diff --git a/.gitignore b/.gitignore index edcc16f..25ef8c4 100644 --- a/.gitignore +++ b/.gitignore @@ -47,9 +47,3 @@ jss-4.2.6.tar.gz /jss-5.4.2.tar.gz /jss-5.5.0-alpha2.tar.gz /jss-5.5.0.tar.gz -/jss-5.5.1.tar.gz -/jss-5.6.0-alpha1.tar.gz -/jss-5.8.0-beta1.tar.gz -/jss-5.8.0-beta3.tar.gz -/jss-5.8.0-beta4.tar.gz -/jss-5.8.0.tar.gz diff --git a/jss-5.4.2-nss-3.97.patch b/jss-5.4.2-nss-3.97.patch new file mode 100644 index 0000000..8b9d64d --- /dev/null +++ b/jss-5.4.2-nss-3.97.patch @@ -0,0 +1,40 @@ +From 130d543f3a7c33196bef386b4ee87ccc4ed53d0b Mon Sep 17 00:00:00 2001 +From: "Endi S. Dewata" +Date: Wed, 7 Feb 2024 14:59:31 -0600 +Subject: [PATCH] Update kea_alg_defs to match NSS 3.97 + +The kea_alg_defs array in SSLCipher.c has been updated to match +the one defined in NSS 3.97. The assertion that compares the size +of the array with ssl_kea_size has also been removed. These +changes will allow JSS to work with the newer NSS 3.97 on Fedora +Rawhide as well as the older NSS versions on other platforms. + +Resolves: https://github.com/dogtagpki/jss/issues/991 +--- + native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c b/native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c +index 4f2dacb0b..ea739617a 100644 +--- a/native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c ++++ b/native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c +@@ -23,7 +23,7 @@ static const CK_MECHANISM_TYPE auth_alg_defs[] = { + }; + PR_STATIC_ASSERT(PR_ARRAY_SIZE(auth_alg_defs) == ssl_auth_size); + +-/* Copied from NSS's ssl3con.c. */ ++/* Copied from NSS 3.97's ssl3con.c. */ + static const CK_MECHANISM_TYPE kea_alg_defs[] = { + CKM_INVALID_MECHANISM, /* ssl_kea_null */ + CKM_RSA_PKCS, /* ssl_kea_rsa */ +@@ -33,8 +33,9 @@ static const CK_MECHANISM_TYPE kea_alg_defs[] = { + CKM_ECDH1_DERIVE, /* ssl_kea_ecdh_psk */ + CKM_DH_PKCS_DERIVE, /* ssl_kea_dh_psk */ + CKM_INVALID_MECHANISM, /* ssl_kea_tls13_any */ ++ CKM_INVALID_MECHANISM, /* ssl_kea_ecdh_hybrid */ ++ CKM_INVALID_MECHANISM, /* ssl_kea_ecdh_hybrid_psk */ + }; +-PR_STATIC_ASSERT(PR_ARRAY_SIZE(kea_alg_defs) == ssl_kea_size); + + #ifdef HAVE_NSS_CIPHER_SUITE_INFO_KDFHASH + /* Not present in ssl3con.c. */ diff --git a/jss.spec b/jss.spec index 794ee73..4445917 100644 --- a/jss.spec +++ b/jss.spec @@ -2,12 +2,11 @@ Name: jss ################################################################################ -%global vendor_id dogtag -%global product_id %{vendor_id}-jss +%global product_id dogtag-jss # Upstream version number: %global major_version 5 -%global minor_version 8 +%global minor_version 5 %global update_version 0 # Downstream release number: @@ -21,18 +20,14 @@ Name: jss # - GA/update (supported): #global phase -%if 0%{?rhel} && 0%{?rhel} >= 10 -%global enable_nss_version_pqc_def_flag -DENABLE_NSS_VERSION_PQC_DEF=ON -%endif - %undefine timestamp %undefine commit_id Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss -License: (MPL-1.1 OR GPL-2.0-or-later OR LGPL-2.1-or-later) AND Apache-2.0 +License: (MPL-1.1 or GPL-2.0-or-later or LGPL-2.1-or-later) and Apache-2.0 Version: %{major_version}.%{minor_version}.%{update_version} -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist} +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.1 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -60,26 +55,9 @@ ExcludeArch: i686 # Java ################################################################################ -# use Java 17 on Fedora 39 or older and RHEL 9 or older -# otherwise, use Java 21 - -# maven-local is a subpackage of javapackages-tools - -%if 0%{?fedora} && 0%{?fedora} >= 43 || 0%{?rhel} >= 11 - -%define java_devel java-25-openjdk-devel -%define java_headless java-25-openjdk-headless -%define java_home %{_jvmdir}/jre-25-openjdk -%define maven_local maven-local-openjdk25 - -%else - -%define java_devel java-21-openjdk-devel -%define java_headless java-21-openjdk-headless -%define java_home %{_jvmdir}/jre-21-openjdk -%define maven_local maven-local - -%endif +%define java_devel java-17-openjdk-devel +%define java_headless java-17-openjdk-headless +%define java_home %{_jvmdir}/jre-17-openjdk ################################################################################ # Build Options @@ -105,11 +83,11 @@ BuildRequires: zip BuildRequires: unzip BuildRequires: gcc-c++ -BuildRequires: nss-devel >= 3.101 -BuildRequires: nss-tools >= 3.101 +BuildRequires: nss-devel >= 3.66 +BuildRequires: nss-tools >= 3.66 BuildRequires: %{java_devel} -BuildRequires: %{maven_local} +BuildRequires: maven-local BuildRequires: mvn(org.apache.commons:commons-lang3) BuildRequires: mvn(org.slf4j:slf4j-api) BuildRequires: mvn(org.slf4j:slf4j-jdk14) @@ -125,7 +103,7 @@ This only works with gcj. Other JREs require that JCE providers be signed. Summary: Java Security Services (JSS) -Requires: nss >= 3.101 +Requires: nss >= 3.66 Requires: %{java_headless} Requires: mvn(org.apache.commons:commons-lang3) @@ -153,21 +131,21 @@ This only works with gcj. Other JREs require that JCE providers be signed. Summary: Java Security Services (JSS) Connector for Tomcat # Tomcat -BuildRequires: mvn(org.apache.tomcat:tomcat-catalina) >= 10.1.36 -BuildRequires: mvn(org.apache.tomcat:tomcat-coyote) >= 10.1.36 -BuildRequires: mvn(org.apache.tomcat:tomcat-juli) >= 10.1.36 +BuildRequires: mvn(org.apache.tomcat:tomcat-catalina) >= 9.0.62 +BuildRequires: mvn(org.apache.tomcat:tomcat-coyote) >= 9.0.62 +BuildRequires: mvn(org.apache.tomcat:tomcat-juli) >= 9.0.62 Requires: %{product_id} = %{version}-%{release} -Requires: mvn(org.apache.tomcat:tomcat-catalina) >= 10.1.36 -Requires: mvn(org.apache.tomcat:tomcat-coyote) >= 10.1.36 -Requires: mvn(org.apache.tomcat:tomcat-juli) >= 10.1.36 +Requires: mvn(org.apache.tomcat:tomcat-catalina) >= 9.0.62 +Requires: mvn(org.apache.tomcat:tomcat-coyote) >= 9.0.62 +Requires: mvn(org.apache.tomcat:tomcat-juli) >= 9.0.62 # Tomcat JSS has been replaced with JSS Connector for Tomcat. # This will remove installed Tomcat JSS packages. Obsoletes: tomcatjss <= 8.5 Conflicts: tomcatjss <= 8.5 -Obsoletes: %{vendor_id}-tomcatjss <= 8.5 -Conflicts: %{vendor_id}-tomcatjss <= 8.5 +Obsoletes: dogtag-tomcatjss <= 8.5 +Conflicts: dogtag-tomcatjss <= 8.5 %if 0%{?rhel} <= 8 # PKI Servlet Engine has been replaced with Tomcat. @@ -181,23 +159,6 @@ JSS Connector for Tomcat is a Java Secure Socket Extension (JSSE) module for Apache Tomcat that uses Java Security Services (JSS), a Java interface to Network Security Services (NSS). -################################################################################ -%package -n %{product_id}-tools -################################################################################ - -Summary: Java Security Services (JSS) Tools - -Provides: jss-tools = %{version}-%{release} -Provides: jss-tools = %{major_version}.%{minor_version} -Provides: %{product_id}-tools = %{major_version}.%{minor_version} - -# Some PKI tools have been moved into jss-tools. -Conflicts: pki-tools < 11.6 -Conflicts: %{vendor_id}-pki-tools < 11.6 - -%description -n %{product_id}-tools -This package contains JSS tools. - %if %{with javadoc} ################################################################################ %package -n %{product_id}-javadoc @@ -248,11 +209,11 @@ This package provides test suite for JSS. # specify Maven artifact locations %mvn_file org.dogtagpki.jss:jss-tomcat jss/jss-tomcat -%mvn_file org.dogtagpki.jss:jss-tomcat-10.1 jss/jss-tomcat-10.1 +%mvn_file org.dogtagpki.jss:jss-tomcat-9.0 jss/jss-tomcat-9.0 # specify Maven artifact packages %mvn_package org.dogtagpki.jss:jss-tomcat jss-tomcat -%mvn_package org.dogtagpki.jss:jss-tomcat-10.1 jss-tomcat +%mvn_package org.dogtagpki.jss:jss-tomcat-9.0 jss-tomcat ################################################################################ %build @@ -314,7 +275,7 @@ touch %{_vpath_builddir}/.targets/finished_generate_javadocs --lib-dir=%{_libdir} \ --sysconf-dir=%{_sysconfdir} \ --share-dir=%{_datadir} \ - --cmake="%{__cmake} %{?enable_nss_version_pqc_def_flag}" \ + --cmake=%{__cmake} \ --java-home=%{java_home} \ --jni-dir=%{_jnidir} \ --version=%{version} \ @@ -371,14 +332,6 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib %files -n %{product_id}-tomcat -f .mfiles-jss-tomcat ################################################################################ -################################################################################ -%files -n %{product_id}-tools -################################################################################ - -%{_bindir}/p12tool -%{_bindir}/p7tool -%{_bindir}/sslget - %if %{with javadoc} ################################################################################ %files -n %{product_id}-javadoc -f .mfiles-javadoc @@ -397,43 +350,7 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib ################################################################################ %changelog -* Tue Nov 04 2025 Dogtag PKI Team 5.8.0-1 -- Rebase to JSS 5.8.0-1 - -* Fri Aug 22 2025 Yaakov Selkowitz - 5.8.0-0.6.beta4 -- Build with Java 25 for ELN - -* Mon Aug 11 2025 Dogtag PKI Team 5.8.0-0.5.beta4 -- Rebuild for Fedora 43 - -* Mon Aug 11 2025 Dogtag PKI Team 5.8.0-0.4.beta4.1 -- Rebase to JSS 5.8.0-beta4 - -* Mon Jul 28 2025 Dogtag PKI Team 5.8.0-0.3.beta3.1 -- Rebase to JSS 5.8.0-beta3 - -* Thu Jul 24 2025 Fedora Release Engineering - 5.8.0-0.1.beta1.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - -* Wed Jul 09 2025 Dogtag PKI Team 5.8.0.1 -- Rebase to JSS 5.8.0-beta1 - -* Fri Jan 17 2025 Fedora Release Engineering - 5.6.0-0.1.alpha1.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild - -* Wed Nov 20 2024 Dogtag PKI Team 5.6.0-1 -- Rebase to JSS 5.6.0-alpha1 - -* Fri Oct 04 2024 Dogtag PKI Team 5.5.1-1 -- Rebase to JSS 5.5.1 - -* Thu Jul 18 2024 Fedora Release Engineering - 5.5.0-2.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - -* Thu Feb 29 2024 Adam Williamson - 5.5.0-2 -- Really build against java-21 - -* Tue Feb 27 2024 Jiri Vanek - 5.5.0-1.1 +* Sat Mar 02 2024 Jiri Vanek - 5.5.0-1.1 - Rebuilt for java-21-openjdk as system jdk * Wed Feb 21 2024 Dogtag PKI Team 5.5.0-1 diff --git a/sources b/sources index f69b2ec..645ec2a 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-5.8.0.tar.gz) = 10f5727d78f8b466062396e47c25b7fdac4b70c6862e6857f8aef49b633c43c4485c1d3cd535006ecd090e8dfe787000fb40d8748ed381c4ac4d1d39312e6c3d +SHA512 (jss-5.5.0.tar.gz) = bda0b4df1ef08a264525c9124a29f57945e3a24adadda609b54032d840a1c311d522e34f29bb2246d03d493d108d425a64e4826edcc8a296a2f55b1cdd8a95c0