[rpms/glib2] cve-2026-58016-f44: Drop FIPS mode test, again

[rpms/glib2] cve-2026-58016-f44: Drop FIPS mode test, again

[Yaakov Selkowitz]

            A new commit has been pushed.

            Repo   : rpms/glib2
            Branch : cve-2026-58016-f44
            Commit : c1041a3f2b683c61c9184b749d10568c2d1a0aab
            Author : Yaakov Selkowitz <yselkowi@redhat.com>
            Date   : 2025-01-22T16:53:30-05:00
            Stats  : +38/-83 in 1 file(s)
            URL    : https://src.fedoraproject.org/rpms/glib2/c/c1041a3f2b683c61c9184b749d10568c2d1a0aab?branch=cve-2026-58016-f44

            Log:
            Drop FIPS mode test, again

This reinstates the changes to gnutls-hmac.patch from commit
0ccd11553a0f13ee179b95bc6a35485510795767 ("Drop FIPS mode test"),
updating it for 2.83.2.

---
diff --git a/gnutls-hmac.patch b/gnutls-hmac.patch
index f01fb9c..0332173 100644
--- a/gnutls-hmac.patch
+++ b/gnutls-hmac.patch
@@ -1,4 +1,4 @@
-From 9ef5cacbf93640434b4d4ac425f87efb79aacc5d Mon Sep 17 00:00:00 2001
+From 79c6d81cad24e488c8c17fb5043f29fef11a245e Mon Sep 17 00:00:00 2001
 From: Colin Walters <walters@verbum.org>
 Date: Fri, 7 Jun 2019 18:44:43 +0000
 Subject: [PATCH 1/4] ghmac: Split off wrapper functions into ghmac-utils.c
@@ -284,7 +284,7 @@ index 97e2fff90..de89d826d 100644
 -                                  (const guchar *) str, length);
 -}
 diff --git a/glib/meson.build b/glib/meson.build
-index b5545b63b..c631a8a0a 100644
+index d2efebadc..d261dde5a 100644
 --- a/glib/meson.build
 +++ b/glib/meson.build
 @@ -289,6 +289,7 @@ glib_sources += files(
@@ -299,7 +299,7 @@ index b5545b63b..c631a8a0a 100644
 2.45.2
 
 
-From 3ef71255bb2ff257830643b7de6e257174b0898d Mon Sep 17 00:00:00 2001
+From 6be9a415a7af65a2cee5518e87a3f313068a2e0e Mon Sep 17 00:00:00 2001
 From: Colin Walters <walters@verbum.org>
 Date: Fri, 7 Jun 2019 19:36:54 +0000
 Subject: [PATCH 2/4] Add a gnutls backend for GHmac
@@ -660,7 +660,7 @@ index de89d826d..616e167e7 100644
   *   Use g_hmac_unref() to free the memory allocated by it.
   *
 diff --git a/glib/meson.build b/glib/meson.build
-index c631a8a0a..c5f6c1680 100644
+index d261dde5a..b3663f184 100644
 --- a/glib/meson.build
 +++ b/glib/meson.build
 @@ -288,7 +288,6 @@ glib_sources += files(
@@ -693,7 +693,7 @@ index c631a8a0a..c5f6c1680 100644
  pcre2_static_args = []
  
  if use_pcre2_static_flag
-@@ -422,6 +429,7 @@ libglib = library('glib-2.0',
+@@ -421,6 +428,7 @@ libglib = library('glib-2.0',
    dependencies : [
      atomic_dep,
      gnulib_libm_dependency,
@@ -702,10 +702,10 @@ index c631a8a0a..c5f6c1680 100644
      libintl_deps,
      libm,
 diff --git a/meson.build b/meson.build
-index 29b61fc40..f11f3737b 100644
+index 85e24aa69..34d14f90a 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -2324,6 +2324,13 @@ if host_system == 'linux'
+@@ -2286,6 +2286,13 @@ if host_system == 'linux'
    endif
  endif
  
@@ -720,7 +720,7 @@ index 29b61fc40..f11f3737b 100644
    winsock2 = cc.find_library('ws2_32')
  else
 diff --git a/meson.options b/meson.options
-index 14ece1039..7f607cd89 100644
+index 69a2135bc..e8599abaa 100644
 --- a/meson.options
 +++ b/meson.options
 @@ -37,6 +37,11 @@ option('libmount',
@@ -739,7 +739,7 @@ index 14ece1039..7f607cd89 100644
 2.45.2
 
 
-From 780c2e18fcb0747cd87d2d6c373781cb63761e7f Mon Sep 17 00:00:00 2001
+From 678df1ffadcd7fa326d4c5234dd4dbf561f3d09c Mon Sep 17 00:00:00 2001
 From: Michael Catanzaro <mcatanzaro@redhat.com>
 Date: Wed, 16 Jun 2021 20:35:00 -0500
 Subject: [PATCH 3/4] dlopen GnuTLS instead of linking directly
@@ -921,10 +921,10 @@ index 616e167e7..ddb163557 100644
  #endif
  
 diff --git a/glib/meson.build b/glib/meson.build
-index c5f6c1680..eca58df81 100644
+index b3663f184..2340d12b2 100644
 --- a/glib/meson.build
 +++ b/glib/meson.build
-@@ -429,7 +429,6 @@ libglib = library('glib-2.0',
+@@ -428,7 +428,6 @@ libglib = library('glib-2.0',
    dependencies : [
      atomic_dep,
      gnulib_libm_dependency,
@@ -933,10 +933,10 @@ index c5f6c1680..eca58df81 100644
      libintl_deps,
      libm,
 diff --git a/meson.build b/meson.build
-index f11f3737b..988ae5ade 100644
+index 34d14f90a..1e6e14554 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -2324,11 +2324,9 @@ if host_system == 'linux'
+@@ -2286,11 +2286,9 @@ if host_system == 'linux'
    endif
  endif
  
@@ -954,27 +954,19 @@ index f11f3737b..988ae5ade 100644
 2.45.2
 
 
-From 267152754263fa9a0f67b8f5313ada392a87793c Mon Sep 17 00:00:00 2001
+From c76bfa6e30ee14bcfb19666ec3e1f3bd379143bd Mon Sep 17 00:00:00 2001
 From: Michael Catanzaro <mcatanzaro@redhat.com>
 Date: Wed, 16 Jun 2021 20:46:24 -0500
-Subject: [PATCH 4/4] Add test for GHmac in FIPS mode
+Subject: [PATCH 4/4] Disable MD5 and SHA-1 HMac tests
 
-This will test a few problems that we hit recently:
-
-g_hmac_copy() is broken, https://bugzilla.redhat.com/show_bug.cgi?id=1786538
-
-Crash in g_hmac_update() in FIPS mode, https://bugzilla.redhat.com/show_bug.cgi?id=1971533
-
-Crash when passing -1 length to g_hmac_update() (discovered in #1971533)
-
-We'll also test to ensure MD5 fails, and stop compiling the other MD5
-tests.
+These are expected to be broken, depending on system crypto policy,
+which may disable the algorithms.
 ---
- glib/tests/hmac.c | 46 ++++++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 46 insertions(+)
+ glib/tests/hmac.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
 
 diff --git a/glib/tests/hmac.c b/glib/tests/hmac.c
-index 3ac3206df..352d18a09 100644
+index 3ac3206df..e7f3fdf08 100644
 --- a/glib/tests/hmac.c
 +++ b/glib/tests/hmac.c
 @@ -1,7 +1,10 @@
@@ -1004,61 +996,34 @@ index 3ac3206df..352d18a09 100644
  HmacCase hmac_md5_tests[] = {
    { G_CHECKSUM_MD5, key_md5_test1, 16, "Hi There", 8, result_md5_test1 },
    { G_CHECKSUM_MD5, "Jefe", 4, "what do ya want for nothing?", 28,
-@@ -317,6 +322,7 @@ HmacCase hmac_md5_tests[] = {
-       73, result_md5_test7 },
+@@ -336,6 +341,7 @@ HmacCase hmac_sha1_tests[] = {
+                " Than One Block-Size Data", 73, result_sha1_test7, },
    { -1, NULL, 0, NULL, 0, NULL },
  };
 +#endif
  
- HmacCase hmac_sha1_tests[] = {
-   { G_CHECKSUM_SHA1, key_sha_test1, 20, "Hi There", 8, result_sha1_test1 },
-@@ -493,11 +499,45 @@ test_hmac_for_bytes (void)
-   g_bytes_unref (data);
- }
- 
-+#ifdef USE_GNUTLS
-+static void
-+test_gnutls_fips_mode (void)
-+{
-+  GHmac *hmac;
-+  GHmac *copy;
-+
-+  /* No MD5 in FIPS mode. */
-+  hmac = g_hmac_new (G_CHECKSUM_MD5, (guchar*)"abc123", sizeof ("abc123"));
-+  g_assert_null (hmac);
-+
-+  /* SHA-256 should be good. */
-+  hmac = g_hmac_new (G_CHECKSUM_SHA256, (guchar*)"abc123", sizeof ("abc123"));
-+  g_assert_nonnull (hmac);
-+
-+  /* Ensure g_hmac_update() does not crash when called with -1. */
-+  g_hmac_update (hmac, (guchar*)"You win again, gravity!", -1);
-+
-+  /* Ensure g_hmac_copy() does not crash. */
-+  copy = g_hmac_copy (hmac);
-+  g_assert_nonnull (hmac);
-+  g_hmac_unref (hmac);
-+
-+  g_assert_cmpstr (g_hmac_get_string (copy), ==, "795ba6900bcb22e8ce65c2ec02db4e85697da921deb960ee3143bf88a4a60f83");
-+  g_hmac_unref (copy);
-+}
-+#endif
-+
- int
- main (int argc,
+ HmacCase hmac_sha256_tests[] = {
+   { G_CHECKSUM_SHA256, key_sha_test1, 20, "Hi There", 8, result_sha256_test1 },
+@@ -498,8 +504,10 @@ main (int argc,
      char **argv)
  {
    int i;
 +
-+#ifdef USE_GNUTLS
-+  /* This has to happen before GnuTLS is dlopened. */
-+  g_setenv ("GNUTLS_FORCE_FIPS_MODE", "1", FALSE);
-+#endif
-+
    g_test_init (&argc, &argv, NULL);
  
++#ifndef USE_GNUTLS
    for (i = 0 ; hmac_sha1_tests[i].key_len > 0 ; i++)
-@@ -532,6 +572,7 @@ main (int argc,
+     {
+       gchar *name = g_strdup_printf ("/hmac/sha1-%d", i + 1);
+@@ -507,6 +515,7 @@ main (int argc,
+         (void (*)(const void *)) test_hmac);
+       g_free (name);
+     }
++#endif
+ 
+   for (i = 0 ; hmac_sha256_tests[i].key_len > 0 ; i++)
+     {
+@@ -532,6 +541,7 @@ main (int argc,
        g_free (name);
      }
  
@@ -1066,7 +1031,7 @@ index 3ac3206df..352d18a09 100644
    for (i = 0 ; hmac_md5_tests[i].key_len > 0 ; i++)
      {
        gchar *name = g_strdup_printf ("/hmac/md5-%d", i + 1);
-@@ -539,6 +580,7 @@ main (int argc,
+@@ -539,6 +549,7 @@ main (int argc,
          (void (*)(const void *)) test_hmac);
        g_free (name);
      }
@@ -1074,16 +1039,6 @@ index 3ac3206df..352d18a09 100644
  
    g_test_add_func ("/hmac/ref-unref", test_hmac_ref_unref);
    g_test_add_func ("/hmac/copy", test_hmac_copy);
-@@ -546,5 +588,9 @@ main (int argc,
-   g_test_add_func ("/hmac/for-string", test_hmac_for_string);
-   g_test_add_func ("/hmac/for-bytes", test_hmac_for_bytes);
- 
-+#ifdef USE_GNUTLS
-+  g_test_add_func ("/hmac/gnutls-fips-mode", test_gnutls_fips_mode);
-+#endif
-+
-   return g_test_run ();
- }
 -- 
 2.45.2