From cf4b0540c9ae51048cee89aefada0126827bac5a Mon Sep 17 00:00:00 2001 From: Bob Relyea Date: Wed, 8 Mar 2023 15:21:28 -0800 Subject: [PATCH 01/23] Resolves: rhbz#2176392 CVE-2023-0767 nss: Mozilla: Arbitrary memory write via PKCS 12 in NSS by rebasing to nss 3.88.1, which is already released in f37, f36, and rawhide. --- .gitignore | 1 + nss.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 73aa652..e89f80b 100644 --- a/.gitignore +++ b/.gitignore @@ -77,3 +77,4 @@ TestUser51.cert /nspr-4.35.tar.gz /nss-3.85.tar.gz /nss-3.87.tar.gz +/nss-3.88.1.tar.gz diff --git a/nss.spec b/nss.spec index ff7b7d4..8d4c9a6 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ %global nspr_version 4.35.0 -%global nss_version 3.87.0 +%global nss_version 3.88.1 # NOTE: To avoid NVR clashes of nspr* packages: # - reset %%{nspr_release} to 1, when updating %%{nspr_version} # - increment %%{nspr_version}, when updating the NSS part only @@ -7,7 +7,7 @@ %global nss_release %baserelease # use "%%global nspr_release %%[%%baserelease+n]" to handle offsets when # release number between nss and nspr are different. -%global nspr_release %[%baserelease+2] +%global nspr_release %[%baserelease+3] # only need to update this as we added new # algorithms under nss policy control %global crypto_policies_version 20210118 @@ -1094,6 +1094,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Fri Feb 10 2023 Frantisek Krenzelok - 3.88.1-1 +- Update NSS to 3.88.1 + * Tue Jan 24 2023 Bob Relyea - 3.87.0-2 - Fix rebuild errors diff --git a/sources b/sources index 48fb43b..d91999e 100644 --- a/sources +++ b/sources @@ -1,4 +1,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403fda3e3d4e7757838061ae56ccf5aac335cb54f254f0a9e6e9c0dd5920b4155a39264525b06 SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (nspr-4.35.tar.gz) = 502815833116e25f79ddf71d1526484908aa92fbc55f8a892729cb404a4daafcc0470a89854cd080d2d20299fdb7d9662507c5362c7ae661cbacf308ac56ef7f -SHA512 (nss-3.87.tar.gz) = 4ec7b94e537df109638b821f3a7e3b7bf31d89c3739a6e4c85cad4fab876390ae482971d6f66198818400f467661e86f39dc1d2a4a88077fd81e3a0b7ed64110 +SHA512 (nss-3.88.1.tar.gz) = d15289803a4c3caa1b7a8872b761a95b4f571688c8b8ffaf2a1478e032a356fbcf8a9239ebe1777561503329f63dd237384e1d8af9ca70fb48b40e70954b455a From aaf3397a66c43830ea2b234891a488b76464585b Mon Sep 17 00:00:00 2001 From: Frantisek Krenzelok Date: Fri, 10 Mar 2023 12:37:17 +0100 Subject: [PATCH 02/23] Update NSS to 3.89.0 & remove unused patch Signed-off-by: Frantisek Krenzelok --- .gitignore | 1 + nss-3.85-fedora-rebuild-errors.patch | 24 ------------------------ nss.spec | 10 +++++----- sources | 2 +- 4 files changed, 7 insertions(+), 30 deletions(-) delete mode 100644 nss-3.85-fedora-rebuild-errors.patch diff --git a/.gitignore b/.gitignore index e89f80b..36c04a5 100644 --- a/.gitignore +++ b/.gitignore @@ -78,3 +78,4 @@ TestUser51.cert /nss-3.85.tar.gz /nss-3.87.tar.gz /nss-3.88.1.tar.gz +/nss-3.89.tar.gz diff --git a/nss-3.85-fedora-rebuild-errors.patch b/nss-3.85-fedora-rebuild-errors.patch deleted file mode 100644 index 266a394..0000000 --- a/nss-3.85-fedora-rebuild-errors.patch +++ /dev/null @@ -1,24 +0,0 @@ -diff -up ./lib/ssl/ssl3exthandle.c.rebuild_errors ./lib/ssl/ssl3exthandle.c ---- ./lib/ssl/ssl3exthandle.c.rebuild_errors 2023-01-24 09:26:36.520183263 -0800 -+++ ./lib/ssl/ssl3exthandle.c 2023-01-24 09:27:07.715379228 -0800 -@@ -201,7 +201,7 @@ ssl3_FreeSniNameArray(TLSExtensionData * - * Clients sends a filled in session ticket if one is available, and otherwise - * sends an empty ticket. Servers always send empty tickets. - */ --PRInt32 -+SECStatus - ssl3_ClientSendSessionTicketXtn(const sslSocket *ss, TLSExtensionData *xtnData, - sslBuffer *buf, PRBool *added) - { -diff -up ./lib/ssl/sslsnce.c.rebuild_errors ./lib/ssl/sslsnce.c ---- ./lib/ssl/sslsnce.c.rebuild_errors 2023-01-24 09:44:52.714977837 -0800 -+++ ./lib/ssl/sslsnce.c 2023-01-24 09:46:20.993510435 -0800 -@@ -1820,7 +1820,7 @@ ssl_GetSelfEncryptKeyPair(SECKEYPublicKe - return SECSuccess; - } - --static PRBool -+static SECStatus - ssl_GenerateSelfEncryptKeys(void *pwArg, PRUint8 *keyName, - PK11SymKey **aesKey, PK11SymKey **macKey); - diff --git a/nss.spec b/nss.spec index 8d4c9a6..f99f80a 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ %global nspr_version 4.35.0 -%global nss_version 3.88.1 +%global nss_version 3.89.0 # NOTE: To avoid NVR clashes of nspr* packages: # - reset %%{nspr_release} to 1, when updating %%{nspr_version} # - increment %%{nspr_version}, when updating the NSS part only @@ -7,7 +7,7 @@ %global nss_release %baserelease # use "%%global nspr_release %%[%%baserelease+n]" to handle offsets when # release number between nss and nspr are different. -%global nspr_release %[%baserelease+3] +%global nspr_release %[%baserelease+4] # only need to update this as we added new # algorithms under nss policy control %global crypto_policies_version 20210118 @@ -134,9 +134,6 @@ Patch40: nss-no-dbm-man-page.patch # https://bugzilla.mozilla.org/show_bug.cgi?id=1774659 Patch51: nss-3.79-dbtool.patch -# fix rebuilds error -Patch52: nss-3.85-fedora-rebuild-errors.patch - Patch100: nspr-config-pc.patch Patch101: nspr-gcc-atomics.patch @@ -1094,6 +1091,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Fri Mar 10 2023 Frantisek Krenzelok - 3.89.0-1 +- Update NSS to 3.89.0 + * Fri Feb 10 2023 Frantisek Krenzelok - 3.88.1-1 - Update NSS to 3.88.1 diff --git a/sources b/sources index d91999e..1e9ca85 100644 --- a/sources +++ b/sources @@ -1,4 +1,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403fda3e3d4e7757838061ae56ccf5aac335cb54f254f0a9e6e9c0dd5920b4155a39264525b06 SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (nspr-4.35.tar.gz) = 502815833116e25f79ddf71d1526484908aa92fbc55f8a892729cb404a4daafcc0470a89854cd080d2d20299fdb7d9662507c5362c7ae661cbacf308ac56ef7f -SHA512 (nss-3.88.1.tar.gz) = d15289803a4c3caa1b7a8872b761a95b4f571688c8b8ffaf2a1478e032a356fbcf8a9239ebe1777561503329f63dd237384e1d8af9ca70fb48b40e70954b455a +SHA512 (nss-3.89.tar.gz) = 1db06d4575f2c16d2a0629007981211e714f99c014c0a6256dd33d0caf8c809ba8d5be204d018f9d1cc99b9fcd055ac1fb99b399486ed43c9cf3f55f2747de82 From 5dbb40f0054d69a72a3d36229bc671e81088c394 Mon Sep 17 00:00:00 2001 From: Frantisek Krenzelok Date: Fri, 10 Mar 2023 12:37:17 +0100 Subject: [PATCH 03/23] Update NSS to 3.89.0 & remove unused patch Signed-off-by: Frantisek Krenzelok --- .gitignore | 1 + nss-3.85-fedora-rebuild-errors.patch | 24 ------------------------ nss.spec | 12 ++++++------ sources | 2 +- 4 files changed, 8 insertions(+), 31 deletions(-) delete mode 100644 nss-3.85-fedora-rebuild-errors.patch diff --git a/.gitignore b/.gitignore index e89f80b..36c04a5 100644 --- a/.gitignore +++ b/.gitignore @@ -78,3 +78,4 @@ TestUser51.cert /nss-3.85.tar.gz /nss-3.87.tar.gz /nss-3.88.1.tar.gz +/nss-3.89.tar.gz diff --git a/nss-3.85-fedora-rebuild-errors.patch b/nss-3.85-fedora-rebuild-errors.patch deleted file mode 100644 index 266a394..0000000 --- a/nss-3.85-fedora-rebuild-errors.patch +++ /dev/null @@ -1,24 +0,0 @@ -diff -up ./lib/ssl/ssl3exthandle.c.rebuild_errors ./lib/ssl/ssl3exthandle.c ---- ./lib/ssl/ssl3exthandle.c.rebuild_errors 2023-01-24 09:26:36.520183263 -0800 -+++ ./lib/ssl/ssl3exthandle.c 2023-01-24 09:27:07.715379228 -0800 -@@ -201,7 +201,7 @@ ssl3_FreeSniNameArray(TLSExtensionData * - * Clients sends a filled in session ticket if one is available, and otherwise - * sends an empty ticket. Servers always send empty tickets. - */ --PRInt32 -+SECStatus - ssl3_ClientSendSessionTicketXtn(const sslSocket *ss, TLSExtensionData *xtnData, - sslBuffer *buf, PRBool *added) - { -diff -up ./lib/ssl/sslsnce.c.rebuild_errors ./lib/ssl/sslsnce.c ---- ./lib/ssl/sslsnce.c.rebuild_errors 2023-01-24 09:44:52.714977837 -0800 -+++ ./lib/ssl/sslsnce.c 2023-01-24 09:46:20.993510435 -0800 -@@ -1820,7 +1820,7 @@ ssl_GetSelfEncryptKeyPair(SECKEYPublicKe - return SECSuccess; - } - --static PRBool -+static SECStatus - ssl_GenerateSelfEncryptKeys(void *pwArg, PRUint8 *keyName, - PK11SymKey **aesKey, PK11SymKey **macKey); - diff --git a/nss.spec b/nss.spec index 8d4c9a6..5da7af5 100644 --- a/nss.spec +++ b/nss.spec @@ -1,13 +1,13 @@ %global nspr_version 4.35.0 -%global nss_version 3.88.1 +%global nss_version 3.89.0 # NOTE: To avoid NVR clashes of nspr* packages: # - reset %%{nspr_release} to 1, when updating %%{nspr_version} # - increment %%{nspr_version}, when updating the NSS part only -%global baserelease 2 +%global baserelease 1 %global nss_release %baserelease # use "%%global nspr_release %%[%%baserelease+n]" to handle offsets when # release number between nss and nspr are different. -%global nspr_release %[%baserelease+3] +%global nspr_release %[%baserelease+4] # only need to update this as we added new # algorithms under nss policy control %global crypto_policies_version 20210118 @@ -134,9 +134,6 @@ Patch40: nss-no-dbm-man-page.patch # https://bugzilla.mozilla.org/show_bug.cgi?id=1774659 Patch51: nss-3.79-dbtool.patch -# fix rebuilds error -Patch52: nss-3.85-fedora-rebuild-errors.patch - Patch100: nspr-config-pc.patch Patch101: nspr-gcc-atomics.patch @@ -1094,6 +1091,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Fri Mar 10 2023 Frantisek Krenzelok - 3.89.0-1 +- Update NSS to 3.89.0 + * Fri Feb 10 2023 Frantisek Krenzelok - 3.88.1-1 - Update NSS to 3.88.1 diff --git a/sources b/sources index d91999e..1e9ca85 100644 --- a/sources +++ b/sources @@ -1,4 +1,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403fda3e3d4e7757838061ae56ccf5aac335cb54f254f0a9e6e9c0dd5920b4155a39264525b06 SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (nspr-4.35.tar.gz) = 502815833116e25f79ddf71d1526484908aa92fbc55f8a892729cb404a4daafcc0470a89854cd080d2d20299fdb7d9662507c5362c7ae661cbacf308ac56ef7f -SHA512 (nss-3.88.1.tar.gz) = d15289803a4c3caa1b7a8872b761a95b4f571688c8b8ffaf2a1478e032a356fbcf8a9239ebe1777561503329f63dd237384e1d8af9ca70fb48b40e70954b455a +SHA512 (nss-3.89.tar.gz) = 1db06d4575f2c16d2a0629007981211e714f99c014c0a6256dd33d0caf8c809ba8d5be204d018f9d1cc99b9fcd055ac1fb99b399486ed43c9cf3f55f2747de82 From 39d0b6e8df7ab5788eccf433a9c1eb2646cf375c Mon Sep 17 00:00:00 2001 From: Frantisek Krenzelok Date: Fri, 5 May 2023 15:13:05 +0200 Subject: [PATCH 04/23] Use %{nss_version} explicitly insted of %{version} Use nss_version explicitly as version is overiden by nspr_version durring execution of spec Signed-off-by: Frantisek Krenzelok --- nss.spec | 33 ++++++++++++++++++--------------- 1 file changed, 18 insertions(+), 15 deletions(-) diff --git a/nss.spec b/nss.spec index 5da7af5..7464ee6 100644 --- a/nss.spec +++ b/nss.spec @@ -147,7 +147,7 @@ v3 certificates, and other security standards. %package tools Summary: Tools for the Network Security Services -Requires: %{name}%{?_isa} = %{version}-%{release} +Requires: %{name}%{?_isa} = %{nss_version}-%{release} %description tools Network Security Services (NSS) is a set of libraries designed to @@ -164,7 +164,7 @@ Summary: System NSS Initialization # providing nss-system-init without version so that it can # be replaced by a better one, e.g. supplied by the os vendor Provides: nss-system-init -Requires: nss%{?_isa} = %{version}-%{release} +Requires: nss%{?_isa} = %{nss_version}-%{release} Requires(post): coreutils, sed %description sysinit @@ -175,8 +175,8 @@ any system or user configured modules. %package devel Summary: Development libraries for Network Security Services -Provides: nss-static = %{version}-%{release} -Requires: nss%{?_isa} = %{version}-%{release} +Provides: nss-static = %{nss_version}-%{release} +Requires: nss%{?_isa} = %{nss_version}-%{release} Requires: nss-util-devel Requires: nss-softokn-devel Requires: nspr-devel >= %{nspr_version} @@ -189,9 +189,9 @@ Header and Library files for doing development with Network Security Services. %package pkcs11-devel Summary: Development libraries for PKCS #11 (Cryptoki) using NSS -Provides: nss-pkcs11-devel-static = %{version}-%{release} -Requires: nss-devel = %{version}-%{release} -Requires: nss-softokn-freebl-devel = %{version}-%{release} +Provides: nss-pkcs11-devel-static = %{nss_version}-%{release} +Requires: nss-devel = %{nss_version}-%{release} +Requires: nss-softokn-freebl-devel = %{nss_version}-%{release} %description pkcs11-devel Library files for developing PKCS #11 modules using basic NSS @@ -207,7 +207,7 @@ Utilities for Network Security Services and the Softoken module %package util-devel Summary: Development libraries for Network Security Services Utilities -Requires: nss-util%{?_isa} = %{version}-%{release} +Requires: nss-util%{?_isa} = %{nss_version}-%{release} Requires: nspr-devel >= %{nspr_version} Requires: pkgconfig @@ -218,8 +218,8 @@ Header and library files for doing development with Network Security Services. %package softokn Summary: Network Security Services Softoken Module Requires: nspr >= %{nspr_version} -Requires: nss-util >= %{version}-%{release} -Requires: nss-softokn-freebl%{_isa} >= %{version}-%{release} +Requires: nss-util >= %{nss_version}-%{release} +Requires: nss-softokn-freebl%{_isa} >= %{nss_version}-%{release} %description softokn Network Security Services Softoken Cryptographic Module @@ -240,8 +240,8 @@ Install the nss-softokn-freebl package if you need the freebl library. %package softokn-freebl-devel Summary: Header and Library files for doing development with the Freebl library for NSS -Provides: nss-softokn-freebl-static = %{version}-%{release} -Requires: nss-softokn-freebl%{?_isa} = %{version}-%{release} +Provides: nss-softokn-freebl-static = %{nss_version}-%{release} +Requires: nss-softokn-freebl%{?_isa} = %{nss_version}-%{release} %description softokn-freebl-devel NSS Softoken Cryptographic Module Freebl Library Development Tools @@ -252,10 +252,10 @@ Developers should rely only on the officially supported NSS public API. %package softokn-devel Summary: Development libraries for Network Security Services -Requires: nss-softokn%{?_isa} = %{version}-%{release} -Requires: nss-softokn-freebl-devel%{?_isa} = %{version}-%{release} +Requires: nss-softokn%{?_isa} = %{nss_version}-%{release} +Requires: nss-softokn-freebl-devel%{?_isa} = %{nss_version}-%{release} Requires: nspr-devel >= %{nspr_version} -Requires: nss-util-devel >= %{version}-%{release} +Requires: nss-util-devel >= %{nss_version}-%{release} Requires: pkgconfig %description softokn-devel @@ -1091,6 +1091,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Fri May 5 2023 Frantisek Krenzelok - 3.89.0-1 +- replace %{version} with %{nss_version} as it version can be overiden. + * Fri Mar 10 2023 Frantisek Krenzelok - 3.89.0-1 - Update NSS to 3.89.0 From a515c1ef8a2d0d437e2c889427df63d1527adc87 Mon Sep 17 00:00:00 2001 From: Frantisek Krenzelok Date: Fri, 5 May 2023 18:14:19 +0200 Subject: [PATCH 05/23] Combine nss and nspr source togeather Mozilla provides a package that has both utilities Signed-off-by: Frantisek Krenzelok --- .gitignore | 1 + nss.spec | 12 ++++++------ sources | 3 +-- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.gitignore b/.gitignore index 36c04a5..d85a5a4 100644 --- a/.gitignore +++ b/.gitignore @@ -79,3 +79,4 @@ TestUser51.cert /nss-3.87.tar.gz /nss-3.88.1.tar.gz /nss-3.89.tar.gz +/nss-3.89-with-nspr-4.35.tar.gz diff --git a/nss.spec b/nss.spec index 7464ee6..580ac12 100644 --- a/nss.spec +++ b/nss.spec @@ -57,6 +57,8 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM", string.gsub(rpm.expand("%nss_archive_version"), "%.", "_"))) } +%global nss_nspr_archive nss-%{nss_archive_version}-with-nspr-%{nspr_archive_version} + Summary: Network Security Services Name: nss Version: %{nss_version} @@ -82,7 +84,7 @@ BuildRequires: psmisc BuildRequires: perl-interpreter BuildRequires: gcc-c++ -Source0: https://ftp.mozilla.org/pub/security/nss/releases/%{nss_release_tag}/src/%{name}-%{nss_archive_version}.tar.gz +Source0: https://ftp.mozilla.org/pub/security/nss/releases/%{nss_release_tag}/src/%{nss_nspr_archive}.tar.gz Source1: nss-util.pc.in Source2: nss-util-config.in Source3: nss-softokn.pc.in @@ -112,7 +114,6 @@ Source27: secmod.db.xml %endif Source28: nss-p11-kit.config -Source100: nspr-%{nspr_archive_version}.tar.gz Source101: nspr-config.xml # This patch uses the GCC -iquote option documented at @@ -288,12 +289,8 @@ Conflicts: filesystem < 3 %description -n nspr-devel Header files for doing development with the Netscape Portable Runtime. - %prep -%setup -q -T -b 100 -n nspr-%{nspr_archive_version} - %setup -q -T -b 0 -n %{name}-%{nss_archive_version} -mv ../nspr-%{nspr_archive_version}/nspr . cp ./nspr/config/nspr-config.in ./nspr/config/nspr-config-pc.in %patch100 -p0 -b .flags @@ -1091,6 +1088,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Fri May 5 2023 Frantisek Krenzelok - 3.89.0-1 +- combine nss and nspr source togeather + * Fri May 5 2023 Frantisek Krenzelok - 3.89.0-1 - replace %{version} with %{nss_version} as it version can be overiden. diff --git a/sources b/sources index 1e9ca85..90039d1 100644 --- a/sources +++ b/sources @@ -1,4 +1,3 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403fda3e3d4e7757838061ae56ccf5aac335cb54f254f0a9e6e9c0dd5920b4155a39264525b06 SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 -SHA512 (nspr-4.35.tar.gz) = 502815833116e25f79ddf71d1526484908aa92fbc55f8a892729cb404a4daafcc0470a89854cd080d2d20299fdb7d9662507c5362c7ae661cbacf308ac56ef7f -SHA512 (nss-3.89.tar.gz) = 1db06d4575f2c16d2a0629007981211e714f99c014c0a6256dd33d0caf8c809ba8d5be204d018f9d1cc99b9fcd055ac1fb99b399486ed43c9cf3f55f2747de82 +SHA512 (nss-3.89-with-nspr-4.35.tar.gz) = 3c7fc3062baf577473001f6a2724bae14c809d725c4ae8d90a6de1ef84c6d1c2276efe09f4112241d7b3c32b0c6d529eb87739ca02b8002e3bed3081f06cdff4 From 83e6b23140c18ed80f0c65ef81bcfa3de58813db Mon Sep 17 00:00:00 2001 From: Frantisek Krenzelok Date: Mon, 5 Jun 2023 11:01:36 +0200 Subject: [PATCH 06/23] Update NSS to 3.90.0 Signed-off-by: Frantisek Krenzelok --- .gitignore | 1 + nss-signtool-format.patch | 4 ++-- nss.spec | 7 +++++-- sources | 2 +- 4 files changed, 9 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index d85a5a4..9550e81 100644 --- a/.gitignore +++ b/.gitignore @@ -80,3 +80,4 @@ TestUser51.cert /nss-3.88.1.tar.gz /nss-3.89.tar.gz /nss-3.89-with-nspr-4.35.tar.gz +/nss-3.90-with-nspr-4.35.tar.gz diff --git a/nss-signtool-format.patch b/nss-signtool-format.patch index 5f146f1..f81d35c 100644 --- a/nss-signtool-format.patch +++ b/nss-signtool-format.patch @@ -10,7 +10,7 @@ diff --git a/cmd/modutil/install.c b/cmd/modutil/install.c /* Recursively delete all entries in the directory */ while ((entry = PR_ReadDir(dir, PR_SKIP_BOTH)) != NULL) { -- sprintf(filename, "%s/%s", path, entry->name); +- snprintf(filename, sizeof(filename), "%s/%s", path, entry->name); + if (snprintf(filename, sizeof(filename), "%s/%s", path, entry->name) >= sizeof(filename)) { + PR_CloseDir(dir); + return -1; @@ -29,7 +29,7 @@ diff --git a/cmd/signtool/util.c b/cmd/signtool/util.c @@ -138,6 +138,12 @@ rm_dash_r(char *path) /* Recursively delete all entries in the directory */ while ((entry = PR_ReadDir(dir, PR_SKIP_BOTH)) != NULL) { - sprintf(filename, "%s/%s", path, entry->name); + snprintf(filename, sizeof(filename), "%s/%s", path, entry->name); + if (snprintf(filename, sizeof(filename), "%s/%s", path, entry->name +) >= sizeof(filename)) { + errorCount++; diff --git a/nss.spec b/nss.spec index 580ac12..31bcc99 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ %global nspr_version 4.35.0 -%global nss_version 3.89.0 +%global nss_version 3.90.0 # NOTE: To avoid NVR clashes of nspr* packages: # - reset %%{nspr_release} to 1, when updating %%{nspr_version} # - increment %%{nspr_version}, when updating the NSS part only @@ -7,7 +7,7 @@ %global nss_release %baserelease # use "%%global nspr_release %%[%%baserelease+n]" to handle offsets when # release number between nss and nspr are different. -%global nspr_release %[%baserelease+4] +%global nspr_release %[%baserelease+0] # only need to update this as we added new # algorithms under nss policy control %global crypto_policies_version 20210118 @@ -1088,6 +1088,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Mon Jun 5 2023 Frantisek Krenzelok - 3.90.0-1 +- Update NSS to 3.90.0 + * Fri May 5 2023 Frantisek Krenzelok - 3.89.0-1 - combine nss and nspr source togeather diff --git a/sources b/sources index 90039d1..126d634 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403fda3e3d4e7757838061ae56ccf5aac335cb54f254f0a9e6e9c0dd5920b4155a39264525b06 SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 -SHA512 (nss-3.89-with-nspr-4.35.tar.gz) = 3c7fc3062baf577473001f6a2724bae14c809d725c4ae8d90a6de1ef84c6d1c2276efe09f4112241d7b3c32b0c6d529eb87739ca02b8002e3bed3081f06cdff4 +SHA512 (nss-3.90-with-nspr-4.35.tar.gz) = cbc75af3d3e1bf084011d435f0957d134cb3d3d66dcee45f9712ed22b470035ba1e808fc6457e8dc0d8d8e168d77d1117a4373d42905130f76ea58217ff88e30 From 1cf21376e78a7829f13f19cad1fda4174b1c94fa Mon Sep 17 00:00:00 2001 From: Frantisek Krenzelok Date: Mon, 5 Jun 2023 13:46:43 +0200 Subject: [PATCH 07/23] Update %patch syntax The syntax was changed from `%patch` to `%patch ` Signed-off-by: Frantisek Krenzelok --- nss.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/nss.spec b/nss.spec index 31bcc99..f452485 100644 --- a/nss.spec +++ b/nss.spec @@ -293,9 +293,9 @@ Header files for doing development with the Netscape Portable Runtime. %setup -q -T -b 0 -n %{name}-%{nss_archive_version} cp ./nspr/config/nspr-config.in ./nspr/config/nspr-config-pc.in -%patch100 -p0 -b .flags +%patch 100 -p0 -b .flags pushd nspr -%patch101 -p1 -b .gcc-atomics +%patch 101 -p1 -b .gcc-atomics popd pushd nss @@ -1088,6 +1088,10 @@ update-crypto-policies &> /dev/null || : %changelog + +* Mon Jun 5 2023 Frantisek Krenzelok - 3.90.0-1 +- Update %patch syntax + * Mon Jun 5 2023 Frantisek Krenzelok - 3.90.0-1 - Update NSS to 3.90.0 From c9d01a43937e530ec77ccd66ee6cbd80dac3094f Mon Sep 17 00:00:00 2001 From: Frantisek Krenzelok Date: Tue, 6 Jun 2023 08:48:06 +0200 Subject: [PATCH 08/23] Fix: add condition for architecture specific assebly feature Upstream bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1836781 Additional bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1836925 Signed-off-by: Frantisek Krenzelok --- nss-3.90-DisablingASM.patch | 36 ++++++++++++++++++++++++++++++++++++ nss.spec | 7 +++++++ 2 files changed, 43 insertions(+) create mode 100644 nss-3.90-DisablingASM.patch diff --git a/nss-3.90-DisablingASM.patch b/nss-3.90-DisablingASM.patch new file mode 100644 index 0000000..3574a47 --- /dev/null +++ b/nss-3.90-DisablingASM.patch @@ -0,0 +1,36 @@ +diff --git a/lib/freebl/Makefile b/lib/freebl/Makefile +--- a/lib/freebl/Makefile ++++ b/lib/freebl/Makefile +@@ -560,6 +560,9 @@ else + endif # Solaris for non-sparc family CPUs + endif # target == SunO + ++# As the result of the bug https://bugzilla.mozilla.org/show_bug.cgi?id=1836925 ++# we currently totally removing the support of Vale implementation of Curve25519 ++SUPPORTS_VALE_CURVE25519 = 0 + ifdef USE_64 + # no __int128 at least up to lcc 1.23 (pretending to be gcc5) + # NB: CC_NAME is not defined here +@@ -568,7 +571,6 @@ ifneq ($(shell $(CC) -? 2>&1 >/dev/null /dev/null || : %changelog +* Thu Jun 6 2023 Frantisek Krenzelok - 3.90.0-1 +- Add patch for https://bugzilla.mozilla.org/show_bug.cgi?id=1836781 & + https://bugzilla.mozilla.org/show_bug.cgi?id=1836925 * Mon Jun 5 2023 Frantisek Krenzelok - 3.90.0-1 - Update %patch syntax From 7cf2a945243842d6a1ddc185af7719f6cda4db5d Mon Sep 17 00:00:00 2001 From: Frantisek Krenzelok Date: Tue, 6 Jun 2023 12:49:30 +0200 Subject: [PATCH 09/23] Hotfix: previous commit 2bdda3a Signed-off-by: Frantisek Krenzelok --- nss-3.90-DisablingASM.patch | 45 +++++++++++++++++++++++++++---------- nss.spec | 2 +- 2 files changed, 34 insertions(+), 13 deletions(-) diff --git a/nss-3.90-DisablingASM.patch b/nss-3.90-DisablingASM.patch index 3574a47..7d1a17f 100644 --- a/nss-3.90-DisablingASM.patch +++ b/nss-3.90-DisablingASM.patch @@ -1,17 +1,8 @@ diff --git a/lib/freebl/Makefile b/lib/freebl/Makefile +index 74e8e65..8995752 100644 --- a/lib/freebl/Makefile +++ b/lib/freebl/Makefile -@@ -560,6 +560,9 @@ else - endif # Solaris for non-sparc family CPUs - endif # target == SunO - -+# As the result of the bug https://bugzilla.mozilla.org/show_bug.cgi?id=1836925 -+# we currently totally removing the support of Vale implementation of Curve25519 -+SUPPORTS_VALE_CURVE25519 = 0 - ifdef USE_64 - # no __int128 at least up to lcc 1.23 (pretending to be gcc5) - # NB: CC_NAME is not defined here -@@ -568,7 +571,6 @@ ifneq ($(shell $(CC) -? 2>&1 >/dev/null &1 >/dev/null /dev/null || : %changelog -* Thu Jun 6 2023 Frantisek Krenzelok - 3.90.0-1 +* Tue Jun 6 2023 Frantisek Krenzelok - 3.90.0-1 - Add patch for https://bugzilla.mozilla.org/show_bug.cgi?id=1836781 & https://bugzilla.mozilla.org/show_bug.cgi?id=1836925 From 6daa59b62e4a077c96a06e5b4deccb344bb48e7d Mon Sep 17 00:00:00 2001 From: Frantisek Krenzelok Date: Wed, 7 Jun 2023 15:18:35 +0200 Subject: [PATCH 10/23] Bump nspr baserelease number --- nss.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nss.spec b/nss.spec index f3555b4..1d6343c 100644 --- a/nss.spec +++ b/nss.spec @@ -7,7 +7,7 @@ %global nss_release %baserelease # use "%%global nspr_release %%[%%baserelease+n]" to handle offsets when # release number between nss and nspr are different. -%global nspr_release %[%baserelease+0] +%global nspr_release %[%baserelease+5] # only need to update this as we added new # algorithms under nss policy control %global crypto_policies_version 20210118 From cceb446af15fa740f9b9947393f5f86135337858 Mon Sep 17 00:00:00 2001 From: Frantisek Krenzelok Date: Wed, 7 Jun 2023 21:21:18 +0200 Subject: [PATCH 11/23] Bump the nspr version once more.. --- nss.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nss.spec b/nss.spec index 1d6343c..e52df88 100644 --- a/nss.spec +++ b/nss.spec @@ -7,7 +7,7 @@ %global nss_release %baserelease # use "%%global nspr_release %%[%%baserelease+n]" to handle offsets when # release number between nss and nspr are different. -%global nspr_release %[%baserelease+5] +%global nspr_release %[%baserelease+6] # only need to update this as we added new # algorithms under nss policy control %global crypto_policies_version 20210118 From 6138fa9218619732377c30536e1a75b8e342c6db Mon Sep 17 00:00:00 2001 From: Frantisek Krenzelok Date: Tue, 13 Jun 2023 12:37:56 +0200 Subject: [PATCH 12/23] Explicitly specify the doc files for nspr-devel nspr-devel now contains only the nspr relevant docs instead of all the docs. Signed-off-by: Frantisek Krenzelok --- nss.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nss.spec b/nss.spec index e52df88..e9e22f6 100644 --- a/nss.spec +++ b/nss.spec @@ -1088,7 +1088,7 @@ update-crypto-policies &> /dev/null || : %{_includedir}/nspr4 %{_libdir}/pkgconfig/nspr.pc %{_bindir}/nspr-config -%{_mandir}/man*/* +%doc %{_mandir}/man1/nspr-config.* %changelog From e3ac43e23f00e23993b7113127a338a2c1a862f9 Mon Sep 17 00:00:00 2001 From: Frantisek Krenzelok Date: Tue, 4 Jul 2023 15:41:56 +0200 Subject: [PATCH 13/23] Update NSS to 3.91.0 Signed-off-by: Frantisek Krenzelok --- .gitignore | 1 + nss-3.90-DisablingASM.patch | 57 ------------------------------------- nss.spec | 11 ++++--- sources | 2 +- 4 files changed, 7 insertions(+), 64 deletions(-) delete mode 100644 nss-3.90-DisablingASM.patch diff --git a/.gitignore b/.gitignore index 9550e81..2577afd 100644 --- a/.gitignore +++ b/.gitignore @@ -81,3 +81,4 @@ TestUser51.cert /nss-3.89.tar.gz /nss-3.89-with-nspr-4.35.tar.gz /nss-3.90-with-nspr-4.35.tar.gz +/nss-3.91-with-nspr-4.35.tar.gz diff --git a/nss-3.90-DisablingASM.patch b/nss-3.90-DisablingASM.patch deleted file mode 100644 index 7d1a17f..0000000 --- a/nss-3.90-DisablingASM.patch +++ /dev/null @@ -1,57 +0,0 @@ -diff --git a/lib/freebl/Makefile b/lib/freebl/Makefile -index 74e8e65..8995752 100644 ---- a/lib/freebl/Makefile -+++ b/lib/freebl/Makefile -@@ -568,7 +568,6 @@ ifneq ($(shell $(CC) -? 2>&1 >/dev/null /dev/null || : %changelog +* Tue Jul 4 2023 Frantisek Krenzelok - 3.91.0-1 +- Update NSS to 3.91.0 + * Tue Jun 6 2023 Frantisek Krenzelok - 3.90.0-1 - Add patch for https://bugzilla.mozilla.org/show_bug.cgi?id=1836781 & https://bugzilla.mozilla.org/show_bug.cgi?id=1836925 diff --git a/sources b/sources index 126d634..e6a5c5c 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403fda3e3d4e7757838061ae56ccf5aac335cb54f254f0a9e6e9c0dd5920b4155a39264525b06 SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 -SHA512 (nss-3.90-with-nspr-4.35.tar.gz) = cbc75af3d3e1bf084011d435f0957d134cb3d3d66dcee45f9712ed22b470035ba1e808fc6457e8dc0d8d8e168d77d1117a4373d42905130f76ea58217ff88e30 +SHA512 (nss-3.91-with-nspr-4.35.tar.gz) = e408dacfa51522b254cc28abc9a2188a05a9d34367e2c770d2bfea0727c7e0073e335a0cdf86f990ab246c331d2c85e1f787c66a1f9aa2fbb0163e6021fb7a37 From 1fc32a789f11990f7de3aeea341dc4cb3af754ee Mon Sep 17 00:00:00 2001 From: Frantisek Krenzelok Date: Tue, 1 Aug 2023 17:05:32 +0200 Subject: [PATCH 14/23] Update NSS to 3.92.0 Signed-off-by: Frantisek Krenzelok --- .gitignore | 1 + nss.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 2577afd..5db6588 100644 --- a/.gitignore +++ b/.gitignore @@ -82,3 +82,4 @@ TestUser51.cert /nss-3.89-with-nspr-4.35.tar.gz /nss-3.90-with-nspr-4.35.tar.gz /nss-3.91-with-nspr-4.35.tar.gz +/nss-3.92-with-nspr-4.35.tar.gz diff --git a/nss.spec b/nss.spec index 40d1c04..d7ed5ba 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ %global nspr_version 4.35.0 -%global nss_version 3.91.0 +%global nss_version 3.92.0 # NOTE: To avoid NVR clashes of nspr* packages: # - reset %%{nspr_release} to 1, when updating %%{nspr_version} # - increment %%{nspr_version}, when updating the NSS part only @@ -7,7 +7,7 @@ %global nss_release %baserelease # use "%%global nspr_release %%[%%baserelease+n]" to handle offsets when # release number between nss and nspr are different. -%global nspr_release %[%baserelease+7] +%global nspr_release %[%baserelease+8] # only need to update this as we added new # algorithms under nss policy control %global crypto_policies_version 20210118 @@ -1088,6 +1088,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Tue Aug 1 2023 Frantisek Krenzelok - 3.92.0-1 +- Update NSS to 3.92.0 + * Tue Jul 4 2023 Frantisek Krenzelok - 3.91.0-1 - Update NSS to 3.91.0 diff --git a/sources b/sources index e6a5c5c..a90f69d 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403fda3e3d4e7757838061ae56ccf5aac335cb54f254f0a9e6e9c0dd5920b4155a39264525b06 SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 -SHA512 (nss-3.91-with-nspr-4.35.tar.gz) = e408dacfa51522b254cc28abc9a2188a05a9d34367e2c770d2bfea0727c7e0073e335a0cdf86f990ab246c331d2c85e1f787c66a1f9aa2fbb0163e6021fb7a37 +SHA512 (nss-3.92-with-nspr-4.35.tar.gz) = 72810b62cea08c40200ea499a478e05483fa2b336f516c15776beb1ad7f8e8a7b69da8ffb7688f2b50a4725c1973d1c34e53a94e55657d2c4496b593af8959b1 From 151578d700694c17aff030c5702c02a5489147ad Mon Sep 17 00:00:00 2001 From: Krenzelok Frantisek Date: Thu, 31 Aug 2023 04:36:41 +0200 Subject: [PATCH 15/23] Update NSS to 3.93.0 --- .gitignore | 1 + nss.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 5db6588..5cfabf8 100644 --- a/.gitignore +++ b/.gitignore @@ -83,3 +83,4 @@ TestUser51.cert /nss-3.90-with-nspr-4.35.tar.gz /nss-3.91-with-nspr-4.35.tar.gz /nss-3.92-with-nspr-4.35.tar.gz +/nss-3.93-with-nspr-4.35.tar.gz diff --git a/nss.spec b/nss.spec index d7ed5ba..1a9e6a4 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ %global nspr_version 4.35.0 -%global nss_version 3.92.0 +%global nss_version 3.93.0 # NOTE: To avoid NVR clashes of nspr* packages: # - reset %%{nspr_release} to 1, when updating %%{nspr_version} # - increment %%{nspr_version}, when updating the NSS part only @@ -7,7 +7,7 @@ %global nss_release %baserelease # use "%%global nspr_release %%[%%baserelease+n]" to handle offsets when # release number between nss and nspr are different. -%global nspr_release %[%baserelease+8] +%global nspr_release %[%baserelease+9] # only need to update this as we added new # algorithms under nss policy control %global crypto_policies_version 20210118 @@ -1088,6 +1088,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Thu Aug 31 2023 Frantisek Krenzelok - 3.93.0-1 +- Update NSS to 3.93.0 + * Tue Aug 1 2023 Frantisek Krenzelok - 3.92.0-1 - Update NSS to 3.92.0 diff --git a/sources b/sources index a90f69d..d342e47 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403fda3e3d4e7757838061ae56ccf5aac335cb54f254f0a9e6e9c0dd5920b4155a39264525b06 SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 -SHA512 (nss-3.92-with-nspr-4.35.tar.gz) = 72810b62cea08c40200ea499a478e05483fa2b336f516c15776beb1ad7f8e8a7b69da8ffb7688f2b50a4725c1973d1c34e53a94e55657d2c4496b593af8959b1 +SHA512 (nss-3.93-with-nspr-4.35.tar.gz) = efe85e09021ca363df35d092b32463b359b2a23fc6e761949e944ba4209b09bdf007fc69015086a278c999411d62b9dba6fbedfb8a7c962ed40e406de45bc28e From 424e5a348acbdf9f4c045a03e6fe3a758bed9d61 Mon Sep 17 00:00:00 2001 From: Krenzelok Frantisek Date: Wed, 4 Oct 2023 08:07:50 +0200 Subject: [PATCH 16/23] Update NSS to 3.94.0 --- .gitignore | 1 + nss.spec | 10 +++++----- sources | 2 +- 3 files changed, 7 insertions(+), 6 deletions(-) diff --git a/.gitignore b/.gitignore index 5cfabf8..61e1690 100644 --- a/.gitignore +++ b/.gitignore @@ -84,3 +84,4 @@ TestUser51.cert /nss-3.91-with-nspr-4.35.tar.gz /nss-3.92-with-nspr-4.35.tar.gz /nss-3.93-with-nspr-4.35.tar.gz +/nss-3.94-with-nspr-4.35.tar.gz diff --git a/nss.spec b/nss.spec index 1a9e6a4..bc2721e 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ %global nspr_version 4.35.0 -%global nss_version 3.93.0 +%global nss_version 3.94.0 # NOTE: To avoid NVR clashes of nspr* packages: # - reset %%{nspr_release} to 1, when updating %%{nspr_version} # - increment %%{nspr_version}, when updating the NSS part only @@ -7,7 +7,7 @@ %global nss_release %baserelease # use "%%global nspr_release %%[%%baserelease+n]" to handle offsets when # release number between nss and nspr are different. -%global nspr_release %[%baserelease+9] +%global nspr_release %[%baserelease+10] # only need to update this as we added new # algorithms under nss policy control %global crypto_policies_version 20210118 @@ -132,9 +132,6 @@ Patch12: nss-signtool-format.patch # fedora disabled dbm by default Patch40: nss-no-dbm-man-page.patch -# https://bugzilla.mozilla.org/show_bug.cgi?id=1774659 -Patch51: nss-3.79-dbtool.patch - Patch100: nspr-config-pc.patch Patch101: nspr-gcc-atomics.patch @@ -1088,6 +1085,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Wed Oct 4 2023 Frantisek Krenzelok - 3.94.0-1 +- Update NSS to 3.94.0 + * Thu Aug 31 2023 Frantisek Krenzelok - 3.93.0-1 - Update NSS to 3.93.0 diff --git a/sources b/sources index d342e47..fa784d4 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403fda3e3d4e7757838061ae56ccf5aac335cb54f254f0a9e6e9c0dd5920b4155a39264525b06 SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 -SHA512 (nss-3.93-with-nspr-4.35.tar.gz) = efe85e09021ca363df35d092b32463b359b2a23fc6e761949e944ba4209b09bdf007fc69015086a278c999411d62b9dba6fbedfb8a7c962ed40e406de45bc28e +SHA512 (nss-3.94-with-nspr-4.35.tar.gz) = 121180c80c635b0e3e9fa5d44297107d4c5da84879210e81da0f799a48e9ed1ea43e5c28d5cb53fd65218678b94b5db282b7ed0ee96482caa01493c39ed93c27 From b3a831eed9333611b68cf53fa9a06a38f39e43b2 Mon Sep 17 00:00:00 2001 From: Robert Relyea Date: Thu, 26 Oct 2023 08:22:15 -0700 Subject: [PATCH 17/23] Fix compatibility issue in upstream patch to use HACL ECC 256 --- nss-3.94-fix-ec-encoding.patch | 107 +++++++++++++++++++++++++++++++++ nss.spec | 8 ++- 2 files changed, 114 insertions(+), 1 deletion(-) create mode 100644 nss-3.94-fix-ec-encoding.patch diff --git a/nss-3.94-fix-ec-encoding.patch b/nss-3.94-fix-ec-encoding.patch new file mode 100644 index 0000000..f4361c9 --- /dev/null +++ b/nss-3.94-fix-ec-encoding.patch @@ -0,0 +1,107 @@ +diff --git a/lib/freebl/blapit.h b/lib/freebl/blapit.h +--- a/lib/freebl/blapit.h ++++ b/lib/freebl/blapit.h +@@ -387,17 +387,18 @@ typedef struct DHPrivateKeyStr DHPrivate + */ + + /* + ** The ECParams data structures can encode elliptic curve + ** parameters for both GFp and GF2m curves. + */ + + typedef enum { ec_params_explicit, +- ec_params_named ++ ec_params_named, ++ ec_params_edwards_named + } ECParamsType; + + typedef enum { ec_field_GFp = 1, + ec_field_GF2m, + ec_field_plain + } ECFieldType; + + struct ECFieldIDStr { +diff --git a/lib/freebl/ecdecode.c b/lib/freebl/ecdecode.c +--- a/lib/freebl/ecdecode.c ++++ b/lib/freebl/ecdecode.c +@@ -171,16 +171,17 @@ EC_FillParams(PLArenaPool *arena, const + * (the NIST P-521 curve) + */ + CHECK_SEC_OK(gf_populate_params_bytes(ECCurve_SECG_PRIME_521R1, + ec_field_GFp, params)); + break; + + case SEC_OID_CURVE25519: + /* Populate params for Curve25519 */ ++ params->type = ec_params_edwards_named; + CHECK_SEC_OK(gf_populate_params_bytes(ECCurve25519, + ec_field_plain, + params)); + break; + + default: + break; + }; +diff --git a/lib/softoken/pkcs11.c b/lib/softoken/pkcs11.c +--- a/lib/softoken/pkcs11.c ++++ b/lib/softoken/pkcs11.c +@@ -1921,17 +1921,17 @@ sftk_GetPubKey(SFTKObject *object, CK_KE + /* special note: We can't just use the first byte to distinguish + * between EC_POINT_FORM_UNCOMPRESSED and SEC_ASN1_OCTET_STRING. + * Both are 0x04. */ + + /* Handle the non-DER encoded case. + * Some curves are always pressumed to be non-DER. + */ + if (pubKey->u.ec.publicValue.len == keyLen && +- (pubKey->u.ec.ecParams.fieldID.type == ec_field_plain || ++ (pubKey->u.ec.ecParams.type == ec_params_edwards_named || + pubKey->u.ec.publicValue.data[0] == EC_POINT_FORM_UNCOMPRESSED)) { + break; /* key was not DER encoded, no need to unwrap */ + } + + /* handle the encoded case */ + if ((pubKey->u.ec.publicValue.data[0] == SEC_ASN1_OCTET_STRING) && + pubKey->u.ec.publicValue.len > keyLen) { + SECItem publicValue; +@@ -1941,17 +1941,17 @@ sftk_GetPubKey(SFTKObject *object, CK_KE + SEC_ASN1_GET(SEC_OctetStringTemplate), + &pubKey->u.ec.publicValue); + /* nope, didn't decode correctly */ + if ((rv != SECSuccess) || (publicValue.len != keyLen)) { + crv = CKR_ATTRIBUTE_VALUE_INVALID; + break; + } + /* we don't handle compressed points except in the case of ECCurve25519 */ +- if ((pubKey->u.ec.ecParams.fieldID.type != ec_field_plain) && ++ if ((pubKey->u.ec.ecParams.type != ec_params_edwards_named) && + (publicValue.data[0] != EC_POINT_FORM_UNCOMPRESSED)) { + crv = CKR_ATTRIBUTE_VALUE_INVALID; + break; + } + /* replace our previous with the decoded key */ + pubKey->u.ec.publicValue = publicValue; + break; + } +diff --git a/lib/softoken/pkcs11c.c b/lib/softoken/pkcs11c.c +--- a/lib/softoken/pkcs11c.c ++++ b/lib/softoken/pkcs11c.c +@@ -5655,17 +5655,17 @@ NSC_GenerateKeyPair(CK_SESSION_HANDLE hS + sftk_fatalError = PR_TRUE; + } + PORT_FreeArena(ecParams->arena, PR_TRUE); + crv = sftk_MapCryptError(PORT_GetError()); + break; + } + + if (PR_GetEnvSecure("NSS_USE_DECODED_CKA_EC_POINT") || +- ecParams->fieldID.type == ec_field_plain) { ++ ecParams->type == ec_params_edwards_named) { + PORT_FreeArena(ecParams->arena, PR_TRUE); + crv = sftk_AddAttributeType(publicKey, CKA_EC_POINT, + sftk_item_expand(&ecPriv->publicValue)); + } else { + PORT_FreeArena(ecParams->arena, PR_TRUE); + SECItem *pubValue = SEC_ASN1EncodeItem(NULL, NULL, + &ecPriv->publicValue, + SEC_ASN1_GET(SEC_OctetStringTemplate)); diff --git a/nss.spec b/nss.spec index bc2721e..05557eb 100644 --- a/nss.spec +++ b/nss.spec @@ -3,7 +3,7 @@ # NOTE: To avoid NVR clashes of nspr* packages: # - reset %%{nspr_release} to 1, when updating %%{nspr_version} # - increment %%{nspr_version}, when updating the NSS part only -%global baserelease 1 +%global baserelease 2 %global nss_release %baserelease # use "%%global nspr_release %%[%%baserelease+n]" to handle offsets when # release number between nss and nspr are different. @@ -132,6 +132,9 @@ Patch12: nss-signtool-format.patch # fedora disabled dbm by default Patch40: nss-no-dbm-man-page.patch +# https://bugzilla.mozilla.org/show_bug.cgi?id=1861265 +Patch50: nss-3.94-fix-ec-encoding.patch + Patch100: nspr-config-pc.patch Patch101: nspr-gcc-atomics.patch @@ -1085,6 +1088,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Thu Oct 26 2023 Bob Relyea - 3.94.0-2 +- binary compatibility issue with HACL ECC 256 patch. + * Wed Oct 4 2023 Frantisek Krenzelok - 3.94.0-1 - Update NSS to 3.94.0 From f61e0ac70670e47a478c18de32eb41df685c3a00 Mon Sep 17 00:00:00 2001 From: Krenzelok Frantisek Date: Mon, 27 Nov 2023 12:25:31 +0100 Subject: [PATCH 18/23] Update NSS to 3.95.0 - remove nss-3.94-fix-ec-encoding.patch (upstreamed) --- .gitignore | 1 + nss-3.94-fix-ec-encoding.patch | 107 --------------------------------- nss.spec | 12 ++-- sources | 2 +- 4 files changed, 8 insertions(+), 114 deletions(-) delete mode 100644 nss-3.94-fix-ec-encoding.patch diff --git a/.gitignore b/.gitignore index 61e1690..3f34bb5 100644 --- a/.gitignore +++ b/.gitignore @@ -85,3 +85,4 @@ TestUser51.cert /nss-3.92-with-nspr-4.35.tar.gz /nss-3.93-with-nspr-4.35.tar.gz /nss-3.94-with-nspr-4.35.tar.gz +/nss-3.95-with-nspr-4.35.tar.gz diff --git a/nss-3.94-fix-ec-encoding.patch b/nss-3.94-fix-ec-encoding.patch deleted file mode 100644 index f4361c9..0000000 --- a/nss-3.94-fix-ec-encoding.patch +++ /dev/null @@ -1,107 +0,0 @@ -diff --git a/lib/freebl/blapit.h b/lib/freebl/blapit.h ---- a/lib/freebl/blapit.h -+++ b/lib/freebl/blapit.h -@@ -387,17 +387,18 @@ typedef struct DHPrivateKeyStr DHPrivate - */ - - /* - ** The ECParams data structures can encode elliptic curve - ** parameters for both GFp and GF2m curves. - */ - - typedef enum { ec_params_explicit, -- ec_params_named -+ ec_params_named, -+ ec_params_edwards_named - } ECParamsType; - - typedef enum { ec_field_GFp = 1, - ec_field_GF2m, - ec_field_plain - } ECFieldType; - - struct ECFieldIDStr { -diff --git a/lib/freebl/ecdecode.c b/lib/freebl/ecdecode.c ---- a/lib/freebl/ecdecode.c -+++ b/lib/freebl/ecdecode.c -@@ -171,16 +171,17 @@ EC_FillParams(PLArenaPool *arena, const - * (the NIST P-521 curve) - */ - CHECK_SEC_OK(gf_populate_params_bytes(ECCurve_SECG_PRIME_521R1, - ec_field_GFp, params)); - break; - - case SEC_OID_CURVE25519: - /* Populate params for Curve25519 */ -+ params->type = ec_params_edwards_named; - CHECK_SEC_OK(gf_populate_params_bytes(ECCurve25519, - ec_field_plain, - params)); - break; - - default: - break; - }; -diff --git a/lib/softoken/pkcs11.c b/lib/softoken/pkcs11.c ---- a/lib/softoken/pkcs11.c -+++ b/lib/softoken/pkcs11.c -@@ -1921,17 +1921,17 @@ sftk_GetPubKey(SFTKObject *object, CK_KE - /* special note: We can't just use the first byte to distinguish - * between EC_POINT_FORM_UNCOMPRESSED and SEC_ASN1_OCTET_STRING. - * Both are 0x04. */ - - /* Handle the non-DER encoded case. - * Some curves are always pressumed to be non-DER. - */ - if (pubKey->u.ec.publicValue.len == keyLen && -- (pubKey->u.ec.ecParams.fieldID.type == ec_field_plain || -+ (pubKey->u.ec.ecParams.type == ec_params_edwards_named || - pubKey->u.ec.publicValue.data[0] == EC_POINT_FORM_UNCOMPRESSED)) { - break; /* key was not DER encoded, no need to unwrap */ - } - - /* handle the encoded case */ - if ((pubKey->u.ec.publicValue.data[0] == SEC_ASN1_OCTET_STRING) && - pubKey->u.ec.publicValue.len > keyLen) { - SECItem publicValue; -@@ -1941,17 +1941,17 @@ sftk_GetPubKey(SFTKObject *object, CK_KE - SEC_ASN1_GET(SEC_OctetStringTemplate), - &pubKey->u.ec.publicValue); - /* nope, didn't decode correctly */ - if ((rv != SECSuccess) || (publicValue.len != keyLen)) { - crv = CKR_ATTRIBUTE_VALUE_INVALID; - break; - } - /* we don't handle compressed points except in the case of ECCurve25519 */ -- if ((pubKey->u.ec.ecParams.fieldID.type != ec_field_plain) && -+ if ((pubKey->u.ec.ecParams.type != ec_params_edwards_named) && - (publicValue.data[0] != EC_POINT_FORM_UNCOMPRESSED)) { - crv = CKR_ATTRIBUTE_VALUE_INVALID; - break; - } - /* replace our previous with the decoded key */ - pubKey->u.ec.publicValue = publicValue; - break; - } -diff --git a/lib/softoken/pkcs11c.c b/lib/softoken/pkcs11c.c ---- a/lib/softoken/pkcs11c.c -+++ b/lib/softoken/pkcs11c.c -@@ -5655,17 +5655,17 @@ NSC_GenerateKeyPair(CK_SESSION_HANDLE hS - sftk_fatalError = PR_TRUE; - } - PORT_FreeArena(ecParams->arena, PR_TRUE); - crv = sftk_MapCryptError(PORT_GetError()); - break; - } - - if (PR_GetEnvSecure("NSS_USE_DECODED_CKA_EC_POINT") || -- ecParams->fieldID.type == ec_field_plain) { -+ ecParams->type == ec_params_edwards_named) { - PORT_FreeArena(ecParams->arena, PR_TRUE); - crv = sftk_AddAttributeType(publicKey, CKA_EC_POINT, - sftk_item_expand(&ecPriv->publicValue)); - } else { - PORT_FreeArena(ecParams->arena, PR_TRUE); - SECItem *pubValue = SEC_ASN1EncodeItem(NULL, NULL, - &ecPriv->publicValue, - SEC_ASN1_GET(SEC_OctetStringTemplate)); diff --git a/nss.spec b/nss.spec index 05557eb..bb4ca44 100644 --- a/nss.spec +++ b/nss.spec @@ -1,13 +1,13 @@ %global nspr_version 4.35.0 -%global nss_version 3.94.0 +%global nss_version 3.95.0 # NOTE: To avoid NVR clashes of nspr* packages: # - reset %%{nspr_release} to 1, when updating %%{nspr_version} # - increment %%{nspr_version}, when updating the NSS part only -%global baserelease 2 +%global baserelease 1 %global nss_release %baserelease # use "%%global nspr_release %%[%%baserelease+n]" to handle offsets when # release number between nss and nspr are different. -%global nspr_release %[%baserelease+10] +%global nspr_release %[%baserelease+12] # only need to update this as we added new # algorithms under nss policy control %global crypto_policies_version 20210118 @@ -132,9 +132,6 @@ Patch12: nss-signtool-format.patch # fedora disabled dbm by default Patch40: nss-no-dbm-man-page.patch -# https://bugzilla.mozilla.org/show_bug.cgi?id=1861265 -Patch50: nss-3.94-fix-ec-encoding.patch - Patch100: nspr-config-pc.patch Patch101: nspr-gcc-atomics.patch @@ -1088,6 +1085,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Mon Nov 27 2023 Frantisek Krenzelok - 3.95.0-1 +- Update NSS to 3.95.0 + * Thu Oct 26 2023 Bob Relyea - 3.94.0-2 - binary compatibility issue with HACL ECC 256 patch. diff --git a/sources b/sources index fa784d4..0a41301 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403fda3e3d4e7757838061ae56ccf5aac335cb54f254f0a9e6e9c0dd5920b4155a39264525b06 SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 -SHA512 (nss-3.94-with-nspr-4.35.tar.gz) = 121180c80c635b0e3e9fa5d44297107d4c5da84879210e81da0f799a48e9ed1ea43e5c28d5cb53fd65218678b94b5db282b7ed0ee96482caa01493c39ed93c27 +SHA512 (nss-3.95-with-nspr-4.35.tar.gz) = 8394a0381db5b5d7f975f5057e0578909901244616ccaca694c1932fd9428e651a52bbf3f30e4d993e692538a603a57df1eae5e9badda3a1291d35836ab02ecd From a1b5a5be16ad3188a894bb65111e4dad72c7f149 Mon Sep 17 00:00:00 2001 From: Krenzelok Frantisek Date: Mon, 18 Dec 2023 13:50:03 +0100 Subject: [PATCH 19/23] Update NSS to 3.96.1 --- .gitignore | 2 ++ nss.spec | 7 +++++-- sources | 2 +- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 3f34bb5..4508106 100644 --- a/.gitignore +++ b/.gitignore @@ -86,3 +86,5 @@ TestUser51.cert /nss-3.93-with-nspr-4.35.tar.gz /nss-3.94-with-nspr-4.35.tar.gz /nss-3.95-with-nspr-4.35.tar.gz +/nss-3.96-with-nspr-4.35.tar.gz +/nss-3.96.1-with-nspr-4.35.tar.gz diff --git a/nss.spec b/nss.spec index bb4ca44..d7dc247 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ %global nspr_version 4.35.0 -%global nss_version 3.95.0 +%global nss_version 3.96.1 # NOTE: To avoid NVR clashes of nspr* packages: # - reset %%{nspr_release} to 1, when updating %%{nspr_version} # - increment %%{nspr_version}, when updating the NSS part only @@ -7,7 +7,7 @@ %global nss_release %baserelease # use "%%global nspr_release %%[%%baserelease+n]" to handle offsets when # release number between nss and nspr are different. -%global nspr_release %[%baserelease+12] +%global nspr_release %[%baserelease+13] # only need to update this as we added new # algorithms under nss policy control %global crypto_policies_version 20210118 @@ -1085,6 +1085,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Thu Dec 21 2023 Frantisek Krenzelok - 3.96.1-1 +- Update NSS to 3.96.1 + * Mon Nov 27 2023 Frantisek Krenzelok - 3.95.0-1 - Update NSS to 3.95.0 diff --git a/sources b/sources index 0a41301..be78d53 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403fda3e3d4e7757838061ae56ccf5aac335cb54f254f0a9e6e9c0dd5920b4155a39264525b06 SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 -SHA512 (nss-3.95-with-nspr-4.35.tar.gz) = 8394a0381db5b5d7f975f5057e0578909901244616ccaca694c1932fd9428e651a52bbf3f30e4d993e692538a603a57df1eae5e9badda3a1291d35836ab02ecd +SHA512 (nss-3.96.1-with-nspr-4.35.tar.gz) = 7831835936748adb7fdb050f06caea09ddcbf48e9c401bba9df1e405b05658204e1cea7800c565aae742551779ff0d4c9834b686b484055ee569ed3f4546f428 From bb73189ca9ffff1dfa335b4db92756105c2e60d1 Mon Sep 17 00:00:00 2001 From: Krenzelok Frantisek Date: Wed, 24 Jan 2024 13:45:51 +0100 Subject: [PATCH 20/23] Update NSS to 3.97.0 --- .gitignore | 1 + nss.spec | 8 ++++++-- sources | 1 + 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 4508106..06a3531 100644 --- a/.gitignore +++ b/.gitignore @@ -88,3 +88,4 @@ TestUser51.cert /nss-3.95-with-nspr-4.35.tar.gz /nss-3.96-with-nspr-4.35.tar.gz /nss-3.96.1-with-nspr-4.35.tar.gz +/nss-3.97-with-nspr-4.35.tar.gz diff --git a/nss.spec b/nss.spec index d7dc247..2fa518a 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ %global nspr_version 4.35.0 -%global nss_version 3.96.1 +%global nss_version 3.97.0 # NOTE: To avoid NVR clashes of nspr* packages: # - reset %%{nspr_release} to 1, when updating %%{nspr_version} # - increment %%{nspr_version}, when updating the NSS part only @@ -7,7 +7,7 @@ %global nss_release %baserelease # use "%%global nspr_release %%[%%baserelease+n]" to handle offsets when # release number between nss and nspr are different. -%global nspr_release %[%baserelease+13] +%global nspr_release %[%baserelease+14] # only need to update this as we added new # algorithms under nss policy control %global crypto_policies_version 20210118 @@ -1010,6 +1010,7 @@ update-crypto-policies &> /dev/null || : %{_includedir}/nss3/utilpars.h %{_includedir}/nss3/utilparst.h %{_includedir}/nss3/utilrename.h +%{_includedir}/nss3/kyber.h %{_includedir}/nss3/templates/templates.c %files softokn @@ -1085,6 +1086,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Sun Feb 15 2024 Frantisek Krenzelok - 3.97.0-1 +- Update NSS to 3.97.0 + * Thu Dec 21 2023 Frantisek Krenzelok - 3.96.1-1 - Update NSS to 3.96.1 diff --git a/sources b/sources index be78d53..e731429 100644 --- a/sources +++ b/sources @@ -1,3 +1,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403fda3e3d4e7757838061ae56ccf5aac335cb54f254f0a9e6e9c0dd5920b4155a39264525b06 SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (nss-3.96.1-with-nspr-4.35.tar.gz) = 7831835936748adb7fdb050f06caea09ddcbf48e9c401bba9df1e405b05658204e1cea7800c565aae742551779ff0d4c9834b686b484055ee569ed3f4546f428 +SHA512 (nss-3.97-with-nspr-4.35.tar.gz) = 5153eb99ca3a372dfa89671d2c589675d99755c04760d65280ce694ff5761b2a0502416cb9f0950bb5156c71a5c68491582dcb7a970e65ea0b1082fff0ba0153 From 9c4a414d0ac7e19f6da702ba249b5d18d9da46cb Mon Sep 17 00:00:00 2001 From: Krenzelok Frantisek Date: Sat, 17 Feb 2024 13:25:50 +0100 Subject: [PATCH 21/23] Update NSS to 3.98.0 --- .gitignore | 1 + nss.spec | 7 +++++-- sources | 1 + 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 06a3531..af02f2d 100644 --- a/.gitignore +++ b/.gitignore @@ -89,3 +89,4 @@ TestUser51.cert /nss-3.96-with-nspr-4.35.tar.gz /nss-3.96.1-with-nspr-4.35.tar.gz /nss-3.97-with-nspr-4.35.tar.gz +/nss-3.98-with-nspr-4.35.tar.gz diff --git a/nss.spec b/nss.spec index 2fa518a..9800382 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ %global nspr_version 4.35.0 -%global nss_version 3.97.0 +%global nss_version 3.98.0 # NOTE: To avoid NVR clashes of nspr* packages: # - reset %%{nspr_release} to 1, when updating %%{nspr_version} # - increment %%{nspr_version}, when updating the NSS part only @@ -7,7 +7,7 @@ %global nss_release %baserelease # use "%%global nspr_release %%[%%baserelease+n]" to handle offsets when # release number between nss and nspr are different. -%global nspr_release %[%baserelease+14] +%global nspr_release %[%baserelease+15] # only need to update this as we added new # algorithms under nss policy control %global crypto_policies_version 20210118 @@ -1086,6 +1086,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Sat Feb 17 2024 Frantisek Krenzelok - 3.98.0-1 +- Update NSS to 3.98.0 + * Sun Feb 15 2024 Frantisek Krenzelok - 3.97.0-1 - Update NSS to 3.97.0 diff --git a/sources b/sources index e731429..72bcc3b 100644 --- a/sources +++ b/sources @@ -2,3 +2,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403 SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 SHA512 (nss-3.96.1-with-nspr-4.35.tar.gz) = 7831835936748adb7fdb050f06caea09ddcbf48e9c401bba9df1e405b05658204e1cea7800c565aae742551779ff0d4c9834b686b484055ee569ed3f4546f428 SHA512 (nss-3.97-with-nspr-4.35.tar.gz) = 5153eb99ca3a372dfa89671d2c589675d99755c04760d65280ce694ff5761b2a0502416cb9f0950bb5156c71a5c68491582dcb7a970e65ea0b1082fff0ba0153 +SHA512 (nss-3.98-with-nspr-4.35.tar.gz) = 1bd2dd5b84a48371e5135866f6f823facb25034aa9d6dafc6008f7dba9aded26442a4115a7aa1df7295d857c2aed082509427b726db145e2b4660d68c55585b5 From 73cb068bc2e730312b2fb5c6fc2a4cab50f12616 Mon Sep 17 00:00:00 2001 From: Krenzelok Frantisek Date: Mon, 18 Mar 2024 16:10:56 +0100 Subject: [PATCH 22/23] Update NSS to 3.99.0 --- .gitignore | 1 + nss.spec | 7 +++++-- sources | 4 +--- 3 files changed, 7 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index af02f2d..61ae8a1 100644 --- a/.gitignore +++ b/.gitignore @@ -90,3 +90,4 @@ TestUser51.cert /nss-3.96.1-with-nspr-4.35.tar.gz /nss-3.97-with-nspr-4.35.tar.gz /nss-3.98-with-nspr-4.35.tar.gz +/nss-3.99-with-nspr-4.35.tar.gz diff --git a/nss.spec b/nss.spec index 9800382..f0d7f84 100644 --- a/nss.spec +++ b/nss.spec @@ -1,5 +1,5 @@ %global nspr_version 4.35.0 -%global nss_version 3.98.0 +%global nss_version 3.99.0 # NOTE: To avoid NVR clashes of nspr* packages: # - reset %%{nspr_release} to 1, when updating %%{nspr_version} # - increment %%{nspr_version}, when updating the NSS part only @@ -7,7 +7,7 @@ %global nss_release %baserelease # use "%%global nspr_release %%[%%baserelease+n]" to handle offsets when # release number between nss and nspr are different. -%global nspr_release %[%baserelease+15] +%global nspr_release %[%baserelease+16] # only need to update this as we added new # algorithms under nss policy control %global crypto_policies_version 20210118 @@ -1086,6 +1086,9 @@ update-crypto-policies &> /dev/null || : %changelog +* Mon Mar 18 2024 Frantisek Krenzelok - 3.99.0-1 +- Update NSS to 3.99.0 + * Sat Feb 17 2024 Frantisek Krenzelok - 3.98.0-1 - Update NSS to 3.98.0 diff --git a/sources b/sources index 72bcc3b..36b0973 100644 --- a/sources +++ b/sources @@ -1,5 +1,3 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403fda3e3d4e7757838061ae56ccf5aac335cb54f254f0a9e6e9c0dd5920b4155a39264525b06 SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7 -SHA512 (nss-3.96.1-with-nspr-4.35.tar.gz) = 7831835936748adb7fdb050f06caea09ddcbf48e9c401bba9df1e405b05658204e1cea7800c565aae742551779ff0d4c9834b686b484055ee569ed3f4546f428 -SHA512 (nss-3.97-with-nspr-4.35.tar.gz) = 5153eb99ca3a372dfa89671d2c589675d99755c04760d65280ce694ff5761b2a0502416cb9f0950bb5156c71a5c68491582dcb7a970e65ea0b1082fff0ba0153 -SHA512 (nss-3.98-with-nspr-4.35.tar.gz) = 1bd2dd5b84a48371e5135866f6f823facb25034aa9d6dafc6008f7dba9aded26442a4115a7aa1df7295d857c2aed082509427b726db145e2b4660d68c55585b5 +SHA512 (nss-3.99-with-nspr-4.35.tar.gz) = d19db94a0a79335afc275876c8019621472a27a9766feed2616ff0461db2e8edebc492f98f720bd8231bf44c38138ab1d8f5d1812a55b23bed94e894c3b171fd From 8dc008510d831cb7f7373cf88b5bf320e10ca315 Mon Sep 17 00:00:00 2001 From: Krenzelok Frantisek Date: Mon, 25 Mar 2024 18:42:57 +0100 Subject: [PATCH 23/23] Fix changelog date --- nss.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nss.spec b/nss.spec index f0d7f84..2502c72 100644 --- a/nss.spec +++ b/nss.spec @@ -1092,7 +1092,7 @@ update-crypto-policies &> /dev/null || : * Sat Feb 17 2024 Frantisek Krenzelok - 3.98.0-1 - Update NSS to 3.98.0 -* Sun Feb 15 2024 Frantisek Krenzelok - 3.97.0-1 +* Thu Feb 15 2024 Frantisek Krenzelok - 3.97.0-1 - Update NSS to 3.97.0 * Thu Dec 21 2023 Frantisek Krenzelok - 3.96.1-1