From gnutls-devel at lists.gnutls.org Fri May 1 03:47:44 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Fri, 01 May 2026 01:47:44 +0000 Subject: [gnutls-devel] GnuTLS | Build failure error: expected ')' in crau/crau.h (#1880) In-Reply-To: References: Message-ID: Ryan Carsten Schmidt commented: https://gitlab.com/gnutls/gnutls/-/work_items/1880#note_3305891149 I don't think f5666f8f1f653cfe2bef808a9c9b61534f279ed1 was correct. It changed the behavior of the code. Previously: If `defined(__has_c_attribute)` and not `__has_c_attribute (__maybe_unused__)` and `defined(__GNUC__)`, it did `#define CRAU_MAYBE_UNUSED __attribute__((__unused__))`. Now: If `defined(__has_c_attribute)` and not `__has_c_attribute (__maybe_unused__)`, it does not define `CRAU_MAYBE_UNUSED`, whether or not `defined(__GNUC__)`. -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/work_items/1880#note_3305891149 You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/4-cmmhx4tztjws7i03yi1fwv0k5-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Fri May 1 04:21:11 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Fri, 01 May 2026 02:21:11 +0000 Subject: [gnutls-devel] GnuTLS | Build failure error: expected ')' in crau/crau.h (#1880) In-Reply-To: References: Message-ID: Daiki Ueno commented: https://gitlab.com/gnutls/gnutls/-/work_items/1880#note_3305921267 Thanks for checking; I'll create a patch. For the meantime, does it help if you add `CFLAGS=-DCRAU_MAYBE_UNUSED` to the configure invocation? -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/work_items/1880#note_3305921267 You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/4-4rvywm4u3gon1jsczujmj1xf2-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Fri May 1 04:24:30 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Fri, 01 May 2026 02:24:30 +0000 Subject: [gnutls-devel] GnuTLS | Build failure error: expected ')' in crau/crau.h (#1880) In-Reply-To: References: Message-ID: Ryan Carsten Schmidt commented: https://gitlab.com/gnutls/gnutls/-/work_items/1880#note_3305924644 This patch works for me: https://github.com/macports/macports-ports/blob/e63c8517894250a6d5702e309a408eb7c80341cc/devel/gnutls/files/CRAU_MAYBE_UNUSED.patch The final stanza is just to ensure that `CRAU_MAYBE_UNUSED` is always defined to something, even if it's the empty string, for very old compilers that don't support any of this. -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/work_items/1880#note_3305924644 You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/4-6i5wk3dr6dgy8bnhnlofroc64-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Fri May 1 04:28:12 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Fri, 01 May 2026 02:28:12 +0000 Subject: [gnutls-devel] GnuTLS | Build failure error: expected ')' in crau/crau.h (#1880) In-Reply-To: References: Message-ID: Daiki Ueno commented: https://gitlab.com/gnutls/gnutls/-/work_items/1880#note_3305929058 Thanks, it looks good to me! Do you mind filing a merge request with that patch? -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/work_items/1880#note_3305929058 You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/4-0zurxny6ixcmbtls41744p5v7-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Fri May 1 04:29:25 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Fri, 01 May 2026 02:29:25 +0000 Subject: [gnutls-devel] GnuTLS | Build failure error: expected ')' in crau/crau.h (#1880) In-Reply-To: References: Message-ID: Milestone changed to Release of GnuTLS 3.8.14 ( https://gitlab.com/gnutls/gnutls/-/milestones/52 ) -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/work_items/1880 You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/4-cpme27wunr8bzqkjaeyscvqmt-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Fri May 1 04:32:46 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Fri, 01 May 2026 02:32:46 +0000 Subject: [gnutls-devel] GnuTLS | Build failure error: expected ')' in crau/crau.h (#1880) In-Reply-To: References: Message-ID: Ryan Carsten Schmidt commented on a discussion: https://gitlab.com/gnutls/gnutls/-/work_items/1880#note_3305933149 > does it help if you add `CFLAGS=-DCRAU_MAYBE_UNUSED` to the configure invocation? That looks plausible to me, but it did not change the error. -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/work_items/1880#note_3305933149 You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/4-0jor5zaaxlj14a59ec48uex8c-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Fri May 1 04:39:33 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Fri, 01 May 2026 02:39:33 +0000 Subject: [gnutls-devel] GnuTLS | Fix CRAU_MAYBE_UNUSED definition for old compilers (!2106) References: Message-ID: Ryan Carsten Schmidt created a merge request: https://gitlab.com/gnutls/gnutls/-/merge_requests/2106 Project:Branches: ryandesign/gnutls:patch-1 to gnutls/gnutls:master Author: Ryan Carsten Schmidt * Fix CRAU_MAYBE_UNUSED definition for old compilers Fix behavior change that caused build failure with clang versions older than 17, introduced in f5666f8f1f653cfe2bef808a9c9b61534f279ed1. Also ensure CRAU_MAYBE_UNUSED is always defined to something, for even older compilers. Fixes #1880 ## Checklist * [ ] Commits have `Signed-off-by:` with name/author being identical to the commit author * [ ] Code modified for feature * [ ] Test suite updated with functionality tests * [ ] Test suite updated with negative tests * [ ] Documentation updated / NEWS entry present (for non-trivial changes) ## Reviewer's checklist: * [ ] Any issues marked for closing are addressed * [ ] There is a test suite reasonably covering new functionality or modifications * [ ] Function naming, parameters, return values, types, etc., are consistent and according to `CONTRIBUTION.md` * [ ] This feature/change has adequate documentation added * [ ] No obvious mistakes in the code -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/merge_requests/2106 You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/4-5nrwcwqehrm9ypjlduau4cywa-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Fri May 1 04:40:04 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Fri, 01 May 2026 02:40:04 +0000 Subject: [gnutls-devel] GnuTLS | Build failure error: expected ')' in crau/crau.h (#1880) In-Reply-To: References: Message-ID: Ryan Carsten Schmidt commented on a discussion: https://gitlab.com/gnutls/gnutls/-/work_items/1880#note_3305939236 > Do you mind filing a merge request with that patch? Here you go: !2106 -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/work_items/1880#note_3305939236 You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/4-9284afxx4iy54gum9z20invwq-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Fri May 1 05:17:14 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Fri, 01 May 2026 03:17:14 +0000 Subject: [gnutls-devel] GnuTLS | Fix CRAU_MAYBE_UNUSED definition for old compilers (!2106) In-Reply-To: References: Message-ID: Ryan Carsten Schmidt commented: https://gitlab.com/gnutls/gnutls/-/merge_requests/2106#note_3305978937 I hereby register my disapproval of your use of and particularly my frustration with your requirement that I use the Signed-off-by line. If you are not already familiar with such objections I'm happy to explain it. -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/merge_requests/2106#note_3305978937 You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/4-50gpmx7jnpcjufl7jrrbn2g7h-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Fri May 1 05:33:29 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Fri, 01 May 2026 03:33:29 +0000 Subject: [gnutls-devel] GnuTLS | Fix CRAU_MAYBE_UNUSED definition for old compilers (!2106) In-Reply-To: References: Message-ID: Merge request !2106 was approved by Daiki Ueno Merge request URL: https://gitlab.com/gnutls/gnutls/-/merge_requests/2106 Project:Branches: ryandesign/gnutls:patch-1 to gnutls/gnutls:master Author: Ryan Carsten Schmidt Assignees: Reviewers: -- You're receiving this email because of your account on gitlab.com. -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Fri May 1 06:09:09 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Fri, 01 May 2026 04:09:09 +0000 Subject: [gnutls-devel] GnuTLS | Fix CRAU_MAYBE_UNUSED definition for old compilers (!2106) In-Reply-To: References: Message-ID: Merge request !2106 was merged Merge request URL: https://gitlab.com/gnutls/gnutls/-/merge_requests/2106 Project:Branches: ryandesign/gnutls:patch-1 to gnutls/gnutls:master Author: Ryan Carsten Schmidt -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/merge_requests/2106 You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/4-ch2ckgau84pvhprinpw8yhnwc-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Fri May 1 06:09:10 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Fri, 01 May 2026 04:09:10 +0000 Subject: [gnutls-devel] GnuTLS | Build failure error: expected ')' in crau/crau.h (#1880) In-Reply-To: References: Message-ID: Issue was closed by Daiki Ueno with commit 29c2027c963cf559817d0da37c1fc2efd0c1bd6a Issue #1880: https://gitlab.com/gnutls/gnutls/-/work_items/1880 -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/work_items/1880 You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/4-ewvkjpfjfq179fn3pszf4x1h1-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Fri May 1 06:09:18 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Fri, 01 May 2026 04:09:18 +0000 Subject: [gnutls-devel] GnuTLS | Fix CRAU_MAYBE_UNUSED definition for old compilers (!2106) In-Reply-To: References: Message-ID: Daiki Ueno commented: https://gitlab.com/gnutls/gnutls/-/merge_requests/2106#note_3306043764 Thank you! -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/merge_requests/2106#note_3306043764 You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/4-f1axiuq02wd8owhmyh7w7roap-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Fri May 1 06:16:21 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Fri, 01 May 2026 04:16:21 +0000 Subject: [gnutls-devel] GnuTLS | OCSP delegated signer EKU check can be bypassed by prefix OID match (#1810) In-Reply-To: References: Message-ID: Issue was closed by Daiki Ueno Issue #1810: https://gitlab.com/gnutls/gnutls/-/issues/1810 -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/issues/1810 You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/4-e34k6xu1ccw66zhuid21jcle2-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Fri May 1 06:16:21 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Fri, 01 May 2026 04:16:21 +0000 Subject: [gnutls-devel] GnuTLS | OCSP delegated signer EKU check can be bypassed by prefix OID match (#1810) In-Reply-To: References: Message-ID: Milestone removed -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/issues/1810 You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/4-d72ggappivuoed15y6y1wnsjc-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Mon May 4 06:31:07 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Mon, 04 May 2026 04:31:07 +0000 Subject: [gnutls-devel] GnuTLS | hpke: allocate `kem_context` on heap instead of stack (#1882) References: Message-ID: Daiki Ueno created an issue: https://gitlab.com/gnutls/gnutls/-/work_items/1882 Currently, a static buffer of size `HPKE_MAX_INFO_LABEL_SIZE` (= 448)` is allocated for `kem_context`. This is reasonably small to have it on stack, though will be increased when we support PQ algorithms as in https://datatracker.ietf.org/doc/draft-ietf-hpke-pq/. For future proof, it would probably be better to allocate it on heap. -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/work_items/1882 You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/4-4ceu8l5k8o8ycyhvp3osmy77q-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Mon May 4 16:05:47 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Mon, 04 May 2026 14:05:47 +0000 Subject: [gnutls-devel] GnuTLS | Amendment to SECURITY.md (#1881) In-Reply-To: References: Message-ID: Alexander Sosedkin commented: https://gitlab.com/gnutls/gnutls/-/work_items/1881#note_3311655051 > The server applications should use address space isolation, meaning that any malicious attempts after successful authentication do not affect other users of the service s/any malicious attempts after successful authentication do not affect other users of the service/a compromised authenticated user cannot read or modify another user's data/ ? > The difficulty is typically due to factors such as demanding timing constraints, specific platform prerequisites, or the involvement of rare options or protocols Should we detail what are "common" options and protocols"? Is DTLS one? Would this downgrade, say, the recent datagram of death ([CVE-2026-33845](https://gitlab.com/gnutls/gnutls/-/issues/1811)) to a Low? Should src/ be out of scope, except generating long-lived key material with certtool? -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/work_items/1881#note_3311655051 You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/4-32n6sif5ej56erc7918er6ydg-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Tue May 5 02:28:43 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Tue, 05 May 2026 00:28:43 +0000 Subject: [gnutls-devel] GnuTLS | Amendment to SECURITY.md (#1881) In-Reply-To: References: Message-ID: Daiki Ueno commented on a discussion: https://gitlab.com/gnutls/gnutls/-/work_items/1881#note_3313329156 Applied the first suggestion. > Should we detail what are "common" options and protocols"? Is DTLS one? I would still consider DTLS a common protocol, given its usage in OpenConnect, though we may say about DTLS 0.9 (and/or SSL 3.0, etc.). > Should src/ be out of scope, except generating long-lived key material with certtool? Some tools are already mentioned in the current version of SECURITY.md, though we can be more specific. -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/work_items/1881#note_3313329156 You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/4-9vbc0bji1uruti6fkjqddxg4q-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Tue May 5 12:04:28 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Tue, 05 May 2026 10:04:28 +0000 Subject: [gnutls-devel] GnuTLS | Amendment to SECURITY.md (#1881) In-Reply-To: References: Message-ID: Daiki Ueno commented: https://gitlab.com/gnutls/gnutls/-/work_items/1881#note_3314606699 Update: mentioned AF\_ALG as a deprecated feature, and protocol downgrade attacks are rated Low if the provided security is good enough -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/work_items/1881#note_3314606699 You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/4-48tl7zk9t8f5gkmhpgoslxhwu-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Thu May 7 02:48:44 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Thu, 07 May 2026 00:48:44 +0000 Subject: [gnutls-devel] GnuTLS | Minor fixes after 3.8.13 release (!2107) In-Reply-To: References: Message-ID: Milestone changed to Release of GnuTLS 3.8.14 (Apr 30, 2026?Jun 30, 2026) ( https://gitlab.com/gnutls/gnutls/-/milestones/52 ) -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/merge_requests/2107 You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/4-arles6whk0efenuqwb9mwljj9-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Thu May 7 02:48:37 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Thu, 07 May 2026 00:48:37 +0000 Subject: [gnutls-devel] GnuTLS | Minor fixes after 3.8.13 release (!2107) References: Message-ID: Daiki Ueno created a merge request: https://gitlab.com/gnutls/gnutls/-/merge_requests/2107 Project:Branches: dueno/gnutls:wip/dueno/minor-fixes to gnutls/gnutls:master Author: Daiki Ueno * drbg-aes: pacify -Wzero-as-null-pointer-constant warning * tests/pkcs11/trust-list-fault: fix issues in linking This fixes the use of automake variables and also adds the linked mock library in .gitignore. * tests/sanity-cpp: limit use of `extern "C" { ... }` ## Checklist * [x] Commits have `Signed-off-by:` with name/author being identical to the commit author * [ ] Code modified for feature * [ ] Test suite updated with functionality tests * [ ] Test suite updated with negative tests * [ ] Documentation updated / NEWS entry present (for non-trivial changes) ## Reviewer's checklist: * [ ] Any issues marked for closing are addressed * [ ] There is a test suite reasonably covering new functionality or modifications * [ ] Function naming, parameters, return values, types, etc., are consistent and according to `CONTRIBUTION.md` * [ ] This feature/change has adequate documentation added * [ ] No obvious mistakes in the code -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/merge_requests/2107 You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/4-0fu3f0n6o3pijqo2pafyr3ycx-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Thu May 7 02:49:41 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Thu, 07 May 2026 00:49:41 +0000 Subject: [gnutls-devel] GnuTLS | Minor fixes after 3.8.13 release (!2107) In-Reply-To: References: Message-ID: Zolt?n Fridrich was added as a reviewer. -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/merge_requests/2107 You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/4-8iiq95fhp4x37ei1pyrr72e5s-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Thu May 7 03:00:44 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Thu, 07 May 2026 01:00:44 +0000 Subject: [gnutls-devel] GnuTLS | Minor fixes after 3.8.13 release (!2107) In-Reply-To: References: Message-ID: Alexander Sosedkin was added as a reviewer. -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/merge_requests/2107 You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/4-4jh065ps4ay6r8xx3ln3hujgd-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Thu May 7 11:58:14 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Thu, 07 May 2026 09:58:14 +0000 Subject: [gnutls-devel] GnuTLS | Minor fixes after 3.8.13 release (!2107) In-Reply-To: References: Message-ID: Zolt?n Fridrich commented: https://gitlab.com/gnutls/gnutls/-/merge_requests/2107#note_3323531104 Seems good to me -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/merge_requests/2107#note_3323531104 You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/4-2ypcurr6pj4pw1ky2a78na1hd-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Thu May 7 12:00:21 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Thu, 07 May 2026 10:00:21 +0000 Subject: [gnutls-devel] GnuTLS | Minor fixes after 3.8.13 release (!2107) In-Reply-To: References: Message-ID: Merge request !2107 was approved by Zolt?n Fridrich Merge request URL: https://gitlab.com/gnutls/gnutls/-/merge_requests/2107 Project:Branches: dueno/gnutls:wip/dueno/minor-fixes to gnutls/gnutls:master Author: Daiki Ueno Assignees: Reviewers: Alexander Sosedkin and Zolt?n Fridrich -- You're receiving this email because of your account on gitlab.com. -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Thu May 7 12:00:21 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Thu, 07 May 2026 10:00:21 +0000 Subject: [gnutls-devel] GnuTLS | Minor fixes after 3.8.13 release (!2107) In-Reply-To: References: Message-ID: Merge request !2107 was merged Merge request URL: https://gitlab.com/gnutls/gnutls/-/merge_requests/2107 Project:Branches: dueno/gnutls:wip/dueno/minor-fixes to gnutls/gnutls:master Author: Daiki Ueno Reviewers: Alexander Sosedkin and Zolt?n Fridrich -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/merge_requests/2107 You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/4-565kun8gpm5xpp9f37j9f1nr6-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Thu May 7 13:25:51 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Thu, 07 May 2026 11:25:51 +0000 Subject: [gnutls-devel] GnuTLS | Amendment to SECURITY.md (#1881) In-Reply-To: References: Message-ID: Daiki Ueno commented: https://gitlab.com/gnutls/gnutls/-/work_items/1881#note_3323850068 Update: added "Denial of Service only relevant to the client is still in scope. However, due to the nature of TLS handshake, which is always initiated by the client, such attacks are classified as Medium or Low severity" -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/work_items/1881#note_3323850068 You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/4-6m2ljzo73jc062xxpz0hswoue-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Wed May 13 08:30:21 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Wed, 13 May 2026 06:30:21 +0000 Subject: [gnutls-devel] GnuTLS | HPKE symbols are added even with --disable-hpke (#1885) References: Message-ID: bbhtt created an issue: https://gitlab.com/gnutls/gnutls/-/work_items/1885 Is this intended? The build clearly says "whether to enable HPKE support...no" ``` ?????????????????????????????? ? ABI Break: libgnutls.so.30 ? ?????????????????????????????? Functions changes summary: 0 Removed, 0 Changed (11 filtered out), 7 Added (2 filtered out) functions Variables changes summary: 0 Removed, 0 Changed, 0 Added variable Function symbols changes summary: 0 Removed, 2 Added function symbols not referenced by debug info Variable symbols changes summary: 0 Removed, 0 Added variable symbol not referenced by debug info 7 Added functions: [A] 'function int gnutls_hpke_deinit(gnutls_hpke_context_t)' {gnutls_hpke_deinit@@GNUTLS_3_8_13} [A] 'function int gnutls_hpke_derive_keypair(gnutls_hpke_kem_t, const gnutls_datum_t*, gnutls_privkey_t, gnutls_pubkey_t)' {gnutls_hpke_derive_keypair@@GNUTLS_3_8_13} [A] 'function int gnutls_hpke_encap(gnutls_hpke_context_t, const gnutls_datum_t*, gnutls_datum_t*, const gnutls_pubkey_t, const gnutls_privkey_t, const gnutls_datum_t*, const gnutls_datum_t*)' {gnutls_hpke_encap@@GNUTLS_3_8_13} [A] 'function int gnutls_hpke_export(gnutls_hpke_context_t, const gnutls_datum_t*, size_t, gnutls_datum_t*)' {gnutls_hpke_export@@GNUTLS_3_8_13} [A] 'function int gnutls_hpke_init(gnutls_hpke_context_t*, gnutls_hpke_mode_t, gnutls_hpke_role_t, gnutls_hpke_kem_t, gnutls_hpke_kdf_t, gnutls_hpke_aead_t)' {gnutls_hpke_init@@GNUTLS_3_8_13} [A] 'function int gnutls_hpke_seal(gnutls_hpke_context_t, const gnutls_datum_t*, const gnutls_datum_t*, gnutls_datum_t*)' {gnutls_hpke_seal@@GNUTLS_3_8_13} [A] 'function int gnutls_pkcs11_obj_get_pk_algorithm(gnutls_pkcs11_obj_t, unsigned int*)' {gnutls_pkcs11_obj_get_pk_algorithm@@GNUTLS_3_8_13} 2 Added function symbols not referenced by debug info: [A] gnutls_hpke_decap@@GNUTLS_3_8_13 [A] gnutls_hpke_open@@GNUTLS_3_8_13 ``` -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/work_items/1885 You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/4-5mfcia2bb6p9rw4kwv9wctoky-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Wed May 13 11:48:33 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Wed, 13 May 2026 09:48:33 +0000 Subject: [gnutls-devel] GnuTLS | HPKE symbols are added even with --disable-hpke (#1885) In-Reply-To: References: Message-ID: Daiki Ueno commented: https://gitlab.com/gnutls/gnutls/-/work_items/1885#note_3343399980 Yes, it's on purpose. With `--disable-hpke`, all those exposed symbols are defined as a stub. This is to avoid future ABI breakage in downstream, i.e., shipping a package with `--enable-hpke` but at some point switch to `--disable-hpke`, which would crash the applications using the ABI. The API might change though, as mentioned in the NEWS. -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/work_items/1885#note_3343399980 You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/4-2s7wp31auera3w6zrn82v0snz-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Wed May 13 11:59:34 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Wed, 13 May 2026 09:59:34 +0000 Subject: [gnutls-devel] GnuTLS | HPKE symbols are added even with --disable-hpke (#1885) In-Reply-To: References: Message-ID: bbhtt commented on a discussion: https://gitlab.com/gnutls/gnutls/-/work_items/1885#note_3343445016 I see thanks. -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/work_items/1885#note_3343445016 You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/4-aoe5ptoxw69scoted38kigbqh-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Wed May 13 11:59:37 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Wed, 13 May 2026 09:59:37 +0000 Subject: [gnutls-devel] GnuTLS | HPKE symbols are added even with --disable-hpke (#1885) In-Reply-To: References: Message-ID: Issue was closed by bbhtt Issue #1885: https://gitlab.com/gnutls/gnutls/-/work_items/1885 -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/work_items/1885 You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/4-a5tx8yxcf3snotey13o769lk1-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Thu May 14 16:58:22 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Thu, 14 May 2026 14:58:22 +0000 Subject: [gnutls-devel] GnuTLS | hpke: allocate `kem_context` on heap instead of stack (!2108) References: Message-ID: David Dudas created a merge request: https://gitlab.com/gnutls/gnutls/-/merge_requests/2108 Project:Branches: d-Dudas/gnutls:dev/ddudas/kem_context_to_heap to gnutls/gnutls:master Author: David Dudas https://gitlab.com/gnutls/gnutls/-/work_items/1882 ## Checklist * [x] Commits have `Signed-off-by:` with name/author being identical to the commit author * [ ] Code modified for feature * [ ] Test suite updated with functionality tests * [ ] Test suite updated with negative tests * [ ] Documentation updated / NEWS entry present (for non-trivial changes) ## Reviewer's checklist: * [ ] Any issues marked for closing are addressed * [ ] There is a test suite reasonably covering new functionality or modifications * [ ] Function naming, parameters, return values, types, etc., are consistent and according to `CONTRIBUTION.md` * [ ] This feature/change has adequate documentation added * [ ] No obvious mistakes in the code -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/merge_requests/2108 You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/4-7ax695nvteyj8ltcj87r4cydz-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Fri May 15 23:43:26 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Fri, 15 May 2026 21:43:26 +0000 Subject: [gnutls-devel] GnuTLS | gnutls_certificate_verify_peers2() does not seem to verify ExtendedKeyUsage (#1886) References: Message-ID: Daniel Stenberg created an issue: https://gitlab.com/gnutls/gnutls/-/work_items/1886 gnutls_certificate_verify_peers2() does not seem to verify ExtendedKeyUsage but gnutls_certificate_verify_peers() does. Neither case is documented clearly. This has already lead to people submitting vuln reports to gnutls-using apps for this omission. Reference: https://www.tenable.com/security/research/tra-2026-38 The aria2c fix: https://github.com/aria2/aria2/pull/2356/changes This seems like a GnuTLS bug to me. -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/work_items/1886 You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/4-al508pkdqcnun9ilftsla8p1g-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Tue May 19 11:59:45 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Tue, 19 May 2026 09:59:45 +0000 Subject: [gnutls-devel] GnuTLS | Building crau.h (#1889) References: Message-ID: Issue created by Bj?rn Christensen: https://gitlab.com/gnutls/gnutls/-/work_items/1889 ## Description of problem: Problems building GnuTLS on mac platform. The code in crau.h seems to have a logic error, lines 253-261 # ifndef CRAU_MAYBE_UNUSED # if defined(__has_c_attribute) # if __has_c_attribute (__maybe_unused__) # define CRAU_MAYBE_UNUSED [[__maybe_unused__]] # endif # elif defined(__GNUC__) # define CRAU_MAYBE_UNUSED __attribute__((__unused__)) # endif # endif /* CRAU_MAYBE_UNUSED */ In my case when compiling, the code ends up without macro CRAU_MAYBE_UNUSED defined. that generates compiler errors for all the later uses. I have solved the problem by adding -DCRAU_MAYBE_UNUSED= to the compilation but is would be nice that the code defined an empty macro CRAU_MAYBE_UNUSED if it cannot provide an alternative for it. Could be: # ifndef CRAU_MAYBE_UNUSED # if defined(__has_c_attribute) # if __has_c_attribute (__maybe_unused__) # define CRAU_MAYBE_UNUSED [[__maybe_unused__]] # else # define CRAU_MAYBE_UNUSED # endif # elif defined(__GNUC__) # define CRAU_MAYBE_UNUSED __attribute__((__unused__)) # else # define CRAU_MAYBE_UNUSED # endif # endif /* CRAU_MAYBE_UNUSED */ ## Version of gnutls used: 3.8.13 ## Distributor of gnutls (e.g., Ubuntu, Fedora, RHEL) sourcecode ## How reproducible: everytime Steps to Reproduce: * one * two * three ## Actual results: ## Expected results: -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/work_items/1889 You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/4-5wx2n22mn9a4p6wp25kwc9i7y-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Thu May 21 10:37:12 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Thu, 21 May 2026 08:37:12 +0000 Subject: [gnutls-devel] GnuTLS | Building crau.h (#1889) In-Reply-To: References: Message-ID: Issue was closed by Daiki Ueno Issue #1889: https://gitlab.com/gnutls/gnutls/-/work_items/1889 -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/work_items/1889 You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/4-3lfmeljvmjloiz3gt7ybolpqy-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Thu May 21 10:36:57 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Thu, 21 May 2026 08:36:57 +0000 Subject: [gnutls-devel] GnuTLS | Building crau.h (#1889) In-Reply-To: References: Message-ID: Daiki Ueno commented: https://gitlab.com/gnutls/gnutls/-/work_items/1889#note_3371400478 Thank you for taking time for reporting this issue. The same issue has already been reported by another reporter. To make it easier to track, we are marking this as a duplicate of the other issue (#1880). -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/work_items/1889#note_3371400478 You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/4-55k61kvc0vpi4dzaybkicg9uz-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Fri May 22 21:55:36 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Fri, 22 May 2026 19:55:36 +0000 Subject: [gnutls-devel] GnuTLS | Add registration API for KDF / PRF / TLS 1.3 HKDF backends (#1891) References: Message-ID: Issue created by Thomas Bechtold: https://gitlab.com/gnutls/gnutls/-/work_items/1891 ## Description of the feature: GnuTLS supports runtime backend override for cipher, MAC, digest, RNG, and PK via the `gnutls_crypto_*_register` family. It does not for KDF (HKDF/PBKDF2), PRF (TLS 1.2), and TLS 1.3 HKDF-Expand-Label ? there are no registration hooks for these, and the in-tree HKDF/PRF implementations call Nettle's HMAC functions directly rather than going through `_gnutls_mac_backend()`, so registering a MAC override does not affect them. Proposal: add `gnutls_crypto_{kdf,prf,tls13_hkdf}_register` mirroring the existing pattern, plus one public `gnutls_load_crypto_provider(path)` for runtime provider loading. All-additive ABI (no removals, no exported-signature changes, no SONAME bump). Off-by-default ? caller must invoke explicitly. Provider callbacks may return `GNUTLS_E_NEED_FALLBACK` to delegate to the in-tree backend, matching the existing PK trampoline fallback pattern. ## Applications that this feature may be relevant to: - FIPS-validated GnuTLS backed by OpenSSL's FIPS module ? no distribution ships this today. Would let consumers reuse existing OpenSSL FIPS validation instead of revalidating GnuTLS per-distro. - Post-quantum vendor backends ? generalizes leancrypto integration (MR !1925) from static link to runtime load. - HSM symmetric crypto offload (related to #367) ? generalizes the PKCS#11 in-tree dispatch. ## Is this feature implemented in other libraries (and which) Yes ? wolfSSL's gnutls-wolfssl (https://github.com/wolfssl/gnutls-wolfssl) does exactly this for wolfCrypt. They maintain a forked GnuTLS with the same four added symbols and the same call-site dispatch changes (~2300 lines), installed to /opt/gnutls to avoid colliding with system GnuTLS. Without these hooks upstream, every external-backend deployment ends up forking libgnutls. Related: #367 (PKCS#11/HSM), !1925 (leancrypto). -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/work_items/1891 You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/4-8h0buf7bbriwmlovqoag1fw76-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Mon May 25 14:31:38 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Mon, 25 May 2026 12:31:38 +0000 Subject: [gnutls-devel] GnuTLS | Draft: SECURITY.md: update with current practices (!2109) References: Message-ID: Daiki Ueno created a merge request: https://gitlab.com/gnutls/gnutls/-/merge_requests/2109 Project:Branches: dueno/gnutls:wip/dueno/security-policy to gnutls/gnutls:master Author: Daiki Ueno * SECURITY.md: update with current practices Fixes: #1881 ## Checklist * [x] Commits have `Signed-off-by:` with name/author being identical to the commit author * [ ] Code modified for feature * [ ] Test suite updated with functionality tests * [ ] Test suite updated with negative tests * [x] Documentation updated / NEWS entry present (for non-trivial changes) ## Reviewer's checklist: * [ ] Any issues marked for closing are addressed * [ ] There is a test suite reasonably covering new functionality or modifications * [ ] Function naming, parameters, return values, types, etc., are consistent and according to `CONTRIBUTION.md` * [ ] This feature/change has adequate documentation added * [ ] No obvious mistakes in the code -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/merge_requests/2109 You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/4-7h0j5clq3t48jyhjthnp7kl4p-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Thu May 28 15:50:49 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Thu, 28 May 2026 13:50:49 +0000 Subject: [gnutls-devel] GnuTLS | DEFAULT_MAX_VERIFY_DEPTH value misaligned with documentation (#1892) References: Message-ID: Issue created by Satya Jhaveri: https://gitlab.com/gnutls/gnutls/-/work_items/1892 ## Summary: The documentation for `gnutls_certificate_set_verify_limits()` (in `lib/cert-session.c`) states that the default for `max_depth` is 5. However, in `lib/gnutls_int.h`, the default is set to 16: `#define DEFAULT_MAX_VERIFY_DEPTH 16` . ## Recommended Fix: The documentation for the `gnutls_certificate_set_verify_limits()` function in `lib/cert-session.c` should be corrected to align with the true default value. -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/work_items/1892 You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/5-djvboksysoikg0d5pv5s1y1vn-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help -------------- next part -------------- An HTML attachment was scrubbed... URL: From gnutls-devel at lists.gnutls.org Thu May 28 16:12:00 2026 From: gnutls-devel at lists.gnutls.org (Read-only notification of GnuTLS library development activities) Date: Thu, 28 May 2026 14:12:00 +0000 Subject: [gnutls-devel] GnuTLS | Consider aligning with OpenSSL's default of 100 for max certificate chain verify depth (#1893) References: Message-ID: Issue created by Satya Jhaveri: https://gitlab.com/gnutls/gnutls/-/work_items/1893 ## Description: The default of 16 for max verify depth is too low for some real-world chains. The constraint is triggered in `_gnutls_x509_cert_verify_peers`: ```c if (info->ncerts > cred->verify_depth && cred->verify_depth > 0) { gnutls_assert(); return GNUTLS_E_CONSTRAINT_ERROR; } ``` A chain with more than 16 certificates causes `GNUTLS_E_CONSTRAINT_ERROR` (-101),which surfaces to applications as a verification failure. The value of 16 is used as a defense against DOS attacks. I'm asking what the motivation for the choice of 16 as a threshold is. OpenSSL defaults to 100, and there are legitimate chains that exceed 16 certificates in length. A limit of 100 still provides meaningful DoS protection, while avoiding breaking real-world deployments. I'd welcome the maintainer's view on where the right balance for this lies. ## Version of gnutls used: 3.73 ## Distributor of gnutls: Ubuntu (22.04.5 LTS) ## How reproducible: Steps to Reproduce: * Generate a root CA, an intermediate CA cross-signed by over 16 alternate roots, and a leaf certificate * Serve the full chain and attempt to connect via any client using GnuTLS * The connection will fail with error -101 -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/work_items/1893 You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/5-dg2eqoezg1ux5bhi6aa4sztdk-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help -------------- next part -------------- An HTML attachment was scrubbed... URL: