[PATCH v2] meson.build: re-add explicit gcrypt/nettle request check

[PATCH v2] meson.build: re-add explicit gcrypt/nettle request check

[Luc Michel]

c4b3d0074 removed the check that nettle or gcrypt were explicitly
requested as the crypto library to use, breaking the --enable-nettle and
--enable-gcrypt options. Re-add the logic to force usage of nettle or
gcrypt for crypto operations, while still keeping gnutls for TLS.

Fixes: c4b3d0074 (crypto: bump min gnutls to 3.7.5)
Signed-off-by: Luc Michel <luc.michel@amd.com>
---
v2:
   - Revert more of c4b3d0074 to restore the gnutls_crypto logic to
     disable gnutls only for crypto ops but keep it for TLS [Daniel]
---
 meson.build                    | 11 ++++++++++-
 crypto/cipher.c                |  2 +-
 tests/unit/test-crypto-block.c |  3 ++-
 crypto/meson.build             |  2 +-
 4 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/meson.build b/meson.build
index 164328ded83..06c43b43581 100644
--- a/meson.build
+++ b/meson.build
@@ -1781,15 +1781,17 @@ if not get_option('libcbor').auto() or have_system
   libcbor = dependency('libcbor', version: '>=0.7.0',
                        required: get_option('libcbor'))
 endif
 
 gnutls = not_found
+gnutls_crypto = not_found
 gnutls_bug1717_workaround = false
 if get_option('gnutls').enabled() or (get_option('gnutls').auto() and have_system)
   gnutls = dependency('gnutls', version: '>=3.7.5',
                       method: 'pkg-config',
                       required: get_option('gnutls'))
+  gnutls_crypto = gnutls
 
   #if gnutls.found() and not get_option('gnutls-bug1717-workaround').disabled()
     # XXX: when bug 1717 is resolved, add logic to probe for
     # the GNUTLS fixed version number to handle the 'auto' case
   #  gnutls_bug1717_workaround = true
@@ -1809,11 +1811,16 @@ crypto_sm3 = not_found
 
 if get_option('nettle').enabled() and get_option('gcrypt').enabled()
   error('Only one of gcrypt & nettle can be enabled')
 endif
 
-if not gnutls.found()
+# Explicit nettle/gcrypt request, so ignore gnutls for crypto
+if get_option('nettle').enabled() or get_option('gcrypt').enabled()
+  gnutls_crypto = not_found
+endif
+
+if not gnutls_crypto.found()
   if (not get_option('gcrypt').auto() or have_system) and not get_option('nettle').enabled()
     gcrypt = dependency('libgcrypt', version: '>=1.9.4',
                         required: get_option('gcrypt'))
     # Debian has removed -lgpg-error from libgcrypt-config
     # as it "spreads unnecessary dependencies" which in
@@ -2511,10 +2518,11 @@ config_host_data.set('CONFIG_VIRTFS', have_virtfs)
 config_host_data.set('CONFIG_VTE', vte.found())
 config_host_data.set('CONFIG_XKBCOMMON', xkbcommon.found())
 config_host_data.set('CONFIG_KEYUTILS', keyutils.found())
 config_host_data.set('CONFIG_GETTID', has_gettid)
 config_host_data.set('CONFIG_GNUTLS', gnutls.found())
+config_host_data.set('CONFIG_GNUTLS_CRYPTO', gnutls_crypto.found())
 config_host_data.set('CONFIG_GNUTLS_BUG1717_WORKAROUND', gnutls_bug1717_workaround)
 config_host_data.set('CONFIG_TASN1', tasn1.found())
 config_host_data.set('CONFIG_GCRYPT', gcrypt.found())
 config_host_data.set('CONFIG_NETTLE', nettle.found())
 config_host_data.set('CONFIG_CRYPTO_SM4', crypto_sm4.found())
@@ -4863,10 +4871,11 @@ summary(summary_info, bool_yn: true, section: 'Block layer support')
 # Crypto
 summary_info = {}
 summary_info += {'TLS priority':      get_option('tls_priority')}
 summary_info += {'GNUTLS support':    gnutls}
 if gnutls.found()
+  summary_info += {'  GNUTLS crypto':   gnutls_crypto.found()}
   summary_info += {'  GNUTLS bug 1717 workaround': gnutls_bug1717_workaround }
 endif
 summary_info += {'libgcrypt':         gcrypt}
 summary_info += {'nettle':            nettle}
 summary_info += {'SM4 ALG support':   crypto_sm4}
diff --git a/crypto/cipher.c b/crypto/cipher.c
index 515165e0dc0..229710f76b4 100644
--- a/crypto/cipher.c
+++ b/crypto/cipher.c
@@ -140,11 +140,11 @@ qcrypto_cipher_validate_key_length(QCryptoCipherAlgo alg,
 
 #ifdef CONFIG_GCRYPT
 #include "cipher-gcrypt.c.inc"
 #elif defined CONFIG_NETTLE
 #include "cipher-nettle.c.inc"
-#elif defined CONFIG_GNUTLS
+#elif defined CONFIG_GNUTLS_CRYPTO
 #include "cipher-gnutls.c.inc"
 #else
 #include "cipher-stub.c.inc"
 #endif
 
diff --git a/tests/unit/test-crypto-block.c b/tests/unit/test-crypto-block.c
index 218e585f988..3ac7f17b2a0 100644
--- a/tests/unit/test-crypto-block.c
+++ b/tests/unit/test-crypto-block.c
@@ -29,11 +29,12 @@
 #ifndef _WIN32
 #include <sys/resource.h>
 #endif
 
 #if (defined(_WIN32) || defined RUSAGE_THREAD) && \
-    (defined(CONFIG_NETTLE) || defined(CONFIG_GCRYPT))
+    (defined(CONFIG_NETTLE) || defined(CONFIG_GCRYPT) || \
+     defined(CONFIG_GNUTLS_CRYPTO))
 #define TEST_LUKS
 #else
 #undef TEST_LUKS
 #endif
 
diff --git a/crypto/meson.build b/crypto/meson.build
index b51597a8792..6ac83857aaa 100644
--- a/crypto/meson.build
+++ b/crypto/meson.build
@@ -36,11 +36,11 @@ if nettle.found()
   if hogweed.found()
     crypto_ss.add(gmp, hogweed)
   endif
 elif gcrypt.found()
   crypto_ss.add(gcrypt, files('hash-gcrypt.c', 'hmac-gcrypt.c', 'pbkdf-gcrypt.c'))
-elif gnutls.found()
+elif gnutls_crypto.found()
   crypto_ss.add(gnutls, files('hash-gnutls.c', 'hmac-gnutls.c', 'pbkdf-gnutls.c'))
 else
   crypto_ss.add(files('hash-glib.c', 'hmac-glib.c', 'pbkdf-stub.c'))
 endif
 
-- 
2.53.0

Re: [PATCH v2] meson.build: re-add explicit gcrypt/nettle request check

[Pierrick Bouvier]

On 7/10/2026 6:25 AM, Luc Michel wrote:
> c4b3d0074 removed the check that nettle or gcrypt were explicitly
> requested as the crypto library to use, breaking the --enable-nettle and
> --enable-gcrypt options. Re-add the logic to force usage of nettle or
> gcrypt for crypto operations, while still keeping gnutls for TLS.
> 
> Fixes: c4b3d0074 (crypto: bump min gnutls to 3.7.5)
> Signed-off-by: Luc Michel <luc.michel@amd.com>
> ---
> v2:
>    - Revert more of c4b3d0074 to restore the gnutls_crypto logic to
>      disable gnutls only for crypto ops but keep it for TLS [Daniel]
> ---
>  meson.build                    | 11 ++++++++++-
>  crypto/cipher.c                |  2 +-
>  tests/unit/test-crypto-block.c |  3 ++-
>  crypto/meson.build             |  2 +-
>  4 files changed, 14 insertions(+), 4 deletions(-)
> 

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>

Re: [PATCH v2] meson.build: re-add explicit gcrypt/nettle request check

[Daniel P. Berrangé]

On Fri, Jul 10, 2026 at 03:25:30PM +0200, Luc Michel wrote:
> c4b3d0074 removed the check that nettle or gcrypt were explicitly
> requested as the crypto library to use, breaking the --enable-nettle and
> --enable-gcrypt options. Re-add the logic to force usage of nettle or
> gcrypt for crypto operations, while still keeping gnutls for TLS.
> 
> Fixes: c4b3d0074 (crypto: bump min gnutls to 3.7.5)
> Signed-off-by: Luc Michel <luc.michel@amd.com>
> ---
> v2:
>    - Revert more of c4b3d0074 to restore the gnutls_crypto logic to
>      disable gnutls only for crypto ops but keep it for TLS [Daniel]
> ---
>  meson.build                    | 11 ++++++++++-
>  crypto/cipher.c                |  2 +-
>  tests/unit/test-crypto-block.c |  3 ++-
>  crypto/meson.build             |  2 +-
>  4 files changed, 14 insertions(+), 4 deletions(-)

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>

and queued.

With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|