From 2bdd1199972bb28747b6f73ff140285e727a5c16 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 4 Mar 2020 11:33:04 -0500 Subject: [PATCH 01/78] Rebase to JSS v4.6.3 Also fixes three additional issues found since v4.6.3 rebase. Signed-off-by: Alexander Scheel --- .gitignore | 1 + 0001-Fix-NativeProxy-reference-tracker.patch | 53 ------------ 0001-Fix-base64-encoding-of-CSRs.patch | 39 +++++++++ ...Fix-swapped-parameter-names-with-PBE.patch | 80 +++++++++++++++++++ ...-Use-specified-algorithm-for-KeyWrap.patch | 60 ++++++++++++++ ...-Use-specified-algorithm-for-KeyWrap.patch | 60 ++++++++++++++ jss.spec | 14 +++- sources | 2 +- 8 files changed, 252 insertions(+), 57 deletions(-) delete mode 100644 0001-Fix-NativeProxy-reference-tracker.patch create mode 100644 0001-Fix-base64-encoding-of-CSRs.patch create mode 100644 0002-Fix-swapped-parameter-names-with-PBE.patch create mode 100644 0003-Use-specified-algorithm-for-KeyWrap.patch create mode 100644 0008-Use-specified-algorithm-for-KeyWrap.patch diff --git a/.gitignore b/.gitignore index 5981ea6..77527dc 100644 --- a/.gitignore +++ b/.gitignore @@ -23,3 +23,4 @@ jss-4.2.6.tar.gz /jss-4.5.3.tar.gz /jss-4.6.1.tar.gz /jss-4.6.2.tar.gz +/jss-4.6.3.tar.gz diff --git a/0001-Fix-NativeProxy-reference-tracker.patch b/0001-Fix-NativeProxy-reference-tracker.patch deleted file mode 100644 index 529b576..0000000 --- a/0001-Fix-NativeProxy-reference-tracker.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 91514ca0a2979ba778d27220ced0cd312e2cd2d2 Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Tue, 29 Oct 2019 10:43:56 -0400 -Subject: [PATCH] Fix NativeProxy reference tracker - -In eb5df01003d74b57473eacb84e538d31f5bb06ca, I introduced a bug by -setting mPointer after trying to add NativeProxy to the registry. In -most instances this won't matter, however, if another instance exists in -the HashSet with the same hash value, the equals comparator will be -used, triggering a NPE. - -Signed-off-by: Alexander Scheel ---- - org/mozilla/jss/util/NativeProxy.java | 13 +++++-------- - 1 file changed, 5 insertions(+), 8 deletions(-) - -diff --git a/org/mozilla/jss/util/NativeProxy.java b/org/mozilla/jss/util/NativeProxy.java -index 1c6d1aa5..a0811f76 100644 ---- a/org/mozilla/jss/util/NativeProxy.java -+++ b/org/mozilla/jss/util/NativeProxy.java -@@ -40,8 +40,8 @@ public abstract class NativeProxy implements AutoCloseable - */ - public NativeProxy(byte[] pointer) { - assert(pointer!=null); -- registry.add(this); - mPointer = pointer; -+ registry.add(this); - - if (saveStacktraces) { - mTrace = Arrays.toString(Thread.currentThread().getStackTrace()); -@@ -61,15 +61,12 @@ public abstract class NativeProxy implements AutoCloseable - if( ! (obj instanceof NativeProxy) ) { - return false; - } -- if( ((NativeProxy)obj).mPointer.length != mPointer.length) { -+ if (((NativeProxy)obj).mPointer == null) { -+ /* If mPointer is null, we have no way to compare the values -+ * of the pointers, so assume they're unequal. */ - return false; - } -- for(int i=0; i < mPointer.length; i++) { -- if(mPointer[i] != ((NativeProxy)obj).mPointer[i]) { -- return false; -- } -- } -- return true; -+ return Arrays.equals(((NativeProxy)obj).mPointer, mPointer); - } - - /** --- -2.21.0 - diff --git a/0001-Fix-base64-encoding-of-CSRs.patch b/0001-Fix-base64-encoding-of-CSRs.patch new file mode 100644 index 0000000..f898ed1 --- /dev/null +++ b/0001-Fix-base64-encoding-of-CSRs.patch @@ -0,0 +1,39 @@ +From 18efce236af6a1affebb274838318ba715114218 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Tue, 25 Feb 2020 09:14:47 -0500 +Subject: [PATCH 3/8] Fix base64-encoding of CSRs + +In 8de4440c5652f6f1af5b4b923a15730ba84f29e1, the base64 encoder was +changed from apache-commons-codec to the Java standard library to drop +a dependency. However, the behavior changed as a result: the Java +standard library doesn't include a final line separator, whereas +apache-commons-codec did. This results in malformed CSRs: + +> YWRPxyBKvFAOB29fwPwBJLZksrwQ0xAs7sooc+qF-----END NEW CERTIFICATE REQUEST----- + +Resolves: https://pagure.io/freeipa/issue/8199 + +Signed-off-by: Alexander Scheel +--- + org/mozilla/jss/netscape/security/util/Utils.java | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/org/mozilla/jss/netscape/security/util/Utils.java b/org/mozilla/jss/netscape/security/util/Utils.java +index 19f3b1f9..e6e56ce4 100644 +--- a/org/mozilla/jss/netscape/security/util/Utils.java ++++ b/org/mozilla/jss/netscape/security/util/Utils.java +@@ -378,7 +378,10 @@ public class Utils { + * @return base-64 encoded data + */ + public static String base64encodeMultiLine(byte[] bytes) { +- return Base64.getMimeEncoder().encodeToString(bytes); ++ // When switching from apache-commons-codec to the standard library, ++ // the standard library does not include a final line separator at ++ // the end of the encoded data. This results in malformed CSRs. ++ return Base64.getMimeEncoder().encodeToString(bytes) + "\r\n"; + } + + +-- +2.24.1 + diff --git a/0002-Fix-swapped-parameter-names-with-PBE.patch b/0002-Fix-swapped-parameter-names-with-PBE.patch new file mode 100644 index 0000000..c535f6e --- /dev/null +++ b/0002-Fix-swapped-parameter-names-with-PBE.patch @@ -0,0 +1,80 @@ +From 9f29430656342829822568f4ef49f5237b41164b Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Fri, 28 Feb 2020 14:10:32 -0500 +Subject: [PATCH 7/8] Fix swapped parameter names with PBE + +Commit 13998a9e77e60d6509ac814ed711dd21e1248ecd introduced a regression +related to extracting the parameter classes during PBE operations: +previously, the classes of the underlying encryption algorithm were +iterated over, instead of the classes of the PBE class itself. However, +this commit iterated over the PBE parameter classes; no PBE algorithm +accepts a IvParameterSpec, resulting in a null parameter passed to the +later encryption or key wrap operation. This resulted in stack traces +like the following: + +Caused by: java.security.InvalidAlgorithmParameterException: DES3/CBC/Pad cannot use a null parameter + at org.mozilla.jss.pkcs11.PK11KeyWrapper.checkParams(PK11KeyWrapper.java:225) + at org.mozilla.jss.pkcs11.PK11KeyWrapper.initWrap(PK11KeyWrapper.java:89) + at org.mozilla.jss.pkcs11.PK11KeyWrapper.initWrap(PK11KeyWrapper.java:57) + at org.mozilla.jss.pkix.primitive.EncryptedPrivateKeyInfo.createPBE(EncryptedPrivateKeyInfo.java:342) + +Resolves: rh-bz#1807371 + +Signed-off-by: Alexander Scheel +--- + org/mozilla/jss/pkcs7/EncryptedContentInfo.java | 2 +- + org/mozilla/jss/pkix/cms/EncryptedContentInfo.java | 2 +- + org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++-- + 3 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/org/mozilla/jss/pkcs7/EncryptedContentInfo.java b/org/mozilla/jss/pkcs7/EncryptedContentInfo.java +index 084752c3..0344b14d 100644 +--- a/org/mozilla/jss/pkcs7/EncryptedContentInfo.java ++++ b/org/mozilla/jss/pkcs7/EncryptedContentInfo.java +@@ -182,7 +182,7 @@ public class EncryptedContentInfo implements ASN1Value { + // generate IV + EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); + AlgorithmParameterSpec params=null; +- Class [] paramClasses = pbeAlg.getParameterClasses(); ++ Class [] paramClasses = encAlg.getParameterClasses(); + for (int i = 0; i < paramClasses.length; i ++) { + if ( paramClasses[i].equals( + javax.crypto.spec.IvParameterSpec.class ) ) { +diff --git a/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java b/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java +index a4709070..d85eb0d3 100644 +--- a/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java ++++ b/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java +@@ -180,7 +180,7 @@ public class EncryptedContentInfo implements ASN1Value { + // generate IV + EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); + AlgorithmParameterSpec params=null; +- Class [] paramClasses = pbeAlg.getParameterClasses(); ++ Class [] paramClasses = encAlg.getParameterClasses(); + for (int i = 0; i < paramClasses.length; i ++) { + if ( paramClasses[i].equals( IVParameterSpec.class ) ) { + params = new IVParameterSpec( kg.generatePBE_IV() ); +diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +index b35714e3..ebd269f3 100644 +--- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java ++++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +@@ -147,7 +147,7 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { + // generate IV + EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); + AlgorithmParameterSpec params=null; +- Class [] paramClasses = pbeAlg.getParameterClasses(); ++ Class [] paramClasses = encAlg.getParameterClasses(); + for (int i = 0; i < paramClasses.length; i ++) { + if ( paramClasses[i].equals( javax.crypto.spec.IvParameterSpec.class ) ) { + params = new IVParameterSpec( kg.generatePBE_IV() ); +@@ -328,7 +328,7 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { + // generate IV + EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); + AlgorithmParameterSpec params=null; +- Class [] paramClasses = pbeAlg.getParameterClasses(); ++ Class [] paramClasses = encAlg.getParameterClasses(); + for (int i = 0; i < paramClasses.length; i ++) { + if ( paramClasses[i].equals( + javax.crypto.spec.IvParameterSpec.class ) ) { +-- +2.24.1 + diff --git a/0003-Use-specified-algorithm-for-KeyWrap.patch b/0003-Use-specified-algorithm-for-KeyWrap.patch new file mode 100644 index 0000000..d75534a --- /dev/null +++ b/0003-Use-specified-algorithm-for-KeyWrap.patch @@ -0,0 +1,60 @@ +From 55482c8bfa0addeb9db7b590703ba3704c5db167 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Fri, 28 Feb 2020 14:39:29 -0500 +Subject: [PATCH 8/8] Use specified algorithm for KeyWrap + +When the token-specified from of EncryptedPrivateKeyInfo.createPBE is +called, it would always request DES3_CBC_PAD as the key wrapping +algorithm, regardless of the input PBE key type. However, the other form +(with an implicit token) was correctly handling this case. + +Introduces a new KeyWrapAlgorithm method to take an OBJECT_IDENTIFIER +instead of having to convert to/from a String form. + +Signed-off-by: Alexander Scheel +--- + org/mozilla/jss/crypto/KeyWrapAlgorithm.java | 5 ++++- + org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++-- + 2 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java +index 3113f614..3a106977 100644 +--- a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java ++++ b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java +@@ -138,7 +138,10 @@ public class KeyWrapAlgorithm extends Algorithm { + + public static KeyWrapAlgorithm fromOID(String wrapOID) throws NoSuchAlgorithmException { + OBJECT_IDENTIFIER oid = new OBJECT_IDENTIFIER(wrapOID); ++ return fromOID(oid); ++ } + ++ public static KeyWrapAlgorithm fromOID(OBJECT_IDENTIFIER oid) throws NoSuchAlgorithmException { + if (oid.equals(AES_KEY_WRAP_PAD_OID)) + return AES_KEY_WRAP_PAD; + +@@ -154,6 +157,6 @@ public class KeyWrapAlgorithm extends Algorithm { + if (oid.equals(DES_CBC_PAD_OID)) + return DES_CBC_PAD; + +- throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + wrapOID); ++ throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + oid); + } + } +diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +index ebd269f3..abfc39a7 100644 +--- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java ++++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +@@ -337,8 +337,8 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { + } + } + +- KeyWrapper wrapper = token.getKeyWrapper( +- KeyWrapAlgorithm.DES3_CBC_PAD); ++ // wrap the key ++ KeyWrapper wrapper = token.getKeyWrapper(KeyWrapAlgorithm.fromOID(encAlg.toOID())); + wrapper.initWrap(key, params); + byte encrypted[] = wrapper.wrap(pri); + +-- +2.24.1 + diff --git a/0008-Use-specified-algorithm-for-KeyWrap.patch b/0008-Use-specified-algorithm-for-KeyWrap.patch new file mode 100644 index 0000000..d75534a --- /dev/null +++ b/0008-Use-specified-algorithm-for-KeyWrap.patch @@ -0,0 +1,60 @@ +From 55482c8bfa0addeb9db7b590703ba3704c5db167 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Fri, 28 Feb 2020 14:39:29 -0500 +Subject: [PATCH 8/8] Use specified algorithm for KeyWrap + +When the token-specified from of EncryptedPrivateKeyInfo.createPBE is +called, it would always request DES3_CBC_PAD as the key wrapping +algorithm, regardless of the input PBE key type. However, the other form +(with an implicit token) was correctly handling this case. + +Introduces a new KeyWrapAlgorithm method to take an OBJECT_IDENTIFIER +instead of having to convert to/from a String form. + +Signed-off-by: Alexander Scheel +--- + org/mozilla/jss/crypto/KeyWrapAlgorithm.java | 5 ++++- + org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++-- + 2 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java +index 3113f614..3a106977 100644 +--- a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java ++++ b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java +@@ -138,7 +138,10 @@ public class KeyWrapAlgorithm extends Algorithm { + + public static KeyWrapAlgorithm fromOID(String wrapOID) throws NoSuchAlgorithmException { + OBJECT_IDENTIFIER oid = new OBJECT_IDENTIFIER(wrapOID); ++ return fromOID(oid); ++ } + ++ public static KeyWrapAlgorithm fromOID(OBJECT_IDENTIFIER oid) throws NoSuchAlgorithmException { + if (oid.equals(AES_KEY_WRAP_PAD_OID)) + return AES_KEY_WRAP_PAD; + +@@ -154,6 +157,6 @@ public class KeyWrapAlgorithm extends Algorithm { + if (oid.equals(DES_CBC_PAD_OID)) + return DES_CBC_PAD; + +- throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + wrapOID); ++ throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + oid); + } + } +diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +index ebd269f3..abfc39a7 100644 +--- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java ++++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +@@ -337,8 +337,8 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { + } + } + +- KeyWrapper wrapper = token.getKeyWrapper( +- KeyWrapAlgorithm.DES3_CBC_PAD); ++ // wrap the key ++ KeyWrapper wrapper = token.getKeyWrapper(KeyWrapAlgorithm.fromOID(encAlg.toOID())); + wrapper.initWrap(key, params); + byte encrypted[] = wrapper.wrap(pri); + +-- +2.24.1 + diff --git a/jss.spec b/jss.spec index 536e1db..c58e687 100644 --- a/jss.spec +++ b/jss.spec @@ -6,8 +6,8 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.6.2 -Release: 3%{?_timestamp}%{?_commit_id}%{?dist} +Version: 4.6.3 +Release: 1%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 # To generate the source tarball: @@ -25,7 +25,9 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch -Patch: 0001-Fix-NativeProxy-reference-tracker.patch +Patch0: 0001-Fix-base64-encoding-of-CSRs.patch +Patch1: 0002-Fix-swapped-parameter-names-with-PBE.patch +Patch2: 0003-Use-specified-algorithm-for-KeyWrap.patch ################################################################################ # Build Dependencies @@ -160,6 +162,12 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Wed Mar 4 2020 Dogtag PKI Team - 4.6.3-1 +- Rebase to JSS 4.6.3 +- Fixes base64 encoding of CSRs +- Fixes swapped parameter names in PBE +- Use specified algorithms for KeyWrap in PBE + * Tue Jan 28 2020 Dogtag PKI Team - 4.6.2-3 - Rebuild with new NSS to fix rhbz#1794814 diff --git a/sources b/sources index 32f2840..c883e35 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.6.2.tar.gz) = 53c12822b980f6dcaf5616366834fe4eaee07d84feae53096aa0ea142146e90d375910456d8192068cde5e63c3b60ded87862af50ea89c6b64224e8c105e00dd +SHA512 (jss-4.6.3.tar.gz) = 6c45b67c40737ee7bbc9ad1db8a5ed233b050697f9c048e1a49cc541de889416afd36b2c9bcdc44a52d10b0c75f036e22155a5ee95869fdf31772683637a27b1 From 3cc21a363a90b1c9ca16982b95e4295a5b6a7d70 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 4 Mar 2020 11:49:32 -0500 Subject: [PATCH 02/78] Revert "Rebase to JSS v4.6.3" This reverts commit 2bdd1199972bb28747b6f73ff140285e727a5c16. --- .gitignore | 1 - 0001-Fix-NativeProxy-reference-tracker.patch | 53 ++++++++++++ 0001-Fix-base64-encoding-of-CSRs.patch | 39 --------- ...Fix-swapped-parameter-names-with-PBE.patch | 80 ------------------- ...-Use-specified-algorithm-for-KeyWrap.patch | 60 -------------- ...-Use-specified-algorithm-for-KeyWrap.patch | 60 -------------- jss.spec | 14 +--- sources | 2 +- 8 files changed, 57 insertions(+), 252 deletions(-) create mode 100644 0001-Fix-NativeProxy-reference-tracker.patch delete mode 100644 0001-Fix-base64-encoding-of-CSRs.patch delete mode 100644 0002-Fix-swapped-parameter-names-with-PBE.patch delete mode 100644 0003-Use-specified-algorithm-for-KeyWrap.patch delete mode 100644 0008-Use-specified-algorithm-for-KeyWrap.patch diff --git a/.gitignore b/.gitignore index 77527dc..5981ea6 100644 --- a/.gitignore +++ b/.gitignore @@ -23,4 +23,3 @@ jss-4.2.6.tar.gz /jss-4.5.3.tar.gz /jss-4.6.1.tar.gz /jss-4.6.2.tar.gz -/jss-4.6.3.tar.gz diff --git a/0001-Fix-NativeProxy-reference-tracker.patch b/0001-Fix-NativeProxy-reference-tracker.patch new file mode 100644 index 0000000..529b576 --- /dev/null +++ b/0001-Fix-NativeProxy-reference-tracker.patch @@ -0,0 +1,53 @@ +From 91514ca0a2979ba778d27220ced0cd312e2cd2d2 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Tue, 29 Oct 2019 10:43:56 -0400 +Subject: [PATCH] Fix NativeProxy reference tracker + +In eb5df01003d74b57473eacb84e538d31f5bb06ca, I introduced a bug by +setting mPointer after trying to add NativeProxy to the registry. In +most instances this won't matter, however, if another instance exists in +the HashSet with the same hash value, the equals comparator will be +used, triggering a NPE. + +Signed-off-by: Alexander Scheel +--- + org/mozilla/jss/util/NativeProxy.java | 13 +++++-------- + 1 file changed, 5 insertions(+), 8 deletions(-) + +diff --git a/org/mozilla/jss/util/NativeProxy.java b/org/mozilla/jss/util/NativeProxy.java +index 1c6d1aa5..a0811f76 100644 +--- a/org/mozilla/jss/util/NativeProxy.java ++++ b/org/mozilla/jss/util/NativeProxy.java +@@ -40,8 +40,8 @@ public abstract class NativeProxy implements AutoCloseable + */ + public NativeProxy(byte[] pointer) { + assert(pointer!=null); +- registry.add(this); + mPointer = pointer; ++ registry.add(this); + + if (saveStacktraces) { + mTrace = Arrays.toString(Thread.currentThread().getStackTrace()); +@@ -61,15 +61,12 @@ public abstract class NativeProxy implements AutoCloseable + if( ! (obj instanceof NativeProxy) ) { + return false; + } +- if( ((NativeProxy)obj).mPointer.length != mPointer.length) { ++ if (((NativeProxy)obj).mPointer == null) { ++ /* If mPointer is null, we have no way to compare the values ++ * of the pointers, so assume they're unequal. */ + return false; + } +- for(int i=0; i < mPointer.length; i++) { +- if(mPointer[i] != ((NativeProxy)obj).mPointer[i]) { +- return false; +- } +- } +- return true; ++ return Arrays.equals(((NativeProxy)obj).mPointer, mPointer); + } + + /** +-- +2.21.0 + diff --git a/0001-Fix-base64-encoding-of-CSRs.patch b/0001-Fix-base64-encoding-of-CSRs.patch deleted file mode 100644 index f898ed1..0000000 --- a/0001-Fix-base64-encoding-of-CSRs.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 18efce236af6a1affebb274838318ba715114218 Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Tue, 25 Feb 2020 09:14:47 -0500 -Subject: [PATCH 3/8] Fix base64-encoding of CSRs - -In 8de4440c5652f6f1af5b4b923a15730ba84f29e1, the base64 encoder was -changed from apache-commons-codec to the Java standard library to drop -a dependency. However, the behavior changed as a result: the Java -standard library doesn't include a final line separator, whereas -apache-commons-codec did. This results in malformed CSRs: - -> YWRPxyBKvFAOB29fwPwBJLZksrwQ0xAs7sooc+qF-----END NEW CERTIFICATE REQUEST----- - -Resolves: https://pagure.io/freeipa/issue/8199 - -Signed-off-by: Alexander Scheel ---- - org/mozilla/jss/netscape/security/util/Utils.java | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/org/mozilla/jss/netscape/security/util/Utils.java b/org/mozilla/jss/netscape/security/util/Utils.java -index 19f3b1f9..e6e56ce4 100644 ---- a/org/mozilla/jss/netscape/security/util/Utils.java -+++ b/org/mozilla/jss/netscape/security/util/Utils.java -@@ -378,7 +378,10 @@ public class Utils { - * @return base-64 encoded data - */ - public static String base64encodeMultiLine(byte[] bytes) { -- return Base64.getMimeEncoder().encodeToString(bytes); -+ // When switching from apache-commons-codec to the standard library, -+ // the standard library does not include a final line separator at -+ // the end of the encoded data. This results in malformed CSRs. -+ return Base64.getMimeEncoder().encodeToString(bytes) + "\r\n"; - } - - --- -2.24.1 - diff --git a/0002-Fix-swapped-parameter-names-with-PBE.patch b/0002-Fix-swapped-parameter-names-with-PBE.patch deleted file mode 100644 index c535f6e..0000000 --- a/0002-Fix-swapped-parameter-names-with-PBE.patch +++ /dev/null @@ -1,80 +0,0 @@ -From 9f29430656342829822568f4ef49f5237b41164b Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Fri, 28 Feb 2020 14:10:32 -0500 -Subject: [PATCH 7/8] Fix swapped parameter names with PBE - -Commit 13998a9e77e60d6509ac814ed711dd21e1248ecd introduced a regression -related to extracting the parameter classes during PBE operations: -previously, the classes of the underlying encryption algorithm were -iterated over, instead of the classes of the PBE class itself. However, -this commit iterated over the PBE parameter classes; no PBE algorithm -accepts a IvParameterSpec, resulting in a null parameter passed to the -later encryption or key wrap operation. This resulted in stack traces -like the following: - -Caused by: java.security.InvalidAlgorithmParameterException: DES3/CBC/Pad cannot use a null parameter - at org.mozilla.jss.pkcs11.PK11KeyWrapper.checkParams(PK11KeyWrapper.java:225) - at org.mozilla.jss.pkcs11.PK11KeyWrapper.initWrap(PK11KeyWrapper.java:89) - at org.mozilla.jss.pkcs11.PK11KeyWrapper.initWrap(PK11KeyWrapper.java:57) - at org.mozilla.jss.pkix.primitive.EncryptedPrivateKeyInfo.createPBE(EncryptedPrivateKeyInfo.java:342) - -Resolves: rh-bz#1807371 - -Signed-off-by: Alexander Scheel ---- - org/mozilla/jss/pkcs7/EncryptedContentInfo.java | 2 +- - org/mozilla/jss/pkix/cms/EncryptedContentInfo.java | 2 +- - org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++-- - 3 files changed, 4 insertions(+), 4 deletions(-) - -diff --git a/org/mozilla/jss/pkcs7/EncryptedContentInfo.java b/org/mozilla/jss/pkcs7/EncryptedContentInfo.java -index 084752c3..0344b14d 100644 ---- a/org/mozilla/jss/pkcs7/EncryptedContentInfo.java -+++ b/org/mozilla/jss/pkcs7/EncryptedContentInfo.java -@@ -182,7 +182,7 @@ public class EncryptedContentInfo implements ASN1Value { - // generate IV - EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); - AlgorithmParameterSpec params=null; -- Class [] paramClasses = pbeAlg.getParameterClasses(); -+ Class [] paramClasses = encAlg.getParameterClasses(); - for (int i = 0; i < paramClasses.length; i ++) { - if ( paramClasses[i].equals( - javax.crypto.spec.IvParameterSpec.class ) ) { -diff --git a/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java b/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java -index a4709070..d85eb0d3 100644 ---- a/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java -+++ b/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java -@@ -180,7 +180,7 @@ public class EncryptedContentInfo implements ASN1Value { - // generate IV - EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); - AlgorithmParameterSpec params=null; -- Class [] paramClasses = pbeAlg.getParameterClasses(); -+ Class [] paramClasses = encAlg.getParameterClasses(); - for (int i = 0; i < paramClasses.length; i ++) { - if ( paramClasses[i].equals( IVParameterSpec.class ) ) { - params = new IVParameterSpec( kg.generatePBE_IV() ); -diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -index b35714e3..ebd269f3 100644 ---- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -+++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -@@ -147,7 +147,7 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { - // generate IV - EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); - AlgorithmParameterSpec params=null; -- Class [] paramClasses = pbeAlg.getParameterClasses(); -+ Class [] paramClasses = encAlg.getParameterClasses(); - for (int i = 0; i < paramClasses.length; i ++) { - if ( paramClasses[i].equals( javax.crypto.spec.IvParameterSpec.class ) ) { - params = new IVParameterSpec( kg.generatePBE_IV() ); -@@ -328,7 +328,7 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { - // generate IV - EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); - AlgorithmParameterSpec params=null; -- Class [] paramClasses = pbeAlg.getParameterClasses(); -+ Class [] paramClasses = encAlg.getParameterClasses(); - for (int i = 0; i < paramClasses.length; i ++) { - if ( paramClasses[i].equals( - javax.crypto.spec.IvParameterSpec.class ) ) { --- -2.24.1 - diff --git a/0003-Use-specified-algorithm-for-KeyWrap.patch b/0003-Use-specified-algorithm-for-KeyWrap.patch deleted file mode 100644 index d75534a..0000000 --- a/0003-Use-specified-algorithm-for-KeyWrap.patch +++ /dev/null @@ -1,60 +0,0 @@ -From 55482c8bfa0addeb9db7b590703ba3704c5db167 Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Fri, 28 Feb 2020 14:39:29 -0500 -Subject: [PATCH 8/8] Use specified algorithm for KeyWrap - -When the token-specified from of EncryptedPrivateKeyInfo.createPBE is -called, it would always request DES3_CBC_PAD as the key wrapping -algorithm, regardless of the input PBE key type. However, the other form -(with an implicit token) was correctly handling this case. - -Introduces a new KeyWrapAlgorithm method to take an OBJECT_IDENTIFIER -instead of having to convert to/from a String form. - -Signed-off-by: Alexander Scheel ---- - org/mozilla/jss/crypto/KeyWrapAlgorithm.java | 5 ++++- - org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++-- - 2 files changed, 6 insertions(+), 3 deletions(-) - -diff --git a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java -index 3113f614..3a106977 100644 ---- a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java -+++ b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java -@@ -138,7 +138,10 @@ public class KeyWrapAlgorithm extends Algorithm { - - public static KeyWrapAlgorithm fromOID(String wrapOID) throws NoSuchAlgorithmException { - OBJECT_IDENTIFIER oid = new OBJECT_IDENTIFIER(wrapOID); -+ return fromOID(oid); -+ } - -+ public static KeyWrapAlgorithm fromOID(OBJECT_IDENTIFIER oid) throws NoSuchAlgorithmException { - if (oid.equals(AES_KEY_WRAP_PAD_OID)) - return AES_KEY_WRAP_PAD; - -@@ -154,6 +157,6 @@ public class KeyWrapAlgorithm extends Algorithm { - if (oid.equals(DES_CBC_PAD_OID)) - return DES_CBC_PAD; - -- throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + wrapOID); -+ throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + oid); - } - } -diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -index ebd269f3..abfc39a7 100644 ---- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -+++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -@@ -337,8 +337,8 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { - } - } - -- KeyWrapper wrapper = token.getKeyWrapper( -- KeyWrapAlgorithm.DES3_CBC_PAD); -+ // wrap the key -+ KeyWrapper wrapper = token.getKeyWrapper(KeyWrapAlgorithm.fromOID(encAlg.toOID())); - wrapper.initWrap(key, params); - byte encrypted[] = wrapper.wrap(pri); - --- -2.24.1 - diff --git a/0008-Use-specified-algorithm-for-KeyWrap.patch b/0008-Use-specified-algorithm-for-KeyWrap.patch deleted file mode 100644 index d75534a..0000000 --- a/0008-Use-specified-algorithm-for-KeyWrap.patch +++ /dev/null @@ -1,60 +0,0 @@ -From 55482c8bfa0addeb9db7b590703ba3704c5db167 Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Fri, 28 Feb 2020 14:39:29 -0500 -Subject: [PATCH 8/8] Use specified algorithm for KeyWrap - -When the token-specified from of EncryptedPrivateKeyInfo.createPBE is -called, it would always request DES3_CBC_PAD as the key wrapping -algorithm, regardless of the input PBE key type. However, the other form -(with an implicit token) was correctly handling this case. - -Introduces a new KeyWrapAlgorithm method to take an OBJECT_IDENTIFIER -instead of having to convert to/from a String form. - -Signed-off-by: Alexander Scheel ---- - org/mozilla/jss/crypto/KeyWrapAlgorithm.java | 5 ++++- - org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++-- - 2 files changed, 6 insertions(+), 3 deletions(-) - -diff --git a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java -index 3113f614..3a106977 100644 ---- a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java -+++ b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java -@@ -138,7 +138,10 @@ public class KeyWrapAlgorithm extends Algorithm { - - public static KeyWrapAlgorithm fromOID(String wrapOID) throws NoSuchAlgorithmException { - OBJECT_IDENTIFIER oid = new OBJECT_IDENTIFIER(wrapOID); -+ return fromOID(oid); -+ } - -+ public static KeyWrapAlgorithm fromOID(OBJECT_IDENTIFIER oid) throws NoSuchAlgorithmException { - if (oid.equals(AES_KEY_WRAP_PAD_OID)) - return AES_KEY_WRAP_PAD; - -@@ -154,6 +157,6 @@ public class KeyWrapAlgorithm extends Algorithm { - if (oid.equals(DES_CBC_PAD_OID)) - return DES_CBC_PAD; - -- throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + wrapOID); -+ throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + oid); - } - } -diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -index ebd269f3..abfc39a7 100644 ---- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -+++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -@@ -337,8 +337,8 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { - } - } - -- KeyWrapper wrapper = token.getKeyWrapper( -- KeyWrapAlgorithm.DES3_CBC_PAD); -+ // wrap the key -+ KeyWrapper wrapper = token.getKeyWrapper(KeyWrapAlgorithm.fromOID(encAlg.toOID())); - wrapper.initWrap(key, params); - byte encrypted[] = wrapper.wrap(pri); - --- -2.24.1 - diff --git a/jss.spec b/jss.spec index c58e687..536e1db 100644 --- a/jss.spec +++ b/jss.spec @@ -6,8 +6,8 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.6.3 -Release: 1%{?_timestamp}%{?_commit_id}%{?dist} +Version: 4.6.2 +Release: 3%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 # To generate the source tarball: @@ -25,9 +25,7 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch -Patch0: 0001-Fix-base64-encoding-of-CSRs.patch -Patch1: 0002-Fix-swapped-parameter-names-with-PBE.patch -Patch2: 0003-Use-specified-algorithm-for-KeyWrap.patch +Patch: 0001-Fix-NativeProxy-reference-tracker.patch ################################################################################ # Build Dependencies @@ -162,12 +160,6 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog -* Wed Mar 4 2020 Dogtag PKI Team - 4.6.3-1 -- Rebase to JSS 4.6.3 -- Fixes base64 encoding of CSRs -- Fixes swapped parameter names in PBE -- Use specified algorithms for KeyWrap in PBE - * Tue Jan 28 2020 Dogtag PKI Team - 4.6.2-3 - Rebuild with new NSS to fix rhbz#1794814 diff --git a/sources b/sources index c883e35..32f2840 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.6.3.tar.gz) = 6c45b67c40737ee7bbc9ad1db8a5ed233b050697f9c048e1a49cc541de889416afd36b2c9bcdc44a52d10b0c75f036e22155a5ee95869fdf31772683637a27b1 +SHA512 (jss-4.6.2.tar.gz) = 53c12822b980f6dcaf5616366834fe4eaee07d84feae53096aa0ea142146e90d375910456d8192068cde5e63c3b60ded87862af50ea89c6b64224e8c105e00dd From 01ab6695c1867669142609f0eb7e373d9c4d3e4d Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 4 Mar 2020 12:01:29 -0500 Subject: [PATCH 03/78] Add fixes for KRA issues Signed-off-by: Alexander Scheel --- ...Fix-swapped-parameter-names-with-PBE.patch | 80 +++++++++++++++++++ ...-Use-specified-algorithm-for-KeyWrap.patch | 60 ++++++++++++++ jss.spec | 9 ++- 3 files changed, 147 insertions(+), 2 deletions(-) create mode 100644 0002-Fix-swapped-parameter-names-with-PBE.patch create mode 100644 0003-Use-specified-algorithm-for-KeyWrap.patch diff --git a/0002-Fix-swapped-parameter-names-with-PBE.patch b/0002-Fix-swapped-parameter-names-with-PBE.patch new file mode 100644 index 0000000..c535f6e --- /dev/null +++ b/0002-Fix-swapped-parameter-names-with-PBE.patch @@ -0,0 +1,80 @@ +From 9f29430656342829822568f4ef49f5237b41164b Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Fri, 28 Feb 2020 14:10:32 -0500 +Subject: [PATCH 7/8] Fix swapped parameter names with PBE + +Commit 13998a9e77e60d6509ac814ed711dd21e1248ecd introduced a regression +related to extracting the parameter classes during PBE operations: +previously, the classes of the underlying encryption algorithm were +iterated over, instead of the classes of the PBE class itself. However, +this commit iterated over the PBE parameter classes; no PBE algorithm +accepts a IvParameterSpec, resulting in a null parameter passed to the +later encryption or key wrap operation. This resulted in stack traces +like the following: + +Caused by: java.security.InvalidAlgorithmParameterException: DES3/CBC/Pad cannot use a null parameter + at org.mozilla.jss.pkcs11.PK11KeyWrapper.checkParams(PK11KeyWrapper.java:225) + at org.mozilla.jss.pkcs11.PK11KeyWrapper.initWrap(PK11KeyWrapper.java:89) + at org.mozilla.jss.pkcs11.PK11KeyWrapper.initWrap(PK11KeyWrapper.java:57) + at org.mozilla.jss.pkix.primitive.EncryptedPrivateKeyInfo.createPBE(EncryptedPrivateKeyInfo.java:342) + +Resolves: rh-bz#1807371 + +Signed-off-by: Alexander Scheel +--- + org/mozilla/jss/pkcs7/EncryptedContentInfo.java | 2 +- + org/mozilla/jss/pkix/cms/EncryptedContentInfo.java | 2 +- + org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++-- + 3 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/org/mozilla/jss/pkcs7/EncryptedContentInfo.java b/org/mozilla/jss/pkcs7/EncryptedContentInfo.java +index 084752c3..0344b14d 100644 +--- a/org/mozilla/jss/pkcs7/EncryptedContentInfo.java ++++ b/org/mozilla/jss/pkcs7/EncryptedContentInfo.java +@@ -182,7 +182,7 @@ public class EncryptedContentInfo implements ASN1Value { + // generate IV + EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); + AlgorithmParameterSpec params=null; +- Class [] paramClasses = pbeAlg.getParameterClasses(); ++ Class [] paramClasses = encAlg.getParameterClasses(); + for (int i = 0; i < paramClasses.length; i ++) { + if ( paramClasses[i].equals( + javax.crypto.spec.IvParameterSpec.class ) ) { +diff --git a/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java b/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java +index a4709070..d85eb0d3 100644 +--- a/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java ++++ b/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java +@@ -180,7 +180,7 @@ public class EncryptedContentInfo implements ASN1Value { + // generate IV + EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); + AlgorithmParameterSpec params=null; +- Class [] paramClasses = pbeAlg.getParameterClasses(); ++ Class [] paramClasses = encAlg.getParameterClasses(); + for (int i = 0; i < paramClasses.length; i ++) { + if ( paramClasses[i].equals( IVParameterSpec.class ) ) { + params = new IVParameterSpec( kg.generatePBE_IV() ); +diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +index b35714e3..ebd269f3 100644 +--- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java ++++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +@@ -147,7 +147,7 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { + // generate IV + EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); + AlgorithmParameterSpec params=null; +- Class [] paramClasses = pbeAlg.getParameterClasses(); ++ Class [] paramClasses = encAlg.getParameterClasses(); + for (int i = 0; i < paramClasses.length; i ++) { + if ( paramClasses[i].equals( javax.crypto.spec.IvParameterSpec.class ) ) { + params = new IVParameterSpec( kg.generatePBE_IV() ); +@@ -328,7 +328,7 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { + // generate IV + EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); + AlgorithmParameterSpec params=null; +- Class [] paramClasses = pbeAlg.getParameterClasses(); ++ Class [] paramClasses = encAlg.getParameterClasses(); + for (int i = 0; i < paramClasses.length; i ++) { + if ( paramClasses[i].equals( + javax.crypto.spec.IvParameterSpec.class ) ) { +-- +2.24.1 + diff --git a/0003-Use-specified-algorithm-for-KeyWrap.patch b/0003-Use-specified-algorithm-for-KeyWrap.patch new file mode 100644 index 0000000..d75534a --- /dev/null +++ b/0003-Use-specified-algorithm-for-KeyWrap.patch @@ -0,0 +1,60 @@ +From 55482c8bfa0addeb9db7b590703ba3704c5db167 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Fri, 28 Feb 2020 14:39:29 -0500 +Subject: [PATCH 8/8] Use specified algorithm for KeyWrap + +When the token-specified from of EncryptedPrivateKeyInfo.createPBE is +called, it would always request DES3_CBC_PAD as the key wrapping +algorithm, regardless of the input PBE key type. However, the other form +(with an implicit token) was correctly handling this case. + +Introduces a new KeyWrapAlgorithm method to take an OBJECT_IDENTIFIER +instead of having to convert to/from a String form. + +Signed-off-by: Alexander Scheel +--- + org/mozilla/jss/crypto/KeyWrapAlgorithm.java | 5 ++++- + org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++-- + 2 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java +index 3113f614..3a106977 100644 +--- a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java ++++ b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java +@@ -138,7 +138,10 @@ public class KeyWrapAlgorithm extends Algorithm { + + public static KeyWrapAlgorithm fromOID(String wrapOID) throws NoSuchAlgorithmException { + OBJECT_IDENTIFIER oid = new OBJECT_IDENTIFIER(wrapOID); ++ return fromOID(oid); ++ } + ++ public static KeyWrapAlgorithm fromOID(OBJECT_IDENTIFIER oid) throws NoSuchAlgorithmException { + if (oid.equals(AES_KEY_WRAP_PAD_OID)) + return AES_KEY_WRAP_PAD; + +@@ -154,6 +157,6 @@ public class KeyWrapAlgorithm extends Algorithm { + if (oid.equals(DES_CBC_PAD_OID)) + return DES_CBC_PAD; + +- throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + wrapOID); ++ throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + oid); + } + } +diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +index ebd269f3..abfc39a7 100644 +--- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java ++++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +@@ -337,8 +337,8 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { + } + } + +- KeyWrapper wrapper = token.getKeyWrapper( +- KeyWrapAlgorithm.DES3_CBC_PAD); ++ // wrap the key ++ KeyWrapper wrapper = token.getKeyWrapper(KeyWrapAlgorithm.fromOID(encAlg.toOID())); + wrapper.initWrap(key, params); + byte encrypted[] = wrapper.wrap(pri); + +-- +2.24.1 + diff --git a/jss.spec b/jss.spec index 536e1db..da423a5 100644 --- a/jss.spec +++ b/jss.spec @@ -7,7 +7,7 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.6.2 -Release: 3%{?_timestamp}%{?_commit_id}%{?dist} +Release: 4%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 # To generate the source tarball: @@ -25,7 +25,9 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch -Patch: 0001-Fix-NativeProxy-reference-tracker.patch +Patch0: 0001-Fix-NativeProxy-reference-tracker.patch +Patch1: 0002-Fix-swapped-parameter-names-with-PBE.patch +Patch2: 0003-Use-specified-algorithm-for-KeyWrap.patch ################################################################################ # Build Dependencies @@ -160,6 +162,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Wed Mar 04 2020 Dogtag PKI Team - 4.6.2-4 +- Fix for PBE errors + * Tue Jan 28 2020 Dogtag PKI Team - 4.6.2-3 - Rebuild with new NSS to fix rhbz#1794814 From b2b801ae83ac831d771bf05124e8f14622d75fc6 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 4 Mar 2020 12:01:29 -0500 Subject: [PATCH 04/78] Add fixes for KRA issues Signed-off-by: Alexander Scheel --- ...Fix-swapped-parameter-names-with-PBE.patch | 80 +++++++++++++++++++ ...-Use-specified-algorithm-for-KeyWrap.patch | 60 ++++++++++++++ jss.spec | 9 ++- 3 files changed, 147 insertions(+), 2 deletions(-) create mode 100644 0002-Fix-swapped-parameter-names-with-PBE.patch create mode 100644 0003-Use-specified-algorithm-for-KeyWrap.patch diff --git a/0002-Fix-swapped-parameter-names-with-PBE.patch b/0002-Fix-swapped-parameter-names-with-PBE.patch new file mode 100644 index 0000000..c535f6e --- /dev/null +++ b/0002-Fix-swapped-parameter-names-with-PBE.patch @@ -0,0 +1,80 @@ +From 9f29430656342829822568f4ef49f5237b41164b Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Fri, 28 Feb 2020 14:10:32 -0500 +Subject: [PATCH 7/8] Fix swapped parameter names with PBE + +Commit 13998a9e77e60d6509ac814ed711dd21e1248ecd introduced a regression +related to extracting the parameter classes during PBE operations: +previously, the classes of the underlying encryption algorithm were +iterated over, instead of the classes of the PBE class itself. However, +this commit iterated over the PBE parameter classes; no PBE algorithm +accepts a IvParameterSpec, resulting in a null parameter passed to the +later encryption or key wrap operation. This resulted in stack traces +like the following: + +Caused by: java.security.InvalidAlgorithmParameterException: DES3/CBC/Pad cannot use a null parameter + at org.mozilla.jss.pkcs11.PK11KeyWrapper.checkParams(PK11KeyWrapper.java:225) + at org.mozilla.jss.pkcs11.PK11KeyWrapper.initWrap(PK11KeyWrapper.java:89) + at org.mozilla.jss.pkcs11.PK11KeyWrapper.initWrap(PK11KeyWrapper.java:57) + at org.mozilla.jss.pkix.primitive.EncryptedPrivateKeyInfo.createPBE(EncryptedPrivateKeyInfo.java:342) + +Resolves: rh-bz#1807371 + +Signed-off-by: Alexander Scheel +--- + org/mozilla/jss/pkcs7/EncryptedContentInfo.java | 2 +- + org/mozilla/jss/pkix/cms/EncryptedContentInfo.java | 2 +- + org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++-- + 3 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/org/mozilla/jss/pkcs7/EncryptedContentInfo.java b/org/mozilla/jss/pkcs7/EncryptedContentInfo.java +index 084752c3..0344b14d 100644 +--- a/org/mozilla/jss/pkcs7/EncryptedContentInfo.java ++++ b/org/mozilla/jss/pkcs7/EncryptedContentInfo.java +@@ -182,7 +182,7 @@ public class EncryptedContentInfo implements ASN1Value { + // generate IV + EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); + AlgorithmParameterSpec params=null; +- Class [] paramClasses = pbeAlg.getParameterClasses(); ++ Class [] paramClasses = encAlg.getParameterClasses(); + for (int i = 0; i < paramClasses.length; i ++) { + if ( paramClasses[i].equals( + javax.crypto.spec.IvParameterSpec.class ) ) { +diff --git a/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java b/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java +index a4709070..d85eb0d3 100644 +--- a/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java ++++ b/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java +@@ -180,7 +180,7 @@ public class EncryptedContentInfo implements ASN1Value { + // generate IV + EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); + AlgorithmParameterSpec params=null; +- Class [] paramClasses = pbeAlg.getParameterClasses(); ++ Class [] paramClasses = encAlg.getParameterClasses(); + for (int i = 0; i < paramClasses.length; i ++) { + if ( paramClasses[i].equals( IVParameterSpec.class ) ) { + params = new IVParameterSpec( kg.generatePBE_IV() ); +diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +index b35714e3..ebd269f3 100644 +--- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java ++++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +@@ -147,7 +147,7 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { + // generate IV + EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); + AlgorithmParameterSpec params=null; +- Class [] paramClasses = pbeAlg.getParameterClasses(); ++ Class [] paramClasses = encAlg.getParameterClasses(); + for (int i = 0; i < paramClasses.length; i ++) { + if ( paramClasses[i].equals( javax.crypto.spec.IvParameterSpec.class ) ) { + params = new IVParameterSpec( kg.generatePBE_IV() ); +@@ -328,7 +328,7 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { + // generate IV + EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); + AlgorithmParameterSpec params=null; +- Class [] paramClasses = pbeAlg.getParameterClasses(); ++ Class [] paramClasses = encAlg.getParameterClasses(); + for (int i = 0; i < paramClasses.length; i ++) { + if ( paramClasses[i].equals( + javax.crypto.spec.IvParameterSpec.class ) ) { +-- +2.24.1 + diff --git a/0003-Use-specified-algorithm-for-KeyWrap.patch b/0003-Use-specified-algorithm-for-KeyWrap.patch new file mode 100644 index 0000000..d75534a --- /dev/null +++ b/0003-Use-specified-algorithm-for-KeyWrap.patch @@ -0,0 +1,60 @@ +From 55482c8bfa0addeb9db7b590703ba3704c5db167 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Fri, 28 Feb 2020 14:39:29 -0500 +Subject: [PATCH 8/8] Use specified algorithm for KeyWrap + +When the token-specified from of EncryptedPrivateKeyInfo.createPBE is +called, it would always request DES3_CBC_PAD as the key wrapping +algorithm, regardless of the input PBE key type. However, the other form +(with an implicit token) was correctly handling this case. + +Introduces a new KeyWrapAlgorithm method to take an OBJECT_IDENTIFIER +instead of having to convert to/from a String form. + +Signed-off-by: Alexander Scheel +--- + org/mozilla/jss/crypto/KeyWrapAlgorithm.java | 5 ++++- + org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++-- + 2 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java +index 3113f614..3a106977 100644 +--- a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java ++++ b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java +@@ -138,7 +138,10 @@ public class KeyWrapAlgorithm extends Algorithm { + + public static KeyWrapAlgorithm fromOID(String wrapOID) throws NoSuchAlgorithmException { + OBJECT_IDENTIFIER oid = new OBJECT_IDENTIFIER(wrapOID); ++ return fromOID(oid); ++ } + ++ public static KeyWrapAlgorithm fromOID(OBJECT_IDENTIFIER oid) throws NoSuchAlgorithmException { + if (oid.equals(AES_KEY_WRAP_PAD_OID)) + return AES_KEY_WRAP_PAD; + +@@ -154,6 +157,6 @@ public class KeyWrapAlgorithm extends Algorithm { + if (oid.equals(DES_CBC_PAD_OID)) + return DES_CBC_PAD; + +- throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + wrapOID); ++ throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + oid); + } + } +diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +index ebd269f3..abfc39a7 100644 +--- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java ++++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +@@ -337,8 +337,8 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { + } + } + +- KeyWrapper wrapper = token.getKeyWrapper( +- KeyWrapAlgorithm.DES3_CBC_PAD); ++ // wrap the key ++ KeyWrapper wrapper = token.getKeyWrapper(KeyWrapAlgorithm.fromOID(encAlg.toOID())); + wrapper.initWrap(key, params); + byte encrypted[] = wrapper.wrap(pri); + +-- +2.24.1 + diff --git a/jss.spec b/jss.spec index 536e1db..da423a5 100644 --- a/jss.spec +++ b/jss.spec @@ -7,7 +7,7 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.6.2 -Release: 3%{?_timestamp}%{?_commit_id}%{?dist} +Release: 4%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 # To generate the source tarball: @@ -25,7 +25,9 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch -Patch: 0001-Fix-NativeProxy-reference-tracker.patch +Patch0: 0001-Fix-NativeProxy-reference-tracker.patch +Patch1: 0002-Fix-swapped-parameter-names-with-PBE.patch +Patch2: 0003-Use-specified-algorithm-for-KeyWrap.patch ################################################################################ # Build Dependencies @@ -160,6 +162,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Wed Mar 04 2020 Dogtag PKI Team - 4.6.2-4 +- Fix for PBE errors + * Tue Jan 28 2020 Dogtag PKI Team - 4.6.2-3 - Rebuild with new NSS to fix rhbz#1794814 From 53c7b90df429ae7050bab67118bf53dbfc00b016 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Thu, 5 Mar 2020 09:32:14 -0500 Subject: [PATCH 05/78] Revert "Revert "Rebase to JSS v4.6.3"" This reverts commit 3cc21a363a90b1c9ca16982b95e4295a5b6a7d70. --- .gitignore | 1 + 0001-Fix-NativeProxy-reference-tracker.patch | 53 -------------------- 0001-Fix-base64-encoding-of-CSRs.patch | 39 ++++++++++++++ jss.spec | 10 ++-- sources | 2 +- 5 files changed, 48 insertions(+), 57 deletions(-) delete mode 100644 0001-Fix-NativeProxy-reference-tracker.patch create mode 100644 0001-Fix-base64-encoding-of-CSRs.patch diff --git a/.gitignore b/.gitignore index 5981ea6..77527dc 100644 --- a/.gitignore +++ b/.gitignore @@ -23,3 +23,4 @@ jss-4.2.6.tar.gz /jss-4.5.3.tar.gz /jss-4.6.1.tar.gz /jss-4.6.2.tar.gz +/jss-4.6.3.tar.gz diff --git a/0001-Fix-NativeProxy-reference-tracker.patch b/0001-Fix-NativeProxy-reference-tracker.patch deleted file mode 100644 index 529b576..0000000 --- a/0001-Fix-NativeProxy-reference-tracker.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 91514ca0a2979ba778d27220ced0cd312e2cd2d2 Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Tue, 29 Oct 2019 10:43:56 -0400 -Subject: [PATCH] Fix NativeProxy reference tracker - -In eb5df01003d74b57473eacb84e538d31f5bb06ca, I introduced a bug by -setting mPointer after trying to add NativeProxy to the registry. In -most instances this won't matter, however, if another instance exists in -the HashSet with the same hash value, the equals comparator will be -used, triggering a NPE. - -Signed-off-by: Alexander Scheel ---- - org/mozilla/jss/util/NativeProxy.java | 13 +++++-------- - 1 file changed, 5 insertions(+), 8 deletions(-) - -diff --git a/org/mozilla/jss/util/NativeProxy.java b/org/mozilla/jss/util/NativeProxy.java -index 1c6d1aa5..a0811f76 100644 ---- a/org/mozilla/jss/util/NativeProxy.java -+++ b/org/mozilla/jss/util/NativeProxy.java -@@ -40,8 +40,8 @@ public abstract class NativeProxy implements AutoCloseable - */ - public NativeProxy(byte[] pointer) { - assert(pointer!=null); -- registry.add(this); - mPointer = pointer; -+ registry.add(this); - - if (saveStacktraces) { - mTrace = Arrays.toString(Thread.currentThread().getStackTrace()); -@@ -61,15 +61,12 @@ public abstract class NativeProxy implements AutoCloseable - if( ! (obj instanceof NativeProxy) ) { - return false; - } -- if( ((NativeProxy)obj).mPointer.length != mPointer.length) { -+ if (((NativeProxy)obj).mPointer == null) { -+ /* If mPointer is null, we have no way to compare the values -+ * of the pointers, so assume they're unequal. */ - return false; - } -- for(int i=0; i < mPointer.length; i++) { -- if(mPointer[i] != ((NativeProxy)obj).mPointer[i]) { -- return false; -- } -- } -- return true; -+ return Arrays.equals(((NativeProxy)obj).mPointer, mPointer); - } - - /** --- -2.21.0 - diff --git a/0001-Fix-base64-encoding-of-CSRs.patch b/0001-Fix-base64-encoding-of-CSRs.patch new file mode 100644 index 0000000..f898ed1 --- /dev/null +++ b/0001-Fix-base64-encoding-of-CSRs.patch @@ -0,0 +1,39 @@ +From 18efce236af6a1affebb274838318ba715114218 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Tue, 25 Feb 2020 09:14:47 -0500 +Subject: [PATCH 3/8] Fix base64-encoding of CSRs + +In 8de4440c5652f6f1af5b4b923a15730ba84f29e1, the base64 encoder was +changed from apache-commons-codec to the Java standard library to drop +a dependency. However, the behavior changed as a result: the Java +standard library doesn't include a final line separator, whereas +apache-commons-codec did. This results in malformed CSRs: + +> YWRPxyBKvFAOB29fwPwBJLZksrwQ0xAs7sooc+qF-----END NEW CERTIFICATE REQUEST----- + +Resolves: https://pagure.io/freeipa/issue/8199 + +Signed-off-by: Alexander Scheel +--- + org/mozilla/jss/netscape/security/util/Utils.java | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/org/mozilla/jss/netscape/security/util/Utils.java b/org/mozilla/jss/netscape/security/util/Utils.java +index 19f3b1f9..e6e56ce4 100644 +--- a/org/mozilla/jss/netscape/security/util/Utils.java ++++ b/org/mozilla/jss/netscape/security/util/Utils.java +@@ -378,7 +378,10 @@ public class Utils { + * @return base-64 encoded data + */ + public static String base64encodeMultiLine(byte[] bytes) { +- return Base64.getMimeEncoder().encodeToString(bytes); ++ // When switching from apache-commons-codec to the standard library, ++ // the standard library does not include a final line separator at ++ // the end of the encoded data. This results in malformed CSRs. ++ return Base64.getMimeEncoder().encodeToString(bytes) + "\r\n"; + } + + +-- +2.24.1 + diff --git a/jss.spec b/jss.spec index da423a5..2610821 100644 --- a/jss.spec +++ b/jss.spec @@ -6,8 +6,8 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.6.2 -Release: 4%{?_timestamp}%{?_commit_id}%{?dist} +Version: 4.6.3 +Release: 1%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 # To generate the source tarball: @@ -25,7 +25,7 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch -Patch0: 0001-Fix-NativeProxy-reference-tracker.patch +Patch0: 0001-Fix-base64-encoding-of-CSRs.patch Patch1: 0002-Fix-swapped-parameter-names-with-PBE.patch Patch2: 0003-Use-specified-algorithm-for-KeyWrap.patch @@ -162,6 +162,10 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Thu Mar 5 2020 Dogtag PKI Team - 4.6.3-1 +- Rebase to JSS 4.6.3 +- Fixes base64 encoding of CSRs + * Wed Mar 04 2020 Dogtag PKI Team - 4.6.2-4 - Fix for PBE errors diff --git a/sources b/sources index 32f2840..c883e35 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.6.2.tar.gz) = 53c12822b980f6dcaf5616366834fe4eaee07d84feae53096aa0ea142146e90d375910456d8192068cde5e63c3b60ded87862af50ea89c6b64224e8c105e00dd +SHA512 (jss-4.6.3.tar.gz) = 6c45b67c40737ee7bbc9ad1db8a5ed233b050697f9c048e1a49cc541de889416afd36b2c9bcdc44a52d10b0c75f036e22155a5ee95869fdf31772683637a27b1 From fa5977c0f1cfc3e047af82bac1d5a90ddd47879d Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Thu, 5 Mar 2020 10:22:02 -0500 Subject: [PATCH 06/78] Rebase to JSS v4.6.3 This cherry-picks commit 53c7b90df429ae7050bab67118bf53dbfc00b016 from master. Signed-off-by: Alexander Scheel --- .gitignore | 1 + 0001-Fix-NativeProxy-reference-tracker.patch | 53 -------------------- 0001-Fix-base64-encoding-of-CSRs.patch | 39 ++++++++++++++ jss.spec | 10 ++-- sources | 2 +- 5 files changed, 48 insertions(+), 57 deletions(-) delete mode 100644 0001-Fix-NativeProxy-reference-tracker.patch create mode 100644 0001-Fix-base64-encoding-of-CSRs.patch diff --git a/.gitignore b/.gitignore index 5981ea6..77527dc 100644 --- a/.gitignore +++ b/.gitignore @@ -23,3 +23,4 @@ jss-4.2.6.tar.gz /jss-4.5.3.tar.gz /jss-4.6.1.tar.gz /jss-4.6.2.tar.gz +/jss-4.6.3.tar.gz diff --git a/0001-Fix-NativeProxy-reference-tracker.patch b/0001-Fix-NativeProxy-reference-tracker.patch deleted file mode 100644 index 529b576..0000000 --- a/0001-Fix-NativeProxy-reference-tracker.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 91514ca0a2979ba778d27220ced0cd312e2cd2d2 Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Tue, 29 Oct 2019 10:43:56 -0400 -Subject: [PATCH] Fix NativeProxy reference tracker - -In eb5df01003d74b57473eacb84e538d31f5bb06ca, I introduced a bug by -setting mPointer after trying to add NativeProxy to the registry. In -most instances this won't matter, however, if another instance exists in -the HashSet with the same hash value, the equals comparator will be -used, triggering a NPE. - -Signed-off-by: Alexander Scheel ---- - org/mozilla/jss/util/NativeProxy.java | 13 +++++-------- - 1 file changed, 5 insertions(+), 8 deletions(-) - -diff --git a/org/mozilla/jss/util/NativeProxy.java b/org/mozilla/jss/util/NativeProxy.java -index 1c6d1aa5..a0811f76 100644 ---- a/org/mozilla/jss/util/NativeProxy.java -+++ b/org/mozilla/jss/util/NativeProxy.java -@@ -40,8 +40,8 @@ public abstract class NativeProxy implements AutoCloseable - */ - public NativeProxy(byte[] pointer) { - assert(pointer!=null); -- registry.add(this); - mPointer = pointer; -+ registry.add(this); - - if (saveStacktraces) { - mTrace = Arrays.toString(Thread.currentThread().getStackTrace()); -@@ -61,15 +61,12 @@ public abstract class NativeProxy implements AutoCloseable - if( ! (obj instanceof NativeProxy) ) { - return false; - } -- if( ((NativeProxy)obj).mPointer.length != mPointer.length) { -+ if (((NativeProxy)obj).mPointer == null) { -+ /* If mPointer is null, we have no way to compare the values -+ * of the pointers, so assume they're unequal. */ - return false; - } -- for(int i=0; i < mPointer.length; i++) { -- if(mPointer[i] != ((NativeProxy)obj).mPointer[i]) { -- return false; -- } -- } -- return true; -+ return Arrays.equals(((NativeProxy)obj).mPointer, mPointer); - } - - /** --- -2.21.0 - diff --git a/0001-Fix-base64-encoding-of-CSRs.patch b/0001-Fix-base64-encoding-of-CSRs.patch new file mode 100644 index 0000000..f898ed1 --- /dev/null +++ b/0001-Fix-base64-encoding-of-CSRs.patch @@ -0,0 +1,39 @@ +From 18efce236af6a1affebb274838318ba715114218 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Tue, 25 Feb 2020 09:14:47 -0500 +Subject: [PATCH 3/8] Fix base64-encoding of CSRs + +In 8de4440c5652f6f1af5b4b923a15730ba84f29e1, the base64 encoder was +changed from apache-commons-codec to the Java standard library to drop +a dependency. However, the behavior changed as a result: the Java +standard library doesn't include a final line separator, whereas +apache-commons-codec did. This results in malformed CSRs: + +> YWRPxyBKvFAOB29fwPwBJLZksrwQ0xAs7sooc+qF-----END NEW CERTIFICATE REQUEST----- + +Resolves: https://pagure.io/freeipa/issue/8199 + +Signed-off-by: Alexander Scheel +--- + org/mozilla/jss/netscape/security/util/Utils.java | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/org/mozilla/jss/netscape/security/util/Utils.java b/org/mozilla/jss/netscape/security/util/Utils.java +index 19f3b1f9..e6e56ce4 100644 +--- a/org/mozilla/jss/netscape/security/util/Utils.java ++++ b/org/mozilla/jss/netscape/security/util/Utils.java +@@ -378,7 +378,10 @@ public class Utils { + * @return base-64 encoded data + */ + public static String base64encodeMultiLine(byte[] bytes) { +- return Base64.getMimeEncoder().encodeToString(bytes); ++ // When switching from apache-commons-codec to the standard library, ++ // the standard library does not include a final line separator at ++ // the end of the encoded data. This results in malformed CSRs. ++ return Base64.getMimeEncoder().encodeToString(bytes) + "\r\n"; + } + + +-- +2.24.1 + diff --git a/jss.spec b/jss.spec index da423a5..2610821 100644 --- a/jss.spec +++ b/jss.spec @@ -6,8 +6,8 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.6.2 -Release: 4%{?_timestamp}%{?_commit_id}%{?dist} +Version: 4.6.3 +Release: 1%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 # To generate the source tarball: @@ -25,7 +25,7 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch -Patch0: 0001-Fix-NativeProxy-reference-tracker.patch +Patch0: 0001-Fix-base64-encoding-of-CSRs.patch Patch1: 0002-Fix-swapped-parameter-names-with-PBE.patch Patch2: 0003-Use-specified-algorithm-for-KeyWrap.patch @@ -162,6 +162,10 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Thu Mar 5 2020 Dogtag PKI Team - 4.6.3-1 +- Rebase to JSS 4.6.3 +- Fixes base64 encoding of CSRs + * Wed Mar 04 2020 Dogtag PKI Team - 4.6.2-4 - Fix for PBE errors diff --git a/sources b/sources index 32f2840..c883e35 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.6.2.tar.gz) = 53c12822b980f6dcaf5616366834fe4eaee07d84feae53096aa0ea142146e90d375910456d8192068cde5e63c3b60ded87862af50ea89c6b64224e8c105e00dd +SHA512 (jss-4.6.3.tar.gz) = 6c45b67c40737ee7bbc9ad1db8a5ed233b050697f9c048e1a49cc541de889416afd36b2c9bcdc44a52d10b0c75f036e22155a5ee95869fdf31772683637a27b1 From c7f3ad477fa72a99b17c405aa4f48bedaee4686c Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Mon, 27 Apr 2020 11:14:28 -0400 Subject: [PATCH 07/78] Rebase to upstream JSS v4.6.4 Signed-off-by: Alexander Scheel --- .gitignore | 1 + jss.spec | 9 +++++---- sources | 2 +- 3 files changed, 7 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 77527dc..6c8702e 100644 --- a/.gitignore +++ b/.gitignore @@ -24,3 +24,4 @@ jss-4.2.6.tar.gz /jss-4.6.1.tar.gz /jss-4.6.2.tar.gz /jss-4.6.3.tar.gz +/jss-4.6.4.tar.gz diff --git a/jss.spec b/jss.spec index 2610821..0920b44 100644 --- a/jss.spec +++ b/jss.spec @@ -6,7 +6,7 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.6.3 +Version: 4.6.4 Release: 1%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 @@ -25,9 +25,6 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch -Patch0: 0001-Fix-base64-encoding-of-CSRs.patch -Patch1: 0002-Fix-swapped-parameter-names-with-PBE.patch -Patch2: 0003-Use-specified-algorithm-for-KeyWrap.patch ################################################################################ # Build Dependencies @@ -162,6 +159,10 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Mon Apr 27 2020 Dogtag PKI Team - 4.6.4-1 +- Rebase to JSS 4.6.4 +- Fixes memory leak present since v4.6.2 + * Thu Mar 5 2020 Dogtag PKI Team - 4.6.3-1 - Rebase to JSS 4.6.3 - Fixes base64 encoding of CSRs diff --git a/sources b/sources index c883e35..25b6a59 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.6.3.tar.gz) = 6c45b67c40737ee7bbc9ad1db8a5ed233b050697f9c048e1a49cc541de889416afd36b2c9bcdc44a52d10b0c75f036e22155a5ee95869fdf31772683637a27b1 +SHA512 (jss-4.6.4.tar.gz) = c0adc950e1ce5e0f3d846dcb158d831575be84176ded3eec7ce3569cfd96c872a2089a2eede249c5924e1eee58d88574accd3403623910343130cf90b504b348 From f4a3a5d4cfa1020770e283a2a6a9286ad3c9324a Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Mon, 27 Apr 2020 11:15:38 -0400 Subject: [PATCH 08/78] Rebase to upstream JSS v4.6.4 Signed-off-by: Alexander Scheel --- .gitignore | 1 + jss.spec | 9 +++++---- sources | 2 +- 3 files changed, 7 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 77527dc..6c8702e 100644 --- a/.gitignore +++ b/.gitignore @@ -24,3 +24,4 @@ jss-4.2.6.tar.gz /jss-4.6.1.tar.gz /jss-4.6.2.tar.gz /jss-4.6.3.tar.gz +/jss-4.6.4.tar.gz diff --git a/jss.spec b/jss.spec index 2610821..0920b44 100644 --- a/jss.spec +++ b/jss.spec @@ -6,7 +6,7 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.6.3 +Version: 4.6.4 Release: 1%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 @@ -25,9 +25,6 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch -Patch0: 0001-Fix-base64-encoding-of-CSRs.patch -Patch1: 0002-Fix-swapped-parameter-names-with-PBE.patch -Patch2: 0003-Use-specified-algorithm-for-KeyWrap.patch ################################################################################ # Build Dependencies @@ -162,6 +159,10 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Mon Apr 27 2020 Dogtag PKI Team - 4.6.4-1 +- Rebase to JSS 4.6.4 +- Fixes memory leak present since v4.6.2 + * Thu Mar 5 2020 Dogtag PKI Team - 4.6.3-1 - Rebase to JSS 4.6.3 - Fixes base64 encoding of CSRs diff --git a/sources b/sources index c883e35..25b6a59 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.6.3.tar.gz) = 6c45b67c40737ee7bbc9ad1db8a5ed233b050697f9c048e1a49cc541de889416afd36b2c9bcdc44a52d10b0c75f036e22155a5ee95869fdf31772683637a27b1 +SHA512 (jss-4.6.4.tar.gz) = c0adc950e1ce5e0f3d846dcb158d831575be84176ded3eec7ce3569cfd96c872a2089a2eede249c5924e1eee58d88574accd3403623910343130cf90b504b348 From 03671f7edfa8387c21b348de21f7cd07346e17f8 Mon Sep 17 00:00:00 2001 From: Dinesh Prasanth M K Date: Wed, 10 Jun 2020 15:40:00 -0400 Subject: [PATCH 09/78] Rebase to latest upstream version 4.7.0-b2 Also, remove unused patch files Signed-off-by: Dinesh Prasanth M K --- .gitignore | 1 + 0001-Fix-base64-encoding-of-CSRs.patch | 39 --------- ...Fix-swapped-parameter-names-with-PBE.patch | 80 ------------------- ...-Use-specified-algorithm-for-KeyWrap.patch | 60 -------------- jss.spec | 25 +++--- sources | 2 +- 6 files changed, 17 insertions(+), 190 deletions(-) delete mode 100644 0001-Fix-base64-encoding-of-CSRs.patch delete mode 100644 0002-Fix-swapped-parameter-names-with-PBE.patch delete mode 100644 0003-Use-specified-algorithm-for-KeyWrap.patch diff --git a/.gitignore b/.gitignore index 6c8702e..de898e2 100644 --- a/.gitignore +++ b/.gitignore @@ -25,3 +25,4 @@ jss-4.2.6.tar.gz /jss-4.6.2.tar.gz /jss-4.6.3.tar.gz /jss-4.6.4.tar.gz +/jss-4.7.0-b2.tar.gz diff --git a/0001-Fix-base64-encoding-of-CSRs.patch b/0001-Fix-base64-encoding-of-CSRs.patch deleted file mode 100644 index f898ed1..0000000 --- a/0001-Fix-base64-encoding-of-CSRs.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 18efce236af6a1affebb274838318ba715114218 Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Tue, 25 Feb 2020 09:14:47 -0500 -Subject: [PATCH 3/8] Fix base64-encoding of CSRs - -In 8de4440c5652f6f1af5b4b923a15730ba84f29e1, the base64 encoder was -changed from apache-commons-codec to the Java standard library to drop -a dependency. However, the behavior changed as a result: the Java -standard library doesn't include a final line separator, whereas -apache-commons-codec did. This results in malformed CSRs: - -> YWRPxyBKvFAOB29fwPwBJLZksrwQ0xAs7sooc+qF-----END NEW CERTIFICATE REQUEST----- - -Resolves: https://pagure.io/freeipa/issue/8199 - -Signed-off-by: Alexander Scheel ---- - org/mozilla/jss/netscape/security/util/Utils.java | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/org/mozilla/jss/netscape/security/util/Utils.java b/org/mozilla/jss/netscape/security/util/Utils.java -index 19f3b1f9..e6e56ce4 100644 ---- a/org/mozilla/jss/netscape/security/util/Utils.java -+++ b/org/mozilla/jss/netscape/security/util/Utils.java -@@ -378,7 +378,10 @@ public class Utils { - * @return base-64 encoded data - */ - public static String base64encodeMultiLine(byte[] bytes) { -- return Base64.getMimeEncoder().encodeToString(bytes); -+ // When switching from apache-commons-codec to the standard library, -+ // the standard library does not include a final line separator at -+ // the end of the encoded data. This results in malformed CSRs. -+ return Base64.getMimeEncoder().encodeToString(bytes) + "\r\n"; - } - - --- -2.24.1 - diff --git a/0002-Fix-swapped-parameter-names-with-PBE.patch b/0002-Fix-swapped-parameter-names-with-PBE.patch deleted file mode 100644 index c535f6e..0000000 --- a/0002-Fix-swapped-parameter-names-with-PBE.patch +++ /dev/null @@ -1,80 +0,0 @@ -From 9f29430656342829822568f4ef49f5237b41164b Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Fri, 28 Feb 2020 14:10:32 -0500 -Subject: [PATCH 7/8] Fix swapped parameter names with PBE - -Commit 13998a9e77e60d6509ac814ed711dd21e1248ecd introduced a regression -related to extracting the parameter classes during PBE operations: -previously, the classes of the underlying encryption algorithm were -iterated over, instead of the classes of the PBE class itself. However, -this commit iterated over the PBE parameter classes; no PBE algorithm -accepts a IvParameterSpec, resulting in a null parameter passed to the -later encryption or key wrap operation. This resulted in stack traces -like the following: - -Caused by: java.security.InvalidAlgorithmParameterException: DES3/CBC/Pad cannot use a null parameter - at org.mozilla.jss.pkcs11.PK11KeyWrapper.checkParams(PK11KeyWrapper.java:225) - at org.mozilla.jss.pkcs11.PK11KeyWrapper.initWrap(PK11KeyWrapper.java:89) - at org.mozilla.jss.pkcs11.PK11KeyWrapper.initWrap(PK11KeyWrapper.java:57) - at org.mozilla.jss.pkix.primitive.EncryptedPrivateKeyInfo.createPBE(EncryptedPrivateKeyInfo.java:342) - -Resolves: rh-bz#1807371 - -Signed-off-by: Alexander Scheel ---- - org/mozilla/jss/pkcs7/EncryptedContentInfo.java | 2 +- - org/mozilla/jss/pkix/cms/EncryptedContentInfo.java | 2 +- - org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++-- - 3 files changed, 4 insertions(+), 4 deletions(-) - -diff --git a/org/mozilla/jss/pkcs7/EncryptedContentInfo.java b/org/mozilla/jss/pkcs7/EncryptedContentInfo.java -index 084752c3..0344b14d 100644 ---- a/org/mozilla/jss/pkcs7/EncryptedContentInfo.java -+++ b/org/mozilla/jss/pkcs7/EncryptedContentInfo.java -@@ -182,7 +182,7 @@ public class EncryptedContentInfo implements ASN1Value { - // generate IV - EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); - AlgorithmParameterSpec params=null; -- Class [] paramClasses = pbeAlg.getParameterClasses(); -+ Class [] paramClasses = encAlg.getParameterClasses(); - for (int i = 0; i < paramClasses.length; i ++) { - if ( paramClasses[i].equals( - javax.crypto.spec.IvParameterSpec.class ) ) { -diff --git a/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java b/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java -index a4709070..d85eb0d3 100644 ---- a/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java -+++ b/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java -@@ -180,7 +180,7 @@ public class EncryptedContentInfo implements ASN1Value { - // generate IV - EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); - AlgorithmParameterSpec params=null; -- Class [] paramClasses = pbeAlg.getParameterClasses(); -+ Class [] paramClasses = encAlg.getParameterClasses(); - for (int i = 0; i < paramClasses.length; i ++) { - if ( paramClasses[i].equals( IVParameterSpec.class ) ) { - params = new IVParameterSpec( kg.generatePBE_IV() ); -diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -index b35714e3..ebd269f3 100644 ---- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -+++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -@@ -147,7 +147,7 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { - // generate IV - EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); - AlgorithmParameterSpec params=null; -- Class [] paramClasses = pbeAlg.getParameterClasses(); -+ Class [] paramClasses = encAlg.getParameterClasses(); - for (int i = 0; i < paramClasses.length; i ++) { - if ( paramClasses[i].equals( javax.crypto.spec.IvParameterSpec.class ) ) { - params = new IVParameterSpec( kg.generatePBE_IV() ); -@@ -328,7 +328,7 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { - // generate IV - EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); - AlgorithmParameterSpec params=null; -- Class [] paramClasses = pbeAlg.getParameterClasses(); -+ Class [] paramClasses = encAlg.getParameterClasses(); - for (int i = 0; i < paramClasses.length; i ++) { - if ( paramClasses[i].equals( - javax.crypto.spec.IvParameterSpec.class ) ) { --- -2.24.1 - diff --git a/0003-Use-specified-algorithm-for-KeyWrap.patch b/0003-Use-specified-algorithm-for-KeyWrap.patch deleted file mode 100644 index d75534a..0000000 --- a/0003-Use-specified-algorithm-for-KeyWrap.patch +++ /dev/null @@ -1,60 +0,0 @@ -From 55482c8bfa0addeb9db7b590703ba3704c5db167 Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Fri, 28 Feb 2020 14:39:29 -0500 -Subject: [PATCH 8/8] Use specified algorithm for KeyWrap - -When the token-specified from of EncryptedPrivateKeyInfo.createPBE is -called, it would always request DES3_CBC_PAD as the key wrapping -algorithm, regardless of the input PBE key type. However, the other form -(with an implicit token) was correctly handling this case. - -Introduces a new KeyWrapAlgorithm method to take an OBJECT_IDENTIFIER -instead of having to convert to/from a String form. - -Signed-off-by: Alexander Scheel ---- - org/mozilla/jss/crypto/KeyWrapAlgorithm.java | 5 ++++- - org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++-- - 2 files changed, 6 insertions(+), 3 deletions(-) - -diff --git a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java -index 3113f614..3a106977 100644 ---- a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java -+++ b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java -@@ -138,7 +138,10 @@ public class KeyWrapAlgorithm extends Algorithm { - - public static KeyWrapAlgorithm fromOID(String wrapOID) throws NoSuchAlgorithmException { - OBJECT_IDENTIFIER oid = new OBJECT_IDENTIFIER(wrapOID); -+ return fromOID(oid); -+ } - -+ public static KeyWrapAlgorithm fromOID(OBJECT_IDENTIFIER oid) throws NoSuchAlgorithmException { - if (oid.equals(AES_KEY_WRAP_PAD_OID)) - return AES_KEY_WRAP_PAD; - -@@ -154,6 +157,6 @@ public class KeyWrapAlgorithm extends Algorithm { - if (oid.equals(DES_CBC_PAD_OID)) - return DES_CBC_PAD; - -- throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + wrapOID); -+ throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + oid); - } - } -diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -index ebd269f3..abfc39a7 100644 ---- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -+++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -@@ -337,8 +337,8 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { - } - } - -- KeyWrapper wrapper = token.getKeyWrapper( -- KeyWrapAlgorithm.DES3_CBC_PAD); -+ // wrap the key -+ KeyWrapper wrapper = token.getKeyWrapper(KeyWrapAlgorithm.fromOID(encAlg.toOID())); - wrapper.initWrap(key, params); - byte encrypted[] = wrapper.wrap(pri); - --- -2.24.1 - diff --git a/jss.spec b/jss.spec index 0920b44..abb49ae 100644 --- a/jss.spec +++ b/jss.spec @@ -6,9 +6,9 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.6.4 -Release: 1%{?_timestamp}%{?_commit_id}%{?dist} -# global _phase -a1 +Version: 4.7.0 +Release: 0.2%{?_timestamp}%{?_commit_id}%{?dist} +%global _phase -b2 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -34,11 +34,13 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas BuildRequires: git BuildRequires: make BuildRequires: cmake +BuildRequires: zip +BuildRequires: unzip BuildRequires: gcc-c++ BuildRequires: nspr-devel >= 4.13.1 -BuildRequires: nss-devel >= 3.30 -BuildRequires: nss-tools >= 3.30 +BuildRequires: nss-devel >= 3.44 +BuildRequires: nss-tools >= 3.44 BuildRequires: java-devel BuildRequires: jpackage-utils BuildRequires: slf4j @@ -49,11 +51,10 @@ BuildRequires: glassfish-jaxb-api BuildRequires: slf4j-jdk14 %endif BuildRequires: apache-commons-lang -BuildRequires: apache-commons-codec BuildRequires: junit -Requires: nss >= 3.30 +Requires: nss >= 3.44 Requires: java-headless Requires: jpackage-utils Requires: slf4j @@ -64,7 +65,6 @@ Requires: glassfish-jaxb-api Requires: slf4j-jdk14 %endif Requires: apache-commons-lang -Requires: apache-commons-codec Conflicts: ldapjdk < 4.20 Conflicts: idm-console-framework < 1.2 @@ -116,7 +116,7 @@ rm -rf build && mkdir -p build && cd build .. %{__make} all -%{__make} javadoc || true +%{__make} javadoc ctest --output-on-failure ################################################################################ @@ -147,7 +147,8 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} %files %defattr(-,root,root,-) -%doc jss.html MPL-1.1.txt gpl.txt lgpl.txt +%doc jss.html +%license MPL-1.1.txt gpl.txt lgpl.txt %{_libdir}/* %{_jnidir}/* @@ -159,6 +160,10 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Wed Jun 10 2020 Dogtag PKI Team - 4.7.0-0.2 +- Rebase to latest upstream JSS 4.7.0 +- JSS Provided SSLEngine + * Mon Apr 27 2020 Dogtag PKI Team - 4.6.4-1 - Rebase to JSS 4.6.4 - Fixes memory leak present since v4.6.2 diff --git a/sources b/sources index 25b6a59..eaf917e 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.6.4.tar.gz) = c0adc950e1ce5e0f3d846dcb158d831575be84176ded3eec7ce3569cfd96c872a2089a2eede249c5924e1eee58d88574accd3403623910343130cf90b504b348 +SHA512 (jss-4.7.0-b2.tar.gz) = 6bd5fd4823ea4b14bfd53dc64796b6fcb7018a6118b943b46be7a5caf874a386802f1e6e0e542743be505d73f2b9625b0f1d479b1292c7364ac62d8cee3e4e52 From 86ebf601e0cb2ddd1738395129f75a4c6475d847 Mon Sep 17 00:00:00 2001 From: Dinesh Prasanth M K Date: Wed, 10 Jun 2020 15:40:00 -0400 Subject: [PATCH 10/78] Rebase to latest upstream version 4.7.0-b2 Also, remove unused patch files Signed-off-by: Dinesh Prasanth M K --- .gitignore | 1 + 0001-Fix-base64-encoding-of-CSRs.patch | 39 --------- ...Fix-swapped-parameter-names-with-PBE.patch | 80 ------------------- ...-Use-specified-algorithm-for-KeyWrap.patch | 60 -------------- jss.spec | 25 +++--- sources | 2 +- 6 files changed, 17 insertions(+), 190 deletions(-) delete mode 100644 0001-Fix-base64-encoding-of-CSRs.patch delete mode 100644 0002-Fix-swapped-parameter-names-with-PBE.patch delete mode 100644 0003-Use-specified-algorithm-for-KeyWrap.patch diff --git a/.gitignore b/.gitignore index 6c8702e..de898e2 100644 --- a/.gitignore +++ b/.gitignore @@ -25,3 +25,4 @@ jss-4.2.6.tar.gz /jss-4.6.2.tar.gz /jss-4.6.3.tar.gz /jss-4.6.4.tar.gz +/jss-4.7.0-b2.tar.gz diff --git a/0001-Fix-base64-encoding-of-CSRs.patch b/0001-Fix-base64-encoding-of-CSRs.patch deleted file mode 100644 index f898ed1..0000000 --- a/0001-Fix-base64-encoding-of-CSRs.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 18efce236af6a1affebb274838318ba715114218 Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Tue, 25 Feb 2020 09:14:47 -0500 -Subject: [PATCH 3/8] Fix base64-encoding of CSRs - -In 8de4440c5652f6f1af5b4b923a15730ba84f29e1, the base64 encoder was -changed from apache-commons-codec to the Java standard library to drop -a dependency. However, the behavior changed as a result: the Java -standard library doesn't include a final line separator, whereas -apache-commons-codec did. This results in malformed CSRs: - -> YWRPxyBKvFAOB29fwPwBJLZksrwQ0xAs7sooc+qF-----END NEW CERTIFICATE REQUEST----- - -Resolves: https://pagure.io/freeipa/issue/8199 - -Signed-off-by: Alexander Scheel ---- - org/mozilla/jss/netscape/security/util/Utils.java | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/org/mozilla/jss/netscape/security/util/Utils.java b/org/mozilla/jss/netscape/security/util/Utils.java -index 19f3b1f9..e6e56ce4 100644 ---- a/org/mozilla/jss/netscape/security/util/Utils.java -+++ b/org/mozilla/jss/netscape/security/util/Utils.java -@@ -378,7 +378,10 @@ public class Utils { - * @return base-64 encoded data - */ - public static String base64encodeMultiLine(byte[] bytes) { -- return Base64.getMimeEncoder().encodeToString(bytes); -+ // When switching from apache-commons-codec to the standard library, -+ // the standard library does not include a final line separator at -+ // the end of the encoded data. This results in malformed CSRs. -+ return Base64.getMimeEncoder().encodeToString(bytes) + "\r\n"; - } - - --- -2.24.1 - diff --git a/0002-Fix-swapped-parameter-names-with-PBE.patch b/0002-Fix-swapped-parameter-names-with-PBE.patch deleted file mode 100644 index c535f6e..0000000 --- a/0002-Fix-swapped-parameter-names-with-PBE.patch +++ /dev/null @@ -1,80 +0,0 @@ -From 9f29430656342829822568f4ef49f5237b41164b Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Fri, 28 Feb 2020 14:10:32 -0500 -Subject: [PATCH 7/8] Fix swapped parameter names with PBE - -Commit 13998a9e77e60d6509ac814ed711dd21e1248ecd introduced a regression -related to extracting the parameter classes during PBE operations: -previously, the classes of the underlying encryption algorithm were -iterated over, instead of the classes of the PBE class itself. However, -this commit iterated over the PBE parameter classes; no PBE algorithm -accepts a IvParameterSpec, resulting in a null parameter passed to the -later encryption or key wrap operation. This resulted in stack traces -like the following: - -Caused by: java.security.InvalidAlgorithmParameterException: DES3/CBC/Pad cannot use a null parameter - at org.mozilla.jss.pkcs11.PK11KeyWrapper.checkParams(PK11KeyWrapper.java:225) - at org.mozilla.jss.pkcs11.PK11KeyWrapper.initWrap(PK11KeyWrapper.java:89) - at org.mozilla.jss.pkcs11.PK11KeyWrapper.initWrap(PK11KeyWrapper.java:57) - at org.mozilla.jss.pkix.primitive.EncryptedPrivateKeyInfo.createPBE(EncryptedPrivateKeyInfo.java:342) - -Resolves: rh-bz#1807371 - -Signed-off-by: Alexander Scheel ---- - org/mozilla/jss/pkcs7/EncryptedContentInfo.java | 2 +- - org/mozilla/jss/pkix/cms/EncryptedContentInfo.java | 2 +- - org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++-- - 3 files changed, 4 insertions(+), 4 deletions(-) - -diff --git a/org/mozilla/jss/pkcs7/EncryptedContentInfo.java b/org/mozilla/jss/pkcs7/EncryptedContentInfo.java -index 084752c3..0344b14d 100644 ---- a/org/mozilla/jss/pkcs7/EncryptedContentInfo.java -+++ b/org/mozilla/jss/pkcs7/EncryptedContentInfo.java -@@ -182,7 +182,7 @@ public class EncryptedContentInfo implements ASN1Value { - // generate IV - EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); - AlgorithmParameterSpec params=null; -- Class [] paramClasses = pbeAlg.getParameterClasses(); -+ Class [] paramClasses = encAlg.getParameterClasses(); - for (int i = 0; i < paramClasses.length; i ++) { - if ( paramClasses[i].equals( - javax.crypto.spec.IvParameterSpec.class ) ) { -diff --git a/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java b/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java -index a4709070..d85eb0d3 100644 ---- a/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java -+++ b/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java -@@ -180,7 +180,7 @@ public class EncryptedContentInfo implements ASN1Value { - // generate IV - EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); - AlgorithmParameterSpec params=null; -- Class [] paramClasses = pbeAlg.getParameterClasses(); -+ Class [] paramClasses = encAlg.getParameterClasses(); - for (int i = 0; i < paramClasses.length; i ++) { - if ( paramClasses[i].equals( IVParameterSpec.class ) ) { - params = new IVParameterSpec( kg.generatePBE_IV() ); -diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -index b35714e3..ebd269f3 100644 ---- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -+++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -@@ -147,7 +147,7 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { - // generate IV - EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); - AlgorithmParameterSpec params=null; -- Class [] paramClasses = pbeAlg.getParameterClasses(); -+ Class [] paramClasses = encAlg.getParameterClasses(); - for (int i = 0; i < paramClasses.length; i ++) { - if ( paramClasses[i].equals( javax.crypto.spec.IvParameterSpec.class ) ) { - params = new IVParameterSpec( kg.generatePBE_IV() ); -@@ -328,7 +328,7 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { - // generate IV - EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); - AlgorithmParameterSpec params=null; -- Class [] paramClasses = pbeAlg.getParameterClasses(); -+ Class [] paramClasses = encAlg.getParameterClasses(); - for (int i = 0; i < paramClasses.length; i ++) { - if ( paramClasses[i].equals( - javax.crypto.spec.IvParameterSpec.class ) ) { --- -2.24.1 - diff --git a/0003-Use-specified-algorithm-for-KeyWrap.patch b/0003-Use-specified-algorithm-for-KeyWrap.patch deleted file mode 100644 index d75534a..0000000 --- a/0003-Use-specified-algorithm-for-KeyWrap.patch +++ /dev/null @@ -1,60 +0,0 @@ -From 55482c8bfa0addeb9db7b590703ba3704c5db167 Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Fri, 28 Feb 2020 14:39:29 -0500 -Subject: [PATCH 8/8] Use specified algorithm for KeyWrap - -When the token-specified from of EncryptedPrivateKeyInfo.createPBE is -called, it would always request DES3_CBC_PAD as the key wrapping -algorithm, regardless of the input PBE key type. However, the other form -(with an implicit token) was correctly handling this case. - -Introduces a new KeyWrapAlgorithm method to take an OBJECT_IDENTIFIER -instead of having to convert to/from a String form. - -Signed-off-by: Alexander Scheel ---- - org/mozilla/jss/crypto/KeyWrapAlgorithm.java | 5 ++++- - org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++-- - 2 files changed, 6 insertions(+), 3 deletions(-) - -diff --git a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java -index 3113f614..3a106977 100644 ---- a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java -+++ b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java -@@ -138,7 +138,10 @@ public class KeyWrapAlgorithm extends Algorithm { - - public static KeyWrapAlgorithm fromOID(String wrapOID) throws NoSuchAlgorithmException { - OBJECT_IDENTIFIER oid = new OBJECT_IDENTIFIER(wrapOID); -+ return fromOID(oid); -+ } - -+ public static KeyWrapAlgorithm fromOID(OBJECT_IDENTIFIER oid) throws NoSuchAlgorithmException { - if (oid.equals(AES_KEY_WRAP_PAD_OID)) - return AES_KEY_WRAP_PAD; - -@@ -154,6 +157,6 @@ public class KeyWrapAlgorithm extends Algorithm { - if (oid.equals(DES_CBC_PAD_OID)) - return DES_CBC_PAD; - -- throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + wrapOID); -+ throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + oid); - } - } -diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -index ebd269f3..abfc39a7 100644 ---- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -+++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -@@ -337,8 +337,8 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { - } - } - -- KeyWrapper wrapper = token.getKeyWrapper( -- KeyWrapAlgorithm.DES3_CBC_PAD); -+ // wrap the key -+ KeyWrapper wrapper = token.getKeyWrapper(KeyWrapAlgorithm.fromOID(encAlg.toOID())); - wrapper.initWrap(key, params); - byte encrypted[] = wrapper.wrap(pri); - --- -2.24.1 - diff --git a/jss.spec b/jss.spec index 0920b44..abb49ae 100644 --- a/jss.spec +++ b/jss.spec @@ -6,9 +6,9 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.6.4 -Release: 1%{?_timestamp}%{?_commit_id}%{?dist} -# global _phase -a1 +Version: 4.7.0 +Release: 0.2%{?_timestamp}%{?_commit_id}%{?dist} +%global _phase -b2 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -34,11 +34,13 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas BuildRequires: git BuildRequires: make BuildRequires: cmake +BuildRequires: zip +BuildRequires: unzip BuildRequires: gcc-c++ BuildRequires: nspr-devel >= 4.13.1 -BuildRequires: nss-devel >= 3.30 -BuildRequires: nss-tools >= 3.30 +BuildRequires: nss-devel >= 3.44 +BuildRequires: nss-tools >= 3.44 BuildRequires: java-devel BuildRequires: jpackage-utils BuildRequires: slf4j @@ -49,11 +51,10 @@ BuildRequires: glassfish-jaxb-api BuildRequires: slf4j-jdk14 %endif BuildRequires: apache-commons-lang -BuildRequires: apache-commons-codec BuildRequires: junit -Requires: nss >= 3.30 +Requires: nss >= 3.44 Requires: java-headless Requires: jpackage-utils Requires: slf4j @@ -64,7 +65,6 @@ Requires: glassfish-jaxb-api Requires: slf4j-jdk14 %endif Requires: apache-commons-lang -Requires: apache-commons-codec Conflicts: ldapjdk < 4.20 Conflicts: idm-console-framework < 1.2 @@ -116,7 +116,7 @@ rm -rf build && mkdir -p build && cd build .. %{__make} all -%{__make} javadoc || true +%{__make} javadoc ctest --output-on-failure ################################################################################ @@ -147,7 +147,8 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} %files %defattr(-,root,root,-) -%doc jss.html MPL-1.1.txt gpl.txt lgpl.txt +%doc jss.html +%license MPL-1.1.txt gpl.txt lgpl.txt %{_libdir}/* %{_jnidir}/* @@ -159,6 +160,10 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Wed Jun 10 2020 Dogtag PKI Team - 4.7.0-0.2 +- Rebase to latest upstream JSS 4.7.0 +- JSS Provided SSLEngine + * Mon Apr 27 2020 Dogtag PKI Team - 4.6.4-1 - Rebase to JSS 4.6.4 - Fixes memory leak present since v4.6.2 diff --git a/sources b/sources index 25b6a59..eaf917e 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.6.4.tar.gz) = c0adc950e1ce5e0f3d846dcb158d831575be84176ded3eec7ce3569cfd96c872a2089a2eede249c5924e1eee58d88574accd3403623910343130cf90b504b348 +SHA512 (jss-4.7.0-b2.tar.gz) = 6bd5fd4823ea4b14bfd53dc64796b6fcb7018a6118b943b46be7a5caf874a386802f1e6e0e542743be505d73f2b9625b0f1d479b1292c7364ac62d8cee3e4e52 From 90b6186a2b3a6a1385fd372f1eb243f016bd0d9c Mon Sep 17 00:00:00 2001 From: Dinesh Prasanth M K Date: Tue, 30 Jun 2020 17:11:55 -0400 Subject: [PATCH 11/78] Rebased to upstream JSS v4.7.0-b4 --- .gitignore | 1 + jss.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index de898e2..87c5030 100644 --- a/.gitignore +++ b/.gitignore @@ -26,3 +26,4 @@ jss-4.2.6.tar.gz /jss-4.6.3.tar.gz /jss-4.6.4.tar.gz /jss-4.7.0-b2.tar.gz +/jss-4.7.0-b4.tar.gz diff --git a/jss.spec b/jss.spec index abb49ae..554fecc 100644 --- a/jss.spec +++ b/jss.spec @@ -7,8 +7,8 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.7.0 -Release: 0.2%{?_timestamp}%{?_commit_id}%{?dist} -%global _phase -b2 +Release: 0.4%{?_timestamp}%{?_commit_id}%{?dist} +%global _phase -b4 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -160,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Tue Jun 30 2020 Dogtag PKI Team - 4.7.0-0.4 +- Rebase to latest upstream JSS v4.7.0-b4 + * Wed Jun 10 2020 Dogtag PKI Team - 4.7.0-0.2 - Rebase to latest upstream JSS 4.7.0 - JSS Provided SSLEngine diff --git a/sources b/sources index eaf917e..eae7417 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.7.0-b2.tar.gz) = 6bd5fd4823ea4b14bfd53dc64796b6fcb7018a6118b943b46be7a5caf874a386802f1e6e0e542743be505d73f2b9625b0f1d479b1292c7364ac62d8cee3e4e52 +SHA512 (jss-4.7.0-b4.tar.gz) = 79c01fc513de479a63cbe164c772f9f685afe032a280f59eb3bb096a653424b3df1a9403c8cf443ffbe8b9a1d97a8aeb48064fbbe92e4c12e29767fb2a547d9f From 4bc20121ec55a9d9e094aa5cce3c937797f57a8c Mon Sep 17 00:00:00 2001 From: Dinesh Prasanth M K Date: Tue, 30 Jun 2020 17:11:55 -0400 Subject: [PATCH 12/78] Rebased to upstream JSS v4.7.0-b4 --- .gitignore | 1 + jss.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index de898e2..87c5030 100644 --- a/.gitignore +++ b/.gitignore @@ -26,3 +26,4 @@ jss-4.2.6.tar.gz /jss-4.6.3.tar.gz /jss-4.6.4.tar.gz /jss-4.7.0-b2.tar.gz +/jss-4.7.0-b4.tar.gz diff --git a/jss.spec b/jss.spec index abb49ae..554fecc 100644 --- a/jss.spec +++ b/jss.spec @@ -7,8 +7,8 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.7.0 -Release: 0.2%{?_timestamp}%{?_commit_id}%{?dist} -%global _phase -b2 +Release: 0.4%{?_timestamp}%{?_commit_id}%{?dist} +%global _phase -b4 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -160,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Tue Jun 30 2020 Dogtag PKI Team - 4.7.0-0.4 +- Rebase to latest upstream JSS v4.7.0-b4 + * Wed Jun 10 2020 Dogtag PKI Team - 4.7.0-0.2 - Rebase to latest upstream JSS 4.7.0 - JSS Provided SSLEngine diff --git a/sources b/sources index eaf917e..eae7417 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.7.0-b2.tar.gz) = 6bd5fd4823ea4b14bfd53dc64796b6fcb7018a6118b943b46be7a5caf874a386802f1e6e0e542743be505d73f2b9625b0f1d479b1292c7364ac62d8cee3e4e52 +SHA512 (jss-4.7.0-b4.tar.gz) = 79c01fc513de479a63cbe164c772f9f685afe032a280f59eb3bb096a653424b3df1a9403c8cf443ffbe8b9a1d97a8aeb48064fbbe92e4c12e29767fb2a547d9f From 77453bee29456db4d5a7132dae0cac6aae12df11 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Mon, 6 Jul 2020 17:34:31 -0400 Subject: [PATCH 13/78] Fix build with new Crypto-Policies on Fedora Rawhide Signed-off-by: Alexander Scheel --- jss-crypto-policies-1.patch | 49 +++++++++++++++++++++++++++++++++++++ jss-crypto-policies-2.patch | 47 +++++++++++++++++++++++++++++++++++ jss.spec | 7 +++++- 3 files changed, 102 insertions(+), 1 deletion(-) create mode 100644 jss-crypto-policies-1.patch create mode 100644 jss-crypto-policies-2.patch diff --git a/jss-crypto-policies-1.patch b/jss-crypto-policies-1.patch new file mode 100644 index 0000000..dc23e85 --- /dev/null +++ b/jss-crypto-policies-1.patch @@ -0,0 +1,49 @@ +From 1fb6097a2ab73ef897d011e7383d7f5f1bf6a1df Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Wed, 1 Jul 2020 12:41:20 -0400 +Subject: [PATCH] Replace SHA-1 signature with SHA-256 + +A recent change in Fedora Rawhide's crypto-policies package caused +failures in the tests like the following: + + Exception in thread "main" java.io.IOException: SocketException cannot read on socket: Error reading from socket: (-12271) SSL peer cannot verify your certificate. + at org.mozilla.jss.ssl.SSLSocket.read(SSLSocket.java:1494) + at org.mozilla.jss.ssl.SSLInputStream.read(SSLInputStream.java:38) + at org.mozilla.jss.ssl.SSLInputStream.read(SSLInputStream.java:25) + at org.mozilla.jss.tests.SSLClientAuth.run(SSLClientAuth.java:435) + at java.lang.Thread.run(Thread.java:748) + Caused by: org.mozilla.jss.ssl.SSLSocketException: Error reading from socket: (-12271) SSL peer cannot verify your certificate. + at org.mozilla.jss.ssl.SSLSocket.socketRead(Native Method) + at org.mozilla.jss.ssl.SSLSocket.read(SSLSocket.java:1488) + ... 4 more + Server exiting + org.mozilla.jss.ssl.SSLSocketException: SSL_ForceHandshake failed: (-8016) Unknown error + at org.mozilla.jss.ssl.SSLSocket.forceHandshake(Native Method) + at org.mozilla.jss.tests.SSLClientAuth.testConnection(SSLClientAuth.java:345) + at org.mozilla.jss.tests.SSLClientAuth.doIt(SSLClientAuth.java:156) + at org.mozilla.jss.tests.SSLClientAuth.main(SSLClientAuth.java:90) + +This was caused by dropping SHA-1 as an allowed hash during handshakes. +However, because SSLClientAuth manually generated its certificate (and +explicitly asked for SHA-1), it failed. + +Switch to SHA-256 instead. + +Signed-off-by: Alexander Scheel +--- + org/mozilla/jss/tests/SSLClientAuth.java | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/org/mozilla/jss/tests/SSLClientAuth.java b/org/mozilla/jss/tests/SSLClientAuth.java +index 6f1fd2b12..bf270a634 100644 +--- a/org/mozilla/jss/tests/SSLClientAuth.java ++++ b/org/mozilla/jss/tests/SSLClientAuth.java +@@ -28,7 +28,7 @@ + + private CryptoManager cm; + public static final SignatureAlgorithm sigAlg = +- SignatureAlgorithm.RSASignatureWithSHA1Digest; ++ SignatureAlgorithm.RSASignatureWithSHA256Digest; + + /** + * Method that generates a certificate for given credential diff --git a/jss-crypto-policies-2.patch b/jss-crypto-policies-2.patch new file mode 100644 index 0000000..71fe8c2 --- /dev/null +++ b/jss-crypto-policies-2.patch @@ -0,0 +1,47 @@ +From 8ed5a82a973922d07d0610fd42c48b2a0ec97d6c Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Wed, 1 Jul 2020 12:44:53 -0400 +Subject: [PATCH] Remove all legacy DSS/DSA tests + +The only signature algorithm suppoted with DSS is SHA-1, which will soon +become deprecated and broken. DSS itself isn't widely used either, so we +should remove it from the test suite as well. + +Signed-off-by: Alexander Scheel +--- + cmake/JSSTests.cmake | 12 +----------- + 1 file changed, 1 insertion(+), 11 deletions(-) + +diff --git a/cmake/JSSTests.cmake b/cmake/JSSTests.cmake +index a26b95425..a0fe36e22 100644 +--- a/cmake/JSSTests.cmake ++++ b/cmake/JSSTests.cmake +@@ -170,11 +170,6 @@ macro(jss_tests) + COMMAND "org.mozilla.jss.tests.GenerateTestCert" "${RESULTS_NSSDB_OUTPUT_DIR}" "${PASSWORD_FILE}" "30" "localhost" "SHA-256/EC" "CA_ECDSA" "Server_ECDSA" "Client_ECDSA" + DEPENDS "Generate_known_RSA_cert_pair" + ) +- jss_test_java( +- NAME "Generate_known_DSS_cert_pair" +- COMMAND "org.mozilla.jss.tests.GenerateTestCert" "${RESULTS_NSSDB_OUTPUT_DIR}" "${PASSWORD_FILE}" "40" "localhost" "SHA-1/DSA" "CA_DSS" "Server_DSS" "Client_DSS" +- DEPENDS "Generate_known_ECDSA_cert_pair" +- ) + jss_test_exec( + NAME "Create_PKCS11_cert_to_PKCS12_rsa.pfx" + COMMAND "pk12util" "-o" "${RESULTS_NSSDB_OUTPUT_DIR}/rsa.pfx" "-n" "CA_RSA" "-d" "${RESULTS_NSSDB_OUTPUT_DIR}" "-K" "${DB_PWD}" "-W" "${DB_PWD}" +@@ -185,15 +180,10 @@ macro(jss_tests) + COMMAND "pk12util" "-o" "${RESULTS_NSSDB_OUTPUT_DIR}/ecdsa.pfx" "-n" "CA_ECDSA" "-d" "${RESULTS_NSSDB_OUTPUT_DIR}" "-K" "${DB_PWD}" "-W" "${DB_PWD}" + DEPENDS "Generate_known_ECDSA_cert_pair" + ) +- jss_test_exec( +- NAME "Create_PKCS11_cert_to_PKCS12_dss.pfx" +- COMMAND "pk12util" "-o" "${RESULTS_NSSDB_OUTPUT_DIR}/dss.pfx" "-n" "CA_DSS" "-d" "${RESULTS_NSSDB_OUTPUT_DIR}" "-K" "${DB_PWD}" "-W" "${DB_PWD}" +- DEPENDS "Generate_known_DSS_cert_pair" +- ) + jss_test_java( + NAME "List_CA_certs" + COMMAND "org.mozilla.jss.tests.ListCACerts" "${RESULTS_NSSDB_OUTPUT_DIR}" "Verbose" +- DEPENDS "Generate_known_DSS_cert_pair" ++ DEPENDS "Generate_known_ECDSA_cert_pair" + ) + jss_test_java( + NAME "SSLClientAuth" diff --git a/jss.spec b/jss.spec index 554fecc..244ef1d 100644 --- a/jss.spec +++ b/jss.spec @@ -7,7 +7,7 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.7.0 -Release: 0.4%{?_timestamp}%{?_commit_id}%{?dist} +Release: 0.5%{?_timestamp}%{?_commit_id}%{?dist} %global _phase -b4 # To generate the source tarball: @@ -25,6 +25,8 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch +Patch0: jss-crypto-policies-1.patch +Patch1: jss-crypto-policies-2.patch ################################################################################ # Build Dependencies @@ -160,6 +162,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Mon Jul 06 2020 Dogtag PKI Team - 4.7.0-0.5 +- Fix build issues with new Crypto-Policies denying SHA-1 usage + * Tue Jun 30 2020 Dogtag PKI Team - 4.7.0-0.4 - Rebase to latest upstream JSS v4.7.0-b4 From af8114637b7efc2e7a37bbb970916cd8d02b2f3b Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Thu, 9 Jul 2020 12:55:29 -0400 Subject: [PATCH 14/78] Update to stable v4.7.0 release Signed-off-by: Alexander Scheel --- .gitignore | 1 + jss.spec | 9 +++++---- sources | 2 +- 3 files changed, 7 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 87c5030..a9ae250 100644 --- a/.gitignore +++ b/.gitignore @@ -27,3 +27,4 @@ jss-4.2.6.tar.gz /jss-4.6.4.tar.gz /jss-4.7.0-b2.tar.gz /jss-4.7.0-b4.tar.gz +/jss-4.7.0.tar.gz diff --git a/jss.spec b/jss.spec index 244ef1d..9eb1987 100644 --- a/jss.spec +++ b/jss.spec @@ -7,8 +7,8 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.7.0 -Release: 0.5%{?_timestamp}%{?_commit_id}%{?dist} -%global _phase -b4 +Release: 1%{?_timestamp}%{?_commit_id}%{?dist} +#global _phase -a1 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -25,8 +25,6 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch -Patch0: jss-crypto-policies-1.patch -Patch1: jss-crypto-policies-2.patch ################################################################################ # Build Dependencies @@ -162,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Thu Jul 09 2020 Dogtag PKI Team - 4.7.0-1 +- Rebase to upstream stable release JSS v4.7.0 + * Mon Jul 06 2020 Dogtag PKI Team - 4.7.0-0.5 - Fix build issues with new Crypto-Policies denying SHA-1 usage diff --git a/sources b/sources index eae7417..7f6e516 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.7.0-b4.tar.gz) = 79c01fc513de479a63cbe164c772f9f685afe032a280f59eb3bb096a653424b3df1a9403c8cf443ffbe8b9a1d97a8aeb48064fbbe92e4c12e29767fb2a547d9f +SHA512 (jss-4.7.0.tar.gz) = 91a6bbc2c9dde436fd07e2f2bf9e71bd0a40c643547f41a95152a51200d126a37e2e580ef78d9075dc349f5dfe613b04eaf2a32009da13889e824ee9db255a43 From b9ae07f554b4eab72feca6711dd4ae527b028102 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Thu, 9 Jul 2020 12:55:29 -0400 Subject: [PATCH 15/78] Update to stable v4.7.0 release Signed-off-by: Alexander Scheel --- .gitignore | 1 + jss.spec | 8 ++++++++ sources | 2 +- 3 files changed, 10 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 87c5030..a9ae250 100644 --- a/.gitignore +++ b/.gitignore @@ -27,3 +27,4 @@ jss-4.2.6.tar.gz /jss-4.6.4.tar.gz /jss-4.7.0-b2.tar.gz /jss-4.7.0-b4.tar.gz +/jss-4.7.0.tar.gz diff --git a/jss.spec b/jss.spec index 554fecc..dc4d474 100644 --- a/jss.spec +++ b/jss.spec @@ -7,8 +7,13 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.7.0 +<<<<<<< HEAD Release: 0.4%{?_timestamp}%{?_commit_id}%{?dist} %global _phase -b4 +======= +Release: 1%{?_timestamp}%{?_commit_id}%{?dist} +#global _phase -a1 +>>>>>>> af81146... Update to stable v4.7.0 release # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -160,6 +165,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Thu Jul 09 2020 Dogtag PKI Team - 4.7.0-1 +- Rebase to upstream stable release JSS v4.7.0 + * Tue Jun 30 2020 Dogtag PKI Team - 4.7.0-0.4 - Rebase to latest upstream JSS v4.7.0-b4 diff --git a/sources b/sources index eae7417..7f6e516 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.7.0-b4.tar.gz) = 79c01fc513de479a63cbe164c772f9f685afe032a280f59eb3bb096a653424b3df1a9403c8cf443ffbe8b9a1d97a8aeb48064fbbe92e4c12e29767fb2a547d9f +SHA512 (jss-4.7.0.tar.gz) = 91a6bbc2c9dde436fd07e2f2bf9e71bd0a40c643547f41a95152a51200d126a37e2e580ef78d9075dc349f5dfe613b04eaf2a32009da13889e824ee9db255a43 From 6e8a9678497dd1f7deb5e2e0eea711630f5ea0cb Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Thu, 9 Jul 2020 12:58:48 -0400 Subject: [PATCH 16/78] Fix merge conflict Signed-off-by: Alexander Scheel --- jss.spec | 5 ----- 1 file changed, 5 deletions(-) diff --git a/jss.spec b/jss.spec index dc4d474..1d833f4 100644 --- a/jss.spec +++ b/jss.spec @@ -7,13 +7,8 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.7.0 -<<<<<<< HEAD -Release: 0.4%{?_timestamp}%{?_commit_id}%{?dist} -%global _phase -b4 -======= Release: 1%{?_timestamp}%{?_commit_id}%{?dist} #global _phase -a1 ->>>>>>> af81146... Update to stable v4.7.0 release # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git From b90185b8b6c5819cf303394d3e8fccf08502ae36 Mon Sep 17 00:00:00 2001 From: Jiri Date: Sat, 11 Jul 2020 01:22:04 +0200 Subject: [PATCH 17/78] Rebuilt for JDK-11 --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index 9eb1987..e9c8c56 100644 --- a/jss.spec +++ b/jss.spec @@ -7,7 +7,7 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.7.0 -Release: 1%{?_timestamp}%{?_commit_id}%{?dist} +Release: 2%{?_timestamp}%{?_commit_id}%{?dist} #global _phase -a1 # To generate the source tarball: @@ -160,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Fri Jul 10 2020 Jiri Vanek - 4.7.0-2 +- Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 + * Thu Jul 09 2020 Dogtag PKI Team - 4.7.0-1 - Rebase to upstream stable release JSS v4.7.0 From 47dd782c32182adb9c910b41e3af18240924e8ab Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Tue, 28 Jul 2020 02:36:22 +0000 Subject: [PATCH 18/78] - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index e9c8c56..2860899 100644 --- a/jss.spec +++ b/jss.spec @@ -7,7 +7,7 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.7.0 -Release: 2%{?_timestamp}%{?_commit_id}%{?dist} +Release: 3%{?_timestamp}%{?_commit_id}%{?dist} #global _phase -a1 # To generate the source tarball: @@ -160,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Tue Jul 28 2020 Fedora Release Engineering - 4.7.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + * Fri Jul 10 2020 Jiri Vanek - 4.7.0-2 - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 From 382e5071a5d6678c87a7cee092c3d3a33ca0aa56 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 1 Aug 2020 03:41:25 +0000 Subject: [PATCH 19/78] - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- jss.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index 2860899..93db0ad 100644 --- a/jss.spec +++ b/jss.spec @@ -7,7 +7,7 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.7.0 -Release: 3%{?_timestamp}%{?_commit_id}%{?dist} +Release: 4%{?_timestamp}%{?_commit_id}%{?dist} #global _phase -a1 # To generate the source tarball: @@ -160,6 +160,10 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Sat Aug 01 2020 Fedora Release Engineering - 4.7.0-4 +- Second attempt - Rebuilt for + https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + * Tue Jul 28 2020 Fedora Release Engineering - 4.7.0-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild From 1aaa1081587204a36830513aaf32cc6ed154cf1d Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Tue, 18 Aug 2020 13:56:49 -0400 Subject: [PATCH 20/78] Rebase to JSS v4.7.2 Signed-off-by: Alexander Scheel --- .gitignore | 1 + jss.spec | 17 ++++++++++------- sources | 2 +- 3 files changed, 12 insertions(+), 8 deletions(-) diff --git a/.gitignore b/.gitignore index a9ae250..d7eb920 100644 --- a/.gitignore +++ b/.gitignore @@ -28,3 +28,4 @@ jss-4.2.6.tar.gz /jss-4.7.0-b2.tar.gz /jss-4.7.0-b4.tar.gz /jss-4.7.0.tar.gz +/jss-4.7.2.tar.gz diff --git a/jss.spec b/jss.spec index 93db0ad..2b099c7 100644 --- a/jss.spec +++ b/jss.spec @@ -6,8 +6,8 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.7.0 -Release: 4%{?_timestamp}%{?_commit_id}%{?dist} +Version: 4.7.2 +Release: 1%{?_timestamp}%{?_commit_id}%{?dist} #global _phase -a1 # To generate the source tarball: @@ -109,12 +109,12 @@ export CFLAGS modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENABLED=1 # The Makefile is not thread-safe -rm -rf build && mkdir -p build && cd build %cmake \ -DJAVA_HOME=%{java_home} \ -DJAVA_LIB_INSTALL_DIR=%{_jnidir} \ - .. + -B %{_vpath_builddir} +cd %{_vpath_builddir} %{__make} all %{__make} javadoc ctest --output-on-failure @@ -126,19 +126,19 @@ ctest --output-on-failure # jars install -d -m 0755 $RPM_BUILD_ROOT%{_jnidir} -install -m 644 build/jss4.jar ${RPM_BUILD_ROOT}%{_jnidir}/jss4.jar +install -m 644 %{_vpath_builddir}/jss4.jar ${RPM_BUILD_ROOT}%{_jnidir}/jss4.jar # We have to use the name libjss4.so because this is dynamically # loaded by the jar file. install -d -m 0755 $RPM_BUILD_ROOT%{_libdir}/jss -install -m 0755 build/libjss4.so ${RPM_BUILD_ROOT}%{_libdir}/jss/ +install -m 0755 %{_vpath_builddir}/libjss4.so ${RPM_BUILD_ROOT}%{_libdir}/jss/ pushd ${RPM_BUILD_ROOT}%{_libdir}/jss ln -fs %{_jnidir}/jss4.jar jss4.jar popd # javadoc install -d -m 0755 $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} -cp -rp build/docs/* $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} +cp -rp %{_vpath_builddir}/docs/* $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} cp -p jss.html $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} @@ -160,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Tue Aug 18 2020 Dogtag PKI Team - 4.7.2-1 +- Rebase to upstream stable release JSS v4.7.2 ; fixes FTBFS + * Sat Aug 01 2020 Fedora Release Engineering - 4.7.0-4 - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild diff --git a/sources b/sources index 7f6e516..1f22225 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.7.0.tar.gz) = 91a6bbc2c9dde436fd07e2f2bf9e71bd0a40c643547f41a95152a51200d126a37e2e580ef78d9075dc349f5dfe613b04eaf2a32009da13889e824ee9db255a43 +SHA512 (jss-4.7.2.tar.gz) = 171b4c341b56c49eaedf0663cee7c949bd91f070781debc80b7b74f85eeacc5e4092cc5ab8eb3ace926493a7ea64d08c5c7a614dccd2e479f8b371b6075d6594 From 7a460bc5961fe67fe5312ca45d51440165bea7f5 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Tue, 18 Aug 2020 13:56:49 -0400 Subject: [PATCH 21/78] Rebase to JSS v4.7.2 Signed-off-by: Alexander Scheel --- .gitignore | 1 + jss.spec | 15 +++++++++------ sources | 2 +- 3 files changed, 11 insertions(+), 7 deletions(-) diff --git a/.gitignore b/.gitignore index a9ae250..d7eb920 100644 --- a/.gitignore +++ b/.gitignore @@ -28,3 +28,4 @@ jss-4.2.6.tar.gz /jss-4.7.0-b2.tar.gz /jss-4.7.0-b4.tar.gz /jss-4.7.0.tar.gz +/jss-4.7.2.tar.gz diff --git a/jss.spec b/jss.spec index 1d833f4..8a33927 100644 --- a/jss.spec +++ b/jss.spec @@ -6,7 +6,7 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.7.0 +Version: 4.7.2 Release: 1%{?_timestamp}%{?_commit_id}%{?dist} #global _phase -a1 @@ -109,12 +109,12 @@ export CFLAGS modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENABLED=1 # The Makefile is not thread-safe -rm -rf build && mkdir -p build && cd build %cmake \ -DJAVA_HOME=%{java_home} \ -DJAVA_LIB_INSTALL_DIR=%{_jnidir} \ - .. + -B %{_vpath_builddir} +cd %{_vpath_builddir} %{__make} all %{__make} javadoc ctest --output-on-failure @@ -126,19 +126,19 @@ ctest --output-on-failure # jars install -d -m 0755 $RPM_BUILD_ROOT%{_jnidir} -install -m 644 build/jss4.jar ${RPM_BUILD_ROOT}%{_jnidir}/jss4.jar +install -m 644 %{_vpath_builddir}/jss4.jar ${RPM_BUILD_ROOT}%{_jnidir}/jss4.jar # We have to use the name libjss4.so because this is dynamically # loaded by the jar file. install -d -m 0755 $RPM_BUILD_ROOT%{_libdir}/jss -install -m 0755 build/libjss4.so ${RPM_BUILD_ROOT}%{_libdir}/jss/ +install -m 0755 %{_vpath_builddir}/libjss4.so ${RPM_BUILD_ROOT}%{_libdir}/jss/ pushd ${RPM_BUILD_ROOT}%{_libdir}/jss ln -fs %{_jnidir}/jss4.jar jss4.jar popd # javadoc install -d -m 0755 $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} -cp -rp build/docs/* $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} +cp -rp %{_vpath_builddir}/docs/* $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} cp -p jss.html $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} @@ -160,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Tue Aug 18 2020 Dogtag PKI Team - 4.7.2-1 +- Rebase to upstream stable release JSS v4.7.2 ; fixes FTBFS + * Thu Jul 09 2020 Dogtag PKI Team - 4.7.0-1 - Rebase to upstream stable release JSS v4.7.0 diff --git a/sources b/sources index 7f6e516..1f22225 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.7.0.tar.gz) = 91a6bbc2c9dde436fd07e2f2bf9e71bd0a40c643547f41a95152a51200d126a37e2e580ef78d9075dc349f5dfe613b04eaf2a32009da13889e824ee9db255a43 +SHA512 (jss-4.7.2.tar.gz) = 171b4c341b56c49eaedf0663cee7c949bd91f070781debc80b7b74f85eeacc5e4092cc5ab8eb3ace926493a7ea64d08c5c7a614dccd2e479f8b371b6075d6594 From 8d0f659a7b9ac2d0ee7ab02be0de758a28f0b46a Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Fri, 11 Sep 2020 16:48:33 -0400 Subject: [PATCH 22/78] Rebase to JSS v4.7.3 Signed-off-by: Alexander Scheel --- .gitignore | 1 + jss.spec | 18 +++++++++++++++++- sources | 2 +- 3 files changed, 19 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index d7eb920..349bfb5 100644 --- a/.gitignore +++ b/.gitignore @@ -29,3 +29,4 @@ jss-4.2.6.tar.gz /jss-4.7.0-b4.tar.gz /jss-4.7.0.tar.gz /jss-4.7.2.tar.gz +/jss-4.7.3.tar.gz diff --git a/jss.spec b/jss.spec index 2b099c7..401fe38 100644 --- a/jss.spec +++ b/jss.spec @@ -6,7 +6,7 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.7.2 +Version: 4.7.3 Release: 1%{?_timestamp}%{?_commit_id}%{?dist} #global _phase -a1 @@ -108,13 +108,26 @@ export CFLAGS # Check if we're in FIPS mode modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENABLED=1 +# RHEL's CMake doesn't support -B flag. +%if 0%{?rhel} +%{__mkdir_p} %{_vpath_builddir} +cd %{_vpath_builddir} +%endif + # The Makefile is not thread-safe %cmake \ -DJAVA_HOME=%{java_home} \ -DJAVA_LIB_INSTALL_DIR=%{_jnidir} \ +%if 0%{?rhel} + .. +%else -B %{_vpath_builddir} +%endif +%if 0%{?fedora} cd %{_vpath_builddir} +%endif + %{__make} all %{__make} javadoc ctest --output-on-failure @@ -160,6 +173,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Fri Sep 11 2020 Dogtag PKI Team - 4.7.3-1 +- Rebase to upstream stable release JSS v4.7.3 + * Tue Aug 18 2020 Dogtag PKI Team - 4.7.2-1 - Rebase to upstream stable release JSS v4.7.2 ; fixes FTBFS diff --git a/sources b/sources index 1f22225..13d43e8 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.7.2.tar.gz) = 171b4c341b56c49eaedf0663cee7c949bd91f070781debc80b7b74f85eeacc5e4092cc5ab8eb3ace926493a7ea64d08c5c7a614dccd2e479f8b371b6075d6594 +SHA512 (jss-4.7.3.tar.gz) = 9358cf78d99e5e32a07dd457d6b0c916bdf9bf6959efe889f1cb91af75aa79fc419c2d057a40bfbe4e2a4924bffc1cafa04d917622cafe07062bcb633f330f98 From 2da11d9b9f943bb01c356ce68b971695d01a208b Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Fri, 11 Sep 2020 16:48:33 -0400 Subject: [PATCH 23/78] Rebase to JSS v4.7.3 Signed-off-by: Alexander Scheel --- .gitignore | 1 + jss.spec | 18 +++++++++++++++++- sources | 2 +- 3 files changed, 19 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index d7eb920..349bfb5 100644 --- a/.gitignore +++ b/.gitignore @@ -29,3 +29,4 @@ jss-4.2.6.tar.gz /jss-4.7.0-b4.tar.gz /jss-4.7.0.tar.gz /jss-4.7.2.tar.gz +/jss-4.7.3.tar.gz diff --git a/jss.spec b/jss.spec index 8a33927..de4fb2c 100644 --- a/jss.spec +++ b/jss.spec @@ -6,7 +6,7 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.7.2 +Version: 4.7.3 Release: 1%{?_timestamp}%{?_commit_id}%{?dist} #global _phase -a1 @@ -108,13 +108,26 @@ export CFLAGS # Check if we're in FIPS mode modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENABLED=1 +# RHEL's CMake doesn't support -B flag. +%if 0%{?rhel} +%{__mkdir_p} %{_vpath_builddir} +cd %{_vpath_builddir} +%endif + # The Makefile is not thread-safe %cmake \ -DJAVA_HOME=%{java_home} \ -DJAVA_LIB_INSTALL_DIR=%{_jnidir} \ +%if 0%{?rhel} + .. +%else -B %{_vpath_builddir} +%endif +%if 0%{?fedora} cd %{_vpath_builddir} +%endif + %{__make} all %{__make} javadoc ctest --output-on-failure @@ -160,6 +173,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Fri Sep 11 2020 Dogtag PKI Team - 4.7.3-1 +- Rebase to upstream stable release JSS v4.7.3 + * Tue Aug 18 2020 Dogtag PKI Team - 4.7.2-1 - Rebase to upstream stable release JSS v4.7.2 ; fixes FTBFS diff --git a/sources b/sources index 1f22225..13d43e8 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.7.2.tar.gz) = 171b4c341b56c49eaedf0663cee7c949bd91f070781debc80b7b74f85eeacc5e4092cc5ab8eb3ace926493a7ea64d08c5c7a614dccd2e479f8b371b6075d6594 +SHA512 (jss-4.7.3.tar.gz) = 9358cf78d99e5e32a07dd457d6b0c916bdf9bf6959efe889f1cb91af75aa79fc419c2d057a40bfbe4e2a4924bffc1cafa04d917622cafe07062bcb633f330f98 From 89bcbe8882b72b2957680ff66ec6a45ab234f0e8 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 21 Oct 2020 12:12:46 -0400 Subject: [PATCH 24/78] Rebase to upstream JSS v4.8.0-b1 Signed-off-by: Alexander Scheel --- .gitignore | 1 + jss-crypto-policies-1.patch | 49 ------------------------------------- jss-crypto-policies-2.patch | 47 ----------------------------------- jss.spec | 26 ++++++-------------- sources | 2 +- 5 files changed, 10 insertions(+), 115 deletions(-) delete mode 100644 jss-crypto-policies-1.patch delete mode 100644 jss-crypto-policies-2.patch diff --git a/.gitignore b/.gitignore index 349bfb5..cb5030b 100644 --- a/.gitignore +++ b/.gitignore @@ -30,3 +30,4 @@ jss-4.2.6.tar.gz /jss-4.7.0.tar.gz /jss-4.7.2.tar.gz /jss-4.7.3.tar.gz +/jss-4.8.0-b1.tar.gz diff --git a/jss-crypto-policies-1.patch b/jss-crypto-policies-1.patch deleted file mode 100644 index dc23e85..0000000 --- a/jss-crypto-policies-1.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 1fb6097a2ab73ef897d011e7383d7f5f1bf6a1df Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Wed, 1 Jul 2020 12:41:20 -0400 -Subject: [PATCH] Replace SHA-1 signature with SHA-256 - -A recent change in Fedora Rawhide's crypto-policies package caused -failures in the tests like the following: - - Exception in thread "main" java.io.IOException: SocketException cannot read on socket: Error reading from socket: (-12271) SSL peer cannot verify your certificate. - at org.mozilla.jss.ssl.SSLSocket.read(SSLSocket.java:1494) - at org.mozilla.jss.ssl.SSLInputStream.read(SSLInputStream.java:38) - at org.mozilla.jss.ssl.SSLInputStream.read(SSLInputStream.java:25) - at org.mozilla.jss.tests.SSLClientAuth.run(SSLClientAuth.java:435) - at java.lang.Thread.run(Thread.java:748) - Caused by: org.mozilla.jss.ssl.SSLSocketException: Error reading from socket: (-12271) SSL peer cannot verify your certificate. - at org.mozilla.jss.ssl.SSLSocket.socketRead(Native Method) - at org.mozilla.jss.ssl.SSLSocket.read(SSLSocket.java:1488) - ... 4 more - Server exiting - org.mozilla.jss.ssl.SSLSocketException: SSL_ForceHandshake failed: (-8016) Unknown error - at org.mozilla.jss.ssl.SSLSocket.forceHandshake(Native Method) - at org.mozilla.jss.tests.SSLClientAuth.testConnection(SSLClientAuth.java:345) - at org.mozilla.jss.tests.SSLClientAuth.doIt(SSLClientAuth.java:156) - at org.mozilla.jss.tests.SSLClientAuth.main(SSLClientAuth.java:90) - -This was caused by dropping SHA-1 as an allowed hash during handshakes. -However, because SSLClientAuth manually generated its certificate (and -explicitly asked for SHA-1), it failed. - -Switch to SHA-256 instead. - -Signed-off-by: Alexander Scheel ---- - org/mozilla/jss/tests/SSLClientAuth.java | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/org/mozilla/jss/tests/SSLClientAuth.java b/org/mozilla/jss/tests/SSLClientAuth.java -index 6f1fd2b12..bf270a634 100644 ---- a/org/mozilla/jss/tests/SSLClientAuth.java -+++ b/org/mozilla/jss/tests/SSLClientAuth.java -@@ -28,7 +28,7 @@ - - private CryptoManager cm; - public static final SignatureAlgorithm sigAlg = -- SignatureAlgorithm.RSASignatureWithSHA1Digest; -+ SignatureAlgorithm.RSASignatureWithSHA256Digest; - - /** - * Method that generates a certificate for given credential diff --git a/jss-crypto-policies-2.patch b/jss-crypto-policies-2.patch deleted file mode 100644 index 71fe8c2..0000000 --- a/jss-crypto-policies-2.patch +++ /dev/null @@ -1,47 +0,0 @@ -From 8ed5a82a973922d07d0610fd42c48b2a0ec97d6c Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Wed, 1 Jul 2020 12:44:53 -0400 -Subject: [PATCH] Remove all legacy DSS/DSA tests - -The only signature algorithm suppoted with DSS is SHA-1, which will soon -become deprecated and broken. DSS itself isn't widely used either, so we -should remove it from the test suite as well. - -Signed-off-by: Alexander Scheel ---- - cmake/JSSTests.cmake | 12 +----------- - 1 file changed, 1 insertion(+), 11 deletions(-) - -diff --git a/cmake/JSSTests.cmake b/cmake/JSSTests.cmake -index a26b95425..a0fe36e22 100644 ---- a/cmake/JSSTests.cmake -+++ b/cmake/JSSTests.cmake -@@ -170,11 +170,6 @@ macro(jss_tests) - COMMAND "org.mozilla.jss.tests.GenerateTestCert" "${RESULTS_NSSDB_OUTPUT_DIR}" "${PASSWORD_FILE}" "30" "localhost" "SHA-256/EC" "CA_ECDSA" "Server_ECDSA" "Client_ECDSA" - DEPENDS "Generate_known_RSA_cert_pair" - ) -- jss_test_java( -- NAME "Generate_known_DSS_cert_pair" -- COMMAND "org.mozilla.jss.tests.GenerateTestCert" "${RESULTS_NSSDB_OUTPUT_DIR}" "${PASSWORD_FILE}" "40" "localhost" "SHA-1/DSA" "CA_DSS" "Server_DSS" "Client_DSS" -- DEPENDS "Generate_known_ECDSA_cert_pair" -- ) - jss_test_exec( - NAME "Create_PKCS11_cert_to_PKCS12_rsa.pfx" - COMMAND "pk12util" "-o" "${RESULTS_NSSDB_OUTPUT_DIR}/rsa.pfx" "-n" "CA_RSA" "-d" "${RESULTS_NSSDB_OUTPUT_DIR}" "-K" "${DB_PWD}" "-W" "${DB_PWD}" -@@ -185,15 +180,10 @@ macro(jss_tests) - COMMAND "pk12util" "-o" "${RESULTS_NSSDB_OUTPUT_DIR}/ecdsa.pfx" "-n" "CA_ECDSA" "-d" "${RESULTS_NSSDB_OUTPUT_DIR}" "-K" "${DB_PWD}" "-W" "${DB_PWD}" - DEPENDS "Generate_known_ECDSA_cert_pair" - ) -- jss_test_exec( -- NAME "Create_PKCS11_cert_to_PKCS12_dss.pfx" -- COMMAND "pk12util" "-o" "${RESULTS_NSSDB_OUTPUT_DIR}/dss.pfx" "-n" "CA_DSS" "-d" "${RESULTS_NSSDB_OUTPUT_DIR}" "-K" "${DB_PWD}" "-W" "${DB_PWD}" -- DEPENDS "Generate_known_DSS_cert_pair" -- ) - jss_test_java( - NAME "List_CA_certs" - COMMAND "org.mozilla.jss.tests.ListCACerts" "${RESULTS_NSSDB_OUTPUT_DIR}" "Verbose" -- DEPENDS "Generate_known_DSS_cert_pair" -+ DEPENDS "Generate_known_ECDSA_cert_pair" - ) - jss_test_java( - NAME "SSLClientAuth" diff --git a/jss.spec b/jss.spec index 401fe38..c0e48c9 100644 --- a/jss.spec +++ b/jss.spec @@ -6,9 +6,9 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.7.3 -Release: 1%{?_timestamp}%{?_commit_id}%{?dist} -#global _phase -a1 +Version: 4.8.0 +Release: 0.1%{?_timestamp}%{?_commit_id}%{?dist} +%global _phase -b1 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -50,7 +50,7 @@ BuildRequires: glassfish-jaxb-api %else BuildRequires: slf4j-jdk14 %endif -BuildRequires: apache-commons-lang +BuildRequires: apache-commons-lang3 BuildRequires: junit @@ -64,7 +64,7 @@ Requires: glassfish-jaxb-api %else Requires: slf4j-jdk14 %endif -Requires: apache-commons-lang +Requires: apache-commons-lang3 Conflicts: ldapjdk < 4.20 Conflicts: idm-console-framework < 1.2 @@ -108,26 +108,13 @@ export CFLAGS # Check if we're in FIPS mode modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENABLED=1 -# RHEL's CMake doesn't support -B flag. -%if 0%{?rhel} -%{__mkdir_p} %{_vpath_builddir} -cd %{_vpath_builddir} -%endif - # The Makefile is not thread-safe %cmake \ -DJAVA_HOME=%{java_home} \ -DJAVA_LIB_INSTALL_DIR=%{_jnidir} \ -%if 0%{?rhel} - .. -%else -B %{_vpath_builddir} -%endif -%if 0%{?fedora} cd %{_vpath_builddir} -%endif - %{__make} all %{__make} javadoc ctest --output-on-failure @@ -173,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Wed Oct 21 2020 Dogtag PKI Team - 4.8.0-b1 +- Rebase to upstream beta release JSS v4.8.0-b1 + * Fri Sep 11 2020 Dogtag PKI Team - 4.7.3-1 - Rebase to upstream stable release JSS v4.7.3 diff --git a/sources b/sources index 13d43e8..c295965 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.7.3.tar.gz) = 9358cf78d99e5e32a07dd457d6b0c916bdf9bf6959efe889f1cb91af75aa79fc419c2d057a40bfbe4e2a4924bffc1cafa04d917622cafe07062bcb633f330f98 +SHA512 (jss-4.8.0-b1.tar.gz) = 5601922b1c2e8006951a01e50486f585e2f6e3c0cd987a7e75c62755b4e14e2c7d489b583f92ba09281ceee2b5b1363f3d8fc94b039232fb3694975bd041a332 From c0c3a769acbb5341a6c4851459aebe8e3b98a150 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 28 Oct 2020 16:01:27 -0400 Subject: [PATCH 25/78] Rebase to latest stable JSS release v4.8.0 Signed-off-by: Alexander Scheel --- .gitignore | 1 + jss.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index cb5030b..181787c 100644 --- a/.gitignore +++ b/.gitignore @@ -31,3 +31,4 @@ jss-4.2.6.tar.gz /jss-4.7.2.tar.gz /jss-4.7.3.tar.gz /jss-4.8.0-b1.tar.gz +/jss-4.8.0.tar.gz diff --git a/jss.spec b/jss.spec index c0e48c9..a7c9812 100644 --- a/jss.spec +++ b/jss.spec @@ -7,8 +7,8 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.8.0 -Release: 0.1%{?_timestamp}%{?_commit_id}%{?dist} -%global _phase -b1 +Release: 1%{?_timestamp}%{?_commit_id}%{?dist} +#global _phase -a1 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -160,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Wed Oct 21 2020 Dogtag PKI Team - 4.8.0-1 +- Rebase to upstream stable release JSS v4.8.0 + * Wed Oct 21 2020 Dogtag PKI Team - 4.8.0-b1 - Rebase to upstream beta release JSS v4.8.0-b1 diff --git a/sources b/sources index c295965..017d89b 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.8.0-b1.tar.gz) = 5601922b1c2e8006951a01e50486f585e2f6e3c0cd987a7e75c62755b4e14e2c7d489b583f92ba09281ceee2b5b1363f3d8fc94b039232fb3694975bd041a332 +SHA512 (jss-4.8.0.tar.gz) = 322d12b69a2665a4ea2302a9a3ba8668c8dd6b56e6aaa17b48e11885ebcb9b38663242312207a0452c95bd84306bab4e968a8d0a1444dea003e4d19e43f6f425 From 62e646fc74ee08b8def0e4bff65271ef761a4341 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 28 Oct 2020 16:17:34 -0400 Subject: [PATCH 26/78] Rebase to latest stable JSS v4.8.0 Signed-off-by: Alexander Scheel --- .gitignore | 1 + jss.spec | 22 ++++++---------------- sources | 2 +- 3 files changed, 8 insertions(+), 17 deletions(-) diff --git a/.gitignore b/.gitignore index 349bfb5..9d82cb3 100644 --- a/.gitignore +++ b/.gitignore @@ -30,3 +30,4 @@ jss-4.2.6.tar.gz /jss-4.7.0.tar.gz /jss-4.7.2.tar.gz /jss-4.7.3.tar.gz +/jss-4.8.0.tar.gz diff --git a/jss.spec b/jss.spec index de4fb2c..4df6281 100644 --- a/jss.spec +++ b/jss.spec @@ -6,7 +6,7 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.7.3 +Version: 4.8.0 Release: 1%{?_timestamp}%{?_commit_id}%{?dist} #global _phase -a1 @@ -50,7 +50,7 @@ BuildRequires: glassfish-jaxb-api %else BuildRequires: slf4j-jdk14 %endif -BuildRequires: apache-commons-lang +BuildRequires: apache-commons-lang3 BuildRequires: junit @@ -64,7 +64,7 @@ Requires: glassfish-jaxb-api %else Requires: slf4j-jdk14 %endif -Requires: apache-commons-lang +Requires: apache-commons-lang3 Conflicts: ldapjdk < 4.20 Conflicts: idm-console-framework < 1.2 @@ -108,26 +108,13 @@ export CFLAGS # Check if we're in FIPS mode modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENABLED=1 -# RHEL's CMake doesn't support -B flag. -%if 0%{?rhel} -%{__mkdir_p} %{_vpath_builddir} -cd %{_vpath_builddir} -%endif - # The Makefile is not thread-safe %cmake \ -DJAVA_HOME=%{java_home} \ -DJAVA_LIB_INSTALL_DIR=%{_jnidir} \ -%if 0%{?rhel} - .. -%else -B %{_vpath_builddir} -%endif -%if 0%{?fedora} cd %{_vpath_builddir} -%endif - %{__make} all %{__make} javadoc ctest --output-on-failure @@ -173,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Wed Oct 21 2020 Dogtag PKI Team - 4.8.0-1 +- Rebase to upstream stable release JSS v4.8.0 + * Fri Sep 11 2020 Dogtag PKI Team - 4.7.3-1 - Rebase to upstream stable release JSS v4.7.3 diff --git a/sources b/sources index 13d43e8..017d89b 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.7.3.tar.gz) = 9358cf78d99e5e32a07dd457d6b0c916bdf9bf6959efe889f1cb91af75aa79fc419c2d057a40bfbe4e2a4924bffc1cafa04d917622cafe07062bcb633f330f98 +SHA512 (jss-4.8.0.tar.gz) = 322d12b69a2665a4ea2302a9a3ba8668c8dd6b56e6aaa17b48e11885ebcb9b38663242312207a0452c95bd84306bab4e968a8d0a1444dea003e4d19e43f6f425 From f25b2d6a41e9049b9c03d0fd3a6e566842bf40a5 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Thu, 5 Nov 2020 09:40:00 -0500 Subject: [PATCH 27/78] Add conflict on older PKI versions due to ACL3 Signed-off-by: Alexander Scheel --- jss.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/jss.spec b/jss.spec index a7c9812..925b552 100644 --- a/jss.spec +++ b/jss.spec @@ -7,7 +7,7 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.8.0 -Release: 1%{?_timestamp}%{?_commit_id}%{?dist} +Release: 2%{?_timestamp}%{?_commit_id}%{?dist} #global _phase -a1 # To generate the source tarball: @@ -69,7 +69,7 @@ Requires: apache-commons-lang3 Conflicts: ldapjdk < 4.20 Conflicts: idm-console-framework < 1.2 Conflicts: tomcatjss < 7.3.4 -Conflicts: pki-base < 10.6.5 +Conflicts: pki-base < 10.10.0 %description Java Security Services (JSS) is a java native interface which provides a bridge @@ -160,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Thu Nov 05 2020 Dogtag PKI Team - 4.8.0-2 +- Add Conflicts on older PKI versions due to missing ACL3 + * Wed Oct 21 2020 Dogtag PKI Team - 4.8.0-1 - Rebase to upstream stable release JSS v4.8.0 From 840b1eb392736a6dc74ce6661bfd3ad17a12ead7 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Thu, 5 Nov 2020 09:40:00 -0500 Subject: [PATCH 28/78] Add conflict on older PKI versions due to ACL3 Signed-off-by: Alexander Scheel --- jss.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/jss.spec b/jss.spec index 4df6281..8140e94 100644 --- a/jss.spec +++ b/jss.spec @@ -7,7 +7,7 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.8.0 -Release: 1%{?_timestamp}%{?_commit_id}%{?dist} +Release: 2%{?_timestamp}%{?_commit_id}%{?dist} #global _phase -a1 # To generate the source tarball: @@ -69,7 +69,7 @@ Requires: apache-commons-lang3 Conflicts: ldapjdk < 4.20 Conflicts: idm-console-framework < 1.2 Conflicts: tomcatjss < 7.3.4 -Conflicts: pki-base < 10.6.5 +Conflicts: pki-base < 10.10.0 %description Java Security Services (JSS) is a java native interface which provides a bridge @@ -160,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Thu Nov 05 2020 Dogtag PKI Team - 4.8.0-2 +- Add Conflicts on older PKI versions due to missing ACL3 + * Wed Oct 21 2020 Dogtag PKI Team - 4.8.0-1 - Rebase to upstream stable release JSS v4.8.0 From fa1266074f30479bacc18e32d4d09fb27956c98e Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Thu, 5 Nov 2020 11:48:28 -0500 Subject: [PATCH 29/78] Add upstream patch to make JDK8 builds work Signed-off-by: Alexander Scheel --- ...check-PKCS11Constants-on-beta-builds.patch | 30 +++++++++++++++++++ jss.spec | 1 + 2 files changed, 31 insertions(+) create mode 100644 0001-Only-check-PKCS11Constants-on-beta-builds.patch diff --git a/0001-Only-check-PKCS11Constants-on-beta-builds.patch b/0001-Only-check-PKCS11Constants-on-beta-builds.patch new file mode 100644 index 0000000..9f09e1a --- /dev/null +++ b/0001-Only-check-PKCS11Constants-on-beta-builds.patch @@ -0,0 +1,30 @@ +From eb6086840f5c79ba2ff5b1ccac3fe78ad2482e06 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Thu, 5 Nov 2020 11:07:13 -0500 +Subject: [PATCH] Only check PKCS11Constants on beta builds + +Recent errors with PKCS11Constants have shown that we shouldn't be +running these tests on release builds for backports: only for +pre-release content. Only run them when the beta bit is set. + +Signed-off-by: Alexander Scheel +--- + cmake/JSSTests.cmake | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/cmake/JSSTests.cmake b/cmake/JSSTests.cmake +index a0fe36e2..7384bdc0 100644 +--- a/cmake/JSSTests.cmake ++++ b/cmake/JSSTests.cmake +@@ -112,7 +112,7 @@ macro(jss_tests) + COMMAND "org.mozilla.jss.tests.TestGlobalReference" + MODE "NONE" + ) +- if ((${Java_VERSION_MAJOR} EQUAL 1) AND (${Java_VERSION_MINOR} LESS 9)) ++ if ((${Java_VERSION_MAJOR} EQUAL 1) AND (${Java_VERSION_MINOR} LESS 9) AND (${JSS_VERSION_BETA} EQUAL 1)) + jss_test_java( + NAME "Test_PKCS11Constants.java_for_Sun_compatibility" + COMMAND "org.mozilla.jss.tests.TestPKCS11Constants" +-- +2.26.2 + diff --git a/jss.spec b/jss.spec index 8140e94..318512f 100644 --- a/jss.spec +++ b/jss.spec @@ -25,6 +25,7 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch +Patch1: 0001-Only-check-PKCS11Constants-on-beta-builds.patch ################################################################################ # Build Dependencies From 049ad39b72d847664f925f54073e15ad66d0d3de Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Thu, 14 Jan 2021 09:09:11 -0500 Subject: [PATCH 30/78] Rebase to latest stable JSS v4.8.1 Signed-off-by: Alexander Scheel --- .gitignore | 1 + jss.spec | 11 +++++++---- sources | 2 +- 3 files changed, 9 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 181787c..5d94c56 100644 --- a/.gitignore +++ b/.gitignore @@ -32,3 +32,4 @@ jss-4.2.6.tar.gz /jss-4.7.3.tar.gz /jss-4.8.0-b1.tar.gz /jss-4.8.0.tar.gz +/jss-4.8.1.tar.gz diff --git a/jss.spec b/jss.spec index 925b552..8849d06 100644 --- a/jss.spec +++ b/jss.spec @@ -6,8 +6,8 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.8.0 -Release: 2%{?_timestamp}%{?_commit_id}%{?dist} +Version: 4.8.1 +Release: 1%{?_timestamp}%{?_commit_id}%{?dist} #global _phase -a1 # To generate the source tarball: @@ -33,7 +33,7 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # autosetup BuildRequires: git BuildRequires: make -BuildRequires: cmake +BuildRequires: cmake >= 3.14 BuildRequires: zip BuildRequires: unzip @@ -68,7 +68,7 @@ Requires: apache-commons-lang3 Conflicts: ldapjdk < 4.20 Conflicts: idm-console-framework < 1.2 -Conflicts: tomcatjss < 7.3.4 +Conflicts: tomcatjss < 7.6.0 Conflicts: pki-base < 10.10.0 %description @@ -160,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Thu Jan 14 2021 Dogtag PKI Team - 4.8.1-1 +- Rebase to upstream stable JSS v4.8.1 + * Thu Nov 05 2020 Dogtag PKI Team - 4.8.0-2 - Add Conflicts on older PKI versions due to missing ACL3 diff --git a/sources b/sources index 017d89b..064f3c9 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.8.0.tar.gz) = 322d12b69a2665a4ea2302a9a3ba8668c8dd6b56e6aaa17b48e11885ebcb9b38663242312207a0452c95bd84306bab4e968a8d0a1444dea003e4d19e43f6f425 +SHA512 (jss-4.8.1.tar.gz) = d18ef995cba627de68077bbd8dc25640b6444c4674e29ec83a05296ac1f18289e1ada35229baafbf5c5e4f1ae712a46e48d9d6dcead935e0f4d3d72b5208cf40 From 4b0f8e454b4b760d0261f264600c5977bc2e02c2 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Thu, 14 Jan 2021 09:09:11 -0500 Subject: [PATCH 31/78] Rebase to latest stable JSS v4.8.1 Signed-off-by: Alexander Scheel --- .gitignore | 1 + jss.spec | 11 +++++++---- sources | 2 +- 3 files changed, 9 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 9d82cb3..1ef681f 100644 --- a/.gitignore +++ b/.gitignore @@ -31,3 +31,4 @@ jss-4.2.6.tar.gz /jss-4.7.2.tar.gz /jss-4.7.3.tar.gz /jss-4.8.0.tar.gz +/jss-4.8.1.tar.gz diff --git a/jss.spec b/jss.spec index 318512f..50d3c84 100644 --- a/jss.spec +++ b/jss.spec @@ -6,8 +6,8 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.8.0 -Release: 2%{?_timestamp}%{?_commit_id}%{?dist} +Version: 4.8.1 +Release: 1%{?_timestamp}%{?_commit_id}%{?dist} #global _phase -a1 # To generate the source tarball: @@ -34,7 +34,7 @@ Patch1: 0001-Only-check-PKCS11Constants-on-beta-builds.patch # autosetup BuildRequires: git BuildRequires: make -BuildRequires: cmake +BuildRequires: cmake >= 3.14 BuildRequires: zip BuildRequires: unzip @@ -69,7 +69,7 @@ Requires: apache-commons-lang3 Conflicts: ldapjdk < 4.20 Conflicts: idm-console-framework < 1.2 -Conflicts: tomcatjss < 7.3.4 +Conflicts: tomcatjss < 7.6.0 Conflicts: pki-base < 10.10.0 %description @@ -161,6 +161,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Thu Jan 14 2021 Dogtag PKI Team - 4.8.1-1 +- Rebase to upstream stable JSS v4.8.1 + * Thu Nov 05 2020 Dogtag PKI Team - 4.8.0-2 - Add Conflicts on older PKI versions due to missing ACL3 diff --git a/sources b/sources index 017d89b..064f3c9 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.8.0.tar.gz) = 322d12b69a2665a4ea2302a9a3ba8668c8dd6b56e6aaa17b48e11885ebcb9b38663242312207a0452c95bd84306bab4e968a8d0a1444dea003e4d19e43f6f425 +SHA512 (jss-4.8.1.tar.gz) = d18ef995cba627de68077bbd8dc25640b6444c4674e29ec83a05296ac1f18289e1ada35229baafbf5c5e4f1ae712a46e48d9d6dcead935e0f4d3d72b5208cf40 From c95c58723141b6a4ddce50bdb2b13b834ec61e87 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Thu, 14 Jan 2021 10:14:10 -0500 Subject: [PATCH 32/78] Remove patch preventing building Signed-off-by: Alexander Scheel --- ...check-PKCS11Constants-on-beta-builds.patch | 30 ------------------- jss.spec | 1 - 2 files changed, 31 deletions(-) delete mode 100644 0001-Only-check-PKCS11Constants-on-beta-builds.patch diff --git a/0001-Only-check-PKCS11Constants-on-beta-builds.patch b/0001-Only-check-PKCS11Constants-on-beta-builds.patch deleted file mode 100644 index 9f09e1a..0000000 --- a/0001-Only-check-PKCS11Constants-on-beta-builds.patch +++ /dev/null @@ -1,30 +0,0 @@ -From eb6086840f5c79ba2ff5b1ccac3fe78ad2482e06 Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Thu, 5 Nov 2020 11:07:13 -0500 -Subject: [PATCH] Only check PKCS11Constants on beta builds - -Recent errors with PKCS11Constants have shown that we shouldn't be -running these tests on release builds for backports: only for -pre-release content. Only run them when the beta bit is set. - -Signed-off-by: Alexander Scheel ---- - cmake/JSSTests.cmake | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/cmake/JSSTests.cmake b/cmake/JSSTests.cmake -index a0fe36e2..7384bdc0 100644 ---- a/cmake/JSSTests.cmake -+++ b/cmake/JSSTests.cmake -@@ -112,7 +112,7 @@ macro(jss_tests) - COMMAND "org.mozilla.jss.tests.TestGlobalReference" - MODE "NONE" - ) -- if ((${Java_VERSION_MAJOR} EQUAL 1) AND (${Java_VERSION_MINOR} LESS 9)) -+ if ((${Java_VERSION_MAJOR} EQUAL 1) AND (${Java_VERSION_MINOR} LESS 9) AND (${JSS_VERSION_BETA} EQUAL 1)) - jss_test_java( - NAME "Test_PKCS11Constants.java_for_Sun_compatibility" - COMMAND "org.mozilla.jss.tests.TestPKCS11Constants" --- -2.26.2 - diff --git a/jss.spec b/jss.spec index 50d3c84..75134cf 100644 --- a/jss.spec +++ b/jss.spec @@ -25,7 +25,6 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch -Patch1: 0001-Only-check-PKCS11Constants-on-beta-builds.patch ################################################################################ # Build Dependencies From 78dbecd2ecd5d46f2367176ac22c790161acc861 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Tue, 26 Jan 2021 15:04:59 +0000 Subject: [PATCH 33/78] - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index 8849d06..e753986 100644 --- a/jss.spec +++ b/jss.spec @@ -7,7 +7,7 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.8.1 -Release: 1%{?_timestamp}%{?_commit_id}%{?dist} +Release: 2%{?_timestamp}%{?_commit_id}%{?dist} #global _phase -a1 # To generate the source tarball: @@ -160,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Tue Jan 26 2021 Fedora Release Engineering - 4.8.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + * Thu Jan 14 2021 Dogtag PKI Team - 4.8.1-1 - Rebase to upstream stable JSS v4.8.1 From 9d6582a8f850f0d377a3ec5985f7913b470c3dfb Mon Sep 17 00:00:00 2001 From: "Endi S. Dewata" Date: Tue, 18 May 2021 19:44:19 -0500 Subject: [PATCH 34/78] Rebase to JSS 4.9.0-alpha1 --- .gitignore | 1 + jss.spec | 11 ++++++++--- sources | 2 +- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 5d94c56..385bad6 100644 --- a/.gitignore +++ b/.gitignore @@ -33,3 +33,4 @@ jss-4.2.6.tar.gz /jss-4.8.0-b1.tar.gz /jss-4.8.0.tar.gz /jss-4.8.1.tar.gz +/jss-4.9.0-alpha1.tar.gz diff --git a/jss.spec b/jss.spec index e753986..c953b50 100644 --- a/jss.spec +++ b/jss.spec @@ -6,9 +6,11 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.8.1 -Release: 2%{?_timestamp}%{?_commit_id}%{?dist} -#global _phase -a1 +# For development (i.e. unsupported) releases, use x.y.z-0.n.. +# For official (i.e. supported) releases, use x.y.z-r where r >=1. +Version: 4.9.0 +Release: 0.1.alpha1%{?_timestamp}%{?_commit_id}%{?dist} +%global _phase -alpha1 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -160,6 +162,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Tue May 18 2021 Dogtag PKI Team - 4.9.0-0.1 +- Rebase to JSS 4.9.0-alpha1 + * Tue Jan 26 2021 Fedora Release Engineering - 4.8.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild diff --git a/sources b/sources index 064f3c9..c706521 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.8.1.tar.gz) = d18ef995cba627de68077bbd8dc25640b6444c4674e29ec83a05296ac1f18289e1ada35229baafbf5c5e4f1ae712a46e48d9d6dcead935e0f4d3d72b5208cf40 +SHA512 (jss-4.9.0-alpha1.tar.gz) = 3ab83818cf0c283f74087fd9de033d618ebbb8214b23a118414832017abbe2d4ed1f0567ab00e9aaec31ec9a04030a8817cf580ec6aeaf8f03a6be4b98c9a327 From d17adf6943138df2da190b413d9371b80a609e84 Mon Sep 17 00:00:00 2001 From: "Endi S. Dewata" Date: Wed, 26 May 2021 18:13:27 -0500 Subject: [PATCH 35/78] Drop git dependency --- jss.spec | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/jss.spec b/jss.spec index c953b50..6bf6884 100644 --- a/jss.spec +++ b/jss.spec @@ -9,7 +9,7 @@ License: MPLv1.1 or GPLv2+ or LGPLv2+ # For development (i.e. unsupported) releases, use x.y.z-0.n.. # For official (i.e. supported) releases, use x.y.z-r where r >=1. Version: 4.9.0 -Release: 0.1.alpha1%{?_timestamp}%{?_commit_id}%{?dist} +Release: 0.2.alpha1%{?_timestamp}%{?_commit_id}%{?dist} %global _phase -alpha1 # To generate the source tarball: @@ -32,8 +32,6 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # Build Dependencies ################################################################################ -# autosetup -BuildRequires: git BuildRequires: make BuildRequires: cmake >= 3.14 BuildRequires: zip @@ -91,7 +89,7 @@ This package contains the API documentation for JSS. ################################################################################ %prep -%autosetup -n %{name}-%{version}%{?_phase} -p 1 -S git +%autosetup -n %{name}-%{version}%{?_phase} -p 1 ################################################################################ %build @@ -162,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Wed May 26 2021 Dogtag PKI Team - 4.9.0-0.2 +- Drop git dependency + * Tue May 18 2021 Dogtag PKI Team - 4.9.0-0.1 - Rebase to JSS 4.9.0-alpha1 From d09d72c0f6f0226350a793faf1782514a0a59810 Mon Sep 17 00:00:00 2001 From: "Endi S. Dewata" Date: Wed, 26 May 2021 18:20:35 -0500 Subject: [PATCH 36/78] Disable unit tests by default --- jss.spec | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/jss.spec b/jss.spec index 6bf6884..e65db2b 100644 --- a/jss.spec +++ b/jss.spec @@ -28,6 +28,15 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch +################################################################################ +# Build Options +################################################################################ + +# By default the build will not execute unit tests unless --with test +# option is specified. + +%bcond_with test + ################################################################################ # Build Dependencies ################################################################################ @@ -117,7 +126,10 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA cd %{_vpath_builddir} %{__make} all %{__make} javadoc + +%if %{with test} ctest --output-on-failure +%endif ################################################################################ %install @@ -162,6 +174,7 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} %changelog * Wed May 26 2021 Dogtag PKI Team - 4.9.0-0.2 - Drop git dependency +- Disable unit tests by default * Tue May 18 2021 Dogtag PKI Team - 4.9.0-0.1 - Rebase to JSS 4.9.0-alpha1 From ef80dbd51c645585ad2255fd0455d252466858a1 Mon Sep 17 00:00:00 2001 From: "Endi S. Dewata" Date: Tue, 22 Jun 2021 14:35:42 -0500 Subject: [PATCH 37/78] Rebase to JSS 5.0.0-alpha1 --- .gitignore | 1 + jss.spec | 196 ++++++++--------------------------------------------- sources | 2 +- 3 files changed, 30 insertions(+), 169 deletions(-) diff --git a/.gitignore b/.gitignore index 385bad6..78c09bc 100644 --- a/.gitignore +++ b/.gitignore @@ -34,3 +34,4 @@ jss-4.2.6.tar.gz /jss-4.8.0.tar.gz /jss-4.8.1.tar.gz /jss-4.9.0-alpha1.tar.gz +/jss-5.0.0-alpha1.tar.gz diff --git a/jss.spec b/jss.spec index e65db2b..79c7bb3 100644 --- a/jss.spec +++ b/jss.spec @@ -8,8 +8,8 @@ License: MPLv1.1 or GPLv2+ or LGPLv2+ # For development (i.e. unsupported) releases, use x.y.z-0.n.. # For official (i.e. supported) releases, use x.y.z-r where r >=1. -Version: 4.9.0 -Release: 0.2.alpha1%{?_timestamp}%{?_commit_id}%{?dist} +Version: 5.0.0 +Release: 0.1.alpha1%{?_timestamp}%{?_commit_id}%{?dist} %global _phase -alpha1 # To generate the source tarball: @@ -28,6 +28,14 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch +################################################################################ +# Java +################################################################################ + +%define java_devel java-11-openjdk-devel +%define java_headless java-11-openjdk-headless +%define java_home /usr/lib/jvm/jre-11-openjdk + ################################################################################ # Build Options ################################################################################ @@ -50,29 +58,21 @@ BuildRequires: gcc-c++ BuildRequires: nspr-devel >= 4.13.1 BuildRequires: nss-devel >= 3.44 BuildRequires: nss-tools >= 3.44 -BuildRequires: java-devel +BuildRequires: %{java_devel} BuildRequires: jpackage-utils BuildRequires: slf4j BuildRequires: glassfish-jaxb-api -%if 0%{?rhel} && 0%{?rhel} <= 7 -# no slf4j-jdk14 -%else BuildRequires: slf4j-jdk14 -%endif BuildRequires: apache-commons-lang3 BuildRequires: junit Requires: nss >= 3.44 -Requires: java-headless +Requires: %{java_headless} Requires: jpackage-utils Requires: slf4j Requires: glassfish-jaxb-api -%if 0%{?rhel} && 0%{?rhel} <= 7 -# no slf4j-jdk14 -%else Requires: slf4j-jdk14 -%endif Requires: apache-commons-lang3 Conflicts: ldapjdk < 4.20 @@ -105,7 +105,7 @@ This package contains the API documentation for JSS. %set_build_flags -[ -z "$JAVA_HOME" ] && export JAVA_HOME=%{_jvmdir}/java +export JAVA_HOME=%{java_home} # Enable compiler optimizations export BUILD_OPT=1 @@ -117,44 +117,24 @@ export CFLAGS # Check if we're in FIPS mode modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENABLED=1 -# The Makefile is not thread-safe -%cmake \ - -DJAVA_HOME=%{java_home} \ - -DJAVA_LIB_INSTALL_DIR=%{_jnidir} \ - -B %{_vpath_builddir} - -cd %{_vpath_builddir} -%{__make} all -%{__make} javadoc - -%if %{with test} -ctest --output-on-failure -%endif +./build.sh \ + %{?_verbose:-v} \ + --work-dir=%{_vpath_builddir} \ + --java-lib-dir=%{_jnidir} \ + --jss-lib-dir=%{_libdir}/jss \ + --version=%{version} \ + %{!?with_test:--without-test} \ + dist ################################################################################ %install -# There is no install target so we'll do it by hand +./build.sh \ + %{?_verbose:-v} \ + --work-dir=%{_vpath_builddir} \ + --install-dir=%{buildroot} \ + install -# jars -install -d -m 0755 $RPM_BUILD_ROOT%{_jnidir} -install -m 644 %{_vpath_builddir}/jss4.jar ${RPM_BUILD_ROOT}%{_jnidir}/jss4.jar - -# We have to use the name libjss4.so because this is dynamically -# loaded by the jar file. -install -d -m 0755 $RPM_BUILD_ROOT%{_libdir}/jss -install -m 0755 %{_vpath_builddir}/libjss4.so ${RPM_BUILD_ROOT}%{_libdir}/jss/ -pushd ${RPM_BUILD_ROOT}%{_libdir}/jss - ln -fs %{_jnidir}/jss4.jar jss4.jar -popd - -# javadoc -install -d -m 0755 $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} -cp -rp %{_vpath_builddir}/docs/* $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} -cp -p jss.html $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} -cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} - -# No ldconfig is required since this library is loaded by Java itself. ################################################################################ %files @@ -172,125 +152,5 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog -* Wed May 26 2021 Dogtag PKI Team - 4.9.0-0.2 -- Drop git dependency -- Disable unit tests by default - -* Tue May 18 2021 Dogtag PKI Team - 4.9.0-0.1 -- Rebase to JSS 4.9.0-alpha1 - -* Tue Jan 26 2021 Fedora Release Engineering - 4.8.1-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - -* Thu Jan 14 2021 Dogtag PKI Team - 4.8.1-1 -- Rebase to upstream stable JSS v4.8.1 - -* Thu Nov 05 2020 Dogtag PKI Team - 4.8.0-2 -- Add Conflicts on older PKI versions due to missing ACL3 - -* Wed Oct 21 2020 Dogtag PKI Team - 4.8.0-1 -- Rebase to upstream stable release JSS v4.8.0 - -* Wed Oct 21 2020 Dogtag PKI Team - 4.8.0-b1 -- Rebase to upstream beta release JSS v4.8.0-b1 - -* Fri Sep 11 2020 Dogtag PKI Team - 4.7.3-1 -- Rebase to upstream stable release JSS v4.7.3 - -* Tue Aug 18 2020 Dogtag PKI Team - 4.7.2-1 -- Rebase to upstream stable release JSS v4.7.2 ; fixes FTBFS - -* Sat Aug 01 2020 Fedora Release Engineering - 4.7.0-4 -- Second attempt - Rebuilt for - https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - -* Tue Jul 28 2020 Fedora Release Engineering - 4.7.0-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - -* Fri Jul 10 2020 Jiri Vanek - 4.7.0-2 -- Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - -* Thu Jul 09 2020 Dogtag PKI Team - 4.7.0-1 -- Rebase to upstream stable release JSS v4.7.0 - -* Mon Jul 06 2020 Dogtag PKI Team - 4.7.0-0.5 -- Fix build issues with new Crypto-Policies denying SHA-1 usage - -* Tue Jun 30 2020 Dogtag PKI Team - 4.7.0-0.4 -- Rebase to latest upstream JSS v4.7.0-b4 - -* Wed Jun 10 2020 Dogtag PKI Team - 4.7.0-0.2 -- Rebase to latest upstream JSS 4.7.0 -- JSS Provided SSLEngine - -* Mon Apr 27 2020 Dogtag PKI Team - 4.6.4-1 -- Rebase to JSS 4.6.4 -- Fixes memory leak present since v4.6.2 - -* Thu Mar 5 2020 Dogtag PKI Team - 4.6.3-1 -- Rebase to JSS 4.6.3 -- Fixes base64 encoding of CSRs - -* Wed Mar 04 2020 Dogtag PKI Team - 4.6.2-4 -- Fix for PBE errors - -* Tue Jan 28 2020 Dogtag PKI Team - 4.6.2-3 -- Rebuild with new NSS to fix rhbz#1794814 - -* Tue Oct 29 2019 Dogtag PKI Team - 4.6.2-2 -- Fix for rhbz#1766451 - -* Tue Oct 15 2019 Dogtag PKI Team - 4.6.2-1 -- Rebase to JSS 4.6.2 -- Fixes CVE-2019-14823 - -* Thu Aug 08 2019 Dogtag PKI Team - 4.6.1-2 -- Disable unnecessary tests to fix broken s390x - -* Thu Aug 08 2019 Dogtag PKI Team - 4.6.1-1 -- Rebase to JSS 4.6.1 - -* Thu Jul 25 2019 Fedora Release Engineering - 4.5.3-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - -* Mon May 06 2019 Dogtag PKI Team - 4.5.3-2 -- Add AIA OCSP certificate checking patch - -* Tue Mar 19 2019 Dogtag PKI Team - 4.5.3-1 -- Rebase to JSS 4.5.3 - -* Fri Feb 01 2019 Dogtag PKI Team - 4.5.2-3 -- Include nuxwdog patch for netscape.security.util.Utils from PKI - -* Fri Feb 01 2019 Fedora Release Engineering - 4.5.2-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild - -* Mon Jan 14 2019 Dogtag PKI Team 4.5.2-1 -- Rebased to JSS 4.5.2 - -* Thu Nov 29 2018 Dogtag PKI Team 4.5.1-1 -- Rebased to JSS 4.5.1 -- Red Hat Bugzilla #1582323 - DER encoding error for enumerated types with a value of zero -- Red Hat Bugzilla #1534765 - javadoc for org.mozilla.jss.pkix.cms.SignedData.getSignerInfos() is incorrect - -* Fri Aug 10 2018 Dogtag PKI Team 4.5.0-1 -- Rebased to JSS 4.5.0 - -* Tue Aug 07 2018 Dogtag PKI Team 4.5.0-0.6 -- Rebased to JSS 4.5.0-b1 - -* Tue Aug 07 2018 Dogtag PKI Team 4.5.0-0.5 -- Red Hat Bugzilla #1612063 - Do not override system crypto policy (support TLS 1.3) - -* Fri Jul 20 2018 Dogtag PKI Team 4.5.0-0.4 -- Rebased to JSS 4.5.0-a4 -- Red Hat Bugzilla #1604462 - jss: FTBFS in Fedora rawhide - -* Thu Jul 05 2018 Dogtag PKI Team 4.5.0-0.3 -- Rebased to JSS 4.5.0-a3 - -* Fri Jun 22 2018 Dogtag PKI Team 4.5.0-0.2 -- Rebased to JSS 4.5.0-a2 - -* Fri Jun 15 2018 Dogtag PKI Team 4.5.0-0.1 -- Rebased to JSS 4.5.0-a1 +* Tue Jun 22 2021 Dogtag PKI Team - 5.0.0-0.1 +- Rebase to JSS 5.0.0-alpha1 diff --git a/sources b/sources index c706521..3d73504 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.9.0-alpha1.tar.gz) = 3ab83818cf0c283f74087fd9de033d618ebbb8214b23a118414832017abbe2d4ed1f0567ab00e9aaec31ec9a04030a8817cf580ec6aeaf8f03a6be4b98c9a327 +SHA512 (jss-5.0.0-alpha1.tar.gz) = 27c18c88cea85a62e9dd2b1c4bf7223629938fd1a47d5c0c9168eaa3ab79366961dd9c6a17cd2c37633b18b9287776ecb2b027090425d530cddb4d056b220e39 From 8e5f461e834d1e2b24c02f404ac69e94b47e26d8 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 22 Jul 2021 09:19:42 +0000 Subject: [PATCH 38/78] - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index 79c7bb3..5db023e 100644 --- a/jss.spec +++ b/jss.spec @@ -9,7 +9,7 @@ License: MPLv1.1 or GPLv2+ or LGPLv2+ # For development (i.e. unsupported) releases, use x.y.z-0.n.. # For official (i.e. supported) releases, use x.y.z-r where r >=1. Version: 5.0.0 -Release: 0.1.alpha1%{?_timestamp}%{?_commit_id}%{?dist} +Release: 0.2.alpha1%{?_timestamp}%{?_commit_id}%{?dist} %global _phase -alpha1 # To generate the source tarball: @@ -152,5 +152,8 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %changelog +* Thu Jul 22 2021 Fedora Release Engineering - 5.0.0-0.2.alpha1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + * Tue Jun 22 2021 Dogtag PKI Team - 5.0.0-0.1 - Rebase to JSS 5.0.0-alpha1 From f29b811b7f89ae9d03f4b2fc44aa5c064b9507a7 Mon Sep 17 00:00:00 2001 From: "Endi S. Dewata" Date: Thu, 12 Aug 2021 13:03:54 -0500 Subject: [PATCH 39/78] Rebase to JSS 5.0.0-alpha2 --- .gitignore | 1 + jss.spec | 32 ++++++++++++++++++++++---------- sources | 2 +- 3 files changed, 24 insertions(+), 11 deletions(-) diff --git a/.gitignore b/.gitignore index 78c09bc..5ea8d6a 100644 --- a/.gitignore +++ b/.gitignore @@ -35,3 +35,4 @@ jss-4.2.6.tar.gz /jss-4.8.1.tar.gz /jss-4.9.0-alpha1.tar.gz /jss-5.0.0-alpha1.tar.gz +/jss-5.0.0-alpha2.tar.gz diff --git a/jss.spec b/jss.spec index 5db023e..95e275b 100644 --- a/jss.spec +++ b/jss.spec @@ -9,8 +9,8 @@ License: MPLv1.1 or GPLv2+ or LGPLv2+ # For development (i.e. unsupported) releases, use x.y.z-0.n.. # For official (i.e. supported) releases, use x.y.z-r where r >=1. Version: 5.0.0 -Release: 0.2.alpha1%{?_timestamp}%{?_commit_id}%{?dist} -%global _phase -alpha1 +Release: 0.3.alpha2%{?_timestamp}%{?_commit_id}%{?dist} +%global _phase -alpha2 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -40,10 +40,15 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # Build Options ################################################################################ -# By default the build will not execute unit tests unless --with test +# By default the javadoc package will be built unless --without javadoc # option is specified. -%bcond_with test +%bcond_without javadoc + +# By default the build will execute unit tests unless --without test +# option is specified. + +%bcond_without test ################################################################################ # Build Dependencies @@ -55,9 +60,8 @@ BuildRequires: zip BuildRequires: unzip BuildRequires: gcc-c++ -BuildRequires: nspr-devel >= 4.13.1 -BuildRequires: nss-devel >= 3.44 -BuildRequires: nss-tools >= 3.44 +BuildRequires: nss-devel >= 3.66 +BuildRequires: nss-tools >= 3.66 BuildRequires: %{java_devel} BuildRequires: jpackage-utils BuildRequires: slf4j @@ -67,7 +71,7 @@ BuildRequires: apache-commons-lang3 BuildRequires: junit -Requires: nss >= 3.44 +Requires: nss >= 3.66 Requires: %{java_headless} Requires: jpackage-utils Requires: slf4j @@ -85,6 +89,7 @@ Java Security Services (JSS) is a java native interface which provides a bridge for java-based applications to use native Network Security Services (NSS). This only works with gcj. Other JREs require that JCE providers be signed. +%if %{with javadoc} ################################################################################ %package javadoc ################################################################################ @@ -94,6 +99,7 @@ Requires: jss = %{version}-%{release} %description javadoc This package contains the API documentation for JSS. +%endif ################################################################################ %prep @@ -123,6 +129,7 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA --java-lib-dir=%{_jnidir} \ --jss-lib-dir=%{_libdir}/jss \ --version=%{version} \ + %{!?with_javadoc:--without-javadoc} \ %{!?with_test:--without-test} \ dist @@ -144,16 +151,21 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA %{_libdir}/* %{_jnidir}/* +%if %{with javadoc} ################################################################################ %files javadoc %defattr(-,root,root,-) -%{_javadocdir}/%{name}-%{version}/ +%{_javadocdir}/%{name}/ +%endif ################################################################################ %changelog +* Thu Aug 12 2021 Dogtag PKI Team - 5.0.0-0.3.alpha2 +- Rebase to JSS 5.0.0-alpha2 + * Thu Jul 22 2021 Fedora Release Engineering - 5.0.0-0.2.alpha1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild -* Tue Jun 22 2021 Dogtag PKI Team - 5.0.0-0.1 +* Tue Jun 22 2021 Dogtag PKI Team - 5.0.0-0.1.alpha1 - Rebase to JSS 5.0.0-alpha1 diff --git a/sources b/sources index 3d73504..756e287 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-5.0.0-alpha1.tar.gz) = 27c18c88cea85a62e9dd2b1c4bf7223629938fd1a47d5c0c9168eaa3ab79366961dd9c6a17cd2c37633b18b9287776ecb2b027090425d530cddb4d056b220e39 +SHA512 (jss-5.0.0-alpha2.tar.gz) = de48ce48f2bc6544871308394ccaa187c4aecb72b3f4d5ce5dd692e8a6f6edaa835ce12aa80c2ac0745baca05e7fb7b943ae3abafe88636c07868633111c6118 From 9c8bb2356f1eee220cf73cfaefed124bdbf80624 Mon Sep 17 00:00:00 2001 From: Chris Kelley Date: Fri, 3 Sep 2021 23:23:32 +0100 Subject: [PATCH 40/78] Rebase to JSS 5.0.0-beta1 --- .gitignore | 1 + jss.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 5ea8d6a..66804ec 100644 --- a/.gitignore +++ b/.gitignore @@ -36,3 +36,4 @@ jss-4.2.6.tar.gz /jss-4.9.0-alpha1.tar.gz /jss-5.0.0-alpha1.tar.gz /jss-5.0.0-alpha2.tar.gz +/jss-5.0.0-beta1.tar.gz diff --git a/jss.spec b/jss.spec index 95e275b..e64e2a3 100644 --- a/jss.spec +++ b/jss.spec @@ -9,8 +9,8 @@ License: MPLv1.1 or GPLv2+ or LGPLv2+ # For development (i.e. unsupported) releases, use x.y.z-0.n.. # For official (i.e. supported) releases, use x.y.z-r where r >=1. Version: 5.0.0 -Release: 0.3.alpha2%{?_timestamp}%{?_commit_id}%{?dist} -%global _phase -alpha2 +Release: 0.4.beta1%{?_timestamp}%{?_commit_id}%{?dist} +%global _phase -beta1 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -161,6 +161,9 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %changelog +* Fri Sep 03 2021 Dogtag PKI Team - 5.0.0-0.4.beta1 +- Rebase to JSS 5.0.0-beta1 + * Thu Aug 12 2021 Dogtag PKI Team - 5.0.0-0.3.alpha2 - Rebase to JSS 5.0.0-alpha2 diff --git a/sources b/sources index 756e287..15f1b12 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-5.0.0-alpha2.tar.gz) = de48ce48f2bc6544871308394ccaa187c4aecb72b3f4d5ce5dd692e8a6f6edaa835ce12aa80c2ac0745baca05e7fb7b943ae3abafe88636c07868633111c6118 +SHA512 (jss-5.0.0-beta1.tar.gz) = 9413102a75e6d73b81b3adaeda65958f2363f075e8295cc2e796afaf0aae2c0e1942734cd3314754d5bccc21f92d3bfa16515e63954b0a4239f7ba85e2ce8f95 From 269ca9b45883b6af3eab6f7ed21cc3ec238ed944 Mon Sep 17 00:00:00 2001 From: "Endi S. Dewata" Date: Wed, 29 Sep 2021 23:11:52 -0500 Subject: [PATCH 41/78] Drop BuildRequires and Requires on glassfish-jaxb-api --- jss.spec | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/jss.spec b/jss.spec index e64e2a3..51490d7 100644 --- a/jss.spec +++ b/jss.spec @@ -9,7 +9,7 @@ License: MPLv1.1 or GPLv2+ or LGPLv2+ # For development (i.e. unsupported) releases, use x.y.z-0.n.. # For official (i.e. supported) releases, use x.y.z-r where r >=1. Version: 5.0.0 -Release: 0.4.beta1%{?_timestamp}%{?_commit_id}%{?dist} +Release: 0.5.beta1%{?_timestamp}%{?_commit_id}%{?dist} %global _phase -beta1 # To generate the source tarball: @@ -34,7 +34,7 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas %define java_devel java-11-openjdk-devel %define java_headless java-11-openjdk-headless -%define java_home /usr/lib/jvm/jre-11-openjdk +%define java_home %{_libdir}/jvm/jre-11-openjdk ################################################################################ # Build Options @@ -65,7 +65,6 @@ BuildRequires: nss-tools >= 3.66 BuildRequires: %{java_devel} BuildRequires: jpackage-utils BuildRequires: slf4j -BuildRequires: glassfish-jaxb-api BuildRequires: slf4j-jdk14 BuildRequires: apache-commons-lang3 @@ -75,7 +74,6 @@ Requires: nss >= 3.66 Requires: %{java_headless} Requires: jpackage-utils Requires: slf4j -Requires: glassfish-jaxb-api Requires: slf4j-jdk14 Requires: apache-commons-lang3 @@ -161,6 +159,9 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %changelog +* Wed Sep 29 2021 Dogtag PKI Team - 5.0.0-0.5.beta1 +- Drop BuildRequires and Requires on glassfish-jaxb-api + * Fri Sep 03 2021 Dogtag PKI Team - 5.0.0-0.4.beta1 - Rebase to JSS 5.0.0-beta1 From 23bd244360ca8ceef2572e5f6859b7af564f9a0f Mon Sep 17 00:00:00 2001 From: "Endi S. Dewata" Date: Thu, 30 Sep 2021 23:34:32 -0500 Subject: [PATCH 42/78] Rebase to JSS 5.0.0 --- .gitignore | 1 + jss.spec | 9 ++++++--- sources | 2 +- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 66804ec..21231ff 100644 --- a/.gitignore +++ b/.gitignore @@ -37,3 +37,4 @@ jss-4.2.6.tar.gz /jss-5.0.0-alpha1.tar.gz /jss-5.0.0-alpha2.tar.gz /jss-5.0.0-beta1.tar.gz +/jss-5.0.0.tar.gz diff --git a/jss.spec b/jss.spec index 51490d7..dfc608f 100644 --- a/jss.spec +++ b/jss.spec @@ -9,8 +9,8 @@ License: MPLv1.1 or GPLv2+ or LGPLv2+ # For development (i.e. unsupported) releases, use x.y.z-0.n.. # For official (i.e. supported) releases, use x.y.z-r where r >=1. Version: 5.0.0 -Release: 0.5.beta1%{?_timestamp}%{?_commit_id}%{?dist} -%global _phase -beta1 +Release: 1%{?_timestamp}%{?_commit_id}%{?dist} +#global _phase -alpha1 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -34,7 +34,7 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas %define java_devel java-11-openjdk-devel %define java_headless java-11-openjdk-headless -%define java_home %{_libdir}/jvm/jre-11-openjdk +%define java_home /usr/lib/jvm/jre-11-openjdk ################################################################################ # Build Options @@ -159,6 +159,9 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %changelog +* Thu Sep 30 2021 Dogtag PKI Team - 5.0.0-1 +- Rebase to JSS 5.0.0 + * Wed Sep 29 2021 Dogtag PKI Team - 5.0.0-0.5.beta1 - Drop BuildRequires and Requires on glassfish-jaxb-api diff --git a/sources b/sources index 15f1b12..fa96496 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-5.0.0-beta1.tar.gz) = 9413102a75e6d73b81b3adaeda65958f2363f075e8295cc2e796afaf0aae2c0e1942734cd3314754d5bccc21f92d3bfa16515e63954b0a4239f7ba85e2ce8f95 +SHA512 (jss-5.0.0.tar.gz) = 9857ff8e6c1e54927c78904be2d9a84ad4afc0559e95a4c835fd2000388c542d90d31bca7da7e99b0b74ef6e4175512227acb3341aa3475526f5f222c071aa97 From fa24161b1a045bad563331d689fc6d01269256e5 Mon Sep 17 00:00:00 2001 From: Chris Kelley Date: Fri, 26 Nov 2021 15:11:57 +0000 Subject: [PATCH 43/78] Rebase to JSS 5.1.0-alpha2 --- .gitignore | 1 + jss.spec | 21 ++++++++++++--------- sources | 2 +- 3 files changed, 14 insertions(+), 10 deletions(-) diff --git a/.gitignore b/.gitignore index 21231ff..d584a8a 100644 --- a/.gitignore +++ b/.gitignore @@ -38,3 +38,4 @@ jss-4.2.6.tar.gz /jss-5.0.0-alpha2.tar.gz /jss-5.0.0-beta1.tar.gz /jss-5.0.0.tar.gz +/jss-5.1.0-alpha2.tar.gz diff --git a/jss.spec b/jss.spec index dfc608f..96d564d 100644 --- a/jss.spec +++ b/jss.spec @@ -8,9 +8,9 @@ License: MPLv1.1 or GPLv2+ or LGPLv2+ # For development (i.e. unsupported) releases, use x.y.z-0.n.. # For official (i.e. supported) releases, use x.y.z-r where r >=1. -Version: 5.0.0 -Release: 1%{?_timestamp}%{?_commit_id}%{?dist} -#global _phase -alpha1 +Version: 5.1.0 +Release: 0.1.alpha2%{?_timestamp}%{?_commit_id}%{?dist} +%global _phase -alpha2 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -32,9 +32,9 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # Java ################################################################################ -%define java_devel java-11-openjdk-devel -%define java_headless java-11-openjdk-headless -%define java_home /usr/lib/jvm/jre-11-openjdk +%define java_devel java-17-openjdk-devel +%define java_headless java-17-openjdk-headless +%define java_home %{_jvmdir}/jre-17-openjdk ################################################################################ # Build Options @@ -45,10 +45,10 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas %bcond_without javadoc -# By default the build will execute unit tests unless --without test +# By default the build will not execute unit tests unless --with tests # option is specified. -%bcond_without test +%bcond_with tests ################################################################################ # Build Dependencies @@ -128,7 +128,7 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA --jss-lib-dir=%{_libdir}/jss \ --version=%{version} \ %{!?with_javadoc:--without-javadoc} \ - %{!?with_test:--without-test} \ + %{?with_tests:--with-tests} \ dist ################################################################################ @@ -159,6 +159,9 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %changelog +* Fri Nov 26 2021 Dogtag PKI Team - 5.1.0-0.1.alpha2 +- Rebase to JSS 5.1.0-alpha2 + * Thu Sep 30 2021 Dogtag PKI Team - 5.0.0-1 - Rebase to JSS 5.0.0 diff --git a/sources b/sources index fa96496..1205a51 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-5.0.0.tar.gz) = 9857ff8e6c1e54927c78904be2d9a84ad4afc0559e95a4c835fd2000388c542d90d31bca7da7e99b0b74ef6e4175512227acb3341aa3475526f5f222c071aa97 +SHA512 (jss-5.1.0-alpha2.tar.gz) = 6c97b42d4d52e6b016b0da72f834f8307905d894780f00a329e39cf3c1271cfb56873f899bd3090188aba015315b08d8b2d8848f5e4f053c64cd1e012f10a6f5 From b513b36692dfe54cfca54d23e1e0d612010986c8 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 20 Jan 2022 14:01:52 +0000 Subject: [PATCH 44/78] - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index 96d564d..f9b3fd2 100644 --- a/jss.spec +++ b/jss.spec @@ -9,7 +9,7 @@ License: MPLv1.1 or GPLv2+ or LGPLv2+ # For development (i.e. unsupported) releases, use x.y.z-0.n.. # For official (i.e. supported) releases, use x.y.z-r where r >=1. Version: 5.1.0 -Release: 0.1.alpha2%{?_timestamp}%{?_commit_id}%{?dist} +Release: 0.2.alpha2%{?_timestamp}%{?_commit_id}%{?dist} %global _phase -alpha2 # To generate the source tarball: @@ -159,6 +159,9 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %changelog +* Thu Jan 20 2022 Fedora Release Engineering - 5.1.0-0.2.alpha2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + * Fri Nov 26 2021 Dogtag PKI Team - 5.1.0-0.1.alpha2 - Rebase to JSS 5.1.0-alpha2 From 2070756ccac09cff425f628d9e6e1c4dabc405e9 Mon Sep 17 00:00:00 2001 From: Jiri Date: Sat, 5 Feb 2022 22:08:15 +0100 Subject: [PATCH 45/78] Rebuilt for java-17-openjdk as system jdk https://fedoraproject.org/wiki/Changes/Java17 --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index f9b3fd2..7b8165e 100644 --- a/jss.spec +++ b/jss.spec @@ -9,7 +9,7 @@ License: MPLv1.1 or GPLv2+ or LGPLv2+ # For development (i.e. unsupported) releases, use x.y.z-0.n.. # For official (i.e. supported) releases, use x.y.z-r where r >=1. Version: 5.1.0 -Release: 0.2.alpha2%{?_timestamp}%{?_commit_id}%{?dist} +Release: 0.3.alpha2%{?_timestamp}%{?_commit_id}%{?dist} %global _phase -alpha2 # To generate the source tarball: @@ -159,6 +159,9 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %changelog +* Sat Feb 05 2022 Jiri Vanek - 5.1.0-0.3.alpha2 +- Rebuilt for java-17-openjdk as system jdk + * Thu Jan 20 2022 Fedora Release Engineering - 5.1.0-0.2.alpha2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild From 13d4c207f4d917e4e83c33713eca26eb9a999eaf Mon Sep 17 00:00:00 2001 From: Chris Kelley Date: Mon, 14 Feb 2022 16:12:37 +0000 Subject: [PATCH 46/78] Rebase to JSS 5.1.0 --- .gitignore | 1 + jss.spec | 13 ++++++++----- sources | 2 +- 3 files changed, 10 insertions(+), 6 deletions(-) diff --git a/.gitignore b/.gitignore index d584a8a..f8083a5 100644 --- a/.gitignore +++ b/.gitignore @@ -39,3 +39,4 @@ jss-4.2.6.tar.gz /jss-5.0.0-beta1.tar.gz /jss-5.0.0.tar.gz /jss-5.1.0-alpha2.tar.gz +/jss-5.1.0.tar.gz diff --git a/jss.spec b/jss.spec index 7b8165e..9d0dd7f 100644 --- a/jss.spec +++ b/jss.spec @@ -9,8 +9,8 @@ License: MPLv1.1 or GPLv2+ or LGPLv2+ # For development (i.e. unsupported) releases, use x.y.z-0.n.. # For official (i.e. supported) releases, use x.y.z-r where r >=1. Version: 5.1.0 -Release: 0.3.alpha2%{?_timestamp}%{?_commit_id}%{?dist} -%global _phase -alpha2 +Release: 1%{?_timestamp}%{?_commit_id}%{?dist} +#global _phase -alpha2 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -124,8 +124,8 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ./build.sh \ %{?_verbose:-v} \ --work-dir=%{_vpath_builddir} \ - --java-lib-dir=%{_jnidir} \ - --jss-lib-dir=%{_libdir}/jss \ + --jni-dir=%{_jnidir} \ + --lib-dir=%{_libdir} \ --version=%{version} \ %{!?with_javadoc:--without-javadoc} \ %{?with_tests:--with-tests} \ @@ -145,7 +145,7 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA %defattr(-,root,root,-) %doc jss.html -%license MPL-1.1.txt gpl.txt lgpl.txt +%license MPL-1.1.txt gpl.txt lgpl.txt symkey/LICENSE %{_libdir}/* %{_jnidir}/* @@ -159,6 +159,9 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %changelog +* Mon Feb 14 2022 Dogtag PKI Team - 5.1.0-1 +- Rebase to JSS 5.1.0 + * Sat Feb 05 2022 Jiri Vanek - 5.1.0-0.3.alpha2 - Rebuilt for java-17-openjdk as system jdk diff --git a/sources b/sources index 1205a51..eefcf57 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-5.1.0-alpha2.tar.gz) = 6c97b42d4d52e6b016b0da72f834f8307905d894780f00a329e39cf3c1271cfb56873f899bd3090188aba015315b08d8b2d8848f5e4f053c64cd1e012f10a6f5 +SHA512 (jss-5.1.0.tar.gz) = 5bed03b443a2f9c8912e153a27469bdd6e8363465c3748c39defb19de1db1f489293ff86aeb6be7417e1b4bdc2c7915847b35521c220c68e18b2c15c24144306 From e1fb53d4aa5cada1f4cd9b73e5fb9a32921d79b3 Mon Sep 17 00:00:00 2001 From: "Endi S. Dewata" Date: Mon, 11 Apr 2022 14:20:55 -0500 Subject: [PATCH 47/78] Rebase to JSS 5.2.0-beta1 --- .gitignore | 1 + jss.spec | 24 ++++++++++++++++++++---- sources | 2 +- 3 files changed, 22 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index f8083a5..ca5b012 100644 --- a/.gitignore +++ b/.gitignore @@ -40,3 +40,4 @@ jss-4.2.6.tar.gz /jss-5.0.0.tar.gz /jss-5.1.0-alpha2.tar.gz /jss-5.1.0.tar.gz +/jss-5.2.0-beta1.tar.gz diff --git a/jss.spec b/jss.spec index 9d0dd7f..0ed4ff9 100644 --- a/jss.spec +++ b/jss.spec @@ -8,9 +8,9 @@ License: MPLv1.1 or GPLv2+ or LGPLv2+ # For development (i.e. unsupported) releases, use x.y.z-0.n.. # For official (i.e. supported) releases, use x.y.z-r where r >=1. -Version: 5.1.0 -Release: 1%{?_timestamp}%{?_commit_id}%{?dist} -#global _phase -alpha2 +Version: 5.2.0 +Release: 0.2.beta1%{?_timestamp}%{?_commit_id}%{?dist} +%global _phase -beta1 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -101,12 +101,16 @@ This package contains the API documentation for JSS. ################################################################################ %prep +################################################################################ %autosetup -n %{name}-%{version}%{?_phase} -p 1 ################################################################################ %build +################################################################################ +# Set build flags for CMake +# (see /usr/lib/rpm/macros.d/macros.cmake) %set_build_flags export JAVA_HOME=%{java_home} @@ -124,8 +128,14 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ./build.sh \ %{?_verbose:-v} \ --work-dir=%{_vpath_builddir} \ - --jni-dir=%{_jnidir} \ + --prefix-dir=%{_prefix} \ + --include-dir=%{_includedir} \ --lib-dir=%{_libdir} \ + --sysconfig-dir=%{_sysconfigdir} \ + --share-dir=%{_datadir} \ + --cmake=%{__cmake} \ + --java-home=%{java_home} \ + --jni-dir=%{_jnidir} \ --version=%{version} \ %{!?with_javadoc:--without-javadoc} \ %{?with_tests:--with-tests} \ @@ -133,6 +143,7 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %install +################################################################################ ./build.sh \ %{?_verbose:-v} \ @@ -142,6 +153,7 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %files +################################################################################ %defattr(-,root,root,-) %doc jss.html @@ -152,6 +164,7 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA %if %{with javadoc} ################################################################################ %files javadoc +################################################################################ %defattr(-,root,root,-) %{_javadocdir}/%{name}/ @@ -159,6 +172,9 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %changelog +* Mon Apr 11 2022 Dogtag PKI Team - 5.2.0-0.2.beta1 +- Rebase to JSS 5.2.0-beta1 + * Mon Feb 14 2022 Dogtag PKI Team - 5.1.0-1 - Rebase to JSS 5.1.0 diff --git a/sources b/sources index eefcf57..b03417d 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-5.1.0.tar.gz) = 5bed03b443a2f9c8912e153a27469bdd6e8363465c3748c39defb19de1db1f489293ff86aeb6be7417e1b4bdc2c7915847b35521c220c68e18b2c15c24144306 +SHA512 (jss-5.2.0-beta1.tar.gz) = be6f4612567676e797bb07a00cbc8e6ebab4e930770e00514152e5c3389a0484dcc3eb959c3c57d33d12ed38fbf160a02c69d1c6d5c7b40b93b9fe90cbf0bbb3 From e499f9be0bf2843994c34997f2d9d95f726ec819 Mon Sep 17 00:00:00 2001 From: "Endi S. Dewata" Date: Wed, 27 Apr 2022 18:19:12 -0500 Subject: [PATCH 48/78] Rebase to JSS 5.2.0-beta2 --- .gitignore | 1 + jss.spec | 52 ++++++++++++++++++++++++++++++++++++++++++---------- sources | 2 +- 3 files changed, 44 insertions(+), 11 deletions(-) diff --git a/.gitignore b/.gitignore index ca5b012..664530f 100644 --- a/.gitignore +++ b/.gitignore @@ -41,3 +41,4 @@ jss-4.2.6.tar.gz /jss-5.1.0-alpha2.tar.gz /jss-5.1.0.tar.gz /jss-5.2.0-beta1.tar.gz +/jss-5.2.0-beta2.tar.gz diff --git a/jss.spec b/jss.spec index 0ed4ff9..42a9102 100644 --- a/jss.spec +++ b/jss.spec @@ -1,16 +1,31 @@ ################################################################################ -Name: jss +Name: dogtag-jss ################################################################################ +# Upstream version number: +%global major_version 5 +%global minor_version 2 +%global update_version 0 + +# Downstream release number: +# - development/stabilization (unsupported): 0. where n >= 1 +# - GA/update (supported): where n >= 1 +%global release_number 0.3 + +# Development phase: +# - development (unsupported): alpha where n >= 1 +# - stabilization (unsupported): beta where n >= 1 +# - GA/update (supported): +%global phase beta2 + +%undefine timestamp +%undefine commit_id + Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ - -# For development (i.e. unsupported) releases, use x.y.z-0.n.. -# For official (i.e. supported) releases, use x.y.z-r where r >=1. -Version: 5.2.0 -Release: 0.2.beta1%{?_timestamp}%{?_commit_id}%{?dist} -%global _phase -beta1 +Version: %{major_version}.%{minor_version}.%{update_version} +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist} # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -19,7 +34,7 @@ Release: 0.2.beta1%{?_timestamp}%{?_commit_id}%{?dist} # $ git push origin v4.5. # Then go to https://github.com/dogtagpki/jss/releases and download the source # tarball. -Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phase}/%{name}-%{version}%{?_phase}.tar.gz +Source: https://github.com/dogtagpki/jss/archive/v%{version}%{?phase:-}%{?phase}/jss-%{version}%{?phase:-}%{?phase}.tar.gz # To create a patch for all changes since a version tag: # $ git format-patch \ @@ -28,6 +43,9 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch +# Java 17 and md2man are not available on i686 +ExcludeArch: i686 + ################################################################################ # Java ################################################################################ @@ -77,6 +95,11 @@ Requires: slf4j Requires: slf4j-jdk14 Requires: apache-commons-lang3 +%if "%{name}" != "jss" +Obsoletes: jss < %{version}-%{release} +Provides: jss = %{version}-%{release} +%endif + Conflicts: ldapjdk < 4.20 Conflicts: idm-console-framework < 1.2 Conflicts: tomcatjss < 7.6.0 @@ -95,6 +118,11 @@ This only works with gcj. Other JREs require that JCE providers be signed. Summary: Java Security Services (JSS) Javadocs Requires: jss = %{version}-%{release} +%if "%{name}" != "jss" +Obsoletes: jss-javadoc < %{version}-%{release} +Provides: jss-javadoc = %{version}-%{release} +%endif + %description javadoc This package contains the API documentation for JSS. %endif @@ -103,7 +131,7 @@ This package contains the API documentation for JSS. %prep ################################################################################ -%autosetup -n %{name}-%{version}%{?_phase} -p 1 +%autosetup -n jss-%{version}%{?phase:-}%{?phase} -p 1 ################################################################################ %build @@ -167,11 +195,15 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %defattr(-,root,root,-) -%{_javadocdir}/%{name}/ +%{_javadocdir}/jss/ %endif ################################################################################ %changelog +* Wed Apr 27 2022 Dogtag PKI Team - 5.2.0-0.3.beta2 +- Rebase to JSS 5.2.0-beta2 +- Rename packages to dogtag-jss + * Mon Apr 11 2022 Dogtag PKI Team - 5.2.0-0.2.beta1 - Rebase to JSS 5.2.0-beta1 diff --git a/sources b/sources index b03417d..2711f9e 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-5.2.0-beta1.tar.gz) = be6f4612567676e797bb07a00cbc8e6ebab4e930770e00514152e5c3389a0484dcc3eb959c3c57d33d12ed38fbf160a02c69d1c6d5c7b40b93b9fe90cbf0bbb3 +SHA512 (jss-5.2.0-beta2.tar.gz) = cdb40a65e816972e0eac1055a4bd4bb5a04906dbeddfefb36d099562a7b6b9841d2fdf3b1217179f59deadeaaf5d1be16affe5f713be01f806f06cab00486917 From ced9b084df8933927a8c463ad63d839ba26955c2 Mon Sep 17 00:00:00 2001 From: "Endi S. Dewata" Date: Thu, 28 Apr 2022 09:55:23 -0500 Subject: [PATCH 49/78] Add dogtag-jss subpackage --- jss.spec | 30 +++++++++++++++++++----------- sources | 2 +- 2 files changed, 20 insertions(+), 12 deletions(-) diff --git a/jss.spec b/jss.spec index 42a9102..fd4940f 100644 --- a/jss.spec +++ b/jss.spec @@ -1,7 +1,9 @@ ################################################################################ -Name: dogtag-jss +Name: jss ################################################################################ +%global product_id dogtag-jss + # Upstream version number: %global major_version 5 %global minor_version 2 @@ -88,6 +90,17 @@ BuildRequires: apache-commons-lang3 BuildRequires: junit +%description +Java Security Services (JSS) is a java native interface which provides a bridge +for java-based applications to use native Network Security Services (NSS). +This only works with gcj. Other JREs require that JCE providers be signed. + +################################################################################ +%package -n %{product_id} +################################################################################ + +Summary: Java Security Services (JSS) + Requires: nss >= 3.66 Requires: %{java_headless} Requires: jpackage-utils @@ -95,35 +108,30 @@ Requires: slf4j Requires: slf4j-jdk14 Requires: apache-commons-lang3 -%if "%{name}" != "jss" Obsoletes: jss < %{version}-%{release} Provides: jss = %{version}-%{release} -%endif Conflicts: ldapjdk < 4.20 Conflicts: idm-console-framework < 1.2 Conflicts: tomcatjss < 7.6.0 Conflicts: pki-base < 10.10.0 -%description +%description -n %{product_id} Java Security Services (JSS) is a java native interface which provides a bridge for java-based applications to use native Network Security Services (NSS). This only works with gcj. Other JREs require that JCE providers be signed. %if %{with javadoc} ################################################################################ -%package javadoc +%package -n %{product_id}-javadoc ################################################################################ Summary: Java Security Services (JSS) Javadocs -Requires: jss = %{version}-%{release} -%if "%{name}" != "jss" Obsoletes: jss-javadoc < %{version}-%{release} Provides: jss-javadoc = %{version}-%{release} -%endif -%description javadoc +%description -n %{product_id}-javadoc This package contains the API documentation for JSS. %endif @@ -180,7 +188,7 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA install ################################################################################ -%files +%files -n %{product_id} ################################################################################ %defattr(-,root,root,-) @@ -191,7 +199,7 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA %if %{with javadoc} ################################################################################ -%files javadoc +%files -n %{product_id}-javadoc ################################################################################ %defattr(-,root,root,-) diff --git a/sources b/sources index 2711f9e..96f4b70 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-5.2.0-beta2.tar.gz) = cdb40a65e816972e0eac1055a4bd4bb5a04906dbeddfefb36d099562a7b6b9841d2fdf3b1217179f59deadeaaf5d1be16affe5f713be01f806f06cab00486917 +SHA512 (jss-5.2.0-beta2.tar.gz) = da0ff4cd544cb9d339995251f48a4e402f44ab838beacfc96a2d92bb32a6581c81c005bc075fb8cfa5220d2c92e332a946f28b7aa1be61ec2671c396d721e48f From e19c3126fcc52b5c77c837706e0786558e945e19 Mon Sep 17 00:00:00 2001 From: "Endi S. Dewata" Date: Wed, 29 Jun 2022 20:06:09 -0500 Subject: [PATCH 50/78] Rebase to JSS 5.2.0 --- .gitignore | 1 + jss.spec | 11 +++++++---- sources | 2 +- 3 files changed, 9 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 664530f..f35bae3 100644 --- a/.gitignore +++ b/.gitignore @@ -42,3 +42,4 @@ jss-4.2.6.tar.gz /jss-5.1.0.tar.gz /jss-5.2.0-beta1.tar.gz /jss-5.2.0-beta2.tar.gz +/jss-5.2.0.tar.gz diff --git a/jss.spec b/jss.spec index fd4940f..823d0ae 100644 --- a/jss.spec +++ b/jss.spec @@ -12,19 +12,19 @@ Name: jss # Downstream release number: # - development/stabilization (unsupported): 0. where n >= 1 # - GA/update (supported): where n >= 1 -%global release_number 0.3 +%global release_number 1 # Development phase: # - development (unsupported): alpha where n >= 1 # - stabilization (unsupported): beta where n >= 1 # - GA/update (supported): -%global phase beta2 +%undefine phase %undefine timestamp %undefine commit_id Summary: Java Security Services (JSS) -URL: http://www.dogtagpki.org/wiki/JSS +URL: https://github.com/dogtagpki/jss License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: %{major_version}.%{minor_version}.%{update_version} Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist} @@ -167,7 +167,7 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA --prefix-dir=%{_prefix} \ --include-dir=%{_includedir} \ --lib-dir=%{_libdir} \ - --sysconfig-dir=%{_sysconfigdir} \ + --sysconf-dir=%{_sysconfdir} \ --share-dir=%{_datadir} \ --cmake=%{__cmake} \ --java-home=%{java_home} \ @@ -208,6 +208,9 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %changelog +* Wed Jun 29 2022 Dogtag PKI Team - 5.2.0-1 +- Rebase to JSS 5.2.0 + * Wed Apr 27 2022 Dogtag PKI Team - 5.2.0-0.3.beta2 - Rebase to JSS 5.2.0-beta2 - Rename packages to dogtag-jss diff --git a/sources b/sources index 96f4b70..ec3fe03 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-5.2.0-beta2.tar.gz) = da0ff4cd544cb9d339995251f48a4e402f44ab838beacfc96a2d92bb32a6581c81c005bc075fb8cfa5220d2c92e332a946f28b7aa1be61ec2671c396d721e48f +SHA512 (jss-5.2.0.tar.gz) = daddcd424d3de93544485b2442b20ffa97cc3653e1ca82cf1402983f3dd08779157fc65ff240eb4872861fcdb02ed720e09e78e5238d51e664c3875f4bb6f663 From 3d194c83fd40661cc2741601e1e2f3faa413057d Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 21 Jul 2022 15:28:13 +0000 Subject: [PATCH 51/78] Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index 823d0ae..e299628 100644 --- a/jss.spec +++ b/jss.spec @@ -27,7 +27,7 @@ Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: %{major_version}.%{minor_version}.%{update_version} -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist} +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.1 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -208,6 +208,9 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %changelog +* Thu Jul 21 2022 Fedora Release Engineering - 5.2.0-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + * Wed Jun 29 2022 Dogtag PKI Team - 5.2.0-1 - Rebase to JSS 5.2.0 From 7aa4dda38d0dd1cc8863009013217f9852645a93 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 19 Jan 2023 13:57:29 +0000 Subject: [PATCH 52/78] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index e299628..e91b95b 100644 --- a/jss.spec +++ b/jss.spec @@ -27,7 +27,7 @@ Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: %{major_version}.%{minor_version}.%{update_version} -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.1 +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.2 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -208,6 +208,9 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %changelog +* Thu Jan 19 2023 Fedora Release Engineering - 5.2.0-1.2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Thu Jul 21 2022 Fedora Release Engineering - 5.2.0-1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild From fddba91c299f613ee08ea85076908f0c221a0d40 Mon Sep 17 00:00:00 2001 From: "Endi S. Dewata" Date: Tue, 7 Feb 2023 12:45:03 -0600 Subject: [PATCH 53/78] Rebase to JSS 5.3.0 --- .gitignore | 1 + jss.spec | 18 ++++++++++++++---- sources | 2 +- 3 files changed, 16 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index f35bae3..e93a466 100644 --- a/.gitignore +++ b/.gitignore @@ -43,3 +43,4 @@ jss-4.2.6.tar.gz /jss-5.2.0-beta1.tar.gz /jss-5.2.0-beta2.tar.gz /jss-5.2.0.tar.gz +/jss-5.3.0.tar.gz diff --git a/jss.spec b/jss.spec index e91b95b..881aa45 100644 --- a/jss.spec +++ b/jss.spec @@ -6,7 +6,7 @@ Name: jss # Upstream version number: %global major_version 5 -%global minor_version 2 +%global minor_version 3 %global update_version 0 # Downstream release number: @@ -18,7 +18,7 @@ Name: jss # - development (unsupported): alpha where n >= 1 # - stabilization (unsupported): beta where n >= 1 # - GA/update (supported): -%undefine phase +#global phase %undefine timestamp %undefine commit_id @@ -27,7 +27,7 @@ Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: %{major_version}.%{minor_version}.%{update_version} -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.2 +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist} # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -45,8 +45,11 @@ Source: https://github.com/dogtagpki/jss/archive/v%{version}%{?phase:-}% # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch -# Java 17 and md2man are not available on i686 +%if 0%{?fedora} && 0%{?fedora} > 35 +ExclusiveArch: %{java_arches} +%else ExcludeArch: i686 +%endif ################################################################################ # Java @@ -110,6 +113,8 @@ Requires: apache-commons-lang3 Obsoletes: jss < %{version}-%{release} Provides: jss = %{version}-%{release} +Provides: jss = %{major_version}.%{minor_version} +Provides: %{product_id} = %{major_version}.%{minor_version} Conflicts: ldapjdk < 4.20 Conflicts: idm-console-framework < 1.2 @@ -130,6 +135,8 @@ Summary: Java Security Services (JSS) Javadocs Obsoletes: jss-javadoc < %{version}-%{release} Provides: jss-javadoc = %{version}-%{release} +Provides: jss-javadoc = %{major_version}.%{minor_version} +Provides: %{product_id}-javadoc = %{major_version}.%{minor_version} %description -n %{product_id}-javadoc This package contains the API documentation for JSS. @@ -208,6 +215,9 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %changelog +* Tue Feb 07 2023 Dogtag PKI Team - 5.3.0-1 +- Rebase to JSS 5.3.0 + * Thu Jan 19 2023 Fedora Release Engineering - 5.2.0-1.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild diff --git a/sources b/sources index ec3fe03..858c130 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-5.2.0.tar.gz) = daddcd424d3de93544485b2442b20ffa97cc3653e1ca82cf1402983f3dd08779157fc65ff240eb4872861fcdb02ed720e09e78e5238d51e664c3875f4bb6f663 +SHA512 (jss-5.3.0.tar.gz) = 6918683925f94c9d5dbd71a0106216f0a764b3aacca3fe2bc5b52a53780f5cd0400bd1767368ab96a081e2553f0525dee916a707c634867da933e3d1a59de4be From 8ccdc10274032547f9b6a45e0e6e3eda11e93bff Mon Sep 17 00:00:00 2001 From: "Endi S. Dewata" Date: Tue, 7 Feb 2023 13:16:09 -0600 Subject: [PATCH 54/78] Update version number in JSSConfig.cmake --- sources | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sources b/sources index 858c130..46e22b9 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-5.3.0.tar.gz) = 6918683925f94c9d5dbd71a0106216f0a764b3aacca3fe2bc5b52a53780f5cd0400bd1767368ab96a081e2553f0525dee916a707c634867da933e3d1a59de4be +SHA512 (jss-5.3.0.tar.gz) = 2cf75d3d7d028493ac22e5367035959d120317298d9b276b34ef5824d189c0eb62bfe8c83fce4ae8cf63e140495f0ea725e57a3da7219c05319195dea31e51ce From fdc6d683c010995ff335684af48935da7eb93db6 Mon Sep 17 00:00:00 2001 From: "Endi S. Dewata" Date: Tue, 7 Feb 2023 13:24:25 -0600 Subject: [PATCH 55/78] Update spec file --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index 881aa45..affdeb5 100644 --- a/jss.spec +++ b/jss.spec @@ -12,7 +12,7 @@ Name: jss # Downstream release number: # - development/stabilization (unsupported): 0. where n >= 1 # - GA/update (supported): where n >= 1 -%global release_number 1 +%global release_number 2 # Development phase: # - development (unsupported): alpha where n >= 1 @@ -215,6 +215,9 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %changelog +* Tue Feb 07 2023 Dogtag PKI Team - 5.3.0-2 +- Update version number in JSSConfig.cmake + * Tue Feb 07 2023 Dogtag PKI Team - 5.3.0-1 - Rebase to JSS 5.3.0 From a7851eaff4b1413a51b762bfe4196b507275e91a Mon Sep 17 00:00:00 2001 From: Chris Kelley Date: Tue, 28 Feb 2023 06:40:19 +0000 Subject: [PATCH 56/78] Update to SPDX licence --- jss.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index affdeb5..5b39906 100644 --- a/jss.spec +++ b/jss.spec @@ -25,7 +25,7 @@ Name: jss Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss -License: MPLv1.1 or GPLv2+ or LGPLv2+ +License: MPL-1.1 or GPL-2.0-or-later or LGPL-2.1-or-later Version: %{major_version}.%{minor_version}.%{update_version} Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist} From f8f85c0c8f42c0a704d049f55757eae9709597c2 Mon Sep 17 00:00:00 2001 From: Packit Date: Fri, 16 Jun 2023 11:55:40 +0000 Subject: [PATCH 57/78] [packit] 5.4.2 upstream release Upstream tag: v5.4.2 Upstream commit: 7e99d7e7 --- .gitignore | 1 + .packit.yaml | 30 ++++++++++++++++++++++++++++++ README.packit | 3 +++ jss.spec | 33 +++++++++++++++++++-------------- sources | 2 +- 5 files changed, 54 insertions(+), 15 deletions(-) create mode 100644 .packit.yaml create mode 100644 README.packit diff --git a/.gitignore b/.gitignore index e93a466..1ddcac1 100644 --- a/.gitignore +++ b/.gitignore @@ -44,3 +44,4 @@ jss-4.2.6.tar.gz /jss-5.2.0-beta2.tar.gz /jss-5.2.0.tar.gz /jss-5.3.0.tar.gz +/jss-5.4.2.tar.gz diff --git a/.packit.yaml b/.packit.yaml new file mode 100644 index 0000000..73d2062 --- /dev/null +++ b/.packit.yaml @@ -0,0 +1,30 @@ +--- +# See the documentation for more information: +# https://packit.dev/docs/configuration/ +specfile_path: jss.spec + +# add or remove files that should be synced +files_to_sync: + - jss.spec + - .packit.yaml + +# Allow dist git reactions on packit and ckelley commits and PRs +allowed_pr_authors: + - packit + - ckelleyRH +allowed_committers: + - packit + - ckelleyRH + +upstream_package_name: jss +# downstream (Fedora/CentOS) RPM package name +downstream_package_name: jss +# see: https://packit.dev/docs/configuration/#upstream_tag_template +upstream_tag_template: "v{version}" + +jobs: + - job: propose_downstream + trigger: release + dist_git_branches: + - fedora-development +# - centos-stream-9-x86_64 # When Packit integration with CentOS is avaiable, enable this diff --git a/README.packit b/README.packit new file mode 100644 index 0000000..07bc213 --- /dev/null +++ b/README.packit @@ -0,0 +1,3 @@ +This repository is maintained by packit. +https://packit.dev/ +The file was generated using packit 0.76.0.post10+g0dcb396. diff --git a/jss.spec b/jss.spec index 5b39906..7f6f32e 100644 --- a/jss.spec +++ b/jss.spec @@ -6,13 +6,13 @@ Name: jss # Upstream version number: %global major_version 5 -%global minor_version 3 -%global update_version 0 +%global minor_version 4 +%global update_version 2 # Downstream release number: # - development/stabilization (unsupported): 0. where n >= 1 # - GA/update (supported): where n >= 1 -%global release_number 2 +%global release_number 1 # Development phase: # - development (unsupported): alpha where n >= 1 @@ -26,7 +26,7 @@ Name: jss Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss License: MPL-1.1 or GPL-2.0-or-later or LGPL-2.1-or-later -Version: %{major_version}.%{minor_version}.%{update_version} +Version: 5.4.2 Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist} # To generate the source tarball: @@ -85,13 +85,13 @@ BuildRequires: unzip BuildRequires: gcc-c++ BuildRequires: nss-devel >= 3.66 BuildRequires: nss-tools >= 3.66 -BuildRequires: %{java_devel} -BuildRequires: jpackage-utils -BuildRequires: slf4j -BuildRequires: slf4j-jdk14 -BuildRequires: apache-commons-lang3 -BuildRequires: junit +BuildRequires: %{java_devel} +BuildRequires: maven-local +BuildRequires: mvn(org.apache.commons:commons-lang3) +BuildRequires: mvn(org.slf4j:slf4j-api) +BuildRequires: mvn(org.slf4j:slf4j-jdk14) +BuildRequires: mvn(junit:junit) %description Java Security Services (JSS) is a java native interface which provides a bridge @@ -105,11 +105,11 @@ This only works with gcj. Other JREs require that JCE providers be signed. Summary: Java Security Services (JSS) Requires: nss >= 3.66 + Requires: %{java_headless} -Requires: jpackage-utils -Requires: slf4j -Requires: slf4j-jdk14 -Requires: apache-commons-lang3 +Requires: mvn(org.apache.commons:commons-lang3) +Requires: mvn(org.slf4j:slf4j-api) +Requires: mvn(org.slf4j:slf4j-jdk14) Obsoletes: jss < %{version}-%{release} Provides: jss = %{version}-%{release} @@ -215,6 +215,11 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %changelog +* Fri Jun 16 2023 Packit - 5.4.2-1 +- Updating version to v5.4.2 (Chris Kelley) +- Upstream spec file changes to reduce diffs (Chris Kelley) +- Introduce Packit configuration for jss (Chris Kelley) + * Tue Feb 07 2023 Dogtag PKI Team - 5.3.0-2 - Update version number in JSSConfig.cmake diff --git a/sources b/sources index 46e22b9..5f64e0c 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-5.3.0.tar.gz) = 2cf75d3d7d028493ac22e5367035959d120317298d9b276b34ef5824d189c0eb62bfe8c83fce4ae8cf63e140495f0ea725e57a3da7219c05319195dea31e51ce +SHA512 (jss-5.4.2.tar.gz) = 8e5c0ed93d8bafbfd8a8f822aaeda5d4b60e7609aa24f793eb3c449918a4a23884a55966f40d66d810e9b56114eb7cefb8dfeee565fe680c79ef876bc9acfefa From 33742c45895518e8e7be3ab4f4d71463ab4362a3 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 20 Jul 2023 08:15:39 +0000 Subject: [PATCH 58/78] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index 7f6f32e..a98c500 100644 --- a/jss.spec +++ b/jss.spec @@ -27,7 +27,7 @@ Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss License: MPL-1.1 or GPL-2.0-or-later or LGPL-2.1-or-later Version: 5.4.2 -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist} +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.1 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -215,6 +215,9 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %changelog +* Thu Jul 20 2023 Fedora Release Engineering - 5.4.2-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Fri Jun 16 2023 Packit - 5.4.2-1 - Updating version to v5.4.2 (Chris Kelley) - Upstream spec file changes to reduce diffs (Chris Kelley) From 419c9333510e5e3175f69551ba875ab05800141b Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 20 Jan 2024 23:50:48 +0000 Subject: [PATCH 59/78] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index a98c500..f5203a7 100644 --- a/jss.spec +++ b/jss.spec @@ -27,7 +27,7 @@ Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss License: MPL-1.1 or GPL-2.0-or-later or LGPL-2.1-or-later Version: 5.4.2 -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.1 +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.2 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -215,6 +215,9 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %changelog +* Sat Jan 20 2024 Fedora Release Engineering - 5.4.2-1.2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Thu Jul 20 2023 Fedora Release Engineering - 5.4.2-1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild From e722059771135bd087d97816917f1e676af76d60 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 24 Jan 2024 23:30:49 +0000 Subject: [PATCH 60/78] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index f5203a7..0b3c810 100644 --- a/jss.spec +++ b/jss.spec @@ -27,7 +27,7 @@ Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss License: MPL-1.1 or GPL-2.0-or-later or LGPL-2.1-or-later Version: 5.4.2 -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.2 +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.3 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -215,6 +215,9 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %changelog +* Wed Jan 24 2024 Fedora Release Engineering - 5.4.2-1.3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Sat Jan 20 2024 Fedora Release Engineering - 5.4.2-1.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From 9eff0686ac23054a17d4332384fdb2da483763dc Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Thu, 8 Feb 2024 12:15:32 -0500 Subject: [PATCH 61/78] Fix compatibility with NSS 3.97 https://github.com/dogtagpki/jss/pull/992 --- jss-5.4.2-nss-3.97.patch | 40 ++++++++++++++++++++++++++++++++++++++++ jss.spec | 8 +++++++- 2 files changed, 47 insertions(+), 1 deletion(-) create mode 100644 jss-5.4.2-nss-3.97.patch diff --git a/jss-5.4.2-nss-3.97.patch b/jss-5.4.2-nss-3.97.patch new file mode 100644 index 0000000..8b9d64d --- /dev/null +++ b/jss-5.4.2-nss-3.97.patch @@ -0,0 +1,40 @@ +From 130d543f3a7c33196bef386b4ee87ccc4ed53d0b Mon Sep 17 00:00:00 2001 +From: "Endi S. Dewata" +Date: Wed, 7 Feb 2024 14:59:31 -0600 +Subject: [PATCH] Update kea_alg_defs to match NSS 3.97 + +The kea_alg_defs array in SSLCipher.c has been updated to match +the one defined in NSS 3.97. The assertion that compares the size +of the array with ssl_kea_size has also been removed. These +changes will allow JSS to work with the newer NSS 3.97 on Fedora +Rawhide as well as the older NSS versions on other platforms. + +Resolves: https://github.com/dogtagpki/jss/issues/991 +--- + native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c b/native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c +index 4f2dacb0b..ea739617a 100644 +--- a/native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c ++++ b/native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c +@@ -23,7 +23,7 @@ static const CK_MECHANISM_TYPE auth_alg_defs[] = { + }; + PR_STATIC_ASSERT(PR_ARRAY_SIZE(auth_alg_defs) == ssl_auth_size); + +-/* Copied from NSS's ssl3con.c. */ ++/* Copied from NSS 3.97's ssl3con.c. */ + static const CK_MECHANISM_TYPE kea_alg_defs[] = { + CKM_INVALID_MECHANISM, /* ssl_kea_null */ + CKM_RSA_PKCS, /* ssl_kea_rsa */ +@@ -33,8 +33,9 @@ static const CK_MECHANISM_TYPE kea_alg_defs[] = { + CKM_ECDH1_DERIVE, /* ssl_kea_ecdh_psk */ + CKM_DH_PKCS_DERIVE, /* ssl_kea_dh_psk */ + CKM_INVALID_MECHANISM, /* ssl_kea_tls13_any */ ++ CKM_INVALID_MECHANISM, /* ssl_kea_ecdh_hybrid */ ++ CKM_INVALID_MECHANISM, /* ssl_kea_ecdh_hybrid_psk */ + }; +-PR_STATIC_ASSERT(PR_ARRAY_SIZE(kea_alg_defs) == ssl_kea_size); + + #ifdef HAVE_NSS_CIPHER_SUITE_INFO_KDFHASH + /* Not present in ssl3con.c. */ diff --git a/jss.spec b/jss.spec index 0b3c810..a3e30bd 100644 --- a/jss.spec +++ b/jss.spec @@ -27,7 +27,7 @@ Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss License: MPL-1.1 or GPL-2.0-or-later or LGPL-2.1-or-later Version: 5.4.2 -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.3 +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.4 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -45,6 +45,9 @@ Source: https://github.com/dogtagpki/jss/archive/v%{version}%{?phase:-}% # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch +# https://github.com/dogtagpki/jss/pull/992 +Patch: jss-5.4.2-nss-3.97.patch + %if 0%{?fedora} && 0%{?fedora} > 35 ExclusiveArch: %{java_arches} %else @@ -215,6 +218,9 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %changelog +* Thu Feb 08 2024 Yaakov Selkowitz - 5.4.2-1.4 +- Fix compatibility with NSS 3.97 + * Wed Jan 24 2024 Fedora Release Engineering - 5.4.2-1.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From 18e3b27daba28e3ecb75e6ef298b2dc21c52275a Mon Sep 17 00:00:00 2001 From: "Endi S. Dewata" Date: Wed, 21 Feb 2024 18:08:28 -0600 Subject: [PATCH 62/78] Rebased to JSS 5.5.0 --- .gitignore | 2 + jss.spec | 181 ++++++++++++++++++++++++++++++++++++++++++++++------- sources | 2 +- 3 files changed, 161 insertions(+), 24 deletions(-) diff --git a/.gitignore b/.gitignore index 1ddcac1..25ef8c4 100644 --- a/.gitignore +++ b/.gitignore @@ -45,3 +45,5 @@ jss-4.2.6.tar.gz /jss-5.2.0.tar.gz /jss-5.3.0.tar.gz /jss-5.4.2.tar.gz +/jss-5.5.0-alpha2.tar.gz +/jss-5.5.0.tar.gz diff --git a/jss.spec b/jss.spec index a3e30bd..5742bef 100644 --- a/jss.spec +++ b/jss.spec @@ -6,8 +6,8 @@ Name: jss # Upstream version number: %global major_version 5 -%global minor_version 4 -%global update_version 2 +%global minor_version 5 +%global update_version 0 # Downstream release number: # - development/stabilization (unsupported): 0. where n >= 1 @@ -25,9 +25,9 @@ Name: jss Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss -License: MPL-1.1 or GPL-2.0-or-later or LGPL-2.1-or-later -Version: 5.4.2 -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.4 +License: (MPL-1.1 or GPL-2.0-or-later or LGPL-2.1-or-later) and Apache-2.0 +Version: %{major_version}.%{minor_version}.%{update_version} +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist} # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -45,10 +45,7 @@ Source: https://github.com/dogtagpki/jss/archive/v%{version}%{?phase:-}% # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch -# https://github.com/dogtagpki/jss/pull/992 -Patch: jss-5.4.2-nss-3.97.patch - -%if 0%{?fedora} && 0%{?fedora} > 35 +%if 0%{?java_arches:1} ExclusiveArch: %{java_arches} %else ExcludeArch: i686 @@ -71,10 +68,10 @@ ExcludeArch: i686 %bcond_without javadoc -# By default the build will not execute unit tests unless --with tests -# option is specified. +# By default the tests package will be built and the tests will executed +# unless --without tests option is specified. -%bcond_with tests +%bcond_without tests ################################################################################ # Build Dependencies @@ -94,7 +91,6 @@ BuildRequires: maven-local BuildRequires: mvn(org.apache.commons:commons-lang3) BuildRequires: mvn(org.slf4j:slf4j-api) BuildRequires: mvn(org.slf4j:slf4j-jdk14) -BuildRequires: mvn(junit:junit) %description Java Security Services (JSS) is a java native interface which provides a bridge @@ -121,7 +117,6 @@ Provides: %{product_id} = %{major_version}.%{minor_version} Conflicts: ldapjdk < 4.20 Conflicts: idm-console-framework < 1.2 -Conflicts: tomcatjss < 7.6.0 Conflicts: pki-base < 10.10.0 %description -n %{product_id} @@ -129,6 +124,41 @@ Java Security Services (JSS) is a java native interface which provides a bridge for java-based applications to use native Network Security Services (NSS). This only works with gcj. Other JREs require that JCE providers be signed. +################################################################################ +%package -n %{product_id}-tomcat +################################################################################ + +Summary: Java Security Services (JSS) Connector for Tomcat + +# Tomcat +BuildRequires: mvn(org.apache.tomcat:tomcat-catalina) >= 9.0.62 +BuildRequires: mvn(org.apache.tomcat:tomcat-coyote) >= 9.0.62 +BuildRequires: mvn(org.apache.tomcat:tomcat-juli) >= 9.0.62 + +Requires: %{product_id} = %{version}-%{release} +Requires: mvn(org.apache.tomcat:tomcat-catalina) >= 9.0.62 +Requires: mvn(org.apache.tomcat:tomcat-coyote) >= 9.0.62 +Requires: mvn(org.apache.tomcat:tomcat-juli) >= 9.0.62 + +# Tomcat JSS has been replaced with JSS Connector for Tomcat. +# This will remove installed Tomcat JSS packages. +Obsoletes: tomcatjss <= 8.5 +Conflicts: tomcatjss <= 8.5 +Obsoletes: dogtag-tomcatjss <= 8.5 +Conflicts: dogtag-tomcatjss <= 8.5 + +%if 0%{?rhel} <= 8 +# PKI Servlet Engine has been replaced with Tomcat. +# This will remove installed PKI Servlet Engine packages. +Obsoletes: pki-servlet-engine <= 9.0 +Conflicts: pki-servlet-engine <= 9.0 +%endif + +%description -n %{product_id}-tomcat +JSS Connector for Tomcat is a Java Secure Socket Extension (JSSE) +module for Apache Tomcat that uses Java Security Services (JSS), +a Java interface to Network Security Services (NSS). + %if %{with javadoc} ################################################################################ %package -n %{product_id}-javadoc @@ -145,12 +175,46 @@ Provides: %{product_id}-javadoc = %{major_version}.%{minor_version} This package contains the API documentation for JSS. %endif +%if %{with tests} +################################################################################ +%package -n %{product_id}-tests +################################################################################ + +Summary: Java Security Services (JSS) Tests + +BuildRequires: mvn(org.junit.jupiter:junit-jupiter) +BuildRequires: mvn(org.opentest4j:opentest4j) + +%description -n %{product_id}-tests +This package provides test suite for JSS. + +# with tests +%endif + ################################################################################ %prep ################################################################################ %autosetup -n jss-%{version}%{?phase:-}%{?phase} -p 1 +# disable native modules since they will be built by CMake +%pom_disable_module native +%pom_disable_module symkey + +# do not ship examples +%pom_disable_module examples + +# flatten-maven-plugin is not available in RPM +%pom_remove_plugin org.codehaus.mojo:flatten-maven-plugin + +# specify Maven artifact locations +%mvn_file org.dogtagpki.jss:jss-tomcat jss/jss-tomcat +%mvn_file org.dogtagpki.jss:jss-tomcat-9.0 jss/jss-tomcat-9.0 + +# specify Maven artifact packages +%mvn_package org.dogtagpki.jss:jss-tomcat jss-tomcat +%mvn_package org.dogtagpki.jss:jss-tomcat-9.0 jss-tomcat + ################################################################################ %build ################################################################################ @@ -171,6 +235,38 @@ export CFLAGS # Check if we're in FIPS mode modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENABLED=1 +# build Java code, run Java tests, and build Javadoc with Maven +%mvn_build %{!?with_tests:-f} %{!?with_javadoc:-j} + +# create links to Maven-built classes for CMake +mkdir -p %{_vpath_builddir}/classes/jss +ln -sf ../../../base/target/classes/org %{_vpath_builddir}/classes/jss +%if %{with tests} +mkdir -p %{_vpath_builddir}/classes/tests +ln -sf ../../../base/target/test-classes/org %{_vpath_builddir}/classes/tests +%endif + +# create links to Maven-built JAR files for CMake +ln -sf ../base/target/jss.jar %{_vpath_builddir} +%if %{with tests} +ln -sf ../base/target/jss-tests.jar %{_vpath_builddir} +%endif + +# create links to Maven-built headers for CMake +mkdir -p %{_vpath_builddir}/include/jss +ln -sf ../../../base/target/include/_jni %{_vpath_builddir}/include/jss/_jni + +# mark Maven-built targets so that CMake will not rebuild them +mkdir -p %{_vpath_builddir}/.targets +touch %{_vpath_builddir}/.targets/finished_generate_java +%if %{with tests} +touch %{_vpath_builddir}/.targets/finished_tests_generate_java +%endif +%if %{with javadoc} +touch %{_vpath_builddir}/.targets/finished_generate_javadocs +%endif + +# build native code and run native tests with CMake ./build.sh \ %{?_verbose:-v} \ --work-dir=%{_vpath_builddir} \ @@ -183,41 +279,80 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA --java-home=%{java_home} \ --jni-dir=%{_jnidir} \ --version=%{version} \ - %{!?with_javadoc:--without-javadoc} \ - %{?with_tests:--with-tests} \ + --without-java \ + --without-javadoc \ + %{!?with_tests:--without-tests} \ dist ################################################################################ %install ################################################################################ +# install Java binaries and Javadoc +%mvn_install + +# install jss.jar +mkdir -p %{buildroot}%{_javadir}/jss +cp base/target/jss.jar %{buildroot}%{_javadir}/jss/jss.jar + +# create links for backward compatibility +mkdir -p %{buildroot}%{_jnidir} +ln -sf ../../..%{_javadir}/jss/jss.jar %{buildroot}%{_jnidir}/jss.jar + +mkdir -p %{buildroot}%{_libdir}/jss +ln -sf ../../..%{_javadir}/jss/jss.jar %{buildroot}%{_libdir}/jss/jss.jar + +# install native binaries ./build.sh \ %{?_verbose:-v} \ --work-dir=%{_vpath_builddir} \ --install-dir=%{buildroot} \ + --without-java \ install +# install tests binaries +%if %{with tests} +mkdir -p %{buildroot}%{_datadir}/jss/tests/lib +cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib +%endif + ################################################################################ -%files -n %{product_id} +%files -n %{product_id} -f .mfiles ################################################################################ -%defattr(-,root,root,-) %doc jss.html %license MPL-1.1.txt gpl.txt lgpl.txt symkey/LICENSE -%{_libdir}/* -%{_jnidir}/* +%{_javadir}/jss/jss.jar +%{_jnidir}/jss.jar +%{_libdir}/jss/jss.jar +%{_libdir}/jss/libjss.so +%{_libdir}/jss/libjss-symkey.so + +################################################################################ +%files -n %{product_id}-tomcat -f .mfiles-jss-tomcat +################################################################################ %if %{with javadoc} ################################################################################ -%files -n %{product_id}-javadoc +%files -n %{product_id}-javadoc -f .mfiles-javadoc +################################################################################ +%endif + +%if %{with tests} +################################################################################ +%files -n %{product_id}-tests ################################################################################ -%defattr(-,root,root,-) -%{_javadocdir}/jss/ +%{_datadir}/jss/tests/ + +# with tests %endif ################################################################################ %changelog +* Wed Feb 21 2024 Dogtag PKI Team 5.5.0-1 +- Rebase to JSS 5.5.0 + * Thu Feb 08 2024 Yaakov Selkowitz - 5.4.2-1.4 - Fix compatibility with NSS 3.97 diff --git a/sources b/sources index 5f64e0c..645ec2a 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-5.4.2.tar.gz) = 8e5c0ed93d8bafbfd8a8f822aaeda5d4b60e7609aa24f793eb3c449918a4a23884a55966f40d66d810e9b56114eb7cefb8dfeee565fe680c79ef876bc9acfefa +SHA512 (jss-5.5.0.tar.gz) = bda0b4df1ef08a264525c9124a29f57945e3a24adadda609b54032d840a1c311d522e34f29bb2246d03d493d108d425a64e4826edcc8a296a2f55b1cdd8a95c0 From d77787f82372d5b7a2707b4bc070d8444b508455 Mon Sep 17 00:00:00 2001 From: Jiri Vanek Date: Tue, 27 Feb 2024 16:42:53 +0100 Subject: [PATCH 63/78] Rebuilt for java-21-openjdk as system jdk https://fedoraproject.org/wiki/Changes/Java21 --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index 5742bef..1defcaa 100644 --- a/jss.spec +++ b/jss.spec @@ -27,7 +27,7 @@ Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss License: (MPL-1.1 or GPL-2.0-or-later or LGPL-2.1-or-later) and Apache-2.0 Version: %{major_version}.%{minor_version}.%{update_version} -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist} +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.1 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -350,6 +350,9 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib ################################################################################ %changelog +* Tue Feb 27 2024 Jiri Vanek - 5.5.0-1.1 +- Rebuilt for java-21-openjdk as system jdk + * Wed Feb 21 2024 Dogtag PKI Team 5.5.0-1 - Rebase to JSS 5.5.0 From bfa1d7c37aa0e8a43b6e6b6b5ea4ff42f6ec23e5 Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Thu, 29 Feb 2024 19:08:28 -0800 Subject: [PATCH 64/78] Really build against java-21 --- jss.spec | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/jss.spec b/jss.spec index 1defcaa..3c07d98 100644 --- a/jss.spec +++ b/jss.spec @@ -12,7 +12,7 @@ Name: jss # Downstream release number: # - development/stabilization (unsupported): 0. where n >= 1 # - GA/update (supported): where n >= 1 -%global release_number 1 +%global release_number 2 # Development phase: # - development (unsupported): alpha where n >= 1 @@ -27,7 +27,7 @@ Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss License: (MPL-1.1 or GPL-2.0-or-later or LGPL-2.1-or-later) and Apache-2.0 Version: %{major_version}.%{minor_version}.%{update_version} -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.1 +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist} # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -55,9 +55,9 @@ ExcludeArch: i686 # Java ################################################################################ -%define java_devel java-17-openjdk-devel -%define java_headless java-17-openjdk-headless -%define java_home %{_jvmdir}/jre-17-openjdk +%define java_devel java-21-openjdk-devel +%define java_headless java-21-openjdk-headless +%define java_home %{_jvmdir}/jre-21-openjdk ################################################################################ # Build Options @@ -350,6 +350,9 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib ################################################################################ %changelog +* Thu Feb 29 2024 Adam Williamson - 5.5.0-2 +- Really build against java-21 + * Tue Feb 27 2024 Jiri Vanek - 5.5.0-1.1 - Rebuilt for java-21-openjdk as system jdk From ed7d60009d506aa3cbff950370e6a3b7fa641275 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 18 Jul 2024 11:12:28 +0000 Subject: [PATCH 65/78] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index 3c07d98..09a8f92 100644 --- a/jss.spec +++ b/jss.spec @@ -27,7 +27,7 @@ Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss License: (MPL-1.1 or GPL-2.0-or-later or LGPL-2.1-or-later) and Apache-2.0 Version: %{major_version}.%{minor_version}.%{update_version} -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist} +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.1 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -350,6 +350,9 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib ################################################################################ %changelog +* Thu Jul 18 2024 Fedora Release Engineering - 5.5.0-2.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Thu Feb 29 2024 Adam Williamson - 5.5.0-2 - Really build against java-21 From b9d8c115ccead49b38ca09eb9fed43d0a2b786f4 Mon Sep 17 00:00:00 2001 From: Jack Magne Date: Tue, 8 Oct 2024 14:20:45 -0700 Subject: [PATCH 66/78] Rebase to 5.5.1, in order to fix rawhide build issue. --- .gitignore | 1 + jss.spec | 6 ++++-- sources | 2 +- 3 files changed, 6 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 25ef8c4..411bfea 100644 --- a/.gitignore +++ b/.gitignore @@ -47,3 +47,4 @@ jss-4.2.6.tar.gz /jss-5.4.2.tar.gz /jss-5.5.0-alpha2.tar.gz /jss-5.5.0.tar.gz +/jss-5.5.1.tar.gz diff --git a/jss.spec b/jss.spec index 09a8f92..a8fc6ce 100644 --- a/jss.spec +++ b/jss.spec @@ -7,12 +7,12 @@ Name: jss # Upstream version number: %global major_version 5 %global minor_version 5 -%global update_version 0 +%global update_version 1 # Downstream release number: # - development/stabilization (unsupported): 0. where n >= 1 # - GA/update (supported): where n >= 1 -%global release_number 2 +%global release_number 1 # Development phase: # - development (unsupported): alpha where n >= 1 @@ -350,6 +350,8 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib ################################################################################ %changelog +* Fri Oct 04 2024 Dogtag PKI Team 5.5.1-1 +- Rebase to JSS 5.5.1 * Thu Jul 18 2024 Fedora Release Engineering - 5.5.0-2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild diff --git a/sources b/sources index 645ec2a..353a32d 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-5.5.0.tar.gz) = bda0b4df1ef08a264525c9124a29f57945e3a24adadda609b54032d840a1c311d522e34f29bb2246d03d493d108d425a64e4826edcc8a296a2f55b1cdd8a95c0 +SHA512 (jss-5.5.1.tar.gz) = 182c9b5f8b6c542278ff44e8573be902194a72c0e9621e2bcdb8df8770a165d83ed27d9189c4c8e66b7ed41cdfe7d66124ef6a056ea0be36ef202126cfce8be3 From 1f8ce4dbba00f3552912caf3dcfb120da1a5fecf Mon Sep 17 00:00:00 2001 From: Marco Fargetta Date: Wed, 20 Nov 2024 18:40:21 +0100 Subject: [PATCH 67/78] Rebase to JSS v5.6.0-alpha1 --- .gitignore | 1 + jss.spec | 44 +++++++++++++++++++++++++++++++++++++------- sources | 2 +- 3 files changed, 39 insertions(+), 8 deletions(-) diff --git a/.gitignore b/.gitignore index 411bfea..377c2aa 100644 --- a/.gitignore +++ b/.gitignore @@ -48,3 +48,4 @@ jss-4.2.6.tar.gz /jss-5.5.0-alpha2.tar.gz /jss-5.5.0.tar.gz /jss-5.5.1.tar.gz +/jss-5.6.0-alpha1.tar.gz diff --git a/jss.spec b/jss.spec index a8fc6ce..e4a38ca 100644 --- a/jss.spec +++ b/jss.spec @@ -2,32 +2,33 @@ Name: jss ################################################################################ -%global product_id dogtag-jss +%global vendor_id dogtag +%global product_id %{vendor_id}-jss # Upstream version number: %global major_version 5 -%global minor_version 5 -%global update_version 1 +%global minor_version 6 +%global update_version 0 # Downstream release number: # - development/stabilization (unsupported): 0. where n >= 1 # - GA/update (supported): where n >= 1 -%global release_number 1 +%global release_number 0.1 # Development phase: # - development (unsupported): alpha where n >= 1 # - stabilization (unsupported): beta where n >= 1 # - GA/update (supported): -#global phase +%global phase alpha1 %undefine timestamp %undefine commit_id Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss -License: (MPL-1.1 or GPL-2.0-or-later or LGPL-2.1-or-later) and Apache-2.0 +License: (MPL-1.1 OR GPL-2.0-or-later OR LGPL-2.1-or-later) AND Apache-2.0 Version: %{major_version}.%{minor_version}.%{update_version} -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.1 +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist} # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -159,6 +160,23 @@ JSS Connector for Tomcat is a Java Secure Socket Extension (JSSE) module for Apache Tomcat that uses Java Security Services (JSS), a Java interface to Network Security Services (NSS). +################################################################################ +%package -n %{product_id}-tools +################################################################################ + +Summary: Java Security Services (JSS) Tools + +Provides: jss-tools = %{version}-%{release} +Provides: jss-tools = %{major_version}.%{minor_version} +Provides: %{product_id}-tools = %{major_version}.%{minor_version} + +# Some PKI tools have been moved into jss-tools. +Conflicts: pki-tools < 11.6 +Conflicts: %{vendor_id}-pki-tools < 11.6 + +%description -n %{product_id}-tools +This package contains JSS tools. + %if %{with javadoc} ################################################################################ %package -n %{product_id}-javadoc @@ -332,6 +350,14 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib %files -n %{product_id}-tomcat -f .mfiles-jss-tomcat ################################################################################ +################################################################################ +%files -n %{product_id}-tools +################################################################################ + +%{_bindir}/p12tool +%{_bindir}/p7tool +%{_bindir}/sslget + %if %{with javadoc} ################################################################################ %files -n %{product_id}-javadoc -f .mfiles-javadoc @@ -350,8 +376,12 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib ################################################################################ %changelog +* Wed Nov 20 2024 Dogtag PKI Team 5.6.0-1 +- Rebase to JSS 5.6.0-alpha1 + * Fri Oct 04 2024 Dogtag PKI Team 5.5.1-1 - Rebase to JSS 5.5.1 + * Thu Jul 18 2024 Fedora Release Engineering - 5.5.0-2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild diff --git a/sources b/sources index 353a32d..8d8bc4b 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-5.5.1.tar.gz) = 182c9b5f8b6c542278ff44e8573be902194a72c0e9621e2bcdb8df8770a165d83ed27d9189c4c8e66b7ed41cdfe7d66124ef6a056ea0be36ef202126cfce8be3 +SHA512 (jss-5.6.0-alpha1.tar.gz) = 239952d7b1fc9d005760e9234aec84a84a02becefffa525853e9cccd5cfc88e6e0d9d2ea2eea59f43e3b6d1686878081eae1e615ed68d759b3c5aef7397a5472 From 9dfe730fd7da6e9d69c14312f867c6f5ef97f61b Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 17 Jan 2025 08:06:05 +0000 Subject: [PATCH 68/78] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index e4a38ca..155a73d 100644 --- a/jss.spec +++ b/jss.spec @@ -28,7 +28,7 @@ Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss License: (MPL-1.1 OR GPL-2.0-or-later OR LGPL-2.1-or-later) AND Apache-2.0 Version: %{major_version}.%{minor_version}.%{update_version} -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist} +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.1 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -376,6 +376,9 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib ################################################################################ %changelog +* Fri Jan 17 2025 Fedora Release Engineering - 5.6.0-0.1.alpha1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Wed Nov 20 2024 Dogtag PKI Team 5.6.0-1 - Rebase to JSS 5.6.0-alpha1 From 0b7b51984cfc72ea2536039d1a185dc4fd79c792 Mon Sep 17 00:00:00 2001 From: jmagne Date: Wed, 9 Jul 2025 15:20:54 -0700 Subject: [PATCH 69/78] Rebase to JSS 5.8.0-beta1. --- .gitignore | 1 + jss.spec | 54 +++++++++++++++++++++++++++++++++++++----------------- sources | 1 + 3 files changed, 39 insertions(+), 17 deletions(-) diff --git a/.gitignore b/.gitignore index 377c2aa..337a5da 100644 --- a/.gitignore +++ b/.gitignore @@ -49,3 +49,4 @@ jss-4.2.6.tar.gz /jss-5.5.0.tar.gz /jss-5.5.1.tar.gz /jss-5.6.0-alpha1.tar.gz +/jss-5.8.0-beta1.tar.gz diff --git a/jss.spec b/jss.spec index 155a73d..e66dbc6 100644 --- a/jss.spec +++ b/jss.spec @@ -7,7 +7,7 @@ Name: jss # Upstream version number: %global major_version 5 -%global minor_version 6 +%global minor_version 8 %global update_version 0 # Downstream release number: @@ -19,7 +19,7 @@ Name: jss # - development (unsupported): alpha where n >= 1 # - stabilization (unsupported): beta where n >= 1 # - GA/update (supported): -%global phase alpha1 +%global phase beta1 %undefine timestamp %undefine commit_id @@ -28,7 +28,7 @@ Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss License: (MPL-1.1 OR GPL-2.0-or-later OR LGPL-2.1-or-later) AND Apache-2.0 Version: %{major_version}.%{minor_version}.%{update_version} -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.1 +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist} # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -56,9 +56,26 @@ ExcludeArch: i686 # Java ################################################################################ +# use Java 17 on Fedora 39 or older and RHEL 9 or older +# otherwise, use Java 21 + +# maven-local is a subpackage of javapackages-tools + +%if 0%{?fedora} && 0%{?fedora} <= 39 || 0%{?rhel} && 0%{?rhel} <= 9 + +%define java_devel java-17-openjdk-devel +%define java_headless java-17-openjdk-headless +%define java_home %{_jvmdir}/jre-17-openjdk +%define maven_local maven-local-openjdk17 + +%else + %define java_devel java-21-openjdk-devel %define java_headless java-21-openjdk-headless %define java_home %{_jvmdir}/jre-21-openjdk +%define maven_local maven-local + +%endif ################################################################################ # Build Options @@ -84,11 +101,11 @@ BuildRequires: zip BuildRequires: unzip BuildRequires: gcc-c++ -BuildRequires: nss-devel >= 3.66 -BuildRequires: nss-tools >= 3.66 +BuildRequires: nss-devel >= 3.101 +BuildRequires: nss-tools >= 3.101 BuildRequires: %{java_devel} -BuildRequires: maven-local +BuildRequires: %{maven_local} BuildRequires: mvn(org.apache.commons:commons-lang3) BuildRequires: mvn(org.slf4j:slf4j-api) BuildRequires: mvn(org.slf4j:slf4j-jdk14) @@ -104,7 +121,7 @@ This only works with gcj. Other JREs require that JCE providers be signed. Summary: Java Security Services (JSS) -Requires: nss >= 3.66 +Requires: nss >= 3.101 Requires: %{java_headless} Requires: mvn(org.apache.commons:commons-lang3) @@ -132,21 +149,21 @@ This only works with gcj. Other JREs require that JCE providers be signed. Summary: Java Security Services (JSS) Connector for Tomcat # Tomcat -BuildRequires: mvn(org.apache.tomcat:tomcat-catalina) >= 9.0.62 -BuildRequires: mvn(org.apache.tomcat:tomcat-coyote) >= 9.0.62 -BuildRequires: mvn(org.apache.tomcat:tomcat-juli) >= 9.0.62 +BuildRequires: mvn(org.apache.tomcat:tomcat-catalina) >= 10.1.33 +BuildRequires: mvn(org.apache.tomcat:tomcat-coyote) >= 10.1.33 +BuildRequires: mvn(org.apache.tomcat:tomcat-juli) >= 10.1.33 Requires: %{product_id} = %{version}-%{release} -Requires: mvn(org.apache.tomcat:tomcat-catalina) >= 9.0.62 -Requires: mvn(org.apache.tomcat:tomcat-coyote) >= 9.0.62 -Requires: mvn(org.apache.tomcat:tomcat-juli) >= 9.0.62 +Requires: mvn(org.apache.tomcat:tomcat-catalina) >= 10.1.33 +Requires: mvn(org.apache.tomcat:tomcat-coyote) >= 10.1.33 +Requires: mvn(org.apache.tomcat:tomcat-juli) >= 10.1.33 # Tomcat JSS has been replaced with JSS Connector for Tomcat. # This will remove installed Tomcat JSS packages. Obsoletes: tomcatjss <= 8.5 Conflicts: tomcatjss <= 8.5 -Obsoletes: dogtag-tomcatjss <= 8.5 -Conflicts: dogtag-tomcatjss <= 8.5 +Obsoletes: %{vendor_id}-tomcatjss <= 8.5 +Conflicts: %{vendor_id}-tomcatjss <= 8.5 %if 0%{?rhel} <= 8 # PKI Servlet Engine has been replaced with Tomcat. @@ -227,11 +244,11 @@ This package provides test suite for JSS. # specify Maven artifact locations %mvn_file org.dogtagpki.jss:jss-tomcat jss/jss-tomcat -%mvn_file org.dogtagpki.jss:jss-tomcat-9.0 jss/jss-tomcat-9.0 +%mvn_file org.dogtagpki.jss:jss-tomcat-10.1 jss/jss-tomcat-10.1 # specify Maven artifact packages %mvn_package org.dogtagpki.jss:jss-tomcat jss-tomcat -%mvn_package org.dogtagpki.jss:jss-tomcat-9.0 jss-tomcat +%mvn_package org.dogtagpki.jss:jss-tomcat-10.1 jss-tomcat ################################################################################ %build @@ -376,6 +393,9 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib ################################################################################ %changelog +* Wed Jul 09 2025 Dogtag PKI Team 5.8.0.1 +- Rebase to JSS 5.8.0-beta1 + * Fri Jan 17 2025 Fedora Release Engineering - 5.6.0-0.1.alpha1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild diff --git a/sources b/sources index 8d8bc4b..45d1760 100644 --- a/sources +++ b/sources @@ -1 +1,2 @@ SHA512 (jss-5.6.0-alpha1.tar.gz) = 239952d7b1fc9d005760e9234aec84a84a02becefffa525853e9cccd5cfc88e6e0d9d2ea2eea59f43e3b6d1686878081eae1e615ed68d759b3c5aef7397a5472 +SHA512 (jss-5.8.0-beta1.tar.gz) = 7890b416218260d215ae80082a05a6c59b3671603ed64afd3ed1e20da20577c34674f53622a075073c568003f3f8dcb05b7b447bd1e32d39292e5e613cbfe894 From 8bbbf53ca8f46fe0c837ad9231ade2504a2d4ac0 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 24 Jul 2025 18:07:42 +0000 Subject: [PATCH 70/78] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index e66dbc6..4272d4a 100644 --- a/jss.spec +++ b/jss.spec @@ -28,7 +28,7 @@ Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss License: (MPL-1.1 OR GPL-2.0-or-later OR LGPL-2.1-or-later) AND Apache-2.0 Version: %{major_version}.%{minor_version}.%{update_version} -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist} +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.1 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -393,6 +393,9 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib ################################################################################ %changelog +* Thu Jul 24 2025 Fedora Release Engineering - 5.8.0-0.1.beta1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Wed Jul 09 2025 Dogtag PKI Team 5.8.0.1 - Rebase to JSS 5.8.0-beta1 From 40255d963a2044724a3285e8787c303e378dfd1f Mon Sep 17 00:00:00 2001 From: jmagne Date: Mon, 28 Jul 2025 17:27:07 -0700 Subject: [PATCH 71/78] Rebase to JSS 5.8.0-beta3 --- .gitignore | 1 + jss.spec | 19 +++++++++++-------- sources | 1 + 3 files changed, 13 insertions(+), 8 deletions(-) diff --git a/.gitignore b/.gitignore index 337a5da..129463a 100644 --- a/.gitignore +++ b/.gitignore @@ -50,3 +50,4 @@ jss-4.2.6.tar.gz /jss-5.5.1.tar.gz /jss-5.6.0-alpha1.tar.gz /jss-5.8.0-beta1.tar.gz +/jss-5.8.0-beta3.tar.gz diff --git a/jss.spec b/jss.spec index 4272d4a..243725a 100644 --- a/jss.spec +++ b/jss.spec @@ -13,13 +13,13 @@ Name: jss # Downstream release number: # - development/stabilization (unsupported): 0. where n >= 1 # - GA/update (supported): where n >= 1 -%global release_number 0.1 +%global release_number 0.3 # Development phase: # - development (unsupported): alpha where n >= 1 # - stabilization (unsupported): beta where n >= 1 # - GA/update (supported): -%global phase beta1 +%global phase beta3 %undefine timestamp %undefine commit_id @@ -149,14 +149,14 @@ This only works with gcj. Other JREs require that JCE providers be signed. Summary: Java Security Services (JSS) Connector for Tomcat # Tomcat -BuildRequires: mvn(org.apache.tomcat:tomcat-catalina) >= 10.1.33 -BuildRequires: mvn(org.apache.tomcat:tomcat-coyote) >= 10.1.33 -BuildRequires: mvn(org.apache.tomcat:tomcat-juli) >= 10.1.33 +BuildRequires: mvn(org.apache.tomcat:tomcat-catalina) >= 10.1.43 +BuildRequires: mvn(org.apache.tomcat:tomcat-coyote) >= 10.1.43 +BuildRequires: mvn(org.apache.tomcat:tomcat-juli) >= 10.1.43 Requires: %{product_id} = %{version}-%{release} -Requires: mvn(org.apache.tomcat:tomcat-catalina) >= 10.1.33 -Requires: mvn(org.apache.tomcat:tomcat-coyote) >= 10.1.33 -Requires: mvn(org.apache.tomcat:tomcat-juli) >= 10.1.33 +Requires: mvn(org.apache.tomcat:tomcat-catalina) >= 10.1.43 +Requires: mvn(org.apache.tomcat:tomcat-coyote) >= 10.1.43 +Requires: mvn(org.apache.tomcat:tomcat-juli) >= 10.1.43 # Tomcat JSS has been replaced with JSS Connector for Tomcat. # This will remove installed Tomcat JSS packages. @@ -393,6 +393,9 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib ################################################################################ %changelog +* Mon Jul 28 2025 Dogtag PKI Team 5.8.0.3 +- Rebase to JSS 5.8.0-beta3 + * Thu Jul 24 2025 Fedora Release Engineering - 5.8.0-0.1.beta1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild diff --git a/sources b/sources index 45d1760..94e6cfe 100644 --- a/sources +++ b/sources @@ -1,2 +1,3 @@ SHA512 (jss-5.6.0-alpha1.tar.gz) = 239952d7b1fc9d005760e9234aec84a84a02becefffa525853e9cccd5cfc88e6e0d9d2ea2eea59f43e3b6d1686878081eae1e615ed68d759b3c5aef7397a5472 SHA512 (jss-5.8.0-beta1.tar.gz) = 7890b416218260d215ae80082a05a6c59b3671603ed64afd3ed1e20da20577c34674f53622a075073c568003f3f8dcb05b7b447bd1e32d39292e5e613cbfe894 +SHA512 (jss-5.8.0-beta3.tar.gz) = 6647ff938d69e39d2ad5f9bb00e03f7fee25c37ba6e4d13700266bdc6c82770927e87ebe486b6bc3378c3368b25db70481ad9d63fd1dd6c9a76e7affd8a127e6 From 6b95178e1edf7854ddf71f5fbe476db9c8eafcba Mon Sep 17 00:00:00 2001 From: Jiri Vanek Date: Wed, 30 Jul 2025 00:01:21 +0200 Subject: [PATCH 72/78] Rebuilt for java-25-openjdk as preffered jdk https://fedoraproject.org/wiki/Changes/Java25AndNoMoreSystemJdk Note, that since f43, you should be always explicit on what jdk to use. This commit should do exactly that. --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index 243725a..6694a9d 100644 --- a/jss.spec +++ b/jss.spec @@ -28,7 +28,7 @@ Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss License: (MPL-1.1 OR GPL-2.0-or-later OR LGPL-2.1-or-later) AND Apache-2.0 Version: %{major_version}.%{minor_version}.%{update_version} -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.1 +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.2 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -393,6 +393,9 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib ################################################################################ %changelog +* Tue Jul 29 2025 jiri vanek - 5.8.0-0.3.beta3.2 +- Rebuilt for java-25-openjdk as preffered jdk + * Mon Jul 28 2025 Dogtag PKI Team 5.8.0.3 - Rebase to JSS 5.8.0-beta3 From 574fd4442eaedad7bbf56137edeb22ede75671d1 Mon Sep 17 00:00:00 2001 From: Jiri Vanek Date: Wed, 30 Jul 2025 14:08:08 +0200 Subject: [PATCH 73/78] Rrevert to jdk21 during rebuild for https://fedoraproject.org/wiki/Changes/Java25AndNoMoreSystemJdk your package failed to build. Is preemptively reverted back to versioned jdk21 --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index 6694a9d..033f464 100644 --- a/jss.spec +++ b/jss.spec @@ -28,7 +28,7 @@ Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss License: (MPL-1.1 OR GPL-2.0-or-later OR LGPL-2.1-or-later) AND Apache-2.0 Version: %{major_version}.%{minor_version}.%{update_version} -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.2 +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.3 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -393,6 +393,9 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib ################################################################################ %changelog +* Wed Jul 30 2025 jiri vanek - 5.8.0-0.3.beta3.3 +- Rrevert to jdk21 + * Tue Jul 29 2025 jiri vanek - 5.8.0-0.3.beta3.2 - Rebuilt for java-25-openjdk as preffered jdk From 591b9b8293c8071fe86c09529a53e88c209978a9 Mon Sep 17 00:00:00 2001 From: jmagne Date: Mon, 11 Aug 2025 16:01:16 -0700 Subject: [PATCH 74/78] Rebase to JSS 5.8.0-beta4 --- .gitignore | 1 + jss.spec | 39 ++++++++++++++++++++------------------- sources | 1 + 3 files changed, 22 insertions(+), 19 deletions(-) diff --git a/.gitignore b/.gitignore index 129463a..0bac5df 100644 --- a/.gitignore +++ b/.gitignore @@ -51,3 +51,4 @@ jss-4.2.6.tar.gz /jss-5.6.0-alpha1.tar.gz /jss-5.8.0-beta1.tar.gz /jss-5.8.0-beta3.tar.gz +/jss-5.8.0-beta4.tar.gz diff --git a/jss.spec b/jss.spec index 033f464..d31e1f5 100644 --- a/jss.spec +++ b/jss.spec @@ -13,13 +13,17 @@ Name: jss # Downstream release number: # - development/stabilization (unsupported): 0. where n >= 1 # - GA/update (supported): where n >= 1 -%global release_number 0.3 +%global release_number 0.4 # Development phase: # - development (unsupported): alpha where n >= 1 # - stabilization (unsupported): beta where n >= 1 # - GA/update (supported): -%global phase beta3 +%global phase beta4 + +%if 0%{?rhel} && 0%{?rhel} >= 10 +%global enable_nss_version_pqc_def_flag -DENABLE_NSS_VERSION_PQC_DEF=ON +%endif %undefine timestamp %undefine commit_id @@ -28,7 +32,7 @@ Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss License: (MPL-1.1 OR GPL-2.0-or-later OR LGPL-2.1-or-later) AND Apache-2.0 Version: %{major_version}.%{minor_version}.%{update_version} -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.3 +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.1 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -61,12 +65,12 @@ ExcludeArch: i686 # maven-local is a subpackage of javapackages-tools -%if 0%{?fedora} && 0%{?fedora} <= 39 || 0%{?rhel} && 0%{?rhel} <= 9 +%if 0%{?fedora} && 0%{?fedora} >= 43 -%define java_devel java-17-openjdk-devel -%define java_headless java-17-openjdk-headless -%define java_home %{_jvmdir}/jre-17-openjdk -%define maven_local maven-local-openjdk17 +%define java_devel java-25-openjdk-devel +%define java_headless java-25-openjdk-headless +%define java_home %{_jvmdir}/jre-25-openjdk +%define maven_local maven-local-openjdk25 %else @@ -149,14 +153,14 @@ This only works with gcj. Other JREs require that JCE providers be signed. Summary: Java Security Services (JSS) Connector for Tomcat # Tomcat -BuildRequires: mvn(org.apache.tomcat:tomcat-catalina) >= 10.1.43 -BuildRequires: mvn(org.apache.tomcat:tomcat-coyote) >= 10.1.43 -BuildRequires: mvn(org.apache.tomcat:tomcat-juli) >= 10.1.43 +BuildRequires: mvn(org.apache.tomcat:tomcat-catalina) >= 10.1.36 +BuildRequires: mvn(org.apache.tomcat:tomcat-coyote) >= 10.1.36 +BuildRequires: mvn(org.apache.tomcat:tomcat-juli) >= 10.1.36 Requires: %{product_id} = %{version}-%{release} -Requires: mvn(org.apache.tomcat:tomcat-catalina) >= 10.1.43 -Requires: mvn(org.apache.tomcat:tomcat-coyote) >= 10.1.43 -Requires: mvn(org.apache.tomcat:tomcat-juli) >= 10.1.43 +Requires: mvn(org.apache.tomcat:tomcat-catalina) >= 10.1.36 +Requires: mvn(org.apache.tomcat:tomcat-coyote) >= 10.1.36 +Requires: mvn(org.apache.tomcat:tomcat-juli) >= 10.1.36 # Tomcat JSS has been replaced with JSS Connector for Tomcat. # This will remove installed Tomcat JSS packages. @@ -393,11 +397,8 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib ################################################################################ %changelog -* Wed Jul 30 2025 jiri vanek - 5.8.0-0.3.beta3.3 -- Rrevert to jdk21 - -* Tue Jul 29 2025 jiri vanek - 5.8.0-0.3.beta3.2 -- Rebuilt for java-25-openjdk as preffered jdk +* Mon Aug 11 2025 Dogtag PKI Team 5.8.0.4 +- Rebase to JSS 5.8.0-beta4 * Mon Jul 28 2025 Dogtag PKI Team 5.8.0.3 - Rebase to JSS 5.8.0-beta3 diff --git a/sources b/sources index 94e6cfe..fc75bdf 100644 --- a/sources +++ b/sources @@ -1,3 +1,4 @@ SHA512 (jss-5.6.0-alpha1.tar.gz) = 239952d7b1fc9d005760e9234aec84a84a02becefffa525853e9cccd5cfc88e6e0d9d2ea2eea59f43e3b6d1686878081eae1e615ed68d759b3c5aef7397a5472 SHA512 (jss-5.8.0-beta1.tar.gz) = 7890b416218260d215ae80082a05a6c59b3671603ed64afd3ed1e20da20577c34674f53622a075073c568003f3f8dcb05b7b447bd1e32d39292e5e613cbfe894 SHA512 (jss-5.8.0-beta3.tar.gz) = 6647ff938d69e39d2ad5f9bb00e03f7fee25c37ba6e4d13700266bdc6c82770927e87ebe486b6bc3378c3368b25db70481ad9d63fd1dd6c9a76e7affd8a127e6 +SHA512 (jss-5.8.0-beta4.tar.gz) = cec7515c4496926303c3b1835d301174588298c8ef1c1cb2bc8fd95683833765d88de5b77af44e418fa953643d2a2d38cc2bd8888abadfc1bd1553e2b33c6268 From 309eeda6384576295e7d4248aa91564403d1a0ec Mon Sep 17 00:00:00 2001 From: Super User Date: Wed, 20 Aug 2025 14:36:12 +0000 Subject: [PATCH 75/78] Rebuild for Fedora 43 --- jss.spec | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/jss.spec b/jss.spec index d31e1f5..c9947c7 100644 --- a/jss.spec +++ b/jss.spec @@ -13,7 +13,7 @@ Name: jss # Downstream release number: # - development/stabilization (unsupported): 0. where n >= 1 # - GA/update (supported): where n >= 1 -%global release_number 0.4 +%global release_number 0.5 # Development phase: # - development (unsupported): alpha where n >= 1 @@ -32,7 +32,7 @@ Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss License: (MPL-1.1 OR GPL-2.0-or-later OR LGPL-2.1-or-later) AND Apache-2.0 Version: %{major_version}.%{minor_version}.%{update_version} -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.1 +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist} # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -397,10 +397,13 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib ################################################################################ %changelog -* Mon Aug 11 2025 Dogtag PKI Team 5.8.0.4 +* Mon Aug 11 2025 Dogtag PKI Team 5.8.0-0.5.beta4 +- Rebuild for Fedora 43 + +* Mon Aug 11 2025 Dogtag PKI Team 5.8.0-0.4.beta4.1 - Rebase to JSS 5.8.0-beta4 -* Mon Jul 28 2025 Dogtag PKI Team 5.8.0.3 +* Mon Jul 28 2025 Dogtag PKI Team 5.8.0-0.3.beta3.1 - Rebase to JSS 5.8.0-beta3 * Thu Jul 24 2025 Fedora Release Engineering - 5.8.0-0.1.beta1.1 From f0361ba6e7debd8efbd65f9bd8643a4f7f878c64 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Fri, 22 Aug 2025 00:05:05 -0400 Subject: [PATCH 76/78] Build with Java 25 for ELN ELN (the future RHEL 11) tracks rawhide and includes the relevant change: https://fedoraproject.org/wiki/Changes/Java25AndNoMoreSystemJdk --- jss.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/jss.spec b/jss.spec index c9947c7..ac6fed7 100644 --- a/jss.spec +++ b/jss.spec @@ -13,7 +13,7 @@ Name: jss # Downstream release number: # - development/stabilization (unsupported): 0. where n >= 1 # - GA/update (supported): where n >= 1 -%global release_number 0.5 +%global release_number 0.6 # Development phase: # - development (unsupported): alpha where n >= 1 @@ -65,7 +65,7 @@ ExcludeArch: i686 # maven-local is a subpackage of javapackages-tools -%if 0%{?fedora} && 0%{?fedora} >= 43 +%if 0%{?fedora} && 0%{?fedora} >= 43 || 0%{?rhel} >= 11 %define java_devel java-25-openjdk-devel %define java_headless java-25-openjdk-headless @@ -397,6 +397,9 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib ################################################################################ %changelog +* Fri Aug 22 2025 Yaakov Selkowitz - 5.8.0-0.6.beta4 +- Build with Java 25 for ELN + * Mon Aug 11 2025 Dogtag PKI Team 5.8.0-0.5.beta4 - Rebuild for Fedora 43 From df09f023d4bd3db32e405738b789f8c9a146a949 Mon Sep 17 00:00:00 2001 From: Marco Fargetta Date: Tue, 4 Nov 2025 10:39:09 +0100 Subject: [PATCH 77/78] Rebase to 5.8.0 --- .gitignore | 1 + jss-5.4.2-nss-3.97.patch | 40 ---------------------------------------- jss.spec | 9 ++++++--- sources | 5 +---- 4 files changed, 8 insertions(+), 47 deletions(-) delete mode 100644 jss-5.4.2-nss-3.97.patch diff --git a/.gitignore b/.gitignore index 0bac5df..edcc16f 100644 --- a/.gitignore +++ b/.gitignore @@ -52,3 +52,4 @@ jss-4.2.6.tar.gz /jss-5.8.0-beta1.tar.gz /jss-5.8.0-beta3.tar.gz /jss-5.8.0-beta4.tar.gz +/jss-5.8.0.tar.gz diff --git a/jss-5.4.2-nss-3.97.patch b/jss-5.4.2-nss-3.97.patch deleted file mode 100644 index 8b9d64d..0000000 --- a/jss-5.4.2-nss-3.97.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 130d543f3a7c33196bef386b4ee87ccc4ed53d0b Mon Sep 17 00:00:00 2001 -From: "Endi S. Dewata" -Date: Wed, 7 Feb 2024 14:59:31 -0600 -Subject: [PATCH] Update kea_alg_defs to match NSS 3.97 - -The kea_alg_defs array in SSLCipher.c has been updated to match -the one defined in NSS 3.97. The assertion that compares the size -of the array with ssl_kea_size has also been removed. These -changes will allow JSS to work with the newer NSS 3.97 on Fedora -Rawhide as well as the older NSS versions on other platforms. - -Resolves: https://github.com/dogtagpki/jss/issues/991 ---- - native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c b/native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c -index 4f2dacb0b..ea739617a 100644 ---- a/native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c -+++ b/native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c -@@ -23,7 +23,7 @@ static const CK_MECHANISM_TYPE auth_alg_defs[] = { - }; - PR_STATIC_ASSERT(PR_ARRAY_SIZE(auth_alg_defs) == ssl_auth_size); - --/* Copied from NSS's ssl3con.c. */ -+/* Copied from NSS 3.97's ssl3con.c. */ - static const CK_MECHANISM_TYPE kea_alg_defs[] = { - CKM_INVALID_MECHANISM, /* ssl_kea_null */ - CKM_RSA_PKCS, /* ssl_kea_rsa */ -@@ -33,8 +33,9 @@ static const CK_MECHANISM_TYPE kea_alg_defs[] = { - CKM_ECDH1_DERIVE, /* ssl_kea_ecdh_psk */ - CKM_DH_PKCS_DERIVE, /* ssl_kea_dh_psk */ - CKM_INVALID_MECHANISM, /* ssl_kea_tls13_any */ -+ CKM_INVALID_MECHANISM, /* ssl_kea_ecdh_hybrid */ -+ CKM_INVALID_MECHANISM, /* ssl_kea_ecdh_hybrid_psk */ - }; --PR_STATIC_ASSERT(PR_ARRAY_SIZE(kea_alg_defs) == ssl_kea_size); - - #ifdef HAVE_NSS_CIPHER_SUITE_INFO_KDFHASH - /* Not present in ssl3con.c. */ diff --git a/jss.spec b/jss.spec index ac6fed7..3300948 100644 --- a/jss.spec +++ b/jss.spec @@ -13,13 +13,13 @@ Name: jss # Downstream release number: # - development/stabilization (unsupported): 0. where n >= 1 # - GA/update (supported): where n >= 1 -%global release_number 0.6 +%global release_number 1 # Development phase: # - development (unsupported): alpha where n >= 1 # - stabilization (unsupported): beta where n >= 1 # - GA/update (supported): -%global phase beta4 +#global phase %if 0%{?rhel} && 0%{?rhel} >= 10 %global enable_nss_version_pqc_def_flag -DENABLE_NSS_VERSION_PQC_DEF=ON @@ -314,7 +314,7 @@ touch %{_vpath_builddir}/.targets/finished_generate_javadocs --lib-dir=%{_libdir} \ --sysconf-dir=%{_sysconfdir} \ --share-dir=%{_datadir} \ - --cmake=%{__cmake} \ + --cmake="%{__cmake} %{?enable_nss_version_pqc_def_flag}" \ --java-home=%{java_home} \ --jni-dir=%{_jnidir} \ --version=%{version} \ @@ -397,6 +397,9 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib ################################################################################ %changelog +* TueNov 04 2025 Dogtag PKI Team 5.8.0-1 +- Rebase to JSS 5.8.0-1 + * Fri Aug 22 2025 Yaakov Selkowitz - 5.8.0-0.6.beta4 - Build with Java 25 for ELN diff --git a/sources b/sources index fc75bdf..f69b2ec 100644 --- a/sources +++ b/sources @@ -1,4 +1 @@ -SHA512 (jss-5.6.0-alpha1.tar.gz) = 239952d7b1fc9d005760e9234aec84a84a02becefffa525853e9cccd5cfc88e6e0d9d2ea2eea59f43e3b6d1686878081eae1e615ed68d759b3c5aef7397a5472 -SHA512 (jss-5.8.0-beta1.tar.gz) = 7890b416218260d215ae80082a05a6c59b3671603ed64afd3ed1e20da20577c34674f53622a075073c568003f3f8dcb05b7b447bd1e32d39292e5e613cbfe894 -SHA512 (jss-5.8.0-beta3.tar.gz) = 6647ff938d69e39d2ad5f9bb00e03f7fee25c37ba6e4d13700266bdc6c82770927e87ebe486b6bc3378c3368b25db70481ad9d63fd1dd6c9a76e7affd8a127e6 -SHA512 (jss-5.8.0-beta4.tar.gz) = cec7515c4496926303c3b1835d301174588298c8ef1c1cb2bc8fd95683833765d88de5b77af44e418fa953643d2a2d38cc2bd8888abadfc1bd1553e2b33c6268 +SHA512 (jss-5.8.0.tar.gz) = 10f5727d78f8b466062396e47c25b7fdac4b70c6862e6857f8aef49b633c43c4485c1d3cd535006ecd090e8dfe787000fb40d8748ed381c4ac4d1d39312e6c3d From 6f9dba75c99de8e629ac4488be635e76280f731c Mon Sep 17 00:00:00 2001 From: Marco Fargetta Date: Tue, 4 Nov 2025 11:08:07 +0100 Subject: [PATCH 78/78] Fix changelog --- jss.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index 3300948..794ee73 100644 --- a/jss.spec +++ b/jss.spec @@ -397,7 +397,7 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib ################################################################################ %changelog -* TueNov 04 2025 Dogtag PKI Team 5.8.0-1 +* Tue Nov 04 2025 Dogtag PKI Team 5.8.0-1 - Rebase to JSS 5.8.0-1 * Fri Aug 22 2025 Yaakov Selkowitz - 5.8.0-0.6.beta4