tce-load -i compiletc nettle-dev p11-kit-dev libidn2-dev unbound-dev texinfo

wget https://www.gnupg.org/ftp/gcrypt/gnutls/v3.7/gnutls-3.7.9.tar.xz

cd gnutls-3.7.9

CC="gcc -march=armv6zk -mtune=arm1176jzf-s -mfpu=vfp -Os -pipe" CXX="g++ -march=armv6zk -mtune=arm1176jzf-s -mfpu=vfp -Os -pipe" ./configure --prefix=/usr/local --localstatedir=/var --disable-static --with-default-trust-store-file=/usr/local/etc/pki/certs/ca-bundle.crt --with-unbound-root-key-file=/usr/local/etc/unbound/root.key --enable-openssl-compatibility --enable-ssl3-support --enable-sha1-support --with-default-trust-store-pkcs11="pkcs11:" --with-default-trust-store-dir=/usr/local/etc/ssl/certs --without-included-libtasn1 --without-included-unistring --with-system-priority-file=/usr/local/etc/gnutls --disable-doc --build=armv7l-unknown-linux-gnueabihf --host=armv7l-unknown-linux-gnueabihf

find . -name Makefile -type f -exec sed -i 's/-g -O2//g' {} \;

make [9m 59.62s]
sudo make install

  version:              3.7.9 shared 64:3:34
  Host/Target system:   armv7l-unknown-linux-gnueabihf
  Build system:         armv7l-unknown-linux-gnueabihf
  Install prefix:       /usr/local
  Compiler:             gcc -march=armv6zk -mtune=arm1176jzf-s -mfpu=vfp -Os -pipe
  Valgrind:             no 
  CFlags:               -g -O2
  Library types:        Shared=yes, Static=no
  Local libtasn1:       no
  Local unistring:      no
  Use nettle-mini:      no
  Documentation:        no (manpages: no)

configure: External hardware support:

  /dev/crypto:          no
  AF_ALG support:       no
  Hardware accel:       none
  Padlock accel:        no
  Random gen. variant:  getrandom
  PKCS#11 support:      yes
  TPM support:          no
  TPM2 support:         auto
  KTLS support:         no

configure:
  TPM2 library:         

configure: Optional features:
(note that included applications might not compile properly
if features are disabled)

  SSL3.0 support:       yes
  SSL2.0 client hello:  yes
  Allow SHA1 sign:      yes
  DTLS-SRTP support:    yes
  ALPN support:         yes
  OCSP support:         yes
  SRP support:          yes
  PSK support:          yes
  DHE support:          yes
  ECDHE support:        yes
  GOST support:         yes
  Anon auth support:    yes
  Heartbeat support:    yes
  IDNA support:         IDNA 2008 (libidn2)
  Non-SuiteB curves:    yes
  FIPS140 mode:         no
  Strict DER time:      yes

configure: Optional libraries:

  Guile wrappers:       no
  C++ library:          yes
  DANE library:         yes
  OpenSSL compat:       yes

configure: System files:

  Trust store pkcs11:   pkcs11:
  Trust store dir:      /usr/local/etc/ssl/certs
  Trust store file:     /usr/local/etc/pki/certs/ca-bundle.crt
  Blacklist file:       
  CRL file:             
  Configuration file:   /usr/local/etc/gnutls
  DNSSEC root key file: /usr/local/etc/unbound/root.key