From: Michael Olbrich <m.olbrich@pengutronix.de>
To: "Sven Püschel" <s.pueschel@pengutronix.de>
Cc: ptxdist@pengutronix.de
Subject: Re: [ptxdist] [PATCH 2/3] nss: version bump 3.130 -> 3.131.1
Date: Mon, 26 Oct 2026 08:57:15 +0100 [thread overview]
Message-ID: <at8H21O3gSdejv9f@pengutronix.de> (raw)
In-Reply-To: <20261021-fixemudhra-v1-2-36306b489b2e@pengutronix.de>
On Wed, Oct 21, 2026 at 11:51:39AM +0200, Sven Püschel wrote:
> Bunch of bugfixes in 3.131
> https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_131.html
>
> With 3.131.1 they only dropped the certs related to the
> eMudhra Intermediate CA Compromise [1]:
> https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/vSxZxnOMMvs
>
> Also dropped the patch adding a pc file and instead using the already
> included PC file and adjusting it's variables with a sed command line.
> This is based on the ArchLinux build script [2], but a similar sed can
> also be found in `nss/build.sh`.
You need to updated host-nns as well.
Michael
> [1] https://emudhra.we-have-a-problem.com/
> [2] https://gitlab.archlinux.org/archlinux/packaging/packages/nss/-/blob/f01ebfe4f1024af88a59c25586729956591abac0/PKGBUILD#L68
>
> Signed-off-by: Sven Püschel <s.pueschel@pengutronix.de>
> ---
> patches/nss-3.130/0002-add-nss.pc.in.patch | 27 ----------------------
> patches/nss-3.130/series | 8 -------
> .../0001-nss-fix-nsinstall-build.patch | 0
> ...HACK-don-t-build-commands-that-need-zlib.patch} | 0
> .../0003-HACK-fix-parallel-building-issue.patch} | 0
> .../0004-fix-dependency-generation.patch} | 0
> patches/nss-3.131.1/series | 7 ++++++
> rules/nss.make | 14 +++++++----
> 8 files changed, 17 insertions(+), 39 deletions(-)
>
> diff --git a/patches/nss-3.130/0002-add-nss.pc.in.patch b/patches/nss-3.130/0002-add-nss.pc.in.patch
> deleted file mode 100644
> index addc805b5d39543f587febae968680276a62470b..0000000000000000000000000000000000000000
> --- a/patches/nss-3.130/0002-add-nss.pc.in.patch
> +++ /dev/null
> @@ -1,27 +0,0 @@
> -From: Lucas Stach <l.stach@pengutronix.de>
> -Date: Tue, 12 Apr 2016 11:36:26 +0200
> -Subject: [PATCH] add nss.pc.in
> -
> -Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> ----
> - nss/nss.pc.in | 11 +++++++++++
> - 1 file changed, 11 insertions(+)
> - create mode 100644 nss/nss.pc.in
> -
> -diff --git a/nss/nss.pc.in b/nss/nss.pc.in
> -new file mode 100644
> -index 000000000000..b80838f8ca0d
> ---- /dev/null
> -+++ b/nss/nss.pc.in
> -@@ -0,0 +1,11 @@
> -+prefix=/usr
> -+exec_prefix=${prefix}
> -+libdir=${prefix}/lib
> -+includedir=${prefix}/include/nss
> -+
> -+Name: NSS
> -+Description: Mozilla Network Security Services
> -+Version: @VERSION@
> -+Requires: nspr
> -+Libs: -lnss3 -lnssutil3 -lsmime3 -lssl3
> -+Cflags: -I${includedir}
> diff --git a/patches/nss-3.130/series b/patches/nss-3.130/series
> deleted file mode 100644
> index 534d0d6d69f823d512f432093a912eb00ff7a666..0000000000000000000000000000000000000000
> --- a/patches/nss-3.130/series
> +++ /dev/null
> @@ -1,8 +0,0 @@
> -# generated by git-ptx-patches
> -#tag:base --start-number 1
> -0001-nss-fix-nsinstall-build.patch
> -0002-add-nss.pc.in.patch
> -0003-HACK-don-t-build-commands-that-need-zlib.patch
> -0004-HACK-fix-parallel-building-issue.patch
> -0005-fix-dependency-generation.patch
> -# 51749efb4fc421b49999aad3745d75b9 - git-ptx-patches magic
> diff --git a/patches/nss-3.130/0001-nss-fix-nsinstall-build.patch b/patches/nss-3.131.1/0001-nss-fix-nsinstall-build.patch
> similarity index 100%
> rename from patches/nss-3.130/0001-nss-fix-nsinstall-build.patch
> rename to patches/nss-3.131.1/0001-nss-fix-nsinstall-build.patch
> diff --git a/patches/nss-3.130/0003-HACK-don-t-build-commands-that-need-zlib.patch b/patches/nss-3.131.1/0002-HACK-don-t-build-commands-that-need-zlib.patch
> similarity index 100%
> rename from patches/nss-3.130/0003-HACK-don-t-build-commands-that-need-zlib.patch
> rename to patches/nss-3.131.1/0002-HACK-don-t-build-commands-that-need-zlib.patch
> diff --git a/patches/nss-3.130/0004-HACK-fix-parallel-building-issue.patch b/patches/nss-3.131.1/0003-HACK-fix-parallel-building-issue.patch
> similarity index 100%
> rename from patches/nss-3.130/0004-HACK-fix-parallel-building-issue.patch
> rename to patches/nss-3.131.1/0003-HACK-fix-parallel-building-issue.patch
> diff --git a/patches/nss-3.130/0005-fix-dependency-generation.patch b/patches/nss-3.131.1/0004-fix-dependency-generation.patch
> similarity index 100%
> rename from patches/nss-3.130/0005-fix-dependency-generation.patch
> rename to patches/nss-3.131.1/0004-fix-dependency-generation.patch
> diff --git a/patches/nss-3.131.1/series b/patches/nss-3.131.1/series
> new file mode 100644
> index 0000000000000000000000000000000000000000..ed1f6706e1f31ed11d93ed6918ecae72fce35707
> --- /dev/null
> +++ b/patches/nss-3.131.1/series
> @@ -0,0 +1,7 @@
> +# generated by git-ptx-patches
> +#tag:base --start-number 1
> +0001-nss-fix-nsinstall-build.patch
> +0002-HACK-don-t-build-commands-that-need-zlib.patch
> +0003-HACK-fix-parallel-building-issue.patch
> +0004-fix-dependency-generation.patch
> +# ea27330855ed3ed4aac49b9ec8451c08 - git-ptx-patches magic
> diff --git a/rules/nss.make b/rules/nss.make
> index 61c4b102c04219e218fb950943679204ec01f501..147d311f24abaeaa90833efb13239451393a965a 100644
> --- a/rules/nss.make
> +++ b/rules/nss.make
> @@ -14,8 +14,8 @@ PACKAGES-$(PTXCONF_NSS) += nss
> #
> # Paths and names
> #
> -NSS_VERSION := 3.130
> -NSS_SHA256 := afab9f82c78bfa3e7e8b4a61ac31922675c58203f67ff385a2714df7fe9bd5c5
> +NSS_VERSION := 3.131.1
> +NSS_SHA256 := b1dbc1d9e7f3f8455dfb6d58ec8f7229d8a8450c629a9e69ef2ef6081f359056
> NSS := nss-$(NSS_VERSION)
> NSS_SUFFIX := tar.gz
> NSS_URL := https://ftp.mozilla.org/pub/security/nss/releases/NSS_$(subst .,_,$(NSS_VERSION))_RTM/src/$(NSS).$(NSS_SUFFIX)
> @@ -96,8 +96,14 @@ $(STATEDIR)/nss.install:
> $(NSS_PKGDIR)/usr/lib/$(lib).so$(ptx/nl))
>
> install -d $(NSS_PKGDIR)/usr/lib/pkgconfig/
> - VERSION=$(NSS_VERSION) ptxd_replace_magic \
> - $(NSS_DIR)/nss/nss.pc.in > $(NSS_PKGDIR)/usr/lib/pkgconfig/nss.pc
> + sed "$(NSS_DIR)/nss/pkg/pkg-config/nss.pc.in" \
> + -e "s,%prefix%,/usr,g" \
> + -e "s,%exec_prefix%,$${prefix},g" \
> + -e "s,%libdir%,/usr/lib,g" \
> + -e "s,%includedir%,/usr/include/nss,g" \
> + -e "s,%NSPR_VERSION%,$(NSPR_VERSION),g" \
> + -e "s,%NSS_VERSION%,$(NSS_VERSION),g" \
> + > "$(NSS_PKGDIR)/usr/lib/pkgconfig/nss.pc"
>
> @install -v -d $(NSS_PKGDIR)/usr/include/nss
> @install -v -m 644 -t $(NSS_PKGDIR)/usr/include/nss $(NSS_DIR)/dist/public/nss/*
>
> --
> 2.47.3
>
>
>
--
Pengutronix e.K. | |
Steuerwalder Str. 21 | http://www.pengutronix.de/ |
31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
next prev parent reply other threads:[~2026-10-26 7:57 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-21 9:51 [ptxdist] [PATCH 0/3] nss/nspr: Update to fix the eMudhra Intermediate CA Compromise Sven Püschel
2026-10-21 9:51 ` [ptxdist] [PATCH 1/3] nspr: version bump 4.37 -> 4.40 Sven Püschel
2026-10-21 9:51 ` [ptxdist] [PATCH 2/3] nss: version bump 3.130 -> 3.131.1 Sven Püschel
2026-10-26 7:57 ` Michael Olbrich [this message]
2026-10-21 9:51 ` [ptxdist] [PATCH 3/3] ca-certificates: version bump 3_130 -> 3_131_1 Sven Püschel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=at8H21O3gSdejv9f@pengutronix.de \
--to=m.olbrich@pengutronix.de \
--cc=ptxdist@pengutronix.de \
--cc=s.pueschel@pengutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox