Rebase to jss 5.7.0

.gitignore

@@ -49,3 +49,5 @@ jss-4.2.6.tar.gz
 /jss-5.5.0.tar.gz
 /jss-5.5.1.tar.gz
 /jss-5.6.0-alpha1.tar.gz
+/jss-5.6.0.tar.gz
+/jss-5.7.0.tar.gz

jss-5.4.2-nss-3.97.patch

@@ -1,40 +0,0 @@
-From 130d543f3a7c33196bef386b4ee87ccc4ed53d0b Mon Sep 17 00:00:00 2001
-From: "Endi S. Dewata" <edewata@redhat.com>
-Date: Wed, 7 Feb 2024 14:59:31 -0600
-Subject: [PATCH] Update kea_alg_defs to match NSS 3.97
-
-The kea_alg_defs array in SSLCipher.c has been updated to match
-the one defined in NSS 3.97. The assertion that compares the size
-of the array with ssl_kea_size has also been removed. These
-changes will allow JSS to work with the newer NSS 3.97 on Fedora
-Rawhide as well as the older NSS versions on other platforms.
-
-Resolves: https://github.com/dogtagpki/jss/issues/991
----
- native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c b/native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c
-index 4f2dacb0b..ea739617a 100644
---- a/native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c
-+++ b/native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c
-@@ -23,7 +23,7 @@ static const CK_MECHANISM_TYPE auth_alg_defs[] = {
- };
- PR_STATIC_ASSERT(PR_ARRAY_SIZE(auth_alg_defs) == ssl_auth_size);
- 
--/* Copied from NSS's ssl3con.c. */
-+/* Copied from NSS 3.97's ssl3con.c. */
- static const CK_MECHANISM_TYPE kea_alg_defs[] = {
-     CKM_INVALID_MECHANISM, /* ssl_kea_null */
-     CKM_RSA_PKCS,          /* ssl_kea_rsa */
-@@ -33,8 +33,9 @@ static const CK_MECHANISM_TYPE kea_alg_defs[] = {
-     CKM_ECDH1_DERIVE,      /* ssl_kea_ecdh_psk */
-     CKM_DH_PKCS_DERIVE,    /* ssl_kea_dh_psk */
-     CKM_INVALID_MECHANISM, /* ssl_kea_tls13_any */
-+    CKM_INVALID_MECHANISM, /* ssl_kea_ecdh_hybrid */
-+    CKM_INVALID_MECHANISM, /* ssl_kea_ecdh_hybrid_psk */
- };
--PR_STATIC_ASSERT(PR_ARRAY_SIZE(kea_alg_defs) == ssl_kea_size);
- 
- #ifdef HAVE_NSS_CIPHER_SUITE_INFO_KDFHASH
- /* Not present in ssl3con.c. */

jss.spec

@@ -7,19 +7,20 @@ Name:           jss
 
 # Upstream version number:
 %global         major_version 5
-%global         minor_version 6
+%global         minor_version 7
 %global         update_version 0
 
 # Downstream release number:
 # - development/stabilization (unsupported): 0.<n> where n >= 1
 # - GA/update (supported): <n> where n >= 1
-%global         release_number 0.1
+
+%global         release_number 1
 
 # Development phase:
 # - development (unsupported): alpha<n> where n >= 1
 # - stabilization (unsupported): beta<n> where n >= 1
 # - GA/update (supported): <none>
-%global         phase alpha1
+#global         phase
 
 %undefine       timestamp
 %undefine       commit_id
@@ -28,7 +29,7 @@ Summary:        Java Security Services (JSS)
 URL:            https://github.com/dogtagpki/jss
 License:        (MPL-1.1 OR GPL-2.0-or-later OR LGPL-2.1-or-later) AND Apache-2.0
 Version:        %{major_version}.%{minor_version}.%{update_version}
-Release:        %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.1
+Release:        %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}
 
 # To generate the source tarball:
 # $ git clone https://github.com/dogtagpki/jss.git
@@ -56,9 +57,26 @@ ExcludeArch: i686
 # Java
 ################################################################################
 
+# use Java 17 on Fedora 39 or older and RHEL 9 or older
+# otherwise, use Java 21
+
+# maven-local is a subpackage of javapackages-tools
+
+%if 0%{?fedora} && 0%{?fedora} <= 39 || 0%{?rhel} && 0%{?rhel} <= 9
+
+%define java_devel java-17-openjdk-devel
+%define java_headless java-17-openjdk-headless
+%define java_home %{_jvmdir}/jre-17-openjdk
+%define maven_local maven-local-openjdk17
+
+%else
+
 %define java_devel java-21-openjdk-devel
 %define java_headless java-21-openjdk-headless
 %define java_home %{_jvmdir}/jre-21-openjdk
+%define maven_local maven-local
+
+%endif
 
 ################################################################################
 # Build Options
@@ -84,11 +102,11 @@ BuildRequires:  zip
 BuildRequires:  unzip
 
 BuildRequires:  gcc-c++
-BuildRequires:  nss-devel >= 3.66
-BuildRequires:  nss-tools >= 3.66
+BuildRequires:  nss-devel >= 3.97
+BuildRequires:  nss-tools >= 3.97
 
 BuildRequires:  %{java_devel}
-BuildRequires:  maven-local
+BuildRequires:  %{maven_local}
 BuildRequires:  mvn(org.apache.commons:commons-lang3)
 BuildRequires:  mvn(org.slf4j:slf4j-api)
 BuildRequires:  mvn(org.slf4j:slf4j-jdk14)
@@ -104,7 +122,7 @@ This only works with gcj. Other JREs require that JCE providers be signed.
 
 Summary:        Java Security Services (JSS)
 
-Requires:       nss >= 3.66
+Requires:       nss >= 3.97
 
 Requires:       %{java_headless}
 Requires:       mvn(org.apache.commons:commons-lang3)
@@ -135,18 +153,24 @@ Summary:        Java Security Services (JSS) Connector for Tomcat
 BuildRequires:  mvn(org.apache.tomcat:tomcat-catalina) >= 9.0.62
 BuildRequires:  mvn(org.apache.tomcat:tomcat-coyote) >= 9.0.62
 BuildRequires:  mvn(org.apache.tomcat:tomcat-juli) >= 9.0.62
+%if 0%{?rhel} && 0%{?rhel} >= 10
+BuildRequires:  tomcat9-lib
+%endif
 
 Requires:       %{product_id} = %{version}-%{release}
 Requires:       mvn(org.apache.tomcat:tomcat-catalina) >= 9.0.62
 Requires:       mvn(org.apache.tomcat:tomcat-coyote) >= 9.0.62
 Requires:       mvn(org.apache.tomcat:tomcat-juli) >= 9.0.62
+%if 0%{?rhel} && 0%{?rhel} >= 10
+Requires:       tomcat9 >= 1:9.0.62
+%endif
 
 # Tomcat JSS has been replaced with JSS Connector for Tomcat.
 # This will remove installed Tomcat JSS packages.
 Obsoletes:      tomcatjss <= 8.5
 Conflicts:      tomcatjss <= 8.5
-Obsoletes:      dogtag-tomcatjss <= 8.5
-Conflicts:      dogtag-tomcatjss <= 8.5
+Obsoletes:      %{vendor_id}-tomcatjss <= 8.5
+Conflicts:      %{vendor_id}-tomcatjss <= 8.5
 
 %if 0%{?rhel} <= 8
 # PKI Servlet Engine has been replaced with Tomcat.
@@ -376,6 +400,12 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib
 
 ################################################################################
 %changelog
+* Tue Sep 23 2025 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.7.0-1
+- Rebase to JSS 5.7.0
+
+* Tue Mar 18 2025 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.6.0-1
+- Rebase to JSS 5.6.0
+
 * Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 5.6.0-0.1.alpha1.1
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
 

sources

@@ -1 +1 @@
-SHA512 (jss-5.6.0-alpha1.tar.gz) = 239952d7b1fc9d005760e9234aec84a84a02becefffa525853e9cccd5cfc88e6e0d9d2ea2eea59f43e3b6d1686878081eae1e615ed68d759b3c5aef7397a5472
+SHA512 (jss-5.7.0.tar.gz) = 00062ebda25b50cd09db59f7bb1343bc4a25f5d5ceec46b734032d2da6004d8b1fb05f529dccbfe36d922cf8ad8b8695ba721eac3de214fb6ffcd881be44a2f1