nss: update to 3.37.1

remove Fix-compilation-for-X32.patch as a solution simular is included in update.

notable changes:
The TLS 1.3 implementation was updated to Draft 28.
The CA certificates list was updated to version 2.24.

refresh patches
fix 32 bit build error nss bug: https://bugzilla.mozilla.org/show_bug.cgi?format=default&id=1459739

(From OE-Core rev: 1ed072515f2a23de75ee56b86d8607c85b42605c)

Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

5 files changed, 123 insertions, 44 deletions

diff --git a/meta/recipes-support/nss/nss/0001-Bug-1432455-Build-FStar.c-when-not-building-with-int.patch b/meta/recipes-support/nss/nss/0001-Bug-1432455-Build-FStar.c-when-not-building-with-int.patch
new file mode 100644
index 0000000000..f14792306c
--- /dev/null
+++ b/meta/recipes-support/nss/nss/0001-Bug-1432455-Build-FStar.c-when-not-building-with-int.patch
@@ -0,0 +1,112 @@
+From fe5fd11f3f02d3625b37f8e3c592e5c3e84c1798 Mon Sep 17 00:00:00 2001
+From: Mike Hommey <mh@glandium.org>
+Date: Sun, 27 May 2018 16:20:00 +0200
+Subject: [PATCH] Bug 1432455 - Build FStar.c when not building with int128
+ support. r=fkiefer
+
+--HG--
+extra : amend_source : b3f739de2f592ecb9ae1f1ce5ee4fb0e04df22cb
+
+Upstream-Status: Backport
+https://hg.mozilla.org/projects/nss/rev/2209bddb98b8d105159998b9be91a155aa6bd283
+
+NSS bug https://bugzilla.mozilla.org/show_bug.cgi?format=default&id=1459739
+
+Signed-off-by: Armin Kuster <akuster808@gmail.com>
+
+---
+ lib/freebl/Makefile         |  6 +++++-
+ lib/freebl/freebl.gyp       | 29 +++++++++++++++++------------
+ lib/freebl/freebl_base.gypi |  4 +++-
+ 3 files changed, 25 insertions(+), 14 deletions(-)
+
+Index: nss-3.37.1/nss/lib/freebl/Makefile
+===================================================================
+--- nss-3.37.1.orig/nss/lib/freebl/Makefile
++++ nss-3.37.1/nss/lib/freebl/Makefile
+@@ -541,12 +541,16 @@ ifeq (,$(filter-out i386 x386 x86 x86_64
+     # All intel architectures get the 64 bit version
+     # With custom uint128 if necessary (faster than generic 32 bit version).
+     ECL_SRCS += curve25519_64.c
+-    VERIFIED_SRCS += Hacl_Curve25519.c FStar.c
++    VERIFIED_SRCS += Hacl_Curve25519.c
+ else
+     # All non intel architectures get the generic 32 bit implementation (slow!)
+     ECL_SRCS += curve25519_32.c
+ endif
+ 
++ifndef HAVE_INT128_SUPPORT
++    VERIFIED_SRCS += FStar.c
++endif
++
+ #######################################################################
+ # (5) Execute "global" rules. (OPTIONAL)                              #
+ #######################################################################
+Index: nss-3.37.1/nss/lib/freebl/freebl.gyp
+===================================================================
+--- nss-3.37.1.orig/nss/lib/freebl/freebl.gyp
++++ nss-3.37.1/nss/lib/freebl/freebl.gyp
+@@ -277,18 +277,10 @@
+           'MP_IS_LITTLE_ENDIAN',
+          ],
+       }],
+-      [ 'OS!="win"', {
+-        'conditions': [
+-          [ 'target_arch=="x64" or target_arch=="arm64" or target_arch=="aarch64"', {
+-            'defines': [
+-              # The Makefile does version-tests on GCC, but we're not doing that here.
+-              'HAVE_INT128_SUPPORT',
+-            ],
+-          }, {
+-            'defines': [
+-              'KRML_NOUINT128',
+-            ],
+-          }],
++      [ 'have_int128_support==1', {
++        'defines': [
++          # The Makefile does version-tests on GCC, but we're not doing that here.
++          'HAVE_INT128_SUPPORT',
+         ],
+       }, {
+         'defines': [
+@@ -350,5 +342,18 @@
+   },
+   'variables': {
+     'module': 'nss',
++    'conditions': [
++      [ 'OS!="win"', {
++        'conditions': [
++          [ 'target_arch=="x64" or target_arch=="arm64" or target_arch=="aarch64"', {
++            'have_int128_support%': 1,
++          }, {
++            'have_int128_support%': 0,
++          }],
++        ],
++      }, {
++        'have_int128_support%': 0,
++      }],
++    ],
+   }
+ }
+Index: nss-3.37.1/nss/lib/freebl/freebl_base.gypi
+===================================================================
+--- nss-3.37.1.orig/nss/lib/freebl/freebl_base.gypi
++++ nss-3.37.1/nss/lib/freebl/freebl_base.gypi
+@@ -60,7 +60,6 @@
+     'shvfy.c',
+     'sysrand.c',
+     'tlsprfalg.c',
+-    'verified/FStar.c',
+   ],
+   'conditions': [
+     [ 'OS=="linux" or OS=="android"', {
+@@ -220,6 +219,9 @@
+         }],
+       ],
+     }],
++    [ 'have_int128_support==0', {
++        'sources': [ 'verified/FStar.c' ],
++    }],
+   ],
+  'ldflags': [
+    '-Wl,-Bsymbolic'
diff --git a/meta/recipes-support/nss/nss/Fix-compilation-for-X32.patch b/meta/recipes-support/nss/nss/Fix-compilation-for-X32.patch
deleted file mode 100644
index 80b86908e5..0000000000
--- a/meta/recipes-support/nss/nss/Fix-compilation-for-X32.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From c8eadfcdfbc1d5a4799e9a264b0f859cb5954c05 Mon Sep 17 00:00:00 2001
-From: Christopher Larson <chris_larson@mentor.com>
-Date: Tue, 13 Dec 2016 11:40:47 -0700
-Subject: [PATCH 7/7] Fix compilation for X32
-
-X32 uses 32-bit pointers, not 64-bit.
-
-Signed-off-by: Christopher Larson <chris_larson@mentor.com>
-
-Upstream-Status: Pending
----
- nss/lib/freebl/poly1305-donna-x64-sse2-incremental-source.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/nss/lib/freebl/poly1305-donna-x64-sse2-incremental-source.c b/nss/lib/freebl/poly1305-donna-x64-sse2-incremental-source.c
-index 2a3301e..d4ade41 100644
---- a/nss/lib/freebl/poly1305-donna-x64-sse2-incremental-source.c
-+++ b/nss/lib/freebl/poly1305-donna-x64-sse2-incremental-source.c
-@@ -87,7 +87,11 @@ static poly1305_state_internal INLINE
-     *
-     poly1305_aligned_state(poly1305_state *state)
- {
-+#ifdef __ILP32__
-+    return (poly1305_state_internal *)(((uint32_t)state + 63) & ~63);
-+#else
-     return (poly1305_state_internal *)(((uint64_t)state + 63) & ~63);
-+#endif
- }
- 
- /* copy 0-63 bytes */
--- 
-2.8.0
-
diff --git a/meta/recipes-support/nss/nss/disable-Wvarargs-with-clang.patch b/meta/recipes-support/nss/nss/disable-Wvarargs-with-clang.patch
index 86b1b60556..de812d27ba 100644
--- a/meta/recipes-support/nss/nss/disable-Wvarargs-with-clang.patch
+++ b/meta/recipes-support/nss/nss/disable-Wvarargs-with-clang.patch
@@ -18,11 +18,11 @@ for more details
 Signed-off-by: Khem Raj <raj.khem@gmail.com>
 Upstream-Status: Pending
 
-Index: nss-3.24/nss/coreconf/Werror.mk
+Index: nss-3.37.1/nss/coreconf/Werror.mk
 ===================================================================
---- nss-3.24.orig/nss/coreconf/Werror.mk
-+++ nss-3.24/nss/coreconf/Werror.mk
-@@ -54,7 +54,7 @@ ifndef WARNING_CFLAGS
+--- nss-3.37.1.orig/nss/coreconf/Werror.mk
++++ nss-3.37.1/nss/coreconf/Werror.mk
+@@ -56,7 +56,7 @@ ifndef WARNING_CFLAGS
      ifdef CC_IS_CLANG
        # -Qunused-arguments : clang objects to arguments that it doesn't understand
        #    and fixing this would require rearchitecture
diff --git a/meta/recipes-support/nss/nss/pqg.c-ULL_addend.patch b/meta/recipes-support/nss/nss/pqg.c-ULL_addend.patch
index 9942bf1926..3a817faaa6 100644
--- a/meta/recipes-support/nss/nss/pqg.c-ULL_addend.patch
+++ b/meta/recipes-support/nss/nss/pqg.c-ULL_addend.patch
@@ -6,11 +6,11 @@ pqg.c:339:16: error: comparison of constant 18446744073709551615 with expression
 
 Signed-off-by: Khem Raj <raj.khem@gmail.com>
 Upstream-Status: Pending
-Index: nss-3.24/nss/lib/freebl/pqg.c
+Index: nss-3.37.1/nss/lib/freebl/pqg.c
 ===================================================================
---- nss-3.24.orig/nss/lib/freebl/pqg.c
-+++ nss-3.24/nss/lib/freebl/pqg.c
-@@ -322,8 +322,8 @@ generate_h_candidate(SECItem *hit, mp_in
+--- nss-3.37.1.orig/nss/lib/freebl/pqg.c
++++ nss-3.37.1/nss/lib/freebl/pqg.c
+@@ -326,8 +326,8 @@ generate_h_candidate(SECItem *hit, mp_in
  
  static SECStatus
  addToSeed(const SECItem *seed,
diff --git a/meta/recipes-support/nss/nss_3.36.1.bb b/meta/recipes-support/nss/nss_3.37.1.bb
index 780a7ab088..0e8b5be365 100644
--- a/meta/recipes-support/nss/nss_3.36.1.bb
+++ b/meta/recipes-support/nss/nss_3.37.1.bb
@@ -25,11 +25,11 @@ SRC_URI = "http://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/${VERSIO
            file://nss-fix-nsinstall-build.patch \
            file://disable-Wvarargs-with-clang.patch \
            file://pqg.c-ULL_addend.patch \
-           file://Fix-compilation-for-X32.patch \
+           file://0001-Bug-1432455-Build-FStar.c-when-not-building-with-int.patch \
            "
 
-SRC_URI[md5sum] = "814d8fe3ec89006cf62078e2a56cf2f9"
-SRC_URI[sha256sum] = "6025441d528ff6a7f1a4b673b6ee7d3540731ada3f78d5acd5c3b3736b222bff"
+SRC_URI[md5sum] = "e9526d7217d02afa96b90b89924c38df"
+SRC_URI[sha256sum] = "097b30e436479ad737b3703b25b6198b6513e202731085c6f097d8853dd20405"
 
 UPSTREAM_CHECK_URI = "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_Releases"
 UPSTREAM_CHECK_REGEX = "NSS_(?P<pver>.+)_release_notes"