Update NSS to 3.85 (rhbz#214318)

Rebase to NSPR 4.34

.gitignore

@@ -64,3 +64,15 @@ TestUser51.cert
 /nss-3.65.tar.gz
 /nss-3.67.tar.gz
 /nspr-4.31.tar.gz
+/nss-3.69.tar.gz
+/nspr-4.32.tar.gz
+/nss-3.71.tar.gz
+/nss-3.73.tar.gz
+/nss-3.75.tar.gz
+/nss-3.77.tar.gz
+/nss-3.79.tar.gz
+/nspr-4.34.tar.gz
+/nss-3.81.tar.gz
+/nss-3.83.tar.gz
+/nspr-4.35.tar.gz
+/nss-3.85.tar.gz

nspr-gcc-atomics.patch

@@ -1,12 +1,7 @@
-diff --git a/pr/include/md/_linux.h b/pr/include/md/_linux.h
---- a/pr/include/md/_linux.h
-+++ b/pr/include/md/_linux.h
-@@ -82,53 +82,73 @@
- #define NO_DLOPEN_NULL
- #endif
- 
- #if defined(__FreeBSD_kernel__) || defined(__GNU__)
- #define _PR_HAVE_SOCKADDR_LEN
+diff -up ./pr/include/md/_linux.h.gcc-atomics ./pr/include/md/_linux.h
+--- ./pr/include/md/_linux.h.gcc-atomics	2022-09-20 11:23:22.008942926 -0700
++++ ./pr/include/md/_linux.h	2022-09-20 11:34:45.536751340 -0700
+@@ -105,6 +105,15 @@
  #endif
  
  #if defined(__i386__)
@@ -22,11 +17,7 @@ diff --git a/pr/include/md/_linux.h b/pr/include/md/_linux.h
  #define _PR_HAVE_ATOMIC_OPS
  #define _MD_INIT_ATOMIC()
  extern PRInt32 _PR_x86_AtomicIncrement(PRInt32 *val);
- #define _MD_ATOMIC_INCREMENT          _PR_x86_AtomicIncrement
- extern PRInt32 _PR_x86_AtomicDecrement(PRInt32 *val);
- #define _MD_ATOMIC_DECREMENT          _PR_x86_AtomicDecrement
- extern PRInt32 _PR_x86_AtomicAdd(PRInt32 *ptr, PRInt32 val);
- #define _MD_ATOMIC_ADD                _PR_x86_AtomicAdd
+@@ -116,6 +125,7 @@ extern PRInt32 _PR_x86_AtomicAdd(PRInt32
  extern PRInt32 _PR_x86_AtomicSet(PRInt32 *val, PRInt32 newval);
  #define _MD_ATOMIC_SET                _PR_x86_AtomicSet
  #endif
@@ -34,15 +25,7 @@ diff --git a/pr/include/md/_linux.h b/pr/include/md/_linux.h
  
  #if defined(__ia64__)
  #define _PR_HAVE_ATOMIC_OPS
- #define _MD_INIT_ATOMIC()
- extern PRInt32 _PR_ia64_AtomicIncrement(PRInt32 *val);
- #define _MD_ATOMIC_INCREMENT          _PR_ia64_AtomicIncrement
- extern PRInt32 _PR_ia64_AtomicDecrement(PRInt32 *val);
- #define _MD_ATOMIC_DECREMENT          _PR_ia64_AtomicDecrement
- extern PRInt32 _PR_ia64_AtomicAdd(PRInt32 *ptr, PRInt32 val);
- #define _MD_ATOMIC_ADD                _PR_ia64_AtomicAdd
- extern PRInt32 _PR_ia64_AtomicSet(PRInt32 *val, PRInt32 newval);
- #define _MD_ATOMIC_SET                _PR_ia64_AtomicSet
+@@ -131,6 +141,15 @@ extern PRInt32 _PR_ia64_AtomicSet(PRInt3
  #endif
  
  #if defined(__x86_64__)
@@ -58,20 +41,11 @@ diff --git a/pr/include/md/_linux.h b/pr/include/md/_linux.h
  #define _PR_HAVE_ATOMIC_OPS
  #define _MD_INIT_ATOMIC()
  extern PRInt32 _PR_x86_64_AtomicIncrement(PRInt32 *val);
- #define _MD_ATOMIC_INCREMENT          _PR_x86_64_AtomicIncrement
- extern PRInt32 _PR_x86_64_AtomicDecrement(PRInt32 *val);
- #define _MD_ATOMIC_DECREMENT          _PR_x86_64_AtomicDecrement
- extern PRInt32 _PR_x86_64_AtomicAdd(PRInt32 *ptr, PRInt32 val);
- #define _MD_ATOMIC_ADD                _PR_x86_64_AtomicAdd
+@@ -142,6 +161,7 @@ extern PRInt32 _PR_x86_64_AtomicAdd(PRIn
  extern PRInt32 _PR_x86_64_AtomicSet(PRInt32 *val, PRInt32 newval);
  #define _MD_ATOMIC_SET                _PR_x86_64_AtomicSet
  #endif
 +#endif
  
- #if defined(__or1k__)
+ #if defined(__loongarch__)
  #if defined(__GNUC__)
- /* Use GCC built-in functions */
- #define _PR_HAVE_ATOMIC_OPS
- #define _MD_INIT_ATOMIC()
- #define _MD_ATOMIC_INCREMENT(ptr) __sync_add_and_fetch(ptr, 1)
- #define _MD_ATOMIC_DECREMENT(ptr) __sync_sub_and_fetch(ptr, 1)

nss-3.79-fix-client-cert-crash.patch

@@ -0,0 +1,23 @@
+diff --git a/lib/ssl/authcert.c b/lib/ssl/authcert.c
+--- a/lib/ssl/authcert.c
++++ b/lib/ssl/authcert.c
+@@ -212,17 +212,17 @@ NSS_GetClientAuthData(void *arg,
+                                                pw_arg);
+         } else {
+             int nnames = 0;
+             char **names = ssl_DistNamesToStrings(caNames, &nnames);
+             rv = CERT_FilterCertListByCANames(certList, nnames, names,
+                                               certUsageSSLClient);
+             ssl_FreeDistNamesStrings(names, nnames);
+         }
+-        if ((rv != SECSuccess) || CERT_LIST_EMPTY(certList)) {
++        if ((rv != SECSuccess) || (certList && CERT_LIST_EMPTY(certList))) {
+             CERT_DestroyCertList(certList);
+             certList = NULL;
+         }
+     }
+     if (certList == NULL) {
+         /* no user certs meeting the nickname/usage requirements found */
+         return SECFailure;
+     }
+

nss-fix-PayPal-upstream.patch

@@ -0,0 +1,42 @@
+diff --git a/tests/chains/chains.sh b/tests/chains/chains.sh
+--- a/tests/chains/chains.sh
++++ b/tests/chains/chains.sh
+@@ -917,7 +917,7 @@
+     done
+ 
+     VFY_OPTS_TNAME="${DB_OPT} ${ENGINE} ${TRUST_AND_DB_OPT} ${REV_OPTS} ${FETCH_OPT} ${USAGE_OPT} ${POLICY_OPT} ${TRUST_OPT}"
+-    VFY_OPTS_ALL="${DB_OPT} ${ENGINE} -vv ${TRUST_AND_DB_OPT} ${REV_OPTS} ${FETCH_OPT} ${USAGE_OPT} ${POLICY_OPT} ${VFY_CERTS} ${TRUST_OPT}"
++    VFY_OPTS_ALL="${DB_OPT} ${ENGINE} -vv ${VFY_TIME_OPT} ${TRUST_AND_DB_OPT} ${REV_OPTS} ${FETCH_OPT} ${USAGE_OPT} ${POLICY_OPT} ${VFY_CERTS} ${TRUST_OPT}"
+ 
+     TESTNAME="Verifying certificate(s) ${VFY_LIST} with flags ${VFY_OPTS_TNAME}"
+     echo "${SCRIPTNAME}: ${TESTNAME}"
+@@ -1118,6 +1118,7 @@
+             ;;
+         "verify")
+             VERIFY="${VALUE}"
++            VFY_TIME_OPT=
+             TRUST=
+             TRUST_AND_DB=
+             POLICY=
+@@ -1126,6 +1127,9 @@
+             REV_OPTS=
+             USAGE_OPT=
+             ;;
++        "at_time")
++            VFY_TIME_OPT="-b ${VALUE}"
++            ;;
+         "cert")
+             VERIFY="${VERIFY} ${VALUE}"
+             ;;
+diff --git a/tests/chains/scenarios/realcerts.cfg b/tests/chains/scenarios/realcerts.cfg
+--- a/tests/chains/scenarios/realcerts.cfg
++++ b/tests/chains/scenarios/realcerts.cfg
+@@ -22,6 +22,7 @@
+ 
+ verify PayPalEE:x
+   policy OID.2.16.840.1.114412.2.1 
++  at_time 2201010000Z
+   result pass
+ 
+ verify BrAirWaysBadSig:x
+

nss.spec

@@ -1,13 +1,13 @@
-%global nspr_version 4.31.0
-%global nss_version 3.67.0
+%global nspr_version 4.35.0
+%global nss_version 3.85.0
 # NOTE: To avoid NVR clashes of nspr* packages:
 # - reset %%{nspr_release} to 1, when updating %%{nspr_version}
 # - increment %%{nspr_version}, when updating the NSS part only
-%global baserelease 4
+%global baserelease 1
 %global nss_release %baserelease
-# use %global nspr_release %[%baserelease+n] to handle offsets when
+# use "%%global nspr_release %%[%%baserelease+n]" to handle offsets when
 # release number between nss and nspr are different.
-%global nspr_release %baserelease
+%global nspr_release %[%baserelease+1]
 # only need to update this as we added new
 # algorithms under nss policy control
 %global crypto_policies_version 20210118
@@ -115,8 +115,6 @@ Source28:         nss-p11-kit.config
 Source100:        nspr-%{nspr_archive_version}.tar.gz
 Source101:        nspr-config.xml
 
-# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=617723
-Patch2:           nss-539183.patch
 # This patch uses the GCC -iquote option documented at
 # http://gcc.gnu.org/onlinedocs/gcc/Directory-Options.html#Directory-Options
 # to give the in-tree headers a higher priority over the system headers,
@@ -130,9 +128,11 @@ Patch2:           nss-539183.patch
 # but it doesn't hurt to keep it.
 Patch4:           iquote.patch
 Patch12:          nss-signtool-format.patch
-Patch30:          nss-fedora-btrf-sql-hack.patch
 # fedora disabled dbm by default
 Patch40:          nss-no-dbm-man-page.patch
+ 
+# upstream bug https://bugzilla.mozilla.org/show_bug.cgi?id=1774654
+Patch50:       nss-3.79-fix-client-cert-crash.patch
 
 Patch100:         nspr-config-pc.patch
 Patch101:         nspr-gcc-atomics.patch
@@ -353,7 +353,7 @@ popd
 # Build NSS
 #
 # This package fails its testsuite with LTO.  Disable LTO for now
-%global _lto_cflags %{nil}
+#%global _lto_cflags %{nil}
 
 #export FREEBL_NO_DEPEND=1
 
@@ -395,6 +395,7 @@ export PKG_CONFIG_ALLOW_SYSTEM_LIBS=1
 export PKG_CONFIG_ALLOW_SYSTEM_CFLAGS=1
 
 export NSPR_INCLUDE_DIR=$PWD/dist/include/nspr
+export NSPR_LIB_DIR=$PWD/dist/lib
 
 export NSS_USE_SYSTEM_SQLITE=1
 
@@ -419,6 +420,7 @@ export POLICY_FILE="nss.config"
 # location of the policy file
 export POLICY_PATH="/etc/crypto-policies/back-ends"
 
+
 %{__make} -C ./nss all
 %{__make} -C ./nss latest
 
@@ -562,6 +564,15 @@ export USE_64=1
 
 # End -- copied from the build section
 
+# copy the nspr libraries into the NSS object directory so we use the
+# newly compiled nspr binaries in our test rather than the build root
+# versions
+export LOBJDIR=`make -s -C ./nss/tests/common objdir_name`
+for i in ./dist/lib/*.so
+do
+   cp $i ./dist/${LOBJDIR}/lib
+done
+
 # This is necessary because the test suite tests algorithms that are
 # disabled by the system policy.
 export NSS_IGNORE_SYSTEM_POLICY=1
@@ -585,9 +596,9 @@ if [ $SPACEISBAD -ne 0 ]; then
   echo "error: filenames containing space are not supported (xargs)"
   exit 1
 fi
-MYRAND=`perl -e 'print 9000 + int rand 1000'`; echo $MYRAND ||:
-RANDSERV=selfserv_${MYRAND}; echo $RANDSERV ||:
-DISTBINDIR=`ls -d ./dist/*.OBJ/bin`; echo $DISTBINDIR ||:
+export MYRAND=`perl -e 'print 9000 + int rand 1000'`; echo $MYRAND
+export RANDSERV=selfserv_${MYRAND}; echo $RANDSERV
+export DISTBINDIR=./dist/${LOBJDIR}/bin
 pushd "$DISTBINDIR"
 ln -s selfserv $RANDSERV
 popd
@@ -646,6 +657,25 @@ for f in nspr-config; do
 done
 popd
 
+# Begin -- copied from the build section
+# this is needed to make sure LOBJDIR is correct
+
+export FREEBL_NO_DEPEND=1
+
+export BUILD_OPT=1
+export NSS_DISABLE_PPC_GHASH=1
+
+%ifnarch noarch
+%if 0%{__isa_bits} == 64
+export USE_64=1
+%endif
+%endif
+
+# End -- copied from the build section
+
+# get the objdir value from the test make file
+export LOBJDIR=`make -s -C ./nss/tests/common objdir_name`
+
 # There is no make install target so we'll do it ourselves.
 
 mkdir -p $RPM_BUILD_ROOT/%{_includedir}/nss3
@@ -674,7 +704,7 @@ mkdir -p $RPM_BUILD_ROOT%{_mandir}/man5
 # Copy the binary libraries we want
 for file in libnssutil3.so libsoftokn3.so %{?with_dbm:libnssdbm3.so} libfreebl3.so libfreeblpriv3.so libnss3.so libnsssysinit.so libsmime3.so libssl3.so
 do
-  install -p -m 755 dist/*.OBJ/lib/$file $RPM_BUILD_ROOT/%{_libdir}
+  install -p -m 755 dist/${LOBJDIR}/lib/$file $RPM_BUILD_ROOT/%{_libdir}
 done
 
 # Install the empty NSS db files
@@ -693,19 +723,19 @@ install -p -m 644 %{SOURCE15} $RPM_BUILD_ROOT/%{_sysconfdir}/pki/nssdb/pkcs11.tx
 # Copy the development libraries we want
 for file in libcrmf.a libnssb.a libnssckfw.a
 do
-  install -p -m 644 dist/*.OBJ/lib/$file $RPM_BUILD_ROOT/%{_libdir}
+  install -p -m 644 dist/${LOBJDIR}/lib/$file $RPM_BUILD_ROOT/%{_libdir}
 done
 
 # Copy the binaries we want
 for file in certutil cmsutil crlutil modutil nss-policy-check pk12util signver ssltap
 do
-  install -p -m 755 dist/*.OBJ/bin/$file $RPM_BUILD_ROOT/%{_bindir}
+  install -p -m 755 dist/${LOBJDIR}/bin/$file $RPM_BUILD_ROOT/%{_bindir}
 done
 
 # Copy the binaries we ship as unsupported
 for file in bltest ecperf fbectest fipstest shlibsign atob btoa derdump listsuites ocspclnt pp selfserv signtool strsclnt symkeyutil tstclnt vfyserv vfychain
 do
-  install -p -m 755 dist/*.OBJ/bin/$file $RPM_BUILD_ROOT/%{unsupported_tools_directory}
+  install -p -m 755 dist/${LOBJDIR}/bin/$file $RPM_BUILD_ROOT/%{unsupported_tools_directory}
 done
 
 # Copy the include files we want
@@ -723,7 +753,7 @@ done
 # Copy the static freebl library
 for file in libfreebl.a
 do
-install -p -m 644 dist/*.OBJ/lib/$file $RPM_BUILD_ROOT/%{_libdir}
+install -p -m 644 dist/${LOBJDIR}/lib/$file $RPM_BUILD_ROOT/%{_libdir}
 done
 
 # Copy the template files we want
@@ -1060,6 +1090,42 @@ update-crypto-policies &> /dev/null || :
 
 
 %changelog
+* Thu Nov 17 2022 Bob Relyea <rrelyea@redhat.com> - 3.85.0-1
+ - update to NSS 3.85
+
+* Tue Sep 20 2022 Bob Relyea <rrelyea@redhat.com> - 3.83.0-1
+ - update to NSS 3.83
+ - update to NSPR 4.35
+
+* Thu Jun 21 2022 Bob Relyea <rrelyea@redhat.com> - 3.81.0-1
+ - udpate to NSS 3.81
+- Fix crash when getting client cert and there is none in the database.
+
+* Tue May 31 2022 Bob Relyea <rrelyea@redhat.com> - 3.79.0-1
+- Update to NSS 3.79
+- Update to NSPR 4.34
+
+* Tue Apr 5 2022 Bob Relyea <rrelyea@redhat.com> - 3.77.0-1
+- Update to 3.77
+
+* Mon Feb 7 2022 Bob Relyea <rrelyea@redhat.com> - 3.75.0-1
+- Update to 3.75
+- fix PayPal expiration issue
+
+* Wed Dec 1 2021 Bob Relyea <rrelyea@redhat.com> - 3.73.0-1
+- Update to 3.73
+- includes CVE 2021-43527
+
+* Mon Oct 4 2021 Bob Relyea <rrelyea@redhat.com> - 3.71.0-1
+- Update to 3.71
+
+* Tue Aug 10 2021 Bob Relyea <rrelyea@redhat.com> - 3.69.0-2
+- turn on lto
+
+* Tue Aug 10 2021 Bob Relyea <rrelyea@redhat.com> - 3.69.0-1
+- Update to 3.69
+- Update to NSPR 4.31
+
 * Tue Jul 27 2021 Bob Relyea <rrelyea@redhat.com> - 3.67.0-4
 - switch to baserelease so rpmdev-bumpspec will work next time
 

sources

@@ -1,7 +1,4 @@
-SHA512 (blank-cert8.db) = ac131d15708c5f1b5e467831f919f4fc4ba13b60a4bb5fe260c845fa9afcd899a588d21ed52060abaa1bbb29f2b53af8b495d28407183cb03aff1974f95f1d3d
 SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403fda3e3d4e7757838061ae56ccf5aac335cb54f254f0a9e6e9c0dd5920b4155a39264525b06
-SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c
 SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7
-SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310
-SHA512 (nss-3.67.tar.gz) = 1d3fa3fafbf3e54c9c3b54b0b3c291aebb48542380a1b704fa07359d3cefab93f166b31928c9db190ed58118e289e67ce8aa1619e4219d69b2c098484a22bc9d
-SHA512 (nspr-4.31.tar.gz) = 1f37d04721335288dd8a5cf700ead5a56cee73365e619f3da90f6067830b78a050a525950686bcdd14fcf61faffd1141ec46d4180a0dd10375f7e9fef6eac6ed
+SHA512 (nss-3.85.tar.gz) = 97cfffa2beed1dba5d31e0c6e450553e5a8c78b427521640adb00c05d9d63cd64dc08388f0dbf96c93efb79f5daf4ba8db8d026b0b43d2e5c865a9b833fc77a1
+SHA512 (nspr-4.35.tar.gz) = 502815833116e25f79ddf71d1526484908aa92fbc55f8a892729cb404a4daafcc0470a89854cd080d2d20299fdb7d9662507c5362c7ae661cbacf308ac56ef7f