12982d4c82
Changelog:
New Functions
in pk11pub.h:
PK11_FindRawCertsWithSubject - Finds all certificates on the given
slot with the given subject distinguished name and returns them as DER bytes.
If no such certificates can be found, returns SECSuccess and sets *results to
NULL. If a failure is encountered while fetching any of the matching
certificates, SECFailure is returned and *results will be NULL.
Notable Changes in NSS 3.45
Bug 1540403 - Implement Delegated Credentials (draft-ietf-tls-subcerts)
This adds a new experimental function: SSL_DelegateCredential
Note: In 3.45, selfserv does not yet support delegated credentials.
See Bug 1548360.
Note: In 3.45 the SSLChannelInfo is left unmodified, while an upcoming
change in 3.46 will set SSLChannelInfo.authKeyBits to that of the delegated
credential for better policy enforcement. See Bug 1563078.
Bug 1550579 - Replace ARM32 Curve25519 implementation with one from
fiat-crypto
Bug 1551129 - Support static linking on Windows
Bug 1552262 - Expose a function PK11_FindRawCertsWithSubject for finding
certificates with a given subject on a given slot
Bug 1546229 - Add IPSEC IKE support to softoken
Bug 1554616 - Add support for the Elbrus lcc compiler (<=1.23)
Bug 1543874 - Expose an external clock for SSL
This adds new experimental functions: SSL_SetTimeFunc,
SSL_CreateAntiReplayContext, SSL_SetAntiReplayContext, and
SSL_ReleaseAntiReplayContext.
The experimental function SSL_InitAntiReplay is removed.
Bug 1546477 - Various changes in response to the ongoing FIPS review
Note: The source package size has increased substantially due to the
new FIPS test vectors. This will likely prompt follow-on work, but please
accept our apologies in the meantime.
Certificate Authority Changes
The following CA certificates were Removed:
Bug 1552374 - CN = Certinomis - Root CA
SHA-256 Fingerprint:
2A99F5BC1174B73CBB1D620884E01C34E51CCB3978DA125F0E33268883BF4158
Bugs fixed in NSS 3.45
Bug 1540541 - Don't unnecessarily strip leading 0's from key material
during PKCS11 import (CVE-2019-11719)
Bug 1515342 - More thorough input checking (CVE-2019-11729)
Bug 1552208 - Prohibit use of RSASSA-PKCS1-v1_5 algorithms in TLS 1.3
(CVE-2019-11727)
Bug 1227090 - Fix a potential divide-by-zero in makePfromQandSeed from
lib/freebl/pqg.c (static analysis)
Bug 1227096 - Fix a potential divide-by-zero in PQG_VerifyParams from
lib/freebl/pqg.c (static analysis)
Bug 1509432 - De-duplicate code between mp_set_long and mp_set_ulong
Bug 1515011 - Fix a mistake with ChaCha20-Poly1305 test code where tags
could be faked. Only relevant for clients that might have copied the unit test
code verbatim
Bug 1550022 - Ensure nssutil3 gets built on Android
Bug 1528174 - ChaCha20Poly1305 should no longer modify output length on
failure
Bug 1549382 - Don't leak in PKCS#11 modules if C_GetSlotInfo() returns
error
Bug 1551041 - Fix builds using GCC < 4.3 on big-endian architectures
Bug 1554659 - Add versioning to OpenBSD builds to fix link time errors
using NSS
Bug 1553443 - Send session ticket only after handshake is marked as
finished
Bug 1550708 - Fix gyp scripts on Solaris SPARC so that
libfreebl_64fpu_3.so builds
Bug 1554336 - Optimize away unneeded loop in mpi.c
Bug 1559906 - fipstest: use CKM_TLS12_MASTER_KEY_DERIVE instead of vendor
specific mechanism
Bug 1558126 - TLS_AES_256_GCM_SHA384 should be marked as FIPS compatible
Bug 1555207 - HelloRetryRequestCallback return code for rejecting 0-RTT
Bug 1556591 - Eliminate races in uses of PK11_SetWrapKey
Bug 1558681 - Stop using a global for anti-replay of TLS 1.3 early data
Bug 1561510 - Fix a bug where removing -arch XXX args from CC didn't work
Bug 1561523 - Add a string for the new-ish error
SSL_ERROR_MISSING_POST_HANDSHAKE_AUTH_EXTENSION
141 lines
4.7 KiB
Makefile
141 lines
4.7 KiB
Makefile
# $NetBSD: Makefile,v 1.169 2019/07/30 12:18:43 ryoon Exp $
|
|
|
|
DISTNAME= nss-${NSS_RELEASE:S/.0$//}
|
|
NSS_RELEASE= 3.45.0
|
|
CATEGORIES= security
|
|
MASTER_SITES= ${MASTER_SITE_MOZILLA_ALL:=security/nss/releases/NSS_${NSS_DIST_DIR_VERSION:S/_0$//}_RTM/src/}
|
|
|
|
MAINTAINER= pkgsrc-users@NetBSD.org
|
|
HOMEPAGE= http://www.mozilla.org/projects/security/pki/nss/
|
|
COMMENT= Libraries to support development of security-enabled applications
|
|
LICENSE= mpl-2.0
|
|
|
|
CHECK_PORTABILITY_SKIP+= nss/tests/libpkix/libpkix.sh
|
|
CHECK_PORTABILITY_SKIP+= nss/tests/multinit/multinit.sh
|
|
CHECK_PORTABILITY_SKIP+= js/src/configure
|
|
CHECK_PORTABILITY_SKIP+= configure
|
|
|
|
CTF_SUPPORTED= no # https://smartos.org/bugview/OS-6510
|
|
|
|
USE_GCC_RUNTIME= yes
|
|
USE_LANGUAGES= c99
|
|
USE_TOOLS+= gmake perl pax pkg-config
|
|
MAKE_JOBS_SAFE= no
|
|
|
|
BUILD_DIRS= nss
|
|
|
|
.include "../../mk/bsd.prefs.mk"
|
|
|
|
SUBST_CLASSES.Darwin+= exec_path
|
|
SUBST_STAGE.exec_path= pre-configure
|
|
SUBST_MESSAGE.exec_path= Fixing @executable_path
|
|
SUBST_FILES.exec_path= nss/coreconf/Darwin.mk
|
|
SUBST_SED.exec_path= -e 's,@executable_path,${PREFIX}/lib/nss,g'
|
|
|
|
SUBST_CLASSES+= zlib
|
|
SUBST_STAGE.zlib= pre-configure
|
|
SUBST_MESSAGE.zlib= Use ZLIB_LIBS from environment
|
|
SUBST_FILES.zlib= nss/coreconf/*.mk
|
|
SUBST_SED.zlib= -e 's,^ZLIB_LIBS,\#ZLIB_LIBS,g'
|
|
|
|
BUILDLINK_TRANSFORM+= rm:-Werror
|
|
BUILDLINK_TRANSFORM+= rm:-ansi
|
|
|
|
MAKE_ENV.Linux+= FREEBL_NO_DEPEND=0
|
|
|
|
.if ${OBJECT_FMT} == "ELF"
|
|
SO_SUFFIX= so
|
|
.elif ${OBJECT_FMT} == "Mach-O"
|
|
SO_SUFFIX= dylib
|
|
.else
|
|
SO_SUFFIX= so.1.0
|
|
.endif
|
|
PLIST_SUBST+= SO_SUFFIX=${SO_SUFFIX:Q}
|
|
|
|
.if !empty(PKGSRC_COMPILER:Mclang) || !empty(PKGSRC_COMPILER:Mgcc)
|
|
MAKE_ENV.SunOS+= NS_USE_GCC=YES
|
|
.endif
|
|
|
|
.if !empty(PKGSRC_COMPILER:Mclang)
|
|
MAKE_ENV.SunOS+= CC_IS_CLANG=YES
|
|
.endif
|
|
|
|
SUBST_CLASSES+= 64bit
|
|
SUBST_STAGE.64bit= pre-configure
|
|
SUBST_FILES.64bit= nss/lib/freebl/*
|
|
SUBST_SED.64bit= -e 's,NSS_USE_64,_LP64,g'
|
|
SUBST_MESSAGE.64bit= Use a generic 64bit check
|
|
|
|
# Just to be safe, do this as well as the _LP64 replacement
|
|
# NSS has a lot more logic for USE_64
|
|
.for platform in ${LP64PLATFORMS}
|
|
. if ${MACHINE_PLATFORM:M${platform}}
|
|
MAKE_ENV+= USE_64=1
|
|
. endif
|
|
.endfor
|
|
|
|
MAKE_ENV+= BUILD_OPT=1
|
|
#MAKE_ENV+= OPTIMIZER=${CFLAGS:Q}
|
|
MAKE_ENV+= INCLUDES=-I${BUILDLINK_PREFIX.nspr}/include/nspr
|
|
MAKE_ENV+= NSS_USE_SYSTEM_SQLITE=1
|
|
MAKE_ENV+= ZLIB_LIBS="${COMPILER_RPATH_FLAG}${BUILDLINK_PREFIX.zlib}/lib -L${BUILDLINK_PREFIX.zlib}/lib -lz"
|
|
MAKE_ENV+= USE_SYSTEM_ZLIB=1
|
|
MAKE_ENV+= EXTRA_SHARED_LIBS="${COMPILER_RPATH_FLAG}${BUILDLINK_PREFIX.nspr}/lib/nspr ${COMPILER_RPATH_FLAG}${PREFIX}/lib/nss -L${BUILDLINK_PREFIX.nspr}/lib/nspr -lplc4 -lplds4 -lnspr4 "${LDFLAGS:Q}
|
|
MAKE_ENV+= NSS_DISABLE_GTESTS=yes
|
|
MAKE_ENV+= NSS_ENABLE_TLS_1_3=1
|
|
.include "../../mk/compiler.mk"
|
|
.if !empty(CC_VERSION:Mgcc-4.[0-7]*)
|
|
CFLAGS+= -DNSS_NO_GCC48
|
|
.endif
|
|
|
|
NSS_MAJOR_VERSION= ${NSS_RELEASE:C/\.[0-9.]*//}
|
|
NSS_MINOR_VERSION= ${NSS_RELEASE:S/3.//:C/\.[0-9]*//}
|
|
NSS_PATCH_VERSION= ${NSS_RELEASE:C/[0-9.]*\.//}
|
|
NSS_DIST_DIR_VERSION= ${NSS_MAJOR_VERSION}_${NSS_MINOR_VERSION}_${NSS_PATCH_VERSION}
|
|
|
|
|
|
SUBST_CLASSES+= config
|
|
SUBST_VARS.config= PREFIX
|
|
SUBST_VARS.config+= NSS_MAJOR_VERSION
|
|
SUBST_VARS.config+= NSS_MINOR_VERSION
|
|
SUBST_VARS.config+= NSS_PATCH_VERSION
|
|
SUBST_VARS.config+= COMPILER_RPATH_FLAG
|
|
SUBST_SED.config+= -e "s,@PTHREAD@,${BUILDLINK_LIBS.pthread:Q},"
|
|
SUBST_STAGE.config= pre-build
|
|
SUBST_MESSAGE.config= Preparing *-config files.
|
|
SUBST_FILES.config+= nss.pc nss-config
|
|
|
|
INSTALLATION_DIRS= bin include/nss lib/nss lib/pkgconfig
|
|
DIST= ${WRKSRC}/dist
|
|
|
|
INSTALL_CMDS+= certutil cmsutil crlutil derdump makepqg \
|
|
mangle modutil ocspclnt oidcalc p7content p7env p7sign \
|
|
p7verify pk12util rsaperf shlibsign signtool signver \
|
|
ssltap strsclnt symkeyutil vfychain vfyserv
|
|
|
|
post-extract:
|
|
find ${WRKSRC} -type f | xargs ${CHMOD} 644
|
|
find ${WRKSRC} -type d | xargs ${CHMOD} 755
|
|
${CP} ${FILESDIR}/nss.pc.in ${WRKSRC}/nss.pc
|
|
${CP} ${FILESDIR}/nss-config.in ${WRKSRC}/nss-config
|
|
|
|
do-install:
|
|
(cd ${DIST}/public && pax -Lrw . ${DESTDIR}${PREFIX}/include/nss/ )
|
|
(cd ${DIST}/*_OPT.OBJ/lib && \
|
|
pax -Lrw *.${SO_SUFFIX} ${DESTDIR}${PREFIX}/lib/nss/ )
|
|
${INSTALL_LIB} ${DIST}/*_OPT.OBJ/lib/libcrmf.a \
|
|
${DESTDIR}${PREFIX}/lib/nss/
|
|
${INSTALL_DATA} ${WRKSRC}/nss.pc ${DESTDIR}${PREFIX}/lib/pkgconfig/nss.pc
|
|
${INSTALL_SCRIPT} ${WRKSRC}/nss-config ${DESTDIR}${PREFIX}/bin/nss-config
|
|
.for cmd in ${INSTALL_CMDS}
|
|
${INSTALL_PROGRAM} ${DIST}/*_OPT.OBJ/bin/${cmd} ${DESTDIR}${PREFIX}/bin
|
|
.endfor
|
|
|
|
# For consistency of libxul.so link in www/firefox.
|
|
BUILDLINK_API_DEPENDS.sqlite3+= sqlite3>=3.8.4.2
|
|
.include "../../databases/sqlite3/buildlink3.mk"
|
|
BUILDLINK_API_DEPENDS.nspr+= nspr>=4.19
|
|
.include "../../devel/nspr/buildlink3.mk"
|
|
.include "../../devel/zlib/buildlink3.mk"
|
|
.include "../../mk/pthread.buildlink3.mk"
|
|
.include "../../mk/bsd.pkg.mk"
|