diff --git a/.gitignore b/.gitignore index 521c173..5981ea6 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,10 @@ +# Local build files +jss-*.src.rpm +jss-*/ +x86_64/ +.build-*.log + +# Releases jss-4.2.6.tar.gz /jss-4.2.6.tar.gz /jss-4.4.0.tar.gz @@ -11,3 +18,8 @@ jss-4.2.6.tar.gz /jss-4.5.0-a4.tar.gz /jss-4.5.0-b1.tar.gz /jss-4.5.0.tar.gz +/jss-4.5.1.tar.gz +/jss-4.5.2.tar.gz +/jss-4.5.3.tar.gz +/jss-4.6.1.tar.gz +/jss-4.6.2.tar.gz diff --git a/0001-Fix-NativeProxy-reference-tracker.patch b/0001-Fix-NativeProxy-reference-tracker.patch new file mode 100644 index 0000000..529b576 --- /dev/null +++ b/0001-Fix-NativeProxy-reference-tracker.patch @@ -0,0 +1,53 @@ +From 91514ca0a2979ba778d27220ced0cd312e2cd2d2 Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Tue, 29 Oct 2019 10:43:56 -0400 +Subject: [PATCH] Fix NativeProxy reference tracker + +In eb5df01003d74b57473eacb84e538d31f5bb06ca, I introduced a bug by +setting mPointer after trying to add NativeProxy to the registry. In +most instances this won't matter, however, if another instance exists in +the HashSet with the same hash value, the equals comparator will be +used, triggering a NPE. + +Signed-off-by: Alexander Scheel +--- + org/mozilla/jss/util/NativeProxy.java | 13 +++++-------- + 1 file changed, 5 insertions(+), 8 deletions(-) + +diff --git a/org/mozilla/jss/util/NativeProxy.java b/org/mozilla/jss/util/NativeProxy.java +index 1c6d1aa5..a0811f76 100644 +--- a/org/mozilla/jss/util/NativeProxy.java ++++ b/org/mozilla/jss/util/NativeProxy.java +@@ -40,8 +40,8 @@ public abstract class NativeProxy implements AutoCloseable + */ + public NativeProxy(byte[] pointer) { + assert(pointer!=null); +- registry.add(this); + mPointer = pointer; ++ registry.add(this); + + if (saveStacktraces) { + mTrace = Arrays.toString(Thread.currentThread().getStackTrace()); +@@ -61,15 +61,12 @@ public abstract class NativeProxy implements AutoCloseable + if( ! (obj instanceof NativeProxy) ) { + return false; + } +- if( ((NativeProxy)obj).mPointer.length != mPointer.length) { ++ if (((NativeProxy)obj).mPointer == null) { ++ /* If mPointer is null, we have no way to compare the values ++ * of the pointers, so assume they're unequal. */ + return false; + } +- for(int i=0; i < mPointer.length; i++) { +- if(mPointer[i] != ((NativeProxy)obj).mPointer[i]) { +- return false; +- } +- } +- return true; ++ return Arrays.equals(((NativeProxy)obj).mPointer, mPointer); + } + + /** +-- +2.21.0 + diff --git a/jss.spec b/jss.spec index 8e63e81..84ff66f 100644 --- a/jss.spec +++ b/jss.spec @@ -6,18 +6,17 @@ Summary: Java Security Services (JSS) URL: http://www.dogtagpki.org/wiki/JSS License: MPLv1.1 or GPLv2+ or LGPLv2+ -Version: 4.5.0 -Release: 1%{?_timestamp}%{?_commit_id}%{?dist} +Version: 4.6.2 +Release: 2%{?_timestamp}%{?_commit_id}%{?dist} # global _phase -a1 # To generate the source tarball: # $ git clone https://github.com/dogtagpki/jss.git # $ cd jss -# $ git archive \ -# --format=tar.gz \ -# --prefix jss-VERSION/ \ -# -o jss-VERSION.tar.gz \ -# +# $ git tag v4.5. +# $ git push origin v4.5. +# Then go to https://github.com/dogtagpki/jss/releases and download the source +# tarball. Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phase}/%{name}-%{version}%{?_phase}.tar.gz # To create a patch for all changes since a version tag: @@ -26,6 +25,7 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # \ # > jss-VERSION-RELEASE.patch # Patch: jss-VERSION-RELEASE.patch +Patch: 0001-Fix-NativeProxy-reference-tracker.patch ################################################################################ # Build Dependencies @@ -33,14 +33,17 @@ Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas # autosetup BuildRequires: git +BuildRequires: make +BuildRequires: cmake BuildRequires: gcc-c++ BuildRequires: nspr-devel >= 4.13.1 -BuildRequires: nss-devel >= 3.28.4-6 -BuildRequires: nss-tools >= 3.28.4-6 +BuildRequires: nss-devel >= 3.30 +BuildRequires: nss-tools >= 3.30 BuildRequires: java-devel BuildRequires: jpackage-utils BuildRequires: slf4j +BuildRequires: glassfish-jaxb-api %if 0%{?rhel} && 0%{?rhel} <= 7 # no slf4j-jdk14 %else @@ -49,14 +52,13 @@ BuildRequires: slf4j-jdk14 BuildRequires: apache-commons-lang BuildRequires: apache-commons-codec -%if 0%{?fedora} >= 25 || 0%{?rhel} > 7 -BuildRequires: perl-interpreter -%endif +BuildRequires: junit -Requires: nss >= 3.28.4-6 +Requires: nss >= 3.30 Requires: java-headless Requires: jpackage-utils Requires: slf4j +Requires: glassfish-jaxb-api %if 0%{?rhel} && 0%{?rhel} <= 7 # no slf4j-jdk14 %else @@ -97,43 +99,27 @@ This package contains the API documentation for JSS. %set_build_flags [ -z "$JAVA_HOME" ] && export JAVA_HOME=%{_jvmdir}/java -[ -z "$USE_INSTALLED_NSPR" ] && export USE_INSTALLED_NSPR=1 -[ -z "$USE_INSTALLED_NSS" ] && export USE_INSTALLED_NSS=1 # Enable compiler optimizations export BUILD_OPT=1 # Generate symbolic info for debuggers -XCFLAGS="-g $RPM_OPT_FLAGS" -export XCFLAGS +CFLAGS="-g $RPM_OPT_FLAGS" +export CFLAGS -PKG_CONFIG_ALLOW_SYSTEM_LIBS=1 -PKG_CONFIG_ALLOW_SYSTEM_CFLAGS=1 - -export PKG_CONFIG_ALLOW_SYSTEM_LIBS -export PKG_CONFIG_ALLOW_SYSTEM_CFLAGS - -NSPR_INCLUDE_DIR=`/usr/bin/pkg-config --cflags-only-I nspr | sed 's/-I//'` -NSPR_LIB_DIR=`/usr/bin/pkg-config --libs-only-L nspr | sed 's/-L//'` - -NSS_INCLUDE_DIR=`/usr/bin/pkg-config --cflags-only-I nss | sed 's/-I//'` -NSS_LIB_DIR=`/usr/bin/pkg-config --libs-only-L nss | sed 's/-L//'` - -export NSPR_INCLUDE_DIR -export NSPR_LIB_DIR -export NSS_INCLUDE_DIR -export NSS_LIB_DIR - -%if 0%{?__isa_bits} == 64 -USE_64=1 -export USE_64 -%endif +# Check if we're in FIPS mode +modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENABLED=1 # The Makefile is not thread-safe -make -C coreconf -make -make javadoc -make test_jss +rm -rf build && mkdir -p build && cd build +%cmake \ + -DJAVA_HOME=%{java_home} \ + -DJAVA_LIB_INSTALL_DIR=%{_jnidir} \ + .. + +%{__make} all +%{__make} javadoc || true +ctest --output-on-failure ################################################################################ %install @@ -142,19 +128,19 @@ make test_jss # jars install -d -m 0755 $RPM_BUILD_ROOT%{_jnidir} -install -m 644 ../dist/xpclass.jar ${RPM_BUILD_ROOT}%{_jnidir}/jss4.jar +install -m 644 build/jss4.jar ${RPM_BUILD_ROOT}%{_jnidir}/jss4.jar # We have to use the name libjss4.so because this is dynamically # loaded by the jar file. install -d -m 0755 $RPM_BUILD_ROOT%{_libdir}/jss -install -m 0755 ../dist/Linux*.OBJ/lib/libjss4.so ${RPM_BUILD_ROOT}%{_libdir}/jss/ +install -m 0755 build/libjss4.so ${RPM_BUILD_ROOT}%{_libdir}/jss/ pushd ${RPM_BUILD_ROOT}%{_libdir}/jss ln -fs %{_jnidir}/jss4.jar jss4.jar popd # javadoc install -d -m 0755 $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} -cp -rp ../dist/jssdoc/* $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} +cp -rp build/docs/* $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} cp -p jss.html $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} @@ -175,6 +161,36 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} ################################################################################ %changelog +* Tue Oct 29 2019 Dogtag PKI Team - 4.6.2-2 +- Fix for rhbz#1766451 + +* Tue Oct 15 2019 Dogtag PKI Team - 4.6.2-1 +- Rebase to JSS 4.6.2 +- Fixes CVE-2019-14823 + +* Thu Aug 08 2019 Dogtag PKI Team - 4.6.1-2 +- Disable unnecessary tests to fix broken s390x + +* Thu Aug 08 2019 Dogtag PKI Team - 4.6.1-1 +- Rebase to JSS 4.6.1 + +* Mon May 06 2019 Dogtag PKI Team - 4.5.3-2 +- Add AIA OCSP certificate checking patch + +* Tue Mar 19 2019 Dogtag PKI Team - 4.5.3-1 +- Rebase to JSS 4.5.3 + +* Fri Feb 01 2019 Dogtag PKI Team - 4.5.2-3 +- Include nuxwdog patch for netscape.security.util.Utils from PKI + +* Mon Jan 14 2019 Dogtag PKI Team 4.5.2-1 +- Rebased to JSS 4.5.2 + +* Thu Nov 29 2018 Dogtag PKI Team 4.5.1-1 +- Rebased to JSS 4.5.1 +- Red Hat Bugzilla #1582323 - DER encoding error for enumerated types with a value of zero +- Red Hat Bugzilla #1534765 - javadoc for org.mozilla.jss.pkix.cms.SignedData.getSignerInfos() is incorrect + * Fri Aug 10 2018 Dogtag PKI Team 4.5.0-1 - Rebased to JSS 4.5.0 diff --git a/sources b/sources index e88e6d8..32f2840 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (jss-4.5.0.tar.gz) = abebd75104f747a95dc3160dc6218c549235f5c9ee2d416299bfe132072b76fb7f0fec4ce2664931bf971280836ab0eb26746f964c13300393fa6a5937f81cda +SHA512 (jss-4.6.2.tar.gz) = 53c12822b980f6dcaf5616366834fe4eaee07d84feae53096aa0ea142146e90d375910456d8192068cde5e63c3b60ded87862af50ea89c6b64224e8c105e00dd