diff --git a/.gitignore b/.gitignore index edcc16f..cf249b7 100644 --- a/.gitignore +++ b/.gitignore @@ -47,9 +47,4 @@ jss-4.2.6.tar.gz /jss-5.4.2.tar.gz /jss-5.5.0-alpha2.tar.gz /jss-5.5.0.tar.gz -/jss-5.5.1.tar.gz -/jss-5.6.0-alpha1.tar.gz -/jss-5.8.0-beta1.tar.gz -/jss-5.8.0-beta3.tar.gz -/jss-5.8.0-beta4.tar.gz -/jss-5.8.0.tar.gz +/jss-5.6.0.tar.gz diff --git a/jss-5.4.2-nss-3.97.patch b/jss-5.4.2-nss-3.97.patch new file mode 100644 index 0000000..8b9d64d --- /dev/null +++ b/jss-5.4.2-nss-3.97.patch @@ -0,0 +1,40 @@ +From 130d543f3a7c33196bef386b4ee87ccc4ed53d0b Mon Sep 17 00:00:00 2001 +From: "Endi S. Dewata" +Date: Wed, 7 Feb 2024 14:59:31 -0600 +Subject: [PATCH] Update kea_alg_defs to match NSS 3.97 + +The kea_alg_defs array in SSLCipher.c has been updated to match +the one defined in NSS 3.97. The assertion that compares the size +of the array with ssl_kea_size has also been removed. These +changes will allow JSS to work with the newer NSS 3.97 on Fedora +Rawhide as well as the older NSS versions on other platforms. + +Resolves: https://github.com/dogtagpki/jss/issues/991 +--- + native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c b/native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c +index 4f2dacb0b..ea739617a 100644 +--- a/native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c ++++ b/native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c +@@ -23,7 +23,7 @@ static const CK_MECHANISM_TYPE auth_alg_defs[] = { + }; + PR_STATIC_ASSERT(PR_ARRAY_SIZE(auth_alg_defs) == ssl_auth_size); + +-/* Copied from NSS's ssl3con.c. */ ++/* Copied from NSS 3.97's ssl3con.c. */ + static const CK_MECHANISM_TYPE kea_alg_defs[] = { + CKM_INVALID_MECHANISM, /* ssl_kea_null */ + CKM_RSA_PKCS, /* ssl_kea_rsa */ +@@ -33,8 +33,9 @@ static const CK_MECHANISM_TYPE kea_alg_defs[] = { + CKM_ECDH1_DERIVE, /* ssl_kea_ecdh_psk */ + CKM_DH_PKCS_DERIVE, /* ssl_kea_dh_psk */ + CKM_INVALID_MECHANISM, /* ssl_kea_tls13_any */ ++ CKM_INVALID_MECHANISM, /* ssl_kea_ecdh_hybrid */ ++ CKM_INVALID_MECHANISM, /* ssl_kea_ecdh_hybrid_psk */ + }; +-PR_STATIC_ASSERT(PR_ARRAY_SIZE(kea_alg_defs) == ssl_kea_size); + + #ifdef HAVE_NSS_CIPHER_SUITE_INFO_KDFHASH + /* Not present in ssl3con.c. */ diff --git a/jss.spec b/jss.spec index 794ee73..0b6cd5e 100644 --- a/jss.spec +++ b/jss.spec @@ -7,13 +7,13 @@ Name: jss # Upstream version number: %global major_version 5 -%global minor_version 8 +%global minor_version 6 %global update_version 0 # Downstream release number: # - development/stabilization (unsupported): 0. where n >= 1 # - GA/update (supported): where n >= 1 -%global release_number 1 +%global release_number 2 # Development phase: # - development (unsupported): alpha where n >= 1 @@ -21,10 +21,6 @@ Name: jss # - GA/update (supported): #global phase -%if 0%{?rhel} && 0%{?rhel} >= 10 -%global enable_nss_version_pqc_def_flag -DENABLE_NSS_VERSION_PQC_DEF=ON -%endif - %undefine timestamp %undefine commit_id @@ -65,12 +61,12 @@ ExcludeArch: i686 # maven-local is a subpackage of javapackages-tools -%if 0%{?fedora} && 0%{?fedora} >= 43 || 0%{?rhel} >= 11 +%if 0%{?fedora} && 0%{?fedora} <= 39 || 0%{?rhel} && 0%{?rhel} <= 9 -%define java_devel java-25-openjdk-devel -%define java_headless java-25-openjdk-headless -%define java_home %{_jvmdir}/jre-25-openjdk -%define maven_local maven-local-openjdk25 +%define java_devel java-17-openjdk-devel +%define java_headless java-17-openjdk-headless +%define java_home %{_jvmdir}/jre-17-openjdk +%define maven_local maven-local-openjdk17 %else @@ -105,8 +101,8 @@ BuildRequires: zip BuildRequires: unzip BuildRequires: gcc-c++ -BuildRequires: nss-devel >= 3.101 -BuildRequires: nss-tools >= 3.101 +BuildRequires: nss-devel >= 3.97 +BuildRequires: nss-tools >= 3.97 BuildRequires: %{java_devel} BuildRequires: %{maven_local} @@ -125,7 +121,7 @@ This only works with gcj. Other JREs require that JCE providers be signed. Summary: Java Security Services (JSS) -Requires: nss >= 3.101 +Requires: nss >= 3.97 Requires: %{java_headless} Requires: mvn(org.apache.commons:commons-lang3) @@ -153,14 +149,20 @@ This only works with gcj. Other JREs require that JCE providers be signed. Summary: Java Security Services (JSS) Connector for Tomcat # Tomcat -BuildRequires: mvn(org.apache.tomcat:tomcat-catalina) >= 10.1.36 -BuildRequires: mvn(org.apache.tomcat:tomcat-coyote) >= 10.1.36 -BuildRequires: mvn(org.apache.tomcat:tomcat-juli) >= 10.1.36 +BuildRequires: mvn(org.apache.tomcat:tomcat-catalina) >= 9.0.62 +BuildRequires: mvn(org.apache.tomcat:tomcat-coyote) >= 9.0.62 +BuildRequires: mvn(org.apache.tomcat:tomcat-juli) >= 9.0.62 +%if 0%{?rhel} && 0%{?rhel} >= 10 +BuildRequires: tomcat9-lib +%endif Requires: %{product_id} = %{version}-%{release} -Requires: mvn(org.apache.tomcat:tomcat-catalina) >= 10.1.36 -Requires: mvn(org.apache.tomcat:tomcat-coyote) >= 10.1.36 -Requires: mvn(org.apache.tomcat:tomcat-juli) >= 10.1.36 +Requires: mvn(org.apache.tomcat:tomcat-catalina) >= 9.0.62 +Requires: mvn(org.apache.tomcat:tomcat-coyote) >= 9.0.62 +Requires: mvn(org.apache.tomcat:tomcat-juli) >= 9.0.62 +%if 0%{?rhel} && 0%{?rhel} >= 10 +Requires: tomcat9 >= 1:9.0.62 +%endif # Tomcat JSS has been replaced with JSS Connector for Tomcat. # This will remove installed Tomcat JSS packages. @@ -248,11 +250,11 @@ This package provides test suite for JSS. # specify Maven artifact locations %mvn_file org.dogtagpki.jss:jss-tomcat jss/jss-tomcat -%mvn_file org.dogtagpki.jss:jss-tomcat-10.1 jss/jss-tomcat-10.1 +%mvn_file org.dogtagpki.jss:jss-tomcat-9.0 jss/jss-tomcat-9.0 # specify Maven artifact packages %mvn_package org.dogtagpki.jss:jss-tomcat jss-tomcat -%mvn_package org.dogtagpki.jss:jss-tomcat-10.1 jss-tomcat +%mvn_package org.dogtagpki.jss:jss-tomcat-9.0 jss-tomcat ################################################################################ %build @@ -314,7 +316,7 @@ touch %{_vpath_builddir}/.targets/finished_generate_javadocs --lib-dir=%{_libdir} \ --sysconf-dir=%{_sysconfdir} \ --share-dir=%{_datadir} \ - --cmake="%{__cmake} %{?enable_nss_version_pqc_def_flag}" \ + --cmake=%{__cmake} \ --java-home=%{java_home} \ --jni-dir=%{_jnidir} \ --version=%{version} \ @@ -397,35 +399,11 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib ################################################################################ %changelog -* Tue Nov 04 2025 Dogtag PKI Team 5.8.0-1 -- Rebase to JSS 5.8.0-1 +* Thu Mar 6 2025 Dogtag PKI Team 5.6.0-2 +- respin for purposes of using side tag. -* Fri Aug 22 2025 Yaakov Selkowitz - 5.8.0-0.6.beta4 -- Build with Java 25 for ELN - -* Mon Aug 11 2025 Dogtag PKI Team 5.8.0-0.5.beta4 -- Rebuild for Fedora 43 - -* Mon Aug 11 2025 Dogtag PKI Team 5.8.0-0.4.beta4.1 -- Rebase to JSS 5.8.0-beta4 - -* Mon Jul 28 2025 Dogtag PKI Team 5.8.0-0.3.beta3.1 -- Rebase to JSS 5.8.0-beta3 - -* Thu Jul 24 2025 Fedora Release Engineering - 5.8.0-0.1.beta1.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - -* Wed Jul 09 2025 Dogtag PKI Team 5.8.0.1 -- Rebase to JSS 5.8.0-beta1 - -* Fri Jan 17 2025 Fedora Release Engineering - 5.6.0-0.1.alpha1.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild - -* Wed Nov 20 2024 Dogtag PKI Team 5.6.0-1 -- Rebase to JSS 5.6.0-alpha1 - -* Fri Oct 04 2024 Dogtag PKI Team 5.5.1-1 -- Rebase to JSS 5.5.1 +* Wed Mar 5 2025 Dogtag PKI Team 5.6.0-1 +- Rebase to JSS 5.6.0 * Thu Jul 18 2024 Fedora Release Engineering - 5.5.0-2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild diff --git a/sources b/sources index f69b2ec..3a193b4 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-5.8.0.tar.gz) = 10f5727d78f8b466062396e47c25b7fdac4b70c6862e6857f8aef49b633c43c4485c1d3cd535006ecd090e8dfe787000fb40d8748ed381c4ac4d1d39312e6c3d +SHA512 (jss-5.6.0.tar.gz) = e2516e26173694b63b755258629e5c88692c1c0d9c09240c67e8b76af846b399ffcdbe262de2b6ddd7a7a2a316777a9ef34ed3ca47c0865f755c86ed4ff90ff3