From 1dda6d788777056836eb40f46882cb06fd594ae2 Mon Sep 17 00:00:00 2001 From: Bob Relyea Date: Wed, 11 Aug 2021 09:31:27 -0700 Subject: [PATCH 01/12] Update f35 to the same rebase and lto as f36. We have to use release 2 here because release 1 is taked f36, but has f35 in the dist name. --- .gitignore | 2 ++ nss.spec | 18 ++++++++++++------ sources | 4 ++-- 3 files changed, 16 insertions(+), 8 deletions(-) diff --git a/.gitignore b/.gitignore index 2911bbd..96a8369 100644 --- a/.gitignore +++ b/.gitignore @@ -64,3 +64,5 @@ TestUser51.cert /nss-3.65.tar.gz /nss-3.67.tar.gz /nspr-4.31.tar.gz +/nss-3.69.tar.gz +/nspr-4.32.tar.gz diff --git a/nss.spec b/nss.spec index e7834f9..e5f1d86 100644 --- a/nss.spec +++ b/nss.spec @@ -1,11 +1,11 @@ -%global nspr_version 4.31.0 -%global nss_version 3.67.0 +%global nspr_version 4.32.0 +%global nss_version 3.69.0 # NOTE: To avoid NVR clashes of nspr* packages: # - reset %%{nspr_release} to 1, when updating %%{nspr_version} # - increment %%{nspr_version}, when updating the NSS part only -%global baserelease 4 +%global baserelease 2 %global nss_release %baserelease -# use %global nspr_release %[%baserelease+n] to handle offsets when +# use "%%global nspr_release %%[%%baserelease+n]" to handle offsets when # release number between nss and nspr are different. %global nspr_release %baserelease # only need to update this as we added new @@ -130,7 +130,6 @@ Patch2: nss-539183.patch # but it doesn't hurt to keep it. Patch4: iquote.patch Patch12: nss-signtool-format.patch -Patch30: nss-fedora-btrf-sql-hack.patch # fedora disabled dbm by default Patch40: nss-no-dbm-man-page.patch @@ -353,7 +352,7 @@ popd # Build NSS # # This package fails its testsuite with LTO. Disable LTO for now -%global _lto_cflags %{nil} +#%global _lto_cflags %{nil} #export FREEBL_NO_DEPEND=1 @@ -1060,6 +1059,13 @@ update-crypto-policies &> /dev/null || : %changelog +* Tue Aug 10 2021 Bob Relyea - 3.69.0-2 +- turn on lto + +* Tue Aug 10 2021 Bob Relyea - 3.69.0-1 +- Update to 3.69 +- Update to NSPR 4.31 + * Tue Jul 27 2021 Bob Relyea - 3.67.0-4 - switch to baserelease so rpmdev-bumpspec will work next time diff --git a/sources b/sources index 1dae6c2..db9e33d 100644 --- a/sources +++ b/sources @@ -3,5 +3,5 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310 -SHA512 (nss-3.67.tar.gz) = 1d3fa3fafbf3e54c9c3b54b0b3c291aebb48542380a1b704fa07359d3cefab93f166b31928c9db190ed58118e289e67ce8aa1619e4219d69b2c098484a22bc9d -SHA512 (nspr-4.31.tar.gz) = 1f37d04721335288dd8a5cf700ead5a56cee73365e619f3da90f6067830b78a050a525950686bcdd14fcf61faffd1141ec46d4180a0dd10375f7e9fef6eac6ed +SHA512 (nss-3.69.tar.gz) = 9dd824b3e96aa5a032d5005cdf60a55efac23f69f3857cd1f4337f3ebad92fc2354bb05ed85f04a368e55306a46ebd17a91f7f432f1c191a96e99aecfa62cfdf +SHA512 (nspr-4.32.tar.gz) = da9b65b374783d20a2e589211b411816d899e296e91175d376e59df1919144c1808c155a234d6ceefdf7b8ae8f47cec98d92a5aa3150a579513251860e50dcb7 From b3faf795588f8e40f7cb147747422e0e48616322 Mon Sep 17 00:00:00 2001 From: Bob Relyea Date: Mon, 4 Oct 2021 10:30:04 -0700 Subject: [PATCH 02/12] Rebase to NSS 3.71: Network Security Services (NSS) 3.71 was released on 30 September 2021. The HG tag is NSS_3_71_RTM. This version of NSS requires NSPR 4.32 or newer. NSS 3.71 source distributions are available on ftp.mozilla.org for secure HTTPS download: Changes: - Bug 1717716 - Set nssckbi version number to 2.52. - Bug 1667000 - Respect server requirements of tlsfuzzer/test-tls13-signature-algorithms.py - Bug 1373716 - Import of PKCS#12 files with Camellia encryption is not supported - Bug 1717707 - Add HARICA Client ECC Root CA 2021. - Bug 1717707 - Add HARICA Client RSA Root CA 2021. - Bug 1717707 - Add HARICA TLS ECC Root CA 2021. - Bug 1717707 - Add HARICA TLS RSA Root CA 2021. - Bug 1728394 - Add TunTrust Root CA certificate to NSS. ------------------------------------- Network Security Services (NSS) 3.70 was released on 4 September 2021. The HG tag is NSS_3_70_RTM. This version of NSS requires NSPR 4.32 or newer. NSS 3.70 source distributions are available on ftp.mozilla.org for secure HTTPS download: Changes: - Documentation: release notes for NSS 3.70. - Documentation: release notes for NSS 3.69.1. - Bug 1726022 - Update test case to verify fix. - Bug 1714579 - Explicitly disable downgrade check in TlsConnectStreamTls13.EchOuterWith12Max - Bug 1714579 - Explicitly disable downgrade check in TlsConnectTest.DisableFalseStartOnFallback - Formatting for lib/util - Bug 1681975 - Avoid using a lookup table in nssb64d. - Bug 1724629 - Use HW accelerated SHA2 on AArch64 Big Endian. - Bug 1714579 - Change default value of enableHelloDowngradeCheck to true. - Formatting for gtests/pk11_gtest/pk11_hpke_unittest.cc - Bug 1726022 - Cache additional PBE entries. - Bug 1709750 - Read HPKE vectors from official JSON. - Documentation: update for NSS 3.69 release. --- .gitignore | 1 + nss.spec | 6 +++--- sources | 2 +- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 96a8369..b844aa4 100644 --- a/.gitignore +++ b/.gitignore @@ -66,3 +66,4 @@ TestUser51.cert /nspr-4.31.tar.gz /nss-3.69.tar.gz /nspr-4.32.tar.gz +/nss-3.71.tar.gz diff --git a/nss.spec b/nss.spec index e5f1d86..bd0fb02 100644 --- a/nss.spec +++ b/nss.spec @@ -1,13 +1,13 @@ %global nspr_version 4.32.0 -%global nss_version 3.69.0 +%global nss_version 3.71.0 # NOTE: To avoid NVR clashes of nspr* packages: # - reset %%{nspr_release} to 1, when updating %%{nspr_version} # - increment %%{nspr_version}, when updating the NSS part only -%global baserelease 2 +%global baserelease 1 %global nss_release %baserelease # use "%%global nspr_release %%[%%baserelease+n]" to handle offsets when # release number between nss and nspr are different. -%global nspr_release %baserelease +%global nspr_release %[%baserelease+2] # only need to update this as we added new # algorithms under nss policy control %global crypto_policies_version 20210118 diff --git a/sources b/sources index db9e33d..6e0c873 100644 --- a/sources +++ b/sources @@ -3,5 +3,5 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310 -SHA512 (nss-3.69.tar.gz) = 9dd824b3e96aa5a032d5005cdf60a55efac23f69f3857cd1f4337f3ebad92fc2354bb05ed85f04a368e55306a46ebd17a91f7f432f1c191a96e99aecfa62cfdf +SHA512 (nss-3.71.tar.gz) = a4a724dc4e8677965b6245ea2309790d31ec7719658e2b349eb67c9008082132c76277340d15e4fdd8d2fe1f560ae6803fb038d023c3dfd2e3772fa3b77720e2 SHA512 (nspr-4.32.tar.gz) = da9b65b374783d20a2e589211b411816d899e296e91175d376e59df1919144c1808c155a234d6ceefdf7b8ae8f47cec98d92a5aa3150a579513251860e50dcb7 From ef32ba0f58d73e073e0c2447c291f83d973a427e Mon Sep 17 00:00:00 2001 From: Bob Relyea Date: Mon, 4 Oct 2021 10:38:52 -0700 Subject: [PATCH 03/12] Sigh, update change log for NSS Update --- nss.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/nss.spec b/nss.spec index bd0fb02..e373644 100644 --- a/nss.spec +++ b/nss.spec @@ -1059,6 +1059,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Mon Oct 4 2021 Bob Relyea - 3.71.0-1 +- Update to 3.71 + * Tue Aug 10 2021 Bob Relyea - 3.69.0-2 - turn on lto From b6a319dd919930807aec5831be58ad737a2685ed Mon Sep 17 00:00:00 2001 From: Bob Relyea Date: Wed, 1 Dec 2021 11:34:42 -0800 Subject: [PATCH 04/12] Resolves: rhbz#2028186 Update to nss 3.73 Fixes cve-2021-43527 --- .gitignore | 1 + nss.spec | 6 +++++- sources | 2 +- 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index b844aa4..60d4d3e 100644 --- a/.gitignore +++ b/.gitignore @@ -67,3 +67,4 @@ TestUser51.cert /nss-3.69.tar.gz /nspr-4.32.tar.gz /nss-3.71.tar.gz +/nss-3.73.tar.gz diff --git a/nss.spec b/nss.spec index e373644..9e01d68 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ %global nspr_version 4.32.0 -%global nss_version 3.71.0 +%global nss_version 3.73.0 # NOTE: To avoid NVR clashes of nspr* packages: # - reset %%{nspr_release} to 1, when updating %%{nspr_version} # - increment %%{nspr_version}, when updating the NSS part only @@ -1059,6 +1059,10 @@ update-crypto-policies &> /dev/null || : %changelog +* Wed Dec 1 2021 Bob Relyea - 3.73.0-1 +- Update to 3.73 +- includes CVE 2021-43527 + * Mon Oct 4 2021 Bob Relyea - 3.71.0-1 - Update to 3.71 diff --git a/sources b/sources index 6e0c873..b87949a 100644 --- a/sources +++ b/sources @@ -3,5 +3,5 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310 -SHA512 (nss-3.71.tar.gz) = a4a724dc4e8677965b6245ea2309790d31ec7719658e2b349eb67c9008082132c76277340d15e4fdd8d2fe1f560ae6803fb038d023c3dfd2e3772fa3b77720e2 +SHA512 (nss-3.73.tar.gz) = 84b6e4ce8838f77674a5587cd227fa103c80f1b36c8bfb9b60a175157f131e59153c79ee77b29feffa57f49b217a90a8a091ee368eb0bc03312894e386a4c01b SHA512 (nspr-4.32.tar.gz) = da9b65b374783d20a2e589211b411816d899e296e91175d376e59df1919144c1808c155a234d6ceefdf7b8ae8f47cec98d92a5aa3150a579513251860e50dcb7 From 356831eb64fbea4ab8e9dbb921b1aa19f91f097b Mon Sep 17 00:00:00 2001 From: Bob Relyea Date: Wed, 1 Dec 2021 19:32:26 -0800 Subject: [PATCH 05/12] Sigh, bump nspr release number --- nss.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nss.spec b/nss.spec index 9e01d68..8cd76cf 100644 --- a/nss.spec +++ b/nss.spec @@ -7,7 +7,7 @@ %global nss_release %baserelease # use "%%global nspr_release %%[%%baserelease+n]" to handle offsets when # release number between nss and nspr are different. -%global nspr_release %[%baserelease+2] +%global nspr_release %[%baserelease+3] # only need to update this as we added new # algorithms under nss policy control %global crypto_policies_version 20210118 From 275a8ac0ed27d2b079f75b28e9b7d1b96168982b Mon Sep 17 00:00:00 2001 From: Bob Relyea Date: Mon, 7 Feb 2022 09:36:14 -0800 Subject: [PATCH 06/12] Rebase to NSS 3.75 --- .gitignore | 1 + nss-fix-PayPal-upstream.patch | 42 +++++++++++++++++++++++++++++++++++ nss.spec | 10 +++++++-- sources | 2 +- 4 files changed, 52 insertions(+), 3 deletions(-) create mode 100644 nss-fix-PayPal-upstream.patch diff --git a/.gitignore b/.gitignore index 60d4d3e..086a490 100644 --- a/.gitignore +++ b/.gitignore @@ -68,3 +68,4 @@ TestUser51.cert /nspr-4.32.tar.gz /nss-3.71.tar.gz /nss-3.73.tar.gz +/nss-3.75.tar.gz diff --git a/nss-fix-PayPal-upstream.patch b/nss-fix-PayPal-upstream.patch new file mode 100644 index 0000000..71e78cb --- /dev/null +++ b/nss-fix-PayPal-upstream.patch @@ -0,0 +1,42 @@ +diff --git a/tests/chains/chains.sh b/tests/chains/chains.sh +--- a/tests/chains/chains.sh ++++ b/tests/chains/chains.sh +@@ -917,7 +917,7 @@ + done + + VFY_OPTS_TNAME="${DB_OPT} ${ENGINE} ${TRUST_AND_DB_OPT} ${REV_OPTS} ${FETCH_OPT} ${USAGE_OPT} ${POLICY_OPT} ${TRUST_OPT}" +- VFY_OPTS_ALL="${DB_OPT} ${ENGINE} -vv ${TRUST_AND_DB_OPT} ${REV_OPTS} ${FETCH_OPT} ${USAGE_OPT} ${POLICY_OPT} ${VFY_CERTS} ${TRUST_OPT}" ++ VFY_OPTS_ALL="${DB_OPT} ${ENGINE} -vv ${VFY_TIME_OPT} ${TRUST_AND_DB_OPT} ${REV_OPTS} ${FETCH_OPT} ${USAGE_OPT} ${POLICY_OPT} ${VFY_CERTS} ${TRUST_OPT}" + + TESTNAME="Verifying certificate(s) ${VFY_LIST} with flags ${VFY_OPTS_TNAME}" + echo "${SCRIPTNAME}: ${TESTNAME}" +@@ -1118,6 +1118,7 @@ + ;; + "verify") + VERIFY="${VALUE}" ++ VFY_TIME_OPT= + TRUST= + TRUST_AND_DB= + POLICY= +@@ -1126,6 +1127,9 @@ + REV_OPTS= + USAGE_OPT= + ;; ++ "at_time") ++ VFY_TIME_OPT="-b ${VALUE}" ++ ;; + "cert") + VERIFY="${VERIFY} ${VALUE}" + ;; +diff --git a/tests/chains/scenarios/realcerts.cfg b/tests/chains/scenarios/realcerts.cfg +--- a/tests/chains/scenarios/realcerts.cfg ++++ b/tests/chains/scenarios/realcerts.cfg +@@ -22,6 +22,7 @@ + + verify PayPalEE:x + policy OID.2.16.840.1.114412.2.1 ++ at_time 2201010000Z + result pass + + verify BrAirWaysBadSig:x + diff --git a/nss.spec b/nss.spec index 8cd76cf..84d2c44 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ %global nspr_version 4.32.0 -%global nss_version 3.73.0 +%global nss_version 3.75.0 # NOTE: To avoid NVR clashes of nspr* packages: # - reset %%{nspr_release} to 1, when updating %%{nspr_version} # - increment %%{nspr_version}, when updating the NSS part only @@ -7,7 +7,7 @@ %global nss_release %baserelease # use "%%global nspr_release %%[%%baserelease+n]" to handle offsets when # release number between nss and nspr are different. -%global nspr_release %[%baserelease+3] +%global nspr_release %[%baserelease+4] # only need to update this as we added new # algorithms under nss policy control %global crypto_policies_version 20210118 @@ -132,6 +132,8 @@ Patch4: iquote.patch Patch12: nss-signtool-format.patch # fedora disabled dbm by default Patch40: nss-no-dbm-man-page.patch +# fix PayPal issue +Patch45: nss-fix-PayPal-upstream.patch Patch100: nspr-config-pc.patch Patch101: nspr-gcc-atomics.patch @@ -1059,6 +1061,10 @@ update-crypto-policies &> /dev/null || : %changelog +* Mon Feb 7 2022 Bob Relyea - 3.75.0-1 +- Update to 3.75 +- fix PayPal expiration issue + * Wed Dec 1 2021 Bob Relyea - 3.73.0-1 - Update to 3.73 - includes CVE 2021-43527 diff --git a/sources b/sources index b87949a..9f55f36 100644 --- a/sources +++ b/sources @@ -3,5 +3,5 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310 -SHA512 (nss-3.73.tar.gz) = 84b6e4ce8838f77674a5587cd227fa103c80f1b36c8bfb9b60a175157f131e59153c79ee77b29feffa57f49b217a90a8a091ee368eb0bc03312894e386a4c01b +SHA512 (nss-3.75.tar.gz) = 0ad42f663b48649d7d16dc8b8956d2971a9566c0f7f655dd0609b94877f400977e5ad693f2eb44e1e277e55d1669294f07b3ba7a32573d3d72837b3944adf86d SHA512 (nspr-4.32.tar.gz) = da9b65b374783d20a2e589211b411816d899e296e91175d376e59df1919144c1808c155a234d6ceefdf7b8ae8f47cec98d92a5aa3150a579513251860e50dcb7 From 63895ffc28e17f3ac2e30b6148af895996e0bd48 Mon Sep 17 00:00:00 2001 From: Bob Relyea Date: Tue, 5 Apr 2022 09:25:58 -0700 Subject: [PATCH 07/12] Update to NSS 3.77 --- .gitignore | 1 + nss.spec | 9 +++++---- sources | 2 +- 3 files changed, 7 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 086a490..1f2ca20 100644 --- a/.gitignore +++ b/.gitignore @@ -69,3 +69,4 @@ TestUser51.cert /nss-3.71.tar.gz /nss-3.73.tar.gz /nss-3.75.tar.gz +/nss-3.77.tar.gz diff --git a/nss.spec b/nss.spec index 84d2c44..f5604d2 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ %global nspr_version 4.32.0 -%global nss_version 3.75.0 +%global nss_version 3.77.0 # NOTE: To avoid NVR clashes of nspr* packages: # - reset %%{nspr_release} to 1, when updating %%{nspr_version} # - increment %%{nspr_version}, when updating the NSS part only @@ -7,7 +7,7 @@ %global nss_release %baserelease # use "%%global nspr_release %%[%%baserelease+n]" to handle offsets when # release number between nss and nspr are different. -%global nspr_release %[%baserelease+4] +%global nspr_release %[%baserelease+5] # only need to update this as we added new # algorithms under nss policy control %global crypto_policies_version 20210118 @@ -132,8 +132,6 @@ Patch4: iquote.patch Patch12: nss-signtool-format.patch # fedora disabled dbm by default Patch40: nss-no-dbm-man-page.patch -# fix PayPal issue -Patch45: nss-fix-PayPal-upstream.patch Patch100: nspr-config-pc.patch Patch101: nspr-gcc-atomics.patch @@ -1061,6 +1059,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Tue Apr 5 2022 Bob Relyea - 3.75.0-1 +- Update to 3.77 + * Mon Feb 7 2022 Bob Relyea - 3.75.0-1 - Update to 3.75 - fix PayPal expiration issue diff --git a/sources b/sources index 9f55f36..f740f31 100644 --- a/sources +++ b/sources @@ -3,5 +3,5 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310 -SHA512 (nss-3.75.tar.gz) = 0ad42f663b48649d7d16dc8b8956d2971a9566c0f7f655dd0609b94877f400977e5ad693f2eb44e1e277e55d1669294f07b3ba7a32573d3d72837b3944adf86d SHA512 (nspr-4.32.tar.gz) = da9b65b374783d20a2e589211b411816d899e296e91175d376e59df1919144c1808c155a234d6ceefdf7b8ae8f47cec98d92a5aa3150a579513251860e50dcb7 +SHA512 (nss-3.77.tar.gz) = bd62eeb8f90ecd2d3999fd78fea6652736c02a6530f29e98d0cad0707f3b901b30409132eb6a6d53b9f5c05c6b464615a946a2a3e255553c793e44d0ed93179e From 624e780d59143cc3c5b91b5cfc3aa5e1255aa922 Mon Sep 17 00:00:00 2001 From: Bob Relyea Date: Tue, 31 May 2022 14:24:07 -0700 Subject: [PATCH 08/12] Rebase to NSS 3.79 Rebase to NSPR 4.34 --- .gitignore | 2 ++ nss.spec | 60 +++++++++++++++++++++++++++++++++++++++++------------- sources | 7 ++----- 3 files changed, 50 insertions(+), 19 deletions(-) diff --git a/.gitignore b/.gitignore index 1f2ca20..88af042 100644 --- a/.gitignore +++ b/.gitignore @@ -70,3 +70,5 @@ TestUser51.cert /nss-3.73.tar.gz /nss-3.75.tar.gz /nss-3.77.tar.gz +/nss-3.79.tar.gz +/nspr-4.34.tar.gz diff --git a/nss.spec b/nss.spec index f5604d2..abb3d79 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ -%global nspr_version 4.32.0 -%global nss_version 3.77.0 +%global nspr_version 4.34.0 +%global nss_version 3.79.0 # NOTE: To avoid NVR clashes of nspr* packages: # - reset %%{nspr_release} to 1, when updating %%{nspr_version} # - increment %%{nspr_version}, when updating the NSS part only @@ -7,7 +7,7 @@ %global nss_release %baserelease # use "%%global nspr_release %%[%%baserelease+n]" to handle offsets when # release number between nss and nspr are different. -%global nspr_release %[%baserelease+5] +%global nspr_release %baserelease # only need to update this as we added new # algorithms under nss policy control %global crypto_policies_version 20210118 @@ -115,8 +115,6 @@ Source28: nss-p11-kit.config Source100: nspr-%{nspr_archive_version}.tar.gz Source101: nspr-config.xml -# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=617723 -Patch2: nss-539183.patch # This patch uses the GCC -iquote option documented at # http://gcc.gnu.org/onlinedocs/gcc/Directory-Options.html#Directory-Options # to give the in-tree headers a higher priority over the system headers, @@ -394,6 +392,7 @@ export PKG_CONFIG_ALLOW_SYSTEM_LIBS=1 export PKG_CONFIG_ALLOW_SYSTEM_CFLAGS=1 export NSPR_INCLUDE_DIR=$PWD/dist/include/nspr +export NSPR_LIB_DIR=$PWD/dist/lib export NSS_USE_SYSTEM_SQLITE=1 @@ -418,6 +417,7 @@ export POLICY_FILE="nss.config" # location of the policy file export POLICY_PATH="/etc/crypto-policies/back-ends" + %{__make} -C ./nss all %{__make} -C ./nss latest @@ -561,6 +561,15 @@ export USE_64=1 # End -- copied from the build section +# copy the nspr libraries into the NSS object directory so we use the +# newly compiled nspr binaries in our test rather than the build root +# versions +export LOBJDIR=`make -s -C ./nss/tests/common objdir_name` +for i in ./dist/lib/*.so +do + cp $i ./dist/${LOBJDIR}/lib +done + # This is necessary because the test suite tests algorithms that are # disabled by the system policy. export NSS_IGNORE_SYSTEM_POLICY=1 @@ -584,9 +593,9 @@ if [ $SPACEISBAD -ne 0 ]; then echo "error: filenames containing space are not supported (xargs)" exit 1 fi -MYRAND=`perl -e 'print 9000 + int rand 1000'`; echo $MYRAND ||: -RANDSERV=selfserv_${MYRAND}; echo $RANDSERV ||: -DISTBINDIR=`ls -d ./dist/*.OBJ/bin`; echo $DISTBINDIR ||: +export MYRAND=`perl -e 'print 9000 + int rand 1000'`; echo $MYRAND +export RANDSERV=selfserv_${MYRAND}; echo $RANDSERV +export DISTBINDIR=./dist/${LOBJDIR}/bin pushd "$DISTBINDIR" ln -s selfserv $RANDSERV popd @@ -645,6 +654,25 @@ for f in nspr-config; do done popd +# Begin -- copied from the build section +# this is needed to make sure LOBJDIR is correct + +export FREEBL_NO_DEPEND=1 + +export BUILD_OPT=1 +export NSS_DISABLE_PPC_GHASH=1 + +%ifnarch noarch +%if 0%{__isa_bits} == 64 +export USE_64=1 +%endif +%endif + +# End -- copied from the build section + +# get the objdir value from the test make file +export LOBJDIR=`make -s -C ./nss/tests/common objdir_name` + # There is no make install target so we'll do it ourselves. mkdir -p $RPM_BUILD_ROOT/%{_includedir}/nss3 @@ -673,7 +701,7 @@ mkdir -p $RPM_BUILD_ROOT%{_mandir}/man5 # Copy the binary libraries we want for file in libnssutil3.so libsoftokn3.so %{?with_dbm:libnssdbm3.so} libfreebl3.so libfreeblpriv3.so libnss3.so libnsssysinit.so libsmime3.so libssl3.so do - install -p -m 755 dist/*.OBJ/lib/$file $RPM_BUILD_ROOT/%{_libdir} + install -p -m 755 dist/${LOBJDIR}/lib/$file $RPM_BUILD_ROOT/%{_libdir} done # Install the empty NSS db files @@ -692,19 +720,19 @@ install -p -m 644 %{SOURCE15} $RPM_BUILD_ROOT/%{_sysconfdir}/pki/nssdb/pkcs11.tx # Copy the development libraries we want for file in libcrmf.a libnssb.a libnssckfw.a do - install -p -m 644 dist/*.OBJ/lib/$file $RPM_BUILD_ROOT/%{_libdir} + install -p -m 644 dist/${LOBJDIR}/lib/$file $RPM_BUILD_ROOT/%{_libdir} done # Copy the binaries we want for file in certutil cmsutil crlutil modutil nss-policy-check pk12util signver ssltap do - install -p -m 755 dist/*.OBJ/bin/$file $RPM_BUILD_ROOT/%{_bindir} + install -p -m 755 dist/${LOBJDIR}/bin/$file $RPM_BUILD_ROOT/%{_bindir} done # Copy the binaries we ship as unsupported for file in bltest ecperf fbectest fipstest shlibsign atob btoa derdump listsuites ocspclnt pp selfserv signtool strsclnt symkeyutil tstclnt vfyserv vfychain do - install -p -m 755 dist/*.OBJ/bin/$file $RPM_BUILD_ROOT/%{unsupported_tools_directory} + install -p -m 755 dist/${LOBJDIR}/bin/$file $RPM_BUILD_ROOT/%{unsupported_tools_directory} done # Copy the include files we want @@ -722,7 +750,7 @@ done # Copy the static freebl library for file in libfreebl.a do -install -p -m 644 dist/*.OBJ/lib/$file $RPM_BUILD_ROOT/%{_libdir} +install -p -m 644 dist/${LOBJDIR}/lib/$file $RPM_BUILD_ROOT/%{_libdir} done # Copy the template files we want @@ -1059,7 +1087,11 @@ update-crypto-policies &> /dev/null || : %changelog -* Tue Apr 5 2022 Bob Relyea - 3.75.0-1 +* Tue May 31 2022 Bob Relyea - 3.79.0-1 +- Update to NSS 3.79 +- Update to NSPR 4.34 + +* Tue Apr 5 2022 Bob Relyea - 3.77.0-1 - Update to 3.77 * Mon Feb 7 2022 Bob Relyea - 3.75.0-1 diff --git a/sources b/sources index f740f31..a96c9b9 100644 --- a/sources +++ b/sources @@ -1,7 +1,4 @@ -SHA512 (blank-cert8.db) = ac131d15708c5f1b5e467831f919f4fc4ba13b60a4bb5fe260c845fa9afcd899a588d21ed52060abaa1bbb29f2b53af8b495d28407183cb03aff1974f95f1d3d SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403fda3e3d4e7757838061ae56ccf5aac335cb54f254f0a9e6e9c0dd5920b4155a39264525b06 -SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 -SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310 -SHA512 (nspr-4.32.tar.gz) = da9b65b374783d20a2e589211b411816d899e296e91175d376e59df1919144c1808c155a234d6ceefdf7b8ae8f47cec98d92a5aa3150a579513251860e50dcb7 -SHA512 (nss-3.77.tar.gz) = bd62eeb8f90ecd2d3999fd78fea6652736c02a6530f29e98d0cad0707f3b901b30409132eb6a6d53b9f5c05c6b464615a946a2a3e255553c793e44d0ed93179e +SHA512 (nspr-4.34.tar.gz) = 4cfac886c14cf7df4c4b79fa1c3bc92e1b14260c9c3018fa2562060d62fecb4e66c0b4e8f7edf4f4823def784a919d99dde88a89674f0cd8a644310b0569ead4 +SHA512 (nss-3.79.tar.gz) = d3311da3bd0e6907760390221c1307a63d84dd8ad9b85dbfdbf59fe4678341c9856b6f93235731999a1236c98dc0ac66d2dc023eb439cb696f73509dae70c41d From ebcf6b047ea2bf1d19ec9ed918f4b2e25d037766 Mon Sep 17 00:00:00 2001 From: Bob Relyea Date: Thu, 21 Jul 2022 12:39:13 -0700 Subject: [PATCH 09/12] Rebase to NSS 3.81 --- .gitignore | 1 + nss-3.79-fix-client-cert-crash.patch | 23 +++++++++++++++++++++++ nss.spec | 11 +++++++++-- sources | 2 +- 4 files changed, 34 insertions(+), 3 deletions(-) create mode 100644 nss-3.79-fix-client-cert-crash.patch diff --git a/.gitignore b/.gitignore index 88af042..e492b18 100644 --- a/.gitignore +++ b/.gitignore @@ -72,3 +72,4 @@ TestUser51.cert /nss-3.77.tar.gz /nss-3.79.tar.gz /nspr-4.34.tar.gz +/nss-3.81.tar.gz diff --git a/nss-3.79-fix-client-cert-crash.patch b/nss-3.79-fix-client-cert-crash.patch new file mode 100644 index 0000000..5f80fdc --- /dev/null +++ b/nss-3.79-fix-client-cert-crash.patch @@ -0,0 +1,23 @@ +diff --git a/lib/ssl/authcert.c b/lib/ssl/authcert.c +--- a/lib/ssl/authcert.c ++++ b/lib/ssl/authcert.c +@@ -212,17 +212,17 @@ NSS_GetClientAuthData(void *arg, + pw_arg); + } else { + int nnames = 0; + char **names = ssl_DistNamesToStrings(caNames, &nnames); + rv = CERT_FilterCertListByCANames(certList, nnames, names, + certUsageSSLClient); + ssl_FreeDistNamesStrings(names, nnames); + } +- if ((rv != SECSuccess) || CERT_LIST_EMPTY(certList)) { ++ if ((rv != SECSuccess) || (certList && CERT_LIST_EMPTY(certList))) { + CERT_DestroyCertList(certList); + certList = NULL; + } + } + if (certList == NULL) { + /* no user certs meeting the nickname/usage requirements found */ + return SECFailure; + } + diff --git a/nss.spec b/nss.spec index abb3d79..58f4218 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ %global nspr_version 4.34.0 -%global nss_version 3.79.0 +%global nss_version 3.81.0 # NOTE: To avoid NVR clashes of nspr* packages: # - reset %%{nspr_release} to 1, when updating %%{nspr_version} # - increment %%{nspr_version}, when updating the NSS part only @@ -7,7 +7,7 @@ %global nss_release %baserelease # use "%%global nspr_release %%[%%baserelease+n]" to handle offsets when # release number between nss and nspr are different. -%global nspr_release %baserelease +%global nspr_release [%baserelease+1] # only need to update this as we added new # algorithms under nss policy control %global crypto_policies_version 20210118 @@ -130,6 +130,9 @@ Patch4: iquote.patch Patch12: nss-signtool-format.patch # fedora disabled dbm by default Patch40: nss-no-dbm-man-page.patch + +# upstream bug https://bugzilla.mozilla.org/show_bug.cgi?id=1774654 +Patch50: nss-3.79-fix-client-cert-crash.patch Patch100: nspr-config-pc.patch Patch101: nspr-gcc-atomics.patch @@ -1087,6 +1090,10 @@ update-crypto-policies &> /dev/null || : %changelog +* Thu Jun 21 2022 Bob Relyea - 3.81.0-1 + - udpate to NSS 3.81 +- Fix crash when getting client cert and there is none in the database. + * Tue May 31 2022 Bob Relyea - 3.79.0-1 - Update to NSS 3.79 - Update to NSPR 4.34 diff --git a/sources b/sources index a96c9b9..8b30724 100644 --- a/sources +++ b/sources @@ -1,4 +1,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403fda3e3d4e7757838061ae56ccf5aac335cb54f254f0a9e6e9c0dd5920b4155a39264525b06 SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (nspr-4.34.tar.gz) = 4cfac886c14cf7df4c4b79fa1c3bc92e1b14260c9c3018fa2562060d62fecb4e66c0b4e8f7edf4f4823def784a919d99dde88a89674f0cd8a644310b0569ead4 -SHA512 (nss-3.79.tar.gz) = d3311da3bd0e6907760390221c1307a63d84dd8ad9b85dbfdbf59fe4678341c9856b6f93235731999a1236c98dc0ac66d2dc023eb439cb696f73509dae70c41d +SHA512 (nss-3.81.tar.gz) = 206faa29ff9fc9c70f85cbb86690b55bd11003a1a5b1d49f5f3731fdd1221690f957a17d912ee5272505afb938968327f4532ae8f5d2d77e6e13370768229747 From 790498e033490559d02210c567974f35f18d322c Mon Sep 17 00:00:00 2001 From: Bob Relyea Date: Thu, 21 Jul 2022 13:07:25 -0700 Subject: [PATCH 10/12] Fix release number syntax error --- nss.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nss.spec b/nss.spec index 58f4218..998fc64 100644 --- a/nss.spec +++ b/nss.spec @@ -7,7 +7,7 @@ %global nss_release %baserelease # use "%%global nspr_release %%[%%baserelease+n]" to handle offsets when # release number between nss and nspr are different. -%global nspr_release [%baserelease+1] +%global nspr_release %[%baserelease+1] # only need to update this as we added new # algorithms under nss policy control %global crypto_policies_version 20210118 From 6759788d7e5d84574d1bfb44e5eeac720e7a343b Mon Sep 17 00:00:00 2001 From: Bob Relyea Date: Wed, 21 Sep 2022 08:31:08 -0700 Subject: [PATCH 11/12] Rebase to nss 3.83 and nspr 4.35 --- .gitignore | 2 ++ nspr-gcc-atomics.patch | 42 ++++++++---------------------------------- nss.spec | 10 +++++++--- sources | 4 ++-- 4 files changed, 19 insertions(+), 39 deletions(-) diff --git a/.gitignore b/.gitignore index e492b18..2e32c54 100644 --- a/.gitignore +++ b/.gitignore @@ -73,3 +73,5 @@ TestUser51.cert /nss-3.79.tar.gz /nspr-4.34.tar.gz /nss-3.81.tar.gz +/nss-3.83.tar.gz +/nspr-4.35.tar.gz diff --git a/nspr-gcc-atomics.patch b/nspr-gcc-atomics.patch index b94e840..20eaefa 100644 --- a/nspr-gcc-atomics.patch +++ b/nspr-gcc-atomics.patch @@ -1,12 +1,7 @@ -diff --git a/pr/include/md/_linux.h b/pr/include/md/_linux.h ---- a/pr/include/md/_linux.h -+++ b/pr/include/md/_linux.h -@@ -82,53 +82,73 @@ - #define NO_DLOPEN_NULL - #endif - - #if defined(__FreeBSD_kernel__) || defined(__GNU__) - #define _PR_HAVE_SOCKADDR_LEN +diff -up ./pr/include/md/_linux.h.gcc-atomics ./pr/include/md/_linux.h +--- ./pr/include/md/_linux.h.gcc-atomics 2022-09-20 11:23:22.008942926 -0700 ++++ ./pr/include/md/_linux.h 2022-09-20 11:34:45.536751340 -0700 +@@ -105,6 +105,15 @@ #endif #if defined(__i386__) @@ -22,11 +17,7 @@ diff --git a/pr/include/md/_linux.h b/pr/include/md/_linux.h #define _PR_HAVE_ATOMIC_OPS #define _MD_INIT_ATOMIC() extern PRInt32 _PR_x86_AtomicIncrement(PRInt32 *val); - #define _MD_ATOMIC_INCREMENT _PR_x86_AtomicIncrement - extern PRInt32 _PR_x86_AtomicDecrement(PRInt32 *val); - #define _MD_ATOMIC_DECREMENT _PR_x86_AtomicDecrement - extern PRInt32 _PR_x86_AtomicAdd(PRInt32 *ptr, PRInt32 val); - #define _MD_ATOMIC_ADD _PR_x86_AtomicAdd +@@ -116,6 +125,7 @@ extern PRInt32 _PR_x86_AtomicAdd(PRInt32 extern PRInt32 _PR_x86_AtomicSet(PRInt32 *val, PRInt32 newval); #define _MD_ATOMIC_SET _PR_x86_AtomicSet #endif @@ -34,15 +25,7 @@ diff --git a/pr/include/md/_linux.h b/pr/include/md/_linux.h #if defined(__ia64__) #define _PR_HAVE_ATOMIC_OPS - #define _MD_INIT_ATOMIC() - extern PRInt32 _PR_ia64_AtomicIncrement(PRInt32 *val); - #define _MD_ATOMIC_INCREMENT _PR_ia64_AtomicIncrement - extern PRInt32 _PR_ia64_AtomicDecrement(PRInt32 *val); - #define _MD_ATOMIC_DECREMENT _PR_ia64_AtomicDecrement - extern PRInt32 _PR_ia64_AtomicAdd(PRInt32 *ptr, PRInt32 val); - #define _MD_ATOMIC_ADD _PR_ia64_AtomicAdd - extern PRInt32 _PR_ia64_AtomicSet(PRInt32 *val, PRInt32 newval); - #define _MD_ATOMIC_SET _PR_ia64_AtomicSet +@@ -131,6 +141,15 @@ extern PRInt32 _PR_ia64_AtomicSet(PRInt3 #endif #if defined(__x86_64__) @@ -58,20 +41,11 @@ diff --git a/pr/include/md/_linux.h b/pr/include/md/_linux.h #define _PR_HAVE_ATOMIC_OPS #define _MD_INIT_ATOMIC() extern PRInt32 _PR_x86_64_AtomicIncrement(PRInt32 *val); - #define _MD_ATOMIC_INCREMENT _PR_x86_64_AtomicIncrement - extern PRInt32 _PR_x86_64_AtomicDecrement(PRInt32 *val); - #define _MD_ATOMIC_DECREMENT _PR_x86_64_AtomicDecrement - extern PRInt32 _PR_x86_64_AtomicAdd(PRInt32 *ptr, PRInt32 val); - #define _MD_ATOMIC_ADD _PR_x86_64_AtomicAdd +@@ -142,6 +161,7 @@ extern PRInt32 _PR_x86_64_AtomicAdd(PRIn extern PRInt32 _PR_x86_64_AtomicSet(PRInt32 *val, PRInt32 newval); #define _MD_ATOMIC_SET _PR_x86_64_AtomicSet #endif +#endif - #if defined(__or1k__) + #if defined(__loongarch__) #if defined(__GNUC__) - /* Use GCC built-in functions */ - #define _PR_HAVE_ATOMIC_OPS - #define _MD_INIT_ATOMIC() - #define _MD_ATOMIC_INCREMENT(ptr) __sync_add_and_fetch(ptr, 1) - #define _MD_ATOMIC_DECREMENT(ptr) __sync_sub_and_fetch(ptr, 1) diff --git a/nss.spec b/nss.spec index 998fc64..b2e4f93 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ -%global nspr_version 4.34.0 -%global nss_version 3.81.0 +%global nspr_version 4.35.0 +%global nss_version 3.83.0 # NOTE: To avoid NVR clashes of nspr* packages: # - reset %%{nspr_release} to 1, when updating %%{nspr_version} # - increment %%{nspr_version}, when updating the NSS part only @@ -7,7 +7,7 @@ %global nss_release %baserelease # use "%%global nspr_release %%[%%baserelease+n]" to handle offsets when # release number between nss and nspr are different. -%global nspr_release %[%baserelease+1] +%global nspr_release %baserelease # only need to update this as we added new # algorithms under nss policy control %global crypto_policies_version 20210118 @@ -1090,6 +1090,10 @@ update-crypto-policies &> /dev/null || : %changelog +* Tue Sep 20 2022 Bob Relyea - 3.83.0-1 + - update to NSS 3.83 + - update to NSPR 4.35 + * Thu Jun 21 2022 Bob Relyea - 3.81.0-1 - udpate to NSS 3.81 - Fix crash when getting client cert and there is none in the database. diff --git a/sources b/sources index 8b30724..b36e034 100644 --- a/sources +++ b/sources @@ -1,4 +1,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403fda3e3d4e7757838061ae56ccf5aac335cb54f254f0a9e6e9c0dd5920b4155a39264525b06 SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 -SHA512 (nspr-4.34.tar.gz) = 4cfac886c14cf7df4c4b79fa1c3bc92e1b14260c9c3018fa2562060d62fecb4e66c0b4e8f7edf4f4823def784a919d99dde88a89674f0cd8a644310b0569ead4 -SHA512 (nss-3.81.tar.gz) = 206faa29ff9fc9c70f85cbb86690b55bd11003a1a5b1d49f5f3731fdd1221690f957a17d912ee5272505afb938968327f4532ae8f5d2d77e6e13370768229747 +SHA512 (nss-3.83.tar.gz) = 550cf1116e39e58041feaa67913f570d791e8153cc0522ba7ae02e27a61e0a4e6a25224be0f25d51a842dc11c70d600263450ebff0a9fdaa2840bafa3fc9ddd5 +SHA512 (nspr-4.35.tar.gz) = 502815833116e25f79ddf71d1526484908aa92fbc55f8a892729cb404a4daafcc0470a89854cd080d2d20299fdb7d9662507c5362c7ae661cbacf308ac56ef7f From 2c6df723fb131773eae873b1f63c135e279bbd44 Mon Sep 17 00:00:00 2001 From: Bob Relyea Date: Thu, 17 Nov 2022 16:31:19 -0800 Subject: [PATCH 12/12] Update NSS to 3.85 (rhbz#214318) --- .gitignore | 1 + nss.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 2e32c54..43c0bc2 100644 --- a/.gitignore +++ b/.gitignore @@ -75,3 +75,4 @@ TestUser51.cert /nss-3.81.tar.gz /nss-3.83.tar.gz /nspr-4.35.tar.gz +/nss-3.85.tar.gz diff --git a/nss.spec b/nss.spec index b2e4f93..87a4152 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ %global nspr_version 4.35.0 -%global nss_version 3.83.0 +%global nss_version 3.85.0 # NOTE: To avoid NVR clashes of nspr* packages: # - reset %%{nspr_release} to 1, when updating %%{nspr_version} # - increment %%{nspr_version}, when updating the NSS part only @@ -7,7 +7,7 @@ %global nss_release %baserelease # use "%%global nspr_release %%[%%baserelease+n]" to handle offsets when # release number between nss and nspr are different. -%global nspr_release %baserelease +%global nspr_release %[%baserelease+1] # only need to update this as we added new # algorithms under nss policy control %global crypto_policies_version 20210118 @@ -1090,6 +1090,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Thu Nov 17 2022 Bob Relyea - 3.85.0-1 + - update to NSS 3.85 + * Tue Sep 20 2022 Bob Relyea - 3.83.0-1 - update to NSS 3.83 - update to NSPR 4.35 diff --git a/sources b/sources index b36e034..c9d91e9 100644 --- a/sources +++ b/sources @@ -1,4 +1,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403fda3e3d4e7757838061ae56ccf5aac335cb54f254f0a9e6e9c0dd5920b4155a39264525b06 SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 -SHA512 (nss-3.83.tar.gz) = 550cf1116e39e58041feaa67913f570d791e8153cc0522ba7ae02e27a61e0a4e6a25224be0f25d51a842dc11c70d600263450ebff0a9fdaa2840bafa3fc9ddd5 +SHA512 (nss-3.85.tar.gz) = 97cfffa2beed1dba5d31e0c6e450553e5a8c78b427521640adb00c05d9d63cd64dc08388f0dbf96c93efb79f5daf4ba8db8d026b0b43d2e5c865a9b833fc77a1 SHA512 (nspr-4.35.tar.gz) = 502815833116e25f79ddf71d1526484908aa92fbc55f8a892729cb404a4daafcc0470a89854cd080d2d20299fdb7d9662507c5362c7ae661cbacf308ac56ef7f