From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Fri, 13 Nov 2026 09:40:57 +0100 Received: from metis.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::104]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1xRmq8-00AMPf-3C for lore@lore.pengutronix.de; Fri, 13 Nov 2026 09:40:57 +0100 Received: from [127.0.0.1] (helo=metis.whiteo.stw.pengutronix.de) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1xRmq5-00047V-Vd; Fri, 13 Nov 2026 09:40:54 +0100 Received: from mx1.white.stw.pengutronix.de ([2a0a:edc0:0:b01:1d::107]) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1xRmoc-0005YK-Ej for ptxdist@pengutronix.de; Fri, 13 Nov 2026 09:39:22 +0100 Received: from dude05.red.stw.pengutronix.de (dude05.red.stw.4.pengutronix.de [10.17.1.19]) (Authenticated sender: relay-from-dude05.red.stw.pengutronix.de) by mx1.white.stw.pengutronix.de (Postfix) with ESMTPSA id 63E012059D3; Fri, 13 Nov 2026 09:39:22 +0100 (CET) ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=pengutronix.de; s=20260414; t=1794559162; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=rzDWt++xqv8MozpfggXX8P9H55wGQz8kWIc1zSX/6Mc=; b=OzVCa3GrW1iiJgY5KR/U9eQMfyXgUtEW4aouDwrsr5lRrX0M+4JEZ3CQSwe30i9gtWaOnW +2ubi5Pss2RLzGc9GJ0/A42GyqPXMzbUTsaSjFW6N42UkNuPUHLZ0vgttbTiagMgN7dP9a UkyJN16dSNYfWaHGNymfiIdX4WCBbK5i0957b5K6shR6nKhMpa80ChuVmkZsdmoE4OJKkG YOCXMRzZjEp81NZ9nISjXr3SascAc9m6KpIqe9ymKaEKxsqMv3OS3EDGVBYKYZmN/S6T+2 TSC4OFkPYya4D3VBHTTUMxFsvrHbZ38Ru7fsHqeUS3j6UCNlO/2oBO/mpqpZVg== ARC-Seal: i=1; s=20260414; d=pengutronix.de; t=1794559162; a=rsa-sha256; cv=none; b=XTmrCAsEPCzLLRnTH1J/pLywmFYvvmpvsYgwrWG0zj2z/P8a/oWZ+cD5s0vusE/sqgRlD0 glCv0aBnqt/mzeLPsS15Ft+FLt0f1BFuoEuUynxHD2PJOWhCY/MuGI2MMGgO968r5LF4QI UEKR9cohU9gSTa6vT1xFk49P1tihDq/uxIpUb625SOZIKe0cUsXQcZGYcqxZwaM8nKad7N yFnhsHfol96EWRKR4UeARpGuSBddgXM7WPM1fkPpYd7/Qpw1SM2Kb7ruIDXS0Mj/ShVV5F dDmm1JaVaJ0ltOAnSD0rkmWffXbsQTbfApqbaz+Th8rANwDEaECReayuxBaVAg== ARC-Authentication-Results: i=1; ORIGINATING; auth=pass smtp.auth=relay-from-dude05.red.stw.pengutronix.de smtp.mailfrom=mol@pengutronix.de Received: by dude05.red.stw.pengutronix.de (Postfix, from userid 1014) id 56113743103; Fri, 13 Nov 2026 09:39:22 +0100 (CET) From: Michael Olbrich To: ptxdist@pengutronix.de Date: Fri, 13 Nov 2026 09:39:22 +0100 Message-ID: <20261113083922.1380286-1-m.olbrich@pengutronix.de> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261027-fixemudhra-v2-2-11be14cb5ae4@pengutronix.de> References: <20261027-fixemudhra-v2-2-11be14cb5ae4@pengutronix.de> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Subject: Re: [ptxdist] [APPLIED] nss: version bump 3.130 -> 3.131.1 X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Cc: =?UTF-8?q?Sven=20P=C3=BCschel?= Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.whiteo.stw.pengutronix.de); SAEximRunCond expanded to false Thanks, applied as 42d28fc27326c02b370bf2ef0cb6aecad415d74a. Michael [sent from post-receive hook] On Fri, 13 Nov 2026 09:39:22 +0100, Sven Püschel wrote: > Bunch of bugfixes in 3.131 > https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_131.html > > With 3.131.1 they only dropped the certs related to the > eMudhra Intermediate CA Compromise [1]: > https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/vSxZxnOMMvs > > Also dropped the patch adding a pc file and instead using the already > included PC file and adjusting it's variables with a sed command line. > This is based on the ArchLinux build script [2], but a similar sed can > also be found in `nss/build.sh`. > > [1] https://emudhra.we-have-a-problem.com/ > [2] https://gitlab.archlinux.org/archlinux/packaging/packages/nss/-/blob/f01ebfe4f1024af88a59c25586729956591abac0/PKGBUILD#L68 > > Signed-off-by: Sven Püschel > Message-Id: <20261027-fixemudhra-v2-2-11be14cb5ae4@pengutronix.de> > Signed-off-by: Michael Olbrich > > diff --git a/patches/nss-3.130/0002-add-nss.pc.in.patch b/patches/nss-3.130/0002-add-nss.pc.in.patch > deleted file mode 100644 > index addc805b5d39..000000000000 > --- a/patches/nss-3.130/0002-add-nss.pc.in.patch > +++ /dev/null > @@ -1,27 +0,0 @@ > -From: Lucas Stach > -Date: Tue, 12 Apr 2016 11:36:26 +0200 > -Subject: [PATCH] add nss.pc.in > - > -Signed-off-by: Michael Olbrich > ---- > - nss/nss.pc.in | 11 +++++++++++ > - 1 file changed, 11 insertions(+) > - create mode 100644 nss/nss.pc.in > - > -diff --git a/nss/nss.pc.in b/nss/nss.pc.in > -new file mode 100644 > -index 000000000000..b80838f8ca0d > ---- /dev/null > -+++ b/nss/nss.pc.in > -@@ -0,0 +1,11 @@ > -+prefix=/usr > -+exec_prefix=${prefix} > -+libdir=${prefix}/lib > -+includedir=${prefix}/include/nss > -+ > -+Name: NSS > -+Description: Mozilla Network Security Services > -+Version: @VERSION@ > -+Requires: nspr > -+Libs: -lnss3 -lnssutil3 -lsmime3 -lssl3 > -+Cflags: -I${includedir} > diff --git a/patches/nss-3.130/series b/patches/nss-3.130/series > deleted file mode 100644 > index 534d0d6d69f8..000000000000 > --- a/patches/nss-3.130/series > +++ /dev/null > @@ -1,8 +0,0 @@ > -# generated by git-ptx-patches > -#tag:base --start-number 1 > -0001-nss-fix-nsinstall-build.patch > -0002-add-nss.pc.in.patch > -0003-HACK-don-t-build-commands-that-need-zlib.patch > -0004-HACK-fix-parallel-building-issue.patch > -0005-fix-dependency-generation.patch > -# 51749efb4fc421b49999aad3745d75b9 - git-ptx-patches magic > diff --git a/patches/nss-3.130/0001-nss-fix-nsinstall-build.patch b/patches/nss-3.131.1/0001-nss-fix-nsinstall-build.patch > similarity index 100% > rename from patches/nss-3.130/0001-nss-fix-nsinstall-build.patch > rename to patches/nss-3.131.1/0001-nss-fix-nsinstall-build.patch > diff --git a/patches/nss-3.130/0003-HACK-don-t-build-commands-that-need-zlib.patch b/patches/nss-3.131.1/0002-HACK-don-t-build-commands-that-need-zlib.patch > similarity index 100% > rename from patches/nss-3.130/0003-HACK-don-t-build-commands-that-need-zlib.patch > rename to patches/nss-3.131.1/0002-HACK-don-t-build-commands-that-need-zlib.patch > diff --git a/patches/nss-3.130/0004-HACK-fix-parallel-building-issue.patch b/patches/nss-3.131.1/0003-HACK-fix-parallel-building-issue.patch > similarity index 100% > rename from patches/nss-3.130/0004-HACK-fix-parallel-building-issue.patch > rename to patches/nss-3.131.1/0003-HACK-fix-parallel-building-issue.patch > diff --git a/patches/nss-3.130/0005-fix-dependency-generation.patch b/patches/nss-3.131.1/0004-fix-dependency-generation.patch > similarity index 100% > rename from patches/nss-3.130/0005-fix-dependency-generation.patch > rename to patches/nss-3.131.1/0004-fix-dependency-generation.patch > diff --git a/patches/nss-3.131.1/series b/patches/nss-3.131.1/series > new file mode 100644 > index 000000000000..ed1f6706e1f3 > --- /dev/null > +++ b/patches/nss-3.131.1/series > @@ -0,0 +1,7 @@ > +# generated by git-ptx-patches > +#tag:base --start-number 1 > +0001-nss-fix-nsinstall-build.patch > +0002-HACK-don-t-build-commands-that-need-zlib.patch > +0003-HACK-fix-parallel-building-issue.patch > +0004-fix-dependency-generation.patch > +# ea27330855ed3ed4aac49b9ec8451c08 - git-ptx-patches magic > diff --git a/rules/host-nss.make b/rules/host-nss.make > index 3f66b40a13b5..5ead1be8695a 100644 > --- a/rules/host-nss.make > +++ b/rules/host-nss.make > @@ -62,8 +62,14 @@ $(STATEDIR)/host-nss.install: > $(HOST_NSS_PKGDIR)/usr/lib/$(lib).so$(ptx/nl)) > > install -d $(HOST_NSS_PKGDIR)/usr/lib/pkgconfig/ > - VERSION=$(NSS_VERSION) ptxd_replace_magic \ > - $(HOST_NSS_DIR)/nss/nss.pc.in > $(HOST_NSS_PKGDIR)/usr/lib/pkgconfig/nss.pc > + sed "$(HOST_NSS_DIR)/nss/pkg/pkg-config/nss.pc.in" \ > + -e "s,%prefix%,/usr,g" \ > + -e "s,%exec_prefix%,$${prefix},g" \ > + -e "s,%libdir%,/usr/lib,g" \ > + -e "s,%includedir%,/usr/include/nss,g" \ > + -e "s,%NSPR_VERSION%,$(NSPR_VERSION),g" \ > + -e "s,%NSS_VERSION%,$(NSS_VERSION),g" \ > + > "$(HOST_NSS_PKGDIR)/usr/lib/pkgconfig/nss.pc" > > install -d $(PTXDIST_SYSROOT_HOST)/usr/include/nss > install -m 644 -t $(PTXDIST_SYSROOT_HOST)/usr/include/nss $(HOST_NSS_DIR)/dist/public/nss/* > diff --git a/rules/nss.make b/rules/nss.make > index 61c4b102c042..147d311f24ab 100644 > --- a/rules/nss.make > +++ b/rules/nss.make > @@ -14,8 +14,8 @@ PACKAGES-$(PTXCONF_NSS) += nss > # > # Paths and names > # > -NSS_VERSION := 3.130 > -NSS_SHA256 := afab9f82c78bfa3e7e8b4a61ac31922675c58203f67ff385a2714df7fe9bd5c5 > +NSS_VERSION := 3.131.1 > +NSS_SHA256 := b1dbc1d9e7f3f8455dfb6d58ec8f7229d8a8450c629a9e69ef2ef6081f359056 > NSS := nss-$(NSS_VERSION) > NSS_SUFFIX := tar.gz > NSS_URL := https://ftp.mozilla.org/pub/security/nss/releases/NSS_$(subst .,_,$(NSS_VERSION))_RTM/src/$(NSS).$(NSS_SUFFIX) > @@ -96,8 +96,14 @@ $(STATEDIR)/nss.install: > $(NSS_PKGDIR)/usr/lib/$(lib).so$(ptx/nl)) > > install -d $(NSS_PKGDIR)/usr/lib/pkgconfig/ > - VERSION=$(NSS_VERSION) ptxd_replace_magic \ > - $(NSS_DIR)/nss/nss.pc.in > $(NSS_PKGDIR)/usr/lib/pkgconfig/nss.pc > + sed "$(NSS_DIR)/nss/pkg/pkg-config/nss.pc.in" \ > + -e "s,%prefix%,/usr,g" \ > + -e "s,%exec_prefix%,$${prefix},g" \ > + -e "s,%libdir%,/usr/lib,g" \ > + -e "s,%includedir%,/usr/include/nss,g" \ > + -e "s,%NSPR_VERSION%,$(NSPR_VERSION),g" \ > + -e "s,%NSS_VERSION%,$(NSS_VERSION),g" \ > + > "$(NSS_PKGDIR)/usr/lib/pkgconfig/nss.pc" > > @install -v -d $(NSS_PKGDIR)/usr/include/nss > @install -v -m 644 -t $(NSS_PKGDIR)/usr/include/nss $(NSS_DIR)/dist/public/nss/*