Problems with upgrade to GnuTLS 3.2.12 (important)

Problems with upgrade to GnuTLS 3.2.12 (important)

[Mark H Weaver]

Due to a grave certificate verification flaw, it is quite important that
we upgrade to GnuTLS 3.2.12 ASAP, but two of the tests in guile/tests
are failing:

  FAIL: x509-auth.scm
  FAIL: openpgp-auth.scm

For both of the failing tests, the error is the same:

--8<---------------cut here---------------start------------->8---
/nix/store/lvfp4x9fwsrv158yzag6qf54q262mgzz-guile-2.0.9/bin/guile: symbol lookup error: /tmp/nix-build-gnutls-3.2.12.drv-0/gnutls-3.2.12/guile/src/.libs/guile-gnutls-v-2.so.0: undefined symbol: gnutls_rsa_params_init
--8<---------------cut here---------------end--------------->8---

The symbol 'gnutls_rsa_params_init' is not new.  I see no relevant
differences between 3.2.11 and 3.2.12 that would affect this symbol.
There are no changes in the guile/ subdirectory at all.

I don't have time to look into this further right now.  Would someone
else like to investigate?

    Mark


--8<---------------cut here---------------start------------->8---
From afecaff5b7445154ceb8db0b4afd1c5bd8ea5994 Mon Sep 17 00:00:00 2001
From: Mark H Weaver <mhw@netris.org>
Date: Tue, 4 Mar 2014 15:15:23 -0500
Subject: [PATCH] gnu: gnutls: Upgrade to 3.2.12.

* gnu/packages/gnutls.scm (gnutls): Upgrade to 3.2.12.
---
 gnu/packages/gnutls.scm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gnu/packages/gnutls.scm b/gnu/packages/gnutls.scm
index 915f6f8..83bfe0f 100644
--- a/gnu/packages/gnutls.scm
+++ b/gnu/packages/gnutls.scm
@@ -63,7 +63,7 @@ specifications.")
 (define-public gnutls
   (package
     (name "gnutls")
-    (version "3.2.11")
+    (version "3.2.12")
     (source (origin
              (method url-fetch)
              (uri
@@ -75,7 +75,7 @@ specifications.")
                              "/gnutls-" version ".tar.xz"))
              (sha256
               (base32
-               "1hgk3k8f6wqijca3bsjbfn8pzyfva509y4j2vaxhm4ynfa5cai5q"))))
+               "0195nliarszq5mginli6d2f5z7ljnd7mwa46iy9z8pkcgy56khbl"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("pkg-config" ,pkg-config)))
-- 
1.8.4
--8<---------------cut here---------------end--------------->8---

Re: Problems with upgrade to GnuTLS 3.2.12 (important)

[Ludovic Courtès]

Mark H Weaver <mhw@netris.org> skribis:

> Due to a grave certificate verification flaw, it is quite important that
> we upgrade to GnuTLS 3.2.12 ASAP, but two of the tests in guile/tests
> are failing:
>
>   FAIL: x509-auth.scm
>   FAIL: openpgp-auth.scm
>
> For both of the failing tests, the error is the same:
>
> /nix/store/lvfp4x9fwsrv158yzag6qf54q262mgzz-guile-2.0.9/bin/guile: symbol lookup error: /tmp/nix-build-gnutls-3.2.12.drv-0/gnutls-3.2.12/guile/src/.libs/guile-gnutls-v-2.so.0: undefined symbol: gnutls_rsa_params_init

This is because:

  1. the --disable-rsa-export configure option disappeared (it’s been
     reinstated in GnuTLS commit a1c626e), and so ENABLE_RSA_EXPORT was
     left undefined, meaning gnutls_rsa_export.c code was not compiled
     (it’s actually a backward-compatibility interface.)

  2. the Guile bindings still use and expose that interface (I’ll ask
     for advice on what to do here.)

I’ll push the upgrade shortly; thanks!

Ludo’.