|
|
@ -1,16 +1,16 @@
|
|
|
|
%global nss_version 3.101.0
|
|
|
|
%global nss_version 3.101.0
|
|
|
|
%global nspr_version 4.35.0
|
|
|
|
%global nspr_version 4.35.0
|
|
|
|
|
|
|
|
# NOTE: To avoid NVR clashes of nspr* packages:
|
|
|
|
|
|
|
|
# - reset %%{nspr_release} to 1, when updating %%{nspr_version}
|
|
|
|
|
|
|
|
# - increment %%{nspr_version}, when updating the NSS part only
|
|
|
|
%global baserelease 7
|
|
|
|
%global baserelease 7
|
|
|
|
%global nss_release %baserelease
|
|
|
|
%global nss_release %baserelease
|
|
|
|
# NOTE: To avoid NVR clashes of nspr* packages:
|
|
|
|
|
|
|
|
# use "%%global nspr_release %%[%%baserelease+n]" to handle offsets when
|
|
|
|
# use "%%global nspr_release %%[%%baserelease+n]" to handle offsets when
|
|
|
|
# release number between nss and nspr are different.
|
|
|
|
# release number between nss and nspr are different.
|
|
|
|
# when a new nspr is released with nss, reset nspr_release to baserelease.
|
|
|
|
%global nspr_release %[%baserelease+21]
|
|
|
|
# for each new nss relase with the same nspr, change increment n by one.
|
|
|
|
|
|
|
|
%global nspr_release %[%baserelease+7]
|
|
|
|
|
|
|
|
# only need to update this as we added new
|
|
|
|
# only need to update this as we added new
|
|
|
|
# algorithms under nss policy control
|
|
|
|
# algorithms under nss policy control
|
|
|
|
%global crypto_policies_version 20210118
|
|
|
|
%global crypto_policies_version 20240522
|
|
|
|
%global unsupported_tools_directory %{_libdir}/nss/unsupported-tools
|
|
|
|
%global unsupported_tools_directory %{_libdir}/nss/unsupported-tools
|
|
|
|
%global saved_files_dir %{_libdir}/nss/saved
|
|
|
|
%global saved_files_dir %{_libdir}/nss/saved
|
|
|
|
%global dracutlibdir %{_prefix}/lib/dracut
|
|
|
|
%global dracutlibdir %{_prefix}/lib/dracut
|
|
|
@ -57,6 +57,8 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM",
|
|
|
|
string.gsub(rpm.expand("%nss_archive_version"), "%.", "_")))
|
|
|
|
string.gsub(rpm.expand("%nss_archive_version"), "%.", "_")))
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
%global nss_nspr_archive nss-%{nss_archive_version}-with-nspr-%{nspr_archive_version}
|
|
|
|
|
|
|
|
|
|
|
|
# This is taken from gnutls.spec
|
|
|
|
# This is taken from gnutls.spec
|
|
|
|
%define srpmhash() %{lua:
|
|
|
|
%define srpmhash() %{lua:
|
|
|
|
local files = rpm.expand("%_specdir/nss.spec")
|
|
|
|
local files = rpm.expand("%_specdir/nss.spec")
|
|
|
@ -76,7 +78,7 @@ Summary: Network Security Services
|
|
|
|
Name: nss
|
|
|
|
Name: nss
|
|
|
|
Version: %{nss_version}
|
|
|
|
Version: %{nss_version}
|
|
|
|
Release: %{nss_release}%{?dist}
|
|
|
|
Release: %{nss_release}%{?dist}
|
|
|
|
License: MPLv2.0
|
|
|
|
License: MPL-2.0
|
|
|
|
URL: http://www.mozilla.org/projects/security/pki/nss/
|
|
|
|
URL: http://www.mozilla.org/projects/security/pki/nss/
|
|
|
|
Requires: nspr >= %{nspr_version}
|
|
|
|
Requires: nspr >= %{nspr_version}
|
|
|
|
Requires: nss-util >= %{nss_version}
|
|
|
|
Requires: nss-util >= %{nss_version}
|
|
|
@ -84,7 +86,6 @@ Requires: nss-util >= %{nss_version}
|
|
|
|
Requires: nss-softokn%{_isa} >= %{nss_version}
|
|
|
|
Requires: nss-softokn%{_isa} >= %{nss_version}
|
|
|
|
Requires: nss-system-init
|
|
|
|
Requires: nss-system-init
|
|
|
|
Requires: p11-kit-trust
|
|
|
|
Requires: p11-kit-trust
|
|
|
|
Requires: /usr/bin/update-crypto-policies
|
|
|
|
|
|
|
|
Requires: crypto-policies >= %{crypto_policies_version}
|
|
|
|
Requires: crypto-policies >= %{crypto_policies_version}
|
|
|
|
# for shlibsign
|
|
|
|
# for shlibsign
|
|
|
|
BuildRequires: make
|
|
|
|
BuildRequires: make
|
|
|
@ -97,7 +98,7 @@ BuildRequires: psmisc
|
|
|
|
BuildRequires: perl-interpreter
|
|
|
|
BuildRequires: perl-interpreter
|
|
|
|
BuildRequires: gcc-c++
|
|
|
|
BuildRequires: gcc-c++
|
|
|
|
|
|
|
|
|
|
|
|
Source0: https://ftp.mozilla.org/pub/security/nss/releases/%{nss_release_tag}/src/%{name}-%{nss_archive_version}.tar.gz
|
|
|
|
Source0: https://ftp.mozilla.org/pub/security/nss/releases/%{nss_release_tag}/src/%{nss_nspr_archive}.tar.gz
|
|
|
|
Source1: nss-util.pc.in
|
|
|
|
Source1: nss-util.pc.in
|
|
|
|
Source2: nss-util-config.in
|
|
|
|
Source2: nss-util-config.in
|
|
|
|
Source3: nss-softokn.pc.in
|
|
|
|
Source3: nss-softokn.pc.in
|
|
|
@ -117,22 +118,18 @@ Source15: system-pkcs11.txt
|
|
|
|
Source16: setup-nsssysinit.sh
|
|
|
|
Source16: setup-nsssysinit.sh
|
|
|
|
Source20: nss-config.xml
|
|
|
|
Source20: nss-config.xml
|
|
|
|
Source21: setup-nsssysinit.xml
|
|
|
|
Source21: setup-nsssysinit.xml
|
|
|
|
|
|
|
|
Source22: pkcs11.txt.xml
|
|
|
|
|
|
|
|
Source24: cert9.db.xml
|
|
|
|
|
|
|
|
Source26: key4.db.xml
|
|
|
|
%if %{with dbm}
|
|
|
|
%if %{with dbm}
|
|
|
|
Source23: cert8.db.xml
|
|
|
|
Source23: cert8.db.xml
|
|
|
|
Source25: key3.db.xml
|
|
|
|
Source25: key3.db.xml
|
|
|
|
Source27: secmod.db.xml
|
|
|
|
Source27: secmod.db.xml
|
|
|
|
%endif
|
|
|
|
%endif
|
|
|
|
Source22: pkcs11.txt.xml
|
|
|
|
|
|
|
|
Source24: cert9.db.xml
|
|
|
|
|
|
|
|
Source26: key4.db.xml
|
|
|
|
|
|
|
|
Source28: nss-p11-kit.config
|
|
|
|
|
|
|
|
# fips algorithms are tied to the red hat validation, others
|
|
|
|
# fips algorithms are tied to the red hat validation, others
|
|
|
|
# will have their own validation
|
|
|
|
# will have their own validation
|
|
|
|
Source30: fips_algorithms.h
|
|
|
|
Source30: fips_algorithms.h
|
|
|
|
|
|
|
|
|
|
|
|
#Source50: NameConstraints_Certs.tar
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Source100: nspr-%{nspr_archive_version}.tar.gz
|
|
|
|
|
|
|
|
Source101: nspr-config.xml
|
|
|
|
Source101: nspr-config.xml
|
|
|
|
|
|
|
|
|
|
|
|
# This patch uses the GCC -iquote option documented at
|
|
|
|
# This patch uses the GCC -iquote option documented at
|
|
|
@ -145,22 +142,19 @@ Source101: nspr-config.xml
|
|
|
|
# changes.
|
|
|
|
# changes.
|
|
|
|
#
|
|
|
|
#
|
|
|
|
# Once the buildroot has been bootstrapped the patch may be removed
|
|
|
|
# Once the buildroot has been bootstrapped the patch may be removed
|
|
|
|
# but it doesn't hurt to keep it
|
|
|
|
# but it doesn't hurt to keep it.
|
|
|
|
Patch4: iquote.patch
|
|
|
|
Patch4: iquote.patch
|
|
|
|
Patch12: nss-signtool-format.patch
|
|
|
|
Patch12: nss-signtool-format.patch
|
|
|
|
Patch20: nss-3.101-extend-db-dump-time.patch
|
|
|
|
Patch20: nss-3.101-extend-db-dump-time.patch
|
|
|
|
Patch21: nss-3.101-enable-sdb-tests.patch
|
|
|
|
Patch21: nss-3.101-enable-sdb-tests.patch
|
|
|
|
|
|
|
|
|
|
|
|
# connect our shared library to the build root loader flags (needed for -relro)
|
|
|
|
# connect our shared library to the build root loader flags (needed for -relro)
|
|
|
|
Patch31: nss-dso-ldflags.patch
|
|
|
|
Patch31: nss-dso-ldflags.patch
|
|
|
|
# keep RHEL 8 semantics of disabling md4 and md5 even if the env variable is set
|
|
|
|
|
|
|
|
Patch32: nss-3.101-disable-md5.patch
|
|
|
|
Patch32: nss-3.101-disable-md5.patch
|
|
|
|
# dbm is disabled on RHEL9, make the man pages reflect that
|
|
|
|
# rhel10 disabled dbm by default
|
|
|
|
%if %{with dbm}
|
|
|
|
|
|
|
|
%else
|
|
|
|
|
|
|
|
Patch33: nss-no-dbm-man-page.patch
|
|
|
|
Patch33: nss-no-dbm-man-page.patch
|
|
|
|
%endif
|
|
|
|
|
|
|
|
# not upstreamable patch...
|
|
|
|
# not upstreamable patch...
|
|
|
|
# WARNING: Need to make this patch work before checking!!! $$$$@@@
|
|
|
|
|
|
|
|
Patch34: nss-3.71-fix-lto-gtests.patch
|
|
|
|
Patch34: nss-3.71-fix-lto-gtests.patch
|
|
|
|
# camellia pkcs12 docs.
|
|
|
|
# camellia pkcs12 docs.
|
|
|
|
Patch35: nss-3.71-camellia-pkcs12-doc.patch
|
|
|
|
Patch35: nss-3.71-camellia-pkcs12-doc.patch
|
|
|
@ -175,8 +169,6 @@ Patch50: nss-3.79-fips.patch
|
|
|
|
Patch51: nss-3.101-fips-review.patches
|
|
|
|
Patch51: nss-3.101-fips-review.patches
|
|
|
|
Patch52: nss-3.90-pbkdf2-indicator.patch
|
|
|
|
Patch52: nss-3.90-pbkdf2-indicator.patch
|
|
|
|
Patch53: nss-3.101-skip-ocsp-if-not-connected.patch
|
|
|
|
Patch53: nss-3.101-skip-ocsp-if-not-connected.patch
|
|
|
|
# dont upstream, must be after patch53 (sigh)
|
|
|
|
|
|
|
|
Patch54: nss-3.101-revert-libpkix-default.patch
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# ems policy. needs to upstream
|
|
|
|
# ems policy. needs to upstream
|
|
|
|
Patch60: nss-3.101-add-ems-policy.patch
|
|
|
|
Patch60: nss-3.101-add-ems-policy.patch
|
|
|
@ -189,8 +181,6 @@ Patch75: nss-3.90-ppc_no_init.patch
|
|
|
|
Patch76: nss-3.101-enable-kyber-policy.patch
|
|
|
|
Patch76: nss-3.101-enable-kyber-policy.patch
|
|
|
|
Patch77: nss-3.101-fix-rsa-policy-test.patch
|
|
|
|
Patch77: nss-3.101-fix-rsa-policy-test.patch
|
|
|
|
Patch78: nss-3.101-fix-pkcs12-md5-decode.patch
|
|
|
|
Patch78: nss-3.101-fix-pkcs12-md5-decode.patch
|
|
|
|
Patch79: nss-3.101-el9-restore-old-pkcs12-default.patch
|
|
|
|
|
|
|
|
Patch80: nss-3.101-no-p12-smime-policy.patch
|
|
|
|
|
|
|
|
Patch81: nss-3.101-fix-missing-size-checks.patch
|
|
|
|
Patch81: nss-3.101-fix-missing-size-checks.patch
|
|
|
|
# https://bugzilla.mozilla.org/show_bug.cgi?id=1905691
|
|
|
|
# https://bugzilla.mozilla.org/show_bug.cgi?id=1905691
|
|
|
|
Patch82: nss-3.101-chacha-timing-fix.patch
|
|
|
|
Patch82: nss-3.101-chacha-timing-fix.patch
|
|
|
@ -199,6 +189,13 @@ Patch84: nss-3.101-fix-pkcs12-pbkdf1-encoding.patch
|
|
|
|
# https://bugzilla.mozilla.org/show_bug.cgi?id=676100
|
|
|
|
# https://bugzilla.mozilla.org/show_bug.cgi?id=676100
|
|
|
|
Patch85: nss-3.101-fix-cms-abi-break.patch
|
|
|
|
Patch85: nss-3.101-fix-cms-abi-break.patch
|
|
|
|
Patch86: nss-3.101-long-pwd-fix.patch
|
|
|
|
Patch86: nss-3.101-long-pwd-fix.patch
|
|
|
|
|
|
|
|
Patch87: nss-3.101-fix-cavs-test.patch
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# RHEL-10 specific
|
|
|
|
|
|
|
|
Patch90: nss-3.101-disable_dsa.patch
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# NSS reverse patches
|
|
|
|
|
|
|
|
Patch300: nss-3.79-distrusted-certs.patch
|
|
|
|
|
|
|
|
|
|
|
|
Patch100: nspr-config-pc.patch
|
|
|
|
Patch100: nspr-config-pc.patch
|
|
|
|
Patch101: nspr-gcc-atomics.patch
|
|
|
|
Patch101: nspr-gcc-atomics.patch
|
|
|
@ -206,11 +203,6 @@ Patch101: nspr-gcc-atomics.patch
|
|
|
|
Patch110: nspr-4.34-fix-coverity-loop-issue.patch
|
|
|
|
Patch110: nspr-4.34-fix-coverity-loop-issue.patch
|
|
|
|
Patch120: nspr-4.34-server-passive.patch
|
|
|
|
Patch120: nspr-4.34-server-passive.patch
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# NSS reverse patches
|
|
|
|
|
|
|
|
Patch300: nss-3.79-distrusted-certs.patch
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
%description
|
|
|
|
%description
|
|
|
|
Network Security Services (NSS) is a set of libraries designed to
|
|
|
|
Network Security Services (NSS) is a set of libraries designed to
|
|
|
|
support cross-platform development of security-enabled client and
|
|
|
|
support cross-platform development of security-enabled client and
|
|
|
@ -220,7 +212,7 @@ v3 certificates, and other security standards.
|
|
|
|
|
|
|
|
|
|
|
|
%package tools
|
|
|
|
%package tools
|
|
|
|
Summary: Tools for the Network Security Services
|
|
|
|
Summary: Tools for the Network Security Services
|
|
|
|
Requires: %{name}%{?_isa} = %{nss_version}-%{nss_release}%{dist}
|
|
|
|
Requires: %{name}%{?_isa} = %{nss_version}-%{release}
|
|
|
|
|
|
|
|
|
|
|
|
%description tools
|
|
|
|
%description tools
|
|
|
|
Network Security Services (NSS) is a set of libraries designed to
|
|
|
|
Network Security Services (NSS) is a set of libraries designed to
|
|
|
@ -237,7 +229,7 @@ Summary: System NSS Initialization
|
|
|
|
# providing nss-system-init without version so that it can
|
|
|
|
# providing nss-system-init without version so that it can
|
|
|
|
# be replaced by a better one, e.g. supplied by the os vendor
|
|
|
|
# be replaced by a better one, e.g. supplied by the os vendor
|
|
|
|
Provides: nss-system-init
|
|
|
|
Provides: nss-system-init
|
|
|
|
Requires: nss%{?_isa} = %{nss_version}-%{nss_release}%{dist}
|
|
|
|
Requires: nss%{?_isa} = %{nss_version}-%{release}
|
|
|
|
Requires(post): coreutils, sed
|
|
|
|
Requires(post): coreutils, sed
|
|
|
|
|
|
|
|
|
|
|
|
%description sysinit
|
|
|
|
%description sysinit
|
|
|
@ -248,8 +240,8 @@ any system or user configured modules.
|
|
|
|
|
|
|
|
|
|
|
|
%package devel
|
|
|
|
%package devel
|
|
|
|
Summary: Development libraries for Network Security Services
|
|
|
|
Summary: Development libraries for Network Security Services
|
|
|
|
Provides: nss-static = %{nss_version}-%{nss_release}%{dist}
|
|
|
|
Provides: nss-static = %{nss_version}-%{release}
|
|
|
|
Requires: nss%{?_isa} = %{nss_version}-%{nss_release}%{dist}
|
|
|
|
Requires: nss%{?_isa} = %{nss_version}-%{release}
|
|
|
|
Requires: nss-util-devel
|
|
|
|
Requires: nss-util-devel
|
|
|
|
Requires: nss-softokn-devel
|
|
|
|
Requires: nss-softokn-devel
|
|
|
|
Requires: nspr-devel >= %{nspr_version}
|
|
|
|
Requires: nspr-devel >= %{nspr_version}
|
|
|
@ -262,9 +254,9 @@ Header and Library files for doing development with Network Security Services.
|
|
|
|
|
|
|
|
|
|
|
|
%package pkcs11-devel
|
|
|
|
%package pkcs11-devel
|
|
|
|
Summary: Development libraries for PKCS #11 (Cryptoki) using NSS
|
|
|
|
Summary: Development libraries for PKCS #11 (Cryptoki) using NSS
|
|
|
|
Provides: nss-pkcs11-devel-static = %{nss_version}-%{nss_release}%{dist}
|
|
|
|
Provides: nss-pkcs11-devel-static = %{nss_version}-%{release}
|
|
|
|
Requires: nss-devel = %{nss_version}-%{nss_release}%{dist}
|
|
|
|
Requires: nss-devel = %{nss_version}-%{release}
|
|
|
|
Requires: nss-softokn-freebl-devel = %{nss_version}-%{nss_release}%{dist}
|
|
|
|
Requires: nss-softokn-freebl-devel = %{nss_version}-%{release}
|
|
|
|
|
|
|
|
|
|
|
|
%description pkcs11-devel
|
|
|
|
%description pkcs11-devel
|
|
|
|
Library files for developing PKCS #11 modules using basic NSS
|
|
|
|
Library files for developing PKCS #11 modules using basic NSS
|
|
|
@ -280,7 +272,7 @@ Utilities for Network Security Services and the Softoken module
|
|
|
|
|
|
|
|
|
|
|
|
%package util-devel
|
|
|
|
%package util-devel
|
|
|
|
Summary: Development libraries for Network Security Services Utilities
|
|
|
|
Summary: Development libraries for Network Security Services Utilities
|
|
|
|
Requires: nss-util%{?_isa} = %{nss_version}-%{nss_release}%{dist}
|
|
|
|
Requires: nss-util%{?_isa} = %{nss_version}-%{release}
|
|
|
|
Requires: nspr-devel >= %{nspr_version}
|
|
|
|
Requires: nspr-devel >= %{nspr_version}
|
|
|
|
Requires: pkgconfig
|
|
|
|
Requires: pkgconfig
|
|
|
|
|
|
|
|
|
|
|
@ -291,8 +283,8 @@ Header and library files for doing development with Network Security Services.
|
|
|
|
%package softokn
|
|
|
|
%package softokn
|
|
|
|
Summary: Network Security Services Softoken Module
|
|
|
|
Summary: Network Security Services Softoken Module
|
|
|
|
Requires: nspr >= %{nspr_version}
|
|
|
|
Requires: nspr >= %{nspr_version}
|
|
|
|
Requires: nss-util >= %{nss_version}-%{nss_release}%{dist}
|
|
|
|
Requires: nss-util >= %{nss_version}-%{release}
|
|
|
|
Requires: nss-softokn-freebl%{_isa} >= %{nss_version}-%{nss_release}%{dist}
|
|
|
|
Requires: nss-softokn-freebl%{_isa} >= %{nss_version}-%{release}
|
|
|
|
|
|
|
|
|
|
|
|
%description softokn
|
|
|
|
%description softokn
|
|
|
|
Network Security Services Softoken Cryptographic Module
|
|
|
|
Network Security Services Softoken Cryptographic Module
|
|
|
@ -313,8 +305,8 @@ Install the nss-softokn-freebl package if you need the freebl library.
|
|
|
|
|
|
|
|
|
|
|
|
%package softokn-freebl-devel
|
|
|
|
%package softokn-freebl-devel
|
|
|
|
Summary: Header and Library files for doing development with the Freebl library for NSS
|
|
|
|
Summary: Header and Library files for doing development with the Freebl library for NSS
|
|
|
|
Provides: nss-softokn-freebl-static = %{nss_version}-%{nss_release}%{dist}
|
|
|
|
Provides: nss-softokn-freebl-static = %{nss_version}-%{release}
|
|
|
|
Requires: nss-softokn-freebl%{?_isa} = %{nss_version}-%{nss_release}%{dist}
|
|
|
|
Requires: nss-softokn-freebl%{?_isa} = %{nss_version}-%{release}
|
|
|
|
|
|
|
|
|
|
|
|
%description softokn-freebl-devel
|
|
|
|
%description softokn-freebl-devel
|
|
|
|
NSS Softoken Cryptographic Module Freebl Library Development Tools
|
|
|
|
NSS Softoken Cryptographic Module Freebl Library Development Tools
|
|
|
@ -325,10 +317,10 @@ Developers should rely only on the officially supported NSS public API.
|
|
|
|
|
|
|
|
|
|
|
|
%package softokn-devel
|
|
|
|
%package softokn-devel
|
|
|
|
Summary: Development libraries for Network Security Services
|
|
|
|
Summary: Development libraries for Network Security Services
|
|
|
|
Requires: nss-softokn%{?_isa} = %{nss_version}-%{nss_release}%{dist}
|
|
|
|
Requires: nss-softokn%{?_isa} = %{nss_version}-%{release}
|
|
|
|
Requires: nss-softokn-freebl-devel%{?_isa} = %{nss_version}-%{nss_release}%{dist}
|
|
|
|
Requires: nss-softokn-freebl-devel%{?_isa} = %{nss_version}-%{release}
|
|
|
|
Requires: nspr-devel >= %{nspr_version}
|
|
|
|
Requires: nspr-devel >= %{nspr_version}
|
|
|
|
Requires: nss-util-devel >= %{nss_version}-%{nss_release}%{dist}
|
|
|
|
Requires: nss-util-devel >= %{nss_version}-%{release}
|
|
|
|
Requires: pkgconfig
|
|
|
|
Requires: pkgconfig
|
|
|
|
|
|
|
|
|
|
|
|
%description softokn-devel
|
|
|
|
%description softokn-devel
|
|
|
@ -338,7 +330,7 @@ Header and library files for doing development with Network Security Services.
|
|
|
|
Summary: Netscape Portable Runtime
|
|
|
|
Summary: Netscape Portable Runtime
|
|
|
|
Version: %{nspr_version}
|
|
|
|
Version: %{nspr_version}
|
|
|
|
Release: %{nspr_release}%{?dist}
|
|
|
|
Release: %{nspr_release}%{?dist}
|
|
|
|
License: MPLv2.0
|
|
|
|
License: MPL-2.0
|
|
|
|
URL: http://www.mozilla.org/projects/nspr/
|
|
|
|
URL: http://www.mozilla.org/projects/nspr/
|
|
|
|
Conflicts: filesystem < 3
|
|
|
|
Conflicts: filesystem < 3
|
|
|
|
BuildRequires: gcc
|
|
|
|
BuildRequires: gcc
|
|
|
@ -361,12 +353,8 @@ Conflicts: filesystem < 3
|
|
|
|
%description -n nspr-devel
|
|
|
|
%description -n nspr-devel
|
|
|
|
Header files for doing development with the Netscape Portable Runtime.
|
|
|
|
Header files for doing development with the Netscape Portable Runtime.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
%prep
|
|
|
|
%prep
|
|
|
|
%setup -q -T -b 100 -n nspr-%{nspr_archive_version}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
%setup -q -T -b 0 -n %{name}-%{nss_archive_version}
|
|
|
|
%setup -q -T -b 0 -n %{name}-%{nss_archive_version}
|
|
|
|
mv ../nspr-%{nspr_archive_version}/nspr .
|
|
|
|
|
|
|
|
cp ./nspr/config/nspr-config.in ./nspr/config/nspr-config-pc.in
|
|
|
|
cp ./nspr/config/nspr-config.in ./nspr/config/nspr-config-pc.in
|
|
|
|
|
|
|
|
|
|
|
|
%patch -P 100 -p0 -b .flags
|
|
|
|
%patch -P 100 -p0 -b .flags
|
|
|
@ -374,12 +362,10 @@ pushd nspr
|
|
|
|
%autopatch -p 1 -m 101 -M 299
|
|
|
|
%autopatch -p 1 -m 101 -M 299
|
|
|
|
popd
|
|
|
|
popd
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
pushd nss
|
|
|
|
pushd nss
|
|
|
|
%autopatch -p1 -M 99
|
|
|
|
%autopatch -p1 -M 99
|
|
|
|
#%%patch -P 400 -p1 -b .backup
|
|
|
|
|
|
|
|
# sigh it would be nice if autopatch supported -R
|
|
|
|
# sigh it would be nice if autopatch supported -R
|
|
|
|
%patch -P 300 -R -p1
|
|
|
|
%patch -P 300 -R -p 1
|
|
|
|
popd
|
|
|
|
popd
|
|
|
|
|
|
|
|
|
|
|
|
# copy the fips_algorithms.h for this release
|
|
|
|
# copy the fips_algorithms.h for this release
|
|
|
@ -387,11 +373,6 @@ popd
|
|
|
|
# each vendors claim in their own FIPS certification
|
|
|
|
# each vendors claim in their own FIPS certification
|
|
|
|
cp %{SOURCE30} nss/lib/softoken/
|
|
|
|
cp %{SOURCE30} nss/lib/softoken/
|
|
|
|
|
|
|
|
|
|
|
|
#update expired test certs
|
|
|
|
|
|
|
|
#pushd nss
|
|
|
|
|
|
|
|
#tar xvf %{SOURCE50}
|
|
|
|
|
|
|
|
#popd
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# https://bugzilla.redhat.com/show_bug.cgi?id=1247353
|
|
|
|
# https://bugzilla.redhat.com/show_bug.cgi?id=1247353
|
|
|
|
find nss/lib/libpkix -perm /u+x -type f -exec chmod -x {} \;
|
|
|
|
find nss/lib/libpkix -perm /u+x -type f -exec chmod -x {} \;
|
|
|
|
|
|
|
|
|
|
|
@ -404,8 +385,6 @@ find nss/lib/libpkix -perm /u+x -type f -exec chmod -x {} \;
|
|
|
|
# adjustment in the NSS build process.
|
|
|
|
# adjustment in the NSS build process.
|
|
|
|
mkdir -p nspr_build
|
|
|
|
mkdir -p nspr_build
|
|
|
|
pushd nspr_build
|
|
|
|
pushd nspr_build
|
|
|
|
export LDFLAGS="$RPM_LD_FLAGS"
|
|
|
|
|
|
|
|
export CFLAGS="$RPM_OPT_FLAGS"
|
|
|
|
|
|
|
|
../nspr/configure \
|
|
|
|
../nspr/configure \
|
|
|
|
--prefix=%{_prefix} \
|
|
|
|
--prefix=%{_prefix} \
|
|
|
|
--libdir=%{_libdir} \
|
|
|
|
--libdir=%{_libdir} \
|
|
|
@ -455,6 +434,10 @@ popd
|
|
|
|
# uncomment if the iquote patch is activated
|
|
|
|
# uncomment if the iquote patch is activated
|
|
|
|
export IN_TREE_FREEBL_HEADERS_FIRST=1
|
|
|
|
export IN_TREE_FREEBL_HEADERS_FIRST=1
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# deprication
|
|
|
|
|
|
|
|
export NSS_DISABLE_DEPRECATED_SEED=1
|
|
|
|
|
|
|
|
export NSS_DISABLE_DSA=1
|
|
|
|
|
|
|
|
|
|
|
|
# FIPS related defines
|
|
|
|
# FIPS related defines
|
|
|
|
export NSS_FORCE_FIPS=1
|
|
|
|
export NSS_FORCE_FIPS=1
|
|
|
|
export NSS_FIPS_VERSION="%{name}\ %{nss_version}-%{srpmhash}"
|
|
|
|
export NSS_FIPS_VERSION="%{name}\ %{nss_version}-%{srpmhash}"
|
|
|
@ -484,6 +467,8 @@ export XCFLAGS="$XCFLAGS -Wno-error=maybe-uninitialized"
|
|
|
|
# Similarly, but for gcc-11
|
|
|
|
# Similarly, but for gcc-11
|
|
|
|
export XCFLAGS="$XCFLAGS -Wno-array-parameter"
|
|
|
|
export XCFLAGS="$XCFLAGS -Wno-array-parameter"
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
export LDFLAGS=$RPM_LD_FLAGS
|
|
|
|
|
|
|
|
|
|
|
|
export DSO_LDFLAGS=$RPM_LD_FLAGS
|
|
|
|
export DSO_LDFLAGS=$RPM_LD_FLAGS
|
|
|
|
|
|
|
|
|
|
|
|
export PKG_CONFIG_ALLOW_SYSTEM_LIBS=1
|
|
|
|
export PKG_CONFIG_ALLOW_SYSTEM_LIBS=1
|
|
|
@ -515,6 +500,7 @@ export POLICY_FILE="nss.config"
|
|
|
|
# location of the policy file
|
|
|
|
# location of the policy file
|
|
|
|
export POLICY_PATH="/etc/crypto-policies/back-ends"
|
|
|
|
export POLICY_PATH="/etc/crypto-policies/back-ends"
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
%{__make} -C ./nss all
|
|
|
|
%{__make} -C ./nss all
|
|
|
|
%{__make} -C ./nss latest
|
|
|
|
%{__make} -C ./nss latest
|
|
|
|
|
|
|
|
|
|
|
@ -611,22 +597,20 @@ date +"%e %B %Y" | tr -d '\n' > date.xml
|
|
|
|
echo -n %{nss_version} > version.xml
|
|
|
|
echo -n %{nss_version} > version.xml
|
|
|
|
|
|
|
|
|
|
|
|
# configuration files and setup script
|
|
|
|
# configuration files and setup script
|
|
|
|
for m in %{SOURCE20} %{SOURCE21} %{SOURCE22} %{SOURCE24} %{SOURCE26}; do
|
|
|
|
|
|
|
|
cp ${m} .
|
|
|
|
|
|
|
|
done
|
|
|
|
|
|
|
|
for m in nss-config.xml setup-nsssysinit.xml pkcs11.txt.xml cert9.db.xml key4.db.xml; do
|
|
|
|
|
|
|
|
xmlto man ${m}
|
|
|
|
|
|
|
|
done
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
%if %{with dbm}
|
|
|
|
%if %{with dbm}
|
|
|
|
# nss dbm databases
|
|
|
|
%global XMLSOURCES %{SOURCE23} %{SOURCE24} %{SOURCE25} %{SOURCE26} %{SOURCE27}
|
|
|
|
for m in %{SOURCE23} %{SOURCE25} %{SOURCE27}; do
|
|
|
|
%global dbfiles cert8.db key3.db secmod.db cert9.db key4.db pkcs11.txt
|
|
|
|
|
|
|
|
%else
|
|
|
|
|
|
|
|
%global XMLSOURCES %{SOURCE22} %{SOURCE24} %{SOURCE26}
|
|
|
|
|
|
|
|
%global dbfiles cert9.db key4.db pkcs11.txt
|
|
|
|
|
|
|
|
%endif
|
|
|
|
|
|
|
|
for m in %{SOURCE20} %{SOURCE21} %{XMLSOURCES}; do
|
|
|
|
cp ${m} .
|
|
|
|
cp ${m} .
|
|
|
|
done
|
|
|
|
done
|
|
|
|
for m in cert8.db.xml key3.db.xml secmod.db.xml; do
|
|
|
|
%global configFiles nss-config setup-nsssysinit
|
|
|
|
xmlto man ${m}
|
|
|
|
for m in %{configFiles} %{dbfiles}; do
|
|
|
|
|
|
|
|
xmlto man ${m}.xml
|
|
|
|
done
|
|
|
|
done
|
|
|
|
%endif
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
%check
|
|
|
|
%check
|
|
|
@ -650,6 +634,9 @@ popd
|
|
|
|
export FREEBL_NO_DEPEND=1
|
|
|
|
export FREEBL_NO_DEPEND=1
|
|
|
|
|
|
|
|
|
|
|
|
export BUILD_OPT=1
|
|
|
|
export BUILD_OPT=1
|
|
|
|
|
|
|
|
export NSS_DISABLE_PPC_GHASH=1
|
|
|
|
|
|
|
|
export NSS_DISABLE_DEPRECATED_SEED=1
|
|
|
|
|
|
|
|
export NSS_DISABLE_DSA=1
|
|
|
|
|
|
|
|
|
|
|
|
%ifnarch noarch
|
|
|
|
%ifnarch noarch
|
|
|
|
%if 0%{__isa_bits} == 64
|
|
|
|
%if 0%{__isa_bits} == 64
|
|
|
@ -672,10 +659,6 @@ done
|
|
|
|
# disabled by the system policy.
|
|
|
|
# disabled by the system policy.
|
|
|
|
export NSS_IGNORE_SYSTEM_POLICY=1
|
|
|
|
export NSS_IGNORE_SYSTEM_POLICY=1
|
|
|
|
|
|
|
|
|
|
|
|
%ifarch i686 ppcle64
|
|
|
|
|
|
|
|
export NSS_DB_DUMP_TIME=10
|
|
|
|
|
|
|
|
%endif
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# enable the following line to force a test failure
|
|
|
|
# enable the following line to force a test failure
|
|
|
|
# find ./nss -name \*.chk | xargs rm -f
|
|
|
|
# find ./nss -name \*.chk | xargs rm -f
|
|
|
|
|
|
|
|
|
|
|
@ -786,7 +769,6 @@ mkdir -p $RPM_BUILD_ROOT/%{_libdir}/pkgconfig
|
|
|
|
mkdir -p $RPM_BUILD_ROOT/%{saved_files_dir}
|
|
|
|
mkdir -p $RPM_BUILD_ROOT/%{saved_files_dir}
|
|
|
|
mkdir -p $RPM_BUILD_ROOT/%{dracut_modules_dir}
|
|
|
|
mkdir -p $RPM_BUILD_ROOT/%{dracut_modules_dir}
|
|
|
|
mkdir -p $RPM_BUILD_ROOT/%{dracut_conf_dir}
|
|
|
|
mkdir -p $RPM_BUILD_ROOT/%{dracut_conf_dir}
|
|
|
|
mkdir -p $RPM_BUILD_ROOT/%{_sysconfdir}/crypto-policies/local.d
|
|
|
|
|
|
|
|
%if %{defined rhel}
|
|
|
|
%if %{defined rhel}
|
|
|
|
# not needed for rhel and its derivatives only fedora
|
|
|
|
# not needed for rhel and its derivatives only fedora
|
|
|
|
%else
|
|
|
|
%else
|
|
|
@ -875,11 +857,11 @@ install -p -m 755 ./dist/pkgconfig/setup-nsssysinit.sh $RPM_BUILD_ROOT/%{_bindir
|
|
|
|
ln -r -s -f $RPM_BUILD_ROOT/%{_bindir}/setup-nsssysinit.sh $RPM_BUILD_ROOT/%{_bindir}/setup-nsssysinit
|
|
|
|
ln -r -s -f $RPM_BUILD_ROOT/%{_bindir}/setup-nsssysinit.sh $RPM_BUILD_ROOT/%{_bindir}/setup-nsssysinit
|
|
|
|
|
|
|
|
|
|
|
|
# Copy the man pages for scripts
|
|
|
|
# Copy the man pages for scripts
|
|
|
|
for f in nss-config setup-nsssysinit; do
|
|
|
|
for f in %{configFiles}; do
|
|
|
|
install -c -m 644 ${f}.1 $RPM_BUILD_ROOT%{_mandir}/man1/${f}.1
|
|
|
|
install -c -m 644 ${f}.1 $RPM_BUILD_ROOT%{_mandir}/man1/${f}.1
|
|
|
|
done
|
|
|
|
done
|
|
|
|
# Copy the man pages for the nss tools
|
|
|
|
# Copy the man pages for the nss tools
|
|
|
|
for f in certutil cmsutil crlutil derdump modutil nss-policy-check pk12util signtool signver ssltap vfychain vfyserv; do
|
|
|
|
for f in certutil cmsutil crlutil derdump modutil pk12util signtool signver ssltap vfychain vfyserv; do
|
|
|
|
install -c -m 644 ./dist/docs/nroff/${f}.1 $RPM_BUILD_ROOT%{_mandir}/man1/${f}.1
|
|
|
|
install -c -m 644 ./dist/docs/nroff/${f}.1 $RPM_BUILD_ROOT%{_mandir}/man1/${f}.1
|
|
|
|
done
|
|
|
|
done
|
|
|
|
%if %{defined rhel}
|
|
|
|
%if %{defined rhel}
|
|
|
@ -888,19 +870,10 @@ install -c -m 644 ./dist/docs/nroff/pp.1 $RPM_BUILD_ROOT%{_mandir}/man1/pp.1
|
|
|
|
install -c -m 644 ./dist/docs/nroff/pp.1 $RPM_BUILD_ROOT%{_datadir}/doc/nss-tools/pp.1
|
|
|
|
install -c -m 644 ./dist/docs/nroff/pp.1 $RPM_BUILD_ROOT%{_datadir}/doc/nss-tools/pp.1
|
|
|
|
%endif
|
|
|
|
%endif
|
|
|
|
|
|
|
|
|
|
|
|
# Copy the man pages for the configuration files
|
|
|
|
# Copy the man pages for the nss databases
|
|
|
|
for f in pkcs11.txt cert9.db key4.db; do
|
|
|
|
for f in %{dbfiles}; do
|
|
|
|
install -c -m 644 ${f}.5 $RPM_BUILD_ROOT%{_mandir}/man5/${f}.5
|
|
|
|
|
|
|
|
done
|
|
|
|
|
|
|
|
# Copy the man pages for the nss dbm databases
|
|
|
|
|
|
|
|
%if %{with dbm}
|
|
|
|
|
|
|
|
for f in cert8.db key3.db secmod.db; do
|
|
|
|
|
|
|
|
install -c -m 644 ${f}.5 $RPM_BUILD_ROOT%{_mandir}/man5/${f}.5
|
|
|
|
install -c -m 644 ${f}.5 $RPM_BUILD_ROOT%{_mandir}/man5/${f}.5
|
|
|
|
done
|
|
|
|
done
|
|
|
|
%endif
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# Copy the crypto-policies configuration file
|
|
|
|
|
|
|
|
install -p -m 644 %{SOURCE28} $RPM_BUILD_ROOT/%{_sysconfdir}/crypto-policies/local.d
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
%triggerpostun -n nss-sysinit -- nss-sysinit < 3.12.8-3
|
|
|
|
%triggerpostun -n nss-sysinit -- nss-sysinit < 3.12.8-3
|
|
|
|
# Reverse unwanted disabling of sysinit by faulty preun sysinit scriplet
|
|
|
|
# Reverse unwanted disabling of sysinit by faulty preun sysinit scriplet
|
|
|
@ -921,9 +894,6 @@ if test $1 -eq 2; then
|
|
|
|
fi
|
|
|
|
fi
|
|
|
|
%endif
|
|
|
|
%endif
|
|
|
|
|
|
|
|
|
|
|
|
%posttrans
|
|
|
|
|
|
|
|
update-crypto-policies &> /dev/null || :
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
%files
|
|
|
|
%files
|
|
|
|
%{!?_licensedir:%global license %%doc}
|
|
|
|
%{!?_licensedir:%global license %%doc}
|
|
|
@ -940,7 +910,6 @@ update-crypto-policies &> /dev/null || :
|
|
|
|
%config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/pki/nssdb/cert9.db
|
|
|
|
%config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/pki/nssdb/cert9.db
|
|
|
|
%config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/pki/nssdb/key4.db
|
|
|
|
%config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/pki/nssdb/key4.db
|
|
|
|
%config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/pki/nssdb/pkcs11.txt
|
|
|
|
%config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/pki/nssdb/pkcs11.txt
|
|
|
|
%config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/crypto-policies/local.d/nss-p11-kit.config
|
|
|
|
|
|
|
|
%if %{with dbm}
|
|
|
|
%if %{with dbm}
|
|
|
|
%doc %{_mandir}/man5/cert8.db.5*
|
|
|
|
%doc %{_mandir}/man5/cert8.db.5*
|
|
|
|
%doc %{_mandir}/man5/key3.db.5*
|
|
|
|
%doc %{_mandir}/man5/key3.db.5*
|
|
|
@ -986,7 +955,6 @@ update-crypto-policies &> /dev/null || :
|
|
|
|
%doc %{_mandir}/man1/cmsutil.1*
|
|
|
|
%doc %{_mandir}/man1/cmsutil.1*
|
|
|
|
%doc %{_mandir}/man1/crlutil.1*
|
|
|
|
%doc %{_mandir}/man1/crlutil.1*
|
|
|
|
%doc %{_mandir}/man1/modutil.1*
|
|
|
|
%doc %{_mandir}/man1/modutil.1*
|
|
|
|
%doc %{_mandir}/man1/nss-policy-check.1*
|
|
|
|
|
|
|
|
%doc %{_mandir}/man1/pk12util.1*
|
|
|
|
%doc %{_mandir}/man1/pk12util.1*
|
|
|
|
%doc %{_mandir}/man1/signver.1*
|
|
|
|
%doc %{_mandir}/man1/signver.1*
|
|
|
|
# unsupported tools
|
|
|
|
# unsupported tools
|
|
|
@ -1089,8 +1057,8 @@ update-crypto-policies &> /dev/null || :
|
|
|
|
%{_includedir}/nss3/base64.h
|
|
|
|
%{_includedir}/nss3/base64.h
|
|
|
|
%{_includedir}/nss3/ciferfam.h
|
|
|
|
%{_includedir}/nss3/ciferfam.h
|
|
|
|
%{_includedir}/nss3/eccutil.h
|
|
|
|
%{_includedir}/nss3/eccutil.h
|
|
|
|
%{_includedir}/nss3/hasht.h
|
|
|
|
|
|
|
|
%{_includedir}/nss3/kyber.h
|
|
|
|
%{_includedir}/nss3/kyber.h
|
|
|
|
|
|
|
|
%{_includedir}/nss3/hasht.h
|
|
|
|
%{_includedir}/nss3/nssb64.h
|
|
|
|
%{_includedir}/nss3/nssb64.h
|
|
|
|
%{_includedir}/nss3/nssb64t.h
|
|
|
|
%{_includedir}/nss3/nssb64t.h
|
|
|
|
%{_includedir}/nss3/nsshash.h
|
|
|
|
%{_includedir}/nss3/nsshash.h
|
|
|
@ -1200,6 +1168,9 @@ update-crypto-policies &> /dev/null || :
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
%changelog
|
|
|
|
%changelog
|
|
|
|
|
|
|
|
* Tue Nov 26 2024 MSVSphere Packaging Team <packager@msvsphere-os.ru> - 3.101.0-7
|
|
|
|
|
|
|
|
- Rebuilt for MSVSphere 10
|
|
|
|
|
|
|
|
|
|
|
|
* Wed Sep 4 2024 Bob Relyea <rrelyea@redhat.com> - 3.101.0-7
|
|
|
|
* Wed Sep 4 2024 Bob Relyea <rrelyea@redhat.com> - 3.101.0-7
|
|
|
|
- fix cms abi breakage
|
|
|
|
- fix cms abi breakage
|
|
|
|
- fix long password issue on pbmac encodings
|
|
|
|
- fix long password issue on pbmac encodings
|
|
|
@ -1208,187 +1179,159 @@ update-crypto-policies &> /dev/null || :
|
|
|
|
- fix param encoding in pkcs12 pbamac encoding
|
|
|
|
- fix param encoding in pkcs12 pbamac encoding
|
|
|
|
- add support for certificate compression in selfserv and tstclient
|
|
|
|
- add support for certificate compression in selfserv and tstclient
|
|
|
|
|
|
|
|
|
|
|
|
* Wed Jul 24 2024 Bob Relyea <rrelyea@redhat.com> - 3.101.0-3
|
|
|
|
* Wed Jul 24 2024 Bob Relyea <rrelyea@redhat.com> - 3.101.0-5
|
|
|
|
- Fix missing and inaccurate key length checks
|
|
|
|
- Fix missing and inaccurate key length checks
|
|
|
|
- Fix chacha timing issue
|
|
|
|
- Fix chacha timing issue
|
|
|
|
|
|
|
|
|
|
|
|
* Tue Jul 16 2024 Bob Relyea <rrelyea@redhat.com> - 3.101.0-2
|
|
|
|
* Thu Jul 18 2024 Bob Relyea <rrelyea@redhat.com> - 3.101.0-4
|
|
|
|
- Fix MD-5 decode issue in pkcs #12
|
|
|
|
- Fix MD-5 decode issue in pkcs #12
|
|
|
|
- turn off policy processing for pkcs12 and smime
|
|
|
|
|
|
|
|
- restore the rhel9 pkcs12 defaults for pk12util
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
* Tue Jun 11 2024 Bob Relyea <rrelyea@redhat.com> - 3.101.0-1
|
|
|
|
* Mon Jul 15 2024 Bob Relyea <rrelyea@redhat.com> - 3.101.0-3
|
|
|
|
- Rebase to NSS 3.101
|
|
|
|
- Add FIPS 140-3 defines to sec file
|
|
|
|
- restore ppc init support
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
* Wed Apr 10 2024 Frantisek Krenzelok <krenzelok.frantisek@gmail.com> - 3.90.0-7
|
|
|
|
* Fri Jul 12 2024 Bob Relyea <rrelyea@redhat.com> - 3.101.0-2
|
|
|
|
- Allow for shorter ecdsa signatures by padding them to full length
|
|
|
|
- Fix spec to deal with annocheck failures
|
|
|
|
|
|
|
|
|
|
|
|
* Tue Jan 23 2024 Bob Relyea <rrelyea@redhat.com> - 3.90.0-6
|
|
|
|
* Tue Jun 25 2024 Bob Relyea <rrelyea@redhat.com> - 3.101.0-1
|
|
|
|
- Fix ecc DER wrapping.
|
|
|
|
- Update NSS to 3.101.0
|
|
|
|
|
|
|
|
- Pick up RHEL FIPS and other patches
|
|
|
|
|
|
|
|
- Turn off SEED and DSA
|
|
|
|
|
|
|
|
|
|
|
|
* Tue Jan 9 2024 Bob Relyea <rrelyea@redhat.com> - 3.90.0-5
|
|
|
|
* Mon Jun 24 2024 Troy Dawson <tdawson@redhat.com> - 3.97.0-2
|
|
|
|
- Pick up validated constant time implementations of p256, p384, and p521
|
|
|
|
- Bump release for June 2024 mass rebuild
|
|
|
|
from upsream
|
|
|
|
|
|
|
|
- More Fips indicator changes
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
* Wed Nov 22 2023 Bob Relyea <rrelyea@redhat.com> - 3.90.0-4
|
|
|
|
* Sun Jan 28 2024 Frantisek Krenzelok <krenzelok.frantisek@gmail.com> - 3.97.0-1
|
|
|
|
- FIPS review changes
|
|
|
|
- Update NSS to 3.97.0
|
|
|
|
- add PORT_SafeZero to avoid compiler optimizing a way zeroing memory.
|
|
|
|
|
|
|
|
- update the indicators for this release
|
|
|
|
|
|
|
|
- allow hashing of longer than int32 values in a single PKCS #11 call.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
* Tue Nov 21 2023 Bob Relyea <rrelyea@redhat.com> - 3.90.0-3.3
|
|
|
|
* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.96.1-3
|
|
|
|
- Fix expired certs in tests
|
|
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
|
|
|
|
- Fix CVE-2023-5388
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
* Fri Aug 4 2023 Bob Relyea <rrelyea@redhat.com> - 3.90.0-3
|
|
|
|
* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.96.1-2
|
|
|
|
- add indicator for pbkdf
|
|
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
|
|
|
|
- fix ems policy bug
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
* Thu Jun 29 2023 frantisek Krenzelok <krenzelok.frantisek@gmail.com> - 3.90.0-2
|
|
|
|
* Thu Dec 21 2023 Frantisek Krenzelok <krenzelok.frantisek@gmail.com> - 3.96.1-1
|
|
|
|
- fix release number
|
|
|
|
- Update NSS to 3.96.1
|
|
|
|
|
|
|
|
|
|
|
|
* Wed Jun 28 2023 Frantisek Krenzelok <krenzelok.frantisek@gmail.com> - 3.90.0-1
|
|
|
|
* Mon Nov 27 2023 Frantisek Krenzelok <krenzelok.frantisek@gmail.com> - 3.95.0-1
|
|
|
|
- fix missing dist tag in packages version
|
|
|
|
- Update NSS to 3.95.0
|
|
|
|
- move from deprecate %%patch format
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
* Mon Jun 12 2023 Bob Relyea <rrelyea@redhat.com> - 3.90.0-1
|
|
|
|
* Wed Oct 25 2023 Frantisek Krenzelok <krenzelok.frantisek@gmail.com> - 3.94.0-2
|
|
|
|
- Rebase to NSS-3.90
|
|
|
|
- revert HACL 256 code to fix binary compatibility issue.
|
|
|
|
- Rebase to NSPR-3.35
|
|
|
|
|
|
|
|
- fix incorrect version values in the NSS spec file for FIPS
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
* Fri Mar 17 2023 Bob Relyea <rrelyea@redhat.com> - 3.79.0-18
|
|
|
|
* Wed Oct 4 2023 Frantisek Krenzelok <krenzelok.frantisek@gmail.com> - 3.94.0-1
|
|
|
|
- fix memory leak, add generator test in FIPS mode.
|
|
|
|
- Update NSS to 3.94.0
|
|
|
|
|
|
|
|
|
|
|
|
* Thu Mar 16 2023 Bob Relyea <rrelyea@redhat.com> - 3.79.0-17
|
|
|
|
* Thu Sep 07 2023 Bob Relyea <rrelyea@redhat.com> - 3.93.0-2
|
|
|
|
- fix consistency return errors. We shouldn't lock the FIPS
|
|
|
|
- Update License field to SPDX.
|
|
|
|
token if the application asked for invalid DH parameters on
|
|
|
|
|
|
|
|
on keygen.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
* Mon Mar 13 2023 Bob Relyea <rrelyea@redhat.com> - 3.79.0-16
|
|
|
|
* Thu Aug 31 2023 Frantisek Krenzelok <krenzelok.frantisek@gmail.com> - 3.93.0-1
|
|
|
|
- Add check for RSA PSS Salt required by FIPS
|
|
|
|
- Update NSS to 3.93.0
|
|
|
|
- Update fips_algorithms.sh according to the review.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
* Thu Mar 2 2023 Bob Relyea <rrelyea@redhat.com> - 3.79.0-15
|
|
|
|
* Tue Aug 1 2023 Frantisek Krenzelok <krenzelok.frantisek@gmail.com> - 3.92.0-1
|
|
|
|
- Fix CVE-2023-0767
|
|
|
|
- Update NSS to 3.92.0
|
|
|
|
|
|
|
|
|
|
|
|
* Wed Aug 24 2022 Bob Relyea <rrelyea@redhat.com> - 3.79.0-14
|
|
|
|
* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 3.91.0-2
|
|
|
|
- Update fips_algorithms.h to match the final FIPS requirements
|
|
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
|
|
|
|
- Disable delegated credentials
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
* Wed Aug 24 2022 Bob Relyea <rrelyea@redhat.com> - 3.79.0-13
|
|
|
|
* Tue Jul 4 2023 Frantisek Krenzelok <krenzelok.frantisek@gmail.com> - 3.91.0-1
|
|
|
|
- remove OAEP from the FIPS indicators
|
|
|
|
- Update NSS to 3.91.0
|
|
|
|
|
|
|
|
|
|
|
|
* Thu Aug 11 2022 Bob Relyea <rrelyea@redhat.com> - 3.79.0-12
|
|
|
|
* Tue Jun 6 2023 Frantisek Krenzelok <krenzelok.frantisek@gmail.com> - 3.90.0-1
|
|
|
|
- only turn off rand changes on all non-fips kernels
|
|
|
|
- Add patch for https://bugzilla.mozilla.org/show_bug.cgi?id=1836781 &
|
|
|
|
|
|
|
|
https://bugzilla.mozilla.org/show_bug.cgi?id=1836925
|
|
|
|
|
|
|
|
|
|
|
|
* Mon Aug 8 2022 Bob Relyea <rrelyea@redhat.com> - 3.79.0-11
|
|
|
|
* Mon Jun 5 2023 Frantisek Krenzelok <krenzelok.frantisek@gmail.com> - 3.90.0-1
|
|
|
|
- only turn off rand changes on ppc64le at build-test time.
|
|
|
|
- Update %%patch syntax
|
|
|
|
|
|
|
|
|
|
|
|
* Mon Aug 8 2022 Bob Relyea <rrelyea@redhat.com> - 3.79.0-10
|
|
|
|
* Mon Jun 5 2023 Frantisek Krenzelok <krenzelok.frantisek@gmail.com> - 3.90.0-1
|
|
|
|
- turn off rand changes on ppc64le
|
|
|
|
- Update NSS to 3.90.0
|
|
|
|
|
|
|
|
|
|
|
|
* Sun Aug 7 2022 Bob Relyea <rrelyea@redhat.com> - 3.79.0-9
|
|
|
|
* Fri May 5 2023 Frantisek Krenzelok <krenzelok.frantisek@gmail.com> - 3.89.0-1
|
|
|
|
- FIPS 140-3 changes
|
|
|
|
- combine nss and nspr source togeather
|
|
|
|
|
|
|
|
|
|
|
|
* Thu Jul 21 2022 Bob Relyea <rrelyea@redhat.com> - 3.79.0-8
|
|
|
|
* Fri May 5 2023 Frantisek Krenzelok <krenzelok.frantisek@gmail.com> - 3.89.0-1
|
|
|
|
- fix encoding issue with NULL passwords
|
|
|
|
- replace %{version} with %{nss_version} as it version can be overiden.
|
|
|
|
|
|
|
|
|
|
|
|
* Thu Jul 7 2022 Bob Relyea <rrelyea@redhat.com> - 3.79.0-7
|
|
|
|
* Fri Mar 10 2023 Frantisek Krenzelok <krenzelok.frantisek@gmail.com> - 3.89.0-1
|
|
|
|
- more complete fix for cert auth regression crash
|
|
|
|
- Update NSS to 3.89.0
|
|
|
|
|
|
|
|
|
|
|
|
* Wed Jun 22 2022 Bob Relyea <rrelyea@redhat.com> - 3.79.0-6
|
|
|
|
* Fri Feb 10 2023 Frantisek Krenzelok <krenzelok.frantisek@gmail.com> - 3.88.1-1
|
|
|
|
- Remove debugging printf from a patch
|
|
|
|
- Update NSS to 3.88.1
|
|
|
|
- increase the pbe cache size to handle reusing the same token key.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
* Mon Jun 20 2022 Bob Relyea <rrelyea@redhat.com> - 3.79.0-5
|
|
|
|
* Tue Jan 24 2023 Bob Relyea - 3.87.0-2
|
|
|
|
- FIPS 140-3 changes
|
|
|
|
- Fix rebuild errors
|
|
|
|
- Reject Small RSA keys, 1024 bit keys are marked as FIP OK when verifying, reject
|
|
|
|
|
|
|
|
signature keys by policy
|
|
|
|
|
|
|
|
- Allow applications to retrigger selftests on demand.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
* Tue Jun 14 2022 Bob Relyea <rrelyea@redhat.com> - 3.79.0-4
|
|
|
|
* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 3.87.0-2
|
|
|
|
- server passive fix
|
|
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
|
|
|
|
|
|
|
|
|
|
|
|
* Sat Jun 11 2022 Bob Relyea <rrelyea@redhat.com> - 3.79.0-3
|
|
|
|
* Tue Jan 10 2023 Frantisek Krenzelok <krenzelok.frantisek@gmail.com> - 3.87.0-1
|
|
|
|
- fix regressions in test suite
|
|
|
|
- Update NSS to 3.87 & remove unused patches
|
|
|
|
|
|
|
|
|
|
|
|
* Mon Jun 6 2022 Bob Relyea <rrelyea@redhat.com> - 3.79.0-2
|
|
|
|
* Thu Nov 17 2022 Bob Relyea <rrelyea@redhat.com> - 3.85.0-1
|
|
|
|
- fix nspr coverify issues.
|
|
|
|
- update to NSS 3.83
|
|
|
|
|
|
|
|
|
|
|
|
* Wed Jun 1 2022 Bob Relyea <rrelyea@redhat.com> - 3.79.0-1
|
|
|
|
* Fri Sep 9 2022 Bob Relyea <rrelyea@redhat.com> - 3.83.0-1
|
|
|
|
- update to NSS 3.79
|
|
|
|
- update to NSS 3.83
|
|
|
|
- update to NSPR 4.34
|
|
|
|
- update to NSPR 4.35
|
|
|
|
- change FIPS Modulename to conform with our final module standard
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
* Wed Feb 16 2022 Bob Relyea <rrelyea@redhat.com> - 3.71.0-7
|
|
|
|
* Fri Sep 9 2022 Bob Relyea <rrelyea@redhat.com> - 3.81.0-2
|
|
|
|
- Fix handling of pkcs12 passwords for PKCS5v2 cases which causes failures
|
|
|
|
- add dbtool
|
|
|
|
on long passwords.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
* Wed Jan 26 2022 Bob Relyea <rrelyea@redhat.com> - 3.71.0-6
|
|
|
|
* Thu Jul 21 2022 Bob Relyea <rrelyea@redhat.com> - 3.81.0-1
|
|
|
|
- update pkcs12 documentation to include camellia
|
|
|
|
- udpate to NSS 3.81
|
|
|
|
- turn on lto
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
* Wed Jan 12 2022 Bob Relyea <rrelyea@redhat.com> - 3.71.0-5
|
|
|
|
* Thu Jun 16 2022 Bob Relyea <rrelyea@redhat.com> - 3.79.0-2
|
|
|
|
- remove old dbm files from the build
|
|
|
|
- Fix crash when getting client cert and there is none in the database.
|
|
|
|
|
|
|
|
|
|
|
|
* Wed Dec 1 2021 Bob Relyea <rrelyea@redhat.com> - 3.71.0-2
|
|
|
|
* Tue May 31 2022 Bob Relyea <rrelyea@redhat.com> - 3.79.0-1
|
|
|
|
- Fix CVE-2021-43527
|
|
|
|
- Update to NSS 3.79
|
|
|
|
|
|
|
|
- Update to NSPR 4.34
|
|
|
|
|
|
|
|
|
|
|
|
* Tue Oct 19 2021 Bob Relyea <rrelyea@redhat.com> - 3.71.0-2
|
|
|
|
* Mon Apr 4 2022 Bob Relyea <rrelyea@redhat.com> - 3.77.0-1
|
|
|
|
- make sure validation is built
|
|
|
|
- Update to 3.77
|
|
|
|
- fix syntax on FIPS module name
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
* Tue Oct 5 2021 Bob Relyea <rrelyea@redhat.com> - 3.71.0-1
|
|
|
|
* Fri Feb 4 2022 Bob Relyea <rrelyea@redhat.com> - 3.75.0-1
|
|
|
|
- rebase to NSS-3.71
|
|
|
|
- Update to 3.75
|
|
|
|
|
|
|
|
- fix PayPal expiration issue
|
|
|
|
|
|
|
|
|
|
|
|
* Wed Aug 25 2021 Bob Relyea <rrelyea@redhat.com> - 3.67.0-13
|
|
|
|
* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 3.73.0-2
|
|
|
|
- rebuild to clear gating.yaml test
|
|
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
|
|
|
|
|
|
|
|
|
|
|
|
* Thu Aug 19 2021 Bob Relyea <rrelyea@redhat.com> - 3.67.0-12
|
|
|
|
* Wed Dec 1 2021 Bob Relyea <rrelyea@redhat.com> - 3.73.0-1
|
|
|
|
- pick up nspr 3.2 for Firefox 92
|
|
|
|
- Update to 3.73
|
|
|
|
|
|
|
|
- includes CVE 2021-43527
|
|
|
|
|
|
|
|
|
|
|
|
* Thu Aug 12 2021 Florian Weimer <fweimer@redhat.com> - 3.67.0-11
|
|
|
|
* Mon Oct 4 2021 Bob Relyea <rrelyea@redhat.com> - 3.71.0-1
|
|
|
|
- Change release number to correct cross-package dependencies (#1991688)
|
|
|
|
- Update to 3.71
|
|
|
|
|
|
|
|
|
|
|
|
* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com>
|
|
|
|
* Tue Aug 10 2021 Bob Relyea <rrelyea@redhat.com> - 3.69.0-2
|
|
|
|
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
|
|
|
|
- turn on lto
|
|
|
|
Related: rhbz#1991688
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
* Thu Jul 8 2021 Bob Relyea <rrelyea@redhat.com> - 3.67.0-8
|
|
|
|
|
|
|
|
- fix relro support in nspr part of build
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
* Tue Jul 6 2021 Bob Relyea <rrelyea@redhat.com> - 3.67.0-7
|
|
|
|
|
|
|
|
- fix ssl alert regressions
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
* Fri Jul 2 2021 Bob Relyea <rrelyea@redhat.com> - 3.67.0-6
|
|
|
|
* Tue Aug 10 2021 Bob Relyea <rrelyea@redhat.com> - 3.69.0-1
|
|
|
|
- bump the nspr release number
|
|
|
|
- Update to 3.69
|
|
|
|
|
|
|
|
- Update to NSPR 4.31
|
|
|
|
|
|
|
|
|
|
|
|
* Thu Jul 1 2021 Bob Relyea <rrelyea@redhat.com> - 3.67.0-5
|
|
|
|
* Tue Jul 27 2021 Bob Relyea <rrelyea@redhat.com> - 3.67.0-4
|
|
|
|
- fix error when trying to read keys from updated databases when updated
|
|
|
|
- switch to baserelease so rpmdev-bumpspec will work next time
|
|
|
|
from unpatched versions of NSS (like on fedora or upstream).
|
|
|
|
|
|
|
|
- fix spelling of LD_OPTFLAGS which prevents relro from working.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
* Fri Jun 18 2021 Bob Relyea <rrelyea@redhat.com> - 3.67.0-4
|
|
|
|
* Tue Jul 27 2021 Bob Relyea <rrelyea@redhat.com> - 3.67.0-3
|
|
|
|
- update nspr man page files to only pick up nspr man pages
|
|
|
|
- rpmdev-bumpspec doesn't work correctly with nss/nspr. Fixup version numbers
|
|
|
|
|
|
|
|
|
|
|
|
* Fri Jun 18 2021 Bob Relyea <rrelyea@redhat.com> - 3.67.0-3
|
|
|
|
* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 3.67.0-2
|
|
|
|
- Update NSS to 3.67
|
|
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
|
|
|
|
- Update NSPR to 2.31
|
|
|
|
|
|
|
|
- pick up rhel coverity patches which have not yet been pushed upstream.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
* Fri Apr 16 2021 Bob Relyea <rrelyea@redhat.com> - 3.63.0-3
|
|
|
|
* Tue Mar 23 2021 Bob Relyea <rrelyea@redhat.com> - 3.67.0-1
|
|
|
|
- prevent MD5 from being enabled even with the environment variables
|
|
|
|
- Update to 3.67
|
|
|
|
and policy. This mirrors the rhel8 semantics.
|
|
|
|
- Update to NSPR 2.31
|
|
|
|
- add DSO_LDFLAGS support so we pick up system LDFLAGS in our shared libraries
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 3.63.0-2
|
|
|
|
* Tue Mar 23 2021 Bob Relyea <rrelyea@redhat.com> - 3.65.0-1
|
|
|
|
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
|
|
|
|
- Update to 3.65
|
|
|
|
|
|
|
|
- update nss-tools manages to remove references to dbm
|
|
|
|
|
|
|
|
|
|
|
|
* Wed Mar 24 2021 Bob Relyea <rrelyea@redhat.com> - 3.63.0-1
|
|
|
|
* Tue Mar 23 2021 Bob Relyea <rrelyea@redhat.com> - 3.63.0-1
|
|
|
|
- Update NSS to 3.62
|
|
|
|
- Update to 3.63
|
|
|
|
- Update NSPR to 2.30
|
|
|
|
- Update to NSPR 2.30
|
|
|
|
|
|
|
|
- Remove old dbm files and man pages
|
|
|
|
|
|
|
|
|
|
|
|
* Tue Feb 23 2021 Bob Relyea <rrelyea@redhat.com> - 3.62.0-1
|
|
|
|
* Tue Feb 23 2021 Bob Relyea <rrelyea@redhat.com> - 3.62.0-1
|
|
|
|
- Update to 3.62
|
|
|
|
- Update to 3.62
|
|
|
|