Fix changelog date

- remove nss-3.94-fix-ec-encoding.patch (upstreamed)

.gitignore

@@ -77,3 +77,17 @@ TestUser51.cert
 /nspr-4.35.tar.gz
 /nss-3.85.tar.gz
 /nss-3.87.tar.gz
+/nss-3.88.1.tar.gz
+/nss-3.89.tar.gz
+/nss-3.89-with-nspr-4.35.tar.gz
+/nss-3.90-with-nspr-4.35.tar.gz
+/nss-3.91-with-nspr-4.35.tar.gz
+/nss-3.92-with-nspr-4.35.tar.gz
+/nss-3.93-with-nspr-4.35.tar.gz
+/nss-3.94-with-nspr-4.35.tar.gz
+/nss-3.95-with-nspr-4.35.tar.gz
+/nss-3.96-with-nspr-4.35.tar.gz
+/nss-3.96.1-with-nspr-4.35.tar.gz
+/nss-3.97-with-nspr-4.35.tar.gz
+/nss-3.98-with-nspr-4.35.tar.gz
+/nss-3.99-with-nspr-4.35.tar.gz

nss-3.85-fedora-rebuild-errors.patch

@@ -1,24 +0,0 @@
-diff -up ./lib/ssl/ssl3exthandle.c.rebuild_errors ./lib/ssl/ssl3exthandle.c
---- ./lib/ssl/ssl3exthandle.c.rebuild_errors	2023-01-24 09:26:36.520183263 -0800
-+++ ./lib/ssl/ssl3exthandle.c	2023-01-24 09:27:07.715379228 -0800
-@@ -201,7 +201,7 @@ ssl3_FreeSniNameArray(TLSExtensionData *
-  * Clients sends a filled in session ticket if one is available, and otherwise
-  * sends an empty ticket.  Servers always send empty tickets.
-  */
--PRInt32
-+SECStatus
- ssl3_ClientSendSessionTicketXtn(const sslSocket *ss, TLSExtensionData *xtnData,
-                                 sslBuffer *buf, PRBool *added)
- {
-diff -up ./lib/ssl/sslsnce.c.rebuild_errors ./lib/ssl/sslsnce.c
---- ./lib/ssl/sslsnce.c.rebuild_errors	2023-01-24 09:44:52.714977837 -0800
-+++ ./lib/ssl/sslsnce.c	2023-01-24 09:46:20.993510435 -0800
-@@ -1820,7 +1820,7 @@ ssl_GetSelfEncryptKeyPair(SECKEYPublicKe
-     return SECSuccess;
- }
- 
--static PRBool
-+static SECStatus
- ssl_GenerateSelfEncryptKeys(void *pwArg, PRUint8 *keyName,
-                             PK11SymKey **aesKey, PK11SymKey **macKey);
- 

nss-signtool-format.patch

@@ -10,7 +10,7 @@ diff --git a/cmd/modutil/install.c b/cmd/modutil/install.c
  
          /* Recursively delete all entries in the directory */
          while ((entry = PR_ReadDir(dir, PR_SKIP_BOTH)) != NULL) {
--            sprintf(filename, "%s/%s", path, entry->name);
+-            snprintf(filename, sizeof(filename), "%s/%s", path, entry->name);
 +            if (snprintf(filename, sizeof(filename), "%s/%s", path, entry->name) >= sizeof(filename)) {
 +                PR_CloseDir(dir);
 +                return -1;
@@ -29,7 +29,7 @@ diff --git a/cmd/signtool/util.c b/cmd/signtool/util.c
 @@ -138,6 +138,12 @@ rm_dash_r(char *path)
          /* Recursively delete all entries in the directory */
          while ((entry = PR_ReadDir(dir, PR_SKIP_BOTH)) != NULL) {
-             sprintf(filename, "%s/%s", path, entry->name);
+             snprintf(filename, sizeof(filename), "%s/%s", path, entry->name);
 +            if (snprintf(filename, sizeof(filename), "%s/%s", path, entry->name
 +) >= sizeof(filename)) {
 +                errorCount++;

nss.spec

@@ -1,13 +1,13 @@
 %global nspr_version 4.35.0
-%global nss_version 3.87.0
+%global nss_version 3.99.0
 # NOTE: To avoid NVR clashes of nspr* packages:
 # - reset %%{nspr_release} to 1, when updating %%{nspr_version}
 # - increment %%{nspr_version}, when updating the NSS part only
-%global baserelease 2
+%global baserelease 1
 %global nss_release %baserelease
 # use "%%global nspr_release %%[%%baserelease+n]" to handle offsets when
 # release number between nss and nspr are different.
-%global nspr_release %[%baserelease+2]
+%global nspr_release %[%baserelease+16]
 # only need to update this as we added new
 # algorithms under nss policy control
 %global crypto_policies_version 20210118
@@ -57,6 +57,8 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM",
            string.gsub(rpm.expand("%nss_archive_version"), "%.", "_")))
 }
 
+%global nss_nspr_archive nss-%{nss_archive_version}-with-nspr-%{nspr_archive_version}
+
 Summary:          Network Security Services
 Name:             nss
 Version:          %{nss_version}
@@ -82,7 +84,7 @@ BuildRequires:    psmisc
 BuildRequires:    perl-interpreter
 BuildRequires:    gcc-c++
 
-Source0:          https://ftp.mozilla.org/pub/security/nss/releases/%{nss_release_tag}/src/%{name}-%{nss_archive_version}.tar.gz
+Source0:          https://ftp.mozilla.org/pub/security/nss/releases/%{nss_release_tag}/src/%{nss_nspr_archive}.tar.gz
 Source1:          nss-util.pc.in
 Source2:          nss-util-config.in
 Source3:          nss-softokn.pc.in
@@ -112,7 +114,6 @@ Source27:         secmod.db.xml
 %endif
 Source28:         nss-p11-kit.config
 
-Source100:        nspr-%{nspr_archive_version}.tar.gz
 Source101:        nspr-config.xml
 
 # This patch uses the GCC -iquote option documented at
@@ -131,12 +132,6 @@ Patch12:          nss-signtool-format.patch
 # fedora disabled dbm by default
 Patch40:          nss-no-dbm-man-page.patch
 
-# https://bugzilla.mozilla.org/show_bug.cgi?id=1774659
-Patch51:	nss-3.79-dbtool.patch
-
-# fix rebuilds error
-Patch52:          nss-3.85-fedora-rebuild-errors.patch
-
 Patch100:         nspr-config-pc.patch
 Patch101:         nspr-gcc-atomics.patch
 
@@ -150,7 +145,7 @@ v3 certificates, and other security standards.
 
 %package tools
 Summary:          Tools for the Network Security Services
-Requires:         %{name}%{?_isa} = %{version}-%{release}
+Requires:         %{name}%{?_isa} = %{nss_version}-%{release}
 
 %description tools
 Network Security Services (NSS) is a set of libraries designed to
@@ -167,7 +162,7 @@ Summary:          System NSS Initialization
 # providing nss-system-init without version so that it can
 # be replaced by a better one, e.g. supplied by the os vendor
 Provides:         nss-system-init
-Requires:         nss%{?_isa} = %{version}-%{release}
+Requires:         nss%{?_isa} = %{nss_version}-%{release}
 Requires(post):   coreutils, sed
 
 %description sysinit
@@ -178,8 +173,8 @@ any system or user configured modules.
 
 %package devel
 Summary:          Development libraries for Network Security Services
-Provides:         nss-static = %{version}-%{release}
-Requires:         nss%{?_isa} = %{version}-%{release}
+Provides:         nss-static = %{nss_version}-%{release}
+Requires:         nss%{?_isa} = %{nss_version}-%{release}
 Requires:         nss-util-devel
 Requires:         nss-softokn-devel
 Requires:         nspr-devel >= %{nspr_version}
@@ -192,9 +187,9 @@ Header and Library files for doing development with Network Security Services.
 
 %package pkcs11-devel
 Summary:          Development libraries for PKCS #11 (Cryptoki) using NSS
-Provides:         nss-pkcs11-devel-static = %{version}-%{release}
-Requires:         nss-devel = %{version}-%{release}
-Requires:         nss-softokn-freebl-devel = %{version}-%{release}
+Provides:         nss-pkcs11-devel-static = %{nss_version}-%{release}
+Requires:         nss-devel = %{nss_version}-%{release}
+Requires:         nss-softokn-freebl-devel = %{nss_version}-%{release}
 
 %description pkcs11-devel
 Library files for developing PKCS #11 modules using basic NSS
@@ -210,7 +205,7 @@ Utilities for Network Security Services and the Softoken module
 
 %package util-devel
 Summary:          Development libraries for Network Security Services Utilities
-Requires:         nss-util%{?_isa} = %{version}-%{release}
+Requires:         nss-util%{?_isa} = %{nss_version}-%{release}
 Requires:         nspr-devel >= %{nspr_version}
 Requires:         pkgconfig
 
@@ -221,8 +216,8 @@ Header and library files for doing development with Network Security Services.
 %package softokn
 Summary:          Network Security Services Softoken Module
 Requires:         nspr >= %{nspr_version}
-Requires:         nss-util >= %{version}-%{release}
-Requires:         nss-softokn-freebl%{_isa} >= %{version}-%{release}
+Requires:         nss-util >= %{nss_version}-%{release}
+Requires:         nss-softokn-freebl%{_isa} >= %{nss_version}-%{release}
 
 %description softokn
 Network Security Services Softoken Cryptographic Module
@@ -243,8 +238,8 @@ Install the nss-softokn-freebl package if you need the freebl library.
 
 %package softokn-freebl-devel
 Summary:          Header and Library files for doing development with the Freebl library for NSS
-Provides:         nss-softokn-freebl-static = %{version}-%{release}
-Requires:         nss-softokn-freebl%{?_isa} = %{version}-%{release}
+Provides:         nss-softokn-freebl-static = %{nss_version}-%{release}
+Requires:         nss-softokn-freebl%{?_isa} = %{nss_version}-%{release}
 
 %description softokn-freebl-devel
 NSS Softoken Cryptographic Module Freebl Library Development Tools
@@ -255,10 +250,10 @@ Developers should rely only on the officially supported NSS public API.
 
 %package softokn-devel
 Summary:          Development libraries for Network Security Services
-Requires:         nss-softokn%{?_isa} = %{version}-%{release}
-Requires:         nss-softokn-freebl-devel%{?_isa} = %{version}-%{release}
+Requires:         nss-softokn%{?_isa} = %{nss_version}-%{release}
+Requires:         nss-softokn-freebl-devel%{?_isa} = %{nss_version}-%{release}
 Requires:         nspr-devel >= %{nspr_version}
-Requires:         nss-util-devel >= %{version}-%{release}
+Requires:         nss-util-devel >= %{nss_version}-%{release}
 Requires:         pkgconfig
 
 %description softokn-devel
@@ -291,17 +286,13 @@ Conflicts:      filesystem < 3
 %description -n nspr-devel
 Header files for doing development with the Netscape Portable Runtime.
 
-
 %prep
-%setup -q -T -b 100 -n nspr-%{nspr_archive_version}
-
 %setup -q -T -b 0 -n %{name}-%{nss_archive_version}
-mv ../nspr-%{nspr_archive_version}/nspr .
 cp ./nspr/config/nspr-config.in ./nspr/config/nspr-config-pc.in
 
-%patch100 -p0 -b .flags
+%patch 100 -p0 -b .flags
 pushd nspr
-%patch101 -p1 -b .gcc-atomics
+%patch 101 -p1 -b .gcc-atomics
 popd
 
 pushd nss
@@ -1019,6 +1010,7 @@ update-crypto-policies &> /dev/null || :
 %{_includedir}/nss3/utilpars.h
 %{_includedir}/nss3/utilparst.h
 %{_includedir}/nss3/utilrename.h
+%{_includedir}/nss3/kyber.h
 %{_includedir}/nss3/templates/templates.c
 
 %files softokn
@@ -1090,10 +1082,62 @@ update-crypto-policies &> /dev/null || :
 %{_includedir}/nspr4
 %{_libdir}/pkgconfig/nspr.pc
 %{_bindir}/nspr-config
-%{_mandir}/man*/*
+%doc %{_mandir}/man1/nspr-config.*
 
 
 %changelog
+* Mon Mar 18 2024 Frantisek Krenzelok <krenzelok.frantisek@gmail.com> - 3.99.0-1
+- Update NSS to 3.99.0
+
+* Sat Feb 17 2024 Frantisek Krenzelok <krenzelok.frantisek@gmail.com> - 3.98.0-1
+- Update NSS to 3.98.0
+
+* Thu Feb 15 2024 Frantisek Krenzelok <krenzelok.frantisek@gmail.com> - 3.97.0-1
+- Update NSS to 3.97.0
+
+* Thu Dec 21 2023 Frantisek Krenzelok <krenzelok.frantisek@gmail.com> - 3.96.1-1
+- Update NSS to 3.96.1
+
+* Mon Nov 27 2023 Frantisek Krenzelok <krenzelok.frantisek@gmail.com> - 3.95.0-1
+- Update NSS to 3.95.0
+
+* Thu Oct 26 2023 Bob Relyea <rrelyea#redhat.com> - 3.94.0-2
+- binary compatibility issue with HACL ECC 256 patch.
+
+* Wed Oct 4 2023 Frantisek Krenzelok <krenzelok.frantisek@gmail.com> - 3.94.0-1
+- Update NSS to 3.94.0
+
+* Thu Aug 31 2023 Frantisek Krenzelok <krenzelok.frantisek@gmail.com> - 3.93.0-1
+- Update NSS to 3.93.0
+
+* Tue Aug 1 2023 Frantisek Krenzelok <krenzelok.frantisek@gmail.com> - 3.92.0-1
+- Update NSS to 3.92.0
+
+* Tue Jul 4 2023 Frantisek Krenzelok <krenzelok.frantisek@gmail.com> - 3.91.0-1
+- Update NSS to 3.91.0
+
+* Tue Jun 6 2023 Frantisek Krenzelok <krenzelok.frantisek@gmail.com> - 3.90.0-1
+- Add patch for https://bugzilla.mozilla.org/show_bug.cgi?id=1836781 &
+                https://bugzilla.mozilla.org/show_bug.cgi?id=1836925
+
+* Mon Jun 5 2023 Frantisek Krenzelok <krenzelok.frantisek@gmail.com> - 3.90.0-1
+- Update %patch syntax
+
+* Mon Jun 5 2023 Frantisek Krenzelok <krenzelok.frantisek@gmail.com> - 3.90.0-1
+- Update NSS to 3.90.0
+
+* Fri May 5 2023 Frantisek Krenzelok <krenzelok.frantisek@gmail.com> - 3.89.0-1
+- combine nss and nspr source togeather
+
+* Fri May 5 2023 Frantisek Krenzelok <krenzelok.frantisek@gmail.com> - 3.89.0-1
+- replace %{version} with %{nss_version} as it version can be overiden.
+
+* Fri Mar 10 2023 Frantisek Krenzelok <krenzelok.frantisek@gmail.com> - 3.89.0-1
+- Update NSS to 3.89.0
+
+* Fri Feb 10 2023 Frantisek Krenzelok <krenzelok.frantisek@gmail.com> - 3.88.1-1
+- Update NSS to 3.88.1
+
 * Tue Jan 24 2023 Bob Relyea - 3.87.0-2
 - Fix rebuild errors
 

sources

@@ -1,4 +1,3 @@
 SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403fda3e3d4e7757838061ae56ccf5aac335cb54f254f0a9e6e9c0dd5920b4155a39264525b06
 SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7
-SHA512 (nspr-4.35.tar.gz) = 502815833116e25f79ddf71d1526484908aa92fbc55f8a892729cb404a4daafcc0470a89854cd080d2d20299fdb7d9662507c5362c7ae661cbacf308ac56ef7f
-SHA512 (nss-3.87.tar.gz) = 4ec7b94e537df109638b821f3a7e3b7bf31d89c3739a6e4c85cad4fab876390ae482971d6f66198818400f467661e86f39dc1d2a4a88077fd81e3a0b7ed64110
+SHA512 (nss-3.99-with-nspr-4.35.tar.gz) = d19db94a0a79335afc275876c8019621472a27a9766feed2616ff0461db2e8edebc492f98f720bd8231bf44c38138ab1d8f5d1812a55b23bed94e894c3b171fd