Fix changelog

ELN (the future RHEL 11) tracks rawhide and includes the relevant change:

https://fedoraproject.org/wiki/Changes/Java25AndNoMoreSystemJdk

.gitignore

@@ -30,5 +30,26 @@ jss-4.2.6.tar.gz
 /jss-4.7.0.tar.gz
 /jss-4.7.2.tar.gz
 /jss-4.7.3.tar.gz
+/jss-4.8.0-b1.tar.gz
 /jss-4.8.0.tar.gz
 /jss-4.8.1.tar.gz
+/jss-4.9.0-alpha1.tar.gz
+/jss-5.0.0-alpha1.tar.gz
+/jss-5.0.0-alpha2.tar.gz
+/jss-5.0.0-beta1.tar.gz
+/jss-5.0.0.tar.gz
+/jss-5.1.0-alpha2.tar.gz
+/jss-5.1.0.tar.gz
+/jss-5.2.0-beta1.tar.gz
+/jss-5.2.0-beta2.tar.gz
+/jss-5.2.0.tar.gz
+/jss-5.3.0.tar.gz
+/jss-5.4.2.tar.gz
+/jss-5.5.0-alpha2.tar.gz
+/jss-5.5.0.tar.gz
+/jss-5.5.1.tar.gz
+/jss-5.6.0-alpha1.tar.gz
+/jss-5.8.0-beta1.tar.gz
+/jss-5.8.0-beta3.tar.gz
+/jss-5.8.0-beta4.tar.gz
+/jss-5.8.0.tar.gz

.packit.yaml

@@ -0,0 +1,30 @@
+---
+# See the documentation for more information:
+# https://packit.dev/docs/configuration/
+specfile_path: jss.spec
+
+# add or remove files that should be synced
+files_to_sync:
+  - jss.spec
+  - .packit.yaml
+
+# Allow dist git reactions on packit and ckelley commits and PRs
+allowed_pr_authors:
+  - packit
+  - ckelleyRH
+allowed_committers:
+  - packit
+  - ckelleyRH
+
+upstream_package_name: jss
+# downstream (Fedora/CentOS) RPM package name
+downstream_package_name: jss
+# see: https://packit.dev/docs/configuration/#upstream_tag_template
+upstream_tag_template: "v{version}"
+
+jobs:
+  - job: propose_downstream
+    trigger: release
+    dist_git_branches:
+      - fedora-development
+#     - centos-stream-9-x86_64 # When Packit integration with CentOS is avaiable, enable this

README.packit

@@ -0,0 +1,3 @@
+This repository is maintained by packit.
+https://packit.dev/
+The file was generated using packit 0.76.0.post10+g0dcb396.

jss-crypto-policies-1.patch

@@ -1,49 +0,0 @@
-From 1fb6097a2ab73ef897d011e7383d7f5f1bf6a1df Mon Sep 17 00:00:00 2001
-From: Alexander Scheel <ascheel@redhat.com>
-Date: Wed, 1 Jul 2020 12:41:20 -0400
-Subject: [PATCH] Replace SHA-1 signature with SHA-256
-
-A recent change in Fedora Rawhide's crypto-policies package caused
-failures in the tests like the following:
-
-    Exception in thread "main" java.io.IOException: SocketException cannot read on socket: Error reading from socket: (-12271) SSL peer cannot verify your certificate.
-        at org.mozilla.jss.ssl.SSLSocket.read(SSLSocket.java:1494)
-        at org.mozilla.jss.ssl.SSLInputStream.read(SSLInputStream.java:38)
-        at org.mozilla.jss.ssl.SSLInputStream.read(SSLInputStream.java:25)
-        at org.mozilla.jss.tests.SSLClientAuth.run(SSLClientAuth.java:435)
-        at java.lang.Thread.run(Thread.java:748)
-    Caused by: org.mozilla.jss.ssl.SSLSocketException: Error reading from socket: (-12271) SSL peer cannot verify your certificate.
-        at org.mozilla.jss.ssl.SSLSocket.socketRead(Native Method)
-        at org.mozilla.jss.ssl.SSLSocket.read(SSLSocket.java:1488)
-        ... 4 more
-    Server exiting
-    org.mozilla.jss.ssl.SSLSocketException: SSL_ForceHandshake failed: (-8016) Unknown error
-        at org.mozilla.jss.ssl.SSLSocket.forceHandshake(Native Method)
-        at org.mozilla.jss.tests.SSLClientAuth.testConnection(SSLClientAuth.java:345)
-        at org.mozilla.jss.tests.SSLClientAuth.doIt(SSLClientAuth.java:156)
-        at org.mozilla.jss.tests.SSLClientAuth.main(SSLClientAuth.java:90)
-
-This was caused by dropping SHA-1 as an allowed hash during handshakes.
-However, because SSLClientAuth manually generated its certificate (and
-explicitly asked for SHA-1), it failed.
-
-Switch to SHA-256 instead.
-
-Signed-off-by: Alexander Scheel <ascheel@redhat.com>
----
- org/mozilla/jss/tests/SSLClientAuth.java | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/org/mozilla/jss/tests/SSLClientAuth.java b/org/mozilla/jss/tests/SSLClientAuth.java
-index 6f1fd2b12..bf270a634 100644
---- a/org/mozilla/jss/tests/SSLClientAuth.java
-+++ b/org/mozilla/jss/tests/SSLClientAuth.java
-@@ -28,7 +28,7 @@
-     
-     private CryptoManager cm;
-     public static final SignatureAlgorithm sigAlg =
--            SignatureAlgorithm.RSASignatureWithSHA1Digest;
-+            SignatureAlgorithm.RSASignatureWithSHA256Digest;
-     
-     /**
-      * Method that generates a certificate for given credential

jss-crypto-policies-2.patch

@@ -1,47 +0,0 @@
-From 8ed5a82a973922d07d0610fd42c48b2a0ec97d6c Mon Sep 17 00:00:00 2001
-From: Alexander Scheel <ascheel@redhat.com>
-Date: Wed, 1 Jul 2020 12:44:53 -0400
-Subject: [PATCH] Remove all legacy DSS/DSA tests
-
-The only signature algorithm suppoted with DSS is SHA-1, which will soon
-become deprecated and broken. DSS itself isn't widely used either, so we
-should remove it from the test suite as well.
-
-Signed-off-by: Alexander Scheel <ascheel@redhat.com>
----
- cmake/JSSTests.cmake | 12 +-----------
- 1 file changed, 1 insertion(+), 11 deletions(-)
-
-diff --git a/cmake/JSSTests.cmake b/cmake/JSSTests.cmake
-index a26b95425..a0fe36e22 100644
---- a/cmake/JSSTests.cmake
-+++ b/cmake/JSSTests.cmake
-@@ -170,11 +170,6 @@ macro(jss_tests)
-         COMMAND "org.mozilla.jss.tests.GenerateTestCert" "${RESULTS_NSSDB_OUTPUT_DIR}" "${PASSWORD_FILE}" "30" "localhost" "SHA-256/EC" "CA_ECDSA" "Server_ECDSA" "Client_ECDSA"
-         DEPENDS "Generate_known_RSA_cert_pair"
-     )
--    jss_test_java(
--        NAME "Generate_known_DSS_cert_pair"
--        COMMAND "org.mozilla.jss.tests.GenerateTestCert" "${RESULTS_NSSDB_OUTPUT_DIR}" "${PASSWORD_FILE}" "40" "localhost" "SHA-1/DSA" "CA_DSS" "Server_DSS" "Client_DSS"
--        DEPENDS "Generate_known_ECDSA_cert_pair"
--    )
-     jss_test_exec(
-         NAME "Create_PKCS11_cert_to_PKCS12_rsa.pfx"
-         COMMAND "pk12util" "-o" "${RESULTS_NSSDB_OUTPUT_DIR}/rsa.pfx" "-n" "CA_RSA" "-d" "${RESULTS_NSSDB_OUTPUT_DIR}" "-K" "${DB_PWD}" "-W" "${DB_PWD}"
-@@ -185,15 +180,10 @@ macro(jss_tests)
-         COMMAND "pk12util" "-o" "${RESULTS_NSSDB_OUTPUT_DIR}/ecdsa.pfx" "-n" "CA_ECDSA" "-d" "${RESULTS_NSSDB_OUTPUT_DIR}" "-K" "${DB_PWD}" "-W" "${DB_PWD}"
-         DEPENDS "Generate_known_ECDSA_cert_pair"
-     )
--    jss_test_exec(
--        NAME "Create_PKCS11_cert_to_PKCS12_dss.pfx"
--        COMMAND "pk12util" "-o" "${RESULTS_NSSDB_OUTPUT_DIR}/dss.pfx" "-n" "CA_DSS" "-d" "${RESULTS_NSSDB_OUTPUT_DIR}" "-K" "${DB_PWD}" "-W" "${DB_PWD}"
--        DEPENDS "Generate_known_DSS_cert_pair"
--    )
-     jss_test_java(
-         NAME "List_CA_certs"
-         COMMAND "org.mozilla.jss.tests.ListCACerts" "${RESULTS_NSSDB_OUTPUT_DIR}" "Verbose"
--        DEPENDS "Generate_known_DSS_cert_pair"
-+        DEPENDS "Generate_known_ECDSA_cert_pair"
-     )
-     jss_test_java(
-         NAME "SSLClientAuth"

jss.spec

@@ -2,13 +2,37 @@
 Name:           jss
 ################################################################################
 
-Summary:        Java Security Services (JSS)
-URL:            http://www.dogtagpki.org/wiki/JSS
-License:        MPLv1.1 or GPLv2+ or LGPLv2+
+%global         vendor_id dogtag
+%global         product_id %{vendor_id}-jss
 
-Version:        4.8.1
-Release:        1%{?_timestamp}%{?_commit_id}%{?dist}
-#global         _phase -a1
+# Upstream version number:
+%global         major_version 5
+%global         minor_version 8
+%global         update_version 0
+
+# Downstream release number:
+# - development/stabilization (unsupported): 0.<n> where n >= 1
+# - GA/update (supported): <n> where n >= 1
+%global         release_number 1
+
+# Development phase:
+# - development (unsupported): alpha<n> where n >= 1
+# - stabilization (unsupported): beta<n> where n >= 1
+# - GA/update (supported): <none>
+#global         phase
+
+%if 0%{?rhel} && 0%{?rhel} >= 10
+%global enable_nss_version_pqc_def_flag -DENABLE_NSS_VERSION_PQC_DEF=ON
+%endif
+
+%undefine       timestamp
+%undefine       commit_id
+
+Summary:        Java Security Services (JSS)
+URL:            https://github.com/dogtagpki/jss
+License:        (MPL-1.1 OR GPL-2.0-or-later OR LGPL-2.1-or-later) AND Apache-2.0
+Version:        %{major_version}.%{minor_version}.%{update_version}
+Release:        %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}
 
 # To generate the source tarball:
 # $ git clone https://github.com/dogtagpki/jss.git
@@ -17,7 +41,7 @@ Release:        1%{?_timestamp}%{?_commit_id}%{?dist}
 # $ git push origin v4.5.<z>
 # Then go to https://github.com/dogtagpki/jss/releases and download the source
 # tarball.
-Source:         https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phase}/%{name}-%{version}%{?_phase}.tar.gz
+Source:         https://github.com/dogtagpki/jss/archive/v%{version}%{?phase:-}%{?phase}/jss-%{version}%{?phase:-}%{?phase}.tar.gz
 
 # To create a patch for all changes since a version tag:
 # $ git format-patch \
@@ -26,50 +50,69 @@ Source:         https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas
 #     > jss-VERSION-RELEASE.patch
 # Patch: jss-VERSION-RELEASE.patch
 
+%if 0%{?java_arches:1}
+ExclusiveArch: %{java_arches}
+%else
+ExcludeArch: i686
+%endif
+
+################################################################################
+# Java
+################################################################################
+
+# use Java 17 on Fedora 39 or older and RHEL 9 or older
+# otherwise, use Java 21
+
+# maven-local is a subpackage of javapackages-tools
+
+%if 0%{?fedora} && 0%{?fedora} >= 43 || 0%{?rhel} >= 11
+
+%define java_devel java-25-openjdk-devel
+%define java_headless java-25-openjdk-headless
+%define java_home %{_jvmdir}/jre-25-openjdk
+%define maven_local maven-local-openjdk25
+
+%else
+
+%define java_devel java-21-openjdk-devel
+%define java_headless java-21-openjdk-headless
+%define java_home %{_jvmdir}/jre-21-openjdk
+%define maven_local maven-local
+
+%endif
+
+################################################################################
+# Build Options
+################################################################################
+
+# By default the javadoc package will be built unless --without javadoc
+# option is specified.
+
+%bcond_without javadoc
+
+# By default the tests package will be built and the tests will executed
+# unless --without tests option is specified.
+
+%bcond_without tests
+
 ################################################################################
 # Build Dependencies
 ################################################################################
 
-# autosetup
-BuildRequires:  git
 BuildRequires:  make
 BuildRequires:  cmake >= 3.14
 BuildRequires:  zip
 BuildRequires:  unzip
 
 BuildRequires:  gcc-c++
-BuildRequires:  nspr-devel >= 4.13.1
-BuildRequires:  nss-devel >= 3.44
-BuildRequires:  nss-tools >= 3.44
-BuildRequires:  java-devel
-BuildRequires:  jpackage-utils
-BuildRequires:  slf4j
-BuildRequires:  glassfish-jaxb-api
-%if 0%{?rhel} && 0%{?rhel} <= 7
-# no slf4j-jdk14
-%else
-BuildRequires:  slf4j-jdk14
-%endif
-BuildRequires:  apache-commons-lang3
+BuildRequires:  nss-devel >= 3.101
+BuildRequires:  nss-tools >= 3.101
 
-BuildRequires:  junit
-
-Requires:       nss >= 3.44
-Requires:       java-headless
-Requires:       jpackage-utils
-Requires:       slf4j
-Requires:       glassfish-jaxb-api
-%if 0%{?rhel} && 0%{?rhel} <= 7
-# no slf4j-jdk14
-%else
-Requires:       slf4j-jdk14
-%endif
-Requires:       apache-commons-lang3
-
-Conflicts:      ldapjdk < 4.20
-Conflicts:      idm-console-framework < 1.2
-Conflicts:      tomcatjss < 7.6.0
-Conflicts:      pki-base < 10.10.0
+BuildRequires:  %{java_devel}
+BuildRequires:  %{maven_local}
+BuildRequires:  mvn(org.apache.commons:commons-lang3)
+BuildRequires:  mvn(org.slf4j:slf4j-api)
+BuildRequires:  mvn(org.slf4j:slf4j-jdk14)
 
 %description
 Java Security Services (JSS) is a java native interface which provides a bridge
@@ -77,26 +120,149 @@ for java-based applications to use native Network Security Services (NSS).
 This only works with gcj. Other JREs require that JCE providers be signed.
 
 ################################################################################
-%package javadoc
+%package -n %{product_id}
+################################################################################
+
+Summary:        Java Security Services (JSS)
+
+Requires:       nss >= 3.101
+
+Requires:       %{java_headless}
+Requires:       mvn(org.apache.commons:commons-lang3)
+Requires:       mvn(org.slf4j:slf4j-api)
+Requires:       mvn(org.slf4j:slf4j-jdk14)
+
+Obsoletes:      jss < %{version}-%{release}
+Provides:       jss = %{version}-%{release}
+Provides:       jss = %{major_version}.%{minor_version}
+Provides:       %{product_id} = %{major_version}.%{minor_version}
+
+Conflicts:      ldapjdk < 4.20
+Conflicts:      idm-console-framework < 1.2
+Conflicts:      pki-base < 10.10.0
+
+%description -n %{product_id}
+Java Security Services (JSS) is a java native interface which provides a bridge
+for java-based applications to use native Network Security Services (NSS).
+This only works with gcj. Other JREs require that JCE providers be signed.
+
+################################################################################
+%package -n %{product_id}-tomcat
+################################################################################
+
+Summary:        Java Security Services (JSS) Connector for Tomcat
+
+# Tomcat
+BuildRequires:  mvn(org.apache.tomcat:tomcat-catalina) >= 10.1.36
+BuildRequires:  mvn(org.apache.tomcat:tomcat-coyote) >= 10.1.36
+BuildRequires:  mvn(org.apache.tomcat:tomcat-juli) >= 10.1.36
+
+Requires:       %{product_id} = %{version}-%{release}
+Requires:       mvn(org.apache.tomcat:tomcat-catalina) >= 10.1.36
+Requires:       mvn(org.apache.tomcat:tomcat-coyote) >= 10.1.36 
+Requires:       mvn(org.apache.tomcat:tomcat-juli) >= 10.1.36
+
+# Tomcat JSS has been replaced with JSS Connector for Tomcat.
+# This will remove installed Tomcat JSS packages.
+Obsoletes:      tomcatjss <= 8.5
+Conflicts:      tomcatjss <= 8.5
+Obsoletes:      %{vendor_id}-tomcatjss <= 8.5
+Conflicts:      %{vendor_id}-tomcatjss <= 8.5
+
+%if 0%{?rhel} <= 8
+# PKI Servlet Engine has been replaced with Tomcat.
+# This will remove installed PKI Servlet Engine packages.
+Obsoletes:      pki-servlet-engine <= 9.0
+Conflicts:      pki-servlet-engine <= 9.0
+%endif
+
+%description -n %{product_id}-tomcat
+JSS Connector for Tomcat is a Java Secure Socket Extension (JSSE)
+module for Apache Tomcat that uses Java Security Services (JSS),
+a Java interface to Network Security Services (NSS).
+
+################################################################################
+%package -n %{product_id}-tools
+################################################################################
+
+Summary:        Java Security Services (JSS) Tools
+
+Provides:       jss-tools = %{version}-%{release}
+Provides:       jss-tools = %{major_version}.%{minor_version}
+Provides:       %{product_id}-tools = %{major_version}.%{minor_version}
+
+# Some PKI tools have been moved into jss-tools.
+Conflicts:      pki-tools < 11.6
+Conflicts:      %{vendor_id}-pki-tools < 11.6
+
+%description -n %{product_id}-tools
+This package contains JSS tools.
+
+%if %{with javadoc}
+################################################################################
+%package -n %{product_id}-javadoc
 ################################################################################
 
 Summary:        Java Security Services (JSS) Javadocs
-Requires:       jss = %{version}-%{release}
 
-%description javadoc
+Obsoletes:      jss-javadoc < %{version}-%{release}
+Provides:       jss-javadoc = %{version}-%{release}
+Provides:       jss-javadoc = %{major_version}.%{minor_version}
+Provides:       %{product_id}-javadoc = %{major_version}.%{minor_version}
+
+%description -n %{product_id}-javadoc
 This package contains the API documentation for JSS.
+%endif
+
+%if %{with tests}
+################################################################################
+%package -n %{product_id}-tests
+################################################################################
+
+Summary:        Java Security Services (JSS) Tests
+
+BuildRequires:  mvn(org.junit.jupiter:junit-jupiter)
+BuildRequires:  mvn(org.opentest4j:opentest4j)
+
+%description -n %{product_id}-tests
+This package provides test suite for JSS.
+
+# with tests
+%endif
 
 ################################################################################
 %prep
+################################################################################
 
-%autosetup -n %{name}-%{version}%{?_phase} -p 1 -S git
+%autosetup -n jss-%{version}%{?phase:-}%{?phase} -p 1
+
+# disable native modules since they will be built by CMake
+%pom_disable_module native
+%pom_disable_module symkey
+
+# do not ship examples
+%pom_disable_module examples
+
+# flatten-maven-plugin is not available in RPM
+%pom_remove_plugin org.codehaus.mojo:flatten-maven-plugin
+
+# specify Maven artifact locations
+%mvn_file org.dogtagpki.jss:jss-tomcat         jss/jss-tomcat
+%mvn_file org.dogtagpki.jss:jss-tomcat-10.1     jss/jss-tomcat-10.1
+
+# specify Maven artifact packages
+%mvn_package org.dogtagpki.jss:jss-tomcat      jss-tomcat
+%mvn_package org.dogtagpki.jss:jss-tomcat-10.1  jss-tomcat
 
 ################################################################################
 %build
+################################################################################
 
+# Set build flags for CMake
+# (see /usr/lib/rpm/macros.d/macros.cmake)
 %set_build_flags
 
-[ -z "$JAVA_HOME" ] && export JAVA_HOME=%{_jvmdir}/java
+export JAVA_HOME=%{java_home}
 
 # Enable compiler optimizations
 export BUILD_OPT=1
@@ -108,164 +274,236 @@ export CFLAGS
 # Check if we're in FIPS mode
 modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENABLED=1
 
-# The Makefile is not thread-safe
-%cmake \
-    -DJAVA_HOME=%{java_home} \
-    -DJAVA_LIB_INSTALL_DIR=%{_jnidir} \
-    -B %{_vpath_builddir}
+# build Java code, run Java tests, and build Javadoc with Maven
+%mvn_build %{!?with_tests:-f} %{!?with_javadoc:-j}
 
-cd %{_vpath_builddir}
-%{__make} all
-%{__make} javadoc
-ctest --output-on-failure
+# create links to Maven-built classes for CMake
+mkdir -p %{_vpath_builddir}/classes/jss
+ln -sf ../../../base/target/classes/org %{_vpath_builddir}/classes/jss
+%if %{with tests}
+mkdir -p %{_vpath_builddir}/classes/tests
+ln -sf ../../../base/target/test-classes/org %{_vpath_builddir}/classes/tests
+%endif
+
+# create links to Maven-built JAR files for CMake
+ln -sf ../base/target/jss.jar %{_vpath_builddir}
+%if %{with tests}
+ln -sf ../base/target/jss-tests.jar %{_vpath_builddir}
+%endif
+
+# create links to Maven-built headers for CMake
+mkdir -p %{_vpath_builddir}/include/jss
+ln -sf ../../../base/target/include/_jni %{_vpath_builddir}/include/jss/_jni
+
+# mark Maven-built targets so that CMake will not rebuild them
+mkdir -p %{_vpath_builddir}/.targets
+touch %{_vpath_builddir}/.targets/finished_generate_java
+%if %{with tests}
+touch %{_vpath_builddir}/.targets/finished_tests_generate_java
+%endif
+%if %{with javadoc}
+touch %{_vpath_builddir}/.targets/finished_generate_javadocs
+%endif
+
+# build native code and run native tests with CMake
+./build.sh \
+    %{?_verbose:-v} \
+    --work-dir=%{_vpath_builddir} \
+    --prefix-dir=%{_prefix} \
+    --include-dir=%{_includedir} \
+    --lib-dir=%{_libdir} \
+    --sysconf-dir=%{_sysconfdir} \
+    --share-dir=%{_datadir} \
+    --cmake="%{__cmake} %{?enable_nss_version_pqc_def_flag}" \
+    --java-home=%{java_home} \
+    --jni-dir=%{_jnidir} \
+    --version=%{version} \
+    --without-java \
+    --without-javadoc \
+    %{!?with_tests:--without-tests} \
+    dist
 
 ################################################################################
 %install
-
-# There is no install target so we'll do it by hand
-
-# jars
-install -d -m 0755 $RPM_BUILD_ROOT%{_jnidir}
-install -m 644 %{_vpath_builddir}/jss4.jar ${RPM_BUILD_ROOT}%{_jnidir}/jss4.jar
-
-# We have to use the name libjss4.so because this is dynamically
-# loaded by the jar file.
-install -d -m 0755 $RPM_BUILD_ROOT%{_libdir}/jss
-install -m 0755 %{_vpath_builddir}/libjss4.so ${RPM_BUILD_ROOT}%{_libdir}/jss/
-pushd  ${RPM_BUILD_ROOT}%{_libdir}/jss
-    ln -fs %{_jnidir}/jss4.jar jss4.jar
-popd
-
-# javadoc
-install -d -m 0755 $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version}
-cp -rp %{_vpath_builddir}/docs/* $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version}
-cp -p jss.html $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version}
-cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version}
-
-# No ldconfig is required since this library is loaded by Java itself.
 ################################################################################
-%files
 
-%defattr(-,root,root,-)
+# install Java binaries and Javadoc
+%mvn_install
+
+# install jss.jar
+mkdir -p %{buildroot}%{_javadir}/jss
+cp base/target/jss.jar %{buildroot}%{_javadir}/jss/jss.jar
+
+# create links for backward compatibility
+mkdir -p %{buildroot}%{_jnidir}
+ln -sf ../../..%{_javadir}/jss/jss.jar %{buildroot}%{_jnidir}/jss.jar
+
+mkdir -p %{buildroot}%{_libdir}/jss
+ln -sf ../../..%{_javadir}/jss/jss.jar %{buildroot}%{_libdir}/jss/jss.jar
+
+# install native binaries
+./build.sh \
+    %{?_verbose:-v} \
+    --work-dir=%{_vpath_builddir} \
+    --install-dir=%{buildroot} \
+    --without-java \
+    install
+
+# install tests binaries
+%if %{with tests}
+mkdir -p %{buildroot}%{_datadir}/jss/tests/lib
+cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib
+%endif
+
+################################################################################
+%files -n %{product_id} -f .mfiles
+################################################################################
+
 %doc jss.html
-%license MPL-1.1.txt gpl.txt lgpl.txt
-%{_libdir}/*
-%{_jnidir}/*
+%license MPL-1.1.txt gpl.txt lgpl.txt symkey/LICENSE
+%{_javadir}/jss/jss.jar
+%{_jnidir}/jss.jar
+%{_libdir}/jss/jss.jar
+%{_libdir}/jss/libjss.so
+%{_libdir}/jss/libjss-symkey.so
 
 ################################################################################
-%files javadoc
+%files -n %{product_id}-tomcat -f .mfiles-jss-tomcat
+################################################################################
 
-%defattr(-,root,root,-)
-%{_javadocdir}/%{name}-%{version}/
+################################################################################
+%files -n %{product_id}-tools
+################################################################################
+
+%{_bindir}/p12tool
+%{_bindir}/p7tool
+%{_bindir}/sslget
+
+%if %{with javadoc}
+################################################################################
+%files -n %{product_id}-javadoc -f .mfiles-javadoc
+################################################################################
+%endif
+
+%if %{with tests}
+################################################################################
+%files -n %{product_id}-tests
+################################################################################
+
+%{_datadir}/jss/tests/
+
+# with tests
+%endif
 
 ################################################################################
 %changelog
-* Thu Jan 14 2021 Dogtag PKI Team <pki-devel@redhat.com> - 4.8.1-1
-- Rebase to upstream stable JSS v4.8.1
+* Tue Nov 04 2025 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.8.0-1
+- Rebase to JSS 5.8.0-1
 
-* Thu Nov 05 2020 Dogtag PKI Team <pki-devel@redhat.com> - 4.8.0-2
-- Add Conflicts on older PKI versions due to missing ACL3
+* Fri Aug 22 2025 Yaakov Selkowitz <yselkowi@redhat.com> - 5.8.0-0.6.beta4
+- Build with Java 25 for ELN
 
-* Wed Oct 21 2020 Dogtag PKI Team <pki-devel@redhat.com> - 4.8.0-1
-- Rebase to upstream stable release JSS v4.8.0
+* Mon Aug 11 2025 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.8.0-0.5.beta4
+- Rebuild for Fedora 43
 
-* Fri Sep 11 2020 Dogtag PKI Team <pki-devel@redhat.com> - 4.7.3-1
-- Rebase to upstream stable release JSS v4.7.3
+* Mon Aug 11 2025 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.8.0-0.4.beta4.1
+- Rebase to JSS 5.8.0-beta4
 
-* Tue Aug 18 2020 Dogtag PKI Team <pki-devel@redhat.com> - 4.7.2-1
-- Rebase to upstream stable release JSS v4.7.2 ; fixes FTBFS
+* Mon Jul 28 2025 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.8.0-0.3.beta3.1
+- Rebase to JSS 5.8.0-beta3
 
-* Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 4.7.0-4
-- Second attempt - Rebuilt for
-  https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 5.8.0-0.1.beta1.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
 
-* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 4.7.0-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+* Wed Jul 09 2025 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.8.0.1
+- Rebase to JSS 5.8.0-beta1
 
-* Fri Jul 10 2020 Jiri Vanek <jvanek@redhat.com> - 4.7.0-2
-- Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11
+* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 5.6.0-0.1.alpha1.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
 
-* Thu Jul 09 2020 Dogtag PKI Team <pki-devel@redhat.com> - 4.7.0-1
-- Rebase to upstream stable release JSS v4.7.0
+* Wed Nov 20 2024 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.6.0-1
+- Rebase to JSS 5.6.0-alpha1
 
-* Mon Jul 06 2020 Dogtag PKI Team <pki-devel@redhat.com> - 4.7.0-0.5
-- Fix build issues with new Crypto-Policies denying SHA-1 usage
+* Fri Oct 04 2024 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.5.1-1
+- Rebase to JSS 5.5.1
 
-* Tue Jun 30 2020 Dogtag PKI Team <pki-devel@redhat.com> - 4.7.0-0.4
-- Rebase to latest upstream JSS v4.7.0-b4
+* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 5.5.0-2.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
 
-* Wed Jun 10 2020 Dogtag PKI Team <pki-devel@redhat.com> - 4.7.0-0.2
-- Rebase to latest upstream JSS 4.7.0
-- JSS Provided SSLEngine
+* Thu Feb 29 2024 Adam Williamson <awilliam@redhat.com> - 5.5.0-2
+- Really build against java-21
 
-* Mon Apr 27 2020 Dogtag PKI Team <pki-devel@redhat.com> - 4.6.4-1
-- Rebase to JSS 4.6.4
-- Fixes memory leak present since v4.6.2
+* Tue Feb 27 2024 Jiri Vanek <jvanek@redhat.com> - 5.5.0-1.1
+- Rebuilt for java-21-openjdk as system jdk
 
-* Thu Mar 5 2020 Dogtag PKI Team <pki-devel@redhat.com> - 4.6.3-1
-- Rebase to JSS 4.6.3
-- Fixes base64 encoding of CSRs
+* Wed Feb 21 2024 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.5.0-1
+- Rebase to JSS 5.5.0
 
-* Wed Mar 04 2020 Dogtag PKI Team <pki-devel@redhat.com> - 4.6.2-4
-- Fix for PBE errors
+* Thu Feb 08 2024 Yaakov Selkowitz <yselkowi@redhat.com> - 5.4.2-1.4
+- Fix compatibility with NSS 3.97
 
-* Tue Jan 28 2020 Dogtag PKI Team <pki-devel@redhat.com> - 4.6.2-3
-- Rebuild with new NSS to fix rhbz#1794814
+* Wed Jan 24 2024 Fedora Release Engineering <releng@fedoraproject.org> - 5.4.2-1.3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
 
-* Tue Oct 29 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.6.2-2
-- Fix for rhbz#1766451
+* Sat Jan 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 5.4.2-1.2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
 
-* Tue Oct 15 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.6.2-1
-- Rebase to JSS 4.6.2
-- Fixes CVE-2019-14823
+* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 5.4.2-1.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
 
-* Thu Aug 08 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.6.1-2
-- Disable unnecessary tests to fix broken s390x
+* Fri Jun 16 2023 Packit <hello@packit.dev> - 5.4.2-1
+- Updating version to v5.4.2 (Chris Kelley)
+- Upstream spec file changes to reduce diffs (Chris Kelley)
+- Introduce Packit configuration for jss (Chris Kelley)
 
-* Thu Aug 08 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.6.1-1
-- Rebase to JSS 4.6.1
+* Tue Feb 07 2023 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.3.0-2
+- Update version number in JSSConfig.cmake
 
-* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 4.5.3-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+* Tue Feb 07 2023 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.3.0-1
+- Rebase to JSS 5.3.0
 
-* Mon May 06 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.5.3-2
-- Add AIA OCSP certificate checking patch
+* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 5.2.0-1.2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
 
-* Tue Mar 19 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.5.3-1
-- Rebase to JSS 4.5.3
+* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 5.2.0-1.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
 
-* Fri Feb 01 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.5.2-3
-- Include nuxwdog patch for netscape.security.util.Utils from PKI
+* Wed Jun 29 2022 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.2.0-1
+- Rebase to JSS 5.2.0
 
-* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 4.5.2-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+* Wed Apr 27 2022 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.2.0-0.3.beta2
+- Rebase to JSS 5.2.0-beta2
+- Rename packages to dogtag-jss
 
-* Mon Jan 14 2019 Dogtag PKI Team <pki-devel@redhat.com> 4.5.2-1
-- Rebased to JSS 4.5.2
+* Mon Apr 11 2022 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.2.0-0.2.beta1
+- Rebase to JSS 5.2.0-beta1
 
-* Thu Nov 29 2018 Dogtag PKI Team <pki-devel@redhat.com> 4.5.1-1
-- Rebased to JSS 4.5.1
-- Red Hat Bugzilla #1582323 - DER encoding error for enumerated types with a value of zero
-- Red Hat Bugzilla #1534765 - javadoc for org.mozilla.jss.pkix.cms.SignedData.getSignerInfos() is incorrect
+* Mon Feb 14 2022 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.1.0-1
+- Rebase to JSS 5.1.0
 
-* Fri Aug 10 2018 Dogtag PKI Team <pki-devel@redhat.com> 4.5.0-1
-- Rebased to JSS 4.5.0
+* Sat Feb 05 2022 Jiri Vanek <jvanek@redhat.com> - 5.1.0-0.3.alpha2
+- Rebuilt for java-17-openjdk as system jdk
 
-* Tue Aug 07 2018 Dogtag PKI Team <pki-devel@redhat.com> 4.5.0-0.6
-- Rebased to JSS 4.5.0-b1
+* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 5.1.0-0.2.alpha2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
 
-* Tue Aug 07 2018 Dogtag PKI Team <pki-devel@redhat.com> 4.5.0-0.5
-- Red Hat Bugzilla #1612063 - Do not override system crypto policy (support TLS 1.3)
+* Fri Nov 26 2021 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.1.0-0.1.alpha2
+- Rebase to JSS 5.1.0-alpha2
 
-* Fri Jul 20 2018 Dogtag PKI Team <pki-devel@redhat.com> 4.5.0-0.4
-- Rebased to JSS 4.5.0-a4
-- Red Hat Bugzilla #1604462 - jss: FTBFS in Fedora rawhide
+* Thu Sep 30 2021 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.0.0-1
+- Rebase to JSS 5.0.0
 
-* Thu Jul 05 2018 Dogtag PKI Team <pki-devel@redhat.com> 4.5.0-0.3
-- Rebased to JSS 4.5.0-a3
+* Wed Sep 29 2021 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.0.0-0.5.beta1
+- Drop BuildRequires and Requires on glassfish-jaxb-api
 
-* Fri Jun 22 2018 Dogtag PKI Team <pki-devel@redhat.com> 4.5.0-0.2
-- Rebased to JSS 4.5.0-a2
+* Fri Sep 03 2021 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.0.0-0.4.beta1
+- Rebase to JSS 5.0.0-beta1
 
-* Fri Jun 15 2018 Dogtag PKI Team <pki-devel@redhat.com> 4.5.0-0.1
-- Rebased to JSS 4.5.0-a1
+* Thu Aug 12 2021 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.0.0-0.3.alpha2
+- Rebase to JSS 5.0.0-alpha2
+
+* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 5.0.0-0.2.alpha1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Tue Jun 22 2021 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.0.0-0.1.alpha1
+- Rebase to JSS 5.0.0-alpha1

sources

@@ -1 +1 @@
-SHA512 (jss-4.8.1.tar.gz) = d18ef995cba627de68077bbd8dc25640b6444c4674e29ec83a05296ac1f18289e1ada35229baafbf5c5e4f1ae712a46e48d9d6dcead935e0f4d3d72b5208cf40
+SHA512 (jss-5.8.0.tar.gz) = 10f5727d78f8b466062396e47c25b7fdac4b70c6862e6857f8aef49b633c43c4485c1d3cd535006ecd090e8dfe787000fb40d8748ed381c4ac4d1d39312e6c3d