From baf8479e59f22e75b6567ae1da1b3565af53b8b1 Mon Sep 17 00:00:00 2001 From: EnumDev Date: Sat, 30 May 2026 12:39:29 +0300 Subject: [PATCH] Update package version to 3.124 --- pkg.info | 8 +- source-files/bundle.sh | 22 ++ source-files/certdata2pem.py | 413 +++++++++++++++++++++++++++++++++++ source-files/nss.patch | 266 ---------------------- source.sh | 61 ++++-- 5 files changed, 487 insertions(+), 283 deletions(-) create mode 100644 source-files/bundle.sh create mode 100644 source-files/certdata2pem.py delete mode 100644 source-files/nss.patch diff --git a/pkg.info b/pkg.info index c87a5d2..df35a37 100644 --- a/pkg.info +++ b/pkg.info @@ -1,9 +1,9 @@ name: nss description: Network Security Services -version: 3.123.1 +version: "3.124" revision: 1 url: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS -license: MPL2 +license: MPL-2.0 maintainers: - enumdev@enumerated.dev architecture: any @@ -12,13 +12,15 @@ depends: - glibc - nspr - p11-kit + - bash - sqlite - zlib make_depends: + - gyp - perl - python3 downloads: - url: https://archive.mozilla.org/pub/security/nss/releases/NSS_${BPM_PKG_VERSION//./_}_RTM/src/nss-${BPM_PKG_VERSION}.tar.gz extract_to: ${BPM_SOURCE} extract_strip_components: 1 - checksum: 42065a3ff780a9710a3dddcd1cee9b9be2aa40628883cea851d562eb58b178b0 + checksum: 80da9f1cbcb267293b2248818d288bc02f874d6a34f1989a2828401d74a0bc9b diff --git a/source-files/bundle.sh b/source-files/bundle.sh new file mode 100644 index 0000000..531a496 --- /dev/null +++ b/source-files/bundle.sh @@ -0,0 +1,22 @@ +#!/bin/sh +# From Fedora's ca-certificates.spec + +( + cat < ca-bundle.trust.p11-kit + +for p in certs/*.tmp-p11-kit; do + cat "$p" >> ca-bundle.trust.p11-kit +done diff --git a/source-files/certdata2pem.py b/source-files/certdata2pem.py new file mode 100644 index 0000000..a52ce9c --- /dev/null +++ b/source-files/certdata2pem.py @@ -0,0 +1,413 @@ +#!/usr/bin/python +# vim:set et sw=4: +# +# certdata2pem.py - splits certdata.txt into multiple files +# +# Copyright (C) 2009 Philipp Kern +# Copyright (C) 2013 Kai Engert +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, +# USA. + +import base64 +import os.path +import re +import sys +import textwrap +import urllib.request, urllib.parse, urllib.error +import subprocess + +objects = [] + +def printable_serial(obj): + return ".".join([str(x) for x in obj['CKA_SERIAL_NUMBER']]) + +# Dirty file parser. +in_data, in_multiline, in_obj = False, False, False +field, ftype, value, binval, obj = None, None, None, bytearray(), dict() +for line in open('certdata.txt', 'r'): + # Ignore the file header. + if not in_data: + if line.startswith('BEGINDATA'): + in_data = True + continue + # Ignore comment lines. + if line.startswith('#'): + continue + # Empty lines are significant if we are inside an object. + if in_obj and len(line.strip()) == 0: + objects.append(obj) + obj = dict() + in_obj = False + continue + if len(line.strip()) == 0: + continue + if in_multiline: + if not line.startswith('END'): + if ftype == 'MULTILINE_OCTAL': + line = line.strip() + for i in re.finditer(r'\\([0-3][0-7][0-7])', line): + integ = int(i.group(1), 8) + binval.extend((integ).to_bytes(1, sys.byteorder)) + obj[field] = binval + else: + value += line + obj[field] = value + continue + in_multiline = False + continue + if line.startswith('CKA_CLASS'): + in_obj = True + line_parts = line.strip().split(' ', 2) + if len(line_parts) > 2: + field, ftype = line_parts[0:2] + value = ' '.join(line_parts[2:]) + elif len(line_parts) == 2: + field, ftype = line_parts + value = None + else: + raise NotImplementedError('line_parts < 2 not supported.\n' + line) + if ftype == 'MULTILINE_OCTAL': + in_multiline = True + value = "" + binval = bytearray() + continue + obj[field] = value +if len(list(obj.items())) > 0: + objects.append(obj) + +# Build up trust database. +trustmap = dict() +for obj in objects: + if obj['CKA_CLASS'] != 'CKO_NSS_TRUST': + continue + key = obj['CKA_LABEL'] + printable_serial(obj) + trustmap[key] = obj + print(" added trust", key) + +# Build up cert database. +certmap = dict() +for obj in objects: + if obj['CKA_CLASS'] != 'CKO_CERTIFICATE': + continue + key = obj['CKA_LABEL'] + printable_serial(obj) + certmap[key] = obj + print(" added cert", key) + +def obj_to_filename(obj): + label = obj['CKA_LABEL'][1:-1] + label = label.replace('/', '_')\ + .replace(' ', '_')\ + .replace('(', '=')\ + .replace(')', '=')\ + .replace(',', '_') + labelbytes = bytearray() + i = 0 + imax = len(label) + while i < imax: + if i < imax-3 and label[i] == '\\' and label[i+1] == 'x': + labelbytes.extend(bytes.fromhex(label[i+2:i+4])) + i += 4 + continue + labelbytes.extend(str.encode(label[i])) + i = i+1 + continue + label = labelbytes.decode('utf-8') + serial = printable_serial(obj) + return label + ":" + serial + +def write_cert_ext_to_file(f, oid, value, public_key): + f.write("[p11-kit-object-v1]\n") + f.write("label: "); + f.write(tobj['CKA_LABEL']) + f.write("\n") + f.write("class: x-certificate-extension\n"); + f.write("object-id: " + oid + "\n") + f.write("value: \"" + value + "\"\n") + f.write("modifiable: false\n"); + f.write(public_key) + +trust_types = { + "CKA_TRUST_DIGITAL_SIGNATURE": "digital-signature", + "CKA_TRUST_NON_REPUDIATION": "non-repudiation", + "CKA_TRUST_KEY_ENCIPHERMENT": "key-encipherment", + "CKA_TRUST_DATA_ENCIPHERMENT": "data-encipherment", + "CKA_TRUST_KEY_AGREEMENT": "key-agreement", + "CKA_TRUST_KEY_CERT_SIGN": "cert-sign", + "CKA_TRUST_CRL_SIGN": "crl-sign", + "CKA_TRUST_SERVER_AUTH": "server-auth", + "CKA_TRUST_CLIENT_AUTH": "client-auth", + "CKA_TRUST_CODE_SIGNING": "code-signing", + "CKA_TRUST_EMAIL_PROTECTION": "email-protection", + "CKA_TRUST_IPSEC_END_SYSTEM": "ipsec-end-system", + "CKA_TRUST_IPSEC_TUNNEL": "ipsec-tunnel", + "CKA_TRUST_IPSEC_USER": "ipsec-user", + "CKA_TRUST_TIME_STAMPING": "time-stamping", + "CKA_TRUST_STEP_UP_APPROVED": "step-up-approved", +} + +legacy_trust_types = { + "LEGACY_CKA_TRUST_SERVER_AUTH": "server-auth", + "LEGACY_CKA_TRUST_CODE_SIGNING": "code-signing", + "LEGACY_CKA_TRUST_EMAIL_PROTECTION": "email-protection", +} + +legacy_to_real_trust_types = { + "LEGACY_CKA_TRUST_SERVER_AUTH": "CKA_TRUST_SERVER_AUTH", + "LEGACY_CKA_TRUST_CODE_SIGNING": "CKA_TRUST_CODE_SIGNING", + "LEGACY_CKA_TRUST_EMAIL_PROTECTION": "CKA_TRUST_EMAIL_PROTECTION", +} + +openssl_trust = { + "CKA_TRUST_SERVER_AUTH": "serverAuth", + "CKA_TRUST_CLIENT_AUTH": "clientAuth", + "CKA_TRUST_CODE_SIGNING": "codeSigning", + "CKA_TRUST_EMAIL_PROTECTION": "emailProtection", +} + +cert_distrust_types = { + "CKA_NSS_SERVER_DISTRUST_AFTER": "nss-server-distrust-after", + "CKA_NSS_EMAIL_DISTRUST_AFTER": "nss-email-distrust-after", +} + +for tobj in objects: + if tobj['CKA_CLASS'] == 'CKO_NSS_TRUST': + key = tobj['CKA_LABEL'] + printable_serial(tobj) + print("producing trust for " + key) + trustbits = [] + distrustbits = [] + openssl_trustflags = [] + openssl_distrustflags = [] + legacy_trustbits = [] + legacy_openssl_trustflags = [] + for t in list(trust_types.keys()): + if t in tobj and tobj[t] == 'CKT_NSS_TRUSTED_DELEGATOR': + trustbits.append(t) + if t in openssl_trust: + openssl_trustflags.append(openssl_trust[t]) + if t in tobj and tobj[t] == 'CKT_NSS_NOT_TRUSTED': + distrustbits.append(t) + if t in openssl_trust: + openssl_distrustflags.append(openssl_trust[t]) + + for t in list(legacy_trust_types.keys()): + if t in tobj and tobj[t] == 'CKT_NSS_TRUSTED_DELEGATOR': + real_t = legacy_to_real_trust_types[t] + legacy_trustbits.append(real_t) + if real_t in openssl_trust: + legacy_openssl_trustflags.append(openssl_trust[real_t]) + if t in tobj and tobj[t] == 'CKT_NSS_NOT_TRUSTED': + raise NotImplementedError('legacy distrust not supported.\n' + line) + + fname = obj_to_filename(tobj) + try: + obj = certmap[key] + except: + obj = None + + # optional debug code, that dumps the parsed input to files + #fulldump = "dump-" + fname + #dumpf = open(fulldump, 'w') + #dumpf.write(str(obj)); + #dumpf.write(str(tobj)); + #dumpf.close(); + + is_legacy = 0 + if 'LEGACY_CKA_TRUST_SERVER_AUTH' in tobj or 'LEGACY_CKA_TRUST_EMAIL_PROTECTION' in tobj or 'LEGACY_CKA_TRUST_CODE_SIGNING' in tobj: + is_legacy = 1 + if obj == None: + raise NotImplementedError('found legacy trust without certificate.\n' + line) + + legacy_fname = "legacy-default/" + fname + ".crt" + f = open(legacy_fname, 'w') + f.write("# alias=%s\n"%tobj['CKA_LABEL']) + f.write("# trust=" + " ".join(legacy_trustbits) + "\n") + if legacy_openssl_trustflags: + f.write("# openssl-trust=" + " ".join(legacy_openssl_trustflags) + "\n") + f.write("-----BEGIN CERTIFICATE-----\n") + temp_encoded_b64 = base64.b64encode(obj['CKA_VALUE']) + temp_wrapped = textwrap.wrap(temp_encoded_b64.decode(), 64) + f.write("\n".join(temp_wrapped)) + f.write("\n-----END CERTIFICATE-----\n") + f.close() + + if 'CKA_TRUST_SERVER_AUTH' in tobj or 'CKA_TRUST_EMAIL_PROTECTION' in tobj or 'CKA_TRUST_CODE_SIGNING' in tobj: + legacy_fname = "legacy-disable/" + fname + ".crt" + f = open(legacy_fname, 'w') + f.write("# alias=%s\n"%tobj['CKA_LABEL']) + f.write("# trust=" + " ".join(trustbits) + "\n") + if openssl_trustflags: + f.write("# openssl-trust=" + " ".join(openssl_trustflags) + "\n") + f.write("-----BEGIN CERTIFICATE-----\n") + f.write("\n".join(textwrap.wrap(base64.b64encode(obj['CKA_VALUE']), 64))) + f.write("\n-----END CERTIFICATE-----\n") + f.close() + + # don't produce p11-kit output for legacy certificates + continue + + pk = '' + cert_comment = '' + if obj != None: + # must extract the public key from the cert, let's use openssl + cert_fname = "cert-" + fname + fc = open(cert_fname, 'w') + fc.write("-----BEGIN CERTIFICATE-----\n") + temp_encoded_b64 = base64.b64encode(obj['CKA_VALUE']) + temp_wrapped = textwrap.wrap(temp_encoded_b64.decode(), 64) + fc.write("\n".join(temp_wrapped)) + fc.write("\n-----END CERTIFICATE-----\n") + fc.close(); + pk_fname = "pubkey-" + fname + fpkout = open(pk_fname, "w") + dump_pk_command = ["openssl", "x509", "-in", cert_fname, "-noout", "-pubkey"] + subprocess.call(dump_pk_command, stdout=fpkout) + fpkout.close() + with open (pk_fname, "r") as myfile: + pk=myfile.read() + # obtain certificate information suitable as a comment + comment_fname = "comment-" + fname + fcout = open(comment_fname, "w") + comment_command = ["openssl", "x509", "-in", cert_fname, "-noout", "-text"] + subprocess.call(comment_command, stdout=fcout) + fcout.close() + sed_command = ["sed", "--in-place", "s/^/#/", comment_fname] + subprocess.call(sed_command) + with open (comment_fname, "r", errors = 'replace') as myfile: + cert_comment=myfile.read() + + fname += ".tmp-p11-kit" + f = open(fname, 'w') + + if obj != None: + is_distrusted = False + has_server_trust = False + has_email_trust = False + has_code_trust = False + + if 'CKA_TRUST_SERVER_AUTH' in tobj: + if tobj['CKA_TRUST_SERVER_AUTH'] == 'CKT_NSS_NOT_TRUSTED': + is_distrusted = True + elif tobj['CKA_TRUST_SERVER_AUTH'] == 'CKT_NSS_TRUSTED_DELEGATOR': + has_server_trust = True + + if 'CKA_TRUST_EMAIL_PROTECTION' in tobj: + if tobj['CKA_TRUST_EMAIL_PROTECTION'] == 'CKT_NSS_NOT_TRUSTED': + is_distrusted = True + elif tobj['CKA_TRUST_EMAIL_PROTECTION'] == 'CKT_NSS_TRUSTED_DELEGATOR': + has_email_trust = True + + if 'CKA_TRUST_CODE_SIGNING' in tobj: + if tobj['CKA_TRUST_CODE_SIGNING'] == 'CKT_NSS_NOT_TRUSTED': + is_distrusted = True + elif tobj['CKA_TRUST_CODE_SIGNING'] == 'CKT_NSS_TRUSTED_DELEGATOR': + has_code_trust = True + + if is_distrusted: + trust_ext_oid = "1.3.6.1.4.1.3319.6.10.1" + trust_ext_value = "0.%06%0a%2b%06%01%04%01%99w%06%0a%01%04 0%1e%06%08%2b%06%01%05%05%07%03%04%06%08%2b%06%01%05%05%07%03%01%06%08%2b%06%01%05%05%07%03%03" + write_cert_ext_to_file(f, trust_ext_oid, trust_ext_value, pk) + + trust_ext_oid = "2.5.29.37" + if has_server_trust: + if has_email_trust: + if has_code_trust: + # server + email + code + trust_ext_value = "0%2a%06%03U%1d%25%01%01%ff%04 0%1e%06%08%2b%06%01%05%05%07%03%04%06%08%2b%06%01%05%05%07%03%01%06%08%2b%06%01%05%05%07%03%03" + else: + # server + email + trust_ext_value = "0 %06%03U%1d%25%01%01%ff%04%160%14%06%08%2b%06%01%05%05%07%03%04%06%08%2b%06%01%05%05%07%03%01" + else: + if has_code_trust: + # server + code + trust_ext_value = "0 %06%03U%1d%25%01%01%ff%04%160%14%06%08%2b%06%01%05%05%07%03%01%06%08%2b%06%01%05%05%07%03%03" + else: + # server + trust_ext_value = "0%16%06%03U%1d%25%01%01%ff%04%0c0%0a%06%08%2b%06%01%05%05%07%03%01" + else: + if has_email_trust: + if has_code_trust: + # email + code + trust_ext_value = "0 %06%03U%1d%25%01%01%ff%04%160%14%06%08%2b%06%01%05%05%07%03%04%06%08%2b%06%01%05%05%07%03%03" + else: + # email + trust_ext_value = "0%16%06%03U%1d%25%01%01%ff%04%0c0%0a%06%08%2b%06%01%05%05%07%03%04" + else: + if has_code_trust: + # code + trust_ext_value = "0%16%06%03U%1d%25%01%01%ff%04%0c0%0a%06%08%2b%06%01%05%05%07%03%03" + else: + # none + trust_ext_value = "0%18%06%03U%1d%25%01%01%ff%04%0e0%0c%06%0a%2b%06%01%04%01%99w%06%0a%10" + + # no 2.5.29.37 for neutral certificates + if (is_distrusted or has_server_trust or has_email_trust or has_code_trust): + write_cert_ext_to_file(f, trust_ext_oid, trust_ext_value, pk) + + pk = '' + f.write("\n") + + f.write("[p11-kit-object-v1]\n") + f.write("label: "); + f.write(tobj['CKA_LABEL']) + f.write("\n") + if is_distrusted: + f.write("x-distrusted: true\n") + elif has_server_trust or has_email_trust or has_code_trust: + f.write("trusted: true\n") + else: + f.write("trusted: false\n") + + # requires p11-kit >= 0.23.4 + f.write("nss-mozilla-ca-policy: true\n") + f.write("modifiable: false\n"); + + # requires p11-kit >= 0.23.19 + for t in list(cert_distrust_types.keys()): + if t in obj: + value = obj[t] + if value == 'CK_FALSE': + value = bytearray(1) + f.write(cert_distrust_types[t] + ": \"") + f.write(urllib.parse.quote(value)); + f.write("\"\n") + + f.write("-----BEGIN CERTIFICATE-----\n") + temp_encoded_b64 = base64.b64encode(obj['CKA_VALUE']) + temp_wrapped = textwrap.wrap(temp_encoded_b64.decode(), 64) + f.write("\n".join(temp_wrapped)) + f.write("\n-----END CERTIFICATE-----\n") + f.write(cert_comment) + f.write("\n") + + else: + f.write("[p11-kit-object-v1]\n") + f.write("label: "); + f.write(tobj['CKA_LABEL']); + f.write("\n") + f.write("class: certificate\n") + f.write("certificate-type: x-509\n") + f.write("modifiable: false\n"); + f.write("issuer: \""); + f.write(urllib.parse.quote(tobj['CKA_ISSUER'])); + f.write("\"\n") + f.write("serial-number: \""); + f.write(urllib.parse.quote(tobj['CKA_SERIAL_NUMBER'])); + f.write("\"\n") + if (tobj['CKA_TRUST_SERVER_AUTH'] == 'CKT_NSS_NOT_TRUSTED') or (tobj['CKA_TRUST_EMAIL_PROTECTION'] == 'CKT_NSS_NOT_TRUSTED') or (tobj['CKA_TRUST_CODE_SIGNING'] == 'CKT_NSS_NOT_TRUSTED'): + f.write("x-distrusted: true\n") + f.write("\n\n") + f.close() + print(" -> written as '%s', trust = %s, openssl-trust = %s, distrust = %s, openssl-distrust = %s" % (fname, trustbits, openssl_trustflags, distrustbits, openssl_distrustflags)) diff --git a/source-files/nss.patch b/source-files/nss.patch deleted file mode 100644 index 009184f..0000000 --- a/source-files/nss.patch +++ /dev/null @@ -1,266 +0,0 @@ -Submitted By: Xi Ruoyao -Date: 2020-08-22 -Initial Package Version: 3.12.4 -Upstream Status: Not applicable -Origin: Self, adjusted for nss-3.56. -Description: Adds auto-generated nss.pc and nss-config script, and - allows building without nspr in the source tree. - Minimum NSPR version is now read out from package, - instead of hardcoded value in the patch. - -diff --color -uNar nss-3.55.orig/nss/config/Makefile nss-3.55/nss/config/Makefile ---- nss-3.55.orig/nss/config/Makefile 1970-01-01 08:00:00.000000000 +0800 -+++ nss-3.55/nss/config/Makefile 2020-07-25 19:34:36.272982957 +0800 -@@ -0,0 +1,42 @@ -+CORE_DEPTH = .. -+DEPTH = .. -+ -+include $(CORE_DEPTH)/coreconf/config.mk -+ -+NSS_MAJOR_VERSION = `grep "NSS_VMAJOR" ../lib/nss/nss.h | awk '{print $$3}'` -+NSS_MINOR_VERSION = `grep "NSS_VMINOR" ../lib/nss/nss.h | awk '{print $$3}'` -+NSS_PATCH_VERSION = `grep "NSS_VPATCH" ../lib/nss/nss.h | awk '{print $$3}'` -+NSS_NSPR_MINIMUM = `head -n1 ../automation/release/nspr-version.txt` -+PREFIX = /usr -+ -+all: export libs -+ -+export: -+ # Create the nss.pc file -+ mkdir -p $(DIST)/lib/pkgconfig -+ sed -e "s,@prefix@,$(PREFIX)," \ -+ -e "s,@exec_prefix@,\$${prefix}," \ -+ -e "s,@libdir@,\$${prefix}/lib," \ -+ -e "s,@includedir@,\$${prefix}/include/nss," \ -+ -e "s,@NSS_MAJOR_VERSION@,$(NSS_MAJOR_VERSION),g" \ -+ -e "s,@NSS_MINOR_VERSION@,$(NSS_MINOR_VERSION)," \ -+ -e "s,@NSS_PATCH_VERSION@,$(NSS_PATCH_VERSION)," \ -+ -e "s,@NSS_NSPR_MINIMUM@,$(NSS_NSPR_MINIMUM)," \ -+ nss.pc.in > nss.pc -+ chmod 0644 nss.pc -+ ln -sf ../../../../nss/config/nss.pc $(DIST)/lib/pkgconfig -+ -+ # Create the nss-config script -+ mkdir -p $(DIST)/bin -+ sed -e "s,@prefix@,$(PREFIX)," \ -+ -e "s,@NSS_MAJOR_VERSION@,$(NSS_MAJOR_VERSION)," \ -+ -e "s,@NSS_MINOR_VERSION@,$(NSS_MINOR_VERSION)," \ -+ -e "s,@NSS_PATCH_VERSION@,$(NSS_PATCH_VERSION)," \ -+ nss-config.in > nss-config -+ chmod 0755 nss-config -+ ln -sf ../../../nss/config/nss-config $(DIST)/bin -+ -+libs: -+ -+dummy: all export libs -+ -diff --color -uNar nss-3.55.orig/nss/config/nss-config.in nss-3.55/nss/config/nss-config.in ---- nss-3.55.orig/nss/config/nss-config.in 1970-01-01 08:00:00.000000000 +0800 -+++ nss-3.55/nss/config/nss-config.in 2020-07-25 19:32:37.239032214 +0800 -@@ -0,0 +1,153 @@ -+#!/bin/sh -+ -+prefix=@prefix@ -+ -+major_version=@NSS_MAJOR_VERSION@ -+minor_version=@NSS_MINOR_VERSION@ -+patch_version=@NSS_PATCH_VERSION@ -+ -+usage() -+{ -+ cat <&2 -+fi -+ -+lib_nss=yes -+lib_nssutil=yes -+lib_smime=yes -+lib_ssl=yes -+lib_softokn=yes -+ -+while test $# -gt 0; do -+ case "$1" in -+ -*=*) optarg=`echo "$1" | sed 's/[-_a-zA-Z0-9]*=//'` ;; -+ *) optarg= ;; -+ esac -+ -+ case $1 in -+ --prefix=*) -+ prefix=$optarg -+ ;; -+ --prefix) -+ echo_prefix=yes -+ ;; -+ --exec-prefix=*) -+ exec_prefix=$optarg -+ ;; -+ --exec-prefix) -+ echo_exec_prefix=yes -+ ;; -+ --includedir=*) -+ includedir=$optarg -+ ;; -+ --includedir) -+ echo_includedir=yes -+ ;; -+ --libdir=*) -+ libdir=$optarg -+ ;; -+ --libdir) -+ echo_libdir=yes -+ ;; -+ --version) -+ echo ${major_version}.${minor_version}.${patch_version} -+ ;; -+ --cflags) -+ echo_cflags=yes -+ ;; -+ --libs) -+ echo_libs=yes -+ ;; -+ nss) -+ lib_nss=yes -+ ;; -+ nssutil) -+ lib_nssutil=yes -+ ;; -+ smime) -+ lib_smime=yes -+ ;; -+ ssl) -+ lib_ssl=yes -+ ;; -+ softokn) -+ lib_softokn=yes -+ ;; -+ *) -+ usage 1 1>&2 -+ ;; -+ esac -+ shift -+done -+ -+# Set variables that may be dependent upon other variables -+if test -z "$exec_prefix"; then -+ exec_prefix=`pkg-config --variable=exec_prefix nss` -+fi -+if test -z "$includedir"; then -+ includedir=`pkg-config --variable=includedir nss` -+fi -+if test -z "$libdir"; then -+ libdir=`pkg-config --variable=libdir nss` -+fi -+ -+if test "$echo_prefix" = "yes"; then -+ echo $prefix -+fi -+ -+if test "$echo_exec_prefix" = "yes"; then -+ echo $exec_prefix -+fi -+ -+if test "$echo_includedir" = "yes"; then -+ echo $includedir -+fi -+ -+if test "$echo_libdir" = "yes"; then -+ echo $libdir -+fi -+ -+if test "$echo_cflags" = "yes"; then -+ echo -I$includedir -+fi -+ -+if test "$echo_libs" = "yes"; then -+ libdirs="-L$libdir" -+ if test -n "$lib_nss"; then -+ libdirs="$libdirs -lnss${major_version}" -+ fi -+ if test -n "$lib_nssutil"; then -+ libdirs="$libdirs -lnssutil${major_version}" -+ fi -+ if test -n "$lib_smime"; then -+ libdirs="$libdirs -lsmime${major_version}" -+ fi -+ if test -n "$lib_ssl"; then -+ libdirs="$libdirs -lssl${major_version}" -+ fi -+ if test -n "$lib_softokn"; then -+ libdirs="$libdirs -lsoftokn${major_version}" -+ fi -+ echo $libdirs -+fi -+ -diff --color -uNar nss-3.55.orig/nss/config/nss.pc.in nss-3.55/nss/config/nss.pc.in ---- nss-3.55.orig/nss/config/nss.pc.in 1970-01-01 08:00:00.000000000 +0800 -+++ nss-3.55/nss/config/nss.pc.in 2020-07-25 19:33:05.958889937 +0800 -@@ -0,0 +1,12 @@ -+prefix=@prefix@ -+exec_prefix=@exec_prefix@ -+libdir=@libdir@ -+includedir=@includedir@ -+ -+Name: NSS -+Description: Network Security Services -+Version: @NSS_MAJOR_VERSION@.@NSS_MINOR_VERSION@.@NSS_PATCH_VERSION@ -+Requires: nspr >= @NSS_NSPR_MINIMUM@ -+Libs: -L@libdir@ -lnss@NSS_MAJOR_VERSION@ -lnssutil@NSS_MAJOR_VERSION@ -lsmime@NSS_MAJOR_VERSION@ -lssl@NSS_MAJOR_VERSION@ -lsoftokn@NSS_MAJOR_VERSION@ -+Cflags: -I${includedir} -+ -diff --color -uNar nss-3.55.orig/nss/Makefile nss-3.55/nss/Makefile ---- nss-3.55.orig/nss/Makefile 2020-07-24 23:10:32.000000000 +0800 -+++ nss-3.55/nss/Makefile 2020-07-25 19:32:37.239032214 +0800 -@@ -4,6 +4,8 @@ - # License, v. 2.0. If a copy of the MPL was not distributed with this - # file, You can obtain one at http://mozilla.org/MPL/2.0/. - -+default: nss_build_all -+ - ####################################################################### - # (1) Include initial platform-independent assignments (MANDATORY). # - ####################################################################### -@@ -48,12 +50,10 @@ - ####################################################################### - - nss_build_all: -- $(MAKE) build_nspr - $(MAKE) all - $(MAKE) latest - - nss_clean_all: -- $(MAKE) clobber_nspr - $(MAKE) clobber - - NSPR_CONFIG_STATUS = $(CORE_DEPTH)/../nspr/$(OBJDIR_NAME)/config.status -diff --color -uNar nss-3.55.orig/nss/manifest.mn nss-3.55/nss/manifest.mn ---- nss-3.55.orig/nss/manifest.mn 2020-07-24 23:10:32.000000000 +0800 -+++ nss-3.55/nss/manifest.mn 2020-07-25 19:32:37.240032237 +0800 -@@ -10,7 +10,7 @@ - - RELEASE = nss - --DIRS = coreconf lib cmd cpputil gtests -+DIRS = coreconf lib cmd cpputil gtests config - - lib: coreconf - cmd: lib diff --git a/source.sh b/source.sh index 3b06ce4..a6dfeec 100644 --- a/source.sh +++ b/source.sh @@ -5,30 +5,63 @@ # The prepare function is executed in the root of the temp directory # This function is used for putting downloaded files to the correct location or applying patches prepare() { - cd "$BPM_SOURCE" - # Patch from Beyond Linux from Scratch - patch -Np1 -i ../nss.patch + chmod +x "$BPM_WORKDIR"/bundle.sh + chmod +x "$BPM_WORKDIR"/certdata2pem.py + + mkdir "$BPM_SOURCE"/certs + ln -srft "$BPM_SOURCE"/certs "$BPM_SOURCE"/nss/lib/ckfw/builtins/{certdata.txt,nssckbi.h} } # The build function is executed in the source directory # This function is used to compile the source code build() { - cd nss - make BUILD_OPT=1 NSPR_INCLUDE_DIR=/usr/include/nspr USE_SYSTEM_ZLIB=1 ZLIB_LIBS=-lz NSS_ENABLE_WERROR=0 USE_64=1 NSS_USE_SYSTEM_SQLITE=1 + cd certs + "$BPM_WORKDIR"/certdata2pem.py + + cd .. + "$BPM_WORKDIR"/bundle.sh + + cd "$BPM_SOURCE"/nss + ./build.sh --disable-tests --enable-libpkix --opt --system-nspr --system-sqlite } # The package function is executed in the source directory # This function is used to move the compiled files into the output directory package() { - cd dist + local nsprver="$(pkg-config --modversion nspr)" + local libdir=/usr/lib includedir=/usr/include/nss - install -dm755 "$BPM_OUTPUT"/usr/{lib/pkgconfig,bin,include/nss} - install -Dm755 Linux*/lib/*.so "$BPM_OUTPUT"/usr/lib - install -Dm644 Linux*/lib/{*.chk,libcrmf.a} "$BPM_OUTPUT"/usr/lib - cp -v -RL {public,private}/nss/* "$BPM_OUTPUT"/usr/include/nss - install -Dm755 Linux*/bin/{certutil,nss-config,pk12util} "$BPM_OUTPUT"/usr/bin - install -Dm644 Linux*/lib/pkgconfig/nss.pc "$BPM_OUTPUT"/usr/lib/pkgconfig + sed nss/pkg/pkg-config/nss.pc.in \ + -e "s,%prefix%,/usr,g" \ + -e "s,%exec_prefix%,\${prefix},g" \ + -e "s,%libdir%,$libdir,g" \ + -e "s,%includedir%,$includedir,g" \ + -e "s,%NSPR_VERSION%,$nsprver,g" \ + -e "s,%NSS_VERSION%,$BPM_PKG_VERSION,g" | + install -Dm644 /dev/stdin "$BPM_OUTPUT"/"$libdir"/pkgconfig/nss.pc - ln -sf pkcs11/p11-kit-trust.so "$BPM_OUTPUT"/usr/lib/p11-kit-trust.so - ln -sf p11-kit-trust.so "$BPM_OUTPUT"/usr/lib/libnssckbi.so + install -Dt "$BPM_OUTPUT"/"$libdir" dist/Release/lib/*.so + + local vmajor vminor vpatch + { read vmajor; read vminor; read vpatch; } \ + < <(awk '/#define.*NSS_V(MAJOR|MINOR|PATCH)/ {print $3}' nss/lib/nss/nss.h) + + sed nss/pkg/pkg-config/nss-config.in \ + -e "s,@prefix@,/usr,g" \ + -e "s,@exec_prefix@,/usr,g" \ + -e "s,@libdir@,$libdir,g" \ + -e "s,@includedir@,$includedir,g" \ + -e "s,@MOD_MAJOR_VERSION@,$vmajor,g" \ + -e "s,@MOD_MINOR_VERSION@,$vminor,g" \ + -e "s,@MOD_PATCH_VERSION@,$vpatch,g" | + install -D /dev/stdin "$BPM_OUTPUT"/usr/bin/nss-config + + install -D dist/Release/bin/{*util,shlibsign,signtool,signver,ssltap} -t "$BPM_OUTPUT"/usr/bin + + install -Dm644 dist/public/nss/*.h -t "$BPM_OUTPUT"/"$includedir" + + install -Dm644 nss/doc/nroff/{*util,signtool,signver,ssltap}.1 -t "$BPM_OUTPUT"/usr/share/man/man1 + + # Replace built-in trust with p11-kit connection + ln -sf pkcs11/p11-kit-trust.so "$BPM_OUTPUT"/"$libdir"/libnssckbi.so }