Resolves: jss Pagure Issue #4,12

- JSS Pagure Issue #12 - org.mozilla.jss.pkix.primitive.AlgorithmIdentifier
  decode/encode process alters original data (cfu)
- JSS Pagure Issue #4 - JSS: Add support for TLS_*_SHA384 ciphers (cfu)

.gitignore

@@ -1,55 +1,6 @@
-# Local build files
-jss-*.src.rpm
-jss-*/
-x86_64/
-.build-*.log
-
-# Releases
 jss-4.2.6.tar.gz
 /jss-4.2.6.tar.gz
 /jss-4.4.0.tar.gz
 /jss-4.4.1.tar.gz
 /jss-4.4.2.tar.gz
-/jss-4.4.3.tar.gz
 /jss-4.4.4.tar.gz
-/jss-4.5.0-a1.tar.gz
-/jss-4.5.0-a2.tar.gz
-/jss-4.5.0-a3.tar.gz
-/jss-4.5.0-a4.tar.gz
-/jss-4.5.0-b1.tar.gz
-/jss-4.5.0.tar.gz
-/jss-4.5.1.tar.gz
-/jss-4.5.2.tar.gz
-/jss-4.5.3.tar.gz
-/jss-4.6.1.tar.gz
-/jss-4.6.2.tar.gz
-/jss-4.6.3.tar.gz
-/jss-4.6.4.tar.gz
-/jss-4.7.0-b2.tar.gz
-/jss-4.7.0-b4.tar.gz
-/jss-4.7.0.tar.gz
-/jss-4.7.2.tar.gz
-/jss-4.7.3.tar.gz
-/jss-4.8.0-b1.tar.gz
-/jss-4.8.0.tar.gz
-/jss-4.8.1.tar.gz
-/jss-4.9.0-alpha1.tar.gz
-/jss-5.0.0-alpha1.tar.gz
-/jss-5.0.0-alpha2.tar.gz
-/jss-5.0.0-beta1.tar.gz
-/jss-5.0.0.tar.gz
-/jss-5.1.0-alpha2.tar.gz
-/jss-5.1.0.tar.gz
-/jss-5.2.0-beta1.tar.gz
-/jss-5.2.0-beta2.tar.gz
-/jss-5.2.0.tar.gz
-/jss-5.3.0.tar.gz
-/jss-5.4.2.tar.gz
-/jss-5.5.0-alpha2.tar.gz
-/jss-5.5.0.tar.gz
-/jss-5.5.1.tar.gz
-/jss-5.6.0-alpha1.tar.gz
-/jss-5.8.0-beta1.tar.gz
-/jss-5.8.0-beta3.tar.gz
-/jss-5.8.0-beta4.tar.gz
-/jss-5.8.0.tar.gz

.packit.yaml

@@ -1,30 +0,0 @@
----
-# See the documentation for more information:
-# https://packit.dev/docs/configuration/
-specfile_path: jss.spec
-
-# add or remove files that should be synced
-files_to_sync:
-  - jss.spec
-  - .packit.yaml
-
-# Allow dist git reactions on packit and ckelley commits and PRs
-allowed_pr_authors:
-  - packit
-  - ckelleyRH
-allowed_committers:
-  - packit
-  - ckelleyRH
-
-upstream_package_name: jss
-# downstream (Fedora/CentOS) RPM package name
-downstream_package_name: jss
-# see: https://packit.dev/docs/configuration/#upstream_tag_template
-upstream_tag_template: "v{version}"
-
-jobs:
-  - job: propose_downstream
-    trigger: release
-    dist_git_branches:
-      - fedora-development
-#     - centos-stream-9-x86_64 # When Packit integration with CentOS is avaiable, enable this

README.packit

@@ -1,3 +0,0 @@
-This repository is maintained by packit.
-https://packit.dev/
-The file was generated using packit 0.76.0.post10+g0dcb396.

copr-build.sh

@@ -1,9 +0,0 @@
-#!/bin/sh
-
-REPO=$1
-
-if [ "$REPO" == "" ]; then
-    REPO="pki-10.6"
-fi
-
-fedpkg copr-build --nowait $REPO

jss-add-TLS-SHA384-ciphers.patch

@@ -0,0 +1,167 @@
+From 82f4b9a032f942fdc005e12a408c8e87c9ea0f36 Mon Sep 17 00:00:00 2001
+From: Christina Fu <cfu@redhat.com>
+Date: Thu, 28 Jun 2018 17:42:36 -0700
+Subject: [PATCH] Ticket #4 Add support for TLS_*_SHA384 ciphers
+
+This patch adds support for TLS_*_SHA384 ciphers.
+
+Fixes https://pagure.io/jss/issue/4
+---
+ org/mozilla/jss/ssl/SSLCipher.java       |  7 +++++
+ org/mozilla/jss/ssl/SSLSocket.java       |  7 +++++
+ org/mozilla/jss/tests/Constants.java     | 11 ++++++--
+ org/mozilla/jss/tests/SSLClientAuth.java | 45 ++++++++++++++++++++++++++++++++
+ 4 files changed, 68 insertions(+), 2 deletions(-)
+
+diff --git a/org/mozilla/jss/ssl/SSLCipher.java b/org/mozilla/jss/ssl/SSLCipher.java
+index 30acdd7..278126b 100644
+--- a/jss/org/mozilla/jss/ssl/SSLCipher.java
++++ b/jss/org/mozilla/jss/ssl/SSLCipher.java
+@@ -258,8 +258,11 @@ public enum SSLCipher {
+     TLS_RSA_WITH_SEED_CBC_SHA                    (0x0096),
+ 
+     TLS_RSA_WITH_AES_128_GCM_SHA256              (0x009C),
++    TLS_RSA_WITH_AES_256_GCM_SHA384              (0x009D),
+     TLS_DHE_RSA_WITH_AES_128_GCM_SHA256          (0x009E),
++    TLS_DHE_RSA_WITH_AES_256_GCM_SHA384          (0x009F),
+     TLS_DHE_DSS_WITH_AES_128_GCM_SHA256          (0x00A2),
++    TLS_DHE_DSS_WITH_AES_256_GCM_SHA384          (0x00A3),
+ 
+     TLS_ECDH_ECDSA_WITH_NULL_SHA                 (0xc001, true),
+     TLS_ECDH_ECDSA_WITH_RC4_128_SHA              (0xc002, true),
+@@ -292,11 +295,15 @@ public enum SSLCipher {
+     TLS_ECDH_anon_WITH_AES_256_CBC_SHA           (0xc019, true),
+ 
+     TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256      (0xc023, true),
++    TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384      (0xc024, true),
+     TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256        (0xc027, true),
++    TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384        (0xc028, true),
+ 
+     TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256      (0xc02B, true),
++    TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384      (0xc02C, true),
+     TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256       (0xc02D, true),
+     TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256        (0xc02F, true),
++    TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384        (0xc030, true),
+     TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256         (0xc031, true);
+ 
+     private int id;
+diff --git a/org/mozilla/jss/ssl/SSLSocket.java b/org/mozilla/jss/ssl/SSLSocket.java
+index 0dd39fd..e104d3c 100644
+--- a/jss/org/mozilla/jss/ssl/SSLSocket.java
++++ b/jss/org/mozilla/jss/ssl/SSLSocket.java
+@@ -268,8 +268,11 @@ public class SSLSocket extends java.net.Socket {
+     public final static int TLS_RSA_WITH_SEED_CBC_SHA                    = 0x0096;
+ 
+     public final static int TLS_RSA_WITH_AES_128_GCM_SHA256              = 0x009C;
++    public final static int TLS_RSA_WITH_AES_256_GCM_SHA384              = 0x009D;
+     public final static int TLS_DHE_RSA_WITH_AES_128_GCM_SHA256          = 0x009E;
++    public final static int TLS_DHE_RSA_WITH_AES_256_GCM_SHA384          = 0x009F;
+     public final static int TLS_DHE_DSS_WITH_AES_128_GCM_SHA256          = 0x00A2;
++    public final static int TLS_DHE_DSS_WITH_AES_256_GCM_SHA384          = 0x00A3;
+ 
+     public final static int TLS_ECDH_ECDSA_WITH_NULL_SHA                 = 0xc001;
+     public final static int TLS_ECDH_ECDSA_WITH_RC4_128_SHA              = 0xc002;
+@@ -302,11 +305,15 @@ public class SSLSocket extends java.net.Socket {
+     public final static int TLS_ECDH_anon_WITH_AES_256_CBC_SHA           = 0xc019;
+ 
+     public final static int TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256      = 0xc023;
++    public final static int TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384      = 0xc024;
+     public final static int TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256        = 0xc027;
++    public final static int TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384        = 0xc028;
+ 
+     public final static int TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256      = 0xc02B;
++    public final static int TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384      = 0xc02C;
+     public final static int TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256       = 0xc02D;
+     public final static int TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256        = 0xc02F;
++    public final static int TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384       = 0xc030;
+     public final static int TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256         = 0xc031;
+ 
+     /*
+diff --git a/org/mozilla/jss/tests/Constants.java b/org/mozilla/jss/tests/Constants.java
+index e613034..d79ad72 100755
+--- a/jss/org/mozilla/jss/tests/Constants.java
++++ b/jss/org/mozilla/jss/tests/Constants.java
+@@ -142,8 +142,15 @@ public interface Constants {
+ /*77*/  new cipher(SSLSocket.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"),
+ /*78*/  new cipher(SSLSocket.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"),
+ /*79*/  new cipher(SSLSocket.TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256, "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256"),
+-/*78*/  new cipher(SSLSocket.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"),
+-/*80*/  new cipher(SSLSocket.TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256, "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256")
++/*80*/  new cipher(SSLSocket.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"),
++/*81*/  new cipher(SSLSocket.TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256, "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256"),
++/*82*/  new cipher(SSLSocket.TLS_RSA_WITH_AES_256_GCM_SHA384, "TLS_RSA_WITH_AES_256_GCM_SHA384"),
++/*83*/  new cipher(SSLSocket.TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384"),
++/*84*/  new cipher(SSLSocket.TLS_DHE_DSS_WITH_AES_256_GCM_SHA384, "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384"),
++/*85*/  new cipher(SSLSocket.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384"),
++/*86*/  new cipher(SSLSocket.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384"),
++/*87*/  new cipher(SSLSocket.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"),
++/*88*/  new cipher(SSLSocket.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384")
+     };
+     
+     /** Cipher supported by JSSE (JDK 1.5.x) */
+diff --git a/org/mozilla/jss/tests/SSLClientAuth.java b/org/mozilla/jss/tests/SSLClientAuth.java
+index e1c6163..b656b82 100644
+--- a/jss/org/mozilla/jss/tests/SSLClientAuth.java
++++ b/jss/org/mozilla/jss/tests/SSLClientAuth.java
+@@ -148,6 +148,8 @@ public class SSLClientAuth implements Runnable {
+             
+         }
+         configureDefaultSSLoptions();
++
++        testSpecificCiphers();
+         
+         useNickname = false;
+         testConnection();
+@@ -265,6 +267,49 @@ public class SSLClientAuth implements Runnable {
+             System.exit(1);
+         }
+     }
++
++    // test one or more specific ciphers
++    //   -- normally for newly added ciphers
++    private void testSpecificCiphers() {
++        try {
++            //Disable SSL2 and SSL3 ciphers
++            SSLSocket.enableSSL2Default(false);
++            SSLSocket.enableSSL3Default(false);
++            /* TLS is enabled by default */
++
++            /* Enable Session tickets by default */
++            SSLSocket.enableSessionTicketsDefault(true);
++
++            /*
++             *  when testing specific ciphers:
++             *  1. flip this to true
++             *  2. change the ciphers comparison (the code below was from
++             *     the latest test
++             */
++            if (false) {
++                System.out.println("testing new TLS_*SHA384 ciphers");
++                System.out.println("Enable ony two new ciphers.");
++                int ciphers[] =
++                        org.mozilla.jss.ssl.SSLSocket.getImplementedCipherSuites();
++                for (int i = 0; i < ciphers.length;  ++i) {
++                    if (ciphers[i] == 157 || ciphers[i] == 159) {
++                        System.out.println("enabling cipher: " + ciphers[i]);
++                        /* enable a couple SHA384 ciphers */
++                        SSLSocket.setCipherPreferenceDefault(ciphers[i], true);
++                    } else {
++                        System.out.println("disabling cipher: " + ciphers[i]);
++                        /* disable the non SHA384 ciphers */
++                        SSLSocket.setCipherPreferenceDefault(ciphers[i], false);
++                    }
++                }
++            }
++
++        } catch (SocketException ex) {
++            System.out.println("Error configuring ciphers.");
++            ex.printStackTrace();
++            System.exit(1);
++        }
++    }
+     
+     private void testConnection() throws Exception {
+         serverReady = false;
+-- 
+1.8.3.1
+

jss-add-build-sh.patch

@@ -0,0 +1,386 @@
+From f2357a2b5721cddb0a8924be76d0cdc9412d59dc Mon Sep 17 00:00:00 2001
+From: "Endi S. Dewata" <edewata@redhat.com>
+Date: Thu, 21 Jun 2018 21:41:21 -0600
+Subject: [PATCH] Added build.sh
+
+A new build script has been added to simplify the build process.
+---
+ build.sh | 366 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 366 insertions(+)
+ create mode 100755 build.sh
+
+diff --git a/build.sh b/build.sh
+new file mode 100755
+index 00000000..ebd46e97
+--- /dev/null
++++ b/build.sh
+@@ -0,0 +1,366 @@
++#!/bin/bash -e
++
++# BEGIN COPYRIGHT BLOCK
++# (C) 2018 Red Hat, Inc.
++# All rights reserved.
++# END COPYRIGHT BLOCK
++
++NAME=jss
++
++SCRIPT_PATH=`readlink -f "$0"`
++SCRIPT_NAME=`basename "$SCRIPT_PATH"`
++
++SRC_DIR=`dirname "$SCRIPT_PATH"`
++WORK_DIR="$HOME/build/$NAME"
++
++SOURCE_TAG=
++
++WITH_TIMESTAMP=
++WITH_COMMIT_ID=
++DIST=
++
++VERBOSE=
++DEBUG=
++
++usage() {
++    echo "Usage: $SCRIPT_NAME [OPTIONS] <target>"
++    echo
++    echo "Options:"
++    echo "    --work-dir=<path>      Working directory (default: $WORK_DIR)."
++    echo "    --source-tag=<tag>     Generate RPM sources from a source tag."
++    echo "    --with-timestamp       Append timestamp to release number."
++    echo "    --with-commit-id       Append commit ID to release number."
++    echo "    --dist=<name>          Distribution name (e.g. fc28)."
++    echo " -v,--verbose              Run in verbose mode."
++    echo "    --debug                Run in debug mode."
++    echo "    --help                 Show help message."
++    echo
++    echo "Target:"
++    echo "    src    Generate RPM sources."
++    echo "    spec   Generate RPM spec."
++    echo "    srpm   Build SRPM package."
++    echo "    rpm    Build RPM packages."
++}
++
++generate_rpm_sources() {
++
++    TARBALL="$NAME-$VERSION.tar.gz"
++
++    if [ "$SOURCE_TAG" != "" ] ; then
++
++        if [ "$VERBOSE" = true ] ; then
++            echo "Generating $TARBALL from $SOURCE_TAG tag"
++        fi
++
++        git -C "$SRC_DIR" \
++            archive \
++            --format=tar.gz \
++            --prefix $NAME-$VERSION/$NAME/ \
++            -o "$WORK_DIR/SOURCES/$TARBALL" \
++            $SOURCE_TAG
++
++        if [ "$SOURCE_TAG" != "HEAD" ] ; then
++
++            TAG_ID=`git -C "$SRC_DIR" rev-parse $SOURCE_TAG`
++            HEAD_ID=`git -C "$SRC_DIR" rev-parse HEAD`
++
++            if [ "$TAG_ID" != "$HEAD_ID" ] ; then
++                generate_patch
++            fi
++        fi
++
++        return
++    fi
++
++    if [ "$VERBOSE" = true ] ; then
++        echo "Generating $TARBALL"
++    fi
++
++    tar czf "$WORK_DIR/SOURCES/$TARBALL" \
++        --transform "s,^./,$NAME-$VERSION/$NAME/," \
++        --exclude .git \
++        --exclude bin \
++        -C "$SRC_DIR" \
++        .
++}
++
++generate_patch() {
++
++    PATCH="$NAME-$VERSION-$RELEASE.patch"
++
++    if [ "$VERBOSE" = true ] ; then
++        echo "Generating $PATCH for all changes since $SOURCE_TAG tag"
++    fi
++
++    git -C "$SRC_DIR" \
++        format-patch \
++        --stdout \
++        $SOURCE_TAG \
++        > "$WORK_DIR/SOURCES/$PATCH"
++}
++
++generate_rpm_spec() {
++
++    RPM_SPEC="$NAME.spec"
++
++    if [ "$VERBOSE" = true ] ; then
++        echo "Generating $RPM_SPEC"
++    fi
++
++    # hard-code timestamp
++    commands="s/%{?_timestamp}/${_TIMESTAMP}/g"
++
++    # hard-code commit ID
++    commands="${commands}; s/%{?_commit_id}/${_COMMIT_ID}/g"
++
++    # hard-code patch
++    if [ "$PATCH" != "" ] ; then
++        commands="${commands}; s/# Patch: jss-VERSION-RELEASE.patch/Patch: $PATCH/g"
++    fi
++
++    sed "$commands" "$SPEC_TEMPLATE" > "$WORK_DIR/SPECS/$RPM_SPEC"
++
++    # rpmlint "$WORK_DIR/SPECS/$RPM_SPEC"
++}
++
++while getopts v-: arg ; do
++    case $arg in
++    v)
++        VERBOSE=true
++        ;;
++    -)
++        LONG_OPTARG="${OPTARG#*=}"
++
++        case $OPTARG in
++        work-dir=?*)
++            WORK_DIR=`readlink -f "$LONG_OPTARG"`
++            ;;
++        source-tag=?*)
++            SOURCE_TAG="$LONG_OPTARG"
++            ;;
++        with-timestamp)
++            WITH_TIMESTAMP=true
++            ;;
++        with-commit-id)
++            WITH_COMMIT_ID=true
++            ;;
++        dist=?*)
++            DIST="$LONG_OPTARG"
++            ;;
++        verbose)
++            VERBOSE=true
++            ;;
++        debug)
++            VERBOSE=true
++            DEBUG=true
++            ;;
++        help)
++            usage
++            exit
++            ;;
++        '')
++            break # "--" terminates argument processing
++            ;;
++        work-dir* | source-tag* | dist*)
++            echo "ERROR: Missing argument for --$OPTARG option" >&2
++            exit 1
++            ;;
++        *)
++            echo "ERROR: Illegal option --$OPTARG" >&2
++            exit 1
++            ;;
++        esac
++        ;;
++    \?)
++        exit 1 # getopts already reported the illegal option
++        ;;
++    esac
++done
++
++# remove parsed options and args from $@ list
++shift $((OPTIND-1))
++
++if [ "$#" -lt 1 ] ; then
++    echo "ERROR: Missing build target" >&2
++    usage
++    exit 1
++fi
++
++BUILD_TARGET=$1
++
++if [ "$DEBUG" = true ] ; then
++    echo "WORK_DIR: $WORK_DIR"
++    echo "BUILD_TARGET: $BUILD_TARGET"
++fi
++
++if [ "$BUILD_TARGET" != "src" ] &&
++        [ "$BUILD_TARGET" != "spec" ] &&
++        [ "$BUILD_TARGET" != "srpm" ] &&
++        [ "$BUILD_TARGET" != "rpm" ] ; then
++    echo "ERROR: Invalid build target: $BUILD_TARGET" >&2
++    exit 1
++fi
++
++SPEC_TEMPLATE="$SRC_DIR/$NAME.spec.in"
++VERSION="`rpmspec -P "$SPEC_TEMPLATE" | grep "^Version:" | awk '{print $2;}'`"
++
++if [ "$DEBUG" = true ] ; then
++    echo "VERSION: $VERSION"
++fi
++
++RELEASE="`rpmspec -P "$SPEC_TEMPLATE" --undefine dist | grep "^Release:" | awk '{print $2;}'`"
++
++if [ "$DEBUG" = true ] ; then
++    echo "RELEASE: $RELEASE"
++fi
++
++if [ "$WITH_TIMESTAMP" = true ] ; then
++    TIMESTAMP="`date +"%Y%m%d%H%M%S"`"
++    _TIMESTAMP=".$TIMESTAMP"
++fi
++
++if [ "$DEBUG" = true ] ; then
++    echo "TIMESTAMP: $TIMESTAMP"
++fi
++
++if [ "$WITH_COMMIT_ID" = true ]; then
++    COMMIT_ID="`git -C "$SRC_DIR" rev-parse --short=8 HEAD`"
++    _COMMIT_ID=".$COMMIT_ID"
++fi
++
++if [ "$DEBUG" = true ] ; then
++    echo "COMMIT_ID: $COMMIT_ID"
++fi
++
++echo "Building $NAME-$VERSION-$RELEASE${_TIMESTAMP}${_COMMIT_ID}"
++
++################################################################################
++# Initialize working directory
++################################################################################
++
++if [ "$VERBOSE" = true ] ; then
++    echo "Initializing $WORK_DIR"
++fi
++
++mkdir -p $WORK_DIR
++cd $WORK_DIR
++
++rm -rf BUILD
++rm -rf RPMS
++rm -rf SOURCES
++rm -rf SPECS
++rm -rf SRPMS
++
++mkdir BUILD
++mkdir RPMS
++mkdir SOURCES
++mkdir SPECS
++mkdir SRPMS
++
++################################################################################
++# Generate RPM sources
++################################################################################
++
++generate_rpm_sources
++
++echo "RPM sources:"
++find "$WORK_DIR/SOURCES" -type f -printf " %p\n"
++
++if [ "$BUILD_TARGET" = "src" ] ; then
++    exit
++fi
++
++################################################################################
++# Generate RPM spec
++################################################################################
++
++generate_rpm_spec
++
++echo "RPM spec:"
++find "$WORK_DIR/SPECS" -type f -printf " %p\n"
++
++if [ "$BUILD_TARGET" = "spec" ] ; then
++    exit
++fi
++
++################################################################################
++# Build source package
++################################################################################
++
++OPTIONS=()
++
++OPTIONS+=(--quiet)
++OPTIONS+=(--define "_topdir ${WORK_DIR}")
++
++if [ "$WITH_TIMESTAMP" = true ] ; then
++    OPTIONS+=(--define "_timestamp ${_TIMESTAMP}")
++fi
++
++if [ "$WITH_COMMIT_ID" = true ] ; then
++    OPTIONS+=(--define "_commit_id ${_COMMIT_ID}")
++fi
++
++if [ "$DIST" != "" ] ; then
++    OPTIONS+=(--define "dist .$DIST")
++fi
++
++if [ "$DEBUG" = true ] ; then
++    echo "rpmbuild -bs ${OPTIONS[@]} $WORK_DIR/SPECS/$RPM_SPEC"
++fi
++
++# build SRPM with user-provided options
++rpmbuild -bs "${OPTIONS[@]}" "$WORK_DIR/SPECS/$RPM_SPEC"
++
++rc=$?
++
++if [ $rc != 0 ]; then
++    echo "ERROR: Unable to build SRPM package"
++    exit 1
++fi
++
++SRPM=`find "$WORK_DIR/SRPMS" -type f`
++
++echo "SRPM package:"
++echo " $SRPM"
++
++if [ "$BUILD_TARGET" = "srpm" ] ; then
++    exit
++fi
++
++################################################################################
++# Build binary packages
++################################################################################
++
++OPTIONS=()
++
++if [ "$VERBOSE" = true ] ; then
++    OPTIONS+=(--define "_verbose 1")
++fi
++
++OPTIONS+=(--define "_topdir ${WORK_DIR}")
++
++if [ "$DEBUG" = true ] ; then
++    echo "rpmbuild --rebuild ${OPTIONS[@]} $SRPM"
++fi
++
++# rebuild RPM with hard-coded options in SRPM
++rpmbuild --rebuild "${OPTIONS[@]}" "$SRPM"
++
++rc=$?
++
++if [ $rc != 0 ]; then
++    echo "ERROR: Unable to build RPM packages"
++    exit 1
++fi
++
++# install SRPM to restore sources and spec file removed during rebuild
++rpm -i --define "_topdir $WORK_DIR" "$SRPM"
++
++# flatten folder
++find "$WORK_DIR/RPMS" -mindepth 2 -type f -exec mv -i '{}' "$WORK_DIR/RPMS" ';'
++
++# remove empty subfolders
++find "$WORK_DIR/RPMS" -mindepth 1 -type d -delete
++
++echo "RPM packages:"
++find "$WORK_DIR/RPMS" -type f -printf " %p\n"
+-- 
+2.14.4
+

jss-add-travis-yml.patch

@@ -0,0 +1,37 @@
+commit f6df4da0a66c9fdad6c1b794190431c265931a16
+Author: Endi S. Dewata <edewata@redhat.com>
+Date:   Thu May 31 04:34:48 2018 +0200
+
+    Added .travis.yml
+    
+    A Travis CI configuration has been added to build JSS and run a
+    basic installation test. Additional tests will be added later.
+
+diff --git a/.travis.yml b/.travis.yml
+new file mode 100644
+index 00000000..ae674cc5
+--- /dev/null
++++ b/.travis.yml
+@@ -0,0 +1,22 @@
++# BEGIN COPYRIGHT BLOCK
++# (C) 2018 Red Hat, Inc.
++# All rights reserved.
++# END COPYRIGHT BLOCK
++
++services:
++  - docker
++
++install:
++  - docker pull registry.fedoraproject.org/fedora:28
++  - docker run
++      --name=container
++      --detach
++      -i
++      -v $(pwd):/root/jss
++      registry.fedoraproject.org/fedora:28
++  - docker exec container dnf install -y dnf-plugins-core gcc make rpm-build
++  - docker exec container dnf builddep -y --spec /root/jss/jss.spec.in
++  - docker exec container /root/jss/build.sh --with-timestamp --with-commit-id rpm
++
++script:
++  - docker exec container rpm -Uvh /root/build/jss/RPMS/*

jss-fix-README.patch

@@ -0,0 +1,67 @@
+commit 76f7c710435d28c9dc8cad8540615ba73f3c00c4
+Author: Alexander Scheel <alexander.m.scheel@gmail.com>
+Date:   Thu May 31 08:17:15 2018 -0400
+
+    Updated README instructions for git
+    
+    Signed-off-by: Alexander Scheel <alexander.m.scheel@gmail.com>
+
+diff --git a/README b/README
+index 5a1bc49c..9f1929ac 100644
+--- a/jss/README
++++ b/jss/README
+@@ -17,7 +17,7 @@
+         (There is no need to clone every time. For additional builds,
+          simply use:
+           cd nspr; hg pull -u -v; cd ..; cd nss; hg pull -u -v; cd ..;
+-          cd jss; hg pull -u -v; cd ..
++          cd jss; git pull -u -v; cd ..
+         )
+ 
+     (b) Alternatively, for upstream builds which use
+@@ -39,7 +39,7 @@
+ 
+         (There is no need to clone every time. For additional builds,
+          simply use:
+-          cd jss; hg pull -u -v; cd ..
++          cd jss; git pull -u -v; cd ..
+         )
+ 
+ 
+@@ -164,7 +164,7 @@
+     good practice to create a "regular tag" to the source code at these
+     various points in time using the following format:
+ 
+-        # hg tag -m "message" JSS_<major>_<minor>_YYYYMMDD
++        # git tag -m "message" JSS_<major>_<minor>_YYYYMMDD
+ 
+         where:  <major> = JSS Major Version Number
+                 <minor> = JSS Minor Version Number
+@@ -174,10 +174,10 @@
+     
+         For example:
+ 
+-            # hg id
+-            b3e864205ff0+ tip
++            # git rev-parse HEAD
++            b3e864205ff0...
+ 
+-            # hg tag -m "Added tag JSS_4_4_20170328 for changeset b3e864205ff0" JSS_4_4_20170328
++            # git tag -m "Added tag JSS_4_4_20170328 for changeset b3e864205ff0" JSS_4_4_20170328
+ 
+     At the appropriate time, a new major.minor version may be created.  At this
+     time, it is important to create a maintenance branch for any future changes
+@@ -185,10 +185,10 @@
+ 
+     For example:
+ 
+-        # hg id
+-        f00f00f00f00+ tip
++        # git rev-parse HEAD
++        f00f00f00f00...
+ 
+-        # hg branch -m "Created branch JSS_4_4_BRANCH for changeset f00f00f00f00" JSS_4_4_BRANCH
++        # git checkout -b JSS_4_4_BRANCH
+ 
+ 
+ (8) Known Issues

jss-fix-algorithm-identifier-encode-decode.patch

@@ -0,0 +1,44 @@
+From 7c7a97f60c1b3400b921981a3cd9e9aae4f28987 Mon Sep 17 00:00:00 2001
+From: Christina Fu <cfu@redhat.com>
+Date: Tue, 26 Jun 2018 17:59:28 -0700
+Subject: [PATCH] Ticket 12 AlgorithmIdentifier decode/encode process alters
+ original data
+
+This patch provides fix to ensure that the encoding and decoding of an AlgorithmIdentifier
+structure would not alter the data.
+
+credit: original fix suggestion provided by david.k.stutzman2.ctr@mail.mil
+
+fixes https://pagure.io/jss/issue/12
+---
+ org/mozilla/jss/pkix/primitive/AlgorithmIdentifier.java | 13 +------------
+ 1 file changed, 1 insertion(+), 12 deletions(-)
+
+diff --git a/org/mozilla/jss/pkix/primitive/AlgorithmIdentifier.java b/org/mozilla/jss/pkix/primitive/AlgorithmIdentifier.java
+index 0662f76..3487707 100644
+--- a/jss/org/mozilla/jss/pkix/primitive/AlgorithmIdentifier.java
++++ b/jss/org/mozilla/jss/pkix/primitive/AlgorithmIdentifier.java
+@@ -103,19 +103,8 @@ public static class Template implements ASN1Template {
+         Assert._assert( seq.size() == 2 );
+ 
+         OBJECT_IDENTIFIER algOID = (OBJECT_IDENTIFIER)seq.elementAt(0);
+-        boolean allowParams = true;
+-        try {
+-            if (algOID.equals(SignatureAlgorithm.ECSignatureWithSHA256Digest.toOID()) ||
+-                algOID.equals(SignatureAlgorithm.ECSignatureWithSHA384Digest.toOID()) ||
+-                algOID.equals(SignatureAlgorithm.ECSignatureWithSHA512Digest.toOID())) {
+-                allowParams = false;
+-            }
+-        } catch (NoSuchAlgorithmException e) {
+-            // System.out.println("JSS: AlgorithmIdentifier:decode: " + e.toString());
+-            // unlikely to happen; swallow it. treat it as allowParams;
+-        }
+ 
+-        if (!allowParams) {
++        if (seq.elementAt(1) == null) {
+             return new AlgorithmIdentifier(
+                 algOID  // OID
+             );
+-- 
+1.8.3.1
+

jss-fix-classpath.patch

@@ -0,0 +1,15 @@
+diff --git a/build_java.pl b/build_java.pl
+index 78cc5fd0..b74a9338 100644
+--- a/jss/build_java.pl
++++ b/jss/build_java.pl
+@@ -162,8 +162,9 @@ sub setup_vars {
+     }
+     $jni_header_dir = "$dist_dir/private/jss/_jni";
+ 
++    $classpath = "-classpath /usr/share/java/apache-commons-codec.jar:/usr/share/java/commons-lang.jar:/usr/share/java/ldapjdk.jar:";
+     if( $jce_jar ) {
+-        $classpath = "-classpath $jce_jar";
++        $classpath .= ":$jce_jar";
+     }
+ 
+     # retrieve present working directory

jss-update-jss-spec-in-template.patch

@@ -0,0 +1,63 @@
+From 56979bf6b22a81355fe948d3c28ec78d925db1d8 Mon Sep 17 00:00:00 2001
+From: Jack Magne <jmagne@redhat.com>
+Date: Thu, 21 Jun 2018 22:18:38 -0600
+Subject: [PATCH] Update dependencies in 'jss.spec.in' template
+
+---
+ jss.spec.in | 27 ++++++++++++++++++++++-----
+ 1 file changed, 22 insertions(+), 5 deletions(-)
+
+diff --git a/jss.spec.in b/jss.spec.in
+index f1e629f2..4a240138 100644
+--- a/jss/jss.spec.in
++++ b/jss/jss.spec.in
+@@ -10,13 +10,22 @@ Version:        4.4.4
+ Release:        1%{?_timestamp}%{?_commit_id}%{?dist}
+ 
+ # To generate the source tarball:
+-#
+-# git clone https://github.com/dogtagpki/jss.git
+-# cd jss
+-# git archive --format=tar.gz --prefix jss-VERSION/jss/ -o jss-VERSION.tar.gz -v HEAD
+-#
++# $ git clone https://github.com/dogtagpki/jss.git
++# $ cd jss
++# $ git archive \
++#     --format=tar.gz \
++#     --prefix jss-VERSION/jss/ \
++#     -o jss-VERSION.tar.gz \
++#     <version tag>
+ Source:         https://github.com/dogtagpki/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz
+ 
++# To create a patch for all changes since a version tag:
++# $ git format-patch \
++#     --stdout \
++#     <version tag> \
++#     > jss-VERSION-RELEASE.patch
++# Patch: jss-VERSION-RELEASE.patch
++
+ Conflicts:      idm-console-framework < 1.1.17-4
+ Conflicts:      pki-base < 10.4.0
+ Conflicts:      tomcatjss < 7.2.1
+@@ -31,10 +40,18 @@ BuildRequires:  jpackage-utils
+ %if 0%{?fedora} >= 25 || 0%{?rhel} > 7
+ BuildRequires:  perl-interpreter
+ %endif
++BuildRequires:  apache-commons-lang
++BuildRequires:  apache-commons-codec
++BuildRequires:  ldapjdk
++
+ 
+ Requires:       nss >= 3.28.4-6
+ Requires:       java-headless
+ Requires:       jpackage-utils
++Requires:       apache-commons-lang
++Requires:       apache-commons-codec
++Requires:       ldapjdk
++
+ 
+ %description
+ Java Security Services (JSS) is a java native interface which provides a bridge
+-- 
+2.14.4
+

jss.spec

@@ -2,117 +2,54 @@
 Name:           jss
 ################################################################################
 
-%global         vendor_id dogtag
-%global         product_id %{vendor_id}-jss
-
-# Upstream version number:
-%global         major_version 5
-%global         minor_version 8
-%global         update_version 0
-
-# Downstream release number:
-# - development/stabilization (unsupported): 0.<n> where n >= 1
-# - GA/update (supported): <n> where n >= 1
-%global         release_number 1
-
-# Development phase:
-# - development (unsupported): alpha<n> where n >= 1
-# - stabilization (unsupported): beta<n> where n >= 1
-# - GA/update (supported): <none>
-#global         phase
-
-%if 0%{?rhel} && 0%{?rhel} >= 10
-%global enable_nss_version_pqc_def_flag -DENABLE_NSS_VERSION_PQC_DEF=ON
-%endif
-
-%undefine       timestamp
-%undefine       commit_id
-
 Summary:        Java Security Services (JSS)
-URL:            https://github.com/dogtagpki/jss
-License:        (MPL-1.1 OR GPL-2.0-or-later OR LGPL-2.1-or-later) AND Apache-2.0
-Version:        %{major_version}.%{minor_version}.%{update_version}
-Release:        %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}
+URL:            http://www.dogtagpki.org/wiki/JSS
+License:        MPLv1.1 or GPLv2+ or LGPLv2+
+
+Version:        4.4.4
+Release:        3%{?_timestamp}%{?_commit_id}%{?dist}
 
 # To generate the source tarball:
-# $ git clone https://github.com/dogtagpki/jss.git
-# $ cd jss
-# $ git tag v4.5.<z>
-# $ git push origin v4.5.<z>
-# Then go to https://github.com/dogtagpki/jss/releases and download the source
-# tarball.
-Source:         https://github.com/dogtagpki/jss/archive/v%{version}%{?phase:-}%{?phase}/jss-%{version}%{?phase:-}%{?phase}.tar.gz
+#
+# git clone https://github.com/dogtagpki/jss.git
+# cd jss
+# git archive --format=tar.gz --prefix jss-VERSION/jss/ -o jss-VERSION.tar.gz -v HEAD
+#
+Source:         https://github.com/dogtagpki/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz
 
-# To create a patch for all changes since a version tag:
-# $ git format-patch \
-#     --stdout \
-#     <version tag> \
-#     > jss-VERSION-RELEASE.patch
-# Patch: jss-VERSION-RELEASE.patch
+Patch0:         jss-fix-classpath.patch
+Patch1:         jss-fix-README.patch
+Patch2:         jss-update-jss-spec-in-template.patch
+Patch3:         jss-add-build-sh.patch
+Patch4:         jss-add-travis-yml.patch
+Patch5:         jss-add-x509-cert-and-crl-migration.patch
+Patch6:         jss-fix-algorithm-identifier-encode-decode.patch
+Patch7:         jss-add-TLS-SHA384-ciphers.patch
 
-%if 0%{?java_arches:1}
-ExclusiveArch: %{java_arches}
-%else
-ExcludeArch: i686
+Conflicts:      idm-console-framework < 1.1.17-4
+Conflicts:      pki-base < 10.4.0
+Conflicts:      tomcatjss < 7.2.1
+
+# autosetup
+BuildRequires:  git
+
+BuildRequires:  nss-devel >= 3.28.4-6
+BuildRequires:  nspr-devel >= 4.13.1
+BuildRequires:  java-devel
+BuildRequires:  jpackage-utils
+%if 0%{?fedora} >= 25 || 0%{?rhel} > 7
+BuildRequires:  perl-interpreter
 %endif
+BuildRequires:  apache-commons-lang
+BuildRequires:  apache-commons-codec
+BuildRequires:  ldapjdk
 
-################################################################################
-# Java
-################################################################################
-
-# use Java 17 on Fedora 39 or older and RHEL 9 or older
-# otherwise, use Java 21
-
-# maven-local is a subpackage of javapackages-tools
-
-%if 0%{?fedora} && 0%{?fedora} >= 43 || 0%{?rhel} >= 11
-
-%define java_devel java-25-openjdk-devel
-%define java_headless java-25-openjdk-headless
-%define java_home %{_jvmdir}/jre-25-openjdk
-%define maven_local maven-local-openjdk25
-
-%else
-
-%define java_devel java-21-openjdk-devel
-%define java_headless java-21-openjdk-headless
-%define java_home %{_jvmdir}/jre-21-openjdk
-%define maven_local maven-local
-
-%endif
-
-################################################################################
-# Build Options
-################################################################################
-
-# By default the javadoc package will be built unless --without javadoc
-# option is specified.
-
-%bcond_without javadoc
-
-# By default the tests package will be built and the tests will executed
-# unless --without tests option is specified.
-
-%bcond_without tests
-
-################################################################################
-# Build Dependencies
-################################################################################
-
-BuildRequires:  make
-BuildRequires:  cmake >= 3.14
-BuildRequires:  zip
-BuildRequires:  unzip
-
-BuildRequires:  gcc-c++
-BuildRequires:  nss-devel >= 3.101
-BuildRequires:  nss-tools >= 3.101
-
-BuildRequires:  %{java_devel}
-BuildRequires:  %{maven_local}
-BuildRequires:  mvn(org.apache.commons:commons-lang3)
-BuildRequires:  mvn(org.slf4j:slf4j-api)
-BuildRequires:  mvn(org.slf4j:slf4j-jdk14)
+Requires:       nss >= 3.28.4-6
+Requires:       java-headless
+Requires:       jpackage-utils
+Requires:       apache-commons-lang
+Requires:       apache-commons-codec
+Requires:       ldapjdk
 
 %description
 Java Security Services (JSS) is a java native interface which provides a bridge
@@ -120,390 +57,141 @@ for java-based applications to use native Network Security Services (NSS).
 This only works with gcj. Other JREs require that JCE providers be signed.
 
 ################################################################################
-%package -n %{product_id}
-################################################################################
-
-Summary:        Java Security Services (JSS)
-
-Requires:       nss >= 3.101
-
-Requires:       %{java_headless}
-Requires:       mvn(org.apache.commons:commons-lang3)
-Requires:       mvn(org.slf4j:slf4j-api)
-Requires:       mvn(org.slf4j:slf4j-jdk14)
-
-Obsoletes:      jss < %{version}-%{release}
-Provides:       jss = %{version}-%{release}
-Provides:       jss = %{major_version}.%{minor_version}
-Provides:       %{product_id} = %{major_version}.%{minor_version}
-
-Conflicts:      ldapjdk < 4.20
-Conflicts:      idm-console-framework < 1.2
-Conflicts:      pki-base < 10.10.0
-
-%description -n %{product_id}
-Java Security Services (JSS) is a java native interface which provides a bridge
-for java-based applications to use native Network Security Services (NSS).
-This only works with gcj. Other JREs require that JCE providers be signed.
-
-################################################################################
-%package -n %{product_id}-tomcat
-################################################################################
-
-Summary:        Java Security Services (JSS) Connector for Tomcat
-
-# Tomcat
-BuildRequires:  mvn(org.apache.tomcat:tomcat-catalina) >= 10.1.36
-BuildRequires:  mvn(org.apache.tomcat:tomcat-coyote) >= 10.1.36
-BuildRequires:  mvn(org.apache.tomcat:tomcat-juli) >= 10.1.36
-
-Requires:       %{product_id} = %{version}-%{release}
-Requires:       mvn(org.apache.tomcat:tomcat-catalina) >= 10.1.36
-Requires:       mvn(org.apache.tomcat:tomcat-coyote) >= 10.1.36 
-Requires:       mvn(org.apache.tomcat:tomcat-juli) >= 10.1.36
-
-# Tomcat JSS has been replaced with JSS Connector for Tomcat.
-# This will remove installed Tomcat JSS packages.
-Obsoletes:      tomcatjss <= 8.5
-Conflicts:      tomcatjss <= 8.5
-Obsoletes:      %{vendor_id}-tomcatjss <= 8.5
-Conflicts:      %{vendor_id}-tomcatjss <= 8.5
-
-%if 0%{?rhel} <= 8
-# PKI Servlet Engine has been replaced with Tomcat.
-# This will remove installed PKI Servlet Engine packages.
-Obsoletes:      pki-servlet-engine <= 9.0
-Conflicts:      pki-servlet-engine <= 9.0
-%endif
-
-%description -n %{product_id}-tomcat
-JSS Connector for Tomcat is a Java Secure Socket Extension (JSSE)
-module for Apache Tomcat that uses Java Security Services (JSS),
-a Java interface to Network Security Services (NSS).
-
-################################################################################
-%package -n %{product_id}-tools
-################################################################################
-
-Summary:        Java Security Services (JSS) Tools
-
-Provides:       jss-tools = %{version}-%{release}
-Provides:       jss-tools = %{major_version}.%{minor_version}
-Provides:       %{product_id}-tools = %{major_version}.%{minor_version}
-
-# Some PKI tools have been moved into jss-tools.
-Conflicts:      pki-tools < 11.6
-Conflicts:      %{vendor_id}-pki-tools < 11.6
-
-%description -n %{product_id}-tools
-This package contains JSS tools.
-
-%if %{with javadoc}
-################################################################################
-%package -n %{product_id}-javadoc
+%package javadoc
 ################################################################################
 
 Summary:        Java Security Services (JSS) Javadocs
+Group:          Documentation
+Requires:       jss = %{version}-%{release}
 
-Obsoletes:      jss-javadoc < %{version}-%{release}
-Provides:       jss-javadoc = %{version}-%{release}
-Provides:       jss-javadoc = %{major_version}.%{minor_version}
-Provides:       %{product_id}-javadoc = %{major_version}.%{minor_version}
-
-%description -n %{product_id}-javadoc
+%description javadoc
 This package contains the API documentation for JSS.
-%endif
-
-%if %{with tests}
-################################################################################
-%package -n %{product_id}-tests
-################################################################################
-
-Summary:        Java Security Services (JSS) Tests
-
-BuildRequires:  mvn(org.junit.jupiter:junit-jupiter)
-BuildRequires:  mvn(org.opentest4j:opentest4j)
-
-%description -n %{product_id}-tests
-This package provides test suite for JSS.
-
-# with tests
-%endif
 
 ################################################################################
 %prep
-################################################################################
 
-%autosetup -n jss-%{version}%{?phase:-}%{?phase} -p 1
-
-# disable native modules since they will be built by CMake
-%pom_disable_module native
-%pom_disable_module symkey
-
-# do not ship examples
-%pom_disable_module examples
-
-# flatten-maven-plugin is not available in RPM
-%pom_remove_plugin org.codehaus.mojo:flatten-maven-plugin
-
-# specify Maven artifact locations
-%mvn_file org.dogtagpki.jss:jss-tomcat         jss/jss-tomcat
-%mvn_file org.dogtagpki.jss:jss-tomcat-10.1     jss/jss-tomcat-10.1
-
-# specify Maven artifact packages
-%mvn_package org.dogtagpki.jss:jss-tomcat      jss-tomcat
-%mvn_package org.dogtagpki.jss:jss-tomcat-10.1  jss-tomcat
+#%autosetup -n %{name}-%{version} -p 1 -S git
+%setup -q -n %{name}-%{version}
+pushd jss
+# Force use of 'patch' rather than 'git apply' by injecting "/jss/" prefix
+# on patches of existing files located in top-level directory . . .
+%patch0 -p2
+%patch1 -p2
+%patch2 -p2
+%patch3 -p1
+%patch4 -p1
+%patch5 -p1
+%patch6 -p2
+%patch7 -p2
+popd
 
 ################################################################################
 %build
-################################################################################
 
-# Set build flags for CMake
-# (see /usr/lib/rpm/macros.d/macros.cmake)
 %set_build_flags
 
-export JAVA_HOME=%{java_home}
+[ -z "$JAVA_HOME" ] && export JAVA_HOME=%{_jvmdir}/java
+[ -z "$USE_INSTALLED_NSPR" ] && export USE_INSTALLED_NSPR=1
+[ -z "$USE_INSTALLED_NSS" ] && export USE_INSTALLED_NSS=1
 
-# Enable compiler optimizations
+# Enable compiler optimizations and disable debugging code
+# NOTE: If you ever need to create a debug build with optimizations disabled
+# just comment out this line and change in the %%install section below the
+# line that copies jars xpclass.jar to be xpclass_dbg.jar
 export BUILD_OPT=1
 
 # Generate symbolic info for debuggers
-CFLAGS="-g $RPM_OPT_FLAGS"
-export CFLAGS
+XCFLAGS="-g $RPM_OPT_FLAGS"
+export XCFLAGS
 
-# Check if we're in FIPS mode
-modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENABLED=1
+PKG_CONFIG_ALLOW_SYSTEM_LIBS=1
+PKG_CONFIG_ALLOW_SYSTEM_CFLAGS=1
 
-# build Java code, run Java tests, and build Javadoc with Maven
-%mvn_build %{!?with_tests:-f} %{!?with_javadoc:-j}
+export PKG_CONFIG_ALLOW_SYSTEM_LIBS
+export PKG_CONFIG_ALLOW_SYSTEM_CFLAGS
 
-# create links to Maven-built classes for CMake
-mkdir -p %{_vpath_builddir}/classes/jss
-ln -sf ../../../base/target/classes/org %{_vpath_builddir}/classes/jss
-%if %{with tests}
-mkdir -p %{_vpath_builddir}/classes/tests
-ln -sf ../../../base/target/test-classes/org %{_vpath_builddir}/classes/tests
+NSPR_INCLUDE_DIR=`/usr/bin/pkg-config --cflags-only-I nspr | sed 's/-I//'`
+NSPR_LIB_DIR=`/usr/bin/pkg-config --libs-only-L nspr | sed 's/-L//'`
+
+NSS_INCLUDE_DIR=`/usr/bin/pkg-config --cflags-only-I nss | sed 's/-I//'`
+NSS_LIB_DIR=`/usr/bin/pkg-config --libs-only-L nss | sed 's/-L//'`
+
+export NSPR_INCLUDE_DIR
+export NSPR_LIB_DIR
+export NSS_INCLUDE_DIR
+export NSS_LIB_DIR
+
+%if 0%{?__isa_bits} == 64
+USE_64=1
+export USE_64
 %endif
 
-# create links to Maven-built JAR files for CMake
-ln -sf ../base/target/jss.jar %{_vpath_builddir}
-%if %{with tests}
-ln -sf ../base/target/jss-tests.jar %{_vpath_builddir}
-%endif
-
-# create links to Maven-built headers for CMake
-mkdir -p %{_vpath_builddir}/include/jss
-ln -sf ../../../base/target/include/_jni %{_vpath_builddir}/include/jss/_jni
-
-# mark Maven-built targets so that CMake will not rebuild them
-mkdir -p %{_vpath_builddir}/.targets
-touch %{_vpath_builddir}/.targets/finished_generate_java
-%if %{with tests}
-touch %{_vpath_builddir}/.targets/finished_tests_generate_java
-%endif
-%if %{with javadoc}
-touch %{_vpath_builddir}/.targets/finished_generate_javadocs
-%endif
-
-# build native code and run native tests with CMake
-./build.sh \
-    %{?_verbose:-v} \
-    --work-dir=%{_vpath_builddir} \
-    --prefix-dir=%{_prefix} \
-    --include-dir=%{_includedir} \
-    --lib-dir=%{_libdir} \
-    --sysconf-dir=%{_sysconfdir} \
-    --share-dir=%{_datadir} \
-    --cmake="%{__cmake} %{?enable_nss_version_pqc_def_flag}" \
-    --java-home=%{java_home} \
-    --jni-dir=%{_jnidir} \
-    --version=%{version} \
-    --without-java \
-    --without-javadoc \
-    %{!?with_tests:--without-tests} \
-    dist
+# The Makefile is not thread-safe
+make -C jss/coreconf
+make -C jss
+make -C jss javadoc
 
 ################################################################################
 %install
+
+# Copy the license files here so we can include them in %%doc
+cp -p jss/MPL-1.1.txt .
+cp -p jss/gpl.txt .
+cp -p jss/lgpl.txt .
+
+# There is no install target so we'll do it by hand
+
+# jars
+install -d -m 0755 $RPM_BUILD_ROOT%{_jnidir}
+# NOTE: if doing a debug no opt build change xpclass.jar to xpclass_dbg.jar
+install -m 644 dist/xpclass.jar ${RPM_BUILD_ROOT}%{_jnidir}/jss4.jar
+
+# We have to use the name libjss4.so because this is dynamically
+# loaded by the jar file.
+install -d -m 0755 $RPM_BUILD_ROOT%{_libdir}/jss
+install -m 0755 dist/Linux*.OBJ/lib/libjss4.so ${RPM_BUILD_ROOT}%{_libdir}/jss/
+pushd  ${RPM_BUILD_ROOT}%{_libdir}/jss
+    ln -fs %{_jnidir}/jss4.jar jss4.jar
+popd
+
+# javadoc
+install -d -m 0755 $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version}
+cp -rp dist/jssdoc/* $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version}
+cp -p jss/jss.html $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version}
+cp -p jss/*.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version}
+
+# No ldconfig is required since this library is loaded by Java itself.
 ################################################################################
+%files
 
-# install Java binaries and Javadoc
-%mvn_install
-
-# install jss.jar
-mkdir -p %{buildroot}%{_javadir}/jss
-cp base/target/jss.jar %{buildroot}%{_javadir}/jss/jss.jar
-
-# create links for backward compatibility
-mkdir -p %{buildroot}%{_jnidir}
-ln -sf ../../..%{_javadir}/jss/jss.jar %{buildroot}%{_jnidir}/jss.jar
-
-mkdir -p %{buildroot}%{_libdir}/jss
-ln -sf ../../..%{_javadir}/jss/jss.jar %{buildroot}%{_libdir}/jss/jss.jar
-
-# install native binaries
-./build.sh \
-    %{?_verbose:-v} \
-    --work-dir=%{_vpath_builddir} \
-    --install-dir=%{buildroot} \
-    --without-java \
-    install
-
-# install tests binaries
-%if %{with tests}
-mkdir -p %{buildroot}%{_datadir}/jss/tests/lib
-cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib
-%endif
+%defattr(-,root,root,-)
+%doc jss/jss.html jss/MPL-1.1.txt jss/gpl.txt jss/lgpl.txt
+%{_libdir}/jss/*
+%{_jnidir}/*
+%{_libdir}/jss/lib*.so
 
 ################################################################################
-%files -n %{product_id} -f .mfiles
-################################################################################
+%files javadoc
 
-%doc jss.html
-%license MPL-1.1.txt gpl.txt lgpl.txt symkey/LICENSE
-%{_javadir}/jss/jss.jar
-%{_jnidir}/jss.jar
-%{_libdir}/jss/jss.jar
-%{_libdir}/jss/libjss.so
-%{_libdir}/jss/libjss-symkey.so
-
-################################################################################
-%files -n %{product_id}-tomcat -f .mfiles-jss-tomcat
-################################################################################
-
-################################################################################
-%files -n %{product_id}-tools
-################################################################################
-
-%{_bindir}/p12tool
-%{_bindir}/p7tool
-%{_bindir}/sslget
-
-%if %{with javadoc}
-################################################################################
-%files -n %{product_id}-javadoc -f .mfiles-javadoc
-################################################################################
-%endif
-
-%if %{with tests}
-################################################################################
-%files -n %{product_id}-tests
-################################################################################
-
-%{_datadir}/jss/tests/
-
-# with tests
-%endif
+%defattr(-,root,root,-)
+%dir %{_javadocdir}/%{name}-%{version}
+%{_javadocdir}/%{name}-%{version}/*
 
 ################################################################################
 %changelog
-* Tue Nov 04 2025 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.8.0-1
-- Rebase to JSS 5.8.0-1
 
-* Fri Aug 22 2025 Yaakov Selkowitz <yselkowi@redhat.com> - 5.8.0-0.6.beta4
-- Build with Java 25 for ELN
+* Thu Jul  5 2018 Dogtag PKI Team <pki-devel@redhat.com> 4.4.4-3
+- JSS Pagure Issue #12 - org.mozilla.jss.pkix.primitive.AlgorithmIdentifier
+  decode/encode process alters original data (cfu)
+- JSS Pagure Issue #4 - JSS: Add support for TLS_*_SHA384 ciphers (cfu)
 
-* Mon Aug 11 2025 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.8.0-0.5.beta4
-- Rebuild for Fedora 43
+* Thu Jun 21 2018 Dogtag PKI Team <pki-devel@redhat.com> 4.4.4-2
+- JSS Pagure Issue #11 - (RFE) Migrate Dogtag x509 cert and crl
+  functionality to JSS (jmagne)
 
-* Mon Aug 11 2025 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.8.0-0.4.beta4.1
-- Rebase to JSS 5.8.0-beta4
+* Tue May 29 2018 Dogtag PKI Team <pki-devel@redhat.com> 4.4.4-1
+- Rebased to JSS 4.4.4
 
-* Mon Jul 28 2025 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.8.0-0.3.beta3.1
-- Rebase to JSS 5.8.0-beta3
-
-* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 5.8.0-0.1.beta1.1
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Wed Jul 09 2025 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.8.0.1
-- Rebase to JSS 5.8.0-beta1
-
-* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 5.6.0-0.1.alpha1.1
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
-
-* Wed Nov 20 2024 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.6.0-1
-- Rebase to JSS 5.6.0-alpha1
-
-* Fri Oct 04 2024 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.5.1-1
-- Rebase to JSS 5.5.1
-
-* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 5.5.0-2.1
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
-
-* Thu Feb 29 2024 Adam Williamson <awilliam@redhat.com> - 5.5.0-2
-- Really build against java-21
-
-* Tue Feb 27 2024 Jiri Vanek <jvanek@redhat.com> - 5.5.0-1.1
-- Rebuilt for java-21-openjdk as system jdk
-
-* Wed Feb 21 2024 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.5.0-1
-- Rebase to JSS 5.5.0
-
-* Thu Feb 08 2024 Yaakov Selkowitz <yselkowi@redhat.com> - 5.4.2-1.4
-- Fix compatibility with NSS 3.97
-
-* Wed Jan 24 2024 Fedora Release Engineering <releng@fedoraproject.org> - 5.4.2-1.3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Sat Jan 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 5.4.2-1.2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 5.4.2-1.1
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
-
-* Fri Jun 16 2023 Packit <hello@packit.dev> - 5.4.2-1
-- Updating version to v5.4.2 (Chris Kelley)
-- Upstream spec file changes to reduce diffs (Chris Kelley)
-- Introduce Packit configuration for jss (Chris Kelley)
-
-* Tue Feb 07 2023 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.3.0-2
-- Update version number in JSSConfig.cmake
-
-* Tue Feb 07 2023 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.3.0-1
-- Rebase to JSS 5.3.0
-
-* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 5.2.0-1.2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
-
-* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 5.2.0-1.1
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
-
-* Wed Jun 29 2022 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.2.0-1
-- Rebase to JSS 5.2.0
-
-* Wed Apr 27 2022 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.2.0-0.3.beta2
-- Rebase to JSS 5.2.0-beta2
-- Rename packages to dogtag-jss
-
-* Mon Apr 11 2022 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.2.0-0.2.beta1
-- Rebase to JSS 5.2.0-beta1
-
-* Mon Feb 14 2022 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.1.0-1
-- Rebase to JSS 5.1.0
-
-* Sat Feb 05 2022 Jiri Vanek <jvanek@redhat.com> - 5.1.0-0.3.alpha2
-- Rebuilt for java-17-openjdk as system jdk
-
-* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 5.1.0-0.2.alpha2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
-
-* Fri Nov 26 2021 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.1.0-0.1.alpha2
-- Rebase to JSS 5.1.0-alpha2
-
-* Thu Sep 30 2021 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.0.0-1
-- Rebase to JSS 5.0.0
-
-* Wed Sep 29 2021 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.0.0-0.5.beta1
-- Drop BuildRequires and Requires on glassfish-jaxb-api
-
-* Fri Sep 03 2021 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.0.0-0.4.beta1
-- Rebase to JSS 5.0.0-beta1
-
-* Thu Aug 12 2021 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.0.0-0.3.alpha2
-- Rebase to JSS 5.0.0-alpha2
-
-* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 5.0.0-0.2.alpha1
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
-
-* Tue Jun 22 2021 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.0.0-0.1.alpha1
-- Rebase to JSS 5.0.0-alpha1
+* Thu Apr 05 2018 Dogtag PKI Team <pki-devel@redhat.com> 4.4.3-1
+- Rebased to JSS 4.4.3
+- Red Hat Bugzilla #1548548 - Partial Fedora build flags injection

sources

@@ -1 +1 @@
-SHA512 (jss-5.8.0.tar.gz) = 10f5727d78f8b466062396e47c25b7fdac4b70c6862e6857f8aef49b633c43c4485c1d3cd535006ecd090e8dfe787000fb40d8748ed381c4ac4d1d39312e6c3d
+SHA512 (jss-4.4.4.tar.gz) = 206a2f26239a647b36f19277e2eebb73bfbd3bc436dabe708423498fb509956618a99c6f0532e47c7b7ddda71652612a450f7490b809866339a1d3827f7e2f51

sources-update.sh

@@ -1,7 +0,0 @@
-#!/bin/sh
-
-SOURCE=$1
-TARGET=`basename $1`
-
-cp $SOURCE $TARGET
-sha512sum --tag $TARGET > sources