[PATCH v2 00/12] Wave goodbye to RHEL 7 vintage distros

[PATCH v2 00/12] Wave goodbye to RHEL 7 vintage distros

[Daniel P. Berrangé]

The main motivation for this series is to eliminate some backcompat
logic in the crypto code only needed for RHEL-7. I take the opportunity
to also bump the min required versions of glib, gcc and clang since we
have dropped many distros since they were last bumped.

There are possibly some more cleanups that can be done as a side effect
of these new min versions, but I leave that for other interested people
to look at.

One that might be intesting is switching from std=gnu99 to gnu11 since
we're no longer constrainted by the 4.8.x vintage GCC which marked gnu11
as experimental (see 7be41675f7cb16be7c8d2554add7a63fa43781a8)

Changed in v2:

 - Changed all the min versions again

    - I had previously forgotten that Debian Stretch was already dropped
    - I didn't distinguish between the primary clang package and the
      alt versions provided by Ubuntu?Debian

  Most versions are newer than the previous posting, but clang one is
  slightly older.

Daniel P. Berrangé (12):
  gitlab: drop linux user build job for CentOS 7
  patchew: move quick build job from CentOS 7 to CentOS 8 container
  crypto: bump min nettle to 3.4, dropping RHEL-7 support
  crypto: drop back compatibility typedefs for nettle
  crypto: bump min gcrypt to 1.8.0, dropping RHEL-7 support
  crypto: bump min gnutls to 3.5.18, dropping RHEL-7 support
  crypto: drop used conditional check
  tests/vm: convert centos VM recipe to CentOS 8
  tests/docker: drop CentOS 7 container
  configure: bump min required glib version to 2.56
  configure: bump min required GCC to 7.5.0
  configure: bump min required CLang to 6.0 / XCode 10.0

 .gitlab-ci.d/containers.yml             |   5 -
 .gitlab-ci.yml                          |  44 -----
 .patchew.yml                            |   6 +-
 configure                               |  40 ++---
 crypto/cipher-nettle.c.inc              |  91 +++--------
 crypto/hash-nettle.c                    |  10 +-
 crypto/hmac-nettle.c                    |  12 +-
 crypto/meson.build                      |   6 +-
 crypto/tlscredsx509.c                   |   2 -
 include/glib-compat.h                   |  13 +-
 tests/docker/dockerfiles/centos7.docker |  43 -----
 tests/vm/centos                         |  17 +-
 util/oslib-win32.c                      | 204 ------------------------
 13 files changed, 55 insertions(+), 438 deletions(-)
 delete mode 100644 tests/docker/dockerfiles/centos7.docker

-- 
2.31.1

[PATCH v2 01/12] gitlab: drop linux user build job for CentOS 7

[Daniel P. Berrangé]

It has been over two years since RHEL-8 was released, and thus per the
platform build policy, we no longer need to support RHEL-7 as a build
target.

The build-user-centos7 job was to detect a failure specific to CentOS
7 and there are already other linux user jobs for other platforms.
Thus we can drop this job rather than move it to CentOS 8.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 .gitlab-ci.yml | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index dcb6317aac..726450a46d 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -441,15 +441,6 @@ build-user-plugins:
     MAKE_CHECK_ARGS: check-tcg
   timeout: 1h 30m
 
-build-user-centos7:
-  <<: *native_build_job_definition
-  needs:
-    job: amd64-centos7-container
-  variables:
-    IMAGE: centos7
-    CONFIGURE_ARGS: --disable-system --disable-tools --disable-docs
-    MAKE_CHECK_ARGS: check-tcg
-
 build-some-softmmu-plugins:
   <<: *native_build_job_definition
   needs:
-- 
2.31.1

[PATCH v2 02/12] patchew: move quick build job from CentOS 7 to CentOS 8 container

[Daniel P. Berrangé]

It has been over two years since RHEL-8 was released, and thus per the
platform build policy, we no longer need to support RHEL-7 as a build
target.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 .patchew.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.patchew.yml b/.patchew.yml
index 988c29261f..2638b7f564 100644
--- a/.patchew.yml
+++ b/.patchew.yml
@@ -88,7 +88,7 @@ email:
         more information:
 
         {{ logtext }}
-        {% elif test == "docker-mingw@fedora" or test == "docker-quick@centos7" or test == "asan" %}
+        {% elif test == "docker-mingw@fedora" or test == "docker-quick@centos8" or test == "asan" %}
         Hi,
 
         This series failed the {{ test }} build test. Please find the testing commands and
@@ -124,13 +124,13 @@ testing:
       script: |
         #!/bin/bash
         time make docker-test-debug@fedora TARGET_LIST=x86_64-softmmu J=14 NETWORK=1
-    docker-quick@centos7:
+    docker-quick@centos8:
       enabled: false
       requirements: docker,x86_64
       timeout: 3600
       script: |
         #!/bin/bash
-        time make docker-test-quick@centos7 SHOW_ENV=1 J=14 NETWORK=1
+        time make docker-test-quick@centos8 SHOW_ENV=1 J=14 NETWORK=1
     checkpatch:
       enabled: true
       requirements: ''
-- 
2.31.1

[PATCH v2 03/12] crypto: bump min nettle to 3.4, dropping RHEL-7 support

[Daniel P. Berrangé]

It has been over two years since RHEL-8 was released, and thus per the
platform build policy, we no longer need to support RHEL-7 as a build
target. This lets us increment the minimum required nettle version and
drop a lot of backwards compatibility code for 2.x series of nettle.

Per repology, current shipping versions are:

             RHEL-8: 3.4.1
      Debian Buster: 3.4.1
 openSUSE Leap 15.2: 3.4.1
   Ubuntu LTS 18.04: 3.4
   Ubuntu LTS 20.04: 3.5.1
            FreeBSD: 3.7.2
          Fedora 33: 3.5.1
          Fedora 34: 3.7.2
            OpenBSD: 3.7.2
     macOS HomeBrew: 3.7.2

Ubuntu LTS 18.04 has the oldest version and so 3.4 is the new minimum.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 .gitlab-ci.yml             | 10 ----------
 configure                  |  4 +---
 crypto/cipher-nettle.c.inc | 31 -------------------------------
 crypto/hash-nettle.c       |  4 ----
 crypto/hmac-nettle.c       |  4 ----
 5 files changed, 1 insertion(+), 52 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 726450a46d..f012b16b79 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -707,16 +707,6 @@ build-coroutine-sigaltstack:
 #
 # These jobs test old gcrypt and nettle from RHEL7
 # which had some API differences.
-crypto-old-nettle:
-  <<: *native_build_job_definition
-  needs:
-    job: amd64-centos7-container
-  variables:
-    IMAGE: centos7
-    TARGETS: x86_64-softmmu x86_64-linux-user
-    CONFIGURE_ARGS: --disable-gcrypt --enable-nettle
-    MAKE_CHECK_ARGS: check
-
 crypto-old-gcrypt:
   <<: *native_build_job_definition
   needs:
diff --git a/configure b/configure
index 6fea3210bd..050299290d 100755
--- a/configure
+++ b/configure
@@ -2860,10 +2860,9 @@ has_libgcrypt() {
 
 if test "$nettle" != "no"; then
     pass="no"
-    if $pkg_config --exists "nettle >= 2.7.1"; then
+    if $pkg_config --exists "nettle >= 3.4"; then
         nettle_cflags=$($pkg_config --cflags nettle)
         nettle_libs=$($pkg_config --libs nettle)
-        nettle_version=$($pkg_config --modversion nettle)
         # Link test to make sure the given libraries work (e.g for static).
         write_c_skeleton
         if compile_prog "" "$nettle_libs" ; then
@@ -5731,7 +5730,6 @@ if test "$gcrypt" = "yes" ; then
 fi
 if test "$nettle" = "yes" ; then
   echo "CONFIG_NETTLE=y" >> $config_host_mak
-  echo "CONFIG_NETTLE_VERSION_MAJOR=${nettle_version%%.*}" >> $config_host_mak
   echo "NETTLE_CFLAGS=$nettle_cflags" >> $config_host_mak
   echo "NETTLE_LIBS=$nettle_libs" >> $config_host_mak
 fi
diff --git a/crypto/cipher-nettle.c.inc b/crypto/cipher-nettle.c.inc
index cac771e4ff..490472656c 100644
--- a/crypto/cipher-nettle.c.inc
+++ b/crypto/cipher-nettle.c.inc
@@ -39,41 +39,10 @@ typedef void (*QCryptoCipherNettleFuncWrapper)(const void *ctx,
                                                uint8_t *dst,
                                                const uint8_t *src);
 
-#if CONFIG_NETTLE_VERSION_MAJOR < 3
-typedef nettle_crypt_func * QCryptoCipherNettleFuncNative;
-typedef void *       cipher_ctx_t;
-typedef unsigned     cipher_length_t;
-#define CONST_CTX
-
-#define cast5_set_key cast128_set_key
-
-#define aes128_ctx aes_ctx
-#define aes192_ctx aes_ctx
-#define aes256_ctx aes_ctx
-#define aes128_set_encrypt_key(c, k) \
-    aes_set_encrypt_key(c, 16, k)
-#define aes192_set_encrypt_key(c, k) \
-    aes_set_encrypt_key(c, 24, k)
-#define aes256_set_encrypt_key(c, k) \
-    aes_set_encrypt_key(c, 32, k)
-#define aes128_set_decrypt_key(c, k) \
-    aes_set_decrypt_key(c, 16, k)
-#define aes192_set_decrypt_key(c, k) \
-    aes_set_decrypt_key(c, 24, k)
-#define aes256_set_decrypt_key(c, k) \
-    aes_set_decrypt_key(c, 32, k)
-#define aes128_encrypt aes_encrypt
-#define aes192_encrypt aes_encrypt
-#define aes256_encrypt aes_encrypt
-#define aes128_decrypt aes_decrypt
-#define aes192_decrypt aes_decrypt
-#define aes256_decrypt aes_decrypt
-#else
 typedef nettle_cipher_func * QCryptoCipherNettleFuncNative;
 typedef const void * cipher_ctx_t;
 typedef size_t       cipher_length_t;
 #define CONST_CTX    const
-#endif
 
 static inline bool qcrypto_length_check(size_t len, size_t blocksize,
                                         Error **errp)
diff --git a/crypto/hash-nettle.c b/crypto/hash-nettle.c
index 2a6ee7c7d5..5c8977fb80 100644
--- a/crypto/hash-nettle.c
+++ b/crypto/hash-nettle.c
@@ -26,11 +26,7 @@
 #include <nettle/sha.h>
 #include <nettle/ripemd160.h>
 
-#if CONFIG_NETTLE_VERSION_MAJOR < 3
-typedef unsigned int     hash_length_t;
-#else
 typedef size_t       hash_length_t;
-#endif
 
 typedef void (*qcrypto_nettle_init)(void *ctx);
 typedef void (*qcrypto_nettle_write)(void *ctx,
diff --git a/crypto/hmac-nettle.c b/crypto/hmac-nettle.c
index 1152b741fd..da6b6fa014 100644
--- a/crypto/hmac-nettle.c
+++ b/crypto/hmac-nettle.c
@@ -18,11 +18,7 @@
 #include "hmacpriv.h"
 #include <nettle/hmac.h>
 
-#if CONFIG_NETTLE_VERSION_MAJOR < 3
-typedef unsigned int hmac_length_t;
-#else
 typedef size_t hmac_length_t;
-#endif
 
 typedef void (*qcrypto_nettle_hmac_setkey)(void *ctx,
                                            hmac_length_t key_length,
-- 
2.31.1

[PATCH v2 04/12] crypto: drop back compatibility typedefs for nettle

[Daniel P. Berrangé]

Now that we only support modern nettle, we don't need to have local
typedefs to mask the real nettle types.

Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/cipher-nettle.c.inc | 60 ++++++++++++++++----------------------
 crypto/hash-nettle.c       |  6 ++--
 crypto/hmac-nettle.c       |  8 ++---
 3 files changed, 30 insertions(+), 44 deletions(-)

diff --git a/crypto/cipher-nettle.c.inc b/crypto/cipher-nettle.c.inc
index 490472656c..fc6f40c026 100644
--- a/crypto/cipher-nettle.c.inc
+++ b/crypto/cipher-nettle.c.inc
@@ -34,16 +34,6 @@
 #include <nettle/xts.h>
 #endif
 
-typedef void (*QCryptoCipherNettleFuncWrapper)(const void *ctx,
-                                               size_t length,
-                                               uint8_t *dst,
-                                               const uint8_t *src);
-
-typedef nettle_cipher_func * QCryptoCipherNettleFuncNative;
-typedef const void * cipher_ctx_t;
-typedef size_t       cipher_length_t;
-#define CONST_CTX    const
-
 static inline bool qcrypto_length_check(size_t len, size_t blocksize,
                                         Error **errp)
 {
@@ -166,12 +156,12 @@ static const struct QCryptoCipherDriver NAME##_driver_ctr = {           \
 static void NAME##_xts_wrape(const void *ctx, size_t length,            \
                              uint8_t *dst, const uint8_t *src)          \
 {                                                                       \
-    ENCRYPT((cipher_ctx_t)ctx, length, dst, src);                       \
+    ENCRYPT((const void *)ctx, length, dst, src);                       \
 }                                                                       \
 static void NAME##_xts_wrapd(const void *ctx, size_t length,            \
                              uint8_t *dst, const uint8_t *src)          \
 {                                                                       \
-    DECRYPT((cipher_ctx_t)ctx, length, dst, src);                       \
+    DECRYPT((const void *)ctx, length, dst, src);                       \
 }                                                                       \
 static int NAME##_encrypt_xts(QCryptoCipher *cipher, const void *in,    \
                               void *out, size_t len, Error **errp)      \
@@ -251,13 +241,13 @@ typedef struct QCryptoNettleDESRFB {
     uint8_t iv[DES_BLOCK_SIZE];
 } QCryptoNettleDESRFB;
 
-static void des_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
+static void des_encrypt_native(const void *ctx, size_t length,
                                uint8_t *dst, const uint8_t *src)
 {
     des_encrypt(ctx, length, dst, src);
 }
 
-static void des_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
+static void des_decrypt_native(const void *ctx, size_t length,
                                uint8_t *dst, const uint8_t *src)
 {
     des_decrypt(ctx, length, dst, src);
@@ -273,13 +263,13 @@ typedef struct QCryptoNettleDES3 {
     uint8_t iv[DES3_BLOCK_SIZE];
 } QCryptoNettleDES3;
 
-static void des3_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
+static void des3_encrypt_native(const void *ctx, size_t length,
                                 uint8_t *dst, const uint8_t *src)
 {
     des3_encrypt(ctx, length, dst, src);
 }
 
-static void des3_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
+static void des3_decrypt_native(const void *ctx, size_t length,
                                 uint8_t *dst, const uint8_t *src)
 {
     des3_decrypt(ctx, length, dst, src);
@@ -296,17 +286,17 @@ typedef struct QCryptoNettleAES128 {
     struct aes128_ctx key[2], key_xts[2];
 } QCryptoNettleAES128;
 
-static void aes128_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
+static void aes128_encrypt_native(const void *ctx, size_t length,
                                   uint8_t *dst, const uint8_t *src)
 {
-    CONST_CTX struct aes128_ctx *keys = ctx;
+    const struct aes128_ctx *keys = ctx;
     aes128_encrypt(&keys[0], length, dst, src);
 }
 
-static void aes128_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
+static void aes128_decrypt_native(const void *ctx, size_t length,
                                   uint8_t *dst, const uint8_t *src)
 {
-    CONST_CTX struct aes128_ctx *keys = ctx;
+    const struct aes128_ctx *keys = ctx;
     aes128_decrypt(&keys[1], length, dst, src);
 }
 
@@ -322,17 +312,17 @@ typedef struct QCryptoNettleAES192 {
     struct aes192_ctx key[2], key_xts[2];
 } QCryptoNettleAES192;
 
-static void aes192_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
+static void aes192_encrypt_native(const void *ctx, size_t length,
                                   uint8_t *dst, const uint8_t *src)
 {
-    CONST_CTX struct aes192_ctx *keys = ctx;
+    const struct aes192_ctx *keys = ctx;
     aes192_encrypt(&keys[0], length, dst, src);
 }
 
-static void aes192_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
+static void aes192_decrypt_native(const void *ctx, size_t length,
                                   uint8_t *dst, const uint8_t *src)
 {
-    CONST_CTX struct aes192_ctx *keys = ctx;
+    const struct aes192_ctx *keys = ctx;
     aes192_decrypt(&keys[1], length, dst, src);
 }
 
@@ -348,17 +338,17 @@ typedef struct QCryptoNettleAES256 {
     struct aes256_ctx key[2], key_xts[2];
 } QCryptoNettleAES256;
 
-static void aes256_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
+static void aes256_encrypt_native(const void *ctx, size_t length,
                                   uint8_t *dst, const uint8_t *src)
 {
-    CONST_CTX struct aes256_ctx *keys = ctx;
+    const struct aes256_ctx *keys = ctx;
     aes256_encrypt(&keys[0], length, dst, src);
 }
 
-static void aes256_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
-                               uint8_t *dst, const uint8_t *src)
+static void aes256_decrypt_native(const void *ctx, size_t length,
+                                  uint8_t *dst, const uint8_t *src)
 {
-    CONST_CTX struct aes256_ctx *keys = ctx;
+    const struct aes256_ctx *keys = ctx;
     aes256_decrypt(&keys[1], length, dst, src);
 }
 
@@ -373,13 +363,13 @@ typedef struct QCryptoNettleCAST128 {
     struct cast128_ctx key, key_xts;
 } QCryptoNettleCAST128;
 
-static void cast128_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
+static void cast128_encrypt_native(const void *ctx, size_t length,
                                    uint8_t *dst, const uint8_t *src)
 {
     cast128_encrypt(ctx, length, dst, src);
 }
 
-static void cast128_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
+static void cast128_decrypt_native(const void *ctx, size_t length,
                                    uint8_t *dst, const uint8_t *src)
 {
     cast128_decrypt(ctx, length, dst, src);
@@ -397,13 +387,13 @@ typedef struct QCryptoNettleSerpent {
 } QCryptoNettleSerpent;
 
 
-static void serpent_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
+static void serpent_encrypt_native(const void *ctx, size_t length,
                                    uint8_t *dst, const uint8_t *src)
 {
     serpent_encrypt(ctx, length, dst, src);
 }
 
-static void serpent_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
+static void serpent_decrypt_native(const void *ctx, size_t length,
                                    uint8_t *dst, const uint8_t *src)
 {
     serpent_decrypt(ctx, length, dst, src);
@@ -420,13 +410,13 @@ typedef struct QCryptoNettleTwofish {
     struct twofish_ctx key, key_xts;
 } QCryptoNettleTwofish;
 
-static void twofish_encrypt_native(cipher_ctx_t ctx, cipher_length_t length,
+static void twofish_encrypt_native(const void *ctx, size_t length,
                                    uint8_t *dst, const uint8_t *src)
 {
     twofish_encrypt(ctx, length, dst, src);
 }
 
-static void twofish_decrypt_native(cipher_ctx_t ctx, cipher_length_t length,
+static void twofish_decrypt_native(const void *ctx, size_t length,
                                    uint8_t *dst, const uint8_t *src)
 {
     twofish_decrypt(ctx, length, dst, src);
diff --git a/crypto/hash-nettle.c b/crypto/hash-nettle.c
index 5c8977fb80..1ca1a41062 100644
--- a/crypto/hash-nettle.c
+++ b/crypto/hash-nettle.c
@@ -26,14 +26,12 @@
 #include <nettle/sha.h>
 #include <nettle/ripemd160.h>
 
-typedef size_t       hash_length_t;
-
 typedef void (*qcrypto_nettle_init)(void *ctx);
 typedef void (*qcrypto_nettle_write)(void *ctx,
-                                     hash_length_t len,
+                                     size_t len,
                                      const uint8_t *buf);
 typedef void (*qcrypto_nettle_result)(void *ctx,
-                                      hash_length_t len,
+                                      size_t len,
                                       uint8_t *buf);
 
 union qcrypto_hash_ctx {
diff --git a/crypto/hmac-nettle.c b/crypto/hmac-nettle.c
index da6b6fa014..1ad6c4f253 100644
--- a/crypto/hmac-nettle.c
+++ b/crypto/hmac-nettle.c
@@ -18,18 +18,16 @@
 #include "hmacpriv.h"
 #include <nettle/hmac.h>
 
-typedef size_t hmac_length_t;
-
 typedef void (*qcrypto_nettle_hmac_setkey)(void *ctx,
-                                           hmac_length_t key_length,
+                                           size_t key_length,
                                            const uint8_t *key);
 
 typedef void (*qcrypto_nettle_hmac_update)(void *ctx,
-                                           hmac_length_t length,
+                                           size_t length,
                                            const uint8_t *data);
 
 typedef void (*qcrypto_nettle_hmac_digest)(void *ctx,
-                                           hmac_length_t length,
+                                           size_t length,
                                            uint8_t *digest);
 
 typedef struct QCryptoHmacNettle QCryptoHmacNettle;
-- 
2.31.1

[PATCH v2 05/12] crypto: bump min gcrypt to 1.8.0, dropping RHEL-7 support

[Daniel P. Berrangé]

It has been over two years since RHEL-8 was released, and thus per the
platform build policy, we no longer need to support RHEL-7 as a build
target. This lets us increment the minimum required gcrypt version and
assume that HMAC is always supported

Per repology, current shipping versions are:

             RHEL-8: 1.8.5
      Debian Buster: 1.8.4
 openSUSE Leap 15.2: 1.8.2
   Ubuntu LTS 18.04: 1.8.1
   Ubuntu LTS 20.04: 1.8.5
            FreeBSD: 1.9.2
          Fedora 33: 1.8.6
          Fedora 34: 1.9.3
            OpenBSD: 1.9.3
     macOS HomeBrew: 1.9.3

Ubuntu LTS 18.04 has the oldest version and so 1.8.0 is the new minimum.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 .gitlab-ci.yml     | 10 ----------
 configure          | 18 +-----------------
 crypto/meson.build |  6 +-----
 3 files changed, 2 insertions(+), 32 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index f012b16b79..f44c5b08ef 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -707,16 +707,6 @@ build-coroutine-sigaltstack:
 #
 # These jobs test old gcrypt and nettle from RHEL7
 # which had some API differences.
-crypto-old-gcrypt:
-  <<: *native_build_job_definition
-  needs:
-    job: amd64-centos7-container
-  variables:
-    IMAGE: centos7
-    TARGETS: x86_64-softmmu x86_64-linux-user
-    CONFIGURE_ARGS: --disable-nettle --enable-gcrypt
-    MAKE_CHECK_ARGS: check
-
 crypto-only-gnutls:
   <<: *native_build_job_definition
   needs:
diff --git a/configure b/configure
index 050299290d..f077cdb9c3 100755
--- a/configure
+++ b/configure
@@ -426,7 +426,6 @@ gnutls="$default_feature"
 nettle="$default_feature"
 nettle_xts="no"
 gcrypt="$default_feature"
-gcrypt_hmac="no"
 gcrypt_xts="no"
 qemu_private_xts="yes"
 auth_pam="$default_feature"
@@ -2849,7 +2848,7 @@ has_libgcrypt() {
     maj=`libgcrypt-config --version | awk -F . '{print $1}'`
     min=`libgcrypt-config --version | awk -F . '{print $2}'`
 
-    if test $maj != 1 || test $min -lt 5
+    if test $maj != 1 || test $min -lt 8
     then
        return 1
     fi
@@ -2915,18 +2914,6 @@ if test "$gcrypt" != "no"; then
         gcrypt="yes"
         cat > $TMPC << EOF
 #include <gcrypt.h>
-int main(void) {
-  gcry_mac_hd_t handle;
-  gcry_mac_open(&handle, GCRY_MAC_HMAC_MD5,
-                GCRY_MAC_FLAG_SECURE, NULL);
-  return 0;
-}
-EOF
-        if compile_prog "$gcrypt_cflags" "$gcrypt_libs" ; then
-            gcrypt_hmac=yes
-        fi
-        cat > $TMPC << EOF
-#include <gcrypt.h>
 int main(void) {
   gcry_cipher_hd_t handle;
   gcry_cipher_open(&handle, GCRY_CIPHER_AES, GCRY_CIPHER_MODE_XTS, 0);
@@ -5722,9 +5709,6 @@ if test "$gnutls" = "yes" ; then
 fi
 if test "$gcrypt" = "yes" ; then
   echo "CONFIG_GCRYPT=y" >> $config_host_mak
-  if test "$gcrypt_hmac" = "yes" ; then
-    echo "CONFIG_GCRYPT_HMAC=y" >> $config_host_mak
-  fi
   echo "GCRYPT_CFLAGS=$gcrypt_cflags" >> $config_host_mak
   echo "GCRYPT_LIBS=$gcrypt_libs" >> $config_host_mak
 fi
diff --git a/crypto/meson.build b/crypto/meson.build
index 7f37b5d335..af7e80c6f6 100644
--- a/crypto/meson.build
+++ b/crypto/meson.build
@@ -26,11 +26,7 @@ if 'CONFIG_NETTLE' in config_host
   crypto_ss.add(files('hash-nettle.c', 'hmac-nettle.c', 'pbkdf-nettle.c'))
 elif 'CONFIG_GCRYPT' in config_host
   crypto_ss.add(files('hash-gcrypt.c', 'pbkdf-gcrypt.c'))
-  if 'CONFIG_GCRYPT_HMAC' in config_host
-    crypto_ss.add(files('hmac-gcrypt.c'))
-  else
-    crypto_ss.add(files('hmac-glib.c'))
-  endif
+  crypto_ss.add(files('hmac-gcrypt.c'))
 else
   crypto_ss.add(files('hash-glib.c', 'hmac-glib.c', 'pbkdf-stub.c'))
 endif
-- 
2.31.1

[PATCH v2 06/12] crypto: bump min gnutls to 3.5.18, dropping RHEL-7 support

[Daniel P. Berrangé]

It has been over two years since RHEL-8 was released, and thus per the
platform build policy, we no longer need to support RHEL-7 as a build
target. This lets us increment the minimum required gnutls version

Per repology, current shipping versions are:

             RHEL-8: 3.6.14
      Debian Buster: 3.6.7
 openSUSE Leap 15.2: 3.6.7
   Ubuntu LTS 18.04: 3.5.18
   Ubuntu LTS 20.04: 3.6.13
            FreeBSD: 3.6.15
          Fedora 33: 3.6.16
          Fedora 34: 3.7.1
            OpenBSD: 3.6.15
     macOS HomeBrew: 3.6.15

Ubuntu LTS 18.04 has the oldest version and so 3.5.18 is the new minimum.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 .gitlab-ci.yml | 15 ---------------
 configure      |  2 +-
 2 files changed, 1 insertion(+), 16 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index f44c5b08ef..f386f445d9 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -703,21 +703,6 @@ build-coroutine-sigaltstack:
                     --enable-trace-backends=ftrace
     MAKE_CHECK_ARGS: check-unit
 
-# Most jobs test latest gcrypt or nettle builds
-#
-# These jobs test old gcrypt and nettle from RHEL7
-# which had some API differences.
-crypto-only-gnutls:
-  <<: *native_build_job_definition
-  needs:
-    job: amd64-centos7-container
-  variables:
-    IMAGE: centos7
-    TARGETS: x86_64-softmmu x86_64-linux-user
-    CONFIGURE_ARGS: --disable-nettle --disable-gcrypt --enable-gnutls
-    MAKE_CHECK_ARGS: check
-
-
 # Check our reduced build configurations
 build-without-default-devices:
   <<: *native_build_job_definition
diff --git a/configure b/configure
index f077cdb9c3..2fa86ccaa1 100755
--- a/configure
+++ b/configure
@@ -2790,7 +2790,7 @@ fi
 
 if test "$gnutls" != "no"; then
     pass="no"
-    if $pkg_config --exists "gnutls >= 3.1.18"; then
+    if $pkg_config --exists "gnutls >= 3.5.18"; then
         gnutls_cflags=$($pkg_config --cflags gnutls)
         gnutls_libs=$($pkg_config --libs gnutls)
         # Packaging for the static libraries is not always correct.
-- 
2.31.1

[PATCH v2 07/12] crypto: drop used conditional check

[Daniel P. Berrangé]

The condition being tested has never been set since the day the code was
first introduced.

Reviewed-by: Willian Rampazzo <willianr@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/tlscredsx509.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/crypto/tlscredsx509.c b/crypto/tlscredsx509.c
index bc503bab55..d9d6f4421e 100644
--- a/crypto/tlscredsx509.c
+++ b/crypto/tlscredsx509.c
@@ -354,11 +354,9 @@ qcrypto_tls_creds_check_cert_pair(gnutls_x509_crt_t cert,
             reason = "The certificate has been revoked";
         }
 
-#ifndef GNUTLS_1_0_COMPAT
         if (status & GNUTLS_CERT_INSECURE_ALGORITHM) {
             reason = "The certificate uses an insecure algorithm";
         }
-#endif
 
         error_setg(errp,
                    "Our own certificate %s failed validation against %s: %s",
-- 
2.31.1

[PATCH v2 08/12] tests/vm: convert centos VM recipe to CentOS 8

[Daniel P. Berrangé]

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 tests/vm/centos | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/tests/vm/centos b/tests/vm/centos
index efe3dbbb36..5c7bc1c1a9 100755
--- a/tests/vm/centos
+++ b/tests/vm/centos
@@ -26,24 +26,23 @@ class CentosVM(basevm.BaseVM):
         export SRC_ARCHIVE=/dev/vdb;
         sudo chmod a+r $SRC_ARCHIVE;
         tar -xf $SRC_ARCHIVE;
-        make docker-test-block@centos7 {verbose} J={jobs} NETWORK=1;
-        make docker-test-quick@centos7 {verbose} J={jobs} NETWORK=1;
+        make docker-test-block@centos8 {verbose} J={jobs} NETWORK=1;
+        make docker-test-quick@centos8 {verbose} J={jobs} NETWORK=1;
         make docker-test-mingw@fedora  {verbose} J={jobs} NETWORK=1;
     """
 
     def build_image(self, img):
-        cimg = self._download_with_cache("https://cloud.centos.org/centos/7/images/CentOS-7-x86_64-GenericCloud-1802.qcow2.xz")
+        cimg = self._download_with_cache("https://cloud.centos.org/centos/8/x86_64/images/CentOS-8-GenericCloud-8.3.2011-20201204.2.x86_64.qcow2")
         img_tmp = img + ".tmp"
-        sys.stderr.write("Extracting the image...\n")
-        subprocess.check_call(["ln", "-f", cimg, img_tmp + ".xz"])
-        subprocess.check_call(["xz", "--keep", "-dvf", img_tmp + ".xz"])
+        subprocess.check_call(["ln", "-f", cimg, img_tmp])
         self.exec_qemu_img("resize", img_tmp, "50G")
         self.boot(img_tmp, extra_args = ["-cdrom", self.gen_cloud_init_iso()])
         self.wait_ssh()
         self.ssh_root_check("touch /etc/cloud/cloud-init.disabled")
-        self.ssh_root_check("yum update -y")
-        self.ssh_root_check("yum install -y docker make ninja-build git python3")
-        self.ssh_root_check("systemctl enable docker")
+        self.ssh_root_check("dnf update -y")
+        self.ssh_root_check("dnf install -y dnf-plugins-core")
+        self.ssh_root_check("dnf config-manager --set-enabled powertools")
+        self.ssh_root_check("dnf install -y podman make ninja-build git python3")
         self.ssh_root("poweroff")
         self.wait()
         os.rename(img_tmp, img)
-- 
2.31.1

[PATCH v2 09/12] tests/docker: drop CentOS 7 container

[Daniel P. Berrangé]

It has been over two years since RHEL-8 was released, and thus per the
platform build policy, we no longer need to support RHEL-7 as a build
target.

Reviewed-by: Thomas Huth <thuth@redhat.com>
Acked-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Willian Rampazzo <willianr@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 .gitlab-ci.d/containers.yml             |  5 ---
 tests/docker/dockerfiles/centos7.docker | 43 -------------------------
 2 files changed, 48 deletions(-)
 delete mode 100644 tests/docker/dockerfiles/centos7.docker

diff --git a/.gitlab-ci.d/containers.yml b/.gitlab-ci.d/containers.yml
index 33e4046e23..0fd792dbe7 100644
--- a/.gitlab-ci.d/containers.yml
+++ b/.gitlab-ci.d/containers.yml
@@ -26,11 +26,6 @@ amd64-alpine-container:
   variables:
     NAME: alpine
 
-amd64-centos7-container:
-  <<: *container_job_definition
-  variables:
-    NAME: centos7
-
 amd64-centos8-container:
   <<: *container_job_definition
   variables:
diff --git a/tests/docker/dockerfiles/centos7.docker b/tests/docker/dockerfiles/centos7.docker
deleted file mode 100644
index 75fdb53c7c..0000000000
--- a/tests/docker/dockerfiles/centos7.docker
+++ /dev/null
@@ -1,43 +0,0 @@
-FROM centos:7
-RUN yum install -y epel-release centos-release-xen-48
-
-RUN yum -y update
-
-# Please keep this list sorted alphabetically
-ENV PACKAGES \
-    bzip2 \
-    bzip2-devel \
-    ccache \
-    csnappy-devel \
-    dbus-daemon \
-    gcc-c++ \
-    gcc \
-    gettext \
-    git \
-    glib2-devel \
-    glibc-static \
-    gnutls-devel \
-    libaio-devel \
-    libepoxy-devel \
-    libfdt-devel \
-    libgcrypt-devel \
-    librdmacm-devel \
-    libzstd-devel \
-    lzo-devel \
-    make \
-    mesa-libEGL-devel \
-    mesa-libgbm-devel \
-    nettle-devel \
-    ninja-build \
-    perl-Test-Harness \
-    pixman-devel \
-    python3 \
-    SDL2-devel \
-    spice-glib-devel \
-    spice-server-devel \
-    tar \
-    vte-devel \
-    xen-devel \
-    zlib-devel
-RUN yum install -y $PACKAGES
-RUN rpm -q $PACKAGES | sort > /packages.txt
-- 
2.31.1

[PATCH v2 10/12] configure: bump min required glib version to 2.56

[Daniel P. Berrangé]

The glib version was not previously constrained by RHEL-7 since it
rebases fairly often. Instead SLES 12 and Ubuntu 16.04 were the
constraints in 00f2cfbbec63fb6f5a7789797a62ccedd22466ea. Both of
these are old enough that they are outside our platform support
matrix now.

Per repology, current shipping versions are:

             RHEL-8: 2.56.4
      Debian Buster: 2.58.3
 openSUSE Leap 15.2: 2.62.6
   Ubuntu LTS 18.04: 2.56.4
   Ubuntu LTS 20.04: 2.64.6
            FreeBSD: 2.66.7
          Fedora 33: 2.66.8
          Fedora 34: 2.68.1
            OpenBSD: 2.68.1
     macOS HomeBrew: 2.68.1

Thus Ubuntu LTS 18.04 / RHEL-8 are the constraint for GLib version
at 2.56

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 configure             |   2 +-
 include/glib-compat.h |  13 +--
 util/oslib-win32.c    | 204 ------------------------------------------
 3 files changed, 3 insertions(+), 216 deletions(-)

diff --git a/configure b/configure
index 2fa86ccaa1..efd76368b5 100755
--- a/configure
+++ b/configure
@@ -3296,7 +3296,7 @@ done
 ##########################################
 # glib support probe
 
-glib_req_ver=2.48
+glib_req_ver=2.56
 glib_modules=gthread-2.0
 if test "$modules" = yes; then
     glib_modules="$glib_modules gmodule-export-2.0"
diff --git a/include/glib-compat.h b/include/glib-compat.h
index 4542e920d5..9e95c888f5 100644
--- a/include/glib-compat.h
+++ b/include/glib-compat.h
@@ -19,12 +19,12 @@
 /* Ask for warnings for anything that was marked deprecated in
  * the defined version, or before. It is a candidate for rewrite.
  */
-#define GLIB_VERSION_MIN_REQUIRED GLIB_VERSION_2_48
+#define GLIB_VERSION_MIN_REQUIRED GLIB_VERSION_2_56
 
 /* Ask for warnings if code tries to use function that did not
  * exist in the defined version. These risk breaking builds
  */
-#define GLIB_VERSION_MAX_ALLOWED GLIB_VERSION_2_48
+#define GLIB_VERSION_MAX_ALLOWED GLIB_VERSION_2_56
 
 #pragma GCC diagnostic push
 #pragma GCC diagnostic ignored "-Wdeprecated-declarations"
@@ -68,15 +68,6 @@
  * without generating warnings.
  */
 
-#if defined(_WIN32) && !GLIB_CHECK_VERSION(2, 50, 0)
-/*
- * g_poll has a problem on Windows when using
- * timeouts < 10ms, so use wrapper.
- */
-#define g_poll(fds, nfds, timeout) g_poll_fixed(fds, nfds, timeout)
-gint g_poll_fixed(GPollFD *fds, guint nfds, gint timeout);
-#endif
-
 #if defined(G_OS_UNIX)
 /*
  * Note: The fallback implementation is not MT-safe, and it returns a copy of
diff --git a/util/oslib-win32.c b/util/oslib-win32.c
index 05e4ee5033..ca99356fdf 100644
--- a/util/oslib-win32.c
+++ b/util/oslib-win32.c
@@ -347,210 +347,6 @@ const char *qemu_get_exec_dir(void)
     return exec_dir;
 }
 
-#if !GLIB_CHECK_VERSION(2, 50, 0)
-/*
- * The original implementation of g_poll from glib has a problem on Windows
- * when using timeouts < 10 ms.
- *
- * Whenever g_poll is called with timeout < 10 ms, it does a quick poll instead
- * of wait. This causes significant performance degradation of QEMU.
- *
- * The following code is a copy of the original code from glib/gpoll.c
- * (glib commit 20f4d1820b8d4d0fc4447188e33efffd6d4a88d8 from 2014-02-19).
- * Some debug code was removed and the code was reformatted.
- * All other code modifications are marked with 'QEMU'.
- */
-
-/*
- * gpoll.c: poll(2) abstraction
- * Copyright 1998 Owen Taylor
- * Copyright 2008 Red Hat, Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
- */
-
-static int poll_rest(gboolean poll_msgs, HANDLE *handles, gint nhandles,
-                     GPollFD *fds, guint nfds, gint timeout)
-{
-    DWORD ready;
-    GPollFD *f;
-    int recursed_result;
-
-    if (poll_msgs) {
-        /* Wait for either messages or handles
-         * -> Use MsgWaitForMultipleObjectsEx
-         */
-        ready = MsgWaitForMultipleObjectsEx(nhandles, handles, timeout,
-                                            QS_ALLINPUT, MWMO_ALERTABLE);
-
-        if (ready == WAIT_FAILED) {
-            gchar *emsg = g_win32_error_message(GetLastError());
-            g_warning("MsgWaitForMultipleObjectsEx failed: %s", emsg);
-            g_free(emsg);
-        }
-    } else if (nhandles == 0) {
-        /* No handles to wait for, just the timeout */
-        if (timeout == INFINITE) {
-            ready = WAIT_FAILED;
-        } else {
-            SleepEx(timeout, TRUE);
-            ready = WAIT_TIMEOUT;
-        }
-    } else {
-        /* Wait for just handles
-         * -> Use WaitForMultipleObjectsEx
-         */
-        ready =
-            WaitForMultipleObjectsEx(nhandles, handles, FALSE, timeout, TRUE);
-        if (ready == WAIT_FAILED) {
-            gchar *emsg = g_win32_error_message(GetLastError());
-            g_warning("WaitForMultipleObjectsEx failed: %s", emsg);
-            g_free(emsg);
-        }
-    }
-
-    if (ready == WAIT_FAILED) {
-        return -1;
-    } else if (ready == WAIT_TIMEOUT || ready == WAIT_IO_COMPLETION) {
-        return 0;
-    } else if (poll_msgs && ready == WAIT_OBJECT_0 + nhandles) {
-        for (f = fds; f < &fds[nfds]; ++f) {
-            if (f->fd == G_WIN32_MSG_HANDLE && f->events & G_IO_IN) {
-                f->revents |= G_IO_IN;
-            }
-        }
-
-        /* If we have a timeout, or no handles to poll, be satisfied
-         * with just noticing we have messages waiting.
-         */
-        if (timeout != 0 || nhandles == 0) {
-            return 1;
-        }
-
-        /* If no timeout and handles to poll, recurse to poll them,
-         * too.
-         */
-        recursed_result = poll_rest(FALSE, handles, nhandles, fds, nfds, 0);
-        return (recursed_result == -1) ? -1 : 1 + recursed_result;
-    } else if (/* QEMU: removed the following unneeded statement which causes
-                * a compiler warning: ready >= WAIT_OBJECT_0 && */
-               ready < WAIT_OBJECT_0 + nhandles) {
-        for (f = fds; f < &fds[nfds]; ++f) {
-            if ((HANDLE) f->fd == handles[ready - WAIT_OBJECT_0]) {
-                f->revents = f->events;
-            }
-        }
-
-        /* If no timeout and polling several handles, recurse to poll
-         * the rest of them.
-         */
-        if (timeout == 0 && nhandles > 1) {
-            /* Remove the handle that fired */
-            int i;
-            for (i = ready - WAIT_OBJECT_0 + 1; i < nhandles; i++) {
-                handles[i-1] = handles[i];
-            }
-            nhandles--;
-            recursed_result = poll_rest(FALSE, handles, nhandles, fds, nfds, 0);
-            return (recursed_result == -1) ? -1 : 1 + recursed_result;
-        }
-        return 1;
-    }
-
-    return 0;
-}
-
-gint g_poll_fixed(GPollFD *fds, guint nfds, gint timeout)
-{
-    HANDLE handles[MAXIMUM_WAIT_OBJECTS];
-    gboolean poll_msgs = FALSE;
-    GPollFD *f;
-    gint nhandles = 0;
-    int retval;
-
-    for (f = fds; f < &fds[nfds]; ++f) {
-        if (f->fd == G_WIN32_MSG_HANDLE && (f->events & G_IO_IN)) {
-            poll_msgs = TRUE;
-        } else if (f->fd > 0) {
-            /* Don't add the same handle several times into the array, as
-             * docs say that is not allowed, even if it actually does seem
-             * to work.
-             */
-            gint i;
-
-            for (i = 0; i < nhandles; i++) {
-                if (handles[i] == (HANDLE) f->fd) {
-                    break;
-                }
-            }
-
-            if (i == nhandles) {
-                if (nhandles == MAXIMUM_WAIT_OBJECTS) {
-                    g_warning("Too many handles to wait for!\n");
-                    break;
-                } else {
-                    handles[nhandles++] = (HANDLE) f->fd;
-                }
-            }
-        }
-    }
-
-    for (f = fds; f < &fds[nfds]; ++f) {
-        f->revents = 0;
-    }
-
-    if (timeout == -1) {
-        timeout = INFINITE;
-    }
-
-    /* Polling for several things? */
-    if (nhandles > 1 || (nhandles > 0 && poll_msgs)) {
-        /* First check if one or several of them are immediately
-         * available
-         */
-        retval = poll_rest(poll_msgs, handles, nhandles, fds, nfds, 0);
-
-        /* If not, and we have a significant timeout, poll again with
-         * timeout then. Note that this will return indication for only
-         * one event, or only for messages. We ignore timeouts less than
-         * ten milliseconds as they are mostly pointless on Windows, the
-         * MsgWaitForMultipleObjectsEx() call will timeout right away
-         * anyway.
-         *
-         * Modification for QEMU: replaced timeout >= 10 by timeout > 0.
-         */
-        if (retval == 0 && (timeout == INFINITE || timeout > 0)) {
-            retval = poll_rest(poll_msgs, handles, nhandles,
-                               fds, nfds, timeout);
-        }
-    } else {
-        /* Just polling for one thing, so no need to check first if
-         * available immediately
-         */
-        retval = poll_rest(poll_msgs, handles, nhandles, fds, nfds, timeout);
-    }
-
-    if (retval == -1) {
-        for (f = fds; f < &fds[nfds]; ++f) {
-            f->revents = 0;
-        }
-    }
-
-    return retval;
-}
-#endif
-
 int getpagesize(void)
 {
     SYSTEM_INFO system_info;
-- 
2.31.1

[PATCH v2 11/12] configure: bump min required GCC to 7.5.0

[Daniel P. Berrangé]

Several distros have been dropped since the last time we bumped the
minimum required GCC version.

Per repology, currently shipping versions are:

             RHEL-8: 8.3.1
      Debian Buster: 8.3.0
 openSUSE Leap 15.2: 7.5.0
   Ubuntu LTS 18.04: 7.5.0
   Ubuntu LTS 20.04: 9.3.0
            FreeBSD: 10.3.0
          Fedora 33: 9.2.0
          Fedora 34: 11.0.1
            OpenBSD: 8.4.0
     macOS HomeBrew: 11.1.0

With this list Ubuntu LTS 18.04 / openSUSE Leap 15.2 are the
constraint at 7.5.0

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 configure | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/configure b/configure
index efd76368b5..ac8520172a 100755
--- a/configure
+++ b/configure
@@ -2059,8 +2059,8 @@ cat > $TMPC << EOF
 #  endif
 # endif
 #elif defined(__GNUC__) && defined(__GNUC_MINOR__)
-# if __GNUC__ < 4 || (__GNUC__ == 4 && __GNUC_MINOR__ < 8)
-#  error You need at least GCC v4.8 to compile QEMU
+# if __GNUC__ < 7 || (__GNUC__ == 7 && __GNUC_MINOR__ < 5)
+#  error You need at least GCC v7.5.0 to compile QEMU
 # endif
 #else
 # error You either need GCC or Clang to compiler QEMU
@@ -2068,7 +2068,7 @@ cat > $TMPC << EOF
 int main (void) { return 0; }
 EOF
 if ! compile_prog "" "" ; then
-    error_exit "You need at least GCC v4.8 or Clang v3.4 (or XCode Clang v5.1)"
+    error_exit "You need at least GCC v7.5 or Clang v3.4 (or XCode Clang v5.1)"
 fi
 
 # Accumulate -Wfoo and -Wno-bar separately.
-- 
2.31.1

[PATCH v2 12/12] configure: bump min required CLang to 6.0 / XCode 10.0

[Daniel P. Berrangé]

Several distros have been dropped since the last time we bumped the
minimum required CLang version.

Per repology, currently shipping versions are:

             RHEL-8: 10.0.1
      Debian Buster: 7.0.1
 openSUSE Leap 15.2: 9.0.1
   Ubuntu LTS 18.04: 6.0.0
   Ubuntu LTS 20.04: 10.0.0
         FreeBSD 12: 8.0.1
          Fedora 33: 11.0.0
          Fedora 34: 11.1.0

With this list Ubuntu LTS 18.04 is the constraint at 6.0.0

An LLVM version of 6.0.0 corresponds to macOS XCode version of 10.0
which dates from Sept 2018.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 configure | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/configure b/configure
index ac8520172a..67e5a267c2 100755
--- a/configure
+++ b/configure
@@ -2050,12 +2050,12 @@ fi
 cat > $TMPC << EOF
 #if defined(__clang_major__) && defined(__clang_minor__)
 # ifdef __apple_build_version__
-#  if __clang_major__ < 5 || (__clang_major__ == 5 && __clang_minor__ < 1)
-#   error You need at least XCode Clang v5.1 to compile QEMU
+#  if __clang_major__ < 10 || (__clang_major__ == 10 && __clang_minor__ < 0)
+#   error You need at least XCode Clang v10.0 to compile QEMU
 #  endif
 # else
-#  if __clang_major__ < 3 || (__clang_major__ == 3 && __clang_minor__ < 4)
-#   error You need at least Clang v3.4 to compile QEMU
+#  if __clang_major__ < 6 || (__clang_major__ == 6 && __clang_minor__ < 0)
+#   error You need at least Clang v6.0 to compile QEMU
 #  endif
 # endif
 #elif defined(__GNUC__) && defined(__GNUC_MINOR__)
@@ -2068,7 +2068,7 @@ cat > $TMPC << EOF
 int main (void) { return 0; }
 EOF
 if ! compile_prog "" "" ; then
-    error_exit "You need at least GCC v7.5 or Clang v3.4 (or XCode Clang v5.1)"
+    error_exit "You need at least GCC v7.5 or Clang v6.0 (or XCode Clang v10.0)"
 fi
 
 # Accumulate -Wfoo and -Wno-bar separately.
-- 
2.31.1

Re: [PATCH v2 01/12] gitlab: drop linux user build job for CentOS 7

[Thomas Huth]

On 14/05/2021 14.04, Daniel P. Berrangé wrote:
> It has been over two years since RHEL-8 was released, and thus per the
> platform build policy, we no longer need to support RHEL-7 as a build
> target.
> 
> The build-user-centos7 job was to detect a failure specific to CentOS
> 7 and there are already other linux user jobs for other platforms.
> Thus we can drop this job rather than move it to CentOS 8.
> 
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
>   .gitlab-ci.yml | 9 ---------
>   1 file changed, 9 deletions(-)
> 
> diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
> index dcb6317aac..726450a46d 100644
> --- a/.gitlab-ci.yml
> +++ b/.gitlab-ci.yml
> @@ -441,15 +441,6 @@ build-user-plugins:
>       MAKE_CHECK_ARGS: check-tcg
>     timeout: 1h 30m
>   
> -build-user-centos7:
> -  <<: *native_build_job_definition
> -  needs:
> -    job: amd64-centos7-container
> -  variables:
> -    IMAGE: centos7
> -    CONFIGURE_ARGS: --disable-system --disable-tools --disable-docs
> -    MAKE_CHECK_ARGS: check-tcg
> -
>   build-some-softmmu-plugins:
>     <<: *native_build_job_definition
>     needs:
> 

Reviewed-by: Thomas Huth <thuth@redhat.com>

Re: [PATCH v2 02/12] patchew: move quick build job from CentOS 7 to CentOS 8 container

[Thomas Huth]

On 14/05/2021 14.04, Daniel P. Berrangé wrote:
> It has been over two years since RHEL-8 was released, and thus per the
> platform build policy, we no longer need to support RHEL-7 as a build
> target.
> 
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
>   .patchew.yml | 6 +++---
>   1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/.patchew.yml b/.patchew.yml
> index 988c29261f..2638b7f564 100644
> --- a/.patchew.yml
> +++ b/.patchew.yml
> @@ -88,7 +88,7 @@ email:
>           more information:
>   
>           {{ logtext }}
> -        {% elif test == "docker-mingw@fedora" or test == "docker-quick@centos7" or test == "asan" %}
> +        {% elif test == "docker-mingw@fedora" or test == "docker-quick@centos8" or test == "asan" %}
>           Hi,
>   
>           This series failed the {{ test }} build test. Please find the testing commands and
> @@ -124,13 +124,13 @@ testing:
>         script: |
>           #!/bin/bash
>           time make docker-test-debug@fedora TARGET_LIST=x86_64-softmmu J=14 NETWORK=1
> -    docker-quick@centos7:
> +    docker-quick@centos8:
>         enabled: false
>         requirements: docker,x86_64
>         timeout: 3600
>         script: |
>           #!/bin/bash
> -        time make docker-test-quick@centos7 SHOW_ENV=1 J=14 NETWORK=1
> +        time make docker-test-quick@centos8 SHOW_ENV=1 J=14 NETWORK=1
>       checkpatch:
>         enabled: true
>         requirements: ''
> 

Reviewed-by: Thomas Huth <thuth@redhat.com>

Re: [PATCH v2 03/12] crypto: bump min nettle to 3.4, dropping RHEL-7 support

[Thomas Huth]

On 14/05/2021 14.04, Daniel P. Berrangé wrote:
> It has been over two years since RHEL-8 was released, and thus per the
> platform build policy, we no longer need to support RHEL-7 as a build
> target. This lets us increment the minimum required nettle version and
> drop a lot of backwards compatibility code for 2.x series of nettle.
> 
> Per repology, current shipping versions are:
> 
>               RHEL-8: 3.4.1
>        Debian Buster: 3.4.1
>   openSUSE Leap 15.2: 3.4.1
>     Ubuntu LTS 18.04: 3.4
>     Ubuntu LTS 20.04: 3.5.1
>              FreeBSD: 3.7.2
>            Fedora 33: 3.5.1
>            Fedora 34: 3.7.2
>              OpenBSD: 3.7.2
>       macOS HomeBrew: 3.7.2
> 
> Ubuntu LTS 18.04 has the oldest version and so 3.4 is the new minimum.
> 
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
>   .gitlab-ci.yml             | 10 ----------
>   configure                  |  4 +---
>   crypto/cipher-nettle.c.inc | 31 -------------------------------
>   crypto/hash-nettle.c       |  4 ----
>   crypto/hmac-nettle.c       |  4 ----
>   5 files changed, 1 insertion(+), 52 deletions(-)

Reviewed-by: Thomas Huth <thuth@redhat.com>

Re: [PATCH v2 05/12] crypto: bump min gcrypt to 1.8.0, dropping RHEL-7 support

[Thomas Huth]

On 14/05/2021 14.04, Daniel P. Berrangé wrote:
> It has been over two years since RHEL-8 was released, and thus per the
> platform build policy, we no longer need to support RHEL-7 as a build
> target. This lets us increment the minimum required gcrypt version and
> assume that HMAC is always supported
> 
> Per repology, current shipping versions are:
> 
>               RHEL-8: 1.8.5
>        Debian Buster: 1.8.4
>   openSUSE Leap 15.2: 1.8.2
>     Ubuntu LTS 18.04: 1.8.1
>     Ubuntu LTS 20.04: 1.8.5
>              FreeBSD: 1.9.2
>            Fedora 33: 1.8.6
>            Fedora 34: 1.9.3
>              OpenBSD: 1.9.3
>       macOS HomeBrew: 1.9.3
> 
> Ubuntu LTS 18.04 has the oldest version and so 1.8.0 is the new minimum.

Maybe add a note why 1.8.0 and not 1.8.1 ? (if I see it correctly, the 
configure script does not check for the third digit?)

> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
>   .gitlab-ci.yml     | 10 ----------
>   configure          | 18 +-----------------
>   crypto/meson.build |  6 +-----
>   3 files changed, 2 insertions(+), 32 deletions(-)
> 
> diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
> index f012b16b79..f44c5b08ef 100644
> --- a/.gitlab-ci.yml
> +++ b/.gitlab-ci.yml
> @@ -707,16 +707,6 @@ build-coroutine-sigaltstack:
>   #
>   # These jobs test old gcrypt and nettle from RHEL7
>   # which had some API differences.
> -crypto-old-gcrypt:
> -  <<: *native_build_job_definition
> -  needs:
> -    job: amd64-centos7-container
> -  variables:
> -    IMAGE: centos7
> -    TARGETS: x86_64-softmmu x86_64-linux-user
> -    CONFIGURE_ARGS: --disable-nettle --enable-gcrypt
> -    MAKE_CHECK_ARGS: check
> -
>   crypto-only-gnutls:
>     <<: *native_build_job_definition
>     needs:
> diff --git a/configure b/configure
> index 050299290d..f077cdb9c3 100755
> --- a/configure
> +++ b/configure
> @@ -426,7 +426,6 @@ gnutls="$default_feature"
>   nettle="$default_feature"
>   nettle_xts="no"
>   gcrypt="$default_feature"
> -gcrypt_hmac="no"
>   gcrypt_xts="no"
>   qemu_private_xts="yes"
>   auth_pam="$default_feature"
> @@ -2849,7 +2848,7 @@ has_libgcrypt() {
>       maj=`libgcrypt-config --version | awk -F . '{print $1}'`
>       min=`libgcrypt-config --version | awk -F . '{print $2}'`
>   
> -    if test $maj != 1 || test $min -lt 5
> +    if test $maj != 1 || test $min -lt 8
>       then
>          return 1
>       fi
> @@ -2915,18 +2914,6 @@ if test "$gcrypt" != "no"; then
>           gcrypt="yes"
>           cat > $TMPC << EOF
>   #include <gcrypt.h>
> -int main(void) {
> -  gcry_mac_hd_t handle;
> -  gcry_mac_open(&handle, GCRY_MAC_HMAC_MD5,
> -                GCRY_MAC_FLAG_SECURE, NULL);
> -  return 0;
> -}
> -EOF
> -        if compile_prog "$gcrypt_cflags" "$gcrypt_libs" ; then
> -            gcrypt_hmac=yes
> -        fi
> -        cat > $TMPC << EOF
> -#include <gcrypt.h>
>   int main(void) {
>     gcry_cipher_hd_t handle;
>     gcry_cipher_open(&handle, GCRY_CIPHER_AES, GCRY_CIPHER_MODE_XTS, 0);
> @@ -5722,9 +5709,6 @@ if test "$gnutls" = "yes" ; then
>   fi
>   if test "$gcrypt" = "yes" ; then
>     echo "CONFIG_GCRYPT=y" >> $config_host_mak
> -  if test "$gcrypt_hmac" = "yes" ; then
> -    echo "CONFIG_GCRYPT_HMAC=y" >> $config_host_mak
> -  fi
>     echo "GCRYPT_CFLAGS=$gcrypt_cflags" >> $config_host_mak
>     echo "GCRYPT_LIBS=$gcrypt_libs" >> $config_host_mak
>   fi
> diff --git a/crypto/meson.build b/crypto/meson.build
> index 7f37b5d335..af7e80c6f6 100644
> --- a/crypto/meson.build
> +++ b/crypto/meson.build
> @@ -26,11 +26,7 @@ if 'CONFIG_NETTLE' in config_host
>     crypto_ss.add(files('hash-nettle.c', 'hmac-nettle.c', 'pbkdf-nettle.c'))
>   elif 'CONFIG_GCRYPT' in config_host
>     crypto_ss.add(files('hash-gcrypt.c', 'pbkdf-gcrypt.c'))
> -  if 'CONFIG_GCRYPT_HMAC' in config_host
> -    crypto_ss.add(files('hmac-gcrypt.c'))
> -  else
> -    crypto_ss.add(files('hmac-glib.c'))
> -  endif
> +  crypto_ss.add(files('hmac-gcrypt.c'))
> 

I think you could also add it to the previous line (as it is done with 
nettle) instead of adding it in a separate line. But well, that's just 
cosmetics, so either way:

Reviewed-by: Thomas Huth <thuth@redhat.com>

Re: [PATCH v2 06/12] crypto: bump min gnutls to 3.5.18, dropping RHEL-7 support

[Thomas Huth]

On 14/05/2021 14.04, Daniel P. Berrangé wrote:
> It has been over two years since RHEL-8 was released, and thus per the
> platform build policy, we no longer need to support RHEL-7 as a build
> target. This lets us increment the minimum required gnutls version
> 
> Per repology, current shipping versions are:
> 
>               RHEL-8: 3.6.14
>        Debian Buster: 3.6.7
>   openSUSE Leap 15.2: 3.6.7
>     Ubuntu LTS 18.04: 3.5.18
>     Ubuntu LTS 20.04: 3.6.13
>              FreeBSD: 3.6.15
>            Fedora 33: 3.6.16
>            Fedora 34: 3.7.1
>              OpenBSD: 3.6.15
>       macOS HomeBrew: 3.6.15
> 
> Ubuntu LTS 18.04 has the oldest version and so 3.5.18 is the new minimum.
> 
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
>   .gitlab-ci.yml | 15 ---------------
>   configure      |  2 +-
>   2 files changed, 1 insertion(+), 16 deletions(-)
> 
> diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
> index f44c5b08ef..f386f445d9 100644
> --- a/.gitlab-ci.yml
> +++ b/.gitlab-ci.yml
> @@ -703,21 +703,6 @@ build-coroutine-sigaltstack:
>                       --enable-trace-backends=ftrace
>       MAKE_CHECK_ARGS: check-unit
>   
> -# Most jobs test latest gcrypt or nettle builds
> -#
> -# These jobs test old gcrypt and nettle from RHEL7
> -# which had some API differences.
> -crypto-only-gnutls:
> -  <<: *native_build_job_definition
> -  needs:
> -    job: amd64-centos7-container
> -  variables:
> -    IMAGE: centos7
> -    TARGETS: x86_64-softmmu x86_64-linux-user
> -    CONFIGURE_ARGS: --disable-nettle --disable-gcrypt --enable-gnutls
> -    MAKE_CHECK_ARGS: check
> -
> -
>   # Check our reduced build configurations
>   build-without-default-devices:
>     <<: *native_build_job_definition
> diff --git a/configure b/configure
> index f077cdb9c3..2fa86ccaa1 100755
> --- a/configure
> +++ b/configure
> @@ -2790,7 +2790,7 @@ fi
>   
>   if test "$gnutls" != "no"; then
>       pass="no"
> -    if $pkg_config --exists "gnutls >= 3.1.18"; then
> +    if $pkg_config --exists "gnutls >= 3.5.18"; then
>           gnutls_cflags=$($pkg_config --cflags gnutls)
>           gnutls_libs=$($pkg_config --libs gnutls)
>           # Packaging for the static libraries is not always correct.
> 

Reviewed-by: Thomas Huth <thuth@redhat.com>

Re: [PATCH v2 11/12] configure: bump min required GCC to 7.5.0

[Thomas Huth]

On 14/05/2021 14.04, Daniel P. Berrangé wrote:
> Several distros have been dropped since the last time we bumped the
> minimum required GCC version.
> 
> Per repology, currently shipping versions are:
> 
>               RHEL-8: 8.3.1
>        Debian Buster: 8.3.0
>   openSUSE Leap 15.2: 7.5.0
>     Ubuntu LTS 18.04: 7.5.0
>     Ubuntu LTS 20.04: 9.3.0
>              FreeBSD: 10.3.0
>            Fedora 33: 9.2.0
>            Fedora 34: 11.0.1
>              OpenBSD: 8.4.0
>       macOS HomeBrew: 11.1.0
> 
> With this list Ubuntu LTS 18.04 / openSUSE Leap 15.2 are the
> constraint at 7.5.0
> 
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
>   configure | 6 +++---
>   1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/configure b/configure
> index efd76368b5..ac8520172a 100755
> --- a/configure
> +++ b/configure
> @@ -2059,8 +2059,8 @@ cat > $TMPC << EOF
>   #  endif
>   # endif
>   #elif defined(__GNUC__) && defined(__GNUC_MINOR__)
> -# if __GNUC__ < 4 || (__GNUC__ == 4 && __GNUC_MINOR__ < 8)
> -#  error You need at least GCC v4.8 to compile QEMU
> +# if __GNUC__ < 7 || (__GNUC__ == 7 && __GNUC_MINOR__ < 5)
> +#  error You need at least GCC v7.5.0 to compile QEMU
>   # endif
>   #else
>   # error You either need GCC or Clang to compiler QEMU
> @@ -2068,7 +2068,7 @@ cat > $TMPC << EOF
>   int main (void) { return 0; }
>   EOF
>   if ! compile_prog "" "" ; then
> -    error_exit "You need at least GCC v4.8 or Clang v3.4 (or XCode Clang v5.1)"
> +    error_exit "You need at least GCC v7.5 or Clang v3.4 (or XCode Clang v5.1)"
>   fi
>   
>   # Accumulate -Wfoo and -Wno-bar separately.
> 

Reviewed-by: Thomas Huth <thuth@redhat.com>

Re: [PATCH v2 12/12] configure: bump min required CLang to 6.0 / XCode 10.0

[Philippe Mathieu-Daudé]

On 5/14/21 2:04 PM, Daniel P. Berrangé wrote:
> Several distros have been dropped since the last time we bumped the
> minimum required CLang version.
> 
> Per repology, currently shipping versions are:
> 
>              RHEL-8: 10.0.1
>       Debian Buster: 7.0.1
>  openSUSE Leap 15.2: 9.0.1
>    Ubuntu LTS 18.04: 6.0.0
>    Ubuntu LTS 20.04: 10.0.0
>          FreeBSD 12: 8.0.1
>           Fedora 33: 11.0.0
>           Fedora 34: 11.1.0
> 
> With this list Ubuntu LTS 18.04 is the constraint at 6.0.0
> 
> An LLVM version of 6.0.0 corresponds to macOS XCode version of 10.0
> which dates from Sept 2018.
> 
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
>  configure | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Re: [PATCH v2 10/12] configure: bump min required glib version to 2.56

[Thomas Huth]

On 14/05/2021 14.04, Daniel P. Berrangé wrote:
> The glib version was not previously constrained by RHEL-7 since it
> rebases fairly often. Instead SLES 12 and Ubuntu 16.04 were the
> constraints in 00f2cfbbec63fb6f5a7789797a62ccedd22466ea. Both of
> these are old enough that they are outside our platform support
> matrix now.
> 
> Per repology, current shipping versions are:
> 
>               RHEL-8: 2.56.4
>        Debian Buster: 2.58.3
>   openSUSE Leap 15.2: 2.62.6
>     Ubuntu LTS 18.04: 2.56.4
>     Ubuntu LTS 20.04: 2.64.6
>              FreeBSD: 2.66.7
>            Fedora 33: 2.66.8
>            Fedora 34: 2.68.1
>              OpenBSD: 2.68.1
>       macOS HomeBrew: 2.68.1
> 
> Thus Ubuntu LTS 18.04 / RHEL-8 are the constraint for GLib version
> at 2.56
> 
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
>   configure             |   2 +-
>   include/glib-compat.h |  13 +--
>   util/oslib-win32.c    | 204 ------------------------------------------
>   3 files changed, 3 insertions(+), 216 deletions(-)

Reviewed-by: Thomas Huth <thuth@redhat.com>

Re: [PATCH v2 02/12] patchew: move quick build job from CentOS 7 to CentOS 8 container

[Willian Rampazzo]

On Fri, May 14, 2021 at 9:04 AM Daniel P. Berrangé <berrange@redhat.com> wrote:
>
> It has been over two years since RHEL-8 was released, and thus per the
> platform build policy, we no longer need to support RHEL-7 as a build
> target.
>
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
>  .patchew.yml | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
>

Reviewed-by: Willian Rampazzo <willianr@redhat.com>

Re: [PATCH v2 01/12] gitlab: drop linux user build job for CentOS 7

[Willian Rampazzo]

On Fri, May 14, 2021 at 9:04 AM Daniel P. Berrangé <berrange@redhat.com> wrote:
>
> It has been over two years since RHEL-8 was released, and thus per the
> platform build policy, we no longer need to support RHEL-7 as a build
> target.
>
> The build-user-centos7 job was to detect a failure specific to CentOS
> 7 and there are already other linux user jobs for other platforms.
> Thus we can drop this job rather than move it to CentOS 8.
>
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
>  .gitlab-ci.yml | 9 ---------
>  1 file changed, 9 deletions(-)
>

Reviewed-by: Willian Rampazzo <willianr@redhat.com>

Re: [PATCH v2 03/12] crypto: bump min nettle to 3.4, dropping RHEL-7 support

[Willian Rampazzo]

On Fri, May 14, 2021 at 9:04 AM Daniel P. Berrangé <berrange@redhat.com> wrote:
>
> It has been over two years since RHEL-8 was released, and thus per the
> platform build policy, we no longer need to support RHEL-7 as a build
> target. This lets us increment the minimum required nettle version and
> drop a lot of backwards compatibility code for 2.x series of nettle.
>
> Per repology, current shipping versions are:
>
>              RHEL-8: 3.4.1
>       Debian Buster: 3.4.1
>  openSUSE Leap 15.2: 3.4.1
>    Ubuntu LTS 18.04: 3.4
>    Ubuntu LTS 20.04: 3.5.1
>             FreeBSD: 3.7.2
>           Fedora 33: 3.5.1
>           Fedora 34: 3.7.2
>             OpenBSD: 3.7.2
>      macOS HomeBrew: 3.7.2
>
> Ubuntu LTS 18.04 has the oldest version and so 3.4 is the new minimum.
>
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
>  .gitlab-ci.yml             | 10 ----------
>  configure                  |  4 +---
>  crypto/cipher-nettle.c.inc | 31 -------------------------------
>  crypto/hash-nettle.c       |  4 ----
>  crypto/hmac-nettle.c       |  4 ----
>  5 files changed, 1 insertion(+), 52 deletions(-)
>

Reviewed-by: Willian Rampazzo <willianr@redhat.com>

Re: [PATCH v2 04/12] crypto: drop back compatibility typedefs for nettle

[Willian Rampazzo]

On Fri, May 14, 2021 at 9:04 AM Daniel P. Berrangé <berrange@redhat.com> wrote:
>
> Now that we only support modern nettle, we don't need to have local
> typedefs to mask the real nettle types.
>
> Reviewed-by: Thomas Huth <thuth@redhat.com>
> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
>  crypto/cipher-nettle.c.inc | 60 ++++++++++++++++----------------------
>  crypto/hash-nettle.c       |  6 ++--
>  crypto/hmac-nettle.c       |  8 ++---
>  3 files changed, 30 insertions(+), 44 deletions(-)
>

Reviewed-by: Willian Rampazzo <willianr@redhat.com>̉̉

Re: [PATCH v2 06/12] crypto: bump min gnutls to 3.5.18, dropping RHEL-7 support

[Willian Rampazzo]

On Fri, May 14, 2021 at 9:04 AM Daniel P. Berrangé <berrange@redhat.com> wrote:
>
> It has been over two years since RHEL-8 was released, and thus per the
> platform build policy, we no longer need to support RHEL-7 as a build
> target. This lets us increment the minimum required gnutls version
>
> Per repology, current shipping versions are:
>
>              RHEL-8: 3.6.14
>       Debian Buster: 3.6.7
>  openSUSE Leap 15.2: 3.6.7
>    Ubuntu LTS 18.04: 3.5.18
>    Ubuntu LTS 20.04: 3.6.13
>             FreeBSD: 3.6.15
>           Fedora 33: 3.6.16
>           Fedora 34: 3.7.1
>             OpenBSD: 3.6.15
>      macOS HomeBrew: 3.6.15
>
> Ubuntu LTS 18.04 has the oldest version and so 3.5.18 is the new minimum.
>
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
>  .gitlab-ci.yml | 15 ---------------
>  configure      |  2 +-
>  2 files changed, 1 insertion(+), 16 deletions(-)
>

Reviewed-by: Willian Rampazzo <willianr@redhat.com>

Re: [PATCH v2 08/12] tests/vm: convert centos VM recipe to CentOS 8

[Willian Rampazzo]

On Fri, May 14, 2021 at 9:05 AM Daniel P. Berrangé <berrange@redhat.com> wrote:
>
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
>  tests/vm/centos | 17 ++++++++---------
>  1 file changed, 8 insertions(+), 9 deletions(-)
>
> diff --git a/tests/vm/centos b/tests/vm/centos
> index efe3dbbb36..5c7bc1c1a9 100755
> --- a/tests/vm/centos
> +++ b/tests/vm/centos
> @@ -26,24 +26,23 @@ class CentosVM(basevm.BaseVM):
>          export SRC_ARCHIVE=/dev/vdb;
>          sudo chmod a+r $SRC_ARCHIVE;
>          tar -xf $SRC_ARCHIVE;
> -        make docker-test-block@centos7 {verbose} J={jobs} NETWORK=1;
> -        make docker-test-quick@centos7 {verbose} J={jobs} NETWORK=1;
> +        make docker-test-block@centos8 {verbose} J={jobs} NETWORK=1;
> +        make docker-test-quick@centos8 {verbose} J={jobs} NETWORK=1;
>          make docker-test-mingw@fedora  {verbose} J={jobs} NETWORK=1;
>      """
>
>      def build_image(self, img):
> -        cimg = self._download_with_cache("https://cloud.centos.org/centos/7/images/CentOS-7-x86_64-GenericCloud-1802.qcow2.xz")
> +        cimg = self._download_with_cache("https://cloud.centos.org/centos/8/x86_64/images/CentOS-8-GenericCloud-8.3.2011-20201204.2.x86_64.qcow2")

I wonder why they didn't keep the compressed option for download.

Reviewed-by: Willian Rampazzo <willianr@redhat.com>

Re: [PATCH v2 10/12] configure: bump min required glib version to 2.56

[Willian Rampazzo]

On Fri, May 14, 2021 at 9:05 AM Daniel P. Berrangé <berrange@redhat.com> wrote:
>
> The glib version was not previously constrained by RHEL-7 since it
> rebases fairly often. Instead SLES 12 and Ubuntu 16.04 were the
> constraints in 00f2cfbbec63fb6f5a7789797a62ccedd22466ea. Both of
> these are old enough that they are outside our platform support
> matrix now.
>
> Per repology, current shipping versions are:
>
>              RHEL-8: 2.56.4
>       Debian Buster: 2.58.3
>  openSUSE Leap 15.2: 2.62.6
>    Ubuntu LTS 18.04: 2.56.4
>    Ubuntu LTS 20.04: 2.64.6
>             FreeBSD: 2.66.7
>           Fedora 33: 2.66.8
>           Fedora 34: 2.68.1
>             OpenBSD: 2.68.1
>      macOS HomeBrew: 2.68.1
>
> Thus Ubuntu LTS 18.04 / RHEL-8 are the constraint for GLib version
> at 2.56
>
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
>  configure             |   2 +-
>  include/glib-compat.h |  13 +--
>  util/oslib-win32.c    | 204 ------------------------------------------
>  3 files changed, 3 insertions(+), 216 deletions(-)
>

Reviewed-by: Willian Rampazzo <willianr@redhat.com>

Re: [PATCH v2 11/12] configure: bump min required GCC to 7.5.0

[Willian Rampazzo]

On Fri, May 14, 2021 at 9:05 AM Daniel P. Berrangé <berrange@redhat.com> wrote:
>
> Several distros have been dropped since the last time we bumped the
> minimum required GCC version.
>
> Per repology, currently shipping versions are:
>
>              RHEL-8: 8.3.1
>       Debian Buster: 8.3.0
>  openSUSE Leap 15.2: 7.5.0
>    Ubuntu LTS 18.04: 7.5.0
>    Ubuntu LTS 20.04: 9.3.0
>             FreeBSD: 10.3.0
>           Fedora 33: 9.2.0
>           Fedora 34: 11.0.1
>             OpenBSD: 8.4.0
>      macOS HomeBrew: 11.1.0
>
> With this list Ubuntu LTS 18.04 / openSUSE Leap 15.2 are the
> constraint at 7.5.0
>
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
>  configure | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
>

Reviewed-by: Willian Rampazzo <willianr@redhat.com>

Re: [PATCH v2 12/12] configure: bump min required CLang to 6.0 / XCode 10.0

[Willian Rampazzo]

On Fri, May 14, 2021 at 9:06 AM Daniel P. Berrangé <berrange@redhat.com> wrote:
>
> Several distros have been dropped since the last time we bumped the
> minimum required CLang version.
>
> Per repology, currently shipping versions are:
>
>              RHEL-8: 10.0.1
>       Debian Buster: 7.0.1
>  openSUSE Leap 15.2: 9.0.1
>    Ubuntu LTS 18.04: 6.0.0
>    Ubuntu LTS 20.04: 10.0.0
>          FreeBSD 12: 8.0.1
>           Fedora 33: 11.0.0
>           Fedora 34: 11.1.0
>
> With this list Ubuntu LTS 18.04 is the constraint at 6.0.0
>
> An LLVM version of 6.0.0 corresponds to macOS XCode version of 10.0
> which dates from Sept 2018.
>
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
>  configure | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)
>

Reviewed-by: Willian Rampazzo <willianr@redhat.com>

Re: [PATCH v2 08/12] tests/vm: convert centos VM recipe to CentOS 8

[Daniel P. Berrangé]

On Fri, May 14, 2021 at 02:31:50PM -0300, Willian Rampazzo wrote:
> On Fri, May 14, 2021 at 9:05 AM Daniel P. Berrangé <berrange@redhat.com> wrote:
> >
> > Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> > ---
> >  tests/vm/centos | 17 ++++++++---------
> >  1 file changed, 8 insertions(+), 9 deletions(-)
> >
> > diff --git a/tests/vm/centos b/tests/vm/centos
> > index efe3dbbb36..5c7bc1c1a9 100755
> > --- a/tests/vm/centos
> > +++ b/tests/vm/centos
> > @@ -26,24 +26,23 @@ class CentosVM(basevm.BaseVM):
> >          export SRC_ARCHIVE=/dev/vdb;
> >          sudo chmod a+r $SRC_ARCHIVE;
> >          tar -xf $SRC_ARCHIVE;
> > -        make docker-test-block@centos7 {verbose} J={jobs} NETWORK=1;
> > -        make docker-test-quick@centos7 {verbose} J={jobs} NETWORK=1;
> > +        make docker-test-block@centos8 {verbose} J={jobs} NETWORK=1;
> > +        make docker-test-quick@centos8 {verbose} J={jobs} NETWORK=1;
> >          make docker-test-mingw@fedora  {verbose} J={jobs} NETWORK=1;
> >      """
> >
> >      def build_image(self, img):
> > -        cimg = self._download_with_cache("https://cloud.centos.org/centos/7/images/CentOS-7-x86_64-GenericCloud-1802.qcow2.xz")
> > +        cimg = self._download_with_cache("https://cloud.centos.org/centos/8/x86_64/images/CentOS-8-GenericCloud-8.3.2011-20201204.2.x86_64.qcow2")
> 
> I wonder why they didn't keep the compressed option for download.

Yeah, its pretty annoying to have a download that is 1.2 GB in size
instead of 260 MB :-(

BTW, if you notice a slightly older CentOS 8 image there that is
only 680 MB in size, don't get too excited because the image is
majorly broken. Many files are 0 bytes in size including "make"
so its unusable for QEMU :-(

> Reviewed-by: Willian Rampazzo <willianr@redhat.com>
> 

Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|

Re: [PATCH v2 01/12] gitlab: drop linux user build job for CentOS 7

[Philippe Mathieu-Daudé]

On Fri, May 14, 2021 at 2:04 PM Daniel P. Berrangé <berrange@redhat.com> wrote:
>
> It has been over two years since RHEL-8 was released, and thus per the
> platform build policy, we no longer need to support RHEL-7 as a build
> target.
>
> The build-user-centos7 job was to detect a failure specific to CentOS
> 7 and there are already other linux user jobs for other platforms.
> Thus we can drop this job rather than move it to CentOS 8.
>
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
>  .gitlab-ci.yml | 9 ---------
>  1 file changed, 9 deletions(-)

Thanks, patch applied to gitlab-ci-next.