[rpms/wget1] rawhide: Use gnutls for NTLM crypto

[Yaakov Selkowitz <yselkowi@redhat.com>]

            A new commit has been pushed.

            Repo   : rpms/wget1
            Branch : rawhide
            Commit : 64c9ffc99af5e3bac0125856e11a7c5703ef5680
            Author : Yaakov Selkowitz <yselkowi@redhat.com>
            Date   : 2026-08-18T00:07:09-04:00
            Stats  : +158/-1 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/wget1/c/64c9ffc99af5e3bac0125856e11a7c5703ef5680?branch=rawhide

            Log:
            Use gnutls for NTLM crypto

This avoids direct usage of nettle and the need to port to its 4.0 API,
as well as avoids FIPS issues with direct nettle usage outside of gnutls.

https://gitlab.com/redhat/centos-stream/rpms/wget/-/commit/ef17e7a0e207a30b93ec7f7e5e8f88625a869b06

---
diff --git a/wget-1.24.5-no-nettle.patch b/wget-1.24.5-no-nettle.patch
new file mode 100644
index 0000000..8d25624
--- /dev/null
+++ b/wget-1.24.5-no-nettle.patch
@@ -0,0 +1,153 @@
+From 9476ce232a3dcadc205e963eb69a567f478fde95 Mon Sep 17 00:00:00 2001
+From: rpm-build <rpm-build>
+Date: Wed, 11 Dec 2024 17:14:58 +0900
+Subject: [PATCH] wget-1.24.5-no-nettle.patch
+
+---
+ src/http-ntlm.c | 91 ++++++++++++++++++++++++++++++++++++-------------
+ 1 file changed, 68 insertions(+), 23 deletions(-)
+
+diff --git a/src/http-ntlm.c b/src/http-ntlm.c
+index ee054e0..9f5b50e 100644
+--- a/src/http-ntlm.c
++++ b/src/http-ntlm.c
+@@ -44,13 +44,14 @@ as that of the covered work.  */
+ 
+ #include "utils.h"
+ #include "http-ntlm.h"
++#include "md4.h"
+ 
+-#ifdef HAVE_NETTLE
+-# include <nettle/md4.h>
++#ifdef HAVE_LIBGNUTLS
++# include <gnutls/crypto.h>
++#elif defined HAVE_NETTLE
+ # include <nettle/des.h>
+ #else
+ # include <openssl/des.h>
+-# include <openssl/md4.h>
+ # include <openssl/opensslv.h>
+ 
+ # if OPENSSL_VERSION_NUMBER < 0x00907001L
+@@ -164,7 +165,31 @@ ntlm_input (struct ntlmdata *ntlm, const char *header)
+  * Turns a 56 bit key into the 64 bit, odd parity key and sets the key.  The
+  * key schedule ks is also set.
+  */
+-#ifdef HAVE_NETTLE
++#ifdef HAVE_LIBGNUTLS
++static void
++setup_des_key(unsigned char *key_56,
++              gnutls_cipher_hd_t *des)
++{
++  unsigned char key[8];
++  gnutls_datum_t _key;
++  int ret;
++
++  key[0] = key_56[0];
++  key[1] = ((key_56[0] << 7) & 0xFF) | (key_56[1] >> 1);
++  key[2] = ((key_56[1] << 6) & 0xFF) | (key_56[2] >> 2);
++  key[3] = ((key_56[2] << 5) & 0xFF) | (key_56[3] >> 3);
++  key[4] = ((key_56[3] << 4) & 0xFF) | (key_56[4] >> 4);
++  key[5] = ((key_56[4] << 3) & 0xFF) | (key_56[5] >> 5);
++  key[6] = ((key_56[5] << 2) & 0xFF) | (key_56[6] >> 6);
++  key[7] =  (key_56[6] << 1) & 0xFF;
++
++  _key.data = key;
++  _key.size = sizeof(key);
++  ret = gnutls_cipher_init(des, GNUTLS_CIPHER_DES_CBC, &_key, NULL);
++  if (ret < 0)
++    abort ();
++}
++#elif defined HAVE_NETTLE
+ static void
+ setup_des_key(unsigned char *key_56,
+               struct des_ctx *des)
+@@ -211,7 +236,28 @@ setup_des_key(unsigned char *key_56,
+ static void
+ calc_resp(unsigned char *keys, unsigned char *plaintext, unsigned char *results)
+ {
+-#ifdef HAVE_NETTLE
++#ifdef HAVE_LIBGNUTLS
++  gnutls_cipher_hd_t des;
++  int ret;
++
++  setup_des_key(keys, &des);
++  ret = gnutls_cipher_encrypt2(des, plaintext, 8, results, 8);
++  if (ret < 0)
++    abort ();
++  gnutls_cipher_deinit(des);
++
++  setup_des_key(keys + 7, &des);
++  ret = gnutls_cipher_encrypt2(des, plaintext, 8, results + 8, 8);
++  if (ret < 0)
++    abort ();
++  gnutls_cipher_deinit(des);
++
++  setup_des_key(keys + 14, &des);
++  ret = gnutls_cipher_encrypt2(des, plaintext, 8, results + 16, 8);
++  if (ret < 0)
++    abort ();
++  gnutls_cipher_deinit(des);
++#elif defined HAVE_NETTLE
+   struct des_ctx des;
+ 
+   setup_des_key(keys, &des);
+@@ -274,7 +320,22 @@ mkhash(const char *password,
+ 
+   {
+     /* create LanManager hashed password */
+-#ifdef HAVE_NETTLE
++#ifdef HAVE_LIBGNUTLS
++    gnutls_cipher_hd_t des;
++    int ret;
++
++    setup_des_key(pw, &des);
++    ret = gnutls_cipher_encrypt2(des, magic, 8, lmbuffer, 8);
++    if (ret < 0)
++      abort ();
++    gnutls_cipher_deinit(des);
++
++    setup_des_key(pw + 7, &des);
++    ret = gnutls_cipher_encrypt2(des, magic, 8, lmbuffer + 8, 8);
++    if (ret < 0)
++      abort ();
++    gnutls_cipher_deinit(des);
++#elif defined HAVE_NETTLE
+     struct des_ctx des;
+ 
+     setup_des_key(pw, &des);
+@@ -301,12 +362,6 @@ mkhash(const char *password,
+ 
+ #ifdef USE_NTRESPONSES
+   {
+-#ifdef HAVE_NETTLE
+-    struct md4_ctx MD4;
+-#else
+-    MD4_CTX MD4;
+-#endif
+-
+     unsigned char pw4[64];
+ 
+     len = strlen (password);
+@@ -319,17 +374,7 @@ mkhash(const char *password,
+       pw4[2 * i + 1] = 0;
+     }
+ 
+-#ifdef HAVE_NETTLE
+-    nettle_md4_init(&MD4);
+-    nettle_md4_update(&MD4, (unsigned) (2 * len), pw4);
+-    nettle_md4_digest(&MD4, MD4_DIGEST_SIZE, ntbuffer);
+-#else
+-    /* create NT hashed password */
+-    MD4_Init(&MD4);
+-    MD4_Update(&MD4, pw4, 2 * len);
+-    MD4_Final(ntbuffer, &MD4);
+-#endif
+-
++    md4_buffer((const char *) pw4, (unsigned) (2 * len), ntbuffer);
+     memset(ntbuffer + 16, 0, 5);
+   }
+ 
+-- 
+2.47.0
+

diff --git a/wget1.spec b/wget1.spec
index 812a6a1..10cc4a7 100644
--- a/wget1.spec
+++ b/wget1.spec
@@ -1,7 +1,7 @@
 Summary: A utility for retrieving files using the HTTP or FTP protocols
 Name: wget1
 Version: 1.25.0
-Release: 4%{?dist}
+Release: 5%{?dist}
 # Generally wget is distributed under GPLv3 or later but there are files in lib/ directory
 # which are under LGPLv2.1 or later and are actually built into the resulting rpm.
 # This version of wget is built with gnutls so I believe that the 'with openssl'
@@ -15,6 +15,7 @@ Patch2: wget-1.25-fix-cve-2026-15146.patch
 Patch3: wget-1.25-fix-cve-2026-58470.patch
 Patch4: wget-1.25-fix-cve-2026-58471.patch
 Patch5: wget-1.25-fix-cve-2026-58472.patch
+Patch6: wget-1.24.5-no-nettle.patch
 
 Provides: bundled(gnulib) 
 # needed for test suite
@@ -116,6 +117,9 @@ echo ".so man1/%{name}.1" > %{buildroot}%{_mandir}/man1/wget.1
 %config(noreplace) %{_sysconfdir}/wgetrc
 
 %changelog
+* Tue Aug 18 2026 Yaakov Selkowitz <yselkowi@redhat.com> - 1.25.0-5
+- Use gnutls for NTLM crypto
+
 * Wed Jul 15 2026 Michal Ruprich <mruprich@redhat.com> - 1.25.0-4
 - Fix for CVE-2026-15146, CVE-2026-58470, CVE-2026-58471, CVE-2026-58472