Author: Zoltan Fridrich <zfridric@redhat.com>
Date:   Wed Mar 16 15:42:40 2022 +0100

    Release 3.7.4
    
    Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>

Author: Zoltan Fridrich <zfridric@redhat.com>
Date:   Tue Mar 8 18:01:37 2022 +0100

    Make gnutls compliant to RFC5280
    
    Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Mon Mar 14 16:03:07 2022 +0100

    cli, serv: allow multiple --compress-cert options
    
    This eliminates the need of parsing the comma separated list manually.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Tobias Heider <tobias.heider@canonical.com>
Date:   Sun Mar 13 23:58:42 2022 +0100

    Handle all cases of calloc returning NULL.
    
    Signed-off-by: Tobias Heider <tobias.heider@canonical.com>

Author: František Krenželok <krenzelok.frantisek@gmail.com>
Date:   Fri Mar 11 18:22:18 2022 +0100

    Fix global-ini-handler
    
    Signed-off-by: Frantisek Krenzelok <krenzelok.frantisek@gmail.com>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Thu Feb 10 15:58:08 2022 +0100

    Make option specification type-safe
    
    This switches the CLI code and documentation generation to the
    external cligen module, which provides more type-safe specification.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Tobias Heider <tobias.heider@canonical.com>
Date:   Wed Mar 9 01:18:20 2022 +0100

    fips: use GNUTLS_FIPS140_STRICT instead of magic number.
    
    Signed-off-by: Tobias Heider <tobias.heider@canonical.com>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Wed Mar 9 08:07:58 2022 +0100

    locks: define lock functions as a macro
    
    When threads are not supported, glthread_* functions are defined as
    no-op and thus dereferencing lock variables in inline functions will
    cause compilation error.  This change fixes it by redefining our lock
    functions as a macro so it will also be compiled out.
    
    Reported by Fabrice Fontaine in:
    https://gitlab.com/gnutls/gnutls/-/issues/1330
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Wed Mar 9 07:25:01 2022 +0100

    .gitlab-ci.yml: prolong timeout for slow CI jobs
    
    Suggested by Marvin Scholz in:
    https://gitlab.com/gnutls/gnutls/-/merge_requests/1543#note_859825412
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Wed Feb 23 19:48:52 2022 +0100

    tpm2: dynamically load tss2 libraries as needed
    
    libtss2-esys links to OpenSSL or mbed TLS for cryptography, which may
    cause packaging issues.  This instead dlopen's tss2 libraries as
    needed so non-TPM applications continue working without loading
    multiple crypto libraries.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Zoltan Fridrich <zfridric@redhat.com>
Date:   Wed Jan 12 14:57:42 2022 +0100

    Add compress_certificate extension (RFC8879)
    
    Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>

Author: Craig Gallek <cgallek@gmail.com>
Date:   Sun Feb 27 10:39:07 2022 -0500

    x509: fix return error code for failed decryption without key
    
    Decrypting an encrypted private key previously returned
    GNUTLS_E_DECRYPTION_FAILED when no password was supplied.  This changed when
    decryption via pin callbacks was added in d31b89de.
    
    That change should have included a check for callback existence in order to
    preserve the error path of the no-password case.
    
    This adds the check and a test for the previous behavior.
    Resolves bug #1321
    
    Signed-off-by: Craig Gallek <cgallek@gmail.com>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Thu Feb 24 09:55:01 2022 +0100

    gnutls_record_send_file: make it work with non-blocking I/O
    
    When either read() or gnutls_record_send() returns EAGAIN, just return
    to the caller so it can call this function again, instead of retrying
    internally.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Marvin Scholz <epirat07@gmail.com>
Date:   Wed Feb 23 19:03:51 2022 +0100

    configure.ac: add missing Libs.private for macOS
    
    On macOS the CoreFoundation and Security frameworks are used by
    GnuTLS, however those were missing in the Libs.private in the .pc
    resulting in link failures with static builds when relying on the
    output of pkg-config --static.
    
    Signed-off-by: Marvin Scholz <epirat07@gmail.com>

Author: František Krenželok <krenzelok.frantisek@gmail.com>
Date:   Wed Feb 16 11:25:11 2022 +0100

    non-KTLS sendfile test
    
    Signed-off-by: Frantisek Krenzelok <krenzelok.frantisek@gmail.com>

Author: František Krenželok <krenzelok.frantisek@gmail.com>
Date:   Wed Feb 16 11:23:36 2022 +0100

    non-KTLS sendfile
    
    Added: sendfile API functionality for non KTLS enabled builds.
    Signed-off-by: Frantisek Krenzelok <krenzelok.frantisek@gmail.com>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Tue Feb 22 17:09:46 2022 +0100

    algorithms: ensure _list() exclude non-existing algorithms
    
    This aligns the behavior of _list() function for sign/pk to the one
    for cipher/mac: the former previously returned all the algorithms
    defined, while the latter returns only algorithms compiled in.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Tue Feb 22 17:25:26 2022 +0100

    Revert "algorithms: compile out GOST algorithm IDs if they are disabled"
    
    This reverts commit aa94bcbdaa55899f4f4ae13dc3e9a8c559354676.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: František Krenželok <krenzelok.frantisek@gmail.com>
Date:   Wed Feb 16 11:22:47 2022 +0100

    auto-generated files update
    
    Signed-off-by: Frantisek Krenzelok <krenzelok.frantisek@gmail.com>

Author: František Krenželok <krenzelok.frantisek@gmail.com>
Date:   Tue Nov 16 12:05:53 2021 +0100

    ktls: sendfile
    
    added API function: gnutls_record_send_file().
    added: _gnutls_ktls_send_file() function which increases the performance
    by offloading the file encryption to kernel, thus the data never goes
    to userspace.
    updated tests/gnutls_ktls to cover new API
    
    Signed-off-by: Frantisek Krenzelok <krenzelok.frantisek@gmail.com>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Mon Feb 21 16:36:32 2022 +0100

    algorithms: compile out GOST algorithm IDs if they are disabled
    
    When compiled with --disable-gost, gnutls-cli --list still prints GOST
    algorithms for public key systems and signatures.  This change adds
    compile time checks to suppress them.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Alexander Sosedkin <asosedkin@redhat.com>
Date:   Mon Feb 21 18:19:25 2022 +0100

    lib/algorithms: add UB warnings on late allowlisting API invocations
    
    Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

Author: Alexander Sosedkin <asosedkin@redhat.com>
Date:   Mon Feb 14 13:48:37 2022 +0100

    lib/priority: defer setting system-wide priority string
    
    Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

Author: Alexander Sosedkin <asosedkin@redhat.com>
Date:   Mon Feb 14 12:44:57 2022 +0100

    lib/priority: split up update_system_wide_priority_string
    
    This is done in preparation for deferring priority string evaluation.
    
    Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Mon Feb 21 16:28:49 2022 +0100

    priority: compile out GOST algorithms IDs if they are disabled
    
    When compiled with --disable-gost, gnutls-cli --priority NORMAL --list
    still prints GOST algorithms for ciphers, MACs, and signatures.  This
    change adds compile time checks to suppress them.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Alexander Sosedkin <asosedkin@redhat.com>
Date:   Fri Feb 18 11:05:15 2022 +0100

    bump GNUTLS_MAX_ALGORITHM_NUM / MAX_ALGOS
    
    Fedora 36 LEGACY crypto-policy uses allowlisting format
    and is long enough to blow past the 64 priority string
    elements mark, causing, effectively, priority string truncation.
    
    Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

Author: Dimitris Apostolou <dimitris.apostolou@icloud.com>
Date:   Thu Feb 17 17:35:59 2022 +0200

    Fix typos
    
    Signed-off-by: Dimitris Apostolou <dimitris.apostolou@icloud.com>

Author: Zoltan Fridrich <zfridric@redhat.com>
Date:   Thu Feb 17 11:46:29 2022 +0100

    Disable some tests in fips mode
    
    Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Thu Feb 10 17:35:13 2022 +0100

    _gnutls_pkcs_raw_{decrypt,encrypt}_data: use public crypto API
    
    These functions previously used the internal crypto
    API (_gnutls_cipher_*) which does not have algorithm checks for FIPS.
    
    This change switches the code to use the public crypto
    API (gnutls_cipher_*) to trigger proper state transitions under FIPS
    mode.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Thu Feb 10 16:43:08 2022 +0100

    pkcs12: mark MAC generation and verification as FIPS non-approved
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Tue Feb 15 17:38:20 2022 +0100

    gnutls_transport_is_ktls_enabled: fix return value of stub
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Wed Jan 12 10:37:53 2022 +0100

    gnutls_ciphersuite_get: new function to get unique ciphersuite name
    
    The existing method to obtain the name of the currently negotiated TLS
    ciphersuite is as follows:
    
    - call gnutls_cipher_get, gnutls_mac_get, gnutls_kx_get
    - call gnutls_cipher_suite_get_name with the value from the above functions
    
    This process is cumbersome and only works with TLS 1.2 or earlier;
    moreover the returned names are GnuTLS specific.
    
    This change adds a new function gnutls_ciphersuite_get to eliminate
    those limitations.  It returns the "canonical" name of the
    ciphersuite, which is mostly identical to the ones registered in IANA,
    with an exception for compatibility.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Mon Dec 20 09:28:10 2021 +0100

    tls-fuzzer: prolong timeout for FFDHE tests
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Fri Nov 26 20:03:15 2021 +0100

    .gitlab-ci.yml: prolong timeout for fedora-nettle-minigmp/test
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Fri Nov 26 09:37:58 2021 +0100

    .gitlab-ci.yml: fix nettle installation path
    
    .fedora-nettle/build clones the nettle into "nettle-git" and
    temporarily change the working directory while buidling it.  After
    moving back to the original working directory, the installation path
    should be prefixed with "${PWD}/nettle-git/".
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Tue Feb 1 15:19:52 2022 +0100

    certtool --generate-privkey: update warnings on RSA key sizes
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Thu Jan 27 18:17:43 2022 +0100

    rsa_generate_fips186_4_keypair: accept a few more modulus sizes
    
    While _rsa_generate_fips186_4_keypair was modified to accept modulus
    sizes other than 2048 and 3076, rsa_generate_fips186_4_keypair, which
    calls that function, was not updated to accept such modulus sizes.
    
    Spotted by Alexander Sosedkin.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Fri Jan 7 11:24:36 2022 +0100

    .gitlab-ci.yml: update Fedora images to Fedora 35
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Seppo Yli-Olli <seppo.yliolli@gmail.com>
Date:   Mon Jan 31 18:32:28 2022 +0200

    Bump libgnutlsxx soname due to ABI break
    
    db_check_entry and db_check_entry now have const parameters
    
    Signed-off-by: Seppo Yli-Olli <seppo.yliolli@gmail.com>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Fri Jan 28 07:49:42 2022 +0100

    configure.ac: make --with-tpm and --with-tpm2 independent
    
    These features are not mutually exclusive, so it doesn't make sense to
    disable the TPM 1.2 support with TPM 2.0 support.
    
    Reported by Jan Palus in:
    https://gitlab.com/gnutls/gnutls/-/issues/1313
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Fri Jan 28 12:50:56 2022 +0100

    gen-getopt.py: avoid struct member name clash with C keywords
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Fri Jan 28 07:55:25 2022 +0100

    tests: tcp_connect: avoid resource leak on error path
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Fri Jan 28 08:48:47 2022 +0100

    README.md: fix versions in build status and add 3.6.x
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Jan Palus <jpalus@fastmail.com>
Date:   Fri Jan 28 11:07:02 2022 +0100

    ktls: fix _gnutls_ktls_send_control_msg return value
    
    always returned 0 on success while contract mandates to return number of
    bytes sent
    
    Fixes #1314
    
    Signed-off-by: Jan Palus <jpalus@fastmail.com>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Fri Jan 28 06:35:45 2022 +0100

    release-steps: fix markup
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: František Krenželok <krenzelok.frantisek@gmail.com>
Date:   Thu Jan 27 13:54:21 2022 +0100

    KTLS: hotfix
    
    fixed: keys will be set only when both sockets were enabled for ktls
    fixed: session->internals.ktls_enabled left uninitialized for non
    ktls-enabled build
    
    Signed-off-by: Frantisek Krenzelok <krenzelok.frantisek@gmail.com>

Author: Alexander Sosedkin <asosedkin@redhat.com>
Date:   Wed Jan 26 16:25:01 2022 +0100

    lib/accelerated: use unlikely on buffer length checks more consistently
    
    Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

Author: Alexander Sosedkin <asosedkin@redhat.com>
Date:   Wed Jan 26 16:15:36 2022 +0100

    lib/accelerated: rearranged several size checks to avoid overflow
    
    Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

Author: Alexander Sosedkin <asosedkin@redhat.com>
Date:   Tue Jan 25 12:32:59 2022 +0100

    tests/scripts/common: fix skipping over x86-specific tests
    
    Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

Author: Alexander Sosedkin <asosedkin@redhat.com>
Date:   Tue Jan 25 13:37:55 2022 +0100

    tests/slow/test-hash-large: output GNUTLS_CPUID_OVERRIDE hints
    
    Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

Author: Alexander Sosedkin <asosedkin@redhat.com>
Date:   Tue Jan 25 13:46:46 2022 +0100

    tests/slow/cipher-api-test: add happy paths, specific error checks etc
    
    Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

Author: Alexander Sosedkin <asosedkin@redhat.com>
Date:   Tue Jan 25 13:36:19 2022 +0100

    lib/accelerated: report GNUTLS_E_SHORT_MEMORY_BUFFER in many places
    
    Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

Author: Alexander Sosedkin <asosedkin@redhat.com>
Date:   Mon Jan 24 17:37:24 2022 +0100

    .gitlab-ci.yml: enable hardware acceleration in UB+ASAN jobs
    
    Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

Author: Alexander Sosedkin <asosedkin@redhat.com>
Date:   Mon Jan 24 17:34:35 2022 +0100

    tests/slow/cipher-api-test: actually test for short buffer...
    
    ... avoiding the case when different failures mask the intended one
    
    Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

Author: Alexander Sosedkin <asosedkin@redhat.com>
Date:   Mon Jan 24 17:33:48 2022 +0100

    lib/accelerated/x86/aes-gcm-x86-pclmul-avx: add short buffer checks
    
    Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

Author: Andreas Metzler <ametzler@debian.org>
Date:   Sun Jan 23 13:40:17 2022 +0100

    testsuite: Fix endless loop on /bin/sh without $RANDOM
    
    Closes #1315
    Signed-off-by: Andreas Metzler <ametzler@bebt.de>

Author: Andreas Metzler <ametzler@debian.org>
Date:   Sun Jan 23 07:52:21 2022 +0100

    testsuite: Fix missed instances of &> redirection
    
    Signed-off-by: Andreas Metzler <ametzler@bebt.de>

Author: Andreas Metzler <ametzler@debian.org>
Date:   Fri Jan 21 18:25:52 2022 +0100

    Avoid &> redirection bashism in testsuite
    
    Signed-off-by: Andreas Metzler <ametzler@bebt.de>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Mon Jan 17 16:48:10 2022 +0100

    Release 3.7.3
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Tue Jan 18 06:43:07 2022 +0100

    tests: privkey-keygen: fix memory leak
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Sat Oct 30 08:56:07 2021 +0200

    x509: fix thread-safety in gnutls_x509_trust_list_verify_crt2
    
    This function previously used gnutls_x509_trust_list_get_issuer
    without GNUTLS_TL_GET_COPY flag, which is required when the function
    is called from multi-threaded application and PKCS #11 trust store is
    in use.
    
    Reported and the change suggested by Remi Gacogne in:
    https://gitlab.com/gnutls/gnutls/-/issues/1277
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Sun Jan 16 07:57:02 2022 +0100

    cli: add --list-config option
    
    With this option gnutls-cli prints the build-time configuration of the
    library, retrieved through gnutls_get_library_config.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Tue Jan 11 07:36:27 2022 +0100

    fips: add build option to embed FIPS module info in library config
    
    This adds a couple of configure options, --with-fips140-module-name
    and --with-fips140-module-version, which packagers can use to embed
    FIPS module information in the library.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Tue Jan 11 07:34:59 2022 +0100

    global: add API to retrieve library configuration at run time
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Sun Jan 16 12:17:39 2022 +0100

    configure.ac: emit feature summary as C macro
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Sun Jan 16 16:19:53 2022 +0100

    tests: suppress GCC -fanalyzer warnings
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Sun Jan 16 16:00:10 2022 +0100

    .gitignore: ignore more files
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Sun Jan 16 15:59:01 2022 +0100

    src: avoid overriding noinst_PROGRAMS
    
    In src, we now have two helper programs: systemkey and dumpcfg.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Thu Jan 13 14:30:02 2022 +0100

    build: hide maintainer tool invocation behind AM_V_GEN
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Alexander Sosedkin <asosedkin@redhat.com>
Date:   Thu Jan 13 14:35:07 2022 +0100

    tests: use more aliases in tests for better alias testing coverage
    
    Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Fri Jan 7 10:02:32 2022 +0100

    .gitlab-ci.yml: run static analyzers on Python files
    
    This runs a couple of code analysis on the Python scripts added to
    remove AutoGen dependency.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Fri Jan 7 09:58:11 2022 +0100

    .gitlab-ci.yml: bump cache key for python3 detection
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Wed Jan 5 08:09:36 2022 +0100

    README.md: mention Python as requirement instead of AutoGen
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Wed Jan 5 07:39:10 2022 +0100

    src: remove AutoGen .def files
    
    As neither the tools nor documentation depends on AutoGen, we don't
    need to include the AutoGen definition files.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Wed Jan 5 07:24:03 2022 +0100

    doc: generate man-pages from JSON
    
    This replaces man-pages generation previously provided by the autogen
    -Tagman.tpl command with a Python script (gen-cmd-man.py).
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Tue Jan 4 09:06:21 2022 +0100

    doc: generate texinfo files from JSON
    
    This replaces texinfo generation previously provided by the autogen
    -Tagtexi.tpl command with a Python script (gen-cmd-texi.py).
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Mon Jan 3 11:02:43 2022 +0100

    src: remove included copy of libopts
    
    As no tools link with libopts anymore, we don't need to include it in
    the distribution.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Mon Jan 3 10:30:34 2022 +0100

    src: replace autoopts/libopts with minimal config parser
    
    This replaces configuration file parsing code previously provided by
    <autoopts/options.h>, with a minimal compatible implementation.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Fri Dec 31 18:13:58 2021 +0100

    src: generate option handling code from JSON
    
    This replaces AutoGen based command-line parser with a Python
    script (gen-getopt.py), which takes JSON description as the input.
    The included JSON files were converted one-off using the parse-autogen
    program: https://gitlab.com/dueno/parse-autogen.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Tue Jan 4 15:18:26 2022 +0100

    python: add library for handling JSON-based option description
    
    This adds the jsonopts Python module used by the command-line parser
    generator and documentation generators in the following commits.  This
    also bumps the required Python interpreter version to 3.6.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>
    Co-authored-by: Alexander Sosedkin <asosedkin@redhat.com>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Thu Jan 13 09:36:52 2022 +0100

    pkcs12: use the correct MAC algorithm for GOST key generation
    
    According to the latest TC-26 requirements, the MAC algorithm used for
    PBKDF2 should always be HMAC_GOSTR3411_2012_512.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Wed Jan 12 08:15:24 2022 +0100

    tests: simple: check if the digest algorithm is compiled in
    
    When the library is built with --disable-gost, gnutls_digest_get_id
    returns GNUTLS_DIG_UNKNOWN for GOST algorithms.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Tue Jan 11 14:07:56 2022 +0100

    x509: fix potential wrong usage of memcpy
    
    Spotted by GCC analyzer:
    
      common.c:552:17: warning: use of NULL 'out.data' where non-null expected [CWE-476] [-Wanalyzer-null-argument]
        552 |                 memcpy(output_data, out.data, (size_t) out.size);
            |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Sun Jan 9 08:34:52 2022 +0100

    cert-auth: suppress false-positive warnings with GCC analyzer
    
    When compiled with gcc -fanalyzer, it reports:
    
      cert.c: In function '_gnutls_pcert_to_auth_info':
      cert.c:85:17: error: dereference of NULL 'info' [CWE-476] [-Werror=analyzer-null-dereference]
         85 |         if (info->raw_certificate_list != NULL) {
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Fri Jan 7 17:48:22 2022 +0100

    gnutls_pkcs12_generate_mac: use SHA256 by default
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Mon Dec 20 16:16:23 2021 +0100

    .gitlab-ci.yml: reduce PKCS#12 iteration count while testing
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Tue Dec 21 15:02:45 2021 +0100

    tests: check algorithms for generating PKCS#12 file
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Sun Dec 26 17:40:42 2021 +0100

    cipher-api-test: mention why it is written using fork
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Tue Nov 23 15:23:34 2021 +0100

    fips: plumb service indicator to symmetric key crypto operations
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>
    Co-authored-by: Pedro Monreal <pmonrealgonzalez@suse.de>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Tue Aug 31 13:29:45 2021 +0200

    fips: plumb service indicator to public key crypto operations
    
    This installs service indicator state transitions in certain public
    key operations in gnutls_crypto_pk_st, namely:
    
    * fallible operations
      - encrypt
      - sign
      - generate_keys
      - derive
    
    * infallible operations
      - decrypt, decrypt2
      - verify
    
    other operations, such as generate_params, are not considered as
    crypto operation.  Note that fallible operations above mean that those
    return value could indicate error, while infallible operations do not
    have distinction between errors and failures: decrypt/verify failures
    are treated as a successful completion of the operation.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>
    Co-authored-by: Pedro Monreal <pmonrealgonzalez@suse.de>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Tue Dec 21 15:17:55 2021 +0100

    _gnutls_pkcs_generate_key: use HMAC-SHA256 for PBKDF2
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Mon Dec 20 16:34:30 2021 +0100

    pkcs12: determine iteration count for MAC at build time
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Mon Dec 20 16:13:06 2021 +0100

    pkcs7: determine iteration count for PBKDF2 at build time
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Mon Dec 20 15:56:24 2021 +0100

    certtool: --to-p12: use modern algorithms by default
    
    Currently certtool uses PKCS12-3DES-SHA1 for encrypting keys in
    PKCS#12, while it is suggested to migrate to more modern algorithms,
    namely AES-128-CBC with PBKDF2 and SHA-256:
    https://bugzilla.redhat.com/show_bug.cgi?id=1759982
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Fri Jul 23 10:31:08 2021 +0200

    fips: add functions to inspect thread-local FIPS operation state
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Andreas Metzler <ametzler@debian.org>
Date:   Thu Jan 6 07:17:01 2022 +0100

    Drop unquoted angle brackets in gtk-doc comment.
    
    Signed-off-by: Andreas Metzler <ametzler@bebt.de>

Author: Andreas Metzler <ametzler@debian.org>
Date:   Thu Jan 6 07:15:31 2022 +0100

    Fix gtk-doc build, use http URI in sgml master.
    
    Signed-off-by: Andreas Metzler <ametzler@bebt.de>

Author: Alon Bar-Lev <alon.barlev@gmail.com>
Date:   Sat Jan 1 21:12:51 2022 +0200

    p11tool: add --mark-always-authenticate option
    
    Signed-off-by: Alon Bar-Lev <alon.barlev@gmail.com>

Author: Alon Bar-Lev <alon.barlev@gmail.com>
Date:   Sun Jan 2 19:31:33 2022 +0200

    doc: updated copyrights for 2022
    
    Signed-off-by: Alon Bar-Lev <alon.barlev@gmail.com>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Thu Nov 18 19:02:03 2021 +0100

    accelerated: fix CPU feature detection for Intel CPUs
    
    This fixes read_cpuid_vals to correctly read the CPUID quadruple, as
    well as to set the bit the ustream CRYPTOGAMS uses to identify Intel
    CPUs.
    
    Suggested by Rafael Gieschke in:
    https://gitlab.com/gnutls/gnutls/-/issues/1282
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Wed Dec 22 17:00:03 2021 +0100

    padlock: reset _gnutls_x86_cpuid_s only after padlock check succeeds
    
    Otherwise it clears _gnutls_x86_cpuid_s which may already hold valid
    CPUID detected for Intel and AMD CPUs.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Wed Dec 22 09:12:25 2021 +0100

    wrap_nettle_hash_fast: avoid calling _update with zero-length input
    
    As Nettle's hash update functions internally call memcpy, providing
    zero-length input may cause undefined behavior.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Wed Dec 22 08:22:04 2021 +0100

    gnutls_{hash,hmac}_copy: mention the functions do not always work
    
    It is known that some built-in accelerated implementation, such as
    AF_ALG, does not support copying hash/hmac contexts.  This expands the
    documentation to suggest checking the return value of those functions.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Alexander Sosedkin <asosedkin@redhat.com>
Date:   Mon Dec 20 17:47:36 2021 +0100

    tests: extend system-override-curves-allowlist with key generation
    
    Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

Author: Alexander Sosedkin <asosedkin@redhat.com>
Date:   Mon Dec 20 16:50:59 2021 +0100

    tests: tweak system-override-curves-allowlist insignificantly
    
    Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

Author: Alexander Sosedkin <asosedkin@redhat.com>
Date:   Fri Dec 17 18:49:27 2021 +0100

    README: document tpm2-tss-engine test dependency
    
    Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

Author: Alexander Sosedkin <asosedkin@redhat.com>
Date:   Thu Dec 16 12:46:38 2021 +0100

    use sha384_digest in lib/accelerated/aarch64/sha-aarch64.c sha384
    
    Mirrors https://gitlab.com/gnutls/gnutls/-/merge_requests/1466
    
    Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

Author: František Krenželok <krenzelok.frantisek@gmail.com>
Date:   Thu Dec 2 16:35:31 2021 +0100

    ktls: flags
    
    ktls enum flags API
    
    Signed-off-by: Frantisek Krenzelok <krenzelok.frantisek@gmail.com>

Author: František Krenželok <krenzelok.frantisek@gmail.com>
Date:   Fri Oct 15 15:00:17 2021 +0200

    KTLS: API
    
    ktls is enabled by default, we can check if inicialization was
    succesfull with gnutls_transport_is_ktls_enabled
    
    Signed-off-by: Frantisek Krenzelok <krenzelok.frantisek@gmail.com>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Thu Dec 9 11:22:14 2021 +0100

    .gitignore: ignore tests/x509cert-ct
    
