Fix changelog

ELN (the future RHEL 11) tracks rawhide and includes the relevant change:

https://fedoraproject.org/wiki/Changes/Java25AndNoMoreSystemJdk

.gitignore

@@ -22,3 +22,34 @@ jss-4.2.6.tar.gz
 /jss-4.5.2.tar.gz
 /jss-4.5.3.tar.gz
 /jss-4.6.1.tar.gz
+/jss-4.6.2.tar.gz
+/jss-4.6.3.tar.gz
+/jss-4.6.4.tar.gz
+/jss-4.7.0-b2.tar.gz
+/jss-4.7.0-b4.tar.gz
+/jss-4.7.0.tar.gz
+/jss-4.7.2.tar.gz
+/jss-4.7.3.tar.gz
+/jss-4.8.0-b1.tar.gz
+/jss-4.8.0.tar.gz
+/jss-4.8.1.tar.gz
+/jss-4.9.0-alpha1.tar.gz
+/jss-5.0.0-alpha1.tar.gz
+/jss-5.0.0-alpha2.tar.gz
+/jss-5.0.0-beta1.tar.gz
+/jss-5.0.0.tar.gz
+/jss-5.1.0-alpha2.tar.gz
+/jss-5.1.0.tar.gz
+/jss-5.2.0-beta1.tar.gz
+/jss-5.2.0-beta2.tar.gz
+/jss-5.2.0.tar.gz
+/jss-5.3.0.tar.gz
+/jss-5.4.2.tar.gz
+/jss-5.5.0-alpha2.tar.gz
+/jss-5.5.0.tar.gz
+/jss-5.5.1.tar.gz
+/jss-5.6.0-alpha1.tar.gz
+/jss-5.8.0-beta1.tar.gz
+/jss-5.8.0-beta3.tar.gz
+/jss-5.8.0-beta4.tar.gz
+/jss-5.8.0.tar.gz

.packit.yaml

@@ -0,0 +1,30 @@
+---
+# See the documentation for more information:
+# https://packit.dev/docs/configuration/
+specfile_path: jss.spec
+
+# add or remove files that should be synced
+files_to_sync:
+  - jss.spec
+  - .packit.yaml
+
+# Allow dist git reactions on packit and ckelley commits and PRs
+allowed_pr_authors:
+  - packit
+  - ckelleyRH
+allowed_committers:
+  - packit
+  - ckelleyRH
+
+upstream_package_name: jss
+# downstream (Fedora/CentOS) RPM package name
+downstream_package_name: jss
+# see: https://packit.dev/docs/configuration/#upstream_tag_template
+upstream_tag_template: "v{version}"
+
+jobs:
+  - job: propose_downstream
+    trigger: release
+    dist_git_branches:
+      - fedora-development
+#     - centos-stream-9-x86_64 # When Packit integration with CentOS is avaiable, enable this

0001-Disable-buffer-based-tests.patch

@@ -1,78 +0,0 @@
-From ab1ba593ac9965607e60a16f3e5e75ba9ccfb505 Mon Sep 17 00:00:00 2001
-From: Alexander Scheel <ascheel@redhat.com>
-Date: Thu, 8 Aug 2019 12:35:28 -0400
-Subject: [PATCH] Disable failing tests on special arches
-
-Signed-off-by: Alexander Scheel <ascheel@redhat.com>
----
- cmake/JSSTests.cmake | 40 ----------------------------------------
- 1 file changed, 40 deletions(-)
-
-diff --git a/cmake/JSSTests.cmake b/cmake/JSSTests.cmake
-index 9397f45d..ae6b0d22 100644
---- a/cmake/JSSTests.cmake
-+++ b/cmake/JSSTests.cmake
-@@ -78,19 +78,6 @@ macro(jss_tests)
-         NAME "BigObjectIdentifier"
-         COMMAND "org.mozilla.jss.tests.BigObjectIdentifier"
-     )
--    jss_test_java(
--        NAME "JSS_Test_PR_FileDesc"
--        COMMAND "org.mozilla.jss.tests.TestPRFD"
--    )
--    jss_test_java(
--        NAME "JSS_Test_Raw_SSL"
--        COMMAND "org.mozilla.jss.tests.TestRawSSL" "${RESULTS_NSSDB_OUTPUT_DIR}"
--        DEPENDS "Setup_DBs"
--    )
--    jss_test_java(
--        NAME "JSS_Test_Buffer"
--        COMMAND "org.mozilla.jss.tests.TestBuffer"
--    )
-     if ((${Java_VERSION_MAJOR} EQUAL 1) AND (${Java_VERSION_MINOR} LESS 9))
-         jss_test_java(
-             NAME "Test_PKCS11Constants.java_for_Sun_compatibility"
-@@ -121,16 +108,6 @@ macro(jss_tests)
-         NAME "JUnit_UTF8StringTest"
-         COMMAND "org.junit.runner.JUnitCore" "org.mozilla.jss.tests.UTF8StringTest"
-     )
--    jss_test_exec(
--        NAME "buffer_size_1"
--        COMMAND "${BIN_OUTPUT_DIR}/buffer_size_1"
--        DEPENDS "generate_c_buffer_size_1"
--    )
--    jss_test_exec(
--        NAME "buffer_size_4"
--        COMMAND "${BIN_OUTPUT_DIR}/buffer_size_4"
--        DEPENDS "generate_c_buffer_size_4"
--    )
-     jss_test_java(
-         NAME "JUnit_ChainSortingTest"
-         COMMAND "org.junit.runner.JUnitCore" "org.mozilla.jss.tests.ChainSortingTest"
-@@ -253,23 +230,6 @@ macro(jss_tests)
-             DEPENDS "Setup_DBs"
-         )
- 
--        # SSL Engine related tests
--        jss_test_exec(
--            NAME "TestBufferPRFD_RSA"
--            COMMAND "${BIN_OUTPUT_DIR}/TestBufferPRFD" "${RESULTS_NSSDB_OUTPUT_DIR}" "${DB_PWD}" "Server_RSA"
--            DEPENDS "List_CA_certs" "generate_c_TestBufferPRFD"
--        )
--        jss_test_exec(
--            NAME "TestBufferPRFD_ECDSA"
--            COMMAND "${BIN_OUTPUT_DIR}/TestBufferPRFD" "${RESULTS_NSSDB_OUTPUT_DIR}" "${DB_PWD}" "Server_ECDSA"
--            DEPENDS "List_CA_certs" "generate_c_TestBufferPRFD"
--        )
--        jss_test_java(
--            NAME "JSS_Test_BufferPRFD"
--            COMMAND "org.mozilla.jss.tests.TestBufferPRFD" "${RESULTS_NSSDB_OUTPUT_DIR}" "${DB_PWD}"
--            DEPENDS "List_CA_certs"
--        )
--
-         # FIPS-related tests
-         jss_test_java(
-             NAME "Enable_FipsMODE"
--- 
-2.21.0
-

README.packit

@@ -0,0 +1,3 @@
+This repository is maintained by packit.
+https://packit.dev/
+The file was generated using packit 0.76.0.post10+g0dcb396.

jss-aia-ocsp-1.patch

@@ -1,659 +0,0 @@
-From 8975c8ae1d0c8b916c5c73aff12046b01d3e6ef0 Mon Sep 17 00:00:00 2001
-From: Jack Magne <jmagne@redhat.com>
-Date: Fri, 25 Jan 2019 14:54:11 -0800
-Subject: [PATCH] Resolve Bug 1666872 - CC: Enable AIA OCSP cert checking for
- entire cert chain.
-
-This fix for jss, solves the one use case where the pki server is configured to perform ocsp checking ONLY with the contents of the AIA extension. Previously, jss could only check the ocsp server for the leaf node cert of the cert being verified. This fix allows the cert chain to be checked over ocsp for each cert in question. This is possible due to the fact that we have made a call in the PKIX library of nss to do the actual cert verfication. This call is made with all the needed flags to tell the PKIX library to make the ocsp verifications remotely over the network using the contents of the AIA extension.
-
-Later on we can use this code to handle the other cases, but for now we want to solve this one particular problem. If the server is configured in any other configuration than the one stated, the original verification code will be called as before. Below is an example of a configuration in server.xml, that will trigger this new code:
-
-< .... enableOCSP="true" ocspCacheSize="10000" ocspMinCacheEntryDuration="7200"   .... >
-
-Note that due to ocsp caching, the cert chain verification may only be apparent after a restart of the server. A way to force an ocsp fetch every time is to set the value of ocspCacheSize=-1, which essentially disables the cache.
-
-Added a couple of minor fixes due to review comments. Possibly more to come.
-Minor include directive change to compile on branch.
----
- org/mozilla/jss/CryptoManager.java |  48 +++++++
- org/mozilla/jss/PK11Finder.c       |  95 ++++++++++++--
- org/mozilla/jss/ssl/callbacks.c    |  67 ++++++++--
- org/mozilla/jss/ssl/common.c       | 196 +++++++++++++++++++++++++++++
- org/mozilla/jss/ssl/jssl.h         |  29 +++++
- org/mozilla/jss/util/java_ids.h    |   9 ++
- 6 files changed, 422 insertions(+), 22 deletions(-)
-
-diff --git a/org/mozilla/jss/CryptoManager.java b/org/mozilla/jss/CryptoManager.java
-index 9b86bf9e..c9a3fb2b 100644
---- a/org/mozilla/jss/CryptoManager.java
-+++ b/org/mozilla/jss/CryptoManager.java
-@@ -1201,6 +1201,44 @@ private native boolean verifyCertTempNative(byte[] certPackage,
-     // OCSP management
-     ///////////////////////////////////////////////////////////////////////
- 
-+    /* OCSP Policy related */
-+
-+    public enum OCSPPolicy {
-+        NONE,
-+        NORMAL,
-+        LEAF_AND_CHAIN;
-+    }
-+
-+    private static OCSPPolicy ocspPolicy  = OCSPPolicy.NONE;
-+
-+    /**
-+     * Gets the current ocsp Policy.
-+     * Currently we only support 2 modes  OCSP_LEAF_AND_CHAIN_POLICY.
-+     * And OCSP_NORMAL_POLICY, which is current processing , by default.
-+     * If we have AIA based OCSP enabled we will check all certs in the chain.
-+     * using PKIX cert verfication calls in the various cert auth callbacks we
-+     * have.
-+     * @return - The current ocsp policy in effect.
-+     */
-+
-+    public static synchronized int getOCSPPolicy() {
-+        return ocspPolicy.ordinal();
-+    }
-+
-+    /**
-+     * Sets the current ocsp Policy.
-+     * Currently we only support one mode OCSP_LEAF_AND_CHAIN_POLICY.
-+     * If we have AIA based OCSP enabled we will check all certs in the chain.
-+     * using PKIX cert verfication calls in the various cert auth callbacks we
-+     * have.
-+     * @param policy - Either cert and chain or normal default processing.
-+     *
-+     */
-+ 
-+    public static synchronized void setOCSPPolicy(OCSPPolicy policy) {
-+        ocspPolicy = policy;
-+    }
-+
-     /**
-      * Enables OCSP, note when you Initialize JSS for the first time, for
-      * backwards compatibility, the initialize will enable OCSP if you
-@@ -1220,6 +1258,16 @@ public void configureOCSP(
-         String ocspResponderCertNickname )
-     throws GeneralSecurityException
-     {
-+        /* set the ocsp policy */
-+
-+        if(ocspCheckingEnabled && 
-+            ocspResponderURL == null && 
-+            ocspResponderCertNickname == null) {
-+            setOCSPPolicy(OCSPPolicy.LEAF_AND_CHAIN);
-+        } else {
-+            setOCSPPolicy(OCSPPolicy.NORMAL);
-+        }
-+
-         configureOCSPNative(ocspCheckingEnabled,
-                                    ocspResponderURL,
-                                     ocspResponderCertNickname );
-diff --git a/org/mozilla/jss/PK11Finder.c b/org/mozilla/jss/PK11Finder.c
-index 45958181..0329e91d 100644
---- a/org/mozilla/jss/PK11Finder.c
-+++ b/org/mozilla/jss/PK11Finder.c
-@@ -14,9 +14,9 @@
- #include <secpkcs7.h>
- 
- #include <jssutil.h>
--
- #include <jss_exceptions.h>
- #include "pk11util.h"
-+#include "ssl/jssl.h"
- #include <java_ids.h>
- 
- /*
-@@ -1574,6 +1574,9 @@ SECStatus verifyCertificateNow(JNIEnv *env, jobject self, jstring nickString,
-          goto finish;
-     }
- 
-+    int ocspPolicy = JSSL_getOCSPPolicy();
-+    
-+
-     certificateUsage = required_certificateUsage;
- 
-     cert = CERT_FindCertByNickname(CERT_GetDefaultCertDB(), nickname);
-@@ -1587,8 +1590,24 @@ SECStatus verifyCertificateNow(JNIEnv *env, jobject self, jstring nickString,
-     /* 0 for certificateUsage in call to CERT_VerifyCertificateNow will
-      * retrieve the current valid usage into currUsage
-      */
--        rv = CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert,
--            checkSig, certificateUsage, NULL, currUsage );
-+        if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) {
-+            rv = JSSL_verifyCertPKIX( cert, certificateUsage,
-+                     NULL /* pin arg */, ocspPolicy, NULL, currUsage);
-+
-+            /* we need to do this just to get the cert usages, the pkix version
-+               doesn't seem to honor the method to get the usages as of yet.
-+               Let the PKIX call only determine the final fate.
-+            */
-+            if(rv == SECSuccess) {
-+                CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert,
-+                checkSig, certificateUsage, NULL, currUsage );
-+            }
-+
-+        } else {
-+            rv = CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert,
-+                checkSig, certificateUsage, NULL, currUsage );
-+        }
-+
-         if ((rv == SECSuccess) && certificateUsage == 0x0000) {
-             if (*currUsage == 
-                 ( certUsageUserCertImport |
-@@ -1639,6 +1658,8 @@ Java_org_mozilla_jss_CryptoManager_verifyCertificateNowNative(JNIEnv *env,
-          goto finish;
-     }
- 
-+    int ocspPolicy = JSSL_getOCSPPolicy();
-+
-     certificateUsage = required_certificateUsage;
- 
-     cert = CERT_FindCertByNickname(CERT_GetDefaultCertDB(), nickname);
-@@ -1653,8 +1674,23 @@ Java_org_mozilla_jss_CryptoManager_verifyCertificateNowNative(JNIEnv *env,
-      * just get the current usage (which we are not passing back for now
-      * but will bypass the certificate usage check
-      */
--        rv = CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert,
--            checkSig, certificateUsage, NULL, &currUsage );
-+
-+        if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) {
-+            rv= JSSL_verifyCertPKIX( cert, certificateUsage,
-+                     NULL /* pin arg */, ocspPolicy, NULL, &currUsage);
-+
-+            /* we need to do this just to get the cert usages, the pkix version
-+               doesn't seem to honor the method to get the usages as of yet.
-+               Let the PKIX call only determine the final fate.
-+            */
-+            if(rv == SECSuccess) {
-+                CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert,
-+                checkSig, certificateUsage, NULL, &currUsage );
-+            }
-+        } else {
-+            rv = CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert,
-+                checkSig, certificateUsage, NULL, &currUsage );
-+        }
-     }
- 
- finish:
-@@ -1720,12 +1756,14 @@ Java_org_mozilla_jss_CryptoManager_verifyCertificateNowNative2(JNIEnv *env,
-     SECStatus                rv = SECFailure;
-     CERTCertificate          *cert = NULL;
-     char                     *nickname = NULL;
--    
-+   
-     if (nickString == NULL) {
-         JSS_throwMsg(env, INVALID_NICKNAME_EXCEPTION, "Missing certificate nickname");
-         goto finish;
-     }
- 
-+    int ocspPolicy = JSSL_getOCSPPolicy();
-+
-     nickname = (char *) (*env)->GetStringUTFChars(env, nickString, NULL);
-     if (nickname == NULL) {
-         JSS_throwMsg(env, INVALID_NICKNAME_EXCEPTION, "Missing certificate nickname");
-@@ -1747,8 +1785,25 @@ Java_org_mozilla_jss_CryptoManager_verifyCertificateNowNative2(JNIEnv *env,
-     /* 0 for certificateUsage in call to CERT_VerifyCertificateNow will
-      * retrieve the current valid usage into currUsage
-      */
--    rv = CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert,
--        checkSig, certificateUsage, NULL, &currUsage);
-+
-+    if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) {
-+        rv = JSSL_verifyCertPKIX( cert, certificateUsage,
-+                     NULL /* pin arg */, ocspPolicy, NULL, &currUsage);
-+
-+        /* we need to do this just to get the cert usages, the pkix version
-+           doesn't seem to honor the method to get the usages as of yet.
-+           Let the PKIX call only determine the final fate.
-+        */
-+        if(rv == SECSuccess) {
-+            CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert,
-+            checkSig, certificateUsage, NULL, &currUsage );
-+
-+        }
-+
-+    } else {
-+        rv = CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert,
-+                     checkSig, certificateUsage, NULL, &currUsage);
-+    }
- 
-     if (rv != SECSuccess) {
-         JSS_throwMsgPrErr(env, CERTIFICATE_EXCEPTION, "Invalid certificate");
-@@ -1803,6 +1858,9 @@ Java_org_mozilla_jss_CryptoManager_verifyCertNowNative(JNIEnv *env,
-     if( nickname == NULL ) {
-          goto finish;
-     }
-+
-+    int ocspPolicy = JSSL_getOCSPPolicy();
-+
-     certUsage = cUsage;
-     cert = CERT_FindCertByNickname(CERT_GetDefaultCertDB(), nickname);
- 
-@@ -1812,8 +1870,13 @@ Java_org_mozilla_jss_CryptoManager_verifyCertNowNative(JNIEnv *env,
-         PR_smprintf_free(message);
-         goto finish;
-     } else {
--        rv = CERT_VerifyCertNow(CERT_GetDefaultCertDB(), cert,
--            checkSig, certUsage, NULL );
-+        if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) {
-+            rv = JSSL_verifyCertPKIX( cert, certUsage,
-+                NULL /* pin arg */, ocspPolicy, NULL, NULL);
-+        } else {
-+            rv = CERT_VerifyCertNow(CERT_GetDefaultCertDB(), cert,
-+                checkSig, certUsage, NULL );
-+        }
-     }
- 
- finish:
-@@ -1858,6 +1921,8 @@ Java_org_mozilla_jss_CryptoManager_verifyCertTempNative(JNIEnv *env,
-     derCerts[0] = JSS_ByteArrayToSECItem(env, packageArray);
-     derCerts[1] = NULL;
- 
-+    int ocspPolicy = JSSL_getOCSPPolicy();
-+
-     rv = CERT_ImportCerts(certdb, cUsage,
-                           1, derCerts, &certArray, PR_FALSE /*temp Certs*/,
-                           PR_FALSE /*caOnly*/, NULL);
-@@ -1869,8 +1934,14 @@ Java_org_mozilla_jss_CryptoManager_verifyCertTempNative(JNIEnv *env,
-     }
- 
-     certUsage = cUsage;
--    rv = CERT_VerifyCertNow(certdb, certArray[0],
--                            checkSig, certUsage, NULL );
-+
-+    if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) {
-+        rv = JSSL_verifyCertPKIX( certArray[0], certUsage,
-+            NULL /* pin arg */, ocspPolicy, NULL, NULL);
-+    } else {
-+        rv = CERT_VerifyCertNow(certdb, certArray[0],
-+            checkSig, certUsage, NULL );
-+    }
- 
-     finish:
-     /* this checks for NULL */
-diff --git a/org/mozilla/jss/ssl/callbacks.c b/org/mozilla/jss/ssl/callbacks.c
-index 634f31ec..42594a14 100644
---- a/org/mozilla/jss/ssl/callbacks.c
-+++ b/org/mozilla/jss/ssl/callbacks.c
-@@ -20,6 +20,40 @@
- #include <pk11util.h>
- #include <secder.h>
- 
-+int
-+JSSL_getOCSPPolicy() {
-+    JNIEnv *env;
-+    jint policy = -1;
-+
-+    jmethodID getOCSPPolicyID;
-+    jclass cryptoManagerClass;
-+
-+    /* get the JNI environment */
-+    if((*JSS_javaVM)->AttachCurrentThread(JSS_javaVM, (void**)&env, NULL) != 0){
-+        PR_ASSERT(PR_FALSE);
-+        goto finish;
-+    }
-+
-+    cryptoManagerClass = (*env)->FindClass(env, CRYPTO_MANAGER_NAME);
-+    if( cryptoManagerClass == NULL ) {
-+        ASSERT_OUTOFMEM(env);
-+        goto finish;
-+    }
-+    getOCSPPolicyID = (*env)->GetStaticMethodID(env, cryptoManagerClass,
-+        GET_OCSP_POLICY_NAME,GET_OCSP_POLICY_SIG);
-+
-+    if( getOCSPPolicyID == NULL ) {
-+        ASSERT_OUTOFMEM(env);
-+        goto finish;
-+    }
-+
-+    policy = (*env)->CallStaticIntMethod(env, cryptoManagerClass,
-+         getOCSPPolicyID);
-+
-+finish:
-+    return (int) policy;
-+}
-+
- static SECStatus
- secCmpCertChainWCANames(CERTCertificate *cert, CERTDistNames *caNames) 
- {
-@@ -443,8 +477,9 @@ JSSL_DefaultCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig,
-     SECCertUsage      certUsage;
-     CERTCertificate   *peerCert=NULL;
- 
-+    int ocspPolicy = JSSL_getOCSPPolicy();
-+
-     certUsage = isServer ? certUsageSSLClient : certUsageSSLServer;
-- 
- 
-     /* SSL_PeerCertificate() returns a shallow copy of the cert, so we
-        must destroy it before we exit this function */
-@@ -452,8 +487,13 @@ JSSL_DefaultCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig,
-     peerCert   = SSL_PeerCertificate(fd);
- 
-     if (peerCert) {
--        rv = CERT_VerifyCertNow(CERT_GetDefaultCertDB(), peerCert,
--                checkSig, certUsage, NULL /*pinarg*/);
-+        if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) {
-+            rv = JSSL_verifyCertPKIX( peerCert, certUsage,
-+                     NULL /* pin arg */, ocspPolicy, NULL, NULL);
-+        } else {
-+            rv = CERT_VerifyCertNow(CERT_GetDefaultCertDB(), peerCert,
-+                    checkSig, certUsage, NULL /*pinarg*/);
-+        }
-     }
- 
-     /* if we're a server, then we don't need to check the CN of the
-@@ -569,6 +609,8 @@ JSSL_JavaCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig,
-     log.tail = NULL;
-     log.count = 0;
- 
-+    int ocspPolicy = JSSL_getOCSPPolicy();
-+
-     /* get the JNI environment */
-     if((*JSS_javaVM)->AttachCurrentThread(JSS_javaVM, (void**)&env, NULL) != 0){
-         PR_ASSERT(PR_FALSE);
-@@ -589,13 +631,18 @@ JSSL_JavaCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig,
-      * logging parameter)
-      */
- 
--    verificationResult = CERT_VerifyCert(   CERT_GetDefaultCertDB(),
--                            peerCert,
--                            checkSig,
--                            certUsage,
--                            PR_Now(),
--                            NULL /*pinarg*/,
--                            &log);
-+    if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) {
-+        verificationResult = JSSL_verifyCertPKIX( peerCert, certUsage,
-+                                 NULL /* pin arg */, ocspPolicy, &log, NULL);
-+     }  else {
-+        verificationResult = CERT_VerifyCert(   CERT_GetDefaultCertDB(),
-+                                peerCert,
-+                                checkSig,
-+                                certUsage,
-+                                PR_Now(),
-+                                NULL /*pinarg*/,
-+                                &log);
-+     }
- 
-     if (verificationResult == SECSuccess && log.count > 0) {
-         verificationResult = SECFailure;
-diff --git a/org/mozilla/jss/ssl/common.c b/org/mozilla/jss/ssl/common.c
-index 5c6efa85..aec88552 100644
---- a/org/mozilla/jss/ssl/common.c
-+++ b/org/mozilla/jss/ssl/common.c
-@@ -15,6 +15,7 @@
- #include <pk11util.h>
- #include "_jni/org_mozilla_jss_ssl_SSLSocket.h"
- #include "jssl.h"
-+#include "cert.h"
- 
- #ifdef WIN32
- #include <winsock.h>
-@@ -889,3 +890,198 @@ JSS_SSL_processExceptions(JNIEnv *env, PRFilePrivate *priv)
-         PR_ASSERT(ret == 0);
-     }
- }
-+
-+/* Get the trusted anchor for pkix */
-+
-+CERTCertificate * getRoot(CERTCertificate *cert, 
-+    SECCertificateUsage certUsage) 
-+{
-+    CERTCertificate  *root = NULL;
-+    CERTCertListNode *node = NULL;
-+
-+    if( !cert ) {
-+        goto finish;
-+    }
-+
-+    CERTCertList *certList =  CERT_GetCertChainFromCert(cert, 
-+        PR_Now(), 
-+        certUsage);
-+
-+    if( certList == NULL) {
-+        goto finish;
-+    }
-+
-+    for (node = CERT_LIST_HEAD(certList);
-+       !CERT_LIST_END(node, certList);
-+       node = CERT_LIST_NEXT(node)) {
-+       
-+        /* try to find the root */
-+       if( node->cert && node->cert->isRoot ) {
-+          root = CERT_DupCertificate(node->cert) ;
-+       } 
-+    }
-+
-+finish:
-+  
-+    CERT_DestroyCertList (certList); 
-+    return root; 
-+}
-+
-+/* Verify a cert using explicit PKIX call.
-+ * For now only used in OCSP AIA context.
-+ * The result of this call will be a full chain
-+ * and leaf network AIA ocsp validation.
-+ * The policy param will be used in the future to
-+ * handle more scenarios.
-+ */
-+
-+SECStatus JSSL_verifyCertPKIX(CERTCertificate *cert,
-+      SECCertificateUsage certUsage,secuPWData *pwdata, int ocspPolicy,
-+      CERTVerifyLog *log, SECCertificateUsage *usage) 
-+{
-+
-+    /* put the first set of possible flags internally here first */
-+    /* later there could be a more complete list to choose from */
-+    /* support our hard core fetch aia ocsp policy for now */
-+
-+    static PRUint64 ocsp_Enabled_Hard_Policy_LeafFlags[2] = {
-+        /* crl */
-+        0,
-+        /* ocsp */
-+        CERT_REV_M_TEST_USING_THIS_METHOD |
-+        CERT_REV_M_FAIL_ON_MISSING_FRESH_INFO
-+    };
-+
-+    static PRUint64 ocsp_Enabled_Hard_Policy_ChainFlags[2] = {
-+        /* crl */
-+        0,
-+        /* ocsp */
-+        CERT_REV_M_TEST_USING_THIS_METHOD |
-+        CERT_REV_M_FAIL_ON_MISSING_FRESH_INFO
-+    };
-+
-+    static CERTRevocationMethodIndex
-+        ocsp_Enabled_Hard_Policy_Method_Preference = {
-+            cert_revocation_method_ocsp
-+        };
-+
-+    static CERTRevocationFlags ocsp_Enabled_Hard_Policy = {
-+    { /* leafTests */
-+      2,
-+      ocsp_Enabled_Hard_Policy_LeafFlags,
-+      1,
-+      &ocsp_Enabled_Hard_Policy_Method_Preference,
-+      0 },
-+    { /* chainTests */
-+      2,
-+      ocsp_Enabled_Hard_Policy_ChainFlags,
-+      1,
-+      &ocsp_Enabled_Hard_Policy_Method_Preference,
-+      0 }
-+    };
-+
-+    /* for future expansion */
-+
-+    CERTValOutParam cvout[20] = {0};
-+    CERTValInParam cvin[20] = {0};
-+
-+    int inParamIndex = 0;
-+    int outParamIndex = 0;
-+    CERTRevocationFlags *rev = NULL;
-+
-+    CERTCertList *trustedCertList = NULL;
-+
-+    PRBool fetchCerts = PR_FALSE;
-+
-+    SECStatus res =  SECFailure;
-+    if(cert == NULL) {
-+        goto finish;
-+    }
-+
-+    if(ocspPolicy != OCSP_LEAF_AND_CHAIN_POLICY) {
-+        goto finish;
-+    }
-+
-+    /* Force the strict ocsp network check on chain
-+       and leaf.
-+    */
-+
-+    fetchCerts = PR_TRUE;   
-+    rev = &ocsp_Enabled_Hard_Policy;
-+
-+    /* fetch aia over net */
-+ 
-+    cvin[inParamIndex].type = cert_pi_useAIACertFetch;
-+    cvin[inParamIndex].value.scalar.b = fetchCerts;
-+    inParamIndex++; 
-+
-+    /* time */
-+
-+    cvin[inParamIndex].type = cert_pi_date;
-+    cvin[inParamIndex].value.scalar.time = PR_Now();
-+    inParamIndex++;
-+
-+    /* flags */
-+
-+    cvin[inParamIndex].type = cert_pi_revocationFlags;
-+    cvin[inParamIndex].value.pointer.revocation = rev;
-+    inParamIndex++;
-+
-+
-+    /* establish trust anchor */
-+
-+    CERTCertificate *root = getRoot(cert,certUsage);
-+
-+    /* Try to add the root as the trust anchor so all the
-+       other memebers of the ca chain will get validated.
-+    */
-+
-+    if( root != NULL ) {
-+        trustedCertList = CERT_NewCertList();
-+        CERT_AddCertToListTail(trustedCertList, root);        
-+
-+        cvin[inParamIndex].type = cert_pi_trustAnchors;
-+        cvin[inParamIndex].value.pointer.chain = trustedCertList;
-+
-+        inParamIndex++;
-+    }
-+
-+    cvin[inParamIndex].type = cert_pi_end;
-+
-+    if(log != NULL) {
-+        cvout[outParamIndex].type = cert_po_errorLog;
-+        cvout[outParamIndex].value.pointer.log = log;
-+        outParamIndex ++;
-+    }
-+
-+    int usageIndex = 0;
-+    if(usage != NULL) {
-+        usageIndex = outParamIndex;
-+        cvout[outParamIndex].type = cert_po_usages;
-+        cvout[outParamIndex].value.scalar.usages = 0;
-+        outParamIndex ++;
-+    }
-+
-+    cvout[outParamIndex].type = cert_po_end;
-+
-+    res = CERT_PKIXVerifyCert(cert, certUsage, cvin, cvout, &pwdata);
-+
-+finish:
-+    /* clean up any trusted cert list */
-+
-+    if (trustedCertList) {
-+        CERT_DestroyCertList(trustedCertList);
-+        trustedCertList = NULL;
-+    }
-+
-+    if(root) {
-+       CERT_DestroyCertificate(root);
-+       root = NULL;
-+    }
-+
-+    if(res == SECSuccess && usage) {
-+        *usage = cvout[usageIndex].value.scalar.usages;
-+    }
-+
-+    return res;
-+}
-diff --git a/org/mozilla/jss/ssl/jssl.h b/org/mozilla/jss/ssl/jssl.h
-index c15acf87..0e93eebe 100644
---- a/org/mozilla/jss/ssl/jssl.h
-+++ b/org/mozilla/jss/ssl/jssl.h
-@@ -5,8 +5,27 @@
- #ifndef ORG_MOZILLA_JSS_SSL_JSSL_H
- #define ORG_MOZILLA_JSS_SSL_JSSL_H
- 
-+/* ocsp policy constants */
-+
-+/* ocsp policy constants */
-+static const int OCSP_NO_POLICY = 0;
-+static const int OCSP_NORMAL_POLICY = 1;
-+static const int OCSP_LEAF_AND_CHAIN_POLICY = 2;
-+
- #include <ssl.h>
- 
-+typedef struct
-+{
-+    enum
-+    {
-+        PW_NONE = 0,
-+        PW_FROMFILE = 1,
-+        PW_PLAINTEXT = 2,
-+        PW_EXTERNAL = 3
-+    } source;
-+    char *data;
-+} secuPWData;
-+
- struct JSSL_SocketData {
-     PRFileDesc *fd;
-     jobject socketObject; /* weak global ref */
-@@ -120,4 +139,14 @@ JSS_SSL_processExceptions(JNIEnv *env, PRFilePrivate *priv);
- 
- void JSSL_throwSSLSocketException(JNIEnv *env, char *message);
- 
-+int
-+JSSL_getOCSPPolicy();
-+
-+
-+SECStatus 
-+JSSL_verifyCertPKIX(CERTCertificate *cert,
-+                    SECCertificateUsage certUsage,
-+                    secuPWData *pwdata, int ocspPolicy,
-+                    CERTVerifyLog *log,SECCertificateUsage *usage);
-+
- #endif
-diff --git a/org/mozilla/jss/util/java_ids.h b/org/mozilla/jss/util/java_ids.h
-index 73b31fa9..4053d9a7 100644
---- a/org/mozilla/jss/util/java_ids.h
-+++ b/org/mozilla/jss/util/java_ids.h
-@@ -276,6 +276,15 @@ PR_BEGIN_EXTERN_C
- #define GET_RECV_BUF_SIZE "getReceiveBufferSize"
- #define GET_BUF_SIZE_SIG "()I"
- 
-+/*
-+ * CryptoManager
-+ *
-+*/
-+
-+#define CRYPTO_MANAGER_NAME "org/mozilla/jss/CryptoManager"
-+#define GET_OCSP_POLICY_NAME "getOCSPPolicy"
-+#define GET_OCSP_POLICY_SIG "()I"
-+
- /*
-  * SocketBase
-  */

jss-aia-ocsp-2.patch

@@ -1,141 +0,0 @@
-From 1fe6a451ec0c3ec960ac1119b39c406d999da5ec Mon Sep 17 00:00:00 2001
-From: Jack Magne <jmagne@redhat.com>
-Date: Fri, 8 Feb 2019 11:21:48 -0800
-Subject: [PATCH] Additional: Resolve Bug 1666872 - CC: Enable AIA OCSP cert
- checking for entire cert chain.
-
-Simple fix to make sure we are using the correct variant of the NSS cert usage quantity.
-
-It turns out some calls need a SECCertUsage and others need a SECCertificateUsage.
-We also need to convert between the two in certain instances.
-
-Found and fixed double certificate object free issue.
----
- org/mozilla/jss/ssl/callbacks.c | 10 ++++++++--
- org/mozilla/jss/ssl/common.c    | 19 ++++++++++++++-----
- org/mozilla/jss/ssl/jssl.h      |  2 +-
- 3 files changed, 23 insertions(+), 8 deletions(-)
-
-diff --git a/org/mozilla/jss/ssl/callbacks.c b/org/mozilla/jss/ssl/callbacks.c
-index 42594a14..4fe08a29 100644
---- a/org/mozilla/jss/ssl/callbacks.c
-+++ b/org/mozilla/jss/ssl/callbacks.c
-@@ -481,6 +481,9 @@ JSSL_DefaultCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig,
- 
-     certUsage = isServer ? certUsageSSLClient : certUsageSSLServer;
- 
-+    /* PKIX call needs a SECCertificate usage, convert */
-+    SECCertificateUsage certificateUsage =  (SECCertificateUsage)1 << certUsage;
-+
-     /* SSL_PeerCertificate() returns a shallow copy of the cert, so we
-        must destroy it before we exit this function */
- 
-@@ -488,7 +491,7 @@ JSSL_DefaultCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig,
- 
-     if (peerCert) {
-         if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) {
--            rv = JSSL_verifyCertPKIX( peerCert, certUsage,
-+            rv = JSSL_verifyCertPKIX( peerCert, certificateUsage,
-                      NULL /* pin arg */, ocspPolicy, NULL, NULL);
-         } else {
-             rv = CERT_VerifyCertNow(CERT_GetDefaultCertDB(), peerCert,
-@@ -624,6 +627,9 @@ JSSL_JavaCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig,
-     if (peerCert == NULL) goto finish;
- 
-     certUsage = isServer ? certUsageSSLClient : certUsageSSLServer;
-+    /* PKIX call needs a SECCertificate usage, convert */
-+    SECCertificateUsage certificateUsage =  (SECCertificateUsage)1 << certUsage;
-+
- 
-     /* 
-      * verify it against current time - (can't use
-@@ -632,7 +638,7 @@ JSSL_JavaCertAuthCallback(void *arg, PRFileDesc *fd, PRBool checkSig,
-      */
- 
-     if( ocspPolicy == OCSP_LEAF_AND_CHAIN_POLICY) {
--        verificationResult = JSSL_verifyCertPKIX( peerCert, certUsage,
-+        verificationResult = JSSL_verifyCertPKIX( peerCert, certificateUsage,
-                                  NULL /* pin arg */, ocspPolicy, &log, NULL);
-      }  else {
-         verificationResult = CERT_VerifyCert(   CERT_GetDefaultCertDB(),
-diff --git a/org/mozilla/jss/ssl/common.c b/org/mozilla/jss/ssl/common.c
-index aec88552..cb281798 100644
---- a/org/mozilla/jss/ssl/common.c
-+++ b/org/mozilla/jss/ssl/common.c
-@@ -894,7 +894,7 @@ JSS_SSL_processExceptions(JNIEnv *env, PRFilePrivate *priv)
- /* Get the trusted anchor for pkix */
- 
- CERTCertificate * getRoot(CERTCertificate *cert, 
--    SECCertificateUsage certUsage) 
-+    SECCertUsage certUsage) 
- {
-     CERTCertificate  *root = NULL;
-     CERTCertListNode *node = NULL;
-@@ -936,7 +936,7 @@ CERTCertificate * getRoot(CERTCertificate *cert,
-  */
- 
- SECStatus JSSL_verifyCertPKIX(CERTCertificate *cert,
--      SECCertificateUsage certUsage,secuPWData *pwdata, int ocspPolicy,
-+      SECCertificateUsage certificateUsage,secuPWData *pwdata, int ocspPolicy,
-       CERTVerifyLog *log, SECCertificateUsage *usage) 
- {
- 
-@@ -993,6 +993,8 @@ SECStatus JSSL_verifyCertPKIX(CERTCertificate *cert,
- 
-     PRBool fetchCerts = PR_FALSE;
- 
-+    SECCertUsage certUsage = certUsageSSLClient /* 0 */;
-+    
-     SECStatus res =  SECFailure;
-     if(cert == NULL) {
-         goto finish;
-@@ -1027,9 +1029,15 @@ SECStatus JSSL_verifyCertPKIX(CERTCertificate *cert,
-     cvin[inParamIndex].value.pointer.revocation = rev;
-     inParamIndex++;
- 
--
-     /* establish trust anchor */
- 
-+    /* We need to convert the SECCertificateUsage to a SECCertUsage to obtain
-+     * the root.
-+    */
-+
-+    SECCertificateUsage testUsage = certificateUsage;
-+    while (0 != (testUsage = testUsage >> 1)) { certUsage++; }
-+
-     CERTCertificate *root = getRoot(cert,certUsage);
- 
-     /* Try to add the root as the trust anchor so all the
-@@ -1064,7 +1072,7 @@ SECStatus JSSL_verifyCertPKIX(CERTCertificate *cert,
- 
-     cvout[outParamIndex].type = cert_po_end;
- 
--    res = CERT_PKIXVerifyCert(cert, certUsage, cvin, cvout, &pwdata);
-+    res = CERT_PKIXVerifyCert(cert, certificateUsage, cvin, cvout, &pwdata);
- 
- finish:
-     /* clean up any trusted cert list */
-@@ -1074,8 +1082,9 @@ SECStatus JSSL_verifyCertPKIX(CERTCertificate *cert,
-         trustedCertList = NULL;
-     }
- 
-+    /* CERT_DestroyCertList destroys interior certs for us. */
-+
-     if(root) {
--       CERT_DestroyCertificate(root);
-        root = NULL;
-     }
- 
-diff --git a/org/mozilla/jss/ssl/jssl.h b/org/mozilla/jss/ssl/jssl.h
-index 0e93eebe..925e1225 100644
---- a/org/mozilla/jss/ssl/jssl.h
-+++ b/org/mozilla/jss/ssl/jssl.h
-@@ -145,7 +145,7 @@ JSSL_getOCSPPolicy();
- 
- SECStatus 
- JSSL_verifyCertPKIX(CERTCertificate *cert,
--                    SECCertificateUsage certUsage,
-+                    SECCertificateUsage certificateUsage,
-                     secuPWData *pwdata, int ocspPolicy,
-                     CERTVerifyLog *log,SECCertificateUsage *usage);
- 

jss.spec

@@ -2,13 +2,37 @@
 Name:           jss
 ################################################################################
 
-Summary:        Java Security Services (JSS)
-URL:            http://www.dogtagpki.org/wiki/JSS
-License:        MPLv1.1 or GPLv2+ or LGPLv2+
+%global         vendor_id dogtag
+%global         product_id %{vendor_id}-jss
 
-Version:        4.6.1
-Release:        2%{?_timestamp}%{?_commit_id}%{?dist}
-# global         _phase -a1
+# Upstream version number:
+%global         major_version 5
+%global         minor_version 8
+%global         update_version 0
+
+# Downstream release number:
+# - development/stabilization (unsupported): 0.<n> where n >= 1
+# - GA/update (supported): <n> where n >= 1
+%global         release_number 1
+
+# Development phase:
+# - development (unsupported): alpha<n> where n >= 1
+# - stabilization (unsupported): beta<n> where n >= 1
+# - GA/update (supported): <none>
+#global         phase
+
+%if 0%{?rhel} && 0%{?rhel} >= 10
+%global enable_nss_version_pqc_def_flag -DENABLE_NSS_VERSION_PQC_DEF=ON
+%endif
+
+%undefine       timestamp
+%undefine       commit_id
+
+Summary:        Java Security Services (JSS)
+URL:            https://github.com/dogtagpki/jss
+License:        (MPL-1.1 OR GPL-2.0-or-later OR LGPL-2.1-or-later) AND Apache-2.0
+Version:        %{major_version}.%{minor_version}.%{update_version}
+Release:        %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}
 
 # To generate the source tarball:
 # $ git clone https://github.com/dogtagpki/jss.git
@@ -17,7 +41,7 @@ Release:        2%{?_timestamp}%{?_commit_id}%{?dist}
 # $ git push origin v4.5.<z>
 # Then go to https://github.com/dogtagpki/jss/releases and download the source
 # tarball.
-Source:         https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phase}/%{name}-%{version}%{?_phase}.tar.gz
+Source:         https://github.com/dogtagpki/jss/archive/v%{version}%{?phase:-}%{?phase}/jss-%{version}%{?phase:-}%{?phase}.tar.gz
 
 # To create a patch for all changes since a version tag:
 # $ git format-patch \
@@ -25,52 +49,70 @@ Source:         https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas
 #     <version tag> \
 #     > jss-VERSION-RELEASE.patch
 # Patch: jss-VERSION-RELEASE.patch
-Patch0: 0001-Disable-buffer-based-tests.patch
+
+%if 0%{?java_arches:1}
+ExclusiveArch: %{java_arches}
+%else
+ExcludeArch: i686
+%endif
+
+################################################################################
+# Java
+################################################################################
+
+# use Java 17 on Fedora 39 or older and RHEL 9 or older
+# otherwise, use Java 21
+
+# maven-local is a subpackage of javapackages-tools
+
+%if 0%{?fedora} && 0%{?fedora} >= 43 || 0%{?rhel} >= 11
+
+%define java_devel java-25-openjdk-devel
+%define java_headless java-25-openjdk-headless
+%define java_home %{_jvmdir}/jre-25-openjdk
+%define maven_local maven-local-openjdk25
+
+%else
+
+%define java_devel java-21-openjdk-devel
+%define java_headless java-21-openjdk-headless
+%define java_home %{_jvmdir}/jre-21-openjdk
+%define maven_local maven-local
+
+%endif
+
+################################################################################
+# Build Options
+################################################################################
+
+# By default the javadoc package will be built unless --without javadoc
+# option is specified.
+
+%bcond_without javadoc
+
+# By default the tests package will be built and the tests will executed
+# unless --without tests option is specified.
+
+%bcond_without tests
 
 ################################################################################
 # Build Dependencies
 ################################################################################
 
-# autosetup
-BuildRequires:  git
 BuildRequires:  make
-BuildRequires:  cmake
+BuildRequires:  cmake >= 3.14
+BuildRequires:  zip
+BuildRequires:  unzip
 
 BuildRequires:  gcc-c++
-BuildRequires:  nspr-devel >= 4.13.1
-BuildRequires:  nss-devel >= 3.30
-BuildRequires:  nss-tools >= 3.30
-BuildRequires:  java-devel
-BuildRequires:  jpackage-utils
-BuildRequires:  slf4j
-BuildRequires:  glassfish-jaxb-api
-%if 0%{?rhel} && 0%{?rhel} <= 7
-# no slf4j-jdk14
-%else
-BuildRequires:  slf4j-jdk14
-%endif
-BuildRequires:  apache-commons-lang
-BuildRequires:  apache-commons-codec
+BuildRequires:  nss-devel >= 3.101
+BuildRequires:  nss-tools >= 3.101
 
-BuildRequires:  junit
-
-Requires:       nss >= 3.30
-Requires:       java-headless
-Requires:       jpackage-utils
-Requires:       slf4j
-Requires:       glassfish-jaxb-api
-%if 0%{?rhel} && 0%{?rhel} <= 7
-# no slf4j-jdk14
-%else
-Requires:       slf4j-jdk14
-%endif
-Requires:       apache-commons-lang
-Requires:       apache-commons-codec
-
-Conflicts:      ldapjdk < 4.20
-Conflicts:      idm-console-framework < 1.2
-Conflicts:      tomcatjss < 7.3.4
-Conflicts:      pki-base < 10.6.5
+BuildRequires:  %{java_devel}
+BuildRequires:  %{maven_local}
+BuildRequires:  mvn(org.apache.commons:commons-lang3)
+BuildRequires:  mvn(org.slf4j:slf4j-api)
+BuildRequires:  mvn(org.slf4j:slf4j-jdk14)
 
 %description
 Java Security Services (JSS) is a java native interface which provides a bridge
@@ -78,26 +120,149 @@ for java-based applications to use native Network Security Services (NSS).
 This only works with gcj. Other JREs require that JCE providers be signed.
 
 ################################################################################
-%package javadoc
+%package -n %{product_id}
+################################################################################
+
+Summary:        Java Security Services (JSS)
+
+Requires:       nss >= 3.101
+
+Requires:       %{java_headless}
+Requires:       mvn(org.apache.commons:commons-lang3)
+Requires:       mvn(org.slf4j:slf4j-api)
+Requires:       mvn(org.slf4j:slf4j-jdk14)
+
+Obsoletes:      jss < %{version}-%{release}
+Provides:       jss = %{version}-%{release}
+Provides:       jss = %{major_version}.%{minor_version}
+Provides:       %{product_id} = %{major_version}.%{minor_version}
+
+Conflicts:      ldapjdk < 4.20
+Conflicts:      idm-console-framework < 1.2
+Conflicts:      pki-base < 10.10.0
+
+%description -n %{product_id}
+Java Security Services (JSS) is a java native interface which provides a bridge
+for java-based applications to use native Network Security Services (NSS).
+This only works with gcj. Other JREs require that JCE providers be signed.
+
+################################################################################
+%package -n %{product_id}-tomcat
+################################################################################
+
+Summary:        Java Security Services (JSS) Connector for Tomcat
+
+# Tomcat
+BuildRequires:  mvn(org.apache.tomcat:tomcat-catalina) >= 10.1.36
+BuildRequires:  mvn(org.apache.tomcat:tomcat-coyote) >= 10.1.36
+BuildRequires:  mvn(org.apache.tomcat:tomcat-juli) >= 10.1.36
+
+Requires:       %{product_id} = %{version}-%{release}
+Requires:       mvn(org.apache.tomcat:tomcat-catalina) >= 10.1.36
+Requires:       mvn(org.apache.tomcat:tomcat-coyote) >= 10.1.36 
+Requires:       mvn(org.apache.tomcat:tomcat-juli) >= 10.1.36
+
+# Tomcat JSS has been replaced with JSS Connector for Tomcat.
+# This will remove installed Tomcat JSS packages.
+Obsoletes:      tomcatjss <= 8.5
+Conflicts:      tomcatjss <= 8.5
+Obsoletes:      %{vendor_id}-tomcatjss <= 8.5
+Conflicts:      %{vendor_id}-tomcatjss <= 8.5
+
+%if 0%{?rhel} <= 8
+# PKI Servlet Engine has been replaced with Tomcat.
+# This will remove installed PKI Servlet Engine packages.
+Obsoletes:      pki-servlet-engine <= 9.0
+Conflicts:      pki-servlet-engine <= 9.0
+%endif
+
+%description -n %{product_id}-tomcat
+JSS Connector for Tomcat is a Java Secure Socket Extension (JSSE)
+module for Apache Tomcat that uses Java Security Services (JSS),
+a Java interface to Network Security Services (NSS).
+
+################################################################################
+%package -n %{product_id}-tools
+################################################################################
+
+Summary:        Java Security Services (JSS) Tools
+
+Provides:       jss-tools = %{version}-%{release}
+Provides:       jss-tools = %{major_version}.%{minor_version}
+Provides:       %{product_id}-tools = %{major_version}.%{minor_version}
+
+# Some PKI tools have been moved into jss-tools.
+Conflicts:      pki-tools < 11.6
+Conflicts:      %{vendor_id}-pki-tools < 11.6
+
+%description -n %{product_id}-tools
+This package contains JSS tools.
+
+%if %{with javadoc}
+################################################################################
+%package -n %{product_id}-javadoc
 ################################################################################
 
 Summary:        Java Security Services (JSS) Javadocs
-Requires:       jss = %{version}-%{release}
 
-%description javadoc
+Obsoletes:      jss-javadoc < %{version}-%{release}
+Provides:       jss-javadoc = %{version}-%{release}
+Provides:       jss-javadoc = %{major_version}.%{minor_version}
+Provides:       %{product_id}-javadoc = %{major_version}.%{minor_version}
+
+%description -n %{product_id}-javadoc
 This package contains the API documentation for JSS.
+%endif
+
+%if %{with tests}
+################################################################################
+%package -n %{product_id}-tests
+################################################################################
+
+Summary:        Java Security Services (JSS) Tests
+
+BuildRequires:  mvn(org.junit.jupiter:junit-jupiter)
+BuildRequires:  mvn(org.opentest4j:opentest4j)
+
+%description -n %{product_id}-tests
+This package provides test suite for JSS.
+
+# with tests
+%endif
 
 ################################################################################
 %prep
+################################################################################
 
-%autosetup -n %{name}-%{version}%{?_phase} -p 1 -S git
+%autosetup -n jss-%{version}%{?phase:-}%{?phase} -p 1
+
+# disable native modules since they will be built by CMake
+%pom_disable_module native
+%pom_disable_module symkey
+
+# do not ship examples
+%pom_disable_module examples
+
+# flatten-maven-plugin is not available in RPM
+%pom_remove_plugin org.codehaus.mojo:flatten-maven-plugin
+
+# specify Maven artifact locations
+%mvn_file org.dogtagpki.jss:jss-tomcat         jss/jss-tomcat
+%mvn_file org.dogtagpki.jss:jss-tomcat-10.1     jss/jss-tomcat-10.1
+
+# specify Maven artifact packages
+%mvn_package org.dogtagpki.jss:jss-tomcat      jss-tomcat
+%mvn_package org.dogtagpki.jss:jss-tomcat-10.1  jss-tomcat
 
 ################################################################################
 %build
+################################################################################
 
+# Set build flags for CMake
+# (see /usr/lib/rpm/macros.d/macros.cmake)
 %set_build_flags
 
-[ -z "$JAVA_HOME" ] && export JAVA_HOME=%{_jvmdir}/java
+export JAVA_HOME=%{java_home}
 
 # Enable compiler optimizations
 export BUILD_OPT=1
@@ -109,104 +274,236 @@ export CFLAGS
 # Check if we're in FIPS mode
 modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENABLED=1
 
-# The Makefile is not thread-safe
-rm -rf build && mkdir -p build && cd build
-%cmake \
-    -DJAVA_HOME=%{java_home} \
-    -DJAVA_LIB_INSTALL_DIR=%{_jnidir} \
-    ..
+# build Java code, run Java tests, and build Javadoc with Maven
+%mvn_build %{!?with_tests:-f} %{!?with_javadoc:-j}
 
-%{__make} all
-%{__make} javadoc || true
-ctest --output-on-failure
+# create links to Maven-built classes for CMake
+mkdir -p %{_vpath_builddir}/classes/jss
+ln -sf ../../../base/target/classes/org %{_vpath_builddir}/classes/jss
+%if %{with tests}
+mkdir -p %{_vpath_builddir}/classes/tests
+ln -sf ../../../base/target/test-classes/org %{_vpath_builddir}/classes/tests
+%endif
+
+# create links to Maven-built JAR files for CMake
+ln -sf ../base/target/jss.jar %{_vpath_builddir}
+%if %{with tests}
+ln -sf ../base/target/jss-tests.jar %{_vpath_builddir}
+%endif
+
+# create links to Maven-built headers for CMake
+mkdir -p %{_vpath_builddir}/include/jss
+ln -sf ../../../base/target/include/_jni %{_vpath_builddir}/include/jss/_jni
+
+# mark Maven-built targets so that CMake will not rebuild them
+mkdir -p %{_vpath_builddir}/.targets
+touch %{_vpath_builddir}/.targets/finished_generate_java
+%if %{with tests}
+touch %{_vpath_builddir}/.targets/finished_tests_generate_java
+%endif
+%if %{with javadoc}
+touch %{_vpath_builddir}/.targets/finished_generate_javadocs
+%endif
+
+# build native code and run native tests with CMake
+./build.sh \
+    %{?_verbose:-v} \
+    --work-dir=%{_vpath_builddir} \
+    --prefix-dir=%{_prefix} \
+    --include-dir=%{_includedir} \
+    --lib-dir=%{_libdir} \
+    --sysconf-dir=%{_sysconfdir} \
+    --share-dir=%{_datadir} \
+    --cmake="%{__cmake} %{?enable_nss_version_pqc_def_flag}" \
+    --java-home=%{java_home} \
+    --jni-dir=%{_jnidir} \
+    --version=%{version} \
+    --without-java \
+    --without-javadoc \
+    %{!?with_tests:--without-tests} \
+    dist
 
 ################################################################################
 %install
-
-# There is no install target so we'll do it by hand
-
-# jars
-install -d -m 0755 $RPM_BUILD_ROOT%{_jnidir}
-install -m 644 build/jss4.jar ${RPM_BUILD_ROOT}%{_jnidir}/jss4.jar
-
-# We have to use the name libjss4.so because this is dynamically
-# loaded by the jar file.
-install -d -m 0755 $RPM_BUILD_ROOT%{_libdir}/jss
-install -m 0755 build/libjss4.so ${RPM_BUILD_ROOT}%{_libdir}/jss/
-pushd  ${RPM_BUILD_ROOT}%{_libdir}/jss
-    ln -fs %{_jnidir}/jss4.jar jss4.jar
-popd
-
-# javadoc
-install -d -m 0755 $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version}
-cp -rp build/docs/* $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version}
-cp -p jss.html $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version}
-cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version}
-
-# No ldconfig is required since this library is loaded by Java itself.
 ################################################################################
-%files
 
-%defattr(-,root,root,-)
-%doc jss.html MPL-1.1.txt gpl.txt lgpl.txt
-%{_libdir}/*
-%{_jnidir}/*
+# install Java binaries and Javadoc
+%mvn_install
+
+# install jss.jar
+mkdir -p %{buildroot}%{_javadir}/jss
+cp base/target/jss.jar %{buildroot}%{_javadir}/jss/jss.jar
+
+# create links for backward compatibility
+mkdir -p %{buildroot}%{_jnidir}
+ln -sf ../../..%{_javadir}/jss/jss.jar %{buildroot}%{_jnidir}/jss.jar
+
+mkdir -p %{buildroot}%{_libdir}/jss
+ln -sf ../../..%{_javadir}/jss/jss.jar %{buildroot}%{_libdir}/jss/jss.jar
+
+# install native binaries
+./build.sh \
+    %{?_verbose:-v} \
+    --work-dir=%{_vpath_builddir} \
+    --install-dir=%{buildroot} \
+    --without-java \
+    install
+
+# install tests binaries
+%if %{with tests}
+mkdir -p %{buildroot}%{_datadir}/jss/tests/lib
+cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib
+%endif
 
 ################################################################################
-%files javadoc
+%files -n %{product_id} -f .mfiles
+################################################################################
 
-%defattr(-,root,root,-)
-%{_javadocdir}/%{name}-%{version}/
+%doc jss.html
+%license MPL-1.1.txt gpl.txt lgpl.txt symkey/LICENSE
+%{_javadir}/jss/jss.jar
+%{_jnidir}/jss.jar
+%{_libdir}/jss/jss.jar
+%{_libdir}/jss/libjss.so
+%{_libdir}/jss/libjss-symkey.so
+
+################################################################################
+%files -n %{product_id}-tomcat -f .mfiles-jss-tomcat
+################################################################################
+
+################################################################################
+%files -n %{product_id}-tools
+################################################################################
+
+%{_bindir}/p12tool
+%{_bindir}/p7tool
+%{_bindir}/sslget
+
+%if %{with javadoc}
+################################################################################
+%files -n %{product_id}-javadoc -f .mfiles-javadoc
+################################################################################
+%endif
+
+%if %{with tests}
+################################################################################
+%files -n %{product_id}-tests
+################################################################################
+
+%{_datadir}/jss/tests/
+
+# with tests
+%endif
 
 ################################################################################
 %changelog
-* Thu Aug 08 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.6.1-2
-- Disable unnecessary tests to fix broken s390x
+* Tue Nov 04 2025 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.8.0-1
+- Rebase to JSS 5.8.0-1
 
-* Thu Aug 08 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.6.1-1
-- Rebase to JSS 4.6.1
+* Fri Aug 22 2025 Yaakov Selkowitz <yselkowi@redhat.com> - 5.8.0-0.6.beta4
+- Build with Java 25 for ELN
 
-* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 4.5.3-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+* Mon Aug 11 2025 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.8.0-0.5.beta4
+- Rebuild for Fedora 43
 
-* Mon May 06 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.5.3-2
-- Add AIA OCSP certificate checking patch
+* Mon Aug 11 2025 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.8.0-0.4.beta4.1
+- Rebase to JSS 5.8.0-beta4
 
-* Tue Mar 19 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.5.3-1
-- Rebase to JSS 4.5.3
+* Mon Jul 28 2025 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.8.0-0.3.beta3.1
+- Rebase to JSS 5.8.0-beta3
 
-* Fri Feb 01 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.5.2-3
-- Include nuxwdog patch for netscape.security.util.Utils from PKI
+* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 5.8.0-0.1.beta1.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
 
-* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 4.5.2-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+* Wed Jul 09 2025 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.8.0.1
+- Rebase to JSS 5.8.0-beta1
 
-* Mon Jan 14 2019 Dogtag PKI Team <pki-devel@redhat.com> 4.5.2-1
-- Rebased to JSS 4.5.2
+* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 5.6.0-0.1.alpha1.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
 
-* Thu Nov 29 2018 Dogtag PKI Team <pki-devel@redhat.com> 4.5.1-1
-- Rebased to JSS 4.5.1
-- Red Hat Bugzilla #1582323 - DER encoding error for enumerated types with a value of zero
-- Red Hat Bugzilla #1534765 - javadoc for org.mozilla.jss.pkix.cms.SignedData.getSignerInfos() is incorrect
+* Wed Nov 20 2024 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.6.0-1
+- Rebase to JSS 5.6.0-alpha1
 
-* Fri Aug 10 2018 Dogtag PKI Team <pki-devel@redhat.com> 4.5.0-1
-- Rebased to JSS 4.5.0
+* Fri Oct 04 2024 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.5.1-1
+- Rebase to JSS 5.5.1
 
-* Tue Aug 07 2018 Dogtag PKI Team <pki-devel@redhat.com> 4.5.0-0.6
-- Rebased to JSS 4.5.0-b1
+* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 5.5.0-2.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
 
-* Tue Aug 07 2018 Dogtag PKI Team <pki-devel@redhat.com> 4.5.0-0.5
-- Red Hat Bugzilla #1612063 - Do not override system crypto policy (support TLS 1.3)
+* Thu Feb 29 2024 Adam Williamson <awilliam@redhat.com> - 5.5.0-2
+- Really build against java-21
 
-* Fri Jul 20 2018 Dogtag PKI Team <pki-devel@redhat.com> 4.5.0-0.4
-- Rebased to JSS 4.5.0-a4
-- Red Hat Bugzilla #1604462 - jss: FTBFS in Fedora rawhide
+* Tue Feb 27 2024 Jiri Vanek <jvanek@redhat.com> - 5.5.0-1.1
+- Rebuilt for java-21-openjdk as system jdk
 
-* Thu Jul 05 2018 Dogtag PKI Team <pki-devel@redhat.com> 4.5.0-0.3
-- Rebased to JSS 4.5.0-a3
+* Wed Feb 21 2024 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.5.0-1
+- Rebase to JSS 5.5.0
 
-* Fri Jun 22 2018 Dogtag PKI Team <pki-devel@redhat.com> 4.5.0-0.2
-- Rebased to JSS 4.5.0-a2
+* Thu Feb 08 2024 Yaakov Selkowitz <yselkowi@redhat.com> - 5.4.2-1.4
+- Fix compatibility with NSS 3.97
 
-* Fri Jun 15 2018 Dogtag PKI Team <pki-devel@redhat.com> 4.5.0-0.1
-- Rebased to JSS 4.5.0-a1
+* Wed Jan 24 2024 Fedora Release Engineering <releng@fedoraproject.org> - 5.4.2-1.3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Sat Jan 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 5.4.2-1.2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 5.4.2-1.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Fri Jun 16 2023 Packit <hello@packit.dev> - 5.4.2-1
+- Updating version to v5.4.2 (Chris Kelley)
+- Upstream spec file changes to reduce diffs (Chris Kelley)
+- Introduce Packit configuration for jss (Chris Kelley)
+
+* Tue Feb 07 2023 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.3.0-2
+- Update version number in JSSConfig.cmake
+
+* Tue Feb 07 2023 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.3.0-1
+- Rebase to JSS 5.3.0
+
+* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 5.2.0-1.2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 5.2.0-1.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Wed Jun 29 2022 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.2.0-1
+- Rebase to JSS 5.2.0
+
+* Wed Apr 27 2022 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.2.0-0.3.beta2
+- Rebase to JSS 5.2.0-beta2
+- Rename packages to dogtag-jss
+
+* Mon Apr 11 2022 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.2.0-0.2.beta1
+- Rebase to JSS 5.2.0-beta1
+
+* Mon Feb 14 2022 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.1.0-1
+- Rebase to JSS 5.1.0
+
+* Sat Feb 05 2022 Jiri Vanek <jvanek@redhat.com> - 5.1.0-0.3.alpha2
+- Rebuilt for java-17-openjdk as system jdk
+
+* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 5.1.0-0.2.alpha2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Fri Nov 26 2021 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.1.0-0.1.alpha2
+- Rebase to JSS 5.1.0-alpha2
+
+* Thu Sep 30 2021 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.0.0-1
+- Rebase to JSS 5.0.0
+
+* Wed Sep 29 2021 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.0.0-0.5.beta1
+- Drop BuildRequires and Requires on glassfish-jaxb-api
+
+* Fri Sep 03 2021 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.0.0-0.4.beta1
+- Rebase to JSS 5.0.0-beta1
+
+* Thu Aug 12 2021 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.0.0-0.3.alpha2
+- Rebase to JSS 5.0.0-alpha2
+
+* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 5.0.0-0.2.alpha1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Tue Jun 22 2021 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.0.0-0.1.alpha1
+- Rebase to JSS 5.0.0-alpha1

sources

@@ -1 +1 @@
-SHA512 (jss-4.6.1.tar.gz) = 7a7eb02e98a22d0817aec34cff32ac942545885c84992812d116b683fa31c12d0fb9b8aa3b8757ab234f9980993fb933d6556c959935cd5e09ca7468d8729c8a
+SHA512 (jss-5.8.0.tar.gz) = 10f5727d78f8b466062396e47c25b7fdac4b70c6862e6857f8aef49b633c43c4485c1d3cd535006ecd090e8dfe787000fb40d8748ed381c4ac4d1d39312e6c3d