Rebuilt for java-21-openjdk as system jdk

https://fedoraproject.org/wiki/Changes/Java21
2024-03-02 18:51:35 +01:00
4 changed files with 64 additions and 113 deletions
--- a/.gitignore
+++ b/.gitignore
@ -47,9 +47,3 @@ jss-4.2.6.tar.gz
 /jss-5.4.2.tar.gz
 /jss-5.5.0-alpha2.tar.gz
 /jss-5.5.0.tar.gz
-/jss-5.5.1.tar.gz
-/jss-5.6.0-alpha1.tar.gz
-/jss-5.8.0-beta1.tar.gz
-/jss-5.8.0-beta3.tar.gz
-/jss-5.8.0-beta4.tar.gz
-/jss-5.8.0.tar.gz
--- a/jss-5.4.2-nss-3.97.patch
+++ b/jss-5.4.2-nss-3.97.patch
@ -0,0 +1,40 @@
+From 130d543f3a7c33196bef386b4ee87ccc4ed53d0b Mon Sep 17 00:00:00 2001
+From: "Endi S. Dewata" <edewata@redhat.com>
+Date: Wed, 7 Feb 2024 14:59:31 -0600
+Subject: [PATCH] Update kea_alg_defs to match NSS 3.97
+
+The kea_alg_defs array in SSLCipher.c has been updated to match
+the one defined in NSS 3.97. The assertion that compares the size
+of the array with ssl_kea_size has also been removed. These
+changes will allow JSS to work with the newer NSS 3.97 on Fedora
+Rawhide as well as the older NSS versions on other platforms.
+
+Resolves: https://github.com/dogtagpki/jss/issues/991
+---
+ native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c b/native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c
+index 4f2dacb0b..ea739617a 100644
+--- a/native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c
+++ b/native/src/main/native/org/mozilla/jss/ssl/SSLCipher.c
+@@ -23,7 +23,7 @@ static const CK_MECHANISM_TYPE auth_alg_defs[] = {
+ };
+ PR_STATIC_ASSERT(PR_ARRAY_SIZE(auth_alg_defs) == ssl_auth_size);
+ 
+-/* Copied from NSS's ssl3con.c. */
+/* Copied from NSS 3.97's ssl3con.c. */
+ static const CK_MECHANISM_TYPE kea_alg_defs[] = {
+     CKM_INVALID_MECHANISM, /* ssl_kea_null */
+     CKM_RSA_PKCS,          /* ssl_kea_rsa */
+@@ -33,8 +33,9 @@ static const CK_MECHANISM_TYPE kea_alg_defs[] = {
+     CKM_ECDH1_DERIVE,      /* ssl_kea_ecdh_psk */
+     CKM_DH_PKCS_DERIVE,    /* ssl_kea_dh_psk */
+     CKM_INVALID_MECHANISM, /* ssl_kea_tls13_any */
+    CKM_INVALID_MECHANISM, /* ssl_kea_ecdh_hybrid */
+    CKM_INVALID_MECHANISM, /* ssl_kea_ecdh_hybrid_psk */
+ };
+-PR_STATIC_ASSERT(PR_ARRAY_SIZE(kea_alg_defs) == ssl_kea_size);
+ 
+ #ifdef HAVE_NSS_CIPHER_SUITE_INFO_KDFHASH
+ /* Not present in ssl3con.c. */
--- a/jss.spec
+++ b/jss.spec
@ -2,12 +2,11 @@
 Name:           jss
 ################################################################################

-%global         vendor_id dogtag
-%global         product_id %{vendor_id}-jss
+%global         product_id dogtag-jss

 # Upstream version number:
 %global         major_version 5
-%global         minor_version 8
+%global         minor_version 5
 %global         update_version 0

 # Downstream release number:
@ -21,18 +20,14 @@ Name:           jss
 # - GA/update (supported): <none>
 #global         phase

-%if 0%{?rhel} && 0%{?rhel} >= 10
-%global enable_nss_version_pqc_def_flag -DENABLE_NSS_VERSION_PQC_DEF=ON
-%endif
-
 %undefine       timestamp
 %undefine       commit_id

 Summary:        Java Security Services (JSS)
 URL:            https://github.com/dogtagpki/jss
-License:        (MPL-1.1 OR GPL-2.0-or-later OR LGPL-2.1-or-later) AND Apache-2.0
+License:        (MPL-1.1 or GPL-2.0-or-later or LGPL-2.1-or-later) and Apache-2.0
 Version:        %{major_version}.%{minor_version}.%{update_version}
-Release:        %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}
+Release:        %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}.1

 # To generate the source tarball:
 # $ git clone https://github.com/dogtagpki/jss.git
@ -60,26 +55,9 @@ ExcludeArch: i686
 # Java
 ################################################################################

-# use Java 17 on Fedora 39 or older and RHEL 9 or older
-# otherwise, use Java 21
-
-# maven-local is a subpackage of javapackages-tools
-
-%if 0%{?fedora} && 0%{?fedora} >= 43 || 0%{?rhel} >= 11
-
-%define java_devel java-25-openjdk-devel
-%define java_headless java-25-openjdk-headless
-%define java_home %{_jvmdir}/jre-25-openjdk
-%define maven_local maven-local-openjdk25
-
-%else
-
-%define java_devel java-21-openjdk-devel
-%define java_headless java-21-openjdk-headless
-%define java_home %{_jvmdir}/jre-21-openjdk
-%define maven_local maven-local
-
-%endif
+%define java_devel java-17-openjdk-devel
+%define java_headless java-17-openjdk-headless
+%define java_home %{_jvmdir}/jre-17-openjdk

 ################################################################################
 # Build Options
@ -105,11 +83,11 @@ BuildRequires:  zip
 BuildRequires:  unzip

 BuildRequires:  gcc-c++
-BuildRequires:  nss-devel >= 3.101
-BuildRequires:  nss-tools >= 3.101
+BuildRequires:  nss-devel >= 3.66
+BuildRequires:  nss-tools >= 3.66

 BuildRequires:  %{java_devel}
-BuildRequires:  %{maven_local}
+BuildRequires:  maven-local
 BuildRequires:  mvn(org.apache.commons:commons-lang3)
 BuildRequires:  mvn(org.slf4j:slf4j-api)
 BuildRequires:  mvn(org.slf4j:slf4j-jdk14)
@ -125,7 +103,7 @@ This only works with gcj. Other JREs require that JCE providers be signed.

 Summary:        Java Security Services (JSS)

-Requires:       nss >= 3.101
+Requires:       nss >= 3.66

 Requires:       %{java_headless}
 Requires:       mvn(org.apache.commons:commons-lang3)
@ -153,21 +131,21 @@ This only works with gcj. Other JREs require that JCE providers be signed.
 Summary:        Java Security Services (JSS) Connector for Tomcat

 # Tomcat
-BuildRequires:  mvn(org.apache.tomcat:tomcat-catalina) >= 10.1.36
-BuildRequires:  mvn(org.apache.tomcat:tomcat-coyote) >= 10.1.36
-BuildRequires:  mvn(org.apache.tomcat:tomcat-juli) >= 10.1.36
+BuildRequires:  mvn(org.apache.tomcat:tomcat-catalina) >= 9.0.62
+BuildRequires:  mvn(org.apache.tomcat:tomcat-coyote) >= 9.0.62
+BuildRequires:  mvn(org.apache.tomcat:tomcat-juli) >= 9.0.62

 Requires:       %{product_id} = %{version}-%{release}
-Requires:       mvn(org.apache.tomcat:tomcat-catalina) >= 10.1.36
-Requires:       mvn(org.apache.tomcat:tomcat-coyote) >= 10.1.36 
-Requires:       mvn(org.apache.tomcat:tomcat-juli) >= 10.1.36
+Requires:       mvn(org.apache.tomcat:tomcat-catalina) >= 9.0.62
+Requires:       mvn(org.apache.tomcat:tomcat-coyote) >= 9.0.62
+Requires:       mvn(org.apache.tomcat:tomcat-juli) >= 9.0.62

 # Tomcat JSS has been replaced with JSS Connector for Tomcat.
 # This will remove installed Tomcat JSS packages.
 Obsoletes:      tomcatjss <= 8.5
 Conflicts:      tomcatjss <= 8.5
-Obsoletes:      %{vendor_id}-tomcatjss <= 8.5
-Conflicts:      %{vendor_id}-tomcatjss <= 8.5
+Obsoletes:      dogtag-tomcatjss <= 8.5
+Conflicts:      dogtag-tomcatjss <= 8.5

 %if 0%{?rhel} <= 8
 # PKI Servlet Engine has been replaced with Tomcat.
@ -181,23 +159,6 @@ JSS Connector for Tomcat is a Java Secure Socket Extension (JSSE)
 module for Apache Tomcat that uses Java Security Services (JSS),
 a Java interface to Network Security Services (NSS).

-################################################################################
-%package -n %{product_id}-tools
-################################################################################
-
-Summary:        Java Security Services (JSS) Tools
-
-Provides:       jss-tools = %{version}-%{release}
-Provides:       jss-tools = %{major_version}.%{minor_version}
-Provides:       %{product_id}-tools = %{major_version}.%{minor_version}
-
-# Some PKI tools have been moved into jss-tools.
-Conflicts:      pki-tools < 11.6
-Conflicts:      %{vendor_id}-pki-tools < 11.6
-
-%description -n %{product_id}-tools
-This package contains JSS tools.
-
 %if %{with javadoc}
 ################################################################################
 %package -n %{product_id}-javadoc
@ -248,11 +209,11 @@ This package provides test suite for JSS.

 # specify Maven artifact locations
 %mvn_file org.dogtagpki.jss:jss-tomcat         jss/jss-tomcat
-%mvn_file org.dogtagpki.jss:jss-tomcat-10.1     jss/jss-tomcat-10.1
+%mvn_file org.dogtagpki.jss:jss-tomcat-9.0     jss/jss-tomcat-9.0

 # specify Maven artifact packages
 %mvn_package org.dogtagpki.jss:jss-tomcat      jss-tomcat
-%mvn_package org.dogtagpki.jss:jss-tomcat-10.1  jss-tomcat
+%mvn_package org.dogtagpki.jss:jss-tomcat-9.0  jss-tomcat

 ################################################################################
 %build
@ -314,7 +275,7 @@ touch %{_vpath_builddir}/.targets/finished_generate_javadocs
    --lib-dir=%{_libdir} \
    --sysconf-dir=%{_sysconfdir} \
    --share-dir=%{_datadir} \
-    --cmake="%{__cmake} %{?enable_nss_version_pqc_def_flag}" \
+    --cmake=%{__cmake} \
    --java-home=%{java_home} \
    --jni-dir=%{_jnidir} \
    --version=%{version} \
@ -371,14 +332,6 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib
 %files -n %{product_id}-tomcat -f .mfiles-jss-tomcat
 ################################################################################

-################################################################################
-%files -n %{product_id}-tools
-################################################################################
-
-%{_bindir}/p12tool
-%{_bindir}/p7tool
-%{_bindir}/sslget
-
 %if %{with javadoc}
 ################################################################################
 %files -n %{product_id}-javadoc -f .mfiles-javadoc
@ -397,43 +350,7 @@ cp base/target/jss-tests.jar %{buildroot}%{_datadir}/jss/tests/lib

 ################################################################################
 %changelog
-* Tue Nov 04 2025 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.8.0-1
- Rebase to JSS 5.8.0-1
-
-* Fri Aug 22 2025 Yaakov Selkowitz <yselkowi@redhat.com> - 5.8.0-0.6.beta4
- Build with Java 25 for ELN
-
-* Mon Aug 11 2025 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.8.0-0.5.beta4
- Rebuild for Fedora 43
-
-* Mon Aug 11 2025 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.8.0-0.4.beta4.1
- Rebase to JSS 5.8.0-beta4
-
-* Mon Jul 28 2025 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.8.0-0.3.beta3.1
- Rebase to JSS 5.8.0-beta3
-
-* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 5.8.0-0.1.beta1.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Wed Jul 09 2025 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.8.0.1
- Rebase to JSS 5.8.0-beta1
-
-* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 5.6.0-0.1.alpha1.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
-
-* Wed Nov 20 2024 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.6.0-1
- Rebase to JSS 5.6.0-alpha1
-
-* Fri Oct 04 2024 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.5.1-1
- Rebase to JSS 5.5.1
-
-* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 5.5.0-2.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
-
-* Thu Feb 29 2024 Adam Williamson <awilliam@redhat.com> - 5.5.0-2
- Really build against java-21
-
-* Tue Feb 27 2024 Jiri Vanek <jvanek@redhat.com> - 5.5.0-1.1
+* Sat Mar 02 2024 Jiri Vanek <jvanek@redhat.com> - 5.5.0-1.1
 - Rebuilt for java-21-openjdk as system jdk

 * Wed Feb 21 2024 Dogtag PKI Team <devel@lists.dogtagpki.org> 5.5.0-1
--- a/2
+++ b/2
@ -1 +1 @@
-SHA512 (jss-5.8.0.tar.gz) = 10f5727d78f8b466062396e47c25b7fdac4b70c6862e6857f8aef49b633c43c4485c1d3cd535006ecd090e8dfe787000fb40d8748ed381c4ac4d1d39312e6c3d
+SHA512 (jss-5.5.0.tar.gz) = bda0b4df1ef08a264525c9124a29f57945e3a24adadda609b54032d840a1c311d522e34f29bb2246d03d493d108d425a64e4826edcc8a296a2f55b1cdd8a95c0