linux/poky.git/meta/recipes-support/nss, branch yocto-2.6.2

nss: Fix SHA_HTONL bug for arm 32be.

2019-01-08T20:14:44+00:00

Rpm use nss as digest crypto library and which will cause an error as follows: error: test-manual-1.2.3-20181012.noarch.rpm: Header SHA1 digest: BAD (Expected f1deb7dc4a10742d88ccd1e967dbc62ae45095a5 !=4ad9d7dad6d70d6086eefec62612ad5d77f2fe81) => this value is wrong error: test-manual-1.2.3-20181012.noarch.rpm: not an rpm package (or package manifest) The error is caused by SHA_HTONL in nss, for there is no need to reverse the host value for arm 32be, so fix it. (From OE-Core rev: 257a1ccd16928dff64aa4d2e1553f52e910edbb2) Signed-off-by: Zheng Ruoqin Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

nss: update to 3.39 includes CVE-2018-12384

2018-11-07T23:08:54+00:00

see: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.39_release_notes (From OE-Core rev: 9d5d19cee30ac73b9fbf75308e5729857384983e) Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

nss: fix non-determinism when create a blank certificate

2018-10-12T15:57:21+00:00

It uses certutil from nss to create a blank certificate. But the checksum of database file key4.db changes every time: $ certutil -N -d sql:. --empty-password $ md5sum * f9dac2cfcb07cc8ca6db442a9a570906 cert9.db b892c5ff7c1977d4728240b0cf628377 key4.db 7b9136cb03f07ae62eb213a5239fda71 pkcs11.txt $ rm * $ certutil -N -d sql:. --empty-password $ md5sum * f9dac2cfcb07cc8ca6db442a9a570906 cert9.db 405d55178e866a115c1aa975fccfa764 key4.db 7b9136cb03f07ae62eb213a5239fda71 pkcs11.txt Provide pre-created databases with a blank certificate to fix non-determinism issue. And these database files are from nss qemux86-64 build. (From OE-Core rev: e64a30f7af87fa960b012ace92c51b88e8abae68) Signed-off-by: Kai Kang Signed-off-by: Richard Purdie

nss :improve reproducibility

2018-08-29T09:42:48+00:00

- Explicitly requests the newer database `sql:' rather than retrieved from NSS_DEFAULT_DB_TYPE - Removes build path prefix from pkcs11.txt Refers certutil manual: [certutil manual] -d [prefix]directory Specify the database directory containing the certificate and key database files. certutil supports two types of databases: the legacy security databases (cert8.db, key3.db, and secmod.db) and new SQLite databases (cert9.db, key4.db, and pkcs11.txt). NSS recognizes the following prefixes: sql: requests the newer database dbm: requests the legacy database If no prefix is specified the default type is retrieved from NSS_DEFAULT_DB_TYPE. If NSS_DEFAULT_DB_TYPE is not set then dbm: is the default. [certutil manual] (From OE-Core rev: e9b99efe4b5cf7e810156f7bb55736e01be36a45) Signed-off-by: Hongxu Jia Signed-off-by: Richard Purdie

nss: update to 3.38

2018-07-06T21:55:02+00:00

remove patch now included in release. includes: CVE-2018-0495 (From OE-Core rev: f0ad38d02da0bbcc1534dcc99d10436675932ed9) Signed-off-by: Armin Kuster Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

nss: update to 3.37.1

2018-06-27T12:55:21+00:00

remove Fix-compilation-for-X32.patch as a solution simular is included in update. notable changes: The TLS 1.3 implementation was updated to Draft 28. The CA certificates list was updated to version 2.24. refresh patches fix 32 bit build error nss bug: https://bugzilla.mozilla.org/show_bug.cgi?format=default&id=1459739 (From OE-Core rev: 1ed072515f2a23de75ee56b86d8607c85b42605c) Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

nss: Fix build error for aarch64be.

2018-06-27T12:55:21+00:00

(From OE-Core rev: 2d9a8a5539342faa1827f4902b1095a9f3448c66) Signed-off-by: Lei Maohui Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

nss: update to 3.36.1

2018-05-29T20:07:14+00:00

removed patches included in update: 0001-Bug-1437734-Use-snprintf-in-sign.c-r-ttaubert.patch nss-build-hacl-poly1305-aarch64.patch (From OE-Core rev: 9755699275e6290950145685c186082dfcd28a9e) Signed-off-by: Armin Kuster Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

nss: Use snprintf in sign.c

2018-03-29T23:31:18+00:00

Fies security warnings | sign.c:86:31: error: 'sprintf' may write a terminating nul past the end of the destination [-Werror=format-overflow=] | sprintf(fullfn, "%s/%s", tree, tempfn); (From OE-Core rev: 7171e96f3a5f54c63674cf5282aea31bcb9cd7f9) Signed-off-by: Khem Raj Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

nss: update to 3.35

2018-03-29T23:31:18+00:00

(From OE-Core rev: d136548ad7aef23021eac6af2ffc6317f36bd1c5) Signed-off-by: Armin Kuster Signed-off-by: Ross Burton Signed-off-by: Richard Purdie