diff --git a/.gitignore b/.gitignore index 377c2aa..edcc16f 100644 --- a/.gitignore +++ b/.gitignore @@ -49,3 +49,7 @@ jss-4.2.6.tar.gz /jss-5.5.0.tar.gz /jss-5.5.1.tar.gz /jss-5.6.0-alpha1.tar.gz +/jss-5.8.0-beta1.tar.gz +/jss-5.8.0-beta3.tar.gz +/jss-5.8.0-beta4.tar.gz +/jss-5.8.0.tar.gz diff --git a/jss-5.4.2-nss-3.97.patch b/jss-5.4.2-nss-3.97.patch deleted file mode 100644 index 8b9d64d..0000000 --- a/jss-5.4.2-nss-3.97.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 130d543f3a7c33196bef386b4ee87ccc4ed53d0b Mon Sep 17 00:00:00 2001 -From: "Endi S. Dewata" -Date: Wed, 7 Feb 2024 14:59:31 -0600 -Subject: [PATCH] Update kea_alg_defs to match NSS 3.97 - -The kea_alg_defs array in SSLCipher.c has been updated to match -the one defined in NSS 3.97. The assertion that compares the size -of the array with ssl_kea_size has also been removed. These -changes will allow JSS to work with the newer NSS 3.97 on Fedora -Rawhide as well as the older NSS versions on other platforms. - -Resolves: https://github.com/dogtagpki/jss/issues/991 ---- - native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c b/native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c -index 4f2dacb0b..ea739617a 100644 ---- a/native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c -+++ b/native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c -@@ -23,7 +23,7 @@ static const CK_MECHANISM_TYPE auth_alg_defs[] = { - }; - PR_STATIC_ASSERT(PR_ARRAY_SIZE(auth_alg_defs) == ssl_auth_size); - --/* Copied from NSS's ssl3con.c. */ -+/* Copied from NSS 3.97's ssl3con.c. */ - static const CK_MECHANISM_TYPE kea_alg_defs[] = { - CKM_INVALID_MECHANISM, /* ssl_kea_null */ - CKM_RSA_PKCS, /* ssl_kea_rsa */ -@@ -33,8 +33,9 @@ static const CK_MECHANISM_TYPE kea_alg_defs[] = { - CKM_ECDH1_DERIVE, /* ssl_kea_ecdh_psk */ - CKM_DH_PKCS_DERIVE, /* ssl_kea_dh_psk */ - CKM_INVALID_MECHANISM, /* ssl_kea_tls13_any */ -+ CKM_INVALID_MECHANISM, /* ssl_kea_ecdh_hybrid */ -+ CKM_INVALID_MECHANISM, /* ssl_kea_ecdh_hybrid_psk */ - }; --PR_STATIC_ASSERT(PR_ARRAY_SIZE(kea_alg_defs) == ssl_kea_size); - - #ifdef HAVE_NSS_CIPHER_SUITE_INFO_KDFHASH - /* Not present in ssl3con.c. */ diff --git a/jss.spec b/jss.spec index 155a73d..794ee73 100644 --- a/jss.spec +++ b/jss.spec @@ -7,19 +7,23 @@ Name: jss # Upstream version number: %global major_version 5 -%global minor_version 6 +%global minor_version 8 %global update_version 0 # Downstream release number: # - development/stabilization (unsupported): 0. where n >= 1 # - GA/update (supported): where n >= 1 -%global release_number 0.1 +%global release_number 1 # Development phase: # - development (unsupported): alpha where n >= 1 # - stabilization (unsupported): beta where n >= 1 # - GA/update (supported): -%global phase alpha1 +#global phase + +%if 0%{?rhel} && 0%{?rhel} >= 10 +%global enable_nss_version_pqc_def_flag -DENABLE_NSS_VERSION_PQC_DEF=ON +%endif %undefine timestamp %undefine commit_id @@ -28,7 +32,7 @@ Summary: Java Security Services (JSS) URL: https://github.com/dogtagpki/jss License: (MPL-1.1 OR GPL-2.0-or-later OR LGPL-2.1-or-later) AND Apache-2.0 Version: %{major_version}.%{minor_version}.%{update_version} -Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.1 +Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist} # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git @@ -56,9 +60,26 @@ ExcludeArch: i686 # Java ################################################################################ +# use Java 17 on Fedora 39 or older and RHEL 9 or older +# otherwise, use Java 21 + +# maven-local is a subpackage of javapackages-tools + +%if 0%{?fedora} && 0%{?fedora} >= 43 || 0%{?rhel} >= 11 + +%define java_devel java-25-openjdk-devel +%define java_headless java-25-openjdk-headless +%define java_home %{_jvmdir}/jre-25-openjdk +%define maven_local maven-local-openjdk25 + +%else + %define java_devel java-21-openjdk-devel %define java_headless java-21-openjdk-headless %define java_home %{_jvmdir}/jre-21-openjdk +%define maven_local maven-local + +%endif ################################################################################ # Build Options @@ -84,11 +105,11 @@ BuildRequires: zip BuildRequires: unzip BuildRequires: gcc-c++ -BuildRequires: nss-devel >= 3.66 -BuildRequires: nss-tools >= 3.66 +BuildRequires: nss-devel >= 3.101 +BuildRequires: nss-tools >= 3.101 BuildRequires: %{java_devel} -BuildRequires: maven-local +BuildRequires: %{maven_local} BuildRequires: mvn(org.apache.commons:commons-lang3) BuildRequires: mvn(org.slf4j:slf4j-api) BuildRequires: mvn(org.slf4j:slf4j-jdk14) @@ -104,7 +125,7 @@ This only works with gcj. Other JREs require that JCE providers be signed. Summary: Java Security Services (JSS) -Requires: nss >= 3.66 +Requires: nss >= 3.101 Requires: %{java_headless} Requires: mvn(org.apache.commons:commons-lang3) @@ -132,21 +153,21 @@ This only works with gcj. Other JREs require that JCE providers be signed. Summary: Java Security Services (JSS) Connector for Tomcat # Tomcat -BuildRequires: mvn(org.apache.tomcat:tomcat-catalina) >= 9.0.62 -BuildRequires: mvn(org.apache.tomcat:tomcat-coyote) >= 9.0.62 -BuildRequires: mvn(org.apache.tomcat:tomcat-juli) >= 9.0.62 +BuildRequires: mvn(org.apache.tomcat:tomcat-catalina) >= 10.1.36 +BuildRequires: mvn(org.apache.tomcat:tomcat-coyote) >= 10.1.36 +BuildRequires: mvn(org.apache.tomcat:tomcat-juli) >= 10.1.36 Requires: %{product_id} = %{version}-%{release} -Requires: mvn(org.apache.tomcat:tomcat-catalina) >= 9.0.62 -Requires: mvn(org.apache.tomcat:tomcat-coyote) >= 9.0.62 -Requires: mvn(org.apache.tomcat:tomcat-juli) >= 9.0.62 +Requires: mvn(org.apache.tomcat:tomcat-catalina) >= 10.1.36 +Requires: mvn(org.apache.tomcat:tomcat-coyote) >= 10.1.36 +Requires: mvn(org.apache.tomcat:tomcat-juli) >= 10.1.36 # Tomcat JSS has been replaced with JSS Connector for Tomcat. # This will remove installed Tomcat JSS packages. Obsoletes: tomcatjss <= 8.5 Conflicts: tomcatjss <= 8.5 -Obsoletes: dogtag-tomcatjss <= 8.5 -Conflicts: dogtag-tomcatjss <= 8.5 +Obsoletes: %{vendor_id}-tomcatjss <= 8.5 +Conflicts: %{vendor_id}-tomcatjss <= 8.5 %if 0%{?rhel} <= 8 # PKI Servlet Engine has been replaced with Tomcat. @@ -227,11 +248,11 @@ This package provides test suite for JSS. # specify Maven artifact locations %mvn_file org.dogtagpki.jss:jss-tomcat jss/jss-tomcat -%mvn_file org.dogtagpki.jss:jss-tomcat-9.0 jss/jss-tomcat-9.0 +%mvn_file org.dogtagpki.jss:jss-tomcat-10.1 jss/jss-tomcat-10.1 # specify Maven artifact packages %mvn_package org.dogtagpki.jss:jss-tomcat jss-tomcat -%mvn_package org.dogtagpki.jss:jss-tomcat-9.0 jss-tomcat +%mvn_package org.dogtagpki.jss:jss-tomcat-10.1 jss-tomcat ################################################################################ %build @@ -293,7 +314,7 @@ touch %{_vpath_builddir}/.targets/finished_generate_javadocs --lib-dir=%{_libdir} \ --sysconf-dir=%{_sysconfdir} \ --share-dir=%{_datadir} \ - --cmake=%{__cmake} \ + --cmake="%{__cmake} %{?enable_nss_version_pqc_def_flag}" \ --java-home=%{java_home} \ --jni-dir=%{_jnidir} \ --version=%{version} \ @@ -376,6 +397,27 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib ################################################################################ %changelog +* Tue Nov 04 2025 Dogtag PKI Team 5.8.0-1 +- Rebase to JSS 5.8.0-1 + +* Fri Aug 22 2025 Yaakov Selkowitz - 5.8.0-0.6.beta4 +- Build with Java 25 for ELN + +* Mon Aug 11 2025 Dogtag PKI Team 5.8.0-0.5.beta4 +- Rebuild for Fedora 43 + +* Mon Aug 11 2025 Dogtag PKI Team 5.8.0-0.4.beta4.1 +- Rebase to JSS 5.8.0-beta4 + +* Mon Jul 28 2025 Dogtag PKI Team 5.8.0-0.3.beta3.1 +- Rebase to JSS 5.8.0-beta3 + +* Thu Jul 24 2025 Fedora Release Engineering - 5.8.0-0.1.beta1.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + +* Wed Jul 09 2025 Dogtag PKI Team 5.8.0.1 +- Rebase to JSS 5.8.0-beta1 + * Fri Jan 17 2025 Fedora Release Engineering - 5.6.0-0.1.alpha1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild diff --git a/sources b/sources index 8d8bc4b..f69b2ec 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-5.6.0-alpha1.tar.gz) = 239952d7b1fc9d005760e9234aec84a84a02becefffa525853e9cccd5cfc88e6e0d9d2ea2eea59f43e3b6d1686878081eae1e615ed68d759b3c5aef7397a5472 +SHA512 (jss-5.8.0.tar.gz) = 10f5727d78f8b466062396e47c25b7fdac4b70c6862e6857f8aef49b633c43c4485c1d3cd535006ecd090e8dfe787000fb40d8748ed381c4ac4d1d39312e6c3d