Files
Natalia Kulatova 979b15b538 Bug 1851092 - land NSS NSS_3_94_RTM UPGRADE_NSS_RELEASE, r=nss-reviewers,jschanck
2023-10-02  Natalia Kulatova  <nkulatova@mozilla.com>

	* doc/rst/releases/nss_3_94.rst:
	Documentation: Release notes for NSS 3.94
	[8c67d6c2d718] [NSS_3_94_RTM] <NSS_3_94_BRANCH>

	* .hgtags:
	Added tag NSS_3_94_RTM for changeset a4d8f6ff9c3b
	[18307440cfb0] <NSS_3_94_BRANCH>

	* doc/rst/releases/index.rst:
	Release notes for NSS 3.94
	[a4d8f6ff9c3b] <NSS_3_94_BRANCH>

	* lib/nss/nss.h, lib/softoken/softkver.h, lib/util/nssutil.h:
	Set version numbers to 3.94 final
	[0af23c222caf] <NSS_3_94_BRANCH>

2023-09-21  Benjamin Beurdouche  <beurdouche@mozilla.com>

	* .hgtags:
	Removed tag NSS_3_94_BETA1
	[1a3ea35e31a2]

2023-09-20  Karthikeyan Bhargavan  <karthik.bhargavan@gmail.com>

	* automation/taskcluster/scripts/run_hacl.sh,
	lib/freebl/verified/Hacl_Hash_SHA3.c,
	lib/freebl/verified/Hacl_IntTypes_Intrinsics.h,
	lib/freebl/verified/Hacl_IntTypes_Intrinsics_128.h,
	lib/freebl/verified/Hacl_Krmllib.h, lib/freebl/verified/Hacl_P256.c,
	lib/freebl/verified/internal/Hacl_Bignum_Base.h,
	lib/freebl/verified/internal/Hacl_Hash_SHA1.h,
	lib/freebl/verified/internal/Hacl_Hash_SHA2.h,
	lib/freebl/verified/internal/Hacl_IntTypes_Intrinsics.h,
	lib/freebl/verified/internal/Hacl_IntTypes_Intrinsics_128.h,
	lib/freebl/verified/internal/Hacl_Krmllib.h,
	lib/freebl/verified/internal/Hacl_P256.h,
	lib/freebl/verified/internal/lib_intrinsics.h,
	lib/freebl/verified/karamel/include/krml/internal/target.h, lib/free
	bl/verified/karamel/krmllib/dist/minimal/FStar_UInt_8_16_32_64.h,
	lib/freebl/verified/karamel/krmllib/dist/minimal/Makefile.basic,
	lib/freebl/verified/lib_intrinsics.h:
	Bug 1853737 - Updated code and commit ID for HACL*. r=jschanck

	[3501ba1860c3]

2023-09-20  Iaroslav Gridin  <iaroslav.gridin@tuni.fi>

	* tests/acvp/fuzzed/ecdsa.json:
	Bug 1840510: update ACVP fuzzed test vector: refuzzed with current
	NSS r=jschanck

	[da1cde22e844]

2023-09-15  Robert Relyea  <rrelyea@redhat.com>

	* automation/abi-check/expected-report-libnssutil3.so.txt,
	lib/freebl/nsslowhash.c, lib/freebl/stubs.c, lib/freebl/stubs.h,
	lib/pk11wrap/pk11util.c, lib/softoken/pkcs11.c,
	lib/util/nssutil.def, lib/util/secport.c, lib/util/secport.h:
	Bug 1827303 Softoken C_ calls should use system FIPS setting to
	select NSC_ or FC_ variants.

	NSS softoken presents a PKCS #11 API to the NSS low level crypto.
	This allows NSS to have native support for replacement PKCS #11
	libraries, and is also the FIPS boundary, allowing the rest of NSS
	to change without affecting any FIPS validations.

	Some applications that need crypto, but have their own higher level
	implementations of SSL or S/MIME use NSS softoken. Softoken has 2
	general APIs: NSC_xxxx calls which implement the normal NSS
	interface, but does not include any FIPS restrictions, The FC_xxx
	interfaces which implements FIPS restrictions on the semantics of
	the calls and additional FIPS requirements (like self-tests and
	software integrity checks). The official PKCS #11 APIs are C_xxx
	interfaces, and NSS exports those as aliases for NSC_xxxx calls.

	Right now applications that use softoken have to know the NSS names
	if they want to access the FIPS api. This bugs removes this
	restriction and causes calls to C_xxxx to alias to FC_xxxxx if the
	system is in FIPS mode. If the system has no system FIPS indicator,
	or the that indicator is off, the C_xxxx will continue to call
	NSC_xxxxx. NSS itself will continue to use NSC_xxxx or FC_xxxx
	according to the NSS internal FIPS settings.

	---------------- Currently there are 3 layers in NSS with code that
	identifies the whether the system is in NSS: nss proper (which is
	also exported to applications), and freebl for the Freebl hash
	direct case. This code would add a 3rd (in softoken). Rather than
	adding a third, this patch relocates the main function to nssutil
	where softoken, nss, and freebl can all access it. The exception is
	when building freebl with 'NODEPEND' (freebl can provide hashing
	without dependencies on NSPR or NSSUTIL), there needs to be a stub
	implementation. In most platforms and cases this stub is never
	compiled.

	[762cb673ca8c]

	* .hgignore, automation/taskcluster/scripts/split.sh, cmd/Makefile,
	cmd/dbtool/Makefile, cmd/dbtool/dbtool.c, cmd/dbtool/dbtool.gyp,
	cmd/dbtool/manifest.mn, cmd/manifest.mn, lib/softoken/sdb.h,
	nss.gyp:
	Bug 1774659 NSS needs a database tool that can dump the low level
	representation of the database. r=jschanck

	When debugging the database, it would be helpful to know what is in
	the database is a nicely formated way. certutil dumps a high level
	view of the certs and keys, sqlite3 can dump the low level tables
	and raw entries. It would be useful to dump the database as softoken
	sees the database.

	This code grabs a copy of the latest sdb.c from softoken and uses it
	to fetch the database entries, then parses them as necessary. It
	uses the pkcs11 table in libsec to format the result data into human
	readable strings.

	[e52240a4bc62]

2023-09-08  John Schanck  <jschanck@mozilla.com>

	* gtests/mozpkix_gtest/pkixnames_tests.cpp:
	Bug 1852179 - declare string literals using char in
	pkixnames_tests.cpp. r=nss-reviewers,nkulatova

	[dbed9fc0522a]

Differential Revision: https://phabricator.services.mozilla.com/D189815
2023-10-02 20:43:59 +00:00

149 lines
4.8 KiB
Bash

copy_top()
{
srcdir_="$1"
dstdir_="$2"
files=`find "$srcdir_" -maxdepth 1 -mindepth 1 -type f`
for f in $files; do
cp -p "$f" "$dstdir_"
done
}
split_util() {
nssdir="$1"
dstdir="$2"
# Prepare a source tree only containing files to build nss-util:
#
# nss/dbm full directory
# nss/coreconf full directory
# nss top files only
# nss/lib top files only
# nss/lib/util full directory
# Copy everything.
cp -R $nssdir $dstdir
# Remove subdirectories that we don't want.
rm -rf $dstdir/cmd
rm -rf $dstdir/lib
rm -rf $dstdir/automation
rm -rf $dstdir/doc
# Start with an empty cmd lib directories to be filled selectively.
mkdir $dstdir/cmd
cp $nssdir/cmd/Makefile $dstdir/cmd
cp $nssdir/cmd/manifest.mn $dstdir/cmd
cp $nssdir/cmd/platlibs.mk $dstdir/cmd
cp $nssdir/cmd/platrules.mk $dstdir/cmd
# Copy some files at the top and the util subdirectory recursively.
mkdir $dstdir/lib
cp $nssdir/lib/Makefile $dstdir/lib
cp -R $nssdir/lib/util $dstdir/lib/util
}
split_softoken() {
nssdir="$1"
dstdir="$2"
# Prepare a source tree only containing files to build nss-softoken:
#
# nss/dbm full directory
# nss/coreconf full directory
# nss top files only
# nss/lib top files only
# nss/lib/freebl full directory
# nss/lib/softoken full directory
# nss/lib/softoken/dbm full directory
# Copy everything.
cp -R $nssdir $dstdir
# Skip gtests when building.
sed '/^DIRS = /s/ cpputil gtests$//' $nssdir/manifest.mn > $dstdir/manifest.mn-t && mv $dstdir/manifest.mn-t $dstdir/manifest.mn
# Remove subdirectories that we don't want.
rm -rf $dstdir/cmd
rm -rf $dstdir/tests
rm -rf $dstdir/lib
rm -rf $dstdir/pkg
rm -rf $dstdir/automation
rm -rf $dstdir/gtests
rm -rf $dstdir/cpputil
rm -rf $dstdir/doc
# Start with an empty lib directory and copy only what we need.
mkdir $dstdir/lib
copy_top $nssdir/lib $dstdir/lib
cp -R $nssdir/lib/dbm $dstdir/lib/dbm
cp -R $nssdir/lib/freebl $dstdir/lib/freebl
cp -R $nssdir/lib/softoken $dstdir/lib/softoken
cp -R $nssdir/lib/sqlite $dstdir/lib/sqlite
mkdir $dstdir/cmd
copy_top $nssdir/cmd $dstdir/cmd
cp -R $nssdir/cmd/bltest $dstdir/cmd/bltest
cp -R $nssdir/cmd/ecperf $dstdir/cmd/ecperf
cp -R $nssdir/cmd/dbtool $dstdir/cmd/dbtool
cp -R $nssdir/cmd/fbectest $dstdir/cmd/fbectest
cp -R $nssdir/cmd/fipstest $dstdir/cmd/fipstest
cp -R $nssdir/cmd/lib $dstdir/cmd/lib
cp -R $nssdir/cmd/lowhashtest $dstdir/cmd/lowhashtest
cp -R $nssdir/cmd/shlibsign $dstdir/cmd/shlibsign
mkdir $dstdir/tests
copy_top $nssdir/tests $dstdir/tests
cp -R $nssdir/tests/cipher $dstdir/tests/cipher
cp -R $nssdir/tests/common $dstdir/tests/common
cp -R $nssdir/tests/ec $dstdir/tests/ec
cp -R $nssdir/tests/lowhash $dstdir/tests/lowhash
cp $nssdir/lib/util/verref.h $dstdir/lib/freebl
cp $nssdir/lib/util/verref.h $dstdir/lib/softoken
cp $nssdir/lib/util/verref.h $dstdir/lib/softoken/legacydb
}
split_nss() {
nssdir="$1"
dstdir="$2"
# Prepare a source tree only containing files to build nss:
#
# nss/dbm full directory
# nss/coreconf full directory
# nss top files only
# nss/lib top files only
# nss/lib/freebl full directory
# nss/lib/softoken full directory
# nss/lib/softoken/dbm full directory
# Copy everything.
cp -R $nssdir $dstdir
# Remove subdirectories that we don't want.
rm -rf $dstdir/lib/freebl
rm -rf $dstdir/lib/softoken
rm -rf $dstdir/lib/util
rm -rf $dstdir/cmd/bltest
rm -rf $dstdir/cmd/fipstest
rm -rf $dstdir/cmd/rsaperf_low
# Copy these headers until the upstream bug is accepted
# Upstream https://bugzilla.mozilla.org/show_bug.cgi?id=820207
cp $nssdir/lib/softoken/lowkeyi.h $dstdir/cmd/rsaperf
cp $nssdir/lib/softoken/lowkeyti.h $dstdir/cmd/rsaperf
# Copy verref.h which will be needed later during the build phase.
cp $nssdir/lib/util/verref.h $dstdir/lib/ckfw/builtins/verref.h
cp $nssdir/lib/util/verref.h $dstdir/lib/nss/verref.h
cp $nssdir/lib/util/verref.h $dstdir/lib/smime/verref.h
cp $nssdir/lib/util/verref.h $dstdir/lib/ssl/verref.h
cp $nssdir/lib/util/templates.c $dstdir/lib/nss/templates.c
# FIXME: Skip util_gtest because it links with libnssutil.a. Note
# that we can't use libnssutil3.so instead, because util_gtest
# depends on internal symbols not exported from the shared library.
sed '/ util_gtest \\/d' $dstdir/gtests/manifest.mn > $dstdir/gtests/manifest.mn-t && mv $dstdir/gtests/manifest.mn-t $dstdir/gtests/manifest.mn
}