From b2b801ae83ac831d771bf05124e8f14622d75fc6 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 4 Mar 2020 12:01:29 -0500 Subject: [PATCH 01/14] Add fixes for KRA issues Signed-off-by: Alexander Scheel --- ...Fix-swapped-parameter-names-with-PBE.patch | 80 +++++++++++++++++++ ...-Use-specified-algorithm-for-KeyWrap.patch | 60 ++++++++++++++ jss.spec | 9 ++- 3 files changed, 147 insertions(+), 2 deletions(-) create mode 100644 0002-Fix-swapped-parameter-names-with-PBE.patch create mode 100644 0003-Use-specified-algorithm-for-KeyWrap.patch diff --git a/0002-Fix-swapped-parameter-names-with-PBE.patch b/0002-Fix-swapped-parameter-names-with-PBE.patch new file mode 100644 index 0000000..c535f6e --- /dev/null +++ b/0002-Fix-swapped-parameter-names-with-PBE.patch @@ -0,0 +1,80 @@ +From 9f29430656342829822568f4ef49f5237b41164b Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Fri, 28 Feb 2020 14:10:32 -0500 +Subject: [PATCH 7/8] Fix swapped parameter names with PBE + +Commit 13998a9e77e60d6509ac814ed711dd21e1248ecd introduced a regression +related to extracting the parameter classes during PBE operations: +previously, the classes of the underlying encryption algorithm were +iterated over, instead of the classes of the PBE class itself. However, +this commit iterated over the PBE parameter classes; no PBE algorithm +accepts a IvParameterSpec, resulting in a null parameter passed to the +later encryption or key wrap operation. This resulted in stack traces +like the following: + +Caused by: java.security.InvalidAlgorithmParameterException: DES3/CBC/Pad cannot use a null parameter + at org.mozilla.jss.pkcs11.PK11KeyWrapper.checkParams(PK11KeyWrapper.java:225) + at org.mozilla.jss.pkcs11.PK11KeyWrapper.initWrap(PK11KeyWrapper.java:89) + at org.mozilla.jss.pkcs11.PK11KeyWrapper.initWrap(PK11KeyWrapper.java:57) + at org.mozilla.jss.pkix.primitive.EncryptedPrivateKeyInfo.createPBE(EncryptedPrivateKeyInfo.java:342) + +Resolves: rh-bz#1807371 + +Signed-off-by: Alexander Scheel +--- + org/mozilla/jss/pkcs7/EncryptedContentInfo.java | 2 +- + org/mozilla/jss/pkix/cms/EncryptedContentInfo.java | 2 +- + org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++-- + 3 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/org/mozilla/jss/pkcs7/EncryptedContentInfo.java b/org/mozilla/jss/pkcs7/EncryptedContentInfo.java +index 084752c3..0344b14d 100644 +--- a/org/mozilla/jss/pkcs7/EncryptedContentInfo.java ++++ b/org/mozilla/jss/pkcs7/EncryptedContentInfo.java +@@ -182,7 +182,7 @@ public class EncryptedContentInfo implements ASN1Value { + // generate IV + EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); + AlgorithmParameterSpec params=null; +- Class [] paramClasses = pbeAlg.getParameterClasses(); ++ Class [] paramClasses = encAlg.getParameterClasses(); + for (int i = 0; i < paramClasses.length; i ++) { + if ( paramClasses[i].equals( + javax.crypto.spec.IvParameterSpec.class ) ) { +diff --git a/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java b/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java +index a4709070..d85eb0d3 100644 +--- a/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java ++++ b/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java +@@ -180,7 +180,7 @@ public class EncryptedContentInfo implements ASN1Value { + // generate IV + EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); + AlgorithmParameterSpec params=null; +- Class [] paramClasses = pbeAlg.getParameterClasses(); ++ Class [] paramClasses = encAlg.getParameterClasses(); + for (int i = 0; i < paramClasses.length; i ++) { + if ( paramClasses[i].equals( IVParameterSpec.class ) ) { + params = new IVParameterSpec( kg.generatePBE_IV() ); +diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +index b35714e3..ebd269f3 100644 +--- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java ++++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +@@ -147,7 +147,7 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { + // generate IV + EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); + AlgorithmParameterSpec params=null; +- Class [] paramClasses = pbeAlg.getParameterClasses(); ++ Class [] paramClasses = encAlg.getParameterClasses(); + for (int i = 0; i < paramClasses.length; i ++) { + if ( paramClasses[i].equals( javax.crypto.spec.IvParameterSpec.class ) ) { + params = new IVParameterSpec( kg.generatePBE_IV() ); +@@ -328,7 +328,7 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { + // generate IV + EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); + AlgorithmParameterSpec params=null; +- Class [] paramClasses = pbeAlg.getParameterClasses(); ++ Class [] paramClasses = encAlg.getParameterClasses(); + for (int i = 0; i < paramClasses.length; i ++) { + if ( paramClasses[i].equals( + javax.crypto.spec.IvParameterSpec.class ) ) { +-- +2.24.1 + diff --git a/0003-Use-specified-algorithm-for-KeyWrap.patch b/0003-Use-specified-algorithm-for-KeyWrap.patch new file mode 100644 index 0000000..d75534a --- /dev/null +++ b/0003-Use-specified-algorithm-for-KeyWrap.patch @@ -0,0 +1,60 @@ +From 55482c8bfa0addeb9db7b590703ba3704c5db167 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Fri, 28 Feb 2020 14:39:29 -0500 +Subject: [PATCH 8/8] Use specified algorithm for KeyWrap + +When the token-specified from of EncryptedPrivateKeyInfo.createPBE is +called, it would always request DES3_CBC_PAD as the key wrapping +algorithm, regardless of the input PBE key type. However, the other form +(with an implicit token) was correctly handling this case. + +Introduces a new KeyWrapAlgorithm method to take an OBJECT_IDENTIFIER +instead of having to convert to/from a String form. + +Signed-off-by: Alexander Scheel +--- + org/mozilla/jss/crypto/KeyWrapAlgorithm.java | 5 ++++- + org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++-- + 2 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java +index 3113f614..3a106977 100644 +--- a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java ++++ b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java +@@ -138,7 +138,10 @@ public class KeyWrapAlgorithm extends Algorithm { + + public static KeyWrapAlgorithm fromOID(String wrapOID) throws NoSuchAlgorithmException { + OBJECT_IDENTIFIER oid = new OBJECT_IDENTIFIER(wrapOID); ++ return fromOID(oid); ++ } + ++ public static KeyWrapAlgorithm fromOID(OBJECT_IDENTIFIER oid) throws NoSuchAlgorithmException { + if (oid.equals(AES_KEY_WRAP_PAD_OID)) + return AES_KEY_WRAP_PAD; + +@@ -154,6 +157,6 @@ public class KeyWrapAlgorithm extends Algorithm { + if (oid.equals(DES_CBC_PAD_OID)) + return DES_CBC_PAD; + +- throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + wrapOID); ++ throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + oid); + } + } +diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +index ebd269f3..abfc39a7 100644 +--- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java ++++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java +@@ -337,8 +337,8 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { + } + } + +- KeyWrapper wrapper = token.getKeyWrapper( +- KeyWrapAlgorithm.DES3_CBC_PAD); ++ // wrap the key ++ KeyWrapper wrapper = token.getKeyWrapper(KeyWrapAlgorithm.fromOID(encAlg.toOID())); + wrapper.initWrap(key, params); + byte encrypted[] = wrapper.wrap(pri); + +-- +2.24.1 + diff --git a/jss.spec b/jss.spec index 536e1db..da423a5 100644 --- a/jss.spec +++ b/jss.spec @@ -7,7 +7,7 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.6.2 -Release: 3%{?_timestamp}%{?_commit_id}%{?dist} +Release: 4%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 # To generate the source tarball: @@ -25,7 +25,9 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch -Patch: 0001-Fix-NativeProxy-reference-tracker.patch +Patch0: 0001-Fix-NativeProxy-reference-tracker.patch +Patch1: 0002-Fix-swapped-parameter-names-with-PBE.patch +Patch2: 0003-Use-specified-algorithm-for-KeyWrap.patch ################################################################################ # Build Dependencies @@ -160,6 +162,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Wed Mar 04 2020 Dogtag PKI Team - 4.6.2-4 +- Fix for PBE errors + * Tue Jan 28 2020 Dogtag PKI Team - 4.6.2-3 - Rebuild with new NSS to fix rhbz#1794814 From fa5977c0f1cfc3e047af82bac1d5a90ddd47879d Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Thu, 5 Mar 2020 10:22:02 -0500 Subject: [PATCH 02/14] Rebase to JSS v4.6.3 This cherry-picks commit 53c7b90df429ae7050bab67118bf53dbfc00b016 from master. Signed-off-by: Alexander Scheel --- .gitignore | 1 + 0001-Fix-NativeProxy-reference-tracker.patch | 53 -------------------- 0001-Fix-base64-encoding-of-CSRs.patch | 39 ++++++++++++++ jss.spec | 10 ++-- sources | 2 +- 5 files changed, 48 insertions(+), 57 deletions(-) delete mode 100644 0001-Fix-NativeProxy-reference-tracker.patch create mode 100644 0001-Fix-base64-encoding-of-CSRs.patch diff --git a/.gitignore b/.gitignore index 5981ea6..77527dc 100644 --- a/.gitignore +++ b/.gitignore @@ -23,3 +23,4 @@ jss-4.2.6.tar.gz /jss-4.5.3.tar.gz /jss-4.6.1.tar.gz /jss-4.6.2.tar.gz +/jss-4.6.3.tar.gz diff --git a/0001-Fix-NativeProxy-reference-tracker.patch b/0001-Fix-NativeProxy-reference-tracker.patch deleted file mode 100644 index 529b576..0000000 --- a/0001-Fix-NativeProxy-reference-tracker.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 91514ca0a2979ba778d27220ced0cd312e2cd2d2 Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Tue, 29 Oct 2019 10:43:56 -0400 -Subject: [PATCH] Fix NativeProxy reference tracker - -In eb5df01003d74b57473eacb84e538d31f5bb06ca, I introduced a bug by -setting mPointer after trying to add NativeProxy to the registry. In -most instances this won't matter, however, if another instance exists in -the HashSet with the same hash value, the equals comparator will be -used, triggering a NPE. - -Signed-off-by: Alexander Scheel ---- - org/mozilla/jss/util/NativeProxy.java | 13 +++++-------- - 1 file changed, 5 insertions(+), 8 deletions(-) - -diff --git a/org/mozilla/jss/util/NativeProxy.java b/org/mozilla/jss/util/NativeProxy.java -index 1c6d1aa5..a0811f76 100644 ---- a/org/mozilla/jss/util/NativeProxy.java -+++ b/org/mozilla/jss/util/NativeProxy.java -@@ -40,8 +40,8 @@ public abstract class NativeProxy implements AutoCloseable - */ - public NativeProxy(byte[] pointer) { - assert(pointer!=null); -- registry.add(this); - mPointer = pointer; -+ registry.add(this); - - if (saveStacktraces) { - mTrace = Arrays.toString(Thread.currentThread().getStackTrace()); -@@ -61,15 +61,12 @@ public abstract class NativeProxy implements AutoCloseable - if( ! (obj instanceof NativeProxy) ) { - return false; - } -- if( ((NativeProxy)obj).mPointer.length != mPointer.length) { -+ if (((NativeProxy)obj).mPointer == null) { -+ /* If mPointer is null, we have no way to compare the values -+ * of the pointers, so assume they're unequal. */ - return false; - } -- for(int i=0; i < mPointer.length; i++) { -- if(mPointer[i] != ((NativeProxy)obj).mPointer[i]) { -- return false; -- } -- } -- return true; -+ return Arrays.equals(((NativeProxy)obj).mPointer, mPointer); - } - - /** --- -2.21.0 - diff --git a/0001-Fix-base64-encoding-of-CSRs.patch b/0001-Fix-base64-encoding-of-CSRs.patch new file mode 100644 index 0000000..f898ed1 --- /dev/null +++ b/0001-Fix-base64-encoding-of-CSRs.patch @@ -0,0 +1,39 @@ +From 18efce236af6a1affebb274838318ba715114218 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Tue, 25 Feb 2020 09:14:47 -0500 +Subject: [PATCH 3/8] Fix base64-encoding of CSRs + +In 8de4440c5652f6f1af5b4b923a15730ba84f29e1, the base64 encoder was +changed from apache-commons-codec to the Java standard library to drop +a dependency. However, the behavior changed as a result: the Java +standard library doesn't include a final line separator, whereas +apache-commons-codec did. This results in malformed CSRs: + +> YWRPxyBKvFAOB29fwPwBJLZksrwQ0xAs7sooc+qF-----END NEW CERTIFICATE REQUEST----- + +Resolves: https://pagure.io/freeipa/issue/8199 + +Signed-off-by: Alexander Scheel +--- + org/mozilla/jss/netscape/security/util/Utils.java | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/org/mozilla/jss/netscape/security/util/Utils.java b/org/mozilla/jss/netscape/security/util/Utils.java +index 19f3b1f9..e6e56ce4 100644 +--- a/org/mozilla/jss/netscape/security/util/Utils.java ++++ b/org/mozilla/jss/netscape/security/util/Utils.java +@@ -378,7 +378,10 @@ public class Utils { + * @return base-64 encoded data + */ + public static String base64encodeMultiLine(byte[] bytes) { +- return Base64.getMimeEncoder().encodeToString(bytes); ++ // When switching from apache-commons-codec to the standard library, ++ // the standard library does not include a final line separator at ++ // the end of the encoded data. This results in malformed CSRs. ++ return Base64.getMimeEncoder().encodeToString(bytes) + "\r\n"; + } + + +-- +2.24.1 + diff --git a/jss.spec b/jss.spec index da423a5..2610821 100644 --- a/jss.spec +++ b/jss.spec @@ -6,8 +6,8 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.6.2 -Release: 4%{?_timestamp}%{?_commit_id}%{?dist} +Version: 4.6.3 +Release: 1%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 # To generate the source tarball: @@ -25,7 +25,7 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch -Patch0: 0001-Fix-NativeProxy-reference-tracker.patch +Patch0: 0001-Fix-base64-encoding-of-CSRs.patch Patch1: 0002-Fix-swapped-parameter-names-with-PBE.patch Patch2: 0003-Use-specified-algorithm-for-KeyWrap.patch @@ -162,6 +162,10 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Thu Mar 5 2020 Dogtag PKI Team - 4.6.3-1 +- Rebase to JSS 4.6.3 +- Fixes base64 encoding of CSRs + * Wed Mar 04 2020 Dogtag PKI Team - 4.6.2-4 - Fix for PBE errors diff --git a/sources b/sources index 32f2840..c883e35 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.6.2.tar.gz) = 53c12822b980f6dcaf5616366834fe4eaee07d84feae53096aa0ea142146e90d375910456d8192068cde5e63c3b60ded87862af50ea89c6b64224e8c105e00dd +SHA512 (jss-4.6.3.tar.gz) = 6c45b67c40737ee7bbc9ad1db8a5ed233b050697f9c048e1a49cc541de889416afd36b2c9bcdc44a52d10b0c75f036e22155a5ee95869fdf31772683637a27b1 From f4a3a5d4cfa1020770e283a2a6a9286ad3c9324a Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Mon, 27 Apr 2020 11:15:38 -0400 Subject: [PATCH 03/14] Rebase to upstream JSS v4.6.4 Signed-off-by: Alexander Scheel --- .gitignore | 1 + jss.spec | 9 +++++---- sources | 2 +- 3 files changed, 7 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 77527dc..6c8702e 100644 --- a/.gitignore +++ b/.gitignore @@ -24,3 +24,4 @@ jss-4.2.6.tar.gz /jss-4.6.1.tar.gz /jss-4.6.2.tar.gz /jss-4.6.3.tar.gz +/jss-4.6.4.tar.gz diff --git a/jss.spec b/jss.spec index 2610821..0920b44 100644 --- a/jss.spec +++ b/jss.spec @@ -6,7 +6,7 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.6.3 +Version: 4.6.4 Release: 1%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 @@ -25,9 +25,6 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch -Patch0: 0001-Fix-base64-encoding-of-CSRs.patch -Patch1: 0002-Fix-swapped-parameter-names-with-PBE.patch -Patch2: 0003-Use-specified-algorithm-for-KeyWrap.patch ################################################################################ # Build Dependencies @@ -162,6 +159,10 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Mon Apr 27 2020 Dogtag PKI Team - 4.6.4-1 +- Rebase to JSS 4.6.4 +- Fixes memory leak present since v4.6.2 + * Thu Mar 5 2020 Dogtag PKI Team - 4.6.3-1 - Rebase to JSS 4.6.3 - Fixes base64 encoding of CSRs diff --git a/sources b/sources index c883e35..25b6a59 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.6.3.tar.gz) = 6c45b67c40737ee7bbc9ad1db8a5ed233b050697f9c048e1a49cc541de889416afd36b2c9bcdc44a52d10b0c75f036e22155a5ee95869fdf31772683637a27b1 +SHA512 (jss-4.6.4.tar.gz) = c0adc950e1ce5e0f3d846dcb158d831575be84176ded3eec7ce3569cfd96c872a2089a2eede249c5924e1eee58d88574accd3403623910343130cf90b504b348 From 86ebf601e0cb2ddd1738395129f75a4c6475d847 Mon Sep 17 00:00:00 2001 From: Dinesh Prasanth M K Date: Wed, 10 Jun 2020 15:40:00 -0400 Subject: [PATCH 04/14] Rebase to latest upstream version 4.7.0-b2 Also, remove unused patch files Signed-off-by: Dinesh Prasanth M K --- .gitignore | 1 + 0001-Fix-base64-encoding-of-CSRs.patch | 39 --------- ...Fix-swapped-parameter-names-with-PBE.patch | 80 ------------------- ...-Use-specified-algorithm-for-KeyWrap.patch | 60 -------------- jss.spec | 25 +++--- sources | 2 +- 6 files changed, 17 insertions(+), 190 deletions(-) delete mode 100644 0001-Fix-base64-encoding-of-CSRs.patch delete mode 100644 0002-Fix-swapped-parameter-names-with-PBE.patch delete mode 100644 0003-Use-specified-algorithm-for-KeyWrap.patch diff --git a/.gitignore b/.gitignore index 6c8702e..de898e2 100644 --- a/.gitignore +++ b/.gitignore @@ -25,3 +25,4 @@ jss-4.2.6.tar.gz /jss-4.6.2.tar.gz /jss-4.6.3.tar.gz /jss-4.6.4.tar.gz +/jss-4.7.0-b2.tar.gz diff --git a/0001-Fix-base64-encoding-of-CSRs.patch b/0001-Fix-base64-encoding-of-CSRs.patch deleted file mode 100644 index f898ed1..0000000 --- a/0001-Fix-base64-encoding-of-CSRs.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 18efce236af6a1affebb274838318ba715114218 Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Tue, 25 Feb 2020 09:14:47 -0500 -Subject: [PATCH 3/8] Fix base64-encoding of CSRs - -In 8de4440c5652f6f1af5b4b923a15730ba84f29e1, the base64 encoder was -changed from apache-commons-codec to the Java standard library to drop -a dependency. However, the behavior changed as a result: the Java -standard library doesn't include a final line separator, whereas -apache-commons-codec did. This results in malformed CSRs: - -> YWRPxyBKvFAOB29fwPwBJLZksrwQ0xAs7sooc+qF-----END NEW CERTIFICATE REQUEST----- - -Resolves: https://pagure.io/freeipa/issue/8199 - -Signed-off-by: Alexander Scheel ---- - org/mozilla/jss/netscape/security/util/Utils.java | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/org/mozilla/jss/netscape/security/util/Utils.java b/org/mozilla/jss/netscape/security/util/Utils.java -index 19f3b1f9..e6e56ce4 100644 ---- a/org/mozilla/jss/netscape/security/util/Utils.java -+++ b/org/mozilla/jss/netscape/security/util/Utils.java -@@ -378,7 +378,10 @@ public class Utils { - * @return base-64 encoded data - */ - public static String base64encodeMultiLine(byte[] bytes) { -- return Base64.getMimeEncoder().encodeToString(bytes); -+ // When switching from apache-commons-codec to the standard library, -+ // the standard library does not include a final line separator at -+ // the end of the encoded data. This results in malformed CSRs. -+ return Base64.getMimeEncoder().encodeToString(bytes) + "\r\n"; - } - - --- -2.24.1 - diff --git a/0002-Fix-swapped-parameter-names-with-PBE.patch b/0002-Fix-swapped-parameter-names-with-PBE.patch deleted file mode 100644 index c535f6e..0000000 --- a/0002-Fix-swapped-parameter-names-with-PBE.patch +++ /dev/null @@ -1,80 +0,0 @@ -From 9f29430656342829822568f4ef49f5237b41164b Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Fri, 28 Feb 2020 14:10:32 -0500 -Subject: [PATCH 7/8] Fix swapped parameter names with PBE - -Commit 13998a9e77e60d6509ac814ed711dd21e1248ecd introduced a regression -related to extracting the parameter classes during PBE operations: -previously, the classes of the underlying encryption algorithm were -iterated over, instead of the classes of the PBE class itself. However, -this commit iterated over the PBE parameter classes; no PBE algorithm -accepts a IvParameterSpec, resulting in a null parameter passed to the -later encryption or key wrap operation. This resulted in stack traces -like the following: - -Caused by: java.security.InvalidAlgorithmParameterException: DES3/CBC/Pad cannot use a null parameter - at org.mozilla.jss.pkcs11.PK11KeyWrapper.checkParams(PK11KeyWrapper.java:225) - at org.mozilla.jss.pkcs11.PK11KeyWrapper.initWrap(PK11KeyWrapper.java:89) - at org.mozilla.jss.pkcs11.PK11KeyWrapper.initWrap(PK11KeyWrapper.java:57) - at org.mozilla.jss.pkix.primitive.EncryptedPrivateKeyInfo.createPBE(EncryptedPrivateKeyInfo.java:342) - -Resolves: rh-bz#1807371 - -Signed-off-by: Alexander Scheel ---- - org/mozilla/jss/pkcs7/EncryptedContentInfo.java | 2 +- - org/mozilla/jss/pkix/cms/EncryptedContentInfo.java | 2 +- - org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++-- - 3 files changed, 4 insertions(+), 4 deletions(-) - -diff --git a/org/mozilla/jss/pkcs7/EncryptedContentInfo.java b/org/mozilla/jss/pkcs7/EncryptedContentInfo.java -index 084752c3..0344b14d 100644 ---- a/org/mozilla/jss/pkcs7/EncryptedContentInfo.java -+++ b/org/mozilla/jss/pkcs7/EncryptedContentInfo.java -@@ -182,7 +182,7 @@ public class EncryptedContentInfo implements ASN1Value { - // generate IV - EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); - AlgorithmParameterSpec params=null; -- Class [] paramClasses = pbeAlg.getParameterClasses(); -+ Class [] paramClasses = encAlg.getParameterClasses(); - for (int i = 0; i < paramClasses.length; i ++) { - if ( paramClasses[i].equals( - javax.crypto.spec.IvParameterSpec.class ) ) { -diff --git a/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java b/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java -index a4709070..d85eb0d3 100644 ---- a/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java -+++ b/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java -@@ -180,7 +180,7 @@ public class EncryptedContentInfo implements ASN1Value { - // generate IV - EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); - AlgorithmParameterSpec params=null; -- Class [] paramClasses = pbeAlg.getParameterClasses(); -+ Class [] paramClasses = encAlg.getParameterClasses(); - for (int i = 0; i < paramClasses.length; i ++) { - if ( paramClasses[i].equals( IVParameterSpec.class ) ) { - params = new IVParameterSpec( kg.generatePBE_IV() ); -diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -index b35714e3..ebd269f3 100644 ---- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -+++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -@@ -147,7 +147,7 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { - // generate IV - EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); - AlgorithmParameterSpec params=null; -- Class [] paramClasses = pbeAlg.getParameterClasses(); -+ Class [] paramClasses = encAlg.getParameterClasses(); - for (int i = 0; i < paramClasses.length; i ++) { - if ( paramClasses[i].equals( javax.crypto.spec.IvParameterSpec.class ) ) { - params = new IVParameterSpec( kg.generatePBE_IV() ); -@@ -328,7 +328,7 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { - // generate IV - EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg(); - AlgorithmParameterSpec params=null; -- Class [] paramClasses = pbeAlg.getParameterClasses(); -+ Class [] paramClasses = encAlg.getParameterClasses(); - for (int i = 0; i < paramClasses.length; i ++) { - if ( paramClasses[i].equals( - javax.crypto.spec.IvParameterSpec.class ) ) { --- -2.24.1 - diff --git a/0003-Use-specified-algorithm-for-KeyWrap.patch b/0003-Use-specified-algorithm-for-KeyWrap.patch deleted file mode 100644 index d75534a..0000000 --- a/0003-Use-specified-algorithm-for-KeyWrap.patch +++ /dev/null @@ -1,60 +0,0 @@ -From 55482c8bfa0addeb9db7b590703ba3704c5db167 Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Fri, 28 Feb 2020 14:39:29 -0500 -Subject: [PATCH 8/8] Use specified algorithm for KeyWrap - -When the token-specified from of EncryptedPrivateKeyInfo.createPBE is -called, it would always request DES3_CBC_PAD as the key wrapping -algorithm, regardless of the input PBE key type. However, the other form -(with an implicit token) was correctly handling this case. - -Introduces a new KeyWrapAlgorithm method to take an OBJECT_IDENTIFIER -instead of having to convert to/from a String form. - -Signed-off-by: Alexander Scheel ---- - org/mozilla/jss/crypto/KeyWrapAlgorithm.java | 5 ++++- - org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++-- - 2 files changed, 6 insertions(+), 3 deletions(-) - -diff --git a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java -index 3113f614..3a106977 100644 ---- a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java -+++ b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java -@@ -138,7 +138,10 @@ public class KeyWrapAlgorithm extends Algorithm { - - public static KeyWrapAlgorithm fromOID(String wrapOID) throws NoSuchAlgorithmException { - OBJECT_IDENTIFIER oid = new OBJECT_IDENTIFIER(wrapOID); -+ return fromOID(oid); -+ } - -+ public static KeyWrapAlgorithm fromOID(OBJECT_IDENTIFIER oid) throws NoSuchAlgorithmException { - if (oid.equals(AES_KEY_WRAP_PAD_OID)) - return AES_KEY_WRAP_PAD; - -@@ -154,6 +157,6 @@ public class KeyWrapAlgorithm extends Algorithm { - if (oid.equals(DES_CBC_PAD_OID)) - return DES_CBC_PAD; - -- throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + wrapOID); -+ throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + oid); - } - } -diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -index ebd269f3..abfc39a7 100644 ---- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -+++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java -@@ -337,8 +337,8 @@ public class EncryptedPrivateKeyInfo implements ASN1Value { - } - } - -- KeyWrapper wrapper = token.getKeyWrapper( -- KeyWrapAlgorithm.DES3_CBC_PAD); -+ // wrap the key -+ KeyWrapper wrapper = token.getKeyWrapper(KeyWrapAlgorithm.fromOID(encAlg.toOID())); - wrapper.initWrap(key, params); - byte encrypted[] = wrapper.wrap(pri); - --- -2.24.1 - diff --git a/jss.spec b/jss.spec index 0920b44..abb49ae 100644 --- a/jss.spec +++ b/jss.spec @@ -6,9 +6,9 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.6.4 -Release: 1%{?_timestamp}%{?_commit_id}%{?dist} -# global _phase -a1 +Version: 4.7.0 +Release: 0.2%{?_timestamp}%{?_commit_id}%{?dist} +%global _phase -b2 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -34,11 +34,13 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas BuildRequires: git BuildRequires: make BuildRequires: cmake +BuildRequires: zip +BuildRequires: unzip BuildRequires: gcc-c++ BuildRequires: nspr-devel >= 4.13.1 -BuildRequires: nss-devel >= 3.30 -BuildRequires: nss-tools >= 3.30 +BuildRequires: nss-devel >= 3.44 +BuildRequires: nss-tools >= 3.44 BuildRequires: java-devel BuildRequires: jpackage-utils BuildRequires: slf4j @@ -49,11 +51,10 @@ BuildRequires: glassfish-jaxb-api BuildRequires: slf4j-jdk14 %endif BuildRequires: apache-commons-lang -BuildRequires: apache-commons-codec BuildRequires: junit -Requires: nss >= 3.30 +Requires: nss >= 3.44 Requires: java-headless Requires: jpackage-utils Requires: slf4j @@ -64,7 +65,6 @@ Requires: glassfish-jaxb-api Requires: slf4j-jdk14 %endif Requires: apache-commons-lang -Requires: apache-commons-codec Conflicts: ldapjdk < 4.20 Conflicts: idm-console-framework < 1.2 @@ -116,7 +116,7 @@ rm -rf build && mkdir -p build && cd build .. %{__make} all -%{__make} javadoc || true +%{__make} javadoc ctest --output-on-failure ################################################################################ @@ -147,7 +147,8 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} %files %defattr(-,root,root,-) -%doc jss.html MPL-1.1.txt gpl.txt lgpl.txt +%doc jss.html +%license MPL-1.1.txt gpl.txt lgpl.txt %{_libdir}/* %{_jnidir}/* @@ -159,6 +160,10 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Wed Jun 10 2020 Dogtag PKI Team - 4.7.0-0.2 +- Rebase to latest upstream JSS 4.7.0 +- JSS Provided SSLEngine + * Mon Apr 27 2020 Dogtag PKI Team - 4.6.4-1 - Rebase to JSS 4.6.4 - Fixes memory leak present since v4.6.2 diff --git a/sources b/sources index 25b6a59..eaf917e 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.6.4.tar.gz) = c0adc950e1ce5e0f3d846dcb158d831575be84176ded3eec7ce3569cfd96c872a2089a2eede249c5924e1eee58d88574accd3403623910343130cf90b504b348 +SHA512 (jss-4.7.0-b2.tar.gz) = 6bd5fd4823ea4b14bfd53dc64796b6fcb7018a6118b943b46be7a5caf874a386802f1e6e0e542743be505d73f2b9625b0f1d479b1292c7364ac62d8cee3e4e52 From 4bc20121ec55a9d9e094aa5cce3c937797f57a8c Mon Sep 17 00:00:00 2001 From: Dinesh Prasanth M K Date: Tue, 30 Jun 2020 17:11:55 -0400 Subject: [PATCH 05/14] Rebased to upstream JSS v4.7.0-b4 --- .gitignore | 1 + jss.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index de898e2..87c5030 100644 --- a/.gitignore +++ b/.gitignore @@ -26,3 +26,4 @@ jss-4.2.6.tar.gz /jss-4.6.3.tar.gz /jss-4.6.4.tar.gz /jss-4.7.0-b2.tar.gz +/jss-4.7.0-b4.tar.gz diff --git a/jss.spec b/jss.spec index abb49ae..554fecc 100644 --- a/jss.spec +++ b/jss.spec @@ -7,8 +7,8 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.7.0 -Release: 0.2%{?_timestamp}%{?_commit_id}%{?dist} -%global _phase -b2 +Release: 0.4%{?_timestamp}%{?_commit_id}%{?dist} +%global _phase -b4 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -160,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Tue Jun 30 2020 Dogtag PKI Team - 4.7.0-0.4 +- Rebase to latest upstream JSS v4.7.0-b4 + * Wed Jun 10 2020 Dogtag PKI Team - 4.7.0-0.2 - Rebase to latest upstream JSS 4.7.0 - JSS Provided SSLEngine diff --git a/sources b/sources index eaf917e..eae7417 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.7.0-b2.tar.gz) = 6bd5fd4823ea4b14bfd53dc64796b6fcb7018a6118b943b46be7a5caf874a386802f1e6e0e542743be505d73f2b9625b0f1d479b1292c7364ac62d8cee3e4e52 +SHA512 (jss-4.7.0-b4.tar.gz) = 79c01fc513de479a63cbe164c772f9f685afe032a280f59eb3bb096a653424b3df1a9403c8cf443ffbe8b9a1d97a8aeb48064fbbe92e4c12e29767fb2a547d9f From b9ae07f554b4eab72feca6711dd4ae527b028102 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Thu, 9 Jul 2020 12:55:29 -0400 Subject: [PATCH 06/14] Update to stable v4.7.0 release Signed-off-by: Alexander Scheel --- .gitignore | 1 + jss.spec | 8 ++++++++ sources | 2 +- 3 files changed, 10 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 87c5030..a9ae250 100644 --- a/.gitignore +++ b/.gitignore @@ -27,3 +27,4 @@ jss-4.2.6.tar.gz /jss-4.6.4.tar.gz /jss-4.7.0-b2.tar.gz /jss-4.7.0-b4.tar.gz +/jss-4.7.0.tar.gz diff --git a/jss.spec b/jss.spec index 554fecc..dc4d474 100644 --- a/jss.spec +++ b/jss.spec @@ -7,8 +7,13 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.7.0 +<<<<<<< HEAD Release: 0.4%{?_timestamp}%{?_commit_id}%{?dist} %global _phase -b4 +======= +Release: 1%{?_timestamp}%{?_commit_id}%{?dist} +#global _phase -a1 +>>>>>>> af81146... Update to stable v4.7.0 release # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -160,6 +165,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Thu Jul 09 2020 Dogtag PKI Team - 4.7.0-1 +- Rebase to upstream stable release JSS v4.7.0 + * Tue Jun 30 2020 Dogtag PKI Team - 4.7.0-0.4 - Rebase to latest upstream JSS v4.7.0-b4 diff --git a/sources b/sources index eae7417..7f6e516 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.7.0-b4.tar.gz) = 79c01fc513de479a63cbe164c772f9f685afe032a280f59eb3bb096a653424b3df1a9403c8cf443ffbe8b9a1d97a8aeb48064fbbe92e4c12e29767fb2a547d9f +SHA512 (jss-4.7.0.tar.gz) = 91a6bbc2c9dde436fd07e2f2bf9e71bd0a40c643547f41a95152a51200d126a37e2e580ef78d9075dc349f5dfe613b04eaf2a32009da13889e824ee9db255a43 From 6e8a9678497dd1f7deb5e2e0eea711630f5ea0cb Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Thu, 9 Jul 2020 12:58:48 -0400 Subject: [PATCH 07/14] Fix merge conflict Signed-off-by: Alexander Scheel --- jss.spec | 5 ----- 1 file changed, 5 deletions(-) diff --git a/jss.spec b/jss.spec index dc4d474..1d833f4 100644 --- a/jss.spec +++ b/jss.spec @@ -7,13 +7,8 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.7.0 -<<<<<<< HEAD -Release: 0.4%{?_timestamp}%{?_commit_id}%{?dist} -%global _phase -b4 -======= Release: 1%{?_timestamp}%{?_commit_id}%{?dist} #global _phase -a1 ->>>>>>> af81146... Update to stable v4.7.0 release # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git From 7a460bc5961fe67fe5312ca45d51440165bea7f5 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Tue, 18 Aug 2020 13:56:49 -0400 Subject: [PATCH 08/14] Rebase to JSS v4.7.2 Signed-off-by: Alexander Scheel --- .gitignore | 1 + jss.spec | 15 +++++++++------ sources | 2 +- 3 files changed, 11 insertions(+), 7 deletions(-) diff --git a/.gitignore b/.gitignore index a9ae250..d7eb920 100644 --- a/.gitignore +++ b/.gitignore @@ -28,3 +28,4 @@ jss-4.2.6.tar.gz /jss-4.7.0-b2.tar.gz /jss-4.7.0-b4.tar.gz /jss-4.7.0.tar.gz +/jss-4.7.2.tar.gz diff --git a/jss.spec b/jss.spec index 1d833f4..8a33927 100644 --- a/jss.spec +++ b/jss.spec @@ -6,7 +6,7 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.7.0 +Version: 4.7.2 Release: 1%{?_timestamp}%{?_commit_id}%{?dist} #global _phase -a1 @@ -109,12 +109,12 @@ export CFLAGS modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENABLED=1 # The Makefile is not thread-safe -rm -rf build && mkdir -p build && cd build %cmake \ -DJAVA_HOME=%{java_home} \ -DJAVA_LIB_INSTALL_DIR=%{_jnidir} \ - .. + -B %{_vpath_builddir} +cd %{_vpath_builddir} %{__make} all %{__make} javadoc ctest --output-on-failure @@ -126,19 +126,19 @@ ctest --output-on-failure # jars install -d -m 0755 $RPM_BUILD_ROOT%{_jnidir} -install -m 644 build/jss4.jar ${RPM_BUILD_ROOT}%{_jnidir}/jss4.jar +install -m 644 %{_vpath_builddir}/jss4.jar ${RPM_BUILD_ROOT}%{_jnidir}/jss4.jar # We have to use the name libjss4.so because this is dynamically # loaded by the jar file. install -d -m 0755 $RPM_BUILD_ROOT%{_libdir}/jss -install -m 0755 build/libjss4.so ${RPM_BUILD_ROOT}%{_libdir}/jss/ +install -m 0755 %{_vpath_builddir}/libjss4.so ${RPM_BUILD_ROOT}%{_libdir}/jss/ pushd ${RPM_BUILD_ROOT}%{_libdir}/jss ln -fs %{_jnidir}/jss4.jar jss4.jar popd # javadoc install -d -m 0755 $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} -cp -rp build/docs/* $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} +cp -rp %{_vpath_builddir}/docs/* $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} cp -p jss.html $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} @@ -160,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Tue Aug 18 2020 Dogtag PKI Team - 4.7.2-1 +- Rebase to upstream stable release JSS v4.7.2 ; fixes FTBFS + * Thu Jul 09 2020 Dogtag PKI Team - 4.7.0-1 - Rebase to upstream stable release JSS v4.7.0 diff --git a/sources b/sources index 7f6e516..1f22225 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.7.0.tar.gz) = 91a6bbc2c9dde436fd07e2f2bf9e71bd0a40c643547f41a95152a51200d126a37e2e580ef78d9075dc349f5dfe613b04eaf2a32009da13889e824ee9db255a43 +SHA512 (jss-4.7.2.tar.gz) = 171b4c341b56c49eaedf0663cee7c949bd91f070781debc80b7b74f85eeacc5e4092cc5ab8eb3ace926493a7ea64d08c5c7a614dccd2e479f8b371b6075d6594 From 2da11d9b9f943bb01c356ce68b971695d01a208b Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Fri, 11 Sep 2020 16:48:33 -0400 Subject: [PATCH 09/14] Rebase to JSS v4.7.3 Signed-off-by: Alexander Scheel --- .gitignore | 1 + jss.spec | 18 +++++++++++++++++- sources | 2 +- 3 files changed, 19 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index d7eb920..349bfb5 100644 --- a/.gitignore +++ b/.gitignore @@ -29,3 +29,4 @@ jss-4.2.6.tar.gz /jss-4.7.0-b4.tar.gz /jss-4.7.0.tar.gz /jss-4.7.2.tar.gz +/jss-4.7.3.tar.gz diff --git a/jss.spec b/jss.spec index 8a33927..de4fb2c 100644 --- a/jss.spec +++ b/jss.spec @@ -6,7 +6,7 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.7.2 +Version: 4.7.3 Release: 1%{?_timestamp}%{?_commit_id}%{?dist} #global _phase -a1 @@ -108,13 +108,26 @@ export CFLAGS # Check if we're in FIPS mode modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENABLED=1 +# RHEL's CMake doesn't support -B flag. +%if 0%{?rhel} +%{__mkdir_p} %{_vpath_builddir} +cd %{_vpath_builddir} +%endif + # The Makefile is not thread-safe %cmake \ -DJAVA_HOME=%{java_home} \ -DJAVA_LIB_INSTALL_DIR=%{_jnidir} \ +%if 0%{?rhel} + .. +%else -B %{_vpath_builddir} +%endif +%if 0%{?fedora} cd %{_vpath_builddir} +%endif + %{__make} all %{__make} javadoc ctest --output-on-failure @@ -160,6 +173,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Fri Sep 11 2020 Dogtag PKI Team - 4.7.3-1 +- Rebase to upstream stable release JSS v4.7.3 + * Tue Aug 18 2020 Dogtag PKI Team - 4.7.2-1 - Rebase to upstream stable release JSS v4.7.2 ; fixes FTBFS diff --git a/sources b/sources index 1f22225..13d43e8 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.7.2.tar.gz) = 171b4c341b56c49eaedf0663cee7c949bd91f070781debc80b7b74f85eeacc5e4092cc5ab8eb3ace926493a7ea64d08c5c7a614dccd2e479f8b371b6075d6594 +SHA512 (jss-4.7.3.tar.gz) = 9358cf78d99e5e32a07dd457d6b0c916bdf9bf6959efe889f1cb91af75aa79fc419c2d057a40bfbe4e2a4924bffc1cafa04d917622cafe07062bcb633f330f98 From 62e646fc74ee08b8def0e4bff65271ef761a4341 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Wed, 28 Oct 2020 16:17:34 -0400 Subject: [PATCH 10/14] Rebase to latest stable JSS v4.8.0 Signed-off-by: Alexander Scheel --- .gitignore | 1 + jss.spec | 22 ++++++---------------- sources | 2 +- 3 files changed, 8 insertions(+), 17 deletions(-) diff --git a/.gitignore b/.gitignore index 349bfb5..9d82cb3 100644 --- a/.gitignore +++ b/.gitignore @@ -30,3 +30,4 @@ jss-4.2.6.tar.gz /jss-4.7.0.tar.gz /jss-4.7.2.tar.gz /jss-4.7.3.tar.gz +/jss-4.8.0.tar.gz diff --git a/jss.spec b/jss.spec index de4fb2c..4df6281 100644 --- a/jss.spec +++ b/jss.spec @@ -6,7 +6,7 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.7.3 +Version: 4.8.0 Release: 1%{?_timestamp}%{?_commit_id}%{?dist} #global _phase -a1 @@ -50,7 +50,7 @@ BuildRequires: glassfish-jaxb-api %else BuildRequires: slf4j-jdk14 %endif -BuildRequires: apache-commons-lang +BuildRequires: apache-commons-lang3 BuildRequires: junit @@ -64,7 +64,7 @@ Requires: glassfish-jaxb-api %else Requires: slf4j-jdk14 %endif -Requires: apache-commons-lang +Requires: apache-commons-lang3 Conflicts: ldapjdk < 4.20 Conflicts: idm-console-framework < 1.2 @@ -108,26 +108,13 @@ export CFLAGS # Check if we're in FIPS mode modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENABLED=1 -# RHEL's CMake doesn't support -B flag. -%if 0%{?rhel} -%{__mkdir_p} %{_vpath_builddir} -cd %{_vpath_builddir} -%endif - # The Makefile is not thread-safe %cmake \ -DJAVA_HOME=%{java_home} \ -DJAVA_LIB_INSTALL_DIR=%{_jnidir} \ -%if 0%{?rhel} - .. -%else -B %{_vpath_builddir} -%endif -%if 0%{?fedora} cd %{_vpath_builddir} -%endif - %{__make} all %{__make} javadoc ctest --output-on-failure @@ -173,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Wed Oct 21 2020 Dogtag PKI Team - 4.8.0-1 +- Rebase to upstream stable release JSS v4.8.0 + * Fri Sep 11 2020 Dogtag PKI Team - 4.7.3-1 - Rebase to upstream stable release JSS v4.7.3 diff --git a/sources b/sources index 13d43e8..017d89b 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.7.3.tar.gz) = 9358cf78d99e5e32a07dd457d6b0c916bdf9bf6959efe889f1cb91af75aa79fc419c2d057a40bfbe4e2a4924bffc1cafa04d917622cafe07062bcb633f330f98 +SHA512 (jss-4.8.0.tar.gz) = 322d12b69a2665a4ea2302a9a3ba8668c8dd6b56e6aaa17b48e11885ebcb9b38663242312207a0452c95bd84306bab4e968a8d0a1444dea003e4d19e43f6f425 From 840b1eb392736a6dc74ce6661bfd3ad17a12ead7 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Thu, 5 Nov 2020 09:40:00 -0500 Subject: [PATCH 11/14] Add conflict on older PKI versions due to ACL3 Signed-off-by: Alexander Scheel --- jss.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/jss.spec b/jss.spec index 4df6281..8140e94 100644 --- a/jss.spec +++ b/jss.spec @@ -7,7 +7,7 @@ URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ Version: 4.8.0 -Release: 1%{?_timestamp}%{?_commit_id}%{?dist} +Release: 2%{?_timestamp}%{?_commit_id}%{?dist} #global _phase -a1 # To generate the source tarball: @@ -69,7 +69,7 @@ Requires: apache-commons-lang3 Conflicts: ldapjdk < 4.20 Conflicts: idm-console-framework < 1.2 Conflicts: tomcatjss < 7.3.4 -Conflicts: pki-base < 10.6.5 +Conflicts: pki-base < 10.10.0 %description Java Security Services (JSS) is a java native interface which provides a bridge @@ -160,6 +160,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Thu Nov 05 2020 Dogtag PKI Team - 4.8.0-2 +- Add Conflicts on older PKI versions due to missing ACL3 + * Wed Oct 21 2020 Dogtag PKI Team - 4.8.0-1 - Rebase to upstream stable release JSS v4.8.0 From fa1266074f30479bacc18e32d4d09fb27956c98e Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Thu, 5 Nov 2020 11:48:28 -0500 Subject: [PATCH 12/14] Add upstream patch to make JDK8 builds work Signed-off-by: Alexander Scheel --- ...check-PKCS11Constants-on-beta-builds.patch | 30 +++++++++++++++++++ jss.spec | 1 + 2 files changed, 31 insertions(+) create mode 100644 0001-Only-check-PKCS11Constants-on-beta-builds.patch diff --git a/0001-Only-check-PKCS11Constants-on-beta-builds.patch b/0001-Only-check-PKCS11Constants-on-beta-builds.patch new file mode 100644 index 0000000..9f09e1a --- /dev/null +++ b/0001-Only-check-PKCS11Constants-on-beta-builds.patch @@ -0,0 +1,30 @@ +From eb6086840f5c79ba2ff5b1ccac3fe78ad2482e06 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Thu, 5 Nov 2020 11:07:13 -0500 +Subject: [PATCH] Only check PKCS11Constants on beta builds + +Recent errors with PKCS11Constants have shown that we shouldn't be +running these tests on release builds for backports: only for +pre-release content. Only run them when the beta bit is set. + +Signed-off-by: Alexander Scheel +--- + cmake/JSSTests.cmake | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/cmake/JSSTests.cmake b/cmake/JSSTests.cmake +index a0fe36e2..7384bdc0 100644 +--- a/cmake/JSSTests.cmake ++++ b/cmake/JSSTests.cmake +@@ -112,7 +112,7 @@ macro(jss_tests) + COMMAND "org.mozilla.jss.tests.TestGlobalReference" + MODE "NONE" + ) +- if ((${Java_VERSION_MAJOR} EQUAL 1) AND (${Java_VERSION_MINOR} LESS 9)) ++ if ((${Java_VERSION_MAJOR} EQUAL 1) AND (${Java_VERSION_MINOR} LESS 9) AND (${JSS_VERSION_BETA} EQUAL 1)) + jss_test_java( + NAME "Test_PKCS11Constants.java_for_Sun_compatibility" + COMMAND "org.mozilla.jss.tests.TestPKCS11Constants" +-- +2.26.2 + diff --git a/jss.spec b/jss.spec index 8140e94..318512f 100644 --- a/jss.spec +++ b/jss.spec @@ -25,6 +25,7 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch +Patch1: 0001-Only-check-PKCS11Constants-on-beta-builds.patch ################################################################################ # Build Dependencies From 4b0f8e454b4b760d0261f264600c5977bc2e02c2 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Thu, 14 Jan 2021 09:09:11 -0500 Subject: [PATCH 13/14] Rebase to latest stable JSS v4.8.1 Signed-off-by: Alexander Scheel --- .gitignore | 1 + jss.spec | 11 +++++++---- sources | 2 +- 3 files changed, 9 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 9d82cb3..1ef681f 100644 --- a/.gitignore +++ b/.gitignore @@ -31,3 +31,4 @@ jss-4.2.6.tar.gz /jss-4.7.2.tar.gz /jss-4.7.3.tar.gz /jss-4.8.0.tar.gz +/jss-4.8.1.tar.gz diff --git a/jss.spec b/jss.spec index 318512f..50d3c84 100644 --- a/jss.spec +++ b/jss.spec @@ -6,8 +6,8 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.8.0 -Release: 2%{?_timestamp}%{?_commit_id}%{?dist} +Version: 4.8.1 +Release: 1%{?_timestamp}%{?_commit_id}%{?dist} #global _phase -a1 # To generate the source tarball: @@ -34,7 +34,7 @@ Patch1: 0001-Only-check-PKCS11Constants-on-beta-builds.patch # autosetup BuildRequires: git BuildRequires: make -BuildRequires: cmake +BuildRequires: cmake >= 3.14 BuildRequires: zip BuildRequires: unzip @@ -69,7 +69,7 @@ Requires: apache-commons-lang3 Conflicts: ldapjdk < 4.20 Conflicts: idm-console-framework < 1.2 -Conflicts: tomcatjss < 7.3.4 +Conflicts: tomcatjss < 7.6.0 Conflicts: pki-base < 10.10.0 %description @@ -161,6 +161,9 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Thu Jan 14 2021 Dogtag PKI Team - 4.8.1-1 +- Rebase to upstream stable JSS v4.8.1 + * Thu Nov 05 2020 Dogtag PKI Team - 4.8.0-2 - Add Conflicts on older PKI versions due to missing ACL3 diff --git a/sources b/sources index 017d89b..064f3c9 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.8.0.tar.gz) = 322d12b69a2665a4ea2302a9a3ba8668c8dd6b56e6aaa17b48e11885ebcb9b38663242312207a0452c95bd84306bab4e968a8d0a1444dea003e4d19e43f6f425 +SHA512 (jss-4.8.1.tar.gz) = d18ef995cba627de68077bbd8dc25640b6444c4674e29ec83a05296ac1f18289e1ada35229baafbf5c5e4f1ae712a46e48d9d6dcead935e0f4d3d72b5208cf40 From c95c58723141b6a4ddce50bdb2b13b834ec61e87 Mon Sep 17 00:00:00 2001 From: Alexander Scheel Date: Thu, 14 Jan 2021 10:14:10 -0500 Subject: [PATCH 14/14] Remove patch preventing building Signed-off-by: Alexander Scheel --- ...check-PKCS11Constants-on-beta-builds.patch | 30 ------------------- jss.spec | 1 - 2 files changed, 31 deletions(-) delete mode 100644 0001-Only-check-PKCS11Constants-on-beta-builds.patch diff --git a/0001-Only-check-PKCS11Constants-on-beta-builds.patch b/0001-Only-check-PKCS11Constants-on-beta-builds.patch deleted file mode 100644 index 9f09e1a..0000000 --- a/0001-Only-check-PKCS11Constants-on-beta-builds.patch +++ /dev/null @@ -1,30 +0,0 @@ -From eb6086840f5c79ba2ff5b1ccac3fe78ad2482e06 Mon Sep 17 00:00:00 2001 -From: Alexander Scheel -Date: Thu, 5 Nov 2020 11:07:13 -0500 -Subject: [PATCH] Only check PKCS11Constants on beta builds - -Recent errors with PKCS11Constants have shown that we shouldn't be -running these tests on release builds for backports: only for -pre-release content. Only run them when the beta bit is set. - -Signed-off-by: Alexander Scheel ---- - cmake/JSSTests.cmake | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/cmake/JSSTests.cmake b/cmake/JSSTests.cmake -index a0fe36e2..7384bdc0 100644 ---- a/cmake/JSSTests.cmake -+++ b/cmake/JSSTests.cmake -@@ -112,7 +112,7 @@ macro(jss_tests) - COMMAND "org.mozilla.jss.tests.TestGlobalReference" - MODE "NONE" - ) -- if ((${Java_VERSION_MAJOR} EQUAL 1) AND (${Java_VERSION_MINOR} LESS 9)) -+ if ((${Java_VERSION_MAJOR} EQUAL 1) AND (${Java_VERSION_MINOR} LESS 9) AND (${JSS_VERSION_BETA} EQUAL 1)) - jss_test_java( - NAME "Test_PKCS11Constants.java_for_Sun_compatibility" - COMMAND "org.mozilla.jss.tests.TestPKCS11Constants" --- -2.26.2 - diff --git a/jss.spec b/jss.spec index 50d3c84..75134cf 100644 --- a/jss.spec +++ b/jss.spec @@ -25,7 +25,6 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch -Patch1: 0001-Only-check-PKCS11Constants-on-beta-builds.patch ################################################################################ # Build Dependencies