Description of problem: a recent update in RHEL 8.3 (after May 25) broke GnuTLS at least in build environments. We noticed that in our Cockpit RHEL 8.3 image refresh (https://github.com/cockpit-project/bots/pull/920).

The unit tests now fail a lot with

DEBUG: ERROR:src/tls/test-server.c:220:assert_https_outcome: assertion failed (gnutls_set_default_priority (session) == GNUTLS_E_SUCCESS): (-50 == 0)
DEBUG: SKIP: test-tls-server Bail out! ERROR:src/tls/test-server.c:220:assert_https_outcome: assertion failed (gnutls_set_default_priority (session) == GNUTLS_E_SUCCESS): (-50 == 0)

This can be reproduced without cockpit, too:

   gnutls-serv -d 5 --x509keyfile=src/bridge/mock-server.key --x509certfile=src/bridge/mock-server.crt --http

(the particular cert and key don't matter -- just pick any that you happen to have laying around), andthen

    curl -k https://localhost:5556

gnutls-serv shows what it's failing on:

|<3>| ASSERT: cert-cred-x509.c[_gnutls_read_key_file]:594
Error reading '/etc/cockpit/ws-certs.d/0-self-signed.cert' or '/etc/cockpit/ws-certs.d/0-self-signed.cert'
Error: Error while reading file.
[mockbuild@m1 cockpit-219.43.ge9bd9dc9a]$ gnutls-serv -d 5 --x509keyfile=src/bridge/mock-server.key --x509certfile=src/bridge/mock-server.crt --http
|<3>| ASSERT: attributes.c[_x509_parse_attribute]:103
|<3>| ASSERT: attributes.c[_x509_parse_attribute]:174
|<3>| ASSERT: x509_ext.c[gnutls_subject_alt_names_get]:110
|<3>| ASSERT: x509.c[get_alt_name]:1853
|<3>| ASSERT: mpi.c[wrap_nettle_mpi_print]:60
HTTP Server listening on IPv4 0.0.0.0 port 5556...done
HTTP Server listening on IPv6 :: port 5556...done


|<5>| REC[0x55f703f086a0]: Allocating epoch #0
|<2>| cfg: unable to access: /etc/crypto-policies/back-ends/gnutls.config: 2
|<2>| resolved 'SYSTEM' to '', next ''
|<2>| unable to resolve @SYSTEM
|<3>| ASSERT: priority.c[gnutls_priority_init]:2009
|<3>| ASSERT: priority.c[gnutls_priority_set_direct]:2335
Could not set default policy: The request is invalid.

That makes the curl request fail ("OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to localhost:5556").

This is *very* similar to bug 1835661, but a slightly different root cause -- there, the permission of /etc/crypto-policies/back-ends/gnutls.config got broken, but in a default mock environment that file does not exist in the first place:

$ ls -l /etc/crypto-policies/back-ends/
total 0

Preferably GnuTLS should get along with an empty directory and just assume the defaults then -- both for upgradeability and also for keeping a clean /etc it is not at all desirable to get a new "unbreak my computer" file. If you must, then presumably the package needs a %post or so to make sure that the file exists -- but IMHO, a fallback in code is so much better than this packaging hackery.

Version-Release number of selected component (if applicable):

gnutls-3.6.13-3.el8.x86_64
crypto-policies-20200527-4.git63fc906.el8.noarch

How reproducible: Always