Fix changelog date

Signed-off-by: Alexander Scheel <ascheel@redhat.com>

.gitignore

@@ -1,3 +1,10 @@
+# Local build files
+jss-*.src.rpm
+jss-*/
+x86_64/
+.build-*.log
+
+# Releases
 jss-4.2.6.tar.gz
 /jss-4.2.6.tar.gz
 /jss-4.4.0.tar.gz
@@ -13,3 +20,8 @@ jss-4.2.6.tar.gz
 /jss-4.5.0.tar.gz
 /jss-4.5.1.tar.gz
 /jss-4.5.2.tar.gz
+/jss-4.5.3.tar.gz
+/jss-4.6.1.tar.gz
+/jss-4.6.2.tar.gz
+/jss-4.6.3.tar.gz
+/jss-4.6.4.tar.gz

0001-Fix-NativeProxy-reference-tracker.patch

@@ -0,0 +1,53 @@
+From 91514ca0a2979ba778d27220ced0cd312e2cd2d2 Mon Sep 17 00:00:00 2001
+From: Alexander Scheel <ascheel@redhat.com>
+Date: Tue, 29 Oct 2019 10:43:56 -0400
+Subject: [PATCH] Fix NativeProxy reference tracker
+
+In eb5df01003d74b57473eacb84e538d31f5bb06ca, I introduced a bug by
+setting mPointer after trying to add NativeProxy to the registry. In
+most instances this won't matter, however, if another instance exists in
+the HashSet with the same hash value, the equals comparator will be
+used, triggering a NPE.
+
+Signed-off-by: Alexander Scheel <ascheel@redhat.com>
+---
+ org/mozilla/jss/util/NativeProxy.java | 13 +++++--------
+ 1 file changed, 5 insertions(+), 8 deletions(-)
+
+diff --git a/org/mozilla/jss/util/NativeProxy.java b/org/mozilla/jss/util/NativeProxy.java
+index 1c6d1aa5..a0811f76 100644
+--- a/org/mozilla/jss/util/NativeProxy.java
++++ b/org/mozilla/jss/util/NativeProxy.java
+@@ -40,8 +40,8 @@ public abstract class NativeProxy implements AutoCloseable
+      */
+     public NativeProxy(byte[] pointer) {
+ 		assert(pointer!=null);
+-        registry.add(this);
+         mPointer = pointer;
++        registry.add(this);
+ 
+         if (saveStacktraces) {
+             mTrace = Arrays.toString(Thread.currentThread().getStackTrace());
+@@ -61,15 +61,12 @@ public abstract class NativeProxy implements AutoCloseable
+         if( ! (obj instanceof NativeProxy) ) {
+             return false;
+         }
+-        if( ((NativeProxy)obj).mPointer.length != mPointer.length) {
++        if (((NativeProxy)obj).mPointer == null) {
++            /* If mPointer is null, we have no way to compare the values
++             * of the pointers, so assume they're unequal. */
+             return false;
+         }
+-        for(int i=0; i < mPointer.length; i++) {
+-            if(mPointer[i] != ((NativeProxy)obj).mPointer[i]) {
+-                return false;
+-            }
+-        }
+-        return true;
++        return Arrays.equals(((NativeProxy)obj).mPointer, mPointer);
+     }
+ 
+     /**
+-- 
+2.21.0
+

0002-Fix-swapped-parameter-names-with-PBE.patch

@@ -0,0 +1,80 @@
+From 9f29430656342829822568f4ef49f5237b41164b Mon Sep 17 00:00:00 2001
+From: Alexander Scheel <ascheel@redhat.com>
+Date: Fri, 28 Feb 2020 14:10:32 -0500
+Subject: [PATCH 7/8] Fix swapped parameter names with PBE
+
+Commit 13998a9e77e60d6509ac814ed711dd21e1248ecd introduced a regression
+related to extracting the parameter classes during PBE operations:
+previously, the classes of the underlying encryption algorithm were
+iterated over, instead of the classes of the PBE class itself. However,
+this commit iterated over the PBE parameter classes; no PBE algorithm
+accepts a IvParameterSpec, resulting in a null parameter passed to the
+later encryption or key wrap operation. This resulted in stack traces
+like the following:
+
+Caused by: java.security.InvalidAlgorithmParameterException: DES3/CBC/Pad cannot use a null parameter
+	at org.mozilla.jss.pkcs11.PK11KeyWrapper.checkParams(PK11KeyWrapper.java:225)
+	at org.mozilla.jss.pkcs11.PK11KeyWrapper.initWrap(PK11KeyWrapper.java:89)
+	at org.mozilla.jss.pkcs11.PK11KeyWrapper.initWrap(PK11KeyWrapper.java:57)
+	at org.mozilla.jss.pkix.primitive.EncryptedPrivateKeyInfo.createPBE(EncryptedPrivateKeyInfo.java:342)
+
+Resolves: rh-bz#1807371
+
+Signed-off-by: Alexander Scheel <ascheel@redhat.com>
+---
+ org/mozilla/jss/pkcs7/EncryptedContentInfo.java             | 2 +-
+ org/mozilla/jss/pkix/cms/EncryptedContentInfo.java          | 2 +-
+ org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++--
+ 3 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/org/mozilla/jss/pkcs7/EncryptedContentInfo.java b/org/mozilla/jss/pkcs7/EncryptedContentInfo.java
+index 084752c3..0344b14d 100644
+--- a/org/mozilla/jss/pkcs7/EncryptedContentInfo.java
++++ b/org/mozilla/jss/pkcs7/EncryptedContentInfo.java
+@@ -182,7 +182,7 @@ public class EncryptedContentInfo implements ASN1Value {
+         // generate IV
+         EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg();
+         AlgorithmParameterSpec params=null;
+-        Class<?> [] paramClasses = pbeAlg.getParameterClasses();
++        Class<?> [] paramClasses = encAlg.getParameterClasses();
+         for (int i = 0; i < paramClasses.length; i ++) {
+             if ( paramClasses[i].equals(
+                       javax.crypto.spec.IvParameterSpec.class ) ) {
+diff --git a/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java b/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java
+index a4709070..d85eb0d3 100644
+--- a/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java
++++ b/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java
+@@ -180,7 +180,7 @@ public class EncryptedContentInfo implements ASN1Value {
+         // generate IV
+         EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg();
+         AlgorithmParameterSpec params=null;
+-        Class<?> [] paramClasses = pbeAlg.getParameterClasses();
++        Class<?> [] paramClasses = encAlg.getParameterClasses();
+         for (int i = 0; i < paramClasses.length; i ++) {
+             if ( paramClasses[i].equals( IVParameterSpec.class ) ) {
+                 params = new IVParameterSpec( kg.generatePBE_IV() );
+diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java
+index b35714e3..ebd269f3 100644
+--- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java
++++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java
+@@ -147,7 +147,7 @@ public class EncryptedPrivateKeyInfo implements ASN1Value {
+         // generate IV
+         EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg();
+         AlgorithmParameterSpec params=null;
+-        Class<?> [] paramClasses = pbeAlg.getParameterClasses();
++        Class<?> [] paramClasses = encAlg.getParameterClasses();
+         for (int i = 0; i < paramClasses.length; i ++) {
+             if ( paramClasses[i].equals( javax.crypto.spec.IvParameterSpec.class ) ) {
+                 params = new IVParameterSpec( kg.generatePBE_IV() );
+@@ -328,7 +328,7 @@ public class EncryptedPrivateKeyInfo implements ASN1Value {
+         // generate IV
+         EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg();
+         AlgorithmParameterSpec params=null;
+-        Class<?> [] paramClasses = pbeAlg.getParameterClasses();
++        Class<?> [] paramClasses = encAlg.getParameterClasses();
+         for (int i = 0; i < paramClasses.length; i ++) {
+             if ( paramClasses[i].equals(
+                       javax.crypto.spec.IvParameterSpec.class ) ) {
+-- 
+2.24.1
+

0003-Use-specified-algorithm-for-KeyWrap.patch

@@ -0,0 +1,60 @@
+From 55482c8bfa0addeb9db7b590703ba3704c5db167 Mon Sep 17 00:00:00 2001
+From: Alexander Scheel <ascheel@redhat.com>
+Date: Fri, 28 Feb 2020 14:39:29 -0500
+Subject: [PATCH 8/8] Use specified algorithm for KeyWrap
+
+When the token-specified from of EncryptedPrivateKeyInfo.createPBE is
+called, it would always request DES3_CBC_PAD as the key wrapping
+algorithm, regardless of the input PBE key type. However, the other form
+(with an implicit token) was correctly handling this case.
+
+Introduces a new KeyWrapAlgorithm method to take an OBJECT_IDENTIFIER
+instead of having to convert to/from a String form.
+
+Signed-off-by: Alexander Scheel <ascheel@redhat.com>
+---
+ org/mozilla/jss/crypto/KeyWrapAlgorithm.java                | 5 ++++-
+ org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++--
+ 2 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java
+index 3113f614..3a106977 100644
+--- a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java
++++ b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java
+@@ -138,7 +138,10 @@ public class KeyWrapAlgorithm extends Algorithm {
+ 
+     public static KeyWrapAlgorithm fromOID(String wrapOID) throws NoSuchAlgorithmException {
+         OBJECT_IDENTIFIER oid = new OBJECT_IDENTIFIER(wrapOID);
++        return fromOID(oid);
++    }
+ 
++    public static KeyWrapAlgorithm fromOID(OBJECT_IDENTIFIER oid) throws NoSuchAlgorithmException {
+         if (oid.equals(AES_KEY_WRAP_PAD_OID))
+             return AES_KEY_WRAP_PAD;
+ 
+@@ -154,6 +157,6 @@ public class KeyWrapAlgorithm extends Algorithm {
+         if (oid.equals(DES_CBC_PAD_OID))
+             return DES_CBC_PAD;
+ 
+-        throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + wrapOID);
++        throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + oid);
+     }
+ }
+diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java
+index ebd269f3..abfc39a7 100644
+--- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java
++++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java
+@@ -337,8 +337,8 @@ public class EncryptedPrivateKeyInfo implements ASN1Value {
+             }
+         }
+ 
+-        KeyWrapper wrapper = token.getKeyWrapper(
+-                KeyWrapAlgorithm.DES3_CBC_PAD);
++        // wrap the key
++        KeyWrapper wrapper = token.getKeyWrapper(KeyWrapAlgorithm.fromOID(encAlg.toOID()));
+         wrapper.initWrap(key, params);
+         byte encrypted[] = wrapper.wrap(pri);
+ 
+-- 
+2.24.1
+

jss-pki-sync-netscape-security-util-Utils.patch

@@ -1,94 +0,0 @@
-From a5b0caf63837acfd876ee15e3823fbfdf5685432 Mon Sep 17 00:00:00 2001
-From: Dinesh Prasanth M K <dmoluguw@redhat.com>
-Date: Wed, 30 Jan 2019 12:31:29 -0500
-Subject: [PATCH] Add exec method to execute shell commands with input
-
-- This is an effort to move duplicate code from PKI code
-  base to JSS code base
-
-- This chunk of code was originally introduced in PKI
-  code: https://github.com/dogtagpki/pki/pull/131
-
-- This PR is a joined effort of:
-  https://github.com/dogtagpki/pki/pull/122
-
-Signed-off-by: Dinesh Prasanth M K <dmoluguw@redhat.com>
----
- .../jss/netscape/security/util/Utils.java     | 57 +++++++++++++++++++
- 1 file changed, 57 insertions(+)
-
-diff --git a/org/mozilla/jss/netscape/security/util/Utils.java b/org/mozilla/jss/netscape/security/util/Utils.java
-index b1a3c341..b45381ae 100644
---- a/org/mozilla/jss/netscape/security/util/Utils.java
-+++ b/org/mozilla/jss/netscape/security/util/Utils.java
-@@ -25,6 +25,7 @@
- import java.io.FileWriter;
- import java.io.IOException;
- import java.io.InputStream;
-+import java.io.InputStreamReader;
- import java.io.OutputStream;
- import java.io.OutputStreamWriter;
- import java.io.PrintWriter;
-@@ -96,6 +97,62 @@ public static boolean exec(String cmd) {
-         return false;
-     }
- 
-+    public static String readFromStream(InputStream inputStream) throws IOException {
-+        StringBuilder sb = new StringBuilder();
-+        BufferedReader br = null;
-+        try {
-+            br = new BufferedReader(new InputStreamReader(inputStream));
-+            String line = null;
-+            while ((line = br.readLine()) != null) {
-+                sb.append(line + System.getProperty("line.separator"));
-+            }
-+        } finally {
-+            br.close();
-+        }
-+        return sb.toString().trim();
-+    }
-+
-+    public static void writeToStream(OutputStream outputStream, String input) throws IOException {
-+        BufferedWriter writer = new BufferedWriter(new OutputStreamWriter(outputStream));
-+        writer.write(input);
-+        writer.flush();
-+        writer.close();
-+    }
-+
-+    /**
-+     * Utility method to execute system commands
-+     *
-+     * @param cmd The command to be executed and its arguments
-+     * @param input The stdin input to be passed to the cmd
-+     * @return stdout or stderr of the command executed
-+     * @throws IOException
-+     * @throws InterruptedException
-+     */
-+    public static String exec(String[] cmd, String input) throws IOException, InterruptedException {
-+
-+        ProcessBuilder pb = new ProcessBuilder(cmd);
-+
-+        Process p = pb.start();
-+
-+        if (input != null) {
-+            writeToStream(p.getOutputStream(), input);
-+        }
-+
-+        p.waitFor();
-+
-+        String output;
-+        if (p.exitValue() == 0) {
-+            output = readFromStream(p.getInputStream());
-+        } else {
-+            output = readFromStream(p.getErrorStream());
-+        }
-+        p.destroy();
-+
-+        return output;
-+    }
-+
-+
-+
-     public static String SpecialURLDecode(String s) {
-         if (s == null)
-             return null;

jss.spec

@@ -6,18 +6,17 @@ Summary:        Java Security Services (JSS)
 URL:            http://www.dogtagpki.org/wiki/JSS
 License:        MPLv1.1 or GPLv2+ or LGPLv2+
 
-Version:        4.5.2
-Release:        3%{?_timestamp}%{?_commit_id}%{?dist}
+Version:        4.6.4
+Release:        1%{?_timestamp}%{?_commit_id}%{?dist}
 # global         _phase -a1
 
 # To generate the source tarball:
 # $ git clone https://github.com/dogtagpki/jss.git
 # $ cd jss
-# $ git archive \
-#     --format=tar.gz \
-#     --prefix jss-VERSION/ \
-#     -o jss-VERSION.tar.gz \
-#     <version tag>
+# $ git tag v4.5.<z>
+# $ git push origin v4.5.<z>
+# Then go to https://github.com/dogtagpki/jss/releases and download the source
+# tarball.
 Source:         https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phase}/%{name}-%{version}%{?_phase}.tar.gz
 
 # To create a patch for all changes since a version tag:
@@ -26,7 +25,6 @@ Source:         https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phas
 #     <version tag> \
 #     > jss-VERSION-RELEASE.patch
 # Patch: jss-VERSION-RELEASE.patch
-Patch1: jss-pki-sync-netscape-security-util-Utils.patch
 
 ################################################################################
 # Build Dependencies
@@ -53,9 +51,7 @@ BuildRequires:  slf4j-jdk14
 BuildRequires:  apache-commons-lang
 BuildRequires:  apache-commons-codec
 
-%if 0%{?fedora} >= 25 || 0%{?rhel} > 7
-BuildRequires:  perl-interpreter
-%endif
+BuildRequires:  junit
 
 Requires:       nss >= 3.30
 Requires:       java-headless
@@ -109,6 +105,9 @@ export BUILD_OPT=1
 CFLAGS="-g $RPM_OPT_FLAGS"
 export CFLAGS
 
+# Check if we're in FIPS mode
+modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENABLED=1
+
 # The Makefile is not thread-safe
 rm -rf build && mkdir -p build && cd build
 %cmake \
@@ -116,7 +115,9 @@ rm -rf build && mkdir -p build && cd build
     -DJAVA_LIB_INSTALL_DIR=%{_jnidir} \
     ..
 
-%{__make} all test javadoc
+%{__make} all
+%{__make} javadoc || true
+ctest --output-on-failure
 
 ################################################################################
 %install
@@ -158,7 +159,36 @@ cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version}
 
 ################################################################################
 %changelog
-* Fri Feb 01 2019 Dogtag PKI Team <pki-devel@redhat.com> 4.5.2-3
+* Mon Apr 27 2020 Dogtag PKI Team <pki-devel@redhat.com> - 4.6.4-1
+- Rebase to JSS 4.6.4
+- Fixes memory leak present since v4.6.2
+
+* Wed Mar 04 2020 Dogtag PKI Team <pki-devel@redhat.com> - 4.6.2-4
+- Fix for PBE errors
+
+* Tue Jan 28 2020 Dogtag PKI Team <pki-devel@redhat.com> - 4.6.2-3
+- Rebuild with new NSS to fix rhbz#1794814
+
+* Tue Oct 29 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.6.2-2
+- Fix for rhbz#1766451
+
+* Tue Oct 15 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.6.2-1
+- Rebase to JSS 4.6.2
+- Fixes CVE-2019-14823
+
+* Thu Aug 08 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.6.1-2
+- Disable unnecessary tests to fix broken s390x
+
+* Thu Aug 08 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.6.1-1
+- Rebase to JSS 4.6.1
+
+* Mon May 06 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.5.3-2
+- Add AIA OCSP certificate checking patch
+
+* Tue Mar 19 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.5.3-1
+- Rebase to JSS 4.5.3
+
+* Fri Feb 01 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.5.2-3
 - Include nuxwdog patch for netscape.security.util.Utils from PKI
 
 * Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 4.5.2-2

sources

@@ -1 +1 @@
-SHA512 (jss-4.5.2.tar.gz) = 344b31a218b7aebb15cc24e24d5697978889bf37856ddefc9521899d2a2a80b1bc9ed0b498a6e0cd19deed169fe1bc56f1ad42e7b8cfc188fadd28245d7bec31
+SHA512 (jss-4.6.4.tar.gz) = c0adc950e1ce5e0f3d846dcb158d831575be84176ded3eec7ce3569cfd96c872a2089a2eede249c5924e1eee58d88574accd3403623910343130cf90b504b348