meson.build | 11 ++++++++++- crypto/cipher.c | 2 +- tests/unit/test-crypto-block.c | 3 ++- crypto/meson.build | 2 +- 4 files changed, 14 insertions(+), 4 deletions(-)
c4b3d0074 removed the check that nettle or gcrypt were explicitly
requested as the crypto library to use, breaking the --enable-nettle and
--enable-gcrypt options. Re-add the logic to force usage of nettle or
gcrypt for crypto operations, while still keeping gnutls for TLS.
Fixes: c4b3d0074 (crypto: bump min gnutls to 3.7.5)
Signed-off-by: Luc Michel <luc.michel@amd.com>
---
v2:
- Revert more of c4b3d0074 to restore the gnutls_crypto logic to
disable gnutls only for crypto ops but keep it for TLS [Daniel]
---
meson.build | 11 ++++++++++-
crypto/cipher.c | 2 +-
tests/unit/test-crypto-block.c | 3 ++-
crypto/meson.build | 2 +-
4 files changed, 14 insertions(+), 4 deletions(-)
diff --git a/meson.build b/meson.build
index 164328ded83..06c43b43581 100644
--- a/meson.build
+++ b/meson.build
@@ -1781,15 +1781,17 @@ if not get_option('libcbor').auto() or have_system
libcbor = dependency('libcbor', version: '>=0.7.0',
required: get_option('libcbor'))
endif
gnutls = not_found
+gnutls_crypto = not_found
gnutls_bug1717_workaround = false
if get_option('gnutls').enabled() or (get_option('gnutls').auto() and have_system)
gnutls = dependency('gnutls', version: '>=3.7.5',
method: 'pkg-config',
required: get_option('gnutls'))
+ gnutls_crypto = gnutls
#if gnutls.found() and not get_option('gnutls-bug1717-workaround').disabled()
# XXX: when bug 1717 is resolved, add logic to probe for
# the GNUTLS fixed version number to handle the 'auto' case
# gnutls_bug1717_workaround = true
@@ -1809,11 +1811,16 @@ crypto_sm3 = not_found
if get_option('nettle').enabled() and get_option('gcrypt').enabled()
error('Only one of gcrypt & nettle can be enabled')
endif
-if not gnutls.found()
+# Explicit nettle/gcrypt request, so ignore gnutls for crypto
+if get_option('nettle').enabled() or get_option('gcrypt').enabled()
+ gnutls_crypto = not_found
+endif
+
+if not gnutls_crypto.found()
if (not get_option('gcrypt').auto() or have_system) and not get_option('nettle').enabled()
gcrypt = dependency('libgcrypt', version: '>=1.9.4',
required: get_option('gcrypt'))
# Debian has removed -lgpg-error from libgcrypt-config
# as it "spreads unnecessary dependencies" which in
@@ -2511,10 +2518,11 @@ config_host_data.set('CONFIG_VIRTFS', have_virtfs)
config_host_data.set('CONFIG_VTE', vte.found())
config_host_data.set('CONFIG_XKBCOMMON', xkbcommon.found())
config_host_data.set('CONFIG_KEYUTILS', keyutils.found())
config_host_data.set('CONFIG_GETTID', has_gettid)
config_host_data.set('CONFIG_GNUTLS', gnutls.found())
+config_host_data.set('CONFIG_GNUTLS_CRYPTO', gnutls_crypto.found())
config_host_data.set('CONFIG_GNUTLS_BUG1717_WORKAROUND', gnutls_bug1717_workaround)
config_host_data.set('CONFIG_TASN1', tasn1.found())
config_host_data.set('CONFIG_GCRYPT', gcrypt.found())
config_host_data.set('CONFIG_NETTLE', nettle.found())
config_host_data.set('CONFIG_CRYPTO_SM4', crypto_sm4.found())
@@ -4863,10 +4871,11 @@ summary(summary_info, bool_yn: true, section: 'Block layer support')
# Crypto
summary_info = {}
summary_info += {'TLS priority': get_option('tls_priority')}
summary_info += {'GNUTLS support': gnutls}
if gnutls.found()
+ summary_info += {' GNUTLS crypto': gnutls_crypto.found()}
summary_info += {' GNUTLS bug 1717 workaround': gnutls_bug1717_workaround }
endif
summary_info += {'libgcrypt': gcrypt}
summary_info += {'nettle': nettle}
summary_info += {'SM4 ALG support': crypto_sm4}
diff --git a/crypto/cipher.c b/crypto/cipher.c
index 515165e0dc0..229710f76b4 100644
--- a/crypto/cipher.c
+++ b/crypto/cipher.c
@@ -140,11 +140,11 @@ qcrypto_cipher_validate_key_length(QCryptoCipherAlgo alg,
#ifdef CONFIG_GCRYPT
#include "cipher-gcrypt.c.inc"
#elif defined CONFIG_NETTLE
#include "cipher-nettle.c.inc"
-#elif defined CONFIG_GNUTLS
+#elif defined CONFIG_GNUTLS_CRYPTO
#include "cipher-gnutls.c.inc"
#else
#include "cipher-stub.c.inc"
#endif
diff --git a/tests/unit/test-crypto-block.c b/tests/unit/test-crypto-block.c
index 218e585f988..3ac7f17b2a0 100644
--- a/tests/unit/test-crypto-block.c
+++ b/tests/unit/test-crypto-block.c
@@ -29,11 +29,12 @@
#ifndef _WIN32
#include <sys/resource.h>
#endif
#if (defined(_WIN32) || defined RUSAGE_THREAD) && \
- (defined(CONFIG_NETTLE) || defined(CONFIG_GCRYPT))
+ (defined(CONFIG_NETTLE) || defined(CONFIG_GCRYPT) || \
+ defined(CONFIG_GNUTLS_CRYPTO))
#define TEST_LUKS
#else
#undef TEST_LUKS
#endif
diff --git a/crypto/meson.build b/crypto/meson.build
index b51597a8792..6ac83857aaa 100644
--- a/crypto/meson.build
+++ b/crypto/meson.build
@@ -36,11 +36,11 @@ if nettle.found()
if hogweed.found()
crypto_ss.add(gmp, hogweed)
endif
elif gcrypt.found()
crypto_ss.add(gcrypt, files('hash-gcrypt.c', 'hmac-gcrypt.c', 'pbkdf-gcrypt.c'))
-elif gnutls.found()
+elif gnutls_crypto.found()
crypto_ss.add(gnutls, files('hash-gnutls.c', 'hmac-gnutls.c', 'pbkdf-gnutls.c'))
else
crypto_ss.add(files('hash-glib.c', 'hmac-glib.c', 'pbkdf-stub.c'))
endif
--
2.53.0On 7/10/2026 6:25 AM, Luc Michel wrote: > c4b3d0074 removed the check that nettle or gcrypt were explicitly > requested as the crypto library to use, breaking the --enable-nettle and > --enable-gcrypt options. Re-add the logic to force usage of nettle or > gcrypt for crypto operations, while still keeping gnutls for TLS. > > Fixes: c4b3d0074 (crypto: bump min gnutls to 3.7.5) > Signed-off-by: Luc Michel <luc.michel@amd.com> > --- > v2: > - Revert more of c4b3d0074 to restore the gnutls_crypto logic to > disable gnutls only for crypto ops but keep it for TLS [Daniel] > --- > meson.build | 11 ++++++++++- > crypto/cipher.c | 2 +- > tests/unit/test-crypto-block.c | 3 ++- > crypto/meson.build | 2 +- > 4 files changed, 14 insertions(+), 4 deletions(-) > Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
© 2016 - 2026 Red Hat, Inc.