From f3989dedc1923020e30910bba57192dbd23c8814 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Thu, 6 Dec 2018 10:14:48 +0100 Subject: [PATCH 01/19] Update to NSS 3.40.1 --- .gitignore | 1 + PayPalEE.cert | Bin 0 -> 2012 bytes PayPalICA.cert | Bin 0 -> 1210 bytes nss.spec | 7 +++++-- sources | 4 +--- 5 files changed, 7 insertions(+), 5 deletions(-) create mode 100644 PayPalEE.cert create mode 100644 PayPalICA.cert diff --git a/.gitignore b/.gitignore index 46aed9f..b0fa934 100644 --- a/.gitignore +++ b/.gitignore @@ -30,3 +30,4 @@ TestUser51.cert /nss-3.37.3.tar.gz /nss-3.38.0.tar.gz /nss-3.39.tar.gz +/nss-3.40.1.tar.gz diff --git a/PayPalEE.cert b/PayPalEE.cert new file mode 100644 index 0000000000000000000000000000000000000000..aef4086762a88dd5d7df06a7f4e23ea2f502c83c GIT binary patch literal 2012 zcma)6Yg7~07M?R11_%&{6C_fQu~4c!k~0w^qGEZ9P$&h#=PC@zG$bn~VG>9YY9%OI zy;{pdQ7b}=6?8#sMQ&N(^-)^-5Qj zK4`K38CvjDH9Qocs2f;)`R&Y(#5|9dEkQGn{B#w%;En;M@uj0K065tpFpqMAjyNwJ z!wED!jdF(s2l#|@j9R6RW>^!sRHvY3Ko8FBM7WvFW{Fa*QY#qNBvI(sQXx>r9r1|3 z7ZGXkkuoy&9TTHdGDBMy z#^F`4_$uWMU*ZzGI*U?Rbv|uk$TwIOty8bF=AsBF#GL|hfC0eMtPgsz;?o^VK`b!39x z$k+@hg)T^;wL#o`B$NnF<2;=Rr|6huGA++w(6c7W1G;lo9wFeyW}piUw3Zthw1Agw z7Xj=Lo&~rf&;t0V1puVGcKrH`ZI`yc*?BR0V+qlEX{4+CYr{G9N?u^|Hbj)tV&413 z!Y9P%8JED2bX|KYihq5N{pf>~E zgkU_}SRLFt@_uTwj6557S(B+9r}}pt+}U)l%ACFDtHa0RZ$$f@TzPs}_WJH?_=&>Q z95o&TXecnsStj%(p`gVn+^oZJI6GQFyJ*s*&}1ZgR~r3s-QM_Q|6u;<)-Y9 zJiYiAx1I=kwXtL3a7)t3LX-y(@QH;t4lTS9=!5gpy?rq;oW4P{=t9cD-kQdH4->NZ z%!OG$jg9rXLT}DNfKA6lZQ-};=O9%ZWd+^l`(SM*zd+Fniw|<=LacZ{EZ%GR%PuU_ za@0nXo-MH1kHy(E1u1Nii$ZP-MM@^0(drEhYio5j*dq5o*RRjkFbb2Ay9E}3Vy)4} z&3Zw-T>CRot-@oy!b<59>>ZD(?Kl^sgc#dQb~@)7yxHa zHiv@gUR*E6aH;gKf+3AgNrU#dovPRw09d?bG6n#w2(E*ElNf?h@pC?Uh0!pjGno3q z3oVVCWKDCLWSrtCozx^wk|q`DPeFR7N70cI1#5!N94~^KJ_@;)xE|+Q<)ya(#Zb%w zbeIKbKn`L?>RKIlHj7t?Hn$NUpH&(73qz~0$1h#`@`kxf@U6>LHv|DpcvEx{f?zx( z9>$@wkRSRg0w>q!lQu`F<(S<#^txR?-8y!HB?cR z-ur&fFV742SqsO(7?d&F^dUi+b?$0{AW8sl+`y=P#Uy-XH4=+}sWNufK zFlp@RoV&lBSMQiVq`C9i&5B#{vSqpqRnVaJ{(U4LY3sYz?z1)bczK2I?!#q;OTv~{ z@{gq6@!YvfDc>>k+@@z`V{)uzm%vz#??b~!^LLdT$S`z?62=~P%bwmvE?3T<+cx0U zGyX7f2}(|@A1$0?Too$QVh7@jh;^?r_r+DixgG4I2Wv)ek=eHT=w#JLfYjctey`I* zGFzJD6js@``ul28*gpn8_4W5zpt0{yPK*>jy*Dvhv7;y0KWf2)MRyvG3s!6%>RuL5 z`S1OE>SmM~e>-&h>W#(h<>j8T4;*G~Z=6@vvphnjbSwVX@{@v-Ra^EQ85X~rn?Ma7 z&3yT-%KCnEeaE{un|edhKJv=;?@D-4zC~GwlG5Sl{_Wd_k{h*Cpxww}CGWzDYT64L#;Huckn_>79!b6YiZ`;BBjRbg-4#6a^OkH6Gh z`5vzvcvN|FsNsoe{o?A0rhXr9-7h0Z$Hh-VP=8;~xU^T`(pBRYHCB{F>mTflRW#iOp^Jx3d%gD&h%3zRV z$Zf#M#vIDRCd?EXY$$3V4B~JJ^SETDXF8`Al_+@TB^yc_h=YW=g$2sX%k@$+(=(G( zi%Rs8^K%Wg4KzVg%)&}=9UhtK848ZY#id1wdC92?u3-v6`S~RZ&W;9h;=G2&h6YAP zhDHVk1_n{$yhavCT!T_dU1MTk1aXZv+%>@-jz$Wu6(y;8DXA$6VTn1JDTyVS`FRS# zsYPX}MIdK2F)AU43nME7a}y&!gFzD`7gG}>Bg6IJB`kqIW-b%+@J?4>HQDomvI#b-}jYQ9{k37p#6kAWT3z%#O>d=9hUR_VQHY4=K-}O=fIU#!lKmGOkGG-PvuXJ#)&p7O%ZAMfb^Pp1JQ1`X$wgA1IusbMNC%0S!rGCT2zk#>GvHo(4^f zt_DJE%%QTvjEw(TI1Jbr8UHgeG8piI#P~sCEX+)dZ3eO+zAB5Dfe0IiHX9==D?2kI zoW*2d0%J2WvS=8n8K}Vc28?YI86_nJR{Hw+$;AaINzK3;WT-rgi-D7Y!vebnHf>f= zrO8D(CMZhvVX+TNitv=^8U{*-&W?J?ML7nxAj1?`%nU$Dh9y*1fx$q_Km+CuCPpzC zkm1Ev`ugZeUf($&7~(-b7BLnP+sgqn?z2|{SL$WOD?ff*<2R58nXb$tVIbBZ zveE8vCi9Q|?u=Jvs7Y}!y-!ZjK8&2)xWUPdkzww(3lrKNwlTduy5NI}Ov%CCvNLU5 zD?WI2IbE|qvC?;K4aeGN+X8khlJf0f->9j0=lQK;Hi{1(3wjo;sgh+}a!SxDe06QO zmP5(k%d)K!0r$h*OBdFLD(JbJ2NdepqCx^?)(!gD%7ix`q$7w;-O;i;}X zJ*9P?1>f4_44Yj+jS-cLb$IUI%YAM5Y1e|9oR2zJ9_}q~F=sw!wDrWSMk%jJe%5ZY zTK_dK`Z=#>@fqH@&9>)RD*8o4s*UCxXIK_= 2 # for Fedora release branches, please use release < 2 (1.0, 1.1, ...) -Release: 4%{?dist} +Release: 1.0%{?dist} License: MPLv2.0 URL: http://www.mozilla.org/projects/security/pki/nss/ Requires: nspr >= %{nspr_version} @@ -922,6 +922,9 @@ update-crypto-policies %changelog +* Thu Dec 6 2018 Daiki Ueno - 3.40.1-1.0 +- Update to NSS 3.40.1 + * Wed Nov 14 2018 Daiki Ueno - 3.39.0-4 - Consolidate nss-util, nss-softokn, and nss into a single package - Fix FTBFS with expired test certs diff --git a/sources b/sources index c45fce5..bd84a22 100644 --- a/sources +++ b/sources @@ -3,6 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310 -SHA512 (nss-3.39.tar.gz) = 16358c2d8660ca301410b1d39b2eae64fe2ebbbfab797872410e5fcc67f802ef48f4e362edeecb0591626c77013537019094a6a5dfc8d24487b6b6e54564da8f -SHA512 (PayPalEE.cert) = 602518b8476b40dd241879923a36a433f3220eb28a8c4f7d941131def6e3d00b01d92050ab498e2a08763b02c3c4709855de0ee23a0053d26f4fa9f9f33aaad3 -SHA512 (PayPalICA.cert) = 013795ebb3f13a1cbd5d9d82eef2f439852e461200f12df9790d0b1d63863dc7755af378ea4758f4c8a3a619dfd2d0d43a59da77553caed57611815d6263946b +SHA512 (nss-3.40.1.tar.gz) = 464ae843161e8deb911975d2117e8bf1194a968689b4ce70f9a12d5a33dba7ddd69f1248ec45244139c30fcc87678b206a4e124f032b26ead8bf894e4e8d0564 From 50cda7ebd1487e1c412afc24f88f8abaf1229c24 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Tue, 11 Dec 2018 13:17:07 +0100 Subject: [PATCH 02/19] Update to NSS 3.41 --- .gitignore | 1 + nss-539183.patch | 8 ++--- nss-tests-paypal-certs-v2.patch | 29 --------------- nss.spec | 36 +++++-------------- renegotiate-transitional.patch | 12 ------- ...8-enable-ecc-3des-ciphers-by-default.patch | 23 ------------ sources | 2 +- utilwrap-include-templates.patch | 14 -------- 8 files changed, 15 insertions(+), 110 deletions(-) delete mode 100644 nss-tests-paypal-certs-v2.patch delete mode 100644 renegotiate-transitional.patch delete mode 100644 rhbz1185708-enable-ecc-3des-ciphers-by-default.patch delete mode 100644 utilwrap-include-templates.patch diff --git a/.gitignore b/.gitignore index b0fa934..357bdc5 100644 --- a/.gitignore +++ b/.gitignore @@ -31,3 +31,4 @@ TestUser51.cert /nss-3.38.0.tar.gz /nss-3.39.tar.gz /nss-3.40.1.tar.gz +/nss-3.41.tar.gz diff --git a/nss-539183.patch b/nss-539183.patch index eda3249..267e71e 100644 --- a/nss-539183.patch +++ b/nss-539183.patch @@ -1,5 +1,5 @@ ---- ./nss/cmd/httpserv/httpserv.c.539183 2016-05-21 18:31:39.879585420 -0700 -+++ ./nss/cmd/httpserv/httpserv.c 2016-05-21 18:37:22.374464057 -0700 +--- nss/cmd/httpserv/httpserv.c.539183 2016-05-21 18:31:39.879585420 -0700 ++++ nss/cmd/httpserv/httpserv.c 2016-05-21 18:37:22.374464057 -0700 @@ -953,23 +953,23 @@ getBoundListenSocket(unsigned short port) { @@ -29,8 +29,8 @@ if (prStatus < 0) { PR_Close(listen_sock); errExit("PR_SetSocketOption(PR_SockOpt_Nonblocking)"); ---- ./nss/cmd/selfserv/selfserv.c.539183 2016-05-21 18:31:39.882585367 -0700 -+++ ./nss/cmd/selfserv/selfserv.c 2016-05-21 18:41:43.092801174 -0700 +--- nss/cmd/selfserv/selfserv.c.539183 2016-05-21 18:31:39.882585367 -0700 ++++ nss/cmd/selfserv/selfserv.c 2016-05-21 18:41:43.092801174 -0700 @@ -1711,23 +1711,23 @@ getBoundListenSocket(unsigned short port) { diff --git a/nss-tests-paypal-certs-v2.patch b/nss-tests-paypal-certs-v2.patch deleted file mode 100644 index 8f37f8c..0000000 --- a/nss-tests-paypal-certs-v2.patch +++ /dev/null @@ -1,29 +0,0 @@ -# HG changeset patch -# User Daiki Ueno -# Date 1541595734 -3600 -# Wed Nov 07 14:02:14 2018 +0100 -# Node ID 19fd907784e38a5febb54588353368af91b12551 -# Parent 3b79af0fa294b4b1c009c1c0b659bb72b4d2c1c8 -Bug 1505317, update PayPal test certs - -diff --git a/tests/chains/scenarios/realcerts.cfg b/tests/chains/scenarios/realcerts.cfg ---- a/tests/chains/scenarios/realcerts.cfg -+++ b/tests/chains/scenarios/realcerts.cfg -@@ -21,7 +21,7 @@ verify TestUser51:x - result pass - - verify PayPalEE:x -- policy OID.2.16.840.1.114412.1.1 -+ policy OID.2.16.840.1.114412.2.1 - result pass - - verify BrAirWaysBadSig:x -diff --git a/tests/libpkix/vfychain_test.lst b/tests/libpkix/vfychain_test.lst ---- a/tests/libpkix/vfychain_test.lst -+++ b/tests/libpkix/vfychain_test.lst -@@ -1,4 +1,4 @@ - # Status | Leaf Cert | Policies | Others(undef) - 0 TestUser50 undef - 0 TestUser51 undef --0 PayPalEE OID.2.16.840.1.114412.1.1 -+0 PayPalEE OID.2.16.840.1.114412.2.1 diff --git a/nss.spec b/nss.spec index da782dd..1024783 100644 --- a/nss.spec +++ b/nss.spec @@ -1,7 +1,6 @@ %global nspr_version 4.20.0 -%global nss_version 3.40.1 +%global nss_version 3.41.0 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools -%global allTools "certutil cmsutil crlutil derdump modutil pk12util signtool signver ssltap vfychain vfyserv" %global saved_files_dir %{_libdir}/nss/saved %global prelink_conf_dir %{_sysconfdir}/prelink.conf.d/ %global dracutlibdir %{_prefix}/lib/dracut @@ -45,9 +44,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM", Summary: Network Security Services Name: nss Version: %{nss_version} -# for Rawhide, please always use release >= 2 -# for Fedora release branches, please use release < 2 (1.0, 1.1, ...) -Release: 1.0%{?dist} +Release: 1%{?dist} License: MPLv2.0 URL: http://www.mozilla.org/projects/security/pki/nss/ Requires: nspr >= %{nspr_version} @@ -94,14 +91,9 @@ Source25: key3.db.xml Source26: key4.db.xml Source27: secmod.db.xml Source28: nss-p11-kit.config -Source29: PayPalICA.cert -Source30: PayPalEE.cert -Patch1: renegotiate-transitional.patch # Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=617723 Patch2: nss-539183.patch -# Fedora / RHEL-only patch, the templates directory was originally introduced to support mod_revocator -Patch3: utilwrap-include-templates.patch # This patch uses the GCC -iquote option documented at # http://gcc.gnu.org/onlinedocs/gcc/Directory-Options.html#Directory-Options # to give the in-tree headers a higher priority over the system headers, @@ -114,10 +106,6 @@ Patch3: utilwrap-include-templates.patch # Once the buildroot aha been bootstrapped the patch may be removed # but it doesn't hurt to keep it. Patch4: iquote.patch -# Local patch for TLS_ECDHE_{ECDSA|RSA}_WITH_3DES_EDE_CBC_SHA ciphers -Patch5: rhbz1185708-enable-ecc-3des-ciphers-by-default.patch -# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=1505317 -Patch6: nss-tests-paypal-certs-v2.patch %description Network Security Services (NSS) is a set of libraries designed to @@ -247,15 +235,8 @@ Header and library files for doing development with Network Security Services. %prep %setup -q -n %{name}-%{nss_archive_version} - -%patch1 -p0 -b .transitional -%patch2 -p0 -b .539183 -%patch3 -p0 -b .templates -%patch4 -p0 -b .iquote -%patch5 -p0 -b .1185708_3des pushd nss -%patch6 -p1 -b .paypal-certs -cp %{SOURCE29} %{SOURCE30} tests/libpkix/certs +%autopatch -p1 popd @@ -467,8 +448,7 @@ fi MYRAND=`perl -e 'print 9000 + int rand 1000'`; echo $MYRAND ||: RANDSERV=selfserv_${MYRAND}; echo $RANDSERV ||: DISTBINDIR=`ls -d ./dist/*.OBJ/bin`; echo $DISTBINDIR ||: -pushd `pwd` -cd $DISTBINDIR +pushd "$DISTBINDIR" ln -s selfserv $RANDSERV popd # man perlrun, man perlrequick @@ -481,7 +461,7 @@ find ./nss/tests -type f |\ killall $RANDSERV || : rm -rf ./tests_results -pushd ./nss/tests/ +pushd nss/tests # all.sh is the test suite script # don't need to run all the tests when testing packaging @@ -498,7 +478,6 @@ pushd ./nss/tests/ # % define nss_ssl_run "cov" HOST=localhost DOMSUF=localdomain PORT=$MYRAND NSS_CYCLES=%{?nss_cycles} NSS_TESTS=%{?nss_tests} NSS_SSL_TESTS=%{?nss_ssl_tests} NSS_SSL_RUN=%{?nss_ssl_run} ./all.sh - popd # Normally, the grep exit status is 0 if selected lines are found and 1 otherwise, @@ -638,7 +617,7 @@ for f in nss-config setup-nsssysinit; do install -c -m 644 ${f}.1 $RPM_BUILD_ROOT%{_mandir}/man1/${f}.1 done # Copy the man pages for the nss tools -for f in "%{allTools}"; do +for f in certutil cmsutil crlutil derdump modutil pk12util signtool signver ssltap vfychain vfyserv; do install -c -m 644 ./dist/docs/nroff/${f}.1 $RPM_BUILD_ROOT%{_mandir}/man1/${f}.1 done %if %{defined rhel} @@ -922,6 +901,9 @@ update-crypto-policies %changelog +* Mon Dec 10 2018 Daiki Ueno - 3.41.0-1 +- Update to NSS 3.41 + * Thu Dec 6 2018 Daiki Ueno - 3.40.1-1.0 - Update to NSS 3.40.1 diff --git a/renegotiate-transitional.patch b/renegotiate-transitional.patch deleted file mode 100644 index d3aa3bd..0000000 --- a/renegotiate-transitional.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -up nss/lib/ssl/sslsock.c.transitional nss/lib/ssl/sslsock.c ---- nss/lib/ssl/sslsock.c.transitional 2018-03-09 13:57:50.615706802 +0100 -+++ nss/lib/ssl/sslsock.c 2018-03-09 13:58:23.708974970 +0100 -@@ -67,7 +67,7 @@ static sslOptions ssl_defaults = { - .noLocks = PR_FALSE, - .enableSessionTickets = PR_FALSE, - .enableDeflate = PR_FALSE, -- .enableRenegotiation = SSL_RENEGOTIATE_REQUIRES_XTN, -+ .enableRenegotiation = SSL_RENEGOTIATE_TRANSITIONAL, - .requireSafeNegotiation = PR_FALSE, - .enableFalseStart = PR_FALSE, - .cbcRandomIV = PR_TRUE, diff --git a/rhbz1185708-enable-ecc-3des-ciphers-by-default.patch b/rhbz1185708-enable-ecc-3des-ciphers-by-default.patch deleted file mode 100644 index 455c747..0000000 --- a/rhbz1185708-enable-ecc-3des-ciphers-by-default.patch +++ /dev/null @@ -1,23 +0,0 @@ ---- ./nss/lib/ssl/ssl3con.c.1185708_3des 2016-06-23 21:10:09.765992512 -0400 -+++ ./nss/lib/ssl/ssl3con.c 2016-06-23 22:58:39.121398601 -0400 -@@ -118,18 +118,18 @@ - { TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, SSL_ALLOWED, PR_TRUE, PR_FALSE}, - { TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, SSL_ALLOWED, PR_TRUE, PR_FALSE}, - { TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, SSL_ALLOWED, PR_TRUE, PR_FALSE}, - { TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, SSL_ALLOWED, PR_TRUE, PR_FALSE}, - { TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, SSL_ALLOWED, PR_TRUE, PR_FALSE}, - { TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, SSL_ALLOWED, PR_TRUE, PR_FALSE}, - { TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, SSL_ALLOWED, PR_FALSE, PR_FALSE}, - { TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, SSL_ALLOWED, PR_FALSE, PR_FALSE}, -- { TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, SSL_ALLOWED, PR_FALSE, PR_FALSE}, -- { TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_ALLOWED, PR_FALSE, PR_FALSE}, -+ { TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, SSL_ALLOWED, PR_TRUE, PR_FALSE}, -+ { TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_ALLOWED, PR_TRUE, PR_FALSE}, - { TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, SSL_ALLOWED, PR_FALSE, PR_FALSE}, - { TLS_ECDHE_RSA_WITH_RC4_128_SHA, SSL_ALLOWED, PR_FALSE, PR_FALSE}, - - { TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, SSL_ALLOWED, PR_TRUE, PR_FALSE}, - { TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256,SSL_ALLOWED,PR_TRUE, PR_FALSE}, - { TLS_DHE_DSS_WITH_AES_128_GCM_SHA256, SSL_ALLOWED, PR_FALSE, PR_FALSE}, - { TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, SSL_ALLOWED, PR_FALSE, PR_FALSE}, - { TLS_DHE_DSS_WITH_AES_256_GCM_SHA384, SSL_ALLOWED, PR_FALSE, PR_FALSE}, diff --git a/sources b/sources index bd84a22..d5a8214 100644 --- a/sources +++ b/sources @@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310 -SHA512 (nss-3.40.1.tar.gz) = 464ae843161e8deb911975d2117e8bf1194a968689b4ce70f9a12d5a33dba7ddd69f1248ec45244139c30fcc87678b206a4e124f032b26ead8bf894e4e8d0564 +SHA512 (nss-3.41.tar.gz) = b5a43fe86ded664002fd714c493d9222a64539cd6139b64720625d1742fec5100712cbe401c90c79196e9cbad9ec07d9b4f0f517ce34e4b207beaa3e01c9e114 diff --git a/utilwrap-include-templates.patch b/utilwrap-include-templates.patch deleted file mode 100644 index 649b548..0000000 --- a/utilwrap-include-templates.patch +++ /dev/null @@ -1,14 +0,0 @@ -diff -up nss/lib/nss/config.mk.templates nss/lib/nss/config.mk ---- nss/lib/nss/config.mk.templates 2013-06-18 11:32:07.590089155 -0700 -+++ nss/lib/nss/config.mk 2013-06-18 11:33:28.732763345 -0700 -@@ -3,6 +3,10 @@ - # License, v. 2.0. If a copy of the MPL was not distributed with this - # file, You can obtain one at http://mozilla.org/MPL/2.0/. - -+#ifeq ($(NSS_BUILD_WITHOUT_SOFTOKEN),1) -+INCLUDES += -I/usr/include/nss3/templates -+#endif -+ - # can't do this in manifest.mn because OS_TARGET isn't defined there. - ifeq (,$(filter-out WIN%,$(OS_TARGET))) - From 04fe880bc65b17a76151e08a284f520442bb892f Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Fri, 11 Jan 2019 16:21:23 +0100 Subject: [PATCH 03/19] Rebuild with recent changes - Remove prelink.conf as prelink was removed in F24, suggested by Harald Reindl - Use quilt for %%autopatch - Make sysinit require arch-dependent nss, suggested by Igor Gnatenko - Silence %%post/%%postun scriptlets, suggested by Ian Collier --- nss-softokn-prelink.conf | 6 ------ nss.spec | 25 +++++++++++++------------ 2 files changed, 13 insertions(+), 18 deletions(-) delete mode 100644 nss-softokn-prelink.conf diff --git a/nss-softokn-prelink.conf b/nss-softokn-prelink.conf deleted file mode 100644 index 11d7fb0..0000000 --- a/nss-softokn-prelink.conf +++ /dev/null @@ -1,6 +0,0 @@ --b /lib{,64}/libfreeblpriv3.so --b /lib{,64}/libsoftokn3.so --b /lib{,64}/libnssdbm3.so --b /usr/lib{,64}/libfreeblpriv3.so --b /usr/lib{,64}/libsoftokn3.so --b /usr/lib{,64}/libnssdbm3.so diff --git a/nss.spec b/nss.spec index 1024783..92ee38e 100644 --- a/nss.spec +++ b/nss.spec @@ -2,7 +2,6 @@ %global nss_version 3.41.0 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools %global saved_files_dir %{_libdir}/nss/saved -%global prelink_conf_dir %{_sysconfdir}/prelink.conf.d/ %global dracutlibdir %{_prefix}/lib/dracut %global dracut_modules_dir %{dracutlibdir}/modules.d/05nss-softokn/ %global dracut_conf_dir %{dracutlibdir}/dracut.conf.d @@ -44,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM", Summary: Network Security Services Name: nss Version: %{nss_version} -Release: 1%{?dist} +Release: 3%{?dist} License: MPLv2.0 URL: http://www.mozilla.org/projects/security/pki/nss/ Requires: nspr >= %{nspr_version} @@ -64,13 +63,13 @@ BuildRequires: gawk BuildRequires: psmisc BuildRequires: perl-interpreter BuildRequires: gcc-c++ +BuildRequires: quilt Source0: https://ftp.mozilla.org/pub/security/nss/releases/%{nss_release_tag}/src/%{name}-%{nss_archive_version}.tar.gz Source1: nss-util.pc.in Source2: nss-util-config.in Source3: nss-softokn.pc.in Source4: nss-softokn-config.in -Source5: nss-softokn-prelink.conf Source6: nss-softokn-dracut-module-setup.sh Source7: nss-softokn-dracut.conf Source8: nss.pc.in @@ -133,7 +132,7 @@ Summary: System NSS Initialization # providing nss-system-init without version so that it can # be replaced by a better one, e.g. supplied by the os vendor Provides: nss-system-init -Requires: nss = %{version}-%{release} +Requires: nss%{?_isa} = %{version}-%{release} Requires(post): coreutils, sed %description sysinit @@ -200,7 +199,6 @@ Requires: nspr >= 4.12 # For NSS_SecureMemcmpZero() from nss-util >= 3.33 Requires: nss-util >= 3.33 Conflicts: nss < 3.12.2.99.3-5 -Conflicts: prelink < 0.4.3 Conflicts: filesystem < 3 %description softokn-freebl @@ -234,7 +232,7 @@ Header and library files for doing development with Network Security Services. %prep -%setup -q -n %{name}-%{nss_archive_version} +%autosetup -N -S quilt -n %{name}-%{nss_archive_version} pushd nss %autopatch -p1 popd @@ -522,7 +520,6 @@ mkdir -p $RPM_BUILD_ROOT/%{_libdir} mkdir -p $RPM_BUILD_ROOT/%{unsupported_tools_directory} mkdir -p $RPM_BUILD_ROOT/%{_libdir}/pkgconfig mkdir -p $RPM_BUILD_ROOT/%{saved_files_dir} -mkdir -p $RPM_BUILD_ROOT/%{prelink_conf_dir} mkdir -p $RPM_BUILD_ROOT/%{dracut_modules_dir} mkdir -p $RPM_BUILD_ROOT/%{dracut_conf_dir} mkdir -p $RPM_BUILD_ROOT/%{_sysconfdir}/crypto-policies/local.d @@ -533,7 +530,6 @@ mkdir -p $RPM_BUILD_ROOT/%{_sysconfdir}/crypto-policies/local.d mkdir -p $RPM_BUILD_ROOT%{_datadir}/doc/nss-tools %endif -install -m 644 %{SOURCE5} $RPM_BUILD_ROOT/%{prelink_conf_dir} install -m 755 %{SOURCE6} $RPM_BUILD_ROOT/%{dracut_modules_dir}/module-setup.sh install -m 644 %{SOURCE7} $RPM_BUILD_ROOT/%{dracut_conf_dir}/50-nss-softokn.conf @@ -644,10 +640,10 @@ install -p -m 644 %{SOURCE28} $RPM_BUILD_ROOT/%{_sysconfdir}/crypto-policies/loc /usr/bin/setup-nsssysinit.sh on %post -update-crypto-policies +update-crypto-policies &> /dev/null || : %postun -update-crypto-policies +update-crypto-policies &> /dev/null || : %files @@ -866,8 +862,6 @@ update-crypto-policies %{_libdir}/libfreeblpriv3.so %{_libdir}/libfreeblpriv3.chk #shared -%dir %{prelink_conf_dir} -%{prelink_conf_dir}/nss-softokn-prelink.conf %dir %{dracut_modules_dir} %{dracut_modules_dir}/module-setup.sh %{dracut_conf_dir}/50-nss-softokn.conf @@ -901,6 +895,13 @@ update-crypto-policies %changelog +* Fri Jan 11 2019 Daiki Ueno - 3.41.0-3 +- Remove prelink.conf as prelink was removed in F24, suggested by + Harald Reindl +- Use quilt for %%autopatch +- Make sysinit require arch-dependent nss, suggested by Igor Gnatenko +- Silence %%post/%%postun scriptlets, suggested by Ian Collier + * Mon Dec 10 2018 Daiki Ueno - 3.41.0-1 - Update to NSS 3.41 From 5fe030432d66dd4874a54bc15c76902ba8b833b7 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Fri, 8 Feb 2019 10:56:04 +0100 Subject: [PATCH 04/19] Simplify test failure detection in %check There is the same logic in the upstream script: https://hg.mozilla.org/projects/nss/file/tip/tests/common/cleanup.sh#l56 --- nss.spec | 33 ++++----------------------------- 1 file changed, 4 insertions(+), 29 deletions(-) diff --git a/nss.spec b/nss.spec index 92ee38e..7912bfd 100644 --- a/nss.spec +++ b/nss.spec @@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM", Summary: Network Security Services Name: nss Version: %{nss_version} -Release: 3%{?dist} +Release: 4%{?dist} License: MPLv2.0 URL: http://www.mozilla.org/projects/security/pki/nss/ Requires: nspr >= %{nspr_version} @@ -478,35 +478,7 @@ pushd nss/tests HOST=localhost DOMSUF=localdomain PORT=$MYRAND NSS_CYCLES=%{?nss_cycles} NSS_TESTS=%{?nss_tests} NSS_SSL_TESTS=%{?nss_ssl_tests} NSS_SSL_RUN=%{?nss_ssl_run} ./all.sh popd -# Normally, the grep exit status is 0 if selected lines are found and 1 otherwise, -# Grep exits with status greater than 1 if an error ocurred. -# If there are test failures we expect TEST_FAILURES > 0 and GREP_EXIT_STATUS = 0, -# With no test failures we expect TEST_FAILURES = 0 and GREP_EXIT_STATUS = 1, whereas -# GREP_EXIT_STATUS > 1 would indicate an error in grep such as failure to find the log file. killall $RANDSERV || : - -TEST_FAILURES=$(grep -c -- '- FAILED$' ./tests_results/security/localhost.1/output.log) || GREP_EXIT_STATUS=$? - -if [ ${GREP_EXIT_STATUS:-0} -eq 1 ]; then - echo "okay: test suite detected no failures" -else - if [ ${GREP_EXIT_STATUS:-0} -eq 0 ]; then - # while a situation in which grep return status is 0 and it doesn't output - # anything shouldn't happen, set the default to something that is - # obviously wrong (-1) - echo "error: test suite had ${TEST_FAILURES:--1} test failure(s)" - exit 1 - else - if [ ${GREP_EXIT_STATUS:-0} -eq 2 ]; then - echo "error: grep has not found log file" - exit 1 - else - echo "error: grep failed with exit code: ${GREP_EXIT_STATUS}" - exit 1 - fi - fi -fi -echo "test suite completed" %endif %install @@ -895,6 +867,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Fri Feb 8 2019 Daiki Ueno - 3.41.0-4 +- Simplify test failure detection in %%check + * Fri Jan 11 2019 Daiki Ueno - 3.41.0-3 - Remove prelink.conf as prelink was removed in F24, suggested by Harald Reindl From 96d0bed28d52866459343cddbe41493f0305badb Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Fri, 8 Feb 2019 12:46:59 +0100 Subject: [PATCH 05/19] Update to NSS 3.42 --- .gitignore | 1 + PayPalEE.cert | Bin 2012 -> 0 bytes PayPalICA.cert | Bin 1210 -> 0 bytes nss.spec | 7 +++++-- sources | 2 +- 5 files changed, 7 insertions(+), 3 deletions(-) delete mode 100644 PayPalEE.cert delete mode 100644 PayPalICA.cert diff --git a/.gitignore b/.gitignore index 357bdc5..da39af8 100644 --- a/.gitignore +++ b/.gitignore @@ -32,3 +32,4 @@ TestUser51.cert /nss-3.39.tar.gz /nss-3.40.1.tar.gz /nss-3.41.tar.gz +/nss-3.42.tar.gz diff --git a/PayPalEE.cert b/PayPalEE.cert deleted file mode 100644 index aef4086762a88dd5d7df06a7f4e23ea2f502c83c..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 2012 zcma)6Yg7~07M?R11_%&{6C_fQu~4c!k~0w^qGEZ9P$&h#=PC@zG$bn~VG>9YY9%OI zy;{pdQ7b}=6?8#sMQ&N(^-)^-5Qj zK4`K38CvjDH9Qocs2f;)`R&Y(#5|9dEkQGn{B#w%;En;M@uj0K065tpFpqMAjyNwJ z!wED!jdF(s2l#|@j9R6RW>^!sRHvY3Ko8FBM7WvFW{Fa*QY#qNBvI(sQXx>r9r1|3 z7ZGXkkuoy&9TTHdGDBMy z#^F`4_$uWMU*ZzGI*U?Rbv|uk$TwIOty8bF=AsBF#GL|hfC0eMtPgsz;?o^VK`b!39x z$k+@hg)T^;wL#o`B$NnF<2;=Rr|6huGA++w(6c7W1G;lo9wFeyW}piUw3Zthw1Agw z7Xj=Lo&~rf&;t0V1puVGcKrH`ZI`yc*?BR0V+qlEX{4+CYr{G9N?u^|Hbj)tV&413 z!Y9P%8JED2bX|KYihq5N{pf>~E zgkU_}SRLFt@_uTwj6557S(B+9r}}pt+}U)l%ACFDtHa0RZ$$f@TzPs}_WJH?_=&>Q z95o&TXecnsStj%(p`gVn+^oZJI6GQFyJ*s*&}1ZgR~r3s-QM_Q|6u;<)-Y9 zJiYiAx1I=kwXtL3a7)t3LX-y(@QH;t4lTS9=!5gpy?rq;oW4P{=t9cD-kQdH4->NZ z%!OG$jg9rXLT}DNfKA6lZQ-};=O9%ZWd+^l`(SM*zd+Fniw|<=LacZ{EZ%GR%PuU_ za@0nXo-MH1kHy(E1u1Nii$ZP-MM@^0(drEhYio5j*dq5o*RRjkFbb2Ay9E}3Vy)4} z&3Zw-T>CRot-@oy!b<59>>ZD(?Kl^sgc#dQb~@)7yxHa zHiv@gUR*E6aH;gKf+3AgNrU#dovPRw09d?bG6n#w2(E*ElNf?h@pC?Uh0!pjGno3q z3oVVCWKDCLWSrtCozx^wk|q`DPeFR7N70cI1#5!N94~^KJ_@;)xE|+Q<)ya(#Zb%w zbeIKbKn`L?>RKIlHj7t?Hn$NUpH&(73qz~0$1h#`@`kxf@U6>LHv|DpcvEx{f?zx( z9>$@wkRSRg0w>q!lQu`F<(S<#^txR?-8y!HB?cR z-ur&fFV742SqsO(7?d&F^dUi+b?$0{AW8sl+`y=P#Uy-XH4=+}sWNufK zFlp@RoV&lBSMQiVq`C9i&5B#{vSqpqRnVaJ{(U4LY3sYz?z1)bczK2I?!#q;OTv~{ z@{gq6@!YvfDc>>k+@@z`V{)uzm%vz#??b~!^LLdT$S`z?62=~P%bwmvE?3T<+cx0U zGyX7f2}(|@A1$0?Too$QVh7@jh;^?r_r+DixgG4I2Wv)ek=eHT=w#JLfYjctey`I* zGFzJD6js@``ul28*gpn8_4W5zpt0{yPK*>jy*Dvhv7;y0KWf2)MRyvG3s!6%>RuL5 z`S1OE>SmM~e>-&h>W#(h<>j8T4;*G~Z=6@vvphnjbSwVX@{@v-Ra^EQ85X~rn?Ma7 z&3yT-%KCnEeaE{un|edhKJv=;?@D-4zC~GwlG5Sl{_Wd_k{h*Cpxww}CGWzDYT64L#;Huckn_>79!b6YiZ`;BBjRbg-4#6a^OkH6Gh z`5vzvcvN|FsNsoe{o?A0rhXr9-7h0Z$Hh-VP=8;~xU^T`(pBRYHCB{F>mTflRW#iOp^Jx3d%gD&h%3zRV z$Zf#M#vIDRCd?EXY$$3V4B~JJ^SETDXF8`Al_+@TB^yc_h=YW=g$2sX%k@$+(=(G( zi%Rs8^K%Wg4KzVg%)&}=9UhtK848ZY#id1wdC92?u3-v6`S~RZ&W;9h;=G2&h6YAP zhDHVk1_n{$yhavCT!T_dU1MTk1aXZv+%>@-jz$Wu6(y;8DXA$6VTn1JDTyVS`FRS# zsYPX}MIdK2F)AU43nME7a}y&!gFzD`7gG}>Bg6IJB`kqIW-b%+@J?4>HQDomvI#b-}jYQ9{k37p#6kAWT3z%#O>d=9hUR_VQHY4=K-}O=fIU#!lKmGOkGG-PvuXJ#)&p7O%ZAMfb^Pp1JQ1`X$wgA1IusbMNC%0S!rGCT2zk#>GvHo(4^f zt_DJE%%QTvjEw(TI1Jbr8UHgeG8piI#P~sCEX+)dZ3eO+zAB5Dfe0IiHX9==D?2kI zoW*2d0%J2WvS=8n8K}Vc28?YI86_nJR{Hw+$;AaINzK3;WT-rgi-D7Y!vebnHf>f= zrO8D(CMZhvVX+TNitv=^8U{*-&W?J?ML7nxAj1?`%nU$Dh9y*1fx$q_Km+CuCPpzC zkm1Ev`ugZeUf($&7~(-b7BLnP+sgqn?z2|{SL$WOD?ff*<2R58nXb$tVIbBZ zveE8vCi9Q|?u=Jvs7Y}!y-!ZjK8&2)xWUPdkzww(3lrKNwlTduy5NI}Ov%CCvNLU5 zD?WI2IbE|qvC?;K4aeGN+X8khlJf0f->9j0=lQK;Hi{1(3wjo;sgh+}a!SxDe06QO zmP5(k%d)K!0r$h*OBdFLD(JbJ2NdepqCx^?)(!gD%7ix`q$7w;-O;i;}X zJ*9P?1>f4_44Yj+jS-cLb$IUI%YAM5Y1e|9oR2zJ9_}q~F=sw!wDrWSMk%jJe%5ZY zTK_dK`Z=#>@fqH@&9>)RD*8o4s*UCxXIK_= %{nspr_version} @@ -867,6 +867,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Fri Feb 8 2019 Daiki Ueno - 3.42.0-1 +- Update to NSS 3.42 + * Fri Feb 8 2019 Daiki Ueno - 3.41.0-4 - Simplify test failure detection in %%check diff --git a/sources b/sources index d5a8214..42c649d 100644 --- a/sources +++ b/sources @@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310 -SHA512 (nss-3.41.tar.gz) = b5a43fe86ded664002fd714c493d9222a64539cd6139b64720625d1742fec5100712cbe401c90c79196e9cbad9ec07d9b4f0f517ce34e4b207beaa3e01c9e114 +SHA512 (nss-3.42.tar.gz) = ad22f4b2672b4f29c7dd5544cbb642d3ec4b451137ffde4f608ff7b9826c762caa885f4802e1df291d2067a291aae9ffa1cf7298af96e1c6afa019fc7c3935bd From 96487199d6fb089a9a6c18c58805177fb75e5dbc Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Mon, 11 Feb 2019 13:06:04 +0100 Subject: [PATCH 06/19] Update to NSS 3.42.1 --- .gitignore | 1 + nss.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index da39af8..9e7d489 100644 --- a/.gitignore +++ b/.gitignore @@ -33,3 +33,4 @@ TestUser51.cert /nss-3.40.1.tar.gz /nss-3.41.tar.gz /nss-3.42.tar.gz +/nss-3.42.1.tar.gz diff --git a/nss.spec b/nss.spec index ee601a3..20f2706 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ %global nspr_version 4.20.0 -%global nss_version 3.42.0 +%global nss_version 3.42.1 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools %global saved_files_dir %{_libdir}/nss/saved %global dracutlibdir %{_prefix}/lib/dracut @@ -867,6 +867,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Mon Feb 11 2019 Daiki Ueno - 3.42.1-1 +- Update to NSS 3.42.1 + * Fri Feb 8 2019 Daiki Ueno - 3.42.0-1 - Update to NSS 3.42 diff --git a/sources b/sources index 42c649d..ce6441c 100644 --- a/sources +++ b/sources @@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310 -SHA512 (nss-3.42.tar.gz) = ad22f4b2672b4f29c7dd5544cbb642d3ec4b451137ffde4f608ff7b9826c762caa885f4802e1df291d2067a291aae9ffa1cf7298af96e1c6afa019fc7c3935bd +SHA512 (nss-3.42.1.tar.gz) = 468e1d4ea9d2b832c7b8975443ee6fe2790b39cbbd9f8e3d8428a43f47cce0e81d5ca21e3566701b75bcd4af09110c0134e204b2850d30ecfd6347ec27e6e265 From 49519a4d9fa255d937512eb10e8205aff1353d12 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Thu, 21 Mar 2019 10:43:19 +0100 Subject: [PATCH 07/19] Update to NSS 3.43 --- .gitignore | 1 + nss.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 9e7d489..0a4fab9 100644 --- a/.gitignore +++ b/.gitignore @@ -34,3 +34,4 @@ TestUser51.cert /nss-3.41.tar.gz /nss-3.42.tar.gz /nss-3.42.1.tar.gz +/nss-3.43.tar.gz diff --git a/nss.spec b/nss.spec index 20f2706..22a04a7 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ -%global nspr_version 4.20.0 -%global nss_version 3.42.1 +%global nspr_version 4.21.0 +%global nss_version 3.43.0 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools %global saved_files_dir %{_libdir}/nss/saved %global dracutlibdir %{_prefix}/lib/dracut @@ -867,6 +867,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Thu Mar 21 2019 Daiki Ueno - 3.43.0-1 +- Update to NSS 3.43 + * Mon Feb 11 2019 Daiki Ueno - 3.42.1-1 - Update to NSS 3.42.1 diff --git a/sources b/sources index ce6441c..72ed007 100644 --- a/sources +++ b/sources @@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310 -SHA512 (nss-3.42.1.tar.gz) = 468e1d4ea9d2b832c7b8975443ee6fe2790b39cbbd9f8e3d8428a43f47cce0e81d5ca21e3566701b75bcd4af09110c0134e204b2850d30ecfd6347ec27e6e265 +SHA512 (nss-3.43.tar.gz) = e9dfba5bd6f68c5ab58fc7a6fa1b16a035be1b1b7c436cf787bdc99257c5f54c78d73d94d015bffd29420df19b2a2818166c68fe592dd7208ab5605344827fb5 From 9f20571928ede2d696468fffb93e579fd19930fe Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Mon, 6 May 2019 18:33:40 +0200 Subject: [PATCH 08/19] Fix PKCS#11 module leak if C_GetSlotInfo() failed --- nss-module-leak.patch | 35 +++++++++++++++++++++++++++++++++++ nss.spec | 7 ++++++- 2 files changed, 41 insertions(+), 1 deletion(-) create mode 100644 nss-module-leak.patch diff --git a/nss-module-leak.patch b/nss-module-leak.patch new file mode 100644 index 0000000..7acf3f3 --- /dev/null +++ b/nss-module-leak.patch @@ -0,0 +1,35 @@ +# HG changeset patch +# User Daiki Ueno +# Date 1557150127 -7200 +# Mon May 06 15:42:07 2019 +0200 +# Node ID 438ac983bda9ec7944990d22a37877e9111caa90 +# Parent b018f3e84d87cce99a1fd81feeecb31123058687 +pk11slot: reference module from slot for finalization + +diff --git a/lib/pk11wrap/pk11slot.c b/lib/pk11wrap/pk11slot.c +--- a/lib/pk11wrap/pk11slot.c ++++ b/lib/pk11wrap/pk11slot.c +@@ -1439,6 +1439,11 @@ PK11_InitSlot(SECMODModule *mod, CK_SLOT + slot->slotID = slotID; + slot->isThreadSafe = mod->isThreadSafe; + slot->hasRSAInfo = PR_FALSE; ++ slot->module = mod; /* NOTE: we don't make a reference here because ++ * modules have references to their slots. This ++ * works because modules keep implicit references ++ * from their slots, and won't unload and disappear ++ * until all their slots have been freed */ + + if (PK11_GETTAB(slot)->C_GetSlotInfo(slotID, &slotInfo) != CKR_OK) { + slot->disabled = PR_TRUE; +@@ -1448,11 +1453,6 @@ PK11_InitSlot(SECMODModule *mod, CK_SLOT + + /* test to make sure claimed mechanism work */ + slot->needTest = mod->internal ? PR_FALSE : PR_TRUE; +- slot->module = mod; /* NOTE: we don't make a reference here because +- * modules have references to their slots. This +- * works because modules keep implicit references +- * from their slots, and won't unload and disappear +- * until all their slots have been freed */ + (void)PK11_MakeString(NULL, slot->slot_name, + (char *)slotInfo.slotDescription, sizeof(slotInfo.slotDescription)); + slot->isHW = (PRBool)((slotInfo.flags & CKF_HW_SLOT) == CKF_HW_SLOT); diff --git a/nss.spec b/nss.spec index 22a04a7..0b8526a 100644 --- a/nss.spec +++ b/nss.spec @@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM", Summary: Network Security Services Name: nss Version: %{nss_version} -Release: 1%{?dist} +Release: 2%{?dist} License: MPLv2.0 URL: http://www.mozilla.org/projects/security/pki/nss/ Requires: nspr >= %{nspr_version} @@ -93,6 +93,8 @@ Source28: nss-p11-kit.config # Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=617723 Patch2: nss-539183.patch +# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=1549382 +Patch3: nss-module-leak.patch # This patch uses the GCC -iquote option documented at # http://gcc.gnu.org/onlinedocs/gcc/Directory-Options.html#Directory-Options # to give the in-tree headers a higher priority over the system headers, @@ -867,6 +869,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Tue May 7 2019 Daiki Ueno - 3.43.0-2 +- Fix PKCS#11 module leak if C_GetSlotInfo() failed + * Thu Mar 21 2019 Daiki Ueno - 3.43.0-1 - Update to NSS 3.43 From c4d0bca3408377b7ee1295e14ee9f003573bc5e2 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Fri, 17 May 2019 13:03:12 +0200 Subject: [PATCH 09/19] Update to NSS 3.44 --- .gitignore | 1 + nss.spec | 10 ++++++++-- sources | 2 +- 3 files changed, 10 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 0a4fab9..75a333c 100644 --- a/.gitignore +++ b/.gitignore @@ -35,3 +35,4 @@ TestUser51.cert /nss-3.42.tar.gz /nss-3.42.1.tar.gz /nss-3.43.tar.gz +/nss-3.44.tar.gz diff --git a/nss.spec b/nss.spec index 0b8526a..7a2c3da 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ %global nspr_version 4.21.0 -%global nss_version 3.43.0 +%global nss_version 3.44.0 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools %global saved_files_dir %{_libdir}/nss/saved %global dracutlibdir %{_prefix}/lib/dracut @@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM", Summary: Network Security Services Name: nss Version: %{nss_version} -Release: 2%{?dist} +Release: 1%{?dist} License: MPLv2.0 URL: http://www.mozilla.org/projects/security/pki/nss/ Requires: nspr >= %{nspr_version} @@ -239,6 +239,9 @@ pushd nss %autopatch -p1 popd +# https://bugzilla.redhat.com/show_bug.cgi?id=1247353 +find nss/lib/libpkix -perm /u+x -type f -exec chmod -x {} \; + %build @@ -869,6 +872,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Fri May 17 2019 Daiki Ueno - 3.44.0-1 +- Update to NSS 3.44 + * Tue May 7 2019 Daiki Ueno - 3.43.0-2 - Fix PKCS#11 module leak if C_GetSlotInfo() failed diff --git a/sources b/sources index 72ed007..0483fb0 100644 --- a/sources +++ b/sources @@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310 -SHA512 (nss-3.43.tar.gz) = e9dfba5bd6f68c5ab58fc7a6fa1b16a035be1b1b7c436cf787bdc99257c5f54c78d73d94d015bffd29420df19b2a2818166c68fe592dd7208ab5605344827fb5 +SHA512 (nss-3.44.tar.gz) = c4d7343a66f91c5888a121e266d1f1471da798a21d608a29caf598a828725e4bf9ea7411a105b23335f20bd7c12788dad567922ceeaebeb0c98fbf9bbe4006f7 From f07ed25f644d7686c0ee7446b7e8e4d49d39eb1a Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Mon, 20 May 2019 11:09:19 +0200 Subject: [PATCH 10/19] Skip TLS 1.3 tests under FIPS mode --- nss-skip-tls13-fips.patch | 27 +++++++++++++++++++++++++++ nss.spec | 7 ++++++- 2 files changed, 33 insertions(+), 1 deletion(-) create mode 100644 nss-skip-tls13-fips.patch diff --git a/nss-skip-tls13-fips.patch b/nss-skip-tls13-fips.patch new file mode 100644 index 0000000..4a7c707 --- /dev/null +++ b/nss-skip-tls13-fips.patch @@ -0,0 +1,27 @@ +# HG changeset patch +# User Daiki Ueno +# Date 1558341826 -7200 +# Mon May 20 10:43:46 2019 +0200 +# Node ID b447f0046807b718d2928d0e33313620d38a287a +# Parent 02ea5f29ac3c1f1c6e6eb4b655afd9b4fc075a9e +tests: skip TLS 1.3 tests under FIPS mode + +diff --git a/tests/ssl/ssl.sh b/tests/ssl/ssl.sh +--- a/tests/ssl/ssl.sh ++++ b/tests/ssl/ssl.sh +@@ -393,6 +393,15 @@ ssl_auth() + echo "${testname}" | grep "TLS 1.3" > /dev/null + TLS13=$? + ++ # Currently TLS 1.3 tests are known to fail under FIPS mode, ++ # because HKDF is implemented using the PKCS #11 functions ++ # prohibited under FIPS mode. ++ if [ "${TLS13}" -eq 0 ] && \ ++ [ "$SERVER_MODE" = "fips" -o "$CLIENT_MODE" = "fips" ] ; then ++ echo "$SCRIPTNAME: skipping $testname (non-FIPS only)" ++ continue ++ fi ++ + if [ "${CLIENT_MODE}" = "fips" -a "${CAUTH}" -eq 0 ] ; then + echo "$SCRIPTNAME: skipping $testname (non-FIPS only)" + elif [ "$ectype" = "SNI" -a "$NORM_EXT" = "Extended Test" ] ; then diff --git a/nss.spec b/nss.spec index 7a2c3da..e2a4adc 100644 --- a/nss.spec +++ b/nss.spec @@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM", Summary: Network Security Services Name: nss Version: %{nss_version} -Release: 1%{?dist} +Release: 2%{?dist} License: MPLv2.0 URL: http://www.mozilla.org/projects/security/pki/nss/ Requires: nspr >= %{nspr_version} @@ -107,6 +107,8 @@ Patch3: nss-module-leak.patch # Once the buildroot aha been bootstrapped the patch may be removed # but it doesn't hurt to keep it. Patch4: iquote.patch +# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=1552767 +Patch5: nss-skip-tls13-fips.patch %description Network Security Services (NSS) is a set of libraries designed to @@ -872,6 +874,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Mon May 20 2019 Daiki Ueno - 3.44.0-2 +- Skip TLS 1.3 tests under FIPS mode + * Fri May 17 2019 Daiki Ueno - 3.44.0-1 - Update to NSS 3.44 From 9d762e183d3fa243ac98c7055c546b5aecf8e37c Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Tue, 2 Jul 2019 12:55:10 +0200 Subject: [PATCH 11/19] Update to NSS 3.44.1 --- .gitignore | 1 + nss.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 75a333c..23a0c00 100644 --- a/.gitignore +++ b/.gitignore @@ -36,3 +36,4 @@ TestUser51.cert /nss-3.42.1.tar.gz /nss-3.43.tar.gz /nss-3.44.tar.gz +/nss-3.44.1.tar.gz diff --git a/nss.spec b/nss.spec index e2a4adc..03232ea 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ %global nspr_version 4.21.0 -%global nss_version 3.44.0 +%global nss_version 3.44.1 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools %global saved_files_dir %{_libdir}/nss/saved %global dracutlibdir %{_prefix}/lib/dracut @@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM", Summary: Network Security Services Name: nss Version: %{nss_version} -Release: 2%{?dist} +Release: 1%{?dist} License: MPLv2.0 URL: http://www.mozilla.org/projects/security/pki/nss/ Requires: nspr >= %{nspr_version} @@ -874,6 +874,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Tue Jul 2 2019 Daiki Ueno - 3.44.1-1 +- Update to NSS 3.44.1 + * Mon May 20 2019 Daiki Ueno - 3.44.0-2 - Skip TLS 1.3 tests under FIPS mode diff --git a/sources b/sources index 0483fb0..53b9c62 100644 --- a/sources +++ b/sources @@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310 -SHA512 (nss-3.44.tar.gz) = c4d7343a66f91c5888a121e266d1f1471da798a21d608a29caf598a828725e4bf9ea7411a105b23335f20bd7c12788dad567922ceeaebeb0c98fbf9bbe4006f7 +SHA512 (nss-3.44.1.tar.gz) = eb8777701a25b54377026633b6bf284e4c62308012058355f348a7c57525afe96db74a07de41ba01754e316a7dff06689de527359a5474ed7ab606779c4cf169 From ad1ef42b5a140b16799e2d22595c61f8affcc67c Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Wed, 3 Jul 2019 15:59:21 +0200 Subject: [PATCH 12/19] Fix CAVS testdir creation --- nss-cavs-tests.patch | 155 +++++++++++++++++++++++++++++++++++++++++++ nss.spec | 1 + 2 files changed, 156 insertions(+) create mode 100644 nss-cavs-tests.patch diff --git a/nss-cavs-tests.patch b/nss-cavs-tests.patch new file mode 100644 index 0000000..c0b2306 --- /dev/null +++ b/nss-cavs-tests.patch @@ -0,0 +1,155 @@ +# HG changeset patch +# User Daiki Ueno +# Date 1562162181 -7200 +# Wed Jul 03 15:56:21 2019 +0200 +# Node ID 88feab2a3e5e4b00b1626d59a0d3ecef93cafb92 +# Parent b5d3f574967f8c5c705dab15682b0e16fac3e4be +tests: ensure CAVS test dirs are created + +diff --git a/tests/fips/cavs_scripts/aes.sh b/tests/fips/cavs_scripts/aes.sh +--- a/tests/fips/cavs_scripts/aes.sh ++++ b/tests/fips/cavs_scripts/aes.sh +@@ -83,6 +83,8 @@ if [ ${COMMAND} = "verify" ]; then + exit $result + fi + ++test -d "${RSPDIR}" || mkdir "${RSPDIR}" ++ + for request in $cbc_kat_requests; do + response=`echo $request | sed -e "s/req/rsp/"` + echo $request $response +diff --git a/tests/fips/cavs_scripts/aesgcm.sh b/tests/fips/cavs_scripts/aesgcm.sh +--- a/tests/fips/cavs_scripts/aesgcm.sh ++++ b/tests/fips/cavs_scripts/aesgcm.sh +@@ -56,6 +56,8 @@ if [ ${COMMAND} = "verify" ]; then + exit $result + fi + ++test -d "${RSPDIR}" || mkdir "${RSPDIR}" ++ + for request in $gcm_decrypt_requests; do + response=`echo $request | sed -e "s/req/rsp/"` + echo $request $response +diff --git a/tests/fips/cavs_scripts/dsa.sh b/tests/fips/cavs_scripts/dsa.sh +--- a/tests/fips/cavs_scripts/dsa.sh ++++ b/tests/fips/cavs_scripts/dsa.sh +@@ -59,6 +59,8 @@ if [ ${COMMAND} = "verify" ]; then + exit $result + fi + ++test -d "${RSPDIR}" || mkdir "${RSPDIR}" ++ + request=KeyPair.req + response=`echo $request | sed -e "s/req/rsp/"` + echo $request $response +diff --git a/tests/fips/cavs_scripts/ecdsa.sh b/tests/fips/cavs_scripts/ecdsa.sh +--- a/tests/fips/cavs_scripts/ecdsa.sh ++++ b/tests/fips/cavs_scripts/ecdsa.sh +@@ -50,6 +50,8 @@ if [ ${COMMAND} = "verify" ]; then + exit $result + fi + ++test -d "${RSPDIR}" || mkdir "${RSPDIR}" ++ + request=KeyPair.req + response=`echo $request | sed -e "s/req/rsp/"` + echo $request $response +diff --git a/tests/fips/cavs_scripts/hmac.sh b/tests/fips/cavs_scripts/hmac.sh +--- a/tests/fips/cavs_scripts/hmac.sh ++++ b/tests/fips/cavs_scripts/hmac.sh +@@ -31,6 +31,9 @@ if [ ${COMMAND} = "verify" ]; then + done + exit $result + fi ++ ++test -d "${RSPDIR}" || mkdir "${RSPDIR}" ++ + for request in $hmac_requests; do + response=`echo $request | sed -e "s/req/rsp/"` + echo $request $response +diff --git a/tests/fips/cavs_scripts/ike.sh b/tests/fips/cavs_scripts/ike.sh +--- a/tests/fips/cavs_scripts/ike.sh ++++ b/tests/fips/cavs_scripts/ike.sh +@@ -33,6 +33,8 @@ if [ ${COMMAND} = "verify" ]; then + exit $result + fi + ++test -d "${RSPDIR}" || mkdir "${RSPDIR}" ++ + request=ikev1_dsa.req + response=`echo $request | sed -e "s/req/rsp/"` + echo $request $response +diff --git a/tests/fips/cavs_scripts/kas.sh b/tests/fips/cavs_scripts/kas.sh +--- a/tests/fips/cavs_scripts/kas.sh ++++ b/tests/fips/cavs_scripts/kas.sh +@@ -68,6 +68,8 @@ if [ ${COMMAND} = "verify" ]; then + exit $result + fi + ++test -d "${RSPDIR}" || mkdir "${RSPDIR}" ++ + request=KASFunctionTest_ECCEphemeralUnified_NOKC_ZZOnly_init.req + response=`echo $request | sed -e "s/req/rsp/"` + echo $request $response +diff --git a/tests/fips/cavs_scripts/rng.sh b/tests/fips/cavs_scripts/rng.sh +--- a/tests/fips/cavs_scripts/rng.sh ++++ b/tests/fips/cavs_scripts/rng.sh +@@ -30,6 +30,9 @@ if [ ${COMMAND} = "verify" ]; then + done + exit $result + fi ++ ++test -d "${RSPDIR}" || mkdir "${RSPDIR}" ++ + for request in $drbg_requests; do + response=`echo $request | sed -e "s/req/rsp/"` + echo $request $response +diff --git a/tests/fips/cavs_scripts/rsa.sh b/tests/fips/cavs_scripts/rsa.sh +--- a/tests/fips/cavs_scripts/rsa.sh ++++ b/tests/fips/cavs_scripts/rsa.sh +@@ -38,6 +38,8 @@ if [ ${COMMAND} = "verify" ]; then + exit $result + fi + ++test -d "${RSPDIR}" || mkdir "${RSPDIR}" ++ + request=SigGen15_186-3.req + response=`echo $request | sed -e "s/req/rsp/"` + echo $request $response +diff --git a/tests/fips/cavs_scripts/sha.sh b/tests/fips/cavs_scripts/sha.sh +--- a/tests/fips/cavs_scripts/sha.sh ++++ b/tests/fips/cavs_scripts/sha.sh +@@ -51,6 +51,8 @@ if [ ${COMMAND} = "verify" ]; then + exit $result + fi + ++test -d "${RSPDIR}" || mkdir "${RSPDIR}" ++ + for request in $sha_ShortMsg_requests; do + response=`echo $request | sed -e "s/req/rsp/"` + echo $request $response +diff --git a/tests/fips/cavs_scripts/tdea.sh b/tests/fips/cavs_scripts/tdea.sh +--- a/tests/fips/cavs_scripts/tdea.sh ++++ b/tests/fips/cavs_scripts/tdea.sh +@@ -77,6 +77,8 @@ if [ ${COMMAND} = "verify" ]; then + exit $result + fi + ++test -d "${RSPDIR}" || mkdir "${RSPDIR}" ++ + for request in $cbc_kat_requests; do + response=`echo $request | sed -e "s/req/rsp/"` + echo $request $response +diff --git a/tests/fips/cavs_scripts/tls.sh b/tests/fips/cavs_scripts/tls.sh +--- a/tests/fips/cavs_scripts/tls.sh ++++ b/tests/fips/cavs_scripts/tls.sh +@@ -30,6 +30,9 @@ if [ ${COMMAND} = "verify" ]; then + done + exit $result + fi ++ ++test -d "${RSPDIR}" || mkdir "${RSPDIR}" ++ + for request in $tls_requests; do + response=`echo $request | sed -e "s/req/rsp/"` + echo $request $response diff --git a/nss.spec b/nss.spec index 03232ea..71b19a7 100644 --- a/nss.spec +++ b/nss.spec @@ -109,6 +109,7 @@ Patch3: nss-module-leak.patch Patch4: iquote.patch # Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=1552767 Patch5: nss-skip-tls13-fips.patch +Patch6: nss-cavs-tests.patch %description Network Security Services (NSS) is a set of libraries designed to From 180b09f6050dead9bd494d8a06126a72105c59e5 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Tue, 3 Sep 2019 09:54:55 +0200 Subject: [PATCH 13/19] Update to NSS 3.46 --- .gitignore | 1 + nss-cavs-tests.patch | 155 ------------------------------------------- nss.spec | 6 +- sources | 2 +- 4 files changed, 6 insertions(+), 158 deletions(-) delete mode 100644 nss-cavs-tests.patch diff --git a/.gitignore b/.gitignore index 23a0c00..f245589 100644 --- a/.gitignore +++ b/.gitignore @@ -37,3 +37,4 @@ TestUser51.cert /nss-3.43.tar.gz /nss-3.44.tar.gz /nss-3.44.1.tar.gz +/nss-3.46.tar.gz diff --git a/nss-cavs-tests.patch b/nss-cavs-tests.patch deleted file mode 100644 index c0b2306..0000000 --- a/nss-cavs-tests.patch +++ /dev/null @@ -1,155 +0,0 @@ -# HG changeset patch -# User Daiki Ueno -# Date 1562162181 -7200 -# Wed Jul 03 15:56:21 2019 +0200 -# Node ID 88feab2a3e5e4b00b1626d59a0d3ecef93cafb92 -# Parent b5d3f574967f8c5c705dab15682b0e16fac3e4be -tests: ensure CAVS test dirs are created - -diff --git a/tests/fips/cavs_scripts/aes.sh b/tests/fips/cavs_scripts/aes.sh ---- a/tests/fips/cavs_scripts/aes.sh -+++ b/tests/fips/cavs_scripts/aes.sh -@@ -83,6 +83,8 @@ if [ ${COMMAND} = "verify" ]; then - exit $result - fi - -+test -d "${RSPDIR}" || mkdir "${RSPDIR}" -+ - for request in $cbc_kat_requests; do - response=`echo $request | sed -e "s/req/rsp/"` - echo $request $response -diff --git a/tests/fips/cavs_scripts/aesgcm.sh b/tests/fips/cavs_scripts/aesgcm.sh ---- a/tests/fips/cavs_scripts/aesgcm.sh -+++ b/tests/fips/cavs_scripts/aesgcm.sh -@@ -56,6 +56,8 @@ if [ ${COMMAND} = "verify" ]; then - exit $result - fi - -+test -d "${RSPDIR}" || mkdir "${RSPDIR}" -+ - for request in $gcm_decrypt_requests; do - response=`echo $request | sed -e "s/req/rsp/"` - echo $request $response -diff --git a/tests/fips/cavs_scripts/dsa.sh b/tests/fips/cavs_scripts/dsa.sh ---- a/tests/fips/cavs_scripts/dsa.sh -+++ b/tests/fips/cavs_scripts/dsa.sh -@@ -59,6 +59,8 @@ if [ ${COMMAND} = "verify" ]; then - exit $result - fi - -+test -d "${RSPDIR}" || mkdir "${RSPDIR}" -+ - request=KeyPair.req - response=`echo $request | sed -e "s/req/rsp/"` - echo $request $response -diff --git a/tests/fips/cavs_scripts/ecdsa.sh b/tests/fips/cavs_scripts/ecdsa.sh ---- a/tests/fips/cavs_scripts/ecdsa.sh -+++ b/tests/fips/cavs_scripts/ecdsa.sh -@@ -50,6 +50,8 @@ if [ ${COMMAND} = "verify" ]; then - exit $result - fi - -+test -d "${RSPDIR}" || mkdir "${RSPDIR}" -+ - request=KeyPair.req - response=`echo $request | sed -e "s/req/rsp/"` - echo $request $response -diff --git a/tests/fips/cavs_scripts/hmac.sh b/tests/fips/cavs_scripts/hmac.sh ---- a/tests/fips/cavs_scripts/hmac.sh -+++ b/tests/fips/cavs_scripts/hmac.sh -@@ -31,6 +31,9 @@ if [ ${COMMAND} = "verify" ]; then - done - exit $result - fi -+ -+test -d "${RSPDIR}" || mkdir "${RSPDIR}" -+ - for request in $hmac_requests; do - response=`echo $request | sed -e "s/req/rsp/"` - echo $request $response -diff --git a/tests/fips/cavs_scripts/ike.sh b/tests/fips/cavs_scripts/ike.sh ---- a/tests/fips/cavs_scripts/ike.sh -+++ b/tests/fips/cavs_scripts/ike.sh -@@ -33,6 +33,8 @@ if [ ${COMMAND} = "verify" ]; then - exit $result - fi - -+test -d "${RSPDIR}" || mkdir "${RSPDIR}" -+ - request=ikev1_dsa.req - response=`echo $request | sed -e "s/req/rsp/"` - echo $request $response -diff --git a/tests/fips/cavs_scripts/kas.sh b/tests/fips/cavs_scripts/kas.sh ---- a/tests/fips/cavs_scripts/kas.sh -+++ b/tests/fips/cavs_scripts/kas.sh -@@ -68,6 +68,8 @@ if [ ${COMMAND} = "verify" ]; then - exit $result - fi - -+test -d "${RSPDIR}" || mkdir "${RSPDIR}" -+ - request=KASFunctionTest_ECCEphemeralUnified_NOKC_ZZOnly_init.req - response=`echo $request | sed -e "s/req/rsp/"` - echo $request $response -diff --git a/tests/fips/cavs_scripts/rng.sh b/tests/fips/cavs_scripts/rng.sh ---- a/tests/fips/cavs_scripts/rng.sh -+++ b/tests/fips/cavs_scripts/rng.sh -@@ -30,6 +30,9 @@ if [ ${COMMAND} = "verify" ]; then - done - exit $result - fi -+ -+test -d "${RSPDIR}" || mkdir "${RSPDIR}" -+ - for request in $drbg_requests; do - response=`echo $request | sed -e "s/req/rsp/"` - echo $request $response -diff --git a/tests/fips/cavs_scripts/rsa.sh b/tests/fips/cavs_scripts/rsa.sh ---- a/tests/fips/cavs_scripts/rsa.sh -+++ b/tests/fips/cavs_scripts/rsa.sh -@@ -38,6 +38,8 @@ if [ ${COMMAND} = "verify" ]; then - exit $result - fi - -+test -d "${RSPDIR}" || mkdir "${RSPDIR}" -+ - request=SigGen15_186-3.req - response=`echo $request | sed -e "s/req/rsp/"` - echo $request $response -diff --git a/tests/fips/cavs_scripts/sha.sh b/tests/fips/cavs_scripts/sha.sh ---- a/tests/fips/cavs_scripts/sha.sh -+++ b/tests/fips/cavs_scripts/sha.sh -@@ -51,6 +51,8 @@ if [ ${COMMAND} = "verify" ]; then - exit $result - fi - -+test -d "${RSPDIR}" || mkdir "${RSPDIR}" -+ - for request in $sha_ShortMsg_requests; do - response=`echo $request | sed -e "s/req/rsp/"` - echo $request $response -diff --git a/tests/fips/cavs_scripts/tdea.sh b/tests/fips/cavs_scripts/tdea.sh ---- a/tests/fips/cavs_scripts/tdea.sh -+++ b/tests/fips/cavs_scripts/tdea.sh -@@ -77,6 +77,8 @@ if [ ${COMMAND} = "verify" ]; then - exit $result - fi - -+test -d "${RSPDIR}" || mkdir "${RSPDIR}" -+ - for request in $cbc_kat_requests; do - response=`echo $request | sed -e "s/req/rsp/"` - echo $request $response -diff --git a/tests/fips/cavs_scripts/tls.sh b/tests/fips/cavs_scripts/tls.sh ---- a/tests/fips/cavs_scripts/tls.sh -+++ b/tests/fips/cavs_scripts/tls.sh -@@ -30,6 +30,9 @@ if [ ${COMMAND} = "verify" ]; then - done - exit $result - fi -+ -+test -d "${RSPDIR}" || mkdir "${RSPDIR}" -+ - for request in $tls_requests; do - response=`echo $request | sed -e "s/req/rsp/"` - echo $request $response diff --git a/nss.spec b/nss.spec index 71b19a7..8a9637b 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ %global nspr_version 4.21.0 -%global nss_version 3.44.1 +%global nss_version 3.46.0 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools %global saved_files_dir %{_libdir}/nss/saved %global dracutlibdir %{_prefix}/lib/dracut @@ -109,7 +109,6 @@ Patch3: nss-module-leak.patch Patch4: iquote.patch # Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=1552767 Patch5: nss-skip-tls13-fips.patch -Patch6: nss-cavs-tests.patch %description Network Security Services (NSS) is a set of libraries designed to @@ -875,6 +874,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Tue Sep 3 2019 Daiki Ueno - 3.46.0-1 +- Update to NSS 3.46 + * Tue Jul 2 2019 Daiki Ueno - 3.44.1-1 - Update to NSS 3.44.1 diff --git a/sources b/sources index 53b9c62..7b4873a 100644 --- a/sources +++ b/sources @@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310 -SHA512 (nss-3.44.1.tar.gz) = eb8777701a25b54377026633b6bf284e4c62308012058355f348a7c57525afe96db74a07de41ba01754e316a7dff06689de527359a5474ed7ab606779c4cf169 +SHA512 (nss-3.46.tar.gz) = de309ec8d6aa2c3cf4d5ebfe9fa1f8bf5def717d22018d5c88c1de963b4ae7b0d69ad64e68d830574fc85613483fd538cb2f319ffb3fa2e1b97ec02f85d37c48 From 28fbcd85706926f3fd3c8a33a2bf9da8153bbf87 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Tue, 3 Sep 2019 11:08:15 +0200 Subject: [PATCH 14/19] Remove upstreamed patch --- nss-module-leak.patch | 35 ----------------------------------- nss.spec | 2 -- 2 files changed, 37 deletions(-) delete mode 100644 nss-module-leak.patch diff --git a/nss-module-leak.patch b/nss-module-leak.patch deleted file mode 100644 index 7acf3f3..0000000 --- a/nss-module-leak.patch +++ /dev/null @@ -1,35 +0,0 @@ -# HG changeset patch -# User Daiki Ueno -# Date 1557150127 -7200 -# Mon May 06 15:42:07 2019 +0200 -# Node ID 438ac983bda9ec7944990d22a37877e9111caa90 -# Parent b018f3e84d87cce99a1fd81feeecb31123058687 -pk11slot: reference module from slot for finalization - -diff --git a/lib/pk11wrap/pk11slot.c b/lib/pk11wrap/pk11slot.c ---- a/lib/pk11wrap/pk11slot.c -+++ b/lib/pk11wrap/pk11slot.c -@@ -1439,6 +1439,11 @@ PK11_InitSlot(SECMODModule *mod, CK_SLOT - slot->slotID = slotID; - slot->isThreadSafe = mod->isThreadSafe; - slot->hasRSAInfo = PR_FALSE; -+ slot->module = mod; /* NOTE: we don't make a reference here because -+ * modules have references to their slots. This -+ * works because modules keep implicit references -+ * from their slots, and won't unload and disappear -+ * until all their slots have been freed */ - - if (PK11_GETTAB(slot)->C_GetSlotInfo(slotID, &slotInfo) != CKR_OK) { - slot->disabled = PR_TRUE; -@@ -1448,11 +1453,6 @@ PK11_InitSlot(SECMODModule *mod, CK_SLOT - - /* test to make sure claimed mechanism work */ - slot->needTest = mod->internal ? PR_FALSE : PR_TRUE; -- slot->module = mod; /* NOTE: we don't make a reference here because -- * modules have references to their slots. This -- * works because modules keep implicit references -- * from their slots, and won't unload and disappear -- * until all their slots have been freed */ - (void)PK11_MakeString(NULL, slot->slot_name, - (char *)slotInfo.slotDescription, sizeof(slotInfo.slotDescription)); - slot->isHW = (PRBool)((slotInfo.flags & CKF_HW_SLOT) == CKF_HW_SLOT); diff --git a/nss.spec b/nss.spec index 8a9637b..8ad5353 100644 --- a/nss.spec +++ b/nss.spec @@ -93,8 +93,6 @@ Source28: nss-p11-kit.config # Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=617723 Patch2: nss-539183.patch -# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=1549382 -Patch3: nss-module-leak.patch # This patch uses the GCC -iquote option documented at # http://gcc.gnu.org/onlinedocs/gcc/Directory-Options.html#Directory-Options # to give the in-tree headers a higher priority over the system headers, From 7fde29358fc49ccbd9cad611679b052d0505e3e2 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Wed, 4 Sep 2019 12:55:32 +0200 Subject: [PATCH 15/19] Rebuild with NSPR 4.22 --- nss-skip-tls13-fips.patch | 27 --------------------------- nss.spec | 9 +++++---- 2 files changed, 5 insertions(+), 31 deletions(-) delete mode 100644 nss-skip-tls13-fips.patch diff --git a/nss-skip-tls13-fips.patch b/nss-skip-tls13-fips.patch deleted file mode 100644 index 4a7c707..0000000 --- a/nss-skip-tls13-fips.patch +++ /dev/null @@ -1,27 +0,0 @@ -# HG changeset patch -# User Daiki Ueno -# Date 1558341826 -7200 -# Mon May 20 10:43:46 2019 +0200 -# Node ID b447f0046807b718d2928d0e33313620d38a287a -# Parent 02ea5f29ac3c1f1c6e6eb4b655afd9b4fc075a9e -tests: skip TLS 1.3 tests under FIPS mode - -diff --git a/tests/ssl/ssl.sh b/tests/ssl/ssl.sh ---- a/tests/ssl/ssl.sh -+++ b/tests/ssl/ssl.sh -@@ -393,6 +393,15 @@ ssl_auth() - echo "${testname}" | grep "TLS 1.3" > /dev/null - TLS13=$? - -+ # Currently TLS 1.3 tests are known to fail under FIPS mode, -+ # because HKDF is implemented using the PKCS #11 functions -+ # prohibited under FIPS mode. -+ if [ "${TLS13}" -eq 0 ] && \ -+ [ "$SERVER_MODE" = "fips" -o "$CLIENT_MODE" = "fips" ] ; then -+ echo "$SCRIPTNAME: skipping $testname (non-FIPS only)" -+ continue -+ fi -+ - if [ "${CLIENT_MODE}" = "fips" -a "${CAUTH}" -eq 0 ] ; then - echo "$SCRIPTNAME: skipping $testname (non-FIPS only)" - elif [ "$ectype" = "SNI" -a "$NORM_EXT" = "Extended Test" ] ; then diff --git a/nss.spec b/nss.spec index 8ad5353..7b7617f 100644 --- a/nss.spec +++ b/nss.spec @@ -1,4 +1,4 @@ -%global nspr_version 4.21.0 +%global nspr_version 4.22.0 %global nss_version 3.46.0 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools %global saved_files_dir %{_libdir}/nss/saved @@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM", Summary: Network Security Services Name: nss Version: %{nss_version} -Release: 1%{?dist} +Release: 2%{?dist} License: MPLv2.0 URL: http://www.mozilla.org/projects/security/pki/nss/ Requires: nspr >= %{nspr_version} @@ -105,8 +105,6 @@ Patch2: nss-539183.patch # Once the buildroot aha been bootstrapped the patch may be removed # but it doesn't hurt to keep it. Patch4: iquote.patch -# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=1552767 -Patch5: nss-skip-tls13-fips.patch %description Network Security Services (NSS) is a set of libraries designed to @@ -872,6 +870,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Wed Sep 4 2019 Daiki Ueno - 3.46.0-2 +- Rebuild with NSPR 4.22 + * Tue Sep 3 2019 Daiki Ueno - 3.46.0-1 - Update to NSS 3.46 From 19c4c64217f2b1f4a3a1dcbb98cf01168725f01a Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Mon, 21 Oct 2019 13:59:40 +0200 Subject: [PATCH 16/19] Update to NSS 3.46.1 --- .gitignore | 1 + nss.spec | 9 ++++++--- sources | 2 +- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index f245589..8f02c46 100644 --- a/.gitignore +++ b/.gitignore @@ -38,3 +38,4 @@ TestUser51.cert /nss-3.44.tar.gz /nss-3.44.1.tar.gz /nss-3.46.tar.gz +/nss-3.46.1.tar.gz diff --git a/nss.spec b/nss.spec index 7b7617f..c0a132e 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ -%global nspr_version 4.22.0 -%global nss_version 3.46.0 +%global nspr_version 4.23.0 +%global nss_version 3.46.1 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools %global saved_files_dir %{_libdir}/nss/saved %global dracutlibdir %{_prefix}/lib/dracut @@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM", Summary: Network Security Services Name: nss Version: %{nss_version} -Release: 2%{?dist} +Release: 1%{?dist} License: MPLv2.0 URL: http://www.mozilla.org/projects/security/pki/nss/ Requires: nspr >= %{nspr_version} @@ -870,6 +870,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Mon Oct 21 2019 Daiki Ueno - 3.46.1-1 +- Update to NSS 3.46.1 + * Wed Sep 4 2019 Daiki Ueno - 3.46.0-2 - Rebuild with NSPR 4.22 diff --git a/sources b/sources index 7b4873a..cef553a 100644 --- a/sources +++ b/sources @@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310 -SHA512 (nss-3.46.tar.gz) = de309ec8d6aa2c3cf4d5ebfe9fa1f8bf5def717d22018d5c88c1de963b4ae7b0d69ad64e68d830574fc85613483fd538cb2f319ffb3fa2e1b97ec02f85d37c48 +SHA512 (nss-3.46.1.tar.gz) = f4c24f0e31d11413cbbf791a24687c02cd934b9baf4a3e9ce27406638a1d497654fbeec79c22ab4ad29374dd0063c05104c9514580b1b8156ed8d18404e1681b From 5d0976df05799512dcdf4f192fecccf258dfb39a Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Tue, 22 Oct 2019 15:26:47 +0200 Subject: [PATCH 17/19] Update to NSS 3.47 --- .gitignore | 1 + nss.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 8f02c46..db90691 100644 --- a/.gitignore +++ b/.gitignore @@ -39,3 +39,4 @@ TestUser51.cert /nss-3.44.1.tar.gz /nss-3.46.tar.gz /nss-3.46.1.tar.gz +/nss-3.47.tar.gz diff --git a/nss.spec b/nss.spec index c0a132e..d1471b6 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ %global nspr_version 4.23.0 -%global nss_version 3.46.1 +%global nss_version 3.47.0 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools %global saved_files_dir %{_libdir}/nss/saved %global dracutlibdir %{_prefix}/lib/dracut @@ -870,6 +870,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Tue Oct 22 2019 Daiki Ueno - 3.47.0-1 +- Update to NSS 3.47 + * Mon Oct 21 2019 Daiki Ueno - 3.46.1-1 - Update to NSS 3.46.1 diff --git a/sources b/sources index cef553a..324bcf1 100644 --- a/sources +++ b/sources @@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310 -SHA512 (nss-3.46.1.tar.gz) = f4c24f0e31d11413cbbf791a24687c02cd934b9baf4a3e9ce27406638a1d497654fbeec79c22ab4ad29374dd0063c05104c9514580b1b8156ed8d18404e1681b +SHA512 (nss-3.47.tar.gz) = 99d04d28c38092826f5aab125662780865de49a97743ff0ab49a191bafae3ba3a937369cd6909ab23e7dcaf06482c8852b31ef057dc12c758f2681e03822e247 From c9f80f18b163b956bba9a838655be3aca56f24b7 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Wed, 23 Oct 2019 10:44:14 +0200 Subject: [PATCH 18/19] Install cmac.h required by blapi.h (#1764513) --- nss.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/nss.spec b/nss.spec index d1471b6..98168dd 100644 --- a/nss.spec +++ b/nss.spec @@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM", Summary: Network Security Services Name: nss Version: %{nss_version} -Release: 1%{?dist} +Release: 2%{?dist} License: MPLv2.0 URL: http://www.mozilla.org/projects/security/pki/nss/ Requires: nspr >= %{nspr_version} @@ -553,7 +553,7 @@ do done # Copy some freebl include files we also want -for file in blapi.h alghmac.h +for file in blapi.h alghmac.h cmac.h do install -p -m 644 dist/private/nss/$file $RPM_BUILD_ROOT/%{_includedir}/nss3 done @@ -846,6 +846,7 @@ update-crypto-policies &> /dev/null || : %{_includedir}/nss3/blapi.h %{_includedir}/nss3/blapit.h %{_includedir}/nss3/alghmac.h +%{_includedir}/nss3/cmac.h %{_includedir}/nss3/lowkeyi.h %{_includedir}/nss3/lowkeyti.h @@ -870,6 +871,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Wed Oct 23 2019 Daiki Ueno - 3.47.0-2 +- Install cmac.h required by blapi.h (#1764513) + * Tue Oct 22 2019 Daiki Ueno - 3.47.0-1 - Update to NSS 3.47 From ee29250c11c9b55c979b6cea530f69cda29308f6 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Fri, 22 Nov 2019 18:05:57 +0100 Subject: [PATCH 19/19] Update to NSS 3.47.1 --- .gitignore | 1 + nss.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index db90691..2580845 100644 --- a/.gitignore +++ b/.gitignore @@ -40,3 +40,4 @@ TestUser51.cert /nss-3.46.tar.gz /nss-3.46.1.tar.gz /nss-3.47.tar.gz +/nss-3.47.1.tar.gz diff --git a/nss.spec b/nss.spec index 98168dd..3e93589 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ %global nspr_version 4.23.0 -%global nss_version 3.47.0 +%global nss_version 3.47.1 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools %global saved_files_dir %{_libdir}/nss/saved %global dracutlibdir %{_prefix}/lib/dracut @@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM", Summary: Network Security Services Name: nss Version: %{nss_version} -Release: 2%{?dist} +Release: 1%{?dist} License: MPLv2.0 URL: http://www.mozilla.org/projects/security/pki/nss/ Requires: nspr >= %{nspr_version} @@ -871,6 +871,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Fri Nov 22 2019 Daiki Ueno - 3.47.1-1 +- Update to NSS 3.47.1 + * Wed Oct 23 2019 Daiki Ueno - 3.47.0-2 - Install cmac.h required by blapi.h (#1764513) diff --git a/sources b/sources index 324bcf1..e15e2b4 100644 --- a/sources +++ b/sources @@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310 -SHA512 (nss-3.47.tar.gz) = 99d04d28c38092826f5aab125662780865de49a97743ff0ab49a191bafae3ba3a937369cd6909ab23e7dcaf06482c8852b31ef057dc12c758f2681e03822e247 +SHA512 (nss-3.47.1.tar.gz) = ddee53f58929e5f3849c9f88a3a6735453a258c3c32a7e3e73cc949e0b7ad2dff81b21db31c9c5e1ef3eb79d63c31660e38ce76c06ca54a5681dd611dc2e2ae9