.gitignore

@@ -1,2 +1,2 @@
 SOURCES/libguestfs.keyring
-SOURCES/libnbd-1.18.1.tar.gz
+SOURCES/libnbd-1.6.0.tar.gz

.libnbd.metadata

@@ -1,2 +1,2 @@
-cc1b37b9cfafa515aab3eefd345ecc59aac2ce7b SOURCES/libguestfs.keyring
+1bbc40f501a7fef9eef2a39b701a71aee2fea7c4 SOURCES/libguestfs.keyring
-4f99e6f21edffe62b394aa9c7fb68149e6d4d5e4 SOURCES/libnbd-1.18.1.tar.gz
+b14ac9349d324df71d26cf3de9fb606c56f18cb0 SOURCES/libnbd-1.6.0.tar.gz

SOURCES/0001-copy-copy-nbd-to-sparse-file.sh-Skip-test-unless-nbd.patch

@@ -0,0 +1,30 @@
+From 486799e853aa9df034366303230a1785087a507a Mon Sep 17 00:00:00 2001
+From: "Richard W.M. Jones" <rjones@redhat.com>
+Date: Fri, 8 Jan 2021 12:14:18 +0000
+Subject: [PATCH] copy/copy-nbd-to-sparse-file.sh: Skip test unless nbdkit
+ available.
+
+This test used nbdkit without checking it is available, which broke
+the test on RHEL 8 i686.
+
+Fixes: commit 28fe8d9d8d1ecb491070d20f22e2f34bb147f19f
+(cherry picked from commit 781cb44b63a87f2d5f40590ab8c446ad2e7b6702)
+---
+ copy/copy-nbd-to-sparse-file.sh | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/copy/copy-nbd-to-sparse-file.sh b/copy/copy-nbd-to-sparse-file.sh
+index aa2cb1b9..47ff09ae 100755
+--- a/copy/copy-nbd-to-sparse-file.sh
++++ b/copy/copy-nbd-to-sparse-file.sh
+@@ -24,6 +24,7 @@ set -x
+ requires cmp --version
+ requires dd --version
+ requires dd oflag=seek_bytes </dev/null
++requires nbdkit --version
+ requires test -r /dev/urandom
+ requires test -r /dev/zero
+ 
+-- 
+2.43.0
+

SOURCES/0001-generator-Fix-assertion-in-ext-mode-BLOCK_STATUS-CVE.patch

@@ -1,88 +0,0 @@
-From 4451e5b61ca07771ceef3e012223779e7a0c7701 Mon Sep 17 00:00:00 2001
-From: Eric Blake <eblake@redhat.com>
-Date: Mon, 30 Oct 2023 12:50:53 -0500
-Subject: [PATCH] generator: Fix assertion in ext-mode BLOCK_STATUS,
- CVE-2023-5871
-
-Another round of fuzz testing revealed that when a server negotiates
-extended headers and replies with a 64-bit flag value where the client
-used the 32-bit API command, we were correctly flagging the server's
-response as being an EOVERFLOW condition, but then immediately failing
-in an assertion failure instead of reporting it to the application.
-
-The following one-byte change to qemu.git at commit fd9a38fd43 allows
-the creation of an intentionally malicious server:
-
-| diff --git i/nbd/server.c w/nbd/server.c
-| index 859c163d19f..32e1e771a95 100644
-| --- i/nbd/server.c
-| +++ w/nbd/server.c
-| @@ -2178,7 +2178,7 @@ static void nbd_extent_array_convert_to_be(NBDExtentArray *ea)
-|
-|      for (i = 0; i < ea->count; i++) {
-|          ea->extents[i].length = cpu_to_be64(ea->extents[i].length);
-| -        ea->extents[i].flags = cpu_to_be64(ea->extents[i].flags);
-| +        ea->extents[i].flags = ~cpu_to_be64(ea->extents[i].flags);
-|      }
-|  }
-
-and can then be detected with the following command line:
-
-$ nbdsh -c - <<\EOF
-> def f(a,b,c,d):
->   pass
->
-> h.connect_systemd_socket_activation(["/path/to/bad/qemu-nbd",
->   "-r", "-f", "raw", "TODO"])
-> h.block_staus(h.get_size(), 0, f)
-> EOF
-nbdsh: generator/states-reply-chunk.c:626: enter_STATE_REPLY_CHUNK_REPLY_RECV_BS_ENTRIES: Assertion `(len | flags) <= UINT32_MAX' failed.
-Aborted (core dumped)
-
-whereas a fixed libnbd will give:
-
-nbdsh: command line script failed: nbd_block_status: block-status: command failed: Value too large for defined data type
-
-We can either relax the assertion (by changing to 'assert ((len |
-flags) <= UINT32_MAX || cmd->error)'), or intentionally truncate flags
-to make the existing assertion reliable.  This patch goes with the
-latter approach.
-
-Sadly, this crash is possible in all existing 1.18.x stable releases,
-if they were built with assertions enabled (most distros do this by
-default), meaning a malicious server has an easy way to cause a Denial
-of Service attack by triggering the assertion failure in vulnerable
-clients, so we have assigned this CVE-2023-5871.  Mitigating factors:
-the crash only happens for a server that sends a 64-bit status block
-reply (no known production servers do so; qemu 8.2 will be the first
-known server to support extended headers, but it is not yet released);
-and as usual, a client can use TLS to guarantee it is connecting only
-to a known-safe server.  If libnbd is compiled without assertions,
-there is no crash or other mistaken behavior; and when assertions are
-enabled, the attacker cannot accomplish anything more than a denial of
-service.
-
-Reported-by: Richard W.M. Jones <rjones@redhat.com>
-Fixes: 20dadb0e10 ("generator: Prepare for extent64 callback", v1.17.4)
-Signed-off-by: Eric Blake <eblake@redhat.com>
-(cherry picked from commit 177308adb17e81fce7c0f2b2fcf655c5c0b6a4d6)
-Signed-off-by: Eric Blake <eblake@redhat.com>
----
- generator/states-reply-chunk.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/generator/states-reply-chunk.c b/generator/states-reply-chunk.c
-index 5a31c192..8ab7e8ba 100644
---- a/generator/states-reply-chunk.c
-+++ b/generator/states-reply-chunk.c
-@@ -600,6 +600,7 @@ STATE_MACHINE {
-             break; /* Skip this and later extents; we already made progress */
-           /* Expose this extent as an error; we made no progress */
-           cmd->error = cmd->error ? : EOVERFLOW;
-+          flags = (uint32_t)flags;
-         }
-       }
- 
--- 
-2.43.0
-

SOURCES/0002-docs-Fix-incorrect-xref-in-libnbd-release-notes-for-.patch

@@ -1,32 +0,0 @@
-From c39e31b7a20c7dc8aa12c5fa3f1742824e1e0c76 Mon Sep 17 00:00:00 2001
-From: "Richard W.M. Jones" <rjones@redhat.com>
-Date: Thu, 9 Nov 2023 09:40:30 +0000
-Subject: [PATCH] docs: Fix incorrect xref in libnbd-release-notes for 1.18
-
-LIBNBD_STRICT_AUTO_FLAG was added to nbd_set_strict_mode(3).
-
-Reported-by: Vera Wu
-(cherry picked from commit 4fef3dbc07e631fce58487d25d991e83bbb424b1)
-Signed-off-by: Eric Blake <eblake@redhat.com>
----
- docs/libnbd-release-notes-1.18.pod | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/docs/libnbd-release-notes-1.18.pod b/docs/libnbd-release-notes-1.18.pod
-index 935fab11..836ebe19 100644
---- a/docs/libnbd-release-notes-1.18.pod
-+++ b/docs/libnbd-release-notes-1.18.pod
-@@ -84,8 +84,8 @@ Golang, OCaml and Python language bindings (Eric Blake).
- 
- L<nbd_shutdown(3)> now works correctly when in opt mode (Eric Blake).
- 
--L<nbd_set_string(3)> adds C<LIBNBD_STRICT_AUTO_FLAG> which allows the
--client to test how servers behave when the payload length flag is
-+L<nbd_set_strict_mode(3)> adds C<LIBNBD_STRICT_AUTO_FLAG> which allows
-+the client to test how servers behave when the payload length flag is
- adjusted (Eric Blake).
- 
- =head2 Protocol
--- 
-2.43.0
-

SOURCES/0002-generator-Refactor-CONNECT.START-state.patch

@@ -0,0 +1,57 @@
+From 5dc2d2261224c9533d2b5ec4df6ed822de4cfc3b Mon Sep 17 00:00:00 2001
+From: "Richard W.M. Jones" <rjones@redhat.com>
+Date: Thu, 4 Feb 2021 17:57:06 +0000
+Subject: [PATCH] generator: Refactor CONNECT.START state.
+
+Small, neutral refactoring to the CONNECT.START to make the subsequent
+commit easier.
+
+(cherry picked from commit cd231fd94bbfaacdd9b89e7d355ba2bbc83c2aeb)
+---
+ generator/states-connect.c | 21 ++++++++++-----------
+ 1 file changed, 10 insertions(+), 11 deletions(-)
+
+diff --git a/generator/states-connect.c b/generator/states-connect.c
+index 392879d4..03b34c7d 100644
+--- a/generator/states-connect.c
++++ b/generator/states-connect.c
+@@ -47,11 +47,12 @@ disable_nagle (int sock)
+ 
+ STATE_MACHINE {
+  CONNECT.START:
+-  int fd;
++  sa_family_t family;
++  int fd, r;
+ 
+   assert (!h->sock);
+-  fd = socket (h->connaddr.ss_family,
+-               SOCK_STREAM|SOCK_NONBLOCK|SOCK_CLOEXEC, 0);
++  family = h->connaddr.ss_family;
++  fd = socket (family, SOCK_STREAM|SOCK_NONBLOCK|SOCK_CLOEXEC, 0);
+   if (fd == -1) {
+     SET_NEXT_STATE (%.DEAD);
+     set_error (errno, "socket");
+@@ -65,14 +66,12 @@ STATE_MACHINE {
+ 
+   disable_nagle (fd);
+ 
+-  if (connect (fd, (struct sockaddr *) &h->connaddr,
+-               h->connaddrlen) == -1) {
+-    if (errno != EINPROGRESS) {
+-      SET_NEXT_STATE (%.DEAD);
+-      set_error (errno, "connect");
+-      return 0;
+-    }
+-  }
++  r = connect (fd, (struct sockaddr *) &h->connaddr, h->connaddrlen);
++  if (r == 0 || (r == -1 && errno == EINPROGRESS))
++    return 0;
++  assert (r == -1);
++  SET_NEXT_STATE (%.DEAD);
++  set_error (errno, "connect");
+   return 0;
+ 
+  CONNECT.CONNECTING:
+-- 
+2.43.0
+

SOURCES/0003-generator-Print-a-better-error-message-if-connect-2-.patch

@@ -0,0 +1,48 @@
+From f094472efcf34cea8bf1f02a1c5c9442ffc4ca53 Mon Sep 17 00:00:00 2001
+From: "Richard W.M. Jones" <rjones@redhat.com>
+Date: Thu, 4 Feb 2021 18:02:46 +0000
+Subject: [PATCH] generator: Print a better error message if connect(2) returns
+ EAGAIN.
+
+The new error message is:
+
+nbd_connect_unix: connect: server backlog overflowed, see https://bugzilla.redhat.com/1925045: Resource temporarily unavailable
+
+Fixes: https://bugzilla.redhat.com/1925045
+Thanks: Xin Long, Lukas Doktor, Eric Blake
+Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
+(cherry picked from commit 85ed74960a658a82d7b61b0be07f43d1b2dcede9)
+---
+ generator/states-connect.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/generator/states-connect.c b/generator/states-connect.c
+index 03b34c7d..98c26e54 100644
+--- a/generator/states-connect.c
++++ b/generator/states-connect.c
+@@ -70,6 +70,22 @@ STATE_MACHINE {
+   if (r == 0 || (r == -1 && errno == EINPROGRESS))
+     return 0;
+   assert (r == -1);
++#ifdef __linux__
++  if (errno == EAGAIN && family == AF_UNIX) {
++    /* This can happen on Linux when connecting to a Unix domain
++     * socket, if the server's backlog is full.  Unfortunately there
++     * is nothing good we can do on the client side when this happens
++     * since any solution would involve sleeping or busy-waiting.  The
++     * only solution is on the server side, increasing the backlog.
++     * But at least improve the error message.
++     * https://bugzilla.redhat.com/1925045
++     */
++    SET_NEXT_STATE (%.DEAD);
++    set_error (errno, "connect: server backlog overflowed, "
++               "see https://bugzilla.redhat.com/1925045");
++    return 0;
++  }
++#endif
+   SET_NEXT_STATE (%.DEAD);
+   set_error (errno, "connect");
+   return 0;
+-- 
+2.43.0
+

SOURCES/0003-tests-Check-behavior-of-nbd_set_strict_mode-STRICT_A.patch

@@ -1,205 +0,0 @@
-From 32cb9ab9f1701b1a1a826b48f2083cb75adf1e87 Mon Sep 17 00:00:00 2001
-From: Eric Blake <eblake@redhat.com>
-Date: Thu, 9 Nov 2023 20:11:08 -0600
-Subject: [PATCH] tests: Check behavior of
- nbd_set_strict_mode(STRICT_AUTO_FLAG)
-
-While developing extended header support for qemu 8.2, I needed a way
-to make libnbd quickly behave as a non-compliant client to test corner
-cases in qemu's server code; so I wrote commit 5c1dae9236 ("api: Add
-LIBNBD_STRICT_AUTO_FLAG to nbd_set_strict", v1.18.0) to meet my needs.
-However, I failed to codify my manual tests of that bit into a unit
-test for libnbd, until now.  Most sane clients will never call
-nbd_set_strict_mode() in the first place (after all, it is explicitly
-documented as an integration tool, which is how I used it with my qemu
-code development), but it never hurts to make sure we don't break it
-even for the relatively small set of users that would ever use it.
-
-The test added here runs in two parts; if you get a SKIP despite
-having qemu-nbd, then the first part ran successfully before the
-second half gave up due to lack of extended headers in qemu
-(presumably qemu 8.1 or older); if you get a PASS, then both parts
-were run.  However, both parts are inherently fragile, depending on
-behavior known to be in qemu 8.2 - while it is unlikely to change in
-future qemu releases (at least as long as I continue to maintain NBD
-code there), the fact that we are intentionally violating the NBD
-protocol means a different server is within its rights to behave
-differently than qemu 8.2 did.  Hence this test lives in interop/
-rather than tests/ because of its strong ties to a particular qemu.
-
-Signed-off-by: Eric Blake <eblake@redhat.com>
-(cherry picked from commit 54d4426394c372413f55f648d4ad1d21b3395e07)
-Signed-off-by: Eric Blake <eblake@redhat.com>
----
- interop/Makefile.am              |   2 +
- interop/strict-mode-auto-flag.sh | 138 +++++++++++++++++++++++++++++++
- 2 files changed, 140 insertions(+)
- create mode 100755 interop/strict-mode-auto-flag.sh
-
-diff --git a/interop/Makefile.am b/interop/Makefile.am
-index d6485adf..ac12d84a 100644
---- a/interop/Makefile.am
-+++ b/interop/Makefile.am
-@@ -28,6 +28,7 @@ EXTRA_DIST = \
- 	structured-read.sh \
- 	opt-extended-headers.sh \
- 	block-status-payload.sh \
-+	strict-mode-auto-flag.sh \
- 	$(NULL)
- 
- TESTS_ENVIRONMENT = \
-@@ -153,6 +154,7 @@ TESTS += \
- 	interop-qemu-block-size.sh \
- 	opt-extended-headers.sh \
- 	block-status-payload.sh \
-+	strict-mode-auto-flag.sh \
- 	$(NULL)
- 
- interop_qemu_nbd_SOURCES = \
-diff --git a/interop/strict-mode-auto-flag.sh b/interop/strict-mode-auto-flag.sh
-new file mode 100755
-index 00000000..8f73ea73
---- /dev/null
-+++ b/interop/strict-mode-auto-flag.sh
-@@ -0,0 +1,138 @@
-+#!/usr/bin/env bash
-+# nbd client library in userspace
-+# Copyright Red Hat
-+#
-+# This library is free software; you can redistribute it and/or
-+# modify it under the terms of the GNU Lesser General Public
-+# License as published by the Free Software Foundation; either
-+# version 2 of the License, or (at your option) any later version.
-+#
-+# This library is distributed in the hope that it will be useful,
-+# but WITHOUT ANY WARRANTY; without even the implied warranty of
-+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-+# Lesser General Public License for more details.
-+#
-+# You should have received a copy of the GNU Lesser General Public
-+# License along with this library; if not, write to the Free Software
-+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
-+
-+# Test effect of AUTO_FLAG bit in set_strict_mode()
-+
-+source ../tests/functions.sh
-+set -e
-+set -x
-+
-+requires truncate --version
-+requires qemu-nbd --version
-+requires nbdsh --version
-+
-+file="strict-mode-auto-flag.file"
-+rm -f $file
-+cleanup_fn rm -f $file
-+
-+truncate -s 1M $file
-+
-+# Unconditional part of test: behavior when extended headers are not in use
-+$VG nbdsh -c '
-+import errno
-+
-+h.set_request_extended_headers(False)
-+args = ["qemu-nbd", "-f", "raw", "'"$file"'"]
-+h.connect_systemd_socket_activation(args)
-+assert h.get_extended_headers_negotiated() is False
-+
-+# STRICT_AUTO_FLAG and STRICT_COMMANDS are on by default
-+flags = h.get_strict_mode()
-+assert flags & nbd.STRICT_AUTO_FLAG
-+assert flags & nbd.STRICT_COMMANDS
-+
-+# Under STRICT_AUTO_FLAG, using or omitting flag does not matter; client
-+# side auto-corrects the flag before passing to server
-+h.pwrite(b"1"*512, 0, 0)
-+h.pwrite(b"2"*512, 0, nbd.CMD_FLAG_PAYLOAD_LEN)
-+
-+# Without STRICT_AUTO_FLAG but still STRICT_COMMANDS, client side now sees
-+# attempts to use the flag as invalid
-+flags = flags & ~nbd.STRICT_AUTO_FLAG
-+h.set_strict_mode(flags)
-+h.pwrite(b"3"*512, 0, 0)
-+stats = h.stats_bytes_sent()
-+try:
-+  h.pwrite(b"4"*512, 0, nbd.CMD_FLAG_PAYLOAD_LEN)
-+  assert False
-+except nbd.Error as e:
-+  assert e.errnum == errno.EINVAL
-+assert stats == h.stats_bytes_sent()
-+
-+# Warning: fragile test ahead.  Without STRICT_COMMANDS, we send unexpected
-+# flag to qemu, and expect failure. For qemu <= 8.1, this is safe (those
-+# versions did not know the flag, and correctly reject unknown flags with
-+# NBD_EINVAL). For qemu 8.2, this also works (qemu knows the flag, but warns
-+# that we were not supposed to send it without extended headers). But if
-+# future qemu versions change to start silently ignoring the flag (after all,
-+# a write command obviously has a payload even without extended headers, so
-+# the flag is redundant for NBD_CMD_WRITE), then we may need to tweak this.
-+flags = flags & ~nbd.STRICT_COMMANDS
-+h.set_strict_mode(flags)
-+h.pwrite(b"5"*512, 0, 0)
-+stats = h.stats_bytes_sent()
-+try:
-+  h.pwrite(b"6"*512, 0, nbd.CMD_FLAG_PAYLOAD_LEN)
-+  print("Did newer qemu change behavior?")
-+  assert False
-+except nbd.Error as e:
-+  assert e.errnum == errno.EINVAL
-+assert stats < h.stats_bytes_sent()
-+
-+h.shutdown()
-+'
-+
-+# Conditional part of test: only run if qemu supports extended headers
-+requires nbdinfo --has extended-headers -- [ qemu-nbd -r -f raw "$file" ]
-+$VG nbdsh -c '
-+import errno
-+
-+args = ["qemu-nbd", "-f", "raw", "'"$file"'"]
-+h.connect_systemd_socket_activation(args)
-+assert h.get_extended_headers_negotiated() is True
-+
-+# STRICT_AUTO_FLAG and STRICT_COMMANDS are on by default
-+flags = h.get_strict_mode()
-+assert flags & nbd.STRICT_AUTO_FLAG
-+assert flags & nbd.STRICT_COMMANDS
-+
-+# Under STRICT_AUTO_FLAG, using or omitting flag does not matter; client
-+# side auto-corrects the flag before passing to server
-+h.pwrite(b"1"*512, 0, 0)
-+h.pwrite(b"2"*512, 0, nbd.CMD_FLAG_PAYLOAD_LEN)
-+
-+# Without STRICT_AUTO_FLAG but still STRICT_COMMANDS, client side now sees
-+# attempts to omit the flag as invalid
-+flags = flags & ~nbd.STRICT_AUTO_FLAG
-+h.set_strict_mode(flags)
-+h.pwrite(b"3"*512, 0, nbd.CMD_FLAG_PAYLOAD_LEN)
-+stats = h.stats_bytes_sent()
-+try:
-+  h.pwrite(b"4"*512, 0, 0)
-+  assert False
-+except nbd.Error as e:
-+  assert e.errnum == errno.EINVAL
-+assert stats == h.stats_bytes_sent()
-+
-+# Warning: fragile test ahead.  Without STRICT_COMMANDS, omitting the flag
-+# is a protocol violation. qemu 8.2 silently ignores the violation; but a
-+# future qemu might start failing the command, at which point we would need
-+# to tweak this part of the test.
-+flags = flags & ~nbd.STRICT_COMMANDS
-+h.set_strict_mode(flags)
-+h.pwrite(b"5"*512, 0, nbd.CMD_FLAG_PAYLOAD_LEN)
-+stats = h.stats_bytes_sent()
-+try:
-+  h.pwrite(b"6"*512, 0, 0)
-+except nbd.Error:
-+  print("Did newer qemu change behavior?")
-+  assert False
-+assert stats < h.stats_bytes_sent()
-+
-+h.shutdown()
-+'
--- 
-2.43.0
-

SOURCES/0004-opt_go-Tolerate-unplanned-server-death.patch

@@ -0,0 +1,59 @@
+From ffe8f0a994c1f2656aa011353b386663d32db69e Mon Sep 17 00:00:00 2001
+From: Eric Blake <eblake@redhat.com>
+Date: Mon, 1 Mar 2021 15:25:31 -0600
+Subject: [PATCH] opt_go: Tolerate unplanned server death
+
+While debugging some experimental nbdkit code that was triggering an
+assertion failure in nbdkit, I noticed a secondary failure of nbdsh
+also dying from an assertion:
+
+libnbd: debug: nbdsh: nbd_opt_go: transition: NEWSTYLE.OPT_GO.SEND -> DEAD
+libnbd: debug: nbdsh: nbd_opt_go: option queued, ignoring state machine failure
+nbdsh: opt.c:86: nbd_unlocked_opt_go: Assertion `nbd_internal_is_state_negotiating (get_next_state (h))' failed.
+
+Although my trigger was from non-production nbdkit code, libnbd should
+never die from an assertion failure merely because a server
+disappeared at the wrong moment during an incomplete reply to
+NBD_OPT_GO or NBD_OPT_INFO.  If this is assigned a CVE, a followup
+patch will add mention of it in docs/libnbd-security.pod.
+
+Fixes: bbf1c51392 (api: Give aio_opt_go a completion callback)
+(cherry picked from commit fb4440de9cc76e9c14bd3ddf3333e78621f40ad0)
+---
+ lib/opt.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/lib/opt.c b/lib/opt.c
+index 2317b72a..e5802f4d 100644
+--- a/lib/opt.c
++++ b/lib/opt.c
+@@ -1,5 +1,5 @@
+ /* NBD client library in userspace
+- * Copyright (C) 2020 Red Hat Inc.
++ * Copyright (C) 2020-2021 Red Hat Inc.
+  *
+  * This library is free software; you can redistribute it and/or
+  * modify it under the terms of the GNU Lesser General Public
+@@ -83,7 +83,8 @@ nbd_unlocked_opt_go (struct nbd_handle *h)
+ 
+   r = wait_for_option (h);
+   if (r == 0 && err) {
+-    assert (nbd_internal_is_state_negotiating (get_next_state (h)));
++    assert (nbd_internal_is_state_negotiating (get_next_state (h)) ||
++            nbd_internal_is_state_dead (get_next_state (h)));
+     set_error (err, "server replied with error to opt_go request");
+     return -1;
+   }
+@@ -105,7 +106,8 @@ nbd_unlocked_opt_info (struct nbd_handle *h)
+ 
+   r = wait_for_option (h);
+   if (r == 0 && err) {
+-    assert (nbd_internal_is_state_negotiating (get_next_state (h)));
++    assert (nbd_internal_is_state_negotiating (get_next_state (h)) ||
++            nbd_internal_is_state_dead (get_next_state (h)));
+     set_error (err, "server replied with error to opt_info request");
+     return -1;
+   }
+-- 
+2.43.0
+

SOURCES/0005-security-Document-assignment-of-CVE-2021-20286.patch

@@ -0,0 +1,40 @@
+From 171ffdde8be590f784086a021a7e6f36c4ecdb4b Mon Sep 17 00:00:00 2001
+From: Eric Blake <eblake@redhat.com>
+Date: Fri, 12 Mar 2021 17:00:58 -0600
+Subject: [PATCH] security: Document assignment of CVE-2021-20286
+
+Now that we finally have a CVE number, it's time to document
+the problem (it's low severity, but still a denial of service).
+
+Fixes: fb4440de9cc7 (opt_go: Tolerate unplanned server death)
+(cherry picked from commit 40308a005eaa6b2e8f98da8952d0c0cacc51efde)
+---
+ docs/libnbd-security.pod | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/docs/libnbd-security.pod b/docs/libnbd-security.pod
+index d8ead875..0cae8462 100644
+--- a/docs/libnbd-security.pod
++++ b/docs/libnbd-security.pod
+@@ -22,6 +22,12 @@ L<https://www.redhat.com/archives/libguestfs/2019-September/msg00128.html>
+ See the full announcement here:
+ L<https://www.redhat.com/archives/libguestfs/2019-October/msg00060.html>
+ 
++=head2 CVE-2021-20286
++denial of service when using L<nbd_set_opt_mode(3)>
++
++See the full announcement here:
++L<https://listman.redhat.com/archives/libguestfs/2021-March/msg00092.html>
++
+ =head1 SEE ALSO
+ 
+ L<libnbd(3)>.
+@@ -34,4 +40,4 @@ Richard W.M. Jones
+ 
+ =head1 COPYRIGHT
+ 
+-Copyright (C) 2019 Red Hat Inc.
++Copyright (C) 2019-2021 Red Hat Inc.
+-- 
+2.43.0
+

SOURCES/0006-copy-Pass-in-dummy-variable-rather-than-errno-to-cal.patch

@@ -0,0 +1,163 @@
+From 22572f8ac13e2e8daf91d227eac2f384303fb5b4 Mon Sep 17 00:00:00 2001
+From: Eric Blake <eblake@redhat.com>
+Date: Thu, 3 Feb 2022 14:25:57 -0600
+Subject: [PATCH] copy: Pass in dummy variable rather than &errno to callback
+
+In several places where asynch handlers manually call the provided
+nbd_completion_callback, the value of errno is indeterminate (for
+example, in file-ops.c:file_asynch_read(), the previous call to
+file_synch_read() already triggered exit() on error, but does not
+guarantee what is left in errno on success).  As the callback should
+be paying attention to the value of *error (to be fixed in the next
+patch), we are better off ensuring that we pass in a pointer to a
+known-zero value.  Besides, passing in &errno carries a risk that if
+the callback uses any other library function that alters errno prior
+to dereferncing *error, it will no longer see the value we passed in.
+Thus, it is easier to use a dummy variable on the stack than to mess
+around with errno and it's magic macro expansion into a thread-local
+storage location.
+
+Note that several callsites then check if the callback returned -1,
+and if so assume that the callback has caused errno to now have a sane
+value to pass on to perror.  In theory, the fact that we are no longer
+passing in &errno means that if the callback assigns into *error but
+did not otherwise affect errno (a tenuous assumption, given our
+argument above that we could not even guarantee that the callback does
+not accidentally alter errno prior to reading *error), our perror call
+would no longer reflect the intended error value from the callback.
+But in practice, since the callback never actually returned -1, nor
+even assigned into *error, the call to perror is dead code; although I
+have chosen to defer that additional cleanup to the next patch.
+
+Message-Id: <20220203202558.203013-5-eblake@redhat.com>
+Acked-by: Richard W.M. Jones <rjones@redhat.com>
+Acked-by: Nir Soffer <nsoffer@redhat.com>
+Reviewed-by: Laszlo Ersek <lersek@redhat.com>
+(cherry picked from commit 794c8ce06e995ebd282e8f2b9465a06140572112)
+Conflicts:
+	copy/file-ops.c - no backport of d5f65e56 ("copy: Do not use trim
+ for zeroing"), so asynch_trim needed same treatment
+	copy/multi-thread-copying.c - context due to missing refactoring
+	copy/null-ops.c - no backport of 0b16205e "copy: Implement "null:"
+  destination."
+(cherry picked from commit 26e3dcf80815fe2db320d3046aabc2580c2f7a0d)
+---
+ copy/file-ops.c             | 22 +++++++++++++---------
+ copy/multi-thread-copying.c |  8 +++++---
+ 2 files changed, 18 insertions(+), 12 deletions(-)
+
+diff --git a/copy/file-ops.c b/copy/file-ops.c
+index 086348a2..cc312b48 100644
+--- a/copy/file-ops.c
++++ b/copy/file-ops.c
+@@ -1,5 +1,5 @@
+ /* NBD client library in userspace.
+- * Copyright (C) 2020 Red Hat Inc.
++ * Copyright (C) 2020-2022 Red Hat Inc.
+  *
+  * This library is free software; you can redistribute it and/or
+  * modify it under the terms of the GNU Lesser General Public
+@@ -158,10 +158,11 @@ file_asynch_read (struct rw *rw,
+                   struct command *command,
+                   nbd_completion_callback cb)
+ {
++  int dummy = 0;
++
+   file_synch_read (rw, slice_ptr (command->slice),
+                    command->slice.len, command->offset);
+-  errno = 0;
+-  if (cb.callback (cb.user_data, &errno) == -1) {
++  if (cb.callback (cb.user_data, &dummy) == -1) {
+     perror (rw->name);
+     exit (EXIT_FAILURE);
+   }
+@@ -172,10 +173,11 @@ file_asynch_write (struct rw *rw,
+                    struct command *command,
+                    nbd_completion_callback cb)
+ {
++  int dummy = 0;
++
+   file_synch_write (rw, slice_ptr (command->slice),
+                     command->slice.len, command->offset);
+-  errno = 0;
+-  if (cb.callback (cb.user_data, &errno) == -1) {
++  if (cb.callback (cb.user_data, &dummy) == -1) {
+     perror (rw->name);
+     exit (EXIT_FAILURE);
+   }
+@@ -185,10 +187,11 @@ static bool
+ file_asynch_trim (struct rw *rw, struct command *command,
+                   nbd_completion_callback cb)
+ {
++  int dummy = 0;
++
+   if (!file_synch_trim (rw, command->offset, command->slice.len))
+     return false;
+-  errno = 0;
+-  if (cb.callback (cb.user_data, &errno) == -1) {
++  if (cb.callback (cb.user_data, &dummy) == -1) {
+     perror (rw->name);
+     exit (EXIT_FAILURE);
+   }
+@@ -199,10 +202,11 @@ static bool
+ file_asynch_zero (struct rw *rw, struct command *command,
+                   nbd_completion_callback cb)
+ {
++  int dummy = 0;
++
+   if (!file_synch_zero (rw, command->offset, command->slice.len))
+     return false;
+-  errno = 0;
+-  if (cb.callback (cb.user_data, &errno) == -1) {
++  if (cb.callback (cb.user_data, &dummy) == -1) {
+     perror (rw->name);
+     exit (EXIT_FAILURE);
+   }
+diff --git a/copy/multi-thread-copying.c b/copy/multi-thread-copying.c
+index a7aaa7de..2593ff76 100644
+--- a/copy/multi-thread-copying.c
++++ b/copy/multi-thread-copying.c
+@@ -1,5 +1,5 @@
+ /* NBD client library in userspace.
+- * Copyright (C) 2020 Red Hat Inc.
++ * Copyright (C) 2020-2022 Red Hat Inc.
+  *
+  * This library is free software; you can redistribute it and/or
+  * modify it under the terms of the GNU Lesser General Public
+@@ -391,6 +391,7 @@ finished_read (void *vp, int *error)
+     bool last_is_hole = false;
+     uint64_t i;
+     struct command *newcommand;
++    int dummy = 0;
+ 
+     /* Iterate over whole blocks in the command, starting on a block
+      * boundary.
+@@ -473,7 +474,7 @@ finished_read (void *vp, int *error)
+     /* Free the original command since it has been split into
+      * subcommands and the original is no longer needed.
+      */
+-    free_command (command, &errno);
++    free_command (command, &dummy);
+   }
+ 
+   return 1; /* auto-retires the command */
+@@ -498,6 +499,7 @@ static void
+ fill_dst_range_with_zeroes (struct command *command)
+ {
+   char *data;
++  int dummy = 0;
+ 
+   if (destination_is_zero)
+     goto free_and_return;
+@@ -541,7 +543,7 @@ fill_dst_range_with_zeroes (struct command *command)
+   free (data);
+ 
+  free_and_return:
+-  free_command (command, &errno);
++  free_command (command, &dummy);
+ }
+ 
+ static int
+-- 
+2.43.0
+

SOURCES/0007-copy-CVE-2022-0485-Fail-nbdcopy-if-NBD-read-or-write.patch

@@ -0,0 +1,318 @@
+From 1b0b732e6a9b4979fccf6a09eb6704264edf675d Mon Sep 17 00:00:00 2001
+From: Eric Blake <eblake@redhat.com>
+Date: Thu, 3 Feb 2022 14:25:58 -0600
+Subject: [PATCH] copy: CVE-2022-0485: Fail nbdcopy if NBD read or write fails
+
+nbdcopy has a nasty bug when performing multi-threaded copies using
+asynchronous nbd calls - it was blindly treating the completion of an
+asynchronous command as successful, rather than checking the *error
+parameter.  This can result in the silent creation of a corrupted
+image in two different ways: when a read fails, we blindly wrote
+garbage to the destination; when a write fails, we did not flag that
+the destination was not written.
+
+Since nbdcopy already calls exit() on a synchronous read or write
+failure to a file, doing the same for an asynchronous op to an NBD
+server is the simplest solution.  A nicer solution, but more invasive
+to code and thus not done here, might be to allow up to N retries of
+the transaction (in case the read or write failure was transient), or
+even having a mode where as much data is copied as possible (portions
+of the copy that failed would be logged on stderr, and nbdcopy would
+still fail with a non-zero exit status, but this would copy more than
+just stopping at the first error, as can be done with rsync or
+ddrescue).
+
+Note that since we rely on auto-retiring and do NOT call
+nbd_aio_command_completed, our completion callbacks must always return
+1 (if they do not exit() first), even when acting on *error, so as not
+leave the command allocated until nbd_close.  As such, there is no
+sane way to return an error to a manual caller of the callback, and
+therefore we can drop dead code that calls perror() and exit() if the
+callback "failed".  It is also worth documenting the contract on when
+we must manually call the callback during the asynch_zero callback, so
+that we do not leak or double-free the command; thankfully, all the
+existing code paths were correct.
+
+The added testsuite script demonstrates several scenarios, some of
+which fail without the rest of this patch in place, and others which
+showcase ways in which sparse images can bypass errors.
+
+Once backports are complete, a followup patch on the main branch will
+edit docs/libnbd-security.pod with the mailing list announcement of
+the stable branch commit ids and release versions that incorporate
+this fix.
+
+Reported-by: Nir Soffer <nsoffer@redhat.com>
+Fixes: bc896eec4d ("copy: Implement multi-conn, multiple threads, multiple requests in flight.", v1.5.6)
+Fixes: https://bugzilla.redhat.com/2046194
+Message-Id: <20220203202558.203013-6-eblake@redhat.com>
+Acked-by: Richard W.M. Jones <rjones@redhat.com>
+Acked-by: Nir Soffer <nsoffer@redhat.com>
+[eblake: fix error message per Nir, tweak requires lines in unit test per Rich]
+Reviewed-by: Laszlo Ersek <lersek@redhat.com>
+
+(cherry picked from commit 8d444b41d09a700c7ee6f9182a649f3f2d325abb)
+Conflicts:
+	copy/nbdcopy.h - copyright context
+	copy/null-ops.c - no backport of 0b16205e "copy: Implement "null:"
+ destination."
+        copy/copy-nbd-error.sh - no backport of d5f65e56 ("copy: Do not use
+ trim for zeroing"), so one test needed an additional error-trim-rate;
+ no backport of 4ff9e62d (copy: Add --request-size option") and friends, so
+ this version uses larger transactions, so change error rate of 0.5 to 1;
+ no backport of 0b16205e "copy: Implement "null:" destination.", so use
+ nbdkit null instead
+Note that while the use of NBD_CMD_TRIM can create data corruption, it is
+not as severe as what this patch fixes, since trim corruption will only
+expose what had previously been on the disk, compared to this patch fixing
+a potential leak of nbdcopy heap contents into the destination.
+(cherry picked from commit 6c8f2f859926b82094fb5e85c446ea099700fa10)
+---
+ TODO                        |  1 +
+ copy/Makefile.am            |  4 +-
+ copy/copy-nbd-error.sh      | 81 +++++++++++++++++++++++++++++++++++++
+ copy/file-ops.c             | 17 +++-----
+ copy/multi-thread-copying.c | 13 ++++++
+ copy/nbdcopy.h              |  7 ++--
+ 6 files changed, 107 insertions(+), 16 deletions(-)
+ create mode 100755 copy/copy-nbd-error.sh
+
+diff --git a/TODO b/TODO
+index 510c219a..19c21d44 100644
+--- a/TODO
++++ b/TODO
+@@ -35,6 +35,7 @@ nbdcopy:
+  - Better page cache usage, see nbdkit-file-plugin options
+    fadvise=sequential cache=none.
+  - Consider io_uring if there are performance bottlenecks.
++ - Configurable retries in response to read or write failures.
+ 
+ nbdfuse:
+  - If you write beyond the end of the virtual file, it returns EIO.
+diff --git a/copy/Makefile.am b/copy/Makefile.am
+index d318388f..3406cd85 100644
+--- a/copy/Makefile.am
++++ b/copy/Makefile.am
+@@ -1,5 +1,5 @@
+ # nbd client library in userspace
+-# Copyright (C) 2020 Red Hat Inc.
++# Copyright (C) 2020-2022 Red Hat Inc.
+ #
+ # This library is free software; you can redistribute it and/or
+ # modify it under the terms of the GNU Lesser General Public
+@@ -30,6 +30,7 @@ EXTRA_DIST = \
+ 	copy-nbd-to-small-nbd-error.sh \
+ 	copy-nbd-to-sparse-file.sh \
+ 	copy-nbd-to-stdout.sh \
++	copy-nbd-error.sh \
+ 	copy-progress-bar.sh \
+ 	copy-sparse.sh \
+ 	copy-sparse-allocated.sh \
+@@ -105,6 +106,7 @@ TESTS += \
+ 	copy-nbd-to-sparse-file.sh \
+ 	copy-stdin-to-nbd.sh \
+ 	copy-nbd-to-stdout.sh \
++	copy-nbd-error.sh \
+ 	copy-progress-bar.sh \
+ 	copy-sparse.sh \
+ 	copy-sparse-allocated.sh \
+diff --git a/copy/copy-nbd-error.sh b/copy/copy-nbd-error.sh
+new file mode 100755
+index 00000000..bba71db5
+--- /dev/null
++++ b/copy/copy-nbd-error.sh
+@@ -0,0 +1,81 @@
++#!/usr/bin/env bash
++# nbd client library in userspace
++# Copyright (C) 2022 Red Hat Inc.
++#
++# This library is free software; you can redistribute it and/or
++# modify it under the terms of the GNU Lesser General Public
++# License as published by the Free Software Foundation; either
++# version 2 of the License, or (at your option) any later version.
++#
++# This library is distributed in the hope that it will be useful,
++# but WITHOUT ANY WARRANTY; without even the implied warranty of
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++# Lesser General Public License for more details.
++#
++# You should have received a copy of the GNU Lesser General Public
++# License along with this library; if not, write to the Free Software
++# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
++
++# Tests several scenarios of handling NBD server errors
++# Serves as a regression test for the CVE-2022-0485 fix.
++
++. ../tests/functions.sh
++
++set -e
++set -x
++
++requires nbdkit --exit-with-parent --version
++requires nbdkit --filter=noextents null --version
++requires nbdkit --filter=error pattern --version
++requires nbdkit --filter=nozero memory --version
++
++fail=0
++
++# Failure to get block status should not be fatal, but merely downgrade to
++# reading the entire image as if data
++echo "Testing extents failures on source"
++$VG nbdcopy -- [ nbdkit --exit-with-parent -v --filter=error pattern 5M \
++    error-extents-rate=1 ] [ nbdkit --exit-with-parent -v null 5M ] || fail=1
++
++# Failure to read should be fatal
++echo "Testing read failures on non-sparse source"
++$VG nbdcopy -- [ nbdkit --exit-with-parent -v --filter=error pattern 5M \
++    error-pread-rate=1 ] [ nbdkit --exit-with-parent -v null 5M ] && fail=1
++
++# However, reliable block status on a sparse image can avoid the need to read
++echo "Testing read failures on sparse source"
++$VG nbdcopy -- [ nbdkit --exit-with-parent -v --filter=error null 5M \
++    error-pread-rate=1 ] [ nbdkit --exit-with-parent -v null 5M ] || fail=1
++
++# Failure to write data should be fatal
++echo "Testing write data failures on arbitrary destination"
++$VG nbdcopy -- [ nbdkit --exit-with-parent -v pattern 5M ] \
++    [ nbdkit --exit-with-parent -v --filter=error --filter=noextents \
++        memory 5M error-pwrite-rate=1 ] && fail=1
++
++# However, writing zeroes can bypass the need for normal writes
++echo "Testing write data failures from sparse source"
++$VG nbdcopy -- [ nbdkit --exit-with-parent -v null 5M ] \
++    [ nbdkit --exit-with-parent -v --filter=error --filter=noextents \
++        memory 5M error-pwrite-rate=1 ] || fail=1
++
++# Failure to write zeroes should be fatal
++echo "Testing write zero failures on arbitrary destination"
++$VG nbdcopy -- [ nbdkit --exit-with-parent -v null 5M ] \
++    [ nbdkit --exit-with-parent -v --filter=error memory 5M \
++        error-trim-rate=1 error-zero-rate=1 ] && fail=1
++
++# However, assuming/learning destination is zero can skip need to write
++echo "Testing write failures on pre-zeroed destination"
++$VG nbdcopy --destination-is-zero -- \
++    [ nbdkit --exit-with-parent -v null 5M ] \
++    [ nbdkit --exit-with-parent -v --filter=error memory 5M \
++        error-pwrite-rate=1 error-zero-rate=1 ] || fail=1
++
++# Likewise, when write zero is not advertised, fallback to normal write works
++echo "Testing write zeroes to destination without zero support"
++$VG nbdcopy -- [ nbdkit --exit-with-parent -v null 5M ] \
++    [ nbdkit --exit-with-parent -v --filter=nozero --filter=error memory 5M \
++        error-zero-rate=1 ] || fail=1
++
++exit $fail
+diff --git a/copy/file-ops.c b/copy/file-ops.c
+index cc312b48..b19af04c 100644
+--- a/copy/file-ops.c
++++ b/copy/file-ops.c
+@@ -162,10 +162,8 @@ file_asynch_read (struct rw *rw,
+ 
+   file_synch_read (rw, slice_ptr (command->slice),
+                    command->slice.len, command->offset);
+-  if (cb.callback (cb.user_data, &dummy) == -1) {
+-    perror (rw->name);
+-    exit (EXIT_FAILURE);
+-  }
++  /* file_synch_read called exit() on error */
++  cb.callback (cb.user_data, &dummy);
+ }
+ 
+ static void
+@@ -177,10 +175,8 @@ file_asynch_write (struct rw *rw,
+ 
+   file_synch_write (rw, slice_ptr (command->slice),
+                     command->slice.len, command->offset);
+-  if (cb.callback (cb.user_data, &dummy) == -1) {
+-    perror (rw->name);
+-    exit (EXIT_FAILURE);
+-  }
++  /* file_synch_write called exit() on error */
++  cb.callback (cb.user_data, &dummy);
+ }
+ 
+ static bool
+@@ -206,10 +202,7 @@ file_asynch_zero (struct rw *rw, struct command *command,
+ 
+   if (!file_synch_zero (rw, command->offset, command->slice.len))
+     return false;
+-  if (cb.callback (cb.user_data, &dummy) == -1) {
+-    perror (rw->name);
+-    exit (EXIT_FAILURE);
+-  }
++  cb.callback (cb.user_data, &dummy);
+   return true;
+ }
+ 
+diff --git a/copy/multi-thread-copying.c b/copy/multi-thread-copying.c
+index 2593ff76..28749ae7 100644
+--- a/copy/multi-thread-copying.c
++++ b/copy/multi-thread-copying.c
+@@ -28,6 +28,7 @@
+ #include <errno.h>
+ #include <assert.h>
+ #include <sys/stat.h>
++#include <inttypes.h>
+ 
+ #include <pthread.h>
+ 
+@@ -374,6 +375,12 @@ finished_read (void *vp, int *error)
+ {
+   struct command *command = vp;
+ 
++  if (*error) {
++    fprintf (stderr, "read at offset %" PRId64 " failed: %s\n",
++             command->offset, strerror (*error));
++    exit (EXIT_FAILURE);
++  }
++
+   if (allocated || sparse_size == 0) {
+     /* If sparseness detection (see below) is turned off then we write
+      * the whole command.
+@@ -552,6 +559,12 @@ free_command (void *vp, int *error)
+   struct command *command = vp;
+   struct buffer *buffer = command->slice.buffer;
+ 
++  if (*error) {
++    fprintf (stderr, "write at offset %" PRId64 " failed: %s\n",
++             command->offset, strerror (*error));
++    exit (EXIT_FAILURE);
++  }
++
+   if (buffer != NULL) {
+     if (--buffer->refs == 0) {
+       free (buffer->data);
+diff --git a/copy/nbdcopy.h b/copy/nbdcopy.h
+index 3dcc6dfe..9626a52c 100644
+--- a/copy/nbdcopy.h
++++ b/copy/nbdcopy.h
+@@ -1,5 +1,5 @@
+ /* NBD client library in userspace.
+- * Copyright (C) 2020 Red Hat Inc.
++ * Copyright (C) 2020-2022 Red Hat Inc.
+  *
+  * This library is free software; you can redistribute it and/or
+  * modify it under the terms of the GNU Lesser General Public
+@@ -134,7 +134,8 @@ struct rw_ops {
+   bool (*synch_zero) (struct rw *rw, uint64_t offset, uint64_t count);
+ 
+   /* Asynchronous I/O operations.  These start the operation and call
+-   * 'cb' on completion.
++   * 'cb' on completion.  'cb' will return 1, for auto-retiring with
++   * asynchronous libnbd calls.
+    *
+    * The file_ops versions are actually implemented synchronously, but
+    * still call 'cb'.
+@@ -156,7 +157,7 @@ struct rw_ops {
+                        nbd_completion_callback cb);
+ 
+   /* Asynchronously zero.  command->slice.buffer is not used.  If not possible,
+-   * returns false.
++   * returns false.  'cb' must be called only if returning true.
+    */
+   bool (*asynch_zero) (struct rw *rw, struct command *command,
+                        nbd_completion_callback cb);
+-- 
+2.43.0
+

SOURCES/0007-interop-Pass-DCERTS-and-DPSK-as-strings.patch

@@ -1,145 +0,0 @@
-From 764fc45a258c08177d01b6b6b6a0e431ee29089a Mon Sep 17 00:00:00 2001
-From: "Richard W.M. Jones" <rjones@redhat.com>
-Date: Mon, 24 Jun 2024 11:49:07 +0100
-Subject: [PATCH] interop: Pass -DCERTS and -DPSK as strings
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Rather than implicitly defining the certificates dir or PSK file in
-interop.c, pass the actual paths from the Makefile.
-
-This also allows -DCERTS=NULL which is interpreted as not calling
-nbd_set_tls_certificates at all.  This makes the test added in a
-subsequent commit possible.
-
-No real change here, just refactoring the tests.
-
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-(cherry picked from commit 69ab18442994c68f749e2b84b91d41031ebbb088)
-(cherry picked from commit 33d7f3aa8e3cf8c826a534107529e1d409c0c004)
----
- interop/Makefile.am | 18 +++++++++---------
- interop/interop.c   | 11 ++++++-----
- 2 files changed, 15 insertions(+), 14 deletions(-)
-
-diff --git a/interop/Makefile.am b/interop/Makefile.am
-index ac12d84a..4cdc55e9 100644
---- a/interop/Makefile.am
-+++ b/interop/Makefile.am
-@@ -100,7 +100,7 @@ interop_nbd_server_tls_CPPFLAGS = \
- 	-DSERVER=\"$(NBD_SERVER)\" \
- 	-DSERVER_PARAMS='"-d", "-C", "nbd-server-tls.conf", "0", TMPFILE' \
- 	-DEXPORT_NAME='""' \
--	-DCERTS=1 \
-+	-DCERTS='"../tests/pki"' \
- 	-DTLS_MODE=LIBNBD_TLS_REQUIRE \
- 	$(NULL)
- interop_nbd_server_tls_LDADD = \
-@@ -186,7 +186,7 @@ interop_qemu_nbd_tls_certs_CPPFLAGS = \
- 	-DSERVER=\"$(QEMU_NBD)\" \
- 	-DSERVER_PARAMS='"--object", "tls-creds-x509,id=tls0,endpoint=server,dir=$(abs_top_builddir)/tests/pki", "--tls-creds", "tls0", "-f", "raw", "-x", "/", TMPFILE' \
- 	-DEXPORT_NAME='"/"' \
--	-DCERTS=1 \
-+	-DCERTS='"../tests/pki"' \
- 	-DTLS_MODE=LIBNBD_TLS_REQUIRE \
- 	$(NULL)
- interop_qemu_nbd_tls_certs_LDADD = \
-@@ -208,7 +208,7 @@ interop_qemu_nbd_tls_psk_CPPFLAGS = \
- 	-DSERVER=\"$(QEMU_NBD)\" \
- 	-DSERVER_PARAMS='"--object", "tls-creds-psk,id=tls0,endpoint=server,dir=$(abs_top_builddir)/tests", "--tls-creds", "tls0", "-f", "raw", "-x", "/", TMPFILE' \
- 	-DEXPORT_NAME='"/"' \
--	-DPSK=1 \
-+	-DPSK='"../tests/keys.psk"' \
- 	-DTLS_MODE=LIBNBD_TLS_REQUIRE \
- 	$(NULL)
- interop_qemu_nbd_tls_psk_LDADD = \
-@@ -323,7 +323,7 @@ interop_nbdkit_tls_certs_CPPFLAGS = \
- 	-DNEEDS_TMPFILE=1 \
- 	-DSERVER=\"$(NBDKIT)\" \
- 	-DSERVER_PARAMS='"--tls=require", "--tls-certificates=../tests/pki", "-s", "--exit-with-parent", "file", TMPFILE' \
--	-DCERTS=1 \
-+	-DCERTS='"../tests/pki"' \
- 	-DTLS_MODE=LIBNBD_TLS_REQUIRE \
- 	$(NULL)
- interop_nbdkit_tls_certs_LDADD = \
-@@ -342,7 +342,7 @@ interop_nbdkit_tls_certs_allow_enabled_CPPFLAGS = \
- 	-DNEEDS_TMPFILE=1 \
- 	-DSERVER=\"$(NBDKIT)\" \
- 	-DSERVER_PARAMS='"--tls=require", "--tls-certificates=../tests/pki", "-s", "--exit-with-parent", "file", TMPFILE' \
--	-DCERTS=1 \
-+	-DCERTS='"../tests/pki"' \
- 	-DTLS_MODE=LIBNBD_TLS_ALLOW \
- 	$(NULL)
- interop_nbdkit_tls_certs_allow_enabled_LDADD = \
-@@ -361,7 +361,7 @@ interop_nbdkit_tls_certs_allow_fallback_CPPFLAGS = \
- 	-DNEEDS_TMPFILE=1 \
- 	-DSERVER=\"$(NBDKIT)\" \
- 	-DSERVER_PARAMS='"--tls=off", "-s", "--exit-with-parent", "file", TMPFILE' \
--	-DCERTS=1 \
-+	-DCERTS='"../tests/pki"' \
- 	-DTLS_MODE=LIBNBD_TLS_ALLOW \
- 	-DTLS_FALLBACK=1 \
- 	$(NULL)
-@@ -381,7 +381,7 @@ interop_nbdkit_tls_psk_CPPFLAGS = \
- 	-DNEEDS_TMPFILE=1 \
- 	-DSERVER=\"$(NBDKIT)\" \
- 	-DSERVER_PARAMS='"--tls=require", "--tls-psk=../tests/keys.psk", "-s", "--exit-with-parent", "file", TMPFILE' \
--	-DPSK=1 \
-+	-DPSK='"../tests/keys.psk"' \
- 	-DTLS_MODE=LIBNBD_TLS_REQUIRE \
- 	$(NULL)
- interop_nbdkit_tls_psk_LDADD = \
-@@ -400,7 +400,7 @@ interop_nbdkit_tls_psk_allow_enabled_CPPFLAGS = \
- 	-DNEEDS_TMPFILE=1 \
- 	-DSERVER=\"$(NBDKIT)\" \
- 	-DSERVER_PARAMS='"--tls=require", "--tls-psk=../tests/keys.psk", "-s", "--exit-with-parent", "file", TMPFILE' \
--	-DPSK=1 \
-+	-DPSK='"../tests/keys.psk"' \
- 	-DTLS_MODE=LIBNBD_TLS_ALLOW \
- 	$(NULL)
- interop_nbdkit_tls_psk_allow_enabled_LDADD = \
-@@ -419,7 +419,7 @@ interop_nbdkit_tls_psk_allow_fallback_CPPFLAGS = \
- 	-DNEEDS_TMPFILE=1 \
- 	-DSERVER=\"$(NBDKIT)\" \
- 	-DSERVER_PARAMS='"--tls=off", "-s", "--exit-with-parent", "file", TMPFILE' \
--	-DPSK=1 \
-+	-DPSK='"../tests/keys.psk"' \
- 	-DTLS_MODE=LIBNBD_TLS_ALLOW \
- 	-DTLS_FALLBACK=1 \
- 	$(NULL)
-diff --git a/interop/interop.c b/interop/interop.c
-index 20e101d4..d4d6671e 100644
---- a/interop/interop.c
-+++ b/interop/interop.c
-@@ -41,7 +41,7 @@
- 
- #define SIZE (1024*1024)
- 
--#if CERTS || PSK
-+#if defined(CERTS) || defined(PSK)
- #define TLS 1
- #ifndef TLS_MODE
- #error "TLS_MODE must be defined when using CERTS || PSK"
-@@ -149,13 +149,14 @@ main (int argc, char *argv[])
-   }
- #endif
- 
--#if CERTS
--  if (nbd_set_tls_certificates (nbd, "../tests/pki") == -1) {
-+#if defined(CERTS)
-+  const char *certs = CERTS;
-+  if (certs && nbd_set_tls_certificates (nbd, certs) == -1) {
-     fprintf (stderr, "%s\n", nbd_get_error ());
-     exit (EXIT_FAILURE);
-   }
--#elif PSK
--  if (nbd_set_tls_psk_file (nbd, "../tests/keys.psk") == -1) {
-+#elif defined(PSK)
-+  if (nbd_set_tls_psk_file (nbd, PSK) == -1) {
-     fprintf (stderr, "%s\n", nbd_get_error ());
-     exit (EXIT_FAILURE);
-   }
--- 
-2.43.0
-

SOURCES/0008-build-Move-to-minimum-gnutls-3.5.18.patch

@@ -1,4 +1,4 @@
-From 596626369b90016f6852610c217da22668158521 Mon Sep 17 00:00:00 2001
+From cd4f3bed33d5ffdba6846d270c0e11713bc1caf6 Mon Sep 17 00:00:00 2001
 From: "Richard W.M. Jones" <rjones@redhat.com>
 Date: Tue, 25 Jun 2024 10:55:54 +0100
 Subject: [PATCH] build: Move to minimum gnutls >= 3.5.18
@@ -24,23 +24,23 @@ On RHEL 7 the configure-time test now prints:
 
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit 5ff09cdbbd19226dd2d5015d76134f88dee9321e)
-(cherry picked from commit 177fd0847723640829eff8d1ab102f8d28a7328e)
+(cherry picked from commit cb6df4f81a97d5d58385d89b0135039f1eddee15)
 ---
- configure.ac | 5 ++---
+ configure.ac | 12 +++---------
- lib/crypto.c | 6 ------
+ lib/crypto.c |  5 +----
- 2 files changed, 2 insertions(+), 9 deletions(-)
+ 2 files changed, 4 insertions(+), 13 deletions(-)
 
 diff --git a/configure.ac b/configure.ac
-index 91fe004b..c0d6a472 100644
+index da3dc38a..29e3b47a 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -178,13 +178,13 @@ AC_ARG_WITH([gnutls],
+@@ -94,12 +94,13 @@ AC_ARG_WITH([gnutls],
      [],
      [with_gnutls=check])
  AS_IF([test "$with_gnutls" != "no"],[
 -    PKG_CHECK_MODULES([GNUTLS], [gnutls >= 3.3.0], [
 +    PKG_CHECK_MODULES([GNUTLS], [gnutls >= 3.5.18], [
-         printf "gnutls version is "; $PKG_CONFIG --modversion gnutls
++        printf "gnutls version is "; $PKG_CONFIG --modversion gnutls
          AC_SUBST([GNUTLS_CFLAGS])
          AC_SUBST([GNUTLS_LIBS])
          AC_DEFINE([HAVE_GNUTLS],[1],[gnutls found at compile time.])
@@ -50,30 +50,33 @@ index 91fe004b..c0d6a472 100644
      ])
  ])
  AM_CONDITIONAL([HAVE_GNUTLS], [test "x$GNUTLS_LIBS" != "x"])
-@@ -210,7 +210,6 @@ AS_IF([test "$GNUTLS_LIBS" != ""],[
+@@ -114,13 +115,6 @@ AS_IF([test "$GNUTLS_LIBS" != ""],[
-     old_LIBS="$LIBS"
+     AC_MSG_RESULT([$tls_priority])
-     LIBS="$GNUTLS_LIBS $LIBS"
+     AC_DEFINE_UNQUOTED([TLS_PRIORITY],["$tls_priority"],
-     AC_CHECK_FUNCS([\
+                        [Default TLS session priority string])
--        gnutls_session_set_verify_cert \
+-
-         gnutls_transport_is_ktls_enabled \
+-    # Check for APIs which may not be present.
-     ])
+-    old_LIBS="$LIBS"
-     LIBS="$old_LIBS"
+-    LIBS="$GNUTLS_LIBS $LIBS"
+-    AC_CHECK_FUNCS([\
+-	gnutls_session_set_verify_cert])
+-    LIBS="$old_LIBS"
+ ])
+ 
+ dnl certtool (part of GnuTLS) for testing TLS with certificates.
 diff --git a/lib/crypto.c b/lib/crypto.c
-index 22a1cfa5..d131f1d0 100644
+index a9b3789c..705e114a 100644
 --- a/lib/crypto.c
 +++ b/lib/crypto.c
-@@ -28,10 +28,8 @@
+@@ -28,6 +28,7 @@
  
  #ifdef HAVE_GNUTLS
  #include <gnutls/gnutls.h>
--#ifdef HAVE_GNUTLS_SOCKET_H
++#include <gnutls/socket.h>
- #include <gnutls/socket.h>
  #endif
--#endif
  
  #include "internal.h"
- #include "nbdkit-string.h"
+@@ -512,12 +513,8 @@ set_up_certificate_credentials (struct nbd_handle *h,
-@@ -532,12 +530,8 @@ set_up_certificate_credentials (struct nbd_handle *h,
    return NULL;
  
   found_certificates:

SOURCES/0008-interop-Add-DEXPECT_FAIL-1-where-we-expect-the-test-.patch

@@ -1,53 +0,0 @@
-From fcb7d28e4dd2ab438c6070e7e5b1aae54cc75f28 Mon Sep 17 00:00:00 2001
-From: "Richard W.M. Jones" <rjones@redhat.com>
-Date: Mon, 24 Jun 2024 13:54:48 +0100
-Subject: [PATCH] interop: Add -DEXPECT_FAIL=1 where we expect the test to fail
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-(cherry picked from commit c7a8df4f78f2c1901f5c532f262dadd6cce84750)
-(cherry picked from commit 175ee89f4a64c52cdb1412a2a72fc8c52fecaf93)
----
- interop/interop.c | 14 +++++++++++++-
- 1 file changed, 13 insertions(+), 1 deletion(-)
-
-diff --git a/interop/interop.c b/interop/interop.c
-index d4d6671e..469327ee 100644
---- a/interop/interop.c
-+++ b/interop/interop.c
-@@ -78,6 +78,7 @@ main (int argc, char *argv[])
-   int64_t actual_size;
-   char buf[512];
-   size_t i;
-+  int r;
- 
-   /* Check requirements or skip the test. */
- #ifdef REQUIRES
-@@ -174,10 +175,21 @@ main (int argc, char *argv[])
- #else
- #define NBD_CONNECT nbd_connect_command
- #endif
--  if (NBD_CONNECT (nbd, args) == -1) {
-+  r = NBD_CONNECT (nbd, args);
-+#if EXPECT_FAIL
-+  if (r != -1) {
-+    fprintf (stderr, "%s: expected connection to fail but it did not\n",
-+             argv[0]);
-+    exit (EXIT_FAILURE);
-+  }
-+  exit (EXIT_SUCCESS);
-+  /*NOTREACHED*/
-+#else
-+  if (r == -1) {
-     fprintf (stderr, "%s\n", nbd_get_error ());
-     exit (EXIT_FAILURE);
-   }
-+#endif
- 
- #if TLS
-   if (TLS_MODE == LIBNBD_TLS_REQUIRE) {
--- 
-2.43.0
-

SOURCES/0009-interop-Test-interop-with-a-bad-system-CA.patch

@@ -1,84 +0,0 @@
-From c20ac23a9a3673cca863974ec53f9129392fd447 Mon Sep 17 00:00:00 2001
-From: "Richard W.M. Jones" <rjones@redhat.com>
-Date: Mon, 24 Jun 2024 11:39:01 +0100
-Subject: [PATCH] interop: Test interop with a bad system CA
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This is expected to fail now.
-
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-(cherry picked from commit 1c7db8f3337632f0395dac9b13cf03b100cf1a4a)
-(cherry picked from commit cb3519eeefa788b8fef466bf9394eefa9d6a6c18)
----
- .gitignore          |  1 +
- interop/Makefile.am | 26 ++++++++++++++++++++++++++
- 2 files changed, 27 insertions(+)
-
-diff --git a/.gitignore b/.gitignore
-index 0b1cf764..597043e1 100644
---- a/.gitignore
-+++ b/.gitignore
-@@ -113,6 +113,7 @@ Makefile.in
- /interop/interop-nbdkit-tls-certs
- /interop/interop-nbdkit-tls-certs-allow-enabled
- /interop/interop-nbdkit-tls-certs-allow-fallback
-+/interop/interop-nbdkit-tls-certs-bad-CA
- /interop/interop-nbdkit-tls-psk
- /interop/interop-nbdkit-tls-psk-allow-enabled
- /interop/interop-nbdkit-tls-psk-allow-fallback
-diff --git a/interop/Makefile.am b/interop/Makefile.am
-index 4cdc55e9..bc974b99 100644
---- a/interop/Makefile.am
-+++ b/interop/Makefile.am
-@@ -281,6 +281,7 @@ check_PROGRAMS += \
- 	interop-nbdkit-tls-certs \
- 	interop-nbdkit-tls-certs-allow-enabled \
- 	interop-nbdkit-tls-certs-allow-fallback \
-+	interop-nbdkit-tls-certs-bad-CA \
- 	interop-nbdkit-tls-psk \
- 	interop-nbdkit-tls-psk-allow-enabled \
- 	interop-nbdkit-tls-psk-allow-fallback \
-@@ -292,6 +293,7 @@ TESTS += \
- 	interop-nbdkit-tls-certs \
- 	interop-nbdkit-tls-certs-allow-enabled \
- 	interop-nbdkit-tls-certs-allow-fallback \
-+	interop-nbdkit-tls-certs-bad-CA \
- 	interop-nbdkit-tls-psk \
- 	interop-nbdkit-tls-psk-allow-enabled \
- 	interop-nbdkit-tls-psk-allow-fallback \
-@@ -370,6 +372,30 @@ interop_nbdkit_tls_certs_allow_fallback_LDADD = \
- 	$(GNUTLS_LIBS) \
- 	$(NULL)
- 
-+# In this test, nbdkit offers a server certificate signed by our CA in
-+# the tests/pki directory, but we deliberately tell libnbd to test
-+# against the system CA (-DCERTS=NULL).  This is expected to fail the
-+# connection with the error:
-+# libnbd: debug: nbd1: nbd_connect_command: handle dead: nbd_connect_command: gnutls_handshake: Error in the certificate verification. (15/1)
-+interop_nbdkit_tls_certs_bad_CA_SOURCES = \
-+	interop.c \
-+	requires.c \
-+	../tests/requires.h \
-+	$(NULL)
-+interop_nbdkit_tls_certs_bad_CA_CPPFLAGS = \
-+	$(AM_CPPFLAGS) \
-+	-DREQUIRES=' requires ("test -d ../tests/pki"); ' \
-+	-DSERVER=\"$(NBDKIT)\" \
-+	-DSERVER_PARAMS='"--tls=require", "--tls-certificates=../tests/pki", "-s", "--exit-with-parent", "null"' \
-+	-DCERTS=NULL \
-+	-DTLS_MODE=LIBNBD_TLS_REQUIRE \
-+	-DEXPECT_FAIL=1 \
-+	$(NULL)
-+interop_nbdkit_tls_certs_bad_CA_LDADD = \
-+	$(top_builddir)/lib/libnbd.la \
-+	$(GNUTLS_LIBS) \
-+	$(NULL)
-+
- interop_nbdkit_tls_psk_SOURCES = \
- 	interop.c \
- 	requires.c \
--- 
-2.43.0
-

SOURCES/0009-tests-Factor-out-some-common-Makefile-flags.patch

@@ -0,0 +1,727 @@
+From a852cec30a6540b5c1ea2947195454eef6269944 Mon Sep 17 00:00:00 2001
+From: "Richard W.M. Jones" <rjones@redhat.com>
+Date: Fri, 27 Aug 2021 15:12:12 +0100
+Subject: [PATCH] tests: Factor out some common Makefile flags
+
+We can use AM_CPPFLAGS, AM_CFLAGS etc to factor out some common flags
+in the tests.  Note the rules here are complicated, see:
+
+https://www.gnu.org/software/automake/manual/html_node/Flag-Variables-Ordering.html
+
+and for unclear reasons there is no AM_LDADD nor any workaround:
+
+https://stackoverflow.com/questions/29252969/automake-am-ldadd-workaround
+
+This commit is mostly pure refactoring but it also tries to make the
+flags usage more consistent across tests so it may have side-effects
+like enabling more warnings.
+
+(cherry picked from commit 5fd648f821e9ab3ee08bf360348d1fb01537a267)
+(cherry picked from commit 6cb1f74b09beca1ddaef794136f221bfb7bb4faa)
+---
+ interop/Makefile.am |  57 ++++++-------
+ tests/Makefile.am   | 190 ++++++++++++++++++--------------------------
+ 2 files changed, 104 insertions(+), 143 deletions(-)
+
+diff --git a/interop/Makefile.am b/interop/Makefile.am
+index 9787c26e..9432ad43 100644
+--- a/interop/Makefile.am
++++ b/interop/Makefile.am
+@@ -28,6 +28,16 @@ LOG_COMPILER = $(top_builddir)/run
+ check_PROGRAMS =
+ TESTS =
+ 
++# Common flags.
++# Note there is no such thing as "AM_LDADD".
++AM_CPPFLAGS = \
++	-I$(top_srcdir)/include \
++	-I$(top_srcdir)/tests \
++	$(NULL)
++AM_CFLAGS = \
++	$(WARNINGS_CFLAGS) \
++	$(NULL)
++
+ if HAVE_NBD_SERVER
+ 
+ check_PROGRAMS += \
+@@ -41,22 +51,20 @@ TESTS += \
+ 
+ interop_nbd_server_SOURCES = interop.c
+ interop_nbd_server_CPPFLAGS = \
+-	-I$(top_srcdir)/include \
++	$(AM_CPPFLAGS) \
+ 	-DSERVER=\"$(NBD_SERVER)\" \
+ 	-DSERVER_PARAMS='"-d", "-C", "/dev/null", "0", tmpfile' \
+ 	-DEXPORT_NAME='""'
+-interop_nbd_server_CFLAGS = $(WARNINGS_CFLAGS)
+ interop_nbd_server_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ list_exports_nbd_server_SOURCES = list-exports.c
+ list_exports_nbd_server_CPPFLAGS = \
+-	-I$(top_srcdir)/include \
++	$(AM_CPPFLAGS) \
+ 	-DSERVER=\"$(NBD_SERVER)\" \
+ 	-DSERVER_PARAMS='"-C", "$(srcdir)/list-exports-nbd-config", "-d", "0"' \
+ 	-DEXPORTS='"disk1", "disk2"' \
+ 	-DDESCRIPTIONS='"", ""' \
+ 	$(NULL)
+-list_exports_nbd_server_CFLAGS = $(WARNINGS_CFLAGS)
+ list_exports_nbd_server_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ endif HAVE_NBD_SERVER
+@@ -104,19 +112,18 @@ endif
+ 
+ interop_qemu_nbd_SOURCES = interop.c
+ interop_qemu_nbd_CPPFLAGS = \
+-	-I$(top_srcdir)/include \
++	$(AM_CPPFLAGS) \
+ 	-DSOCKET_ACTIVATION=1 \
+ 	-DSERVER=\"$(QEMU_NBD)\" \
+ 	-DSERVER_PARAMS='"-f", "raw", "-x", "/", tmpfile' \
+ 	-DEXPORT_NAME='"/"' \
+ 	$(NULL)
+-interop_qemu_nbd_CFLAGS = $(WARNINGS_CFLAGS)
+ interop_qemu_nbd_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ # qemu-nbd requires absolute path to dir
+ interop_qemu_nbd_tls_certs_SOURCES = interop.c
+ interop_qemu_nbd_tls_certs_CPPFLAGS = \
+-	-I$(top_srcdir)/include \
++	$(AM_CPPFLAGS) \
+ 	-DSOCKET_ACTIVATION=1 \
+ 	-DSERVER=\"$(QEMU_NBD)\" \
+ 	-DSERVER_PARAMS='"--object", "tls-creds-x509,id=tls0,endpoint=server,dir=$(abs_top_builddir)/tests/pki", "--tls-creds", "tls0", "-f", "raw", "-x", "/", tmpfile' \
+@@ -124,13 +131,12 @@ interop_qemu_nbd_tls_certs_CPPFLAGS = \
+ 	-DCERTS=1 \
+ 	-DTLS_MODE=LIBNBD_TLS_REQUIRE \
+ 	$(NULL)
+-interop_qemu_nbd_tls_certs_CFLAGS = $(WARNINGS_CFLAGS)
+ interop_qemu_nbd_tls_certs_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ # qemu-nbd requires absolute path to dir
+ interop_qemu_nbd_tls_psk_SOURCES = interop.c
+ interop_qemu_nbd_tls_psk_CPPFLAGS = \
+-	-I$(top_srcdir)/include \
++	$(AM_CPPFLAGS) \
+ 	-DSOCKET_ACTIVATION=1 \
+ 	-DSERVER=\"$(QEMU_NBD)\" \
+ 	-DSERVER_PARAMS='"--object", "tls-creds-psk,id=tls0,endpoint=server,dir=$(abs_top_builddir)/tests", "--tls-creds", "tls0", "-f", "raw", "-x", "/", tmpfile' \
+@@ -138,7 +144,6 @@ interop_qemu_nbd_tls_psk_CPPFLAGS = \
+ 	-DPSK=1 \
+ 	-DTLS_MODE=LIBNBD_TLS_REQUIRE \
+ 	$(NULL)
+-interop_qemu_nbd_tls_psk_CFLAGS = $(WARNINGS_CFLAGS)
+ interop_qemu_nbd_tls_psk_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ dirty_bitmap_SOURCES = dirty-bitmap.c
+@@ -148,28 +153,24 @@ dirty_bitmap_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ list_exports_qemu_nbd_SOURCES = list-exports.c
+ list_exports_qemu_nbd_CPPFLAGS = \
+-	-I$(top_srcdir)/include \
++	$(AM_CPPFLAGS) \
+ 	-DSOCKET_ACTIVATION=1 \
+ 	-DSERVER=\"$(QEMU_NBD)\" \
+ 	-DSERVER_PARAMS='"-f", "raw", "-x", "testing", "-D", "data", tmpfile' \
+ 	-DEXPORTS='"testing"' \
+ 	-DDESCRIPTIONS='"data"' \
+ 	$(NULL)
+-list_exports_qemu_nbd_CFLAGS = $(WARNINGS_CFLAGS)
+ list_exports_qemu_nbd_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ socket_activation_qemu_nbd_SOURCES = socket-activation.c
+ socket_activation_qemu_nbd_CPPFLAGS = \
+-	-I$(top_srcdir)/include \
++	$(AM_CPPFLAGS) \
+ 	-DSERVER=\"$(QEMU_NBD)\" \
+ 	-DSERVER_PARAMS='"-f", "raw", "-x", "", tmpfile' \
+ 	$(NULL)
+-socket_activation_qemu_nbd_CFLAGS = $(WARNINGS_CFLAGS)
+ socket_activation_qemu_nbd_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ structured_read_SOURCES = structured-read.c
+-structured_read_CPPFLAGS = -I$(top_srcdir)/include
+-structured_read_CFLAGS = $(WARNINGS_CFLAGS)
+ structured_read_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ endif HAVE_QEMU_NBD
+@@ -215,88 +216,80 @@ endif
+ 
+ interop_nbdkit_SOURCES = interop.c
+ interop_nbdkit_CPPFLAGS = \
+-	-I$(top_srcdir)/include \
++	$(AM_CPPFLAGS) \
+ 	-DSERVER=\"$(NBDKIT)\" \
+ 	-DSERVER_PARAMS='"-s", "--exit-with-parent", "file", tmpfile' \
+ 	$(NULL)
+-interop_nbdkit_CFLAGS = $(WARNINGS_CFLAGS)
+ interop_nbdkit_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ interop_nbdkit_tls_certs_SOURCES = interop.c
+ interop_nbdkit_tls_certs_CPPFLAGS = \
+-	-I$(top_srcdir)/include \
++	$(AM_CPPFLAGS) \
+ 	-DSERVER=\"$(NBDKIT)\" \
+ 	-DSERVER_PARAMS='"--tls=require", "--tls-certificates=../tests/pki", "-s", "--exit-with-parent", "file", tmpfile' \
+ 	-DCERTS=1 \
+ 	-DTLS_MODE=LIBNBD_TLS_REQUIRE \
+ 	$(NULL)
+-interop_nbdkit_tls_certs_CFLAGS = $(WARNINGS_CFLAGS)
+ interop_nbdkit_tls_certs_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ interop_nbdkit_tls_certs_allow_enabled_SOURCES = interop.c
+ interop_nbdkit_tls_certs_allow_enabled_CPPFLAGS = \
+-	-I$(top_srcdir)/include \
++	$(AM_CPPFLAGS) \
+ 	-DSERVER=\"$(NBDKIT)\" \
+ 	-DSERVER_PARAMS='"--tls=require", "--tls-certificates=../tests/pki", "-s", "--exit-with-parent", "file", tmpfile' \
+ 	-DCERTS=1 \
+ 	-DTLS_MODE=LIBNBD_TLS_ALLOW \
+ 	$(NULL)
+-interop_nbdkit_tls_certs_allow_enabled_CFLAGS = $(WARNINGS_CFLAGS)
+ interop_nbdkit_tls_certs_allow_enabled_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ interop_nbdkit_tls_certs_allow_fallback_SOURCES = interop.c
+ interop_nbdkit_tls_certs_allow_fallback_CPPFLAGS = \
+-	-I$(top_srcdir)/include \
++	$(AM_CPPFLAGS) \
+ 	-DSERVER=\"$(NBDKIT)\" \
+ 	-DSERVER_PARAMS='"--tls=off", "-s", "--exit-with-parent", "file", tmpfile' \
+ 	-DCERTS=1 \
+ 	-DTLS_MODE=LIBNBD_TLS_ALLOW \
+ 	-DTLS_FALLBACK=1 \
+ 	$(NULL)
+-interop_nbdkit_tls_certs_allow_fallback_CFLAGS = $(WARNINGS_CFLAGS)
+ interop_nbdkit_tls_certs_allow_fallback_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ interop_nbdkit_tls_psk_SOURCES = interop.c
+ interop_nbdkit_tls_psk_CPPFLAGS = \
+-	-I$(top_srcdir)/include \
++	$(AM_CPPFLAGS) \
+ 	-DSERVER=\"$(NBDKIT)\" \
+ 	-DSERVER_PARAMS='"--tls=require", "--tls-psk=../tests/keys.psk", "-s", "--exit-with-parent", "file", tmpfile' \
+ 	-DPSK=1 \
+ 	-DTLS_MODE=LIBNBD_TLS_REQUIRE \
+ 	$(NULL)
+-interop_nbdkit_tls_psk_CFLAGS = $(WARNINGS_CFLAGS)
+ interop_nbdkit_tls_psk_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ interop_nbdkit_tls_psk_allow_enabled_SOURCES = interop.c
+ interop_nbdkit_tls_psk_allow_enabled_CPPFLAGS = \
+-	-I$(top_srcdir)/include \
++	$(AM_CPPFLAGS) \
+ 	-DSERVER=\"$(NBDKIT)\" \
+ 	-DSERVER_PARAMS='"--tls=require", "--tls-psk=../tests/keys.psk", "-s", "--exit-with-parent", "file", tmpfile' \
+ 	-DPSK=1 \
+ 	-DTLS_MODE=LIBNBD_TLS_ALLOW \
+ 	$(NULL)
+-interop_nbdkit_tls_psk_allow_enabled_CFLAGS = $(WARNINGS_CFLAGS)
+ interop_nbdkit_tls_psk_allow_enabled_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ interop_nbdkit_tls_psk_allow_fallback_SOURCES = interop.c
+ interop_nbdkit_tls_psk_allow_fallback_CPPFLAGS = \
+-	-I$(top_srcdir)/include \
++	$(AM_CPPFLAGS) \
+ 	-DSERVER=\"$(NBDKIT)\" \
+ 	-DSERVER_PARAMS='"--tls=off", "-s", "--exit-with-parent", "file", tmpfile' \
+ 	-DPSK=1 \
+ 	-DTLS_MODE=LIBNBD_TLS_ALLOW \
+ 	-DTLS_FALLBACK=1 \
+ 	$(NULL)
+-interop_nbdkit_tls_psk_allow_fallback_CFLAGS = $(WARNINGS_CFLAGS)
+ interop_nbdkit_tls_psk_allow_fallback_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ socket_activation_nbdkit_SOURCES = socket-activation.c
+ socket_activation_nbdkit_CPPFLAGS = \
+-	-I$(top_srcdir)/include \
++	$(AM_CPPFLAGS) \
+ 	-DSERVER=\"$(NBDKIT)\" \
+ 	-DSERVER_PARAMS='"file", tmpfile' \
+ 	$(NULL)
+-socket_activation_nbdkit_CFLAGS = $(WARNINGS_CFLAGS)
+ socket_activation_nbdkit_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ endif HAVE_NBDKIT
+diff --git a/tests/Makefile.am b/tests/Makefile.am
+index 64320cad..436e1c10 100644
+--- a/tests/Makefile.am
++++ b/tests/Makefile.am
+@@ -52,6 +52,18 @@ TESTS_ENVIRONMENT = srcdir=$(srcdir) LIBNBD_DEBUG=1
+ # Use the ./run script so we're always using the local library and tools.
+ LOG_COMPILER = $(top_builddir)/run
+ 
++# Common flags.
++# Note there is no such thing as "AM_LDADD".
++AM_CPPFLAGS = \
++	-I$(top_srcdir)/include \
++	$(NULL)
++AM_CFLAGS = \
++	$(WARNINGS_CFLAGS) \
++	$(NULL)
++AM_CXXFLAGS = \
++	$(WARNINGS_CFLAGS) \
++	$(NULL)
++
+ #----------------------------------------------------------------------
+ # The following tests do not need an NBD server.
+ 
+@@ -81,45 +93,30 @@ TESTS += \
+ .PHONY: compile
+ 
+ compile_header_only_SOURCES = compile-header-only.c
+-compile_header_only_CPPFLAGS = -I$(top_srcdir)/include
+-compile_header_only_CFLAGS = $(WARNINGS_CFLAGS)
+ compile_header_only_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ compile_c_SOURCES = compile.c
+-compile_c_CPPFLAGS = -I$(top_srcdir)/include
+-compile_c_CFLAGS = $(WARNINGS_CFLAGS)
+ compile_c_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ compile_ansi_c_SOURCES = compile-ansi-c.c
+ compile_ansi_c_CPPFLAGS = \
+-	-I$(top_srcdir)/include \
++	$(AM_CPPFLAGS) \
+ 	-std=c90 -pedantic
+-compile_ansi_c_CFLAGS = $(WARNINGS_CFLAGS)
+ compile_ansi_c_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ close_null_SOURCES = close-null.c
+-close_null_CPPFLAGS = -I$(top_srcdir)/include
+-close_null_CFLAGS = $(WARNINGS_CFLAGS)
+ close_null_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ debug_SOURCES = debug.c
+-debug_CPPFLAGS = -I$(top_srcdir)/include
+-debug_CFLAGS = $(WARNINGS_CFLAGS)
+ debug_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ debug_environment_SOURCES = debug-environment.c
+-debug_environment_CPPFLAGS = -I$(top_srcdir)/include
+-debug_environment_CFLAGS = $(WARNINGS_CFLAGS)
+ debug_environment_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ version_SOURCES = version.c
+-version_CPPFLAGS = -I$(top_srcdir)/include
+-version_CFLAGS = $(WARNINGS_CFLAGS)
+ version_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ export_name_SOURCES = export-name.c
+-export_name_CPPFLAGS = -I$(top_srcdir)/include
+-export_name_CFLAGS = $(WARNINGS_CFLAGS)
+ export_name_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ if HAVE_CXX
+@@ -128,8 +125,6 @@ check_PROGRAMS += compile-cxx
+ TESTS += compile-cxx
+ 
+ compile_cxx_SOURCES = compile-cxx.cpp
+-compile_cxx_CPPFLAGS = -I$(top_srcdir)/include
+-compile_cxx_CXXFLAGS = $(WARNINGS_CFLAGS)
+ compile_cxx_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ endif HAVE_CXX
+@@ -220,243 +215,208 @@ TESTS += \
+ 	$(NULL)
+ 
+ errors_SOURCES = errors.c
+-errors_CPPFLAGS = -I$(top_srcdir)/include
+-errors_CFLAGS = $(WARNINGS_CFLAGS)
+ errors_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ server_death_SOURCES = server-death.c
+-server_death_CPPFLAGS = -I$(top_srcdir)/include
+-server_death_CFLAGS = $(WARNINGS_CFLAGS)
+ server_death_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ shutdown_flags_SOURCES = shutdown-flags.c
+-shutdown_flags_CPPFLAGS = -I$(top_srcdir)/include
+-shutdown_flags_CFLAGS = $(WARNINGS_CFLAGS)
+ shutdown_flags_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ get_size_SOURCES = get-size.c
+-get_size_CPPFLAGS = -I$(top_srcdir)/include
+-get_size_CFLAGS = $(WARNINGS_CFLAGS)
+ get_size_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ read_only_flag_SOURCES = read-only-flag.c
+-read_only_flag_CPPFLAGS = -I$(top_srcdir)/include
+-read_only_flag_CFLAGS = $(WARNINGS_CFLAGS)
+ read_only_flag_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ read_write_flag_SOURCES = read-write-flag.c
+-read_write_flag_CPPFLAGS = -I$(top_srcdir)/include
+-read_write_flag_CFLAGS = $(WARNINGS_CFLAGS)
+ read_write_flag_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ can_flush_flag_SOURCES = eflags.c
+ can_flush_flag_CPPFLAGS = \
+-	-I$(top_srcdir)/include -Dflag=can_flush \
++	$(AM_CPPFLAGS) \
++	-Dflag=can_flush \
+ 	$(NULL)
+-can_flush_flag_CFLAGS = $(WARNINGS_CFLAGS)
+ can_flush_flag_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ can_not_flush_flag_SOURCES = eflags.c
+ can_not_flush_flag_CPPFLAGS = \
+-	-I$(top_srcdir)/include -Dflag=can_flush -Dvalue=false \
++	$(AM_CPPFLAGS) \
++	-Dflag=can_flush -Dvalue=false \
+ 	$(NULL)
+-can_not_flush_flag_CFLAGS = $(WARNINGS_CFLAGS)
+ can_not_flush_flag_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ can_fua_flag_SOURCES = eflags.c
+ can_fua_flag_CPPFLAGS = \
+-	-I$(top_srcdir)/include -Dflag=can_fua -Dvalue=native \
++	$(AM_CPPFLAGS) \
++	-Dflag=can_fua -Dvalue=native \
+ 	$(NULL)
+-can_fua_flag_CFLAGS = $(WARNINGS_CFLAGS)
+ can_fua_flag_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ can_not_fua_flag_SOURCES = eflags.c
+ can_not_fua_flag_CPPFLAGS = \
+-	-I$(top_srcdir)/include -Dflag=can_fua -Dvalue=none \
++	$(AM_CPPFLAGS) \
++	-Dflag=can_fua -Dvalue=none \
+ 	$(NULL)
+-can_not_fua_flag_CFLAGS = $(WARNINGS_CFLAGS)
+ can_not_fua_flag_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ is_rotational_flag_SOURCES = eflags.c
+ is_rotational_flag_CPPFLAGS = \
+-	-I$(top_srcdir)/include -Dflag=is_rotational \
++	$(AM_CPPFLAGS) \
++	-Dflag=is_rotational \
+ 	$(NULL)
+-is_rotational_flag_CFLAGS = $(WARNINGS_CFLAGS)
+ is_rotational_flag_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ is_not_rotational_flag_SOURCES = eflags.c
+ is_not_rotational_flag_CPPFLAGS = \
+-	-I$(top_srcdir)/include -Dflag=is_rotational -Dvalue=false \
++	$(AM_CPPFLAGS) \
++	-Dflag=is_rotational -Dvalue=false \
+ 	$(NULL)
+-is_not_rotational_flag_CFLAGS = $(WARNINGS_CFLAGS)
+ is_not_rotational_flag_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ can_trim_flag_SOURCES = eflags.c
+ can_trim_flag_CPPFLAGS = \
+-	-I$(top_srcdir)/include -Dflag=can_trim \
++	$(AM_CPPFLAGS) \
++	-Dflag=can_trim \
+ 	$(NULL)
+-can_trim_flag_CFLAGS = $(WARNINGS_CFLAGS)
+ can_trim_flag_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ can_not_trim_flag_SOURCES = eflags.c
+ can_not_trim_flag_CPPFLAGS = \
+-	-I$(top_srcdir)/include -Dflag=can_trim -Dvalue=false \
++	$(AM_CPPFLAGS) \
++	-Dflag=can_trim -Dvalue=false \
+ 	$(NULL)
+-can_not_trim_flag_CFLAGS = $(WARNINGS_CFLAGS)
+ can_not_trim_flag_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ can_zero_flag_SOURCES = eflags.c
+ can_zero_flag_CPPFLAGS = \
+-	-I$(top_srcdir)/include -Dflag=can_zero \
++	$(AM_CPPFLAGS) \
++	-Dflag=can_zero \
+ 	$(NULL)
+-can_zero_flag_CFLAGS = $(WARNINGS_CFLAGS)
+ can_zero_flag_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ can_not_zero_flag_SOURCES = eflags.c
+ can_not_zero_flag_CPPFLAGS = \
+-	-I$(top_srcdir)/include -Dflag=can_zero -Dvalue=false \
++	$(AM_CPPFLAGS) \
++	-Dflag=can_zero -Dvalue=false \
+ 	-Dfilter='"--filter=nozero"' \
+ 	$(NULL)
+-can_not_zero_flag_CFLAGS = $(WARNINGS_CFLAGS)
+ can_not_zero_flag_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ can_fast_zero_flag_SOURCES = eflags.c
+ can_fast_zero_flag_CPPFLAGS = \
++	$(AM_CPPFLAGS) \
+ 	-I$(top_srcdir)/include -Dflag=can_fast_zero \
+ 	-Drequire='"has_can_fast_zero=1"' \
+ 	$(NULL)
+-can_fast_zero_flag_CFLAGS = $(WARNINGS_CFLAGS)
+ can_fast_zero_flag_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ can_not_fast_zero_flag_SOURCES = eflags.c
+ can_not_fast_zero_flag_CPPFLAGS = \
++	$(AM_CPPFLAGS) \
+ 	-I$(top_srcdir)/include -Dflag=can_fast_zero -Dvalue=false \
+ 	-Drequire='"has_can_fast_zero=1"' \
+ 	$(NULL)
+-can_not_fast_zero_flag_CFLAGS = $(WARNINGS_CFLAGS)
+ can_not_fast_zero_flag_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ can_df_flag_SOURCES = eflags.c
+ can_df_flag_CPPFLAGS = \
+-	-I$(top_srcdir)/include -Dflag=can_df \
++	$(AM_CPPFLAGS) \
++	-Dflag=can_df \
+ 	$(NULL)
+-can_df_flag_CFLAGS = $(WARNINGS_CFLAGS)
+ can_df_flag_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ can_not_df_flag_SOURCES = eflags.c
+ can_not_df_flag_CPPFLAGS = \
+-	-I$(top_srcdir)/include -Dflag=can_df -Dvalue=false -Dno_sr \
++	$(AM_CPPFLAGS) \
++	-Dflag=can_df -Dvalue=false -Dno_sr \
+ 	$(NULL)
+-can_not_df_flag_CFLAGS = $(WARNINGS_CFLAGS)
+ can_not_df_flag_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ can_multi_conn_flag_SOURCES = eflags.c
+ can_multi_conn_flag_CPPFLAGS = \
+-	-I$(top_srcdir)/include -Dflag=can_multi_conn \
++	$(AM_CPPFLAGS) \
++	-Dflag=can_multi_conn \
+ 	$(NULL)
+-can_multi_conn_flag_CFLAGS = $(WARNINGS_CFLAGS)
+ can_multi_conn_flag_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ can_not_multi_conn_flag_SOURCES = eflags.c
+ can_not_multi_conn_flag_CPPFLAGS = \
+-	-I$(top_srcdir)/include -Dflag=can_multi_conn -Dvalue=false \
++	$(AM_CPPFLAGS) \
++	-Dflag=can_multi_conn -Dvalue=false \
+ 	$(NULL)
+-can_not_multi_conn_flag_CFLAGS = $(WARNINGS_CFLAGS)
+ can_not_multi_conn_flag_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ can_cache_flag_SOURCES = eflags.c
+ can_cache_flag_CPPFLAGS = \
++	$(AM_CPPFLAGS) \
+ 	-I$(top_srcdir)/include -Dflag=can_cache -Dvalue=native \
+ 	-Drequire='"has_can_cache=1"' \
+ 	$(NULL)
+-can_cache_flag_CFLAGS = $(WARNINGS_CFLAGS)
+ can_cache_flag_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ can_not_cache_flag_SOURCES = eflags.c
+ can_not_cache_flag_CPPFLAGS = \
++	$(AM_CPPFLAGS) \
+ 	-I$(top_srcdir)/include -Dflag=can_cache -Dvalue=none \
+ 	-Drequire='"has_can_cache=1"' \
+ 	$(NULL)
+-can_not_cache_flag_CFLAGS = $(WARNINGS_CFLAGS)
+ can_not_cache_flag_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ oldstyle_SOURCES = oldstyle.c
+-oldstyle_CPPFLAGS = -I$(top_srcdir)/include
+-oldstyle_CFLAGS = $(WARNINGS_CFLAGS)
+ oldstyle_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ newstyle_limited_SOURCES = newstyle-limited.c
+-newstyle_limited_CPPFLAGS = -I$(top_srcdir)/include
+-newstyle_limited_CFLAGS = $(WARNINGS_CFLAGS)
+ newstyle_limited_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ opt_abort_SOURCES = opt-abort.c
+-opt_abort_CPPFLAGS = -I$(top_srcdir)/include
+-opt_abort_CFLAGS = $(WARNINGS_CFLAGS)
+ opt_abort_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ opt_list_SOURCES = opt-list.c
+ opt_list_CPPFLAGS = \
+-	-I$(top_srcdir)/include \
++	$(AM_CPPFLAGS) \
+ 	-DSCRIPT='"$(abs_srcdir)/opt-list.sh"' \
+ 	$(NULL)
+-opt_list_CFLAGS = $(WARNINGS_CFLAGS)
+ opt_list_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ opt_info_SOURCES = opt-info.c
+ opt_info_CPPFLAGS = \
+-	-I$(top_srcdir)/include \
++	$(AM_CPPFLAGS) \
+ 	-DSCRIPT='"$(abs_srcdir)/opt-info.sh"' \
+ 	$(NULL)
+-opt_info_CFLAGS = $(WARNINGS_CFLAGS)
+ opt_info_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ opt_list_meta_SOURCES = opt-list-meta.c
+-opt_list_meta_CPPFLAGS = \
+-	-I$(top_srcdir)/include \
+-	$(NULL)
+-opt_list_meta_CFLAGS = $(WARNINGS_CFLAGS)
+ opt_list_meta_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ connect_unix_SOURCES = connect-unix.c
+-connect_unix_CPPFLAGS = -I$(top_srcdir)/include
+-connect_unix_CFLAGS = $(WARNINGS_CFLAGS)
+ connect_unix_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ connect_tcp_SOURCES = connect-tcp.c
+-connect_tcp_CPPFLAGS = -I$(top_srcdir)/include
+-connect_tcp_CFLAGS = $(WARNINGS_CFLAGS)
+ connect_tcp_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ aio_parallel_SOURCES = aio-parallel.c
+ aio_parallel_CPPFLAGS = \
+-	-I$(top_srcdir)/include \
++	$(AM_CPPFLAGS) \
+ 	-I$(top_srcdir)/common/include \
+ 	$(NULL)
+-aio_parallel_CFLAGS = $(WARNINGS_CFLAGS) $(PTHREAD_CFLAGS)
+ aio_parallel_LDADD = $(top_builddir)/lib/libnbd.la $(PTHREAD_LIBS)
+ 
+ aio_parallel_load_SOURCES = aio-parallel-load.c
+-aio_parallel_load_CPPFLAGS = -I$(top_srcdir)/include
+-aio_parallel_load_CFLAGS = $(WARNINGS_CFLAGS) $(PTHREAD_CFLAGS)
+ aio_parallel_load_LDADD = $(top_builddir)/lib/libnbd.la $(PTHREAD_LIBS)
+ 
+ synch_parallel_SOURCES = synch-parallel.c
+ synch_parallel_CPPFLAGS = \
+-	-I$(top_srcdir)/include \
++	$(AM_CPPFLAGS) \
+ 	-I$(top_srcdir)/common/include \
+ 	$(NULL)
+-synch_parallel_CFLAGS = $(WARNINGS_CFLAGS) $(PTHREAD_CFLAGS)
++synch_parallel_CFLAGS = $(AM_CFLAGS) $(PTHREAD_CFLAGS)
+ synch_parallel_LDADD = $(top_builddir)/lib/libnbd.la $(PTHREAD_LIBS)
+ 
+ meta_base_allocation_SOURCES = meta-base-allocation.c
+-meta_base_allocation_CPPFLAGS = -I$(top_srcdir)/include
+-meta_base_allocation_CFLAGS = $(WARNINGS_CFLAGS)
+ meta_base_allocation_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ closure_lifetimes_SOURCES = closure-lifetimes.c
+-closure_lifetimes_CPPFLAGS = -I$(top_srcdir)/include
+-closure_lifetimes_CFLAGS = $(WARNINGS_CFLAGS)
+ closure_lifetimes_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ #----------------------------------------------------------------------
+@@ -470,8 +430,10 @@ check_DATA += pki/stamp-pki
+ TESTS += connect-tls-certs
+ 
+ connect_tls_certs_SOURCES = connect-tls.c
+-connect_tls_certs_CPPFLAGS = -I$(top_srcdir)/include -DCERTS=1
+-connect_tls_certs_CFLAGS = $(WARNINGS_CFLAGS)
++connect_tls_certs_CPPFLAGS = \
++	$(AM_CPPFLAGS) \
++	-DCERTS=1 \
++	$(NULL)
+ connect_tls_certs_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ pki/stamp-pki: $(srcdir)/make-pki.sh
+@@ -499,31 +461,36 @@ TESTS += \
+ check_DATA += keys.psk
+ 
+ connect_tls_psk_SOURCES = connect-tls.c
+-connect_tls_psk_CPPFLAGS = -I$(top_srcdir)/include -DPSK=1
+-connect_tls_psk_CFLAGS = $(WARNINGS_CFLAGS)
++connect_tls_psk_CPPFLAGS = \
++	$(AM_CPPFLAGS) \
++	-DPSK=1 \
++	$(NULL)
+ connect_tls_psk_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ aio_parallel_tls_SOURCES = aio-parallel.c
+ aio_parallel_tls_CPPFLAGS = \
+-	-I$(top_srcdir)/include \
++	$(AM_CPPFLAGS) \
+ 	-I$(top_srcdir)/common/include \
+ 	-DTLS=1 \
+ 	$(NULL)
+-aio_parallel_tls_CFLAGS = $(WARNINGS_CFLAGS) $(PTHREAD_CFLAGS)
++aio_parallel_tls_CFLAGS = $(AM_CFLAGS) $(PTHREAD_CFLAGS)
+ aio_parallel_tls_LDADD = $(top_builddir)/lib/libnbd.la $(PTHREAD_LIBS)
+ 
+ aio_parallel_load_tls_SOURCES = aio-parallel-load.c
+-aio_parallel_load_tls_CPPFLAGS = -I$(top_srcdir)/include -DTLS=1
+-aio_parallel_load_tls_CFLAGS = $(WARNINGS_CFLAGS) $(PTHREAD_CFLAGS)
++aio_parallel_load_tls_CPPFLAGS = \
++	$(AM_CPPFLAGS) \
++	-DTLS=1 \
++	$(NULL)
++aio_parallel_load_tls_CFLAGS = $(AM_CFLAGS) $(PTHREAD_CFLAGS)
+ aio_parallel_load_tls_LDADD = $(top_builddir)/lib/libnbd.la $(PTHREAD_LIBS)
+ 
+ synch_parallel_tls_SOURCES = synch-parallel.c
+ synch_parallel_tls_CPPFLAGS = \
+-	-I$(top_srcdir)/include \
++	$(AM_CPPFLAGS) \
+ 	-I$(top_srcdir)/common/include \
+ 	-DTLS=1 \
+ 	$(NULL)
+-synch_parallel_tls_CFLAGS = $(WARNINGS_CFLAGS) $(PTHREAD_CFLAGS)
++synch_parallel_tls_CFLAGS = $(AM_CFLAGS) $(PTHREAD_CFLAGS)
+ synch_parallel_tls_LDADD = $(top_builddir)/lib/libnbd.la $(PTHREAD_LIBS)
+ 
+ keys.psk:
+@@ -550,18 +517,19 @@ TESTS += \
+ RANDOM1 := $(shell bash -c "echo $$(( 32768 + (RANDOM & 16383) ))")
+ connect_uri_nbd_SOURCES = connect-uri.c
+ connect_uri_nbd_CPPFLAGS = \
+-	-I$(top_srcdir)/include \
++	$(AM_CPPFLAGS) \
+ 	-DSERVER_PARAMS='"-p", "$(RANDOM1)"' \
+ 	-DPIDFILE='"connect-uri-nbd.pid"' \
+-	-DURI='"nbd://localhost:$(RANDOM1)/"'
+-connect_uri_nbd_CFLAGS = $(WARNINGS_CFLAGS)
++	-DURI='"nbd://localhost:$(RANDOM1)/"' \
++	$(NULL)
++connect_uri_nbd_CFLAGS = $(AM_CFLAGS)
+ connect_uri_nbd_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ CONNECT_URI_NBD_UNIX_SOCKET := \
+ 	$(shell mktemp /tmp/connect-uri-nbd-unix-socket-XXXXXX)
+ connect_uri_nbd_unix_SOURCES = connect-uri.c
+ connect_uri_nbd_unix_CPPFLAGS = \
+-	-I$(top_srcdir)/include \
++	$(AM_CPPFLAGS) \
+ 	-DSERVER_PARAMS='"-U", SOCKET' \
+ 	-DSOCKET='"$(CONNECT_URI_NBD_UNIX_SOCKET)"' \
+ 	-DPIDFILE='"connect-uri-nbd-unix.pid"' \
+@@ -584,18 +552,18 @@ TESTS += \
+ RANDOM2 := $(shell bash -c "echo $$(( 32768 + (RANDOM & 16383) ))")
+ connect_uri_nbds_SOURCES = connect-uri.c
+ connect_uri_nbds_CPPFLAGS = \
+-	-I$(top_srcdir)/include \
++	$(AM_CPPFLAGS) \
+ 	-DSERVER_PARAMS='"-p", "$(RANDOM2)", "--tls=require", "--tls-certificates=pki"' \
+ 	-DPIDFILE='"connect-uri-nbds.pid"' \
+-	-DURI='"nbds://localhost:$(RANDOM2)/"'
+-connect_uri_nbds_CFLAGS = $(WARNINGS_CFLAGS)
++	-DURI='"nbds://localhost:$(RANDOM2)/"' \
++	$(NULL)
+ connect_uri_nbds_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ CONNECT_URI_NBDS_UNIX_SOCKET := \
+ 	$(shell mktemp /tmp/connect-uri-nbds-unix-socket-XXXXXX)
+ connect_uri_nbds_unix_SOURCES = connect-uri.c
+ connect_uri_nbds_unix_CPPFLAGS = \
+-	-I$(top_srcdir)/include \
++	$(AM_CPPFLAGS) \
+ 	-DSERVER_PARAMS='"-U", SOCKET, "--tls=require", "--tls-certificates=pki"' \
+ 	-DSOCKET='"$(CONNECT_URI_NBDS_UNIX_SOCKET)"' \
+ 	-DPIDFILE='"connect-uri-nbds-unix.pid"' \
+@@ -617,11 +585,11 @@ TESTS += \
+ RANDOM3 := $(shell bash -c "echo $$(( 32768 + (RANDOM & 16383) ))")
+ connect_uri_nbds_psk_SOURCES = connect-uri.c
+ connect_uri_nbds_psk_CPPFLAGS = \
+-	-I$(top_srcdir)/include \
++	$(AM_CPPFLAGS) \
+ 	-DSERVER_PARAMS='"-p", "$(RANDOM3)", "--tls=require", "--tls-psk=keys.psk"' \
+ 	-DPIDFILE='"connect-uri-nbds-psk.pid"' \
+-	-DURI='"nbds://alice@localhost:$(RANDOM3)/?tls-psk-file=keys.psk"'
+-connect_uri_nbds_psk_CFLAGS = $(WARNINGS_CFLAGS)
++	-DURI='"nbds://alice@localhost:$(RANDOM3)/?tls-psk-file=keys.psk"' \
++	$(NULL)
+ connect_uri_nbds_psk_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ endif HAVE_PSKTOOL
+-- 
+2.43.0
+

SOURCES/0010-tests-connect-uri.c-Ensure-Unix-domain-socket-is-cle.patch

@@ -0,0 +1,149 @@
+From da628792ddf7a3d3cb8f8b770c7dbb9b9d67444b Mon Sep 17 00:00:00 2001
+From: "Richard W.M. Jones" <rjones@redhat.com>
+Date: Sat, 24 Apr 2021 21:40:58 +0100
+Subject: [PATCH] tests/connect-uri.c: Ensure Unix domain socket is cleaned up
+ on exit
+
+Commit 70f83fed13 ("tests: Create test sockets in /tmp instead of
+local directory.") aimed to create sockets with short path names in
+/tmp.  However it never cleaned them up.  Worse still, every time the
+Makefile was evaluated at all a temporary file was created.
+
+Fix this properly in the C file.
+
+Fixes: commit 70f83fed131c7e52b1a31a28d9acaf19f6c11d57
+(cherry picked from commit f5955c4c5bb0269e192b906a3ef98601aa63ad59)
+(cherry picked from commit 502f0b59ec1dbd64c6c64279316e03540258a54c)
+---
+ tests/Makefile.am   | 16 ++++++----------
+ tests/connect-uri.c | 45 +++++++++++++++++++++++++++++++++++++++------
+ 2 files changed, 45 insertions(+), 16 deletions(-)
+
+diff --git a/tests/Makefile.am b/tests/Makefile.am
+index 436e1c10..ed5585a5 100644
+--- a/tests/Makefile.am
++++ b/tests/Makefile.am
+@@ -525,15 +525,13 @@ connect_uri_nbd_CPPFLAGS = \
+ connect_uri_nbd_CFLAGS = $(AM_CFLAGS)
+ connect_uri_nbd_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+-CONNECT_URI_NBD_UNIX_SOCKET := \
+-	$(shell mktemp /tmp/connect-uri-nbd-unix-socket-XXXXXX)
+ connect_uri_nbd_unix_SOURCES = connect-uri.c
+ connect_uri_nbd_unix_CPPFLAGS = \
+ 	$(AM_CPPFLAGS) \
+-	-DSERVER_PARAMS='"-U", SOCKET' \
+-	-DSOCKET='"$(CONNECT_URI_NBD_UNIX_SOCKET)"' \
++	-DNEEDS_UNIX_SOCKET=1 \
++	-DSERVER_PARAMS='"-U", UNIX_SOCKET' \
+ 	-DPIDFILE='"connect-uri-nbd-unix.pid"' \
+-	-DURI='"nbd+unix:///?socket=" SOCKET'
++	-DURI='"nbd+unix:///?socket="' # UNIX_SOCKET appended
+ connect_uri_nbd_unix_CFLAGS = $(WARNINGS_CFLAGS)
+ connect_uri_nbd_unix_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+@@ -559,15 +557,13 @@ connect_uri_nbds_CPPFLAGS = \
+ 	$(NULL)
+ connect_uri_nbds_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+-CONNECT_URI_NBDS_UNIX_SOCKET := \
+-	$(shell mktemp /tmp/connect-uri-nbds-unix-socket-XXXXXX)
+ connect_uri_nbds_unix_SOURCES = connect-uri.c
+ connect_uri_nbds_unix_CPPFLAGS = \
+ 	$(AM_CPPFLAGS) \
+-	-DSERVER_PARAMS='"-U", SOCKET, "--tls=require", "--tls-certificates=pki"' \
+-	-DSOCKET='"$(CONNECT_URI_NBDS_UNIX_SOCKET)"' \
++	-DNEEDS_UNIX_SOCKET=1 \
++	-DSERVER_PARAMS='"-U", UNIX_SOCKET, "--tls=require", "--tls-certificates=pki"' \
+ 	-DPIDFILE='"connect-uri-nbds-unix.pid"' \
+-	-DURI='"nbds+unix:///?socket=" SOCKET'
++	-DURI='"nbds+unix:///?socket="' # UNIX_SOCKET appended
+ connect_uri_nbds_unix_CFLAGS = $(WARNINGS_CFLAGS)
+ connect_uri_nbds_unix_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+diff --git a/tests/connect-uri.c b/tests/connect-uri.c
+index 6e7d1685..ce9e4d9b 100644
+--- a/tests/connect-uri.c
++++ b/tests/connect-uri.c
+@@ -29,16 +29,49 @@
+ 
+ #include <libnbd.h>
+ 
++#ifdef NEEDS_UNIX_SOCKET
++#define UNIX_SOCKET tmp
++static char tmp[] = "/tmp/nbdXXXXXX";
++
++static void
++unlink_unix_socket (void)
++{
++  unlink (UNIX_SOCKET);
++}
++#endif /* NEEDS_UNIX_SOCKET */
++
+ int
+ main (int argc, char *argv[])
+ {
+   struct nbd_handle *nbd;
+   pid_t pid;
+   size_t i;
++#ifdef NEEDS_UNIX_SOCKET
++  char *uri;
++#else
++  const char *uri = URI;
++#endif
++
++#ifdef NEEDS_UNIX_SOCKET
++  int fd = mkstemp (UNIX_SOCKET);
++  if (fd == -1 ||
++      close (fd) == -1) {
++    perror (UNIX_SOCKET);
++    exit (EXIT_FAILURE);
++  }
++  /* We have to remove the temporary file first, since we will create
++   * a socket in its place, and ensure the socket is removed on exit.
++   */
++  unlink_unix_socket ();
++  atexit (unlink_unix_socket);
+ 
+-#ifdef SOCKET
+-  unlink (SOCKET);
++  /* uri = URI + UNIX_SOCKET */
++  if (asprintf (&uri, "%s%s", URI, UNIX_SOCKET) == -1) {
++    perror ("asprintf");
++    exit (EXIT_FAILURE);
++  }
+ #endif
++
+   unlink (PIDFILE);
+ 
+   pid = fork ();
+@@ -75,13 +108,13 @@ main (int argc, char *argv[])
+ 
+   nbd_set_uri_allow_local_file (nbd, true);
+ 
+-  if (nbd_connect_uri (nbd, URI) == -1) {
++  if (nbd_connect_uri (nbd, uri) == -1) {
+     fprintf (stderr, "%s\n", nbd_get_error ());
+     exit (EXIT_FAILURE);
+   }
+ 
+   /* Check we negotiated the right kind of connection. */
+-  if (strncmp (URI, "nbds", 4) == 0) {
++  if (strncmp (uri, "nbds", 4) == 0) {
+     if (! nbd_get_tls_negotiated (nbd)) {
+       fprintf (stderr, "%s: failed to negotiate a TLS connection\n",
+                argv[0]);
+@@ -95,8 +128,8 @@ main (int argc, char *argv[])
+   }
+ 
+   nbd_close (nbd);
+-#ifdef SOCKET
+-  unlink (SOCKET);
++#ifdef NEEDS_UNIX_SOCKET
++  free (uri);
+ #endif
+   exit (EXIT_SUCCESS);
+ }
+-- 
+2.43.0
+

SOURCES/0011-lib-Allow-tls-certificates-DIR-query-parameter-in-UR.patch

@@ -0,0 +1,194 @@
+From ee3f88640062372d04406da321270a775377eb6c Mon Sep 17 00:00:00 2001
+From: "Richard W.M. Jones" <rjones@redhat.com>
+Date: Fri, 3 Sep 2021 08:42:31 +0100
+Subject: [PATCH] lib: Allow tls-certificates=<DIR> query parameter in URIs
+
+For nbd_connect_uri, this allows a non-default path to a certificates
+directory to be specified.  For example:
+
+  nbds+unix://user@/?socket=/tmp/sock&tls-certificates=tests/pki
+
+nbd_get_uri is also extended to produce the tls-certificates query
+field if nbd_set_tls_certificates was called.
+
+The main work here is extending the test suite so it actually tests
+TLS URIs properly.  Firstly we need to add --tls-verify-peer to the
+nbdkit command line so it checks TLS client credentials at all
+(previously it enabled TLS but didn't verify the client).  Then we
+need to add tests which use TLS certificates (previously only PSK was
+being tested).  And finally I loosened the rules for comparing URIs
+since the order that query strings are returned by nbd_get_uri is not
+necessarily the same as the query strings in nbd_connect_uri.
+
+(cherry picked from commit 847e0b9830f6a9f07b4c242e1a500cd2b90cca5a)
+(cherry picked from commit 5e85582ec79460c95552f06c6d6c41d15dae092f)
+---
+ .gitignore        |  5 +++--
+ generator/API.ml  | 10 ++++++++++
+ lib/uri.c         | 14 ++++++++++++--
+ tests/Makefile.am | 47 +++++++++++++++++++++++++++++------------------
+ 4 files changed, 54 insertions(+), 22 deletions(-)
+
+diff --git a/.gitignore b/.gitignore
+index 4935b81b..c974e27b 100644
+--- a/.gitignore
++++ b/.gitignore
+@@ -167,9 +167,10 @@ Makefile.in
+ /tests/connect-unix
+ /tests/connect-uri-nbd
+ /tests/connect-uri-nbd-unix
+-/tests/connect-uri-nbds
++/tests/connect-uri-nbds-certs
+ /tests/connect-uri-nbds-psk
+-/tests/connect-uri-nbds-unix
++/tests/connect-uri-nbds-unix-certs
++/tests/connect-uri-nbds-unix-psk
+ /tests/debug
+ /tests/debug-environment
+ /tests/errors
+diff --git a/generator/API.ml b/generator/API.ml
+index a46c6407..4b2a62e8 100644
+--- a/generator/API.ml
++++ b/generator/API.ml
+@@ -1231,6 +1231,11 @@ Connect over the Unix domain socket F</tmp/nbd.sock> to
+ an NBD server running locally.  The export name is set to C<foo>
+ (note without any leading C</> character).
+ 
++=item C<nbds+unix://alice@/?socket=/tmp/nbd.sock&tls-certificates=certs>
++
++Connect over a Unix domain socket, enabling TLS and setting the
++path to a directory containing certificates and keys.
++
+ =item C<nbd+vsock:///>
+ 
+ In this scenario libnbd is running in a virtual machine.  Connect
+@@ -1291,6 +1296,11 @@ Specifies the Unix domain socket to connect on.
+ Must be present for the C<+unix> transport and must not
+ be present for the other transports.
+ 
++=item B<tls-certificates=>F<DIR>
++
++Set the certificates directory.  See L<nbd_set_tls_certificates(3)>.
++Note this is not allowed by default - see next section.
++
+ =item B<tls-psk-file=>F<PSKFILE>
+ 
+ Set the PSK file.  See L<nbd_set_tls_psk_file(3)>.  Note
+diff --git a/lib/uri.c b/lib/uri.c
+index 9f5a2901..c8d9041e 100644
+--- a/lib/uri.c
++++ b/lib/uri.c
+@@ -249,9 +249,19 @@ nbd_unlocked_aio_connect_uri (struct nbd_handle *h, const char *raw_uri)
+   if (tls && nbd_unlocked_set_tls (h, LIBNBD_TLS_REQUIRE) == -1)
+     goto cleanup;
+ 
+-  /* Look for some tls-* parameters.  XXX More to come. */
++  /* Look for some tls-* parameters. */
+   for (i = 0; i < queries.size; i++) {
+-    if (strcmp (queries.ptr[i].name, "tls-psk-file") == 0) {
++    if (strcmp (queries.ptr[i].name, "tls-certificates") == 0) {
++      if (! h->uri_allow_local_file) {
++        set_error (EPERM,
++                   "local file access (tls-certificates) is not allowed, "
++                   "call nbd_set_uri_allow_local_file to enable this");
++        goto cleanup;
++      }
++      if (nbd_unlocked_set_tls_certificates (h, queries.ptr[i].value) == -1)
++        goto cleanup;
++    }
++    else if (strcmp (queries.ptr[i].name, "tls-psk-file") == 0) {
+       if (! h->uri_allow_local_file) {
+         set_error (EPERM,
+                    "local file access (tls-psk-file) is not allowed, "
+diff --git a/tests/Makefile.am b/tests/Makefile.am
+index ed5585a5..3c33b747 100644
+--- a/tests/Makefile.am
++++ b/tests/Makefile.am
+@@ -539,33 +539,32 @@ if HAVE_GNUTLS
+ if HAVE_CERTTOOL
+ 
+ check_PROGRAMS += \
+-	connect-uri-nbds \
+-	connect-uri-nbds-unix \
++	connect-uri-nbds-certs \
++	connect-uri-nbds-unix-certs \
+ 	$(NULL)
+ TESTS += \
+-	connect-uri-nbds \
+-	connect-uri-nbds-unix \
++	connect-uri-nbds-certs \
++	connect-uri-nbds-unix-certs \
+ 	$(NULL)
+ 
+ RANDOM2 := $(shell bash -c "echo $$(( 32768 + (RANDOM & 16383) ))")
+-connect_uri_nbds_SOURCES = connect-uri.c
+-connect_uri_nbds_CPPFLAGS = \
++connect_uri_nbds_certs_SOURCES = connect-uri.c
++connect_uri_nbds_certs_CPPFLAGS = \
+ 	$(AM_CPPFLAGS) \
+-	-DSERVER_PARAMS='"-p", "$(RANDOM2)", "--tls=require", "--tls-certificates=pki"' \
+-	-DPIDFILE='"connect-uri-nbds.pid"' \
+-	-DURI='"nbds://localhost:$(RANDOM2)/"' \
++	-DSERVER_PARAMS='"-p", "$(RANDOM2)", "--tls=require", "--tls-verify-peer", "--tls-certificates=pki"' \
++	-DPIDFILE='"connect-uri-nbds-certs.pid"' \
++	-DURI='"nbds://localhost:$(RANDOM2)/?tls-certificates=pki"' \
+ 	$(NULL)
+-connect_uri_nbds_LDADD = $(top_builddir)/lib/libnbd.la
++connect_uri_nbds_certs_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+-connect_uri_nbds_unix_SOURCES = connect-uri.c
+-connect_uri_nbds_unix_CPPFLAGS = \
++connect_uri_nbds_unix_certs_SOURCES = connect-uri.c
++connect_uri_nbds_unix_certs_CPPFLAGS = \
+ 	$(AM_CPPFLAGS) \
+ 	-DNEEDS_UNIX_SOCKET=1 \
+-	-DSERVER_PARAMS='"-U", UNIX_SOCKET, "--tls=require", "--tls-certificates=pki"' \
+-	-DPIDFILE='"connect-uri-nbds-unix.pid"' \
+-	-DURI='"nbds+unix:///?socket="' # UNIX_SOCKET appended
+-connect_uri_nbds_unix_CFLAGS = $(WARNINGS_CFLAGS)
+-connect_uri_nbds_unix_LDADD = $(top_builddir)/lib/libnbd.la
++	-DSERVER_PARAMS='"-U", UNIX_SOCKET, "--tls=require", "--tls-verify-peer", "--tls-certificates=pki"' \
++	-DPIDFILE='"connect-uri-nbds-unix-certs.pid"' \
++	-DURI='"nbds+unix://alice@/?tls-certificates=pki&socket="' # UNIX_SOCKET appended
++connect_uri_nbds_unix_certs_LDADD = $(top_builddir)/lib/libnbd.la
+ 
+ endif HAVE_CERTTOOL
+ 
+@@ -573,21 +572,33 @@ if HAVE_PSKTOOL
+ 
+ check_PROGRAMS += \
+ 	connect-uri-nbds-psk \
++	connect-uri-nbds-unix-psk \
+ 	$(NULL)
+ TESTS += \
+ 	connect-uri-nbds-psk \
++	connect-uri-nbds-unix-psk \
+ 	$(NULL)
+ 
+ RANDOM3 := $(shell bash -c "echo $$(( 32768 + (RANDOM & 16383) ))")
+ connect_uri_nbds_psk_SOURCES = connect-uri.c
+ connect_uri_nbds_psk_CPPFLAGS = \
+ 	$(AM_CPPFLAGS) \
+-	-DSERVER_PARAMS='"-p", "$(RANDOM3)", "--tls=require", "--tls-psk=keys.psk"' \
++	-DSERVER_PARAMS='"-p", "$(RANDOM3)", "--tls=require", "--tls-verify-peer", "--tls-psk=keys.psk"' \
+ 	-DPIDFILE='"connect-uri-nbds-psk.pid"' \
+ 	-DURI='"nbds://alice@localhost:$(RANDOM3)/?tls-psk-file=keys.psk"' \
+ 	$(NULL)
+ connect_uri_nbds_psk_LDADD = $(top_builddir)/lib/libnbd.la
+ 
++connect_uri_nbds_unix_psk_SOURCES = connect-uri.c
++connect_uri_nbds_unix_psk_CPPFLAGS = \
++	$(AM_CPPFLAGS) \
++	-DNEEDS_UNIX_SOCKET=1 \
++	-DSERVER_PARAMS='"-U", UNIX_SOCKET, "--tls=require", "--tls-verify-peer", "--tls-psk=keys.psk"' \
++	-DPIDFILE='"connect-uri-nbds-unix-psk.pid"' \
++	-DURI='"nbds+unix://alice@/?tls-psk-file=keys.psk&socket="' # UNIX_SOCKET appended \
++	$(NULL)
++connect_uri_nbds_unix_psk_LDADD = $(top_builddir)/lib/libnbd.la
++
+ endif HAVE_PSKTOOL
+ 
+ endif HAVE_GNUTLS
+-- 
+2.43.0
+

SOURCES/0012-tests-make-pki.sh-Use-Subject-Alternative-Name-for-s.patch

@@ -0,0 +1,33 @@
+From 10ca0d72932092b09475893de233f17d3eff8a72 Mon Sep 17 00:00:00 2001
+From: "Richard W.M. Jones" <rjones@redhat.com>
+Date: Thu, 4 Aug 2022 13:28:25 +0100
+Subject: [PATCH] tests/make-pki.sh: Use Subject Alternative Name for server
+ certificate
+
+This allows us to test this feature.
+
+(cherry picked from nbdkit commit 0c50bef16f9d6705add8db85c7ea7b4523770fba)
+
+(cherry picked from commit 38eabf6df05fae109212a4ce9afc9c0fe63c2f0e)
+(cherry picked from commit b07898e1ee70b0641ec5233d6e8f7fa16b63c287)
+---
+ tests/make-pki.sh | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/tests/make-pki.sh b/tests/make-pki.sh
+index d4f61204..03f4faa1 100755
+--- a/tests/make-pki.sh
++++ b/tests/make-pki.sh
+@@ -75,6 +75,9 @@ chmod 0600 $1/server-key.pem
+ cat > $1/server.info <<EOF
+ organization = Test
+ cn = localhost
++dns_name = localhost
++ip_address = 127.0.0.1
++ip_address = ::1
+ tls_www_server
+ encryption_key
+ signing_key
+-- 
+2.43.0
+

SOURCES/0013-lib-crypto.c-Check-server-certificate-even-when-usin.patch

@@ -1,4 +1,4 @@
-From d8ec4c8ecc5244ed192f58bc3a976c4b2f9cc6d7 Mon Sep 17 00:00:00 2001
+From dab43717f183cf96fcda6a0be22c39801dcfda83 Mon Sep 17 00:00:00 2001
 From: "Richard W.M. Jones" <rjones@redhat.com>
 Date: Mon, 24 Jun 2024 10:48:12 +0100
 Subject: [PATCH] lib/crypto.c: Check server certificate even when using system
@@ -23,16 +23,16 @@ nbdinfo: nbd_connect_uri: gnutls_handshake: Error in the certificate verificatio
 Reported-by: Jon Szymaniak <jon.szymaniak@gmail.com>
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit 87ef41b69929d5d293390ec36b1c10aba2c9a57a)
-(cherry picked from commit 7a6739aeca8250515a449bacd23d09bf40587dec)
+(cherry picked from commit 81bd57bb8ab0b142207efb9f69a233418fbb4f8f)
 ---
  lib/crypto.c | 6 +++---
  1 file changed, 3 insertions(+), 3 deletions(-)
 
 diff --git a/lib/crypto.c b/lib/crypto.c
-index d131f1d0..c542ce6b 100644
+index 705e114a..4c398b03 100644
 --- a/lib/crypto.c
 +++ b/lib/crypto.c
-@@ -530,9 +530,6 @@ set_up_certificate_credentials (struct nbd_handle *h,
+@@ -513,9 +513,6 @@ set_up_certificate_credentials (struct nbd_handle *h,
    return NULL;
  
   found_certificates:
@@ -42,7 +42,7 @@ index d131f1d0..c542ce6b 100644
    err = gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, ret);
    if (err < 0) {
      set_error (0, "gnutls_credentials_set: %s", gnutls_strerror (err));
-@@ -647,6 +644,9 @@ nbd_internal_crypto_create_session (struct nbd_handle *h,
+@@ -625,6 +622,9 @@ nbd_internal_crypto_create_session (struct nbd_handle *h,
        gnutls_deinit (session);
        return NULL;
      }

SOURCES/0014-lib-crypto.c-Allow-CA-verification-even-if-h-hostnam.patch

@@ -1,4 +1,4 @@
-From af09b72a486fd870ab72170a0cba4b1d6d37894f Mon Sep 17 00:00:00 2001
+From 17dc75c8235af7126b3820d5e0be3488efe74671 Mon Sep 17 00:00:00 2001
 From: "Richard W.M. Jones" <rjones@redhat.com>
 Date: Mon, 24 Jun 2024 10:31:10 +0100
 Subject: [PATCH] lib/crypto.c: Allow CA verification even if h->hostname is
@@ -53,16 +53,16 @@ which is signed by the CA from the nbdkit/tests/pki directory)
 
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit 6ed47a27d14f6f11946bb096d94e5bf21d97083d)
-(cherry picked from commit 3a427e6d7a83f89299ab6fdaeeffbd9074610ecc)
+(cherry picked from commit 42ee6d8dd919b241b1f1510f5759673b26fc9731)
 ---
  lib/crypto.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/lib/crypto.c b/lib/crypto.c
-index c542ce6b..437e24ec 100644
+index 4c398b03..a5177bbb 100644
 --- a/lib/crypto.c
 +++ b/lib/crypto.c
-@@ -645,7 +645,7 @@ nbd_internal_crypto_create_session (struct nbd_handle *h,
+@@ -623,7 +623,7 @@ nbd_internal_crypto_create_session (struct nbd_handle *h,
        return NULL;
      }
  

SOURCES/0015-lib-uri.c-Allow-tls-verify-peer-to-be-overridden-in-.patch

@@ -1,4 +1,4 @@
-From a2541de206b3560fdfadf5dfada2cac1b69c09a1 Mon Sep 17 00:00:00 2001
+From 1f82b6d2d894bf567926f4ae52f4362654db8f38 Mon Sep 17 00:00:00 2001
 From: "Richard W.M. Jones" <rjones@redhat.com>
 Date: Tue, 25 Jun 2024 11:12:56 +0100
 Subject: [PATCH] lib/uri.c: Allow tls-verify-peer to be overridden in URIs
@@ -12,17 +12,18 @@ Since some clients might be depending on this, allow
 
 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
 (cherry picked from commit 75641c6b30155abce272f60cf3518a65654aa401)
-(cherry picked from commit b12466821fc534fb68d5b8e695832ee03496e0af)
+(cherry picked from commit caad9cfb5dda0957c4b15cc85738a4c6ac856e8b)
+(cherry picked from commit 4bfc3176de535350f884732b8793574e37714d2a)
 ---
  generator/API.ml |  5 +++++
  lib/uri.c        | 32 ++++++++++++++++++++++++++++++++
  2 files changed, 37 insertions(+)
 
 diff --git a/generator/API.ml b/generator/API.ml
-index c4547615..f2752f25 100644
+index 4b2a62e8..69ee428d 100644
 --- a/generator/API.ml
 +++ b/generator/API.ml
-@@ -1994,6 +1994,11 @@ Note this is not allowed by default - see next section.
+@@ -1306,6 +1306,11 @@ Note this is not allowed by default - see next section.
  Set the PSK file.  See L<nbd_set_tls_psk_file(3)>.  Note
  this is not allowed by default - see next section.
  
@@ -35,10 +36,10 @@ index c4547615..f2752f25 100644
  
  =head2 Disable URI features
 diff --git a/lib/uri.c b/lib/uri.c
-index 0c8e87cf..969e88be 100644
+index c8d9041e..8dfefd00 100644
 --- a/lib/uri.c
 +++ b/lib/uri.c
-@@ -150,6 +150,31 @@ parse_uri_queries (const char *query_raw, uri_query_list *list)
+@@ -140,6 +140,31 @@ error:
    return -1;
  }
  
@@ -70,7 +71,7 @@ index 0c8e87cf..969e88be 100644
  int
  nbd_unlocked_aio_connect_uri (struct nbd_handle *h, const char *raw_uri)
  {
-@@ -298,6 +323,13 @@ nbd_unlocked_aio_connect_uri (struct nbd_handle *h, const char *raw_uri)
+@@ -271,6 +296,13 @@ nbd_unlocked_aio_connect_uri (struct nbd_handle *h, const char *raw_uri)
        if (nbd_unlocked_set_tls_psk_file (h, queries.ptr[i].value) == -1)
          goto cleanup;
      }

SOURCES/0016-docs-security-Add-link-to-TLS-server-certificate-che.patch

@@ -1,22 +1,23 @@
-From dfa2a23c7638e325694101fe81b5330ceede68f9 Mon Sep 17 00:00:00 2001
+From 437d3aedd5ecbcb8d5234665015c5813a6ca1712 Mon Sep 17 00:00:00 2001
 From: "Richard W.M. Jones" <rjones@redhat.com>
 Date: Tue, 25 Jun 2024 17:53:47 +0100
 Subject: [PATCH] docs: security: Add link to TLS server certificate checking
  announcement
 
 (cherry picked from commit 9c723aa660c6ee7d224afbfc16eb7450d21fb9cf)
-(cherry picked from commit 820f45a58fda50dc7d5e126c55403e33824cffe4)
+(cherry picked from commit 9b77d853d82c291f74b51305d58e9db7f555a254)
+(cherry picked from commit b477be4ed47daa6ba73c176ae8b0288ec8e84f23)
 ---
  docs/libnbd-security.pod | 5 +++++
  1 file changed, 5 insertions(+)
 
 diff --git a/docs/libnbd-security.pod b/docs/libnbd-security.pod
-index 216efa43..c9960d8c 100644
+index 0cae8462..b31f3f8b 100644
 --- a/docs/libnbd-security.pod
 +++ b/docs/libnbd-security.pod
-@@ -45,6 +45,11 @@ negative size result from nbd_get_size(3)
+@@ -28,6 +28,11 @@ denial of service when using L<nbd_set_opt_mode(3)>
  See the full announcement here:
- L<https://listman.redhat.com/archives/libguestfs/2023-September/032711.html>
+ L<https://listman.redhat.com/archives/libguestfs/2021-March/msg00092.html>
  
 +=head2 multiple flaws in TLS server certificate checking
 +

SOURCES/0017-docs-libnbd-security.pod-Assign-CVE-2024-7383.patch

@@ -1,4 +1,4 @@
-From 8334404ee0883dcfa90697b6fdae541ed4751b79 Mon Sep 17 00:00:00 2001
+From 626331d88fdf8ed87dc066faeb836fc5926f5420 Mon Sep 17 00:00:00 2001
 From: "Richard W.M. Jones" <rjones@redhat.com>
 Date: Thu, 1 Aug 2024 15:17:29 +0100
 Subject: [PATCH] docs/libnbd-security.pod: Assign CVE-2024-7383
@@ -9,17 +9,19 @@ found in libnbd certificate checking.
 Reported-by: Jon Szymaniak
 Thanks: Mauro Matteo Cascella
 (cherry picked from commit 81a22ac6697ccdeb13509aba3072609251d1378b)
+(cherry picked from commit 599281af594db8414d856db409846b04fce03824)
+(cherry picked from commit 8f7dce2b6d6716f9eec0f352a3c420ae84a84be9)
 ---
  docs/libnbd-security.pod | 3 ++-
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/docs/libnbd-security.pod b/docs/libnbd-security.pod
-index c9960d8c..ece0cf5a 100644
+index b31f3f8b..4c3b5bbd 100644
 --- a/docs/libnbd-security.pod
 +++ b/docs/libnbd-security.pod
-@@ -45,7 +45,8 @@ negative size result from nbd_get_size(3)
+@@ -28,7 +28,8 @@ denial of service when using L<nbd_set_opt_mode(3)>
  See the full announcement here:
- L<https://listman.redhat.com/archives/libguestfs/2023-September/032711.html>
+ L<https://listman.redhat.com/archives/libguestfs/2021-March/msg00092.html>
  
 -=head2 multiple flaws in TLS server certificate checking
 +=head2 CVE-2024-7383

SOURCES/copy-patches.sh

@@ -6,7 +6,7 @@ set -e
 # directory.  Use it like this:
 #   ./copy-patches.sh
 
-rhel_version=9.4
+rhel_version=8.10
 
 # Check we're in the right directory.
 if [ ! -f libnbd.spec ]; then

SOURCES/libnbd-1.18.1.tar.gz.sig

@@ -1,17 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQJFBAABCAAvFiEE93dPsa0HSn6Mh2fqkXOPc+G3aKAFAmU2izoRHHJpY2hAYW5u
-ZXhpYS5vcmcACgkQkXOPc+G3aKA+txAAkLeWdvH2ryibEyqMeyejvh9vMgQO5I46
-LaygI8jDi+XG+rGy7imiwIxxWvyCZI3y2U5MFudLZoFi+gCyVAC+LeBxjF41NBGz
-fbgwFaQHrCbxyLlsj9OcR6M0+EPU8NXXPPGgXZNcnf7tHNZkTO0OGS9chml0wXHA
-Zx9WheHl6wbLTVIAtLWOJqzRQj80RlcPC+De1wZL+WFMPMkfF8L8K5FRNsfeTIXn
-l31d1R0g5QOMTTqBiKE2iopPmVmA5uC/adWCuqF3mzzjzCkHp+Ux/Ys99tkCETrU
-jUuHgJ+1pYjn4Lmt/HUwXQZD3L+RkNAWWQziY/3ejK31tGxZqR/XTwq5RPrc6Qs1
-/zuoWvSWJZZo9yvX1Iq2RQAaZF5724V/svm+HgaCakaK8EJEj6sntM0OhAl2pRC4
-G45Kb2o7k016WgL8plNOlrbHNxaruBcPrkFYDMoyy3KLnWaw3OYMARTD5w/Pd4dC
-CJa3tIXIKedhXw9xDtEWfxiKIHfO+LBHBMjpW9KzP/oxE2akmcJZJT+JNpsrpdzV
-O6mbVDPedWd5LQQ1bNmwzxkCsMEC9HFhVbCaTuYuSXe/By04Norns4xyEJyDXlG/
-QqFgEUS8R+V9xwYHoAPg5RUmycXubSmm64iTAQNqc46QsxeP0Va7gpbrPLe5qVk/
-irUsxdBhGIM=
-=pgmp
------END PGP SIGNATURE-----

SOURCES/libnbd-1.6.0.tar.gz.sig

@@ -0,0 +1,17 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQJFBAABCAAvFiEE93dPsa0HSn6Mh2fqkXOPc+G3aKAFAl/3RFQRHHJpY2hAYW5u
+ZXhpYS5vcmcACgkQkXOPc+G3aKD9aw/+Pfg3owjJmhTcCyFvuH2lgiiBb+qL2An+
+hsoax6dM5JxzV6x1Ikgn3C8z2+dLRMowo2FrRgpzTwfaS+ngLDipSC04hKl9MhFN
+7OPLCm+L7wcP7KUk4cC0qTSHpHkApo2SP3/bD7vVBYZMYSjgUVFcRoqZlRl3N9RF
+7XNsxA2YG9bV4Ln3KbB+k2uxIKNUZIVjmEpretVbb+NTKW9C23ZHicSHYB+Eok1M
+iTN6j66rYFn0Xb+L2v7jty19tSdYOMbkdSn0KpniURAWevjjVWGqcojMqW4YuAZ5
+h2MpRfyKFyusbsbtX5bjICTu6+AgFFUALKH7ReDs1RY1cEph9XdBLVulXTggxY05
+E3I1Nns1YmjRlV6ky2Abl2e+Doc44mycINRlwL2q8+Q3TqlVVPFXoVTWxIJ6/Uae
+tqnEwWIa2wGv3KU1KLNbWTn1z6I8NM/Nj+7pMKDNnxJzFmHEjL94tmG+iNmHsF34
+vWBZ1q7h9EezxHLOPFYDjlpS+IxeuXakbpuTX2jXvi3zSAbr5WmRR1uO8dAiwu9b
+RwOHRmVQOFLAAICYTZDmxl42DpWs5Z2aP7eRwpe8/MOSRiAVepjhUD/bsdaFwmBR
+8Z7CGNzyTtt+sy5l7cPBYZ+4RdxWgFEBceBbHs06zdlD/Pui288UQVB/0e9AXYOc
+wluyWT1v7sA=
+=BaN1
+-----END PGP SIGNATURE-----

SPECS/libnbd.spec

@@ -5,15 +5,15 @@
 %global patches_touch_autotools 1
 
 # The source directory.
-%global source_directory 1.18-stable
+%global source_directory 1.6-stable
 
 Name:           libnbd
-Version:        1.18.1
+Version:        1.6.0
-Release:        4%{?dist}
+Release:        6%{?dist}
 Summary:        NBD client library in userspace
 
-License:        LGPL-2.0-or-later AND BSD-3-Clause
+License:        LGPLv2+
-URL:            https://gitlab.com/nbdkit/libnbd
+URL:            https://github.com/libguestfs/libnbd
 
 Source0:        http://libguestfs.org/download/libnbd/%{source_directory}/%{name}-%{version}.tar.gz
 Source1:        http://libguestfs.org/download/libnbd/%{source_directory}/%{name}-%{version}.tar.gz.sig
@@ -25,22 +25,27 @@ Source2:       libguestfs.keyring
 # Maintainer script which helps with handling patches.
 Source3:        copy-patches.sh
 
-# Patches are stored in the upstream repository:
+# Patches come from this upstream branch:
-# https://gitlab.com/nbdkit/libnbd/-/commits/rhel-9.4/
+# https://github.com/libguestfs/libnbd/tree/rhel-8.10
 
 # Patches.
-Patch0001:     0001-generator-Fix-assertion-in-ext-mode-BLOCK_STATUS-CVE.patch
+Patch0001:     0001-copy-copy-nbd-to-sparse-file.sh-Skip-test-unless-nbd.patch
-Patch0002:     0002-docs-Fix-incorrect-xref-in-libnbd-release-notes-for-.patch
+Patch0002:     0002-generator-Refactor-CONNECT.START-state.patch
-Patch0003:     0003-tests-Check-behavior-of-nbd_set_strict_mode-STRICT_A.patch
+Patch0003:     0003-generator-Print-a-better-error-message-if-connect-2-.patch
-Patch0004:     0004-build-Move-to-minimum-gnutls-3.5.18.patch
+Patch0004:     0004-opt_go-Tolerate-unplanned-server-death.patch
-Patch0005:     0005-lib-crypto.c-Check-server-certificate-even-when-usin.patch
+Patch0005:     0005-security-Document-assignment-of-CVE-2021-20286.patch
-Patch0006:     0006-lib-crypto.c-Allow-CA-verification-even-if-h-hostnam.patch
+Patch0006:     0006-copy-Pass-in-dummy-variable-rather-than-errno-to-cal.patch
-Patch0007:     0007-interop-Pass-DCERTS-and-DPSK-as-strings.patch
+Patch0007:     0007-copy-CVE-2022-0485-Fail-nbdcopy-if-NBD-read-or-write.patch
-Patch0008:     0008-interop-Add-DEXPECT_FAIL-1-where-we-expect-the-test-.patch
+Patch0008:     0008-build-Move-to-minimum-gnutls-3.5.18.patch
-Patch0009:     0009-interop-Test-interop-with-a-bad-system-CA.patch
+Patch0009:     0009-tests-Factor-out-some-common-Makefile-flags.patch
-Patch0010:     0010-lib-uri.c-Allow-tls-verify-peer-to-be-overridden-in-.patch
+Patch0010:     0010-tests-connect-uri.c-Ensure-Unix-domain-socket-is-cle.patch
-Patch0011:     0011-docs-security-Add-link-to-TLS-server-certificate-che.patch
+Patch0011:     0011-lib-Allow-tls-certificates-DIR-query-parameter-in-UR.patch
-Patch0012:     0012-docs-libnbd-security.pod-Assign-CVE-2024-7383.patch
+Patch0012:     0012-tests-make-pki.sh-Use-Subject-Alternative-Name-for-s.patch
+Patch0013:     0013-lib-crypto.c-Check-server-certificate-even-when-usin.patch
+Patch0014:     0014-lib-crypto.c-Allow-CA-verification-even-if-h-hostnam.patch
+Patch0015:     0015-lib-uri.c-Allow-tls-verify-peer-to-be-overridden-in-.patch
+Patch0016:     0016-docs-security-Add-link-to-TLS-server-certificate-che.patch
+Patch0017:     0017-docs-libnbd-security.pod-Assign-CVE-2024-7383.patch
 
 %if 0%{patches_touch_autotools}
 BuildRequires: autoconf, automake, libtool
@@ -52,29 +57,20 @@ BuildRequires:  gnupg2
 
 # For the core library.
 BuildRequires:  gcc
-BuildRequires:  make
 BuildRequires:  /usr/bin/pod2man
 BuildRequires:  gnutls-devel
 BuildRequires:  libxml2-devel
 
 # For nbdfuse.
-BuildRequires:  fuse3, fuse3-devel
+BuildRequires:  fuse, fuse-devel
-
-%if !0%{?rhel}
-# For nbdublk
-BuildRequires:  liburing-devel >= 2.2
-BuildRequires:  ubdsrv-devel >= 1.0-3.rc6
-%endif
 
 # For the Python 3 bindings.
 BuildRequires:  python3-devel
 
-%ifnarch %{ix86}
 # For the OCaml bindings.
 BuildRequires:  ocaml
 BuildRequires:  ocaml-findlib-devel
 BuildRequires:  ocaml-ocamldoc
-%endif
 
 # Only for building the examples.
 BuildRequires:  glib2-devel
@@ -86,33 +82,20 @@ BuildRequires:  bash-completion
 BuildRequires:  coreutils
 BuildRequires:  gcc-c++
 BuildRequires:  gnutls-utils
-BuildRequires:  iproute
+#BuildRequires:  jq
-BuildRequires:  jq
-%if !0%{?rhel}
-BuildRequires:  nbd
-%endif
-BuildRequires:  util-linux
-
-# On RHEL, maybe even in Fedora in future, we do not build qemu-img or
-# nbdkit for i686.  These are only needed for the test suite so make
-# them optional.  This reduces our test exposure on 32 bit platforms,
-# although there is still Fedora/armv7 and some upstream testing.
 %ifnarch %{ix86}
-BuildRequires:  qemu-img
 BuildRequires:  nbdkit
 BuildRequires:  nbdkit-data-plugin
-BuildRequires:  nbdkit-eval-plugin
+#BuildRequires:  nbdkit-eval-plugin
 BuildRequires:  nbdkit-memory-plugin
 BuildRequires:  nbdkit-null-plugin
 BuildRequires:  nbdkit-pattern-plugin
 BuildRequires:  nbdkit-sh-plugin
-BuildRequires:  nbdkit-sparse-random-plugin
+#BuildRequires:  nbdkit-sparse-random-plugin
-%endif
+#BuildRequires:  nbd
-
+BuildRequires:  qemu-img
-%ifnarch %{ix86}
-# The OCaml runtime system does not provide this symbol
-%global __ocaml_requires_opts -x Stdlib__Callback
 %endif
+BuildRequires:  util-linux
 
 
 %description
@@ -138,6 +121,7 @@ The key features are:
 
 %package devel
 Summary:        Development headers for %{name}
+License:        LGPLv2+ and BSD
 Requires:       %{name}%{?_isa} = %{version}-%{release}
 
 
@@ -145,7 +129,6 @@ Requires:       %{name}%{?_isa} = %{version}-%{release}
 This package contains development headers for %{name}.
 
 
-%ifnarch %{ix86}
 %package -n ocaml-%{name}
 Summary:        OCaml language bindings for %{name}
 Requires:       %{name}%{?_isa} = %{version}-%{release}
@@ -164,7 +147,6 @@ Requires:       ocaml-%{name}%{?_isa} = %{version}-%{release}
 This package contains OCaml language development package for
 %{name}.  Install this if you want to compile OCaml software which
 uses %{name}.
-%endif
 
 
 %package -n python3-%{name}
@@ -183,28 +165,14 @@ python3-%{name} contains Python 3 bindings for %{name}.
 
 %package -n nbdfuse
 Summary:        FUSE support for %{name}
+License:        LGPLv2+ and BSD
 Requires:       %{name}%{?_isa} = %{version}-%{release}
-Recommends:     fuse3
 
 
 %description -n nbdfuse
 This package contains FUSE support for %{name}.
 
 
-%if !0%{?rhel}
-%package -n nbdublk
-Summary:        Userspace NBD block device
-Requires:       %{name}%{?_isa} = %{version}-%{release}
-Recommends:     kernel >= 6.0.0
-Recommends:     %{_sbindir}/ublk
-
-
-%description -n nbdublk
-This package contains a userspace NBD block device
-based on %{name}.
-%endif
-
-
 %package bash-completion
 Summary:       Bash tab-completion for %{name}
 BuildArch:     noarch
@@ -221,7 +189,8 @@ for %{name}.
 
 %prep
 %if 0%{verify_tarball_signature}
-%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
+tmphome="$(mktemp -d)"
+gpgv2 --homedir "$tmphome" --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0}
 %endif
 %autosetup -p1
 %if 0%{patches_touch_autotools}
@@ -235,14 +204,9 @@ autoreconf -i
     --with-tls-priority=@LIBNBD,SYSTEM \
     PYTHON=%{__python3} \
     --enable-python \
-%ifnarch %{ix86}
     --enable-ocaml \
-%else
-    --disable-ocaml \
-%endif
     --enable-fuse \
-    --disable-golang \
+    --disable-golang
-    --disable-rust
 
 make %{?_smp_mflags}
 
@@ -256,48 +220,30 @@ find $RPM_BUILD_ROOT -name '*.la' -delete
 # Delete the golang man page since we're not distributing the bindings.
 rm $RPM_BUILD_ROOT%{_mandir}/man3/libnbd-golang.3*
 
-%ifarch %{ix86}
-# Delete the OCaml man page on i686.
-rm $RPM_BUILD_ROOT%{_mandir}/man3/libnbd-ocaml.3*
-%endif
-
-%if 0%{?rhel}
-# Delete nbdublk on RHEL.
-rm $RPM_BUILD_ROOT%{_datadir}/bash-completion/completions/nbdublk
-%endif
-
 
 %check
-function skip_test ()
-{
-    for f in "$@"; do
-        rm -f "$f"
-        echo 'exit 77' > "$f"
-        chmod +x "$f"
-    done
-}
-
 # interop/structured-read.sh fails with the old qemu-nbd in Fedora 29,
 # so disable it there.
 %if 0%{?fedora} <= 29
-skip_test interop/structured-read.sh
+rm interop/structured-read.sh
-%endif
+touch interop/structured-read.sh
-
+chmod +x interop/structured-read.sh
-# interop/interop-qemu-storage-daemon.sh fails in RHEL 9 because of
-# this bug in qemu:
-# https://lists.nongnu.org/archive/html/qemu-devel/2021-03/threads.html#03544
-%if 0%{?rhel}
-skip_test interop/interop-qemu-storage-daemon.sh
 %endif
 
 # All fuse tests fail in Koji with:
 # fusermount: entry for fuse/test-*.d not found in /etc/mtab
 # for unknown reasons but probably related to the Koji environment.
-skip_test fuse/test-*.sh
+for f in fuse/test-*.sh; do
-
+    rm $f
-# IPv6 loopback connections fail in Koji.
+    touch $f
-make -C tests connect-tcp6 ||:
+    chmod +x $f
-skip_test tests/connect-tcp6
+done
+
+# info/info-map-base-allocation-json.sh fails because of a bug in
+# jq 1.5 in RHEL 8 (fixed in later versions).
+rm info/info-map-base-allocation-json.sh
+touch info/info-map-base-allocation-json.sh
+chmod +x info/info-map-base-allocation-json.sh
 
 make %{?_smp_mflags} check || {
     for f in $(find -name test-suite.log); do
@@ -310,14 +256,12 @@ make %{?_smp_mflags} check || {
 
 
 %files
-%doc README.md
+%doc README
 %license COPYING.LIB
 %{_bindir}/nbdcopy
-%{_bindir}/nbddump
 %{_bindir}/nbdinfo
 %{_libdir}/libnbd.so.*
 %{_mandir}/man1/nbdcopy.1*
-%{_mandir}/man1/nbddump.1*
 %{_mandir}/man1/nbdinfo.1*
 
 
@@ -333,12 +277,12 @@ make %{?_smp_mflags} check || {
 %{_mandir}/man3/nbd_*.3*
 
 
-%ifnarch %{ix86}
 %files -n ocaml-%{name}
-%dir %{_libdir}/ocaml/nbd
+%{_libdir}/ocaml/nbd
-%{_libdir}/ocaml/nbd/META
+%exclude %{_libdir}/ocaml/nbd/*.a
-%{_libdir}/ocaml/nbd/*.cma
+%exclude %{_libdir}/ocaml/nbd/*.cmxa
-%{_libdir}/ocaml/nbd/*.cmi
+%exclude %{_libdir}/ocaml/nbd/*.cmx
+%exclude %{_libdir}/ocaml/nbd/*.mli
 %{_libdir}/ocaml/stublibs/dllmlnbd.so
 %{_libdir}/ocaml/stublibs/dllmlnbd.so.owner
 
@@ -346,16 +290,13 @@ make %{?_smp_mflags} check || {
 %files -n ocaml-%{name}-devel
 %doc ocaml/examples/*.ml
 %license ocaml/examples/LICENSE-FOR-EXAMPLES
-%ifarch %{ocaml_native_compiler}
+%{_libdir}/ocaml/nbd/*.a
 %{_libdir}/ocaml/nbd/*.cmxa
 %{_libdir}/ocaml/nbd/*.cmx
-%endif
-%{_libdir}/ocaml/nbd/*.a
 %{_libdir}/ocaml/nbd/*.mli
 %{_mandir}/man3/libnbd-ocaml.3*
 %{_mandir}/man3/NBD.3*
 %{_mandir}/man3/NBD.*.3*
-%endif
 
 
 %files -n python3-%{name}
@@ -372,325 +313,57 @@ make %{?_smp_mflags} check || {
 %{_mandir}/man1/nbdfuse.1*
 
 
-%if !0%{?rhel}
-%files -n nbdublk
-%{_bindir}/nbdublk
-%{_mandir}/man1/nbdublk.1*
-%endif
-
-
 %files bash-completion
 %dir %{_datadir}/bash-completion/completions
 %{_datadir}/bash-completion/completions/nbdcopy
-%{_datadir}/bash-completion/completions/nbddump
 %{_datadir}/bash-completion/completions/nbdfuse
 %{_datadir}/bash-completion/completions/nbdinfo
 %{_datadir}/bash-completion/completions/nbdsh
-%if !0%{?rhel}
-%{_datadir}/bash-completion/completions/nbdublk
-%endif
 
 
 %changelog
-* Tue Aug 27 2024 Richard W.M. Jones <rjones@redhat.com> - 1.18.1-4
+* Tue Aug 27 2024 Richard W.M. Jones <rjones@redhat.com> - 1.6.0-6.el8
 - Fix CVE-2024-7383 NBD server improper certificate validation
-  resolves: RHEL-52730
+  resolves: RHEL-52728
-
-* Mon Nov 13 2023 Eric Blake <eblake@redhat.com> - 1.18.1-3
-- Backport unit test of recent libnbd API addition
-  resolves: RHEL-16292
-
-* Wed Nov 01 2023 Richard W.M. Jones <rjones@redhat.com> - 1.18.1-2
-- Fix assertion in ext-mode BLOCK_STATUS (CVE-2023-5871)
-  resolves: RHEL-15143
-
-* Tue Oct 24 2023 Richard W.M. Jones <rjones@redhat.com> - 1.18.1-1
-- Rebase to 1.18.1
-  resolves: RHEL-14476
-
-* Tue Apr 18 2023 Richard W.M. Jones <rjones@redhat.com> - 1.16.0-1
-- Rebase to 1.16.0
-  resolves: rhbz#2168628
-
-* Tue Jan 03 2023 Richard W.M. Jones <rjones@redhat.com> - 1.14.2-1
-- Rebase to new stable branch version 1.14.2
-  resolves: rhbz#2135764
-
-* Thu Jul 28 2022 Richard W.M. Jones <rjones@redhat.com> - 1.12.6-1
-- Rebase to new stable branch version 1.12.6
-  resolves: rhbz#2059288
-- New tool: nbddump
-- nbdcopy: Use preferred block size for copying
-  related: rhbz#2047660
-- Fix remote TLS failures
-  resolves: rhbz#2111524
-  (and 2111813)
-
-* Thu Feb 10 2022 Richard W.M. Jones <rjones@redhat.com> - 1.10.5-1
-- Rebase to new stable branch version 1.10.5
-  resolves: rhbz#2011708
-- Map uint32_t to OCaml int64 to avoid signedness problems
-  resolves: rhbz#2040610
-- CVE-2022-0485 nbdcopy destination image corruption
-- New upstream API to control initialization of pread buffer
-  resolves: rhbz#2046194
-
-* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 1.8.2-3
-- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
-  Related: rhbz#1991688
-
-* Fri Jul 30 2021 Richard W.M. Jones <rjones@redhat.com> - 1.8.2-2
-- Fix nbdcopy progress bar.
-- Add nbdinfo --map --totals and --can/--is options.
-  resolves: rhbz#1950630
-
-* Sat Jul 03 2021 Richard W.M. Jones <rjones@redhat.com> - 1.8.2-1
-- New upstream stable version 1.8.2.
-
-* Wed Jun 23 2021 Richard W.M. Jones <rjones@redhat.com> - 1.8.1-2
-- Bump and rebuild
-  resolves: rhbz#1975316
-
-* Fri Jun 11 2021 Richard W.M. Jones <rjones@redhat.com> - 1.8.1-1
-- New upstream stable version 1.8.1.
-
-* Mon Jun 07 2021 Richard W.M. Jones <rjones@redhat.com> - 1.8.0-1
-- New upstream version 1.8.0.
-
-* Fri Jun 04 2021 Python Maint <python-maint@redhat.com> - 1.7.12-2
-- Rebuilt for Python 3.10
-
-* Sat May 29 2021 Richard W.M. Jones <rjones@redhat.com> - 1.7.12-1
-- New upstream version 1.7.12.
-
-* Thu May 20 2021 Richard W.M. Jones <rjones@redhat.com> - 1.7.11-1
-- New upstream version 1.7.11.
-
-* Fri May 14 2021 Richard W.M. Jones <rjones@redhat.com> - 1.7.10-1
-- New upstream version 1.7.10.
 
-* Thu Apr 29 2021 Richard W.M. Jones <rjones@redhat.com> - 1.7.9-1
+* Mon Feb  7 2022 Richard W.M. Jones <rjones@redhat.com> - 1.6.0-5.el8
-- New upstream version 1.7.9.
+- Fix CVE-2022-0485: Fail nbdcopy if NBD read or write fails
-- Switch to fuse3.
+  resolves: rhbz#2045718
-- Make nbdfuse package recommend fuse3 (to get fusermount3).
 
-* Sat Apr 24 2021 Richard W.M. Jones <rjones@redhat.com> - 1.7.8-1
+* Thu Sep 2 2021 Danilo C. L. de Paula <ddepaula@redhat.com> - 1.6.0-4.el8
-- New upstream development version 1.7.8.
+- Resolves: bz#2000225
+  (Rebase virt:rhel module:stream based on AV-8.6)
 
-* Sat Apr 10 2021 Richard W.M. Jones <rjones@redhat.com> - 1.7.7-1
+* Mon Jul 13 2020 Danilo C. L. de Paula <ddepaula@redhat.com> - 1.2.2
-- New upstream development version 1.7.7.
+- Resolves: bz#1844296
-- +BR iproute
+(Upgrade components in virt:rhel module:stream for RHEL-8.3 release)
-- Add skip_test helper function.
-- Skip connect-tcp6 test which fails under Koji.
 
-* Thu Apr 08 2021 Richard W.M. Jones <rjones@redhat.com> - 1.7.6-1
+* Wed Feb  5 2020 Richard W.M. Jones <rjones@redhat.com> - 1.2.2-1
-- New upstream development version 1.7.6.
+- New stable release 1.2.2.
 
-* Sat Apr 03 2021 Richard W.M. Jones <rjones@redhat.com> - 1.7.5-1
+* Tue Dec  3 2019 Richard W.M. Jones <rjones@redhat.com> - 1.2.1-1
-- New upstream development version 1.7.5.
+- New stable release 1.2.1.
-
-* Mon Mar 15 2021 Richard W.M. Jones <rjones@redhat.com> - 1.7.4-1
-- New upstream development version 1.7.4.
-
-* Mon Mar 15 2021 Richard W.M. Jones <rjones@redhat.com> - 1.7.3-3
-- Update documentation for CVE-2021-20286.
-- Workaround broken interop/interop-qemu-storage-daemon.sh test in RHEL 9.
-
-* Thu Mar  4 2021 Richard W.M. Jones <rjones@redhat.com> - 1.7.3-2
-- Add fix for nbdkit test suite.
-
-* Tue Mar  2 2021 Richard W.M. Jones <rjones@redhat.com> - 1.7.3-1
-- New upstream version 1.7.3.
-
-* Mon Mar  1 2021 Richard W.M. Jones <rjones@redhat.com> - 1.7.2-3
-- OCaml 4.12.0 build
-
-* Wed Feb 24 2021 Richard W.M. Jones <rjones@redhat.com> - 1.7.2-2
-- Disable nbd BR on RHEL.
-
-* Mon Feb 22 2021 Richard W.M. Jones <rjones@redhat.com> - 1.7.2-1
-- New upstream version 1.7.2.
-
-* Fri Jan 29 2021 Richard W.M. Jones <rjones@redhat.com> - 1.7.1-6
-- Disable BR qemu-img on i686.
-
-* Thu Jan 28 2021 Richard W.M. Jones <rjones@redhat.com> - 1.7.1-3
-- Disable BR nbdkit on i686 because it breaks ELN/RHEL 9.
-
-* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.7.1-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
-
-* Wed Jan 20 2021 Richard W.M. Jones <rjones@redhat.com> - 1.7.1-1
-- New upstream development version 1.7.1.
-
-* Thu Jan 07 2021 Richard W.M. Jones <rjones@redhat.com> - 1.6.0-1
-- New upstream stable version 1.6.0.
-
-* Tue Dec 08 2020 Richard W.M. Jones <rjones@redhat.com> - 1.5.9-1
-- New upstream development version 1.5.9.
-
-* Thu Dec 03 2020 Richard W.M. Jones <rjones@redhat.com> - 1.5.8-1
-- New upstream development version 1.5.8.
-- Unify Fedora and RHEL spec files.
-
-* Wed Nov 25 2020 Richard W.M. Jones <rjones@redhat.com> - 1.5.7-1
-- New upstream development version 1.5.7.
-- Add some more test suite buildrequires lines.
-- Fix bogus date in changelog.
-
-* Thu Nov 12 2020 Richard W.M. Jones <rjones@redhat.com> - 1.5.6-1
-- New upstream development version 1.5.6.
-
-* Mon Nov 02 2020 Richard W.M. Jones <rjones@redhat.com> - 1.5.5-1
-- New upstream development version 1.5.5.
-
-* Mon Oct 05 2020 Richard W.M. Jones <rjones@redhat.com> - 1.5.4-1
-- New upstream development version 1.5.4.
-- More OCaml man pages.
-
-* Sat Sep 26 2020 Richard W.M. Jones <rjones@redhat.com> - 1.5.3-1
-- New upstream development version 1.5.3.
-
-* Thu Sep 10 2020 Richard W.M. Jones <rjones@redhat.com> - 1.5.2-1
-- New upstream development version 1.5.2.
-
-* Tue Sep 08 2020 Richard W.M. Jones <rjones@redhat.com> - 1.5.1-1
-- New upstream development version 1.5.1.
-
-* Tue Sep 01 2020 Richard W.M. Jones <rjones@redhat.com> - 1.4.0-2
-- OCaml 4.11.1 rebuild
-
-* Tue Aug 25 2020 Richard W.M. Jones <rjones@redhat.com> - 1.4.0-1
-- New stable release 1.4.0.
-
-* Fri Aug 21 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.12-3
-- Bump release and rebuild.
-
-* Fri Aug 21 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.12-2
-- OCaml 4.11.0 rebuild
-
-* Thu Aug 20 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.12-1
-- New upstream version 1.3.12.
-
-* Thu Aug  6 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.11-1
-- New upstream version 1.3.11.
-
-* Tue Aug  4 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.10-1
-- New upstream version 1.3.10.
-
-* Wed Jul 29 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.9-3
-- Bump and rebuild.
-
-* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.3.9-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Tue Jul 21 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.9-1
-- New upstream version 1.3.9.
-- New tool: nbdinfo.
-
-* Fri Jul 17 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.8-2
-- New upstream version 1.3.8.
-- New tool: nbdcopy
-- Add upstream patch to fix compilation with glibc from Rawhide.
-
-* Tue May 26 2020 Miro Hrončok <mhroncok@redhat.com> - 1.3.7-3
-- Rebuilt for Python 3.9
-
-* Mon May 04 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.7-2
-- OCaml 4.11.0+dev2-2020-04-22 rebuild
-
-* Thu Apr 23 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.7-1
-- New upstream version 1.3.7.
-
-* Tue Apr 21 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.6-5
-- OCaml 4.11.0 pre-release attempt 2
-
-* Fri Apr 17 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.6-4
-- OCaml 4.11.0 pre-release
-- Add upstream patch to fix one of the tests that fails on slow machines.
-
-* Thu Apr 02 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.6-2
-- Update all OCaml dependencies for RPM 4.16.
-
-* Tue Mar 31 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.6-1
-- New upstream development version 1.3.6.
-- Golang bindings are contained in this release but not distributed.
-
-* Wed Mar 11 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.5-2
-- Fix bogus runtime Requires of new bash-completion package.
-
-* Tue Mar 10 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.5-1
-- New upstream development version 1.3.5.
-- Add new bash-completion subpackage.
-
-* Sat Feb 29 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.4-1
-- New upstream development version 1.3.4.
-
-* Wed Feb 26 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.3-2
-- OCaml 4.10.0 final.
-
-* Wed Feb 05 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.3-1
-- New upstream development version 1.3.3.
-
-* Thu Jan 30 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.2-1
-- New upstream development version 1.3.2.
-
-* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.3.1-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
-
-* Sun Jan 19 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.1-4
-- Bump release and rebuild.
-
-* Sun Jan 19 2020 Richard W.M. Jones <rjones@redhat.com> - 1.3.1-3
-- OCaml 4.10.0+beta1 rebuild.
-
-* Thu Dec 12 2019 Richard W.M. Jones <rjones@redhat.com> - 1.3.1-2
-- Rebuild for OCaml 4.09.0.
-
-* Tue Dec 03 2019 Richard W.M. Jones <rjones@redhat.com> - 1.3.1-1
-- New upstream development version 1.3.1.
-
-* Wed Nov 27 2019 Richard W.M. Jones <rjones@redhat.com> - 1.2.0-2
-- Use gpgverify macro instead of explicit gpgv2 command.
 
 * Thu Nov 14 2019 Richard W.M. Jones <rjones@redhat.com> - 1.2.0-1
-- New stable release 1.2.0
+- New stable release 1.2.0.
-
-* Sat Nov 09 2019 Richard W.M. Jones <rjones@redhat.com> - 1.1.9-1
-- New upstream version 1.1.9.
-- Add new nbdkit-release-notes-1.2(1) man page.
-
-* Wed Nov 06 2019 Richard W.M. Jones <rjones@redhat.com> - 1.1.8-1
-- New upstream version 1.1.8.
-
-* Thu Oct 24 2019 Richard W.M. Jones <rjones@redhat.com> - 1.1.7-1
-- New upstream version 1.1.7.
 
-* Sat Oct 19 2019 Richard W.M. Jones <rjones@redhat.com> - 1.1.6-1
+* Wed Oct  9 2019 Richard W.M. Jones <rjones@redhat.com> - 1.0.3-1
-- New upstream version 1.1.6.
+- New upstream version 1.0.3.
-
-* Sat Oct 12 2019 Richard W.M. Jones <rjones@redhat.com> - 1.1.5-1
-- New upstream version 1.1.5.
-- New tool and subpackage nbdfuse.
-
-* Wed Oct  9 2019 Richard W.M. Jones <rjones@redhat.com> - 1.1.4-1
-- New upstream version 1.1.4.
 - Contains fix for remote code execution vulnerability.
 - Add new libnbd-security(3) man page.
 
-* Tue Oct  1 2019 Richard W.M. Jones <rjones@redhat.com> - 1.1.3-1
+* Tue Sep 17 2019 Richard W.M. Jones <rjones@redhat.com> - 1.0.2-1
-- New upstream version 1.1.3.
+- New upstream version 1.0.2.
-
-* Tue Sep 17 2019 Richard W.M. Jones <rjones@redhat.com> - 1.1.2-1
-- New upstream version 1.1.2.
 - Remove patches which are upstream.
 - Contains fix for NBD Protocol Downgrade Attack (CVE-2019-14842).
+- Fix previous commit message.
 
-* Thu Sep 12 2019 Richard W.M. Jones <rjones@redhat.com> - 1.1.1-2
+* Thu Sep 12 2019 Richard W.M. Jones <rjones@redhat.com> - 1.0.1-2
 - Add upstream patch to fix nbdsh (for nbdkit tests).
+- Fix interop tests on slow machines.
 
-* Sun Sep 08 2019 Richard W.M. Jones <rjones@redhat.com> - 1.1.1-1
+* Sun Sep 08 2019 Richard W.M. Jones <rjones@redhat.com> - 1.0.1-1
-- New development version 1.1.1.
+- New stable version 1.0.1.
 
 * Wed Aug 28 2019 Richard W.M. Jones <rjones@redhat.com> - 1.0.0-1
 - New upstream version 1.0.0.