mailarchive of the ptxdist mailing list
 help / color / mirror / Atom feed
From: "Sven Püschel" <s.pueschel@pengutronix.de>
To: ptxdist@pengutronix.de
Cc: "Sven Püschel" <s.pueschel@pengutronix.de>
Subject: [ptxdist] [PATCH 2/3] nss: version bump 3.130 -> 3.131.1
Date: Wed, 21 Oct 2026 11:51:39 +0200	[thread overview]
Message-ID: <20261021-fixemudhra-v1-2-36306b489b2e@pengutronix.de> (raw)
In-Reply-To: <20261021-fixemudhra-v1-0-36306b489b2e@pengutronix.de>

Bunch of bugfixes in 3.131
https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_131.html

With 3.131.1 they only dropped the certs related to the
eMudhra Intermediate CA Compromise [1]:
https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/vSxZxnOMMvs

Also dropped the patch adding a pc file and instead using the already
included PC file and adjusting it's variables with a sed command line.
This is based on the ArchLinux build script [2], but a similar sed can
also be found in `nss/build.sh`.

[1] https://emudhra.we-have-a-problem.com/
[2] https://gitlab.archlinux.org/archlinux/packaging/packages/nss/-/blob/f01ebfe4f1024af88a59c25586729956591abac0/PKGBUILD#L68

Signed-off-by: Sven Püschel <s.pueschel@pengutronix.de>
---
 patches/nss-3.130/0002-add-nss.pc.in.patch         | 27 ----------------------
 patches/nss-3.130/series                           |  8 -------
 .../0001-nss-fix-nsinstall-build.patch             |  0
 ...HACK-don-t-build-commands-that-need-zlib.patch} |  0
 .../0003-HACK-fix-parallel-building-issue.patch}   |  0
 .../0004-fix-dependency-generation.patch}          |  0
 patches/nss-3.131.1/series                         |  7 ++++++
 rules/nss.make                                     | 14 +++++++----
 8 files changed, 17 insertions(+), 39 deletions(-)

diff --git a/patches/nss-3.130/0002-add-nss.pc.in.patch b/patches/nss-3.130/0002-add-nss.pc.in.patch
deleted file mode 100644
index addc805b5d39543f587febae968680276a62470b..0000000000000000000000000000000000000000
--- a/patches/nss-3.130/0002-add-nss.pc.in.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From: Lucas Stach <l.stach@pengutronix.de>
-Date: Tue, 12 Apr 2016 11:36:26 +0200
-Subject: [PATCH] add nss.pc.in
-
-Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
----
- nss/nss.pc.in | 11 +++++++++++
- 1 file changed, 11 insertions(+)
- create mode 100644 nss/nss.pc.in
-
-diff --git a/nss/nss.pc.in b/nss/nss.pc.in
-new file mode 100644
-index 000000000000..b80838f8ca0d
---- /dev/null
-+++ b/nss/nss.pc.in
-@@ -0,0 +1,11 @@
-+prefix=/usr
-+exec_prefix=${prefix}
-+libdir=${prefix}/lib
-+includedir=${prefix}/include/nss
-+
-+Name: NSS
-+Description: Mozilla Network Security Services
-+Version: @VERSION@
-+Requires: nspr
-+Libs: -lnss3 -lnssutil3 -lsmime3 -lssl3
-+Cflags: -I${includedir}
diff --git a/patches/nss-3.130/series b/patches/nss-3.130/series
deleted file mode 100644
index 534d0d6d69f823d512f432093a912eb00ff7a666..0000000000000000000000000000000000000000
--- a/patches/nss-3.130/series
+++ /dev/null
@@ -1,8 +0,0 @@
-# generated by git-ptx-patches
-#tag:base --start-number 1
-0001-nss-fix-nsinstall-build.patch
-0002-add-nss.pc.in.patch
-0003-HACK-don-t-build-commands-that-need-zlib.patch
-0004-HACK-fix-parallel-building-issue.patch
-0005-fix-dependency-generation.patch
-# 51749efb4fc421b49999aad3745d75b9  - git-ptx-patches magic
diff --git a/patches/nss-3.130/0001-nss-fix-nsinstall-build.patch b/patches/nss-3.131.1/0001-nss-fix-nsinstall-build.patch
similarity index 100%
rename from patches/nss-3.130/0001-nss-fix-nsinstall-build.patch
rename to patches/nss-3.131.1/0001-nss-fix-nsinstall-build.patch
diff --git a/patches/nss-3.130/0003-HACK-don-t-build-commands-that-need-zlib.patch b/patches/nss-3.131.1/0002-HACK-don-t-build-commands-that-need-zlib.patch
similarity index 100%
rename from patches/nss-3.130/0003-HACK-don-t-build-commands-that-need-zlib.patch
rename to patches/nss-3.131.1/0002-HACK-don-t-build-commands-that-need-zlib.patch
diff --git a/patches/nss-3.130/0004-HACK-fix-parallel-building-issue.patch b/patches/nss-3.131.1/0003-HACK-fix-parallel-building-issue.patch
similarity index 100%
rename from patches/nss-3.130/0004-HACK-fix-parallel-building-issue.patch
rename to patches/nss-3.131.1/0003-HACK-fix-parallel-building-issue.patch
diff --git a/patches/nss-3.130/0005-fix-dependency-generation.patch b/patches/nss-3.131.1/0004-fix-dependency-generation.patch
similarity index 100%
rename from patches/nss-3.130/0005-fix-dependency-generation.patch
rename to patches/nss-3.131.1/0004-fix-dependency-generation.patch
diff --git a/patches/nss-3.131.1/series b/patches/nss-3.131.1/series
new file mode 100644
index 0000000000000000000000000000000000000000..ed1f6706e1f31ed11d93ed6918ecae72fce35707
--- /dev/null
+++ b/patches/nss-3.131.1/series
@@ -0,0 +1,7 @@
+# generated by git-ptx-patches
+#tag:base --start-number 1
+0001-nss-fix-nsinstall-build.patch
+0002-HACK-don-t-build-commands-that-need-zlib.patch
+0003-HACK-fix-parallel-building-issue.patch
+0004-fix-dependency-generation.patch
+# ea27330855ed3ed4aac49b9ec8451c08  - git-ptx-patches magic
diff --git a/rules/nss.make b/rules/nss.make
index 61c4b102c04219e218fb950943679204ec01f501..147d311f24abaeaa90833efb13239451393a965a 100644
--- a/rules/nss.make
+++ b/rules/nss.make
@@ -14,8 +14,8 @@ PACKAGES-$(PTXCONF_NSS) += nss
 #
 # Paths and names
 #
-NSS_VERSION	:= 3.130
-NSS_SHA256	:= afab9f82c78bfa3e7e8b4a61ac31922675c58203f67ff385a2714df7fe9bd5c5
+NSS_VERSION	:= 3.131.1
+NSS_SHA256	:= b1dbc1d9e7f3f8455dfb6d58ec8f7229d8a8450c629a9e69ef2ef6081f359056
 NSS		:= nss-$(NSS_VERSION)
 NSS_SUFFIX	:= tar.gz
 NSS_URL		:= https://ftp.mozilla.org/pub/security/nss/releases/NSS_$(subst .,_,$(NSS_VERSION))_RTM/src/$(NSS).$(NSS_SUFFIX)
@@ -96,8 +96,14 @@ $(STATEDIR)/nss.install:
 			$(NSS_PKGDIR)/usr/lib/$(lib).so$(ptx/nl))
 
 	install -d $(NSS_PKGDIR)/usr/lib/pkgconfig/
-	VERSION=$(NSS_VERSION) ptxd_replace_magic \
-		$(NSS_DIR)/nss/nss.pc.in > $(NSS_PKGDIR)/usr/lib/pkgconfig/nss.pc
+	sed "$(NSS_DIR)/nss/pkg/pkg-config/nss.pc.in" \
+		-e "s,%prefix%,/usr,g" \
+		-e "s,%exec_prefix%,$${prefix},g" \
+		-e "s,%libdir%,/usr/lib,g" \
+		-e "s,%includedir%,/usr/include/nss,g" \
+		-e "s,%NSPR_VERSION%,$(NSPR_VERSION),g" \
+		-e "s,%NSS_VERSION%,$(NSS_VERSION),g" \
+		> "$(NSS_PKGDIR)/usr/lib/pkgconfig/nss.pc"
 
 	@install -v -d $(NSS_PKGDIR)/usr/include/nss
 	@install -v -m 644 -t $(NSS_PKGDIR)/usr/include/nss $(NSS_DIR)/dist/public/nss/*

-- 
2.47.3




  parent reply	other threads:[~2026-10-21  9:52 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-10-21  9:51 [ptxdist] [PATCH 0/3] nss/nspr: Update to fix the eMudhra Intermediate CA Compromise Sven Püschel
2026-10-21  9:51 ` [ptxdist] [PATCH 1/3] nspr: version bump 4.37 -> 4.40 Sven Püschel
2026-10-21  9:51 ` Sven Püschel [this message]
2026-10-26  7:57   ` [ptxdist] [PATCH 2/3] nss: version bump 3.130 -> 3.131.1 Michael Olbrich
2026-10-21  9:51 ` [ptxdist] [PATCH 3/3] ca-certificates: version bump 3_130 -> 3_131_1 Sven Püschel

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20261021-fixemudhra-v1-2-36306b489b2e@pengutronix.de \
    --to=s.pueschel@pengutronix.de \
    --cc=ptxdist@pengutronix.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox