From 029bec3f48fb47d88bb1fb02cdf40be71e2496ba Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Thu, 21 Mar 2019 10:36:42 +0100
Subject: [PATCH 01/30] Update to NSS 3.43

---
 .gitignore | 1 +
 nss.spec   | 7 +++++--
 sources    | 2 +-
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/.gitignore b/.gitignore
index 9e7d489..0a4fab9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -34,3 +34,4 @@ TestUser51.cert
 /nss-3.41.tar.gz
 /nss-3.42.tar.gz
 /nss-3.42.1.tar.gz
+/nss-3.43.tar.gz
diff --git a/nss.spec b/nss.spec
index 666af0f..c3745d1 100644
--- a/nss.spec
+++ b/nss.spec
@@ -1,5 +1,5 @@
-%global nspr_version 4.20.0
-%global nss_version 3.42.1
+%global nspr_version 4.21.0
+%global nss_version 3.43.0
 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools
 %global saved_files_dir %{_libdir}/nss/saved
 %global dracutlibdir %{_prefix}/lib/dracut
@@ -867,6 +867,9 @@ update-crypto-policies &> /dev/null || :
 
 
 %changelog
+* Thu Mar 21 2019 Daiki Ueno <dueno@redhat.com> - 3.43.0-1
+- Update to NSS 3.43
+
 * Mon Feb 11 2019 Daiki Ueno <dueno@redhat.com> - 3.42.1-1
 - Update to NSS 3.42.1
 
diff --git a/sources b/sources
index ce6441c..72ed007 100644
--- a/sources
+++ b/sources
@@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403
 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c
 SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7
 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310
-SHA512 (nss-3.42.1.tar.gz) = 468e1d4ea9d2b832c7b8975443ee6fe2790b39cbbd9f8e3d8428a43f47cce0e81d5ca21e3566701b75bcd4af09110c0134e204b2850d30ecfd6347ec27e6e265
+SHA512 (nss-3.43.tar.gz) = e9dfba5bd6f68c5ab58fc7a6fa1b16a035be1b1b7c436cf787bdc99257c5f54c78d73d94d015bffd29420df19b2a2818166c68fe592dd7208ab5605344827fb5

From 4f0a56566af3c7b9dadc6eba15189905350c8842 Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Mon, 6 May 2019 18:33:40 +0200
Subject: [PATCH 02/30] Fix PKCS#11 module leak if C_GetSlotInfo() failed

---
 nss-module-leak.patch | 35 +++++++++++++++++++++++++++++++++++
 nss.spec              |  7 ++++++-
 2 files changed, 41 insertions(+), 1 deletion(-)
 create mode 100644 nss-module-leak.patch

diff --git a/nss-module-leak.patch b/nss-module-leak.patch
new file mode 100644
index 0000000..7acf3f3
--- /dev/null
+++ b/nss-module-leak.patch
@@ -0,0 +1,35 @@
+# HG changeset patch
+# User Daiki Ueno <dueno@redhat.com>
+# Date 1557150127 -7200
+#      Mon May 06 15:42:07 2019 +0200
+# Node ID 438ac983bda9ec7944990d22a37877e9111caa90
+# Parent  b018f3e84d87cce99a1fd81feeecb31123058687
+pk11slot: reference module from slot for finalization
+
+diff --git a/lib/pk11wrap/pk11slot.c b/lib/pk11wrap/pk11slot.c
+--- a/lib/pk11wrap/pk11slot.c
++++ b/lib/pk11wrap/pk11slot.c
+@@ -1439,6 +1439,11 @@ PK11_InitSlot(SECMODModule *mod, CK_SLOT
+     slot->slotID = slotID;
+     slot->isThreadSafe = mod->isThreadSafe;
+     slot->hasRSAInfo = PR_FALSE;
++    slot->module = mod; /* NOTE: we don't make a reference here because
++                         * modules have references to their slots. This
++                         * works because modules keep implicit references
++                         * from their slots, and won't unload and disappear
++                         * until all their slots have been freed */
+ 
+     if (PK11_GETTAB(slot)->C_GetSlotInfo(slotID, &slotInfo) != CKR_OK) {
+         slot->disabled = PR_TRUE;
+@@ -1448,11 +1453,6 @@ PK11_InitSlot(SECMODModule *mod, CK_SLOT
+ 
+     /* test to make sure claimed mechanism work */
+     slot->needTest = mod->internal ? PR_FALSE : PR_TRUE;
+-    slot->module = mod; /* NOTE: we don't make a reference here because
+-                         * modules have references to their slots. This
+-                         * works because modules keep implicit references
+-                         * from their slots, and won't unload and disappear
+-                         * until all their slots have been freed */
+     (void)PK11_MakeString(NULL, slot->slot_name,
+                           (char *)slotInfo.slotDescription, sizeof(slotInfo.slotDescription));
+     slot->isHW = (PRBool)((slotInfo.flags & CKF_HW_SLOT) == CKF_HW_SLOT);
diff --git a/nss.spec b/nss.spec
index c3745d1..65417dd 100644
--- a/nss.spec
+++ b/nss.spec
@@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM",
 Summary:          Network Security Services
 Name:             nss
 Version:          %{nss_version}
-Release:          1%{?dist}
+Release:          2%{?dist}
 License:          MPLv2.0
 URL:              http://www.mozilla.org/projects/security/pki/nss/
 Requires:         nspr >= %{nspr_version}
@@ -93,6 +93,8 @@ Source28:         nss-p11-kit.config
 
 # Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=617723
 Patch2:           nss-539183.patch
+# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=1549382
+Patch3:           nss-module-leak.patch
 # This patch uses the GCC -iquote option documented at
 # http://gcc.gnu.org/onlinedocs/gcc/Directory-Options.html#Directory-Options
 # to give the in-tree headers a higher priority over the system headers,
@@ -867,6 +869,9 @@ update-crypto-policies &> /dev/null || :
 
 
 %changelog
+* Tue May  7 2019 Daiki Ueno <dueno@redhat.com> - 3.43.0-2
+- Fix PKCS#11 module leak if C_GetSlotInfo() failed
+
 * Thu Mar 21 2019 Daiki Ueno <dueno@redhat.com> - 3.43.0-1
 - Update to NSS 3.43
 

From 75e8e3f0d9fc972c74607709f8db7811173cfa19 Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Fri, 17 May 2019 13:03:12 +0200
Subject: [PATCH 03/30] Update to NSS 3.44

---
 .gitignore |  1 +
 nss.spec   | 12 +++++++++---
 sources    |  2 +-
 3 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/.gitignore b/.gitignore
index 0a4fab9..75a333c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -35,3 +35,4 @@ TestUser51.cert
 /nss-3.42.tar.gz
 /nss-3.42.1.tar.gz
 /nss-3.43.tar.gz
+/nss-3.44.tar.gz
diff --git a/nss.spec b/nss.spec
index 65417dd..9650f48 100644
--- a/nss.spec
+++ b/nss.spec
@@ -1,5 +1,5 @@
 %global nspr_version 4.21.0
-%global nss_version 3.43.0
+%global nss_version 3.44.0
 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools
 %global saved_files_dir %{_libdir}/nss/saved
 %global dracutlibdir %{_prefix}/lib/dracut
@@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM",
 Summary:          Network Security Services
 Name:             nss
 Version:          %{nss_version}
-Release:          2%{?dist}
+Release:          1%{?dist}
 License:          MPLv2.0
 URL:              http://www.mozilla.org/projects/security/pki/nss/
 Requires:         nspr >= %{nspr_version}
@@ -239,6 +239,9 @@ pushd nss
 %autopatch -p1
 popd
 
+# https://bugzilla.redhat.com/show_bug.cgi?id=1247353
+find nss/lib/libpkix -perm /u+x -type f -exec chmod -x {} \;
+
 
 %build
 
@@ -869,7 +872,10 @@ update-crypto-policies &> /dev/null || :
 
 
 %changelog
-* Tue May  7 2019 Daiki Ueno <dueno@redhat.com> - 3.43.0-2
+* Fri May 17 2019 Daiki Ueno <dueno@redhat.com> - 3.44.0-1
+- Update to NSS 3.44
+
+* Mon May  6 2019 Daiki Ueno <dueno@redhat.com> - 3.43.0-3
 - Fix PKCS#11 module leak if C_GetSlotInfo() failed
 
 * Thu Mar 21 2019 Daiki Ueno <dueno@redhat.com> - 3.43.0-1
diff --git a/sources b/sources
index 72ed007..0483fb0 100644
--- a/sources
+++ b/sources
@@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403
 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c
 SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7
 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310
-SHA512 (nss-3.43.tar.gz) = e9dfba5bd6f68c5ab58fc7a6fa1b16a035be1b1b7c436cf787bdc99257c5f54c78d73d94d015bffd29420df19b2a2818166c68fe592dd7208ab5605344827fb5
+SHA512 (nss-3.44.tar.gz) = c4d7343a66f91c5888a121e266d1f1471da798a21d608a29caf598a828725e4bf9ea7411a105b23335f20bd7c12788dad567922ceeaebeb0c98fbf9bbe4006f7

From 2fcdef431a5bcd4b19d882f215235f813b22f7c0 Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Mon, 20 May 2019 11:09:19 +0200
Subject: [PATCH 04/30] Skip TLS 1.3 tests under FIPS mode

---
 nss-skip-tls13-fips.patch | 27 +++++++++++++++++++++++++++
 nss.spec                  |  7 ++++++-
 2 files changed, 33 insertions(+), 1 deletion(-)
 create mode 100644 nss-skip-tls13-fips.patch

diff --git a/nss-skip-tls13-fips.patch b/nss-skip-tls13-fips.patch
new file mode 100644
index 0000000..4a7c707
--- /dev/null
+++ b/nss-skip-tls13-fips.patch
@@ -0,0 +1,27 @@
+# HG changeset patch
+# User Daiki Ueno <dueno@redhat.com>
+# Date 1558341826 -7200
+#      Mon May 20 10:43:46 2019 +0200
+# Node ID b447f0046807b718d2928d0e33313620d38a287a
+# Parent  02ea5f29ac3c1f1c6e6eb4b655afd9b4fc075a9e
+tests: skip TLS 1.3 tests under FIPS mode
+
+diff --git a/tests/ssl/ssl.sh b/tests/ssl/ssl.sh
+--- a/tests/ssl/ssl.sh
++++ b/tests/ssl/ssl.sh
+@@ -393,6 +393,15 @@ ssl_auth()
+       echo "${testname}" | grep "TLS 1.3" > /dev/null
+       TLS13=$?
+ 
++      # Currently TLS 1.3 tests are known to fail under FIPS mode,
++      # because HKDF is implemented using the PKCS #11 functions
++      # prohibited under FIPS mode.
++      if [ "${TLS13}" -eq 0 ] && \
++	 [ "$SERVER_MODE" = "fips" -o "$CLIENT_MODE" = "fips" ] ; then
++          echo "$SCRIPTNAME: skipping  $testname (non-FIPS only)"
++          continue
++      fi
++
+       if [ "${CLIENT_MODE}" = "fips" -a "${CAUTH}" -eq 0 ] ; then
+           echo "$SCRIPTNAME: skipping  $testname (non-FIPS only)"
+       elif [ "$ectype" = "SNI" -a "$NORM_EXT" = "Extended Test" ] ; then
diff --git a/nss.spec b/nss.spec
index 9650f48..ea569f1 100644
--- a/nss.spec
+++ b/nss.spec
@@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM",
 Summary:          Network Security Services
 Name:             nss
 Version:          %{nss_version}
-Release:          1%{?dist}
+Release:          2%{?dist}
 License:          MPLv2.0
 URL:              http://www.mozilla.org/projects/security/pki/nss/
 Requires:         nspr >= %{nspr_version}
@@ -107,6 +107,8 @@ Patch3:           nss-module-leak.patch
 # Once the buildroot aha been bootstrapped the patch may be removed
 # but it doesn't hurt to keep it.
 Patch4:           iquote.patch
+# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=1552767
+Patch5:           nss-skip-tls13-fips.patch
 
 %description
 Network Security Services (NSS) is a set of libraries designed to
@@ -872,6 +874,9 @@ update-crypto-policies &> /dev/null || :
 
 
 %changelog
+* Mon May 20 2019 Daiki Ueno <dueno@redhat.com> - 3.44.0-2
+- Skip TLS 1.3 tests under FIPS mode
+
 * Fri May 17 2019 Daiki Ueno <dueno@redhat.com> - 3.44.0-1
 - Update to NSS 3.44
 

From 01053c04e012cd2abccca58d222c0fbde39974f2 Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Tue, 2 Jul 2019 12:55:10 +0200
Subject: [PATCH 05/30] Update to NSS 3.44.1

---
 .gitignore | 1 +
 nss.spec   | 7 +++++--
 sources    | 2 +-
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/.gitignore b/.gitignore
index 75a333c..23a0c00 100644
--- a/.gitignore
+++ b/.gitignore
@@ -36,3 +36,4 @@ TestUser51.cert
 /nss-3.42.1.tar.gz
 /nss-3.43.tar.gz
 /nss-3.44.tar.gz
+/nss-3.44.1.tar.gz
diff --git a/nss.spec b/nss.spec
index ea569f1..c86e304 100644
--- a/nss.spec
+++ b/nss.spec
@@ -1,5 +1,5 @@
 %global nspr_version 4.21.0
-%global nss_version 3.44.0
+%global nss_version 3.44.1
 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools
 %global saved_files_dir %{_libdir}/nss/saved
 %global dracutlibdir %{_prefix}/lib/dracut
@@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM",
 Summary:          Network Security Services
 Name:             nss
 Version:          %{nss_version}
-Release:          2%{?dist}
+Release:          1%{?dist}
 License:          MPLv2.0
 URL:              http://www.mozilla.org/projects/security/pki/nss/
 Requires:         nspr >= %{nspr_version}
@@ -874,6 +874,9 @@ update-crypto-policies &> /dev/null || :
 
 
 %changelog
+* Tue Jul  2 2019 Daiki Ueno <dueno@redhat.com> - 3.44.1-1
+- Update to NSS 3.44.1
+
 * Mon May 20 2019 Daiki Ueno <dueno@redhat.com> - 3.44.0-2
 - Skip TLS 1.3 tests under FIPS mode
 
diff --git a/sources b/sources
index 0483fb0..53b9c62 100644
--- a/sources
+++ b/sources
@@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403
 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c
 SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7
 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310
-SHA512 (nss-3.44.tar.gz) = c4d7343a66f91c5888a121e266d1f1471da798a21d608a29caf598a828725e4bf9ea7411a105b23335f20bd7c12788dad567922ceeaebeb0c98fbf9bbe4006f7
+SHA512 (nss-3.44.1.tar.gz) = eb8777701a25b54377026633b6bf284e4c62308012058355f348a7c57525afe96db74a07de41ba01754e316a7dff06689de527359a5474ed7ab606779c4cf169

From 07556cd8af29ed7e55708837b48a8a350cb57b26 Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Wed, 3 Jul 2019 15:59:21 +0200
Subject: [PATCH 06/30] Fix CAVS testdir creation

---
 nss-cavs-tests.patch | 155 +++++++++++++++++++++++++++++++++++++++++++
 nss.spec             |   1 +
 2 files changed, 156 insertions(+)
 create mode 100644 nss-cavs-tests.patch

diff --git a/nss-cavs-tests.patch b/nss-cavs-tests.patch
new file mode 100644
index 0000000..c0b2306
--- /dev/null
+++ b/nss-cavs-tests.patch
@@ -0,0 +1,155 @@
+# HG changeset patch
+# User Daiki Ueno <dueno@redhat.com>
+# Date 1562162181 -7200
+#      Wed Jul 03 15:56:21 2019 +0200
+# Node ID 88feab2a3e5e4b00b1626d59a0d3ecef93cafb92
+# Parent  b5d3f574967f8c5c705dab15682b0e16fac3e4be
+tests: ensure CAVS test dirs are created
+
+diff --git a/tests/fips/cavs_scripts/aes.sh b/tests/fips/cavs_scripts/aes.sh
+--- a/tests/fips/cavs_scripts/aes.sh
++++ b/tests/fips/cavs_scripts/aes.sh
+@@ -83,6 +83,8 @@ if [ ${COMMAND} = "verify" ]; then
+     exit $result
+ fi
+ 
++test -d "${RSPDIR}" || mkdir "${RSPDIR}"
++
+ for request in $cbc_kat_requests; do
+     response=`echo $request | sed -e "s/req/rsp/"`
+     echo $request $response
+diff --git a/tests/fips/cavs_scripts/aesgcm.sh b/tests/fips/cavs_scripts/aesgcm.sh
+--- a/tests/fips/cavs_scripts/aesgcm.sh
++++ b/tests/fips/cavs_scripts/aesgcm.sh
+@@ -56,6 +56,8 @@ if [ ${COMMAND} = "verify" ]; then
+     exit $result
+ fi
+ 
++test -d "${RSPDIR}" || mkdir "${RSPDIR}"
++
+ for request in $gcm_decrypt_requests; do
+     response=`echo $request | sed -e "s/req/rsp/"`
+     echo $request $response
+diff --git a/tests/fips/cavs_scripts/dsa.sh b/tests/fips/cavs_scripts/dsa.sh
+--- a/tests/fips/cavs_scripts/dsa.sh
++++ b/tests/fips/cavs_scripts/dsa.sh
+@@ -59,6 +59,8 @@ if [ ${COMMAND} = "verify" ]; then
+     exit $result
+ fi
+ 
++test -d "${RSPDIR}" || mkdir "${RSPDIR}"
++
+ request=KeyPair.req
+ response=`echo $request | sed -e "s/req/rsp/"`
+ echo $request $response
+diff --git a/tests/fips/cavs_scripts/ecdsa.sh b/tests/fips/cavs_scripts/ecdsa.sh
+--- a/tests/fips/cavs_scripts/ecdsa.sh
++++ b/tests/fips/cavs_scripts/ecdsa.sh
+@@ -50,6 +50,8 @@ if [ ${COMMAND} = "verify" ]; then
+     exit $result
+ fi
+ 
++test -d "${RSPDIR}" || mkdir "${RSPDIR}"
++
+ request=KeyPair.req
+ response=`echo $request | sed -e "s/req/rsp/"`
+ echo $request $response
+diff --git a/tests/fips/cavs_scripts/hmac.sh b/tests/fips/cavs_scripts/hmac.sh
+--- a/tests/fips/cavs_scripts/hmac.sh
++++ b/tests/fips/cavs_scripts/hmac.sh
+@@ -31,6 +31,9 @@ if [ ${COMMAND} = "verify" ]; then
+     done
+     exit $result
+ fi
++
++test -d "${RSPDIR}" || mkdir "${RSPDIR}"
++
+ for request in $hmac_requests; do
+     response=`echo $request | sed -e "s/req/rsp/"`
+     echo $request $response
+diff --git a/tests/fips/cavs_scripts/ike.sh b/tests/fips/cavs_scripts/ike.sh
+--- a/tests/fips/cavs_scripts/ike.sh
++++ b/tests/fips/cavs_scripts/ike.sh
+@@ -33,6 +33,8 @@ if [ ${COMMAND} = "verify" ]; then
+     exit $result
+ fi
+ 
++test -d "${RSPDIR}" || mkdir "${RSPDIR}"
++
+ request=ikev1_dsa.req
+ response=`echo $request | sed -e "s/req/rsp/"`
+ echo $request $response
+diff --git a/tests/fips/cavs_scripts/kas.sh b/tests/fips/cavs_scripts/kas.sh
+--- a/tests/fips/cavs_scripts/kas.sh
++++ b/tests/fips/cavs_scripts/kas.sh
+@@ -68,6 +68,8 @@ if [ ${COMMAND} = "verify" ]; then
+     exit $result
+ fi
+ 
++test -d "${RSPDIR}" || mkdir "${RSPDIR}"
++
+ request=KASFunctionTest_ECCEphemeralUnified_NOKC_ZZOnly_init.req
+ response=`echo $request | sed -e "s/req/rsp/"`
+ echo $request $response
+diff --git a/tests/fips/cavs_scripts/rng.sh b/tests/fips/cavs_scripts/rng.sh
+--- a/tests/fips/cavs_scripts/rng.sh
++++ b/tests/fips/cavs_scripts/rng.sh
+@@ -30,6 +30,9 @@ if [ ${COMMAND} = "verify" ]; then
+     done
+     exit $result
+ fi
++
++test -d "${RSPDIR}" || mkdir "${RSPDIR}"
++
+ for request in $drbg_requests; do
+     response=`echo $request | sed -e "s/req/rsp/"`
+     echo $request $response
+diff --git a/tests/fips/cavs_scripts/rsa.sh b/tests/fips/cavs_scripts/rsa.sh
+--- a/tests/fips/cavs_scripts/rsa.sh
++++ b/tests/fips/cavs_scripts/rsa.sh
+@@ -38,6 +38,8 @@ if [ ${COMMAND} = "verify" ]; then
+     exit $result
+ fi
+ 
++test -d "${RSPDIR}" || mkdir "${RSPDIR}"
++
+ request=SigGen15_186-3.req
+ response=`echo $request | sed -e "s/req/rsp/"`
+ echo $request $response
+diff --git a/tests/fips/cavs_scripts/sha.sh b/tests/fips/cavs_scripts/sha.sh
+--- a/tests/fips/cavs_scripts/sha.sh
++++ b/tests/fips/cavs_scripts/sha.sh
+@@ -51,6 +51,8 @@ if [ ${COMMAND} = "verify" ]; then
+     exit $result
+ fi
+ 
++test -d "${RSPDIR}" || mkdir "${RSPDIR}"
++
+ for request in $sha_ShortMsg_requests; do
+     response=`echo $request | sed -e "s/req/rsp/"`
+     echo $request $response
+diff --git a/tests/fips/cavs_scripts/tdea.sh b/tests/fips/cavs_scripts/tdea.sh
+--- a/tests/fips/cavs_scripts/tdea.sh
++++ b/tests/fips/cavs_scripts/tdea.sh
+@@ -77,6 +77,8 @@ if [ ${COMMAND} = "verify" ]; then
+     exit $result
+ fi
+ 
++test -d "${RSPDIR}" || mkdir "${RSPDIR}"
++
+ for request in $cbc_kat_requests; do
+     response=`echo $request | sed -e "s/req/rsp/"`
+     echo $request $response
+diff --git a/tests/fips/cavs_scripts/tls.sh b/tests/fips/cavs_scripts/tls.sh
+--- a/tests/fips/cavs_scripts/tls.sh
++++ b/tests/fips/cavs_scripts/tls.sh
+@@ -30,6 +30,9 @@ if [ ${COMMAND} = "verify" ]; then
+     done
+     exit $result
+ fi
++
++test -d "${RSPDIR}" || mkdir "${RSPDIR}"
++
+ for request in $tls_requests; do
+     response=`echo $request | sed -e "s/req/rsp/"`
+     echo $request $response
diff --git a/nss.spec b/nss.spec
index c86e304..e489b66 100644
--- a/nss.spec
+++ b/nss.spec
@@ -109,6 +109,7 @@ Patch3:           nss-module-leak.patch
 Patch4:           iquote.patch
 # Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=1552767
 Patch5:           nss-skip-tls13-fips.patch
+Patch6:           nss-cavs-tests.patch
 
 %description
 Network Security Services (NSS) is a set of libraries designed to

From 4de2ca8ecec4aa4ce588176f543f24cabcae752f Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Tue, 3 Sep 2019 09:52:53 +0200
Subject: [PATCH 07/30] Update to NSS 3.46

---
 .gitignore           |   1 +
 nss-cavs-tests.patch | 155 -------------------------------------------
 nss.spec             |   6 +-
 sources              |   2 +-
 4 files changed, 6 insertions(+), 158 deletions(-)
 delete mode 100644 nss-cavs-tests.patch

diff --git a/.gitignore b/.gitignore
index 23a0c00..f245589 100644
--- a/.gitignore
+++ b/.gitignore
@@ -37,3 +37,4 @@ TestUser51.cert
 /nss-3.43.tar.gz
 /nss-3.44.tar.gz
 /nss-3.44.1.tar.gz
+/nss-3.46.tar.gz
diff --git a/nss-cavs-tests.patch b/nss-cavs-tests.patch
deleted file mode 100644
index c0b2306..0000000
--- a/nss-cavs-tests.patch
+++ /dev/null
@@ -1,155 +0,0 @@
-# HG changeset patch
-# User Daiki Ueno <dueno@redhat.com>
-# Date 1562162181 -7200
-#      Wed Jul 03 15:56:21 2019 +0200
-# Node ID 88feab2a3e5e4b00b1626d59a0d3ecef93cafb92
-# Parent  b5d3f574967f8c5c705dab15682b0e16fac3e4be
-tests: ensure CAVS test dirs are created
-
-diff --git a/tests/fips/cavs_scripts/aes.sh b/tests/fips/cavs_scripts/aes.sh
---- a/tests/fips/cavs_scripts/aes.sh
-+++ b/tests/fips/cavs_scripts/aes.sh
-@@ -83,6 +83,8 @@ if [ ${COMMAND} = "verify" ]; then
-     exit $result
- fi
- 
-+test -d "${RSPDIR}" || mkdir "${RSPDIR}"
-+
- for request in $cbc_kat_requests; do
-     response=`echo $request | sed -e "s/req/rsp/"`
-     echo $request $response
-diff --git a/tests/fips/cavs_scripts/aesgcm.sh b/tests/fips/cavs_scripts/aesgcm.sh
---- a/tests/fips/cavs_scripts/aesgcm.sh
-+++ b/tests/fips/cavs_scripts/aesgcm.sh
-@@ -56,6 +56,8 @@ if [ ${COMMAND} = "verify" ]; then
-     exit $result
- fi
- 
-+test -d "${RSPDIR}" || mkdir "${RSPDIR}"
-+
- for request in $gcm_decrypt_requests; do
-     response=`echo $request | sed -e "s/req/rsp/"`
-     echo $request $response
-diff --git a/tests/fips/cavs_scripts/dsa.sh b/tests/fips/cavs_scripts/dsa.sh
---- a/tests/fips/cavs_scripts/dsa.sh
-+++ b/tests/fips/cavs_scripts/dsa.sh
-@@ -59,6 +59,8 @@ if [ ${COMMAND} = "verify" ]; then
-     exit $result
- fi
- 
-+test -d "${RSPDIR}" || mkdir "${RSPDIR}"
-+
- request=KeyPair.req
- response=`echo $request | sed -e "s/req/rsp/"`
- echo $request $response
-diff --git a/tests/fips/cavs_scripts/ecdsa.sh b/tests/fips/cavs_scripts/ecdsa.sh
---- a/tests/fips/cavs_scripts/ecdsa.sh
-+++ b/tests/fips/cavs_scripts/ecdsa.sh
-@@ -50,6 +50,8 @@ if [ ${COMMAND} = "verify" ]; then
-     exit $result
- fi
- 
-+test -d "${RSPDIR}" || mkdir "${RSPDIR}"
-+
- request=KeyPair.req
- response=`echo $request | sed -e "s/req/rsp/"`
- echo $request $response
-diff --git a/tests/fips/cavs_scripts/hmac.sh b/tests/fips/cavs_scripts/hmac.sh
---- a/tests/fips/cavs_scripts/hmac.sh
-+++ b/tests/fips/cavs_scripts/hmac.sh
-@@ -31,6 +31,9 @@ if [ ${COMMAND} = "verify" ]; then
-     done
-     exit $result
- fi
-+
-+test -d "${RSPDIR}" || mkdir "${RSPDIR}"
-+
- for request in $hmac_requests; do
-     response=`echo $request | sed -e "s/req/rsp/"`
-     echo $request $response
-diff --git a/tests/fips/cavs_scripts/ike.sh b/tests/fips/cavs_scripts/ike.sh
---- a/tests/fips/cavs_scripts/ike.sh
-+++ b/tests/fips/cavs_scripts/ike.sh
-@@ -33,6 +33,8 @@ if [ ${COMMAND} = "verify" ]; then
-     exit $result
- fi
- 
-+test -d "${RSPDIR}" || mkdir "${RSPDIR}"
-+
- request=ikev1_dsa.req
- response=`echo $request | sed -e "s/req/rsp/"`
- echo $request $response
-diff --git a/tests/fips/cavs_scripts/kas.sh b/tests/fips/cavs_scripts/kas.sh
---- a/tests/fips/cavs_scripts/kas.sh
-+++ b/tests/fips/cavs_scripts/kas.sh
-@@ -68,6 +68,8 @@ if [ ${COMMAND} = "verify" ]; then
-     exit $result
- fi
- 
-+test -d "${RSPDIR}" || mkdir "${RSPDIR}"
-+
- request=KASFunctionTest_ECCEphemeralUnified_NOKC_ZZOnly_init.req
- response=`echo $request | sed -e "s/req/rsp/"`
- echo $request $response
-diff --git a/tests/fips/cavs_scripts/rng.sh b/tests/fips/cavs_scripts/rng.sh
---- a/tests/fips/cavs_scripts/rng.sh
-+++ b/tests/fips/cavs_scripts/rng.sh
-@@ -30,6 +30,9 @@ if [ ${COMMAND} = "verify" ]; then
-     done
-     exit $result
- fi
-+
-+test -d "${RSPDIR}" || mkdir "${RSPDIR}"
-+
- for request in $drbg_requests; do
-     response=`echo $request | sed -e "s/req/rsp/"`
-     echo $request $response
-diff --git a/tests/fips/cavs_scripts/rsa.sh b/tests/fips/cavs_scripts/rsa.sh
---- a/tests/fips/cavs_scripts/rsa.sh
-+++ b/tests/fips/cavs_scripts/rsa.sh
-@@ -38,6 +38,8 @@ if [ ${COMMAND} = "verify" ]; then
-     exit $result
- fi
- 
-+test -d "${RSPDIR}" || mkdir "${RSPDIR}"
-+
- request=SigGen15_186-3.req
- response=`echo $request | sed -e "s/req/rsp/"`
- echo $request $response
-diff --git a/tests/fips/cavs_scripts/sha.sh b/tests/fips/cavs_scripts/sha.sh
---- a/tests/fips/cavs_scripts/sha.sh
-+++ b/tests/fips/cavs_scripts/sha.sh
-@@ -51,6 +51,8 @@ if [ ${COMMAND} = "verify" ]; then
-     exit $result
- fi
- 
-+test -d "${RSPDIR}" || mkdir "${RSPDIR}"
-+
- for request in $sha_ShortMsg_requests; do
-     response=`echo $request | sed -e "s/req/rsp/"`
-     echo $request $response
-diff --git a/tests/fips/cavs_scripts/tdea.sh b/tests/fips/cavs_scripts/tdea.sh
---- a/tests/fips/cavs_scripts/tdea.sh
-+++ b/tests/fips/cavs_scripts/tdea.sh
-@@ -77,6 +77,8 @@ if [ ${COMMAND} = "verify" ]; then
-     exit $result
- fi
- 
-+test -d "${RSPDIR}" || mkdir "${RSPDIR}"
-+
- for request in $cbc_kat_requests; do
-     response=`echo $request | sed -e "s/req/rsp/"`
-     echo $request $response
-diff --git a/tests/fips/cavs_scripts/tls.sh b/tests/fips/cavs_scripts/tls.sh
---- a/tests/fips/cavs_scripts/tls.sh
-+++ b/tests/fips/cavs_scripts/tls.sh
-@@ -30,6 +30,9 @@ if [ ${COMMAND} = "verify" ]; then
-     done
-     exit $result
- fi
-+
-+test -d "${RSPDIR}" || mkdir "${RSPDIR}"
-+
- for request in $tls_requests; do
-     response=`echo $request | sed -e "s/req/rsp/"`
-     echo $request $response
diff --git a/nss.spec b/nss.spec
index e489b66..666718c 100644
--- a/nss.spec
+++ b/nss.spec
@@ -1,5 +1,5 @@
 %global nspr_version 4.21.0
-%global nss_version 3.44.1
+%global nss_version 3.46.0
 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools
 %global saved_files_dir %{_libdir}/nss/saved
 %global dracutlibdir %{_prefix}/lib/dracut
@@ -109,7 +109,6 @@ Patch3:           nss-module-leak.patch
 Patch4:           iquote.patch
 # Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=1552767
 Patch5:           nss-skip-tls13-fips.patch
-Patch6:           nss-cavs-tests.patch
 
 %description
 Network Security Services (NSS) is a set of libraries designed to
@@ -875,6 +874,9 @@ update-crypto-policies &> /dev/null || :
 
 
 %changelog
+* Tue Sep  3 2019 Daiki Ueno <dueno@redhat.com> - 3.46.0-1
+- Update to NSS 3.46
+
 * Tue Jul  2 2019 Daiki Ueno <dueno@redhat.com> - 3.44.1-1
 - Update to NSS 3.44.1
 
diff --git a/sources b/sources
index 53b9c62..7b4873a 100644
--- a/sources
+++ b/sources
@@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403
 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c
 SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7
 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310
-SHA512 (nss-3.44.1.tar.gz) = eb8777701a25b54377026633b6bf284e4c62308012058355f348a7c57525afe96db74a07de41ba01754e316a7dff06689de527359a5474ed7ab606779c4cf169
+SHA512 (nss-3.46.tar.gz) = de309ec8d6aa2c3cf4d5ebfe9fa1f8bf5def717d22018d5c88c1de963b4ae7b0d69ad64e68d830574fc85613483fd538cb2f319ffb3fa2e1b97ec02f85d37c48

From ee7d6ef7f9f0facd5397b7780e67f6eeee4cda87 Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Tue, 3 Sep 2019 11:07:19 +0200
Subject: [PATCH 08/30] Remove upstreamed patch

---
 nss-module-leak.patch | 35 -----------------------------------
 nss.spec              |  2 --
 2 files changed, 37 deletions(-)
 delete mode 100644 nss-module-leak.patch

diff --git a/nss-module-leak.patch b/nss-module-leak.patch
deleted file mode 100644
index 7acf3f3..0000000
--- a/nss-module-leak.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-# HG changeset patch
-# User Daiki Ueno <dueno@redhat.com>
-# Date 1557150127 -7200
-#      Mon May 06 15:42:07 2019 +0200
-# Node ID 438ac983bda9ec7944990d22a37877e9111caa90
-# Parent  b018f3e84d87cce99a1fd81feeecb31123058687
-pk11slot: reference module from slot for finalization
-
-diff --git a/lib/pk11wrap/pk11slot.c b/lib/pk11wrap/pk11slot.c
---- a/lib/pk11wrap/pk11slot.c
-+++ b/lib/pk11wrap/pk11slot.c
-@@ -1439,6 +1439,11 @@ PK11_InitSlot(SECMODModule *mod, CK_SLOT
-     slot->slotID = slotID;
-     slot->isThreadSafe = mod->isThreadSafe;
-     slot->hasRSAInfo = PR_FALSE;
-+    slot->module = mod; /* NOTE: we don't make a reference here because
-+                         * modules have references to their slots. This
-+                         * works because modules keep implicit references
-+                         * from their slots, and won't unload and disappear
-+                         * until all their slots have been freed */
- 
-     if (PK11_GETTAB(slot)->C_GetSlotInfo(slotID, &slotInfo) != CKR_OK) {
-         slot->disabled = PR_TRUE;
-@@ -1448,11 +1453,6 @@ PK11_InitSlot(SECMODModule *mod, CK_SLOT
- 
-     /* test to make sure claimed mechanism work */
-     slot->needTest = mod->internal ? PR_FALSE : PR_TRUE;
--    slot->module = mod; /* NOTE: we don't make a reference here because
--                         * modules have references to their slots. This
--                         * works because modules keep implicit references
--                         * from their slots, and won't unload and disappear
--                         * until all their slots have been freed */
-     (void)PK11_MakeString(NULL, slot->slot_name,
-                           (char *)slotInfo.slotDescription, sizeof(slotInfo.slotDescription));
-     slot->isHW = (PRBool)((slotInfo.flags & CKF_HW_SLOT) == CKF_HW_SLOT);
diff --git a/nss.spec b/nss.spec
index 666718c..e7ec3dc 100644
--- a/nss.spec
+++ b/nss.spec
@@ -93,8 +93,6 @@ Source28:         nss-p11-kit.config
 
 # Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=617723
 Patch2:           nss-539183.patch
-# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=1549382
-Patch3:           nss-module-leak.patch
 # This patch uses the GCC -iquote option documented at
 # http://gcc.gnu.org/onlinedocs/gcc/Directory-Options.html#Directory-Options
 # to give the in-tree headers a higher priority over the system headers,

From 1b102037fd450b4b3960926dcf5b5132fab850b6 Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Wed, 4 Sep 2019 12:34:06 +0200
Subject: [PATCH 09/30] Rebuild with NSPR 4.22

---
 nss-skip-tls13-fips.patch | 27 ---------------------------
 nss.spec                  |  9 +++++----
 2 files changed, 5 insertions(+), 31 deletions(-)
 delete mode 100644 nss-skip-tls13-fips.patch

diff --git a/nss-skip-tls13-fips.patch b/nss-skip-tls13-fips.patch
deleted file mode 100644
index 4a7c707..0000000
--- a/nss-skip-tls13-fips.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-# HG changeset patch
-# User Daiki Ueno <dueno@redhat.com>
-# Date 1558341826 -7200
-#      Mon May 20 10:43:46 2019 +0200
-# Node ID b447f0046807b718d2928d0e33313620d38a287a
-# Parent  02ea5f29ac3c1f1c6e6eb4b655afd9b4fc075a9e
-tests: skip TLS 1.3 tests under FIPS mode
-
-diff --git a/tests/ssl/ssl.sh b/tests/ssl/ssl.sh
---- a/tests/ssl/ssl.sh
-+++ b/tests/ssl/ssl.sh
-@@ -393,6 +393,15 @@ ssl_auth()
-       echo "${testname}" | grep "TLS 1.3" > /dev/null
-       TLS13=$?
- 
-+      # Currently TLS 1.3 tests are known to fail under FIPS mode,
-+      # because HKDF is implemented using the PKCS #11 functions
-+      # prohibited under FIPS mode.
-+      if [ "${TLS13}" -eq 0 ] && \
-+	 [ "$SERVER_MODE" = "fips" -o "$CLIENT_MODE" = "fips" ] ; then
-+          echo "$SCRIPTNAME: skipping  $testname (non-FIPS only)"
-+          continue
-+      fi
-+
-       if [ "${CLIENT_MODE}" = "fips" -a "${CAUTH}" -eq 0 ] ; then
-           echo "$SCRIPTNAME: skipping  $testname (non-FIPS only)"
-       elif [ "$ectype" = "SNI" -a "$NORM_EXT" = "Extended Test" ] ; then
diff --git a/nss.spec b/nss.spec
index e7ec3dc..b23be35 100644
--- a/nss.spec
+++ b/nss.spec
@@ -1,4 +1,4 @@
-%global nspr_version 4.21.0
+%global nspr_version 4.22.0
 %global nss_version 3.46.0
 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools
 %global saved_files_dir %{_libdir}/nss/saved
@@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM",
 Summary:          Network Security Services
 Name:             nss
 Version:          %{nss_version}
-Release:          1%{?dist}
+Release:          2%{?dist}
 License:          MPLv2.0
 URL:              http://www.mozilla.org/projects/security/pki/nss/
 Requires:         nspr >= %{nspr_version}
@@ -105,8 +105,6 @@ Patch2:           nss-539183.patch
 # Once the buildroot aha been bootstrapped the patch may be removed
 # but it doesn't hurt to keep it.
 Patch4:           iquote.patch
-# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=1552767
-Patch5:           nss-skip-tls13-fips.patch
 
 %description
 Network Security Services (NSS) is a set of libraries designed to
@@ -872,6 +870,9 @@ update-crypto-policies &> /dev/null || :
 
 
 %changelog
+* Wed Sep  4 2019 Daiki Ueno <dueno@redhat.com> - 3.46.0-2
+- Rebuild with NSPR 4.22
+
 * Tue Sep  3 2019 Daiki Ueno <dueno@redhat.com> - 3.46.0-1
 - Update to NSS 3.46
 

From 21c87edf0fdb72362aacf63c89bb2e2c579a33f3 Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Mon, 21 Oct 2019 13:56:08 +0200
Subject: [PATCH 10/30] Update to NSS 3.46.1

---
 .gitignore | 1 +
 nss.spec   | 9 ++++++---
 sources    | 2 +-
 3 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/.gitignore b/.gitignore
index f245589..8f02c46 100644
--- a/.gitignore
+++ b/.gitignore
@@ -38,3 +38,4 @@ TestUser51.cert
 /nss-3.44.tar.gz
 /nss-3.44.1.tar.gz
 /nss-3.46.tar.gz
+/nss-3.46.1.tar.gz
diff --git a/nss.spec b/nss.spec
index b23be35..12e363e 100644
--- a/nss.spec
+++ b/nss.spec
@@ -1,5 +1,5 @@
-%global nspr_version 4.22.0
-%global nss_version 3.46.0
+%global nspr_version 4.23.0
+%global nss_version 3.46.1
 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools
 %global saved_files_dir %{_libdir}/nss/saved
 %global dracutlibdir %{_prefix}/lib/dracut
@@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM",
 Summary:          Network Security Services
 Name:             nss
 Version:          %{nss_version}
-Release:          2%{?dist}
+Release:          1%{?dist}
 License:          MPLv2.0
 URL:              http://www.mozilla.org/projects/security/pki/nss/
 Requires:         nspr >= %{nspr_version}
@@ -870,6 +870,9 @@ update-crypto-policies &> /dev/null || :
 
 
 %changelog
+* Mon Oct 21 2019 Daiki Ueno <dueno@redhat.com> - 3.46.1-1
+- Update to NSS 3.46.1
+
 * Wed Sep  4 2019 Daiki Ueno <dueno@redhat.com> - 3.46.0-2
 - Rebuild with NSPR 4.22
 
diff --git a/sources b/sources
index 7b4873a..cef553a 100644
--- a/sources
+++ b/sources
@@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403
 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c
 SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7
 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310
-SHA512 (nss-3.46.tar.gz) = de309ec8d6aa2c3cf4d5ebfe9fa1f8bf5def717d22018d5c88c1de963b4ae7b0d69ad64e68d830574fc85613483fd538cb2f319ffb3fa2e1b97ec02f85d37c48
+SHA512 (nss-3.46.1.tar.gz) = f4c24f0e31d11413cbbf791a24687c02cd934b9baf4a3e9ce27406638a1d497654fbeec79c22ab4ad29374dd0063c05104c9514580b1b8156ed8d18404e1681b

From 33337028ab73b9a38787130555030047e1917781 Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Tue, 22 Oct 2019 15:25:52 +0200
Subject: [PATCH 11/30] Update to NSS 3.47

---
 .gitignore | 1 +
 nss.spec   | 5 ++++-
 sources    | 2 +-
 3 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index 8f02c46..db90691 100644
--- a/.gitignore
+++ b/.gitignore
@@ -39,3 +39,4 @@ TestUser51.cert
 /nss-3.44.1.tar.gz
 /nss-3.46.tar.gz
 /nss-3.46.1.tar.gz
+/nss-3.47.tar.gz
diff --git a/nss.spec b/nss.spec
index 12e363e..cc1c183 100644
--- a/nss.spec
+++ b/nss.spec
@@ -1,5 +1,5 @@
 %global nspr_version 4.23.0
-%global nss_version 3.46.1
+%global nss_version 3.47.0
 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools
 %global saved_files_dir %{_libdir}/nss/saved
 %global dracutlibdir %{_prefix}/lib/dracut
@@ -870,6 +870,9 @@ update-crypto-policies &> /dev/null || :
 
 
 %changelog
+* Tue Oct 22 2019 Daiki Ueno <dueno@redhat.com> - 3.47.0-1
+- Update to NSS 3.47
+
 * Mon Oct 21 2019 Daiki Ueno <dueno@redhat.com> - 3.46.1-1
 - Update to NSS 3.46.1
 
diff --git a/sources b/sources
index cef553a..324bcf1 100644
--- a/sources
+++ b/sources
@@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403
 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c
 SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7
 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310
-SHA512 (nss-3.46.1.tar.gz) = f4c24f0e31d11413cbbf791a24687c02cd934b9baf4a3e9ce27406638a1d497654fbeec79c22ab4ad29374dd0063c05104c9514580b1b8156ed8d18404e1681b
+SHA512 (nss-3.47.tar.gz) = 99d04d28c38092826f5aab125662780865de49a97743ff0ab49a191bafae3ba3a937369cd6909ab23e7dcaf06482c8852b31ef057dc12c758f2681e03822e247

From 4499328bb9b6aa4d7055ec1addb4297e94ebbdbb Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Wed, 23 Oct 2019 10:44:14 +0200
Subject: [PATCH 12/30] Install cmac.h required by blapi.h (#1764513)

---
 nss.spec | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/nss.spec b/nss.spec
index cc1c183..dcfbcf1 100644
--- a/nss.spec
+++ b/nss.spec
@@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM",
 Summary:          Network Security Services
 Name:             nss
 Version:          %{nss_version}
-Release:          1%{?dist}
+Release:          2%{?dist}
 License:          MPLv2.0
 URL:              http://www.mozilla.org/projects/security/pki/nss/
 Requires:         nspr >= %{nspr_version}
@@ -553,7 +553,7 @@ do
 done
 
 # Copy some freebl include files we also want
-for file in blapi.h alghmac.h
+for file in blapi.h alghmac.h cmac.h
 do
   install -p -m 644 dist/private/nss/$file $RPM_BUILD_ROOT/%{_includedir}/nss3
 done
@@ -846,6 +846,7 @@ update-crypto-policies &> /dev/null || :
 %{_includedir}/nss3/blapi.h
 %{_includedir}/nss3/blapit.h
 %{_includedir}/nss3/alghmac.h
+%{_includedir}/nss3/cmac.h
 %{_includedir}/nss3/lowkeyi.h
 %{_includedir}/nss3/lowkeyti.h
 
@@ -870,6 +871,9 @@ update-crypto-policies &> /dev/null || :
 
 
 %changelog
+* Wed Oct 23 2019 Daiki Ueno <dueno@redhat.com> - 3.47.0-2
+- Install cmac.h required by blapi.h (#1764513)
+
 * Tue Oct 22 2019 Daiki Ueno <dueno@redhat.com> - 3.47.0-1
 - Update to NSS 3.47
 

From 397535b861f421d4bd5defffe14543afac1cb882 Mon Sep 17 00:00:00 2001
From: Bob Relyea <rrelyea@redhat.com>
Date: Mon, 4 Nov 2019 14:11:20 -0800
Subject: [PATCH 13/30] Resolves: rhbz#1768655 NSS softoken does not include
 CKM_NSS_IKE1_APP_B_PRF_DERIVE in it's mechanism list, causing libreswan to
 crash.

---
 nss-3.47-ike-fix.patch | 22 ++++++++++++++++++++++
 nss.spec               |  7 ++++++-
 2 files changed, 28 insertions(+), 1 deletion(-)
 create mode 100644 nss-3.47-ike-fix.patch

diff --git a/nss-3.47-ike-fix.patch b/nss-3.47-ike-fix.patch
new file mode 100644
index 0000000..2de0aee
--- /dev/null
+++ b/nss-3.47-ike-fix.patch
@@ -0,0 +1,22 @@
+diff -up ./lib/softoken/pkcs11.c.ike_fix ./lib/softoken/pkcs11.c
+--- ./lib/softoken/pkcs11.c.ike_fix	2019-11-04 10:15:08.022176945 -0800
++++ ./lib/softoken/pkcs11.c	2019-11-04 10:17:35.396733750 -0800
+@@ -330,7 +330,7 @@ static const struct mechanismList mechan
+     { CKM_AES_CTS, { 16, 32, CKF_EN_DE }, PR_TRUE },
+     { CKM_AES_CTR, { 16, 32, CKF_EN_DE }, PR_TRUE },
+     { CKM_AES_GCM, { 16, 32, CKF_EN_DE }, PR_TRUE },
+-    { CKM_AES_XCBC_MAC_96, { 16, 16, CKF_SN_VR }, PR_TRUE },
++    { CKM_AES_XCBC_MAC_96, { 12, 12, CKF_SN_VR }, PR_TRUE },
+     { CKM_AES_XCBC_MAC, { 16, 16, CKF_SN_VR }, PR_TRUE },
+     /* ------------------------- Camellia Operations --------------------- */
+     { CKM_CAMELLIA_KEY_GEN, { 16, 32, CKF_GENERATE }, PR_TRUE },
+@@ -518,7 +518,8 @@ static const struct mechanismList mechan
+     /* --------------------IPSEC ----------------------- */
+     { CKM_NSS_IKE_PRF_PLUS_DERIVE, { 8, 255 * 64, CKF_DERIVE }, PR_TRUE },
+     { CKM_NSS_IKE_PRF_DERIVE, { 8, 64, CKF_DERIVE }, PR_TRUE },
+-    { CKM_NSS_IKE1_PRF_DERIVE, { 8, 64, CKF_DERIVE }, PR_TRUE }
++    { CKM_NSS_IKE1_PRF_DERIVE, { 8, 64, CKF_DERIVE }, PR_TRUE },
++    { CKM_NSS_IKE1_APP_B_PRF_DERIVE, { 8, 255 * 64, CKF_DERIVE }, PR_TRUE }
+ };
+ static const CK_ULONG mechanismCount = sizeof(mechanisms) / sizeof(mechanisms[0]);
+ 
diff --git a/nss.spec b/nss.spec
index dcfbcf1..b634a6e 100644
--- a/nss.spec
+++ b/nss.spec
@@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM",
 Summary:          Network Security Services
 Name:             nss
 Version:          %{nss_version}
-Release:          2%{?dist}
+Release:          3%{?dist}
 License:          MPLv2.0
 URL:              http://www.mozilla.org/projects/security/pki/nss/
 Requires:         nspr >= %{nspr_version}
@@ -105,6 +105,8 @@ Patch2:           nss-539183.patch
 # Once the buildroot aha been bootstrapped the patch may be removed
 # but it doesn't hurt to keep it.
 Patch4:           iquote.patch
+# add missing ike mechanism to softoken
+Patch10:          nss-3.47-ike-fix.patch
 
 %description
 Network Security Services (NSS) is a set of libraries designed to
@@ -871,6 +873,9 @@ update-crypto-policies &> /dev/null || :
 
 
 %changelog
+* Mon Nov 7 2019 Bob Relyea <rrelyea@redhat.com> - 3.47.0-3
+- Include ike mechanism fix
+
 * Wed Oct 23 2019 Daiki Ueno <dueno@redhat.com> - 3.47.0-2
 - Install cmac.h required by blapi.h (#1764513)
 

From de5b47f5cb834548d14bd54c019c8313c1f2bfb1 Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Fri, 22 Nov 2019 18:04:12 +0100
Subject: [PATCH 14/30] Update to NSS 3.47.1

---
 .gitignore | 1 +
 nss.spec   | 7 +++++--
 sources    | 2 +-
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/.gitignore b/.gitignore
index db90691..2580845 100644
--- a/.gitignore
+++ b/.gitignore
@@ -40,3 +40,4 @@ TestUser51.cert
 /nss-3.46.tar.gz
 /nss-3.46.1.tar.gz
 /nss-3.47.tar.gz
+/nss-3.47.1.tar.gz
diff --git a/nss.spec b/nss.spec
index b634a6e..89913a9 100644
--- a/nss.spec
+++ b/nss.spec
@@ -1,5 +1,5 @@
 %global nspr_version 4.23.0
-%global nss_version 3.47.0
+%global nss_version 3.47.1
 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools
 %global saved_files_dir %{_libdir}/nss/saved
 %global dracutlibdir %{_prefix}/lib/dracut
@@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM",
 Summary:          Network Security Services
 Name:             nss
 Version:          %{nss_version}
-Release:          3%{?dist}
+Release:          1%{?dist}
 License:          MPLv2.0
 URL:              http://www.mozilla.org/projects/security/pki/nss/
 Requires:         nspr >= %{nspr_version}
@@ -873,6 +873,9 @@ update-crypto-policies &> /dev/null || :
 
 
 %changelog
+* Fri Nov 22 2019 Daiki Ueno <dueno@redhat.com> - 3.47.1-1
+- Update to NSS 3.47.1
+
 * Mon Nov 7 2019 Bob Relyea <rrelyea@redhat.com> - 3.47.0-3
 - Include ike mechanism fix
 
diff --git a/sources b/sources
index 324bcf1..e15e2b4 100644
--- a/sources
+++ b/sources
@@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403
 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c
 SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7
 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310
-SHA512 (nss-3.47.tar.gz) = 99d04d28c38092826f5aab125662780865de49a97743ff0ab49a191bafae3ba3a937369cd6909ab23e7dcaf06482c8852b31ef057dc12c758f2681e03822e247
+SHA512 (nss-3.47.1.tar.gz) = ddee53f58929e5f3849c9f88a3a6735453a258c3c32a7e3e73cc949e0b7ad2dff81b21db31c9c5e1ef3eb79d63c31660e38ce76c06ca54a5681dd611dc2e2ae9

From 78081612f7749c9bad522f1fa7837bb2b121f8ef Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Thu, 28 Nov 2019 16:13:41 +0100
Subject: [PATCH 15/30] Fix intermittent SEC_ERROR_UNKNOWN_ISSUER (#1752303,
 #1648617)

---
 nss-3.47-certdb-temp-cert.patch | 230 ++++++++++++++++++++++++++++++++
 nss.spec                        |   7 +-
 2 files changed, 236 insertions(+), 1 deletion(-)
 create mode 100644 nss-3.47-certdb-temp-cert.patch

diff --git a/nss-3.47-certdb-temp-cert.patch b/nss-3.47-certdb-temp-cert.patch
new file mode 100644
index 0000000..b5623de
--- /dev/null
+++ b/nss-3.47-certdb-temp-cert.patch
@@ -0,0 +1,230 @@
+# HG changeset patch
+# User Daiki Ueno <dueno@redhat.com>
+# Date 1574953499 -3600
+#      Thu Nov 28 16:04:59 2019 +0100
+# Node ID f1f705bd0528713216e16867233825c299d3e3b2
+# Parent  10722c590949819ed4d971ad5ae213bc8b11a1bf
+Bug 1593167, certdb: prefer perm certs over temp certs when trust is not available
+
+Summary:
+When a builtin root module is loaded after some temp certs being
+loaded, our certificate lookup logic preferred those temp certs over
+perm certs stored on the root module.  This was a problem because such
+temp certs are usually not accompanied with trust information.
+
+This makes the certificate lookup logic capable of handling such
+situations by checking if the trust information is attached to temp
+certs and otherwise falling back to perm certs.
+
+Reviewers: rrelyea, keeler
+
+Reviewed By: rrelyea
+
+Subscribers: heftig
+
+Bug #: 1593167
+
+Differential Revision: https://phabricator.services.mozilla.com/D54726
+
+diff --git a/lib/certdb/stanpcertdb.c b/lib/certdb/stanpcertdb.c
+--- a/lib/certdb/stanpcertdb.c
++++ b/lib/certdb/stanpcertdb.c
+@@ -340,6 +340,91 @@ CERT_AddTempCertToPerm(CERTCertificate *
+     return __CERT_AddTempCertToPerm(cert, nickname, trust);
+ }
+ 
++static CERTCertificate *
++find_cert_by_der_cert(CERTCertDBHandle *handle, SECItem *derCert)
++{
++    CERTCertificate *cc;
++    NSSCryptoContext *context;
++    NSSCertificate *cert = NULL;
++    NSSCertificate *tempCert = NULL;
++    NSSCertificate *permCert = NULL;
++    NSSDER encoding;
++    nssCertificateStoreTrace lockTrace = { NULL, NULL, PR_FALSE, PR_FALSE };
++    nssCertificateStoreTrace unlockTrace = { NULL, NULL, PR_FALSE, PR_FALSE };
++
++    /* We retrieve a certificate instance for derCert in this order:
++     * 1. Look up a temp cert in the crypto context.  If it is found
++     *    and has a trust object associated, use it.
++     * 2. Look up a perm cert in the trust domain.  If it is found,
++     *    use it.  Otherwise, use the temp cert.
++     */
++    NSSITEM_FROM_SECITEM(&encoding, derCert);
++    context = STAN_GetDefaultCryptoContext();
++
++    /* First, see if it is already a temp cert */
++    tempCert = NSSCryptoContext_FindCertificateByEncodedCertificate(context,
++                                                                    &encoding);
++    if (tempCert) {
++        NSSTrust *trust;
++
++        trust = nssCryptoContext_FindTrustForCertificate(context, tempCert);
++        if (trust) {
++            nssTrust_Destroy(trust);
++            cert = tempCert;
++            tempCert = NULL;
++        }
++    }
++
++    /* Then, see if it is already a perm cert */
++    if (!cert && handle) {
++        permCert = NSSTrustDomain_FindCertificateByEncodedCertificate(handle,
++                                                                      &encoding);
++        if (permCert) {
++            /* Delete the temp instance */
++            if (tempCert) {
++                nssCertificateStore_Lock(context->certStore, &lockTrace);
++                nssCertificateStore_RemoveCertLOCKED(context->certStore,
++                                                     tempCert);
++                nssCertificateStore_Unlock(context->certStore, &lockTrace,
++                                           &unlockTrace);
++            }
++            cert = permCert;
++            permCert = NULL;
++        } else if (tempCert) {
++            cert = tempCert;
++            tempCert = NULL;
++        }
++    }
++
++    if (tempCert) {
++        nssCertificate_Destroy(tempCert);
++    }
++    if (permCert) {
++        nssCertificate_Destroy(permCert);
++    }
++
++    if (!cert) {
++        return NULL;
++    }
++
++    /* Actually, that search ends up going by issuer/serial,
++     * so it is still possible to return a cert with the same
++     * issuer/serial but a different encoding, and we're
++     * going to reject that
++     */
++    if (!nssItem_Equal(&cert->encoding, &encoding, NULL)) {
++        nssCertificate_Destroy(cert);
++        PORT_SetError(SEC_ERROR_REUSED_ISSUER_AND_SERIAL);
++        return NULL;
++    }
++
++    cc = STAN_GetCERTCertificateOrRelease(cert);
++    if (!cc) {
++        CERT_MapStanError();
++    }
++    return cc;
++}
++
+ CERTCertificate *
+ CERT_NewTempCertificate(CERTCertDBHandle *handle, SECItem *derCert,
+                         char *nickname, PRBool isperm, PRBool copyDER)
+@@ -351,32 +436,8 @@ CERT_NewTempCertificate(CERTCertDBHandle
+     NSSCryptoContext *gCC = STAN_GetDefaultCryptoContext();
+     NSSTrustDomain *gTD = STAN_GetDefaultTrustDomain();
+     if (!isperm) {
+-        NSSDER encoding;
+-        NSSITEM_FROM_SECITEM(&encoding, derCert);
+-        /* First, see if it is already a temp cert */
+-        c = NSSCryptoContext_FindCertificateByEncodedCertificate(gCC,
+-                                                                 &encoding);
+-        if (!c && handle) {
+-            /* Then, see if it is already a perm cert */
+-            c = NSSTrustDomain_FindCertificateByEncodedCertificate(handle,
+-                                                                   &encoding);
+-        }
+-        if (c) {
+-            /* actually, that search ends up going by issuer/serial,
+-             * so it is still possible to return a cert with the same
+-             * issuer/serial but a different encoding, and we're
+-             * going to reject that
+-             */
+-            if (!nssItem_Equal(&c->encoding, &encoding, NULL)) {
+-                nssCertificate_Destroy(c);
+-                PORT_SetError(SEC_ERROR_REUSED_ISSUER_AND_SERIAL);
+-                cc = NULL;
+-            } else {
+-                cc = STAN_GetCERTCertificateOrRelease(c);
+-                if (cc == NULL) {
+-                    CERT_MapStanError();
+-                }
+-            }
++        cc = find_cert_by_der_cert(handle, derCert);
++        if (cc) {
+             return cc;
+         }
+     }
+@@ -598,19 +659,7 @@ CERT_FindCertByNickname(CERTCertDBHandle
+ CERTCertificate *
+ CERT_FindCertByDERCert(CERTCertDBHandle *handle, SECItem *derCert)
+ {
+-    NSSCryptoContext *cc;
+-    NSSCertificate *c;
+-    NSSDER encoding;
+-    NSSITEM_FROM_SECITEM(&encoding, derCert);
+-    cc = STAN_GetDefaultCryptoContext();
+-    c = NSSCryptoContext_FindCertificateByEncodedCertificate(cc, &encoding);
+-    if (!c) {
+-        c = NSSTrustDomain_FindCertificateByEncodedCertificate(handle,
+-                                                               &encoding);
+-        if (!c)
+-            return NULL;
+-    }
+-    return STAN_GetCERTCertificateOrRelease(c);
++    return find_cert_by_der_cert(handle, derCert);
+ }
+ 
+ static CERTCertificate *
+diff --git a/lib/pki/pkistore.c b/lib/pki/pkistore.c
+--- a/lib/pki/pkistore.c
++++ b/lib/pki/pkistore.c
+@@ -27,6 +27,8 @@
+ 
+ #include "prbit.h"
+ 
++#include "secerr.h"
++
+ /*
+  * Certificate Store
+  *
+@@ -544,6 +546,13 @@ nssCertificateStore_FindCertificateByEnc
+                                                                         &serial);
+     PORT_Free(issuer.data);
+     PORT_Free(serial.data);
++
++    if (rvCert && !nssItem_Equal(&rvCert->encoding, encoding, NULL)) {
++        nssCertificate_Destroy(rvCert);
++        PORT_SetError(SEC_ERROR_REUSED_ISSUER_AND_SERIAL);
++        return NULL;
++    }
++
+     return rvCert;
+ }
+ 
+diff --git a/lib/pki/trustdomain.c b/lib/pki/trustdomain.c
+--- a/lib/pki/trustdomain.c
++++ b/lib/pki/trustdomain.c
+@@ -15,6 +15,7 @@
+ #include "pk11pub.h"
+ #include "nssrwlk.h"
+ #include "pk11priv.h"
++#include "secerr.h"
+ 
+ #define NSSTRUSTDOMAIN_DEFAULT_CACHE_SIZE 32
+ 
+@@ -841,6 +842,13 @@ nssTrustDomain_FindCertificateByEncodedC
+                                                                    &serial);
+     PORT_Free(issuer.data);
+     PORT_Free(serial.data);
++
++    if (rvCert && !nssItem_Equal(&rvCert->encoding, ber, NULL)) {
++        nssCertificate_Destroy(rvCert);
++        PORT_SetError(SEC_ERROR_REUSED_ISSUER_AND_SERIAL);
++        return NULL;
++    }
++
+     return rvCert;
+ }
+ 
diff --git a/nss.spec b/nss.spec
index 89913a9..9215146 100644
--- a/nss.spec
+++ b/nss.spec
@@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM",
 Summary:          Network Security Services
 Name:             nss
 Version:          %{nss_version}
-Release:          1%{?dist}
+Release:          2%{?dist}
 License:          MPLv2.0
 URL:              http://www.mozilla.org/projects/security/pki/nss/
 Requires:         nspr >= %{nspr_version}
@@ -107,6 +107,8 @@ Patch2:           nss-539183.patch
 Patch4:           iquote.patch
 # add missing ike mechanism to softoken
 Patch10:          nss-3.47-ike-fix.patch
+# https://bugzilla.mozilla.org/show_bug.cgi?id=1593167
+Patch11:	  nss-3.47-certdb-temp-cert.patch
 
 %description
 Network Security Services (NSS) is a set of libraries designed to
@@ -873,6 +875,9 @@ update-crypto-policies &> /dev/null || :
 
 
 %changelog
+* Thu Nov 28 2019 Daiki Ueno <dueno@redhat.com> - 3.47.1-2
+- Fix intermittent SEC_ERROR_UNKNOWN_ISSUER (#1752303, #1648617)
+
 * Fri Nov 22 2019 Daiki Ueno <dueno@redhat.com> - 3.47.1-1
 - Update to NSS 3.47.1
 

From d85f98774d7cb4e8217c3b68a11de9ef9401394a Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Tue, 3 Dec 2019 09:31:24 +0100
Subject: [PATCH 16/30] Update nss-3.47-certdb-temp-cert.patch to the final
 version

---
 nss-3.47-certdb-temp-cert.patch | 249 +++-----------------------------
 nss.spec                        |   5 +-
 2 files changed, 24 insertions(+), 230 deletions(-)

diff --git a/nss-3.47-certdb-temp-cert.patch b/nss-3.47-certdb-temp-cert.patch
index b5623de..a1608f4 100644
--- a/nss-3.47-certdb-temp-cert.patch
+++ b/nss-3.47-certdb-temp-cert.patch
@@ -1,230 +1,21 @@
-# HG changeset patch
-# User Daiki Ueno <dueno@redhat.com>
-# Date 1574953499 -3600
-#      Thu Nov 28 16:04:59 2019 +0100
-# Node ID f1f705bd0528713216e16867233825c299d3e3b2
-# Parent  10722c590949819ed4d971ad5ae213bc8b11a1bf
-Bug 1593167, certdb: prefer perm certs over temp certs when trust is not available
-
-Summary:
-When a builtin root module is loaded after some temp certs being
-loaded, our certificate lookup logic preferred those temp certs over
-perm certs stored on the root module.  This was a problem because such
-temp certs are usually not accompanied with trust information.
-
-This makes the certificate lookup logic capable of handling such
-situations by checking if the trust information is attached to temp
-certs and otherwise falling back to perm certs.
-
-Reviewers: rrelyea, keeler
-
-Reviewed By: rrelyea
-
-Subscribers: heftig
-
-Bug #: 1593167
-
-Differential Revision: https://phabricator.services.mozilla.com/D54726
-
-diff --git a/lib/certdb/stanpcertdb.c b/lib/certdb/stanpcertdb.c
---- a/lib/certdb/stanpcertdb.c
-+++ b/lib/certdb/stanpcertdb.c
-@@ -340,6 +340,91 @@ CERT_AddTempCertToPerm(CERTCertificate *
-     return __CERT_AddTempCertToPerm(cert, nickname, trust);
- }
- 
-+static CERTCertificate *
-+find_cert_by_der_cert(CERTCertDBHandle *handle, SECItem *derCert)
-+{
-+    CERTCertificate *cc;
-+    NSSCryptoContext *context;
-+    NSSCertificate *cert = NULL;
-+    NSSCertificate *tempCert = NULL;
-+    NSSCertificate *permCert = NULL;
-+    NSSDER encoding;
-+    nssCertificateStoreTrace lockTrace = { NULL, NULL, PR_FALSE, PR_FALSE };
-+    nssCertificateStoreTrace unlockTrace = { NULL, NULL, PR_FALSE, PR_FALSE };
-+
-+    /* We retrieve a certificate instance for derCert in this order:
-+     * 1. Look up a temp cert in the crypto context.  If it is found
-+     *    and has a trust object associated, use it.
-+     * 2. Look up a perm cert in the trust domain.  If it is found,
-+     *    use it.  Otherwise, use the temp cert.
-+     */
-+    NSSITEM_FROM_SECITEM(&encoding, derCert);
-+    context = STAN_GetDefaultCryptoContext();
-+
-+    /* First, see if it is already a temp cert */
-+    tempCert = NSSCryptoContext_FindCertificateByEncodedCertificate(context,
-+                                                                    &encoding);
-+    if (tempCert) {
-+        NSSTrust *trust;
-+
-+        trust = nssCryptoContext_FindTrustForCertificate(context, tempCert);
-+        if (trust) {
-+            nssTrust_Destroy(trust);
-+            cert = tempCert;
-+            tempCert = NULL;
-+        }
-+    }
-+
-+    /* Then, see if it is already a perm cert */
-+    if (!cert && handle) {
-+        permCert = NSSTrustDomain_FindCertificateByEncodedCertificate(handle,
-+                                                                      &encoding);
-+        if (permCert) {
-+            /* Delete the temp instance */
-+            if (tempCert) {
-+                nssCertificateStore_Lock(context->certStore, &lockTrace);
-+                nssCertificateStore_RemoveCertLOCKED(context->certStore,
-+                                                     tempCert);
-+                nssCertificateStore_Unlock(context->certStore, &lockTrace,
-+                                           &unlockTrace);
-+            }
-+            cert = permCert;
-+            permCert = NULL;
-+        } else if (tempCert) {
-+            cert = tempCert;
-+            tempCert = NULL;
-+        }
-+    }
-+
-+    if (tempCert) {
-+        nssCertificate_Destroy(tempCert);
-+    }
-+    if (permCert) {
-+        nssCertificate_Destroy(permCert);
-+    }
-+
-+    if (!cert) {
-+        return NULL;
-+    }
-+
-+    /* Actually, that search ends up going by issuer/serial,
-+     * so it is still possible to return a cert with the same
-+     * issuer/serial but a different encoding, and we're
-+     * going to reject that
-+     */
-+    if (!nssItem_Equal(&cert->encoding, &encoding, NULL)) {
-+        nssCertificate_Destroy(cert);
-+        PORT_SetError(SEC_ERROR_REUSED_ISSUER_AND_SERIAL);
-+        return NULL;
-+    }
-+
-+    cc = STAN_GetCERTCertificateOrRelease(cert);
-+    if (!cc) {
-+        CERT_MapStanError();
-+    }
-+    return cc;
-+}
-+
- CERTCertificate *
- CERT_NewTempCertificate(CERTCertDBHandle *handle, SECItem *derCert,
-                         char *nickname, PRBool isperm, PRBool copyDER)
-@@ -351,32 +436,8 @@ CERT_NewTempCertificate(CERTCertDBHandle
-     NSSCryptoContext *gCC = STAN_GetDefaultCryptoContext();
-     NSSTrustDomain *gTD = STAN_GetDefaultTrustDomain();
-     if (!isperm) {
--        NSSDER encoding;
--        NSSITEM_FROM_SECITEM(&encoding, derCert);
--        /* First, see if it is already a temp cert */
--        c = NSSCryptoContext_FindCertificateByEncodedCertificate(gCC,
--                                                                 &encoding);
--        if (!c && handle) {
--            /* Then, see if it is already a perm cert */
--            c = NSSTrustDomain_FindCertificateByEncodedCertificate(handle,
--                                                                   &encoding);
--        }
--        if (c) {
--            /* actually, that search ends up going by issuer/serial,
--             * so it is still possible to return a cert with the same
--             * issuer/serial but a different encoding, and we're
--             * going to reject that
--             */
--            if (!nssItem_Equal(&c->encoding, &encoding, NULL)) {
--                nssCertificate_Destroy(c);
--                PORT_SetError(SEC_ERROR_REUSED_ISSUER_AND_SERIAL);
--                cc = NULL;
--            } else {
--                cc = STAN_GetCERTCertificateOrRelease(c);
--                if (cc == NULL) {
--                    CERT_MapStanError();
--                }
--            }
-+        cc = find_cert_by_der_cert(handle, derCert);
-+        if (cc) {
-             return cc;
-         }
+diff --git a/lib/pki/pki3hack.c b/lib/pki/pki3hack.c
+--- a/lib/pki/pki3hack.c
++++ b/lib/pki/pki3hack.c
+@@ -921,11 +921,11 @@
      }
-@@ -598,19 +659,7 @@ CERT_FindCertByNickname(CERTCertDBHandle
- CERTCertificate *
- CERT_FindCertByDERCert(CERTCertDBHandle *handle, SECItem *derCert)
- {
--    NSSCryptoContext *cc;
--    NSSCertificate *c;
--    NSSDER encoding;
--    NSSITEM_FROM_SECITEM(&encoding, derCert);
--    cc = STAN_GetDefaultCryptoContext();
--    c = NSSCryptoContext_FindCertificateByEncodedCertificate(cc, &encoding);
--    if (!c) {
--        c = NSSTrustDomain_FindCertificateByEncodedCertificate(handle,
--                                                               &encoding);
--        if (!c)
--            return NULL;
--    }
--    return STAN_GetCERTCertificateOrRelease(c);
-+    return find_cert_by_der_cert(handle, derCert);
- }
- 
- static CERTCertificate *
-diff --git a/lib/pki/pkistore.c b/lib/pki/pkistore.c
---- a/lib/pki/pkistore.c
-+++ b/lib/pki/pkistore.c
-@@ -27,6 +27,8 @@
- 
- #include "prbit.h"
- 
-+#include "secerr.h"
-+
- /*
-  * Certificate Store
-  *
-@@ -544,6 +546,13 @@ nssCertificateStore_FindCertificateByEnc
-                                                                         &serial);
-     PORT_Free(issuer.data);
-     PORT_Free(serial.data);
-+
-+    if (rvCert && !nssItem_Equal(&rvCert->encoding, encoding, NULL)) {
-+        nssCertificate_Destroy(rvCert);
-+        PORT_SetError(SEC_ERROR_REUSED_ISSUER_AND_SERIAL);
-+        return NULL;
-+    }
-+
-     return rvCert;
- }
- 
-diff --git a/lib/pki/trustdomain.c b/lib/pki/trustdomain.c
---- a/lib/pki/trustdomain.c
-+++ b/lib/pki/trustdomain.c
-@@ -15,6 +15,7 @@
- #include "pk11pub.h"
- #include "nssrwlk.h"
- #include "pk11priv.h"
-+#include "secerr.h"
- 
- #define NSSTRUSTDOMAIN_DEFAULT_CACHE_SIZE 32
- 
-@@ -841,6 +842,13 @@ nssTrustDomain_FindCertificateByEncodedC
-                                                                    &serial);
-     PORT_Free(issuer.data);
-     PORT_Free(serial.data);
-+
-+    if (rvCert && !nssItem_Equal(&rvCert->encoding, ber, NULL)) {
-+        nssCertificate_Destroy(rvCert);
-+        PORT_SetError(SEC_ERROR_REUSED_ISSUER_AND_SERIAL);
-+        return NULL;
-+    }
-+
-     return rvCert;
- }
- 
+     if (!cc->nssCertificate || forceUpdate) {
+         fill_CERTCertificateFields(c, cc, forceUpdate);
+-    } else if (CERT_GetCertTrust(cc, &certTrust) != SECSuccess &&
+-               !c->object.cryptoContext) {
+-        /* if it's a perm cert, it might have been stored before the
+-         * trust, so look for the trust again.  But a temp cert can be
+-         * ignored.
++    } else if (CERT_GetCertTrust(cc, &certTrust) != SECSuccess) {
++        /* If it's a perm cert, it might have been stored before the
++         * trust, so look for the trust again. If it's a temp cert, it
++         * might have been stored before the builtin module is loaded,
++         * so still need to look for the trust again.
+          */
+         CERTCertTrust *trust = NULL;
+         trust = nssTrust_GetCERTCertTrustForCert(c, cc);
+
diff --git a/nss.spec b/nss.spec
index 9215146..d04242a 100644
--- a/nss.spec
+++ b/nss.spec
@@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM",
 Summary:          Network Security Services
 Name:             nss
 Version:          %{nss_version}
-Release:          2%{?dist}
+Release:          3%{?dist}
 License:          MPLv2.0
 URL:              http://www.mozilla.org/projects/security/pki/nss/
 Requires:         nspr >= %{nspr_version}
@@ -875,6 +875,9 @@ update-crypto-policies &> /dev/null || :
 
 
 %changelog
+* Tue Dec  3 2019 Daiki Ueno <dueno@redhat.com> - 3.47.1-3
+- Update nss-3.47-certdb-temp-cert.patch to the final version
+
 * Thu Nov 28 2019 Daiki Ueno <dueno@redhat.com> - 3.47.1-2
 - Fix intermittent SEC_ERROR_UNKNOWN_ISSUER (#1752303, #1648617)
 

From 6f99a369b53f0300bafb7b7042147cc33a474332 Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Tue, 3 Dec 2019 15:51:55 +0100
Subject: [PATCH 17/30] Update nss-3.47-certdb-temp-cert.patch to avoid setting
 empty trust value

---
 nss-3.47-certdb-temp-cert.patch | 61 ++++++++++++++++++++++++++++-----
 nss.spec                        |  5 ++-
 2 files changed, 56 insertions(+), 10 deletions(-)

diff --git a/nss-3.47-certdb-temp-cert.patch b/nss-3.47-certdb-temp-cert.patch
index a1608f4..b2afd50 100644
--- a/nss-3.47-certdb-temp-cert.patch
+++ b/nss-3.47-certdb-temp-cert.patch
@@ -1,7 +1,35 @@
+# HG changeset patch
+# User Daiki Ueno <dueno@redhat.com>
+# Date 1575381287 -3600
+#      Tue Dec 03 14:54:47 2019 +0100
+# Node ID 5ad40d3c760edac96d22b99e4e3e916b74f903fe
+# Parent  d64102b76a437f24d98a20480dcc9f1655143e7c
+Bug 1593167, certdb: prefer perm certs over temp certs when trust is not available
+
+Summary:
+When a builtin root module is loaded after some temp certs being
+loaded, our certificate lookup logic preferred those temp certs over
+perm certs stored on the root module.  This was a problem because such
+temp certs are usually not accompanied with trust information.
+
+This makes the certificate lookup logic capable of handling such
+situations by checking if the trust information is attached to temp
+certs and otherwise falling back to perm certs.
+
+Reviewers: rrelyea, keeler
+
+Reviewed By: rrelyea
+
+Subscribers: reviewbot, heftig
+
+Bug #: 1593167
+
+Differential Revision: https://phabricator.services.mozilla.com/D54726
+
 diff --git a/lib/pki/pki3hack.c b/lib/pki/pki3hack.c
 --- a/lib/pki/pki3hack.c
 +++ b/lib/pki/pki3hack.c
-@@ -921,11 +921,11 @@
+@@ -921,14 +921,24 @@ stan_GetCERTCertificate(NSSCertificate *
      }
      if (!cc->nssCertificate || forceUpdate) {
          fill_CERTCertificateFields(c, cc, forceUpdate);
@@ -10,12 +38,27 @@ diff --git a/lib/pki/pki3hack.c b/lib/pki/pki3hack.c
 -        /* if it's a perm cert, it might have been stored before the
 -         * trust, so look for the trust again.  But a temp cert can be
 -         * ignored.
+-         */
+-        CERTCertTrust *trust = NULL;
+-        trust = nssTrust_GetCERTCertTrustForCert(c, cc);
 +    } else if (CERT_GetCertTrust(cc, &certTrust) != SECSuccess) {
-+        /* If it's a perm cert, it might have been stored before the
-+         * trust, so look for the trust again. If it's a temp cert, it
-+         * might have been stored before the builtin module is loaded,
-+         * so still need to look for the trust again.
-          */
-         CERTCertTrust *trust = NULL;
-         trust = nssTrust_GetCERTCertTrustForCert(c, cc);
-
++        CERTCertTrust *trust;
++        if (!c->object.cryptoContext) {
++            /* If it's a perm cert, it might have been stored before the
++             * trust, so look for the trust again.
++             */
++            trust = nssTrust_GetCERTCertTrustForCert(c, cc);
++        } else {
++            /* If it's a temp cert, it might have been stored before
++             * the builtin module is loaded, so look for the trust
++             * again, but not set the empty trust if not found.
++             */
++            NSSTrust *t = nssTrustDomain_FindTrustForCertificate(c->object.cryptoContext->td, c);
++            if (!t) {
++                goto loser;
++            }
++            trust = cert_trust_from_stan_trust(t, cc->arena);
++        }
+ 
+         CERT_LockCertTrust(cc);
+         cc->trust = trust;
diff --git a/nss.spec b/nss.spec
index d04242a..737ffb5 100644
--- a/nss.spec
+++ b/nss.spec
@@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM",
 Summary:          Network Security Services
 Name:             nss
 Version:          %{nss_version}
-Release:          3%{?dist}
+Release:          4%{?dist}
 License:          MPLv2.0
 URL:              http://www.mozilla.org/projects/security/pki/nss/
 Requires:         nspr >= %{nspr_version}
@@ -875,6 +875,9 @@ update-crypto-policies &> /dev/null || :
 
 
 %changelog
+* Tue Dec  3 2019 Daiki Ueno <dueno@redhat.com> - 3.47.1-4
+- Update nss-3.47-certdb-temp-cert.patch to avoid setting empty trust value
+
 * Tue Dec  3 2019 Daiki Ueno <dueno@redhat.com> - 3.47.1-3
 - Update nss-3.47-certdb-temp-cert.patch to the final version
 

From 33941cb03e48710ac64753bc287a476a9039f55f Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Wed, 4 Dec 2019 10:20:43 +0100
Subject: [PATCH 18/30] Update nss-3.47-certdb-temp-cert.patch

---
 nss-3.47-certdb-temp-cert.patch | 29 ++++++++++++++---------------
 1 file changed, 14 insertions(+), 15 deletions(-)

diff --git a/nss-3.47-certdb-temp-cert.patch b/nss-3.47-certdb-temp-cert.patch
index b2afd50..0c37c0f 100644
--- a/nss-3.47-certdb-temp-cert.patch
+++ b/nss-3.47-certdb-temp-cert.patch
@@ -1,20 +1,15 @@
 # HG changeset patch
 # User Daiki Ueno <dueno@redhat.com>
-# Date 1575381287 -3600
-#      Tue Dec 03 14:54:47 2019 +0100
-# Node ID 5ad40d3c760edac96d22b99e4e3e916b74f903fe
+# Date 1575450841 -3600
+#      Wed Dec 04 10:14:01 2019 +0100
+# Node ID 017097f0a0eaea1a3d849f3de79475c9bc28fcc2
 # Parent  d64102b76a437f24d98a20480dcc9f1655143e7c
-Bug 1593167, certdb: prefer perm certs over temp certs when trust is not available
+Bug 1593167, certdb: propagate trust information if trust module is loaded afterwards
 
 Summary:
-When a builtin root module is loaded after some temp certs being
-loaded, our certificate lookup logic preferred those temp certs over
-perm certs stored on the root module.  This was a problem because such
-temp certs are usually not accompanied with trust information.
+When the builtin trust module is loaded after some temp certs being created, these temp certs are usually not accompanied by trust information. This causes a problem in Firefox as it loads the module from a separate thread while accessing the network cache which populates temp certs.
 
-This makes the certificate lookup logic capable of handling such
-situations by checking if the trust information is attached to temp
-certs and otherwise falling back to perm certs.
+This change makes it properly roll up the trust information, if a temp cert doesn't have trust information.
 
 Reviewers: rrelyea, keeler
 
@@ -29,7 +24,7 @@ Differential Revision: https://phabricator.services.mozilla.com/D54726
 diff --git a/lib/pki/pki3hack.c b/lib/pki/pki3hack.c
 --- a/lib/pki/pki3hack.c
 +++ b/lib/pki/pki3hack.c
-@@ -921,14 +921,24 @@ stan_GetCERTCertificate(NSSCertificate *
+@@ -921,14 +921,28 @@ stan_GetCERTCertificate(NSSCertificate *
      }
      if (!cc->nssCertificate || forceUpdate) {
          fill_CERTCertificateFields(c, cc, forceUpdate);
@@ -49,15 +44,19 @@ diff --git a/lib/pki/pki3hack.c b/lib/pki/pki3hack.c
 +             */
 +            trust = nssTrust_GetCERTCertTrustForCert(c, cc);
 +        } else {
-+            /* If it's a temp cert, it might have been stored before
-+             * the builtin module is loaded, so look for the trust
-+             * again, but not set the empty trust if not found.
++            /* If it's a temp cert, it might have been stored before the
++             * builtin trust module is loaded, so look for the trust
++             * again, but don't set the empty trust if it is not found.
 +             */
 +            NSSTrust *t = nssTrustDomain_FindTrustForCertificate(c->object.cryptoContext->td, c);
 +            if (!t) {
 +                goto loser;
 +            }
 +            trust = cert_trust_from_stan_trust(t, cc->arena);
++            nssTrust_Destroy(t);
++            if (!trust) {
++                goto loser;
++            }
 +        }
  
          CERT_LockCertTrust(cc);

From 4bd6c22d7b9d290f9d125b64156cf592cdb4c14e Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Fri, 3 Jan 2020 11:27:31 +0100
Subject: [PATCH 19/30] Update to NSS 3.48

---
 .gitignore |  1 +
 nss.spec   | 11 +++++++----
 sources    |  2 +-
 3 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/.gitignore b/.gitignore
index 2580845..a3c611b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -41,3 +41,4 @@ TestUser51.cert
 /nss-3.46.1.tar.gz
 /nss-3.47.tar.gz
 /nss-3.47.1.tar.gz
+/nss-3.48.tar.gz
diff --git a/nss.spec b/nss.spec
index 737ffb5..fb66d66 100644
--- a/nss.spec
+++ b/nss.spec
@@ -1,5 +1,5 @@
-%global nspr_version 4.23.0
-%global nss_version 3.47.1
+%global nspr_version 4.24.0
+%global nss_version 3.48.0
 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools
 %global saved_files_dir %{_libdir}/nss/saved
 %global dracutlibdir %{_prefix}/lib/dracut
@@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM",
 Summary:          Network Security Services
 Name:             nss
 Version:          %{nss_version}
-Release:          4%{?dist}
+Release:          1%{?dist}
 License:          MPLv2.0
 URL:              http://www.mozilla.org/projects/security/pki/nss/
 Requires:         nspr >= %{nspr_version}
@@ -875,6 +875,9 @@ update-crypto-policies &> /dev/null || :
 
 
 %changelog
+* Fri Jan  3 2020 Daiki Ueno <dueno@redhat.com> - 3.48.0-1
+- Update to NSS 3.48
+
 * Tue Dec  3 2019 Daiki Ueno <dueno@redhat.com> - 3.47.1-4
 - Update nss-3.47-certdb-temp-cert.patch to avoid setting empty trust value
 
@@ -887,7 +890,7 @@ update-crypto-policies &> /dev/null || :
 * Fri Nov 22 2019 Daiki Ueno <dueno@redhat.com> - 3.47.1-1
 - Update to NSS 3.47.1
 
-* Mon Nov 7 2019 Bob Relyea <rrelyea@redhat.com> - 3.47.0-3
+* Thu Nov 7 2019 Bob Relyea <rrelyea@redhat.com> - 3.47.0-3
 - Include ike mechanism fix
 
 * Wed Oct 23 2019 Daiki Ueno <dueno@redhat.com> - 3.47.0-2
diff --git a/sources b/sources
index e15e2b4..2e36a5d 100644
--- a/sources
+++ b/sources
@@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403
 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c
 SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7
 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310
-SHA512 (nss-3.47.1.tar.gz) = ddee53f58929e5f3849c9f88a3a6735453a258c3c32a7e3e73cc949e0b7ad2dff81b21db31c9c5e1ef3eb79d63c31660e38ce76c06ca54a5681dd611dc2e2ae9
+SHA512 (nss-3.48.tar.gz) = 71aefe323501dd8d750ed36606554f2e67ecb2bca85b55bc798d5dfc3a47f3d454348ca950971aaaafb16f6d847c098d2b1c40d40b50380e0c2540ed1b9a9e9a

From 4075855ec15e0e024df3bc95e85b5fd6bf924a5e Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Fri, 10 Jan 2020 10:41:24 +0100
Subject: [PATCH 20/30] Update to NSS 3.49

---
 .gitignore                      |  1 +
 nss-3.47-certdb-temp-cert.patch | 63 ---------------------------------
 nss.spec                        |  7 ++--
 sources                         |  2 +-
 4 files changed, 6 insertions(+), 67 deletions(-)
 delete mode 100644 nss-3.47-certdb-temp-cert.patch

diff --git a/.gitignore b/.gitignore
index a3c611b..fff1204 100644
--- a/.gitignore
+++ b/.gitignore
@@ -42,3 +42,4 @@ TestUser51.cert
 /nss-3.47.tar.gz
 /nss-3.47.1.tar.gz
 /nss-3.48.tar.gz
+/nss-3.49.tar.gz
diff --git a/nss-3.47-certdb-temp-cert.patch b/nss-3.47-certdb-temp-cert.patch
deleted file mode 100644
index 0c37c0f..0000000
--- a/nss-3.47-certdb-temp-cert.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-# HG changeset patch
-# User Daiki Ueno <dueno@redhat.com>
-# Date 1575450841 -3600
-#      Wed Dec 04 10:14:01 2019 +0100
-# Node ID 017097f0a0eaea1a3d849f3de79475c9bc28fcc2
-# Parent  d64102b76a437f24d98a20480dcc9f1655143e7c
-Bug 1593167, certdb: propagate trust information if trust module is loaded afterwards
-
-Summary:
-When the builtin trust module is loaded after some temp certs being created, these temp certs are usually not accompanied by trust information. This causes a problem in Firefox as it loads the module from a separate thread while accessing the network cache which populates temp certs.
-
-This change makes it properly roll up the trust information, if a temp cert doesn't have trust information.
-
-Reviewers: rrelyea, keeler
-
-Reviewed By: rrelyea
-
-Subscribers: reviewbot, heftig
-
-Bug #: 1593167
-
-Differential Revision: https://phabricator.services.mozilla.com/D54726
-
-diff --git a/lib/pki/pki3hack.c b/lib/pki/pki3hack.c
---- a/lib/pki/pki3hack.c
-+++ b/lib/pki/pki3hack.c
-@@ -921,14 +921,28 @@ stan_GetCERTCertificate(NSSCertificate *
-     }
-     if (!cc->nssCertificate || forceUpdate) {
-         fill_CERTCertificateFields(c, cc, forceUpdate);
--    } else if (CERT_GetCertTrust(cc, &certTrust) != SECSuccess &&
--               !c->object.cryptoContext) {
--        /* if it's a perm cert, it might have been stored before the
--         * trust, so look for the trust again.  But a temp cert can be
--         * ignored.
--         */
--        CERTCertTrust *trust = NULL;
--        trust = nssTrust_GetCERTCertTrustForCert(c, cc);
-+    } else if (CERT_GetCertTrust(cc, &certTrust) != SECSuccess) {
-+        CERTCertTrust *trust;
-+        if (!c->object.cryptoContext) {
-+            /* If it's a perm cert, it might have been stored before the
-+             * trust, so look for the trust again.
-+             */
-+            trust = nssTrust_GetCERTCertTrustForCert(c, cc);
-+        } else {
-+            /* If it's a temp cert, it might have been stored before the
-+             * builtin trust module is loaded, so look for the trust
-+             * again, but don't set the empty trust if it is not found.
-+             */
-+            NSSTrust *t = nssTrustDomain_FindTrustForCertificate(c->object.cryptoContext->td, c);
-+            if (!t) {
-+                goto loser;
-+            }
-+            trust = cert_trust_from_stan_trust(t, cc->arena);
-+            nssTrust_Destroy(t);
-+            if (!trust) {
-+                goto loser;
-+            }
-+        }
- 
-         CERT_LockCertTrust(cc);
-         cc->trust = trust;
diff --git a/nss.spec b/nss.spec
index fb66d66..c7377ec 100644
--- a/nss.spec
+++ b/nss.spec
@@ -1,5 +1,5 @@
 %global nspr_version 4.24.0
-%global nss_version 3.48.0
+%global nss_version 3.49.0
 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools
 %global saved_files_dir %{_libdir}/nss/saved
 %global dracutlibdir %{_prefix}/lib/dracut
@@ -107,8 +107,6 @@ Patch2:           nss-539183.patch
 Patch4:           iquote.patch
 # add missing ike mechanism to softoken
 Patch10:          nss-3.47-ike-fix.patch
-# https://bugzilla.mozilla.org/show_bug.cgi?id=1593167
-Patch11:	  nss-3.47-certdb-temp-cert.patch
 
 %description
 Network Security Services (NSS) is a set of libraries designed to
@@ -875,6 +873,9 @@ update-crypto-policies &> /dev/null || :
 
 
 %changelog
+* Fri Jan 10 2020 Daiki Ueno <dueno@redhat.com> - 3.49.0-1
+- Update to NSS 3.49
+
 * Fri Jan  3 2020 Daiki Ueno <dueno@redhat.com> - 3.48.0-1
 - Update to NSS 3.48
 
diff --git a/sources b/sources
index 2e36a5d..b9615c6 100644
--- a/sources
+++ b/sources
@@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403
 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c
 SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7
 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310
-SHA512 (nss-3.48.tar.gz) = 71aefe323501dd8d750ed36606554f2e67ecb2bca85b55bc798d5dfc3a47f3d454348ca950971aaaafb16f6d847c098d2b1c40d40b50380e0c2540ed1b9a9e9a
+SHA512 (nss-3.49.tar.gz) = 7d8df73a2e585585a7cb3f887af3f933854984479531b3dd30316873bdd92c130e2fadb54e7b3b1f0b10675b1bce09112ef39860d74ef6f0df7b57bf430bd072

From cae9808be2191e1a934cdd1ccb465f2c1b89fe34 Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Fri, 10 Jan 2020 17:26:33 +0100
Subject: [PATCH 21/30] Fix build on armv7hl with the patch proposed in
 upstream

---
 nss-3.49-neon-build-fixes.patch | 159 ++++++++++++++++++++++++++++++++
 nss.spec                        |   5 +
 2 files changed, 164 insertions(+)
 create mode 100644 nss-3.49-neon-build-fixes.patch

diff --git a/nss-3.49-neon-build-fixes.patch b/nss-3.49-neon-build-fixes.patch
new file mode 100644
index 0000000..7ac5b0f
--- /dev/null
+++ b/nss-3.49-neon-build-fixes.patch
@@ -0,0 +1,159 @@
+# HG changeset patch
+# User Mike Hommey <mh@glandium.org>
+# Date 1578673372 -3600
+#      Fri Jan 10 17:22:52 2020 +0100
+# Node ID 9c359d019d333282476ffeec3dab819cfdcf127e
+# Parent  4921046404f197526969a6b79f19c136469e69f8
+Bug 1608327 - Fix freebl arm NEON code use on tier3 platforms.
+
+Summary:
+Despite the code having runtime detection of NEON and crypto extensions,
+the optimized code using those instructions is disabled at build time on
+platforms where the compiler doesn't enable NEON by default of with the
+flags it's given for the caller code.
+
+In the case of gcm, this goes as far as causing a build error.
+
+What is needed is for the optimized code to be enabled in every case,
+letting the caller code choose whether to use that code based on the
+existing runtime checks.
+
+But this can't be simply done either, because those optimized parts of
+the code need to be built with NEON enabled, unconditionally, but that
+is not compatible with platforms using the softfloat ABI. For those,
+we need to use the softfp ABI, which is compatible. However, the softfp
+ABI is not compatible with the hardfp ABI, so we also can't
+unconditionally use the softfp ABI, so we do so only when the compiler
+targets the softfloat ABI, which confusingly enough is advertized via
+the `__SOFTFP__` define.
+
+Reviewers: jcj!
+
+Bug #: 1608327
+
+Differential Revision: https://phabricator.services.mozilla.com/D59451
+
+diff --git a/lib/freebl/Makefile b/lib/freebl/Makefile
+--- a/lib/freebl/Makefile
++++ b/lib/freebl/Makefile
+@@ -781,8 +781,12 @@ ifdef INTEL_GCM_CLANG_CL
+ endif
+ 
+ ifeq ($(CPU_ARCH),arm)
+-$(OBJDIR)/$(PROG_PREFIX)aes-armv8$(OBJ_SUFFIX): CFLAGS += -march=armv8-a -mfpu=crypto-neon-fp-armv8
+-$(OBJDIR)/$(PROG_PREFIX)gcm-arm32-neon$(OBJ_SUFFIX): CFLAGS += -mfpu=neon
++# When the compiler uses the softfloat ABI, we want to use the compatible softfp ABI when
++# enabling NEON for these objects.
++# Confusingly, __SOFTFP__ is the name of the define for the softfloat ABI, not for the softfp ABI.
++USES_SOFTFLOAT_ABI := $(shell $(CC) -o - -E -dM - $(CFLAGS) < /dev/null | grep __SOFTFP__ > /dev/null && echo 1)
++$(OBJDIR)/$(PROG_PREFIX)aes-armv8$(OBJ_SUFFIX): CFLAGS += -march=armv8-a -mfpu=crypto-neon-fp-armv8$(if $(USES_SOFTFLOAT_ABI), -mfloat-abi=softfp)
++$(OBJDIR)/$(PROG_PREFIX)gcm-arm32-neon$(OBJ_SUFFIX): CFLAGS += -mfpu=neon$(if $(USES_SOFTFLOAT_ABI), -mfloat-abi=softfp)
+ endif
+ ifeq ($(CPU_ARCH),aarch64)
+ $(OBJDIR)/$(PROG_PREFIX)aes-armv8$(OBJ_SUFFIX): CFLAGS += -march=armv8-a+crypto
+diff --git a/lib/freebl/aes-armv8.c b/lib/freebl/aes-armv8.c
+--- a/lib/freebl/aes-armv8.c
++++ b/lib/freebl/aes-armv8.c
+@@ -8,7 +8,7 @@
+ #if ((defined(__clang__) ||                                         \
+       (defined(__GNUC__) && defined(__GNUC_MINOR__) &&              \
+        (__GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ > 8)))) && \
+-     (defined(__ARM_NEON) || defined(__ARM_NEON__)))
++     defined(IS_LITTLE_ENDIAN))
+ 
+ #ifndef __ARM_FEATURE_CRYPTO
+ #error "Compiler option is invalid"
+diff --git a/lib/freebl/freebl.gyp b/lib/freebl/freebl.gyp
+--- a/lib/freebl/freebl.gyp
++++ b/lib/freebl/freebl.gyp
+@@ -126,10 +126,12 @@
+         '<(DEPTH)/exports.gyp:nss_exports'
+       ],
+       'cflags': [
+-        '-mfpu=neon'
++        '-mfpu=neon',
++        '<@(softfp_cflags)',
+       ],
+       'cflags_mozilla': [
+-        '-mfpu=neon'
++        '-mfpu=neon',
++        '<@(softfp_cflags)',
+       ]
+     },
+     {
+@@ -179,11 +181,13 @@
+         [ 'target_arch=="arm"', {
+           'cflags': [
+             '-march=armv8-a',
+-            '-mfpu=crypto-neon-fp-armv8'
++            '-mfpu=crypto-neon-fp-armv8',
++            '<@(softfp_cflags)',
+           ],
+           'cflags_mozilla': [
+             '-march=armv8-a',
+-            '-mfpu=crypto-neon-fp-armv8'
++            '-mfpu=crypto-neon-fp-armv8',
++            '<@(softfp_cflags)',
+           ],
+         }, 'target_arch=="arm64" or target_arch=="aarch64"', {
+           'cflags': [
+@@ -533,6 +537,11 @@
+       }, {
+         'have_int128_support%': 0,
+       }],
++      [ 'target_arch=="arm"', {
++        # When the compiler uses the softfloat ABI, we want to use the compatible softfp ABI when enabling NEON for these objects.
++        # Confusingly, __SOFTFP__ is the name of the define for the softfloat ABI, not for the softfp ABI.
++        'softfp_cflags': '<!(${CC:-cc} -o - -E -dM - ${CFLAGS} < /dev/null | grep __SOFTFP__ > /dev/null && echo -mfloat-abi=softfp || true)',
++      }],
+     ],
+   }
+ }
+diff --git a/lib/freebl/gcm-arm32-neon.c b/lib/freebl/gcm-arm32-neon.c
+--- a/lib/freebl/gcm-arm32-neon.c
++++ b/lib/freebl/gcm-arm32-neon.c
+@@ -11,7 +11,7 @@
+ #include "secerr.h"
+ #include "prtypes.h"
+ 
+-#if defined(__ARM_NEON__) || defined(__ARM_NEON)
++#if defined(IS_LITTLE_ENDIAN)
+ 
+ #include <arm_neon.h>
+ 
+@@ -199,4 +199,4 @@ gcm_HashZeroX_hw(gcmHashContext *ghash)
+     return SECSuccess;
+ }
+ 
+-#endif /* __ARM_NEON__ || __ARM_NEON */
++#endif /* IS_LITTLE_ENDIAN */
+diff --git a/lib/freebl/gcm.c b/lib/freebl/gcm.c
+--- a/lib/freebl/gcm.c
++++ b/lib/freebl/gcm.c
+@@ -21,11 +21,8 @@
+ #if defined(__aarch64__) && defined(IS_LITTLE_ENDIAN) && \
+     (defined(__clang__) || defined(__GNUC__) && __GNUC__ > 6)
+ #define USE_ARM_GCM
+-#elif defined(__arm__) && defined(IS_LITTLE_ENDIAN) && \
+-    (defined(__ARM_NEON__) || defined(__ARM_NEON))
+-/* We don't test on big endian platform, so disable this on big endian.
+- * Also, we don't check whether compiler support NEON well, so this uses
+- * that compiler uses -mfpu=neon only. */
++#elif defined(__arm__) && defined(IS_LITTLE_ENDIAN)
++/* We don't test on big endian platform, so disable this on big endian. */
+ #define USE_ARM_GCM
+ #endif
+ 
+diff --git a/lib/freebl/rijndael.c b/lib/freebl/rijndael.c
+--- a/lib/freebl/rijndael.c
++++ b/lib/freebl/rijndael.c
+@@ -20,8 +20,7 @@
+ #include "gcm.h"
+ #include "mpi.h"
+ 
+-#if (!defined(IS_LITTLE_ENDIAN) && !defined(NSS_X86_OR_X64)) || \
+-    (defined(__arm__) && !defined(__ARM_NEON) && !defined(__ARM_NEON__))
++#if !defined(IS_LITTLE_ENDIAN) && !defined(NSS_X86_OR_X64)
+ // not test yet on big endian platform of arm
+ #undef USE_HW_AES
+ #endif
diff --git a/nss.spec b/nss.spec
index c7377ec..815ee58 100644
--- a/nss.spec
+++ b/nss.spec
@@ -107,6 +107,8 @@ Patch2:           nss-539183.patch
 Patch4:           iquote.patch
 # add missing ike mechanism to softoken
 Patch10:          nss-3.47-ike-fix.patch
+# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=1608327
+Patch11:          nss-3.49-neon-build-fixes.patch
 
 %description
 Network Security Services (NSS) is a set of libraries designed to
@@ -245,6 +247,8 @@ find nss/lib/libpkix -perm /u+x -type f -exec chmod -x {} \;
 
 %build
 
+gcc -mfpu=neon -dM -E - < /dev/null
+
 export FREEBL_NO_DEPEND=1
 
 # Must export FREEBL_LOWHASH=1 for nsslowhash.h so that it gets
@@ -875,6 +879,7 @@ update-crypto-policies &> /dev/null || :
 %changelog
 * Fri Jan 10 2020 Daiki Ueno <dueno@redhat.com> - 3.49.0-1
 - Update to NSS 3.49
+- Fix build on armv7hl with the patch proposed in upstream
 
 * Fri Jan  3 2020 Daiki Ueno <dueno@redhat.com> - 3.48.0-1
 - Update to NSS 3.48

From 4e4e75552ac37b925f5fe746e206ee9cd3f288a2 Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Sat, 11 Jan 2020 09:02:36 +0100
Subject: [PATCH 22/30] Remove leftover debug command in %build

---
 nss.spec | 2 --
 1 file changed, 2 deletions(-)

diff --git a/nss.spec b/nss.spec
index 815ee58..73203ae 100644
--- a/nss.spec
+++ b/nss.spec
@@ -247,8 +247,6 @@ find nss/lib/libpkix -perm /u+x -type f -exec chmod -x {} \;
 
 %build
 
-gcc -mfpu=neon -dM -E - < /dev/null
-
 export FREEBL_NO_DEPEND=1
 
 # Must export FREEBL_LOWHASH=1 for nsslowhash.h so that it gets

From c9d26fb099a2ad93a6af8886477f1a810cb09c38 Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Mon, 27 Jan 2020 10:24:30 +0100
Subject: [PATCH 23/30] Update to NSS 3.49.2

---
 .gitignore                      |   1 +
 nss-3.49-neon-build-fixes.patch | 159 --------------------------------
 nss-tls13-default.patch         |  12 +++
 nss.spec                        |  13 ++-
 sources                         |   2 +-
 5 files changed, 24 insertions(+), 163 deletions(-)
 delete mode 100644 nss-3.49-neon-build-fixes.patch
 create mode 100644 nss-tls13-default.patch

diff --git a/.gitignore b/.gitignore
index fff1204..9bcb442 100644
--- a/.gitignore
+++ b/.gitignore
@@ -43,3 +43,4 @@ TestUser51.cert
 /nss-3.47.1.tar.gz
 /nss-3.48.tar.gz
 /nss-3.49.tar.gz
+/nss-3.49.2.tar.gz
diff --git a/nss-3.49-neon-build-fixes.patch b/nss-3.49-neon-build-fixes.patch
deleted file mode 100644
index 7ac5b0f..0000000
--- a/nss-3.49-neon-build-fixes.patch
+++ /dev/null
@@ -1,159 +0,0 @@
-# HG changeset patch
-# User Mike Hommey <mh@glandium.org>
-# Date 1578673372 -3600
-#      Fri Jan 10 17:22:52 2020 +0100
-# Node ID 9c359d019d333282476ffeec3dab819cfdcf127e
-# Parent  4921046404f197526969a6b79f19c136469e69f8
-Bug 1608327 - Fix freebl arm NEON code use on tier3 platforms.
-
-Summary:
-Despite the code having runtime detection of NEON and crypto extensions,
-the optimized code using those instructions is disabled at build time on
-platforms where the compiler doesn't enable NEON by default of with the
-flags it's given for the caller code.
-
-In the case of gcm, this goes as far as causing a build error.
-
-What is needed is for the optimized code to be enabled in every case,
-letting the caller code choose whether to use that code based on the
-existing runtime checks.
-
-But this can't be simply done either, because those optimized parts of
-the code need to be built with NEON enabled, unconditionally, but that
-is not compatible with platforms using the softfloat ABI. For those,
-we need to use the softfp ABI, which is compatible. However, the softfp
-ABI is not compatible with the hardfp ABI, so we also can't
-unconditionally use the softfp ABI, so we do so only when the compiler
-targets the softfloat ABI, which confusingly enough is advertized via
-the `__SOFTFP__` define.
-
-Reviewers: jcj!
-
-Bug #: 1608327
-
-Differential Revision: https://phabricator.services.mozilla.com/D59451
-
-diff --git a/lib/freebl/Makefile b/lib/freebl/Makefile
---- a/lib/freebl/Makefile
-+++ b/lib/freebl/Makefile
-@@ -781,8 +781,12 @@ ifdef INTEL_GCM_CLANG_CL
- endif
- 
- ifeq ($(CPU_ARCH),arm)
--$(OBJDIR)/$(PROG_PREFIX)aes-armv8$(OBJ_SUFFIX): CFLAGS += -march=armv8-a -mfpu=crypto-neon-fp-armv8
--$(OBJDIR)/$(PROG_PREFIX)gcm-arm32-neon$(OBJ_SUFFIX): CFLAGS += -mfpu=neon
-+# When the compiler uses the softfloat ABI, we want to use the compatible softfp ABI when
-+# enabling NEON for these objects.
-+# Confusingly, __SOFTFP__ is the name of the define for the softfloat ABI, not for the softfp ABI.
-+USES_SOFTFLOAT_ABI := $(shell $(CC) -o - -E -dM - $(CFLAGS) < /dev/null | grep __SOFTFP__ > /dev/null && echo 1)
-+$(OBJDIR)/$(PROG_PREFIX)aes-armv8$(OBJ_SUFFIX): CFLAGS += -march=armv8-a -mfpu=crypto-neon-fp-armv8$(if $(USES_SOFTFLOAT_ABI), -mfloat-abi=softfp)
-+$(OBJDIR)/$(PROG_PREFIX)gcm-arm32-neon$(OBJ_SUFFIX): CFLAGS += -mfpu=neon$(if $(USES_SOFTFLOAT_ABI), -mfloat-abi=softfp)
- endif
- ifeq ($(CPU_ARCH),aarch64)
- $(OBJDIR)/$(PROG_PREFIX)aes-armv8$(OBJ_SUFFIX): CFLAGS += -march=armv8-a+crypto
-diff --git a/lib/freebl/aes-armv8.c b/lib/freebl/aes-armv8.c
---- a/lib/freebl/aes-armv8.c
-+++ b/lib/freebl/aes-armv8.c
-@@ -8,7 +8,7 @@
- #if ((defined(__clang__) ||                                         \
-       (defined(__GNUC__) && defined(__GNUC_MINOR__) &&              \
-        (__GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ > 8)))) && \
--     (defined(__ARM_NEON) || defined(__ARM_NEON__)))
-+     defined(IS_LITTLE_ENDIAN))
- 
- #ifndef __ARM_FEATURE_CRYPTO
- #error "Compiler option is invalid"
-diff --git a/lib/freebl/freebl.gyp b/lib/freebl/freebl.gyp
---- a/lib/freebl/freebl.gyp
-+++ b/lib/freebl/freebl.gyp
-@@ -126,10 +126,12 @@
-         '<(DEPTH)/exports.gyp:nss_exports'
-       ],
-       'cflags': [
--        '-mfpu=neon'
-+        '-mfpu=neon',
-+        '<@(softfp_cflags)',
-       ],
-       'cflags_mozilla': [
--        '-mfpu=neon'
-+        '-mfpu=neon',
-+        '<@(softfp_cflags)',
-       ]
-     },
-     {
-@@ -179,11 +181,13 @@
-         [ 'target_arch=="arm"', {
-           'cflags': [
-             '-march=armv8-a',
--            '-mfpu=crypto-neon-fp-armv8'
-+            '-mfpu=crypto-neon-fp-armv8',
-+            '<@(softfp_cflags)',
-           ],
-           'cflags_mozilla': [
-             '-march=armv8-a',
--            '-mfpu=crypto-neon-fp-armv8'
-+            '-mfpu=crypto-neon-fp-armv8',
-+            '<@(softfp_cflags)',
-           ],
-         }, 'target_arch=="arm64" or target_arch=="aarch64"', {
-           'cflags': [
-@@ -533,6 +537,11 @@
-       }, {
-         'have_int128_support%': 0,
-       }],
-+      [ 'target_arch=="arm"', {
-+        # When the compiler uses the softfloat ABI, we want to use the compatible softfp ABI when enabling NEON for these objects.
-+        # Confusingly, __SOFTFP__ is the name of the define for the softfloat ABI, not for the softfp ABI.
-+        'softfp_cflags': '<!(${CC:-cc} -o - -E -dM - ${CFLAGS} < /dev/null | grep __SOFTFP__ > /dev/null && echo -mfloat-abi=softfp || true)',
-+      }],
-     ],
-   }
- }
-diff --git a/lib/freebl/gcm-arm32-neon.c b/lib/freebl/gcm-arm32-neon.c
---- a/lib/freebl/gcm-arm32-neon.c
-+++ b/lib/freebl/gcm-arm32-neon.c
-@@ -11,7 +11,7 @@
- #include "secerr.h"
- #include "prtypes.h"
- 
--#if defined(__ARM_NEON__) || defined(__ARM_NEON)
-+#if defined(IS_LITTLE_ENDIAN)
- 
- #include <arm_neon.h>
- 
-@@ -199,4 +199,4 @@ gcm_HashZeroX_hw(gcmHashContext *ghash)
-     return SECSuccess;
- }
- 
--#endif /* __ARM_NEON__ || __ARM_NEON */
-+#endif /* IS_LITTLE_ENDIAN */
-diff --git a/lib/freebl/gcm.c b/lib/freebl/gcm.c
---- a/lib/freebl/gcm.c
-+++ b/lib/freebl/gcm.c
-@@ -21,11 +21,8 @@
- #if defined(__aarch64__) && defined(IS_LITTLE_ENDIAN) && \
-     (defined(__clang__) || defined(__GNUC__) && __GNUC__ > 6)
- #define USE_ARM_GCM
--#elif defined(__arm__) && defined(IS_LITTLE_ENDIAN) && \
--    (defined(__ARM_NEON__) || defined(__ARM_NEON))
--/* We don't test on big endian platform, so disable this on big endian.
-- * Also, we don't check whether compiler support NEON well, so this uses
-- * that compiler uses -mfpu=neon only. */
-+#elif defined(__arm__) && defined(IS_LITTLE_ENDIAN)
-+/* We don't test on big endian platform, so disable this on big endian. */
- #define USE_ARM_GCM
- #endif
- 
-diff --git a/lib/freebl/rijndael.c b/lib/freebl/rijndael.c
---- a/lib/freebl/rijndael.c
-+++ b/lib/freebl/rijndael.c
-@@ -20,8 +20,7 @@
- #include "gcm.h"
- #include "mpi.h"
- 
--#if (!defined(IS_LITTLE_ENDIAN) && !defined(NSS_X86_OR_X64)) || \
--    (defined(__arm__) && !defined(__ARM_NEON) && !defined(__ARM_NEON__))
-+#if !defined(IS_LITTLE_ENDIAN) && !defined(NSS_X86_OR_X64)
- // not test yet on big endian platform of arm
- #undef USE_HW_AES
- #endif
diff --git a/nss-tls13-default.patch b/nss-tls13-default.patch
new file mode 100644
index 0000000..ffdca50
--- /dev/null
+++ b/nss-tls13-default.patch
@@ -0,0 +1,12 @@
+diff -up nss/lib/ssl/sslsock.c.tls13-default nss/lib/ssl/sslsock.c
+--- nss/lib/ssl/sslsock.c.tls13-default	2020-01-27 10:21:44.930830558 +0100
++++ nss/lib/ssl/sslsock.c	2020-01-27 10:21:47.419852229 +0100
+@@ -97,7 +97,7 @@ static sslOptions ssl_defaults = {
+  */
+ static SSLVersionRange versions_defaults_stream = {
+     SSL_LIBRARY_VERSION_TLS_1_0,
+-    SSL_LIBRARY_VERSION_TLS_1_3
++    SSL_LIBRARY_VERSION_TLS_1_2
+ };
+ 
+ static SSLVersionRange versions_defaults_datagram = {
diff --git a/nss.spec b/nss.spec
index 73203ae..2056e83 100644
--- a/nss.spec
+++ b/nss.spec
@@ -1,5 +1,5 @@
 %global nspr_version 4.24.0
-%global nss_version 3.49.0
+%global nss_version 3.49.2
 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools
 %global saved_files_dir %{_libdir}/nss/saved
 %global dracutlibdir %{_prefix}/lib/dracut
@@ -107,8 +107,11 @@ Patch2:           nss-539183.patch
 Patch4:           iquote.patch
 # add missing ike mechanism to softoken
 Patch10:          nss-3.47-ike-fix.patch
-# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=1608327
-Patch11:          nss-3.49-neon-build-fixes.patch
+# To revert the upstream change:
+# https://bugzilla.mozilla.org/show_bug.cgi?id=1573118
+# as it still doesn't work under FIPS mode because of missing HKDF
+# support in PKCS #11.
+Patch11:	  nss-tls13-default.patch
 
 %description
 Network Security Services (NSS) is a set of libraries designed to
@@ -875,6 +878,10 @@ update-crypto-policies &> /dev/null || :
 
 
 %changelog
+* Mon Jan 27 2020 Daiki Ueno <dueno@redhat.com> - 3.49.2-1
+- Update to NSS 3.49.2
+- Don't enable TLS 1.3 by default (#1794814)
+
 * Fri Jan 10 2020 Daiki Ueno <dueno@redhat.com> - 3.49.0-1
 - Update to NSS 3.49
 - Fix build on armv7hl with the patch proposed in upstream
diff --git a/sources b/sources
index b9615c6..935d8e3 100644
--- a/sources
+++ b/sources
@@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403
 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c
 SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7
 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310
-SHA512 (nss-3.49.tar.gz) = 7d8df73a2e585585a7cb3f887af3f933854984479531b3dd30316873bdd92c130e2fadb54e7b3b1f0b10675b1bce09112ef39860d74ef6f0df7b57bf430bd072
+SHA512 (nss-3.49.2.tar.gz) = fe0fe032db15853384a50b145dd6f3187a855109f0b81f1846312d33f8c628aededcbca4d199f974ae52530aec3f2312f80afbca3e5b97ed1ff96fcffafd2881

From 7ea65d900ed25723488ea42fc203f99c0d1e6b86 Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Wed, 4 Mar 2020 17:34:17 +0100
Subject: [PATCH 24/30] Update to NSS 3.50

---
 nss-kremlin-ppc64le.patch | 30 +++++++++++++
 nss-signtool-format.patch | 94 +++++++++++++++++++++++++++++++++++++++
 nss.spec                  | 10 ++++-
 3 files changed, 132 insertions(+), 2 deletions(-)
 create mode 100644 nss-kremlin-ppc64le.patch
 create mode 100644 nss-signtool-format.patch

diff --git a/nss-kremlin-ppc64le.patch b/nss-kremlin-ppc64le.patch
new file mode 100644
index 0000000..d4e9d89
--- /dev/null
+++ b/nss-kremlin-ppc64le.patch
@@ -0,0 +1,30 @@
+Index: nss/lib/freebl/verified/kremlin/include/kremlin/internal/types.h
+===================================================================
+--- nss.orig/lib/freebl/verified/kremlin/include/kremlin/internal/types.h
++++ nss/lib/freebl/verified/kremlin/include/kremlin/internal/types.h
+@@ -56,7 +56,9 @@ typedef const char *Prims_string;
+ #include <emmintrin.h>
+ typedef __m128i FStar_UInt128_uint128;
+ #elif !defined(KRML_VERIFIED_UINT128) && !defined(_MSC_VER) && \
+-    (defined(__x86_64__) || defined(__x86_64) || defined(__aarch64__))
++    (defined(__x86_64__) || defined(__x86_64) || defined(__aarch64__) || \
++    (defined(__powerpc64__) && defined(__LITTLE_ENDIAN__)) || \
++     defined(__s390x__))
+ typedef unsigned __int128 FStar_UInt128_uint128;
+ #else
+ typedef struct FStar_UInt128_uint128_s {
+Index: nss/lib/freebl/verified/kremlin/kremlib/dist/minimal/fstar_uint128_gcc64.h
+===================================================================
+--- nss.orig/lib/freebl/verified/kremlin/kremlib/dist/minimal/fstar_uint128_gcc64.h
++++ nss/lib/freebl/verified/kremlin/kremlib/dist/minimal/fstar_uint128_gcc64.h
+@@ -25,7 +25,9 @@
+ #include "LowStar_Endianness.h"
+ 
+ #if !defined(KRML_VERIFIED_UINT128) && !defined(_MSC_VER) && \
+-    (defined(__x86_64__) || defined(__x86_64) || defined(__aarch64__))
++    (defined(__x86_64__) || defined(__x86_64) || defined(__aarch64__) || \
++    (defined(__powerpc64__) && defined(__LITTLE_ENDIAN__)) || \
++     defined(__s390x__))
+ 
+ /* GCC + using native unsigned __int128 support */
+ 
diff --git a/nss-signtool-format.patch b/nss-signtool-format.patch
new file mode 100644
index 0000000..f54e7f3
--- /dev/null
+++ b/nss-signtool-format.patch
@@ -0,0 +1,94 @@
+diff --git a/cmd/modutil/install.c b/cmd/modutil/install.c
+--- a/cmd/modutil/install.c
++++ b/cmd/modutil/install.c
+@@ -825,17 +825,20 @@ rm_dash_r(char *path)
+ 
+         dir = PR_OpenDir(path);
+         if (!dir) {
+             return -1;
+         }
+ 
+         /* Recursively delete all entries in the directory */
+         while ((entry = PR_ReadDir(dir, PR_SKIP_BOTH)) != NULL) {
+-            sprintf(filename, "%s/%s", path, entry->name);
++            if (snprintf(filename, sizeof(filename), "%s/%s", path, entry->name) >= sizeof(filename)) {
++                PR_CloseDir(dir);
++                return -1;
++            }
+             if (rm_dash_r(filename)) {
+                 PR_CloseDir(dir);
+                 return -1;
+             }
+         }
+ 
+         if (PR_CloseDir(dir) != PR_SUCCESS) {
+             return -1;
+diff --git a/cmd/signtool/util.c b/cmd/signtool/util.c
+--- a/cmd/signtool/util.c
++++ b/cmd/signtool/util.c
+@@ -132,17 +132,20 @@ rm_dash_r(char *path)
+         if (!dir) {
+             PR_fprintf(errorFD, "Error: Unable to open directory %s.\n", path);
+             errorCount++;
+             return -1;
+         }
+ 
+         /* Recursively delete all entries in the directory */
+         while ((entry = PR_ReadDir(dir, PR_SKIP_BOTH)) != NULL) {
+-            sprintf(filename, "%s/%s", path, entry->name);
++            if (snprintf(filename, sizeof(filename), "%s/%s", path, entry->name) >= sizeof(filename)) {
++                errorCount++;
++                return -1;
++            }
+             if (rm_dash_r(filename))
+                 return -1;
+         }
+ 
+         if (PR_CloseDir(dir) != PR_SUCCESS) {
+             PR_fprintf(errorFD, "Error: Could not close %s.\n", path);
+             errorCount++;
+             return -1;
+diff --git a/lib/libpkix/pkix/util/pkix_list.c b/lib/libpkix/pkix/util/pkix_list.c
+--- a/lib/libpkix/pkix/util/pkix_list.c
++++ b/lib/libpkix/pkix/util/pkix_list.c
+@@ -1530,17 +1530,17 @@ cleanup:
+  */
+ PKIX_Error *
+ PKIX_List_SetItem(
+         PKIX_List *list,
+         PKIX_UInt32 index,
+         PKIX_PL_Object *item,
+         void *plContext)
+ {
+-        PKIX_List *element;
++        PKIX_List *element = NULL;
+ 
+         PKIX_ENTER(LIST, "PKIX_List_SetItem");
+         PKIX_NULLCHECK_ONE(list);
+ 
+         if (list->immutable){
+                 PKIX_ERROR(PKIX_OPERATIONNOTPERMITTEDONIMMUTABLELIST);
+         }
+ 
+diff --git a/lib/libpkix/pkix_pl_nss/system/pkix_pl_oid.c b/lib/libpkix/pkix_pl_nss/system/pkix_pl_oid.c
+--- a/lib/libpkix/pkix_pl_nss/system/pkix_pl_oid.c
++++ b/lib/libpkix/pkix_pl_nss/system/pkix_pl_oid.c
+@@ -102,17 +102,17 @@ cleanup:
+  */
+ static PKIX_Error *
+ pkix_pl_OID_Equals(
+         PKIX_PL_Object *first,
+         PKIX_PL_Object *second,
+         PKIX_Boolean *pResult,
+         void *plContext)
+ {
+-        PKIX_Int32 cmpResult;
++        PKIX_Int32 cmpResult = 0;
+ 
+         PKIX_ENTER(OID, "pkix_pl_OID_Equals");
+         PKIX_NULLCHECK_THREE(first, second, pResult);
+ 
+         PKIX_CHECK(pkix_pl_OID_Comparator
+                     (first, second, &cmpResult, plContext),
+                     PKIX_OIDCOMPARATORFAILED);
+ 
diff --git a/nss.spec b/nss.spec
index 2056e83..ab4e761 100644
--- a/nss.spec
+++ b/nss.spec
@@ -1,5 +1,5 @@
-%global nspr_version 4.24.0
-%global nss_version 3.49.2
+%global nspr_version 4.25.0
+%global nss_version 3.50.0
 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools
 %global saved_files_dir %{_libdir}/nss/saved
 %global dracutlibdir %{_prefix}/lib/dracut
@@ -112,6 +112,9 @@ Patch10:          nss-3.47-ike-fix.patch
 # as it still doesn't work under FIPS mode because of missing HKDF
 # support in PKCS #11.
 Patch11:	  nss-tls13-default.patch
+Patch12:          nss-signtool-format.patch
+# https://github.com/FStarLang/kremlin/issues/166
+Patch13:          nss-kremlin-ppc64le.patch
 
 %description
 Network Security Services (NSS) is a set of libraries designed to
@@ -878,6 +881,9 @@ update-crypto-policies &> /dev/null || :
 
 
 %changelog
+* Mon Feb 17 2020 Daiki Ueno <dueno@redhat.com> - 3.50.0-1
+- Update to NSS 3.50
+
 * Mon Jan 27 2020 Daiki Ueno <dueno@redhat.com> - 3.49.2-1
 - Update to NSS 3.49.2
 - Don't enable TLS 1.3 by default (#1794814)

From 98d8e211b439a84809b1b4908469486aef6e1f90 Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Wed, 4 Mar 2020 17:35:50 +0100
Subject: [PATCH 25/30] Upload new sources

---
 .gitignore | 1 +
 sources    | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 9bcb442..4e170e7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -44,3 +44,4 @@ TestUser51.cert
 /nss-3.48.tar.gz
 /nss-3.49.tar.gz
 /nss-3.49.2.tar.gz
+/nss-3.50.tar.gz
diff --git a/sources b/sources
index 935d8e3..8a7e320 100644
--- a/sources
+++ b/sources
@@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403
 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c
 SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7
 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310
-SHA512 (nss-3.49.2.tar.gz) = fe0fe032db15853384a50b145dd6f3187a855109f0b81f1846312d33f8c628aededcbca4d199f974ae52530aec3f2312f80afbca3e5b97ed1ff96fcffafd2881
+SHA512 (nss-3.50.tar.gz) = d6bcaf8ad65b5a97c42cd6cbbc68add5c4b49db74b2debcedb2a007f72511ac0e9bd21fd2dec041bc1975cfc8af26a48450aa0d1b962f755931ab2ac45c795b1

From 26e9cf8babc54037c1d0a76e82c3361d9056b7e8 Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Thu, 5 Mar 2020 09:57:34 +0100
Subject: [PATCH 26/30] Apply CMAC fixes from upstream

---
 nss-cmac-fixes.patch | 75 ++++++++++++++++++++++++++++++++++++++++++++
 nss.spec             |  8 ++++-
 2 files changed, 82 insertions(+), 1 deletion(-)
 create mode 100644 nss-cmac-fixes.patch

diff --git a/nss-cmac-fixes.patch b/nss-cmac-fixes.patch
new file mode 100644
index 0000000..9bcd954
--- /dev/null
+++ b/nss-cmac-fixes.patch
@@ -0,0 +1,75 @@
+# HG changeset patch
+# User Robert Relyea <rrelyea@redhat.com>
+# Date 1581383641 28800
+#      Mon Feb 10 17:14:01 2020 -0800
+# Node ID df142975f4f695f84a662abdd27219c21c87c8d1
+# Parent  046a6f5bfb271ed03ed6a93e3f879d57905999c5
+Bug 1611209 - Value of CKM_AES_CMAC and CKM_AES_CMAC_GENERAL are swapped r=rrelyea
+
+diff --git a/lib/util/pkcs11t.h b/lib/util/pkcs11t.h
+--- a/lib/util/pkcs11t.h
++++ b/lib/util/pkcs11t.h
+@@ -898,8 +898,8 @@ typedef CK_ULONG CK_MECHANISM_TYPE;
+ #define CKM_AES_CCM 0x00001088
+ #define CKM_AES_CTS 0x00001089
+ /* AES-CMAC values copied from v2.40 errata 1 header file */
+-#define CKM_AES_CMAC_GENERAL 0x0000108A
+-#define CKM_AES_CMAC 0x0000108B
++#define CKM_AES_CMAC 0x0000108A
++#define CKM_AES_CMAC_GENERAL 0x0000108B
+ #define CKM_AES_XCBC_MAC 0x0000108C
+ #define CKM_AES_XCBC_MAC_96 0x0000108D
+ 
+# HG changeset patch
+# User Robert Relyea <rrelyea@redhat.com>
+# Date 1581371554 28800
+#      Mon Feb 10 13:52:34 2020 -0800
+# Node ID 046a6f5bfb271ed03ed6a93e3f879d57905999c5
+# Parent  f161f15f8c8d37070aa5763a1edd91cbbc7c54fb
+Bug 1610687 - Crash on unaligned CMACContext.aes.keySchedule when using AES-NI intrinsics r=kjacobs
+https://phabricator.services.mozilla.com/D60699
+
+diff --git a/lib/freebl/cmac.c b/lib/freebl/cmac.c
+--- a/lib/freebl/cmac.c
++++ b/lib/freebl/cmac.c
+@@ -22,7 +22,7 @@ struct CMACContextStr {
+      * add a new Context pointer to the cipher union with the correct type. */
+     CMACCipher cipherType;
+     union {
+-        AESContext aes;
++        AESContext *aes;
+     } cipher;
+     int blockSize;
+ 
+@@ -62,7 +62,7 @@ cmac_Encrypt(CMACContext *ctx, unsigned 
+ {
+     if (ctx->cipherType == CMAC_AES) {
+         unsigned int tmpOutputLen;
+-        SECStatus rv = AES_Encrypt(&ctx->cipher.aes, output, &tmpOutputLen,
++        SECStatus rv = AES_Encrypt(ctx->cipher.aes, output, &tmpOutputLen,
+                                    ctx->blockSize, input, inputLen);
+ 
+         /* Assumption: AES_Encrypt (when in ECB mode) always returns an
+@@ -156,8 +156,9 @@ CMAC_Init(CMACContext *ctx, CMACCipher t
+ 
+     ctx->blockSize = AES_BLOCK_SIZE;
+     ctx->cipherType = CMAC_AES;
+-    if (AES_InitContext(&ctx->cipher.aes, key, key_len, NULL, NSS_AES, 1,
+-                        ctx->blockSize) != SECSuccess) {
++    ctx->cipher.aes = AES_CreateContext(key, NULL, NSS_AES, 1, key_len,
++                                        ctx->blockSize);
++    if (ctx->cipher.aes == NULL) {
+         return SECFailure;
+     }
+ 
+@@ -308,8 +309,8 @@ CMAC_Destroy(CMACContext *ctx, PRBool fr
+         return;
+     }
+ 
+-    if (ctx->cipherType == CMAC_AES) {
+-        AES_DestroyContext(&ctx->cipher.aes, PR_FALSE);
++    if (ctx->cipherType == CMAC_AES && ctx->cipher.aes != NULL) {
++        AES_DestroyContext(ctx->cipher.aes, PR_TRUE);
+     }
+ 
+     /* Destroy everything in the context. This includes sensitive data in
diff --git a/nss.spec b/nss.spec
index ab4e761..783fb85 100644
--- a/nss.spec
+++ b/nss.spec
@@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM",
 Summary:          Network Security Services
 Name:             nss
 Version:          %{nss_version}
-Release:          1%{?dist}
+Release:          2%{?dist}
 License:          MPLv2.0
 URL:              http://www.mozilla.org/projects/security/pki/nss/
 Requires:         nspr >= %{nspr_version}
@@ -115,6 +115,9 @@ Patch11:	  nss-tls13-default.patch
 Patch12:          nss-signtool-format.patch
 # https://github.com/FStarLang/kremlin/issues/166
 Patch13:          nss-kremlin-ppc64le.patch
+# https://bugzilla.mozilla.org/show_bug.cgi?id=1611209
+# https://bugzilla.mozilla.org/show_bug.cgi?id=1610687
+Patch14:	  nss-cmac-fixes.patch
 
 %description
 Network Security Services (NSS) is a set of libraries designed to
@@ -881,6 +884,9 @@ update-crypto-policies &> /dev/null || :
 
 
 %changelog
+* Thu Mar  5 2020 Daiki Ueno <dueno@redhat.com> - 3.50.0-2
+- Apply CMAC fixes from upstream
+
 * Mon Feb 17 2020 Daiki Ueno <dueno@redhat.com> - 3.50.0-1
 - Update to NSS 3.50
 

From 4581c9b5c08aeabdf3c07f087d1436c515467de2 Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Tue, 7 Apr 2020 11:18:10 +0200
Subject: [PATCH 27/30] Update to NSS 3.51

---
 .gitignore           |  1 +
 nss-cmac-fixes.patch | 75 --------------------------------------------
 nss.spec             | 10 +++---
 sources              |  2 +-
 4 files changed, 7 insertions(+), 81 deletions(-)
 delete mode 100644 nss-cmac-fixes.patch

diff --git a/.gitignore b/.gitignore
index 4e170e7..303c2dc 100644
--- a/.gitignore
+++ b/.gitignore
@@ -45,3 +45,4 @@ TestUser51.cert
 /nss-3.49.tar.gz
 /nss-3.49.2.tar.gz
 /nss-3.50.tar.gz
+/nss-3.51.tar.gz
diff --git a/nss-cmac-fixes.patch b/nss-cmac-fixes.patch
deleted file mode 100644
index 9bcd954..0000000
--- a/nss-cmac-fixes.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-# HG changeset patch
-# User Robert Relyea <rrelyea@redhat.com>
-# Date 1581383641 28800
-#      Mon Feb 10 17:14:01 2020 -0800
-# Node ID df142975f4f695f84a662abdd27219c21c87c8d1
-# Parent  046a6f5bfb271ed03ed6a93e3f879d57905999c5
-Bug 1611209 - Value of CKM_AES_CMAC and CKM_AES_CMAC_GENERAL are swapped r=rrelyea
-
-diff --git a/lib/util/pkcs11t.h b/lib/util/pkcs11t.h
---- a/lib/util/pkcs11t.h
-+++ b/lib/util/pkcs11t.h
-@@ -898,8 +898,8 @@ typedef CK_ULONG CK_MECHANISM_TYPE;
- #define CKM_AES_CCM 0x00001088
- #define CKM_AES_CTS 0x00001089
- /* AES-CMAC values copied from v2.40 errata 1 header file */
--#define CKM_AES_CMAC_GENERAL 0x0000108A
--#define CKM_AES_CMAC 0x0000108B
-+#define CKM_AES_CMAC 0x0000108A
-+#define CKM_AES_CMAC_GENERAL 0x0000108B
- #define CKM_AES_XCBC_MAC 0x0000108C
- #define CKM_AES_XCBC_MAC_96 0x0000108D
- 
-# HG changeset patch
-# User Robert Relyea <rrelyea@redhat.com>
-# Date 1581371554 28800
-#      Mon Feb 10 13:52:34 2020 -0800
-# Node ID 046a6f5bfb271ed03ed6a93e3f879d57905999c5
-# Parent  f161f15f8c8d37070aa5763a1edd91cbbc7c54fb
-Bug 1610687 - Crash on unaligned CMACContext.aes.keySchedule when using AES-NI intrinsics r=kjacobs
-https://phabricator.services.mozilla.com/D60699
-
-diff --git a/lib/freebl/cmac.c b/lib/freebl/cmac.c
---- a/lib/freebl/cmac.c
-+++ b/lib/freebl/cmac.c
-@@ -22,7 +22,7 @@ struct CMACContextStr {
-      * add a new Context pointer to the cipher union with the correct type. */
-     CMACCipher cipherType;
-     union {
--        AESContext aes;
-+        AESContext *aes;
-     } cipher;
-     int blockSize;
- 
-@@ -62,7 +62,7 @@ cmac_Encrypt(CMACContext *ctx, unsigned 
- {
-     if (ctx->cipherType == CMAC_AES) {
-         unsigned int tmpOutputLen;
--        SECStatus rv = AES_Encrypt(&ctx->cipher.aes, output, &tmpOutputLen,
-+        SECStatus rv = AES_Encrypt(ctx->cipher.aes, output, &tmpOutputLen,
-                                    ctx->blockSize, input, inputLen);
- 
-         /* Assumption: AES_Encrypt (when in ECB mode) always returns an
-@@ -156,8 +156,9 @@ CMAC_Init(CMACContext *ctx, CMACCipher t
- 
-     ctx->blockSize = AES_BLOCK_SIZE;
-     ctx->cipherType = CMAC_AES;
--    if (AES_InitContext(&ctx->cipher.aes, key, key_len, NULL, NSS_AES, 1,
--                        ctx->blockSize) != SECSuccess) {
-+    ctx->cipher.aes = AES_CreateContext(key, NULL, NSS_AES, 1, key_len,
-+                                        ctx->blockSize);
-+    if (ctx->cipher.aes == NULL) {
-         return SECFailure;
-     }
- 
-@@ -308,8 +309,8 @@ CMAC_Destroy(CMACContext *ctx, PRBool fr
-         return;
-     }
- 
--    if (ctx->cipherType == CMAC_AES) {
--        AES_DestroyContext(&ctx->cipher.aes, PR_FALSE);
-+    if (ctx->cipherType == CMAC_AES && ctx->cipher.aes != NULL) {
-+        AES_DestroyContext(ctx->cipher.aes, PR_TRUE);
-     }
- 
-     /* Destroy everything in the context. This includes sensitive data in
diff --git a/nss.spec b/nss.spec
index 783fb85..9f9337b 100644
--- a/nss.spec
+++ b/nss.spec
@@ -1,5 +1,5 @@
 %global nspr_version 4.25.0
-%global nss_version 3.50.0
+%global nss_version 3.51.0
 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools
 %global saved_files_dir %{_libdir}/nss/saved
 %global dracutlibdir %{_prefix}/lib/dracut
@@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM",
 Summary:          Network Security Services
 Name:             nss
 Version:          %{nss_version}
-Release:          2%{?dist}
+Release:          1%{?dist}
 License:          MPLv2.0
 URL:              http://www.mozilla.org/projects/security/pki/nss/
 Requires:         nspr >= %{nspr_version}
@@ -115,9 +115,6 @@ Patch11:	  nss-tls13-default.patch
 Patch12:          nss-signtool-format.patch
 # https://github.com/FStarLang/kremlin/issues/166
 Patch13:          nss-kremlin-ppc64le.patch
-# https://bugzilla.mozilla.org/show_bug.cgi?id=1611209
-# https://bugzilla.mozilla.org/show_bug.cgi?id=1610687
-Patch14:	  nss-cmac-fixes.patch
 
 %description
 Network Security Services (NSS) is a set of libraries designed to
@@ -884,6 +881,9 @@ update-crypto-policies &> /dev/null || :
 
 
 %changelog
+* Tue Apr  7 2020 Daiki Ueno <dueno@redhat.com> - 3.51.0-1
+- Update to NSS 3.51
+
 * Thu Mar  5 2020 Daiki Ueno <dueno@redhat.com> - 3.50.0-2
 - Apply CMAC fixes from upstream
 
diff --git a/sources b/sources
index 8a7e320..d0ba033 100644
--- a/sources
+++ b/sources
@@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403
 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c
 SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7
 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310
-SHA512 (nss-3.50.tar.gz) = d6bcaf8ad65b5a97c42cd6cbbc68add5c4b49db74b2debcedb2a007f72511ac0e9bd21fd2dec041bc1975cfc8af26a48450aa0d1b962f755931ab2ac45c795b1
+SHA512 (nss-3.51.tar.gz) = 9c894b1ea41449b000750a7b3a89fcb43dfc3d0d4d6dcc0dc288bc73996f76f1ee1ede927a8aecae6d4a07f9f3d3e3a042c6a60cf06e27e0cdc004fce2e510fd

From f718e580f2e68a422ee4bad671bc694b06d6791f Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Mon, 4 May 2020 07:54:02 +0200
Subject: [PATCH 28/30] Update to NSS 3.51.1

---
 .gitignore | 1 +
 nss.spec   | 5 ++++-
 sources    | 2 +-
 3 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index 303c2dc..e7b1e2c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -46,3 +46,4 @@ TestUser51.cert
 /nss-3.49.2.tar.gz
 /nss-3.50.tar.gz
 /nss-3.51.tar.gz
+/nss-3.51.1.tar.gz
diff --git a/nss.spec b/nss.spec
index 9f9337b..4a85175 100644
--- a/nss.spec
+++ b/nss.spec
@@ -1,5 +1,5 @@
 %global nspr_version 4.25.0
-%global nss_version 3.51.0
+%global nss_version 3.51.1
 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools
 %global saved_files_dir %{_libdir}/nss/saved
 %global dracutlibdir %{_prefix}/lib/dracut
@@ -881,6 +881,9 @@ update-crypto-policies &> /dev/null || :
 
 
 %changelog
+* Mon May  4 2020 Daiki Ueno <dueno@redhat.com> - 3.51.1-1
+- Update to NSS 3.51.1
+
 * Tue Apr  7 2020 Daiki Ueno <dueno@redhat.com> - 3.51.0-1
 - Update to NSS 3.51
 
diff --git a/sources b/sources
index d0ba033..8464526 100644
--- a/sources
+++ b/sources
@@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403
 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c
 SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7
 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310
-SHA512 (nss-3.51.tar.gz) = 9c894b1ea41449b000750a7b3a89fcb43dfc3d0d4d6dcc0dc288bc73996f76f1ee1ede927a8aecae6d4a07f9f3d3e3a042c6a60cf06e27e0cdc004fce2e510fd
+SHA512 (nss-3.51.1.tar.gz) = 1878780886cc330489a14a60ee5cb67b174f3167d020db256eacdce079652ef8af65813914cd0fb5684457053fa27acc9bff72d0713fbea28795613ca45a6d46

From df38c937fb13654369c8d73e280cd62a4635c751 Mon Sep 17 00:00:00 2001
From: Daiki Ueno <dueno@redhat.com>
Date: Mon, 11 May 2020 18:21:55 +0200
Subject: [PATCH 29/30] Update to NSS 3.52

---
 .gitignore                |  1 +
 nss-3.47-ike-fix.patch    | 22 ----------------------
 nss-kremlin-ppc64le.patch | 23 ++++++++++++-----------
 nss-tls13-default.patch   | 12 ------------
 nss.spec                  | 12 ++++--------
 sources                   |  2 +-
 6 files changed, 18 insertions(+), 54 deletions(-)
 delete mode 100644 nss-3.47-ike-fix.patch
 delete mode 100644 nss-tls13-default.patch

diff --git a/.gitignore b/.gitignore
index e7b1e2c..9718285 100644
--- a/.gitignore
+++ b/.gitignore
@@ -47,3 +47,4 @@ TestUser51.cert
 /nss-3.50.tar.gz
 /nss-3.51.tar.gz
 /nss-3.51.1.tar.gz
+/nss-3.52.tar.gz
diff --git a/nss-3.47-ike-fix.patch b/nss-3.47-ike-fix.patch
deleted file mode 100644
index 2de0aee..0000000
--- a/nss-3.47-ike-fix.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-diff -up ./lib/softoken/pkcs11.c.ike_fix ./lib/softoken/pkcs11.c
---- ./lib/softoken/pkcs11.c.ike_fix	2019-11-04 10:15:08.022176945 -0800
-+++ ./lib/softoken/pkcs11.c	2019-11-04 10:17:35.396733750 -0800
-@@ -330,7 +330,7 @@ static const struct mechanismList mechan
-     { CKM_AES_CTS, { 16, 32, CKF_EN_DE }, PR_TRUE },
-     { CKM_AES_CTR, { 16, 32, CKF_EN_DE }, PR_TRUE },
-     { CKM_AES_GCM, { 16, 32, CKF_EN_DE }, PR_TRUE },
--    { CKM_AES_XCBC_MAC_96, { 16, 16, CKF_SN_VR }, PR_TRUE },
-+    { CKM_AES_XCBC_MAC_96, { 12, 12, CKF_SN_VR }, PR_TRUE },
-     { CKM_AES_XCBC_MAC, { 16, 16, CKF_SN_VR }, PR_TRUE },
-     /* ------------------------- Camellia Operations --------------------- */
-     { CKM_CAMELLIA_KEY_GEN, { 16, 32, CKF_GENERATE }, PR_TRUE },
-@@ -518,7 +518,8 @@ static const struct mechanismList mechan
-     /* --------------------IPSEC ----------------------- */
-     { CKM_NSS_IKE_PRF_PLUS_DERIVE, { 8, 255 * 64, CKF_DERIVE }, PR_TRUE },
-     { CKM_NSS_IKE_PRF_DERIVE, { 8, 64, CKF_DERIVE }, PR_TRUE },
--    { CKM_NSS_IKE1_PRF_DERIVE, { 8, 64, CKF_DERIVE }, PR_TRUE }
-+    { CKM_NSS_IKE1_PRF_DERIVE, { 8, 64, CKF_DERIVE }, PR_TRUE },
-+    { CKM_NSS_IKE1_APP_B_PRF_DERIVE, { 8, 255 * 64, CKF_DERIVE }, PR_TRUE }
- };
- static const CK_ULONG mechanismCount = sizeof(mechanisms) / sizeof(mechanisms[0]);
- 
diff --git a/nss-kremlin-ppc64le.patch b/nss-kremlin-ppc64le.patch
index d4e9d89..b5f4700 100644
--- a/nss-kremlin-ppc64le.patch
+++ b/nss-kremlin-ppc64le.patch
@@ -2,27 +2,28 @@ Index: nss/lib/freebl/verified/kremlin/include/kremlin/internal/types.h
 ===================================================================
 --- nss.orig/lib/freebl/verified/kremlin/include/kremlin/internal/types.h
 +++ nss/lib/freebl/verified/kremlin/include/kremlin/internal/types.h
-@@ -56,7 +56,9 @@ typedef const char *Prims_string;
+@@ -56,9 +56,10 @@ typedef const char *Prims_string;
+     !defined(__clang__)
  #include <emmintrin.h>
  typedef __m128i FStar_UInt128_uint128;
- #elif !defined(KRML_VERIFIED_UINT128) && !defined(_MSC_VER) && \
--    (defined(__x86_64__) || defined(__x86_64) || defined(__aarch64__))
-+    (defined(__x86_64__) || defined(__x86_64) || defined(__aarch64__) || \
+-#elif !defined(KRML_VERIFIED_UINT128) && !defined(_MSC_VER) &&           \
++#elif !defined(KRML_VERIFIED_UINT128) && !defined(_MSC_VER) && \
+     (defined(__x86_64__) || defined(__x86_64) || defined(__aarch64__) || \
+-     (defined(__powerpc64__) && defined(__LITTLE_ENDIAN__)))
 +    (defined(__powerpc64__) && defined(__LITTLE_ENDIAN__)) || \
 +     defined(__s390x__))
  typedef unsigned __int128 FStar_UInt128_uint128;
- #else
- typedef struct FStar_UInt128_uint128_s {
+ #elif !defined(KRML_VERIFIED_UINT128) && defined(_MSC_VER) && defined(__clang__)
+ typedef __uint128_t FStar_UInt128_uint128;
 Index: nss/lib/freebl/verified/kremlin/kremlib/dist/minimal/fstar_uint128_gcc64.h
 ===================================================================
 --- nss.orig/lib/freebl/verified/kremlin/kremlib/dist/minimal/fstar_uint128_gcc64.h
 +++ nss/lib/freebl/verified/kremlin/kremlib/dist/minimal/fstar_uint128_gcc64.h
-@@ -25,7 +25,9 @@
- #include "LowStar_Endianness.h"
+@@ -26,7 +26,8 @@
  
- #if !defined(KRML_VERIFIED_UINT128) && !defined(_MSC_VER) && \
--    (defined(__x86_64__) || defined(__x86_64) || defined(__aarch64__))
-+    (defined(__x86_64__) || defined(__x86_64) || defined(__aarch64__) || \
+ #if !defined(KRML_VERIFIED_UINT128) && (!defined(_MSC_VER) || defined(__clang__)) && \
+     (defined(__x86_64__) || defined(__x86_64) || defined(__aarch64__) ||             \
+-     (defined(__powerpc64__) && defined(__LITTLE_ENDIAN__)))
 +    (defined(__powerpc64__) && defined(__LITTLE_ENDIAN__)) || \
 +     defined(__s390x__))
  
diff --git a/nss-tls13-default.patch b/nss-tls13-default.patch
deleted file mode 100644
index ffdca50..0000000
--- a/nss-tls13-default.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -up nss/lib/ssl/sslsock.c.tls13-default nss/lib/ssl/sslsock.c
---- nss/lib/ssl/sslsock.c.tls13-default	2020-01-27 10:21:44.930830558 +0100
-+++ nss/lib/ssl/sslsock.c	2020-01-27 10:21:47.419852229 +0100
-@@ -97,7 +97,7 @@ static sslOptions ssl_defaults = {
-  */
- static SSLVersionRange versions_defaults_stream = {
-     SSL_LIBRARY_VERSION_TLS_1_0,
--    SSL_LIBRARY_VERSION_TLS_1_3
-+    SSL_LIBRARY_VERSION_TLS_1_2
- };
- 
- static SSLVersionRange versions_defaults_datagram = {
diff --git a/nss.spec b/nss.spec
index 4a85175..fac1ae9 100644
--- a/nss.spec
+++ b/nss.spec
@@ -1,5 +1,5 @@
 %global nspr_version 4.25.0
-%global nss_version 3.51.1
+%global nss_version 3.52.0
 %global unsupported_tools_directory %{_libdir}/nss/unsupported-tools
 %global saved_files_dir %{_libdir}/nss/saved
 %global dracutlibdir %{_prefix}/lib/dracut
@@ -105,13 +105,6 @@ Patch2:           nss-539183.patch
 # Once the buildroot aha been bootstrapped the patch may be removed
 # but it doesn't hurt to keep it.
 Patch4:           iquote.patch
-# add missing ike mechanism to softoken
-Patch10:          nss-3.47-ike-fix.patch
-# To revert the upstream change:
-# https://bugzilla.mozilla.org/show_bug.cgi?id=1573118
-# as it still doesn't work under FIPS mode because of missing HKDF
-# support in PKCS #11.
-Patch11:	  nss-tls13-default.patch
 Patch12:          nss-signtool-format.patch
 # https://github.com/FStarLang/kremlin/issues/166
 Patch13:          nss-kremlin-ppc64le.patch
@@ -881,6 +874,9 @@ update-crypto-policies &> /dev/null || :
 
 
 %changelog
+* Mon May 11 2020 Daiki Ueno <dueno@redhat.com> - 3.52.0-1
+- Update to NSS 3.52
+
 * Mon May  4 2020 Daiki Ueno <dueno@redhat.com> - 3.51.1-1
 - Update to NSS 3.51.1
 
diff --git a/sources b/sources
index 8464526..2f019bb 100644
--- a/sources
+++ b/sources
@@ -3,4 +3,4 @@ SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403
 SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c
 SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7
 SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310
-SHA512 (nss-3.51.1.tar.gz) = 1878780886cc330489a14a60ee5cb67b174f3167d020db256eacdce079652ef8af65813914cd0fb5684457053fa27acc9bff72d0713fbea28795613ca45a6d46
+SHA512 (nss-3.52.tar.gz) = a45baf38717bceda03c292b2c01def680a24a846327e17d36044a85e30ed40c68220c78c0a2c3025c11778ee58f5d5eb0fff1b4cd274b95c408fb59e394e62c6

From 1595e0e28c023889cb8ca004acdcba06eaac1d28 Mon Sep 17 00:00:00 2001
From: Bob Relyea <rrelyea@redhat.com>
Date: Wed, 13 May 2020 15:58:21 -0700
Subject: [PATCH 30/30]  Delay new CK_GCM_PARAMS semantics until fedora 34
 unless explicitly enabled.

---
 nss-gcm-param-default-pkcs11v2.patch | 21 +++++++++++++++++++++
 nss.spec                             | 10 +++++++++-
 2 files changed, 30 insertions(+), 1 deletion(-)
 create mode 100644 nss-gcm-param-default-pkcs11v2.patch

diff --git a/nss-gcm-param-default-pkcs11v2.patch b/nss-gcm-param-default-pkcs11v2.patch
new file mode 100644
index 0000000..2d6cba8
--- /dev/null
+++ b/nss-gcm-param-default-pkcs11v2.patch
@@ -0,0 +1,21 @@
+diff -up ./lib/util/pkcs11n.h.aes_gcm_pkcs11_v2 ./lib/util/pkcs11n.h
+--- ./lib/util/pkcs11n.h.aes_gcm_pkcs11_v2	2020-05-13 13:44:11.312405744 -0700
++++ ./lib/util/pkcs11n.h	2020-05-13 13:45:23.951723660 -0700
+@@ -605,7 +605,7 @@ typedef struct CK_NSS_GCM_PARAMS {
+ typedef CK_NSS_GCM_PARAMS CK_PTR CK_NSS_GCM_PARAMS_PTR;
+ 
+ /* deprecated #defines. Drop in future NSS releases */
+-#ifdef NSS_PKCS11_2_0_COMPAT
++#ifndef NSS_PKCS11_3_0_STRICT
+ 
+ /* defines that were changed between NSS's PKCS #11 and the Oasis headers */
+ #define CKF_EC_FP CKF_EC_F_P
+@@ -664,7 +664,7 @@ typedef CK_NSS_GCM_PARAMS CK_PTR CK_GCM_
+ #define CKT_NETSCAPE_VALID CKT_NSS_VALID
+ #define CKT_NETSCAPE_VALID_DELEGATOR CKT_NSS_VALID_DELEGATOR
+ #else
+-/* use the new CK_GCM_PARAMS if NSS_PKCS11_2_0_COMPAT is not defined */
++/* use the new CK_GCM_PARAMS if NSS_PKCS11_3_0_STRICT is defined */
+ typedef struct CK_GCM_PARAMS_V3 CK_GCM_PARAMS;
+ typedef CK_GCM_PARAMS_V3 CK_PTR CK_GCM_PARAMS_PTR;
+ #endif
diff --git a/nss.spec b/nss.spec
index fac1ae9..c23c636 100644
--- a/nss.spec
+++ b/nss.spec
@@ -43,7 +43,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM",
 Summary:          Network Security Services
 Name:             nss
 Version:          %{nss_version}
-Release:          1%{?dist}
+Release:          2%{?dist}
 License:          MPLv2.0
 URL:              http://www.mozilla.org/projects/security/pki/nss/
 Requires:         nspr >= %{nspr_version}
@@ -108,6 +108,11 @@ Patch4:           iquote.patch
 Patch12:          nss-signtool-format.patch
 # https://github.com/FStarLang/kremlin/issues/166
 Patch13:          nss-kremlin-ppc64le.patch
+%if 0%{?fedora} < 34
+%if 0%{?rhel} < 9
+Patch20:          nss-gcm-param-default-pkcs11v2.patch
+%endif
+%endif
 
 %description
 Network Security Services (NSS) is a set of libraries designed to
@@ -874,6 +879,9 @@ update-crypto-policies &> /dev/null || :
 
 
 %changelog
+* Wed May 13 2020 Bob Relyea <rrelyea@redhat.com> - 3.52.0-2
+- Delay CK_GCM_PARAMS semantics until fedora 34
+
 * Mon May 11 2020 Daiki Ueno <dueno@redhat.com> - 3.52.0-1
 - Update to NSS 3.52