Bug#1142662: TLS 1.3 handshake issue with openjdk

[Romain Tartière]

Package: libgnutls30t64
Version: 3.8.9-3+deb13u4
Tags: patch 

Dear Maintainer,

About one year ago, OpenJDK fixed handling of signature scheme
constraints in TLS by differentiating between handshake signatures and
certificate signatures (https://bugs.openjdk.org/browse/JDK-8349583).
The corresponding packages for OpenJDK were updated in Debian and we
immediately experienced a regression in Debian packages that relied on
GnuTLS for mutual TLS: connection failed to establish with spurious
error messages.

More recently, I could find the root cause and fix the issue causing
this regression in GnuTLS, and this fix was part of GnuTLS 3.8.13:
https://gitlab.com/gnutls/gnutls/-/merge_requests/2095/

The version of GnuTLS in Debian testing is now working correctly, but I
would like the fix to be backported to Debian 12 and 13 where the issue
still exists today.

I opened two merge requests to include this patch on what I think are
the correct branches in the salsa project:
  - https://salsa.debian.org/gnutls-team/gnutls/-/merge_requests/6
  - https://salsa.debian.org/gnutls-team/gnutls/-/merge_requests/7

I was not able to find the correct commands I should run to build
packages from this repository, and would appreciate some guidance to
help me improve these merge requests.  In-line comments in gitlab are
probably the most convenient for me.

Thank you!

-- 
Romain Tartière <romain at blogreen.org>        http://romain.blogreen.org/
pgp: 8234 9A78 E7C0 B807 0B59  80FF BA4D 1D95 5112 336F (ID: 0x5112336F)
(plain text =non-HTML= PGP/GPG encrypted/signed e-mail much appreciated)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 699 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-gnutls-maint/attachments/20260723/c38e2380/attachment.sig>