svn commit: r522462 - in head/security: ca_root_nss nss nss/files
Jan Beich
jbeich at FreeBSD.org
Wed Jan 8 22:51:14 UTC 2020
Author: jbeich
Date: Wed Jan 8 22:51:12 2020
New Revision: 522462
URL: https://svnweb.freebsd.org/changeset/ports/522462
Log:
security/nss: update to 3.49
Changes: https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.49_release_notes
Changes: https://hg.mozilla.org/projects/nss/shortlog/NSS_3_49_RTM
ABI: https://abi-laboratory.pro/tracker/timeline/nss/
Reported by: Repology
Modified:
head/security/ca_root_nss/Makefile (contents, props changed)
head/security/ca_root_nss/distinfo (contents, props changed)
head/security/nss/Makefile (contents, props changed)
head/security/nss/distinfo (contents, props changed)
head/security/nss/files/patch-bug1575843 (contents, props changed)
head/security/nss/files/patch-lib_freebl_blinit.c (contents, props changed)
Modified: head/security/ca_root_nss/Makefile
==============================================================================
--- head/security/ca_root_nss/Makefile Wed Jan 8 21:40:19 2020 (r522461)
+++ head/security/ca_root_nss/Makefile Wed Jan 8 22:51:12 2020 (r522462)
@@ -32,7 +32,7 @@ PLIST_SUB+= CERTDIR=${CERTDIR}
# !!! Please DO NOT submit patches for new version until it has !!!
# !!! been committed there first. !!!
# !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
-VERSION_NSS= 3.48
+VERSION_NSS= 3.49
#NSS_SUFFIX= -with-ckbi-1.98
CERTDATA_TXT_PATH= nss-${VERSION_NSS}/nss/lib/ckfw/builtins/certdata.txt
BUNDLE_PROCESSOR= MAca-bundle.pl
Modified: head/security/ca_root_nss/distinfo
==============================================================================
--- head/security/ca_root_nss/distinfo Wed Jan 8 21:40:19 2020 (r522461)
+++ head/security/ca_root_nss/distinfo Wed Jan 8 22:51:12 2020 (r522462)
@@ -1,3 +1,3 @@
-TIMESTAMP = 1575417811
-SHA256 (nss-3.48.tar.gz) = 3f9c822a86a4e3e1bfe63e2ed0f922d8b7c2e0b7cafe36774b1c627970d0f8ac
-SIZE (nss-3.48.tar.gz) = 76481237
+TIMESTAMP = 1578083263
+SHA256 (nss-3.49.tar.gz) = 6738094dc4fd63061118a122bf3999a64fe8c7117fc52f6e81c2279181bde71d
+SIZE (nss-3.49.tar.gz) = 76488781
Modified: head/security/nss/Makefile
==============================================================================
--- head/security/nss/Makefile Wed Jan 8 21:40:19 2020 (r522461)
+++ head/security/nss/Makefile Wed Jan 8 22:51:12 2020 (r522462)
@@ -2,7 +2,7 @@
# $FreeBSD$
PORTNAME= nss
-PORTVERSION= 3.48
+PORTVERSION= 3.49
CATEGORIES= security
MASTER_SITES= MOZILLA/security/${PORTNAME}/releases/${DISTNAME:tu:C/[-.]/_/g}_RTM/src
Modified: head/security/nss/distinfo
==============================================================================
--- head/security/nss/distinfo Wed Jan 8 21:40:19 2020 (r522461)
+++ head/security/nss/distinfo Wed Jan 8 22:51:12 2020 (r522462)
@@ -1,3 +1,3 @@
-TIMESTAMP = 1575417811
-SHA256 (nss-3.48.tar.gz) = 3f9c822a86a4e3e1bfe63e2ed0f922d8b7c2e0b7cafe36774b1c627970d0f8ac
-SIZE (nss-3.48.tar.gz) = 76481237
+TIMESTAMP = 1578083263
+SHA256 (nss-3.49.tar.gz) = 6738094dc4fd63061118a122bf3999a64fe8c7117fc52f6e81c2279181bde71d
+SIZE (nss-3.49.tar.gz) = 76488781
Modified: head/security/nss/files/patch-bug1575843
==============================================================================
--- head/security/nss/files/patch-bug1575843 Wed Jan 8 21:40:19 2020 (r522461)
+++ head/security/nss/files/patch-bug1575843 Wed Jan 8 22:51:12 2020 (r522462)
@@ -2,9 +2,9 @@ Detect ARM CPU features on FreeBSD.
elf_aux_info is similar to getauxval but is nop on aarch64.
---- lib/freebl/blinit.c.orig 2019-08-30 15:46:32 UTC
+--- lib/freebl/blinit.c.orig 2020-01-03 20:27:43 UTC
+++ lib/freebl/blinit.c
-@@ -96,8 +96,8 @@ CheckX86CPUSupport()
+@@ -101,8 +101,8 @@ CheckX86CPUSupport()
#ifndef __has_include
#define __has_include(x) 0
#endif
@@ -15,7 +15,7 @@ elf_aux_info is similar to getauxval but is nop on aar
/* This might be conflict with host compiler */
#if !defined(__ANDROID__)
#include <sys/auxv.h>
-@@ -106,6 +106,10 @@ extern unsigned long getauxval(unsigned long type) __a
+@@ -111,6 +111,10 @@ extern unsigned long getauxval(unsigned long type) __a
#else
static unsigned long (*getauxval)(unsigned long) = NULL;
#endif /* defined(__GNUC__) && __GNUC__ >= 2 && defined(__ELF__)*/
@@ -26,7 +26,7 @@ elf_aux_info is similar to getauxval but is nop on aar
#ifndef AT_HWCAP2
#define AT_HWCAP2 26
-@@ -118,6 +122,9 @@ static unsigned long (*getauxval)(unsigned long) = NUL
+@@ -123,6 +127,9 @@ static unsigned long (*getauxval)(unsigned long) = NUL
/* clang-format on */
#if defined(__aarch64__)
@@ -36,15 +36,16 @@ elf_aux_info is similar to getauxval but is nop on aar
// Defines from hwcap.h in Linux kernel - ARM64
#ifndef HWCAP_AES
#define HWCAP_AES (1 << 3)
-@@ -138,6 +145,7 @@ CheckARMSupport()
- char *disable_arm_neon = PR_GetEnvSecure("NSS_DISABLE_ARM_NEON");
- char *disable_hw_aes = PR_GetEnvSecure("NSS_DISABLE_HW_AES");
- char *disable_pmull = PR_GetEnvSecure("NSS_DISABLE_PMULL");
-+#if defined(__linux__)
+@@ -149,7 +156,7 @@ CheckARMSupport()
+ arm_pmull_support_ = arm_crypto_support && disable_pmull == NULL;
+ arm_sha1_support_ = arm_crypto_support;
+ arm_sha2_support_ = arm_crypto_support;
+-#else
++#elif defined(__linux__)
if (getauxval) {
long hwcaps = getauxval(AT_HWCAP);
arm_aes_support_ = hwcaps & HWCAP_AES && disable_hw_aes == NULL;
-@@ -145,6 +153,23 @@ CheckARMSupport()
+@@ -157,7 +164,23 @@ CheckARMSupport()
arm_sha1_support_ = hwcaps & HWCAP_SHA1;
arm_sha2_support_ = hwcaps & HWCAP_SHA2;
}
@@ -64,11 +65,11 @@ elf_aux_info is similar to getauxval but is nop on aar
+ arm_pmull_support_ = ID_AA64ISAR0_AES_VAL(id_aa64isar0) == ID_AA64ISAR0_AES_PMULL && disable_pmull == NULL;
+ arm_sha1_support_ = ID_AA64ISAR0_SHA1_VAL(id_aa64isar0) == ID_AA64ISAR0_SHA1_BASE;
+ arm_sha2_support_ = ID_AA64ISAR0_SHA2_VAL(id_aa64isar0) >= ID_AA64ISAR0_SHA2_BASE;
-+#endif /* defined(__linux__) */
+ #endif
/* aarch64 must support NEON. */
arm_neon_support_ = disable_arm_neon == NULL;
}
-@@ -187,7 +203,7 @@ GetNeonSupport()
+@@ -200,7 +223,7 @@ GetNeonSupport()
// If no getauxval, compiler generate NEON instruction by default,
// we should allow NOEN support.
return PR_TRUE;
@@ -77,7 +78,7 @@ elf_aux_info is similar to getauxval but is nop on aar
// Android's cpu-features.c detects features by the following logic
//
// - Call getauxval(AT_HWCAP)
-@@ -201,6 +217,10 @@ GetNeonSupport()
+@@ -214,6 +237,10 @@ GetNeonSupport()
if (getauxval) {
return (getauxval(AT_HWCAP) & HWCAP_NEON);
}
@@ -88,7 +89,7 @@ elf_aux_info is similar to getauxval but is nop on aar
#endif /* defined(__ARM_NEON) || defined(__ARM_NEON__) */
return PR_FALSE;
}
-@@ -249,6 +269,7 @@ void
+@@ -262,6 +289,7 @@ void
CheckARMSupport()
{
char *disable_hw_aes = PR_GetEnvSecure("NSS_DISABLE_HW_AES");
@@ -96,7 +97,7 @@ elf_aux_info is similar to getauxval but is nop on aar
if (getauxval) {
// Android's cpu-features.c uses AT_HWCAP2 for newer features.
// AT_HWCAP2 is implemented on newer devices / kernel, so we can trust
-@@ -257,13 +278,19 @@ CheckARMSupport()
+@@ -270,13 +298,19 @@ CheckARMSupport()
// AT_HWCAP2 isn't supported by glibc or Linux kernel, getauxval will
// returns 0.
long hwcaps = getauxval(AT_HWCAP2);
Modified: head/security/nss/files/patch-lib_freebl_blinit.c
==============================================================================
--- head/security/nss/files/patch-lib_freebl_blinit.c Wed Jan 8 21:40:19 2020 (r522461)
+++ head/security/nss/files/patch-lib_freebl_blinit.c Wed Jan 8 22:51:12 2020 (r522462)
@@ -2,9 +2,9 @@ qemu:handle_cpu_signal received signal outside vCPU co
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=240037
---- lib/freebl/blinit.c.orig 2019-08-30 15:46:32 UTC
+--- lib/freebl/blinit.c.orig 2020-01-03 20:27:43 UTC
+++ lib/freebl/blinit.c
-@@ -163,12 +163,14 @@ CheckARMSupport()
+@@ -174,12 +174,14 @@ CheckARMSupport()
#ifndef ID_AA64ISAR0_SHA2_VAL
#define ID_AA64ISAR0_SHA2_VAL ID_AA64ISAR0_SHA2
#endif
@@ -22,6 +22,6 @@ https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=2400
+ arm_sha1_support_ = ID_AA64ISAR0_SHA1_VAL(id_aa64isar0) == ID_AA64ISAR0_SHA1_BASE;
+ arm_sha2_support_ = ID_AA64ISAR0_SHA2_VAL(id_aa64isar0) >= ID_AA64ISAR0_SHA2_BASE;
+ }
- #endif /* defined(__linux__) */
+ #endif
/* aarch64 must support NEON. */
arm_neon_support_ = disable_arm_neon == NULL;
More information about the svn-ports-head
mailing list