%define major_minor %(echo %{version} | awk -F '.' '{print $1 "." $2}')

Summary: The GNU TLS protocol implementation
Name: gnutls
Version: 3.8.2
Release: 5%{?dist}
License: LGPLv2.1+ and GPLv3+
URL: http://www.gnutls.org/
Source0: https://www.gnupg.org/ftp/gcrypt/gnutls/v%{major_minor}/%{name}-%{version}.tar.xz

Patch3000: gnutls-3.2.7-rpath.patch
Patch3001: gnutls-3.7.8-ktls_disable_keyupdate_test.patch
Patch3002: gnutls-3.7.8-ktls_skip_tls12_chachapoly_test.patch
Patch3003: gnutls-3.8.2-revert-pkcs11-ed448.patch

Patch0001: gnutls-3.8.2-CVE-2024-0553.patch
Patch0002: gnutls-3.8.2-CVE-2024-0567.patch
Patch0003: gnutls-3.8.2-CVE-2024-28834.patch
Patch0004: gnutls-3.8.2-CVE-2024-28835.patch

BuildRequires: p11-kit-devel, gettext-devel, zlib-devel, readline-devel
BuildRequires: libtasn1-devel, nettle-devel, libidn2-devel, libunistring-devel
BuildRequires: automake, autoconf, make, gperf, libtool, texinfo
BuildRequires: net-tools, datefudge, softhsm, gcc, gcc-c++, gnupg2
BuildRequires: p11-kit-trust, ca-certificates, fipscheck
BuildRequires: tpm2-tss-devel, unbound-devel, unbound-libs
Requires: crypto-policies, p11-kit-trust, libtasn1, nettle

Provides: bundled(gnulib) = 20130424
Obsoletes: %{name}-guile < %{version}-%{release}

%description
GnuTLS is a secure communications library implementing the SSL, TLS and DTLS
protocols and technologies around them. It provides a simple C language
application programming interface (API) to access the secure communications
protocols as well as APIs to parse and write X.509, PKCS #12, OpenPGP and
other required structures.

%package c++
Summary: C++ APIs for GnuTLS
Requires: %{name} = %{version}-%{release}

%description c++
This package contains C++ APIs for the GnuTLS library.

%package devel
Summary: Development files for the %{name} package
Requires: %{name} = %{version}-%{release}
Requires: %{name}-c++ = %{version}-%{release}
Requires: %{name}-dane = %{version}-%{release}
Requires: pkgconfig

%description devel
This package contains files needed for developing applications with
the GnuTLS library.

%package utils
Summary: Command line tools for TLS protocol
License: GPLv3+
Requires: %{name} = %{version}-%{release}
Requires: %{name}-dane = %{version}-%{release}

%description utils
This package contains command line TLS client and server and certificate
manipulation tools.

%package dane
Summary: A DANE protocol implementation for GnuTLS
Requires: %{name} = %{version}-%{release}

%description dane
This package contains library that implements the DANE protocol for verifying
TLS certificates through DNSSEC.

%prep
%autosetup -p1

sed -i -e 's|sys_lib_dlsearch_path_spec="/lib /usr/lib|sys_lib_dlsearch_path_spec="/lib /usr/lib %{_libdir}|g' configure
rm -f lib/minitasn1/*.c lib/minitasn1/*.h

echo "SYSTEM=NORMAL" >> tests/system.prio

%build
%define _lto_cflags %{nil}

CCASFLAGS="$CCASFLAGS -Wa,--generate-missing-build-notes=yes"
export CCASFLAGS

%configure \
           --enable-fips140-mode \
           --with-fips140-module-name="GnuTLS version" \
           --with-fips140-module-version="%{version}-%{release}" \
           --enable-sha1-support \
           --disable-static \
           --disable-openssl-compatibility \
           --disable-non-suiteb-curves \
           --with-system-priority-file=%{_sysconfdir}/crypto-policies/back-ends/gnutls.config \
           --with-default-trust-store-pkcs11="pkcs11:" \
           --without-tpm \
           --with-tpm2 \
           --htmldir=%{_docdir}/manual \
           --with-unbound-root-key-file=/var/lib/unbound/root.key \
           --enable-libdane \
           --disable-rpath \
           --with-default-priority-string="@SYSTEM"

%make_build V=1

%define __spec_install_post \
	%{?__debug_package:%{__debug_install_post}} \
	%{__arch_install_post} \
	%{__os_install_post} \
	rm -f $RPM_BUILD_ROOT%{_libdir}/.libgnutls.so.*.hmac \
	fipshmac -d $RPM_BUILD_ROOT%{_libdir} $RPM_BUILD_ROOT%{_libdir}/libgnutls.so.30.*.* \
	file=`basename $RPM_BUILD_ROOT%{_libdir}/libgnutls.so.30.*.hmac` \
	mv $RPM_BUILD_ROOT%{_libdir}/$file $RPM_BUILD_ROOT%{_libdir}/.$file \
	ln -s .$file $RPM_BUILD_ROOT%{_libdir}/.libgnutls.so.30.hmac \
%{nil}

%install
rm -rf $RPM_BUILD_ROOT
%make_install
make -C doc install-html DESTDIR=$RPM_BUILD_ROOT
rm -f $RPM_BUILD_ROOT%{_infodir}/dir
rm -f $RPM_BUILD_ROOT%{_libdir}/*.la

%find_lang gnutls

%check
make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null

%files -f gnutls.lang
%license LICENSE doc/COPYING doc/COPYING.LESSER
%doc README.md AUTHORS NEWS THANKS
%{_libdir}/libgnutls.so.30*
%{_libdir}/.libgnutls.so.30*.hmac

%files c++
%{_libdir}/libgnutlsxx.so.*

%files devel
%{_includedir}/*
%{_libdir}/libgnutls*.so
%{_libdir}/.libgnutls.so.*.hmac
%{_libdir}/pkgconfig/*.pc
%{_mandir}/man3/*
%{_infodir}/gnutls*
%{_infodir}/pkcs11-vision*
%{_docdir}/manual/*

%files utils
%doc doc/certtool.cfg
%{_bindir}/certtool
%{_bindir}/ocsptool
%{_bindir}/psktool
%{_bindir}/p11tool
%{_bindir}/danetool
%{_bindir}/gnutls*
%{_mandir}/man1/*

%files dane
%{_libdir}/libgnutls-dane.so.*

%changelog
* Thu Aug 22 2024 wynnfeng<[email protected]> - 3.8.2-5
- [type] other
- [desc] fix source error

* Fri Aug 16 2024 OpenCloudOS Release Engineering <[email protected]> - 3.8.2-4
- Rebuilt for loongarch release

* Mon Mar 25 2024 wynnfeng<[email protected]> - 3.8.2-3
- fix CVE-2024-28834 and CVE-2024-28835

* Tue Jan 30 2024 wynnfeng<[email protected]> - 3.8.2-2
- fix CVE-2024-0553 and CVE-2024-0567

* Mon Jan 08 2024 wynnfeng<[email protected]> - 3.8.2-1
- upgrade to 3.8.2

* Wed Dec 06 2023 wynnfeng<[email protected]> - 3.8.0-5
- fix CVE-2023-5981

* Fri Sep 08 2023 OpenCloudOS Release Engineering <[email protected]> - 3.8.0-4
- Rebuilt for OpenCloudOS Stream 23.09

* Fri Aug 18 2023 cunshunxia <[email protected]> - 3.8.0-3
- Rebuilt for tpm2-tss 4.0.1

* Thu Aug 17 2023 Shuo Wang <[email protected]> - 3.8.0-2
- Rebuilt for libunistring 1.1

* Fri Jul 28 2023 Shuo Wang <[email protected]> - 3.8.0-1
- update to 3.8.0

* Fri Apr 28 2023 OpenCloudOS Release Engineering <[email protected]> - 3.7.6-4
- Rebuilt for OpenCloudOS Stream 23.05

* Fri Mar 31 2023 OpenCloudOS Release Engineering <[email protected]> - 3.7.6-3
- Rebuilt for OpenCloudOS Stream 23

* Tue Sep 13 2022 Anakin Zhang <[email protected]> - 3.7.6-2
- Update guile dependence to 3.0

* Mon Jun 13 2022 Anakin Zhang <[email protected]> - 3.7.6-1
- Initial build