import UBI gnutls-3.8.10-2.el10

2025-11-11 21:41:49 +00:00 · 2025-11-11 21:41:49 +00:00 · 41a78c78ca
commit 41a78c78ca
parent 2d3c2b7902
14 changed files with 360 additions and 3851 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1,6 +1,6 @@
 gmp-6.2.1.tar.xz
-gnutls-3.8.9.tar.xz
-gnutls-3.8.9.tar.xz.sig
-leancrypto-1.2.0.tar.gz
+gnutls-3.8.10.tar.xz
+gnutls-3.8.10.tar.xz.sig
+leancrypto-1.5.0.tar.gz
 nettle-3.10.1.tar.gz
 nettle-3.10.1.tar.gz.sig
--- a/gnutls-3.7.6-fips-sha1-sigver.patch
+++ b/gnutls-3.7.6-fips-sha1-sigver.patch
@ -1,107 +0,0 @@
-From 115c0edc929a3f09b0a252507112c0de70026b5e Mon Sep 17 00:00:00 2001
-From: rpm-build <rpm-build>
-Date: Mon, 10 Feb 2025 11:43:51 +0900
-Subject: [PATCH] gnutls-3.7.6-fips-sha1-sigver.patch
-
-Signed-off-by: rpm-build <rpm-build>
---
- lib/nettle/pk.c   | 11 ++++-------
- lib/pubkey.c      |  3 ---
- tests/fips-test.c |  8 ++++----
- 3 files changed, 8 insertions(+), 14 deletions(-)
-
-diff --git a/lib/nettle/pk.c b/lib/nettle/pk.c
-index 91eaffd..0b4788a 100644
--- a/lib/nettle/pk.c
-+++ b/lib/nettle/pk.c
-@@ -2784,10 +2784,7 @@ static int _wrap_nettle_pk_verify(gnutls_pk_algorithm_t algo,
- 		if (hash_len > vdata->size)
- 			hash_len = vdata->size;
- 
-		/* SHA-1 is allowed for SigVer in FIPS 140-3 in legacy
-			 * mode */
- 		switch (DIG_TO_MAC(sign_params->dsa_dig)) {
-		case GNUTLS_MAC_SHA1:
- 		case GNUTLS_MAC_SHA256:
- 		case GNUTLS_MAC_SHA384:
- 		case GNUTLS_MAC_SHA512:
-@@ -2857,7 +2854,7 @@ static int _wrap_nettle_pk_verify(gnutls_pk_algorithm_t algo,
- 		bits = mpz_sizeinbase(pub.n, 2);
- 
- 		/* In FIPS 140-3, RSA key size should be larger than 2048-bit.
-			 * In addition to this, only SHA-1 and SHA-2 are allowed
-+			 * In addition to this, only SHA-2 is allowed
- 			 * for SigVer; it is checked in _pkcs1_rsa_verify_sig in
- 			 * lib/pubkey.c.
- 			 */
-@@ -2903,9 +2900,9 @@ static int _wrap_nettle_pk_verify(gnutls_pk_algorithm_t algo,
- 		}
- 
- 		/* RSA modulus size should be 2048-bit or larger in FIPS
-			 * 140-3.  In addition to this, only SHA-1 and SHA-2 are
-			 * allowed for SigVer, while Nettle only supports
-			 * SHA256, SHA384, and SHA512 for RSA-PSS (see
-+			 * 140-3.  In addition to this, only SHA-2 is allowed
-+			 * for SigVer, while Nettle only supports SHA256,
-+			 * SHA384, and SHA512 for RSA-PSS (see
- 			 * _rsa_pss_verify_digest in this file for the details).
- 			 */
- 		if (unlikely(mpz_sizeinbase(pub.n, 2) < 2048)) {
-diff --git a/lib/pubkey.c b/lib/pubkey.c
-index 1e5ecf3..811e531 100644
--- a/lib/pubkey.c
-+++ b/lib/pubkey.c
-@@ -2516,10 +2516,7 @@ static int _pkcs1_rsa_verify_sig(gnutls_pk_algorithm_t pk,
- 	d.size = digest_size;
- 
- 	if (pk == GNUTLS_PK_RSA) {
-		/* SHA-1 is allowed for SigVer in FIPS 140-3 in legacy
-		 * mode */
- 		switch (me->id) {
-		case GNUTLS_MAC_SHA1:
- 		case GNUTLS_MAC_SHA256:
- 		case GNUTLS_MAC_SHA384:
- 		case GNUTLS_MAC_SHA512:
-diff --git a/tests/fips-test.c b/tests/fips-test.c
-index 3af4df7..c024427 100644
--- a/tests/fips-test.c
-+++ b/tests/fips-test.c
-@@ -596,7 +596,7 @@ void doit(void)
- 	}
- 	FIPS_POP_CONTEXT(NOT_APPROVED);
- 
-	/* Verify a signature created with 2432-bit RSA and SHA-1; approved */
-+	/* Verify a signature created with 2432-bit RSA and SHA-1; not approved */
- 	FIPS_PUSH_CONTEXT();
- 	ret = gnutls_pubkey_verify_data2(pubkey, GNUTLS_SIGN_RSA_SHA1,
- 					 GNUTLS_VERIFY_ALLOW_SIGN_WITH_SHA1,
-@@ -604,7 +604,7 @@ void doit(void)
- 	if (ret < 0) {
- 		fail("gnutls_pubkey_verify_data2 failed\n");
- 	}
-	FIPS_POP_CONTEXT(APPROVED);
-+	FIPS_POP_CONTEXT(NOT_APPROVED);
- 	gnutls_free(signature.data);
- 	gnutls_pubkey_deinit(pubkey);
- 	gnutls_privkey_deinit(privkey);
-@@ -707,7 +707,7 @@ void doit(void)
- 	}
- 	FIPS_POP_CONTEXT(NOT_APPROVED);
- 
-	/* Verify a signature created with ECDSA and SHA-1; approved */
-+	/* Verify a signature created with ECDSA and SHA-1; not approved */
- 	FIPS_PUSH_CONTEXT();
- 	ret = gnutls_pubkey_verify_data2(pubkey, GNUTLS_SIGN_ECDSA_SHA1,
- 					 GNUTLS_VERIFY_ALLOW_SIGN_WITH_SHA1,
-@@ -715,7 +715,7 @@ void doit(void)
- 	if (ret < 0) {
- 		fail("gnutls_pubkey_verify_data2 failed\n");
- 	}
-	FIPS_POP_CONTEXT(APPROVED);
-+	FIPS_POP_CONTEXT(NOT_APPROVED);
- 	gnutls_free(signature.data);
- 
- 	/* Create a signature with ECDSA and SHA-1 (old API); not approved */
-- 
-2.48.1
-
--- a/gnutls-3.8.10-tests-ktls.patch
+++ b/gnutls-3.8.10-tests-ktls.patch
@ -0,0 +1,114 @@
+From e0eb2bbb212a5c9d72311c59e7235832a0075dcc Mon Sep 17 00:00:00 2001
+From: rpm-build <rpm-build>
+Date: Wed, 9 Jul 2025 18:54:48 +0900
+Subject: [PATCH] add tests/ktls_utils.h
+
+Signed-off-by: rpm-build <rpm-build>
+---
+ tests/ktls_utils.h | 94 ++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 94 insertions(+)
+ create mode 100644 tests/ktls_utils.h
+
+diff --git a/tests/ktls_utils.h b/tests/ktls_utils.h
+new file mode 100644
+index 0000000..231618d
+--- /dev/null
+++ b/tests/ktls_utils.h
+@@ -0,0 +1,94 @@
+#ifndef GNUTLS_TESTS_KTLS_UTILS_H
+#define GNUTLS_TESTS_KTLS_UTILS_H
+
+#include <fcntl.h>
+#include <signal.h>
+
+#include <netinet/in.h>
+
+#include <sys/socket.h>
+#include <sys/wait.h>
+
+/* Sets the NONBLOCK flag on the socket(fd) */
+inline static int set_nonblocking(int fd)
+{
+	int flags = fcntl(fd, F_GETFL, 0);
+	if (flags == -1) {
+		return 1;
+	}
+
+	if (fcntl(fd, F_SETFL, flags | O_NONBLOCK) == -1) {
+		return 2;
+	}
+
+	return 0;
+}
+
+/* Creates a pair of TCP connected sockets */
+static int create_socket_pair(int *client_fd, int *server_fd)
+{
+	int ret;
+	struct sockaddr_in saddr;
+	socklen_t addrlen;
+	int listener;
+
+	listener = socket(AF_INET, SOCK_STREAM, 0);
+	if (listener == -1) {
+		fail("error in listener(): %s\n", strerror(errno));
+		return 1;
+	}
+
+	int opt = 0;
+	setsockopt(listener, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof(opt));
+
+	memset(&saddr, 0, sizeof(saddr));
+	saddr.sin_family = AF_INET;
+	saddr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+	saddr.sin_port = 0;
+
+	ret = bind(listener, (struct sockaddr *)&saddr, sizeof(saddr));
+	if (ret == -1) {
+		fail("error in bind(): %s\n", strerror(errno));
+		return 1;
+	}
+
+	addrlen = sizeof(saddr);
+	ret = getsockname(listener, (struct sockaddr *)&saddr, &addrlen);
+	if (ret == -1) {
+		fail("error in getsockname(): %s\n", strerror(errno));
+		return 1;
+	}
+
+	ret = listen(listener, 1);
+	if (ret == -1) {
+		fail("error in listen(): %s\n", strerror(errno));
+		close(listener);
+		return 1;
+	}
+
+	*client_fd = socket(AF_INET, SOCK_STREAM, 0);
+	if (*client_fd < 0) {
+		fail("error in socket(): %s\n", strerror(errno));
+		return 1;
+	}
+
+	ret = connect(*client_fd, (struct sockaddr *)&saddr, addrlen);
+	if (ret < 0) {
+		fail("error in connect(): %s\n", strerror(errno));
+		close(listener);
+		close(*client_fd);
+		return 1;
+	}
+
+	*server_fd = accept(listener, NULL, NULL);
+	if (*server_fd < 0) {
+		fail("error in accept(): %s\n", strerror(errno));
+		close(listener);
+		close(*client_fd);
+		return 1;
+	}
+
+	return 0;
+}
+
+#endif //GNUTLS_TESTS_KTLS_UTILS_H
+-- 
+2.49.0
+
--- a/gnutls-3.8.10-tests-mldsa.patch
+++ b/gnutls-3.8.10-tests-mldsa.patch
@ -0,0 +1,58 @@
+From 15fb5ad536c375a74cc0d87859c9fc919d924c9d Mon Sep 17 00:00:00 2001
+From: rpm-build <rpm-build>
+Date: Thu, 10 Jul 2025 05:45:06 +0900
+Subject: [PATCH] support VPATH build for mldsa tests
+
+Signed-off-by: rpm-build <rpm-build>
+---
+ tests/cert-tests/mldsa.sh | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/tests/cert-tests/mldsa.sh b/tests/cert-tests/mldsa.sh
+index 7e31e11..55e31ce 100644
+--- a/tests/cert-tests/mldsa.sh
+++ b/tests/cert-tests/mldsa.sh
+@@ -130,7 +130,7 @@ for variant in 44 65 87; do
+ 	# Check default
+ 	TMPKEYDEFAULT=$testdir/key-$algo-$format-default
+ 	TMPKEY=$testdir/key-$algo-$format
+-	${VALGRIND} "${CERTTOOL}" -k --no-text --infile "data/key-$algo-$format.pem" >"$TMPKEYDEFAULT"
+	${VALGRIND} "${CERTTOOL}" -k --no-text --infile "$srcdir/data/key-$algo-$format.pem" >"$TMPKEYDEFAULT"
+ 	if [ $? != 0 ]; then
+ 	    cat "$TMPKEYDEFAULT"
+ 	    exit 1
+@@ -138,19 +138,19 @@ for variant in 44 65 87; do
+ 
+ 	# The "expandedKey" format doesn't have public key part
+ 	if [ "$format" = seed ] || [ "$format" = both ]; then
+-	    if ! "${DIFF}" "$TMPKEYDEFAULT" "data/key-$algo-both.pem"; then
+	    if ! "${DIFF}" "$TMPKEYDEFAULT" "$srcdir/data/key-$algo-both.pem"; then
+ 		exit 1
+ 	    fi
+ 	fi
+ 
+ 	# Check roundtrip with --key-format
+-	${VALGRIND} "${CERTTOOL}" -k --no-text --key-format "$format" --infile "data/key-$algo-$format.pem" >"$TMPKEY"
+	${VALGRIND} "${CERTTOOL}" -k --no-text --key-format "$format" --infile "$srcdir/data/key-$algo-$format.pem" >"$TMPKEY"
+ 	if [ $? != 0 ]; then
+ 	    cat "$TMPKEY"
+ 	    exit 1
+ 	fi
+ 
+-	if ! "${DIFF}" "$TMPKEY" "data/key-$algo-$format.pem"; then
+	if ! "${DIFF}" "$TMPKEY" "$srcdir/data/key-$algo-$format.pem"; then
+ 	    exit 1
+ 	fi
+     done
+@@ -164,7 +164,7 @@ for n in 1; do
+     fi
+ 
+     echo "Testing inconsistent ML-DSA key ($n)"
+-    if "${CERTTOOL}" -k --infile "data/key-mldsa-inconsistent$n.pem"; then
+    if "${CERTTOOL}" -k --infile "$srcdir/data/key-mldsa-inconsistent$n.pem"; then
+ 	exit 1
+     fi
+ done
+-- 
+2.49.0
+
--- a/gnutls-3.8.9-allow-rsa-pkcs1-encrypt.patch
+++ b/gnutls-3.8.9-allow-rsa-pkcs1-encrypt.patch
@ -1,4 +1,4 @@
-From 24de1f83a7ff5432cc9cca2ce7f88590e6c1536d Mon Sep 17 00:00:00 2001
+From 56402841df86125e2eb21fd548bae1bf482d939b Mon Sep 17 00:00:00 2001
 From: Daiki Ueno <ueno@gnu.org>
 Date: Wed, 18 Dec 2024 01:11:50 +0900
 Subject: [PATCH 1/6] pk: use deterministic RNG for RSA-PSS in self-tests
@ -12,10 +12,10 @@ Signed-off-by: Daiki Ueno <ueno@gnu.org>
 1 file changed, 7 insertions(+), 7 deletions(-)

 diff --git a/lib/nettle/pk.c b/lib/nettle/pk.c
-index 91eaffd689..f2d484bec5 100644
+index 5986a410c2..7baf003f41 100644
 --- a/lib/nettle/pk.c
 +++ b/lib/nettle/pk.c
-@@ -1697,11 +1697,7 @@ static int _rsa_pss_sign_digest_tr(gnutls_digest_algorithm_t dig,
+@@ -1494,11 +1494,7 @@ static int _rsa_pss_sign_digest_tr(gnutls_digest_algorithm_t dig,
 		if (salt == NULL)
 			return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR);
 
@ -28,7 +28,7 @@ index 91eaffd689..f2d484bec5 100644
 	}
 
 	ret = sign_func(pub, priv, rnd_ctx, rnd_func, salt_size, salt, digest,
-@@ -1712,7 +1708,6 @@ static int _rsa_pss_sign_digest_tr(gnutls_digest_algorithm_t dig,
+@@ -1509,7 +1505,6 @@ static int _rsa_pss_sign_digest_tr(gnutls_digest_algorithm_t dig,
 	} else
 		ret = 0;
 
@ -36,7 +36,7 @@ index 91eaffd689..f2d484bec5 100644
 	gnutls_free(salt);
 	return ret;
 }
-@@ -2500,6 +2495,7 @@ static int _wrap_nettle_pk_sign(gnutls_pk_algorithm_t algo,
+@@ -2126,6 +2121,7 @@ static int _wrap_nettle_pk_sign(gnutls_pk_algorithm_t algo,
 	case GNUTLS_PK_RSA_PSS: {
 		struct rsa_private_key priv;
 		struct rsa_public_key pub;
@ -44,7 +44,7 @@ index 91eaffd689..f2d484bec5 100644
 		mpz_t s;
 
 		_rsa_params_to_privkey(pk_params, &priv);
-@@ -2531,8 +2527,12 @@ static int _wrap_nettle_pk_sign(gnutls_pk_algorithm_t algo,
+@@ -2157,8 +2153,12 @@ static int _wrap_nettle_pk_sign(gnutls_pk_algorithm_t algo,
 			not_approved = true;
 		}
 
@ -59,10 +59,10 @@ index 91eaffd689..f2d484bec5 100644
 					      vdata->data, s);
 		if (ret < 0) {
 -- 
-2.48.1
+2.49.0


-From 49d06efa414ff3a2957ab94ff8967ceec20d026b Mon Sep 17 00:00:00 2001
+From 9f60b84e1496fa7bc62a136b83519e54ba935721 Mon Sep 17 00:00:00 2001
 From: Daiki Ueno <ueno@gnu.org>
 Date: Tue, 17 Dec 2024 16:55:47 +0900
 Subject: [PATCH 2/6] fips: perform RSA self-tests using RSA-PSS instead of
@ -204,10 +204,10 @@ index 63306705aa..84a70b5619 100644
 
 	ret = gnutls_pk_self_test(0, GNUTLS_PK_EC);
 -- 
-2.48.1
+2.49.0


-From 2117b2d505116efb43b14f4ef8914142780170f6 Mon Sep 17 00:00:00 2001
+From f653b2c15f4dd550f7937cf86d255a3c96bdb236 Mon Sep 17 00:00:00 2001
 From: Daiki Ueno <ueno@gnu.org>
 Date: Wed, 12 Feb 2025 07:23:59 +0900
 Subject: [PATCH 3/6] pk: sprinkle SPKI over encryption functions
@ -222,10 +222,11 @@ Signed-off-by: Daiki Ueno <ueno@gnu.org>
 lib/auth/rsa_psk.c   |  2 +-
 lib/crypto-backend.h |  9 ++++++---
 lib/nettle/pk.c      | 40 ++++++++++++++++++++++++----------------
- lib/pk.h             | 18 ++++++++++++------
+ lib/pk.h             | 17 +++++++++++------
+ lib/pkcs11/p11_pk.c  | 23 +++++++++++++----------
 lib/privkey.c        |  6 ++++--
 lib/pubkey.c         |  2 +-
- 7 files changed, 49 insertions(+), 30 deletions(-)
+ 8 files changed, 61 insertions(+), 40 deletions(-)

 diff --git a/lib/auth/rsa.c b/lib/auth/rsa.c
 index b5ecc092f8..4d181327ba 100644
@ -254,10 +255,10 @@ index 399fb4da14..9f97569c5b 100644
 		return ret;
 	}
 diff --git a/lib/crypto-backend.h b/lib/crypto-backend.h
-index f213a43dcf..1c7a25fd12 100644
+index 74e29a7cb9..24cbb60f77 100644
 --- a/lib/crypto-backend.h
 +++ b/lib/crypto-backend.h
-@@ -378,13 +378,16 @@ typedef struct gnutls_crypto_pk {
+@@ -386,13 +386,16 @@ typedef struct gnutls_crypto_pk {
 	 * parameters, depending on the operation */
 	int (*encrypt)(gnutls_pk_algorithm_t, gnutls_datum_t *ciphertext,
 		       const gnutls_datum_t *plaintext,
@ -278,10 +279,10 @@ index f213a43dcf..1c7a25fd12 100644
 		    const gnutls_datum_t *data, const gnutls_pk_params_st *priv,
 		    const gnutls_x509_spki_st *sign);
 diff --git a/lib/nettle/pk.c b/lib/nettle/pk.c
-index f2d484bec5..9fa63c4a56 100644
+index 7baf003f41..ffd7493748 100644
 --- a/lib/nettle/pk.c
 +++ b/lib/nettle/pk.c
-@@ -1221,7 +1221,8 @@ static inline int _rsa_oaep_encrypt(gnutls_digest_algorithm_t dig,
+@@ -1018,7 +1018,8 @@ static inline int _rsa_oaep_encrypt(gnutls_digest_algorithm_t dig,
 static int _wrap_nettle_pk_encrypt(gnutls_pk_algorithm_t algo,
 				   gnutls_datum_t *ciphertext,
 				   const gnutls_datum_t *plaintext,
@ -291,7 +292,7 @@ index f2d484bec5..9fa63c4a56 100644
 {
 	int ret;
 	bool not_approved = false;
-@@ -1297,10 +1298,10 @@ static int _wrap_nettle_pk_encrypt(gnutls_pk_algorithm_t algo,
+@@ -1094,10 +1095,10 @@ static int _wrap_nettle_pk_encrypt(gnutls_pk_algorithm_t algo,
 			goto cleanup;
 		}
 
@ -305,7 +306,7 @@ index f2d484bec5..9fa63c4a56 100644
 					plaintext->size, plaintext->data, buf);
 		if (ret == 0 || HAVE_LIB_ERROR()) {
 			ret = gnutls_assert_val(GNUTLS_E_ENCRYPTION_FAILED);
-@@ -1395,7 +1396,8 @@ static inline int _rsa_oaep_decrypt(gnutls_digest_algorithm_t dig,
+@@ -1192,7 +1193,8 @@ static inline int _rsa_oaep_decrypt(gnutls_digest_algorithm_t dig,
 static int _wrap_nettle_pk_decrypt(gnutls_pk_algorithm_t algo,
 				   gnutls_datum_t *plaintext,
 				   const gnutls_datum_t *ciphertext,
@ -315,7 +316,7 @@ index f2d484bec5..9fa63c4a56 100644
 {
 	int ret;
 	bool not_approved = false;
-@@ -1403,7 +1405,7 @@ static int _wrap_nettle_pk_decrypt(gnutls_pk_algorithm_t algo,
+@@ -1200,7 +1202,7 @@ static int _wrap_nettle_pk_decrypt(gnutls_pk_algorithm_t algo,
 
 	FAIL_IF_LIB_ERROR;
 
@ -324,7 +325,7 @@ index f2d484bec5..9fa63c4a56 100644
 		algo = GNUTLS_PK_RSA_OAEP;
 	}
 
-@@ -1488,10 +1490,10 @@ static int _wrap_nettle_pk_decrypt(gnutls_pk_algorithm_t algo,
+@@ -1285,10 +1287,10 @@ static int _wrap_nettle_pk_decrypt(gnutls_pk_algorithm_t algo,
 			random_func = rnd_nonce_func_fallback;
 		else
 			random_func = rnd_nonce_func;
@ -338,7 +339,7 @@ index f2d484bec5..9fa63c4a56 100644
 					&length, buf, ciphertext->data);
 
 		if (ret == 0 || HAVE_LIB_ERROR()) {
-@@ -1557,7 +1559,8 @@ static int _wrap_nettle_pk_decrypt2(gnutls_pk_algorithm_t algo,
+@@ -1354,7 +1356,8 @@ static int _wrap_nettle_pk_decrypt2(gnutls_pk_algorithm_t algo,
 				    const gnutls_datum_t *ciphertext,
 				    unsigned char *plaintext,
 				    size_t plaintext_size,
@ -348,7 +349,7 @@ index f2d484bec5..9fa63c4a56 100644
 {
 	struct rsa_private_key priv;
 	struct rsa_public_key pub;
-@@ -1573,7 +1576,7 @@ static int _wrap_nettle_pk_decrypt2(gnutls_pk_algorithm_t algo,
+@@ -1370,7 +1373,7 @@ static int _wrap_nettle_pk_decrypt2(gnutls_pk_algorithm_t algo,
 		goto fail;
 	}
 
@ -357,7 +358,7 @@ index f2d484bec5..9fa63c4a56 100644
 		algo = GNUTLS_PK_RSA_OAEP;
 	}
 
-@@ -1610,10 +1613,10 @@ static int _wrap_nettle_pk_decrypt2(gnutls_pk_algorithm_t algo,
+@@ -1407,10 +1410,10 @@ static int _wrap_nettle_pk_decrypt2(gnutls_pk_algorithm_t algo,
 				       ciphertext->data);
 		break;
 	case GNUTLS_PK_RSA_OAEP:
@ -371,7 +372,7 @@ index f2d484bec5..9fa63c4a56 100644
 					&plaintext_size, plaintext,
 					ciphertext->data);
 		break;
-@@ -3645,6 +3648,11 @@ static int pct_test(gnutls_pk_algorithm_t algo,
+@@ -3255,6 +3258,11 @@ static int pct_test(gnutls_pk_algorithm_t algo,
 			ret = gnutls_assert_val(GNUTLS_E_PK_GENERATION_ERROR);
 			goto cleanup;
 		}
@ -383,7 +384,7 @@ index f2d484bec5..9fa63c4a56 100644
 	} else {
 		ddata.data = (void *)const_data;
 		ddata.size = sizeof(const_data);
-@@ -3670,7 +3678,7 @@ static int pct_test(gnutls_pk_algorithm_t algo,
+@@ -3280,7 +3288,7 @@ static int pct_test(gnutls_pk_algorithm_t algo,
 			}
 		}
 
@ -392,7 +393,7 @@ index f2d484bec5..9fa63c4a56 100644
 		if (ret < 0) {
 			ret = gnutls_assert_val(GNUTLS_E_PK_GENERATION_ERROR);
 		}
-@@ -3679,7 +3687,7 @@ static int pct_test(gnutls_pk_algorithm_t algo,
+@@ -3289,7 +3297,7 @@ static int pct_test(gnutls_pk_algorithm_t algo,
 			ret = gnutls_assert_val(GNUTLS_E_PK_GENERATION_ERROR);
 		}
 		if (ret == 0 &&
@ -402,34 +403,118 @@ index f2d484bec5..9fa63c4a56 100644
 		}
 		if (ret == 0 &&
 diff --git a/lib/pk.h b/lib/pk.h
-index eca4e02d73..873ec4ef4e 100644
+index 6969b534de..246d6e0299 100644
 --- a/lib/pk.h
 +++ b/lib/pk.h
-@@ -26,12 +26,18 @@
+@@ -27,13 +27,18 @@
+ 
 extern int crypto_pk_prio;
- extern gnutls_crypto_pk_st _gnutls_pk_ops;
 
 -#define _gnutls_pk_encrypt(algo, ciphertext, plaintext, params) \
-	_gnutls_pk_ops.encrypt(algo, ciphertext, plaintext, params)
+-	_gnutls_pk_backend()->encrypt(algo, ciphertext, plaintext, params)
 -#define _gnutls_pk_decrypt(algo, ciphertext, plaintext, params) \
-	_gnutls_pk_ops.decrypt(algo, ciphertext, plaintext, params)
-#define _gnutls_pk_decrypt2(algo, ciphertext, plaintext, size, params) \
-	_gnutls_pk_ops.decrypt2(algo, ciphertext, plaintext, size, params)
-+#define _gnutls_pk_encrypt(algo, ciphertext, plaintext, params,     \
-+			   encrypt_params)                          \
-+	_gnutls_pk_ops.encrypt(algo, ciphertext, plaintext, params, \
-+			       encrypt_params)
-+#define _gnutls_pk_decrypt(algo, ciphertext, plaintext, params,     \
-+			   encrypt_params)                          \
-+	_gnutls_pk_ops.decrypt(algo, ciphertext, plaintext, params, \
-+			       encrypt_params)
-+#define _gnutls_pk_decrypt2(algo, ciphertext, plaintext, size, params,     \
-+			    encrypt_params)                                \
-+	_gnutls_pk_ops.decrypt2(algo, ciphertext, plaintext, size, params, \
-+				encrypt_params)
+-	_gnutls_pk_backend()->decrypt(algo, ciphertext, plaintext, params)
+-#define _gnutls_pk_decrypt2(algo, ciphertext, plaintext, size, params)    \
+#define _gnutls_pk_encrypt(algo, ciphertext, plaintext, params,            \
+			   encrypt_params)                                 \
+	_gnutls_pk_backend()->encrypt(algo, ciphertext, plaintext, params, \
+				      encrypt_params)
+#define _gnutls_pk_decrypt(algo, ciphertext, plaintext, params,            \
+			   encrypt_params)                                 \
+	_gnutls_pk_backend()->decrypt(algo, ciphertext, plaintext, params, \
+				      encrypt_params)
+#define _gnutls_pk_decrypt2(algo, ciphertext, plaintext, size, params,    \
+			    encrypt_params)                               \
+ 	_gnutls_pk_backend()->decrypt2(algo, ciphertext, plaintext, size, \
+-				       params)
+				       params, encrypt_params)
 #define _gnutls_pk_sign(algo, sig, data, params, sign_params) \
- 	_gnutls_pk_ops.sign(algo, sig, data, params, sign_params)
+ 	_gnutls_pk_backend()->sign(algo, sig, data, params, sign_params)
 #define _gnutls_pk_verify(algo, data, sig, params, sign_params) \
+diff --git a/lib/pkcs11/p11_pk.c b/lib/pkcs11/p11_pk.c
+index 34a9cd24bc..8227998a2f 100644
+--- a/lib/pkcs11/p11_pk.c
+++ b/lib/pkcs11/p11_pk.c
+@@ -228,9 +228,9 @@ cleanup:
+ }
+ 
+ static bool init_rsa_oaep_param(CK_RSA_PKCS_OAEP_PARAMS *param,
+-				const gnutls_pk_params_st *pk_params)
+				const gnutls_x509_spki_st *encrypt_params)
+ {
+-	switch (pk_params->spki.rsa_oaep_dig) {
+	switch (encrypt_params->rsa_oaep_dig) {
+ 	case GNUTLS_DIG_SHA256:
+ 		param->hashAlg = CKM_SHA256;
+ 		param->mgf = CKG_MGF1_SHA256;
+@@ -247,8 +247,8 @@ static bool init_rsa_oaep_param(CK_RSA_PKCS_OAEP_PARAMS *param,
+ 		return false;
+ 	}
+ 	param->source = CKZ_DATA_SPECIFIED;
+-	param->pSourceData = pk_params->spki.rsa_oaep_label.data;
+-	param->ulSourceDataLen = pk_params->spki.rsa_oaep_label.size;
+	param->pSourceData = encrypt_params->rsa_oaep_label.data;
+	param->ulSourceDataLen = encrypt_params->rsa_oaep_label.size;
+ 	return true;
+ }
+ 
+@@ -706,7 +706,8 @@ static int derive_ecdh_secret(CK_SESSION_HANDLE session,
+ static int _wrap_p11_pk_encrypt(gnutls_pk_algorithm_t algo,
+ 				gnutls_datum_t *ciphertext,
+ 				const gnutls_datum_t *plaintext,
+-				const gnutls_pk_params_st *pk_params)
+				const gnutls_pk_params_st *pk_params,
+				const gnutls_x509_spki_st *encrypt_params)
+ {
+ 	int ret = 0;
+ 	CK_RV rv;
+@@ -742,7 +743,7 @@ static int _wrap_p11_pk_encrypt(gnutls_pk_algorithm_t algo,
+ 		mech.pParameter = &param_rsa_oaep;
+ 		mech.ulParameterLen = sizeof(param_rsa_oaep);
+ 
+-		if (!init_rsa_oaep_param(&param_rsa_oaep, pk_params)) {
+		if (!init_rsa_oaep_param(&param_rsa_oaep, encrypt_params)) {
+ 			ret = gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
+ 			goto cleanup;
+ 		}
+@@ -798,7 +799,8 @@ cleanup:
+ static int _wrap_p11_pk_decrypt(gnutls_pk_algorithm_t algo,
+ 				gnutls_datum_t *plaintext,
+ 				const gnutls_datum_t *ciphertext,
+-				const gnutls_pk_params_st *pk_params)
+				const gnutls_pk_params_st *pk_params,
+				const gnutls_x509_spki_st *encrypt_params)
+ {
+ 	int ret = 0;
+ 	CK_RV rv;
+@@ -834,7 +836,7 @@ static int _wrap_p11_pk_decrypt(gnutls_pk_algorithm_t algo,
+ 		mech.pParameter = &param_rsa_oaep;
+ 		mech.ulParameterLen = sizeof(param_rsa_oaep);
+ 
+-		if (!init_rsa_oaep_param(&param_rsa_oaep, pk_params)) {
+		if (!init_rsa_oaep_param(&param_rsa_oaep, encrypt_params)) {
+ 			ret = gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
+ 			goto cleanup;
+ 		}
+@@ -890,7 +892,8 @@ static int _wrap_p11_pk_decrypt2(gnutls_pk_algorithm_t algo,
+ 				 const gnutls_datum_t *ciphertext,
+ 				 unsigned char *plaintext,
+ 				 size_t plaintext_size,
+-				 const gnutls_pk_params_st *pk_params)
+				 const gnutls_pk_params_st *pk_params,
+				 const gnutls_x509_spki_st *encrypt_params)
+ {
+ 	int ret = 0;
+ 	uint32_t is_err;
+@@ -928,7 +931,7 @@ static int _wrap_p11_pk_decrypt2(gnutls_pk_algorithm_t algo,
+ 		mech.pParameter = &param_rsa_oaep;
+ 		mech.ulParameterLen = sizeof(param_rsa_oaep);
+ 
+-		if (!init_rsa_oaep_param(&param_rsa_oaep, pk_params)) {
+		if (!init_rsa_oaep_param(&param_rsa_oaep, encrypt_params)) {
+ 			ret = gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
+ 			goto cleanup;
+ 		}
 diff --git a/lib/privkey.c b/lib/privkey.c
 index 84e984f6b9..05a3804c25 100644
 --- a/lib/privkey.c
@ -455,7 +540,7 @@ index 84e984f6b9..05a3804c25 100644
 	case GNUTLS_PRIVKEY_PKCS11:
 		return _gnutls_pkcs11_privkey_decrypt_data2(key->key.pkcs11,
 diff --git a/lib/pubkey.c b/lib/pubkey.c
-index 1e5ecf31cd..97ac347348 100644
+index 02a08b8163..73dd9e16b0 100644
 --- a/lib/pubkey.c
 +++ b/lib/pubkey.c
@@ -2336,7 +2336,7 @@ int gnutls_pubkey_encrypt_data(gnutls_pubkey_t key, unsigned int flags,
@ -468,10 +553,10 @@ index 1e5ecf31cd..97ac347348 100644
 
 static int pubkey_supports_sig(gnutls_pubkey_t pubkey,
 -- 
-2.48.1
+2.49.0


-From 12da96dbc7f3e1061a066cbb589844018c031737 Mon Sep 17 00:00:00 2001
+From e1be1e6b805b50a43ada57757ffe9cdf201289b5 Mon Sep 17 00:00:00 2001
 From: Daiki Ueno <ueno@gnu.org>
 Date: Wed, 12 Feb 2025 12:13:47 +0900
 Subject: [PATCH 4/6] pk: exercise decrypt2 in PCT
@ -482,10 +567,10 @@ Signed-off-by: Daiki Ueno <ueno@gnu.org>
 1 file changed, 12 insertions(+), 1 deletion(-)

 diff --git a/lib/nettle/pk.c b/lib/nettle/pk.c
-index 9fa63c4a56..65c3d8a990 100644
+index ffd7493748..e4ad772842 100644
 --- a/lib/nettle/pk.c
 +++ b/lib/nettle/pk.c
-@@ -1571,7 +1571,8 @@ static int _wrap_nettle_pk_decrypt2(gnutls_pk_algorithm_t algo,
+@@ -1368,7 +1368,8 @@ static int _wrap_nettle_pk_decrypt2(gnutls_pk_algorithm_t algo,
 
 	FAIL_IF_LIB_ERROR;
 
@ -495,7 +580,7 @@ index 9fa63c4a56..65c3d8a990 100644
 		ret = gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);
 		goto fail;
 	}
-@@ -3695,6 +3696,16 @@ static int pct_test(gnutls_pk_algorithm_t algo,
+@@ -3305,6 +3306,16 @@ static int pct_test(gnutls_pk_algorithm_t algo,
 		      memcmp(tmp.data, ddata.data, tmp.size) == 0)) {
 			ret = gnutls_assert_val(GNUTLS_E_PK_GENERATION_ERROR);
 		}
@ -513,10 +598,10 @@ index 9fa63c4a56..65c3d8a990 100644
 		if (algo == GNUTLS_PK_RSA) {
 			if (unlikely(gnutls_fips140_pop_context() < 0)) {
 -- 
-2.48.1
+2.49.0


-From cce5688e3cb40eb535d2317cd263347f3bccbeb8 Mon Sep 17 00:00:00 2001
+From 4e7b9e800f17bb0655e6d4de8f101d8a3b601fbc Mon Sep 17 00:00:00 2001
 From: Daiki Ueno <ueno@gnu.org>
 Date: Mon, 27 Jan 2025 16:36:41 +0900
 Subject: [PATCH 5/6] fips: perform both PCTs for unrestricted RSA key
@ -535,10 +620,10 @@ Signed-off-by: Daiki Ueno <ueno@gnu.org>
 3 files changed, 19 insertions(+), 41 deletions(-)

 diff --git a/lib/nettle/pk.c b/lib/nettle/pk.c
-index 65c3d8a990..5cad889f91 100644
+index e4ad772842..f7f7c0637b 100644
 --- a/lib/nettle/pk.c
 +++ b/lib/nettle/pk.c
-@@ -3603,7 +3603,6 @@ static int pct_test(gnutls_pk_algorithm_t algo,
+@@ -3213,7 +3213,6 @@ static int pct_test(gnutls_pk_algorithm_t algo,
 	gnutls_datum_t ddata, tmp = { NULL, 0 };
 	char *gen_data = NULL;
 	gnutls_x509_spki_st spki;
@ -546,7 +631,7 @@ index 65c3d8a990..5cad889f91 100644
 
 	ret = _gnutls_x509_spki_copy(&spki, &params->spki);
 	if (ret < 0) {
-@@ -3661,25 +3660,23 @@ static int pct_test(gnutls_pk_algorithm_t algo,
+@@ -3271,25 +3270,23 @@ static int pct_test(gnutls_pk_algorithm_t algo,
 
 	switch (algo) {
 	case GNUTLS_PK_RSA:
@ -588,7 +673,7 @@ index 65c3d8a990..5cad889f91 100644
 		if (ret < 0) {
 			ret = gnutls_assert_val(GNUTLS_E_PK_GENERATION_ERROR);
 		}
-@@ -3707,14 +3704,6 @@ static int pct_test(gnutls_pk_algorithm_t algo,
+@@ -3317,14 +3314,6 @@ static int pct_test(gnutls_pk_algorithm_t algo,
 			ret = gnutls_assert_val(GNUTLS_E_PK_GENERATION_ERROR);
 		}
 
@ -603,7 +688,7 @@ index 65c3d8a990..5cad889f91 100644
 		if (ret < 0) {
 			goto cleanup;
 		}
-@@ -3722,12 +3711,7 @@ static int pct_test(gnutls_pk_algorithm_t algo,
+@@ -3332,12 +3321,7 @@ static int pct_test(gnutls_pk_algorithm_t algo,
 		free(sig.data);
 		sig.data = NULL;
 
@ -651,10 +736,10 @@ index 61a76d3c09..2963ccd531 100644
 	sign_verify_unsuccessfully(privkey, pubkey);
 	generate_unsuccessfully(&privkey, &pubkey, 1024);
 -- 
-2.48.1
+2.49.0


-From 4e1642b13fdf194aa007cb37086ce9d42f867e47 Mon Sep 17 00:00:00 2001
+From 7b5f1bddcd77d61531fdb5c084c43947786b27ab Mon Sep 17 00:00:00 2001
 From: Daiki Ueno <ueno@gnu.org>
 Date: Mon, 10 Feb 2025 15:57:39 +0900
 Subject: [PATCH 6/6] tests: do not assume RSAES-PKCS1-v1_5 is enabled in
@ -686,5 +771,5 @@ index 714d0af946..30cb77ca50 100755
 -
 exit 0
 -- 
-2.48.1
+2.49.0

--- a/gnutls-3.8.9-cli-earlydata.patch
+++ b/gnutls-3.8.9-cli-earlydata.patch
@ -1,196 +0,0 @@
-From 54c06a9cd7bcf8f245cf5f9da760f91939259f69 Mon Sep 17 00:00:00 2001
-From: Daiki Ueno <ueno@gnu.org>
-Date: Sun, 16 Feb 2025 09:02:46 +0900
-Subject: [PATCH 1/3] serv: fix detection of early data reception
-
-Upon success, gnutls_record_recv_early_data returns the amount of data
-received, so the application should treat positive numbers as an
-indication of early data reception.
-
-Signed-off-by: Daiki Ueno <ueno@gnu.org>
---
- src/serv.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/serv.c b/src/serv.c
-index 17db12c5ca..86008c9523 100644
--- a/src/serv.c
-+++ b/src/serv.c
-@@ -1690,7 +1690,7 @@ static void tcp_server(const char *name, int port, int timeout)
- 						    GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
- 							j->earlydata_eof = 1;
- 						}
-						if (r == 0) {
-+						if (r >= 0) {
- 							earlydata_read = 1;
- 						}
- 					}
-- 
-2.49.0
-
-
-From 8c488288ea05a759977dccd4ee4d61610da4dc38 Mon Sep 17 00:00:00 2001
-From: Daiki Ueno <ueno@gnu.org>
-Date: Mon, 17 Mar 2025 09:00:44 +0900
-Subject: [PATCH 2/3] cli: send early data only after session data is set
-
-Now that max_early_data_size is recorded as part of the stored
-resumption data, this needs to be read before attempting to send early
-data.
-
-Signed-off-by: Daiki Ueno <ueno@gnu.org>
---
- src/socket.c | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/src/socket.c b/src/socket.c
-index 48784b67fa..f32910c239 100644
--- a/src/socket.c
-+++ b/src/socket.c
-@@ -580,6 +580,11 @@ void socket_open_int(socket_st *hd, const char *hostname, const char *service,
- 		}
- 
- 		if (hd->session) {
-+			if (hd->rdata.data) {
-+				gnutls_session_set_data(hd->session,
-+							hd->rdata.data,
-+							hd->rdata.size);
-+			}
- 			if (hd->edata.data) {
- 				ret = gnutls_record_send_early_data(
- 					hd->session, hd->edata.data,
-@@ -591,11 +596,6 @@ void socket_open_int(socket_st *hd, const char *hostname, const char *service,
- 					exit(1);
- 				}
- 			}
-			if (hd->rdata.data) {
-				gnutls_session_set_data(hd->session,
-							hd->rdata.data,
-							hd->rdata.size);
-			}
- 
- 			if (client_trace || server_trace) {
- 				hd->server_trace = server_trace;
-- 
-2.49.0
-
-
-From 56fa5e1901fe40a97553cf3141a4d205c4286702 Mon Sep 17 00:00:00 2001
-From: Daiki Ueno <ueno@gnu.org>
-Date: Sun, 16 Feb 2025 09:04:50 +0900
-Subject: [PATCH 3/3] tests: add basic tests for 0-RTT with gnutls-serv and
- gnutls-cli
-
-Signed-off-by: Daiki Ueno <ueno@gnu.org>
---
- tests/Makefile.am             |  2 +-
- tests/gnutls-cli-earlydata.sh | 84 +++++++++++++++++++++++++++++++++++
- 2 files changed, 85 insertions(+), 1 deletion(-)
- create mode 100755 tests/gnutls-cli-earlydata.sh
-
-diff --git a/tests/Makefile.am b/tests/Makefile.am
-index ec8fd982c5..72926e9da4 100644
--- a/tests/Makefile.am
-+++ b/tests/Makefile.am
-@@ -546,7 +546,7 @@ dist_check_SCRIPTS += fastopen.sh pkgconfig.sh starttls.sh starttls-ftp.sh start
- 	sni-resume.sh ocsp-tests/ocsptool.sh cert-reencoding.sh pkcs7-cat.sh long-crl.sh \
- 	serv-udp.sh logfile-option.sh gnutls-cli-resume.sh profile-tests.sh \
- 	server-weak-keys.sh ocsp-tests/ocsp-signer-verify.sh cfg-test.sh \
-	sanity-lib.sh
-+	sanity-lib.sh gnutls-cli-earlydata.sh
- 
- if !DISABLE_SYSTEM_CONFIG
- dist_check_SCRIPTS += system-override-sig.sh system-override-hash.sh \
-diff --git a/tests/gnutls-cli-earlydata.sh b/tests/gnutls-cli-earlydata.sh
-new file mode 100755
-index 0000000000..72763f029f
--- /dev/null
-+++ b/tests/gnutls-cli-earlydata.sh
-@@ -0,0 +1,84 @@
-+#!/bin/sh
-+
-+# Copyright (C) 2025 Red Hat, Inc.
-+#
-+# Author: Daiki Ueno
-+#
-+# This file is part of GnuTLS.
-+#
-+# GnuTLS is free software; you can redistribute it and/or modify it
-+# under the terms of the GNU General Public License as published by the
-+# Free Software Foundation; either version 3 of the License, or (at
-+# your option) any later version.
-+#
-+# GnuTLS is distributed in the hope that it will be useful, but
-+# WITHOUT ANY WARRANTY; without even the implied warranty of
-+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-+# General Public License for more details.
-+#
-+# You should have received a copy of the GNU Lesser General Public License
-+# along with this program.  If not, see <https://www.gnu.org/licenses/>
-+#
-+
-+: ${srcdir=.}
-+: ${SERV=../src/gnutls-serv${EXEEXT}}
-+: ${CLI=../src/gnutls-cli${EXEEXT}}
-+unset RETCODE
-+
-+if ! test -x "$SERV"; then
-+	exit 77
-+fi
-+
-+if ! test -x "$CLI"; then
-+	exit 77
-+fi
-+
-+if test "$WINDIR" != ""; then
-+	exit 77
-+fi
-+
-+if test -n "$VALGRIND"; then
-+	VALGRIND="${LIBTOOL:-libtool} --mode=execute $VALGRIND --error-exitcode=1"
-+fi
-+
-+SERV="$SERV -q"
-+
-+. "$srcdir/scripts/common.sh"
-+
-+: ${ac_cv_sizeof_time_t=8}
-+if test "$ac_cv_sizeof_time_t" -ge 8; then
-+	ATTIME_VALID="2038-10-12"  # almost the pregenerated cert expiration
-+else
-+	ATTIME_VALID="2030-12-17"  # end of epoch − 2590 days of validity
-+fi
-+
-+testdir=`create_testdir earlydata`
-+KEY="$srcdir/../doc/credentials/x509/key-ecc.pem"
-+CERT="$srcdir/../doc/credentials/x509/cert-ecc.pem"
-+CACERT="$srcdir/../doc/credentials/x509/ca.pem"
-+
-+eval "$GETPORT"
-+launch_server --echo --x509keyfile "$KEY" --x509certfile "$CERT" --disable-client-cert --earlydata --maxearlydata 1000
-+PID=$!
-+wait_server "$PID"
-+
-+echo "This is a test message" > "$testdir/earlydata.txt"
-+
-+$VALGRIND "$CLI" --attime="$ATTIME_VALID" -p "$PORT" localhost --logfile="$testdir/cli.log" --priority="NORMAL:-VERS-ALL:+VERS-TLS1.3" --x509cafile "$CACERT" --resume --waitresumption --earlydata="$testdir/earlydata.txt" </dev/null >"$testdir/cli.out"
-+if test $? -ne 0; then
-+	cat "$testdir/cli.log"
-+	fail "$PID" "failed to communicate with the server"
-+fi
-+
-+if ! grep "This is a resumed session" "$testdir/cli.log" > /dev/null; then
-+	fail "$PID" "session is not resumed"
-+fi
-+
-+if ! cmp "$testdir/earlydata.txt" "$testdir/cli.out" > /dev/null; then
-+	fail "$PID" "early data has not been sent back"
-+fi
-+
-+kill "$PID"
-+wait
-+
-+exit 0
-- 
-2.49.0
-
--- a/gnutls-3.8.9-cve-2025-32988.patch
+++ b/gnutls-3.8.9-cve-2025-32988.patch
@ -1,40 +0,0 @@
-From 741e8c7e011b859955a9424579af48f80d6a754a Mon Sep 17 00:00:00 2001
-From: Daiki Ueno <ueno@gnu.org>
-Date: Mon, 7 Jul 2025 10:44:12 +0900
-Subject: [PATCH] x509: avoid double free when exporting othernames in SAN
-
-Previously, the _gnutls_write_new_othername function, called by
-gnutls_x509_ext_export_subject_alt_names to export "otherName" in a
-certificate's SAN extension, freed the caller allocated ASN.1
-structure upon error, resulting in a potential double-free.
-
-Reported by OpenAI Security Research Team.
-
-Signed-off-by: Daiki Ueno <ueno@gnu.org>
---
- lib/x509/extensions.c | 2 --
- 1 file changed, 2 deletions(-)
-
-diff --git a/lib/x509/extensions.c b/lib/x509/extensions.c
-index 6c2da8fd10..e8be12eaf5 100644
--- a/lib/x509/extensions.c
-+++ b/lib/x509/extensions.c
-@@ -754,7 +754,6 @@ int _gnutls_write_new_othername(asn1_node ext, const char *ext_name,
- 	result = asn1_write_value(ext, name2, oid, 1);
- 	if (result != ASN1_SUCCESS) {
- 		gnutls_assert();
-		asn1_delete_structure(&ext);
- 		return _gnutls_asn2err(result);
- 	}
- 
-@@ -763,7 +762,6 @@ int _gnutls_write_new_othername(asn1_node ext, const char *ext_name,
- 	result = asn1_write_value(ext, name2, data, data_size);
- 	if (result != ASN1_SUCCESS) {
- 		gnutls_assert();
-		asn1_delete_structure(&ext);
- 		return _gnutls_asn2err(result);
- 	}
- 
-- 
-2.50.1
-
--- a/gnutls-3.8.9-cve-2025-32989.patch
+++ b/gnutls-3.8.9-cve-2025-32989.patch
@ -1,34 +0,0 @@
-From 8d9f4514676e7bdba85a3b0db65f8feab9855533 Mon Sep 17 00:00:00 2001
-From: Andrew Hamilton <adhamilt@gmail.com>
-Date: Mon, 7 Jul 2025 10:23:59 +0900
-Subject: [PATCH] x509: fix read buffer overrun in SCT timestamps
-
-Prevent reading beyond heap buffer in call to _gnutls_parse_ct_sct
-when processing x509 Signed Certificate Timestamps with certain
-malformed data. Spotted by oss-fuzz at:
-https://issues.oss-fuzz.com/issues/42530513
-
-Signed-off-by: Andrew Hamilton <adhamilt@gmail.com>
-Signed-off-by: Daiki Ueno <ueno@gnu.org>
---
- .../04939b75417cc95b7372c6f208c4bda4579bdc34     | Bin 0 -> 1782 bytes
- lib/x509/x509_ext.c                              |   2 +-
- 2 files changed, 1 insertion(+), 1 deletion(-)
- create mode 100644 fuzz/gnutls_x509_parser_fuzzer.repro/04939b75417cc95b7372c6f208c4bda4579bdc34
-
-diff --git a/lib/x509/x509_ext.c b/lib/x509/x509_ext.c
-index 1714578de6..a0b831cee1 100644
--- a/lib/x509/x509_ext.c
-+++ b/lib/x509/x509_ext.c
-@@ -3757,7 +3757,7 @@ int gnutls_x509_ext_ct_import_scts(const gnutls_datum_t *ext,
- 	}
- 
- 	length = _gnutls_read_uint16(scts_content.data);
-	if (length < 4) {
-+	if (length < 4 || length > scts_content.size) {
- 		gnutls_free(scts_content.data);
- 		return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
- 	}
-- 
-2.50.1
-
--- a/gnutls-3.8.9-cve-2025-32990.patch
+++ b/gnutls-3.8.9-cve-2025-32990.patch
--- a/gnutls-3.8.9-cve-2025-6395.patch
+++ b/gnutls-3.8.9-cve-2025-6395.patch
@ -1,282 +0,0 @@
-From bb7f0238cd58e00c0b00257bbe18bfde346651f0 Mon Sep 17 00:00:00 2001
-From: Daiki Ueno <ueno@gnu.org>
-Date: Mon, 7 Jul 2025 11:15:45 +0900
-Subject: [PATCH] handshake: clear HSK_PSK_SELECTED is when resetting binders
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-When a TLS 1.3 handshake involves HRR and resumption or PSK, and the
-second Client Hello omits PSK, the server would result in a NULL
-pointer dereference as the PSK binder information is cleared while the
-HSK_PSK_SELECTED flag is still set. This makes sure that
-HSK_PSK_SELECTED flag is always cleared when the PSK binders are
-reset. This also makes it clear the HSK_PSK_SELECTED flag is valid
-only during a handshake; after that, whether PSK is used can be
-checked with gnutls_auth_client_get_type.
-
-Reported by Stefan Bühler.
-
-Signed-off-by: Daiki Ueno <ueno@gnu.org>
---
- .gitignore                            |   1 +
- lib/handshake.c                       |  25 +++-
- lib/state.c                           |   4 +-
- tests/Makefile.am                     |   2 +
- tests/tls13/hello_retry_request_psk.c | 173 ++++++++++++++++++++++++++
- 5 files changed, 201 insertions(+), 4 deletions(-)
- create mode 100644 tests/tls13/hello_retry_request_psk.c
-
-diff --git a/lib/handshake.c b/lib/handshake.c
-index 722307be7c..489d021945 100644
--- a/lib/handshake.c
-+++ b/lib/handshake.c
-@@ -589,9 +589,28 @@ static int set_auth_types(gnutls_session_t session)
- 		/* Under TLS1.3 this returns a KX which matches the negotiated
- 		 * groups from the key shares; if we are resuming then the KX seen
- 		 * here doesn't match the original session. */
-		if (!session->internals.resumed)
-			kx = gnutls_kx_get(session);
-		else
-+		if (!session->internals.resumed) {
-+			const gnutls_group_entry_st *group = get_group(session);
-+
-+			if (session->internals.hsk_flags & HSK_PSK_SELECTED) {
-+				if (group) {
-+					kx = group->pk == GNUTLS_PK_DH ?
-+						     GNUTLS_KX_DHE_PSK :
-+						     GNUTLS_KX_ECDHE_PSK;
-+				} else {
-+					kx = GNUTLS_KX_PSK;
-+				}
-+			} else if (group) {
-+				/* Not necessarily be RSA, but just to
-+				 * make _gnutls_map_kx_get_cred below
-+				 * work.
-+				 */
-+				kx = group->pk == GNUTLS_PK_DH ?
-+					     GNUTLS_KX_DHE_RSA :
-+					     GNUTLS_KX_ECDHE_RSA;
-+			} else
-+				kx = GNUTLS_KX_UNKNOWN;
-+		} else
- 			kx = GNUTLS_KX_UNKNOWN;
- 	} else {
- 		/* TLS1.2 or earlier, kx is associated with ciphersuite */
-diff --git a/lib/state.c b/lib/state.c
-index 9d3ece7570..020f212856 100644
--- a/lib/state.c
-+++ b/lib/state.c
-@@ -202,7 +202,8 @@ gnutls_kx_algorithm_t gnutls_kx_get(gnutls_session_t session)
- 		const gnutls_group_entry_st *group = get_group(session);
- 
- 		if (ver->tls13_sem) {
-			if (session->internals.hsk_flags & HSK_PSK_SELECTED) {
-+			if (gnutls_auth_client_get_type(session) ==
-+			    GNUTLS_CRD_PSK) {
- 				if (group) {
- 					if (group->pk == GNUTLS_PK_DH)
- 						return GNUTLS_KX_DHE_PSK;
-@@ -349,6 +350,7 @@ void reset_binders(gnutls_session_t session)
- 	_gnutls_free_temp_key_datum(&session->key.binders[0].psk);
- 	_gnutls_free_temp_key_datum(&session->key.binders[1].psk);
- 	memset(session->key.binders, 0, sizeof(session->key.binders));
-+	session->internals.hsk_flags &= ~HSK_PSK_SELECTED;
- }
- 
- /* Check whether certificate credentials of type @cert_type are set
-diff --git a/tests/Makefile.am b/tests/Makefile.am
-index ec8fd982c5..0dd10fe1bd 100644
--- a/tests/Makefile.am
-+++ b/tests/Makefile.am
-@@ -131,6 +131,8 @@ ctests += tls13/hello_retry_request
- 
- ctests += tls13/hello_retry_request_resume
- 
-+ctests += tls13/hello_retry_request_psk
-+
- ctests += tls13/psk-ext
- 
- ctests += tls13/key_update
-diff --git a/tests/tls13/hello_retry_request_psk.c b/tests/tls13/hello_retry_request_psk.c
-new file mode 100644
-index 0000000000..a20cb0d965
--- /dev/null
-+++ b/tests/tls13/hello_retry_request_psk.c
-@@ -0,0 +1,173 @@
-+/*
-+ * Copyright (C) 2017-2025 Red Hat, Inc.
-+ *
-+ * Author: Nikos Mavrogiannopoulos, Daiki Ueno
-+ *
-+ * This file is part of GnuTLS.
-+ *
-+ * GnuTLS is free software; you can redistribute it and/or modify it
-+ * under the terms of the GNU General Public License as published by
-+ * the Free Software Foundation; either version 3 of the License, or
-+ * (at your option) any later version.
-+ *
-+ * GnuTLS is distributed in the hope that it will be useful, but
-+ * WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-+ * General Public License for more details.
-+ *
-+ * You should have received a copy of the GNU Lesser General Public License
-+ * along with this program.  If not, see <https://www.gnu.org/licenses/>
-+ */
-+
-+#ifdef HAVE_CONFIG_H
-+#include "config.h"
-+#endif
-+
-+#include <stdio.h>
-+#include <stdlib.h>
-+#include <stdint.h>
-+
-+#include <string.h>
-+#include <gnutls/gnutls.h>
-+#include <assert.h>
-+
-+#include "cert-common.h"
-+#include "utils.h"
-+#include "tls13/ext-parse.h"
-+#include "eagain-common.h"
-+
-+/* This program exercises the case where a TLS 1.3 handshake ends up
-+ * with HRR, and the first CH includes PSK while the 2nd CH omits
-+ * it */
-+
-+const char *testname = "hello entry request";
-+
-+const char *side = "";
-+
-+#define myfail(fmt, ...) fail("%s: " fmt, testname, ##__VA_ARGS__)
-+
-+static void tls_log_func(int level, const char *str)
-+{
-+	fprintf(stderr, "%s|<%d>| %s", side, level, str);
-+}
-+
-+struct ctx_st {
-+	unsigned hrr_seen;
-+	unsigned hello_counter;
-+};
-+
-+static int pskfunc(gnutls_session_t session, const char *username,
-+		   gnutls_datum_t *key)
-+{
-+	if (debug)
-+		printf("psk: username %s\n", username);
-+	key->data = gnutls_malloc(4);
-+	key->data[0] = 0xDE;
-+	key->data[1] = 0xAD;
-+	key->data[2] = 0xBE;
-+	key->data[3] = 0xEF;
-+	key->size = 4;
-+	return 0;
-+}
-+
-+static int hello_callback(gnutls_session_t session, unsigned int htype,
-+			  unsigned post, unsigned int incoming,
-+			  const gnutls_datum_t *msg)
-+{
-+	struct ctx_st *ctx = gnutls_session_get_ptr(session);
-+	assert(ctx != NULL);
-+
-+	if (htype == GNUTLS_HANDSHAKE_HELLO_RETRY_REQUEST)
-+		ctx->hrr_seen = 1;
-+
-+	if (htype == GNUTLS_HANDSHAKE_CLIENT_HELLO) {
-+		if (post == GNUTLS_HOOK_POST)
-+			ctx->hello_counter++;
-+		else {
-+			/* Unset the PSK credential to omit the extension */
-+			gnutls_credentials_set(session, GNUTLS_CRD_PSK, NULL);
-+		}
-+	}
-+
-+	return 0;
-+}
-+
-+void doit(void)
-+{
-+	int sret, cret;
-+	gnutls_psk_server_credentials_t scred;
-+	gnutls_psk_client_credentials_t ccred;
-+	gnutls_certificate_credentials_t ccred2;
-+	gnutls_session_t server, client;
-+	/* Need to enable anonymous KX specifically. */
-+	const gnutls_datum_t key = { (void *)"DEADBEEF", 8 };
-+
-+	struct ctx_st ctx;
-+	memset(&ctx, 0, sizeof(ctx));
-+
-+	global_init();
-+
-+	gnutls_global_set_log_function(tls_log_func);
-+	if (debug)
-+		gnutls_global_set_log_level(9);
-+
-+	/* Init server */
-+	assert(gnutls_psk_allocate_server_credentials(&scred) >= 0);
-+	gnutls_psk_set_server_credentials_function(scred, pskfunc);
-+
-+	gnutls_init(&server, GNUTLS_SERVER);
-+
-+	assert(gnutls_priority_set_direct(
-+		       server,
-+		       "NORMAL:-VERS-ALL:+VERS-TLS1.3:-GROUP-ALL:+GROUP-X25519:+DHE-PSK",
-+		       NULL) >= 0);
-+
-+	gnutls_credentials_set(server, GNUTLS_CRD_PSK, scred);
-+	gnutls_transport_set_push_function(server, server_push);
-+	gnutls_transport_set_pull_function(server, server_pull);
-+	gnutls_transport_set_ptr(server, server);
-+
-+	/* Init client */
-+	assert(gnutls_psk_allocate_client_credentials(&ccred) >= 0);
-+	gnutls_psk_set_client_credentials(ccred, "test", &key,
-+					  GNUTLS_PSK_KEY_HEX);
-+	assert(gnutls_certificate_allocate_credentials(&ccred2) >= 0);
-+
-+	assert(gnutls_init(&client, GNUTLS_CLIENT | GNUTLS_KEY_SHARE_TOP) >= 0);
-+
-+	gnutls_session_set_ptr(client, &ctx);
-+
-+	cret = gnutls_priority_set_direct(
-+		client,
-+		"NORMAL:-VERS-ALL:+VERS-TLS1.3:-GROUP-ALL:+GROUP-SECP256R1:+GROUP-X25519:+DHE-PSK",
-+		NULL);
-+	if (cret < 0)
-+		myfail("cannot set TLS 1.3 priorities\n");
-+
-+	gnutls_credentials_set(client, GNUTLS_CRD_PSK, ccred);
-+	gnutls_credentials_set(client, GNUTLS_CRD_CERTIFICATE, ccred2);
-+	gnutls_transport_set_push_function(client, client_push);
-+	gnutls_transport_set_pull_function(client, client_pull);
-+	gnutls_transport_set_ptr(client, client);
-+
-+	gnutls_handshake_set_hook_function(client, GNUTLS_HANDSHAKE_ANY,
-+					   GNUTLS_HOOK_BOTH, hello_callback);
-+
-+	HANDSHAKE_EXPECT(client, server, GNUTLS_E_AGAIN,
-+			 GNUTLS_E_INSUFFICIENT_CREDENTIALS);
-+
-+	assert(ctx.hrr_seen != 0);
-+
-+	gnutls_bye(client, GNUTLS_SHUT_WR);
-+	gnutls_bye(server, GNUTLS_SHUT_WR);
-+
-+	gnutls_deinit(client);
-+	gnutls_deinit(server);
-+
-+	gnutls_psk_free_server_credentials(scred);
-+	gnutls_psk_free_client_credentials(ccred);
-+	gnutls_certificate_free_credentials(ccred2);
-+
-+	gnutls_global_deinit();
-+	reset_buffers();
-+}
-- 
-2.50.1
-
--- a/gnutls-3.8.9-limit-shuffle-extensions.patch
+++ b/gnutls-3.8.9-limit-shuffle-extensions.patch
@ -1,213 +0,0 @@
-From dc5ee80c3a28577e9de0f82fb08164e4c02b96af Mon Sep 17 00:00:00 2001
-From: Daiki Ueno <ueno@gnu.org>
-Date: Sun, 9 Feb 2025 10:31:20 +0900
-Subject: [PATCH] handshake: only shuffle extensions in the first Client Hello
-
-RFC 8446 section 4.1.2 states that the second Client Hello after HRR
-should preserve the same content as the first Client Hello with
-limited exceptions.  Since GnuTLS 3.8.5, however, the library started
-shuffling the order of extensions for privacy reasons and that didn't
-comply with the RFC, leading to a connectivity issue against the
-server configuration with a stricter check on that.
-
-Signed-off-by: Daiki Ueno <ueno@gnu.org>
---
- lib/gnutls_int.h                  |  4 +++
- lib/hello_ext.c                   | 41 ++++++++++++++++---------
- lib/state.c                       |  2 ++
- tests/tls13/hello_retry_request.c | 51 ++++++++++++++++++++++++++++---
- 4 files changed, 79 insertions(+), 19 deletions(-)
-
-diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h
-index d10a028b59..572de5aba3 100644
--- a/lib/gnutls_int.h
-+++ b/lib/gnutls_int.h
-@@ -1666,6 +1666,10 @@ typedef struct {
- 	/* Compression method for certificate compression */
- 	gnutls_compression_method_t compress_certificate_method;
- 
-+	/* To shuffle extension sending order */
-+	extensions_t client_hello_exts[MAX_EXT_TYPES];
-+	bool client_hello_exts_set;
-+
- 	/* If you add anything here, check _gnutls_handshake_internal_state_clear().
- 	 */
- } internals_st;
-diff --git a/lib/hello_ext.c b/lib/hello_ext.c
-index 40af8c2b10..d677addd75 100644
--- a/lib/hello_ext.c
-+++ b/lib/hello_ext.c
-@@ -438,8 +438,6 @@ int _gnutls_gen_hello_extensions(gnutls_session_t session,
- 	int pos, ret;
- 	size_t i;
- 	hello_ext_ctx_st ctx;
-	/* To shuffle extension sending order */
-	extensions_t indices[MAX_EXT_TYPES];
- 
- 	msg &= GNUTLS_EXT_FLAG_SET_ONLY_FLAGS_MASK;
- 
-@@ -469,26 +467,39 @@ int _gnutls_gen_hello_extensions(gnutls_session_t session,
- 				ret - 4);
- 	}
- 
-	/* Initializing extensions array */
-	for (i = 0; i < MAX_EXT_TYPES; i++) {
-		indices[i] = i;
-	}
-+	if (msg & GNUTLS_EXT_FLAG_CLIENT_HELLO &&
-+	    !session->internals.client_hello_exts_set) {
-+		/* Initializing extensions array */
-+		for (i = 0; i < MAX_EXT_TYPES; i++) {
-+			session->internals.client_hello_exts[i] = i;
-+		}
- 
-	if (!session->internals.priorities->no_shuffle_extensions) {
-		/* Ordering padding and pre_shared_key as last extensions */
-		swap_exts(indices, MAX_EXT_TYPES - 2, GNUTLS_EXTENSION_DUMBFW);
-		swap_exts(indices, MAX_EXT_TYPES - 1,
-			  GNUTLS_EXTENSION_PRE_SHARED_KEY);
-+		if (!session->internals.priorities->no_shuffle_extensions) {
-+			/* Ordering padding and pre_shared_key as last extensions */
-+			swap_exts(session->internals.client_hello_exts,
-+				  MAX_EXT_TYPES - 2, GNUTLS_EXTENSION_DUMBFW);
-+			swap_exts(session->internals.client_hello_exts,
-+				  MAX_EXT_TYPES - 1,
-+				  GNUTLS_EXTENSION_PRE_SHARED_KEY);
- 
-		ret = shuffle_exts(indices, MAX_EXT_TYPES - 2);
-		if (ret < 0)
-			return gnutls_assert_val(ret);
-+			ret = shuffle_exts(session->internals.client_hello_exts,
-+					   MAX_EXT_TYPES - 2);
-+			if (ret < 0)
-+				return gnutls_assert_val(ret);
-+		}
-+		session->internals.client_hello_exts_set = true;
- 	}
- 
- 	/* hello_ext_send() ensures we don't send duplicates, in case
- 	 * of overridden extensions */
- 	for (i = 0; i < MAX_EXT_TYPES; i++) {
-		size_t ii = indices[i];
-+		size_t ii;
-+
-+		if (msg & GNUTLS_EXT_FLAG_CLIENT_HELLO)
-+			ii = session->internals.client_hello_exts[i];
-+		else
-+			ii = i;
-+
- 		if (!extfunc[ii])
- 			continue;
- 
-diff --git a/lib/state.c b/lib/state.c
-index 9d3ece7570..43e961cfa2 100644
--- a/lib/state.c
-+++ b/lib/state.c
-@@ -516,6 +516,8 @@ static void handshake_internal_state_clear1(gnutls_session_t session)
- 
- 	session->internals.hrr_cs[0] = CS_INVALID_MAJOR;
- 	session->internals.hrr_cs[1] = CS_INVALID_MINOR;
-+
-+	session->internals.client_hello_exts_set = false;
- }
- 
- /* This function will clear all the variables in internals
-diff --git a/tests/tls13/hello_retry_request.c b/tests/tls13/hello_retry_request.c
-index f407b64234..6c5f698f01 100644
--- a/tests/tls13/hello_retry_request.c
-+++ b/tests/tls13/hello_retry_request.c
-@@ -51,14 +51,37 @@ static void tls_log_func(int level, const char *str)
- }
- 
- #define HANDSHAKE_SESSION_ID_POS 34
-+#define MAX_EXT_TYPES 64
- 
- struct ctx_st {
- 	unsigned hrr_seen;
- 	unsigned hello_counter;
- 	uint8_t session_id[32];
- 	size_t session_id_len;
-+	unsigned extensions[MAX_EXT_TYPES];
-+	size_t extensions_size1;
-+	size_t extensions_size2;
- };
- 
-+static int ext_callback(void *_ctx, unsigned tls_id, const unsigned char *data,
-+			unsigned size)
-+{
-+	struct ctx_st *ctx = _ctx;
-+	if (ctx->hello_counter == 0) {
-+		assert(ctx->extensions_size1 < MAX_EXT_TYPES);
-+		ctx->extensions[ctx->extensions_size1++] = tls_id;
-+	} else {
-+		assert(ctx->extensions_size2 < MAX_EXT_TYPES);
-+		if (tls_id != ctx->extensions[ctx->extensions_size2]) {
-+			fail("extension doesn't match at position %zu, %u != %u\n",
-+			     ctx->extensions_size2, tls_id,
-+			     ctx->extensions[ctx->extensions_size2]);
-+		}
-+		ctx->extensions_size2++;
-+	}
-+	return 0;
-+}
-+
- static int hello_callback(gnutls_session_t session, unsigned int htype,
- 			  unsigned post, unsigned int incoming,
- 			  const gnutls_datum_t *msg)
-@@ -73,15 +96,25 @@ static int hello_callback(gnutls_session_t session, unsigned int htype,
- 	    post == GNUTLS_HOOK_POST) {
- 		size_t session_id_len;
- 		uint8_t *session_id;
-+		unsigned pos = HANDSHAKE_SESSION_ID_POS;
-+		gnutls_datum_t mmsg;
-+		int ret;
- 
-		assert(msg->size > HANDSHAKE_SESSION_ID_POS + 1);
-		session_id_len = msg->data[HANDSHAKE_SESSION_ID_POS];
-		session_id = &msg->data[HANDSHAKE_SESSION_ID_POS + 1];
-+		assert(msg->size > pos + 1);
-+		session_id_len = msg->data[pos];
-+		session_id = &msg->data[pos + 1];
-+
-+		SKIP8(pos, msg->size);
-+		SKIP16(pos, msg->size);
-+		SKIP8(pos, msg->size);
-+
-+		mmsg.data = &msg->data[pos];
-+		mmsg.size = msg->size - pos;
- 
- 		if (ctx->hello_counter > 0) {
- 			assert(msg->size > 4);
- 			if (msg->data[0] != 0x03 || msg->data[1] != 0x03) {
-				fail("version is %d.%d expected 3,3\n",
-+				fail("version is %d.%d expected 3.3\n",
- 				     (int)msg->data[0], (int)msg->data[1]);
- 			}
- 
-@@ -95,6 +128,12 @@ static int hello_callback(gnutls_session_t session, unsigned int htype,
- 		ctx->session_id_len = session_id_len;
- 		memcpy(ctx->session_id, session_id, session_id_len);
- 
-+		ret = gnutls_ext_raw_parse(ctx, ext_callback, &mmsg, 0);
-+		if (ret < 0) {
-+			fail("unable to parse extensions: %s\n",
-+			     gnutls_strerror(ret));
-+		}
-+
- 		ctx->hello_counter++;
- 	}
- 
-@@ -164,6 +203,10 @@ void doit(void)
- 		myfail("group doesn't match the expected: %s\n",
- 		       gnutls_group_get_name(gnutls_group_get(server)));
- 
-+	if (ctx.extensions_size1 != ctx.extensions_size2)
-+		myfail("the number of extensions don't match in second Client Hello: %zu != %zu\n",
-+		       ctx.extensions_size1, ctx.extensions_size2);
-+
- 	gnutls_bye(client, GNUTLS_SHUT_WR);
- 	gnutls_bye(server, GNUTLS_SHUT_WR);
- 
-- 
-2.48.1
-
--- a/gnutls.spec
+++ b/gnutls.spec
@ -2,7 +2,7 @@
 ## (rpmautospec version 0.6.5)
 ## RPMAUTOSPEC: autorelease, autochangelog
 %define autorelease(e:s:pb:n) %{?-p:0.}%{lua:
-    release_number = 14;
+    release_number = 2;
    base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}"));
    print(release_number + base_release_number - 1);
 }%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}}
@ -22,8 +22,8 @@ sha256sum:close()
 print(string.sub(hash, 0, 16))
 }

-Version: 3.8.9
-Release: 9%{?dist}.%{autorelease -n}
+Version: 3.8.10
+Release: %{?autorelease}%{!?autorelease:1%{?dist}}
 # not upstreamed: can we drop this as configure is regenerated when bootstrapping?
 Patch: gnutls-3.2.7-rpath.patch
 # not upstreamed: modifies the generated code
@ -34,21 +34,15 @@ Patch: gnutls-3.7.2-no-explicit-init.patch
 Patch: gnutls-3.7.3-disable-config-reload.patch
 # not upstreamed, reseed source DRBG for prediction resistance
 Patch: gnutls-3.7.6-drbg-reseed.patch
-# not upstreamed, hard blocking SHA-1 signature verification, for long-term support purposes
-Patch: gnutls-3.7.6-fips-sha1-sigver.patch
 # not upstreamed: see https://gitlab.com/gnutls/gnutls/-/issues/1443
 Patch: gnutls-3.8.8-tests-ktls-skip-tls12-chachapoly.patch
 # not upstreamed: https://gitlab.com/gnutls/gnutls/-/merge_requests/1932
 Patch: gnutls-3.8.9-allow-rsa-pkcs1-encrypt.patch
-# upstreamed: https://gitlab.com/gnutls/gnutls/-/merge_requests/1930
-Patch: gnutls-3.8.9-limit-shuffle-extensions.patch
-# upstreamed: https://gitlab.com/gnutls/gnutls/-/merge_requests/1936
-Patch: gnutls-3.8.9-cli-earlydata.patch
-Patch: gnutls-3.8.9-cve-2025-6395.patch
-Patch: gnutls-3.8.9-cve-2025-32988.patch
-Patch: gnutls-3.8.9-cve-2025-32989.patch
-Patch: gnutls-3.8.9-cve-2025-32990.patch
-# upstreamed: https://gitlab.com/gnutls/gnutls/-/merge_requests/1990
+# usptreamed: https://gitlab.com/gnutls/gnutls/-/merge_requests/1980
+Patch: gnutls-3.8.10-tests-ktls.patch
+# upstreamed: https://gitlab.com/gnutls/gnutls/-/merge_requests/1980
+Patch: gnutls-3.8.10-tests-mldsa.patch
+# not yet upstreamed: https://gitlab.com/gnutls/gnutls/-/merge_requests/1990/diffs?commit_id=993a8055c03b60c95fc65962ed82adc80b049a9a
 Patch: gnutls-3.8.10-keyupdate.patch

 %bcond_without bootstrap
@ -186,8 +180,7 @@ Source204:	nettle-3.10-hobble-to-configure.patch
 %endif

 %if %{with leancrypto}
-Source300:	leancrypto-1.2.0.tar.gz
-Source301:	leancrypto-1.2.0-intel-cet.patch
+Source300:	leancrypto-1.5.0.tar.gz
 %endif

 # Wildcard bundling exception https://fedorahosted.org/fpc/ticket/174
@ -338,7 +331,6 @@ popd
 mkdir -p bundled_leancrypto
 pushd bundled_leancrypto
 tar --strip-components=1 -xf %{SOURCE300}
-patch -p1 < %{SOURCE301}
 popd
 %endif

@ -597,22 +589,7 @@ rm -f $RPM_BUILD_ROOT%{mingw64_libdir}/ncrypt.dll*
 %check
 %if %{with tests}
 pushd native_build
-
-# KeyUpdate is not yet supported in the kernel.
-xfail_tests=ktls_keyupdate.sh
-
-# The ktls.sh test currently only supports kernel 5.11+.  This needs to
-# be checked at run time, as the koji builder might be using a different
-# version of kernel on the host than the one indicated by the
-# kernel-devel package.
-
-case "$(uname -r)" in
-  4.* | 5.[0-9].* | 5.10.* )
-    xfail_tests="$xfail_tests ktls.sh"
-    ;;
-esac
-
-make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null XFAIL_TESTS="$xfail_tests"
+make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null || { cat tests/test-suite.log tests/cert-tests/test-suite.log tests/slow/test-suite.log src/gl/tests/test-suite.log; exit 1; }
 popd
 %endif

@ -704,15 +681,36 @@ popd

 %changelog
 ## START: Generated by rpmautospec
-* Wed Aug 13 2025 Daiki Ueno <dueno@redhat.com> - 3.8.9-14
+* Fri Aug 01 2025 Daiki Ueno <dueno@redhat.com> - 3.8.10-2
 - key_update: rework the rekeying logic

-* Wed Aug 13 2025 Daiki Ueno <dueno@redhat.com> - 3.8.9-13
- Fix CVE-2025-6395, CVE-2025-32988, CVE-2025-32989, CVE-2025-32990
+* Thu Jul 10 2025 Daiki Ueno <dueno@redhat.com> - 3.8.10-1
+- Update to 3.8.10 upstream release

-* Wed Aug 13 2025 Daiki Ueno <dueno@redhat.com> - 3.8.9-12
+* Fri Jul 04 2025 Daiki Ueno <dueno@redhat.com> - 3.8.9-19
+- algorithms: assign hash strength to ML-DSA signature algorithms
+
+* Wed Jun 25 2025 Daiki Ueno <dueno@redhat.com> - 3.8.9-18
+- nettle/pk: mark ML-DSA as FIPS-unapproved
+
+* Thu Jun 19 2025 Daiki Ueno <dueno@redhat.com> - 3.8.9-17
+- Enable ML-DSA at TLS 1.3 level
+
+* Thu May 08 2025 Alexander Sosedkin <asosedkin@redhat.com> - 3.8.9-16
+- Preserve ARM registers, reenable ARM assembly
+
+* Wed May 07 2025 Alexander Sosedkin <asosedkin@redhat.com> - 3.8.9-15
+- Disable assembly on aarch64 as a stopgap measure
+
+* Thu Apr 24 2025 Daiki Ueno <dueno@redhat.com> - 3.8.9-14
+- tests: make pqc-hybrid-kx.sh work when system time set beyond 2038
+
+* Tue Apr 22 2025 Daiki Ueno <dueno@redhat.com> - 3.8.9-13
 - Update gnutls-3.8.9-cli-earlydata.patch to the upstream version

+* Mon Apr 14 2025 Daiki Ueno <dueno@redhat.com> - 3.8.9-12
+- Update leancrypto to 1.3.0
+
 * Mon Feb 17 2025 Daiki Ueno <dueno@redhat.com> - 3.8.9-11
 - Improve 0-RTT handling in commands

--- a/leancrypto-1.2.0-intel-cet.patch
+++ b/leancrypto-1.2.0-intel-cet.patch
@ -1,782 +0,0 @@
-From ef682559d1acb92b897412647d4468486aa4f0fc Mon Sep 17 00:00:00 2001
-From: Stephan Mueller <smueller@chronox.de>
-Date: Wed, 12 Feb 2025 09:21:24 +0100
-Subject: [PATCH 1/2] Intel x86 asm: Add endbr[64|32] to all symbols
-
-Suggested-by: Daiki Ueno <dueno@redhat.com>
-Signed-off-by: Stephan Mueller <smueller@chronox.de>
---
- CHANGES.md                       |  2 ++
- internal/api/assembler_support.h | 11 ++++++++++-
- 2 files changed, 12 insertions(+), 1 deletion(-)
-
-diff --git a/internal/api/assembler_support.h b/internal/api/assembler_support.h
-index f90fa4ba..54f33f6f 100644
--- a/internal/api/assembler_support.h
-+++ b/internal/api/assembler_support.h
-@@ -20,6 +20,14 @@
- #ifndef ASSEMBLER_SUPPORT_H
- #define ASSEMBLER_SUPPORT_H
- 
-+#ifdef __x86_64__
-+#define LC_ENDBR "endbr64"
-+#elif defined(__i386__)
-+#define LC_ENDBR "endbr32"
-+#else
-+#define LC_ENDBR
-+#endif
-+
- #ifdef LINUX_KERNEL
- 
- #include <linux/linkage.h>
-@@ -121,7 +129,8 @@
- #  define SYM_FUNC_START(name)						       \
- 	.hidden SYM_FUNC(name) ;					       \
- 	.global SYM_FUNC(name) ;					       \
-	SYM_FUNC(name):
-+	SYM_FUNC(name):							       \
-+	LC_ENDBR
- 
- #  define SYM_FUNC_ENTER(name)
- 
-- 
-2.48.1
-
-
-From 07cbd3c7f28901f26604b3e8803b99d8ec755fdb Mon Sep 17 00:00:00 2001
-From: Stephan Mueller <smueller@chronox.de>
-Date: Wed, 12 Feb 2025 09:50:31 +0100
-Subject: [PATCH 2/2] Fix gcc build error
-
-Clang can handle instructions enclosed with quotation marks, GCC
-cannot...
-
-Signed-off-by: Stephan Mueller <smueller@chronox.de>
---
- internal/api/assembler_support.h | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/internal/api/assembler_support.h b/internal/api/assembler_support.h
-index 54f33f6f..de333805 100644
--- a/internal/api/assembler_support.h
-+++ b/internal/api/assembler_support.h
-@@ -21,9 +21,9 @@
- #define ASSEMBLER_SUPPORT_H
- 
- #ifdef __x86_64__
-#define LC_ENDBR "endbr64"
-+#define LC_ENDBR endbr64
- #elif defined(__i386__)
-#define LC_ENDBR "endbr32"
-+#define LC_ENDBR endbr32
- #else
- #define LC_ENDBR
- #endif
-- 
-2.48.1
-
-From ef49175f0c2f89df027ca9a40075e290ba77d850 Mon Sep 17 00:00:00 2001
-From: Stephan Mueller <smueller@chronox.de>
-Date: Thu, 6 Feb 2025 08:39:07 +0100
-Subject: [PATCH] prevent compiler warnings
-
-Signed-off-by: Stephan Mueller <smueller@chronox.de>
---
- hash/src/asm/ARMv8_2x/keccakx2_armce.S | 9 ++++++---
- 1 file changed, 6 insertions(+), 3 deletions(-)
-
-diff --git a/hash/src/asm/ARMv8_2x/keccakx2_armce.S b/hash/src/asm/ARMv8_2x/keccakx2_armce.S
-index 7d4772e5..0cf8fddb 100644
--- a/hash/src/asm/ARMv8_2x/keccakx2_armce.S
-+++ b/hash/src/asm/ARMv8_2x/keccakx2_armce.S
-@@ -45,8 +45,12 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- SOFTWARE.
- */
- 
-#pragma GCC diagnostic push
-#pragma GCC diagnostic ignored "-Wundef"
-+#ifndef __APPLE__
-+#define __APPLE__ 0
-+#endif
-+#ifndef __ARM_FEATURE_SHA3
-+#define __ARM_FEATURE_SHA3 0
-+#endif
- #if (__APPLE__ && __ARM_FEATURE_CRYPTO) || (__ARM_FEATURE_SHA3)
- 
- #include "assembler_support.h"
-@@ -191,4 +195,3 @@ loop:
- SYM_FUNC_END(keccak_f1600x2_armce)
- 
- #endif
-#pragma GCC diagnostic pop
-- 
-2.48.1
-
-From 038e226c8a4b024f2feda157989952843292c21c Mon Sep 17 00:00:00 2001
-From: Daiki Ueno <dueno@redhat.com>
-Date: Thu, 13 Feb 2025 08:43:35 +0900
-Subject: [PATCH] x86: embed .note.gnu.property for Intel CET in assembly files
-
-Instead of generating the note section with a linker option, this
-embeds it in each .S file through a preprocessor macro. The main
-motivation behind this is to simplify the build process when a shared
-library is statically linking to leancrypto. As a bonus, this
-mechanism could be used to support PACBTI on AArch64 in a future
-extension.
-
-Signed-off-by: Daiki Ueno <dueno@redhat.com>
---
- curve25519/src/armv7/x25519-cortex-m4-gcc.S   |  2 ++
- curve25519/src/armv8/X25519-AArch64.S         |  2 ++
- curve25519/src/avx/curve25519_avx_asm.S       |  2 ++
- hash/src/asm/ARMv8A/KeccakP-1600-armv8a-ce.S  |  2 ++
- .../src/asm/ARMv8A/KeccakP-1600-armv8a-neon.S |  4 +++
- hash/src/asm/ARMv8A/sha2-256-ARMv8.S          |  2 ++
- hash/src/asm/ARMv8A/sha2-512-ARMv8.S          |  2 ++
- hash/src/asm/ARMv8_2x/keccakx2_armce.S        |  2 ++
- hash/src/asm/AVX2/KeccakP-1600-AVX2.S         |  2 ++
- hash/src/asm/AVX2/sha2-256-AVX2.S             |  2 ++
- hash/src/asm/AVX2/sha2-512-AVX2.S             |  2 ++
- hash/src/asm/AVX512/KeccakP-1600-AVX512.S     |  2 ++
- hash/src/asm/riscv32/keccakf1600_asm.S        |  2 ++
- hash/src/asm/riscv64/fips202_rv64im.S         |  2 ++
- hash/src/asm/riscv64/fips202_rv64imb.S        |  2 ++
- hash/src/asm/riscv64/sha2-256-riscv.S         |  2 ++
- hash/src/asm/riscv64/sha2-512-riscv.S         |  2 ++
- internal/api/assembler_support.h              | 33 +++++++++++++++++++
- meson.build                                   |  6 ----
- ml-dsa/src/armv7/dilithium_ntt_armv7.S        |  2 ++
- .../armv7/dilithium_pointwise_smull_armv7.S   |  2 ++
- ml-dsa/src/armv7/dilithium_poly_armv7.S       |  2 ++
- ml-dsa/src/armv8/dilithium_intt_armv8.S       |  2 ++
- ml-dsa/src/armv8/dilithium_ntt_armv8.S        |  2 ++
- ml-dsa/src/armv8/dilithium_poly_armv8.S       |  2 ++
- ml-dsa/src/avx2/dilithium_invntt_avx2.S       |  2 ++
- ml-dsa/src/avx2/dilithium_ntt_avx2.S          |  2 ++
- ml-dsa/src/avx2/dilithium_pointwise_avx2.S    |  2 ++
- ml-dsa/src/avx2/dilithium_shuffle_avx2.S      |  2 ++
- .../riscv64/ntt_8l_dualissue_plant_rv64im.S   |  2 ++
- ml-dsa/src/riscv64/ntt_rvv.S                  |  2 ++
- ml-kem/src/armv7/kyber_fastinvntt_armv7.S     |  2 ++
- ml-kem/src/armv7/kyber_fastntt_armv7.S        |  2 ++
- ml-kem/src/armv7/kyber_poly_armv7.S           |  2 ++
- ml-kem/src/armv8/kyber_add_armv8.S            |  2 ++
- ml-kem/src/armv8/kyber_basemul_armv8.S        |  2 ++
- ml-kem/src/armv8/kyber_cbd_armv8.S            |  2 ++
- ml-kem/src/armv8/kyber_inv_ntt_armv8.S        |  2 ++
- ml-kem/src/armv8/kyber_ntt_armv8_asm.S        |  2 ++
- ml-kem/src/armv8/kyber_poly_armv8_asm.S       |  2 ++
- ml-kem/src/armv8/kyber_reduce_armv8.S         |  2 ++
- ml-kem/src/avx2/kyber_basemul_avx2.S          |  2 ++
- ml-kem/src/avx2/kyber_fq_avx2.S               |  2 ++
- ml-kem/src/avx2/kyber_invntt_avx2.S           |  2 ++
- ml-kem/src/avx2/kyber_ntt_avx2.S              |  2 ++
- ml-kem/src/avx2/kyber_shuffle_avx2.S          |  2 ++
- .../src/riscv64/ntt_dualissue_plant_rv64im.S  |  2 ++
- ml-kem/src/riscv64/ntt_rvv_vlen128.S          |  2 ++
- ml-kem/src/riscv64/ntt_rvv_vlen256.S          |  2 ++
- ml-kem/src/riscv64/riscv_rvv_selector_test.S  |  2 ++
- sym/src/asm/AESNI_x86_64/aes_aesni_x86_64.S   |  2 ++
- sym/src/asm/ARMv8/aes_armv8_ce.S              |  2 ++
- sym/src/asm/riscv64/riscv64_aes_asm.S         |  2 ++
- sym/src/asm/riscv64/riscv64_aes_zkn_asm.S     |  2 ++
- 54 files changed, 139 insertions(+), 6 deletions(-)
-
-diff --git a/curve25519/src/armv7/x25519-cortex-m4-gcc.S b/curve25519/src/armv7/x25519-cortex-m4-gcc.S
-index 9151c401..c19cff26 100644
--- a/curve25519/src/armv7/x25519-cortex-m4-gcc.S
-+++ b/curve25519/src/armv7/x25519-cortex-m4-gcc.S
-@@ -1040,3 +1040,5 @@ SYM_FUNC_ENTER(crypto_scalarmult_curve25519_armv7)
- 	// in total for whole function 548 873 cycles
- 
- SYM_FUNC_END(crypto_scalarmult_curve25519_armv7)
-+
-+ASM_END
-diff --git a/curve25519/src/armv8/X25519-AArch64.S b/curve25519/src/armv8/X25519-AArch64.S
-index a04cce4d..2d8e9985 100644
--- a/curve25519/src/armv8/X25519-AArch64.S
-+++ b/curve25519/src/armv8/X25519-AArch64.S
-@@ -1641,3 +1641,5 @@ invtable:
- 	.hword	 50|       (2<<9)
- 	.hword	  5|       (1<<9)
- 	.hword	  0|       (0<<9)
-+
-+ASM_END
-diff --git a/curve25519/src/avx/curve25519_avx_asm.S b/curve25519/src/avx/curve25519_avx_asm.S
-index e6c79b64..be16ca3c 100644
--- a/curve25519/src/avx/curve25519_avx_asm.S
-+++ b/curve25519/src/avx/curve25519_avx_asm.S
-@@ -37,3 +37,5 @@
- #if defined(__linux__) && defined(__ELF__)
- .section .note.GNU-stack,"",%progbits
- #endif
-+
-+ASM_END
-diff --git a/hash/src/asm/ARMv8A/KeccakP-1600-armv8a-ce.S b/hash/src/asm/ARMv8A/KeccakP-1600-armv8a-ce.S
-index 21299298..98e74d85 100644
--- a/hash/src/asm/ARMv8A/KeccakP-1600-armv8a-ce.S
-+++ b/hash/src/asm/ARMv8A/KeccakP-1600-armv8a-ce.S
-@@ -1039,3 +1039,5 @@ SYM_FUNC_ENTER(lc_keccak_squeeze_arm_ce)
- SYM_FUNC_END(lc_keccak_squeeze_arm_ce)
- .byte	75,101,99,99,97,107,45,49,54,48,48,32,97,98,115,111,114,98,32,97,110,100,32,115,113,117,101,101,122,101,32,102,111,114,32,65,82,77,118,56,44,32,67,82,89,80,84,79,71,65,77,83,32,98,121,32,60,97,112,112,114,111,64,111,112,101,110,115,115,108,46,111,114,103,62,0
- .align	2
-+
-+ASM_END
-diff --git a/hash/src/asm/ARMv8A/KeccakP-1600-armv8a-neon.S b/hash/src/asm/ARMv8A/KeccakP-1600-armv8a-neon.S
-index fa9aff40..5cb2de6d 100644
--- a/hash/src/asm/ARMv8A/KeccakP-1600-armv8a-neon.S
-+++ b/hash/src/asm/ARMv8A/KeccakP-1600-armv8a-neon.S
-@@ -31,6 +31,8 @@
- // This implementation comes with KeccakP-1600-SnP.h in the same folder.
- // Please refer to LowLevel.build for the exact list of other files it must be combined with.
- 
-+#include "assembler_support.h"
-+
- // INFO: Tested on Cortex-A53(odroid-c2), using gcc.
- // WARNING: These functions work only on little endian CPU with ARMv8a + NEON architecture
- // WARNING: State must be 512 bit (64 bytes) aligned.
-@@ -560,3 +562,5 @@ KeccakP1600_Permute_RoundLoop:
- KeccakP1600_Permute_Exit:
-     StoreState
-     ret
-+
-+ASM_END
-diff --git a/hash/src/asm/ARMv8A/sha2-256-ARMv8.S b/hash/src/asm/ARMv8A/sha2-256-ARMv8.S
-index ada570b0..1b9b23e1 100644
--- a/hash/src/asm/ARMv8A/sha2-256-ARMv8.S
-+++ b/hash/src/asm/ARMv8A/sha2-256-ARMv8.S
-@@ -2016,3 +2016,5 @@ SYM_FUNC_ENTER(sha256_block_neon)
- 	add	sp,sp,#16*4+2*__SIZEOF_POINTER__
- 	RET
- SYM_FUNC_END(sha256_block_neon)
-+
-+ASM_END
-diff --git a/hash/src/asm/ARMv8A/sha2-512-ARMv8.S b/hash/src/asm/ARMv8A/sha2-512-ARMv8.S
-index 88372b41..5990ad76 100644
--- a/hash/src/asm/ARMv8A/sha2-512-ARMv8.S
-+++ b/hash/src/asm/ARMv8A/sha2-512-ARMv8.S
-@@ -1565,3 +1565,5 @@ SYM_FUNC_ENTER(sha512_block_armv8ce)
- 	RET
- SYM_FUNC_END(sha512_block_armv8ce)
- 
-+
-+ASM_END
-diff --git a/hash/src/asm/ARMv8_2x/keccakx2_armce.S b/hash/src/asm/ARMv8_2x/keccakx2_armce.S
-index 0cf8fddb..04c44c29 100644
--- a/hash/src/asm/ARMv8_2x/keccakx2_armce.S
-+++ b/hash/src/asm/ARMv8_2x/keccakx2_armce.S
-@@ -194,4 +194,6 @@ loop:
- 
- SYM_FUNC_END(keccak_f1600x2_armce)
- 
-+ASM_END
-+
- #endif
-diff --git a/hash/src/asm/AVX2/KeccakP-1600-AVX2.S b/hash/src/asm/AVX2/KeccakP-1600-AVX2.S
-index f59cd1b5..26f965df 100644
--- a/hash/src/asm/AVX2/KeccakP-1600-AVX2.S
-+++ b/hash/src/asm/AVX2/KeccakP-1600-AVX2.S
-@@ -1032,3 +1032,5 @@ mask6_17:
-     .quad    ALLON, ALLON,     0,     0
- 
- .asciz  "Keccak-1600 for AVX2, CRYPTOGAMS by <appro@openssl.org>"
-+
-+ASM_END
-diff --git a/hash/src/asm/AVX2/sha2-256-AVX2.S b/hash/src/asm/AVX2/sha2-256-AVX2.S
-index e79b733f..e0b77dcc 100644
--- a/hash/src/asm/AVX2/sha2-256-AVX2.S
-+++ b/hash/src/asm/AVX2/sha2-256-AVX2.S
-@@ -5495,3 +5495,5 @@ K256:
- .long	0x03020100,0x0b0a0908,0xffffffff,0xffffffff
- .long	0xffffffff,0xffffffff,0x03020100,0x0b0a0908
- .long	0xffffffff,0xffffffff,0x03020100,0x0b0a0908
-+
-+ASM_END
-diff --git a/hash/src/asm/AVX2/sha2-512-AVX2.S b/hash/src/asm/AVX2/sha2-512-AVX2.S
-index d4a9d931..52c77715 100644
--- a/hash/src/asm/AVX2/sha2-512-AVX2.S
-+++ b/hash/src/asm/AVX2/sha2-512-AVX2.S
-@@ -5760,3 +5760,5 @@ K512_nodup:
- .quad	0x3c9ebe0a15c9bebc,0x431d67c49c100d4c
- .quad	0x4cc5d4becb3e42b6,0x597f299cfc657e2a
- .quad	0x5fcb6fab3ad6faec,0x6c44198c4a475817
-+
-+ASM_END
-diff --git a/hash/src/asm/AVX512/KeccakP-1600-AVX512.S b/hash/src/asm/AVX512/KeccakP-1600-AVX512.S
-index 70e8e4f7..83cc26a3 100644
--- a/hash/src/asm/AVX512/KeccakP-1600-AVX512.S
-+++ b/hash/src/asm/AVX512/KeccakP-1600-AVX512.S
-@@ -971,3 +971,5 @@ iotas:
-     .quad    0x8000000080008008
- iotas_end:
- .asciz    "Keccak-1600 for AVX-512F, CRYPTOGAMS by <appro@openssl.org>"
-+
-+ASM_END
-diff --git a/hash/src/asm/riscv32/keccakf1600_asm.S b/hash/src/asm/riscv32/keccakf1600_asm.S
-index 2a1c7df6..1dc9b0d3 100644
--- a/hash/src/asm/riscv32/keccakf1600_asm.S
-+++ b/hash/src/asm/riscv32/keccakf1600_asm.S
-@@ -540,3 +540,5 @@ SYM_FUNC_START(lc_keccakf1600_riscv)
- 
-     RET
- SYM_FUNC_END(lc_keccakf1600_riscv)
-+
-+ASM_END
-diff --git a/hash/src/asm/riscv64/fips202_rv64im.S b/hash/src/asm/riscv64/fips202_rv64im.S
-index 8a01dcc9..13c434c2 100644
--- a/hash/src/asm/riscv64/fips202_rv64im.S
-+++ b/hash/src/asm/riscv64/fips202_rv64im.S
-@@ -451,3 +451,5 @@ loop:
-     addi sp, sp, 8*19
-     RET
- SYM_FUNC_END(KeccakF1600_StatePermute_RV64ASM)
-+
-+ASM_END
-diff --git a/hash/src/asm/riscv64/fips202_rv64imb.S b/hash/src/asm/riscv64/fips202_rv64imb.S
-index e17e474c..b5a87ea1 100644
--- a/hash/src/asm/riscv64/fips202_rv64imb.S
-+++ b/hash/src/asm/riscv64/fips202_rv64imb.S
-@@ -355,3 +355,5 @@ rounds1_loop_start:
-     addi sp, sp, 8*18
-     RET
- SYM_FUNC_END(KeccakF1600_StatePermute_RV64ZBB)
-+
-+ASM_END
-diff --git a/hash/src/asm/riscv64/sha2-256-riscv.S b/hash/src/asm/riscv64/sha2-256-riscv.S
-index 6aef4c83..75365bff 100644
--- a/hash/src/asm/riscv64/sha2-256-riscv.S
-+++ b/hash/src/asm/riscv64/sha2-256-riscv.S
-@@ -2927,3 +2927,5 @@ K256:
- 	.word	0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
- .string	"SHA256 for RISC-V, CRYPTOGAMS by @dot-asm"
- .align	5
-+
-+ASM_END
-diff --git a/hash/src/asm/riscv64/sha2-512-riscv.S b/hash/src/asm/riscv64/sha2-512-riscv.S
-index 28735e31..3137d5bb 100644
--- a/hash/src/asm/riscv64/sha2-512-riscv.S
-+++ b/hash/src/asm/riscv64/sha2-512-riscv.S
-@@ -3143,3 +3143,5 @@ K512:
- 	.dword	0x5fcb6fab3ad6faec, 0x6c44198c4a475817
- .string	"SHA512 for RISC-V, CRYPTOGAMS by @dot-asm"
- .align	5
-+
-+ASM_END
-diff --git a/internal/api/assembler_support.h b/internal/api/assembler_support.h
-index de333805..7a683989 100644
--- a/internal/api/assembler_support.h
-+++ b/internal/api/assembler_support.h
-@@ -44,6 +44,8 @@
- # define FRAME_END
- #endif
- 
-+# define ASM_END
-+
- # define SYM_FUNC_ENTER(name)
- 
- # define SYM_FUNC(name)	name
-@@ -73,6 +75,7 @@
- # define ANNOTATE_INTRA_FUNCTION_CALL
- 
- # ifdef __APPLE__
-+#  define ASM_END
- #  define SYM_FUNC(name)	_##name
- #  define SYM_TYPE_OBJ(name)
- #  define SYM_TYPE_FUNC(name)
-@@ -91,6 +94,8 @@
- 
- # elif (defined(__CYGWIN__) || defined(_WIN32))
- 
-+#  define ASM_END
-+
- #  define SYM_FUNC(name)	name
- 
- #  define SYM_TYPE_OBJ(name)						       \
-@@ -115,6 +120,34 @@
- 
- # else /* __APPLE__ */
- 
-+#  if defined __ELF__ && defined __CET__
-+#   ifdef __x86_64__
-+#    define ASM_X86_MARK_CET_ALIGN 3
-+#   else
-+#    define ASM_X86_MARK_CET_ALIGN 2
-+#   endif
-+#   define ASM_END				\
-+	.pushsection ".note.gnu.property", "a";	\
-+	.p2align ASM_X86_MARK_CET_ALIGN;	\
-+	.long 1f - 0f;				\
-+	.long 4f - 1f;				\
-+	.long 5;				\
-+0:						\
-+	.asciz "GNU";				\
-+1:						\
-+	.p2align ASM_X86_MARK_CET_ALIGN;	\
-+	.long 0xc0000002;			\
-+	.long 3f - 2f;				\
-+2:						\
-+	.long 3;				\
-+3:						\
-+	.p2align ASM_X86_MARK_CET_ALIGN;	\
-+4:						\
-+	.popsection
-+#  else
-+#   define ASM_END
-+#  endif
-+
- #  define SYM_FUNC(name)	name
- 
- #  define SYM_TYPE_OBJ(name)						       \
-diff --git a/ml-dsa/src/armv7/dilithium_ntt_armv7.S b/ml-dsa/src/armv7/dilithium_ntt_armv7.S
-index 878a2623..100eeb67 100644
--- a/ml-dsa/src/armv7/dilithium_ntt_armv7.S
-+++ b/ml-dsa/src/armv7/dilithium_ntt_armv7.S
-@@ -589,3 +589,5 @@ inv_ntt_asm_smull_q:
- .align 2
- inv_ntt_asm_smull_64:
- .word 64
-+
-+ASM_END
-diff --git a/ml-dsa/src/armv7/dilithium_pointwise_smull_armv7.S b/ml-dsa/src/armv7/dilithium_pointwise_smull_armv7.S
-index b84a7fac..dcd2706b 100644
--- a/ml-dsa/src/armv7/dilithium_pointwise_smull_armv7.S
-+++ b/ml-dsa/src/armv7/dilithium_pointwise_smull_armv7.S
-@@ -166,3 +166,5 @@ SYM_FUNC_ENTER(armv7_poly_pointwise_acc_invmontgomery_asm_smull)
-     pop.w {r4-r11, pc}
- 
- SYM_FUNC_END(armv7_poly_pointwise_acc_invmontgomery_asm_smull)
-+
-+ASM_END
-diff --git a/ml-dsa/src/armv7/dilithium_poly_armv7.S b/ml-dsa/src/armv7/dilithium_poly_armv7.S
-index e0a62a49..fa0994f2 100644
--- a/ml-dsa/src/armv7/dilithium_poly_armv7.S
-+++ b/ml-dsa/src/armv7/dilithium_poly_armv7.S
-@@ -131,3 +131,5 @@ end:
-     bx lr
- 
- SYM_FUNC_END(armv7_rej_uniform_asm)
-+
-+ASM_END
-diff --git a/ml-dsa/src/armv8/dilithium_intt_armv8.S b/ml-dsa/src/armv8/dilithium_intt_armv8.S
-index ddcae06e..1b10e466 100644
--- a/ml-dsa/src/armv8/dilithium_intt_armv8.S
-+++ b/ml-dsa/src/armv8/dilithium_intt_armv8.S
-@@ -545,3 +545,5 @@ SYM_FUNC_ENTER(intt_SIMD_bot_armv8)
-     br lr
- 
- SYM_FUNC_END(intt_SIMD_bot_armv8)
-+
-+ASM_END
-diff --git a/ml-dsa/src/armv8/dilithium_ntt_armv8.S b/ml-dsa/src/armv8/dilithium_ntt_armv8.S
-index 06fdc42a..2d89b9d8 100644
--- a/ml-dsa/src/armv8/dilithium_ntt_armv8.S
-+++ b/ml-dsa/src/armv8/dilithium_ntt_armv8.S
-@@ -300,3 +300,5 @@ SYM_FUNC_ENTER(ntt_SIMD_bot_armv8)
-     br lr
- 
- SYM_FUNC_END(ntt_SIMD_bot_armv8)
-+
-+ASM_END
-diff --git a/ml-dsa/src/armv8/dilithium_poly_armv8.S b/ml-dsa/src/armv8/dilithium_poly_armv8.S
-index 3fd814fb..fe28cda1 100644
--- a/ml-dsa/src/armv8/dilithium_poly_armv8.S
-+++ b/ml-dsa/src/armv8/dilithium_poly_armv8.S
-@@ -918,3 +918,5 @@ SYM_FUNC_ENTER(polyvecl_pointwise_acc_montgomery_armv8)
-     br lr
- 
- SYM_FUNC_END(polyvecl_pointwise_acc_montgomery_armv8)
-+
-+ASM_END
-diff --git a/ml-dsa/src/avx2/dilithium_invntt_avx2.S b/ml-dsa/src/avx2/dilithium_invntt_avx2.S
-index 893c95e9..9de0a07a 100644
--- a/ml-dsa/src/avx2/dilithium_invntt_avx2.S
-+++ b/ml-dsa/src/avx2/dilithium_invntt_avx2.S
-@@ -238,3 +238,5 @@ levels6t7	3
- 
- RET
- SYM_FUNC_END(dilithium_invntt_avx)
-+
-+ASM_END
-diff --git a/ml-dsa/src/avx2/dilithium_ntt_avx2.S b/ml-dsa/src/avx2/dilithium_ntt_avx2.S
-index e9e3c520..d9c1f391 100644
--- a/ml-dsa/src/avx2/dilithium_ntt_avx2.S
-+++ b/ml-dsa/src/avx2/dilithium_ntt_avx2.S
-@@ -196,3 +196,5 @@ levels2t7	3
- 
- RET
- SYM_FUNC_END(dilithium_ntt_avx)
-+
-+ASM_END
-diff --git a/ml-dsa/src/avx2/dilithium_pointwise_avx2.S b/ml-dsa/src/avx2/dilithium_pointwise_avx2.S
-index 58911a4c..bed14608 100644
--- a/ml-dsa/src/avx2/dilithium_pointwise_avx2.S
-+++ b/ml-dsa/src/avx2/dilithium_pointwise_avx2.S
-@@ -208,3 +208,5 @@ jb _looptop2
- 
- RET
- SYM_FUNC_END(dilithium_pointwise_acc_avx)
-+
-+ASM_END
-diff --git a/ml-dsa/src/avx2/dilithium_shuffle_avx2.S b/ml-dsa/src/avx2/dilithium_shuffle_avx2.S
-index 5b76acbf..028a4c27 100644
--- a/ml-dsa/src/avx2/dilithium_shuffle_avx2.S
-+++ b/ml-dsa/src/avx2/dilithium_shuffle_avx2.S
-@@ -50,3 +50,5 @@ add		$256,%rdi
- nttunpack128_avx
- RET
- SYM_FUNC_END(dilithium_nttunpack_avx)
-+
-+ASM_END
-diff --git a/ml-dsa/src/riscv64/ntt_8l_dualissue_plant_rv64im.S b/ml-dsa/src/riscv64/ntt_8l_dualissue_plant_rv64im.S
-index a86380b2..142764aa 100644
--- a/ml-dsa/src/riscv64/ntt_8l_dualissue_plant_rv64im.S
-+++ b/ml-dsa/src/riscv64/ntt_8l_dualissue_plant_rv64im.S
-@@ -1168,3 +1168,5 @@ poly_reduce_rv64im_loop:
-     bne a3, a0, poly_reduce_rv64im_loop
-     RET
- SYM_FUNC_END(dilithium_poly_reduce_rv64im)
-+
-+ASM_END
-diff --git a/ml-dsa/src/riscv64/ntt_rvv.S b/ml-dsa/src/riscv64/ntt_rvv.S
-index 8254fca9..116a8c3b 100644
--- a/ml-dsa/src/riscv64/ntt_rvv.S
-+++ b/ml-dsa/src/riscv64/ntt_rvv.S
-@@ -1588,3 +1588,5 @@ poly_reduce_rvv_loop:
-     bnez a3, poly_reduce_rvv_loop
-     RET
- SYM_FUNC_END(dilithium_poly_reduce_rvv)
-+
-+ASM_END
-diff --git a/ml-kem/src/armv7/kyber_fastinvntt_armv7.S b/ml-kem/src/armv7/kyber_fastinvntt_armv7.S
-index 8b163a66..b3862483 100644
--- a/ml-kem/src/armv7/kyber_fastinvntt_armv7.S
-+++ b/ml-kem/src/armv7/kyber_fastinvntt_armv7.S
-@@ -272,3 +272,5 @@ SYM_FUNC_ENTER(kyber_invntt_armv7)
-   pop.w {r4-r11, pc}
- 
- SYM_FUNC_END(kyber_invntt_armv7)
-+
-+ASM_END
-diff --git a/ml-kem/src/armv7/kyber_fastntt_armv7.S b/ml-kem/src/armv7/kyber_fastntt_armv7.S
-index 9b8580c9..988a4cff 100644
--- a/ml-kem/src/armv7/kyber_fastntt_armv7.S
-+++ b/ml-kem/src/armv7/kyber_fastntt_armv7.S
-@@ -243,3 +243,5 @@ SYM_FUNC_ENTER(kyber_ntt_armv7)
-   pop.w {r4-r11, pc}
- 
- SYM_FUNC_END(kyber_ntt_armv7)
-+
-+ASM_END
-diff --git a/ml-kem/src/armv7/kyber_poly_armv7.S b/ml-kem/src/armv7/kyber_poly_armv7.S
-index 8810555f..08582c35 100644
--- a/ml-kem/src/armv7/kyber_poly_armv7.S
-+++ b/ml-kem/src/armv7/kyber_poly_armv7.S
-@@ -283,3 +283,5 @@ SYM_FUNC_ENTER(kyber_basemul_armv7)
- 
- .unreq qinv
- SYM_FUNC_END(kyber_basemul_armv7)
-+
-+ASM_END
-diff --git a/ml-kem/src/armv8/kyber_add_armv8.S b/ml-kem/src/armv8/kyber_add_armv8.S
-index c2cb39ed..487be1ff 100644
--- a/ml-kem/src/armv8/kyber_add_armv8.S
-+++ b/ml-kem/src/armv8/kyber_add_armv8.S
-@@ -79,3 +79,5 @@ SYM_FUNC_ENTER(kyber_add_armv8)
- 	RET
- SYM_FUNC_END(kyber_add_armv8)
- 
-+
-+ASM_END
-diff --git a/ml-kem/src/armv8/kyber_basemul_armv8.S b/ml-kem/src/armv8/kyber_basemul_armv8.S
-index 7bec9b9c..4058ccac 100644
--- a/ml-kem/src/armv8/kyber_basemul_armv8.S
-+++ b/ml-kem/src/armv8/kyber_basemul_armv8.S
-@@ -99,3 +99,5 @@ SYM_FUNC_ENTER(kyber_basemul_armv8)
- 
- 	RET
- SYM_FUNC_END(kyber_basemul_armv8)
-+
-+ASM_END
-diff --git a/ml-kem/src/armv8/kyber_cbd_armv8.S b/ml-kem/src/armv8/kyber_cbd_armv8.S
-index 28a1724f..287078a9 100644
--- a/ml-kem/src/armv8/kyber_cbd_armv8.S
-+++ b/ml-kem/src/armv8/kyber_cbd_armv8.S
-@@ -263,3 +263,5 @@ SYM_FUNC_ENTER(kyber_cbd3_armv8)
- 	//
- 	RET
- SYM_FUNC_END(kyber_cbd3_armv8)
-+
-+ASM_END
-diff --git a/ml-kem/src/armv8/kyber_inv_ntt_armv8.S b/ml-kem/src/armv8/kyber_inv_ntt_armv8.S
-index 4264445f..f0238c65 100644
--- a/ml-kem/src/armv8/kyber_inv_ntt_armv8.S
-+++ b/ml-kem/src/armv8/kyber_inv_ntt_armv8.S
-@@ -239,3 +239,5 @@ SYM_FUNC_ENTER(kyber_inv_ntt_armv8)
- 
- 	RET
- SYM_FUNC_END(kyber_inv_ntt_armv8)
-+
-+ASM_END
-diff --git a/ml-kem/src/armv8/kyber_ntt_armv8_asm.S b/ml-kem/src/armv8/kyber_ntt_armv8_asm.S
-index ae4eb3a5..da2cbff9 100644
--- a/ml-kem/src/armv8/kyber_ntt_armv8_asm.S
-+++ b/ml-kem/src/armv8/kyber_ntt_armv8_asm.S
-@@ -217,3 +217,5 @@ SYM_FUNC_ENTER(kyber_ntt_armv8)
- 
- 	RET
- SYM_FUNC_END(kyber_ntt_armv8)
-+
-+ASM_END
-diff --git a/ml-kem/src/armv8/kyber_poly_armv8_asm.S b/ml-kem/src/armv8/kyber_poly_armv8_asm.S
-index d9ee3819..8a9bb6ec 100644
--- a/ml-kem/src/armv8/kyber_poly_armv8_asm.S
-+++ b/ml-kem/src/armv8/kyber_poly_armv8_asm.S
-@@ -143,3 +143,5 @@ SYM_FUNC_ENTER(kyber_poly_frombytes_armv8)
- 
- 	RET
- SYM_FUNC_END(kyber_poly_frombytes_armv8)
-+
-+ASM_END
-diff --git a/ml-kem/src/armv8/kyber_reduce_armv8.S b/ml-kem/src/armv8/kyber_reduce_armv8.S
-index 47f1b7bf..2a341b8f 100644
--- a/ml-kem/src/armv8/kyber_reduce_armv8.S
-+++ b/ml-kem/src/armv8/kyber_reduce_armv8.S
-@@ -261,3 +261,5 @@ SYM_FUNC_ENTER(kyber_add_add_reduce_armv8)
- 	
- 	RET
- SYM_FUNC_END(kyber_add_add_reduce_armv8)
-+
-+ASM_END
-diff --git a/ml-kem/src/avx2/kyber_basemul_avx2.S b/ml-kem/src/avx2/kyber_basemul_avx2.S
-index 0b81bdd3..fc1ec793 100644
--- a/ml-kem/src/avx2/kyber_basemul_avx2.S
-+++ b/ml-kem/src/avx2/kyber_basemul_avx2.S
-@@ -106,3 +106,5 @@ mov		%r8,%rsp
- RET
- SYM_FUNC_END(kyber_basemul_avx)
- STACK_FRAME_NON_STANDARD kyber_basemul_avx
-+
-+ASM_END
-diff --git a/ml-kem/src/avx2/kyber_fq_avx2.S b/ml-kem/src/avx2/kyber_fq_avx2.S
-index fa0409b5..94ff5b0e 100644
--- a/ml-kem/src/avx2/kyber_fq_avx2.S
-+++ b/ml-kem/src/avx2/kyber_fq_avx2.S
-@@ -86,3 +86,5 @@ add		$256,%rdi
- tomont128_avx
- RET
- SYM_FUNC_END(tomont_avx)
-+
-+ASM_END
-diff --git a/ml-kem/src/avx2/kyber_invntt_avx2.S b/ml-kem/src/avx2/kyber_invntt_avx2.S
-index 4090c5d7..66cc61cd 100644
--- a/ml-kem/src/avx2/kyber_invntt_avx2.S
-+++ b/ml-kem/src/avx2/kyber_invntt_avx2.S
-@@ -193,3 +193,5 @@ intt_level6	0
- intt_level6	1
- RET
- SYM_FUNC_END(kyber_invntt_avx)
-+
-+ASM_END
-diff --git a/ml-kem/src/avx2/kyber_ntt_avx2.S b/ml-kem/src/avx2/kyber_ntt_avx2.S
-index c4962fc5..b3633613 100644
--- a/ml-kem/src/avx2/kyber_ntt_avx2.S
-+++ b/ml-kem/src/avx2/kyber_ntt_avx2.S
-@@ -189,3 +189,5 @@ levels1t6	1
- 
- RET
- SYM_FUNC_END(kyber_ntt_avx)
-+
-+ASM_END
-diff --git a/ml-kem/src/avx2/kyber_shuffle_avx2.S b/ml-kem/src/avx2/kyber_shuffle_avx2.S
-index ffb642dc..0319e129 100644
--- a/ml-kem/src/avx2/kyber_shuffle_avx2.S
-+++ b/ml-kem/src/avx2/kyber_shuffle_avx2.S
-@@ -252,3 +252,5 @@ add		$192,%rsi
- kyber_nttfrombytes128_avx
- RET
- SYM_FUNC_END(kyber_nttfrombytes_avx)
-+
-+ASM_END
-diff --git a/ml-kem/src/riscv64/ntt_dualissue_plant_rv64im.S b/ml-kem/src/riscv64/ntt_dualissue_plant_rv64im.S
-index 7eab10be..f509806e 100644
--- a/ml-kem/src/riscv64/ntt_dualissue_plant_rv64im.S
-+++ b/ml-kem/src/riscv64/ntt_dualissue_plant_rv64im.S
-@@ -1969,3 +1969,5 @@ SYM_FUNC_START(kyber_poly_toplant_rv64im)
-   addi sp, sp, 8*1
-   RET
- SYM_FUNC_END(kyber_poly_toplant_rv64im)
-+
-+ASM_END
-diff --git a/ml-kem/src/riscv64/ntt_rvv_vlen128.S b/ml-kem/src/riscv64/ntt_rvv_vlen128.S
-index 2d3afc5d..d113d39f 100644
--- a/ml-kem/src/riscv64/ntt_rvv_vlen128.S
-+++ b/ml-kem/src/riscv64/ntt_rvv_vlen128.S
-@@ -1196,3 +1196,5 @@ cbd3_rvv_vlen128_loop:
-     bnez a4, cbd3_rvv_vlen128_loop
-     RET
- SYM_FUNC_END(kyber_cbd3_rvv_vlen128)
-+
-+ASM_END
-diff --git a/ml-kem/src/riscv64/ntt_rvv_vlen256.S b/ml-kem/src/riscv64/ntt_rvv_vlen256.S
-index 16b5aa2f..7f827f53 100644
--- a/ml-kem/src/riscv64/ntt_rvv_vlen256.S
-+++ b/ml-kem/src/riscv64/ntt_rvv_vlen256.S
-@@ -1199,3 +1199,5 @@ cbd3_rvv_vlen256_loop:
-     bnez a4, cbd3_rvv_vlen256_loop
-     RET
- SYM_FUNC_END(kyber_cbd3_rvv_vlen256)
-+
-+ASM_END
-diff --git a/ml-kem/src/riscv64/riscv_rvv_selector_test.S b/ml-kem/src/riscv64/riscv_rvv_selector_test.S
-index a420ffea..9f8aa904 100644
--- a/ml-kem/src/riscv64/riscv_rvv_selector_test.S
-+++ b/ml-kem/src/riscv64/riscv_rvv_selector_test.S
-@@ -24,3 +24,5 @@ SYM_FUNC_START(kyber_rvv_selector)
-    sext.w  a0,a0
-    RET
- SYM_FUNC_END(kyber_rvv_selector)
-+
-+ASM_END
-diff --git a/sym/src/asm/AESNI_x86_64/aes_aesni_x86_64.S b/sym/src/asm/AESNI_x86_64/aes_aesni_x86_64.S
-index d53a97a3..a79cc977 100644
--- a/sym/src/asm/AESNI_x86_64/aes_aesni_x86_64.S
-+++ b/sym/src/asm/AESNI_x86_64/aes_aesni_x86_64.S
-@@ -4568,3 +4568,5 @@ SYM_FUNC_END(aesni_set_encrypt_key)
- 
- .byte	65,69,83,32,102,111,114,32,73,110,116,101,108,32,65,69,83,45,78,73,44,32,67,82,89,80,84,79,71,65,77,83,32,98,121,32,60,97,112,112,114,111,64,111,112,101,110,115,115,108,46,111,114,103,62,0
- .align	64
-+
-+ASM_END
-diff --git a/sym/src/asm/ARMv8/aes_armv8_ce.S b/sym/src/asm/ARMv8/aes_armv8_ce.S
-index 89f61553..894645fc 100644
--- a/sym/src/asm/ARMv8/aes_armv8_ce.S
-+++ b/sym/src/asm/ARMv8/aes_armv8_ce.S
-@@ -3215,3 +3215,5 @@ Lxts_dec_abort:
- Lxts_dec_final_abort:
- 	RET
- SYM_FUNC_END(aes_v8_xts_decrypt)
-+
-+ASM_END
-diff --git a/sym/src/asm/riscv64/riscv64_aes_asm.S b/sym/src/asm/riscv64/riscv64_aes_asm.S
-index 7a7ff426..4dc92bdd 100644
--- a/sym/src/asm/riscv64/riscv64_aes_asm.S
-+++ b/sym/src/asm/riscv64/riscv64_aes_asm.S
-@@ -1900,3 +1900,5 @@ AES_rcon:
- .word 0x00000001U, 0x00000002U, 0x00000004U, 0x00000008U
- .word 0x00000010U, 0x00000020U, 0x00000040U, 0x00000080U
- .word 0x0000001BU, 0x00000036U
-+
-+ASM_END
-diff --git a/sym/src/asm/riscv64/riscv64_aes_zkn_asm.S b/sym/src/asm/riscv64/riscv64_aes_zkn_asm.S
-index 2d8eac75..4f9f887d 100644
--- a/sym/src/asm/riscv64/riscv64_aes_zkn_asm.S
-+++ b/sym/src/asm/riscv64/riscv64_aes_zkn_asm.S
-@@ -732,3 +732,5 @@ rv64i_zknd_set_decrypt_key:
-     ld      x8,0(sp)
-     addi    sp,sp,16
-     RET
-+
-+ASM_END
-- 
-2.48.1
-
--- a/6
+++ b/6
@ -1,6 +1,6 @@
 SHA512 (gmp-6.2.1.tar.xz) = c99be0950a1d05a0297d65641dd35b75b74466f7bf03c9e8a99895a3b2f9a0856cd17887738fa51cf7499781b65c049769271cbcb77d057d2e9f1ec52e07dd84
-SHA512 (gnutls-3.8.9.tar.xz) = b3b201671bf4e75325610a0291d4cd36a669718e22b3685246b64bde97b5bd94f463ab376ed817869869714115f4ff11bdc53c32604bb04a8ff8e10daa6d1fc7
-SHA512 (gnutls-3.8.9.tar.xz.sig) = 5a47a519ef35f21b59e2122528246d6109dd95667bfe5d01713b9a7efa2931f8523bf325b8824433f3117d63e0e50d66f8c467a7ee4bd2068ae039601a28441e
-SHA512 (leancrypto-1.2.0.tar.gz) = 0b58644e3362bd512dd2a19a291ef58ba310d688c8d7c5fb2b7b3ac48ec51122311b998786a23cafa3127f3e4c75425babbc61d287e44fe3318ce584cbc87df7
+SHA512 (gnutls-3.8.10.tar.xz) = d453bd4527af95cb3905ce8753ceafd969e3f442ad1d148544a233ebf13285b999930553a805a0511293cc25390bb6a040260df5544a7c55019640f920ad3d92
+SHA512 (gnutls-3.8.10.tar.xz.sig) = 72d6dd2c23f768f5041c3dca0f49b3f60cd01fc960ce77f097094a2aae6d76fddeb6295c425e3750c711d5f700957a62268aecc4873e53c31abb60eecf0fd4a8
+SHA512 (leancrypto-1.5.0.tar.gz) = 1170a502f58c9bce424578cece64a3ebf856620adc02f390b8877981bccf0c2bf35e64b1628094a06c069ec38a3be5889be22516d45d85f4e75b40085d9001c9
 SHA512 (nettle-3.10.1.tar.gz) = e8673bbcde9cde859ccae75ed6c9c30591e68a995a7c6d724106cfd67a5a5bd45b3468d742443b6565628849d0fd29505a28ca5ee4e89dd13197cdb51429f96c
 SHA512 (nettle-3.10.1.tar.gz.sig) = d074a921df31070a6e6562a9f7e213e67b8e6ce331e2683e8180f387aca92058a5fe8610800817a0aa5098b47176dfcb42b52d617648c84cc6262a09ef557eb8