From: "Sven Püschel" <s.pueschel@pengutronix.de>
To: ptxdist@pengutronix.de
Cc: "Sven Püschel" <s.pueschel@pengutronix.de>
Subject: [ptxdist] [PATCH 2/3] nss: version bump 3.130 -> 3.131.1
Date: Wed, 21 Oct 2026 11:51:39 +0200 [thread overview]
Message-ID: <20261021-fixemudhra-v1-2-36306b489b2e@pengutronix.de> (raw)
In-Reply-To: <20261021-fixemudhra-v1-0-36306b489b2e@pengutronix.de>
Bunch of bugfixes in 3.131
https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_131.html
With 3.131.1 they only dropped the certs related to the
eMudhra Intermediate CA Compromise [1]:
https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/vSxZxnOMMvs
Also dropped the patch adding a pc file and instead using the already
included PC file and adjusting it's variables with a sed command line.
This is based on the ArchLinux build script [2], but a similar sed can
also be found in `nss/build.sh`.
[1] https://emudhra.we-have-a-problem.com/
[2] https://gitlab.archlinux.org/archlinux/packaging/packages/nss/-/blob/f01ebfe4f1024af88a59c25586729956591abac0/PKGBUILD#L68
Signed-off-by: Sven Püschel <s.pueschel@pengutronix.de>
---
patches/nss-3.130/0002-add-nss.pc.in.patch | 27 ----------------------
patches/nss-3.130/series | 8 -------
.../0001-nss-fix-nsinstall-build.patch | 0
...HACK-don-t-build-commands-that-need-zlib.patch} | 0
.../0003-HACK-fix-parallel-building-issue.patch} | 0
.../0004-fix-dependency-generation.patch} | 0
patches/nss-3.131.1/series | 7 ++++++
rules/nss.make | 14 +++++++----
8 files changed, 17 insertions(+), 39 deletions(-)
diff --git a/patches/nss-3.130/0002-add-nss.pc.in.patch b/patches/nss-3.130/0002-add-nss.pc.in.patch
deleted file mode 100644
index addc805b5d39543f587febae968680276a62470b..0000000000000000000000000000000000000000
--- a/patches/nss-3.130/0002-add-nss.pc.in.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From: Lucas Stach <l.stach@pengutronix.de>
-Date: Tue, 12 Apr 2016 11:36:26 +0200
-Subject: [PATCH] add nss.pc.in
-
-Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
----
- nss/nss.pc.in | 11 +++++++++++
- 1 file changed, 11 insertions(+)
- create mode 100644 nss/nss.pc.in
-
-diff --git a/nss/nss.pc.in b/nss/nss.pc.in
-new file mode 100644
-index 000000000000..b80838f8ca0d
---- /dev/null
-+++ b/nss/nss.pc.in
-@@ -0,0 +1,11 @@
-+prefix=/usr
-+exec_prefix=${prefix}
-+libdir=${prefix}/lib
-+includedir=${prefix}/include/nss
-+
-+Name: NSS
-+Description: Mozilla Network Security Services
-+Version: @VERSION@
-+Requires: nspr
-+Libs: -lnss3 -lnssutil3 -lsmime3 -lssl3
-+Cflags: -I${includedir}
diff --git a/patches/nss-3.130/series b/patches/nss-3.130/series
deleted file mode 100644
index 534d0d6d69f823d512f432093a912eb00ff7a666..0000000000000000000000000000000000000000
--- a/patches/nss-3.130/series
+++ /dev/null
@@ -1,8 +0,0 @@
-# generated by git-ptx-patches
-#tag:base --start-number 1
-0001-nss-fix-nsinstall-build.patch
-0002-add-nss.pc.in.patch
-0003-HACK-don-t-build-commands-that-need-zlib.patch
-0004-HACK-fix-parallel-building-issue.patch
-0005-fix-dependency-generation.patch
-# 51749efb4fc421b49999aad3745d75b9 - git-ptx-patches magic
diff --git a/patches/nss-3.130/0001-nss-fix-nsinstall-build.patch b/patches/nss-3.131.1/0001-nss-fix-nsinstall-build.patch
similarity index 100%
rename from patches/nss-3.130/0001-nss-fix-nsinstall-build.patch
rename to patches/nss-3.131.1/0001-nss-fix-nsinstall-build.patch
diff --git a/patches/nss-3.130/0003-HACK-don-t-build-commands-that-need-zlib.patch b/patches/nss-3.131.1/0002-HACK-don-t-build-commands-that-need-zlib.patch
similarity index 100%
rename from patches/nss-3.130/0003-HACK-don-t-build-commands-that-need-zlib.patch
rename to patches/nss-3.131.1/0002-HACK-don-t-build-commands-that-need-zlib.patch
diff --git a/patches/nss-3.130/0004-HACK-fix-parallel-building-issue.patch b/patches/nss-3.131.1/0003-HACK-fix-parallel-building-issue.patch
similarity index 100%
rename from patches/nss-3.130/0004-HACK-fix-parallel-building-issue.patch
rename to patches/nss-3.131.1/0003-HACK-fix-parallel-building-issue.patch
diff --git a/patches/nss-3.130/0005-fix-dependency-generation.patch b/patches/nss-3.131.1/0004-fix-dependency-generation.patch
similarity index 100%
rename from patches/nss-3.130/0005-fix-dependency-generation.patch
rename to patches/nss-3.131.1/0004-fix-dependency-generation.patch
diff --git a/patches/nss-3.131.1/series b/patches/nss-3.131.1/series
new file mode 100644
index 0000000000000000000000000000000000000000..ed1f6706e1f31ed11d93ed6918ecae72fce35707
--- /dev/null
+++ b/patches/nss-3.131.1/series
@@ -0,0 +1,7 @@
+# generated by git-ptx-patches
+#tag:base --start-number 1
+0001-nss-fix-nsinstall-build.patch
+0002-HACK-don-t-build-commands-that-need-zlib.patch
+0003-HACK-fix-parallel-building-issue.patch
+0004-fix-dependency-generation.patch
+# ea27330855ed3ed4aac49b9ec8451c08 - git-ptx-patches magic
diff --git a/rules/nss.make b/rules/nss.make
index 61c4b102c04219e218fb950943679204ec01f501..147d311f24abaeaa90833efb13239451393a965a 100644
--- a/rules/nss.make
+++ b/rules/nss.make
@@ -14,8 +14,8 @@ PACKAGES-$(PTXCONF_NSS) += nss
#
# Paths and names
#
-NSS_VERSION := 3.130
-NSS_SHA256 := afab9f82c78bfa3e7e8b4a61ac31922675c58203f67ff385a2714df7fe9bd5c5
+NSS_VERSION := 3.131.1
+NSS_SHA256 := b1dbc1d9e7f3f8455dfb6d58ec8f7229d8a8450c629a9e69ef2ef6081f359056
NSS := nss-$(NSS_VERSION)
NSS_SUFFIX := tar.gz
NSS_URL := https://ftp.mozilla.org/pub/security/nss/releases/NSS_$(subst .,_,$(NSS_VERSION))_RTM/src/$(NSS).$(NSS_SUFFIX)
@@ -96,8 +96,14 @@ $(STATEDIR)/nss.install:
$(NSS_PKGDIR)/usr/lib/$(lib).so$(ptx/nl))
install -d $(NSS_PKGDIR)/usr/lib/pkgconfig/
- VERSION=$(NSS_VERSION) ptxd_replace_magic \
- $(NSS_DIR)/nss/nss.pc.in > $(NSS_PKGDIR)/usr/lib/pkgconfig/nss.pc
+ sed "$(NSS_DIR)/nss/pkg/pkg-config/nss.pc.in" \
+ -e "s,%prefix%,/usr,g" \
+ -e "s,%exec_prefix%,$${prefix},g" \
+ -e "s,%libdir%,/usr/lib,g" \
+ -e "s,%includedir%,/usr/include/nss,g" \
+ -e "s,%NSPR_VERSION%,$(NSPR_VERSION),g" \
+ -e "s,%NSS_VERSION%,$(NSS_VERSION),g" \
+ > "$(NSS_PKGDIR)/usr/lib/pkgconfig/nss.pc"
@install -v -d $(NSS_PKGDIR)/usr/include/nss
@install -v -m 644 -t $(NSS_PKGDIR)/usr/include/nss $(NSS_DIR)/dist/public/nss/*
--
2.47.3
next prev parent reply other threads:[~2026-10-21 9:52 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-21 9:51 [ptxdist] [PATCH 0/3] nss/nspr: Update to fix the eMudhra Intermediate CA Compromise Sven Püschel
2026-10-21 9:51 ` [ptxdist] [PATCH 1/3] nspr: version bump 4.37 -> 4.40 Sven Püschel
2026-10-21 9:51 ` Sven Püschel [this message]
2026-10-26 7:57 ` [ptxdist] [PATCH 2/3] nss: version bump 3.130 -> 3.131.1 Michael Olbrich
2026-10-21 9:51 ` [ptxdist] [PATCH 3/3] ca-certificates: version bump 3_130 -> 3_131_1 Sven Püschel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261021-fixemudhra-v1-2-36306b489b2e@pengutronix.de \
--to=s.pueschel@pengutronix.de \
--cc=ptxdist@pengutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox