[arch-commits] Commit in lib32-nss/repos (4 files)
Jan Steffens
heftig at archlinux.org
Fri Dec 6 20:10:57 UTC 2019
Date: Friday, December 6, 2019 @ 20:10:56
Author: heftig
Revision: 536060
archrelease: copy trunk to multilib-testing-x86_64
Added:
lib32-nss/repos/multilib-testing-x86_64/
lib32-nss/repos/multilib-testing-x86_64/PKGBUILD
(from rev 536059, lib32-nss/trunk/PKGBUILD)
lib32-nss/repos/multilib-testing-x86_64/no-plt.diff
(from rev 536059, lib32-nss/trunk/no-plt.diff)
lib32-nss/repos/multilib-testing-x86_64/nss-3.47-certdb-temp-cert.patch
(from rev 536059, lib32-nss/trunk/nss-3.47-certdb-temp-cert.patch)
---------------------------------+
PKGBUILD | 64 +++++++++++++++++++++++++++++++++++
no-plt.diff | 48 ++++++++++++++++++++++++++
nss-3.47-certdb-temp-cert.patch | 68 ++++++++++++++++++++++++++++++++++++++
3 files changed, 180 insertions(+)
Copied: lib32-nss/repos/multilib-testing-x86_64/PKGBUILD (from rev 536059, lib32-nss/trunk/PKGBUILD)
===================================================================
--- multilib-testing-x86_64/PKGBUILD (rev 0)
+++ multilib-testing-x86_64/PKGBUILD 2019-12-06 20:10:56 UTC (rev 536060)
@@ -0,0 +1,64 @@
+# Maintainer: Daniel Wallace <danielwallace at gtmanfred dot com>
+# Contributor: kfgz <kfgz at interia pl>
+# Contributor: Ionut Biru <ibiru at archlinux dot org>
+
+pkgname=lib32-nss
+pkgver=3.48
+pkgrel=1
+pkgdesc="Network Security Services (32-bit)"
+url="https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS"
+arch=(x86_64)
+license=(MPL GPL)
+_nsprver=4.20
+depends=("lib32-nspr>=${_nsprver}" lib32-sqlite lib32-zlib lib32-p11-kit nss)
+makedepends=(perl python2 gyp)
+source=("https://ftp.mozilla.org/pub/security/nss/releases/NSS_${pkgver//./_}_RTM/src/nss-${pkgver}.tar.gz"
+ nss-3.47-certdb-temp-cert.patch
+ no-plt.diff)
+sha256sums=('3f9c822a86a4e3e1bfe63e2ed0f922d8b7c2e0b7cafe36774b1c627970d0f8ac'
+ 'bd16ba87e5ea736888f76dd54dff18b25ca6608245c0195fb85bad3d782db73c'
+ 'ea8e1b871c0f1dd29cdea1b1a2e7f47bf4713e2ae7b947ec832dba7dfcc67daa')
+
+prepare() {
+ mkdir path
+
+ ln -s /usr/bin/python2 path/python
+
+ cd nss-$pkgver
+
+ # https://bugzilla.mozilla.org/show_bug.cgi?id=1382942
+ patch -Np2 -i ../no-plt.diff
+
+ # https://bugzilla.mozilla.org/show_bug.cgi?id=1593167
+ patch -d nss -Np1 < ../nss-3.47-certdb-temp-cert.patch
+}
+
+build() {
+ export PKG_CONFIG_PATH=/usr/lib32/pkgconfig
+
+ cd nss-$pkgver/nss
+ PATH="$srcdir/path:$PATH" bash -x ./build.sh -v \
+ --m32 --opt --system-sqlite --system-nspr --enable-libpkix --disable-tests
+}
+
+package() {
+ cd nss-$pkgver
+
+ sed nss/pkg/pkg-config/nss.pc.in \
+ -e "s,%libdir%,/usr/lib32,g" \
+ -e "s,%prefix%,/usr,g" \
+ -e "s,%exec_prefix%,/usr/bin,g" \
+ -e "s,%includedir%,/usr/include/nss,g" \
+ -e "s,%NSPR_VERSION%,$_nsprver,g" \
+ -e "s,%NSS_VERSION%,$pkgver,g" |
+ install -Dm644 /dev/stdin "$pkgdir/usr/lib32/pkgconfig/nss.pc"
+
+ ln -s nss.pc "$pkgdir/usr/lib32/pkgconfig/mozilla-nss.pc"
+
+ cd dist/Release/lib
+ install -Dt "$pkgdir/usr/lib32" *.so
+ install -Dt "$pkgdir/usr/lib32" -m644 *.chk
+
+ # Replace built-in trust with p11-kit connection
+ ln -sf libnssckbi-p11-kit.so "$pkgdir/usr/lib32/libnssckbi.so"
+}
Copied: lib32-nss/repos/multilib-testing-x86_64/no-plt.diff (from rev 536059, lib32-nss/trunk/no-plt.diff)
===================================================================
--- multilib-testing-x86_64/no-plt.diff (rev 0)
+++ multilib-testing-x86_64/no-plt.diff 2019-12-06 20:10:56 UTC (rev 536060)
@@ -0,0 +1,48 @@
+diff --git i/security/nss/lib/freebl/mpi/mpi_x86.s w/security/nss/lib/freebl/mpi/mpi_x86.s
+index 8f7e2130c3264754..b3ca1ce5b41b3771 100644
+--- i/security/nss/lib/freebl/mpi/mpi_x86.s
++++ w/security/nss/lib/freebl/mpi/mpi_x86.s
+@@ -22,22 +22,41 @@ is_sse: .long -1
+ #
+ .ifndef NO_PIC
+ .macro GET var,reg
+- movl \var at GOTOFF(%ebx),\reg
++ call thunk.ax
++ addl $_GLOBAL_OFFSET_TABLE_, %eax
++ movl \var at GOTOFF(%eax),\reg
+ .endm
+ .macro PUT reg,var
+- movl \reg,\var at GOTOFF(%ebx)
++ call thunk.dx
++ addl $_GLOBAL_OFFSET_TABLE_, %edx
++ movl \reg,\var at GOTOFF(%edx)
+ .endm
+ .else
+ .macro GET var,reg
+ movl \var,\reg
+ .endm
+ .macro PUT reg,var
+ movl \reg,\var
+ .endm
+ .endif
+
+ .text
+
++.ifndef NO_PIC
++.globl thunk.ax
++.hidden thunk.ax
++.type thunk.ax, @function
++thunk.ax:
++ movl (%esp),%eax
++ ret
++
++.globl thunk.dx
++.hidden thunk.dx
++.type thunk.dx, @function
++thunk.dx:
++ movl (%esp),%edx
++ ret
++.endif
+
+ # ebp - 36: caller's esi
+ # ebp - 32: caller's edi
Copied: lib32-nss/repos/multilib-testing-x86_64/nss-3.47-certdb-temp-cert.patch (from rev 536059, lib32-nss/trunk/nss-3.47-certdb-temp-cert.patch)
===================================================================
--- multilib-testing-x86_64/nss-3.47-certdb-temp-cert.patch (rev 0)
+++ multilib-testing-x86_64/nss-3.47-certdb-temp-cert.patch 2019-12-06 20:10:56 UTC (rev 536060)
@@ -0,0 +1,68 @@
+From 9530978d1552674792e281391100269305a38c47 Mon Sep 17 00:00:00 2001
+From: Daiki Ueno <dueno at redhat.com>
+Date: Fri, 6 Dec 2019 10:47:01 +0100
+Subject: [PATCH] Bug 1593167, certdb: propagate trust information if trust
+ module is loaded afterwards, r=rrelyea,keeler
+
+Summary:
+When the builtin trust module is loaded after some temp certs being created, these temp certs are usually not accompanied by trust information. This causes a problem in Firefox as it loads the module from a separate thread while accessing the network cache which populates temp certs.
+
+This change makes it properly roll up the trust information, if a temp cert doesn't have trust information.
+
+Reviewers: rrelyea, keeler
+
+Reviewed By: rrelyea, keeler
+
+Subscribers: reviewbot, heftig
+
+Bug #: 1593167
+
+Differential Revision: https://phabricator.services.mozilla.com/D54726
+---
+ lib/pki/pki3hack.c | 30 ++++++++++++++++++++++--------
+ 1 file changed, 22 insertions(+), 8 deletions(-)
+
+diff --git a/lib/pki/pki3hack.c b/lib/pki/pki3hack.c
+index 29d2fb5a40..eac4a5705e 100644
+--- a/lib/pki/pki3hack.c
++++ b/lib/pki/pki3hack.c
+@@ -921,14 +921,28 @@ stan_GetCERTCertificate(NSSCertificate *c, PRBool forceUpdate)
+ }
+ if (!cc->nssCertificate || forceUpdate) {
+ fill_CERTCertificateFields(c, cc, forceUpdate);
+- } else if (CERT_GetCertTrust(cc, &certTrust) != SECSuccess &&
+- !c->object.cryptoContext) {
+- /* if it's a perm cert, it might have been stored before the
+- * trust, so look for the trust again. But a temp cert can be
+- * ignored.
+- */
+- CERTCertTrust *trust = NULL;
+- trust = nssTrust_GetCERTCertTrustForCert(c, cc);
++ } else if (CERT_GetCertTrust(cc, &certTrust) != SECSuccess) {
++ CERTCertTrust *trust;
++ if (!c->object.cryptoContext) {
++ /* If it's a perm cert, it might have been stored before the
++ * trust, so look for the trust again.
++ */
++ trust = nssTrust_GetCERTCertTrustForCert(c, cc);
++ } else {
++ /* If it's a temp cert, it might have been stored before the
++ * builtin trust module is loaded, so look for the trust
++ * again, but don't set the empty trust if it is not found.
++ */
++ NSSTrust *t = nssTrustDomain_FindTrustForCertificate(c->object.cryptoContext->td, c);
++ if (!t) {
++ goto loser;
++ }
++ trust = cert_trust_from_stan_trust(t, cc->arena);
++ nssTrust_Destroy(t);
++ if (!trust) {
++ goto loser;
++ }
++ }
+
+ CERT_LockCertTrust(cc);
+ cc->trust = trust;
+--
+2.24.0
+
More information about the arch-commits
mailing list