From 9c3f65618b4aa69712c0da534d3583ee638e2f5f Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Tue, 15 Oct 2019 15:22:57 -0400 Subject: [PATCH 01/77] Rebase to upstream JSS v4.6.2 Fixes CVE-2019-14823 Signed-off-by: Alexander Scheel --- .gitignore | 1 + 0001-Disable-buffer-based-tests.patch | 78 --------------------------- jss.spec | 9 ++-- sources | 2 +- 4 files changed, 8 insertions(+), 82 deletions(-) delete mode 100644 0001-Disable-buffer-based-tests.patch diff --git a/.gitignore b/.gitignore index 1c7e1b3..5981ea6 100644 --- a/.gitignore +++ b/.gitignore @@ -22,3 +22,4 @@ jss-4.2.6.tar.gz /jss-4.5.2.tar.gz /jss-4.5.3.tar.gz /jss-4.6.1.tar.gz +/jss-4.6.2.tar.gz diff --git a/0001-Disable-buffer-based-tests.patch b/0001-Disable-buffer-based-tests.patch deleted file mode 100644 index c432844..0000000 --- a/0001-Disable-buffer-based-tests.patch +++ /dev/null @@ -1,78 +0,0 @@ -From ab1ba593ac9965607e60a16f3e5e75ba9ccfb505 Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Thu, 8 Aug 2019 12:35:28 -0400 -Subject: [PATCH] Disable failing tests on special arches - -Signed-off-by: Alexander Scheel ---- - cmake/JSSTests.cmake | 40 ---------------------------------------- - 1 file changed, 40 deletions(-) - -diff --git a/cmake/JSSTests.cmake b/cmake/JSSTests.cmake -index 9397f45d..ae6b0d22 100644 ---- a/cmake/JSSTests.cmake -+++ b/cmake/JSSTests.cmake -@@ -78,19 +78,6 @@ macro(jss_tests) - NAME "BigObjectIdentifier" - COMMAND "org.mozilla.jss.tests.BigObjectIdentifier" - ) -- jss_test_java( -- NAME "JSS_Test_PR_FileDesc" -- COMMAND "org.mozilla.jss.tests.TestPRFD" -- ) -- jss_test_java( -- NAME "JSS_Test_Raw_SSL" -- COMMAND "org.mozilla.jss.tests.TestRawSSL" "${RESULTS_NSSDB_OUTPUT_DIR}" -- DEPENDS "Setup_DBs" -- ) -- jss_test_java( -- NAME "JSS_Test_Buffer" -- COMMAND "org.mozilla.jss.tests.TestBuffer" -- ) - if ((${Java_VERSION_MAJOR} EQUAL 1) AND (${Java_VERSION_MINOR} LESS 9)) - jss_test_java( - NAME "Test_PKCS11Constants.java_for_Sun_compatibility" -@@ -121,16 +108,6 @@ macro(jss_tests) - NAME "JUnit_UTF8StringTest" - COMMAND "org.junit.runner.JUnitCore" "org.mozilla.jss.tests.UTF8StringTest" - ) -- jss_test_exec( -- NAME "buffer_size_1" -- COMMAND "${BIN_OUTPUT_DIR}/buffer_size_1" -- DEPENDS "generate_c_buffer_size_1" -- ) -- jss_test_exec( -- NAME "buffer_size_4" -- COMMAND "${BIN_OUTPUT_DIR}/buffer_size_4" -- DEPENDS "generate_c_buffer_size_4" -- ) - jss_test_java( - NAME "JUnit_ChainSortingTest" - COMMAND "org.junit.runner.JUnitCore" "org.mozilla.jss.tests.ChainSortingTest" -@@ -253,23 +230,6 @@ macro(jss_tests) - DEPENDS "Setup_DBs" - ) - -- # SSL Engine related tests -- jss_test_exec( -- NAME "TestBufferPRFD_RSA" -- COMMAND "${BIN_OUTPUT_DIR}/TestBufferPRFD" "${RESULTS_NSSDB_OUTPUT_DIR}" "${DB_PWD}" "Server_RSA" -- DEPENDS "List_CA_certs" "generate_c_TestBufferPRFD" -- ) -- jss_test_exec( -- NAME "TestBufferPRFD_ECDSA" -- COMMAND "${BIN_OUTPUT_DIR}/TestBufferPRFD" "${RESULTS_NSSDB_OUTPUT_DIR}" "${DB_PWD}" "Server_ECDSA" -- DEPENDS "List_CA_certs" "generate_c_TestBufferPRFD" -- ) -- jss_test_java( -- NAME "JSS_Test_BufferPRFD" -- COMMAND "org.mozilla.jss.tests.TestBufferPRFD" "${RESULTS_NSSDB_OUTPUT_DIR}" "${DB_PWD}" -- DEPENDS "List_CA_certs" -- ) -- - # FIPS-related tests - jss_test_java( - NAME "Enable_FipsMODE" --- -2.21.0 - diff --git a/jss.spec b/jss.spec index 40bbda1..5c9fbd3 100644 --- a/jss.spec +++ b/jss.spec @@ -6,8 +6,8 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.6.1 -Release: 2%{?_timestamp}%{?_commit_id}%{?dist} +Version: 4.6.2 +Release: 1%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 # To generate the source tarball: @@ -25,7 +25,6 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch -Patch0: 0001-Disable-buffer-based-tests.patch ################################################################################ # Build Dependencies @@ -160,6 +159,10 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Tue Oct 15 2019 Dogtag PKI Team - 4.6.2-1 +- Rebase to JSS 4.6.2 +- Fixes CVE-2019-14823 + * Thu Aug 08 2019 Dogtag PKI Team - 4.6.1-2 - Disable unnecessary tests to fix broken s390x diff --git a/sources b/sources index 99c1894..32f2840 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.6.1.tar.gz) = 7a7eb02e98a22d0817aec34cff32ac942545885c84992812d116b683fa31c12d0fb9b8aa3b8757ab234f9980993fb933d6556c959935cd5e09ca7468d8729c8a +SHA512 (jss-4.6.2.tar.gz) = 53c12822b980f6dcaf5616366834fe4eaee07d84feae53096aa0ea142146e90d375910456d8192068cde5e63c3b60ded87862af50ea89c6b64224e8c105e00dd From 458481976b4577a07d35b77d1206f6b2821d198f Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Tue, 15 Oct 2019 16:05:53 -0400 Subject: [PATCH 02/77] Rebase to upstream JSS v4.6.2 Fixes CVE-2019-14823 Signed-off-by: Alexander Scheel --- .gitignore | 1 + 0001-Disable-buffer-based-tests.patch | 78 --------------------------- jss.spec | 10 ++-- sources | 2 +- 4 files changed, 7 insertions(+), 84 deletions(-) delete mode 100644 0001-Disable-buffer-based-tests.patch diff --git a/.gitignore b/.gitignore index 1c7e1b3..5981ea6 100644 --- a/.gitignore +++ b/.gitignore @@ -22,3 +22,4 @@ jss-4.2.6.tar.gz /jss-4.5.2.tar.gz /jss-4.5.3.tar.gz /jss-4.6.1.tar.gz +/jss-4.6.2.tar.gz diff --git a/0001-Disable-buffer-based-tests.patch b/0001-Disable-buffer-based-tests.patch deleted file mode 100644 index c432844..0000000 --- a/0001-Disable-buffer-based-tests.patch +++ /dev/null @@ -1,78 +0,0 @@ -From ab1ba593ac9965607e60a16f3e5e75ba9ccfb505 Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Thu, 8 Aug 2019 12:35:28 -0400 -Subject: [PATCH] Disable failing tests on special arches - -Signed-off-by: Alexander Scheel ---- - cmake/JSSTests.cmake | 40 ---------------------------------------- - 1 file changed, 40 deletions(-) - -diff --git a/cmake/JSSTests.cmake b/cmake/JSSTests.cmake -index 9397f45d..ae6b0d22 100644 ---- a/cmake/JSSTests.cmake -+++ b/cmake/JSSTests.cmake -@@ -78,19 +78,6 @@ macro(jss_tests) - NAME "BigObjectIdentifier" - COMMAND "org.mozilla.jss.tests.BigObjectIdentifier" - ) -- jss_test_java( -- NAME "JSS_Test_PR_FileDesc" -- COMMAND "org.mozilla.jss.tests.TestPRFD" -- ) -- jss_test_java( -- NAME "JSS_Test_Raw_SSL" -- COMMAND "org.mozilla.jss.tests.TestRawSSL" "${RESULTS_NSSDB_OUTPUT_DIR}" -- DEPENDS "Setup_DBs" -- ) -- jss_test_java( -- NAME "JSS_Test_Buffer" -- COMMAND "org.mozilla.jss.tests.TestBuffer" -- ) - if ((${Java_VERSION_MAJOR} EQUAL 1) AND (${Java_VERSION_MINOR} LESS 9)) - jss_test_java( - NAME "Test_PKCS11Constants.java_for_Sun_compatibility" -@@ -121,16 +108,6 @@ macro(jss_tests) - NAME "JUnit_UTF8StringTest" - COMMAND "org.junit.runner.JUnitCore" "org.mozilla.jss.tests.UTF8StringTest" - ) -- jss_test_exec( -- NAME "buffer_size_1" -- COMMAND "${BIN_OUTPUT_DIR}/buffer_size_1" -- DEPENDS "generate_c_buffer_size_1" -- ) -- jss_test_exec( -- NAME "buffer_size_4" -- COMMAND "${BIN_OUTPUT_DIR}/buffer_size_4" -- DEPENDS "generate_c_buffer_size_4" -- ) - jss_test_java( - NAME "JUnit_ChainSortingTest" - COMMAND "org.junit.runner.JUnitCore" "org.mozilla.jss.tests.ChainSortingTest" -@@ -253,23 +230,6 @@ macro(jss_tests) - DEPENDS "Setup_DBs" - ) - -- # SSL Engine related tests -- jss_test_exec( -- NAME "TestBufferPRFD_RSA" -- COMMAND "${BIN_OUTPUT_DIR}/TestBufferPRFD" "${RESULTS_NSSDB_OUTPUT_DIR}" "${DB_PWD}" "Server_RSA" -- DEPENDS "List_CA_certs" "generate_c_TestBufferPRFD" -- ) -- jss_test_exec( -- NAME "TestBufferPRFD_ECDSA" -- COMMAND "${BIN_OUTPUT_DIR}/TestBufferPRFD" "${RESULTS_NSSDB_OUTPUT_DIR}" "${DB_PWD}" "Server_ECDSA" -- DEPENDS "List_CA_certs" "generate_c_TestBufferPRFD" -- ) -- jss_test_java( -- NAME "JSS_Test_BufferPRFD" -- COMMAND "org.mozilla.jss.tests.TestBufferPRFD" "${RESULTS_NSSDB_OUTPUT_DIR}" "${DB_PWD}" -- DEPENDS "List_CA_certs" -- ) -- - # FIPS-related tests - jss_test_java( - NAME "Enable_FipsMODE" --- -2.21.0 - diff --git a/jss.spec b/jss.spec index 40bbda1..7bcc899 100644 --- a/jss.spec +++ b/jss.spec @@ -6,8 +6,8 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.6.1 -Release: 2%{?_timestamp}%{?_commit_id}%{?dist} +Version: 4.6.2 +Release: 1%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 # To generate the source tarball: @@ -25,7 +25,6 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch -Patch0: 0001-Disable-buffer-based-tests.patch ################################################################################ # Build Dependencies @@ -160,8 +159,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog -* Thu Aug 08 2019 Dogtag PKI Team - 4.6.1-2 -- Disable unnecessary tests to fix broken s390x +* Tue Oct 15 2019 Dogtag PKI Team - 4.6.2-1 +- Rebase to JSS 4.6.2 +- Fixes CVE-2019-14823 * Thu Aug 08 2019 Dogtag PKI Team - 4.6.1-1 - Rebase to JSS 4.6.1 diff --git a/sources b/sources index 99c1894..32f2840 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.6.1.tar.gz) = 7a7eb02e98a22d0817aec34cff32ac942545885c84992812d116b683fa31c12d0fb9b8aa3b8757ab234f9980993fb933d6556c959935cd5e09ca7468d8729c8a +SHA512 (jss-4.6.2.tar.gz) = 53c12822b980f6dcaf5616366834fe4eaee07d84feae53096aa0ea142146e90d375910456d8192068cde5e63c3b60ded87862af50ea89c6b64224e8c105e00dd From 92d15fc305c3234d89258eb9d1af14b464a386fc Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Tue, 29 Oct 2019 10:56:50 -0400 Subject: [PATCH 03/77] Fix creation of NativeProxy Resolves: rhbz#1766451 Signed-off-by: Alexander Scheel --- 0001-Fix-NativeProxy-reference-tracker.patch | 53 ++ jss-aia-ocsp-1.patch | 659 ------------------- jss-aia-ocsp-2.patch | 141 ---- jss.spec | 6 +- 4 files changed, 58 insertions(+), 801 deletions(-) create mode 100644 0001-Fix-NativeProxy-reference-tracker.patch delete mode 100644 jss-aia-ocsp-1.patch delete mode 100644 jss-aia-ocsp-2.patch diff --git a/0001-Fix-NativeProxy-reference-tracker.patch b/0001-Fix-NativeProxy-reference-tracker.patch new file mode 100644 index 0000000..529b576 --- /dev/null +++ b/0001-Fix-NativeProxy-reference-tracker.patch @@ -0,0 +1,53 @@ +From 91514ca0a2979ba778d27220ced0cd312e2cd2d2 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Tue, 29 Oct 2019 10:43:56 -0400 +Subject: [PATCH] Fix NativeProxy reference tracker + +In eb5df01003d74b57473eacb84e538d31f5bb06ca, I introduced a bug by +setting mPointer after trying to add NativeProxy to the registry. In +most instances this won't matter, however, if another instance exists in +the HashSet with the same hash value, the equals comparator will be +used, triggering a NPE. + +Signed-off-by: Alexander Scheel +--- + org/mozilla/jss/util/NativeProxy.java | 13 +++++-------- + 1 file changed, 5 insertions(+), 8 deletions(-) + +diff --git a/org/mozilla/jss/util/NativeProxy.java b/org/mozilla/jss/util/NativeProxy.java +index 1c6d1aa5..a0811f76 100644 +--- a/org/mozilla/jss/util/NativeProxy.java ++++ b/org/mozilla/jss/util/NativeProxy.java +@@ -40,8 +40,8 @@ public abstract class NativeProxy implements AutoCloseable + */ + public NativeProxy(byte[] pointer) { + assert(pointer!=null); +- registry.add(this); + mPointer = pointer; ++ registry.add(this); + + if (saveStacktraces) { + mTrace = Arrays.toString(Thread.currentThread().getStackTrace()); +@@ -61,15 +61,12 @@ public abstract class NativeProxy implements AutoCloseable + if( ! (obj instanceof NativeProxy) ) { + return false; + } +- if( ((NativeProxy)obj).mPointer.length != mPointer.length) { ++ if (((NativeProxy)obj).mPointer == null) { ++ /* If mPointer is null, we have no way to compare the values ++ * of the pointers, so assume they're unequal. */ + return false; + } +- for(int i=0; i < mPointer.length; i++) { +- if(mPointer[i] != ((NativeProxy)obj).mPointer[i]) { +- return false; +- } +- } +- return true; ++ return Arrays.equals(((NativeProxy)obj).mPointer, mPointer); + } + + /** +-- +2.21.0 + diff --git a/jss-aia-ocsp-1.patch b/jss-aia-ocsp-1.patch deleted file mode 100644 index f20207c..0000000 --- a/jss-aia-ocsp-1.patch +++ /dev/null @@ -1,659 +0,0 @@ -From 8975c8ae1d0c8b916c5c73aff12046b01d3e6ef0 Mon Sep 17 00:00:00 2001 -From: Jack Magne -Date: Fri, 25 Jan 2019 14:54:11 -0800 -Subject: [PATCH] Resolve Bug 1666872 - CC: Enable AIA OCSP cert checking for - entire cert chain. - -This fix for jss, solves the one use case where the pki server is configured to perform ocsp checking ONLY with the contents of the AIA extension. Previously, jss could only check the ocsp server for the leaf node cert of the cert being verified. This fix allows the cert chain to be checked over ocsp for each cert in question. This is possible due to the fact that we have made a call in the PKIX library of nss to do the actual cert verfication. This call is made with all the needed flags to tell the PKIX library to make the ocsp verifications remotely over the network using the contents of the AIA extension. - -Later on we can use this code to handle the other cases, but for now we want to solve this one particular problem. If the server is configured in any other configuration than the one stated, the original verification code will be called as before. Below is an example of a configuration in server.xml, that will trigger this new code: - -< .... enableOCSP="true" ocspCacheSize="10000" ocspMinCacheEntryDuration="7200" .... > - -Note that due to ocsp caching, the cert chain verification may only be apparent after a restart of the server. A way to force an ocsp fetch every time is to set the value of ocspCacheSize=-1, which essentially disables the cache. - -Added a couple of minor fixes due to review comments. Possibly more to come. -Minor include directive change to compile on branch. ---- - org/mozilla/jss/CryptoManager.java | 48 +++++++ - org/mozilla/jss/PK11Finder.c | 95 ++++++++++++-- - org/mozilla/jss/ssl/callbacks.c | 67 ++++++++-- - org/mozilla/jss/ssl/common.c | 196 +++++++++++++++++++++++++++++ - org/mozilla/jss/ssl/jssl.h | 29 +++++ - org/mozilla/jss/util/java_ids.h | 9 ++ - 6 files changed, 422 insertions(+), 22 deletions(-) - -diff --git a/org/mozilla/jss/CryptoManager.java b/org/mozilla/jss/CryptoManager.java -index 9b86bf9e..c9a3fb2b 100644 ---- a/org/mozilla/jss/CryptoManager.java -+++ b/org/mozilla/jss/CryptoManager.java -@@ -1201,6 +1201,44 @@ private native boolean verifyCertTempNative(byte[] certPackage, - // OCSP management - /////////////////////////////////////////////////////////////////////// - -+ /* OCSP Policy related */ -+ -+ public enum OCSPPolicy { -+ NONE, -+ NORMAL, -+ LEAF_AND_CHAIN; -+ } -+ -+ private static OCSPPolicy ocspPolicy = OCSPPolicy.NONE; -+ -+ /** -+ * Gets the current ocsp Policy. -+ * Currently we only support 2 modes OCSP_LEAF_AND_CHAIN_POLICY. -+ * And OCSP_NORMAL_POLICY, which is current processing , by default. -+ * If we have AIA based OCSP enabled we will check all certs in the chain. -+ * using PKIX cert verfication calls in the various cert auth callbacks we -+ * have. -+ * @return - The current ocsp policy in effect. -+ */ -+ -+ public static synchronized int getOCSPPolicy() { -+ return ocspPolicy.ordinal(); -+ } -+ -+ /** -+ * Sets the current ocsp Policy. -+ * Currently we only support one mode OCSP_LEAF_AND_CHAIN_POLICY. -+ * If we have AIA based OCSP enabled we will check all certs in the chain. -+ * using PKIX cert verfication calls in the various cert auth callbacks we -+ * have. -+ * @param policy - Either cert and chain or normal default processing. -+ * -+ */ -+ -+ public static synchronized void setOCSPPolicy(OCSPPolicy policy) { -+ ocspPolicy = policy; -+ } -+ - /** - * Enables OCSP, note when you Initialize JSS for the first time, for - * backwards compatibility, the initialize will enable OCSP if you -@@ -1220,6 +1258,16 @@ public void configureOCSP( - String ocspResponderCertNickname ) - throws GeneralSecurityException - { -+ /* set the ocsp policy */ -+ -+ if(ocspCheckingEnabled && -+ ocspResponderURL == null && -+ ocspResponderCertNickname == null) { -+ setOCSPPolicy(OCSPPolicy.LEAF_AND_CHAIN); -+ } else { -+ setOCSPPolicy(OCSPPolicy.NORMAL); -+ } -+ - configureOCSPNative(ocspCheckingEnabled, - ocspResponderURL, - ocspResponderCertNickname ); -diff --git a/org/mozilla/jss/PK11Finder.c b/org/mozilla/jss/PK11Finder.c -index 45958181..0329e91d 100644 ---- a/org/mozilla/jss/PK11Finder.c -+++ b/org/mozilla/jss/PK11Finder.c -@@ -14,9 +14,9 @@ - #include - - #include -- - #include - #include "pk11util.h" -+#include "ssl/jssl.h" - #include - - /* -@@ -1574,6 +1574,9 @@ SECStatus verifyCertificateNow(JNIEnv *env, jobject self, jstring nickString, - goto finish; - } - -+ int ocspPolicy = JSSL_getOCSPPolicy(); -+ -+ - certificateUsage = required_certificateUsage; - - cert = CERT_FindCertByNickname(CERT_GetDefaultCertDB(), nickname); -@@ -1587,8 +1590,24 @@ SECStatus verifyCertificateNow(JNIEnv *env, jobject self, jstring nickString, - /* 0 for certificateUsage in call to CERT_VerifyCertificateNow will - * retrieve the current valid usage into currUsage - */ -- rv = CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, -- checkSig, certificateUsage, NULL, currUsage ); -+ if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { -+ rv = JSSL_verifyCertPKIX( cert, certificateUsage, -+ NULL /* pin arg */, ocspPolicy, NULL, currUsage); -+ -+ /* we need to do this just to get the cert usages, the pkix version -+ doesn't seem to honor the method to get the usages as of yet. -+ Let the PKIX call only determine the final fate. -+ */ -+ if(rv == SECSuccess) { -+ CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, -+ checkSig, certificateUsage, NULL, currUsage ); -+ } -+ -+ } else { -+ rv = CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, -+ checkSig, certificateUsage, NULL, currUsage ); -+ } -+ - if ((rv == SECSuccess) && certificateUsage == 0x0000) { - if (*currUsage == - ( certUsageUserCertImport | -@@ -1639,6 +1658,8 @@ Java_org_mozilla_jss_CryptoManager_verifyCertificateNowNative(JNIEnv *env, - goto finish; - } - -+ int ocspPolicy = JSSL_getOCSPPolicy(); -+ - certificateUsage = required_certificateUsage; - - cert = CERT_FindCertByNickname(CERT_GetDefaultCertDB(), nickname); -@@ -1653,8 +1674,23 @@ Java_org_mozilla_jss_CryptoManager_verifyCertificateNowNative(JNIEnv *env, - * just get the current usage (which we are not passing back for now - * but will bypass the certificate usage check - */ -- rv = CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, -- checkSig, certificateUsage, NULL, &currUsage ); -+ -+ if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { -+ rv= JSSL_verifyCertPKIX( cert, certificateUsage, -+ NULL /* pin arg */, ocspPolicy, NULL, &currUsage); -+ -+ /* we need to do this just to get the cert usages, the pkix version -+ doesn't seem to honor the method to get the usages as of yet. -+ Let the PKIX call only determine the final fate. -+ */ -+ if(rv == SECSuccess) { -+ CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, -+ checkSig, certificateUsage, NULL, &currUsage ); -+ } -+ } else { -+ rv = CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, -+ checkSig, certificateUsage, NULL, &currUsage ); -+ } - } - - finish: -@@ -1720,12 +1756,14 @@ Java_org_mozilla_jss_CryptoManager_verifyCertificateNowNative2(JNIEnv *env, - SECStatus rv = SECFailure; - CERTCertificate *cert = NULL; - char *nickname = NULL; -- -+ - if (nickString == NULL) { - JSS_throwMsg(env, INVALID_NICKNAME_EXCEPTION, "Missing certificate nickname"); - goto finish; - } - -+ int ocspPolicy = JSSL_getOCSPPolicy(); -+ - nickname = (char *) (*env)->GetStringUTFChars(env, nickString, NULL); - if (nickname == NULL) { - JSS_throwMsg(env, INVALID_NICKNAME_EXCEPTION, "Missing certificate nickname"); -@@ -1747,8 +1785,25 @@ Java_org_mozilla_jss_CryptoManager_verifyCertificateNowNative2(JNIEnv *env, - /* 0 for certificateUsage in call to CERT_VerifyCertificateNow will - * retrieve the current valid usage into currUsage - */ -- rv = CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, -- checkSig, certificateUsage, NULL, &currUsage); -+ -+ if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { -+ rv = JSSL_verifyCertPKIX( cert, certificateUsage, -+ NULL /* pin arg */, ocspPolicy, NULL, &currUsage); -+ -+ /* we need to do this just to get the cert usages, the pkix version -+ doesn't seem to honor the method to get the usages as of yet. -+ Let the PKIX call only determine the final fate. -+ */ -+ if(rv == SECSuccess) { -+ CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, -+ checkSig, certificateUsage, NULL, &currUsage ); -+ -+ } -+ -+ } else { -+ rv = CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, -+ checkSig, certificateUsage, NULL, &currUsage); -+ } - - if (rv != SECSuccess) { - JSS_throwMsgPrErr(env, CERTIFICATE_EXCEPTION, "Invalid certificate"); -@@ -1803,6 +1858,9 @@ Java_org_mozilla_jss_CryptoManager_verifyCertNowNative(JNIEnv *env, - if( nickname == NULL ) { - goto finish; - } -+ -+ int ocspPolicy = JSSL_getOCSPPolicy(); -+ - certUsage = cUsage; - cert = CERT_FindCertByNickname(CERT_GetDefaultCertDB(), nickname); - -@@ -1812,8 +1870,13 @@ Java_org_mozilla_jss_CryptoManager_verifyCertNowNative(JNIEnv *env, - PR_smprintf_free(message); - goto finish; - } else { -- rv = CERT_VerifyCertNow(CERT_GetDefaultCertDB(), cert, -- checkSig, certUsage, NULL ); -+ if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { -+ rv = JSSL_verifyCertPKIX( cert, certUsage, -+ NULL /* pin arg */, ocspPolicy, NULL, NULL); -+ } else { -+ rv = CERT_VerifyCertNow(CERT_GetDefaultCertDB(), cert, -+ checkSig, certUsage, NULL ); -+ } - } - - finish: -@@ -1858,6 +1921,8 @@ Java_org_mozilla_jss_CryptoManager_verifyCertTempNative(JNIEnv *env, - derCerts[0] = JSS_ByteArrayToSECItem(env, packageArray); - derCerts[1] = NULL; - -+ int ocspPolicy = JSSL_getOCSPPolicy(); -+ - rv = CERT_ImportCerts(certdb, cUsage, - 1, derCerts, &certArray, PR_FALSE /*temp Certs*/, - PR_FALSE /*caOnly*/, NULL); -@@ -1869,8 +1934,14 @@ Java_org_mozilla_jss_CryptoManager_verifyCertTempNative(JNIEnv *env, - } - - certUsage = cUsage; -- rv = CERT_VerifyCertNow(certdb, certArray[0], -- checkSig, certUsage, NULL ); -+ -+ if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { -+ rv = JSSL_verifyCertPKIX( certArray[0], certUsage, -+ NULL /* pin arg */, ocspPolicy, NULL, NULL); -+ } else { -+ rv = CERT_VerifyCertNow(certdb, certArray[0], -+ checkSig, certUsage, NULL ); -+ } - - finish: - /* this checks for NULL */ -diff --git a/org/mozilla/jss/ssl/callbacks.c b/org/mozilla/jss/ssl/callbacks.c -index 634f31ec..42594a14 100644 ---- a/org/mozilla/jss/ssl/callbacks.c -+++ b/org/mozilla/jss/ssl/callbacks.c -@@ -20,6 +20,40 @@ - #include - #include - -+int -+JSSL_getOCSPPolicy() { -+ JNIEnv *env; -+ jint policy = -1; -+ -+ jmethodID getOCSPPolicyID; -+ jclass cryptoManagerClass; -+ -+ /* get the JNI environment */ -+ if((*JSS_javaVM)->AttachCurrentThread(JSS_javaVM, (void**)&env, NULL) != 0){ -+ PR_ASSERT(PR_FALSE); -+ goto finish; -+ } -+ -+ cryptoManagerClass = (*env)->FindClass(env, CRYPTO_MANAGER_NAME); -+ if( cryptoManagerClass == NULL ) { -+ ASSERT_OUTOFMEM(env); -+ goto finish; -+ } -+ getOCSPPolicyID = (*env)->GetStaticMethodID(env, cryptoManagerClass, -+ GET_OCSP_POLICY_NAME,GET_OCSP_POLICY_SIG); -+ -+ if( getOCSPPolicyID == NULL ) { -+ ASSERT_OUTOFMEM(env); -+ goto finish; -+ } -+ -+ policy = (*env)->CallStaticIntMethod(env, cryptoManagerClass, -+ getOCSPPolicyID); -+ -+finish: -+ return (int) policy; -+} -+ - static SECStatus - secCmpCertChainWCANames(CERTCertificate *cert, CERTDistNames *caNames) - { -@@ -443,8 +477,9 @@ JSSL_DefaultCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, - SECCertUsage certUsage; - CERTCertificate *peerCert=NULL; - -+ int ocspPolicy = JSSL_getOCSPPolicy(); -+ - certUsage = isServer ? certUsageSSLClient : certUsageSSLServer; -- - - /* SSL_PeerCertificate() returns a shallow copy of the cert, so we - must destroy it before we exit this function */ -@@ -452,8 +487,13 @@ JSSL_DefaultCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, - peerCert = SSL_PeerCertificate(fd); - - if (peerCert) { -- rv = CERT_VerifyCertNow(CERT_GetDefaultCertDB(), peerCert, -- checkSig, certUsage, NULL /*pinarg*/); -+ if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { -+ rv = JSSL_verifyCertPKIX( peerCert, certUsage, -+ NULL /* pin arg */, ocspPolicy, NULL, NULL); -+ } else { -+ rv = CERT_VerifyCertNow(CERT_GetDefaultCertDB(), peerCert, -+ checkSig, certUsage, NULL /*pinarg*/); -+ } - } - - /* if we're a server, then we don't need to check the CN of the -@@ -569,6 +609,8 @@ JSSL_JavaCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, - log.tail = NULL; - log.count = 0; - -+ int ocspPolicy = JSSL_getOCSPPolicy(); -+ - /* get the JNI environment */ - if((*JSS_javaVM)->AttachCurrentThread(JSS_javaVM, (void**)&env, NULL) != 0){ - PR_ASSERT(PR_FALSE); -@@ -589,13 +631,18 @@ JSSL_JavaCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, - * logging parameter) - */ - -- verificationResult = CERT_VerifyCert( CERT_GetDefaultCertDB(), -- peerCert, -- checkSig, -- certUsage, -- PR_Now(), -- NULL /*pinarg*/, -- &log); -+ if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { -+ verificationResult = JSSL_verifyCertPKIX( peerCert, certUsage, -+ NULL /* pin arg */, ocspPolicy, &log, NULL); -+ } else { -+ verificationResult = CERT_VerifyCert( CERT_GetDefaultCertDB(), -+ peerCert, -+ checkSig, -+ certUsage, -+ PR_Now(), -+ NULL /*pinarg*/, -+ &log); -+ } - - if (verificationResult == SECSuccess && log.count > 0) { - verificationResult = SECFailure; -diff --git a/org/mozilla/jss/ssl/common.c b/org/mozilla/jss/ssl/common.c -index 5c6efa85..aec88552 100644 ---- a/org/mozilla/jss/ssl/common.c -+++ b/org/mozilla/jss/ssl/common.c -@@ -15,6 +15,7 @@ - #include - #include "_jni/org_mozilla_jss_ssl_SSLSocket.h" - #include "jssl.h" -+#include "cert.h" - - #ifdef WIN32 - #include -@@ -889,3 +890,198 @@ JSS_SSL_processExceptions(JNIEnv *env, PRFilePrivate *priv) - PR_ASSERT(ret == 0); - } - } -+ -+/* Get the trusted anchor for pkix */ -+ -+CERTCertificate * getRoot(CERTCertificate *cert, -+ SECCertificateUsage certUsage) -+{ -+ CERTCertificate *root = NULL; -+ CERTCertListNode *node = NULL; -+ -+ if( !cert ) { -+ goto finish; -+ } -+ -+ CERTCertList *certList = CERT_GetCertChainFromCert(cert, -+ PR_Now(), -+ certUsage); -+ -+ if( certList == NULL) { -+ goto finish; -+ } -+ -+ for (node = CERT_LIST_HEAD(certList); -+ !CERT_LIST_END(node, certList); -+ node = CERT_LIST_NEXT(node)) { -+ -+ /* try to find the root */ -+ if( node->cert && node->cert->isRoot ) { -+ root = CERT_DupCertificate(node->cert) ; -+ } -+ } -+ -+finish: -+ -+ CERT_DestroyCertList (certList); -+ return root; -+} -+ -+/* Verify a cert using explicit PKIX call. -+ * For now only used in OCSP AIA context. -+ * The result of this call will be a full chain -+ * and leaf network AIA ocsp validation. -+ * The policy param will be used in the future to -+ * handle more scenarios. -+ */ -+ -+SECStatus JSSL_verifyCertPKIX(CERTCertificate *cert, -+ SECCertificateUsage certUsage,secuPWData *pwdata, int ocspPolicy, -+ CERTVerifyLog *log, SECCertificateUsage *usage) -+{ -+ -+ /* put the first set of possible flags internally here first */ -+ /* later there could be a more complete list to choose from */ -+ /* support our hard core fetch aia ocsp policy for now */ -+ -+ static PRUint64 ocsp_Enabled_Hard_Policy_LeafFlags[2] = { -+ /* crl */ -+ 0, -+ /* ocsp */ -+ CERT_REV_M_TEST_USING_THIS_METHOD | -+ CERT_REV_M_FAIL_ON_MISSING_FRESH_INFO -+ }; -+ -+ static PRUint64 ocsp_Enabled_Hard_Policy_ChainFlags[2] = { -+ /* crl */ -+ 0, -+ /* ocsp */ -+ CERT_REV_M_TEST_USING_THIS_METHOD | -+ CERT_REV_M_FAIL_ON_MISSING_FRESH_INFO -+ }; -+ -+ static CERTRevocationMethodIndex -+ ocsp_Enabled_Hard_Policy_Method_Preference = { -+ cert_revocation_method_ocsp -+ }; -+ -+ static CERTRevocationFlags ocsp_Enabled_Hard_Policy = { -+ { /* leafTests */ -+ 2, -+ ocsp_Enabled_Hard_Policy_LeafFlags, -+ 1, -+ &ocsp_Enabled_Hard_Policy_Method_Preference, -+ 0 }, -+ { /* chainTests */ -+ 2, -+ ocsp_Enabled_Hard_Policy_ChainFlags, -+ 1, -+ &ocsp_Enabled_Hard_Policy_Method_Preference, -+ 0 } -+ }; -+ -+ /* for future expansion */ -+ -+ CERTValOutParam cvout[20] = {0}; -+ CERTValInParam cvin[20] = {0}; -+ -+ int inParamIndex = 0; -+ int outParamIndex = 0; -+ CERTRevocationFlags *rev = NULL; -+ -+ CERTCertList *trustedCertList = NULL; -+ -+ PRBool fetchCerts = PR_FALSE; -+ -+ SECStatus res = SECFailure; -+ if(cert == NULL) { -+ goto finish; -+ } -+ -+ if(ocspPolicy != OCSP_LEAF_AND_CHAIN_POLICY) { -+ goto finish; -+ } -+ -+ /* Force the strict ocsp network check on chain -+ and leaf. -+ */ -+ -+ fetchCerts = PR_TRUE; -+ rev = &ocsp_Enabled_Hard_Policy; -+ -+ /* fetch aia over net */ -+ -+ cvin[inParamIndex].type = cert_pi_useAIACertFetch; -+ cvin[inParamIndex].value.scalar.b = fetchCerts; -+ inParamIndex++; -+ -+ /* time */ -+ -+ cvin[inParamIndex].type = cert_pi_date; -+ cvin[inParamIndex].value.scalar.time = PR_Now(); -+ inParamIndex++; -+ -+ /* flags */ -+ -+ cvin[inParamIndex].type = cert_pi_revocationFlags; -+ cvin[inParamIndex].value.pointer.revocation = rev; -+ inParamIndex++; -+ -+ -+ /* establish trust anchor */ -+ -+ CERTCertificate *root = getRoot(cert,certUsage); -+ -+ /* Try to add the root as the trust anchor so all the -+ other memebers of the ca chain will get validated. -+ */ -+ -+ if( root != NULL ) { -+ trustedCertList = CERT_NewCertList(); -+ CERT_AddCertToListTail(trustedCertList, root); -+ -+ cvin[inParamIndex].type = cert_pi_trustAnchors; -+ cvin[inParamIndex].value.pointer.chain = trustedCertList; -+ -+ inParamIndex++; -+ } -+ -+ cvin[inParamIndex].type = cert_pi_end; -+ -+ if(log != NULL) { -+ cvout[outParamIndex].type = cert_po_errorLog; -+ cvout[outParamIndex].value.pointer.log = log; -+ outParamIndex ++; -+ } -+ -+ int usageIndex = 0; -+ if(usage != NULL) { -+ usageIndex = outParamIndex; -+ cvout[outParamIndex].type = cert_po_usages; -+ cvout[outParamIndex].value.scalar.usages = 0; -+ outParamIndex ++; -+ } -+ -+ cvout[outParamIndex].type = cert_po_end; -+ -+ res = CERT_PKIXVerifyCert(cert, certUsage, cvin, cvout, &pwdata); -+ -+finish: -+ /* clean up any trusted cert list */ -+ -+ if (trustedCertList) { -+ CERT_DestroyCertList(trustedCertList); -+ trustedCertList = NULL; -+ } -+ -+ if(root) { -+ CERT_DestroyCertificate(root); -+ root = NULL; -+ } -+ -+ if(res == SECSuccess && usage) { -+ *usage = cvout[usageIndex].value.scalar.usages; -+ } -+ -+ return res; -+} -diff --git a/org/mozilla/jss/ssl/jssl.h b/org/mozilla/jss/ssl/jssl.h -index c15acf87..0e93eebe 100644 ---- a/org/mozilla/jss/ssl/jssl.h -+++ b/org/mozilla/jss/ssl/jssl.h -@@ -5,8 +5,27 @@ - #ifndef ORG_MOZILLA_JSS_SSL_JSSL_H - #define ORG_MOZILLA_JSS_SSL_JSSL_H - -+/* ocsp policy constants */ -+ -+/* ocsp policy constants */ -+static const int OCSP_NO_POLICY = 0; -+static const int OCSP_NORMAL_POLICY = 1; -+static const int OCSP_LEAF_AND_CHAIN_POLICY = 2; -+ - #include - -+typedef struct -+{ -+ enum -+ { -+ PW_NONE = 0, -+ PW_FROMFILE = 1, -+ PW_PLAINTEXT = 2, -+ PW_EXTERNAL = 3 -+ } source; -+ char *data; -+} secuPWData; -+ - struct JSSL_SocketData { - PRFileDesc *fd; - jobject socketObject; /* weak global ref */ -@@ -120,4 +139,14 @@ JSS_SSL_processExceptions(JNIEnv *env, PRFilePrivate *priv); - - void JSSL_throwSSLSocketException(JNIEnv *env, char *message); - -+int -+JSSL_getOCSPPolicy(); -+ -+ -+SECStatus -+JSSL_verifyCertPKIX(CERTCertificate *cert, -+ SECCertificateUsage certUsage, -+ secuPWData *pwdata, int ocspPolicy, -+ CERTVerifyLog *log,SECCertificateUsage *usage); -+ - #endif -diff --git a/org/mozilla/jss/util/java_ids.h b/org/mozilla/jss/util/java_ids.h -index 73b31fa9..4053d9a7 100644 ---- a/org/mozilla/jss/util/java_ids.h -+++ b/org/mozilla/jss/util/java_ids.h -@@ -276,6 +276,15 @@ PR_BEGIN_EXTERN_C - #define GET_RECV_BUF_SIZE "getReceiveBufferSize" - #define GET_BUF_SIZE_SIG "()I" - -+/* -+ * CryptoManager -+ * -+*/ -+ -+#define CRYPTO_MANAGER_NAME "org/mozilla/jss/CryptoManager" -+#define GET_OCSP_POLICY_NAME "getOCSPPolicy" -+#define GET_OCSP_POLICY_SIG "()I" -+ - /* - * SocketBase - */ diff --git a/jss-aia-ocsp-2.patch b/jss-aia-ocsp-2.patch deleted file mode 100644 index c6b2f1c..0000000 --- a/jss-aia-ocsp-2.patch +++ /dev/null @@ -1,141 +0,0 @@ -From 1fe6a451ec0c3ec960ac1119b39c406d999da5ec Mon Sep 17 00:00:00 2001 -From: Jack Magne -Date: Fri, 8 Feb 2019 11:21:48 -0800 -Subject: [PATCH] Additional: Resolve Bug 1666872 - CC: Enable AIA OCSP cert - checking for entire cert chain. - -Simple fix to make sure we are using the correct variant of the NSS cert usage quantity. - -It turns out some calls need a SECCertUsage and others need a SECCertificateUsage. -We also need to convert between the two in certain instances. - -Found and fixed double certificate object free issue. ---- - org/mozilla/jss/ssl/callbacks.c | 10 ++++++++-- - org/mozilla/jss/ssl/common.c | 19 ++++++++++++++----- - org/mozilla/jss/ssl/jssl.h | 2 +- - 3 files changed, 23 insertions(+), 8 deletions(-) - -diff --git a/org/mozilla/jss/ssl/callbacks.c b/org/mozilla/jss/ssl/callbacks.c -index 42594a14..4fe08a29 100644 ---- a/org/mozilla/jss/ssl/callbacks.c -+++ b/org/mozilla/jss/ssl/callbacks.c -@@ -481,6 +481,9 @@ JSSL_DefaultCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, - - certUsage = isServer ? certUsageSSLClient : certUsageSSLServer; - -+ /* PKIX call needs a SECCertificate usage, convert */ -+ SECCertificateUsage certificateUsage = (SECCertificateUsage)1 << certUsage; -+ - /* SSL_PeerCertificate() returns a shallow copy of the cert, so we - must destroy it before we exit this function */ - -@@ -488,7 +491,7 @@ JSSL_DefaultCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, - - if (peerCert) { - if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { -- rv = JSSL_verifyCertPKIX( peerCert, certUsage, -+ rv = JSSL_verifyCertPKIX( peerCert, certificateUsage, - NULL /* pin arg */, ocspPolicy, NULL, NULL); - } else { - rv = CERT_VerifyCertNow(CERT_GetDefaultCertDB(), peerCert, -@@ -624,6 +627,9 @@ JSSL_JavaCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, - if (peerCert == NULL) goto finish; - - certUsage = isServer ? certUsageSSLClient : certUsageSSLServer; -+ /* PKIX call needs a SECCertificate usage, convert */ -+ SECCertificateUsage certificateUsage = (SECCertificateUsage)1 << certUsage; -+ - - /* - * verify it against current time - (can't use -@@ -632,7 +638,7 @@ JSSL_JavaCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, - */ - - if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { -- verificationResult = JSSL_verifyCertPKIX( peerCert, certUsage, -+ verificationResult = JSSL_verifyCertPKIX( peerCert, certificateUsage, - NULL /* pin arg */, ocspPolicy, &log, NULL); - } else { - verificationResult = CERT_VerifyCert( CERT_GetDefaultCertDB(), -diff --git a/org/mozilla/jss/ssl/common.c b/org/mozilla/jss/ssl/common.c -index aec88552..cb281798 100644 ---- a/org/mozilla/jss/ssl/common.c -+++ b/org/mozilla/jss/ssl/common.c -@@ -894,7 +894,7 @@ JSS_SSL_processExceptions(JNIEnv *env, PRFilePrivate *priv) - /* Get the trusted anchor for pkix */ - - CERTCertificate * getRoot(CERTCertificate *cert, -- SECCertificateUsage certUsage) -+ SECCertUsage certUsage) - { - CERTCertificate *root = NULL; - CERTCertListNode *node = NULL; -@@ -936,7 +936,7 @@ CERTCertificate * getRoot(CERTCertificate *cert, - */ - - SECStatus JSSL_verifyCertPKIX(CERTCertificate *cert, -- SECCertificateUsage certUsage,secuPWData *pwdata, int ocspPolicy, -+ SECCertificateUsage certificateUsage,secuPWData *pwdata, int ocspPolicy, - CERTVerifyLog *log, SECCertificateUsage *usage) - { - -@@ -993,6 +993,8 @@ SECStatus JSSL_verifyCertPKIX(CERTCertificate *cert, - - PRBool fetchCerts = PR_FALSE; - -+ SECCertUsage certUsage = certUsageSSLClient /* 0 */; -+ - SECStatus res = SECFailure; - if(cert == NULL) { - goto finish; -@@ -1027,9 +1029,15 @@ SECStatus JSSL_verifyCertPKIX(CERTCertificate *cert, - cvin[inParamIndex].value.pointer.revocation = rev; - inParamIndex++; - -- - /* establish trust anchor */ - -+ /* We need to convert the SECCertificateUsage to a SECCertUsage to obtain -+ * the root. -+ */ -+ -+ SECCertificateUsage testUsage = certificateUsage; -+ while (0 != (testUsage = testUsage >> 1)) { certUsage++; } -+ - CERTCertificate *root = getRoot(cert,certUsage); - - /* Try to add the root as the trust anchor so all the -@@ -1064,7 +1072,7 @@ SECStatus JSSL_verifyCertPKIX(CERTCertificate *cert, - - cvout[outParamIndex].type = cert_po_end; - -- res = CERT_PKIXVerifyCert(cert, certUsage, cvin, cvout, &pwdata); -+ res = CERT_PKIXVerifyCert(cert, certificateUsage, cvin, cvout, &pwdata); - - finish: - /* clean up any trusted cert list */ -@@ -1074,8 +1082,9 @@ SECStatus JSSL_verifyCertPKIX(CERTCertificate *cert, - trustedCertList = NULL; - } - -+ /* CERT_DestroyCertList destroys interior certs for us. */ -+ - if(root) { -- CERT_DestroyCertificate(root); - root = NULL; - } - -diff --git a/org/mozilla/jss/ssl/jssl.h b/org/mozilla/jss/ssl/jssl.h -index 0e93eebe..925e1225 100644 ---- a/org/mozilla/jss/ssl/jssl.h -+++ b/org/mozilla/jss/ssl/jssl.h -@@ -145,7 +145,7 @@ JSSL_getOCSPPolicy(); - - SECStatus - JSSL_verifyCertPKIX(CERTCertificate *cert, -- SECCertificateUsage certUsage, -+ SECCertificateUsage certificateUsage, - secuPWData *pwdata, int ocspPolicy, - CERTVerifyLog *log,SECCertificateUsage *usage); - diff --git a/jss.spec b/jss.spec index 5c9fbd3..be8e0ab 100644 --- a/jss.spec +++ b/jss.spec @@ -7,7 +7,7 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.6.2 -Release: 1%{?_timestamp}%{?_commit_id}%{?dist} +Release: 2%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 # To generate the source tarball: @@ -25,6 +25,7 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch +Patch: 0001-Fix-NativeProxy-reference-tracker.patch ################################################################################ # Build Dependencies @@ -159,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Tue Oct 29 2019 Dogtag PKI Team - 4.6.2-2 +- Fix for rhbz#1766451 + * Tue Oct 15 2019 Dogtag PKI Team - 4.6.2-1 - Rebase to JSS 4.6.2 - Fixes CVE-2019-14823 From 1d9e3f12dedb0d5d55fab4d31177a24cf1af662c Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Tue, 29 Oct 2019 10:56:50 -0400 Subject: [PATCH 04/77] Fix creation of NativeProxy Resolves: rhbz#1766451 Signed-off-by: Alexander Scheel --- 0001-Fix-NativeProxy-reference-tracker.patch | 53 ++ jss-aia-ocsp-1.patch | 659 ------------------- jss-aia-ocsp-2.patch | 141 ---- jss.spec | 6 +- 4 files changed, 58 insertions(+), 801 deletions(-) create mode 100644 0001-Fix-NativeProxy-reference-tracker.patch delete mode 100644 jss-aia-ocsp-1.patch delete mode 100644 jss-aia-ocsp-2.patch diff --git a/0001-Fix-NativeProxy-reference-tracker.patch b/0001-Fix-NativeProxy-reference-tracker.patch new file mode 100644 index 0000000..529b576 --- /dev/null +++ b/0001-Fix-NativeProxy-reference-tracker.patch @@ -0,0 +1,53 @@ +From 91514ca0a2979ba778d27220ced0cd312e2cd2d2 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Tue, 29 Oct 2019 10:43:56 -0400 +Subject: [PATCH] Fix NativeProxy reference tracker + +In eb5df01003d74b57473eacb84e538d31f5bb06ca, I introduced a bug by +setting mPointer after trying to add NativeProxy to the registry. In +most instances this won't matter, however, if another instance exists in +the HashSet with the same hash value, the equals comparator will be +used, triggering a NPE. + +Signed-off-by: Alexander Scheel +--- + org/mozilla/jss/util/NativeProxy.java | 13 +++++-------- + 1 file changed, 5 insertions(+), 8 deletions(-) + +diff --git a/org/mozilla/jss/util/NativeProxy.java b/org/mozilla/jss/util/NativeProxy.java +index 1c6d1aa5..a0811f76 100644 +--- a/org/mozilla/jss/util/NativeProxy.java ++++ b/org/mozilla/jss/util/NativeProxy.java +@@ -40,8 +40,8 @@ public abstract class NativeProxy implements AutoCloseable + */ + public NativeProxy(byte[] pointer) { + assert(pointer!=null); +- registry.add(this); + mPointer = pointer; ++ registry.add(this); + + if (saveStacktraces) { + mTrace = Arrays.toString(Thread.currentThread().getStackTrace()); +@@ -61,15 +61,12 @@ public abstract class NativeProxy implements AutoCloseable + if( ! (obj instanceof NativeProxy) ) { + return false; + } +- if( ((NativeProxy)obj).mPointer.length != mPointer.length) { ++ if (((NativeProxy)obj).mPointer == null) { ++ /* If mPointer is null, we have no way to compare the values ++ * of the pointers, so assume they're unequal. */ + return false; + } +- for(int i=0; i < mPointer.length; i++) { +- if(mPointer[i] != ((NativeProxy)obj).mPointer[i]) { +- return false; +- } +- } +- return true; ++ return Arrays.equals(((NativeProxy)obj).mPointer, mPointer); + } + + /** +-- +2.21.0 + diff --git a/jss-aia-ocsp-1.patch b/jss-aia-ocsp-1.patch deleted file mode 100644 index f20207c..0000000 --- a/jss-aia-ocsp-1.patch +++ /dev/null @@ -1,659 +0,0 @@ -From 8975c8ae1d0c8b916c5c73aff12046b01d3e6ef0 Mon Sep 17 00:00:00 2001 -From: Jack Magne -Date: Fri, 25 Jan 2019 14:54:11 -0800 -Subject: [PATCH] Resolve Bug 1666872 - CC: Enable AIA OCSP cert checking for - entire cert chain. - -This fix for jss, solves the one use case where the pki server is configured to perform ocsp checking ONLY with the contents of the AIA extension. Previously, jss could only check the ocsp server for the leaf node cert of the cert being verified. This fix allows the cert chain to be checked over ocsp for each cert in question. This is possible due to the fact that we have made a call in the PKIX library of nss to do the actual cert verfication. This call is made with all the needed flags to tell the PKIX library to make the ocsp verifications remotely over the network using the contents of the AIA extension. - -Later on we can use this code to handle the other cases, but for now we want to solve this one particular problem. If the server is configured in any other configuration than the one stated, the original verification code will be called as before. Below is an example of a configuration in server.xml, that will trigger this new code: - -< .... enableOCSP="true" ocspCacheSize="10000" ocspMinCacheEntryDuration="7200" .... > - -Note that due to ocsp caching, the cert chain verification may only be apparent after a restart of the server. A way to force an ocsp fetch every time is to set the value of ocspCacheSize=-1, which essentially disables the cache. - -Added a couple of minor fixes due to review comments. Possibly more to come. -Minor include directive change to compile on branch. ---- - org/mozilla/jss/CryptoManager.java | 48 +++++++ - org/mozilla/jss/PK11Finder.c | 95 ++++++++++++-- - org/mozilla/jss/ssl/callbacks.c | 67 ++++++++-- - org/mozilla/jss/ssl/common.c | 196 +++++++++++++++++++++++++++++ - org/mozilla/jss/ssl/jssl.h | 29 +++++ - org/mozilla/jss/util/java_ids.h | 9 ++ - 6 files changed, 422 insertions(+), 22 deletions(-) - -diff --git a/org/mozilla/jss/CryptoManager.java b/org/mozilla/jss/CryptoManager.java -index 9b86bf9e..c9a3fb2b 100644 ---- a/org/mozilla/jss/CryptoManager.java -+++ b/org/mozilla/jss/CryptoManager.java -@@ -1201,6 +1201,44 @@ private native boolean verifyCertTempNative(byte[] certPackage, - // OCSP management - /////////////////////////////////////////////////////////////////////// - -+ /* OCSP Policy related */ -+ -+ public enum OCSPPolicy { -+ NONE, -+ NORMAL, -+ LEAF_AND_CHAIN; -+ } -+ -+ private static OCSPPolicy ocspPolicy = OCSPPolicy.NONE; -+ -+ /** -+ * Gets the current ocsp Policy. -+ * Currently we only support 2 modes OCSP_LEAF_AND_CHAIN_POLICY. -+ * And OCSP_NORMAL_POLICY, which is current processing , by default. -+ * If we have AIA based OCSP enabled we will check all certs in the chain. -+ * using PKIX cert verfication calls in the various cert auth callbacks we -+ * have. -+ * @return - The current ocsp policy in effect. -+ */ -+ -+ public static synchronized int getOCSPPolicy() { -+ return ocspPolicy.ordinal(); -+ } -+ -+ /** -+ * Sets the current ocsp Policy. -+ * Currently we only support one mode OCSP_LEAF_AND_CHAIN_POLICY. -+ * If we have AIA based OCSP enabled we will check all certs in the chain. -+ * using PKIX cert verfication calls in the various cert auth callbacks we -+ * have. -+ * @param policy - Either cert and chain or normal default processing. -+ * -+ */ -+ -+ public static synchronized void setOCSPPolicy(OCSPPolicy policy) { -+ ocspPolicy = policy; -+ } -+ - /** - * Enables OCSP, note when you Initialize JSS for the first time, for - * backwards compatibility, the initialize will enable OCSP if you -@@ -1220,6 +1258,16 @@ public void configureOCSP( - String ocspResponderCertNickname ) - throws GeneralSecurityException - { -+ /* set the ocsp policy */ -+ -+ if(ocspCheckingEnabled && -+ ocspResponderURL == null && -+ ocspResponderCertNickname == null) { -+ setOCSPPolicy(OCSPPolicy.LEAF_AND_CHAIN); -+ } else { -+ setOCSPPolicy(OCSPPolicy.NORMAL); -+ } -+ - configureOCSPNative(ocspCheckingEnabled, - ocspResponderURL, - ocspResponderCertNickname ); -diff --git a/org/mozilla/jss/PK11Finder.c b/org/mozilla/jss/PK11Finder.c -index 45958181..0329e91d 100644 ---- a/org/mozilla/jss/PK11Finder.c -+++ b/org/mozilla/jss/PK11Finder.c -@@ -14,9 +14,9 @@ - #include - - #include -- - #include - #include "pk11util.h" -+#include "ssl/jssl.h" - #include - - /* -@@ -1574,6 +1574,9 @@ SECStatus verifyCertificateNow(JNIEnv *env, jobject self, jstring nickString, - goto finish; - } - -+ int ocspPolicy = JSSL_getOCSPPolicy(); -+ -+ - certificateUsage = required_certificateUsage; - - cert = CERT_FindCertByNickname(CERT_GetDefaultCertDB(), nickname); -@@ -1587,8 +1590,24 @@ SECStatus verifyCertificateNow(JNIEnv *env, jobject self, jstring nickString, - /* 0 for certificateUsage in call to CERT_VerifyCertificateNow will - * retrieve the current valid usage into currUsage - */ -- rv = CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, -- checkSig, certificateUsage, NULL, currUsage ); -+ if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { -+ rv = JSSL_verifyCertPKIX( cert, certificateUsage, -+ NULL /* pin arg */, ocspPolicy, NULL, currUsage); -+ -+ /* we need to do this just to get the cert usages, the pkix version -+ doesn't seem to honor the method to get the usages as of yet. -+ Let the PKIX call only determine the final fate. -+ */ -+ if(rv == SECSuccess) { -+ CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, -+ checkSig, certificateUsage, NULL, currUsage ); -+ } -+ -+ } else { -+ rv = CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, -+ checkSig, certificateUsage, NULL, currUsage ); -+ } -+ - if ((rv == SECSuccess) && certificateUsage == 0x0000) { - if (*currUsage == - ( certUsageUserCertImport | -@@ -1639,6 +1658,8 @@ Java_org_mozilla_jss_CryptoManager_verifyCertificateNowNative(JNIEnv *env, - goto finish; - } - -+ int ocspPolicy = JSSL_getOCSPPolicy(); -+ - certificateUsage = required_certificateUsage; - - cert = CERT_FindCertByNickname(CERT_GetDefaultCertDB(), nickname); -@@ -1653,8 +1674,23 @@ Java_org_mozilla_jss_CryptoManager_verifyCertificateNowNative(JNIEnv *env, - * just get the current usage (which we are not passing back for now - * but will bypass the certificate usage check - */ -- rv = CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, -- checkSig, certificateUsage, NULL, &currUsage ); -+ -+ if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { -+ rv= JSSL_verifyCertPKIX( cert, certificateUsage, -+ NULL /* pin arg */, ocspPolicy, NULL, &currUsage); -+ -+ /* we need to do this just to get the cert usages, the pkix version -+ doesn't seem to honor the method to get the usages as of yet. -+ Let the PKIX call only determine the final fate. -+ */ -+ if(rv == SECSuccess) { -+ CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, -+ checkSig, certificateUsage, NULL, &currUsage ); -+ } -+ } else { -+ rv = CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, -+ checkSig, certificateUsage, NULL, &currUsage ); -+ } - } - - finish: -@@ -1720,12 +1756,14 @@ Java_org_mozilla_jss_CryptoManager_verifyCertificateNowNative2(JNIEnv *env, - SECStatus rv = SECFailure; - CERTCertificate *cert = NULL; - char *nickname = NULL; -- -+ - if (nickString == NULL) { - JSS_throwMsg(env, INVALID_NICKNAME_EXCEPTION, "Missing certificate nickname"); - goto finish; - } - -+ int ocspPolicy = JSSL_getOCSPPolicy(); -+ - nickname = (char *) (*env)->GetStringUTFChars(env, nickString, NULL); - if (nickname == NULL) { - JSS_throwMsg(env, INVALID_NICKNAME_EXCEPTION, "Missing certificate nickname"); -@@ -1747,8 +1785,25 @@ Java_org_mozilla_jss_CryptoManager_verifyCertificateNowNative2(JNIEnv *env, - /* 0 for certificateUsage in call to CERT_VerifyCertificateNow will - * retrieve the current valid usage into currUsage - */ -- rv = CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, -- checkSig, certificateUsage, NULL, &currUsage); -+ -+ if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { -+ rv = JSSL_verifyCertPKIX( cert, certificateUsage, -+ NULL /* pin arg */, ocspPolicy, NULL, &currUsage); -+ -+ /* we need to do this just to get the cert usages, the pkix version -+ doesn't seem to honor the method to get the usages as of yet. -+ Let the PKIX call only determine the final fate. -+ */ -+ if(rv == SECSuccess) { -+ CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, -+ checkSig, certificateUsage, NULL, &currUsage ); -+ -+ } -+ -+ } else { -+ rv = CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert, -+ checkSig, certificateUsage, NULL, &currUsage); -+ } - - if (rv != SECSuccess) { - JSS_throwMsgPrErr(env, CERTIFICATE_EXCEPTION, "Invalid certificate"); -@@ -1803,6 +1858,9 @@ Java_org_mozilla_jss_CryptoManager_verifyCertNowNative(JNIEnv *env, - if( nickname == NULL ) { - goto finish; - } -+ -+ int ocspPolicy = JSSL_getOCSPPolicy(); -+ - certUsage = cUsage; - cert = CERT_FindCertByNickname(CERT_GetDefaultCertDB(), nickname); - -@@ -1812,8 +1870,13 @@ Java_org_mozilla_jss_CryptoManager_verifyCertNowNative(JNIEnv *env, - PR_smprintf_free(message); - goto finish; - } else { -- rv = CERT_VerifyCertNow(CERT_GetDefaultCertDB(), cert, -- checkSig, certUsage, NULL ); -+ if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { -+ rv = JSSL_verifyCertPKIX( cert, certUsage, -+ NULL /* pin arg */, ocspPolicy, NULL, NULL); -+ } else { -+ rv = CERT_VerifyCertNow(CERT_GetDefaultCertDB(), cert, -+ checkSig, certUsage, NULL ); -+ } - } - - finish: -@@ -1858,6 +1921,8 @@ Java_org_mozilla_jss_CryptoManager_verifyCertTempNative(JNIEnv *env, - derCerts[0] = JSS_ByteArrayToSECItem(env, packageArray); - derCerts[1] = NULL; - -+ int ocspPolicy = JSSL_getOCSPPolicy(); -+ - rv = CERT_ImportCerts(certdb, cUsage, - 1, derCerts, &certArray, PR_FALSE /*temp Certs*/, - PR_FALSE /*caOnly*/, NULL); -@@ -1869,8 +1934,14 @@ Java_org_mozilla_jss_CryptoManager_verifyCertTempNative(JNIEnv *env, - } - - certUsage = cUsage; -- rv = CERT_VerifyCertNow(certdb, certArray[0], -- checkSig, certUsage, NULL ); -+ -+ if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { -+ rv = JSSL_verifyCertPKIX( certArray[0], certUsage, -+ NULL /* pin arg */, ocspPolicy, NULL, NULL); -+ } else { -+ rv = CERT_VerifyCertNow(certdb, certArray[0], -+ checkSig, certUsage, NULL ); -+ } - - finish: - /* this checks for NULL */ -diff --git a/org/mozilla/jss/ssl/callbacks.c b/org/mozilla/jss/ssl/callbacks.c -index 634f31ec..42594a14 100644 ---- a/org/mozilla/jss/ssl/callbacks.c -+++ b/org/mozilla/jss/ssl/callbacks.c -@@ -20,6 +20,40 @@ - #include - #include - -+int -+JSSL_getOCSPPolicy() { -+ JNIEnv *env; -+ jint policy = -1; -+ -+ jmethodID getOCSPPolicyID; -+ jclass cryptoManagerClass; -+ -+ /* get the JNI environment */ -+ if((*JSS_javaVM)->AttachCurrentThread(JSS_javaVM, (void**)&env, NULL) != 0){ -+ PR_ASSERT(PR_FALSE); -+ goto finish; -+ } -+ -+ cryptoManagerClass = (*env)->FindClass(env, CRYPTO_MANAGER_NAME); -+ if( cryptoManagerClass == NULL ) { -+ ASSERT_OUTOFMEM(env); -+ goto finish; -+ } -+ getOCSPPolicyID = (*env)->GetStaticMethodID(env, cryptoManagerClass, -+ GET_OCSP_POLICY_NAME,GET_OCSP_POLICY_SIG); -+ -+ if( getOCSPPolicyID == NULL ) { -+ ASSERT_OUTOFMEM(env); -+ goto finish; -+ } -+ -+ policy = (*env)->CallStaticIntMethod(env, cryptoManagerClass, -+ getOCSPPolicyID); -+ -+finish: -+ return (int) policy; -+} -+ - static SECStatus - secCmpCertChainWCANames(CERTCertificate *cert, CERTDistNames *caNames) - { -@@ -443,8 +477,9 @@ JSSL_DefaultCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, - SECCertUsage certUsage; - CERTCertificate *peerCert=NULL; - -+ int ocspPolicy = JSSL_getOCSPPolicy(); -+ - certUsage = isServer ? certUsageSSLClient : certUsageSSLServer; -- - - /* SSL_PeerCertificate() returns a shallow copy of the cert, so we - must destroy it before we exit this function */ -@@ -452,8 +487,13 @@ JSSL_DefaultCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, - peerCert = SSL_PeerCertificate(fd); - - if (peerCert) { -- rv = CERT_VerifyCertNow(CERT_GetDefaultCertDB(), peerCert, -- checkSig, certUsage, NULL /*pinarg*/); -+ if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { -+ rv = JSSL_verifyCertPKIX( peerCert, certUsage, -+ NULL /* pin arg */, ocspPolicy, NULL, NULL); -+ } else { -+ rv = CERT_VerifyCertNow(CERT_GetDefaultCertDB(), peerCert, -+ checkSig, certUsage, NULL /*pinarg*/); -+ } - } - - /* if we're a server, then we don't need to check the CN of the -@@ -569,6 +609,8 @@ JSSL_JavaCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, - log.tail = NULL; - log.count = 0; - -+ int ocspPolicy = JSSL_getOCSPPolicy(); -+ - /* get the JNI environment */ - if((*JSS_javaVM)->AttachCurrentThread(JSS_javaVM, (void**)&env, NULL) != 0){ - PR_ASSERT(PR_FALSE); -@@ -589,13 +631,18 @@ JSSL_JavaCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, - * logging parameter) - */ - -- verificationResult = CERT_VerifyCert( CERT_GetDefaultCertDB(), -- peerCert, -- checkSig, -- certUsage, -- PR_Now(), -- NULL /*pinarg*/, -- &log); -+ if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { -+ verificationResult = JSSL_verifyCertPKIX( peerCert, certUsage, -+ NULL /* pin arg */, ocspPolicy, &log, NULL); -+ } else { -+ verificationResult = CERT_VerifyCert( CERT_GetDefaultCertDB(), -+ peerCert, -+ checkSig, -+ certUsage, -+ PR_Now(), -+ NULL /*pinarg*/, -+ &log); -+ } - - if (verificationResult == SECSuccess && log.count > 0) { - verificationResult = SECFailure; -diff --git a/org/mozilla/jss/ssl/common.c b/org/mozilla/jss/ssl/common.c -index 5c6efa85..aec88552 100644 ---- a/org/mozilla/jss/ssl/common.c -+++ b/org/mozilla/jss/ssl/common.c -@@ -15,6 +15,7 @@ - #include - #include "_jni/org_mozilla_jss_ssl_SSLSocket.h" - #include "jssl.h" -+#include "cert.h" - - #ifdef WIN32 - #include -@@ -889,3 +890,198 @@ JSS_SSL_processExceptions(JNIEnv *env, PRFilePrivate *priv) - PR_ASSERT(ret == 0); - } - } -+ -+/* Get the trusted anchor for pkix */ -+ -+CERTCertificate * getRoot(CERTCertificate *cert, -+ SECCertificateUsage certUsage) -+{ -+ CERTCertificate *root = NULL; -+ CERTCertListNode *node = NULL; -+ -+ if( !cert ) { -+ goto finish; -+ } -+ -+ CERTCertList *certList = CERT_GetCertChainFromCert(cert, -+ PR_Now(), -+ certUsage); -+ -+ if( certList == NULL) { -+ goto finish; -+ } -+ -+ for (node = CERT_LIST_HEAD(certList); -+ !CERT_LIST_END(node, certList); -+ node = CERT_LIST_NEXT(node)) { -+ -+ /* try to find the root */ -+ if( node->cert && node->cert->isRoot ) { -+ root = CERT_DupCertificate(node->cert) ; -+ } -+ } -+ -+finish: -+ -+ CERT_DestroyCertList (certList); -+ return root; -+} -+ -+/* Verify a cert using explicit PKIX call. -+ * For now only used in OCSP AIA context. -+ * The result of this call will be a full chain -+ * and leaf network AIA ocsp validation. -+ * The policy param will be used in the future to -+ * handle more scenarios. -+ */ -+ -+SECStatus JSSL_verifyCertPKIX(CERTCertificate *cert, -+ SECCertificateUsage certUsage,secuPWData *pwdata, int ocspPolicy, -+ CERTVerifyLog *log, SECCertificateUsage *usage) -+{ -+ -+ /* put the first set of possible flags internally here first */ -+ /* later there could be a more complete list to choose from */ -+ /* support our hard core fetch aia ocsp policy for now */ -+ -+ static PRUint64 ocsp_Enabled_Hard_Policy_LeafFlags[2] = { -+ /* crl */ -+ 0, -+ /* ocsp */ -+ CERT_REV_M_TEST_USING_THIS_METHOD | -+ CERT_REV_M_FAIL_ON_MISSING_FRESH_INFO -+ }; -+ -+ static PRUint64 ocsp_Enabled_Hard_Policy_ChainFlags[2] = { -+ /* crl */ -+ 0, -+ /* ocsp */ -+ CERT_REV_M_TEST_USING_THIS_METHOD | -+ CERT_REV_M_FAIL_ON_MISSING_FRESH_INFO -+ }; -+ -+ static CERTRevocationMethodIndex -+ ocsp_Enabled_Hard_Policy_Method_Preference = { -+ cert_revocation_method_ocsp -+ }; -+ -+ static CERTRevocationFlags ocsp_Enabled_Hard_Policy = { -+ { /* leafTests */ -+ 2, -+ ocsp_Enabled_Hard_Policy_LeafFlags, -+ 1, -+ &ocsp_Enabled_Hard_Policy_Method_Preference, -+ 0 }, -+ { /* chainTests */ -+ 2, -+ ocsp_Enabled_Hard_Policy_ChainFlags, -+ 1, -+ &ocsp_Enabled_Hard_Policy_Method_Preference, -+ 0 } -+ }; -+ -+ /* for future expansion */ -+ -+ CERTValOutParam cvout[20] = {0}; -+ CERTValInParam cvin[20] = {0}; -+ -+ int inParamIndex = 0; -+ int outParamIndex = 0; -+ CERTRevocationFlags *rev = NULL; -+ -+ CERTCertList *trustedCertList = NULL; -+ -+ PRBool fetchCerts = PR_FALSE; -+ -+ SECStatus res = SECFailure; -+ if(cert == NULL) { -+ goto finish; -+ } -+ -+ if(ocspPolicy != OCSP_LEAF_AND_CHAIN_POLICY) { -+ goto finish; -+ } -+ -+ /* Force the strict ocsp network check on chain -+ and leaf. -+ */ -+ -+ fetchCerts = PR_TRUE; -+ rev = &ocsp_Enabled_Hard_Policy; -+ -+ /* fetch aia over net */ -+ -+ cvin[inParamIndex].type = cert_pi_useAIACertFetch; -+ cvin[inParamIndex].value.scalar.b = fetchCerts; -+ inParamIndex++; -+ -+ /* time */ -+ -+ cvin[inParamIndex].type = cert_pi_date; -+ cvin[inParamIndex].value.scalar.time = PR_Now(); -+ inParamIndex++; -+ -+ /* flags */ -+ -+ cvin[inParamIndex].type = cert_pi_revocationFlags; -+ cvin[inParamIndex].value.pointer.revocation = rev; -+ inParamIndex++; -+ -+ -+ /* establish trust anchor */ -+ -+ CERTCertificate *root = getRoot(cert,certUsage); -+ -+ /* Try to add the root as the trust anchor so all the -+ other memebers of the ca chain will get validated. -+ */ -+ -+ if( root != NULL ) { -+ trustedCertList = CERT_NewCertList(); -+ CERT_AddCertToListTail(trustedCertList, root); -+ -+ cvin[inParamIndex].type = cert_pi_trustAnchors; -+ cvin[inParamIndex].value.pointer.chain = trustedCertList; -+ -+ inParamIndex++; -+ } -+ -+ cvin[inParamIndex].type = cert_pi_end; -+ -+ if(log != NULL) { -+ cvout[outParamIndex].type = cert_po_errorLog; -+ cvout[outParamIndex].value.pointer.log = log; -+ outParamIndex ++; -+ } -+ -+ int usageIndex = 0; -+ if(usage != NULL) { -+ usageIndex = outParamIndex; -+ cvout[outParamIndex].type = cert_po_usages; -+ cvout[outParamIndex].value.scalar.usages = 0; -+ outParamIndex ++; -+ } -+ -+ cvout[outParamIndex].type = cert_po_end; -+ -+ res = CERT_PKIXVerifyCert(cert, certUsage, cvin, cvout, &pwdata); -+ -+finish: -+ /* clean up any trusted cert list */ -+ -+ if (trustedCertList) { -+ CERT_DestroyCertList(trustedCertList); -+ trustedCertList = NULL; -+ } -+ -+ if(root) { -+ CERT_DestroyCertificate(root); -+ root = NULL; -+ } -+ -+ if(res == SECSuccess && usage) { -+ *usage = cvout[usageIndex].value.scalar.usages; -+ } -+ -+ return res; -+} -diff --git a/org/mozilla/jss/ssl/jssl.h b/org/mozilla/jss/ssl/jssl.h -index c15acf87..0e93eebe 100644 ---- a/org/mozilla/jss/ssl/jssl.h -+++ b/org/mozilla/jss/ssl/jssl.h -@@ -5,8 +5,27 @@ - #ifndef ORG_MOZILLA_JSS_SSL_JSSL_H - #define ORG_MOZILLA_JSS_SSL_JSSL_H - -+/* ocsp policy constants */ -+ -+/* ocsp policy constants */ -+static const int OCSP_NO_POLICY = 0; -+static const int OCSP_NORMAL_POLICY = 1; -+static const int OCSP_LEAF_AND_CHAIN_POLICY = 2; -+ - #include - -+typedef struct -+{ -+ enum -+ { -+ PW_NONE = 0, -+ PW_FROMFILE = 1, -+ PW_PLAINTEXT = 2, -+ PW_EXTERNAL = 3 -+ } source; -+ char *data; -+} secuPWData; -+ - struct JSSL_SocketData { - PRFileDesc *fd; - jobject socketObject; /* weak global ref */ -@@ -120,4 +139,14 @@ JSS_SSL_processExceptions(JNIEnv *env, PRFilePrivate *priv); - - void JSSL_throwSSLSocketException(JNIEnv *env, char *message); - -+int -+JSSL_getOCSPPolicy(); -+ -+ -+SECStatus -+JSSL_verifyCertPKIX(CERTCertificate *cert, -+ SECCertificateUsage certUsage, -+ secuPWData *pwdata, int ocspPolicy, -+ CERTVerifyLog *log,SECCertificateUsage *usage); -+ - #endif -diff --git a/org/mozilla/jss/util/java_ids.h b/org/mozilla/jss/util/java_ids.h -index 73b31fa9..4053d9a7 100644 ---- a/org/mozilla/jss/util/java_ids.h -+++ b/org/mozilla/jss/util/java_ids.h -@@ -276,6 +276,15 @@ PR_BEGIN_EXTERN_C - #define GET_RECV_BUF_SIZE "getReceiveBufferSize" - #define GET_BUF_SIZE_SIG "()I" - -+/* -+ * CryptoManager -+ * -+*/ -+ -+#define CRYPTO_MANAGER_NAME "org/mozilla/jss/CryptoManager" -+#define GET_OCSP_POLICY_NAME "getOCSPPolicy" -+#define GET_OCSP_POLICY_SIG "()I" -+ - /* - * SocketBase - */ diff --git a/jss-aia-ocsp-2.patch b/jss-aia-ocsp-2.patch deleted file mode 100644 index c6b2f1c..0000000 --- a/jss-aia-ocsp-2.patch +++ /dev/null @@ -1,141 +0,0 @@ -From 1fe6a451ec0c3ec960ac1119b39c406d999da5ec Mon Sep 17 00:00:00 2001 -From: Jack Magne -Date: Fri, 8 Feb 2019 11:21:48 -0800 -Subject: [PATCH] Additional: Resolve Bug 1666872 - CC: Enable AIA OCSP cert - checking for entire cert chain. - -Simple fix to make sure we are using the correct variant of the NSS cert usage quantity. - -It turns out some calls need a SECCertUsage and others need a SECCertificateUsage. -We also need to convert between the two in certain instances. - -Found and fixed double certificate object free issue. ---- - org/mozilla/jss/ssl/callbacks.c | 10 ++++++++-- - org/mozilla/jss/ssl/common.c | 19 ++++++++++++++----- - org/mozilla/jss/ssl/jssl.h | 2 +- - 3 files changed, 23 insertions(+), 8 deletions(-) - -diff --git a/org/mozilla/jss/ssl/callbacks.c b/org/mozilla/jss/ssl/callbacks.c -index 42594a14..4fe08a29 100644 ---- a/org/mozilla/jss/ssl/callbacks.c -+++ b/org/mozilla/jss/ssl/callbacks.c -@@ -481,6 +481,9 @@ JSSL_DefaultCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, - - certUsage = isServer ? certUsageSSLClient : certUsageSSLServer; - -+ /* PKIX call needs a SECCertificate usage, convert */ -+ SECCertificateUsage certificateUsage = (SECCertificateUsage)1 << certUsage; -+ - /* SSL_PeerCertificate() returns a shallow copy of the cert, so we - must destroy it before we exit this function */ - -@@ -488,7 +491,7 @@ JSSL_DefaultCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, - - if (peerCert) { - if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { -- rv = JSSL_verifyCertPKIX( peerCert, certUsage, -+ rv = JSSL_verifyCertPKIX( peerCert, certificateUsage, - NULL /* pin arg */, ocspPolicy, NULL, NULL); - } else { - rv = CERT_VerifyCertNow(CERT_GetDefaultCertDB(), peerCert, -@@ -624,6 +627,9 @@ JSSL_JavaCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, - if (peerCert == NULL) goto finish; - - certUsage = isServer ? certUsageSSLClient : certUsageSSLServer; -+ /* PKIX call needs a SECCertificate usage, convert */ -+ SECCertificateUsage certificateUsage = (SECCertificateUsage)1 << certUsage; -+ - - /* - * verify it against current time - (can't use -@@ -632,7 +638,7 @@ JSSL_JavaCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig, - */ - - if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) { -- verificationResult = JSSL_verifyCertPKIX( peerCert, certUsage, -+ verificationResult = JSSL_verifyCertPKIX( peerCert, certificateUsage, - NULL /* pin arg */, ocspPolicy, &log, NULL); - } else { - verificationResult = CERT_VerifyCert( CERT_GetDefaultCertDB(), -diff --git a/org/mozilla/jss/ssl/common.c b/org/mozilla/jss/ssl/common.c -index aec88552..cb281798 100644 ---- a/org/mozilla/jss/ssl/common.c -+++ b/org/mozilla/jss/ssl/common.c -@@ -894,7 +894,7 @@ JSS_SSL_processExceptions(JNIEnv *env, PRFilePrivate *priv) - /* Get the trusted anchor for pkix */ - - CERTCertificate * getRoot(CERTCertificate *cert, -- SECCertificateUsage certUsage) -+ SECCertUsage certUsage) - { - CERTCertificate *root = NULL; - CERTCertListNode *node = NULL; -@@ -936,7 +936,7 @@ CERTCertificate * getRoot(CERTCertificate *cert, - */ - - SECStatus JSSL_verifyCertPKIX(CERTCertificate *cert, -- SECCertificateUsage certUsage,secuPWData *pwdata, int ocspPolicy, -+ SECCertificateUsage certificateUsage,secuPWData *pwdata, int ocspPolicy, - CERTVerifyLog *log, SECCertificateUsage *usage) - { - -@@ -993,6 +993,8 @@ SECStatus JSSL_verifyCertPKIX(CERTCertificate *cert, - - PRBool fetchCerts = PR_FALSE; - -+ SECCertUsage certUsage = certUsageSSLClient /* 0 */; -+ - SECStatus res = SECFailure; - if(cert == NULL) { - goto finish; -@@ -1027,9 +1029,15 @@ SECStatus JSSL_verifyCertPKIX(CERTCertificate *cert, - cvin[inParamIndex].value.pointer.revocation = rev; - inParamIndex++; - -- - /* establish trust anchor */ - -+ /* We need to convert the SECCertificateUsage to a SECCertUsage to obtain -+ * the root. -+ */ -+ -+ SECCertificateUsage testUsage = certificateUsage; -+ while (0 != (testUsage = testUsage >> 1)) { certUsage++; } -+ - CERTCertificate *root = getRoot(cert,certUsage); - - /* Try to add the root as the trust anchor so all the -@@ -1064,7 +1072,7 @@ SECStatus JSSL_verifyCertPKIX(CERTCertificate *cert, - - cvout[outParamIndex].type = cert_po_end; - -- res = CERT_PKIXVerifyCert(cert, certUsage, cvin, cvout, &pwdata); -+ res = CERT_PKIXVerifyCert(cert, certificateUsage, cvin, cvout, &pwdata); - - finish: - /* clean up any trusted cert list */ -@@ -1074,8 +1082,9 @@ SECStatus JSSL_verifyCertPKIX(CERTCertificate *cert, - trustedCertList = NULL; - } - -+ /* CERT_DestroyCertList destroys interior certs for us. */ -+ - if(root) { -- CERT_DestroyCertificate(root); - root = NULL; - } - -diff --git a/org/mozilla/jss/ssl/jssl.h b/org/mozilla/jss/ssl/jssl.h -index 0e93eebe..925e1225 100644 ---- a/org/mozilla/jss/ssl/jssl.h -+++ b/org/mozilla/jss/ssl/jssl.h -@@ -145,7 +145,7 @@ JSSL_getOCSPPolicy(); - - SECStatus - JSSL_verifyCertPKIX(CERTCertificate *cert, -- SECCertificateUsage certUsage, -+ SECCertificateUsage certificateUsage, - secuPWData *pwdata, int ocspPolicy, - CERTVerifyLog *log,SECCertificateUsage *usage); - diff --git a/jss.spec b/jss.spec index 7bcc899..f403822 100644 --- a/jss.spec +++ b/jss.spec @@ -7,7 +7,7 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.6.2 -Release: 1%{?_timestamp}%{?_commit_id}%{?dist} +Release: 2%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 # To generate the source tarball: @@ -25,6 +25,7 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch +Patch: 0001-Fix-NativeProxy-reference-tracker.patch ################################################################################ # Build Dependencies @@ -159,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Tue Oct 29 2019 Dogtag PKI Team - 4.6.2-2 +- Fix for rhbz#1766451 + * Tue Oct 15 2019 Dogtag PKI Team - 4.6.2-1 - Rebase to JSS 4.6.2 - Fixes CVE-2019-14823 From 7e749ce6786c63ae48bb0097fbddd8e182a2cf1f Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Tue, 28 Jan 2020 10:48:11 -0500 Subject: [PATCH 05/77] Rebuild with new NSS Resolves: rhbz#1794814 Signed-off-by: Alexander Scheel --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index be8e0ab..536e1db 100644 --- a/jss.spec +++ b/jss.spec @@ -7,7 +7,7 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.6.2 -Release: 2%{?_timestamp}%{?_commit_id}%{?dist} +Release: 3%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 # To generate the source tarball: @@ -160,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Tue Jan 28 2020 Dogtag PKI Team - 4.6.2-3 +- Rebuild with new NSS to fix rhbz#1794814 + * Tue Oct 29 2019 Dogtag PKI Team - 4.6.2-2 - Fix for rhbz#1766451 From f21007ede6ff9e8a7528e0188757e33cf1ae87b3 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Tue, 28 Jan 2020 10:48:11 -0500 Subject: [PATCH 06/77] Rebuild with new NSS Resolves: rhbz#1794814 Signed-off-by: Alexander Scheel --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index f403822..0c333df 100644 --- a/jss.spec +++ b/jss.spec @@ -7,7 +7,7 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.6.2 -Release: 2%{?_timestamp}%{?_commit_id}%{?dist} +Release: 3%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 # To generate the source tarball: @@ -160,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Tue Jan 28 2020 Dogtag PKI Team - 4.6.2-3 +- Rebuild with new NSS to fix rhbz#1794814 + * Tue Oct 29 2019 Dogtag PKI Team - 4.6.2-2 - Fix for rhbz#1766451 From 2bdd1199972bb28747b6f73ff140285e727a5c16 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 4 Mar 2020 11:33:04 -0500 Subject: [PATCH 07/77] Rebase to JSS v4.6.3 Also fixes three additional issues found since v4.6.3 rebase. Signed-off-by: Alexander Scheel --- .gitignore | 1 + 0001-Fix-NativeProxy-reference-tracker.patch | 53 ------------ 0001-Fix-base64-encoding-of-CSRs.patch | 39 +++++++++ ...Fix-swapped-parameter-names-with-PBE.patch | 80 +++++++++++++++++++ ...-Use-specified-algorithm-for-KeyWrap.patch | 60 ++++++++++++++ ...-Use-specified-algorithm-for-KeyWrap.patch | 60 ++++++++++++++ jss.spec | 14 +++- sources | 2 +- 8 files changed, 252 insertions(+), 57 deletions(-) delete mode 100644 0001-Fix-NativeProxy-reference-tracker.patch create mode 100644 0001-Fix-base64-encoding-of-CSRs.patch create mode 100644 0002-Fix-swapped-parameter-names-with-PBE.patch create mode 100644 0003-Use-specified-algorithm-for-KeyWrap.patch create mode 100644 0008-Use-specified-algorithm-for-KeyWrap.patch diff --git a/.gitignore b/.gitignore index 5981ea6..77527dc 100644 --- a/.gitignore +++ b/.gitignore @@ -23,3 +23,4 @@ jss-4.2.6.tar.gz /jss-4.5.3.tar.gz /jss-4.6.1.tar.gz /jss-4.6.2.tar.gz +/jss-4.6.3.tar.gz diff --git a/0001-Fix-NativeProxy-reference-tracker.patch b/0001-Fix-NativeProxy-reference-tracker.patch deleted file mode 100644 index 529b576..0000000 --- a/0001-Fix-NativeProxy-reference-tracker.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 91514ca0a2979ba778d27220ced0cd312e2cd2d2 Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Tue, 29 Oct 2019 10:43:56 -0400 -Subject: [PATCH] Fix NativeProxy reference tracker - -In eb5df01003d74b57473eacb84e538d31f5bb06ca, I introduced a bug by -setting mPointer after trying to add NativeProxy to the registry. In -most instances this won't matter, however, if another instance exists in -the HashSet with the same hash value, the equals comparator will be -used, triggering a NPE. - -Signed-off-by: Alexander Scheel ---- - org/mozilla/jss/util/NativeProxy.java | 13 +++++-------- - 1 file changed, 5 insertions(+), 8 deletions(-) - -diff --git a/org/mozilla/jss/util/NativeProxy.java b/org/mozilla/jss/util/NativeProxy.java -index 1c6d1aa5..a0811f76 100644 ---- a/org/mozilla/jss/util/NativeProxy.java -+++ b/org/mozilla/jss/util/NativeProxy.java -@@ -40,8 +40,8 @@ public abstract class NativeProxy implements AutoCloseable - */ - public NativeProxy(byte[] pointer) { - assert(pointer!=null); -- registry.add(this); - mPointer = pointer; -+ registry.add(this); - - if (saveStacktraces) { - mTrace = Arrays.toString(Thread.currentThread().getStackTrace()); -@@ -61,15 +61,12 @@ public abstract class NativeProxy implements AutoCloseable - if( ! (obj instanceof NativeProxy) ) { - return false; - } -- if( ((NativeProxy)obj).mPointer.length != mPointer.length) { -+ if (((NativeProxy)obj).mPointer == null) { -+ /* If mPointer is null, we have no way to compare the values -+ * of the pointers, so assume they're unequal. */ - return false; - } -- for(int i=0; i < mPointer.length; i++) { -- if(mPointer[i] != ((NativeProxy)obj).mPointer[i]) { -- return false; -- } -- } -- return true; -+ return Arrays.equals(((NativeProxy)obj).mPointer, mPointer); - } - - /** --- -2.21.0 - diff --git a/0001-Fix-base64-encoding-of-CSRs.patch b/0001-Fix-base64-encoding-of-CSRs.patch new file mode 100644 index 0000000..f898ed1 --- /dev/null +++ b/0001-Fix-base64-encoding-of-CSRs.patch @@ -0,0 +1,39 @@ +From 18efce236af6a1affebb274838318ba715114218 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Tue, 25 Feb 2020 09:14:47 -0500 +Subject: [PATCH 3/8] Fix base64-encoding of CSRs + +In 8de4440c5652f6f1af5b4b923a15730ba84f29e1, the base64 encoder was +changed from apache-commons-codec to the Java standard library to drop +a dependency. However, the behavior changed as a result: the Java +standard library doesn't include a final line separator, whereas +apache-commons-codec did. This results in malformed CSRs: + +> YWRPxyBKvFAOB29fwPwBJLZksrwQ0xAs7sooc+qF-----END NEW CERTIFICATE REQUEST----- + +Resolves: https://pagure.io/freeipa/issue/8199 + +Signed-off-by: Alexander Scheel +--- + org/mozilla/jss/netscape/security/util/Utils.java | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/org/mozilla/jss/netscape/security/util/Utils.java b/org/mozilla/jss/netscape/security/util/Utils.java +index 19f3b1f9..e6e56ce4 100644 +--- a/org/mozilla/jss/netscape/security/util/Utils.java ++++ b/org/mozilla/jss/netscape/security/util/Utils.java +@@ -378,7 +378,10 @@ public class Utils { + * @return base-64 encoded data + */ + public static String base64encodeMultiLine(byte[] bytes) { +- return Base64.getMimeEncoder().encodeToString(bytes); ++ // When switching from apache-commons-codec to the standard library, ++ // the standard library does not include a final line separator at ++ // the end of the encoded data. This results in malformed CSRs. ++ return Base64.getMimeEncoder().encodeToString(bytes) + "\r\n"; + } + + +-- +2.24.1 + diff --git a/0002-Fix-swapped-parameter-names-with-PBE.patch b/0002-Fix-swapped-parameter-names-with-PBE.patch new file mode 100644 index 0000000..c535f6e --- /dev/null +++ b/0002-Fix-swapped-parameter-names-with-PBE.patch @@ -0,0 +1,80 @@ +From 9f29430656342829822568f4ef49f5237b41164b Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Fri, 28 Feb 2020 14:10:32 -0500 +Subject: [PATCH 7/8] Fix swapped parameter names with PBE + +Commit 13998a9e77e60d6509ac814ed711dd21e1248ecd introduced a regression +related to extracting the parameter classes during PBE operations: +previously, the classes of the underlying encryption algorithm were +iterated over, instead of the classes of the PBE class itself. However, +this commit iterated over the PBE parameter classes; no PBE algorithm +accepts a IvParameterSpec, resulting in a null parameter passed to the +later encryption or key wrap operation. This resulted in stack traces +like the following: + +Caused by: java.security.InvalidAlgorithmParameterException: DES3/CBC/Pad cannot use a null parameter + at org.mozilla.jss.pkcs11.PK11KeyWrapper.checkParams(PK11KeyWrapper.java:225) + at org.mozilla.jss.pkcs11.PK11KeyWrapper.initWrap(PK11KeyWrapper.java:89) + at org.mozilla.jss.pkcs11.PK11KeyWrapper.initWrap(PK11KeyWrapper.java:57) + at org.mozilla.jss.pkix.primitive.EncryptedPrivateKeyInfo.createPBE(EncryptedPrivateKeyInfo.java:342) + +Resolves: rh-bz#1807371 + +Signed-off-by: Alexander Scheel +--- + org/mozilla/jss/pkcs7/EncryptedContentInfo.java | 2 +- + org/mozilla/jss/pkix/cms/EncryptedContentInfo.java | 2 +- + org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++-- + 3 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/org/mozilla/jss/pkcs7/EncryptedContentInfo.java b/org/mozilla/jss/pkcs7/EncryptedContentInfo.java +index 084752c3..0344b14d 100644 +--- a/org/mozilla/jss/pkcs7/EncryptedContentInfo.java ++++ b/org/mozilla/jss/pkcs7/EncryptedContentInfo.java +@@ -182,7 +182,7 @@ public class EncryptedContentInfo implements ASN1Value { + // generate IV + EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); + AlgorithmParameterSpec params=null; +- Class [] paramClasses = pbeAlg.getParameterClasses(); ++ Class [] paramClasses = encAlg.getParameterClasses(); + for (int i = 0; i < paramClasses.length; i ++) { + if ( paramClasses[i].equals( + javax.crypto.spec.IvParameterSpec.class ) ) { +diff --git a/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java b/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java +index a4709070..d85eb0d3 100644 +--- a/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java ++++ b/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java +@@ -180,7 +180,7 @@ public class EncryptedContentInfo implements ASN1Value { + // generate IV + EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); + AlgorithmParameterSpec params=null; +- Class [] paramClasses = pbeAlg.getParameterClasses(); ++ Class [] paramClasses = encAlg.getParameterClasses(); + for (int i = 0; i < paramClasses.length; i ++) { + if ( paramClasses[i].equals( IVParameterSpec.class ) ) { + params = new IVParameterSpec( kg.generatePBE_IV() ); +diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +index b35714e3..ebd269f3 100644 +--- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java ++++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +@@ -147,7 +147,7 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { + // generate IV + EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); + AlgorithmParameterSpec params=null; +- Class [] paramClasses = pbeAlg.getParameterClasses(); ++ Class [] paramClasses = encAlg.getParameterClasses(); + for (int i = 0; i < paramClasses.length; i ++) { + if ( paramClasses[i].equals( javax.crypto.spec.IvParameterSpec.class ) ) { + params = new IVParameterSpec( kg.generatePBE_IV() ); +@@ -328,7 +328,7 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { + // generate IV + EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); + AlgorithmParameterSpec params=null; +- Class [] paramClasses = pbeAlg.getParameterClasses(); ++ Class [] paramClasses = encAlg.getParameterClasses(); + for (int i = 0; i < paramClasses.length; i ++) { + if ( paramClasses[i].equals( + javax.crypto.spec.IvParameterSpec.class ) ) { +-- +2.24.1 + diff --git a/0003-Use-specified-algorithm-for-KeyWrap.patch b/0003-Use-specified-algorithm-for-KeyWrap.patch new file mode 100644 index 0000000..d75534a --- /dev/null +++ b/0003-Use-specified-algorithm-for-KeyWrap.patch @@ -0,0 +1,60 @@ +From 55482c8bfa0addeb9db7b590703ba3704c5db167 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Fri, 28 Feb 2020 14:39:29 -0500 +Subject: [PATCH 8/8] Use specified algorithm for KeyWrap + +When the token-specified from of EncryptedPrivateKeyInfo.createPBE is +called, it would always request DES3_CBC_PAD as the key wrapping +algorithm, regardless of the input PBE key type. However, the other form +(with an implicit token) was correctly handling this case. + +Introduces a new KeyWrapAlgorithm method to take an OBJECT_IDENTIFIER +instead of having to convert to/from a String form. + +Signed-off-by: Alexander Scheel +--- + org/mozilla/jss/crypto/KeyWrapAlgorithm.java | 5 ++++- + org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++-- + 2 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java +index 3113f614..3a106977 100644 +--- a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java ++++ b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java +@@ -138,7 +138,10 @@ public class KeyWrapAlgorithm extends Algorithm { + + public static KeyWrapAlgorithm fromOID(String wrapOID) throws NoSuchAlgorithmException { + OBJECT_IDENTIFIER oid = new OBJECT_IDENTIFIER(wrapOID); ++ return fromOID(oid); ++ } + ++ public static KeyWrapAlgorithm fromOID(OBJECT_IDENTIFIER oid) throws NoSuchAlgorithmException { + if (oid.equals(AES_KEY_WRAP_PAD_OID)) + return AES_KEY_WRAP_PAD; + +@@ -154,6 +157,6 @@ public class KeyWrapAlgorithm extends Algorithm { + if (oid.equals(DES_CBC_PAD_OID)) + return DES_CBC_PAD; + +- throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + wrapOID); ++ throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + oid); + } + } +diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +index ebd269f3..abfc39a7 100644 +--- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java ++++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +@@ -337,8 +337,8 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { + } + } + +- KeyWrapper wrapper = token.getKeyWrapper( +- KeyWrapAlgorithm.DES3_CBC_PAD); ++ // wrap the key ++ KeyWrapper wrapper = token.getKeyWrapper(KeyWrapAlgorithm.fromOID(encAlg.toOID())); + wrapper.initWrap(key, params); + byte encrypted[] = wrapper.wrap(pri); + +-- +2.24.1 + diff --git a/0008-Use-specified-algorithm-for-KeyWrap.patch b/0008-Use-specified-algorithm-for-KeyWrap.patch new file mode 100644 index 0000000..d75534a --- /dev/null +++ b/0008-Use-specified-algorithm-for-KeyWrap.patch @@ -0,0 +1,60 @@ +From 55482c8bfa0addeb9db7b590703ba3704c5db167 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Fri, 28 Feb 2020 14:39:29 -0500 +Subject: [PATCH 8/8] Use specified algorithm for KeyWrap + +When the token-specified from of EncryptedPrivateKeyInfo.createPBE is +called, it would always request DES3_CBC_PAD as the key wrapping +algorithm, regardless of the input PBE key type. However, the other form +(with an implicit token) was correctly handling this case. + +Introduces a new KeyWrapAlgorithm method to take an OBJECT_IDENTIFIER +instead of having to convert to/from a String form. + +Signed-off-by: Alexander Scheel +--- + org/mozilla/jss/crypto/KeyWrapAlgorithm.java | 5 ++++- + org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++-- + 2 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java +index 3113f614..3a106977 100644 +--- a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java ++++ b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java +@@ -138,7 +138,10 @@ public class KeyWrapAlgorithm extends Algorithm { + + public static KeyWrapAlgorithm fromOID(String wrapOID) throws NoSuchAlgorithmException { + OBJECT_IDENTIFIER oid = new OBJECT_IDENTIFIER(wrapOID); ++ return fromOID(oid); ++ } + ++ public static KeyWrapAlgorithm fromOID(OBJECT_IDENTIFIER oid) throws NoSuchAlgorithmException { + if (oid.equals(AES_KEY_WRAP_PAD_OID)) + return AES_KEY_WRAP_PAD; + +@@ -154,6 +157,6 @@ public class KeyWrapAlgorithm extends Algorithm { + if (oid.equals(DES_CBC_PAD_OID)) + return DES_CBC_PAD; + +- throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + wrapOID); ++ throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + oid); + } + } +diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +index ebd269f3..abfc39a7 100644 +--- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java ++++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +@@ -337,8 +337,8 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { + } + } + +- KeyWrapper wrapper = token.getKeyWrapper( +- KeyWrapAlgorithm.DES3_CBC_PAD); ++ // wrap the key ++ KeyWrapper wrapper = token.getKeyWrapper(KeyWrapAlgorithm.fromOID(encAlg.toOID())); + wrapper.initWrap(key, params); + byte encrypted[] = wrapper.wrap(pri); + +-- +2.24.1 + diff --git a/jss.spec b/jss.spec index 536e1db..c58e687 100644 --- a/jss.spec +++ b/jss.spec @@ -6,8 +6,8 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.6.2 -Release: 3%{?_timestamp}%{?_commit_id}%{?dist} +Version: 4.6.3 +Release: 1%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 # To generate the source tarball: @@ -25,7 +25,9 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch -Patch: 0001-Fix-NativeProxy-reference-tracker.patch +Patch0: 0001-Fix-base64-encoding-of-CSRs.patch +Patch1: 0002-Fix-swapped-parameter-names-with-PBE.patch +Patch2: 0003-Use-specified-algorithm-for-KeyWrap.patch ################################################################################ # Build Dependencies @@ -160,6 +162,12 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Wed Mar 4 2020 Dogtag PKI Team - 4.6.3-1 +- Rebase to JSS 4.6.3 +- Fixes base64 encoding of CSRs +- Fixes swapped parameter names in PBE +- Use specified algorithms for KeyWrap in PBE + * Tue Jan 28 2020 Dogtag PKI Team - 4.6.2-3 - Rebuild with new NSS to fix rhbz#1794814 diff --git a/sources b/sources index 32f2840..c883e35 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.6.2.tar.gz) = 53c12822b980f6dcaf5616366834fe4eaee07d84feae53096aa0ea142146e90d375910456d8192068cde5e63c3b60ded87862af50ea89c6b64224e8c105e00dd +SHA512 (jss-4.6.3.tar.gz) = 6c45b67c40737ee7bbc9ad1db8a5ed233b050697f9c048e1a49cc541de889416afd36b2c9bcdc44a52d10b0c75f036e22155a5ee95869fdf31772683637a27b1 From 3cc21a363a90b1c9ca16982b95e4295a5b6a7d70 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 4 Mar 2020 11:49:32 -0500 Subject: [PATCH 08/77] Revert "Rebase to JSS v4.6.3" This reverts commit 2bdd1199972bb28747b6f73ff140285e727a5c16. --- .gitignore | 1 - 0001-Fix-NativeProxy-reference-tracker.patch | 53 ++++++++++++ 0001-Fix-base64-encoding-of-CSRs.patch | 39 --------- ...Fix-swapped-parameter-names-with-PBE.patch | 80 ------------------- ...-Use-specified-algorithm-for-KeyWrap.patch | 60 -------------- ...-Use-specified-algorithm-for-KeyWrap.patch | 60 -------------- jss.spec | 14 +--- sources | 2 +- 8 files changed, 57 insertions(+), 252 deletions(-) create mode 100644 0001-Fix-NativeProxy-reference-tracker.patch delete mode 100644 0001-Fix-base64-encoding-of-CSRs.patch delete mode 100644 0002-Fix-swapped-parameter-names-with-PBE.patch delete mode 100644 0003-Use-specified-algorithm-for-KeyWrap.patch delete mode 100644 0008-Use-specified-algorithm-for-KeyWrap.patch diff --git a/.gitignore b/.gitignore index 77527dc..5981ea6 100644 --- a/.gitignore +++ b/.gitignore @@ -23,4 +23,3 @@ jss-4.2.6.tar.gz /jss-4.5.3.tar.gz /jss-4.6.1.tar.gz /jss-4.6.2.tar.gz -/jss-4.6.3.tar.gz diff --git a/0001-Fix-NativeProxy-reference-tracker.patch b/0001-Fix-NativeProxy-reference-tracker.patch new file mode 100644 index 0000000..529b576 --- /dev/null +++ b/0001-Fix-NativeProxy-reference-tracker.patch @@ -0,0 +1,53 @@ +From 91514ca0a2979ba778d27220ced0cd312e2cd2d2 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Tue, 29 Oct 2019 10:43:56 -0400 +Subject: [PATCH] Fix NativeProxy reference tracker + +In eb5df01003d74b57473eacb84e538d31f5bb06ca, I introduced a bug by +setting mPointer after trying to add NativeProxy to the registry. In +most instances this won't matter, however, if another instance exists in +the HashSet with the same hash value, the equals comparator will be +used, triggering a NPE. + +Signed-off-by: Alexander Scheel +--- + org/mozilla/jss/util/NativeProxy.java | 13 +++++-------- + 1 file changed, 5 insertions(+), 8 deletions(-) + +diff --git a/org/mozilla/jss/util/NativeProxy.java b/org/mozilla/jss/util/NativeProxy.java +index 1c6d1aa5..a0811f76 100644 +--- a/org/mozilla/jss/util/NativeProxy.java ++++ b/org/mozilla/jss/util/NativeProxy.java +@@ -40,8 +40,8 @@ public abstract class NativeProxy implements AutoCloseable + */ + public NativeProxy(byte[] pointer) { + assert(pointer!=null); +- registry.add(this); + mPointer = pointer; ++ registry.add(this); + + if (saveStacktraces) { + mTrace = Arrays.toString(Thread.currentThread().getStackTrace()); +@@ -61,15 +61,12 @@ public abstract class NativeProxy implements AutoCloseable + if( ! (obj instanceof NativeProxy) ) { + return false; + } +- if( ((NativeProxy)obj).mPointer.length != mPointer.length) { ++ if (((NativeProxy)obj).mPointer == null) { ++ /* If mPointer is null, we have no way to compare the values ++ * of the pointers, so assume they're unequal. */ + return false; + } +- for(int i=0; i < mPointer.length; i++) { +- if(mPointer[i] != ((NativeProxy)obj).mPointer[i]) { +- return false; +- } +- } +- return true; ++ return Arrays.equals(((NativeProxy)obj).mPointer, mPointer); + } + + /** +-- +2.21.0 + diff --git a/0001-Fix-base64-encoding-of-CSRs.patch b/0001-Fix-base64-encoding-of-CSRs.patch deleted file mode 100644 index f898ed1..0000000 --- a/0001-Fix-base64-encoding-of-CSRs.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 18efce236af6a1affebb274838318ba715114218 Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Tue, 25 Feb 2020 09:14:47 -0500 -Subject: [PATCH 3/8] Fix base64-encoding of CSRs - -In 8de4440c5652f6f1af5b4b923a15730ba84f29e1, the base64 encoder was -changed from apache-commons-codec to the Java standard library to drop -a dependency. However, the behavior changed as a result: the Java -standard library doesn't include a final line separator, whereas -apache-commons-codec did. This results in malformed CSRs: - -> YWRPxyBKvFAOB29fwPwBJLZksrwQ0xAs7sooc+qF-----END NEW CERTIFICATE REQUEST----- - -Resolves: https://pagure.io/freeipa/issue/8199 - -Signed-off-by: Alexander Scheel ---- - org/mozilla/jss/netscape/security/util/Utils.java | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/org/mozilla/jss/netscape/security/util/Utils.java b/org/mozilla/jss/netscape/security/util/Utils.java -index 19f3b1f9..e6e56ce4 100644 ---- a/org/mozilla/jss/netscape/security/util/Utils.java -+++ b/org/mozilla/jss/netscape/security/util/Utils.java -@@ -378,7 +378,10 @@ public class Utils { - * @return base-64 encoded data - */ - public static String base64encodeMultiLine(byte[] bytes) { -- return Base64.getMimeEncoder().encodeToString(bytes); -+ // When switching from apache-commons-codec to the standard library, -+ // the standard library does not include a final line separator at -+ // the end of the encoded data. This results in malformed CSRs. -+ return Base64.getMimeEncoder().encodeToString(bytes) + "\r\n"; - } - - --- -2.24.1 - diff --git a/0002-Fix-swapped-parameter-names-with-PBE.patch b/0002-Fix-swapped-parameter-names-with-PBE.patch deleted file mode 100644 index c535f6e..0000000 --- a/0002-Fix-swapped-parameter-names-with-PBE.patch +++ /dev/null @@ -1,80 +0,0 @@ -From 9f29430656342829822568f4ef49f5237b41164b Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Fri, 28 Feb 2020 14:10:32 -0500 -Subject: [PATCH 7/8] Fix swapped parameter names with PBE - -Commit 13998a9e77e60d6509ac814ed711dd21e1248ecd introduced a regression -related to extracting the parameter classes during PBE operations: -previously, the classes of the underlying encryption algorithm were -iterated over, instead of the classes of the PBE class itself. However, -this commit iterated over the PBE parameter classes; no PBE algorithm -accepts a IvParameterSpec, resulting in a null parameter passed to the -later encryption or key wrap operation. This resulted in stack traces -like the following: - -Caused by: java.security.InvalidAlgorithmParameterException: DES3/CBC/Pad cannot use a null parameter - at org.mozilla.jss.pkcs11.PK11KeyWrapper.checkParams(PK11KeyWrapper.java:225) - at org.mozilla.jss.pkcs11.PK11KeyWrapper.initWrap(PK11KeyWrapper.java:89) - at org.mozilla.jss.pkcs11.PK11KeyWrapper.initWrap(PK11KeyWrapper.java:57) - at org.mozilla.jss.pkix.primitive.EncryptedPrivateKeyInfo.createPBE(EncryptedPrivateKeyInfo.java:342) - -Resolves: rh-bz#1807371 - -Signed-off-by: Alexander Scheel ---- - org/mozilla/jss/pkcs7/EncryptedContentInfo.java | 2 +- - org/mozilla/jss/pkix/cms/EncryptedContentInfo.java | 2 +- - org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++-- - 3 files changed, 4 insertions(+), 4 deletions(-) - -diff --git a/org/mozilla/jss/pkcs7/EncryptedContentInfo.java b/org/mozilla/jss/pkcs7/EncryptedContentInfo.java -index 084752c3..0344b14d 100644 ---- a/org/mozilla/jss/pkcs7/EncryptedContentInfo.java -+++ b/org/mozilla/jss/pkcs7/EncryptedContentInfo.java -@@ -182,7 +182,7 @@ public class EncryptedContentInfo implements ASN1Value { - // generate IV - EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); - AlgorithmParameterSpec params=null; -- Class [] paramClasses = pbeAlg.getParameterClasses(); -+ Class [] paramClasses = encAlg.getParameterClasses(); - for (int i = 0; i < paramClasses.length; i ++) { - if ( paramClasses[i].equals( - javax.crypto.spec.IvParameterSpec.class ) ) { -diff --git a/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java b/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java -index a4709070..d85eb0d3 100644 ---- a/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java -+++ b/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java -@@ -180,7 +180,7 @@ public class EncryptedContentInfo implements ASN1Value { - // generate IV - EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); - AlgorithmParameterSpec params=null; -- Class [] paramClasses = pbeAlg.getParameterClasses(); -+ Class [] paramClasses = encAlg.getParameterClasses(); - for (int i = 0; i < paramClasses.length; i ++) { - if ( paramClasses[i].equals( IVParameterSpec.class ) ) { - params = new IVParameterSpec( kg.generatePBE_IV() ); -diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -index b35714e3..ebd269f3 100644 ---- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -+++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -@@ -147,7 +147,7 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { - // generate IV - EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); - AlgorithmParameterSpec params=null; -- Class [] paramClasses = pbeAlg.getParameterClasses(); -+ Class [] paramClasses = encAlg.getParameterClasses(); - for (int i = 0; i < paramClasses.length; i ++) { - if ( paramClasses[i].equals( javax.crypto.spec.IvParameterSpec.class ) ) { - params = new IVParameterSpec( kg.generatePBE_IV() ); -@@ -328,7 +328,7 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { - // generate IV - EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); - AlgorithmParameterSpec params=null; -- Class [] paramClasses = pbeAlg.getParameterClasses(); -+ Class [] paramClasses = encAlg.getParameterClasses(); - for (int i = 0; i < paramClasses.length; i ++) { - if ( paramClasses[i].equals( - javax.crypto.spec.IvParameterSpec.class ) ) { --- -2.24.1 - diff --git a/0003-Use-specified-algorithm-for-KeyWrap.patch b/0003-Use-specified-algorithm-for-KeyWrap.patch deleted file mode 100644 index d75534a..0000000 --- a/0003-Use-specified-algorithm-for-KeyWrap.patch +++ /dev/null @@ -1,60 +0,0 @@ -From 55482c8bfa0addeb9db7b590703ba3704c5db167 Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Fri, 28 Feb 2020 14:39:29 -0500 -Subject: [PATCH 8/8] Use specified algorithm for KeyWrap - -When the token-specified from of EncryptedPrivateKeyInfo.createPBE is -called, it would always request DES3_CBC_PAD as the key wrapping -algorithm, regardless of the input PBE key type. However, the other form -(with an implicit token) was correctly handling this case. - -Introduces a new KeyWrapAlgorithm method to take an OBJECT_IDENTIFIER -instead of having to convert to/from a String form. - -Signed-off-by: Alexander Scheel ---- - org/mozilla/jss/crypto/KeyWrapAlgorithm.java | 5 ++++- - org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++-- - 2 files changed, 6 insertions(+), 3 deletions(-) - -diff --git a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java -index 3113f614..3a106977 100644 ---- a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java -+++ b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java -@@ -138,7 +138,10 @@ public class KeyWrapAlgorithm extends Algorithm { - - public static KeyWrapAlgorithm fromOID(String wrapOID) throws NoSuchAlgorithmException { - OBJECT_IDENTIFIER oid = new OBJECT_IDENTIFIER(wrapOID); -+ return fromOID(oid); -+ } - -+ public static KeyWrapAlgorithm fromOID(OBJECT_IDENTIFIER oid) throws NoSuchAlgorithmException { - if (oid.equals(AES_KEY_WRAP_PAD_OID)) - return AES_KEY_WRAP_PAD; - -@@ -154,6 +157,6 @@ public class KeyWrapAlgorithm extends Algorithm { - if (oid.equals(DES_CBC_PAD_OID)) - return DES_CBC_PAD; - -- throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + wrapOID); -+ throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + oid); - } - } -diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -index ebd269f3..abfc39a7 100644 ---- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -+++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -@@ -337,8 +337,8 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { - } - } - -- KeyWrapper wrapper = token.getKeyWrapper( -- KeyWrapAlgorithm.DES3_CBC_PAD); -+ // wrap the key -+ KeyWrapper wrapper = token.getKeyWrapper(KeyWrapAlgorithm.fromOID(encAlg.toOID())); - wrapper.initWrap(key, params); - byte encrypted[] = wrapper.wrap(pri); - --- -2.24.1 - diff --git a/0008-Use-specified-algorithm-for-KeyWrap.patch b/0008-Use-specified-algorithm-for-KeyWrap.patch deleted file mode 100644 index d75534a..0000000 --- a/0008-Use-specified-algorithm-for-KeyWrap.patch +++ /dev/null @@ -1,60 +0,0 @@ -From 55482c8bfa0addeb9db7b590703ba3704c5db167 Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Fri, 28 Feb 2020 14:39:29 -0500 -Subject: [PATCH 8/8] Use specified algorithm for KeyWrap - -When the token-specified from of EncryptedPrivateKeyInfo.createPBE is -called, it would always request DES3_CBC_PAD as the key wrapping -algorithm, regardless of the input PBE key type. However, the other form -(with an implicit token) was correctly handling this case. - -Introduces a new KeyWrapAlgorithm method to take an OBJECT_IDENTIFIER -instead of having to convert to/from a String form. - -Signed-off-by: Alexander Scheel ---- - org/mozilla/jss/crypto/KeyWrapAlgorithm.java | 5 ++++- - org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++-- - 2 files changed, 6 insertions(+), 3 deletions(-) - -diff --git a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java -index 3113f614..3a106977 100644 ---- a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java -+++ b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java -@@ -138,7 +138,10 @@ public class KeyWrapAlgorithm extends Algorithm { - - public static KeyWrapAlgorithm fromOID(String wrapOID) throws NoSuchAlgorithmException { - OBJECT_IDENTIFIER oid = new OBJECT_IDENTIFIER(wrapOID); -+ return fromOID(oid); -+ } - -+ public static KeyWrapAlgorithm fromOID(OBJECT_IDENTIFIER oid) throws NoSuchAlgorithmException { - if (oid.equals(AES_KEY_WRAP_PAD_OID)) - return AES_KEY_WRAP_PAD; - -@@ -154,6 +157,6 @@ public class KeyWrapAlgorithm extends Algorithm { - if (oid.equals(DES_CBC_PAD_OID)) - return DES_CBC_PAD; - -- throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + wrapOID); -+ throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + oid); - } - } -diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -index ebd269f3..abfc39a7 100644 ---- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -+++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -@@ -337,8 +337,8 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { - } - } - -- KeyWrapper wrapper = token.getKeyWrapper( -- KeyWrapAlgorithm.DES3_CBC_PAD); -+ // wrap the key -+ KeyWrapper wrapper = token.getKeyWrapper(KeyWrapAlgorithm.fromOID(encAlg.toOID())); - wrapper.initWrap(key, params); - byte encrypted[] = wrapper.wrap(pri); - --- -2.24.1 - diff --git a/jss.spec b/jss.spec index c58e687..536e1db 100644 --- a/jss.spec +++ b/jss.spec @@ -6,8 +6,8 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.6.3 -Release: 1%{?_timestamp}%{?_commit_id}%{?dist} +Version: 4.6.2 +Release: 3%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 # To generate the source tarball: @@ -25,9 +25,7 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch -Patch0: 0001-Fix-base64-encoding-of-CSRs.patch -Patch1: 0002-Fix-swapped-parameter-names-with-PBE.patch -Patch2: 0003-Use-specified-algorithm-for-KeyWrap.patch +Patch: 0001-Fix-NativeProxy-reference-tracker.patch ################################################################################ # Build Dependencies @@ -162,12 +160,6 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog -* Wed Mar 4 2020 Dogtag PKI Team - 4.6.3-1 -- Rebase to JSS 4.6.3 -- Fixes base64 encoding of CSRs -- Fixes swapped parameter names in PBE -- Use specified algorithms for KeyWrap in PBE - * Tue Jan 28 2020 Dogtag PKI Team - 4.6.2-3 - Rebuild with new NSS to fix rhbz#1794814 diff --git a/sources b/sources index c883e35..32f2840 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.6.3.tar.gz) = 6c45b67c40737ee7bbc9ad1db8a5ed233b050697f9c048e1a49cc541de889416afd36b2c9bcdc44a52d10b0c75f036e22155a5ee95869fdf31772683637a27b1 +SHA512 (jss-4.6.2.tar.gz) = 53c12822b980f6dcaf5616366834fe4eaee07d84feae53096aa0ea142146e90d375910456d8192068cde5e63c3b60ded87862af50ea89c6b64224e8c105e00dd From 01ab6695c1867669142609f0eb7e373d9c4d3e4d Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 4 Mar 2020 12:01:29 -0500 Subject: [PATCH 09/77] Add fixes for KRA issues Signed-off-by: Alexander Scheel --- ...Fix-swapped-parameter-names-with-PBE.patch | 80 +++++++++++++++++++ ...-Use-specified-algorithm-for-KeyWrap.patch | 60 ++++++++++++++ jss.spec | 9 ++- 3 files changed, 147 insertions(+), 2 deletions(-) create mode 100644 0002-Fix-swapped-parameter-names-with-PBE.patch create mode 100644 0003-Use-specified-algorithm-for-KeyWrap.patch diff --git a/0002-Fix-swapped-parameter-names-with-PBE.patch b/0002-Fix-swapped-parameter-names-with-PBE.patch new file mode 100644 index 0000000..c535f6e --- /dev/null +++ b/0002-Fix-swapped-parameter-names-with-PBE.patch @@ -0,0 +1,80 @@ +From 9f29430656342829822568f4ef49f5237b41164b Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Fri, 28 Feb 2020 14:10:32 -0500 +Subject: [PATCH 7/8] Fix swapped parameter names with PBE + +Commit 13998a9e77e60d6509ac814ed711dd21e1248ecd introduced a regression +related to extracting the parameter classes during PBE operations: +previously, the classes of the underlying encryption algorithm were +iterated over, instead of the classes of the PBE class itself. However, +this commit iterated over the PBE parameter classes; no PBE algorithm +accepts a IvParameterSpec, resulting in a null parameter passed to the +later encryption or key wrap operation. This resulted in stack traces +like the following: + +Caused by: java.security.InvalidAlgorithmParameterException: DES3/CBC/Pad cannot use a null parameter + at org.mozilla.jss.pkcs11.PK11KeyWrapper.checkParams(PK11KeyWrapper.java:225) + at org.mozilla.jss.pkcs11.PK11KeyWrapper.initWrap(PK11KeyWrapper.java:89) + at org.mozilla.jss.pkcs11.PK11KeyWrapper.initWrap(PK11KeyWrapper.java:57) + at org.mozilla.jss.pkix.primitive.EncryptedPrivateKeyInfo.createPBE(EncryptedPrivateKeyInfo.java:342) + +Resolves: rh-bz#1807371 + +Signed-off-by: Alexander Scheel +--- + org/mozilla/jss/pkcs7/EncryptedContentInfo.java | 2 +- + org/mozilla/jss/pkix/cms/EncryptedContentInfo.java | 2 +- + org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++-- + 3 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/org/mozilla/jss/pkcs7/EncryptedContentInfo.java b/org/mozilla/jss/pkcs7/EncryptedContentInfo.java +index 084752c3..0344b14d 100644 +--- a/org/mozilla/jss/pkcs7/EncryptedContentInfo.java ++++ b/org/mozilla/jss/pkcs7/EncryptedContentInfo.java +@@ -182,7 +182,7 @@ public class EncryptedContentInfo implements ASN1Value { + // generate IV + EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); + AlgorithmParameterSpec params=null; +- Class [] paramClasses = pbeAlg.getParameterClasses(); ++ Class [] paramClasses = encAlg.getParameterClasses(); + for (int i = 0; i < paramClasses.length; i ++) { + if ( paramClasses[i].equals( + javax.crypto.spec.IvParameterSpec.class ) ) { +diff --git a/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java b/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java +index a4709070..d85eb0d3 100644 +--- a/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java ++++ b/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java +@@ -180,7 +180,7 @@ public class EncryptedContentInfo implements ASN1Value { + // generate IV + EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); + AlgorithmParameterSpec params=null; +- Class [] paramClasses = pbeAlg.getParameterClasses(); ++ Class [] paramClasses = encAlg.getParameterClasses(); + for (int i = 0; i < paramClasses.length; i ++) { + if ( paramClasses[i].equals( IVParameterSpec.class ) ) { + params = new IVParameterSpec( kg.generatePBE_IV() ); +diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +index b35714e3..ebd269f3 100644 +--- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java ++++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +@@ -147,7 +147,7 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { + // generate IV + EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); + AlgorithmParameterSpec params=null; +- Class [] paramClasses = pbeAlg.getParameterClasses(); ++ Class [] paramClasses = encAlg.getParameterClasses(); + for (int i = 0; i < paramClasses.length; i ++) { + if ( paramClasses[i].equals( javax.crypto.spec.IvParameterSpec.class ) ) { + params = new IVParameterSpec( kg.generatePBE_IV() ); +@@ -328,7 +328,7 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { + // generate IV + EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); + AlgorithmParameterSpec params=null; +- Class [] paramClasses = pbeAlg.getParameterClasses(); ++ Class [] paramClasses = encAlg.getParameterClasses(); + for (int i = 0; i < paramClasses.length; i ++) { + if ( paramClasses[i].equals( + javax.crypto.spec.IvParameterSpec.class ) ) { +-- +2.24.1 + diff --git a/0003-Use-specified-algorithm-for-KeyWrap.patch b/0003-Use-specified-algorithm-for-KeyWrap.patch new file mode 100644 index 0000000..d75534a --- /dev/null +++ b/0003-Use-specified-algorithm-for-KeyWrap.patch @@ -0,0 +1,60 @@ +From 55482c8bfa0addeb9db7b590703ba3704c5db167 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Fri, 28 Feb 2020 14:39:29 -0500 +Subject: [PATCH 8/8] Use specified algorithm for KeyWrap + +When the token-specified from of EncryptedPrivateKeyInfo.createPBE is +called, it would always request DES3_CBC_PAD as the key wrapping +algorithm, regardless of the input PBE key type. However, the other form +(with an implicit token) was correctly handling this case. + +Introduces a new KeyWrapAlgorithm method to take an OBJECT_IDENTIFIER +instead of having to convert to/from a String form. + +Signed-off-by: Alexander Scheel +--- + org/mozilla/jss/crypto/KeyWrapAlgorithm.java | 5 ++++- + org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++-- + 2 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java +index 3113f614..3a106977 100644 +--- a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java ++++ b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java +@@ -138,7 +138,10 @@ public class KeyWrapAlgorithm extends Algorithm { + + public static KeyWrapAlgorithm fromOID(String wrapOID) throws NoSuchAlgorithmException { + OBJECT_IDENTIFIER oid = new OBJECT_IDENTIFIER(wrapOID); ++ return fromOID(oid); ++ } + ++ public static KeyWrapAlgorithm fromOID(OBJECT_IDENTIFIER oid) throws NoSuchAlgorithmException { + if (oid.equals(AES_KEY_WRAP_PAD_OID)) + return AES_KEY_WRAP_PAD; + +@@ -154,6 +157,6 @@ public class KeyWrapAlgorithm extends Algorithm { + if (oid.equals(DES_CBC_PAD_OID)) + return DES_CBC_PAD; + +- throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + wrapOID); ++ throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + oid); + } + } +diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +index ebd269f3..abfc39a7 100644 +--- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java ++++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +@@ -337,8 +337,8 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { + } + } + +- KeyWrapper wrapper = token.getKeyWrapper( +- KeyWrapAlgorithm.DES3_CBC_PAD); ++ // wrap the key ++ KeyWrapper wrapper = token.getKeyWrapper(KeyWrapAlgorithm.fromOID(encAlg.toOID())); + wrapper.initWrap(key, params); + byte encrypted[] = wrapper.wrap(pri); + +-- +2.24.1 + diff --git a/jss.spec b/jss.spec index 536e1db..da423a5 100644 --- a/jss.spec +++ b/jss.spec @@ -7,7 +7,7 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.6.2 -Release: 3%{?_timestamp}%{?_commit_id}%{?dist} +Release: 4%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 # To generate the source tarball: @@ -25,7 +25,9 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch -Patch: 0001-Fix-NativeProxy-reference-tracker.patch +Patch0: 0001-Fix-NativeProxy-reference-tracker.patch +Patch1: 0002-Fix-swapped-parameter-names-with-PBE.patch +Patch2: 0003-Use-specified-algorithm-for-KeyWrap.patch ################################################################################ # Build Dependencies @@ -160,6 +162,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Wed Mar 04 2020 Dogtag PKI Team - 4.6.2-4 +- Fix for PBE errors + * Tue Jan 28 2020 Dogtag PKI Team - 4.6.2-3 - Rebuild with new NSS to fix rhbz#1794814 From ad19be35d3b948054d9787061ae0e3f3dbc297c5 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 4 Mar 2020 12:01:29 -0500 Subject: [PATCH 10/77] Add fixes for KRA issues Signed-off-by: Alexander Scheel --- ...Fix-swapped-parameter-names-with-PBE.patch | 80 +++++++++++++++++++ ...-Use-specified-algorithm-for-KeyWrap.patch | 60 ++++++++++++++ jss.spec | 9 ++- 3 files changed, 147 insertions(+), 2 deletions(-) create mode 100644 0002-Fix-swapped-parameter-names-with-PBE.patch create mode 100644 0003-Use-specified-algorithm-for-KeyWrap.patch diff --git a/0002-Fix-swapped-parameter-names-with-PBE.patch b/0002-Fix-swapped-parameter-names-with-PBE.patch new file mode 100644 index 0000000..c535f6e --- /dev/null +++ b/0002-Fix-swapped-parameter-names-with-PBE.patch @@ -0,0 +1,80 @@ +From 9f29430656342829822568f4ef49f5237b41164b Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Fri, 28 Feb 2020 14:10:32 -0500 +Subject: [PATCH 7/8] Fix swapped parameter names with PBE + +Commit 13998a9e77e60d6509ac814ed711dd21e1248ecd introduced a regression +related to extracting the parameter classes during PBE operations: +previously, the classes of the underlying encryption algorithm were +iterated over, instead of the classes of the PBE class itself. However, +this commit iterated over the PBE parameter classes; no PBE algorithm +accepts a IvParameterSpec, resulting in a null parameter passed to the +later encryption or key wrap operation. This resulted in stack traces +like the following: + +Caused by: java.security.InvalidAlgorithmParameterException: DES3/CBC/Pad cannot use a null parameter + at org.mozilla.jss.pkcs11.PK11KeyWrapper.checkParams(PK11KeyWrapper.java:225) + at org.mozilla.jss.pkcs11.PK11KeyWrapper.initWrap(PK11KeyWrapper.java:89) + at org.mozilla.jss.pkcs11.PK11KeyWrapper.initWrap(PK11KeyWrapper.java:57) + at org.mozilla.jss.pkix.primitive.EncryptedPrivateKeyInfo.createPBE(EncryptedPrivateKeyInfo.java:342) + +Resolves: rh-bz#1807371 + +Signed-off-by: Alexander Scheel +--- + org/mozilla/jss/pkcs7/EncryptedContentInfo.java | 2 +- + org/mozilla/jss/pkix/cms/EncryptedContentInfo.java | 2 +- + org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++-- + 3 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/org/mozilla/jss/pkcs7/EncryptedContentInfo.java b/org/mozilla/jss/pkcs7/EncryptedContentInfo.java +index 084752c3..0344b14d 100644 +--- a/org/mozilla/jss/pkcs7/EncryptedContentInfo.java ++++ b/org/mozilla/jss/pkcs7/EncryptedContentInfo.java +@@ -182,7 +182,7 @@ public class EncryptedContentInfo implements ASN1Value { + // generate IV + EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); + AlgorithmParameterSpec params=null; +- Class [] paramClasses = pbeAlg.getParameterClasses(); ++ Class [] paramClasses = encAlg.getParameterClasses(); + for (int i = 0; i < paramClasses.length; i ++) { + if ( paramClasses[i].equals( + javax.crypto.spec.IvParameterSpec.class ) ) { +diff --git a/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java b/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java +index a4709070..d85eb0d3 100644 +--- a/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java ++++ b/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java +@@ -180,7 +180,7 @@ public class EncryptedContentInfo implements ASN1Value { + // generate IV + EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); + AlgorithmParameterSpec params=null; +- Class [] paramClasses = pbeAlg.getParameterClasses(); ++ Class [] paramClasses = encAlg.getParameterClasses(); + for (int i = 0; i < paramClasses.length; i ++) { + if ( paramClasses[i].equals( IVParameterSpec.class ) ) { + params = new IVParameterSpec( kg.generatePBE_IV() ); +diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +index b35714e3..ebd269f3 100644 +--- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java ++++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +@@ -147,7 +147,7 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { + // generate IV + EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); + AlgorithmParameterSpec params=null; +- Class [] paramClasses = pbeAlg.getParameterClasses(); ++ Class [] paramClasses = encAlg.getParameterClasses(); + for (int i = 0; i < paramClasses.length; i ++) { + if ( paramClasses[i].equals( javax.crypto.spec.IvParameterSpec.class ) ) { + params = new IVParameterSpec( kg.generatePBE_IV() ); +@@ -328,7 +328,7 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { + // generate IV + EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); + AlgorithmParameterSpec params=null; +- Class [] paramClasses = pbeAlg.getParameterClasses(); ++ Class [] paramClasses = encAlg.getParameterClasses(); + for (int i = 0; i < paramClasses.length; i ++) { + if ( paramClasses[i].equals( + javax.crypto.spec.IvParameterSpec.class ) ) { +-- +2.24.1 + diff --git a/0003-Use-specified-algorithm-for-KeyWrap.patch b/0003-Use-specified-algorithm-for-KeyWrap.patch new file mode 100644 index 0000000..d75534a --- /dev/null +++ b/0003-Use-specified-algorithm-for-KeyWrap.patch @@ -0,0 +1,60 @@ +From 55482c8bfa0addeb9db7b590703ba3704c5db167 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Fri, 28 Feb 2020 14:39:29 -0500 +Subject: [PATCH 8/8] Use specified algorithm for KeyWrap + +When the token-specified from of EncryptedPrivateKeyInfo.createPBE is +called, it would always request DES3_CBC_PAD as the key wrapping +algorithm, regardless of the input PBE key type. However, the other form +(with an implicit token) was correctly handling this case. + +Introduces a new KeyWrapAlgorithm method to take an OBJECT_IDENTIFIER +instead of having to convert to/from a String form. + +Signed-off-by: Alexander Scheel +--- + org/mozilla/jss/crypto/KeyWrapAlgorithm.java | 5 ++++- + org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++-- + 2 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java +index 3113f614..3a106977 100644 +--- a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java ++++ b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java +@@ -138,7 +138,10 @@ public class KeyWrapAlgorithm extends Algorithm { + + public static KeyWrapAlgorithm fromOID(String wrapOID) throws NoSuchAlgorithmException { + OBJECT_IDENTIFIER oid = new OBJECT_IDENTIFIER(wrapOID); ++ return fromOID(oid); ++ } + ++ public static KeyWrapAlgorithm fromOID(OBJECT_IDENTIFIER oid) throws NoSuchAlgorithmException { + if (oid.equals(AES_KEY_WRAP_PAD_OID)) + return AES_KEY_WRAP_PAD; + +@@ -154,6 +157,6 @@ public class KeyWrapAlgorithm extends Algorithm { + if (oid.equals(DES_CBC_PAD_OID)) + return DES_CBC_PAD; + +- throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + wrapOID); ++ throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + oid); + } + } +diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +index ebd269f3..abfc39a7 100644 +--- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java ++++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +@@ -337,8 +337,8 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { + } + } + +- KeyWrapper wrapper = token.getKeyWrapper( +- KeyWrapAlgorithm.DES3_CBC_PAD); ++ // wrap the key ++ KeyWrapper wrapper = token.getKeyWrapper(KeyWrapAlgorithm.fromOID(encAlg.toOID())); + wrapper.initWrap(key, params); + byte encrypted[] = wrapper.wrap(pri); + +-- +2.24.1 + diff --git a/jss.spec b/jss.spec index 0c333df..f6974c7 100644 --- a/jss.spec +++ b/jss.spec @@ -7,7 +7,7 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.6.2 -Release: 3%{?_timestamp}%{?_commit_id}%{?dist} +Release: 4%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 # To generate the source tarball: @@ -25,7 +25,9 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch -Patch: 0001-Fix-NativeProxy-reference-tracker.patch +Patch0: 0001-Fix-NativeProxy-reference-tracker.patch +Patch1: 0002-Fix-swapped-parameter-names-with-PBE.patch +Patch2: 0003-Use-specified-algorithm-for-KeyWrap.patch ################################################################################ # Build Dependencies @@ -160,6 +162,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Wed Mar 04 2020 Dogtag PKI Team - 4.6.2-4 +- Fix for PBE errors + * Tue Jan 28 2020 Dogtag PKI Team - 4.6.2-3 - Rebuild with new NSS to fix rhbz#1794814 From 53c7b90df429ae7050bab67118bf53dbfc00b016 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Thu, 5 Mar 2020 09:32:14 -0500 Subject: [PATCH 11/77] Revert "Revert "Rebase to JSS v4.6.3"" This reverts commit 3cc21a363a90b1c9ca16982b95e4295a5b6a7d70. --- .gitignore | 1 + 0001-Fix-NativeProxy-reference-tracker.patch | 53 -------------------- 0001-Fix-base64-encoding-of-CSRs.patch | 39 ++++++++++++++ jss.spec | 10 ++-- sources | 2 +- 5 files changed, 48 insertions(+), 57 deletions(-) delete mode 100644 0001-Fix-NativeProxy-reference-tracker.patch create mode 100644 0001-Fix-base64-encoding-of-CSRs.patch diff --git a/.gitignore b/.gitignore index 5981ea6..77527dc 100644 --- a/.gitignore +++ b/.gitignore @@ -23,3 +23,4 @@ jss-4.2.6.tar.gz /jss-4.5.3.tar.gz /jss-4.6.1.tar.gz /jss-4.6.2.tar.gz +/jss-4.6.3.tar.gz diff --git a/0001-Fix-NativeProxy-reference-tracker.patch b/0001-Fix-NativeProxy-reference-tracker.patch deleted file mode 100644 index 529b576..0000000 --- a/0001-Fix-NativeProxy-reference-tracker.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 91514ca0a2979ba778d27220ced0cd312e2cd2d2 Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Tue, 29 Oct 2019 10:43:56 -0400 -Subject: [PATCH] Fix NativeProxy reference tracker - -In eb5df01003d74b57473eacb84e538d31f5bb06ca, I introduced a bug by -setting mPointer after trying to add NativeProxy to the registry. In -most instances this won't matter, however, if another instance exists in -the HashSet with the same hash value, the equals comparator will be -used, triggering a NPE. - -Signed-off-by: Alexander Scheel ---- - org/mozilla/jss/util/NativeProxy.java | 13 +++++-------- - 1 file changed, 5 insertions(+), 8 deletions(-) - -diff --git a/org/mozilla/jss/util/NativeProxy.java b/org/mozilla/jss/util/NativeProxy.java -index 1c6d1aa5..a0811f76 100644 ---- a/org/mozilla/jss/util/NativeProxy.java -+++ b/org/mozilla/jss/util/NativeProxy.java -@@ -40,8 +40,8 @@ public abstract class NativeProxy implements AutoCloseable - */ - public NativeProxy(byte[] pointer) { - assert(pointer!=null); -- registry.add(this); - mPointer = pointer; -+ registry.add(this); - - if (saveStacktraces) { - mTrace = Arrays.toString(Thread.currentThread().getStackTrace()); -@@ -61,15 +61,12 @@ public abstract class NativeProxy implements AutoCloseable - if( ! (obj instanceof NativeProxy) ) { - return false; - } -- if( ((NativeProxy)obj).mPointer.length != mPointer.length) { -+ if (((NativeProxy)obj).mPointer == null) { -+ /* If mPointer is null, we have no way to compare the values -+ * of the pointers, so assume they're unequal. */ - return false; - } -- for(int i=0; i < mPointer.length; i++) { -- if(mPointer[i] != ((NativeProxy)obj).mPointer[i]) { -- return false; -- } -- } -- return true; -+ return Arrays.equals(((NativeProxy)obj).mPointer, mPointer); - } - - /** --- -2.21.0 - diff --git a/0001-Fix-base64-encoding-of-CSRs.patch b/0001-Fix-base64-encoding-of-CSRs.patch new file mode 100644 index 0000000..f898ed1 --- /dev/null +++ b/0001-Fix-base64-encoding-of-CSRs.patch @@ -0,0 +1,39 @@ +From 18efce236af6a1affebb274838318ba715114218 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Tue, 25 Feb 2020 09:14:47 -0500 +Subject: [PATCH 3/8] Fix base64-encoding of CSRs + +In 8de4440c5652f6f1af5b4b923a15730ba84f29e1, the base64 encoder was +changed from apache-commons-codec to the Java standard library to drop +a dependency. However, the behavior changed as a result: the Java +standard library doesn't include a final line separator, whereas +apache-commons-codec did. This results in malformed CSRs: + +> YWRPxyBKvFAOB29fwPwBJLZksrwQ0xAs7sooc+qF-----END NEW CERTIFICATE REQUEST----- + +Resolves: https://pagure.io/freeipa/issue/8199 + +Signed-off-by: Alexander Scheel +--- + org/mozilla/jss/netscape/security/util/Utils.java | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/org/mozilla/jss/netscape/security/util/Utils.java b/org/mozilla/jss/netscape/security/util/Utils.java +index 19f3b1f9..e6e56ce4 100644 +--- a/org/mozilla/jss/netscape/security/util/Utils.java ++++ b/org/mozilla/jss/netscape/security/util/Utils.java +@@ -378,7 +378,10 @@ public class Utils { + * @return base-64 encoded data + */ + public static String base64encodeMultiLine(byte[] bytes) { +- return Base64.getMimeEncoder().encodeToString(bytes); ++ // When switching from apache-commons-codec to the standard library, ++ // the standard library does not include a final line separator at ++ // the end of the encoded data. This results in malformed CSRs. ++ return Base64.getMimeEncoder().encodeToString(bytes) + "\r\n"; + } + + +-- +2.24.1 + diff --git a/jss.spec b/jss.spec index da423a5..2610821 100644 --- a/jss.spec +++ b/jss.spec @@ -6,8 +6,8 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.6.2 -Release: 4%{?_timestamp}%{?_commit_id}%{?dist} +Version: 4.6.3 +Release: 1%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 # To generate the source tarball: @@ -25,7 +25,7 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch -Patch0: 0001-Fix-NativeProxy-reference-tracker.patch +Patch0: 0001-Fix-base64-encoding-of-CSRs.patch Patch1: 0002-Fix-swapped-parameter-names-with-PBE.patch Patch2: 0003-Use-specified-algorithm-for-KeyWrap.patch @@ -162,6 +162,10 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Thu Mar 5 2020 Dogtag PKI Team - 4.6.3-1 +- Rebase to JSS 4.6.3 +- Fixes base64 encoding of CSRs + * Wed Mar 04 2020 Dogtag PKI Team - 4.6.2-4 - Fix for PBE errors diff --git a/sources b/sources index 32f2840..c883e35 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.6.2.tar.gz) = 53c12822b980f6dcaf5616366834fe4eaee07d84feae53096aa0ea142146e90d375910456d8192068cde5e63c3b60ded87862af50ea89c6b64224e8c105e00dd +SHA512 (jss-4.6.3.tar.gz) = 6c45b67c40737ee7bbc9ad1db8a5ed233b050697f9c048e1a49cc541de889416afd36b2c9bcdc44a52d10b0c75f036e22155a5ee95869fdf31772683637a27b1 From c7f3ad477fa72a99b17c405aa4f48bedaee4686c Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Mon, 27 Apr 2020 11:14:28 -0400 Subject: [PATCH 12/77] Rebase to upstream JSS v4.6.4 Signed-off-by: Alexander Scheel --- .gitignore | 1 + jss.spec | 9 +++++---- sources | 2 +- 3 files changed, 7 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 77527dc..6c8702e 100644 --- a/.gitignore +++ b/.gitignore @@ -24,3 +24,4 @@ jss-4.2.6.tar.gz /jss-4.6.1.tar.gz /jss-4.6.2.tar.gz /jss-4.6.3.tar.gz +/jss-4.6.4.tar.gz diff --git a/jss.spec b/jss.spec index 2610821..0920b44 100644 --- a/jss.spec +++ b/jss.spec @@ -6,7 +6,7 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.6.3 +Version: 4.6.4 Release: 1%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 @@ -25,9 +25,6 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch -Patch0: 0001-Fix-base64-encoding-of-CSRs.patch -Patch1: 0002-Fix-swapped-parameter-names-with-PBE.patch -Patch2: 0003-Use-specified-algorithm-for-KeyWrap.patch ################################################################################ # Build Dependencies @@ -162,6 +159,10 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Mon Apr 27 2020 Dogtag PKI Team - 4.6.4-1 +- Rebase to JSS 4.6.4 +- Fixes memory leak present since v4.6.2 + * Thu Mar 5 2020 Dogtag PKI Team - 4.6.3-1 - Rebase to JSS 4.6.3 - Fixes base64 encoding of CSRs diff --git a/sources b/sources index c883e35..25b6a59 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.6.3.tar.gz) = 6c45b67c40737ee7bbc9ad1db8a5ed233b050697f9c048e1a49cc541de889416afd36b2c9bcdc44a52d10b0c75f036e22155a5ee95869fdf31772683637a27b1 +SHA512 (jss-4.6.4.tar.gz) = c0adc950e1ce5e0f3d846dcb158d831575be84176ded3eec7ce3569cfd96c872a2089a2eede249c5924e1eee58d88574accd3403623910343130cf90b504b348 From acbeca61d35277c75c8f99aee3d04a17c7076f0a Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Mon, 27 Apr 2020 11:18:32 -0400 Subject: [PATCH 13/77] Rebase to upstream JSS v4.6.4 Signed-off-by: Alexander Scheel --- .gitignore | 2 ++ jss.spec | 13 +++++++------ sources | 2 +- 3 files changed, 10 insertions(+), 7 deletions(-) diff --git a/.gitignore b/.gitignore index 5981ea6..6c8702e 100644 --- a/.gitignore +++ b/.gitignore @@ -23,3 +23,5 @@ jss-4.2.6.tar.gz /jss-4.5.3.tar.gz /jss-4.6.1.tar.gz /jss-4.6.2.tar.gz +/jss-4.6.3.tar.gz +/jss-4.6.4.tar.gz diff --git a/jss.spec b/jss.spec index f6974c7..f2b6c0d 100644 --- a/jss.spec +++ b/jss.spec @@ -6,8 +6,8 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.6.2 -Release: 4%{?_timestamp}%{?_commit_id}%{?dist} +Version: 4.6.4 +Release: 1%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 # To generate the source tarball: @@ -25,9 +25,6 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch -Patch0: 0001-Fix-NativeProxy-reference-tracker.patch -Patch1: 0002-Fix-swapped-parameter-names-with-PBE.patch -Patch2: 0003-Use-specified-algorithm-for-KeyWrap.patch ################################################################################ # Build Dependencies @@ -162,7 +159,11 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog -* Wed Mar 04 2020 Dogtag PKI Team - 4.6.2-4 +* Mon Apr 27 2020 Dogtag PKI Team - 4.6.4-1 +- Rebase to JSS 4.6.4 +- Fixes memory leak present since v4.6.2 + +* Wed March 04 2020 Dogtag PKI Team - 4.6.2-4 - Fix for PBE errors * Tue Jan 28 2020 Dogtag PKI Team - 4.6.2-3 diff --git a/sources b/sources index 32f2840..25b6a59 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.6.2.tar.gz) = 53c12822b980f6dcaf5616366834fe4eaee07d84feae53096aa0ea142146e90d375910456d8192068cde5e63c3b60ded87862af50ea89c6b64224e8c105e00dd +SHA512 (jss-4.6.4.tar.gz) = c0adc950e1ce5e0f3d846dcb158d831575be84176ded3eec7ce3569cfd96c872a2089a2eede249c5924e1eee58d88574accd3403623910343130cf90b504b348 From 03671f7edfa8387c21b348de21f7cd07346e17f8 Mon Sep 17 00:00:00 2001 From: Dinesh Prasanth M K Date: Wed, 10 Jun 2020 15:40:00 -0400 Subject: [PATCH 14/77] Rebase to latest upstream version 4.7.0-b2 Also, remove unused patch files Signed-off-by: Dinesh Prasanth M K --- .gitignore | 1 + 0001-Fix-base64-encoding-of-CSRs.patch | 39 --------- ...Fix-swapped-parameter-names-with-PBE.patch | 80 ------------------- ...-Use-specified-algorithm-for-KeyWrap.patch | 60 -------------- jss.spec | 25 +++--- sources | 2 +- 6 files changed, 17 insertions(+), 190 deletions(-) delete mode 100644 0001-Fix-base64-encoding-of-CSRs.patch delete mode 100644 0002-Fix-swapped-parameter-names-with-PBE.patch delete mode 100644 0003-Use-specified-algorithm-for-KeyWrap.patch diff --git a/.gitignore b/.gitignore index 6c8702e..de898e2 100644 --- a/.gitignore +++ b/.gitignore @@ -25,3 +25,4 @@ jss-4.2.6.tar.gz /jss-4.6.2.tar.gz /jss-4.6.3.tar.gz /jss-4.6.4.tar.gz +/jss-4.7.0-b2.tar.gz diff --git a/0001-Fix-base64-encoding-of-CSRs.patch b/0001-Fix-base64-encoding-of-CSRs.patch deleted file mode 100644 index f898ed1..0000000 --- a/0001-Fix-base64-encoding-of-CSRs.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 18efce236af6a1affebb274838318ba715114218 Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Tue, 25 Feb 2020 09:14:47 -0500 -Subject: [PATCH 3/8] Fix base64-encoding of CSRs - -In 8de4440c5652f6f1af5b4b923a15730ba84f29e1, the base64 encoder was -changed from apache-commons-codec to the Java standard library to drop -a dependency. However, the behavior changed as a result: the Java -standard library doesn't include a final line separator, whereas -apache-commons-codec did. This results in malformed CSRs: - -> YWRPxyBKvFAOB29fwPwBJLZksrwQ0xAs7sooc+qF-----END NEW CERTIFICATE REQUEST----- - -Resolves: https://pagure.io/freeipa/issue/8199 - -Signed-off-by: Alexander Scheel ---- - org/mozilla/jss/netscape/security/util/Utils.java | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/org/mozilla/jss/netscape/security/util/Utils.java b/org/mozilla/jss/netscape/security/util/Utils.java -index 19f3b1f9..e6e56ce4 100644 ---- a/org/mozilla/jss/netscape/security/util/Utils.java -+++ b/org/mozilla/jss/netscape/security/util/Utils.java -@@ -378,7 +378,10 @@ public class Utils { - * @return base-64 encoded data - */ - public static String base64encodeMultiLine(byte[] bytes) { -- return Base64.getMimeEncoder().encodeToString(bytes); -+ // When switching from apache-commons-codec to the standard library, -+ // the standard library does not include a final line separator at -+ // the end of the encoded data. This results in malformed CSRs. -+ return Base64.getMimeEncoder().encodeToString(bytes) + "\r\n"; - } - - --- -2.24.1 - diff --git a/0002-Fix-swapped-parameter-names-with-PBE.patch b/0002-Fix-swapped-parameter-names-with-PBE.patch deleted file mode 100644 index c535f6e..0000000 --- a/0002-Fix-swapped-parameter-names-with-PBE.patch +++ /dev/null @@ -1,80 +0,0 @@ -From 9f29430656342829822568f4ef49f5237b41164b Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Fri, 28 Feb 2020 14:10:32 -0500 -Subject: [PATCH 7/8] Fix swapped parameter names with PBE - -Commit 13998a9e77e60d6509ac814ed711dd21e1248ecd introduced a regression -related to extracting the parameter classes during PBE operations: -previously, the classes of the underlying encryption algorithm were -iterated over, instead of the classes of the PBE class itself. However, -this commit iterated over the PBE parameter classes; no PBE algorithm -accepts a IvParameterSpec, resulting in a null parameter passed to the -later encryption or key wrap operation. This resulted in stack traces -like the following: - -Caused by: java.security.InvalidAlgorithmParameterException: DES3/CBC/Pad cannot use a null parameter - at org.mozilla.jss.pkcs11.PK11KeyWrapper.checkParams(PK11KeyWrapper.java:225) - at org.mozilla.jss.pkcs11.PK11KeyWrapper.initWrap(PK11KeyWrapper.java:89) - at org.mozilla.jss.pkcs11.PK11KeyWrapper.initWrap(PK11KeyWrapper.java:57) - at org.mozilla.jss.pkix.primitive.EncryptedPrivateKeyInfo.createPBE(EncryptedPrivateKeyInfo.java:342) - -Resolves: rh-bz#1807371 - -Signed-off-by: Alexander Scheel ---- - org/mozilla/jss/pkcs7/EncryptedContentInfo.java | 2 +- - org/mozilla/jss/pkix/cms/EncryptedContentInfo.java | 2 +- - org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++-- - 3 files changed, 4 insertions(+), 4 deletions(-) - -diff --git a/org/mozilla/jss/pkcs7/EncryptedContentInfo.java b/org/mozilla/jss/pkcs7/EncryptedContentInfo.java -index 084752c3..0344b14d 100644 ---- a/org/mozilla/jss/pkcs7/EncryptedContentInfo.java -+++ b/org/mozilla/jss/pkcs7/EncryptedContentInfo.java -@@ -182,7 +182,7 @@ public class EncryptedContentInfo implements ASN1Value { - // generate IV - EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); - AlgorithmParameterSpec params=null; -- Class [] paramClasses = pbeAlg.getParameterClasses(); -+ Class [] paramClasses = encAlg.getParameterClasses(); - for (int i = 0; i < paramClasses.length; i ++) { - if ( paramClasses[i].equals( - javax.crypto.spec.IvParameterSpec.class ) ) { -diff --git a/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java b/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java -index a4709070..d85eb0d3 100644 ---- a/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java -+++ b/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java -@@ -180,7 +180,7 @@ public class EncryptedContentInfo implements ASN1Value { - // generate IV - EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); - AlgorithmParameterSpec params=null; -- Class [] paramClasses = pbeAlg.getParameterClasses(); -+ Class [] paramClasses = encAlg.getParameterClasses(); - for (int i = 0; i < paramClasses.length; i ++) { - if ( paramClasses[i].equals( IVParameterSpec.class ) ) { - params = new IVParameterSpec( kg.generatePBE_IV() ); -diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -index b35714e3..ebd269f3 100644 ---- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -+++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -@@ -147,7 +147,7 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { - // generate IV - EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); - AlgorithmParameterSpec params=null; -- Class [] paramClasses = pbeAlg.getParameterClasses(); -+ Class [] paramClasses = encAlg.getParameterClasses(); - for (int i = 0; i < paramClasses.length; i ++) { - if ( paramClasses[i].equals( javax.crypto.spec.IvParameterSpec.class ) ) { - params = new IVParameterSpec( kg.generatePBE_IV() ); -@@ -328,7 +328,7 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { - // generate IV - EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); - AlgorithmParameterSpec params=null; -- Class [] paramClasses = pbeAlg.getParameterClasses(); -+ Class [] paramClasses = encAlg.getParameterClasses(); - for (int i = 0; i < paramClasses.length; i ++) { - if ( paramClasses[i].equals( - javax.crypto.spec.IvParameterSpec.class ) ) { --- -2.24.1 - diff --git a/0003-Use-specified-algorithm-for-KeyWrap.patch b/0003-Use-specified-algorithm-for-KeyWrap.patch deleted file mode 100644 index d75534a..0000000 --- a/0003-Use-specified-algorithm-for-KeyWrap.patch +++ /dev/null @@ -1,60 +0,0 @@ -From 55482c8bfa0addeb9db7b590703ba3704c5db167 Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Fri, 28 Feb 2020 14:39:29 -0500 -Subject: [PATCH 8/8] Use specified algorithm for KeyWrap - -When the token-specified from of EncryptedPrivateKeyInfo.createPBE is -called, it would always request DES3_CBC_PAD as the key wrapping -algorithm, regardless of the input PBE key type. However, the other form -(with an implicit token) was correctly handling this case. - -Introduces a new KeyWrapAlgorithm method to take an OBJECT_IDENTIFIER -instead of having to convert to/from a String form. - -Signed-off-by: Alexander Scheel ---- - org/mozilla/jss/crypto/KeyWrapAlgorithm.java | 5 ++++- - org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++-- - 2 files changed, 6 insertions(+), 3 deletions(-) - -diff --git a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java -index 3113f614..3a106977 100644 ---- a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java -+++ b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java -@@ -138,7 +138,10 @@ public class KeyWrapAlgorithm extends Algorithm { - - public static KeyWrapAlgorithm fromOID(String wrapOID) throws NoSuchAlgorithmException { - OBJECT_IDENTIFIER oid = new OBJECT_IDENTIFIER(wrapOID); -+ return fromOID(oid); -+ } - -+ public static KeyWrapAlgorithm fromOID(OBJECT_IDENTIFIER oid) throws NoSuchAlgorithmException { - if (oid.equals(AES_KEY_WRAP_PAD_OID)) - return AES_KEY_WRAP_PAD; - -@@ -154,6 +157,6 @@ public class KeyWrapAlgorithm extends Algorithm { - if (oid.equals(DES_CBC_PAD_OID)) - return DES_CBC_PAD; - -- throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + wrapOID); -+ throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + oid); - } - } -diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -index ebd269f3..abfc39a7 100644 ---- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -+++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -@@ -337,8 +337,8 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { - } - } - -- KeyWrapper wrapper = token.getKeyWrapper( -- KeyWrapAlgorithm.DES3_CBC_PAD); -+ // wrap the key -+ KeyWrapper wrapper = token.getKeyWrapper(KeyWrapAlgorithm.fromOID(encAlg.toOID())); - wrapper.initWrap(key, params); - byte encrypted[] = wrapper.wrap(pri); - --- -2.24.1 - diff --git a/jss.spec b/jss.spec index 0920b44..abb49ae 100644 --- a/jss.spec +++ b/jss.spec @@ -6,9 +6,9 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.6.4 -Release: 1%{?_timestamp}%{?_commit_id}%{?dist} -# global _phase -a1 +Version: 4.7.0 +Release: 0.2%{?_timestamp}%{?_commit_id}%{?dist} +%global _phase -b2 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -34,11 +34,13 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas BuildRequires: git BuildRequires: make BuildRequires: cmake +BuildRequires: zip +BuildRequires: unzip BuildRequires: gcc-c++ BuildRequires: nspr-devel >= 4.13.1 -BuildRequires: nss-devel >= 3.30 -BuildRequires: nss-tools >= 3.30 +BuildRequires: nss-devel >= 3.44 +BuildRequires: nss-tools >= 3.44 BuildRequires: java-devel BuildRequires: jpackage-utils BuildRequires: slf4j @@ -49,11 +51,10 @@ BuildRequires: glassfish-jaxb-api BuildRequires: slf4j-jdk14 %endif BuildRequires: apache-commons-lang -BuildRequires: apache-commons-codec BuildRequires: junit -Requires: nss >= 3.30 +Requires: nss >= 3.44 Requires: java-headless Requires: jpackage-utils Requires: slf4j @@ -64,7 +65,6 @@ Requires: glassfish-jaxb-api Requires: slf4j-jdk14 %endif Requires: apache-commons-lang -Requires: apache-commons-codec Conflicts: ldapjdk < 4.20 Conflicts: idm-console-framework < 1.2 @@ -116,7 +116,7 @@ rm -rf build && mkdir -p build && cd build .. %{__make} all -%{__make} javadoc || true +%{__make} javadoc ctest --output-on-failure ################################################################################ @@ -147,7 +147,8 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} %files %defattr(-,root,root,-) -%doc jss.html MPL-1.1.txt gpl.txt lgpl.txt +%doc jss.html +%license MPL-1.1.txt gpl.txt lgpl.txt %{_libdir}/* %{_jnidir}/* @@ -159,6 +160,10 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Wed Jun 10 2020 Dogtag PKI Team - 4.7.0-0.2 +- Rebase to latest upstream JSS 4.7.0 +- JSS Provided SSLEngine + * Mon Apr 27 2020 Dogtag PKI Team - 4.6.4-1 - Rebase to JSS 4.6.4 - Fixes memory leak present since v4.6.2 diff --git a/sources b/sources index 25b6a59..eaf917e 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.6.4.tar.gz) = c0adc950e1ce5e0f3d846dcb158d831575be84176ded3eec7ce3569cfd96c872a2089a2eede249c5924e1eee58d88574accd3403623910343130cf90b504b348 +SHA512 (jss-4.7.0-b2.tar.gz) = 6bd5fd4823ea4b14bfd53dc64796b6fcb7018a6118b943b46be7a5caf874a386802f1e6e0e542743be505d73f2b9625b0f1d479b1292c7364ac62d8cee3e4e52 From 868043d230a3a647f64e48d3a4a2fbf717a1e29c Mon Sep 17 00:00:00 2001 From: Dinesh Prasanth M K Date: Wed, 10 Jun 2020 15:40:00 -0400 Subject: [PATCH 15/77] Rebase to latest upstream version 4.7.0-b2 Also, remove unused patch files Signed-off-by: Dinesh Prasanth M K --- .gitignore | 1 + ...Fix-swapped-parameter-names-with-PBE.patch | 80 ------------------- ...-Use-specified-algorithm-for-KeyWrap.patch | 60 -------------- jss.spec | 25 +++--- sources | 2 +- 5 files changed, 17 insertions(+), 151 deletions(-) delete mode 100644 0002-Fix-swapped-parameter-names-with-PBE.patch delete mode 100644 0003-Use-specified-algorithm-for-KeyWrap.patch diff --git a/.gitignore b/.gitignore index 6c8702e..de898e2 100644 --- a/.gitignore +++ b/.gitignore @@ -25,3 +25,4 @@ jss-4.2.6.tar.gz /jss-4.6.2.tar.gz /jss-4.6.3.tar.gz /jss-4.6.4.tar.gz +/jss-4.7.0-b2.tar.gz diff --git a/0002-Fix-swapped-parameter-names-with-PBE.patch b/0002-Fix-swapped-parameter-names-with-PBE.patch deleted file mode 100644 index c535f6e..0000000 --- a/0002-Fix-swapped-parameter-names-with-PBE.patch +++ /dev/null @@ -1,80 +0,0 @@ -From 9f29430656342829822568f4ef49f5237b41164b Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Fri, 28 Feb 2020 14:10:32 -0500 -Subject: [PATCH 7/8] Fix swapped parameter names with PBE - -Commit 13998a9e77e60d6509ac814ed711dd21e1248ecd introduced a regression -related to extracting the parameter classes during PBE operations: -previously, the classes of the underlying encryption algorithm were -iterated over, instead of the classes of the PBE class itself. However, -this commit iterated over the PBE parameter classes; no PBE algorithm -accepts a IvParameterSpec, resulting in a null parameter passed to the -later encryption or key wrap operation. This resulted in stack traces -like the following: - -Caused by: java.security.InvalidAlgorithmParameterException: DES3/CBC/Pad cannot use a null parameter - at org.mozilla.jss.pkcs11.PK11KeyWrapper.checkParams(PK11KeyWrapper.java:225) - at org.mozilla.jss.pkcs11.PK11KeyWrapper.initWrap(PK11KeyWrapper.java:89) - at org.mozilla.jss.pkcs11.PK11KeyWrapper.initWrap(PK11KeyWrapper.java:57) - at org.mozilla.jss.pkix.primitive.EncryptedPrivateKeyInfo.createPBE(EncryptedPrivateKeyInfo.java:342) - -Resolves: rh-bz#1807371 - -Signed-off-by: Alexander Scheel ---- - org/mozilla/jss/pkcs7/EncryptedContentInfo.java | 2 +- - org/mozilla/jss/pkix/cms/EncryptedContentInfo.java | 2 +- - org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++-- - 3 files changed, 4 insertions(+), 4 deletions(-) - -diff --git a/org/mozilla/jss/pkcs7/EncryptedContentInfo.java b/org/mozilla/jss/pkcs7/EncryptedContentInfo.java -index 084752c3..0344b14d 100644 ---- a/org/mozilla/jss/pkcs7/EncryptedContentInfo.java -+++ b/org/mozilla/jss/pkcs7/EncryptedContentInfo.java -@@ -182,7 +182,7 @@ public class EncryptedContentInfo implements ASN1Value { - // generate IV - EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); - AlgorithmParameterSpec params=null; -- Class [] paramClasses = pbeAlg.getParameterClasses(); -+ Class [] paramClasses = encAlg.getParameterClasses(); - for (int i = 0; i < paramClasses.length; i ++) { - if ( paramClasses[i].equals( - javax.crypto.spec.IvParameterSpec.class ) ) { -diff --git a/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java b/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java -index a4709070..d85eb0d3 100644 ---- a/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java -+++ b/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java -@@ -180,7 +180,7 @@ public class EncryptedContentInfo implements ASN1Value { - // generate IV - EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); - AlgorithmParameterSpec params=null; -- Class [] paramClasses = pbeAlg.getParameterClasses(); -+ Class [] paramClasses = encAlg.getParameterClasses(); - for (int i = 0; i < paramClasses.length; i ++) { - if ( paramClasses[i].equals( IVParameterSpec.class ) ) { - params = new IVParameterSpec( kg.generatePBE_IV() ); -diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -index b35714e3..ebd269f3 100644 ---- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -+++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -@@ -147,7 +147,7 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { - // generate IV - EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); - AlgorithmParameterSpec params=null; -- Class [] paramClasses = pbeAlg.getParameterClasses(); -+ Class [] paramClasses = encAlg.getParameterClasses(); - for (int i = 0; i < paramClasses.length; i ++) { - if ( paramClasses[i].equals( javax.crypto.spec.IvParameterSpec.class ) ) { - params = new IVParameterSpec( kg.generatePBE_IV() ); -@@ -328,7 +328,7 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { - // generate IV - EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); - AlgorithmParameterSpec params=null; -- Class [] paramClasses = pbeAlg.getParameterClasses(); -+ Class [] paramClasses = encAlg.getParameterClasses(); - for (int i = 0; i < paramClasses.length; i ++) { - if ( paramClasses[i].equals( - javax.crypto.spec.IvParameterSpec.class ) ) { --- -2.24.1 - diff --git a/0003-Use-specified-algorithm-for-KeyWrap.patch b/0003-Use-specified-algorithm-for-KeyWrap.patch deleted file mode 100644 index d75534a..0000000 --- a/0003-Use-specified-algorithm-for-KeyWrap.patch +++ /dev/null @@ -1,60 +0,0 @@ -From 55482c8bfa0addeb9db7b590703ba3704c5db167 Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Fri, 28 Feb 2020 14:39:29 -0500 -Subject: [PATCH 8/8] Use specified algorithm for KeyWrap - -When the token-specified from of EncryptedPrivateKeyInfo.createPBE is -called, it would always request DES3_CBC_PAD as the key wrapping -algorithm, regardless of the input PBE key type. However, the other form -(with an implicit token) was correctly handling this case. - -Introduces a new KeyWrapAlgorithm method to take an OBJECT_IDENTIFIER -instead of having to convert to/from a String form. - -Signed-off-by: Alexander Scheel ---- - org/mozilla/jss/crypto/KeyWrapAlgorithm.java | 5 ++++- - org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++-- - 2 files changed, 6 insertions(+), 3 deletions(-) - -diff --git a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java -index 3113f614..3a106977 100644 ---- a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java -+++ b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java -@@ -138,7 +138,10 @@ public class KeyWrapAlgorithm extends Algorithm { - - public static KeyWrapAlgorithm fromOID(String wrapOID) throws NoSuchAlgorithmException { - OBJECT_IDENTIFIER oid = new OBJECT_IDENTIFIER(wrapOID); -+ return fromOID(oid); -+ } - -+ public static KeyWrapAlgorithm fromOID(OBJECT_IDENTIFIER oid) throws NoSuchAlgorithmException { - if (oid.equals(AES_KEY_WRAP_PAD_OID)) - return AES_KEY_WRAP_PAD; - -@@ -154,6 +157,6 @@ public class KeyWrapAlgorithm extends Algorithm { - if (oid.equals(DES_CBC_PAD_OID)) - return DES_CBC_PAD; - -- throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + wrapOID); -+ throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + oid); - } - } -diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -index ebd269f3..abfc39a7 100644 ---- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -+++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -@@ -337,8 +337,8 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { - } - } - -- KeyWrapper wrapper = token.getKeyWrapper( -- KeyWrapAlgorithm.DES3_CBC_PAD); -+ // wrap the key -+ KeyWrapper wrapper = token.getKeyWrapper(KeyWrapAlgorithm.fromOID(encAlg.toOID())); - wrapper.initWrap(key, params); - byte encrypted[] = wrapper.wrap(pri); - --- -2.24.1 - diff --git a/jss.spec b/jss.spec index f2b6c0d..3a764a2 100644 --- a/jss.spec +++ b/jss.spec @@ -6,9 +6,9 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.6.4 -Release: 1%{?_timestamp}%{?_commit_id}%{?dist} -# global _phase -a1 +Version: 4.7.0 +Release: 0.2%{?_timestamp}%{?_commit_id}%{?dist} +%global _phase -b2 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -34,11 +34,13 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas BuildRequires: git BuildRequires: make BuildRequires: cmake +BuildRequires: zip +BuildRequires: unzip BuildRequires: gcc-c++ BuildRequires: nspr-devel >= 4.13.1 -BuildRequires: nss-devel >= 3.30 -BuildRequires: nss-tools >= 3.30 +BuildRequires: nss-devel >= 3.44 +BuildRequires: nss-tools >= 3.44 BuildRequires: java-devel BuildRequires: jpackage-utils BuildRequires: slf4j @@ -49,11 +51,10 @@ BuildRequires: glassfish-jaxb-api BuildRequires: slf4j-jdk14 %endif BuildRequires: apache-commons-lang -BuildRequires: apache-commons-codec BuildRequires: junit -Requires: nss >= 3.30 +Requires: nss >= 3.44 Requires: java-headless Requires: jpackage-utils Requires: slf4j @@ -64,7 +65,6 @@ Requires: glassfish-jaxb-api Requires: slf4j-jdk14 %endif Requires: apache-commons-lang -Requires: apache-commons-codec Conflicts: ldapjdk < 4.20 Conflicts: idm-console-framework < 1.2 @@ -116,7 +116,7 @@ rm -rf build && mkdir -p build && cd build .. %{__make} all -%{__make} javadoc || true +%{__make} javadoc ctest --output-on-failure ################################################################################ @@ -147,7 +147,8 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} %files %defattr(-,root,root,-) -%doc jss.html MPL-1.1.txt gpl.txt lgpl.txt +%doc jss.html +%license MPL-1.1.txt gpl.txt lgpl.txt %{_libdir}/* %{_jnidir}/* @@ -159,6 +160,10 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Wed Jun 10 2020 Dogtag PKI Team - 4.7.0-0.2 +- Rebase to latest upstream JSS 4.7.0 +- JSS Provided SSLEngine + * Mon Apr 27 2020 Dogtag PKI Team - 4.6.4-1 - Rebase to JSS 4.6.4 - Fixes memory leak present since v4.6.2 diff --git a/sources b/sources index 25b6a59..eaf917e 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.6.4.tar.gz) = c0adc950e1ce5e0f3d846dcb158d831575be84176ded3eec7ce3569cfd96c872a2089a2eede249c5924e1eee58d88574accd3403623910343130cf90b504b348 +SHA512 (jss-4.7.0-b2.tar.gz) = 6bd5fd4823ea4b14bfd53dc64796b6fcb7018a6118b943b46be7a5caf874a386802f1e6e0e542743be505d73f2b9625b0f1d479b1292c7364ac62d8cee3e4e52 From 90b6186a2b3a6a1385fd372f1eb243f016bd0d9c Mon Sep 17 00:00:00 2001 From: Dinesh Prasanth M K Date: Tue, 30 Jun 2020 17:11:55 -0400 Subject: [PATCH 16/77] Rebased to upstream JSS v4.7.0-b4 --- .gitignore | 1 + jss.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index de898e2..87c5030 100644 --- a/.gitignore +++ b/.gitignore @@ -26,3 +26,4 @@ jss-4.2.6.tar.gz /jss-4.6.3.tar.gz /jss-4.6.4.tar.gz /jss-4.7.0-b2.tar.gz +/jss-4.7.0-b4.tar.gz diff --git a/jss.spec b/jss.spec index abb49ae..554fecc 100644 --- a/jss.spec +++ b/jss.spec @@ -7,8 +7,8 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.7.0 -Release: 0.2%{?_timestamp}%{?_commit_id}%{?dist} -%global _phase -b2 +Release: 0.4%{?_timestamp}%{?_commit_id}%{?dist} +%global _phase -b4 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -160,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Tue Jun 30 2020 Dogtag PKI Team - 4.7.0-0.4 +- Rebase to latest upstream JSS v4.7.0-b4 + * Wed Jun 10 2020 Dogtag PKI Team - 4.7.0-0.2 - Rebase to latest upstream JSS 4.7.0 - JSS Provided SSLEngine diff --git a/sources b/sources index eaf917e..eae7417 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.7.0-b2.tar.gz) = 6bd5fd4823ea4b14bfd53dc64796b6fcb7018a6118b943b46be7a5caf874a386802f1e6e0e542743be505d73f2b9625b0f1d479b1292c7364ac62d8cee3e4e52 +SHA512 (jss-4.7.0-b4.tar.gz) = 79c01fc513de479a63cbe164c772f9f685afe032a280f59eb3bb096a653424b3df1a9403c8cf443ffbe8b9a1d97a8aeb48064fbbe92e4c12e29767fb2a547d9f From 03683b7734cbb889e58b96667642f78c75a79660 Mon Sep 17 00:00:00 2001 From: Dinesh Prasanth M K Date: Tue, 30 Jun 2020 17:11:55 -0400 Subject: [PATCH 17/77] Rebased to upstream JSS v4.7.0-b4 --- .gitignore | 1 + jss.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index de898e2..87c5030 100644 --- a/.gitignore +++ b/.gitignore @@ -26,3 +26,4 @@ jss-4.2.6.tar.gz /jss-4.6.3.tar.gz /jss-4.6.4.tar.gz /jss-4.7.0-b2.tar.gz +/jss-4.7.0-b4.tar.gz diff --git a/jss.spec b/jss.spec index 3a764a2..4566e5e 100644 --- a/jss.spec +++ b/jss.spec @@ -7,8 +7,8 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.7.0 -Release: 0.2%{?_timestamp}%{?_commit_id}%{?dist} -%global _phase -b2 +Release: 0.4%{?_timestamp}%{?_commit_id}%{?dist} +%global _phase -b4 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -160,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Tue Jun 30 2020 Dogtag PKI Team - 4.7.0-0.4 +- Rebase to latest upstream JSS v4.7.0-b4 + * Wed Jun 10 2020 Dogtag PKI Team - 4.7.0-0.2 - Rebase to latest upstream JSS 4.7.0 - JSS Provided SSLEngine diff --git a/sources b/sources index eaf917e..eae7417 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.7.0-b2.tar.gz) = 6bd5fd4823ea4b14bfd53dc64796b6fcb7018a6118b943b46be7a5caf874a386802f1e6e0e542743be505d73f2b9625b0f1d479b1292c7364ac62d8cee3e4e52 +SHA512 (jss-4.7.0-b4.tar.gz) = 79c01fc513de479a63cbe164c772f9f685afe032a280f59eb3bb096a653424b3df1a9403c8cf443ffbe8b9a1d97a8aeb48064fbbe92e4c12e29767fb2a547d9f From 77453bee29456db4d5a7132dae0cac6aae12df11 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Mon, 6 Jul 2020 17:34:31 -0400 Subject: [PATCH 18/77] Fix build with new Crypto-Policies on Fedora Rawhide Signed-off-by: Alexander Scheel --- jss-crypto-policies-1.patch | 49 +++++++++++++++++++++++++++++++++++++ jss-crypto-policies-2.patch | 47 +++++++++++++++++++++++++++++++++++ jss.spec | 7 +++++- 3 files changed, 102 insertions(+), 1 deletion(-) create mode 100644 jss-crypto-policies-1.patch create mode 100644 jss-crypto-policies-2.patch diff --git a/jss-crypto-policies-1.patch b/jss-crypto-policies-1.patch new file mode 100644 index 0000000..dc23e85 --- /dev/null +++ b/jss-crypto-policies-1.patch @@ -0,0 +1,49 @@ +From 1fb6097a2ab73ef897d011e7383d7f5f1bf6a1df Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Wed, 1 Jul 2020 12:41:20 -0400 +Subject: [PATCH] Replace SHA-1 signature with SHA-256 + +A recent change in Fedora Rawhide's crypto-policies package caused +failures in the tests like the following: + + Exception in thread "main" java.io.IOException: SocketException cannot read on socket: Error reading from socket: (-12271) SSL peer cannot verify your certificate. + at org.mozilla.jss.ssl.SSLSocket.read(SSLSocket.java:1494) + at org.mozilla.jss.ssl.SSLInputStream.read(SSLInputStream.java:38) + at org.mozilla.jss.ssl.SSLInputStream.read(SSLInputStream.java:25) + at org.mozilla.jss.tests.SSLClientAuth.run(SSLClientAuth.java:435) + at java.lang.Thread.run(Thread.java:748) + Caused by: org.mozilla.jss.ssl.SSLSocketException: Error reading from socket: (-12271) SSL peer cannot verify your certificate. + at org.mozilla.jss.ssl.SSLSocket.socketRead(Native Method) + at org.mozilla.jss.ssl.SSLSocket.read(SSLSocket.java:1488) + ... 4 more + Server exiting + org.mozilla.jss.ssl.SSLSocketException: SSL_ForceHandshake failed: (-8016) Unknown error + at org.mozilla.jss.ssl.SSLSocket.forceHandshake(Native Method) + at org.mozilla.jss.tests.SSLClientAuth.testConnection(SSLClientAuth.java:345) + at org.mozilla.jss.tests.SSLClientAuth.doIt(SSLClientAuth.java:156) + at org.mozilla.jss.tests.SSLClientAuth.main(SSLClientAuth.java:90) + +This was caused by dropping SHA-1 as an allowed hash during handshakes. +However, because SSLClientAuth manually generated its certificate (and +explicitly asked for SHA-1), it failed. + +Switch to SHA-256 instead. + +Signed-off-by: Alexander Scheel +--- + org/mozilla/jss/tests/SSLClientAuth.java | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/org/mozilla/jss/tests/SSLClientAuth.java b/org/mozilla/jss/tests/SSLClientAuth.java +index 6f1fd2b12..bf270a634 100644 +--- a/org/mozilla/jss/tests/SSLClientAuth.java ++++ b/org/mozilla/jss/tests/SSLClientAuth.java +@@ -28,7 +28,7 @@ + + private CryptoManager cm; + public static final SignatureAlgorithm sigAlg = +- SignatureAlgorithm.RSASignatureWithSHA1Digest; ++ SignatureAlgorithm.RSASignatureWithSHA256Digest; + + /** + * Method that generates a certificate for given credential diff --git a/jss-crypto-policies-2.patch b/jss-crypto-policies-2.patch new file mode 100644 index 0000000..71fe8c2 --- /dev/null +++ b/jss-crypto-policies-2.patch @@ -0,0 +1,47 @@ +From 8ed5a82a973922d07d0610fd42c48b2a0ec97d6c Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Wed, 1 Jul 2020 12:44:53 -0400 +Subject: [PATCH] Remove all legacy DSS/DSA tests + +The only signature algorithm suppoted with DSS is SHA-1, which will soon +become deprecated and broken. DSS itself isn't widely used either, so we +should remove it from the test suite as well. + +Signed-off-by: Alexander Scheel +--- + cmake/JSSTests.cmake | 12 +----------- + 1 file changed, 1 insertion(+), 11 deletions(-) + +diff --git a/cmake/JSSTests.cmake b/cmake/JSSTests.cmake +index a26b95425..a0fe36e22 100644 +--- a/cmake/JSSTests.cmake ++++ b/cmake/JSSTests.cmake +@@ -170,11 +170,6 @@ macro(jss_tests) + COMMAND "org.mozilla.jss.tests.GenerateTestCert" "${RESULTS_NSSDB_OUTPUT_DIR}" "${PASSWORD_FILE}" "30" "localhost" "SHA-256/EC" "CA_ECDSA" "Server_ECDSA" "Client_ECDSA" + DEPENDS "Generate_known_RSA_cert_pair" + ) +- jss_test_java( +- NAME "Generate_known_DSS_cert_pair" +- COMMAND "org.mozilla.jss.tests.GenerateTestCert" "${RESULTS_NSSDB_OUTPUT_DIR}" "${PASSWORD_FILE}" "40" "localhost" "SHA-1/DSA" "CA_DSS" "Server_DSS" "Client_DSS" +- DEPENDS "Generate_known_ECDSA_cert_pair" +- ) + jss_test_exec( + NAME "Create_PKCS11_cert_to_PKCS12_rsa.pfx" + COMMAND "pk12util" "-o" "${RESULTS_NSSDB_OUTPUT_DIR}/rsa.pfx" "-n" "CA_RSA" "-d" "${RESULTS_NSSDB_OUTPUT_DIR}" "-K" "${DB_PWD}" "-W" "${DB_PWD}" +@@ -185,15 +180,10 @@ macro(jss_tests) + COMMAND "pk12util" "-o" "${RESULTS_NSSDB_OUTPUT_DIR}/ecdsa.pfx" "-n" "CA_ECDSA" "-d" "${RESULTS_NSSDB_OUTPUT_DIR}" "-K" "${DB_PWD}" "-W" "${DB_PWD}" + DEPENDS "Generate_known_ECDSA_cert_pair" + ) +- jss_test_exec( +- NAME "Create_PKCS11_cert_to_PKCS12_dss.pfx" +- COMMAND "pk12util" "-o" "${RESULTS_NSSDB_OUTPUT_DIR}/dss.pfx" "-n" "CA_DSS" "-d" "${RESULTS_NSSDB_OUTPUT_DIR}" "-K" "${DB_PWD}" "-W" "${DB_PWD}" +- DEPENDS "Generate_known_DSS_cert_pair" +- ) + jss_test_java( + NAME "List_CA_certs" + COMMAND "org.mozilla.jss.tests.ListCACerts" "${RESULTS_NSSDB_OUTPUT_DIR}" "Verbose" +- DEPENDS "Generate_known_DSS_cert_pair" ++ DEPENDS "Generate_known_ECDSA_cert_pair" + ) + jss_test_java( + NAME "SSLClientAuth" diff --git a/jss.spec b/jss.spec index 554fecc..244ef1d 100644 --- a/jss.spec +++ b/jss.spec @@ -7,7 +7,7 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.7.0 -Release: 0.4%{?_timestamp}%{?_commit_id}%{?dist} +Release: 0.5%{?_timestamp}%{?_commit_id}%{?dist} %global _phase -b4 # To generate the source tarball: @@ -25,6 +25,8 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch +Patch0: jss-crypto-policies-1.patch +Patch1: jss-crypto-policies-2.patch ################################################################################ # Build Dependencies @@ -160,6 +162,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Mon Jul 06 2020 Dogtag PKI Team - 4.7.0-0.5 +- Fix build issues with new Crypto-Policies denying SHA-1 usage + * Tue Jun 30 2020 Dogtag PKI Team - 4.7.0-0.4 - Rebase to latest upstream JSS v4.7.0-b4 From af8114637b7efc2e7a37bbb970916cd8d02b2f3b Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Thu, 9 Jul 2020 12:55:29 -0400 Subject: [PATCH 19/77] Update to stable v4.7.0 release Signed-off-by: Alexander Scheel --- .gitignore | 1 + jss.spec | 9 +++++---- sources | 2 +- 3 files changed, 7 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 87c5030..a9ae250 100644 --- a/.gitignore +++ b/.gitignore @@ -27,3 +27,4 @@ jss-4.2.6.tar.gz /jss-4.6.4.tar.gz /jss-4.7.0-b2.tar.gz /jss-4.7.0-b4.tar.gz +/jss-4.7.0.tar.gz diff --git a/jss.spec b/jss.spec index 244ef1d..9eb1987 100644 --- a/jss.spec +++ b/jss.spec @@ -7,8 +7,8 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.7.0 -Release: 0.5%{?_timestamp}%{?_commit_id}%{?dist} -%global _phase -b4 +Release: 1%{?_timestamp}%{?_commit_id}%{?dist} +#global _phase -a1 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -25,8 +25,6 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch -Patch0: jss-crypto-policies-1.patch -Patch1: jss-crypto-policies-2.patch ################################################################################ # Build Dependencies @@ -162,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Thu Jul 09 2020 Dogtag PKI Team - 4.7.0-1 +- Rebase to upstream stable release JSS v4.7.0 + * Mon Jul 06 2020 Dogtag PKI Team - 4.7.0-0.5 - Fix build issues with new Crypto-Policies denying SHA-1 usage diff --git a/sources b/sources index eae7417..7f6e516 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.7.0-b4.tar.gz) = 79c01fc513de479a63cbe164c772f9f685afe032a280f59eb3bb096a653424b3df1a9403c8cf443ffbe8b9a1d97a8aeb48064fbbe92e4c12e29767fb2a547d9f +SHA512 (jss-4.7.0.tar.gz) = 91a6bbc2c9dde436fd07e2f2bf9e71bd0a40c643547f41a95152a51200d126a37e2e580ef78d9075dc349f5dfe613b04eaf2a32009da13889e824ee9db255a43 From a380f751d4268e8d1c5067c92635ffb6f51ee897 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Thu, 9 Jul 2020 12:55:29 -0400 Subject: [PATCH 20/77] Update to stable v4.7.0 release Signed-off-by: Alexander Scheel --- .gitignore | 1 + jss.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 87c5030..a9ae250 100644 --- a/.gitignore +++ b/.gitignore @@ -27,3 +27,4 @@ jss-4.2.6.tar.gz /jss-4.6.4.tar.gz /jss-4.7.0-b2.tar.gz /jss-4.7.0-b4.tar.gz +/jss-4.7.0.tar.gz diff --git a/jss.spec b/jss.spec index 4566e5e..a3a2d28 100644 --- a/jss.spec +++ b/jss.spec @@ -7,8 +7,8 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.7.0 -Release: 0.4%{?_timestamp}%{?_commit_id}%{?dist} -%global _phase -b4 +Release: 1%{?_timestamp}%{?_commit_id}%{?dist} +#global _phase -a1 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -160,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Thu Jul 09 2020 Dogtag PKI Team - 4.7.0-1 +- Rebase to upstream stable release JSS v4.7.0 + * Tue Jun 30 2020 Dogtag PKI Team - 4.7.0-0.4 - Rebase to latest upstream JSS v4.7.0-b4 diff --git a/sources b/sources index eae7417..7f6e516 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.7.0-b4.tar.gz) = 79c01fc513de479a63cbe164c772f9f685afe032a280f59eb3bb096a653424b3df1a9403c8cf443ffbe8b9a1d97a8aeb48064fbbe92e4c12e29767fb2a547d9f +SHA512 (jss-4.7.0.tar.gz) = 91a6bbc2c9dde436fd07e2f2bf9e71bd0a40c643547f41a95152a51200d126a37e2e580ef78d9075dc349f5dfe613b04eaf2a32009da13889e824ee9db255a43 From b90185b8b6c5819cf303394d3e8fccf08502ae36 Mon Sep 17 00:00:00 2001 From: Jiri Date: Sat, 11 Jul 2020 01:22:04 +0200 Subject: [PATCH 21/77] Rebuilt for JDK-11 --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index 9eb1987..e9c8c56 100644 --- a/jss.spec +++ b/jss.spec @@ -7,7 +7,7 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.7.0 -Release: 1%{?_timestamp}%{?_commit_id}%{?dist} +Release: 2%{?_timestamp}%{?_commit_id}%{?dist} #global _phase -a1 # To generate the source tarball: @@ -160,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Fri Jul 10 2020 Jiri Vanek - 4.7.0-2 +- Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 + * Thu Jul 09 2020 Dogtag PKI Team - 4.7.0-1 - Rebase to upstream stable release JSS v4.7.0 From 47dd782c32182adb9c910b41e3af18240924e8ab Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Tue, 28 Jul 2020 02:36:22 +0000 Subject: [PATCH 22/77] - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index e9c8c56..2860899 100644 --- a/jss.spec +++ b/jss.spec @@ -7,7 +7,7 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.7.0 -Release: 2%{?_timestamp}%{?_commit_id}%{?dist} +Release: 3%{?_timestamp}%{?_commit_id}%{?dist} #global _phase -a1 # To generate the source tarball: @@ -160,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Tue Jul 28 2020 Fedora Release Engineering - 4.7.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + * Fri Jul 10 2020 Jiri Vanek - 4.7.0-2 - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 From 382e5071a5d6678c87a7cee092c3d3a33ca0aa56 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 1 Aug 2020 03:41:25 +0000 Subject: [PATCH 23/77] - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- jss.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index 2860899..93db0ad 100644 --- a/jss.spec +++ b/jss.spec @@ -7,7 +7,7 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.7.0 -Release: 3%{?_timestamp}%{?_commit_id}%{?dist} +Release: 4%{?_timestamp}%{?_commit_id}%{?dist} #global _phase -a1 # To generate the source tarball: @@ -160,6 +160,10 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Sat Aug 01 2020 Fedora Release Engineering - 4.7.0-4 +- Second attempt - Rebuilt for + https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + * Tue Jul 28 2020 Fedora Release Engineering - 4.7.0-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild From 1aaa1081587204a36830513aaf32cc6ed154cf1d Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Tue, 18 Aug 2020 13:56:49 -0400 Subject: [PATCH 24/77] Rebase to JSS v4.7.2 Signed-off-by: Alexander Scheel --- .gitignore | 1 + jss.spec | 17 ++++++++++------- sources | 2 +- 3 files changed, 12 insertions(+), 8 deletions(-) diff --git a/.gitignore b/.gitignore index a9ae250..d7eb920 100644 --- a/.gitignore +++ b/.gitignore @@ -28,3 +28,4 @@ jss-4.2.6.tar.gz /jss-4.7.0-b2.tar.gz /jss-4.7.0-b4.tar.gz /jss-4.7.0.tar.gz +/jss-4.7.2.tar.gz diff --git a/jss.spec b/jss.spec index 93db0ad..2b099c7 100644 --- a/jss.spec +++ b/jss.spec @@ -6,8 +6,8 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.7.0 -Release: 4%{?_timestamp}%{?_commit_id}%{?dist} +Version: 4.7.2 +Release: 1%{?_timestamp}%{?_commit_id}%{?dist} #global _phase -a1 # To generate the source tarball: @@ -109,12 +109,12 @@ export CFLAGS modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENABLED=1 # The Makefile is not thread-safe -rm -rf build && mkdir -p build && cd build %cmake \ -DJAVA_HOME=%{java_home} \ -DJAVA_LIB_INSTALL_DIR=%{_jnidir} \ - .. + -B %{_vpath_builddir} +cd %{_vpath_builddir} %{__make} all %{__make} javadoc ctest --output-on-failure @@ -126,19 +126,19 @@ ctest --output-on-failure # jars install -d -m 0755 $RPM_BUILD_ROOT%{_jnidir} -install -m 644 build/jss4.jar ${RPM_BUILD_ROOT}%{_jnidir}/jss4.jar +install -m 644 %{_vpath_builddir}/jss4.jar ${RPM_BUILD_ROOT}%{_jnidir}/jss4.jar # We have to use the name libjss4.so because this is dynamically # loaded by the jar file. install -d -m 0755 $RPM_BUILD_ROOT%{_libdir}/jss -install -m 0755 build/libjss4.so ${RPM_BUILD_ROOT}%{_libdir}/jss/ +install -m 0755 %{_vpath_builddir}/libjss4.so ${RPM_BUILD_ROOT}%{_libdir}/jss/ pushd ${RPM_BUILD_ROOT}%{_libdir}/jss ln -fs %{_jnidir}/jss4.jar jss4.jar popd # javadoc install -d -m 0755 $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} -cp -rp build/docs/* $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} +cp -rp %{_vpath_builddir}/docs/* $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} cp -p jss.html $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} @@ -160,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Tue Aug 18 2020 Dogtag PKI Team - 4.7.2-1 +- Rebase to upstream stable release JSS v4.7.2 ; fixes FTBFS + * Sat Aug 01 2020 Fedora Release Engineering - 4.7.0-4 - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild diff --git a/sources b/sources index 7f6e516..1f22225 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.7.0.tar.gz) = 91a6bbc2c9dde436fd07e2f2bf9e71bd0a40c643547f41a95152a51200d126a37e2e580ef78d9075dc349f5dfe613b04eaf2a32009da13889e824ee9db255a43 +SHA512 (jss-4.7.2.tar.gz) = 171b4c341b56c49eaedf0663cee7c949bd91f070781debc80b7b74f85eeacc5e4092cc5ab8eb3ace926493a7ea64d08c5c7a614dccd2e479f8b371b6075d6594 From c860b09f9f33a3d26e49ded03d744529a4891e2f Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Tue, 18 Aug 2020 13:56:49 -0400 Subject: [PATCH 25/77] Rebase to JSS v4.7.2 Signed-off-by: Alexander Scheel --- .gitignore | 1 + jss.spec | 15 +++++++++------ sources | 2 +- 3 files changed, 11 insertions(+), 7 deletions(-) diff --git a/.gitignore b/.gitignore index a9ae250..d7eb920 100644 --- a/.gitignore +++ b/.gitignore @@ -28,3 +28,4 @@ jss-4.2.6.tar.gz /jss-4.7.0-b2.tar.gz /jss-4.7.0-b4.tar.gz /jss-4.7.0.tar.gz +/jss-4.7.2.tar.gz diff --git a/jss.spec b/jss.spec index a3a2d28..22d91ff 100644 --- a/jss.spec +++ b/jss.spec @@ -6,7 +6,7 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.7.0 +Version: 4.7.2 Release: 1%{?_timestamp}%{?_commit_id}%{?dist} #global _phase -a1 @@ -109,12 +109,12 @@ export CFLAGS modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENABLED=1 # The Makefile is not thread-safe -rm -rf build && mkdir -p build && cd build %cmake \ -DJAVA_HOME=%{java_home} \ -DJAVA_LIB_INSTALL_DIR=%{_jnidir} \ - .. + -B %{_vpath_builddir} +cd %{_vpath_builddir} %{__make} all %{__make} javadoc ctest --output-on-failure @@ -126,19 +126,19 @@ ctest --output-on-failure # jars install -d -m 0755 $RPM_BUILD_ROOT%{_jnidir} -install -m 644 build/jss4.jar ${RPM_BUILD_ROOT}%{_jnidir}/jss4.jar +install -m 644 %{_vpath_builddir}/jss4.jar ${RPM_BUILD_ROOT}%{_jnidir}/jss4.jar # We have to use the name libjss4.so because this is dynamically # loaded by the jar file. install -d -m 0755 $RPM_BUILD_ROOT%{_libdir}/jss -install -m 0755 build/libjss4.so ${RPM_BUILD_ROOT}%{_libdir}/jss/ +install -m 0755 %{_vpath_builddir}/libjss4.so ${RPM_BUILD_ROOT}%{_libdir}/jss/ pushd ${RPM_BUILD_ROOT}%{_libdir}/jss ln -fs %{_jnidir}/jss4.jar jss4.jar popd # javadoc install -d -m 0755 $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} -cp -rp build/docs/* $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} +cp -rp %{_vpath_builddir}/docs/* $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} cp -p jss.html $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} @@ -160,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Tue Aug 18 2020 Dogtag PKI Team - 4.7.2-1 +- Rebase to upstream stable release JSS v4.7.2 ; fixes FTBFS + * Thu Jul 09 2020 Dogtag PKI Team - 4.7.0-1 - Rebase to upstream stable release JSS v4.7.0 diff --git a/sources b/sources index 7f6e516..1f22225 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.7.0.tar.gz) = 91a6bbc2c9dde436fd07e2f2bf9e71bd0a40c643547f41a95152a51200d126a37e2e580ef78d9075dc349f5dfe613b04eaf2a32009da13889e824ee9db255a43 +SHA512 (jss-4.7.2.tar.gz) = 171b4c341b56c49eaedf0663cee7c949bd91f070781debc80b7b74f85eeacc5e4092cc5ab8eb3ace926493a7ea64d08c5c7a614dccd2e479f8b371b6075d6594 From 8d0f659a7b9ac2d0ee7ab02be0de758a28f0b46a Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Fri, 11 Sep 2020 16:48:33 -0400 Subject: [PATCH 26/77] Rebase to JSS v4.7.3 Signed-off-by: Alexander Scheel --- .gitignore | 1 + jss.spec | 18 +++++++++++++++++- sources | 2 +- 3 files changed, 19 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index d7eb920..349bfb5 100644 --- a/.gitignore +++ b/.gitignore @@ -29,3 +29,4 @@ jss-4.2.6.tar.gz /jss-4.7.0-b4.tar.gz /jss-4.7.0.tar.gz /jss-4.7.2.tar.gz +/jss-4.7.3.tar.gz diff --git a/jss.spec b/jss.spec index 2b099c7..401fe38 100644 --- a/jss.spec +++ b/jss.spec @@ -6,7 +6,7 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.7.2 +Version: 4.7.3 Release: 1%{?_timestamp}%{?_commit_id}%{?dist} #global _phase -a1 @@ -108,13 +108,26 @@ export CFLAGS # Check if we're in FIPS mode modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENABLED=1 +# RHEL's CMake doesn't support -B flag. +%if 0%{?rhel} +%{__mkdir_p} %{_vpath_builddir} +cd %{_vpath_builddir} +%endif + # The Makefile is not thread-safe %cmake \ -DJAVA_HOME=%{java_home} \ -DJAVA_LIB_INSTALL_DIR=%{_jnidir} \ +%if 0%{?rhel} + .. +%else -B %{_vpath_builddir} +%endif +%if 0%{?fedora} cd %{_vpath_builddir} +%endif + %{__make} all %{__make} javadoc ctest --output-on-failure @@ -160,6 +173,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Fri Sep 11 2020 Dogtag PKI Team - 4.7.3-1 +- Rebase to upstream stable release JSS v4.7.3 + * Tue Aug 18 2020 Dogtag PKI Team - 4.7.2-1 - Rebase to upstream stable release JSS v4.7.2 ; fixes FTBFS diff --git a/sources b/sources index 1f22225..13d43e8 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.7.2.tar.gz) = 171b4c341b56c49eaedf0663cee7c949bd91f070781debc80b7b74f85eeacc5e4092cc5ab8eb3ace926493a7ea64d08c5c7a614dccd2e479f8b371b6075d6594 +SHA512 (jss-4.7.3.tar.gz) = 9358cf78d99e5e32a07dd457d6b0c916bdf9bf6959efe889f1cb91af75aa79fc419c2d057a40bfbe4e2a4924bffc1cafa04d917622cafe07062bcb633f330f98 From f338e1034c7d99fd1744cbf7f59597478793b53d Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Fri, 11 Sep 2020 16:48:33 -0400 Subject: [PATCH 27/77] Rebase to JSS v4.7.3 Signed-off-by: Alexander Scheel --- .gitignore | 1 + jss.spec | 18 +++++++++++++++++- sources | 2 +- 3 files changed, 19 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index d7eb920..349bfb5 100644 --- a/.gitignore +++ b/.gitignore @@ -29,3 +29,4 @@ jss-4.2.6.tar.gz /jss-4.7.0-b4.tar.gz /jss-4.7.0.tar.gz /jss-4.7.2.tar.gz +/jss-4.7.3.tar.gz diff --git a/jss.spec b/jss.spec index 22d91ff..368f582 100644 --- a/jss.spec +++ b/jss.spec @@ -6,7 +6,7 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.7.2 +Version: 4.7.3 Release: 1%{?_timestamp}%{?_commit_id}%{?dist} #global _phase -a1 @@ -108,13 +108,26 @@ export CFLAGS # Check if we're in FIPS mode modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENABLED=1 +# RHEL's CMake doesn't support -B flag. +%if 0%{?rhel} +%{__mkdir_p} %{_vpath_builddir} +cd %{_vpath_builddir} +%endif + # The Makefile is not thread-safe %cmake \ -DJAVA_HOME=%{java_home} \ -DJAVA_LIB_INSTALL_DIR=%{_jnidir} \ +%if 0%{?rhel} + .. +%else -B %{_vpath_builddir} +%endif +%if 0%{?fedora} cd %{_vpath_builddir} +%endif + %{__make} all %{__make} javadoc ctest --output-on-failure @@ -160,6 +173,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Fri Sep 11 2020 Dogtag PKI Team - 4.7.3-1 +- Rebase to upstream stable release JSS v4.7.3 + * Tue Aug 18 2020 Dogtag PKI Team - 4.7.2-1 - Rebase to upstream stable release JSS v4.7.2 ; fixes FTBFS diff --git a/sources b/sources index 1f22225..13d43e8 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.7.2.tar.gz) = 171b4c341b56c49eaedf0663cee7c949bd91f070781debc80b7b74f85eeacc5e4092cc5ab8eb3ace926493a7ea64d08c5c7a614dccd2e479f8b371b6075d6594 +SHA512 (jss-4.7.3.tar.gz) = 9358cf78d99e5e32a07dd457d6b0c916bdf9bf6959efe889f1cb91af75aa79fc419c2d057a40bfbe4e2a4924bffc1cafa04d917622cafe07062bcb633f330f98 From 89bcbe8882b72b2957680ff66ec6a45ab234f0e8 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 21 Oct 2020 12:12:46 -0400 Subject: [PATCH 28/77] Rebase to upstream JSS v4.8.0-b1 Signed-off-by: Alexander Scheel --- .gitignore | 1 + jss-crypto-policies-1.patch | 49 ------------------------------------- jss-crypto-policies-2.patch | 47 ----------------------------------- jss.spec | 26 ++++++-------------- sources | 2 +- 5 files changed, 10 insertions(+), 115 deletions(-) delete mode 100644 jss-crypto-policies-1.patch delete mode 100644 jss-crypto-policies-2.patch diff --git a/.gitignore b/.gitignore index 349bfb5..cb5030b 100644 --- a/.gitignore +++ b/.gitignore @@ -30,3 +30,4 @@ jss-4.2.6.tar.gz /jss-4.7.0.tar.gz /jss-4.7.2.tar.gz /jss-4.7.3.tar.gz +/jss-4.8.0-b1.tar.gz diff --git a/jss-crypto-policies-1.patch b/jss-crypto-policies-1.patch deleted file mode 100644 index dc23e85..0000000 --- a/jss-crypto-policies-1.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 1fb6097a2ab73ef897d011e7383d7f5f1bf6a1df Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Wed, 1 Jul 2020 12:41:20 -0400 -Subject: [PATCH] Replace SHA-1 signature with SHA-256 - -A recent change in Fedora Rawhide's crypto-policies package caused -failures in the tests like the following: - - Exception in thread "main" java.io.IOException: SocketException cannot read on socket: Error reading from socket: (-12271) SSL peer cannot verify your certificate. - at org.mozilla.jss.ssl.SSLSocket.read(SSLSocket.java:1494) - at org.mozilla.jss.ssl.SSLInputStream.read(SSLInputStream.java:38) - at org.mozilla.jss.ssl.SSLInputStream.read(SSLInputStream.java:25) - at org.mozilla.jss.tests.SSLClientAuth.run(SSLClientAuth.java:435) - at java.lang.Thread.run(Thread.java:748) - Caused by: org.mozilla.jss.ssl.SSLSocketException: Error reading from socket: (-12271) SSL peer cannot verify your certificate. - at org.mozilla.jss.ssl.SSLSocket.socketRead(Native Method) - at org.mozilla.jss.ssl.SSLSocket.read(SSLSocket.java:1488) - ... 4 more - Server exiting - org.mozilla.jss.ssl.SSLSocketException: SSL_ForceHandshake failed: (-8016) Unknown error - at org.mozilla.jss.ssl.SSLSocket.forceHandshake(Native Method) - at org.mozilla.jss.tests.SSLClientAuth.testConnection(SSLClientAuth.java:345) - at org.mozilla.jss.tests.SSLClientAuth.doIt(SSLClientAuth.java:156) - at org.mozilla.jss.tests.SSLClientAuth.main(SSLClientAuth.java:90) - -This was caused by dropping SHA-1 as an allowed hash during handshakes. -However, because SSLClientAuth manually generated its certificate (and -explicitly asked for SHA-1), it failed. - -Switch to SHA-256 instead. - -Signed-off-by: Alexander Scheel ---- - org/mozilla/jss/tests/SSLClientAuth.java | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/org/mozilla/jss/tests/SSLClientAuth.java b/org/mozilla/jss/tests/SSLClientAuth.java -index 6f1fd2b12..bf270a634 100644 ---- a/org/mozilla/jss/tests/SSLClientAuth.java -+++ b/org/mozilla/jss/tests/SSLClientAuth.java -@@ -28,7 +28,7 @@ - - private CryptoManager cm; - public static final SignatureAlgorithm sigAlg = -- SignatureAlgorithm.RSASignatureWithSHA1Digest; -+ SignatureAlgorithm.RSASignatureWithSHA256Digest; - - /** - * Method that generates a certificate for given credential diff --git a/jss-crypto-policies-2.patch b/jss-crypto-policies-2.patch deleted file mode 100644 index 71fe8c2..0000000 --- a/jss-crypto-policies-2.patch +++ /dev/null @@ -1,47 +0,0 @@ -From 8ed5a82a973922d07d0610fd42c48b2a0ec97d6c Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Wed, 1 Jul 2020 12:44:53 -0400 -Subject: [PATCH] Remove all legacy DSS/DSA tests - -The only signature algorithm suppoted with DSS is SHA-1, which will soon -become deprecated and broken. DSS itself isn't widely used either, so we -should remove it from the test suite as well. - -Signed-off-by: Alexander Scheel ---- - cmake/JSSTests.cmake | 12 +----------- - 1 file changed, 1 insertion(+), 11 deletions(-) - -diff --git a/cmake/JSSTests.cmake b/cmake/JSSTests.cmake -index a26b95425..a0fe36e22 100644 ---- a/cmake/JSSTests.cmake -+++ b/cmake/JSSTests.cmake -@@ -170,11 +170,6 @@ macro(jss_tests) - COMMAND "org.mozilla.jss.tests.GenerateTestCert" "${RESULTS_NSSDB_OUTPUT_DIR}" "${PASSWORD_FILE}" "30" "localhost" "SHA-256/EC" "CA_ECDSA" "Server_ECDSA" "Client_ECDSA" - DEPENDS "Generate_known_RSA_cert_pair" - ) -- jss_test_java( -- NAME "Generate_known_DSS_cert_pair" -- COMMAND "org.mozilla.jss.tests.GenerateTestCert" "${RESULTS_NSSDB_OUTPUT_DIR}" "${PASSWORD_FILE}" "40" "localhost" "SHA-1/DSA" "CA_DSS" "Server_DSS" "Client_DSS" -- DEPENDS "Generate_known_ECDSA_cert_pair" -- ) - jss_test_exec( - NAME "Create_PKCS11_cert_to_PKCS12_rsa.pfx" - COMMAND "pk12util" "-o" "${RESULTS_NSSDB_OUTPUT_DIR}/rsa.pfx" "-n" "CA_RSA" "-d" "${RESULTS_NSSDB_OUTPUT_DIR}" "-K" "${DB_PWD}" "-W" "${DB_PWD}" -@@ -185,15 +180,10 @@ macro(jss_tests) - COMMAND "pk12util" "-o" "${RESULTS_NSSDB_OUTPUT_DIR}/ecdsa.pfx" "-n" "CA_ECDSA" "-d" "${RESULTS_NSSDB_OUTPUT_DIR}" "-K" "${DB_PWD}" "-W" "${DB_PWD}" - DEPENDS "Generate_known_ECDSA_cert_pair" - ) -- jss_test_exec( -- NAME "Create_PKCS11_cert_to_PKCS12_dss.pfx" -- COMMAND "pk12util" "-o" "${RESULTS_NSSDB_OUTPUT_DIR}/dss.pfx" "-n" "CA_DSS" "-d" "${RESULTS_NSSDB_OUTPUT_DIR}" "-K" "${DB_PWD}" "-W" "${DB_PWD}" -- DEPENDS "Generate_known_DSS_cert_pair" -- ) - jss_test_java( - NAME "List_CA_certs" - COMMAND "org.mozilla.jss.tests.ListCACerts" "${RESULTS_NSSDB_OUTPUT_DIR}" "Verbose" -- DEPENDS "Generate_known_DSS_cert_pair" -+ DEPENDS "Generate_known_ECDSA_cert_pair" - ) - jss_test_java( - NAME "SSLClientAuth" diff --git a/jss.spec b/jss.spec index 401fe38..c0e48c9 100644 --- a/jss.spec +++ b/jss.spec @@ -6,9 +6,9 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.7.3 -Release: 1%{?_timestamp}%{?_commit_id}%{?dist} -#global _phase -a1 +Version: 4.8.0 +Release: 0.1%{?_timestamp}%{?_commit_id}%{?dist} +%global _phase -b1 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -50,7 +50,7 @@ BuildRequires: glassfish-jaxb-api %else BuildRequires: slf4j-jdk14 %endif -BuildRequires: apache-commons-lang +BuildRequires: apache-commons-lang3 BuildRequires: junit @@ -64,7 +64,7 @@ Requires: glassfish-jaxb-api %else Requires: slf4j-jdk14 %endif -Requires: apache-commons-lang +Requires: apache-commons-lang3 Conflicts: ldapjdk < 4.20 Conflicts: idm-console-framework < 1.2 @@ -108,26 +108,13 @@ export CFLAGS # Check if we're in FIPS mode modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENABLED=1 -# RHEL's CMake doesn't support -B flag. -%if 0%{?rhel} -%{__mkdir_p} %{_vpath_builddir} -cd %{_vpath_builddir} -%endif - # The Makefile is not thread-safe %cmake \ -DJAVA_HOME=%{java_home} \ -DJAVA_LIB_INSTALL_DIR=%{_jnidir} \ -%if 0%{?rhel} - .. -%else -B %{_vpath_builddir} -%endif -%if 0%{?fedora} cd %{_vpath_builddir} -%endif - %{__make} all %{__make} javadoc ctest --output-on-failure @@ -173,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Wed Oct 21 2020 Dogtag PKI Team - 4.8.0-b1 +- Rebase to upstream beta release JSS v4.8.0-b1 + * Fri Sep 11 2020 Dogtag PKI Team - 4.7.3-1 - Rebase to upstream stable release JSS v4.7.3 diff --git a/sources b/sources index 13d43e8..c295965 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.7.3.tar.gz) = 9358cf78d99e5e32a07dd457d6b0c916bdf9bf6959efe889f1cb91af75aa79fc419c2d057a40bfbe4e2a4924bffc1cafa04d917622cafe07062bcb633f330f98 +SHA512 (jss-4.8.0-b1.tar.gz) = 5601922b1c2e8006951a01e50486f585e2f6e3c0cd987a7e75c62755b4e14e2c7d489b583f92ba09281ceee2b5b1363f3d8fc94b039232fb3694975bd041a332 From c0c3a769acbb5341a6c4851459aebe8e3b98a150 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 28 Oct 2020 16:01:27 -0400 Subject: [PATCH 29/77] Rebase to latest stable JSS release v4.8.0 Signed-off-by: Alexander Scheel --- .gitignore | 1 + jss.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index cb5030b..181787c 100644 --- a/.gitignore +++ b/.gitignore @@ -31,3 +31,4 @@ jss-4.2.6.tar.gz /jss-4.7.2.tar.gz /jss-4.7.3.tar.gz /jss-4.8.0-b1.tar.gz +/jss-4.8.0.tar.gz diff --git a/jss.spec b/jss.spec index c0e48c9..a7c9812 100644 --- a/jss.spec +++ b/jss.spec @@ -7,8 +7,8 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.8.0 -Release: 0.1%{?_timestamp}%{?_commit_id}%{?dist} -%global _phase -b1 +Release: 1%{?_timestamp}%{?_commit_id}%{?dist} +#global _phase -a1 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -160,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Wed Oct 21 2020 Dogtag PKI Team - 4.8.0-1 +- Rebase to upstream stable release JSS v4.8.0 + * Wed Oct 21 2020 Dogtag PKI Team - 4.8.0-b1 - Rebase to upstream beta release JSS v4.8.0-b1 diff --git a/sources b/sources index c295965..017d89b 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.8.0-b1.tar.gz) = 5601922b1c2e8006951a01e50486f585e2f6e3c0cd987a7e75c62755b4e14e2c7d489b583f92ba09281ceee2b5b1363f3d8fc94b039232fb3694975bd041a332 +SHA512 (jss-4.8.0.tar.gz) = 322d12b69a2665a4ea2302a9a3ba8668c8dd6b56e6aaa17b48e11885ebcb9b38663242312207a0452c95bd84306bab4e968a8d0a1444dea003e4d19e43f6f425 From f25b2d6a41e9049b9c03d0fd3a6e566842bf40a5 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Thu, 5 Nov 2020 09:40:00 -0500 Subject: [PATCH 30/77] Add conflict on older PKI versions due to ACL3 Signed-off-by: Alexander Scheel --- jss.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/jss.spec b/jss.spec index a7c9812..925b552 100644 --- a/jss.spec +++ b/jss.spec @@ -7,7 +7,7 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.8.0 -Release: 1%{?_timestamp}%{?_commit_id}%{?dist} +Release: 2%{?_timestamp}%{?_commit_id}%{?dist} #global _phase -a1 # To generate the source tarball: @@ -69,7 +69,7 @@ Requires: apache-commons-lang3 Conflicts: ldapjdk < 4.20 Conflicts: idm-console-framework < 1.2 Conflicts: tomcatjss < 7.3.4 -Conflicts: pki-base < 10.6.5 +Conflicts: pki-base < 10.10.0 %description Java Security Services (JSS) is a java native interface which provides a bridge @@ -160,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Thu Nov 05 2020 Dogtag PKI Team - 4.8.0-2 +- Add Conflicts on older PKI versions due to missing ACL3 + * Wed Oct 21 2020 Dogtag PKI Team - 4.8.0-1 - Rebase to upstream stable release JSS v4.8.0 From 049ad39b72d847664f925f54073e15ad66d0d3de Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Thu, 14 Jan 2021 09:09:11 -0500 Subject: [PATCH 31/77] Rebase to latest stable JSS v4.8.1 Signed-off-by: Alexander Scheel --- .gitignore | 1 + jss.spec | 11 +++++++---- sources | 2 +- 3 files changed, 9 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 181787c..5d94c56 100644 --- a/.gitignore +++ b/.gitignore @@ -32,3 +32,4 @@ jss-4.2.6.tar.gz /jss-4.7.3.tar.gz /jss-4.8.0-b1.tar.gz /jss-4.8.0.tar.gz +/jss-4.8.1.tar.gz diff --git a/jss.spec b/jss.spec index 925b552..8849d06 100644 --- a/jss.spec +++ b/jss.spec @@ -6,8 +6,8 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.8.0 -Release: 2%{?_timestamp}%{?_commit_id}%{?dist} +Version: 4.8.1 +Release: 1%{?_timestamp}%{?_commit_id}%{?dist} #global _phase -a1 # To generate the source tarball: @@ -33,7 +33,7 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # autosetup BuildRequires: git BuildRequires: make -BuildRequires: cmake +BuildRequires: cmake >= 3.14 BuildRequires: zip BuildRequires: unzip @@ -68,7 +68,7 @@ Requires: apache-commons-lang3 Conflicts: ldapjdk < 4.20 Conflicts: idm-console-framework < 1.2 -Conflicts: tomcatjss < 7.3.4 +Conflicts: tomcatjss < 7.6.0 Conflicts: pki-base < 10.10.0 %description @@ -160,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Thu Jan 14 2021 Dogtag PKI Team - 4.8.1-1 +- Rebase to upstream stable JSS v4.8.1 + * Thu Nov 05 2020 Dogtag PKI Team - 4.8.0-2 - Add Conflicts on older PKI versions due to missing ACL3 diff --git a/sources b/sources index 017d89b..064f3c9 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.8.0.tar.gz) = 322d12b69a2665a4ea2302a9a3ba8668c8dd6b56e6aaa17b48e11885ebcb9b38663242312207a0452c95bd84306bab4e968a8d0a1444dea003e4d19e43f6f425 +SHA512 (jss-4.8.1.tar.gz) = d18ef995cba627de68077bbd8dc25640b6444c4674e29ec83a05296ac1f18289e1ada35229baafbf5c5e4f1ae712a46e48d9d6dcead935e0f4d3d72b5208cf40 From 78dbecd2ecd5d46f2367176ac22c790161acc861 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Tue, 26 Jan 2021 15:04:59 +0000 Subject: [PATCH 32/77] - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index 8849d06..e753986 100644 --- a/jss.spec +++ b/jss.spec @@ -7,7 +7,7 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.8.1 -Release: 1%{?_timestamp}%{?_commit_id}%{?dist} +Release: 2%{?_timestamp}%{?_commit_id}%{?dist} #global _phase -a1 # To generate the source tarball: @@ -160,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Tue Jan 26 2021 Fedora Release Engineering - 4.8.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + * Thu Jan 14 2021 Dogtag PKI Team - 4.8.1-1 - Rebase to upstream stable JSS v4.8.1 From 9d6582a8f850f0d377a3ec5985f7913b470c3dfb Mon Sep 17 00:00:00 2001 From: "Endi S. Dewata" Date: Tue, 18 May 2021 19:44:19 -0500 Subject: [PATCH 33/77] Rebase to JSS 4.9.0-alpha1 --- .gitignore | 1 + jss.spec | 11 ++++++++--- sources | 2 +- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 5d94c56..385bad6 100644 --- a/.gitignore +++ b/.gitignore @@ -33,3 +33,4 @@ jss-4.2.6.tar.gz /jss-4.8.0-b1.tar.gz /jss-4.8.0.tar.gz /jss-4.8.1.tar.gz +/jss-4.9.0-alpha1.tar.gz diff --git a/jss.spec b/jss.spec index e753986..c953b50 100644 --- a/jss.spec +++ b/jss.spec @@ -6,9 +6,11 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.8.1 -Release: 2%{?_timestamp}%{?_commit_id}%{?dist} -#global _phase -a1 +# For development (i.e. unsupported) releases, use x.y.z-0.n.. +# For official (i.e. supported) releases, use x.y.z-r where r >=1. +Version: 4.9.0 +Release: 0.1.alpha1%{?_timestamp}%{?_commit_id}%{?dist} +%global _phase -alpha1 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -160,6 +162,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Tue May 18 2021 Dogtag PKI Team - 4.9.0-0.1 +- Rebase to JSS 4.9.0-alpha1 + * Tue Jan 26 2021 Fedora Release Engineering - 4.8.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild diff --git a/sources b/sources index 064f3c9..c706521 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.8.1.tar.gz) = d18ef995cba627de68077bbd8dc25640b6444c4674e29ec83a05296ac1f18289e1ada35229baafbf5c5e4f1ae712a46e48d9d6dcead935e0f4d3d72b5208cf40 +SHA512 (jss-4.9.0-alpha1.tar.gz) = 3ab83818cf0c283f74087fd9de033d618ebbb8214b23a118414832017abbe2d4ed1f0567ab00e9aaec31ec9a04030a8817cf580ec6aeaf8f03a6be4b98c9a327 From d17adf6943138df2da190b413d9371b80a609e84 Mon Sep 17 00:00:00 2001 From: "Endi S. Dewata" Date: Wed, 26 May 2021 18:13:27 -0500 Subject: [PATCH 34/77] Drop git dependency --- jss.spec | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/jss.spec b/jss.spec index c953b50..6bf6884 100644 --- a/jss.spec +++ b/jss.spec @@ -9,7 +9,7 @@ License: MPLv1.1 or GPLv2+ or LGPLv2+ # For development (i.e. unsupported) releases, use x.y.z-0.n.. # For official (i.e. supported) releases, use x.y.z-r where r >=1. Version: 4.9.0 -Release: 0.1.alpha1%{?_timestamp}%{?_commit_id}%{?dist} +Release: 0.2.alpha1%{?_timestamp}%{?_commit_id}%{?dist} %global _phase -alpha1 # To generate the source tarball: @@ -32,8 +32,6 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # Build Dependencies ################################################################################ -# autosetup -BuildRequires: git BuildRequires: make BuildRequires: cmake >= 3.14 BuildRequires: zip @@ -91,7 +89,7 @@ This package contains the API documentation for JSS. ################################################################################ %prep -%autosetup -n %{name}-%{version}%{?_phase} -p 1 -S git +%autosetup -n %{name}-%{version}%{?_phase} -p 1 ################################################################################ %build @@ -162,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Wed May 26 2021 Dogtag PKI Team - 4.9.0-0.2 +- Drop git dependency + * Tue May 18 2021 Dogtag PKI Team - 4.9.0-0.1 - Rebase to JSS 4.9.0-alpha1 From d09d72c0f6f0226350a793faf1782514a0a59810 Mon Sep 17 00:00:00 2001 From: "Endi S. Dewata" Date: Wed, 26 May 2021 18:20:35 -0500 Subject: [PATCH 35/77] Disable unit tests by default --- jss.spec | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/jss.spec b/jss.spec index 6bf6884..e65db2b 100644 --- a/jss.spec +++ b/jss.spec @@ -28,6 +28,15 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch +################################################################################ +# Build Options +################################################################################ + +# By default the build will not execute unit tests unless --with test +# option is specified. + +%bcond_with test + ################################################################################ # Build Dependencies ################################################################################ @@ -117,7 +126,10 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA cd %{_vpath_builddir} %{__make} all %{__make} javadoc + +%if %{with test} ctest --output-on-failure +%endif ################################################################################ %install @@ -162,6 +174,7 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} %changelog * Wed May 26 2021 Dogtag PKI Team - 4.9.0-0.2 - Drop git dependency +- Disable unit tests by default * Tue May 18 2021 Dogtag PKI Team - 4.9.0-0.1 - Rebase to JSS 4.9.0-alpha1 From ef80dbd51c645585ad2255fd0455d252466858a1 Mon Sep 17 00:00:00 2001 From: "Endi S. Dewata" Date: Tue, 22 Jun 2021 14:35:42 -0500 Subject: [PATCH 36/77] Rebase to JSS 5.0.0-alpha1 --- .gitignore | 1 + jss.spec | 196 ++++++++--------------------------------------------- sources | 2 +- 3 files changed, 30 insertions(+), 169 deletions(-) diff --git a/.gitignore b/.gitignore index 385bad6..78c09bc 100644 --- a/.gitignore +++ b/.gitignore @@ -34,3 +34,4 @@ jss-4.2.6.tar.gz /jss-4.8.0.tar.gz /jss-4.8.1.tar.gz /jss-4.9.0-alpha1.tar.gz +/jss-5.0.0-alpha1.tar.gz diff --git a/jss.spec b/jss.spec index e65db2b..79c7bb3 100644 --- a/jss.spec +++ b/jss.spec @@ -8,8 +8,8 @@ License: MPLv1.1 or GPLv2+ or LGPLv2+ # For development (i.e. unsupported) releases, use x.y.z-0.n.. # For official (i.e. supported) releases, use x.y.z-r where r >=1. -Version: 4.9.0 -Release: 0.2.alpha1%{?_timestamp}%{?_commit_id}%{?dist} +Version: 5.0.0 +Release: 0.1.alpha1%{?_timestamp}%{?_commit_id}%{?dist} %global _phase -alpha1 # To generate the source tarball: @@ -28,6 +28,14 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch +################################################################################ +# Java +################################################################################ + +%define java_devel java-11-openjdk-devel +%define java_headless java-11-openjdk-headless +%define java_home /usr/lib/jvm/jre-11-openjdk + ################################################################################ # Build Options ################################################################################ @@ -50,29 +58,21 @@ BuildRequires: gcc-c++ BuildRequires: nspr-devel >= 4.13.1 BuildRequires: nss-devel >= 3.44 BuildRequires: nss-tools >= 3.44 -BuildRequires: java-devel +BuildRequires: %{java_devel} BuildRequires: jpackage-utils BuildRequires: slf4j BuildRequires: glassfish-jaxb-api -%if 0%{?rhel} && 0%{?rhel} <= 7 -# no slf4j-jdk14 -%else BuildRequires: slf4j-jdk14 -%endif BuildRequires: apache-commons-lang3 BuildRequires: junit Requires: nss >= 3.44 -Requires: java-headless +Requires: %{java_headless} Requires: jpackage-utils Requires: slf4j Requires: glassfish-jaxb-api -%if 0%{?rhel} && 0%{?rhel} <= 7 -# no slf4j-jdk14 -%else Requires: slf4j-jdk14 -%endif Requires: apache-commons-lang3 Conflicts: ldapjdk < 4.20 @@ -105,7 +105,7 @@ This package contains the API documentation for JSS. %set_build_flags -[ -z "$JAVA_HOME" ] && export JAVA_HOME=%{_jvmdir}/java +export JAVA_HOME=%{java_home} # Enable compiler optimizations export BUILD_OPT=1 @@ -117,44 +117,24 @@ export CFLAGS # Check if we're in FIPS mode modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENABLED=1 -# The Makefile is not thread-safe -%cmake \ - -DJAVA_HOME=%{java_home} \ - -DJAVA_LIB_INSTALL_DIR=%{_jnidir} \ - -B %{_vpath_builddir} - -cd %{_vpath_builddir} -%{__make} all -%{__make} javadoc - -%if %{with test} -ctest --output-on-failure -%endif +./build.sh \ + %{?_verbose:-v} \ + --work-dir=%{_vpath_builddir} \ + --java-lib-dir=%{_jnidir} \ + --jss-lib-dir=%{_libdir}/jss \ + --version=%{version} \ + %{!?with_test:--without-test} \ + dist ################################################################################ %install -# There is no install target so we'll do it by hand +./build.sh \ + %{?_verbose:-v} \ + --work-dir=%{_vpath_builddir} \ + --install-dir=%{buildroot} \ + install -# jars -install -d -m 0755 $RPM_BUILD_ROOT%{_jnidir} -install -m 644 %{_vpath_builddir}/jss4.jar ${RPM_BUILD_ROOT}%{_jnidir}/jss4.jar - -# We have to use the name libjss4.so because this is dynamically -# loaded by the jar file. -install -d -m 0755 $RPM_BUILD_ROOT%{_libdir}/jss -install -m 0755 %{_vpath_builddir}/libjss4.so ${RPM_BUILD_ROOT}%{_libdir}/jss/ -pushd ${RPM_BUILD_ROOT}%{_libdir}/jss - ln -fs %{_jnidir}/jss4.jar jss4.jar -popd - -# javadoc -install -d -m 0755 $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} -cp -rp %{_vpath_builddir}/docs/* $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} -cp -p jss.html $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} -cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} - -# No ldconfig is required since this library is loaded by Java itself. ################################################################################ %files @@ -172,125 +152,5 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog -* Wed May 26 2021 Dogtag PKI Team - 4.9.0-0.2 -- Drop git dependency -- Disable unit tests by default - -* Tue May 18 2021 Dogtag PKI Team - 4.9.0-0.1 -- Rebase to JSS 4.9.0-alpha1 - -* Tue Jan 26 2021 Fedora Release Engineering - 4.8.1-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - -* Thu Jan 14 2021 Dogtag PKI Team - 4.8.1-1 -- Rebase to upstream stable JSS v4.8.1 - -* Thu Nov 05 2020 Dogtag PKI Team - 4.8.0-2 -- Add Conflicts on older PKI versions due to missing ACL3 - -* Wed Oct 21 2020 Dogtag PKI Team - 4.8.0-1 -- Rebase to upstream stable release JSS v4.8.0 - -* Wed Oct 21 2020 Dogtag PKI Team - 4.8.0-b1 -- Rebase to upstream beta release JSS v4.8.0-b1 - -* Fri Sep 11 2020 Dogtag PKI Team - 4.7.3-1 -- Rebase to upstream stable release JSS v4.7.3 - -* Tue Aug 18 2020 Dogtag PKI Team - 4.7.2-1 -- Rebase to upstream stable release JSS v4.7.2 ; fixes FTBFS - -* Sat Aug 01 2020 Fedora Release Engineering - 4.7.0-4 -- Second attempt - Rebuilt for - https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - -* Tue Jul 28 2020 Fedora Release Engineering - 4.7.0-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - -* Fri Jul 10 2020 Jiri Vanek - 4.7.0-2 -- Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - -* Thu Jul 09 2020 Dogtag PKI Team - 4.7.0-1 -- Rebase to upstream stable release JSS v4.7.0 - -* Mon Jul 06 2020 Dogtag PKI Team - 4.7.0-0.5 -- Fix build issues with new Crypto-Policies denying SHA-1 usage - -* Tue Jun 30 2020 Dogtag PKI Team - 4.7.0-0.4 -- Rebase to latest upstream JSS v4.7.0-b4 - -* Wed Jun 10 2020 Dogtag PKI Team - 4.7.0-0.2 -- Rebase to latest upstream JSS 4.7.0 -- JSS Provided SSLEngine - -* Mon Apr 27 2020 Dogtag PKI Team - 4.6.4-1 -- Rebase to JSS 4.6.4 -- Fixes memory leak present since v4.6.2 - -* Thu Mar 5 2020 Dogtag PKI Team - 4.6.3-1 -- Rebase to JSS 4.6.3 -- Fixes base64 encoding of CSRs - -* Wed Mar 04 2020 Dogtag PKI Team - 4.6.2-4 -- Fix for PBE errors - -* Tue Jan 28 2020 Dogtag PKI Team - 4.6.2-3 -- Rebuild with new NSS to fix rhbz#1794814 - -* Tue Oct 29 2019 Dogtag PKI Team - 4.6.2-2 -- Fix for rhbz#1766451 - -* Tue Oct 15 2019 Dogtag PKI Team - 4.6.2-1 -- Rebase to JSS 4.6.2 -- Fixes CVE-2019-14823 - -* Thu Aug 08 2019 Dogtag PKI Team - 4.6.1-2 -- Disable unnecessary tests to fix broken s390x - -* Thu Aug 08 2019 Dogtag PKI Team - 4.6.1-1 -- Rebase to JSS 4.6.1 - -* Thu Jul 25 2019 Fedora Release Engineering - 4.5.3-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - -* Mon May 06 2019 Dogtag PKI Team - 4.5.3-2 -- Add AIA OCSP certificate checking patch - -* Tue Mar 19 2019 Dogtag PKI Team - 4.5.3-1 -- Rebase to JSS 4.5.3 - -* Fri Feb 01 2019 Dogtag PKI Team - 4.5.2-3 -- Include nuxwdog patch for netscape.security.util.Utils from PKI - -* Fri Feb 01 2019 Fedora Release Engineering - 4.5.2-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild - -* Mon Jan 14 2019 Dogtag PKI Team 4.5.2-1 -- Rebased to JSS 4.5.2 - -* Thu Nov 29 2018 Dogtag PKI Team 4.5.1-1 -- Rebased to JSS 4.5.1 -- Red Hat Bugzilla #1582323 - DER encoding error for enumerated types with a value of zero -- Red Hat Bugzilla #1534765 - javadoc for org.mozilla.jss.pkix.cms.SignedData.getSignerInfos() is incorrect - -* Fri Aug 10 2018 Dogtag PKI Team 4.5.0-1 -- Rebased to JSS 4.5.0 - -* Tue Aug 07 2018 Dogtag PKI Team 4.5.0-0.6 -- Rebased to JSS 4.5.0-b1 - -* Tue Aug 07 2018 Dogtag PKI Team 4.5.0-0.5 -- Red Hat Bugzilla #1612063 - Do not override system crypto policy (support TLS 1.3) - -* Fri Jul 20 2018 Dogtag PKI Team 4.5.0-0.4 -- Rebased to JSS 4.5.0-a4 -- Red Hat Bugzilla #1604462 - jss: FTBFS in Fedora rawhide - -* Thu Jul 05 2018 Dogtag PKI Team 4.5.0-0.3 -- Rebased to JSS 4.5.0-a3 - -* Fri Jun 22 2018 Dogtag PKI Team 4.5.0-0.2 -- Rebased to JSS 4.5.0-a2 - -* Fri Jun 15 2018 Dogtag PKI Team 4.5.0-0.1 -- Rebased to JSS 4.5.0-a1 +* Tue Jun 22 2021 Dogtag PKI Team - 5.0.0-0.1 +- Rebase to JSS 5.0.0-alpha1 diff --git a/sources b/sources index c706521..3d73504 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.9.0-alpha1.tar.gz) = 3ab83818cf0c283f74087fd9de033d618ebbb8214b23a118414832017abbe2d4ed1f0567ab00e9aaec31ec9a04030a8817cf580ec6aeaf8f03a6be4b98c9a327 +SHA512 (jss-5.0.0-alpha1.tar.gz) = 27c18c88cea85a62e9dd2b1c4bf7223629938fd1a47d5c0c9168eaa3ab79366961dd9c6a17cd2c37633b18b9287776ecb2b027090425d530cddb4d056b220e39 From 8e5f461e834d1e2b24c02f404ac69e94b47e26d8 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 22 Jul 2021 09:19:42 +0000 Subject: [PATCH 37/77] - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index 79c7bb3..5db023e 100644 --- a/jss.spec +++ b/jss.spec @@ -9,7 +9,7 @@ License: MPLv1.1 or GPLv2+ or LGPLv2+ # For development (i.e. unsupported) releases, use x.y.z-0.n.. # For official (i.e. supported) releases, use x.y.z-r where r >=1. Version: 5.0.0 -Release: 0.1.alpha1%{?_timestamp}%{?_commit_id}%{?dist} +Release: 0.2.alpha1%{?_timestamp}%{?_commit_id}%{?dist} %global _phase -alpha1 # To generate the source tarball: @@ -152,5 +152,8 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %changelog +* Thu Jul 22 2021 Fedora Release Engineering - 5.0.0-0.2.alpha1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + * Tue Jun 22 2021 Dogtag PKI Team - 5.0.0-0.1 - Rebase to JSS 5.0.0-alpha1 From f29b811b7f89ae9d03f4b2fc44aa5c064b9507a7 Mon Sep 17 00:00:00 2001 From: "Endi S. Dewata" Date: Thu, 12 Aug 2021 13:03:54 -0500 Subject: [PATCH 38/77] Rebase to JSS 5.0.0-alpha2 --- .gitignore | 1 + jss.spec | 32 ++++++++++++++++++++++---------- sources | 2 +- 3 files changed, 24 insertions(+), 11 deletions(-) diff --git a/.gitignore b/.gitignore index 78c09bc..5ea8d6a 100644 --- a/.gitignore +++ b/.gitignore @@ -35,3 +35,4 @@ jss-4.2.6.tar.gz /jss-4.8.1.tar.gz /jss-4.9.0-alpha1.tar.gz /jss-5.0.0-alpha1.tar.gz +/jss-5.0.0-alpha2.tar.gz diff --git a/jss.spec b/jss.spec index 5db023e..95e275b 100644 --- a/jss.spec +++ b/jss.spec @@ -9,8 +9,8 @@ License: MPLv1.1 or GPLv2+ or LGPLv2+ # For development (i.e. unsupported) releases, use x.y.z-0.n.. # For official (i.e. supported) releases, use x.y.z-r where r >=1. Version: 5.0.0 -Release: 0.2.alpha1%{?_timestamp}%{?_commit_id}%{?dist} -%global _phase -alpha1 +Release: 0.3.alpha2%{?_timestamp}%{?_commit_id}%{?dist} +%global _phase -alpha2 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -40,10 +40,15 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # Build Options ################################################################################ -# By default the build will not execute unit tests unless --with test +# By default the javadoc package will be built unless --without javadoc # option is specified. -%bcond_with test +%bcond_without javadoc + +# By default the build will execute unit tests unless --without test +# option is specified. + +%bcond_without test ################################################################################ # Build Dependencies @@ -55,9 +60,8 @@ BuildRequires: zip BuildRequires: unzip BuildRequires: gcc-c++ -BuildRequires: nspr-devel >= 4.13.1 -BuildRequires: nss-devel >= 3.44 -BuildRequires: nss-tools >= 3.44 +BuildRequires: nss-devel >= 3.66 +BuildRequires: nss-tools >= 3.66 BuildRequires: %{java_devel} BuildRequires: jpackage-utils BuildRequires: slf4j @@ -67,7 +71,7 @@ BuildRequires: apache-commons-lang3 BuildRequires: junit -Requires: nss >= 3.44 +Requires: nss >= 3.66 Requires: %{java_headless} Requires: jpackage-utils Requires: slf4j @@ -85,6 +89,7 @@ Java Security Services (JSS) is a java native interface which provides a bridge for java-based applications to use native Network Security Services (NSS). This only works with gcj. Other JREs require that JCE providers be signed. +%if %{with javadoc} ################################################################################ %package javadoc ################################################################################ @@ -94,6 +99,7 @@ Requires: jss = %{version}-%{release} %description javadoc This package contains the API documentation for JSS. +%endif ################################################################################ %prep @@ -123,6 +129,7 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA --java-lib-dir=%{_jnidir} \ --jss-lib-dir=%{_libdir}/jss \ --version=%{version} \ + %{!?with_javadoc:--without-javadoc} \ %{!?with_test:--without-test} \ dist @@ -144,16 +151,21 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA %{_libdir}/* %{_jnidir}/* +%if %{with javadoc} ################################################################################ %files javadoc %defattr(-,root,root,-) -%{_javadocdir}/%{name}-%{version}/ +%{_javadocdir}/%{name}/ +%endif ################################################################################ %changelog +* Thu Aug 12 2021 Dogtag PKI Team - 5.0.0-0.3.alpha2 +- Rebase to JSS 5.0.0-alpha2 + * Thu Jul 22 2021 Fedora Release Engineering - 5.0.0-0.2.alpha1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild -* Tue Jun 22 2021 Dogtag PKI Team - 5.0.0-0.1 +* Tue Jun 22 2021 Dogtag PKI Team - 5.0.0-0.1.alpha1 - Rebase to JSS 5.0.0-alpha1 diff --git a/sources b/sources index 3d73504..756e287 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-5.0.0-alpha1.tar.gz) = 27c18c88cea85a62e9dd2b1c4bf7223629938fd1a47d5c0c9168eaa3ab79366961dd9c6a17cd2c37633b18b9287776ecb2b027090425d530cddb4d056b220e39 +SHA512 (jss-5.0.0-alpha2.tar.gz) = de48ce48f2bc6544871308394ccaa187c4aecb72b3f4d5ce5dd692e8a6f6edaa835ce12aa80c2ac0745baca05e7fb7b943ae3abafe88636c07868633111c6118 From 9c8bb2356f1eee220cf73cfaefed124bdbf80624 Mon Sep 17 00:00:00 2001 From: Chris Kelley Date: Fri, 3 Sep 2021 23:23:32 +0100 Subject: [PATCH 39/77] Rebase to JSS 5.0.0-beta1 --- .gitignore | 1 + jss.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 5ea8d6a..66804ec 100644 --- a/.gitignore +++ b/.gitignore @@ -36,3 +36,4 @@ jss-4.2.6.tar.gz /jss-4.9.0-alpha1.tar.gz /jss-5.0.0-alpha1.tar.gz /jss-5.0.0-alpha2.tar.gz +/jss-5.0.0-beta1.tar.gz diff --git a/jss.spec b/jss.spec index 95e275b..e64e2a3 100644 --- a/jss.spec +++ b/jss.spec @@ -9,8 +9,8 @@ License: MPLv1.1 or GPLv2+ or LGPLv2+ # For development (i.e. unsupported) releases, use x.y.z-0.n.. # For official (i.e. supported) releases, use x.y.z-r where r >=1. Version: 5.0.0 -Release: 0.3.alpha2%{?_timestamp}%{?_commit_id}%{?dist} -%global _phase -alpha2 +Release: 0.4.beta1%{?_timestamp}%{?_commit_id}%{?dist} +%global _phase -beta1 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -161,6 +161,9 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %changelog +* Fri Sep 03 2021 Dogtag PKI Team - 5.0.0-0.4.beta1 +- Rebase to JSS 5.0.0-beta1 + * Thu Aug 12 2021 Dogtag PKI Team - 5.0.0-0.3.alpha2 - Rebase to JSS 5.0.0-alpha2 diff --git a/sources b/sources index 756e287..15f1b12 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-5.0.0-alpha2.tar.gz) = de48ce48f2bc6544871308394ccaa187c4aecb72b3f4d5ce5dd692e8a6f6edaa835ce12aa80c2ac0745baca05e7fb7b943ae3abafe88636c07868633111c6118 +SHA512 (jss-5.0.0-beta1.tar.gz) = 9413102a75e6d73b81b3adaeda65958f2363f075e8295cc2e796afaf0aae2c0e1942734cd3314754d5bccc21f92d3bfa16515e63954b0a4239f7ba85e2ce8f95 From 269ca9b45883b6af3eab6f7ed21cc3ec238ed944 Mon Sep 17 00:00:00 2001 From: "Endi S. Dewata" Date: Wed, 29 Sep 2021 23:11:52 -0500 Subject: [PATCH 40/77] Drop BuildRequires and Requires on glassfish-jaxb-api --- jss.spec | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/jss.spec b/jss.spec index e64e2a3..51490d7 100644 --- a/jss.spec +++ b/jss.spec @@ -9,7 +9,7 @@ License: MPLv1.1 or GPLv2+ or LGPLv2+ # For development (i.e. unsupported) releases, use x.y.z-0.n.. # For official (i.e. supported) releases, use x.y.z-r where r >=1. Version: 5.0.0 -Release: 0.4.beta1%{?_timestamp}%{?_commit_id}%{?dist} +Release: 0.5.beta1%{?_timestamp}%{?_commit_id}%{?dist} %global _phase -beta1 # To generate the source tarball: @@ -34,7 +34,7 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas %define java_devel java-11-openjdk-devel %define java_headless java-11-openjdk-headless -%define java_home /usr/lib/jvm/jre-11-openjdk +%define java_home %{_libdir}/jvm/jre-11-openjdk ################################################################################ # Build Options @@ -65,7 +65,6 @@ BuildRequires: nss-tools >= 3.66 BuildRequires: %{java_devel} BuildRequires: jpackage-utils BuildRequires: slf4j -BuildRequires: glassfish-jaxb-api BuildRequires: slf4j-jdk14 BuildRequires: apache-commons-lang3 @@ -75,7 +74,6 @@ Requires: nss >= 3.66 Requires: %{java_headless} Requires: jpackage-utils Requires: slf4j -Requires: glassfish-jaxb-api Requires: slf4j-jdk14 Requires: apache-commons-lang3 @@ -161,6 +159,9 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %changelog +* Wed Sep 29 2021 Dogtag PKI Team - 5.0.0-0.5.beta1 +- Drop BuildRequires and Requires on glassfish-jaxb-api + * Fri Sep 03 2021 Dogtag PKI Team - 5.0.0-0.4.beta1 - Rebase to JSS 5.0.0-beta1 From 23bd244360ca8ceef2572e5f6859b7af564f9a0f Mon Sep 17 00:00:00 2001 From: "Endi S. Dewata" Date: Thu, 30 Sep 2021 23:34:32 -0500 Subject: [PATCH 41/77] Rebase to JSS 5.0.0 --- .gitignore | 1 + jss.spec | 9 ++++++--- sources | 2 +- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 66804ec..21231ff 100644 --- a/.gitignore +++ b/.gitignore @@ -37,3 +37,4 @@ jss-4.2.6.tar.gz /jss-5.0.0-alpha1.tar.gz /jss-5.0.0-alpha2.tar.gz /jss-5.0.0-beta1.tar.gz +/jss-5.0.0.tar.gz diff --git a/jss.spec b/jss.spec index 51490d7..dfc608f 100644 --- a/jss.spec +++ b/jss.spec @@ -9,8 +9,8 @@ License: MPLv1.1 or GPLv2+ or LGPLv2+ # For development (i.e. unsupported) releases, use x.y.z-0.n.. # For official (i.e. supported) releases, use x.y.z-r where r >=1. Version: 5.0.0 -Release: 0.5.beta1%{?_timestamp}%{?_commit_id}%{?dist} -%global _phase -beta1 +Release: 1%{?_timestamp}%{?_commit_id}%{?dist} +#global _phase -alpha1 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -34,7 +34,7 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas %define java_devel java-11-openjdk-devel %define java_headless java-11-openjdk-headless -%define java_home %{_libdir}/jvm/jre-11-openjdk +%define java_home /usr/lib/jvm/jre-11-openjdk ################################################################################ # Build Options @@ -159,6 +159,9 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %changelog +* Thu Sep 30 2021 Dogtag PKI Team - 5.0.0-1 +- Rebase to JSS 5.0.0 + * Wed Sep 29 2021 Dogtag PKI Team - 5.0.0-0.5.beta1 - Drop BuildRequires and Requires on glassfish-jaxb-api diff --git a/sources b/sources index 15f1b12..fa96496 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-5.0.0-beta1.tar.gz) = 9413102a75e6d73b81b3adaeda65958f2363f075e8295cc2e796afaf0aae2c0e1942734cd3314754d5bccc21f92d3bfa16515e63954b0a4239f7ba85e2ce8f95 +SHA512 (jss-5.0.0.tar.gz) = 9857ff8e6c1e54927c78904be2d9a84ad4afc0559e95a4c835fd2000388c542d90d31bca7da7e99b0b74ef6e4175512227acb3341aa3475526f5f222c071aa97 From fa24161b1a045bad563331d689fc6d01269256e5 Mon Sep 17 00:00:00 2001 From: Chris Kelley Date: Fri, 26 Nov 2021 15:11:57 +0000 Subject: [PATCH 42/77] Rebase to JSS 5.1.0-alpha2 --- .gitignore | 1 + jss.spec | 21 ++++++++++++--------- sources | 2 +- 3 files changed, 14 insertions(+), 10 deletions(-) diff --git a/.gitignore b/.gitignore index 21231ff..d584a8a 100644 --- a/.gitignore +++ b/.gitignore @@ -38,3 +38,4 @@ jss-4.2.6.tar.gz /jss-5.0.0-alpha2.tar.gz /jss-5.0.0-beta1.tar.gz /jss-5.0.0.tar.gz +/jss-5.1.0-alpha2.tar.gz diff --git a/jss.spec b/jss.spec index dfc608f..96d564d 100644 --- a/jss.spec +++ b/jss.spec @@ -8,9 +8,9 @@ License: MPLv1.1 or GPLv2+ or LGPLv2+ # For development (i.e. unsupported) releases, use x.y.z-0.n.. # For official (i.e. supported) releases, use x.y.z-r where r >=1. -Version: 5.0.0 -Release: 1%{?_timestamp}%{?_commit_id}%{?dist} -#global _phase -alpha1 +Version: 5.1.0 +Release: 0.1.alpha2%{?_timestamp}%{?_commit_id}%{?dist} +%global _phase -alpha2 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -32,9 +32,9 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # Java ################################################################################ -%define java_devel java-11-openjdk-devel -%define java_headless java-11-openjdk-headless -%define java_home /usr/lib/jvm/jre-11-openjdk +%define java_devel java-17-openjdk-devel +%define java_headless java-17-openjdk-headless +%define java_home %{_jvmdir}/jre-17-openjdk ################################################################################ # Build Options @@ -45,10 +45,10 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas %bcond_without javadoc -# By default the build will execute unit tests unless --without test +# By default the build will not execute unit tests unless --with tests # option is specified. -%bcond_without test +%bcond_with tests ################################################################################ # Build Dependencies @@ -128,7 +128,7 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA --jss-lib-dir=%{_libdir}/jss \ --version=%{version} \ %{!?with_javadoc:--without-javadoc} \ - %{!?with_test:--without-test} \ + %{?with_tests:--with-tests} \ dist ################################################################################ @@ -159,6 +159,9 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %changelog +* Fri Nov 26 2021 Dogtag PKI Team - 5.1.0-0.1.alpha2 +- Rebase to JSS 5.1.0-alpha2 + * Thu Sep 30 2021 Dogtag PKI Team - 5.0.0-1 - Rebase to JSS 5.0.0 diff --git a/sources b/sources index fa96496..1205a51 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-5.0.0.tar.gz) = 9857ff8e6c1e54927c78904be2d9a84ad4afc0559e95a4c835fd2000388c542d90d31bca7da7e99b0b74ef6e4175512227acb3341aa3475526f5f222c071aa97 +SHA512 (jss-5.1.0-alpha2.tar.gz) = 6c97b42d4d52e6b016b0da72f834f8307905d894780f00a329e39cf3c1271cfb56873f899bd3090188aba015315b08d8b2d8848f5e4f053c64cd1e012f10a6f5 From b513b36692dfe54cfca54d23e1e0d612010986c8 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 20 Jan 2022 14:01:52 +0000 Subject: [PATCH 43/77] - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index 96d564d..f9b3fd2 100644 --- a/jss.spec +++ b/jss.spec @@ -9,7 +9,7 @@ License: MPLv1.1 or GPLv2+ or LGPLv2+ # For development (i.e. unsupported) releases, use x.y.z-0.n.. # For official (i.e. supported) releases, use x.y.z-r where r >=1. Version: 5.1.0 -Release: 0.1.alpha2%{?_timestamp}%{?_commit_id}%{?dist} +Release: 0.2.alpha2%{?_timestamp}%{?_commit_id}%{?dist} %global _phase -alpha2 # To generate the source tarball: @@ -159,6 +159,9 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %changelog +* Thu Jan 20 2022 Fedora Release Engineering - 5.1.0-0.2.alpha2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + * Fri Nov 26 2021 Dogtag PKI Team - 5.1.0-0.1.alpha2 - Rebase to JSS 5.1.0-alpha2 From 2070756ccac09cff425f628d9e6e1c4dabc405e9 Mon Sep 17 00:00:00 2001 From: Jiri Date: Sat, 5 Feb 2022 22:08:15 +0100 Subject: [PATCH 44/77] Rebuilt for java-17-openjdk as system jdk https://fedoraproject.org/wiki/Changes/Java17 --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index f9b3fd2..7b8165e 100644 --- a/jss.spec +++ b/jss.spec @@ -9,7 +9,7 @@ License: MPLv1.1 or GPLv2+ or LGPLv2+ # For development (i.e. unsupported) releases, use x.y.z-0.n.. # For official (i.e. supported) releases, use x.y.z-r where r >=1. Version: 5.1.0 -Release: 0.2.alpha2%{?_timestamp}%{?_commit_id}%{?dist} +Release: 0.3.alpha2%{?_timestamp}%{?_commit_id}%{?dist} %global _phase -alpha2 # To generate the source tarball: @@ -159,6 +159,9 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %changelog +* Sat Feb 05 2022 Jiri Vanek - 5.1.0-0.3.alpha2 +- Rebuilt for java-17-openjdk as system jdk + * Thu Jan 20 2022 Fedora Release Engineering - 5.1.0-0.2.alpha2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild From 13d4c207f4d917e4e83c33713eca26eb9a999eaf Mon Sep 17 00:00:00 2001 From: Chris Kelley Date: Mon, 14 Feb 2022 16:12:37 +0000 Subject: [PATCH 45/77] Rebase to JSS 5.1.0 --- .gitignore | 1 + jss.spec | 13 ++++++++----- sources | 2 +- 3 files changed, 10 insertions(+), 6 deletions(-) diff --git a/.gitignore b/.gitignore index d584a8a..f8083a5 100644 --- a/.gitignore +++ b/.gitignore @@ -39,3 +39,4 @@ jss-4.2.6.tar.gz /jss-5.0.0-beta1.tar.gz /jss-5.0.0.tar.gz /jss-5.1.0-alpha2.tar.gz +/jss-5.1.0.tar.gz diff --git a/jss.spec b/jss.spec index 7b8165e..9d0dd7f 100644 --- a/jss.spec +++ b/jss.spec @@ -9,8 +9,8 @@ License: MPLv1.1 or GPLv2+ or LGPLv2+ # For development (i.e. unsupported) releases, use x.y.z-0.n.. # For official (i.e. supported) releases, use x.y.z-r where r >=1. Version: 5.1.0 -Release: 0.3.alpha2%{?_timestamp}%{?_commit_id}%{?dist} -%global _phase -alpha2 +Release: 1%{?_timestamp}%{?_commit_id}%{?dist} +#global _phase -alpha2 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -124,8 +124,8 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ./build.sh \ %{?_verbose:-v} \ --work-dir=%{_vpath_builddir} \ - --java-lib-dir=%{_jnidir} \ - --jss-lib-dir=%{_libdir}/jss \ + --jni-dir=%{_jnidir} \ + --lib-dir=%{_libdir} \ --version=%{version} \ %{!?with_javadoc:--without-javadoc} \ %{?with_tests:--with-tests} \ @@ -145,7 +145,7 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA %defattr(-,root,root,-) %doc jss.html -%license MPL-1.1.txt gpl.txt lgpl.txt +%license MPL-1.1.txt gpl.txt lgpl.txt symkey/LICENSE %{_libdir}/* %{_jnidir}/* @@ -159,6 +159,9 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %changelog +* Mon Feb 14 2022 Dogtag PKI Team - 5.1.0-1 +- Rebase to JSS 5.1.0 + * Sat Feb 05 2022 Jiri Vanek - 5.1.0-0.3.alpha2 - Rebuilt for java-17-openjdk as system jdk diff --git a/sources b/sources index 1205a51..eefcf57 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-5.1.0-alpha2.tar.gz) = 6c97b42d4d52e6b016b0da72f834f8307905d894780f00a329e39cf3c1271cfb56873f899bd3090188aba015315b08d8b2d8848f5e4f053c64cd1e012f10a6f5 +SHA512 (jss-5.1.0.tar.gz) = 5bed03b443a2f9c8912e153a27469bdd6e8363465c3748c39defb19de1db1f489293ff86aeb6be7417e1b4bdc2c7915847b35521c220c68e18b2c15c24144306 From e1fb53d4aa5cada1f4cd9b73e5fb9a32921d79b3 Mon Sep 17 00:00:00 2001 From: "Endi S. Dewata" Date: Mon, 11 Apr 2022 14:20:55 -0500 Subject: [PATCH 46/77] Rebase to JSS 5.2.0-beta1 --- .gitignore | 1 + jss.spec | 24 ++++++++++++++++++++---- sources | 2 +- 3 files changed, 22 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index f8083a5..ca5b012 100644 --- a/.gitignore +++ b/.gitignore @@ -40,3 +40,4 @@ jss-4.2.6.tar.gz /jss-5.0.0.tar.gz /jss-5.1.0-alpha2.tar.gz /jss-5.1.0.tar.gz +/jss-5.2.0-beta1.tar.gz diff --git a/jss.spec b/jss.spec index 9d0dd7f..0ed4ff9 100644 --- a/jss.spec +++ b/jss.spec @@ -8,9 +8,9 @@ License: MPLv1.1 or GPLv2+ or LGPLv2+ # For development (i.e. unsupported) releases, use x.y.z-0.n.. # For official (i.e. supported) releases, use x.y.z-r where r >=1. -Version: 5.1.0 -Release: 1%{?_timestamp}%{?_commit_id}%{?dist} -#global _phase -alpha2 +Version: 5.2.0 +Release: 0.2.beta1%{?_timestamp}%{?_commit_id}%{?dist} +%global _phase -beta1 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -101,12 +101,16 @@ This package contains the API documentation for JSS. ################################################################################ %prep +################################################################################ %autosetup -n %{name}-%{version}%{?_phase} -p 1 ################################################################################ %build +################################################################################ +# Set build flags for CMake +# (see /usr/lib/rpm/macros.d/macros.cmake) %set_build_flags export JAVA_HOME=%{java_home} @@ -124,8 +128,14 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ./build.sh \ %{?_verbose:-v} \ --work-dir=%{_vpath_builddir} \ - --jni-dir=%{_jnidir} \ + --prefix-dir=%{_prefix} \ + --include-dir=%{_includedir} \ --lib-dir=%{_libdir} \ + --sysconfig-dir=%{_sysconfigdir} \ + --share-dir=%{_datadir} \ + --cmake=%{__cmake} \ + --java-home=%{java_home} \ + --jni-dir=%{_jnidir} \ --version=%{version} \ %{!?with_javadoc:--without-javadoc} \ %{?with_tests:--with-tests} \ @@ -133,6 +143,7 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %install +################################################################################ ./build.sh \ %{?_verbose:-v} \ @@ -142,6 +153,7 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %files +################################################################################ %defattr(-,root,root,-) %doc jss.html @@ -152,6 +164,7 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA %if %{with javadoc} ################################################################################ %files javadoc +################################################################################ %defattr(-,root,root,-) %{_javadocdir}/%{name}/ @@ -159,6 +172,9 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %changelog +* Mon Apr 11 2022 Dogtag PKI Team - 5.2.0-0.2.beta1 +- Rebase to JSS 5.2.0-beta1 + * Mon Feb 14 2022 Dogtag PKI Team - 5.1.0-1 - Rebase to JSS 5.1.0 diff --git a/sources b/sources index eefcf57..b03417d 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-5.1.0.tar.gz) = 5bed03b443a2f9c8912e153a27469bdd6e8363465c3748c39defb19de1db1f489293ff86aeb6be7417e1b4bdc2c7915847b35521c220c68e18b2c15c24144306 +SHA512 (jss-5.2.0-beta1.tar.gz) = be6f4612567676e797bb07a00cbc8e6ebab4e930770e00514152e5c3389a0484dcc3eb959c3c57d33d12ed38fbf160a02c69d1c6d5c7b40b93b9fe90cbf0bbb3 From e499f9be0bf2843994c34997f2d9d95f726ec819 Mon Sep 17 00:00:00 2001 From: "Endi S. Dewata" Date: Wed, 27 Apr 2022 18:19:12 -0500 Subject: [PATCH 47/77] Rebase to JSS 5.2.0-beta2 --- .gitignore | 1 + jss.spec | 52 ++++++++++++++++++++++++++++++++++++++++++---------- sources | 2 +- 3 files changed, 44 insertions(+), 11 deletions(-) diff --git a/.gitignore b/.gitignore index ca5b012..664530f 100644 --- a/.gitignore +++ b/.gitignore @@ -41,3 +41,4 @@ jss-4.2.6.tar.gz /jss-5.1.0-alpha2.tar.gz /jss-5.1.0.tar.gz /jss-5.2.0-beta1.tar.gz +/jss-5.2.0-beta2.tar.gz diff --git a/jss.spec b/jss.spec index 0ed4ff9..42a9102 100644 --- a/jss.spec +++ b/jss.spec @@ -1,16 +1,31 @@ ################################################################################ -Name: jss +Name: dogtag-jss ################################################################################ +# Upstream version number: +%global major_version 5 +%global minor_version 2 +%global update_version 0 + +# Downstream release number: +# - development/stabilization (unsupported): 0. where n >= 1 +# - GA/update (supported): where n >= 1 +%global release_number 0.3 + +# Development phase: +# - development (unsupported): alpha where n >= 1 +# - stabilization (unsupported): beta where n >= 1 +# - GA/update (supported): +%global phase beta2 + +%undefine timestamp +%undefine commit_id + Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ - -# For development (i.e. unsupported) releases, use x.y.z-0.n.. -# For official (i.e. supported) releases, use x.y.z-r where r >=1. -Version: 5.2.0 -Release: 0.2.beta1%{?_timestamp}%{?_commit_id}%{?dist} -%global _phase -beta1 +Version: %{major_version}.%{minor_version}.%{update_version} +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist} # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -19,7 +34,7 @@ Release: 0.2.beta1%{?_timestamp}%{?_commit_id}%{?dist} # $ git push origin v4.5. # Then go to https://github.com/dogtagpki/jss/releases and download the source # tarball. -Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phase}/%{name}-%{version}%{?_phase}.tar.gz +Source: https://github.com/dogtagpki/jss/archive/v%{version}%{?phase:-}%{?phase}/jss-%{version}%{?phase:-}%{?phase}.tar.gz # To create a patch for all changes since a version tag: # $ git format-patch \ @@ -28,6 +43,9 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch +# Java 17 and md2man are not available on i686 +ExcludeArch: i686 + ################################################################################ # Java ################################################################################ @@ -77,6 +95,11 @@ Requires: slf4j Requires: slf4j-jdk14 Requires: apache-commons-lang3 +%if "%{name}" != "jss" +Obsoletes: jss < %{version}-%{release} +Provides: jss = %{version}-%{release} +%endif + Conflicts: ldapjdk < 4.20 Conflicts: idm-console-framework < 1.2 Conflicts: tomcatjss < 7.6.0 @@ -95,6 +118,11 @@ This only works with gcj. Other JREs require that JCE providers be signed. Summary: Java Security Services (JSS) Javadocs Requires: jss = %{version}-%{release} +%if "%{name}" != "jss" +Obsoletes: jss-javadoc < %{version}-%{release} +Provides: jss-javadoc = %{version}-%{release} +%endif + %description javadoc This package contains the API documentation for JSS. %endif @@ -103,7 +131,7 @@ This package contains the API documentation for JSS. %prep ################################################################################ -%autosetup -n %{name}-%{version}%{?_phase} -p 1 +%autosetup -n jss-%{version}%{?phase:-}%{?phase} -p 1 ################################################################################ %build @@ -167,11 +195,15 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %defattr(-,root,root,-) -%{_javadocdir}/%{name}/ +%{_javadocdir}/jss/ %endif ################################################################################ %changelog +* Wed Apr 27 2022 Dogtag PKI Team - 5.2.0-0.3.beta2 +- Rebase to JSS 5.2.0-beta2 +- Rename packages to dogtag-jss + * Mon Apr 11 2022 Dogtag PKI Team - 5.2.0-0.2.beta1 - Rebase to JSS 5.2.0-beta1 diff --git a/sources b/sources index b03417d..2711f9e 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-5.2.0-beta1.tar.gz) = be6f4612567676e797bb07a00cbc8e6ebab4e930770e00514152e5c3389a0484dcc3eb959c3c57d33d12ed38fbf160a02c69d1c6d5c7b40b93b9fe90cbf0bbb3 +SHA512 (jss-5.2.0-beta2.tar.gz) = cdb40a65e816972e0eac1055a4bd4bb5a04906dbeddfefb36d099562a7b6b9841d2fdf3b1217179f59deadeaaf5d1be16affe5f713be01f806f06cab00486917 From ced9b084df8933927a8c463ad63d839ba26955c2 Mon Sep 17 00:00:00 2001 From: "Endi S. Dewata" Date: Thu, 28 Apr 2022 09:55:23 -0500 Subject: [PATCH 48/77] Add dogtag-jss subpackage --- jss.spec | 30 +++++++++++++++++++----------- sources | 2 +- 2 files changed, 20 insertions(+), 12 deletions(-) diff --git a/jss.spec b/jss.spec index 42a9102..fd4940f 100644 --- a/jss.spec +++ b/jss.spec @@ -1,7 +1,9 @@ ################################################################################ -Name: dogtag-jss +Name: jss ################################################################################ +%global product_id dogtag-jss + # Upstream version number: %global major_version 5 %global minor_version 2 @@ -88,6 +90,17 @@ BuildRequires: apache-commons-lang3 BuildRequires: junit +%description +Java Security Services (JSS) is a java native interface which provides a bridge +for java-based applications to use native Network Security Services (NSS). +This only works with gcj. Other JREs require that JCE providers be signed. + +################################################################################ +%package -n %{product_id} +################################################################################ + +Summary: Java Security Services (JSS) + Requires: nss >= 3.66 Requires: %{java_headless} Requires: jpackage-utils @@ -95,35 +108,30 @@ Requires: slf4j Requires: slf4j-jdk14 Requires: apache-commons-lang3 -%if "%{name}" != "jss" Obsoletes: jss < %{version}-%{release} Provides: jss = %{version}-%{release} -%endif Conflicts: ldapjdk < 4.20 Conflicts: idm-console-framework < 1.2 Conflicts: tomcatjss < 7.6.0 Conflicts: pki-base < 10.10.0 -%description +%description -n %{product_id} Java Security Services (JSS) is a java native interface which provides a bridge for java-based applications to use native Network Security Services (NSS). This only works with gcj. Other JREs require that JCE providers be signed. %if %{with javadoc} ################################################################################ -%package javadoc +%package -n %{product_id}-javadoc ################################################################################ Summary: Java Security Services (JSS) Javadocs -Requires: jss = %{version}-%{release} -%if "%{name}" != "jss" Obsoletes: jss-javadoc < %{version}-%{release} Provides: jss-javadoc = %{version}-%{release} -%endif -%description javadoc +%description -n %{product_id}-javadoc This package contains the API documentation for JSS. %endif @@ -180,7 +188,7 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA install ################################################################################ -%files +%files -n %{product_id} ################################################################################ %defattr(-,root,root,-) @@ -191,7 +199,7 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA %if %{with javadoc} ################################################################################ -%files javadoc +%files -n %{product_id}-javadoc ################################################################################ %defattr(-,root,root,-) diff --git a/sources b/sources index 2711f9e..96f4b70 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-5.2.0-beta2.tar.gz) = cdb40a65e816972e0eac1055a4bd4bb5a04906dbeddfefb36d099562a7b6b9841d2fdf3b1217179f59deadeaaf5d1be16affe5f713be01f806f06cab00486917 +SHA512 (jss-5.2.0-beta2.tar.gz) = da0ff4cd544cb9d339995251f48a4e402f44ab838beacfc96a2d92bb32a6581c81c005bc075fb8cfa5220d2c92e332a946f28b7aa1be61ec2671c396d721e48f From e19c3126fcc52b5c77c837706e0786558e945e19 Mon Sep 17 00:00:00 2001 From: "Endi S. Dewata" Date: Wed, 29 Jun 2022 20:06:09 -0500 Subject: [PATCH 49/77] Rebase to JSS 5.2.0 --- .gitignore | 1 + jss.spec | 11 +++++++---- sources | 2 +- 3 files changed, 9 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 664530f..f35bae3 100644 --- a/.gitignore +++ b/.gitignore @@ -42,3 +42,4 @@ jss-4.2.6.tar.gz /jss-5.1.0.tar.gz /jss-5.2.0-beta1.tar.gz /jss-5.2.0-beta2.tar.gz +/jss-5.2.0.tar.gz diff --git a/jss.spec b/jss.spec index fd4940f..823d0ae 100644 --- a/jss.spec +++ b/jss.spec @@ -12,19 +12,19 @@ Name: jss # Downstream release number: # - development/stabilization (unsupported): 0. where n >= 1 # - GA/update (supported): where n >= 1 -%global release_number 0.3 +%global release_number 1 # Development phase: # - development (unsupported): alpha where n >= 1 # - stabilization (unsupported): beta where n >= 1 # - GA/update (supported): -%global phase beta2 +%undefine phase %undefine timestamp %undefine commit_id Summary: Java Security Services (JSS) -URL: http://www.dogtagpki.org/wiki/JSS +URL: https://github.com/dogtagpki/jss License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: %{major_version}.%{minor_version}.%{update_version} Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist} @@ -167,7 +167,7 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA --prefix-dir=%{_prefix} \ --include-dir=%{_includedir} \ --lib-dir=%{_libdir} \ - --sysconfig-dir=%{_sysconfigdir} \ + --sysconf-dir=%{_sysconfdir} \ --share-dir=%{_datadir} \ --cmake=%{__cmake} \ --java-home=%{java_home} \ @@ -208,6 +208,9 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %changelog +* Wed Jun 29 2022 Dogtag PKI Team - 5.2.0-1 +- Rebase to JSS 5.2.0 + * Wed Apr 27 2022 Dogtag PKI Team - 5.2.0-0.3.beta2 - Rebase to JSS 5.2.0-beta2 - Rename packages to dogtag-jss diff --git a/sources b/sources index 96f4b70..ec3fe03 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-5.2.0-beta2.tar.gz) = da0ff4cd544cb9d339995251f48a4e402f44ab838beacfc96a2d92bb32a6581c81c005bc075fb8cfa5220d2c92e332a946f28b7aa1be61ec2671c396d721e48f +SHA512 (jss-5.2.0.tar.gz) = daddcd424d3de93544485b2442b20ffa97cc3653e1ca82cf1402983f3dd08779157fc65ff240eb4872861fcdb02ed720e09e78e5238d51e664c3875f4bb6f663 From 3d194c83fd40661cc2741601e1e2f3faa413057d Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 21 Jul 2022 15:28:13 +0000 Subject: [PATCH 50/77] Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index 823d0ae..e299628 100644 --- a/jss.spec +++ b/jss.spec @@ -27,7 +27,7 @@ Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: %{major_version}.%{minor_version}.%{update_version} -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist} +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.1 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -208,6 +208,9 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %changelog +* Thu Jul 21 2022 Fedora Release Engineering - 5.2.0-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + * Wed Jun 29 2022 Dogtag PKI Team - 5.2.0-1 - Rebase to JSS 5.2.0 From 7aa4dda38d0dd1cc8863009013217f9852645a93 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 19 Jan 2023 13:57:29 +0000 Subject: [PATCH 51/77] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index e299628..e91b95b 100644 --- a/jss.spec +++ b/jss.spec @@ -27,7 +27,7 @@ Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: %{major_version}.%{minor_version}.%{update_version} -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.1 +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.2 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -208,6 +208,9 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %changelog +* Thu Jan 19 2023 Fedora Release Engineering - 5.2.0-1.2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Thu Jul 21 2022 Fedora Release Engineering - 5.2.0-1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild From fddba91c299f613ee08ea85076908f0c221a0d40 Mon Sep 17 00:00:00 2001 From: "Endi S. Dewata" Date: Tue, 7 Feb 2023 12:45:03 -0600 Subject: [PATCH 52/77] Rebase to JSS 5.3.0 --- .gitignore | 1 + jss.spec | 18 ++++++++++++++---- sources | 2 +- 3 files changed, 16 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index f35bae3..e93a466 100644 --- a/.gitignore +++ b/.gitignore @@ -43,3 +43,4 @@ jss-4.2.6.tar.gz /jss-5.2.0-beta1.tar.gz /jss-5.2.0-beta2.tar.gz /jss-5.2.0.tar.gz +/jss-5.3.0.tar.gz diff --git a/jss.spec b/jss.spec index e91b95b..881aa45 100644 --- a/jss.spec +++ b/jss.spec @@ -6,7 +6,7 @@ Name: jss # Upstream version number: %global major_version 5 -%global minor_version 2 +%global minor_version 3 %global update_version 0 # Downstream release number: @@ -18,7 +18,7 @@ Name: jss # - development (unsupported): alpha where n >= 1 # - stabilization (unsupported): beta where n >= 1 # - GA/update (supported): -%undefine phase +#global phase %undefine timestamp %undefine commit_id @@ -27,7 +27,7 @@ Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: %{major_version}.%{minor_version}.%{update_version} -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.2 +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist} # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -45,8 +45,11 @@ Source: https://github.com/dogtagpki/jss/archive/v%{version}%{?phase:-}% # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch -# Java 17 and md2man are not available on i686 +%if 0%{?fedora} && 0%{?fedora} > 35 +ExclusiveArch: %{java_arches} +%else ExcludeArch: i686 +%endif ################################################################################ # Java @@ -110,6 +113,8 @@ Requires: apache-commons-lang3 Obsoletes: jss < %{version}-%{release} Provides: jss = %{version}-%{release} +Provides: jss = %{major_version}.%{minor_version} +Provides: %{product_id} = %{major_version}.%{minor_version} Conflicts: ldapjdk < 4.20 Conflicts: idm-console-framework < 1.2 @@ -130,6 +135,8 @@ Summary: Java Security Services (JSS) Javadocs Obsoletes: jss-javadoc < %{version}-%{release} Provides: jss-javadoc = %{version}-%{release} +Provides: jss-javadoc = %{major_version}.%{minor_version} +Provides: %{product_id}-javadoc = %{major_version}.%{minor_version} %description -n %{product_id}-javadoc This package contains the API documentation for JSS. @@ -208,6 +215,9 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %changelog +* Tue Feb 07 2023 Dogtag PKI Team - 5.3.0-1 +- Rebase to JSS 5.3.0 + * Thu Jan 19 2023 Fedora Release Engineering - 5.2.0-1.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild diff --git a/sources b/sources index ec3fe03..858c130 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-5.2.0.tar.gz) = daddcd424d3de93544485b2442b20ffa97cc3653e1ca82cf1402983f3dd08779157fc65ff240eb4872861fcdb02ed720e09e78e5238d51e664c3875f4bb6f663 +SHA512 (jss-5.3.0.tar.gz) = 6918683925f94c9d5dbd71a0106216f0a764b3aacca3fe2bc5b52a53780f5cd0400bd1767368ab96a081e2553f0525dee916a707c634867da933e3d1a59de4be From 8ccdc10274032547f9b6a45e0e6e3eda11e93bff Mon Sep 17 00:00:00 2001 From: "Endi S. Dewata" Date: Tue, 7 Feb 2023 13:16:09 -0600 Subject: [PATCH 53/77] Update version number in JSSConfig.cmake --- sources | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sources b/sources index 858c130..46e22b9 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-5.3.0.tar.gz) = 6918683925f94c9d5dbd71a0106216f0a764b3aacca3fe2bc5b52a53780f5cd0400bd1767368ab96a081e2553f0525dee916a707c634867da933e3d1a59de4be +SHA512 (jss-5.3.0.tar.gz) = 2cf75d3d7d028493ac22e5367035959d120317298d9b276b34ef5824d189c0eb62bfe8c83fce4ae8cf63e140495f0ea725e57a3da7219c05319195dea31e51ce From fdc6d683c010995ff335684af48935da7eb93db6 Mon Sep 17 00:00:00 2001 From: "Endi S. Dewata" Date: Tue, 7 Feb 2023 13:24:25 -0600 Subject: [PATCH 54/77] Update spec file --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index 881aa45..affdeb5 100644 --- a/jss.spec +++ b/jss.spec @@ -12,7 +12,7 @@ Name: jss # Downstream release number: # - development/stabilization (unsupported): 0. where n >= 1 # - GA/update (supported): where n >= 1 -%global release_number 1 +%global release_number 2 # Development phase: # - development (unsupported): alpha where n >= 1 @@ -215,6 +215,9 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %changelog +* Tue Feb 07 2023 Dogtag PKI Team - 5.3.0-2 +- Update version number in JSSConfig.cmake + * Tue Feb 07 2023 Dogtag PKI Team - 5.3.0-1 - Rebase to JSS 5.3.0 From a7851eaff4b1413a51b762bfe4196b507275e91a Mon Sep 17 00:00:00 2001 From: Chris Kelley Date: Tue, 28 Feb 2023 06:40:19 +0000 Subject: [PATCH 55/77] Update to SPDX licence --- jss.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index affdeb5..5b39906 100644 --- a/jss.spec +++ b/jss.spec @@ -25,7 +25,7 @@ Name: jss Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss -License: MPLv1.1 or GPLv2+ or LGPLv2+ +License: MPL-1.1 or GPL-2.0-or-later or LGPL-2.1-or-later Version: %{major_version}.%{minor_version}.%{update_version} Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist} From f8f85c0c8f42c0a704d049f55757eae9709597c2 Mon Sep 17 00:00:00 2001 From: Packit Date: Fri, 16 Jun 2023 11:55:40 +0000 Subject: [PATCH 56/77] [packit] 5.4.2 upstream release Upstream tag: v5.4.2 Upstream commit: 7e99d7e7 --- .gitignore | 1 + .packit.yaml | 30 ++++++++++++++++++++++++++++++ README.packit | 3 +++ jss.spec | 33 +++++++++++++++++++-------------- sources | 2 +- 5 files changed, 54 insertions(+), 15 deletions(-) create mode 100644 .packit.yaml create mode 100644 README.packit diff --git a/.gitignore b/.gitignore index e93a466..1ddcac1 100644 --- a/.gitignore +++ b/.gitignore @@ -44,3 +44,4 @@ jss-4.2.6.tar.gz /jss-5.2.0-beta2.tar.gz /jss-5.2.0.tar.gz /jss-5.3.0.tar.gz +/jss-5.4.2.tar.gz diff --git a/.packit.yaml b/.packit.yaml new file mode 100644 index 0000000..73d2062 --- /dev/null +++ b/.packit.yaml @@ -0,0 +1,30 @@ +--- +# See the documentation for more information: +# https://packit.dev/docs/configuration/ +specfile_path: jss.spec + +# add or remove files that should be synced +files_to_sync: + - jss.spec + - .packit.yaml + +# Allow dist git reactions on packit and ckelley commits and PRs +allowed_pr_authors: + - packit + - ckelleyRH +allowed_committers: + - packit + - ckelleyRH + +upstream_package_name: jss +# downstream (Fedora/CentOS) RPM package name +downstream_package_name: jss +# see: https://packit.dev/docs/configuration/#upstream_tag_template +upstream_tag_template: "v{version}" + +jobs: + - job: propose_downstream + trigger: release + dist_git_branches: + - fedora-development +# - centos-stream-9-x86_64 # When Packit integration with CentOS is avaiable, enable this diff --git a/README.packit b/README.packit new file mode 100644 index 0000000..07bc213 --- /dev/null +++ b/README.packit @@ -0,0 +1,3 @@ +This repository is maintained by packit. +https://packit.dev/ +The file was generated using packit 0.76.0.post10+g0dcb396. diff --git a/jss.spec b/jss.spec index 5b39906..7f6f32e 100644 --- a/jss.spec +++ b/jss.spec @@ -6,13 +6,13 @@ Name: jss # Upstream version number: %global major_version 5 -%global minor_version 3 -%global update_version 0 +%global minor_version 4 +%global update_version 2 # Downstream release number: # - development/stabilization (unsupported): 0. where n >= 1 # - GA/update (supported): where n >= 1 -%global release_number 2 +%global release_number 1 # Development phase: # - development (unsupported): alpha where n >= 1 @@ -26,7 +26,7 @@ Name: jss Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss License: MPL-1.1 or GPL-2.0-or-later or LGPL-2.1-or-later -Version: %{major_version}.%{minor_version}.%{update_version} +Version: 5.4.2 Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist} # To generate the source tarball: @@ -85,13 +85,13 @@ BuildRequires: unzip BuildRequires: gcc-c++ BuildRequires: nss-devel >= 3.66 BuildRequires: nss-tools >= 3.66 -BuildRequires: %{java_devel} -BuildRequires: jpackage-utils -BuildRequires: slf4j -BuildRequires: slf4j-jdk14 -BuildRequires: apache-commons-lang3 -BuildRequires: junit +BuildRequires: %{java_devel} +BuildRequires: maven-local +BuildRequires: mvn(org.apache.commons:commons-lang3) +BuildRequires: mvn(org.slf4j:slf4j-api) +BuildRequires: mvn(org.slf4j:slf4j-jdk14) +BuildRequires: mvn(junit:junit) %description Java Security Services (JSS) is a java native interface which provides a bridge @@ -105,11 +105,11 @@ This only works with gcj. Other JREs require that JCE providers be signed. Summary: Java Security Services (JSS) Requires: nss >= 3.66 + Requires: %{java_headless} -Requires: jpackage-utils -Requires: slf4j -Requires: slf4j-jdk14 -Requires: apache-commons-lang3 +Requires: mvn(org.apache.commons:commons-lang3) +Requires: mvn(org.slf4j:slf4j-api) +Requires: mvn(org.slf4j:slf4j-jdk14) Obsoletes: jss < %{version}-%{release} Provides: jss = %{version}-%{release} @@ -215,6 +215,11 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %changelog +* Fri Jun 16 2023 Packit - 5.4.2-1 +- Updating version to v5.4.2 (Chris Kelley) +- Upstream spec file changes to reduce diffs (Chris Kelley) +- Introduce Packit configuration for jss (Chris Kelley) + * Tue Feb 07 2023 Dogtag PKI Team - 5.3.0-2 - Update version number in JSSConfig.cmake diff --git a/sources b/sources index 46e22b9..5f64e0c 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-5.3.0.tar.gz) = 2cf75d3d7d028493ac22e5367035959d120317298d9b276b34ef5824d189c0eb62bfe8c83fce4ae8cf63e140495f0ea725e57a3da7219c05319195dea31e51ce +SHA512 (jss-5.4.2.tar.gz) = 8e5c0ed93d8bafbfd8a8f822aaeda5d4b60e7609aa24f793eb3c449918a4a23884a55966f40d66d810e9b56114eb7cefb8dfeee565fe680c79ef876bc9acfefa From 33742c45895518e8e7be3ab4f4d71463ab4362a3 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 20 Jul 2023 08:15:39 +0000 Subject: [PATCH 57/77] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index 7f6f32e..a98c500 100644 --- a/jss.spec +++ b/jss.spec @@ -27,7 +27,7 @@ Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss License: MPL-1.1 or GPL-2.0-or-later or LGPL-2.1-or-later Version: 5.4.2 -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist} +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.1 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -215,6 +215,9 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %changelog +* Thu Jul 20 2023 Fedora Release Engineering - 5.4.2-1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Fri Jun 16 2023 Packit - 5.4.2-1 - Updating version to v5.4.2 (Chris Kelley) - Upstream spec file changes to reduce diffs (Chris Kelley) From 419c9333510e5e3175f69551ba875ab05800141b Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 20 Jan 2024 23:50:48 +0000 Subject: [PATCH 58/77] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index a98c500..f5203a7 100644 --- a/jss.spec +++ b/jss.spec @@ -27,7 +27,7 @@ Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss License: MPL-1.1 or GPL-2.0-or-later or LGPL-2.1-or-later Version: 5.4.2 -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.1 +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.2 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -215,6 +215,9 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %changelog +* Sat Jan 20 2024 Fedora Release Engineering - 5.4.2-1.2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Thu Jul 20 2023 Fedora Release Engineering - 5.4.2-1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild From e722059771135bd087d97816917f1e676af76d60 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 24 Jan 2024 23:30:49 +0000 Subject: [PATCH 59/77] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index f5203a7..0b3c810 100644 --- a/jss.spec +++ b/jss.spec @@ -27,7 +27,7 @@ Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss License: MPL-1.1 or GPL-2.0-or-later or LGPL-2.1-or-later Version: 5.4.2 -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.2 +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.3 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -215,6 +215,9 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %changelog +* Wed Jan 24 2024 Fedora Release Engineering - 5.4.2-1.3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Sat Jan 20 2024 Fedora Release Engineering - 5.4.2-1.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From 9eff0686ac23054a17d4332384fdb2da483763dc Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Thu, 8 Feb 2024 12:15:32 -0500 Subject: [PATCH 60/77] Fix compatibility with NSS 3.97 https://github.com/dogtagpki/jss/pull/992 --- jss-5.4.2-nss-3.97.patch | 40 ++++++++++++++++++++++++++++++++++++++++ jss.spec | 8 +++++++- 2 files changed, 47 insertions(+), 1 deletion(-) create mode 100644 jss-5.4.2-nss-3.97.patch diff --git a/jss-5.4.2-nss-3.97.patch b/jss-5.4.2-nss-3.97.patch new file mode 100644 index 0000000..8b9d64d --- /dev/null +++ b/jss-5.4.2-nss-3.97.patch @@ -0,0 +1,40 @@ +From 130d543f3a7c33196bef386b4ee87ccc4ed53d0b Mon Sep 17 00:00:00 2001 +From: "Endi S. Dewata" +Date: Wed, 7 Feb 2024 14:59:31 -0600 +Subject: [PATCH] Update kea_alg_defs to match NSS 3.97 + +The kea_alg_defs array in SSLCipher.c has been updated to match +the one defined in NSS 3.97. The assertion that compares the size +of the array with ssl_kea_size has also been removed. These +changes will allow JSS to work with the newer NSS 3.97 on Fedora +Rawhide as well as the older NSS versions on other platforms. + +Resolves: https://github.com/dogtagpki/jss/issues/991 +--- + native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c b/native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c +index 4f2dacb0b..ea739617a 100644 +--- a/native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c ++++ b/native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c +@@ -23,7 +23,7 @@ static const CK_MECHANISM_TYPE auth_alg_defs[] = { + }; + PR_STATIC_ASSERT(PR_ARRAY_SIZE(auth_alg_defs) == ssl_auth_size); + +-/* Copied from NSS's ssl3con.c. */ ++/* Copied from NSS 3.97's ssl3con.c. */ + static const CK_MECHANISM_TYPE kea_alg_defs[] = { + CKM_INVALID_MECHANISM, /* ssl_kea_null */ + CKM_RSA_PKCS, /* ssl_kea_rsa */ +@@ -33,8 +33,9 @@ static const CK_MECHANISM_TYPE kea_alg_defs[] = { + CKM_ECDH1_DERIVE, /* ssl_kea_ecdh_psk */ + CKM_DH_PKCS_DERIVE, /* ssl_kea_dh_psk */ + CKM_INVALID_MECHANISM, /* ssl_kea_tls13_any */ ++ CKM_INVALID_MECHANISM, /* ssl_kea_ecdh_hybrid */ ++ CKM_INVALID_MECHANISM, /* ssl_kea_ecdh_hybrid_psk */ + }; +-PR_STATIC_ASSERT(PR_ARRAY_SIZE(kea_alg_defs) == ssl_kea_size); + + #ifdef HAVE_NSS_CIPHER_SUITE_INFO_KDFHASH + /* Not present in ssl3con.c. */ diff --git a/jss.spec b/jss.spec index 0b3c810..a3e30bd 100644 --- a/jss.spec +++ b/jss.spec @@ -27,7 +27,7 @@ Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss License: MPL-1.1 or GPL-2.0-or-later or LGPL-2.1-or-later Version: 5.4.2 -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.3 +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.4 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -45,6 +45,9 @@ Source: https://github.com/dogtagpki/jss/archive/v%{version}%{?phase:-}% # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch +# https://github.com/dogtagpki/jss/pull/992 +Patch: jss-5.4.2-nss-3.97.patch + %if 0%{?fedora} && 0%{?fedora} > 35 ExclusiveArch: %{java_arches} %else @@ -215,6 +218,9 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA ################################################################################ %changelog +* Thu Feb 08 2024 Yaakov Selkowitz - 5.4.2-1.4 +- Fix compatibility with NSS 3.97 + * Wed Jan 24 2024 Fedora Release Engineering - 5.4.2-1.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From 18e3b27daba28e3ecb75e6ef298b2dc21c52275a Mon Sep 17 00:00:00 2001 From: "Endi S. Dewata" Date: Wed, 21 Feb 2024 18:08:28 -0600 Subject: [PATCH 61/77] Rebased to JSS 5.5.0 --- .gitignore | 2 + jss.spec | 181 ++++++++++++++++++++++++++++++++++++++++++++++------- sources | 2 +- 3 files changed, 161 insertions(+), 24 deletions(-) diff --git a/.gitignore b/.gitignore index 1ddcac1..25ef8c4 100644 --- a/.gitignore +++ b/.gitignore @@ -45,3 +45,5 @@ jss-4.2.6.tar.gz /jss-5.2.0.tar.gz /jss-5.3.0.tar.gz /jss-5.4.2.tar.gz +/jss-5.5.0-alpha2.tar.gz +/jss-5.5.0.tar.gz diff --git a/jss.spec b/jss.spec index a3e30bd..5742bef 100644 --- a/jss.spec +++ b/jss.spec @@ -6,8 +6,8 @@ Name: jss # Upstream version number: %global major_version 5 -%global minor_version 4 -%global update_version 2 +%global minor_version 5 +%global update_version 0 # Downstream release number: # - development/stabilization (unsupported): 0. where n >= 1 @@ -25,9 +25,9 @@ Name: jss Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss -License: MPL-1.1 or GPL-2.0-or-later or LGPL-2.1-or-later -Version: 5.4.2 -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.4 +License: (MPL-1.1 or GPL-2.0-or-later or LGPL-2.1-or-later) and Apache-2.0 +Version: %{major_version}.%{minor_version}.%{update_version} +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist} # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -45,10 +45,7 @@ Source: https://github.com/dogtagpki/jss/archive/v%{version}%{?phase:-}% # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch -# https://github.com/dogtagpki/jss/pull/992 -Patch: jss-5.4.2-nss-3.97.patch - -%if 0%{?fedora} && 0%{?fedora} > 35 +%if 0%{?java_arches:1} ExclusiveArch: %{java_arches} %else ExcludeArch: i686 @@ -71,10 +68,10 @@ ExcludeArch: i686 %bcond_without javadoc -# By default the build will not execute unit tests unless --with tests -# option is specified. +# By default the tests package will be built and the tests will executed +# unless --without tests option is specified. -%bcond_with tests +%bcond_without tests ################################################################################ # Build Dependencies @@ -94,7 +91,6 @@ BuildRequires: maven-local BuildRequires: mvn(org.apache.commons:commons-lang3) BuildRequires: mvn(org.slf4j:slf4j-api) BuildRequires: mvn(org.slf4j:slf4j-jdk14) -BuildRequires: mvn(junit:junit) %description Java Security Services (JSS) is a java native interface which provides a bridge @@ -121,7 +117,6 @@ Provides: %{product_id} = %{major_version}.%{minor_version} Conflicts: ldapjdk < 4.20 Conflicts: idm-console-framework < 1.2 -Conflicts: tomcatjss < 7.6.0 Conflicts: pki-base < 10.10.0 %description -n %{product_id} @@ -129,6 +124,41 @@ Java Security Services (JSS) is a java native interface which provides a bridge for java-based applications to use native Network Security Services (NSS). This only works with gcj. Other JREs require that JCE providers be signed. +################################################################################ +%package -n %{product_id}-tomcat +################################################################################ + +Summary: Java Security Services (JSS) Connector for Tomcat + +# Tomcat +BuildRequires: mvn(org.apache.tomcat:tomcat-catalina) >= 9.0.62 +BuildRequires: mvn(org.apache.tomcat:tomcat-coyote) >= 9.0.62 +BuildRequires: mvn(org.apache.tomcat:tomcat-juli) >= 9.0.62 + +Requires: %{product_id} = %{version}-%{release} +Requires: mvn(org.apache.tomcat:tomcat-catalina) >= 9.0.62 +Requires: mvn(org.apache.tomcat:tomcat-coyote) >= 9.0.62 +Requires: mvn(org.apache.tomcat:tomcat-juli) >= 9.0.62 + +# Tomcat JSS has been replaced with JSS Connector for Tomcat. +# This will remove installed Tomcat JSS packages. +Obsoletes: tomcatjss <= 8.5 +Conflicts: tomcatjss <= 8.5 +Obsoletes: dogtag-tomcatjss <= 8.5 +Conflicts: dogtag-tomcatjss <= 8.5 + +%if 0%{?rhel} <= 8 +# PKI Servlet Engine has been replaced with Tomcat. +# This will remove installed PKI Servlet Engine packages. +Obsoletes: pki-servlet-engine <= 9.0 +Conflicts: pki-servlet-engine <= 9.0 +%endif + +%description -n %{product_id}-tomcat +JSS Connector for Tomcat is a Java Secure Socket Extension (JSSE) +module for Apache Tomcat that uses Java Security Services (JSS), +a Java interface to Network Security Services (NSS). + %if %{with javadoc} ################################################################################ %package -n %{product_id}-javadoc @@ -145,12 +175,46 @@ Provides: %{product_id}-javadoc = %{major_version}.%{minor_version} This package contains the API documentation for JSS. %endif +%if %{with tests} +################################################################################ +%package -n %{product_id}-tests +################################################################################ + +Summary: Java Security Services (JSS) Tests + +BuildRequires: mvn(org.junit.jupiter:junit-jupiter) +BuildRequires: mvn(org.opentest4j:opentest4j) + +%description -n %{product_id}-tests +This package provides test suite for JSS. + +# with tests +%endif + ################################################################################ %prep ################################################################################ %autosetup -n jss-%{version}%{?phase:-}%{?phase} -p 1 +# disable native modules since they will be built by CMake +%pom_disable_module native +%pom_disable_module symkey + +# do not ship examples +%pom_disable_module examples + +# flatten-maven-plugin is not available in RPM +%pom_remove_plugin org.codehaus.mojo:flatten-maven-plugin + +# specify Maven artifact locations +%mvn_file org.dogtagpki.jss:jss-tomcat jss/jss-tomcat +%mvn_file org.dogtagpki.jss:jss-tomcat-9.0 jss/jss-tomcat-9.0 + +# specify Maven artifact packages +%mvn_package org.dogtagpki.jss:jss-tomcat jss-tomcat +%mvn_package org.dogtagpki.jss:jss-tomcat-9.0 jss-tomcat + ################################################################################ %build ################################################################################ @@ -171,6 +235,38 @@ export CFLAGS # Check if we're in FIPS mode modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENABLED=1 +# build Java code, run Java tests, and build Javadoc with Maven +%mvn_build %{!?with_tests:-f} %{!?with_javadoc:-j} + +# create links to Maven-built classes for CMake +mkdir -p %{_vpath_builddir}/classes/jss +ln -sf ../../../base/target/classes/org %{_vpath_builddir}/classes/jss +%if %{with tests} +mkdir -p %{_vpath_builddir}/classes/tests +ln -sf ../../../base/target/test-classes/org %{_vpath_builddir}/classes/tests +%endif + +# create links to Maven-built JAR files for CMake +ln -sf ../base/target/jss.jar %{_vpath_builddir} +%if %{with tests} +ln -sf ../base/target/jss-tests.jar %{_vpath_builddir} +%endif + +# create links to Maven-built headers for CMake +mkdir -p %{_vpath_builddir}/include/jss +ln -sf ../../../base/target/include/_jni %{_vpath_builddir}/include/jss/_jni + +# mark Maven-built targets so that CMake will not rebuild them +mkdir -p %{_vpath_builddir}/.targets +touch %{_vpath_builddir}/.targets/finished_generate_java +%if %{with tests} +touch %{_vpath_builddir}/.targets/finished_tests_generate_java +%endif +%if %{with javadoc} +touch %{_vpath_builddir}/.targets/finished_generate_javadocs +%endif + +# build native code and run native tests with CMake ./build.sh \ %{?_verbose:-v} \ --work-dir=%{_vpath_builddir} \ @@ -183,41 +279,80 @@ modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENA --java-home=%{java_home} \ --jni-dir=%{_jnidir} \ --version=%{version} \ - %{!?with_javadoc:--without-javadoc} \ - %{?with_tests:--with-tests} \ + --without-java \ + --without-javadoc \ + %{!?with_tests:--without-tests} \ dist ################################################################################ %install ################################################################################ +# install Java binaries and Javadoc +%mvn_install + +# install jss.jar +mkdir -p %{buildroot}%{_javadir}/jss +cp base/target/jss.jar %{buildroot}%{_javadir}/jss/jss.jar + +# create links for backward compatibility +mkdir -p %{buildroot}%{_jnidir} +ln -sf ../../..%{_javadir}/jss/jss.jar %{buildroot}%{_jnidir}/jss.jar + +mkdir -p %{buildroot}%{_libdir}/jss +ln -sf ../../..%{_javadir}/jss/jss.jar %{buildroot}%{_libdir}/jss/jss.jar + +# install native binaries ./build.sh \ %{?_verbose:-v} \ --work-dir=%{_vpath_builddir} \ --install-dir=%{buildroot} \ + --without-java \ install +# install tests binaries +%if %{with tests} +mkdir -p %{buildroot}%{_datadir}/jss/tests/lib +cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib +%endif + ################################################################################ -%files -n %{product_id} +%files -n %{product_id} -f .mfiles ################################################################################ -%defattr(-,root,root,-) %doc jss.html %license MPL-1.1.txt gpl.txt lgpl.txt symkey/LICENSE -%{_libdir}/* -%{_jnidir}/* +%{_javadir}/jss/jss.jar +%{_jnidir}/jss.jar +%{_libdir}/jss/jss.jar +%{_libdir}/jss/libjss.so +%{_libdir}/jss/libjss-symkey.so + +################################################################################ +%files -n %{product_id}-tomcat -f .mfiles-jss-tomcat +################################################################################ %if %{with javadoc} ################################################################################ -%files -n %{product_id}-javadoc +%files -n %{product_id}-javadoc -f .mfiles-javadoc +################################################################################ +%endif + +%if %{with tests} +################################################################################ +%files -n %{product_id}-tests ################################################################################ -%defattr(-,root,root,-) -%{_javadocdir}/jss/ +%{_datadir}/jss/tests/ + +# with tests %endif ################################################################################ %changelog +* Wed Feb 21 2024 Dogtag PKI Team 5.5.0-1 +- Rebase to JSS 5.5.0 + * Thu Feb 08 2024 Yaakov Selkowitz - 5.4.2-1.4 - Fix compatibility with NSS 3.97 diff --git a/sources b/sources index 5f64e0c..645ec2a 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-5.4.2.tar.gz) = 8e5c0ed93d8bafbfd8a8f822aaeda5d4b60e7609aa24f793eb3c449918a4a23884a55966f40d66d810e9b56114eb7cefb8dfeee565fe680c79ef876bc9acfefa +SHA512 (jss-5.5.0.tar.gz) = bda0b4df1ef08a264525c9124a29f57945e3a24adadda609b54032d840a1c311d522e34f29bb2246d03d493d108d425a64e4826edcc8a296a2f55b1cdd8a95c0 From d77787f82372d5b7a2707b4bc070d8444b508455 Mon Sep 17 00:00:00 2001 From: Jiri Vanek Date: Tue, 27 Feb 2024 16:42:53 +0100 Subject: [PATCH 62/77] Rebuilt for java-21-openjdk as system jdk https://fedoraproject.org/wiki/Changes/Java21 --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index 5742bef..1defcaa 100644 --- a/jss.spec +++ b/jss.spec @@ -27,7 +27,7 @@ Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss License: (MPL-1.1 or GPL-2.0-or-later or LGPL-2.1-or-later) and Apache-2.0 Version: %{major_version}.%{minor_version}.%{update_version} -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist} +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.1 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -350,6 +350,9 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib ################################################################################ %changelog +* Tue Feb 27 2024 Jiri Vanek - 5.5.0-1.1 +- Rebuilt for java-21-openjdk as system jdk + * Wed Feb 21 2024 Dogtag PKI Team 5.5.0-1 - Rebase to JSS 5.5.0 From bfa1d7c37aa0e8a43b6e6b6b5ea4ff42f6ec23e5 Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Thu, 29 Feb 2024 19:08:28 -0800 Subject: [PATCH 63/77] Really build against java-21 --- jss.spec | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/jss.spec b/jss.spec index 1defcaa..3c07d98 100644 --- a/jss.spec +++ b/jss.spec @@ -12,7 +12,7 @@ Name: jss # Downstream release number: # - development/stabilization (unsupported): 0. where n >= 1 # - GA/update (supported): where n >= 1 -%global release_number 1 +%global release_number 2 # Development phase: # - development (unsupported): alpha where n >= 1 @@ -27,7 +27,7 @@ Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss License: (MPL-1.1 or GPL-2.0-or-later or LGPL-2.1-or-later) and Apache-2.0 Version: %{major_version}.%{minor_version}.%{update_version} -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.1 +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist} # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -55,9 +55,9 @@ ExcludeArch: i686 # Java ################################################################################ -%define java_devel java-17-openjdk-devel -%define java_headless java-17-openjdk-headless -%define java_home %{_jvmdir}/jre-17-openjdk +%define java_devel java-21-openjdk-devel +%define java_headless java-21-openjdk-headless +%define java_home %{_jvmdir}/jre-21-openjdk ################################################################################ # Build Options @@ -350,6 +350,9 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib ################################################################################ %changelog +* Thu Feb 29 2024 Adam Williamson - 5.5.0-2 +- Really build against java-21 + * Tue Feb 27 2024 Jiri Vanek - 5.5.0-1.1 - Rebuilt for java-21-openjdk as system jdk From ed7d60009d506aa3cbff950370e6a3b7fa641275 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 18 Jul 2024 11:12:28 +0000 Subject: [PATCH 64/77] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index 3c07d98..09a8f92 100644 --- a/jss.spec +++ b/jss.spec @@ -27,7 +27,7 @@ Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss License: (MPL-1.1 or GPL-2.0-or-later or LGPL-2.1-or-later) and Apache-2.0 Version: %{major_version}.%{minor_version}.%{update_version} -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist} +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.1 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -350,6 +350,9 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib ################################################################################ %changelog +* Thu Jul 18 2024 Fedora Release Engineering - 5.5.0-2.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Thu Feb 29 2024 Adam Williamson - 5.5.0-2 - Really build against java-21 From b9d8c115ccead49b38ca09eb9fed43d0a2b786f4 Mon Sep 17 00:00:00 2001 From: Jack Magne Date: Tue, 8 Oct 2024 14:20:45 -0700 Subject: [PATCH 65/77] Rebase to 5.5.1, in order to fix rawhide build issue. --- .gitignore | 1 + jss.spec | 6 ++++-- sources | 2 +- 3 files changed, 6 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 25ef8c4..411bfea 100644 --- a/.gitignore +++ b/.gitignore @@ -47,3 +47,4 @@ jss-4.2.6.tar.gz /jss-5.4.2.tar.gz /jss-5.5.0-alpha2.tar.gz /jss-5.5.0.tar.gz +/jss-5.5.1.tar.gz diff --git a/jss.spec b/jss.spec index 09a8f92..a8fc6ce 100644 --- a/jss.spec +++ b/jss.spec @@ -7,12 +7,12 @@ Name: jss # Upstream version number: %global major_version 5 %global minor_version 5 -%global update_version 0 +%global update_version 1 # Downstream release number: # - development/stabilization (unsupported): 0. where n >= 1 # - GA/update (supported): where n >= 1 -%global release_number 2 +%global release_number 1 # Development phase: # - development (unsupported): alpha where n >= 1 @@ -350,6 +350,8 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib ################################################################################ %changelog +* Fri Oct 04 2024 Dogtag PKI Team 5.5.1-1 +- Rebase to JSS 5.5.1 * Thu Jul 18 2024 Fedora Release Engineering - 5.5.0-2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild diff --git a/sources b/sources index 645ec2a..353a32d 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-5.5.0.tar.gz) = bda0b4df1ef08a264525c9124a29f57945e3a24adadda609b54032d840a1c311d522e34f29bb2246d03d493d108d425a64e4826edcc8a296a2f55b1cdd8a95c0 +SHA512 (jss-5.5.1.tar.gz) = 182c9b5f8b6c542278ff44e8573be902194a72c0e9621e2bcdb8df8770a165d83ed27d9189c4c8e66b7ed41cdfe7d66124ef6a056ea0be36ef202126cfce8be3 From 1f8ce4dbba00f3552912caf3dcfb120da1a5fecf Mon Sep 17 00:00:00 2001 From: Marco Fargetta Date: Wed, 20 Nov 2024 18:40:21 +0100 Subject: [PATCH 66/77] Rebase to JSS v5.6.0-alpha1 --- .gitignore | 1 + jss.spec | 44 +++++++++++++++++++++++++++++++++++++------- sources | 2 +- 3 files changed, 39 insertions(+), 8 deletions(-) diff --git a/.gitignore b/.gitignore index 411bfea..377c2aa 100644 --- a/.gitignore +++ b/.gitignore @@ -48,3 +48,4 @@ jss-4.2.6.tar.gz /jss-5.5.0-alpha2.tar.gz /jss-5.5.0.tar.gz /jss-5.5.1.tar.gz +/jss-5.6.0-alpha1.tar.gz diff --git a/jss.spec b/jss.spec index a8fc6ce..e4a38ca 100644 --- a/jss.spec +++ b/jss.spec @@ -2,32 +2,33 @@ Name: jss ################################################################################ -%global product_id dogtag-jss +%global vendor_id dogtag +%global product_id %{vendor_id}-jss # Upstream version number: %global major_version 5 -%global minor_version 5 -%global update_version 1 +%global minor_version 6 +%global update_version 0 # Downstream release number: # - development/stabilization (unsupported): 0. where n >= 1 # - GA/update (supported): where n >= 1 -%global release_number 1 +%global release_number 0.1 # Development phase: # - development (unsupported): alpha where n >= 1 # - stabilization (unsupported): beta where n >= 1 # - GA/update (supported): -#global phase +%global phase alpha1 %undefine timestamp %undefine commit_id Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss -License: (MPL-1.1 or GPL-2.0-or-later or LGPL-2.1-or-later) and Apache-2.0 +License: (MPL-1.1 OR GPL-2.0-or-later OR LGPL-2.1-or-later) AND Apache-2.0 Version: %{major_version}.%{minor_version}.%{update_version} -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.1 +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist} # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -159,6 +160,23 @@ JSS Connector for Tomcat is a Java Secure Socket Extension (JSSE) module for Apache Tomcat that uses Java Security Services (JSS), a Java interface to Network Security Services (NSS). +################################################################################ +%package -n %{product_id}-tools +################################################################################ + +Summary: Java Security Services (JSS) Tools + +Provides: jss-tools = %{version}-%{release} +Provides: jss-tools = %{major_version}.%{minor_version} +Provides: %{product_id}-tools = %{major_version}.%{minor_version} + +# Some PKI tools have been moved into jss-tools. +Conflicts: pki-tools < 11.6 +Conflicts: %{vendor_id}-pki-tools < 11.6 + +%description -n %{product_id}-tools +This package contains JSS tools. + %if %{with javadoc} ################################################################################ %package -n %{product_id}-javadoc @@ -332,6 +350,14 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib %files -n %{product_id}-tomcat -f .mfiles-jss-tomcat ################################################################################ +################################################################################ +%files -n %{product_id}-tools +################################################################################ + +%{_bindir}/p12tool +%{_bindir}/p7tool +%{_bindir}/sslget + %if %{with javadoc} ################################################################################ %files -n %{product_id}-javadoc -f .mfiles-javadoc @@ -350,8 +376,12 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib ################################################################################ %changelog +* Wed Nov 20 2024 Dogtag PKI Team 5.6.0-1 +- Rebase to JSS 5.6.0-alpha1 + * Fri Oct 04 2024 Dogtag PKI Team 5.5.1-1 - Rebase to JSS 5.5.1 + * Thu Jul 18 2024 Fedora Release Engineering - 5.5.0-2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild diff --git a/sources b/sources index 353a32d..8d8bc4b 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-5.5.1.tar.gz) = 182c9b5f8b6c542278ff44e8573be902194a72c0e9621e2bcdb8df8770a165d83ed27d9189c4c8e66b7ed41cdfe7d66124ef6a056ea0be36ef202126cfce8be3 +SHA512 (jss-5.6.0-alpha1.tar.gz) = 239952d7b1fc9d005760e9234aec84a84a02becefffa525853e9cccd5cfc88e6e0d9d2ea2eea59f43e3b6d1686878081eae1e615ed68d759b3c5aef7397a5472 From 9dfe730fd7da6e9d69c14312f867c6f5ef97f61b Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 17 Jan 2025 08:06:05 +0000 Subject: [PATCH 67/77] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index e4a38ca..155a73d 100644 --- a/jss.spec +++ b/jss.spec @@ -28,7 +28,7 @@ Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss License: (MPL-1.1 OR GPL-2.0-or-later OR LGPL-2.1-or-later) AND Apache-2.0 Version: %{major_version}.%{minor_version}.%{update_version} -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist} +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.1 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -376,6 +376,9 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib ################################################################################ %changelog +* Fri Jan 17 2025 Fedora Release Engineering - 5.6.0-0.1.alpha1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Wed Nov 20 2024 Dogtag PKI Team 5.6.0-1 - Rebase to JSS 5.6.0-alpha1 From 0b7b51984cfc72ea2536039d1a185dc4fd79c792 Mon Sep 17 00:00:00 2001 From: jmagne Date: Wed, 9 Jul 2025 15:20:54 -0700 Subject: [PATCH 68/77] Rebase to JSS 5.8.0-beta1. --- .gitignore | 1 + jss.spec | 54 +++++++++++++++++++++++++++++++++++++----------------- sources | 1 + 3 files changed, 39 insertions(+), 17 deletions(-) diff --git a/.gitignore b/.gitignore index 377c2aa..337a5da 100644 --- a/.gitignore +++ b/.gitignore @@ -49,3 +49,4 @@ jss-4.2.6.tar.gz /jss-5.5.0.tar.gz /jss-5.5.1.tar.gz /jss-5.6.0-alpha1.tar.gz +/jss-5.8.0-beta1.tar.gz diff --git a/jss.spec b/jss.spec index 155a73d..e66dbc6 100644 --- a/jss.spec +++ b/jss.spec @@ -7,7 +7,7 @@ Name: jss # Upstream version number: %global major_version 5 -%global minor_version 6 +%global minor_version 8 %global update_version 0 # Downstream release number: @@ -19,7 +19,7 @@ Name: jss # - development (unsupported): alpha where n >= 1 # - stabilization (unsupported): beta where n >= 1 # - GA/update (supported): -%global phase alpha1 +%global phase beta1 %undefine timestamp %undefine commit_id @@ -28,7 +28,7 @@ Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss License: (MPL-1.1 OR GPL-2.0-or-later OR LGPL-2.1-or-later) AND Apache-2.0 Version: %{major_version}.%{minor_version}.%{update_version} -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.1 +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist} # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -56,9 +56,26 @@ ExcludeArch: i686 # Java ################################################################################ +# use Java 17 on Fedora 39 or older and RHEL 9 or older +# otherwise, use Java 21 + +# maven-local is a subpackage of javapackages-tools + +%if 0%{?fedora} && 0%{?fedora} <= 39 || 0%{?rhel} && 0%{?rhel} <= 9 + +%define java_devel java-17-openjdk-devel +%define java_headless java-17-openjdk-headless +%define java_home %{_jvmdir}/jre-17-openjdk +%define maven_local maven-local-openjdk17 + +%else + %define java_devel java-21-openjdk-devel %define java_headless java-21-openjdk-headless %define java_home %{_jvmdir}/jre-21-openjdk +%define maven_local maven-local + +%endif ################################################################################ # Build Options @@ -84,11 +101,11 @@ BuildRequires: zip BuildRequires: unzip BuildRequires: gcc-c++ -BuildRequires: nss-devel >= 3.66 -BuildRequires: nss-tools >= 3.66 +BuildRequires: nss-devel >= 3.101 +BuildRequires: nss-tools >= 3.101 BuildRequires: %{java_devel} -BuildRequires: maven-local +BuildRequires: %{maven_local} BuildRequires: mvn(org.apache.commons:commons-lang3) BuildRequires: mvn(org.slf4j:slf4j-api) BuildRequires: mvn(org.slf4j:slf4j-jdk14) @@ -104,7 +121,7 @@ This only works with gcj. Other JREs require that JCE providers be signed. Summary: Java Security Services (JSS) -Requires: nss >= 3.66 +Requires: nss >= 3.101 Requires: %{java_headless} Requires: mvn(org.apache.commons:commons-lang3) @@ -132,21 +149,21 @@ This only works with gcj. Other JREs require that JCE providers be signed. Summary: Java Security Services (JSS) Connector for Tomcat # Tomcat -BuildRequires: mvn(org.apache.tomcat:tomcat-catalina) >= 9.0.62 -BuildRequires: mvn(org.apache.tomcat:tomcat-coyote) >= 9.0.62 -BuildRequires: mvn(org.apache.tomcat:tomcat-juli) >= 9.0.62 +BuildRequires: mvn(org.apache.tomcat:tomcat-catalina) >= 10.1.33 +BuildRequires: mvn(org.apache.tomcat:tomcat-coyote) >= 10.1.33 +BuildRequires: mvn(org.apache.tomcat:tomcat-juli) >= 10.1.33 Requires: %{product_id} = %{version}-%{release} -Requires: mvn(org.apache.tomcat:tomcat-catalina) >= 9.0.62 -Requires: mvn(org.apache.tomcat:tomcat-coyote) >= 9.0.62 -Requires: mvn(org.apache.tomcat:tomcat-juli) >= 9.0.62 +Requires: mvn(org.apache.tomcat:tomcat-catalina) >= 10.1.33 +Requires: mvn(org.apache.tomcat:tomcat-coyote) >= 10.1.33 +Requires: mvn(org.apache.tomcat:tomcat-juli) >= 10.1.33 # Tomcat JSS has been replaced with JSS Connector for Tomcat. # This will remove installed Tomcat JSS packages. Obsoletes: tomcatjss <= 8.5 Conflicts: tomcatjss <= 8.5 -Obsoletes: dogtag-tomcatjss <= 8.5 -Conflicts: dogtag-tomcatjss <= 8.5 +Obsoletes: %{vendor_id}-tomcatjss <= 8.5 +Conflicts: %{vendor_id}-tomcatjss <= 8.5 %if 0%{?rhel} <= 8 # PKI Servlet Engine has been replaced with Tomcat. @@ -227,11 +244,11 @@ This package provides test suite for JSS. # specify Maven artifact locations %mvn_file org.dogtagpki.jss:jss-tomcat jss/jss-tomcat -%mvn_file org.dogtagpki.jss:jss-tomcat-9.0 jss/jss-tomcat-9.0 +%mvn_file org.dogtagpki.jss:jss-tomcat-10.1 jss/jss-tomcat-10.1 # specify Maven artifact packages %mvn_package org.dogtagpki.jss:jss-tomcat jss-tomcat -%mvn_package org.dogtagpki.jss:jss-tomcat-9.0 jss-tomcat +%mvn_package org.dogtagpki.jss:jss-tomcat-10.1 jss-tomcat ################################################################################ %build @@ -376,6 +393,9 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib ################################################################################ %changelog +* Wed Jul 09 2025 Dogtag PKI Team 5.8.0.1 +- Rebase to JSS 5.8.0-beta1 + * Fri Jan 17 2025 Fedora Release Engineering - 5.6.0-0.1.alpha1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild diff --git a/sources b/sources index 8d8bc4b..45d1760 100644 --- a/sources +++ b/sources @@ -1 +1,2 @@ SHA512 (jss-5.6.0-alpha1.tar.gz) = 239952d7b1fc9d005760e9234aec84a84a02becefffa525853e9cccd5cfc88e6e0d9d2ea2eea59f43e3b6d1686878081eae1e615ed68d759b3c5aef7397a5472 +SHA512 (jss-5.8.0-beta1.tar.gz) = 7890b416218260d215ae80082a05a6c59b3671603ed64afd3ed1e20da20577c34674f53622a075073c568003f3f8dcb05b7b447bd1e32d39292e5e613cbfe894 From 8bbbf53ca8f46fe0c837ad9231ade2504a2d4ac0 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 24 Jul 2025 18:07:42 +0000 Subject: [PATCH 69/77] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index e66dbc6..4272d4a 100644 --- a/jss.spec +++ b/jss.spec @@ -28,7 +28,7 @@ Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss License: (MPL-1.1 OR GPL-2.0-or-later OR LGPL-2.1-or-later) AND Apache-2.0 Version: %{major_version}.%{minor_version}.%{update_version} -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist} +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.1 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -393,6 +393,9 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib ################################################################################ %changelog +* Thu Jul 24 2025 Fedora Release Engineering - 5.8.0-0.1.beta1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Wed Jul 09 2025 Dogtag PKI Team 5.8.0.1 - Rebase to JSS 5.8.0-beta1 From 40255d963a2044724a3285e8787c303e378dfd1f Mon Sep 17 00:00:00 2001 From: jmagne Date: Mon, 28 Jul 2025 17:27:07 -0700 Subject: [PATCH 70/77] Rebase to JSS 5.8.0-beta3 --- .gitignore | 1 + jss.spec | 19 +++++++++++-------- sources | 1 + 3 files changed, 13 insertions(+), 8 deletions(-) diff --git a/.gitignore b/.gitignore index 337a5da..129463a 100644 --- a/.gitignore +++ b/.gitignore @@ -50,3 +50,4 @@ jss-4.2.6.tar.gz /jss-5.5.1.tar.gz /jss-5.6.0-alpha1.tar.gz /jss-5.8.0-beta1.tar.gz +/jss-5.8.0-beta3.tar.gz diff --git a/jss.spec b/jss.spec index 4272d4a..243725a 100644 --- a/jss.spec +++ b/jss.spec @@ -13,13 +13,13 @@ Name: jss # Downstream release number: # - development/stabilization (unsupported): 0. where n >= 1 # - GA/update (supported): where n >= 1 -%global release_number 0.1 +%global release_number 0.3 # Development phase: # - development (unsupported): alpha where n >= 1 # - stabilization (unsupported): beta where n >= 1 # - GA/update (supported): -%global phase beta1 +%global phase beta3 %undefine timestamp %undefine commit_id @@ -149,14 +149,14 @@ This only works with gcj. Other JREs require that JCE providers be signed. Summary: Java Security Services (JSS) Connector for Tomcat # Tomcat -BuildRequires: mvn(org.apache.tomcat:tomcat-catalina) >= 10.1.33 -BuildRequires: mvn(org.apache.tomcat:tomcat-coyote) >= 10.1.33 -BuildRequires: mvn(org.apache.tomcat:tomcat-juli) >= 10.1.33 +BuildRequires: mvn(org.apache.tomcat:tomcat-catalina) >= 10.1.43 +BuildRequires: mvn(org.apache.tomcat:tomcat-coyote) >= 10.1.43 +BuildRequires: mvn(org.apache.tomcat:tomcat-juli) >= 10.1.43 Requires: %{product_id} = %{version}-%{release} -Requires: mvn(org.apache.tomcat:tomcat-catalina) >= 10.1.33 -Requires: mvn(org.apache.tomcat:tomcat-coyote) >= 10.1.33 -Requires: mvn(org.apache.tomcat:tomcat-juli) >= 10.1.33 +Requires: mvn(org.apache.tomcat:tomcat-catalina) >= 10.1.43 +Requires: mvn(org.apache.tomcat:tomcat-coyote) >= 10.1.43 +Requires: mvn(org.apache.tomcat:tomcat-juli) >= 10.1.43 # Tomcat JSS has been replaced with JSS Connector for Tomcat. # This will remove installed Tomcat JSS packages. @@ -393,6 +393,9 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib ################################################################################ %changelog +* Mon Jul 28 2025 Dogtag PKI Team 5.8.0.3 +- Rebase to JSS 5.8.0-beta3 + * Thu Jul 24 2025 Fedora Release Engineering - 5.8.0-0.1.beta1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild diff --git a/sources b/sources index 45d1760..94e6cfe 100644 --- a/sources +++ b/sources @@ -1,2 +1,3 @@ SHA512 (jss-5.6.0-alpha1.tar.gz) = 239952d7b1fc9d005760e9234aec84a84a02becefffa525853e9cccd5cfc88e6e0d9d2ea2eea59f43e3b6d1686878081eae1e615ed68d759b3c5aef7397a5472 SHA512 (jss-5.8.0-beta1.tar.gz) = 7890b416218260d215ae80082a05a6c59b3671603ed64afd3ed1e20da20577c34674f53622a075073c568003f3f8dcb05b7b447bd1e32d39292e5e613cbfe894 +SHA512 (jss-5.8.0-beta3.tar.gz) = 6647ff938d69e39d2ad5f9bb00e03f7fee25c37ba6e4d13700266bdc6c82770927e87ebe486b6bc3378c3368b25db70481ad9d63fd1dd6c9a76e7affd8a127e6 From 6b95178e1edf7854ddf71f5fbe476db9c8eafcba Mon Sep 17 00:00:00 2001 From: Jiri Vanek Date: Wed, 30 Jul 2025 00:01:21 +0200 Subject: [PATCH 71/77] Rebuilt for java-25-openjdk as preffered jdk https://fedoraproject.org/wiki/Changes/Java25AndNoMoreSystemJdk Note, that since f43, you should be always explicit on what jdk to use. This commit should do exactly that. --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index 243725a..6694a9d 100644 --- a/jss.spec +++ b/jss.spec @@ -28,7 +28,7 @@ Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss License: (MPL-1.1 OR GPL-2.0-or-later OR LGPL-2.1-or-later) AND Apache-2.0 Version: %{major_version}.%{minor_version}.%{update_version} -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.1 +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.2 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -393,6 +393,9 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib ################################################################################ %changelog +* Tue Jul 29 2025 jiri vanek - 5.8.0-0.3.beta3.2 +- Rebuilt for java-25-openjdk as preffered jdk + * Mon Jul 28 2025 Dogtag PKI Team 5.8.0.3 - Rebase to JSS 5.8.0-beta3 From 574fd4442eaedad7bbf56137edeb22ede75671d1 Mon Sep 17 00:00:00 2001 From: Jiri Vanek Date: Wed, 30 Jul 2025 14:08:08 +0200 Subject: [PATCH 72/77] Rrevert to jdk21 during rebuild for https://fedoraproject.org/wiki/Changes/Java25AndNoMoreSystemJdk your package failed to build. Is preemptively reverted back to versioned jdk21 --- jss.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index 6694a9d..033f464 100644 --- a/jss.spec +++ b/jss.spec @@ -28,7 +28,7 @@ Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss License: (MPL-1.1 OR GPL-2.0-or-later OR LGPL-2.1-or-later) AND Apache-2.0 Version: %{major_version}.%{minor_version}.%{update_version} -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.2 +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.3 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -393,6 +393,9 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib ################################################################################ %changelog +* Wed Jul 30 2025 jiri vanek - 5.8.0-0.3.beta3.3 +- Rrevert to jdk21 + * Tue Jul 29 2025 jiri vanek - 5.8.0-0.3.beta3.2 - Rebuilt for java-25-openjdk as preffered jdk From 591b9b8293c8071fe86c09529a53e88c209978a9 Mon Sep 17 00:00:00 2001 From: jmagne Date: Mon, 11 Aug 2025 16:01:16 -0700 Subject: [PATCH 73/77] Rebase to JSS 5.8.0-beta4 --- .gitignore | 1 + jss.spec | 39 ++++++++++++++++++++------------------- sources | 1 + 3 files changed, 22 insertions(+), 19 deletions(-) diff --git a/.gitignore b/.gitignore index 129463a..0bac5df 100644 --- a/.gitignore +++ b/.gitignore @@ -51,3 +51,4 @@ jss-4.2.6.tar.gz /jss-5.6.0-alpha1.tar.gz /jss-5.8.0-beta1.tar.gz /jss-5.8.0-beta3.tar.gz +/jss-5.8.0-beta4.tar.gz diff --git a/jss.spec b/jss.spec index 033f464..d31e1f5 100644 --- a/jss.spec +++ b/jss.spec @@ -13,13 +13,17 @@ Name: jss # Downstream release number: # - development/stabilization (unsupported): 0. where n >= 1 # - GA/update (supported): where n >= 1 -%global release_number 0.3 +%global release_number 0.4 # Development phase: # - development (unsupported): alpha where n >= 1 # - stabilization (unsupported): beta where n >= 1 # - GA/update (supported): -%global phase beta3 +%global phase beta4 + +%if 0%{?rhel} && 0%{?rhel} >= 10 +%global enable_nss_version_pqc_def_flag -DENABLE_NSS_VERSION_PQC_DEF=ON +%endif %undefine timestamp %undefine commit_id @@ -28,7 +32,7 @@ Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss License: (MPL-1.1 OR GPL-2.0-or-later OR LGPL-2.1-or-later) AND Apache-2.0 Version: %{major_version}.%{minor_version}.%{update_version} -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.3 +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.1 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -61,12 +65,12 @@ ExcludeArch: i686 # maven-local is a subpackage of javapackages-tools -%if 0%{?fedora} && 0%{?fedora} <= 39 || 0%{?rhel} && 0%{?rhel} <= 9 +%if 0%{?fedora} && 0%{?fedora} >= 43 -%define java_devel java-17-openjdk-devel -%define java_headless java-17-openjdk-headless -%define java_home %{_jvmdir}/jre-17-openjdk -%define maven_local maven-local-openjdk17 +%define java_devel java-25-openjdk-devel +%define java_headless java-25-openjdk-headless +%define java_home %{_jvmdir}/jre-25-openjdk +%define maven_local maven-local-openjdk25 %else @@ -149,14 +153,14 @@ This only works with gcj. Other JREs require that JCE providers be signed. Summary: Java Security Services (JSS) Connector for Tomcat # Tomcat -BuildRequires: mvn(org.apache.tomcat:tomcat-catalina) >= 10.1.43 -BuildRequires: mvn(org.apache.tomcat:tomcat-coyote) >= 10.1.43 -BuildRequires: mvn(org.apache.tomcat:tomcat-juli) >= 10.1.43 +BuildRequires: mvn(org.apache.tomcat:tomcat-catalina) >= 10.1.36 +BuildRequires: mvn(org.apache.tomcat:tomcat-coyote) >= 10.1.36 +BuildRequires: mvn(org.apache.tomcat:tomcat-juli) >= 10.1.36 Requires: %{product_id} = %{version}-%{release} -Requires: mvn(org.apache.tomcat:tomcat-catalina) >= 10.1.43 -Requires: mvn(org.apache.tomcat:tomcat-coyote) >= 10.1.43 -Requires: mvn(org.apache.tomcat:tomcat-juli) >= 10.1.43 +Requires: mvn(org.apache.tomcat:tomcat-catalina) >= 10.1.36 +Requires: mvn(org.apache.tomcat:tomcat-coyote) >= 10.1.36 +Requires: mvn(org.apache.tomcat:tomcat-juli) >= 10.1.36 # Tomcat JSS has been replaced with JSS Connector for Tomcat. # This will remove installed Tomcat JSS packages. @@ -393,11 +397,8 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib ################################################################################ %changelog -* Wed Jul 30 2025 jiri vanek - 5.8.0-0.3.beta3.3 -- Rrevert to jdk21 - -* Tue Jul 29 2025 jiri vanek - 5.8.0-0.3.beta3.2 -- Rebuilt for java-25-openjdk as preffered jdk +* Mon Aug 11 2025 Dogtag PKI Team 5.8.0.4 +- Rebase to JSS 5.8.0-beta4 * Mon Jul 28 2025 Dogtag PKI Team 5.8.0.3 - Rebase to JSS 5.8.0-beta3 diff --git a/sources b/sources index 94e6cfe..fc75bdf 100644 --- a/sources +++ b/sources @@ -1,3 +1,4 @@ SHA512 (jss-5.6.0-alpha1.tar.gz) = 239952d7b1fc9d005760e9234aec84a84a02becefffa525853e9cccd5cfc88e6e0d9d2ea2eea59f43e3b6d1686878081eae1e615ed68d759b3c5aef7397a5472 SHA512 (jss-5.8.0-beta1.tar.gz) = 7890b416218260d215ae80082a05a6c59b3671603ed64afd3ed1e20da20577c34674f53622a075073c568003f3f8dcb05b7b447bd1e32d39292e5e613cbfe894 SHA512 (jss-5.8.0-beta3.tar.gz) = 6647ff938d69e39d2ad5f9bb00e03f7fee25c37ba6e4d13700266bdc6c82770927e87ebe486b6bc3378c3368b25db70481ad9d63fd1dd6c9a76e7affd8a127e6 +SHA512 (jss-5.8.0-beta4.tar.gz) = cec7515c4496926303c3b1835d301174588298c8ef1c1cb2bc8fd95683833765d88de5b77af44e418fa953643d2a2d38cc2bd8888abadfc1bd1553e2b33c6268 From 309eeda6384576295e7d4248aa91564403d1a0ec Mon Sep 17 00:00:00 2001 From: Super User Date: Wed, 20 Aug 2025 14:36:12 +0000 Subject: [PATCH 74/77] Rebuild for Fedora 43 --- jss.spec | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/jss.spec b/jss.spec index d31e1f5..c9947c7 100644 --- a/jss.spec +++ b/jss.spec @@ -13,7 +13,7 @@ Name: jss # Downstream release number: # - development/stabilization (unsupported): 0. where n >= 1 # - GA/update (supported): where n >= 1 -%global release_number 0.4 +%global release_number 0.5 # Development phase: # - development (unsupported): alpha where n >= 1 @@ -32,7 +32,7 @@ Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss License: (MPL-1.1 OR GPL-2.0-or-later OR LGPL-2.1-or-later) AND Apache-2.0 Version: %{major_version}.%{minor_version}.%{update_version} -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.1 +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist} # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -397,10 +397,13 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib ################################################################################ %changelog -* Mon Aug 11 2025 Dogtag PKI Team 5.8.0.4 +* Mon Aug 11 2025 Dogtag PKI Team 5.8.0-0.5.beta4 +- Rebuild for Fedora 43 + +* Mon Aug 11 2025 Dogtag PKI Team 5.8.0-0.4.beta4.1 - Rebase to JSS 5.8.0-beta4 -* Mon Jul 28 2025 Dogtag PKI Team 5.8.0.3 +* Mon Jul 28 2025 Dogtag PKI Team 5.8.0-0.3.beta3.1 - Rebase to JSS 5.8.0-beta3 * Thu Jul 24 2025 Fedora Release Engineering - 5.8.0-0.1.beta1.1 From f0361ba6e7debd8efbd65f9bd8643a4f7f878c64 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Fri, 22 Aug 2025 00:05:05 -0400 Subject: [PATCH 75/77] Build with Java 25 for ELN ELN (the future RHEL 11) tracks rawhide and includes the relevant change: https://fedoraproject.org/wiki/Changes/Java25AndNoMoreSystemJdk --- jss.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/jss.spec b/jss.spec index c9947c7..ac6fed7 100644 --- a/jss.spec +++ b/jss.spec @@ -13,7 +13,7 @@ Name: jss # Downstream release number: # - development/stabilization (unsupported): 0. where n >= 1 # - GA/update (supported): where n >= 1 -%global release_number 0.5 +%global release_number 0.6 # Development phase: # - development (unsupported): alpha where n >= 1 @@ -65,7 +65,7 @@ ExcludeArch: i686 # maven-local is a subpackage of javapackages-tools -%if 0%{?fedora} && 0%{?fedora} >= 43 +%if 0%{?fedora} && 0%{?fedora} >= 43 || 0%{?rhel} >= 11 %define java_devel java-25-openjdk-devel %define java_headless java-25-openjdk-headless @@ -397,6 +397,9 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib ################################################################################ %changelog +* Fri Aug 22 2025 Yaakov Selkowitz - 5.8.0-0.6.beta4 +- Build with Java 25 for ELN + * Mon Aug 11 2025 Dogtag PKI Team 5.8.0-0.5.beta4 - Rebuild for Fedora 43 From df09f023d4bd3db32e405738b789f8c9a146a949 Mon Sep 17 00:00:00 2001 From: Marco Fargetta Date: Tue, 4 Nov 2025 10:39:09 +0100 Subject: [PATCH 76/77] Rebase to 5.8.0 --- .gitignore | 1 + jss-5.4.2-nss-3.97.patch | 40 ---------------------------------------- jss.spec | 9 ++++++--- sources | 5 +---- 4 files changed, 8 insertions(+), 47 deletions(-) delete mode 100644 jss-5.4.2-nss-3.97.patch diff --git a/.gitignore b/.gitignore index 0bac5df..edcc16f 100644 --- a/.gitignore +++ b/.gitignore @@ -52,3 +52,4 @@ jss-4.2.6.tar.gz /jss-5.8.0-beta1.tar.gz /jss-5.8.0-beta3.tar.gz /jss-5.8.0-beta4.tar.gz +/jss-5.8.0.tar.gz diff --git a/jss-5.4.2-nss-3.97.patch b/jss-5.4.2-nss-3.97.patch deleted file mode 100644 index 8b9d64d..0000000 --- a/jss-5.4.2-nss-3.97.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 130d543f3a7c33196bef386b4ee87ccc4ed53d0b Mon Sep 17 00:00:00 2001 -From: "Endi S. Dewata" -Date: Wed, 7 Feb 2024 14:59:31 -0600 -Subject: [PATCH] Update kea_alg_defs to match NSS 3.97 - -The kea_alg_defs array in SSLCipher.c has been updated to match -the one defined in NSS 3.97. The assertion that compares the size -of the array with ssl_kea_size has also been removed. These -changes will allow JSS to work with the newer NSS 3.97 on Fedora -Rawhide as well as the older NSS versions on other platforms. - -Resolves: https://github.com/dogtagpki/jss/issues/991 ---- - native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c b/native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c -index 4f2dacb0b..ea739617a 100644 ---- a/native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c -+++ b/native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c -@@ -23,7 +23,7 @@ static const CK_MECHANISM_TYPE auth_alg_defs[] = { - }; - PR_STATIC_ASSERT(PR_ARRAY_SIZE(auth_alg_defs) == ssl_auth_size); - --/* Copied from NSS's ssl3con.c. */ -+/* Copied from NSS 3.97's ssl3con.c. */ - static const CK_MECHANISM_TYPE kea_alg_defs[] = { - CKM_INVALID_MECHANISM, /* ssl_kea_null */ - CKM_RSA_PKCS, /* ssl_kea_rsa */ -@@ -33,8 +33,9 @@ static const CK_MECHANISM_TYPE kea_alg_defs[] = { - CKM_ECDH1_DERIVE, /* ssl_kea_ecdh_psk */ - CKM_DH_PKCS_DERIVE, /* ssl_kea_dh_psk */ - CKM_INVALID_MECHANISM, /* ssl_kea_tls13_any */ -+ CKM_INVALID_MECHANISM, /* ssl_kea_ecdh_hybrid */ -+ CKM_INVALID_MECHANISM, /* ssl_kea_ecdh_hybrid_psk */ - }; --PR_STATIC_ASSERT(PR_ARRAY_SIZE(kea_alg_defs) == ssl_kea_size); - - #ifdef HAVE_NSS_CIPHER_SUITE_INFO_KDFHASH - /* Not present in ssl3con.c. */ diff --git a/jss.spec b/jss.spec index ac6fed7..3300948 100644 --- a/jss.spec +++ b/jss.spec @@ -13,13 +13,13 @@ Name: jss # Downstream release number: # - development/stabilization (unsupported): 0. where n >= 1 # - GA/update (supported): where n >= 1 -%global release_number 0.6 +%global release_number 1 # Development phase: # - development (unsupported): alpha where n >= 1 # - stabilization (unsupported): beta where n >= 1 # - GA/update (supported): -%global phase beta4 +#global phase %if 0%{?rhel} && 0%{?rhel} >= 10 %global enable_nss_version_pqc_def_flag -DENABLE_NSS_VERSION_PQC_DEF=ON @@ -314,7 +314,7 @@ touch %{_vpath_builddir}/.targets/finished_generate_javadocs --lib-dir=%{_libdir} \ --sysconf-dir=%{_sysconfdir} \ --share-dir=%{_datadir} \ - --cmake=%{__cmake} \ + --cmake="%{__cmake} %{?enable_nss_version_pqc_def_flag}" \ --java-home=%{java_home} \ --jni-dir=%{_jnidir} \ --version=%{version} \ @@ -397,6 +397,9 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib ################################################################################ %changelog +* TueNov 04 2025 Dogtag PKI Team 5.8.0-1 +- Rebase to JSS 5.8.0-1 + * Fri Aug 22 2025 Yaakov Selkowitz - 5.8.0-0.6.beta4 - Build with Java 25 for ELN diff --git a/sources b/sources index fc75bdf..f69b2ec 100644 --- a/sources +++ b/sources @@ -1,4 +1 @@ -SHA512 (jss-5.6.0-alpha1.tar.gz) = 239952d7b1fc9d005760e9234aec84a84a02becefffa525853e9cccd5cfc88e6e0d9d2ea2eea59f43e3b6d1686878081eae1e615ed68d759b3c5aef7397a5472 -SHA512 (jss-5.8.0-beta1.tar.gz) = 7890b416218260d215ae80082a05a6c59b3671603ed64afd3ed1e20da20577c34674f53622a075073c568003f3f8dcb05b7b447bd1e32d39292e5e613cbfe894 -SHA512 (jss-5.8.0-beta3.tar.gz) = 6647ff938d69e39d2ad5f9bb00e03f7fee25c37ba6e4d13700266bdc6c82770927e87ebe486b6bc3378c3368b25db70481ad9d63fd1dd6c9a76e7affd8a127e6 -SHA512 (jss-5.8.0-beta4.tar.gz) = cec7515c4496926303c3b1835d301174588298c8ef1c1cb2bc8fd95683833765d88de5b77af44e418fa953643d2a2d38cc2bd8888abadfc1bd1553e2b33c6268 +SHA512 (jss-5.8.0.tar.gz) = 10f5727d78f8b466062396e47c25b7fdac4b70c6862e6857f8aef49b633c43c4485c1d3cd535006ecd090e8dfe787000fb40d8748ed381c4ac4d1d39312e6c3d From 6f9dba75c99de8e629ac4488be635e76280f731c Mon Sep 17 00:00:00 2001 From: Marco Fargetta Date: Tue, 4 Nov 2025 11:08:07 +0100 Subject: [PATCH 77/77] Fix changelog --- jss.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/jss.spec b/jss.spec index 3300948..794ee73 100644 --- a/jss.spec +++ b/jss.spec @@ -397,7 +397,7 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib ################################################################################ %changelog -* TueNov 04 2025 Dogtag PKI Team 5.8.0-1 +* Tue Nov 04 2025 Dogtag PKI Team 5.8.0-1 - Rebase to JSS 5.8.0-1 * Fri Aug 22 2025 Yaakov Selkowitz - 5.8.0-0.6.beta4