From 0e4e211f36cf765c0216a3c6d1a9b7be9165c558 Mon Sep 17 00:00:00 2001
From: Mark Atwood <mark@wolfssl.com>
Date: Tue, 26 May 2026 12:32:38 -0700
Subject: [PATCH 1/2] debian/control: add libgnutls30t64 to
 Conflicts/Replaces/Provides

Debian Trixie and Ubuntu Noble underwent the t64 transition (time_t
becomes 64-bit on 32-bit archs), which renamed libgnutls30 to
libgnutls30t64. The upstream libgnutls30t64 binary package declares
'Provides: libgnutls30' as a transition stub so most consumers
continue to work transparently.

But this gnutls-wolfssl source package's drop-in-replacement clauses
list only libgnutls30. On a fresh Trixie host (which has
libgnutls30t64 installed providing virtual libgnutls30), apt refuses
to install gnutls-wolfssl:

  gnutls-wolfssl conflicts with libgnutls30; libgnutls30t64 provides
  libgnutls30 and is present and installed.

Standard Debian t64 transition pattern is to extend the lists to
include both names. This is what Debian's own openssl source package
did (libssl3 -> libssl3t64).

The change is unconditional and safe across suites:
- On Bookworm and pre-t64 systems, there's no libgnutls30t64 to match
  against, so the t64-specific clauses are inert. No behavior change.
- On Trixie and post-t64 systems, the t64 clauses let apt resolve
  the drop-in replacement correctly and install gnutls-wolfssl
  cleanly over the system's libgnutls30t64.

Discovered while building gnutls-wolfssl for Debian Trixie/amd64 on
2026-05-24 in the wolfSSL FIPS-eval channel pipeline. The
FIPS-eval build harness has been sed-patching debian/control at
build time as a workaround; this commit lands the fix upstream so
the workaround can be removed from downstream pipelines.

Refs: https://wiki.debian.org/ArmHfPort/64bit_time_t (t64 transition
background)
---
 debian/control | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/debian/control b/debian/control
index cbda469..4dc6c96 100644
--- a/debian/control
+++ b/debian/control
@@ -31,9 +31,9 @@ Rules-Requires-Root: no
 Package: gnutls-wolfssl
 Architecture: any
 Depends: ${shlibs:Depends}, ${misc:Depends}
-Provides: libgnutls30 (= 3.8.9)
-Conflicts: libgnutls30
-Replaces: libgnutls30
+Provides: libgnutls30 (= 3.8.9), libgnutls30t64 (= 3.8.9)
+Conflicts: libgnutls30, libgnutls30t64
+Replaces: libgnutls30, libgnutls30t64
 Section: libs
 Description: GnuTLS linked against wolfSSL
  GnuTLS 3.x rebuilt to use wolfSSL as its cryptographic backend.

From ad97bd0c5de745ef2efc3e9bc6bfc55ed2cf3bfe Mon Sep 17 00:00:00 2001
From: Mark Atwood <mark@wolfssl.com>
Date: Thu, 1 Oct 2026 09:34:20 -0700
Subject: [PATCH 2/2] ci: run the deb packaging job on trixie too

Run deb-testing on debian:bookworm and debian:trixie, so the package
build, wrapper-load smoke test and unit tests run on both. Checked
locally by running the job's steps in a debian:trixie container: all
steps pass.
---
 .github/workflows/deb.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/deb.yml b/.github/workflows/deb.yml
index 2ef1c02..8cb2262 100644
--- a/.github/workflows/deb.yml
+++ b/.github/workflows/deb.yml
@@ -10,9 +10,14 @@ concurrency:
 
 jobs:
   deb-testing:
+    strategy:
+      fail-fast: false
+      matrix:
+        debian: [ bookworm, trixie ]
+    name: deb-testing (${{ matrix.debian }})
     runs-on: ubuntu-latest
     container:
-      image: debian:bookworm
+      image: debian:${{ matrix.debian }}
     env:
       DEBIAN_FRONTEND: noninteractive
     steps: