Fix changelog date

Signed-off-by: Alexander Scheel <ascheel@redhat.com>

.gitignore

@@ -25,31 +25,3 @@ jss-4.2.6.tar.gz
 /jss-4.6.2.tar.gz
 /jss-4.6.3.tar.gz
 /jss-4.6.4.tar.gz
-/jss-4.7.0-b2.tar.gz
-/jss-4.7.0-b4.tar.gz
-/jss-4.7.0.tar.gz
-/jss-4.7.2.tar.gz
-/jss-4.7.3.tar.gz
-/jss-4.8.0-b1.tar.gz
-/jss-4.8.0.tar.gz
-/jss-4.8.1.tar.gz
-/jss-4.9.0-alpha1.tar.gz
-/jss-5.0.0-alpha1.tar.gz
-/jss-5.0.0-alpha2.tar.gz
-/jss-5.0.0-beta1.tar.gz
-/jss-5.0.0.tar.gz
-/jss-5.1.0-alpha2.tar.gz
-/jss-5.1.0.tar.gz
-/jss-5.2.0-beta1.tar.gz
-/jss-5.2.0-beta2.tar.gz
-/jss-5.2.0.tar.gz
-/jss-5.3.0.tar.gz
-/jss-5.4.2.tar.gz
-/jss-5.5.0-alpha2.tar.gz
-/jss-5.5.0.tar.gz
-/jss-5.5.1.tar.gz
-/jss-5.6.0-alpha1.tar.gz
-/jss-5.8.0-beta1.tar.gz
-/jss-5.8.0-beta3.tar.gz
-/jss-5.8.0-beta4.tar.gz
-/jss-5.8.0.tar.gz

.packit.yaml

@@ -1,30 +0,0 @@
----
-# See the documentation for more information:
-# https://packit.dev/docs/configuration/
-specfile_path: jss.spec
-
-# add or remove files that should be synced
-files_to_sync:
-  - jss.spec
-  - .packit.yaml
-
-# Allow dist git reactions on packit and ckelley commits and PRs
-allowed_pr_authors:
-  - packit
-  - ckelleyRH
-allowed_committers:
-  - packit
-  - ckelleyRH
-
-upstream_package_name: jss
-# downstream (Fedora/CentOS) RPM package name
-downstream_package_name: jss
-# see: https://packit.dev/docs/configuration/#upstream_tag_template
-upstream_tag_template: "v{version}"
-
-jobs:
-  - job: propose_downstream
-    trigger: release
-    dist_git_branches:
-      - fedora-development
-#     - centos-stream-9-x86_64 # When Packit integration with CentOS is avaiable, enable this

0001-Fix-NativeProxy-reference-tracker.patch

@@ -0,0 +1,53 @@
+From 91514ca0a2979ba778d27220ced0cd312e2cd2d2 Mon Sep 17 00:00:00 2001
+From: Alexander Scheel <ascheel@redhat.com>
+Date: Tue, 29 Oct 2019 10:43:56 -0400
+Subject: [PATCH] Fix NativeProxy reference tracker
+
+In eb5df01003d74b57473eacb84e538d31f5bb06ca, I introduced a bug by
+setting mPointer after trying to add NativeProxy to the registry. In
+most instances this won't matter, however, if another instance exists in
+the HashSet with the same hash value, the equals comparator will be
+used, triggering a NPE.
+
+Signed-off-by: Alexander Scheel <ascheel@redhat.com>
+---
+ org/mozilla/jss/util/NativeProxy.java | 13 +++++--------
+ 1 file changed, 5 insertions(+), 8 deletions(-)
+
+diff --git a/org/mozilla/jss/util/NativeProxy.java b/org/mozilla/jss/util/NativeProxy.java
+index 1c6d1aa5..a0811f76 100644
+--- a/org/mozilla/jss/util/NativeProxy.java
++++ b/org/mozilla/jss/util/NativeProxy.java
+@@ -40,8 +40,8 @@ public abstract class NativeProxy implements AutoCloseable
+      */
+     public NativeProxy(byte[] pointer) {
+ 		assert(pointer!=null);
+-        registry.add(this);
+         mPointer = pointer;
++        registry.add(this);
+ 
+         if (saveStacktraces) {
+             mTrace = Arrays.toString(Thread.currentThread().getStackTrace());
+@@ -61,15 +61,12 @@ public abstract class NativeProxy implements AutoCloseable
+         if( ! (obj instanceof NativeProxy) ) {
+             return false;
+         }
+-        if( ((NativeProxy)obj).mPointer.length != mPointer.length) {
++        if (((NativeProxy)obj).mPointer == null) {
++            /* If mPointer is null, we have no way to compare the values
++             * of the pointers, so assume they're unequal. */
+             return false;
+         }
+-        for(int i=0; i < mPointer.length; i++) {
+-            if(mPointer[i] != ((NativeProxy)obj).mPointer[i]) {
+-                return false;
+-            }
+-        }
+-        return true;
++        return Arrays.equals(((NativeProxy)obj).mPointer, mPointer);
+     }
+ 
+     /**
+-- 
+2.21.0
+

0002-Fix-swapped-parameter-names-with-PBE.patch

@@ -0,0 +1,80 @@
+From 9f29430656342829822568f4ef49f5237b41164b Mon Sep 17 00:00:00 2001
+From: Alexander Scheel <ascheel@redhat.com>
+Date: Fri, 28 Feb 2020 14:10:32 -0500
+Subject: [PATCH 7/8] Fix swapped parameter names with PBE
+
+Commit 13998a9e77e60d6509ac814ed711dd21e1248ecd introduced a regression
+related to extracting the parameter classes during PBE operations:
+previously, the classes of the underlying encryption algorithm were
+iterated over, instead of the classes of the PBE class itself. However,
+this commit iterated over the PBE parameter classes; no PBE algorithm
+accepts a IvParameterSpec, resulting in a null parameter passed to the
+later encryption or key wrap operation. This resulted in stack traces
+like the following:
+
+Caused by: java.security.InvalidAlgorithmParameterException: DES3/CBC/Pad cannot use a null parameter
+	at org.mozilla.jss.pkcs11.PK11KeyWrapper.checkParams(PK11KeyWrapper.java:225)
+	at org.mozilla.jss.pkcs11.PK11KeyWrapper.initWrap(PK11KeyWrapper.java:89)
+	at org.mozilla.jss.pkcs11.PK11KeyWrapper.initWrap(PK11KeyWrapper.java:57)
+	at org.mozilla.jss.pkix.primitive.EncryptedPrivateKeyInfo.createPBE(EncryptedPrivateKeyInfo.java:342)
+
+Resolves: rh-bz#1807371
+
+Signed-off-by: Alexander Scheel <ascheel@redhat.com>
+---
+ org/mozilla/jss/pkcs7/EncryptedContentInfo.java             | 2 +-
+ org/mozilla/jss/pkix/cms/EncryptedContentInfo.java          | 2 +-
+ org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++--
+ 3 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/org/mozilla/jss/pkcs7/EncryptedContentInfo.java b/org/mozilla/jss/pkcs7/EncryptedContentInfo.java
+index 084752c3..0344b14d 100644
+--- a/org/mozilla/jss/pkcs7/EncryptedContentInfo.java
++++ b/org/mozilla/jss/pkcs7/EncryptedContentInfo.java
+@@ -182,7 +182,7 @@ public class EncryptedContentInfo implements ASN1Value {
+         // generate IV
+         EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg();
+         AlgorithmParameterSpec params=null;
+-        Class<?> [] paramClasses = pbeAlg.getParameterClasses();
++        Class<?> [] paramClasses = encAlg.getParameterClasses();
+         for (int i = 0; i < paramClasses.length; i ++) {
+             if ( paramClasses[i].equals(
+                       javax.crypto.spec.IvParameterSpec.class ) ) {
+diff --git a/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java b/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java
+index a4709070..d85eb0d3 100644
+--- a/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java
++++ b/org/mozilla/jss/pkix/cms/EncryptedContentInfo.java
+@@ -180,7 +180,7 @@ public class EncryptedContentInfo implements ASN1Value {
+         // generate IV
+         EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg();
+         AlgorithmParameterSpec params=null;
+-        Class<?> [] paramClasses = pbeAlg.getParameterClasses();
++        Class<?> [] paramClasses = encAlg.getParameterClasses();
+         for (int i = 0; i < paramClasses.length; i ++) {
+             if ( paramClasses[i].equals( IVParameterSpec.class ) ) {
+                 params = new IVParameterSpec( kg.generatePBE_IV() );
+diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java
+index b35714e3..ebd269f3 100644
+--- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java
++++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java
+@@ -147,7 +147,7 @@ public class EncryptedPrivateKeyInfo implements ASN1Value {
+         // generate IV
+         EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg();
+         AlgorithmParameterSpec params=null;
+-        Class<?> [] paramClasses = pbeAlg.getParameterClasses();
++        Class<?> [] paramClasses = encAlg.getParameterClasses();
+         for (int i = 0; i < paramClasses.length; i ++) {
+             if ( paramClasses[i].equals( javax.crypto.spec.IvParameterSpec.class ) ) {
+                 params = new IVParameterSpec( kg.generatePBE_IV() );
+@@ -328,7 +328,7 @@ public class EncryptedPrivateKeyInfo implements ASN1Value {
+         // generate IV
+         EncryptionAlgorithm encAlg = pbeAlg.getEncryptionAlg();
+         AlgorithmParameterSpec params=null;
+-        Class<?> [] paramClasses = pbeAlg.getParameterClasses();
++        Class<?> [] paramClasses = encAlg.getParameterClasses();
+         for (int i = 0; i < paramClasses.length; i ++) {
+             if ( paramClasses[i].equals(
+                       javax.crypto.spec.IvParameterSpec.class ) ) {
+-- 
+2.24.1
+

0003-Use-specified-algorithm-for-KeyWrap.patch

@@ -0,0 +1,60 @@
+From 55482c8bfa0addeb9db7b590703ba3704c5db167 Mon Sep 17 00:00:00 2001
+From: Alexander Scheel <ascheel@redhat.com>
+Date: Fri, 28 Feb 2020 14:39:29 -0500
+Subject: [PATCH 8/8] Use specified algorithm for KeyWrap
+
+When the token-specified from of EncryptedPrivateKeyInfo.createPBE is
+called, it would always request DES3_CBC_PAD as the key wrapping
+algorithm, regardless of the input PBE key type. However, the other form
+(with an implicit token) was correctly handling this case.
+
+Introduces a new KeyWrapAlgorithm method to take an OBJECT_IDENTIFIER
+instead of having to convert to/from a String form.
+
+Signed-off-by: Alexander Scheel <ascheel@redhat.com>
+---
+ org/mozilla/jss/crypto/KeyWrapAlgorithm.java                | 5 ++++-
+ org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java | 4 ++--
+ 2 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java
+index 3113f614..3a106977 100644
+--- a/org/mozilla/jss/crypto/KeyWrapAlgorithm.java
++++ b/org/mozilla/jss/crypto/KeyWrapAlgorithm.java
+@@ -138,7 +138,10 @@ public class KeyWrapAlgorithm extends Algorithm {
+ 
+     public static KeyWrapAlgorithm fromOID(String wrapOID) throws NoSuchAlgorithmException {
+         OBJECT_IDENTIFIER oid = new OBJECT_IDENTIFIER(wrapOID);
++        return fromOID(oid);
++    }
+ 
++    public static KeyWrapAlgorithm fromOID(OBJECT_IDENTIFIER oid) throws NoSuchAlgorithmException {
+         if (oid.equals(AES_KEY_WRAP_PAD_OID))
+             return AES_KEY_WRAP_PAD;
+ 
+@@ -154,6 +157,6 @@ public class KeyWrapAlgorithm extends Algorithm {
+         if (oid.equals(DES_CBC_PAD_OID))
+             return DES_CBC_PAD;
+ 
+-        throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + wrapOID);
++        throw new NoSuchAlgorithmException("Unknown Algorithm for OID: " + oid);
+     }
+ }
+diff --git a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java
+index ebd269f3..abfc39a7 100644
+--- a/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java
++++ b/org/mozilla/jss/pkix/primitive/EncryptedPrivateKeyInfo.java
+@@ -337,8 +337,8 @@ public class EncryptedPrivateKeyInfo implements ASN1Value {
+             }
+         }
+ 
+-        KeyWrapper wrapper = token.getKeyWrapper(
+-                KeyWrapAlgorithm.DES3_CBC_PAD);
++        // wrap the key
++        KeyWrapper wrapper = token.getKeyWrapper(KeyWrapAlgorithm.fromOID(encAlg.toOID()));
+         wrapper.initWrap(key, params);
+         byte encrypted[] = wrapper.wrap(pri);
+ 
+-- 
+2.24.1
+

README.packit

@@ -1,3 +0,0 @@
-This repository is maintained by packit.
-https://packit.dev/
-The file was generated using packit 0.76.0.post10+g0dcb396.

jss.spec

@@ -2,37 +2,13 @@
 Name:           jss
 ################################################################################
 
-%global         vendor_id dogtag
-%global         product_id %{vendor_id}-jss
-
-# Upstream version number:
-%global         major_version 5
-%global         minor_version 8
-%global         update_version 0
-
-# Downstream release number:
-# - development/stabilization (unsupported): 0.<n> where n >= 1
-# - GA/update (supported): <n> where n >= 1
-%global         release_number 1
-
-# Development phase:
-# - development (unsupported): alpha<n> where n >= 1
-# - stabilization (unsupported): beta<n> where n >= 1
-# - GA/update (supported): <none>
-#global         phase
-
-%if 0%{?rhel} && 0%{?rhel} >= 10
-%global enable_nss_version_pqc_def_flag -DENABLE_NSS_VERSION_PQC_DEF=ON
-%endif
-
-%undefine       timestamp
-%undefine       commit_id
-
 Summary:        Java Security Services (JSS)
-URL:            https://github.com/dogtagpki/jss
-License:        (MPL-1.1 OR GPL-2.0-or-later OR LGPL-2.1-or-later) AND Apache-2.0
-Version:        %{major_version}.%{minor_version}.%{update_version}
-Release:        %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}
+URL:            http://www.dogtagpki.org/wiki/JSS
+License:        MPLv1.1 or GPLv2+ or LGPLv2+
+
+Version:        4.6.4
+Release:        1%{?_timestamp}%{?_commit_id}%{?dist}
+# global         _phase -a1
 
 # To generate the source tarball:
 # $ git clone https://github.com/dogtagpki/jss.git
@@ -41,7 +17,7 @@ Release:        %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp
 # $ git push origin v4.5.<z>
 # Then go to https://github.com/dogtagpki/jss/releases and download the source
 # tarball.
-Source:         https://github.com/dogtagpki/jss/archive/v%{version}%{?phase:-}%{?phase}/jss-%{version}%{?phase:-}%{?phase}.tar.gz
+Source:         https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phase}/%{name}-%{version}%{?_phase}.tar.gz
 
 # To create a patch for all changes since a version tag:
 # $ git format-patch \
@@ -50,69 +26,50 @@ Source:         https://github.com/dogtagpki/jss/archive/v%{version}%{?phase:-}%
 #     > jss-VERSION-RELEASE.patch
 # Patch: jss-VERSION-RELEASE.patch
 
-%if 0%{?java_arches:1}
-ExclusiveArch: %{java_arches}
-%else
-ExcludeArch: i686
-%endif
-
-################################################################################
-# Java
-################################################################################
-
-# use Java 17 on Fedora 39 or older and RHEL 9 or older
-# otherwise, use Java 21
-
-# maven-local is a subpackage of javapackages-tools
-
-%if 0%{?fedora} && 0%{?fedora} >= 43 || 0%{?rhel} >= 11
-
-%define java_devel java-25-openjdk-devel
-%define java_headless java-25-openjdk-headless
-%define java_home %{_jvmdir}/jre-25-openjdk
-%define maven_local maven-local-openjdk25
-
-%else
-
-%define java_devel java-21-openjdk-devel
-%define java_headless java-21-openjdk-headless
-%define java_home %{_jvmdir}/jre-21-openjdk
-%define maven_local maven-local
-
-%endif
-
-################################################################################
-# Build Options
-################################################################################
-
-# By default the javadoc package will be built unless --without javadoc
-# option is specified.
-
-%bcond_without javadoc
-
-# By default the tests package will be built and the tests will executed
-# unless --without tests option is specified.
-
-%bcond_without tests
-
 ################################################################################
 # Build Dependencies
 ################################################################################
 
+# autosetup
+BuildRequires:  git
 BuildRequires:  make
-BuildRequires:  cmake >= 3.14
-BuildRequires:  zip
-BuildRequires:  unzip
+BuildRequires:  cmake
 
 BuildRequires:  gcc-c++
-BuildRequires:  nss-devel >= 3.101
-BuildRequires:  nss-tools >= 3.101
+BuildRequires:  nspr-devel >= 4.13.1
+BuildRequires:  nss-devel >= 3.30
+BuildRequires:  nss-tools >= 3.30
+BuildRequires:  java-devel
+BuildRequires:  jpackage-utils
+BuildRequires:  slf4j
+BuildRequires:  glassfish-jaxb-api
+%if 0%{?rhel} && 0%{?rhel} <= 7
+# no slf4j-jdk14
+%else
+BuildRequires:  slf4j-jdk14
+%endif
+BuildRequires:  apache-commons-lang
+BuildRequires:  apache-commons-codec
 
-BuildRequires:  %{java_devel}
-BuildRequires:  %{maven_local}
-BuildRequires:  mvn(org.apache.commons:commons-lang3)
-BuildRequires:  mvn(org.slf4j:slf4j-api)
-BuildRequires:  mvn(org.slf4j:slf4j-jdk14)
+BuildRequires:  junit
+
+Requires:       nss >= 3.30
+Requires:       java-headless
+Requires:       jpackage-utils
+Requires:       slf4j
+Requires:       glassfish-jaxb-api
+%if 0%{?rhel} && 0%{?rhel} <= 7
+# no slf4j-jdk14
+%else
+Requires:       slf4j-jdk14
+%endif
+Requires:       apache-commons-lang
+Requires:       apache-commons-codec
+
+Conflicts:      ldapjdk < 4.20
+Conflicts:      idm-console-framework < 1.2
+Conflicts:      tomcatjss < 7.3.4
+Conflicts:      pki-base < 10.6.5
 
 %description
 Java Security Services (JSS) is a java native interface which provides a bridge
@@ -120,149 +77,26 @@ for java-based applications to use native Network Security Services (NSS).
 This only works with gcj. Other JREs require that JCE providers be signed.
 
 ################################################################################
-%package -n %{product_id}
-################################################################################
-
-Summary:        Java Security Services (JSS)
-
-Requires:       nss >= 3.101
-
-Requires:       %{java_headless}
-Requires:       mvn(org.apache.commons:commons-lang3)
-Requires:       mvn(org.slf4j:slf4j-api)
-Requires:       mvn(org.slf4j:slf4j-jdk14)
-
-Obsoletes:      jss < %{version}-%{release}
-Provides:       jss = %{version}-%{release}
-Provides:       jss = %{major_version}.%{minor_version}
-Provides:       %{product_id} = %{major_version}.%{minor_version}
-
-Conflicts:      ldapjdk < 4.20
-Conflicts:      idm-console-framework < 1.2
-Conflicts:      pki-base < 10.10.0
-
-%description -n %{product_id}
-Java Security Services (JSS) is a java native interface which provides a bridge
-for java-based applications to use native Network Security Services (NSS).
-This only works with gcj. Other JREs require that JCE providers be signed.
-
-################################################################################
-%package -n %{product_id}-tomcat
-################################################################################
-
-Summary:        Java Security Services (JSS) Connector for Tomcat
-
-# Tomcat
-BuildRequires:  mvn(org.apache.tomcat:tomcat-catalina) >= 10.1.36
-BuildRequires:  mvn(org.apache.tomcat:tomcat-coyote) >= 10.1.36
-BuildRequires:  mvn(org.apache.tomcat:tomcat-juli) >= 10.1.36
-
-Requires:       %{product_id} = %{version}-%{release}
-Requires:       mvn(org.apache.tomcat:tomcat-catalina) >= 10.1.36
-Requires:       mvn(org.apache.tomcat:tomcat-coyote) >= 10.1.36 
-Requires:       mvn(org.apache.tomcat:tomcat-juli) >= 10.1.36
-
-# Tomcat JSS has been replaced with JSS Connector for Tomcat.
-# This will remove installed Tomcat JSS packages.
-Obsoletes:      tomcatjss <= 8.5
-Conflicts:      tomcatjss <= 8.5
-Obsoletes:      %{vendor_id}-tomcatjss <= 8.5
-Conflicts:      %{vendor_id}-tomcatjss <= 8.5
-
-%if 0%{?rhel} <= 8
-# PKI Servlet Engine has been replaced with Tomcat.
-# This will remove installed PKI Servlet Engine packages.
-Obsoletes:      pki-servlet-engine <= 9.0
-Conflicts:      pki-servlet-engine <= 9.0
-%endif
-
-%description -n %{product_id}-tomcat
-JSS Connector for Tomcat is a Java Secure Socket Extension (JSSE)
-module for Apache Tomcat that uses Java Security Services (JSS),
-a Java interface to Network Security Services (NSS).
-
-################################################################################
-%package -n %{product_id}-tools
-################################################################################
-
-Summary:        Java Security Services (JSS) Tools
-
-Provides:       jss-tools = %{version}-%{release}
-Provides:       jss-tools = %{major_version}.%{minor_version}
-Provides:       %{product_id}-tools = %{major_version}.%{minor_version}
-
-# Some PKI tools have been moved into jss-tools.
-Conflicts:      pki-tools < 11.6
-Conflicts:      %{vendor_id}-pki-tools < 11.6
-
-%description -n %{product_id}-tools
-This package contains JSS tools.
-
-%if %{with javadoc}
-################################################################################
-%package -n %{product_id}-javadoc
+%package javadoc
 ################################################################################
 
 Summary:        Java Security Services (JSS) Javadocs
+Requires:       jss = %{version}-%{release}
 
-Obsoletes:      jss-javadoc < %{version}-%{release}
-Provides:       jss-javadoc = %{version}-%{release}
-Provides:       jss-javadoc = %{major_version}.%{minor_version}
-Provides:       %{product_id}-javadoc = %{major_version}.%{minor_version}
-
-%description -n %{product_id}-javadoc
+%description javadoc
 This package contains the API documentation for JSS.
-%endif
-
-%if %{with tests}
-################################################################################
-%package -n %{product_id}-tests
-################################################################################
-
-Summary:        Java Security Services (JSS) Tests
-
-BuildRequires:  mvn(org.junit.jupiter:junit-jupiter)
-BuildRequires:  mvn(org.opentest4j:opentest4j)
-
-%description -n %{product_id}-tests
-This package provides test suite for JSS.
-
-# with tests
-%endif
 
 ################################################################################
 %prep
-################################################################################
 
-%autosetup -n jss-%{version}%{?phase:-}%{?phase} -p 1
-
-# disable native modules since they will be built by CMake
-%pom_disable_module native
-%pom_disable_module symkey
-
-# do not ship examples
-%pom_disable_module examples
-
-# flatten-maven-plugin is not available in RPM
-%pom_remove_plugin org.codehaus.mojo:flatten-maven-plugin
-
-# specify Maven artifact locations
-%mvn_file org.dogtagpki.jss:jss-tomcat         jss/jss-tomcat
-%mvn_file org.dogtagpki.jss:jss-tomcat-10.1     jss/jss-tomcat-10.1
-
-# specify Maven artifact packages
-%mvn_package org.dogtagpki.jss:jss-tomcat      jss-tomcat
-%mvn_package org.dogtagpki.jss:jss-tomcat-10.1  jss-tomcat
+%autosetup -n %{name}-%{version}%{?_phase} -p 1 -S git
 
 ################################################################################
 %build
-################################################################################
 
-# Set build flags for CMake
-# (see /usr/lib/rpm/macros.d/macros.cmake)
 %set_build_flags
 
-export JAVA_HOME=%{java_home}
+[ -z "$JAVA_HOME" ] && export JAVA_HOME=%{_jvmdir}/java
 
 # Enable compiler optimizations
 export BUILD_OPT=1
@@ -274,236 +108,118 @@ export CFLAGS
 # Check if we're in FIPS mode
 modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENABLED=1
 
-# build Java code, run Java tests, and build Javadoc with Maven
-%mvn_build %{!?with_tests:-f} %{!?with_javadoc:-j}
+# The Makefile is not thread-safe
+rm -rf build && mkdir -p build && cd build
+%cmake \
+    -DJAVA_HOME=%{java_home} \
+    -DJAVA_LIB_INSTALL_DIR=%{_jnidir} \
+    ..
 
-# create links to Maven-built classes for CMake
-mkdir -p %{_vpath_builddir}/classes/jss
-ln -sf ../../../base/target/classes/org %{_vpath_builddir}/classes/jss
-%if %{with tests}
-mkdir -p %{_vpath_builddir}/classes/tests
-ln -sf ../../../base/target/test-classes/org %{_vpath_builddir}/classes/tests
-%endif
-
-# create links to Maven-built JAR files for CMake
-ln -sf ../base/target/jss.jar %{_vpath_builddir}
-%if %{with tests}
-ln -sf ../base/target/jss-tests.jar %{_vpath_builddir}
-%endif
-
-# create links to Maven-built headers for CMake
-mkdir -p %{_vpath_builddir}/include/jss
-ln -sf ../../../base/target/include/_jni %{_vpath_builddir}/include/jss/_jni
-
-# mark Maven-built targets so that CMake will not rebuild them
-mkdir -p %{_vpath_builddir}/.targets
-touch %{_vpath_builddir}/.targets/finished_generate_java
-%if %{with tests}
-touch %{_vpath_builddir}/.targets/finished_tests_generate_java
-%endif
-%if %{with javadoc}
-touch %{_vpath_builddir}/.targets/finished_generate_javadocs
-%endif
-
-# build native code and run native tests with CMake
-./build.sh \
-    %{?_verbose:-v} \
-    --work-dir=%{_vpath_builddir} \
-    --prefix-dir=%{_prefix} \
-    --include-dir=%{_includedir} \
-    --lib-dir=%{_libdir} \
-    --sysconf-dir=%{_sysconfdir} \
-    --share-dir=%{_datadir} \
-    --cmake="%{__cmake} %{?enable_nss_version_pqc_def_flag}" \
-    --java-home=%{java_home} \
-    --jni-dir=%{_jnidir} \
-    --version=%{version} \
-    --without-java \
-    --without-javadoc \
-    %{!?with_tests:--without-tests} \
-    dist
+%{__make} all
+%{__make} javadoc || true
+ctest --output-on-failure
 
 ################################################################################
 %install
+
+# There is no install target so we'll do it by hand
+
+# jars
+install -d -m 0755 $RPM_BUILD_ROOT%{_jnidir}
+install -m 644 build/jss4.jar ${RPM_BUILD_ROOT}%{_jnidir}/jss4.jar
+
+# We have to use the name libjss4.so because this is dynamically
+# loaded by the jar file.
+install -d -m 0755 $RPM_BUILD_ROOT%{_libdir}/jss
+install -m 0755 build/libjss4.so ${RPM_BUILD_ROOT}%{_libdir}/jss/
+pushd  ${RPM_BUILD_ROOT}%{_libdir}/jss
+    ln -fs %{_jnidir}/jss4.jar jss4.jar
+popd
+
+# javadoc
+install -d -m 0755 $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version}
+cp -rp build/docs/* $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version}
+cp -p jss.html $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version}
+cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version}
+
+# No ldconfig is required since this library is loaded by Java itself.
 ################################################################################
+%files
 
-# install Java binaries and Javadoc
-%mvn_install
-
-# install jss.jar
-mkdir -p %{buildroot}%{_javadir}/jss
-cp base/target/jss.jar %{buildroot}%{_javadir}/jss/jss.jar
-
-# create links for backward compatibility
-mkdir -p %{buildroot}%{_jnidir}
-ln -sf ../../..%{_javadir}/jss/jss.jar %{buildroot}%{_jnidir}/jss.jar
-
-mkdir -p %{buildroot}%{_libdir}/jss
-ln -sf ../../..%{_javadir}/jss/jss.jar %{buildroot}%{_libdir}/jss/jss.jar
-
-# install native binaries
-./build.sh \
-    %{?_verbose:-v} \
-    --work-dir=%{_vpath_builddir} \
-    --install-dir=%{buildroot} \
-    --without-java \
-    install
-
-# install tests binaries
-%if %{with tests}
-mkdir -p %{buildroot}%{_datadir}/jss/tests/lib
-cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib
-%endif
+%defattr(-,root,root,-)
+%doc jss.html MPL-1.1.txt gpl.txt lgpl.txt
+%{_libdir}/*
+%{_jnidir}/*
 
 ################################################################################
-%files -n %{product_id} -f .mfiles
-################################################################################
+%files javadoc
 
-%doc jss.html
-%license MPL-1.1.txt gpl.txt lgpl.txt symkey/LICENSE
-%{_javadir}/jss/jss.jar
-%{_jnidir}/jss.jar
-%{_libdir}/jss/jss.jar
-%{_libdir}/jss/libjss.so
-%{_libdir}/jss/libjss-symkey.so
-
-################################################################################
-%files -n %{product_id}-tomcat -f .mfiles-jss-tomcat
-################################################################################
-
-################################################################################
-%files -n %{product_id}-tools
-################################################################################
-
-%{_bindir}/p12tool
-%{_bindir}/p7tool
-%{_bindir}/sslget
-
-%if %{with javadoc}
-################################################################################
-%files -n %{product_id}-javadoc -f .mfiles-javadoc
-################################################################################
-%endif
-
-%if %{with tests}
-################################################################################
-%files -n %{product_id}-tests
-################################################################################
-
-%{_datadir}/jss/tests/
-
-# with tests
-%endif
+%defattr(-,root,root,-)
+%{_javadocdir}/%{name}-%{version}/
 
 ################################################################################
 %changelog
-* Tue Nov 04 2025 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.8.0-1
-- Rebase to JSS 5.8.0-1
+* Mon Apr 27 2020 Dogtag PKI Team <pki-devel@redhat.com> - 4.6.4-1
+- Rebase to JSS 4.6.4
+- Fixes memory leak present since v4.6.2
 
-* Fri Aug 22 2025 Yaakov Selkowitz <yselkowi@redhat.com> - 5.8.0-0.6.beta4
-- Build with Java 25 for ELN
+* Wed Mar 04 2020 Dogtag PKI Team <pki-devel@redhat.com> - 4.6.2-4
+- Fix for PBE errors
 
-* Mon Aug 11 2025 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.8.0-0.5.beta4
-- Rebuild for Fedora 43
+* Tue Jan 28 2020 Dogtag PKI Team <pki-devel@redhat.com> - 4.6.2-3
+- Rebuild with new NSS to fix rhbz#1794814
 
-* Mon Aug 11 2025 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.8.0-0.4.beta4.1
-- Rebase to JSS 5.8.0-beta4
+* Tue Oct 29 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.6.2-2
+- Fix for rhbz#1766451
 
-* Mon Jul 28 2025 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.8.0-0.3.beta3.1
-- Rebase to JSS 5.8.0-beta3
+* Tue Oct 15 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.6.2-1
+- Rebase to JSS 4.6.2
+- Fixes CVE-2019-14823
 
-* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 5.8.0-0.1.beta1.1
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+* Thu Aug 08 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.6.1-2
+- Disable unnecessary tests to fix broken s390x
 
-* Wed Jul 09 2025 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.8.0.1
-- Rebase to JSS 5.8.0-beta1
+* Thu Aug 08 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.6.1-1
+- Rebase to JSS 4.6.1
 
-* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 5.6.0-0.1.alpha1.1
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+* Mon May 06 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.5.3-2
+- Add AIA OCSP certificate checking patch
 
-* Wed Nov 20 2024 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.6.0-1
-- Rebase to JSS 5.6.0-alpha1
+* Tue Mar 19 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.5.3-1
+- Rebase to JSS 4.5.3
 
-* Fri Oct 04 2024 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.5.1-1
-- Rebase to JSS 5.5.1
+* Fri Feb 01 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.5.2-3
+- Include nuxwdog patch for netscape.security.util.Utils from PKI
 
-* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 5.5.0-2.1
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 4.5.2-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
 
-* Thu Feb 29 2024 Adam Williamson <awilliam@redhat.com> - 5.5.0-2
-- Really build against java-21
+* Mon Jan 14 2019 Dogtag PKI Team <pki-devel@redhat.com> 4.5.2-1
+- Rebased to JSS 4.5.2
 
-* Tue Feb 27 2024 Jiri Vanek <jvanek@redhat.com> - 5.5.0-1.1
-- Rebuilt for java-21-openjdk as system jdk
+* Thu Nov 29 2018 Dogtag PKI Team <pki-devel@redhat.com> 4.5.1-1
+- Rebased to JSS 4.5.1
+- Red Hat Bugzilla #1582323 - DER encoding error for enumerated types with a value of zero
+- Red Hat Bugzilla #1534765 - javadoc for org.mozilla.jss.pkix.cms.SignedData.getSignerInfos() is incorrect
 
-* Wed Feb 21 2024 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.5.0-1
-- Rebase to JSS 5.5.0
+* Fri Aug 10 2018 Dogtag PKI Team <pki-devel@redhat.com> 4.5.0-1
+- Rebased to JSS 4.5.0
 
-* Thu Feb 08 2024 Yaakov Selkowitz <yselkowi@redhat.com> - 5.4.2-1.4
-- Fix compatibility with NSS 3.97
+* Tue Aug 07 2018 Dogtag PKI Team <pki-devel@redhat.com> 4.5.0-0.6
+- Rebased to JSS 4.5.0-b1
 
-* Wed Jan 24 2024 Fedora Release Engineering <releng@fedoraproject.org> - 5.4.2-1.3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+* Tue Aug 07 2018 Dogtag PKI Team <pki-devel@redhat.com> 4.5.0-0.5
+- Red Hat Bugzilla #1612063 - Do not override system crypto policy (support TLS 1.3)
 
-* Sat Jan 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 5.4.2-1.2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+* Fri Jul 20 2018 Dogtag PKI Team <pki-devel@redhat.com> 4.5.0-0.4
+- Rebased to JSS 4.5.0-a4
+- Red Hat Bugzilla #1604462 - jss: FTBFS in Fedora rawhide
 
-* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 5.4.2-1.1
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+* Thu Jul 05 2018 Dogtag PKI Team <pki-devel@redhat.com> 4.5.0-0.3
+- Rebased to JSS 4.5.0-a3
 
-* Fri Jun 16 2023 Packit <hello@packit.dev> - 5.4.2-1
-- Updating version to v5.4.2 (Chris Kelley)
-- Upstream spec file changes to reduce diffs (Chris Kelley)
-- Introduce Packit configuration for jss (Chris Kelley)
+* Fri Jun 22 2018 Dogtag PKI Team <pki-devel@redhat.com> 4.5.0-0.2
+- Rebased to JSS 4.5.0-a2
 
-* Tue Feb 07 2023 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.3.0-2
-- Update version number in JSSConfig.cmake
-
-* Tue Feb 07 2023 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.3.0-1
-- Rebase to JSS 5.3.0
-
-* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 5.2.0-1.2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
-
-* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 5.2.0-1.1
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
-
-* Wed Jun 29 2022 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.2.0-1
-- Rebase to JSS 5.2.0
-
-* Wed Apr 27 2022 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.2.0-0.3.beta2
-- Rebase to JSS 5.2.0-beta2
-- Rename packages to dogtag-jss
-
-* Mon Apr 11 2022 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.2.0-0.2.beta1
-- Rebase to JSS 5.2.0-beta1
-
-* Mon Feb 14 2022 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.1.0-1
-- Rebase to JSS 5.1.0
-
-* Sat Feb 05 2022 Jiri Vanek <jvanek@redhat.com> - 5.1.0-0.3.alpha2
-- Rebuilt for java-17-openjdk as system jdk
-
-* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 5.1.0-0.2.alpha2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
-
-* Fri Nov 26 2021 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.1.0-0.1.alpha2
-- Rebase to JSS 5.1.0-alpha2
-
-* Thu Sep 30 2021 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.0.0-1
-- Rebase to JSS 5.0.0
-
-* Wed Sep 29 2021 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.0.0-0.5.beta1
-- Drop BuildRequires and Requires on glassfish-jaxb-api
-
-* Fri Sep 03 2021 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.0.0-0.4.beta1
-- Rebase to JSS 5.0.0-beta1
-
-* Thu Aug 12 2021 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.0.0-0.3.alpha2
-- Rebase to JSS 5.0.0-alpha2
-
-* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 5.0.0-0.2.alpha1
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
-
-* Tue Jun 22 2021 Dogtag PKI Team <devel@lists.dogtagpki.org> - 5.0.0-0.1.alpha1
-- Rebase to JSS 5.0.0-alpha1
+* Fri Jun 15 2018 Dogtag PKI Team <pki-devel@redhat.com> 4.5.0-0.1
+- Rebased to JSS 4.5.0-a1

sources

@@ -1 +1 @@
-SHA512 (jss-5.8.0.tar.gz) = 10f5727d78f8b466062396e47c25b7fdac4b70c6862e6857f8aef49b633c43c4485c1d3cd535006ecd090e8dfe787000fb40d8748ed381c4ac4d1d39312e6c3d
+SHA512 (jss-4.6.4.tar.gz) = c0adc950e1ce5e0f3d846dcb158d831575be84176ded3eec7ce3569cfd96c872a2089a2eede249c5924e1eee58d88574accd3403623910343130cf90b504b348