Daiki Ueno <ueno@gnu.org> | Bug修复 | False |
| master | [da1df0a](https://gitlab.com/gnutls/gnutls/-/commit/da1df0a3167ec96605fed267d97f9081cf498eec) | 2024-11-06 | fips: Allow SigVer only with RSA keys with modulus >= 2048 bits This is for easier complience with FIPS 186-5, otherwise it would be necessary to justify how the timestamp is provided to prove that only pre-existing signatures can be verified in compliance with FIPS 186-5. Signed-off-by: Angel Yankov <angel.yankov@suse.com> | 性能优化 | True |
| master | [0d63c26](https://gitlab.com/gnutls/gnutls/-/commit/0d63c26f91baf941df7f0484297d698da7d555f2) | 2024-11-05 | Fixed the check at src/benchmark-tls.c Signed-off-by: David Meliksetyan <d.meliksetyan@fobos-nt.ru> Signed-off-by: Daiki Ueno <ueno@gnu.org> | Bug修复 | True |
| master | [4636b6b](https://gitlab.com/gnutls/gnutls/-/commit/4636b6b9399607e0026c58d25cf2b02e6d3deb29) | 2024-11-01 | priority: give KEM groups precedence over EC(DH) groups in TLS 1.3 Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | False |
| master | [1065654](https://gitlab.com/gnutls/gnutls/-/commit/1065654c828eaad638fab3c4af7096ab0c8ee615) | 2024-11-01 | key_share: detect overlap of PK types in hybrid groups The client limits sending the key_share extension to at most one from each public key type. To support hybrid groups, the logic needs to be extedended to check all siblings. Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | False |
| master | [0c35788](https://gitlab.com/gnutls/gnutls/-/commit/0c35788f2ddbd9fef52f126abcb6055498588235) | 2024-10-30 | _gnutls_session_supports_group: return boolean instead of error code Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | True |
| master | [d25aeeb](https://gitlab.com/gnutls/gnutls/-/commit/d25aeebe773f1734839e4b6e74b30c4c25d27c23) | 2024-10-29 | key_share: rework hybrid algorithms handling Previously we put 2 public key algorithms in a single gnutls_group_entry_st, with pk and pk2 fields. That turned to be not flexible enough to handle the cases where the number of combinations increases or the order of algorithms is swapped. This changes the representation with a linked list so one can easily construct and traverse any combinations. Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | False |
| master | [71af914](https://gitlab.com/gnutls/gnutls/-/commit/71af91474b74e2b984b6dc56b2cee42227395f20) | 2024-10-29 | priority: take into account of KEM groups When constructing a ciphersuite list, include hybrid PQC groups with KEM as the first key share. Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | True |
| master | [5d0ca0b](https://gitlab.com/gnutls/gnutls/-/commit/5d0ca0b4bd6f2a24d350f703edd8c3109d740d36) | 2024-10-29 | supported_groups: give KEM groups higher priority than DH Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | True |
| master | [028387a](https://gitlab.com/gnutls/gnutls/-/commit/028387ac6c9e27d5a1da49985b34159415ec2458) | 2024-10-29 | liboqs: check library version at run-time This is to safeguard when the library is compiled with a newer liboqs but deployed to an enviromnent with an older liboqs, which may break ABI compatibility. Signed-off-by: Daiki Ueno <ueno@gnu.org> | Bug修复 | False |
| master | [5b603fe](https://gitlab.com/gnutls/gnutls/-/commit/5b603fea130a2647aff1008bb083b36b4398facb) | 2024-10-29 | liboqs: require version 0.11.0 liboqs 0.11.0 shipped with public headers for plugging in alternative symmetric algorithms (e.g., sha3_ops.h), which were previously missing. Signed-off-by: Daiki Ueno <ueno@gnu.org> | Bug修复 | False |
| master | [7099c52](https://gitlab.com/gnutls/gnutls/-/commit/7099c52575d8536ed356313bec3f28d1d0170cec) | 2024-10-16 | hash: return error if gnutls_hash is called after squeeze Previously, when gnutls_hash is called after gnutls_hash_squeeze, it hits an assertion failure in nettle: sha3.c:76: _nettle_sha3_update: Assertion `pos < block_size' failed. This adds an internal function to check whether the hash context has already been finalized with squeezing and in that case errors out. Signed-off-by: Daiki Ueno <ueno@gnu.org> | Bug修复 | False |
| master | [0eba16a](https://gitlab.com/gnutls/gnutls/-/commit/0eba16a8d82ef723903a75b6ec0c2baf9f12a86b) | 2024-10-10 | compress_certificate: improve error checks Signed-off-by: Zoltan Fridrich <zfridric@redhat.com> | 性能优化 | False |
| master | [7f2d774](https://gitlab.com/gnutls/gnutls/-/commit/7f2d774197cfecbe5dea852b3acb4abbdbd49660) | 2024-10-08 | lib/nettle/int/nettle-internal.h: include alloca.h if configure found it Needed for alloca definition on Solaris, to avoid build error with gcc 14: lib/nettle/int/nettle-internal.h:59:39: error: implicit declaration of function 'alloca' [-Wimplicit-function-declaration] 59 \| #define TMP_ALLOC(name, size) (name = alloca(sizeof(*name) * (size))) \| ^~~~~~ Closes #782 Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> | Bug修复 | True |

rpm-tracker 抓取数据如下：
| branch | id | date | message | type | 能否合入 |
| --- | --- | --- | --- | --- | --- |
| master | [36365a5](https://gitlab.com/gnutls/gnutls/-/commit/36365a5602020fc372807a9b750e613c7f242926) | 2024-12-21 | configure.ac: Ensure Python is available when it's needed. * configure.ac: Use AM_PATH_PYTHON only when needed, and ensure it then succeeds. Signed-off-by: Maxim Cournoyer <maxim.cournoyer@gmail.com> | Bug修复 | True |
| master | [681d187](https://gitlab.com/gnutls/gnutls/-/commit/681d1871e0fd7b74af94fcbb2d1c2abd3983b802) | 2024-12-21 | bootstrap.conf: Sort requirements. * bootstrap.conf (buildreq): Sort. Signed-off-by: Maxim Cournoyer <maxim.cournoyer@gmail.com> | 性能优化 | False |
| master | [430984d](https://gitlab.com/gnutls/gnutls/-/commit/430984d37a8174b3cae46a50f70e261b8b19f97d) | 2024-12-21 | bootstrap.conf: Require the 'wget' command. wget is used to retrieve translation files. * bootstrap.conf (buildreq): Register wget. Signed-off-by: Maxim Cournoyer <maxim.cournoyer@gmail.com> | CVE修复 | False |
| master | [834704e](https://gitlab.com/gnutls/gnutls/-/commit/834704ea63497494455fc313b9bc3bb028c260d9) | 2024-12-21 | bootstrap.conf: Require the 'bison' command. * bootstrap.conf (buildreq): Register bison. Fixes: <https://gitlab.com/gnutls/gnutls/-/issues/1196> Signed-off-by: Maxim Cournoyer <maxim.cournoyer@gmail.com> | Bug修复 | False |
| master | [9a7ce5a](https://gitlab.com/gnutls/gnutls/-/commit/9a7ce5a74cbef069394f677c0c79af2c876546db) | 2024-12-19 | Set default value of early date size for client to 0 This commit sets the default value of "early_data_size" to 0 for the client. "early_data_size" is set to a non-zero value when the server sends the relevant extension in a session ticket to the client. This makes it easy for the client to determine if a server supports early data. Link: https://gitlab.com/gnutls/gnutls/-/issues/1619 Signed-off-by: Sahil Siddiq <sahilcdq@proton.me> | 性能优化 | True |
| master | [9cc9d55](https://gitlab.com/gnutls/gnutls/-/commit/9cc9d5556d258d23a399abfe45715773e719d134) | 2024-12-10 | groups: represent hybrid groups with an array of IDs Previously, the supported_groups array contained externally defined elements, which is legitimate in C99 but caused error with Clang: groups.c:93:2: error: initializer element is not a compile-time constant group_x25519, ^~~~~~~~~~~~ This reworks the array definition of indirection through group IDs (gnutls_group_t, i.e., integer). This also makes pqc-hybrid-kx test more exhaustive. Signed-off-by: Daiki Ueno <ueno@gnu.org> | 性能优化 | False |
| master | [8b09258](https://gitlab.com/gnutls/gnutls/-/commit/8b09258ce165612d93071d75d5b4e3907684ae48) | 2024-12-09 | fix tmt provision -h local TMT started requiring --feeling-safe for local provisioning. Signed-off-by: Stanislav Zidek <szidek@redhat.com> | Bug修复 | False |

koji 编译构建**成功**，点击链接查看详细信息：[#605559](https://build.stream.opencloudos.tech/koji/taskinfo?taskID=605559)

<table><tr><th>测试项名称</th><th>测试项名称</th><th>架构</th><th width="15%">结果</th><th>详细日志</th><th>流水线</th><th>备注</th></tr><tr><td>install</td><td>install</td><td rowspan="8">x86_64</td><td>:white_check_mark: SUCCESS</td><td><a href="https://qa.opencloudos.tech/job/OCS-Auto-Upgrade/job/OCS-Commit/350/artifact/350/ocs_ci_api/output/x86_64_all_install_info.json">x86_64_install_info</a> </td><td><a href="https://qa.opencloudos.tech/blue/organizations/jenkins/OCS-Auto-Upgrade%2FOCS-Commit/detail/OCS-Commit/350/pipeline/">:link:2.1</a></td><td rowspan="4">-</td></tr><tr><td rowspan="7">compatibility</td><td>subrpmlist</td><td>:white_check_mark: SUCCESS</td><td><a href="https://qa.opencloudos.tech/job/OCS-Auto-Upgrade/job/OCS-Commit/350/artifact/350/ocs_ci_api/output/x86_64_compat_subrpmlist.json">rpmlist</a> </td><td rowspan="7"><a href="https://qa.opencloudos.tech/blue/organizations/jenkins/OCS-Auto-Upgrade%2FOCS-Commit/detail/OCS-Commit/350/pipeline/">:link:3.1</a></td></tr><tr><td>filelist</td><td>:white_check_mark: SUCCESS</td><td><a href="https://qa.opencloudos.tech/job/OCS-Auto-Upgrade/job/OCS-Commit/350/artifact/350/ocs_ci_api/output/x86_64_compat_filelist_rpmdiff.json">filelist_rpmdiff</a> </td></tr><tr><td>ability</td><td>:white_check_mark: SUCCESS</td><td><a href="https://qa.opencloudos.tech/job/OCS-Auto-Upgrade/job/OCS-Commit/350/artifact/350/ocs_ci_api/output/x86_64_compat_ability_rpmdiff.json">ability_rpmdiff</a> </td></tr><tr><td>abi</td><td>:white_check_mark: SUCCESS</td><td rowspan="2"><a href="https://qa.opencloudos.tech/job/OCS-Auto-Upgrade/job/OCS-Commit/350/artifact/350/ocs_ci_api/output/x86_64_compat_summary.json">summary</a> <a href="https://qa.opencloudos.tech/job/OCS-Auto-Upgrade/job/OCS-Commit/350/artifact/350/ocs_ci_api/output/x86_64_compat_abidiff.json">abidiff</a> <a href="https://qa.opencloudos.tech/job/OCS-Auto-Upgrade/job/OCS-Commit/350/artifact/350/ocs_ci_api/output/x86_64_pkgs_compat_buildrequire.json">pkgs_buildrequire_gnutls</a> <a href="https://qa.opencloudos.tech/job/OCS-Auto-Upgrade/job/OCS-Commit/350/artifact/350/ocs_ci_api/output/x86_64_pkgs_compat_require.json">pkgs_require_gnutls</a> </td><td></td></tr><tr><td>api</td><td>:white_check_mark: SUCCESS</td><td rowspan="3">-</td></tr><tr><td>executable</td><td>:white_check_mark: SUCCESS</td><td>-</td></tr><tr><td>conf</td><td>:white_check_mark: SUCCESS</td><td><a href="https://qa.opencloudos.tech/job/OCS-Auto-Upgrade/job/OCS-Commit/350/artifact/350/ocs_ci_api/output/x86_64_compat_conf.json">confdiff</a> </td></tr></table>

需要测试重编的软件包：
| 软件包名      | 仓库链接                                               | 备注                  |
|:--------------|:-------------------------------------------------------|:----------------------|
| pacemaker     | https://gitee.com/opencloudos-stream/pacemaker.git     | runtime_require&check |
| gtk-vnc       | https://gitee.com/opencloudos-stream/gtk-vnc.git       | runtime_require&check |
| libmicrohttpd | https://gitee.com/opencloudos-stream/libmicrohttpd.git | runtime_require&check |
| libjcat       | https://gitee.com/opencloudos-stream/libjcat.git       | runtime_require&check |
| qpdf          | https://gitee.com/opencloudos-stream/qpdf.git          | runtime_require&check |

兼容性检查完成，结果如上，请根据以上检查结果判断下一步操作：
- 合并 commit：通过 `/pr '<commit_id>'` 命令触发 PR；
- 隐藏 commit：若无需处理该 commit，可通过 `/hide '<commit_id>' <原因> 反馈原因并隐藏；
- 帮助：评论 `/help` 获取命令详细说明。

#### :warning: gnutls 的兼容性等级为 0.5，表示在 **major** 版本内不允许升级。详情参考：[OC生命周期说明](https://docs.opencloudos.org/release/oc_intro/#opencloudos)

访问流水线可查看具体日志：[#350-gnutls-IB8NHK (/pick "0337521 b7cd1e9 f979aa3 b5faada")](https://qa.opencloudos.tech/job/OCS-Auto-Upgrade/job/OCS-Commit/350/display/redirect)

koji 编译构建**成功**，点击链接查看详细信息：[#605660](https://build.stream.opencloudos.tech/koji/taskinfo?taskID=605660)

<table><tr><th>测试项名称</th><th>测试项名称</th><th>架构</th><th width="15%">结果</th><th>详细日志</th><th>流水线</th><th>备注</th></tr><tr><td>install</td><td>install</td><td rowspan="8">x86_64</td><td>:white_check_mark: SUCCESS</td><td><a href="https://qa.opencloudos.tech/job/OCS-Auto-Upgrade/job/OCS-Commit/353/artifact/353/ocs_ci_api/output/x86_64_all_install_info.json">x86_64_install_info</a> </td><td><a href="https://qa.opencloudos.tech/blue/organizations/jenkins/OCS-Auto-Upgrade%2FOCS-Commit/detail/OCS-Commit/353/pipeline/">:link:2.1</a></td><td rowspan="4">-</td></tr><tr><td rowspan="7">compatibility</td><td>subrpmlist</td><td>:white_check_mark: SUCCESS</td><td><a href="https://qa.opencloudos.tech/job/OCS-Auto-Upgrade/job/OCS-Commit/353/artifact/353/ocs_ci_api/output/x86_64_compat_subrpmlist.json">rpmlist</a> </td><td rowspan="7"><a href="https://qa.opencloudos.tech/blue/organizations/jenkins/OCS-Auto-Upgrade%2FOCS-Commit/detail/OCS-Commit/353/pipeline/">:link:3.1</a></td></tr><tr><td>filelist</td><td>:white_check_mark: SUCCESS</td><td><a href="https://qa.opencloudos.tech/job/OCS-Auto-Upgrade/job/OCS-Commit/353/artifact/353/ocs_ci_api/output/x86_64_compat_filelist_rpmdiff.json">filelist_rpmdiff</a> </td></tr><tr><td>ability</td><td>:white_check_mark: SUCCESS</td><td><a href="https://qa.opencloudos.tech/job/OCS-Auto-Upgrade/job/OCS-Commit/353/artifact/353/ocs_ci_api/output/x86_64_compat_ability_rpmdiff.json">ability_rpmdiff</a> </td></tr><tr><td>abi</td><td>:white_check_mark: SUCCESS</td><td rowspan="2"><a href="https://qa.opencloudos.tech/job/OCS-Auto-Upgrade/job/OCS-Commit/353/artifact/353/ocs_ci_api/output/x86_64_compat_summary.json">summary</a> <a href="https://qa.opencloudos.tech/job/OCS-Auto-Upgrade/job/OCS-Commit/353/artifact/353/ocs_ci_api/output/x86_64_compat_abidiff.json">abidiff</a> <a href="https://qa.opencloudos.tech/job/OCS-Auto-Upgrade/job/OCS-Commit/353/artifact/353/ocs_ci_api/output/x86_64_pkgs_compat_buildrequire.json">pkgs_buildrequire_gnutls</a> <a href="https://qa.opencloudos.tech/job/OCS-Auto-Upgrade/job/OCS-Commit/353/artifact/353/ocs_ci_api/output/x86_64_pkgs_compat_require.json">pkgs_require_gnutls</a> </td><td></td></tr><tr><td>api</td><td>:white_check_mark: SUCCESS</td><td rowspan="3">-</td></tr><tr><td>executable</td><td>:white_check_mark: SUCCESS</td><td>-</td></tr><tr><td>conf</td><td>:white_check_mark: SUCCESS</td><td><a href="https://qa.opencloudos.tech/job/OCS-Auto-Upgrade/job/OCS-Commit/353/artifact/353/ocs_ci_api/output/x86_64_compat_conf.json">confdiff</a> </td></tr></table>

需要测试重编的软件包：
| 软件包名      | 仓库链接                                               | 备注                  |
|:--------------|:-------------------------------------------------------|:----------------------|
| qpdf          | https://gitee.com/opencloudos-stream/qpdf.git          | runtime_require&check |
| libmicrohttpd | https://gitee.com/opencloudos-stream/libmicrohttpd.git | runtime_require&check |
| pacemaker     | https://gitee.com/opencloudos-stream/pacemaker.git     | runtime_require&check |
| libjcat       | https://gitee.com/opencloudos-stream/libjcat.git       | runtime_require&check |
| gtk-vnc       | https://gitee.com/opencloudos-stream/gtk-vnc.git       | runtime_require&check |

兼容性检查完成，结果如上，请根据以上检查结果判断下一步操作：
- 合并 commit：通过 `/pr '<commit_id>'` 命令触发 PR；
- 隐藏 commit：若无需处理该 commit，可通过 `/hide '<commit_id>' <原因> 反馈原因并隐藏；
- 帮助：评论 `/help` 获取命令详细说明。

#### :warning: gnutls 的兼容性等级为 0.5，表示在 **major** 版本内不允许升级。详情参考：[OC生命周期说明](https://docs.opencloudos.org/release/oc_intro/#opencloudos)

访问流水线可查看具体日志：[#353-gnutls-IB8NHK (/pick "0337521 b7cd1e9 f979aa3 b5faada d76f43f 0a97df5 beba3bd 2c87dc3")](https://qa.opencloudos.tech/job/OCS-Auto-Upgrade/job/OCS-Commit/353/display/redirect)

OpenCloudOS Stream/gnutls

内容风险标识

评论 (19)

OpenCloudOS Stream/gnutls .gitee-modal { width: 500px !important; }

内容风险标识