Author: Zoltan Fridrich <zfridric@redhat.com>
Date:   Thu Aug 3 11:52:04 2023 +0200

    Release 3.8.1
    
    Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>

Author: Zoltan Fridrich <zfridric@redhat.com>
Date:   Thu Aug 3 14:09:33 2023 +0200

    Safeguard against overflow inside pkcs11_find_objects
    
    Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>

Author: Zoltan Fridrich <zfridric@redhat.com>
Date:   Tue Jul 25 16:23:49 2023 +0200

    Refactor pkcs11_find_objects to use p11-kit iterator
    
    Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Mon Jul 31 23:46:19 2023 +0900

    tests: propagate $CFLAGS in pkgconfig.sh
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Mon Jul 31 11:54:27 2023 +0900

    .gitlab-ci.yml: re-enable i686 cross build
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Mon Jul 31 17:38:02 2023 +0900

    doc: fix C++ example compilation on MinGW
    
    The examples under doc/examples/ are compiled with Gnulib, which
    overrides write if it's not available, as a macro.  This conflicts
    with the usage of std::iostream::write in ex-cxx.cpp.  To avoid the
    build issue, use a custom namespace to hide it, as suggested in:
    https://www.gnu.org/software/gnulib/manual/html_node/A-C_002b_002b-namespace-for-gnulib.html
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Zoltan Fridrich <zfridric@redhat.com>
Date:   Thu Jul 27 10:36:48 2023 +0200

    Reduce the number of objects received per iteration in pkcs11_find_objects
    
    Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Mon Jul 24 09:14:20 2023 +0200

    .gitlab-ci.yml: drop use of Debian cross images
    
    Due to licensing concern, we had to remove the Debian-based CI images
    for cross compilation.  Some of them are already covered by the
    Fedora-based CI images, though it would be nice if the following are
    added back:
    
    - x86 (32-bit): maybe we could just use -m32 on Fedora image,
      similarly to mingw targets
    - Arm (32-bit)
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Sun Jul 23 08:17:32 2023 +0200

    .gitlab-ci.yml: enable use of Fedora cross toolchain
    
    This adds new tests for cross-compiling to AArch64, PowerPC 64 (LE),
    and s390x through the CI image based on Fedora 38.  The main advantage
    of doing this is that the toolchain version is in sync with the
    current Fedora native builds.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Thu Jul 20 08:54:36 2023 +0200

    accelerated: check nonce length in aead_{encrypt,decrypt}
    
    This propagates any IV length mismatch detected as an error, in the
    accelerated code for x86.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Thu Jul 20 08:49:30 2023 +0200

    nettle: check nonce length in aead_{encrypt,decrypt}
    
    This adds a missing check on the maximum IV length in aead_encrypt and
    aead_decrypt, to the Nettle crypto backend.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Elias Gustafsson <elias.skondal@gmail.com>
Date:   Tue Apr 4 02:16:04 2023 +0200

    tests: add negative serial number test
    
    Signed-off-by: Elias Gustafsson <elias.skondal@gmail.com>

Author: Elias Gustafsson <elias.skondal@gmail.com>
Date:   Tue Apr 4 02:07:21 2023 +0200

    certtool: reject negative serial numbers
    
    Signed-off-by: Elias Gustafsson <elias.skondal@gmail.com>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Mon Jul 10 14:53:35 2023 +0200

    tests: use template file for generating long DNS certificate request
    
    Instead of an interaction file, which causes problems on Windows when
    reading a password from tty.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Sat Jul 8 14:47:19 2023 +0200

    tests: fix error code in ocsp-tests/ocsp-must-staple-connection.sh
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Sat Jul 8 14:42:33 2023 +0200

    tests: print diff when cert-tests/crq.sh produces unexpected output
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Sat Jul 8 06:36:39 2023 +0200

    build: remove unused backward compatibility macro
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Fri Jul 7 15:48:19 2023 +0200

    tests: remove unnecessary calls to skip_if_no_datefudge
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Wed Jul 5 17:00:40 2023 +0200

    NEWS: mention --attime option
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Wed Jul 5 17:45:54 2023 +0200

    tests: use SH_LOG_COMPILER in cert-tests
    
    This omits the need of setting executable bits on shell script tests,
    as well as makes the log file naming consistent.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Sat Jul 8 06:29:17 2023 +0200

    gnutls-serv, gnutls-cli, gnutls-cli-debug: add --attime option
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Wilbur Wetterquarz <freaxmate@protonmail.com>
Date:   Wed Mar 22 01:00:09 2023 +0100

    certtool: add --attime option
    
    This adds a --attime option to certtool, so the tests don't need
    faketime or datefudge to adjust system time.
    
    Signed-off-by: Wilbur Wetterquarz <freaxmate@protonmail.com>
    Modified-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Thu Jul 6 14:30:52 2023 +0200

    ocsptool: fix memleak spotted by ASan
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Pravek Sharma <sharmapravek@gmail.com>
Date:   Sun Mar 12 22:31:33 2023 -0400

    ocsptool: add --attime option
    
    This adds a --attime option to ocsptool, so the tests don't need
    faketime or datefudge to adjust system time.
    
    Signed-off-by: Pravek Sharma <sharmapravek@gmail.com>
    Modified-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Wed Jul 5 17:28:47 2023 +0200

    system: override gettime if time is overridden
    
    If the gnutls_time is manually set by user, it would be more intuitive
    to also update gnutls_gettime to use it internally.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Wed Jul 5 15:55:16 2023 +0200

    tests: detect faketime at configure time
    
    Previously, the test suite checked the existence of faketime or
    datefudge at "make check", multiple times when it is needed.  This
    moves the check to configure and check it only once.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>
    Co-authored-by: Andreas Metzler <ametzler@bebt.de>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Tue Jul 4 09:47:52 2023 +0200

    priority: add config keyword "tls-session-hash"
    
    This adds a new keyword in the configuration file, "tls-session-hash",
    which shall appear in the [overrides] section and takes either
    "request" or "require" as the argument.  This is particularly useful
    when reverting the EMS requirement in FIPS mode for interoperability
    reasons.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Thu Jun 29 10:04:51 2023 +0200

    tls1-prf: mark use of non-EMS PRF non-approved in FIPS
    
    This adds service indicator transitions around the use of TLS 1.2 PRF.
    As of May 16, 2023, the use of extended master secret is mandatory
    according to FIPS 140-3 IG.  This patch detects the usage of non-EMS
    KDF by checking the label: if it is "master secret", the service
    indicator transitions to a non-approved state.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Andreas Metzler <ametzler@debian.org>
Date:   Sun Jun 4 14:15:45 2023 +0200

    Fix update-copyright-year target for switch from GNU autogen
    
    Signed-off-by: Andreas Metzler <ametzler@bebt.de>

Author: Andreas Metzler <ametzler@debian.org>
Date:   Sun Jun 4 13:53:43 2023 +0200

    Automate and fix manpage copyright year update
    
    Handle manpage copyright year update in update-copyright-year
    target, and fix the library manpage copyright year statement, $(YEAR)
    expanded to an empty string
    
    Broken by: 5a58370864e04f5dbb05b0ae453e6fa592a93175
    Signed-off-by: Andreas Metzler <ametzler@bebt.de>

Author: Andreas Metzler <ametzler@debian.org>
Date:   Sat Jun 3 13:27:53 2023 +0200

    Bump manpage copyright year
    
    Signed-off-by: Andreas Metzler <ametzler@bebt.de>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Mon Jun 5 16:47:36 2023 +0200

    tests: re-add test-ciphersuite-names.sh to TESTS
    
    The test was removed from TESTS in commit
    5e52b0d0fec0d9eaac30ca8f35fd7b8368064222.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Thu Jun 1 16:08:24 2023 +0200

    tests: update tests/suite/ciphersuite after a96b04ff
    
    The commit a96b04ffcf8fd7375dc3c0f90602bf679f5a9791 introduced a new
    field in gnutls_cipher_suite_entry_st for gnutls_ciphersuite_get. The
    scan-gnutls.sh script needs to be updated to correctly parse the
    ciphersuites list.  This also fixes the include path so the test
    doesn't require gnutls to be installed on the system.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Fri Jul 7 13:18:20 2023 +0200

    tests: make testcompat-openssl-tls13-serv.sh less flaky
    
    Bash has a special variable GROUPS[1] which clashes with our use in
    testcompat-openssl-tls13-serv.sh as a list of key exchange groups.
    This avoids using it as well as expands the logging message to
    indicate what is tested.
    
    1. https://www.gnu.org/software/bash/manual/html_node/Bash-Variables.html#index-GROUPS
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Fri Jul 7 10:07:26 2023 +0200

    lib: suppress -Wmaybe-uninitialized warning
    
    Spotted by GCC 13:
    
      pkcs11.c: In function 'gnutls_pkcs11_token_get_info':
      pkcs11.c:2535:25: error: 'str' may be used uninitialized [-Werror=maybe-uninitialized]
       2535 |                         memcpy(output, str, len);
            |                         ^~~~~~~~~~~~~~~~~~~~~~~~
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Wed Jun 7 16:44:00 2023 +0200

    lib: suppress false-positive -Wanalyzer-out-of-bounds
    
    GCC analyzer from GCC 13 reports this:
    
      verify-high.c:1471:21: error: stack-based buffer over-read [CWE-126] [-Werror=analyzer-out-of-bounds]
       1471 |                 if (gnutls_x509_trust_list_get_issuer(
            |                     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
       1472 |                             list, cert_list[i - 1], &issuer,
    
    This is false-positive, as i is always in a range 0 < i < cert_list_size.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Wed Jun 7 11:54:54 2023 +0200

    lib: suppress false-positive -Wanalyzer-deref-before-check
    
    GCC analyzer from GCC 13 reports an error when a pointer dereference
    followed by a memcpy:
    
      x509_dn.c:54:17: error: check of '*name.data' for NULL after already dereferencing it [-Werror=analyzer-deref-before-check]
         54 |                 memcpy(_oid, name->data, name->size);
            |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    
    This is a false-positive, because we check name->size is > 0 on a
    previous line.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Wed Jun 7 11:43:32 2023 +0200

    src: suppress clang-analyzer warning
    
    clang-analyzer from Clang 16 reports the following:
    
      serv.c:2069:2: warning: Null pointer passed to 1st parameter expecting 'nonnull' [core.NonNullParamChecker]
              memcpy(cache_db[i].session_data.data, data.data, data.size);
              ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Tue Jun 6 09:30:50 2023 +0200

    .gitlab-ci.yml: switch to Fedora 38 images
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Ajit Singh <ajeetsinghchahar2@gmail.com>
Date:   Wed Jun 7 22:06:57 2023 +0530

    m4/hooks.m4: Fixed typo
    
    Signed-off-by: Ajit Singh <ajeetsinghchahar2@gmail.com>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Wed May 24 09:02:26 2023 +0200

    .gitlab-ci.yml: pull in clang16-extra-tools instead of clang15-*
    
    Also re-indent the existing code with the newer version of clang.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Thu May 11 09:57:09 2023 +0900

    tests: use GNUTLS_SELF_TEST_FLAG_ALL macro instead of magic number
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Thu May 11 09:52:20 2023 +0900

    crypto-selftests: mark CFB8 block sizes tests optional
    
    It was not obvious that the second function supplied to CASE2 macro
    was only called when GNUTLS_SELF_TEST_FLAG_ALL is set.  This splits
    the macro into two: the one to be required and the other to be
    optional.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Thu May 11 22:13:25 2023 +0900

    nettle: remove files no longer used
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Tue May 2 08:41:08 2023 +0900

    psk: Add basic support for RFC 9258 external PSK importer interface
    
    This adds a minimal, callback-based API to import external PSK,
    following RFC 9258.  The client and the server importing external PSK
    are supposed to set a callback to retrieve PSK, which returns flags
    that may indicate the PSK is imported, along with the key:
    
      typedef int gnutls_psk_client_credentials_function3(
              gnutls_session_t session,
              gnutls_datum_t *username, gnutls_datum_t *key,
              gnutls_psk_key_flags *flags);
    
      typedef int gnutls_psk_server_credentials_function3(
              gnutls_session_t session,
              const gnutls_datum_t *username, gnutls_datum_t *key,
              gnutls_psk_key_flags *flags);
    
    Those callbacks are responsible to call
    gnutls_psk_format_imported_identity() for external PSKs to build a
    serialized PSK identity, and set GNUTLS_PSK_KEY_EXT in flags if the
    identity is an imported one.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Mon Apr 24 12:39:42 2023 +0900

    build: re-indent code
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Fri Mar 17 18:17:30 2023 +0900

    doc: add missing documentation for enums
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Thu Mar 16 11:31:42 2023 +0900

    .gitlab-ci.yml: install clang15-extra-tools for clang-format
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Fri Mar 17 13:05:41 2023 +0900

    gnutls.h.in: stop indenting doc-comments for typedefs
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Thu Mar 16 16:21:37 2023 +0900

    build: use /* clang-format {on|off} */ annotation
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Mon Apr 24 12:38:56 2023 +0900

    doc: mention how to indent source code
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Thu Mar 16 10:33:14 2023 +0900

    build: switch to using clang-format instead of GNU indent
    
    GNU indent yields weird output when using the Linux kernel coding
    style as in the below examples, which affects code readability.
    
    - Too long lines cause unexpected indentation:
                            if (!
                                (priv->flags &
                                 GNUTLS_PKCS11_OBJ_FLAG_RETRIEVE_DISTRUSTED)
      && (priv->flags & GNUTLS_PKCS11_OBJ_FLAG_OVERWRITE_TRUSTMOD_EXT)
      && data.size > 0) {
    
    - Unary operators (`-` and `+`) after a type cast are not recognized
      properly: `(time_t)-1` becomes `(time-t) - 1`
    
    - Long conditionals are wrapped before binary operators, such as `&&`
      or `||`.  This is not mandatory in the style, but all the occurrences
      are replaced with that style
    
    This switches to using clang-format instead, with the configuration
    used in the Linux kernel as of commit
    596ff4a09b8981790e15572e8e7bc904df5835e7:
    https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/.clang-format
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Sat Apr 15 08:04:01 2023 +0900

    doc: fix typo in %DISABLE_SAFE_RENEGOTIATION documentation
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Sun Apr 2 08:21:41 2023 +0900

    doc: mention ClientHello extensions shuffling
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Sun Apr 2 08:16:33 2023 +0900

    hello_ext: minor cleanup of extension shuffling code
    
    This reduces the number of calls to gnutls_rnd(GNUTLS_RND_RANDOM)
    based on the assumption that extension indices fit in uint8_t.
    
    This also renames the priority string modifier from %NO_EXTS_SHUFFLE
    to %NO_SHUFFLE_EXTENSIONS.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: xuraoqing <609179072@qq.com>
Date:   Thu Apr 13 09:56:26 2023 +0000

    tests: add test for gnutls_certificate_set_x509_trust
    
    Signed-off-by: xuraoqing <xuraoqing@huawei.com>

Author: Andreas Metzler <ametzler@debian.org>
Date:   Sun Mar 5 14:27:39 2023 +0100

    Update docs for faketime instead of datefudge
    
    Signed-off-by: Andreas Metzler <ametzler@bebt.de>

Author: Andreas Metzler <ametzler@debian.org>
Date:   Sun Mar 19 14:42:27 2023 +0100

    Drop unused function.
    
    Signed-off-by: Andreas Metzler <ametzler@bebt.de>

Author: Andreas Metzler <ametzler@debian.org>
Date:   Sun Mar 5 14:17:31 2023 +0100

    Also use gnutls_timewrapper non-frozen time
    
    also switch timeout/wrapper order
    
    Signed-off-by: Andreas Metzler <ametzler@bebt.de>

Author: Andreas Metzler <ametzler@debian.org>
Date:   Sun Mar 5 11:29:17 2023 +0100

    Use gnutls_timewrapper for static (frozen time) instances
    
    Also switch setsid/wrapper order
    
    Signed-off-by: Andreas Metzler <ametzler@bebt.de>

Author: Andreas Metzler <ametzler@debian.org>
Date:   Fri Mar 17 18:18:46 2023 +0100

    Add wrapper around faketime/datefudge
    
    Prefer faketime, fall back to datefudge.
    
    Signed-off-by: Andreas Metzler <ametzler@bebt.de>

Author: Andreas Metzler <ametzler@debian.org>
Date:   Tue Feb 28 18:49:56 2023 +0100

    Change timestamp format for faketime compatibility.
    
    Change all timestamps passed to "datefudge -s" to "YYYY-MM-DD hh:mm:ss"
    format for compatibility with faketime -f ("Freeze clock" advanced format)
    
    Signed-off-by: Andreas Metzler <ametzler@bebt.de>

Author: ATHARVA S MARATHE <atharvamarathe8@gmail.com>
Date:   Tue Apr 4 03:49:13 2023 +0000

    gnutls-serv: add configurable timeout
    
    This adds --timeout option to gnutls-serv to control the inactivity
    interval, which would be useful for testing.
    
    Fixes: #1471
    Signed-off-by: maratheatharva <atharvamarathe8@gmail.com>

Author: @Ajit <ajeetsinghchahar2@gmail.com>
Date:   Sat Apr 1 23:05:00 2023 +0000

    hello_ext: add ClientHello extension permutation
    
    This adds a mechanism to randomize the order of TLS extensions in the
    ClientHello to make fingerprinting harder. The mechanism is enabled by
    default and a new priority keyword %NO_EXTS_SHUFFLE has been added to
    turn it off.
    
    Signed-off-by: peonix <ajeetsinghchahar2@gmail.com>

Author: Tobias Heider <tobias.heider@canonical.com>
Date:   Thu Mar 30 16:38:05 2023 +0200

    fips: adjust pbkdf2 tests for SP 800-132 limits
    
    - Make sure to always use approved iteration count
    - Check that salt < 16 return non-approved
    - Check that iteration count < 1000 returns non-approved
    
    Signed-off-by: Tobias Heider <tobias.heider@canonical.com>

Author: Tobias Heider <tobias.heider@canonical.com>
Date:   Thu Mar 30 11:36:34 2023 +0200

    fips: add additional pbkdf limit checks as defined in SP 800-132
    
    Signed-off-by: Tobias Heider <tobias.heider@canonical.com>

Author: peonix <ajeetsinghchahar2@gmail.com>
Date:   Tue Mar 28 14:21:07 2023 +0530

    changes to keep backward compatibility
    
    Signed-off-by: peonix <ajeetsinghchahar2@gmail.com>

Author: peonix <ajeetsinghchahar2@gmail.com>
Date:   Tue Mar 28 14:20:47 2023 +0530

    reformatted
    
    Signed-off-by: peonix <ajeetsinghchahar2@gmail.com>

Author: peonix <ajeetsinghchahar2@gmail.com>
Date:   Tue Mar 28 09:10:36 2023 +0530

    Updated desc for @GNUTLS_NO_DEFAULT_EXTENSIONS
    
    Signed-off-by: peonix <ajeetsinghchahar2@gmail.com>

Author: peonix <ajeetsinghchahar2@gmail.com>
Date:   Tue Mar 28 09:08:40 2023 +0530

    Modifier GNUTLS_NO_EXTENSIONS renamed to GNUTLS_NO_DEFAULT_EXTENSIONS
    
    Signed-off-by: peonix <ajeetsinghchahar2@gmail.com>

Author: xuraoqing <xuraoqing@huawei.com>
Date:   Wed Mar 22 11:46:55 2023 +0800

    fix incorrect parameter description of crl import function
    
    Signed-off-by: xuraoqing <xuraoqing@huawei.com>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Sun Mar 19 13:01:39 2023 +0900

    psk: guard against the case where psk_auth_info_t has NULL username
    
    This happens when gnutls_psk_server_get_username is called from a
    client.  Also simplify the embedded NUL-byte check with memchr.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Sun Mar 19 13:00:36 2023 +0900

    src: print_info: prefer gnutls_psk_server_get_username2
    
    gnutls_psk_server_get_username only supports NUL-terminated usernames,
    while we added support for non-NULL terminated usernames in
    d00638997fa269a975095d852633b48b2b64fbf9.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: xuraoqing <xuraoqing@huawei.com>
Date:   Mon Mar 20 14:43:34 2023 +0800

    add DER crl list import test
    
    Signed-off-by: xuraoqing <xuraoqing@huawei.com>

Author: xuraoqing <xuraoqing@huawei.com>
Date:   Mon Mar 20 14:18:19 2023 +0800

    add get dn by oid test
    
    Signed-off-by: xuraoqing <xuraoqing@huawei.com>

Author: Yongye Zhu <zyy1102000@gmail.com>
Date:   Sat Mar 18 15:33:57 2023 -0500

    rewrite tests/tls13/key_limits.c in single process
    
    Signed-off-by: Yongye Zhu <zyy1102000@gmail.com>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Sat Mar 18 10:52:13 2023 +0900

    .gitlab-ci.yml: make use of .pre stage
    
    Jobs in the .pre stage run before any other jobs:
    https://docs.gitlab.com/ee/ci/yaml/index.html#stage-pre
    
    As commit-check is lightweight and a prerequisite for merging MRs,
    this moves it from the test stage to .pre.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Mon Mar 13 16:58:45 2023 +0900

    pkcs11: respect Mozilla's time-based distrust upon issuer lookup
    
    This implements the basic logic needed to support time-based distrust
    of CA, according to [1].
    
    1. https://wiki.mozilla.org/CA/Additional_Trust_Changes#Distrust_After
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: xuraoqing <609179072@qq.com>
Date:   Mon Mar 13 14:04:03 2023 +0000

    tests: add tests for CRL issuer get functions
    
    Signed-off-by: xuraoqing <xuraoqing@huawei.com>

Author: Richard W.M. Jones <rjones@redhat.com>
Date:   Fri Mar 10 11:15:19 2023 +0000

    ktls: Do not return GNUTLS_E_INTERRUPTED/AGAIN from short writes
    
    If sendmsg returns a short write, we end up going around the loop with
    data_to_send being smaller.  However if sendmsg then returns -EAGAIN
    or -EINTR then we return an error.  But we have "forgotten" that we
    already sent some data.
    
    This causes the caller to retry gnutls_record_send with the full
    buffer (ie. with a buffer that has already been partially sent),
    causing desynchronization.
    
    Instead check if we sent some data in this case and return the number
    of bytes sent.
    
    Fixes: https://gitlab.com/gnutls/gnutls/-/issues/1470
    Thanks: Dan Berrange for suggesting a fix
    Signed-off-by: Richard W.M. Jones <rjones@redhat.com>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Thu Mar 9 14:09:14 2023 +0900

    tests: skip TLS 1.2 resume tests without EMS under FIPS
    
    In FIPS mode, extended master secret is required and those tests are
    not supported.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Sun Mar 5 15:20:35 2023 +0900

    tests: close unused peer socket in the tests using socketpair
    
    Otherwise, the subsequent call to wait will block, when the child
    process exits abnormally.  Checked with the following script:
    
      for i in $(git grep -l socketpair); do
              if ! grep -q 'close.*\[' $i; then echo $i; fi
      done
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Tue Feb 21 15:35:37 2023 +0900

    fips: enable %FORCE_SESSION_HASH by default under FIPS mode
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Tue Feb 21 14:46:09 2023 +0900

    priority: add %FORCE_SESSION_HASH modifier
    
    This adds a new priority string modifier %FORCE_SESSION_HASH, which
    requires to negotiate extended master secret and aborts the connection
    if the peer does not send the extension in hello messages.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: xuraoqing <xuraoqing@huawei.com>
Date:   Mon Mar 6 14:42:16 2023 +0800

    add gnutls_pkcs7_get_signature_count test
    
    Signed-off-by: xuraoqing <xuraoqing@huawei.com>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Thu Mar 2 13:24:22 2023 +0900

    .gitlab-ci.yml: switch to Fedora 37 images
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Christopher Baines <mail@cbaines.net>
Date:   Tue Sep 20 11:33:45 2022 +0200

    doc: Don't depend on /usr/bin/perl in the Makefile.am.
    
    Instead, work if perl is on the $PATH. I hit this problem on GNU Guix
    which doesn't use the /usr/bin directory.
    
    Signed-off-by: Christopher Baines <mail@cbaines.net>

Author: xuraoqing <xuraoqing@huawei.com>
Date:   Tue Feb 28 11:40:11 2023 +0800

    remove unused extern variables
    
    Signed-off-by: xuraoqing <xuraoqing@huawei.com>

Author: Pedro Monreal <pmgdeb@gmail.com>
Date:   Thu Feb 16 17:02:38 2023 +0100

    pk: extend pair-wise consistency to cover DH key generation
    
    Perform SP800 56A (rev 3) 5.6.2.1.4 Owner Assurance of Pair-wise
    Consistency check, even if we only support ephemeral DH, as it is
    required by FIPS 140-3 IG 10.3.A.
    
    Signed-off-by: Pedro Monreal <pmgdeb@gmail.com>
    Co-authored-by: Daiki Ueno <ueno@gnu.org>

Author: xuraoqing <609179072@qq.com>
Date:   Mon Feb 27 05:37:50 2023 +0000

    gnutls-serv: fix possible memory leakage around realloc
    
    Signed-off-by: xuraoqing <xuraoqing@huawei.com>

Author: Radostin Stoyanov <radostin@redhat.com>
Date:   Sat Feb 25 10:16:38 2023 +0900

    tests: fix typo in rsa-encrypt-decrypt
    
    Signed-off-by: Radostin Stoyanov <radostin@redhat.com>

Author: Pedro Monreal <pmgdeb@gmail.com>
Date:   Fri Feb 24 22:02:48 2023 +0000

    ecdh: perform SP800-56A rev3 full pubkey validation on key derivation
    
    This implements full public key validation required in
    SP800-56A rev3, section 5.6.2.3.3.
    
    Co-authored-by: Daiki Ueno <ueno@gnu.org>
    Signed-off-by: Pedro Monreal <pmgdeb@gmail.com>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Thu Feb 23 10:41:41 2023 +0900

    .gitmodules: revert to use full URLs for submodules
    
    The previous attempt to use relative paths caused issues when the
    repository is mirrored, requiring all the local submodules are
    mirrored as well.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Zoltan Fridrich <zfridric@redhat.com>
Date:   Fri Feb 10 11:32:43 2023 +0100

    Update release steps
    
    Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>

Author: Zoltan Fridrich <zfridric@redhat.com>
Date:   Fri Feb 10 11:31:38 2023 +0100

    Fix typo in NEWS
    
    Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Tue Feb 21 17:09:49 2023 +0900

    .gitlab-ci.yml: simplify timestamp preservation
    
    This simplifies commit 738b968271 to consolidate the logic into
    default target.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Mon Feb 20 09:36:00 2023 +0900

    .gitlab-ci.yml: bump cache version
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Mon Feb 20 17:35:38 2023 +0900

    .gitlab-ci.yml: preserve timestamp around bootstrap
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Mon Feb 20 09:49:32 2023 +0900

    .gitlab-ci.yml: take advantage of git submodules in GitLab CI
    
    GitLab CI has support for automatic checkout of submodules, though it
    requires some modifications to .gitmodules:
    https://docs.gitlab.com/ee/ci/git_submodules.html
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Fri Feb 17 15:02:29 2023 +0900

    .gitlab-ci.yml: use artifacts:untracked
    
    The "artifacts:untracked" enables to efficiently archive build
    artifacts:
    https://docs.gitlab.com/ee/ci/yaml/#artifactsuntracked
    
    Also copy files with bootstrap, as symlinks are excluded from the
    artifacts.
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: Daiki Ueno <ueno@gnu.org>
Date:   Fri Feb 17 11:29:23 2023 +0900

    gnulib: update git submodule
    
    Signed-off-by: Daiki Ueno <ueno@gnu.org>

Author: xuraoqing <609179072@qq.com>
Date:   Mon Feb 13 11:32:34 2023 +0800

    use xrealloc replace realloc in src/serv.c which just for test.
    
    Signed-off-by: xuraoqing <609179072@qq.com>

Author: Peter Leitmann <pleitman@redhat.com>
Date:   Thu Feb 9 22:34:00 2023 +0100

    add new interop tests
    
    Signed-off-by: Peter Leitmann <pleitman@redhat.com>

Author: Zoltan Fridrich <zfridric@redhat.com>
Date:   Thu Feb 9 12:47:13 2023 +0100

    Release 3.8.0
    
    Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>

Author: xuraoqing <609179072@qq.com>
Date:   Tue Feb 7 11:37:04 2023 +0800

    fix possible out-of-bounds access
    
    Signed-off-by: xuraoqing <609179072@qq.com>
