Index: head/security/ca_root_nss/Makefile =================================================================== --- head/security/ca_root_nss/Makefile (revision 525756) +++ head/security/ca_root_nss/Makefile (revision 525757) @@ -1,68 +1,68 @@ # $FreeBSD$ PORTNAME= ca_root_nss PORTVERSION= ${VERSION_NSS} CATEGORIES= security MASTER_SITES= MOZILLA/security/nss/releases/${DISTNAME:tu:C/[-.]/_/g}_RTM/src DISTNAME= nss-${VERSION_NSS}${NSS_SUFFIX} MAINTAINER= ports-secteam@FreeBSD.org COMMENT= Root certificate bundle from the Mozilla Project LICENSE= MPL20 OPTIONS_DEFINE= ETCSYMLINK OPTIONS_DEFAULT= ETCSYMLINK OPTIONS_SUB= yes ETCSYMLINK_DESC= Add symlink to /etc/ssl/cert.pem ETCSYMLINK_CONFLICTS_INSTALL= ca-roots-[0-9]* USES= perl5 ssl:build USE_PERL5= build NO_ARCH= yes NO_WRKSUBDIR= yes CERTDIR?= share/certs PLIST_SUB+= CERTDIR=${CERTDIR} # !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! # !!! These versions are intended to track security/nss. !!! # !!! Please DO NOT submit patches for new version until it has !!! # !!! been committed there first. !!! # !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! -VERSION_NSS= 3.49.2 +VERSION_NSS= 3.50 #NSS_SUFFIX= -with-ckbi-1.98 CERTDATA_TXT_PATH= nss-${VERSION_NSS}/nss/lib/ckfw/builtins/certdata.txt BUNDLE_PROCESSOR= MAca-bundle.pl SUB_FILES= MAca-bundle.pl pkg-message SUB_LIST= VERSION_NSS=${VERSION_NSS} do-extract: @${MKDIR} ${WRKDIR} @${TAR} -C ${WRKDIR} -xf ${DISTDIR}/nss-${VERSION_NSS}${NSS_SUFFIX}${EXTRACT_SUFX} \ ${CERTDATA_TXT_PATH} @${CP} ${WRKDIR}/${CERTDATA_TXT_PATH} ${WRKDIR} @${RM} -r ${WRKDIR}/nss-${VERSION_NSS} do-build: apply-slist @${SETENV} PATH=${LOCALBASE}/bin:$${PATH} \ ${PERL} ${WRKDIR}/${BUNDLE_PROCESSOR} \ < ${WRKDIR}/certdata.txt > \ ${WRKDIR}/ca-root-nss.crt do-install: ${MKDIR} ${STAGEDIR}${PREFIX}/${CERTDIR} ${INSTALL_DATA} ${WRKDIR}/ca-root-nss.crt ${STAGEDIR}${PREFIX}/${CERTDIR} ${MKDIR} ${STAGEDIR}${PREFIX}/etc/ssl ${LN} -sf ${PREFIX}/${CERTDIR}/ca-root-nss.crt ${STAGEDIR}${PREFIX}/etc/ssl/cert.pem.sample ${MKDIR} ${STAGEDIR}${PREFIX}/openssl ${LN} -sf ${PREFIX}/${CERTDIR}/ca-root-nss.crt ${STAGEDIR}${PREFIX}/openssl/cert.pem.sample do-install-ETCSYMLINK-on: ${MKDIR} ${STAGEDIR}/etc/ssl ${LN} -sf ${PREFIX}/${CERTDIR}/ca-root-nss.crt ${STAGEDIR}/etc/ssl/cert.pem .include Index: head/security/ca_root_nss/distinfo =================================================================== --- head/security/ca_root_nss/distinfo (revision 525756) +++ head/security/ca_root_nss/distinfo (revision 525757) @@ -1,3 +1,3 @@ -TIMESTAMP = 1579818145 -SHA256 (nss-3.49.2.tar.gz) = faa7502c3ce9240d4be2aa88f63d88cf7d1cc512060e63ef21a7813c236160b2 -SIZE (nss-3.49.2.tar.gz) = 76489641 +TIMESTAMP = 1581109126 +SHA256 (nss-3.50.tar.gz) = 185df319775243f5f5daa9d49b7f9cc5f2b389435be3247c3376579bee063ba7 +SIZE (nss-3.50.tar.gz) = 78041630 Index: head/security/nss/Makefile =================================================================== --- head/security/nss/Makefile (revision 525756) +++ head/security/nss/Makefile (revision 525757) @@ -1,105 +1,104 @@ # Created by: Maxim Sobolev # $FreeBSD$ PORTNAME= nss -PORTVERSION= 3.49.2 -PORTREVISION= 2 +PORTVERSION= 3.50 CATEGORIES= security MASTER_SITES= MOZILLA/security/${PORTNAME}/releases/${DISTNAME:tu:C/[-.]/_/g}_RTM/src MAINTAINER= gecko@FreeBSD.org COMMENT= Libraries to support development of security-enabled applications LICENSE= MPL20 LICENSE_FILE= ${WRKSRC}/COPYING LIB_DEPENDS= libnspr4.so:devel/nspr \ libsqlite3.so:databases/sqlite3 TEST_DEPENDS= bash:shells/bash USES= cpe gmake perl5 MAKE_JOBS_UNSAFE= yes WRKSRC_SUBDIR= nss USE_LDCONFIG= yes CPE_VENDOR= mozilla CPE_PRODUCT= network_security_services USE_PERL5= build MAKE_ENV= LIBRARY_PATH="${LOCALBASE}/lib" \ SQLITE_INCLUDE_DIR="${LOCALBASE}/include" \ FREEBL_LOWHASH=1 \ NSS_DISABLE_GTESTS=1 \ NSS_USE_SYSTEM_SQLITE=1 CFLAGS+= -I${LOCALBASE}/include/nspr SUB_FILES= nss-config nss.pc SUB_LIST= PORTVERSION=${PORTVERSION} DIST= ${WRKSRC:H}/dist EXTRACT_AFTER_ARGS=--exclude */lib/zlib --exclude */lib/dbm --exclude */lib/sqlite INSTALL_BINS= certutil cmsutil crlutil derdump makepqg \ mangle modutil ocspclnt oidcalc p7content p7env p7sign \ p7verify pk12util rsaperf shlibsign signtool signver \ ssltap strsclnt symkeyutil vfychain vfyserv OPTIONS_DEFINE= DEBUG .include .if ! ${PORT_OPTIONS:MDEBUG} MAKE_ENV+= BUILD_OPT=1 BINS= ${DIST}/${OPSYS}${OSREL}_OPT.OBJ .else BINS= ${DIST}/${OPSYS}${OSREL}_DBG.OBJ .endif .if ${ARCH} == powerpc64 USES+= compiler:c++11-lang # -mcrypto -mvsx .endif .if ${OPSYS} == FreeBSD && ${ARCH} == amd64 USE_BINUTILS= # intel-gcm.s CC+= -B${LOCALBASE}/bin .endif do-test: cd ${WRKSRC}/tests; \ ${SETENV} PATH="${BINS}/bin:${PATH}" \ LD_LIBRARY_PATH="${BINS}/lib" \ ${MAKE_ENV} \ bash ./all.sh @if ${GREP} -Fh '>Failed<' \ ${WRKSRC:H}/tests_results/security/*/results.html; then \ echo "Some tests have failed. Let ${MAINTAINER} know."; \ exit 1; \ else \ echo "All tests succeeded. Good news."; \ fi post-patch: @${REINPLACE_CMD} '/NSS_DEFAULT_SYSTEM/s,/etc,${PREFIX}&,' \ ${WRKSRC}/lib/sysinit/nsssysinit.c @cd ${WRKSRC} && \ ${FIND} . -name "*.c" -o -name "*.h" | \ ${XARGS} ${REINPLACE_CMD} -e 's|"nspr.h"||' do-install: ${MKDIR} ${STAGEDIR}${PREFIX}/include/nss ${STAGEDIR}${PREFIX}/lib ${FIND} ${DIST}/public/nss -type l \ -exec ${INSTALL_DATA} {} ${STAGEDIR}${PREFIX}/include/nss \; ${INSTALL_LIB} ${BINS}/lib/*.so \ ${STAGEDIR}${PREFIX}/lib/ ${INSTALL_DATA} ${BINS}/lib/libcrmf.a \ ${STAGEDIR}${PREFIX}/lib/ .for bin in ${INSTALL_BINS} ${INSTALL_PROGRAM} ${BINS}/bin/${bin} \ ${STAGEDIR}${PREFIX}/bin .endfor ${INSTALL_SCRIPT} ${WRKDIR}/nss-config ${STAGEDIR}${PREFIX}/bin ${INSTALL_DATA} ${WRKDIR}/nss.pc ${STAGEDIR}${PREFIX}/libdata/pkgconfig .include Index: head/security/nss/distinfo =================================================================== --- head/security/nss/distinfo (revision 525756) +++ head/security/nss/distinfo (revision 525757) @@ -1,3 +1,3 @@ -TIMESTAMP = 1579818145 -SHA256 (nss-3.49.2.tar.gz) = faa7502c3ce9240d4be2aa88f63d88cf7d1cc512060e63ef21a7813c236160b2 -SIZE (nss-3.49.2.tar.gz) = 76489641 +TIMESTAMP = 1581109126 +SHA256 (nss-3.50.tar.gz) = 185df319775243f5f5daa9d49b7f9cc5f2b389435be3247c3376579bee063ba7 +SIZE (nss-3.50.tar.gz) = 78041630 Index: head/security/nss/files/patch-bug1602386 =================================================================== --- head/security/nss/files/patch-bug1602386 (revision 525756) +++ head/security/nss/files/patch-bug1602386 (nonexistent) @@ -1,49 +0,0 @@ -Fix build on FreeBSD/powerpc platforms. - -https://bugzilla.mozilla.org/show_bug.cgi?id=1602386 - ---- lib/freebl/Makefile.orig 2019-12-04 01:03:31.000000000 +0100 -+++ lib/freebl/Makefile 2019-12-11 16:48:47.959791000 +0100 -@@ -788,5 +788,7 @@ - endif - - ifeq ($(CPU_ARCH),ppc) --$(OBJDIR)/$(PROG_PREFIX)gcm-ppc$(OBJ_SUFFIX): CFLAGS += -mcrypto -maltivec -+$(OBJDIR)/$(PROG_PREFIX)gcm-ppc$(OBJ_SUFFIX): CFLAGS += -mcrypto -maltivec -mvsx -+$(OBJDIR)/$(PROG_PREFIX)gcm$(OBJ_SUFFIX): CFLAGS += -mcrypto -maltivec -mvsx -+$(OBJDIR)/$(PROG_PREFIX)rijndael$(OBJ_SUFFIX): CFLAGS += -mcrypto -maltivec -mvsx - endif ---- lib/freebl/blinit.c.orig 2019-12-11 17:45:06.930646000 +0100 -+++ lib/freebl/blinit.c 2019-12-11 17:50:04.797680000 +0100 -@@ -393,7 +393,12 @@ - - #if defined(__powerpc__) - -+#if defined(__FreeBSD__) && __FreeBSD__ < 12 -+#include -+#include -+#else - #include -+#endif - - // Defines from cputable.h in Linux kernel - PPC, letting us build on older kernels - #ifndef PPC_FEATURE2_VEC_CRYPTO -@@ -405,7 +410,17 @@ - { - char *disable_hw_crypto = PR_GetEnvSecure("NSS_DISABLE_PPC_GHASH"); - -- long hwcaps = getauxval(AT_HWCAP2); -+ unsigned long hwcaps = 0; -+#if defined(__linux__) -+ hwcaps = getauxval(AT_HWCAP2); -+#elif defined(__FreeBSD__) -+# if __FreeBSD__ >= 12 -+ elf_aux_info(AT_HWCAP2, &hwcaps, sizeof(hwcaps)); -+# else -+ size_t len = sizeof(hwcaps); -+ sysctlbyname("hw.cpu_features2", &hwcaps, &len, NULL, 0); -+# endif -+#endif - - ppc_crypto_support_ = hwcaps & PPC_FEATURE2_VEC_CRYPTO && disable_hw_crypto == NULL; - } Property changes on: head/security/nss/files/patch-bug1602386 ___________________________________________________________________ Deleted: fbsd:nokeywords ## -1 +0,0 ## -yes \ No newline at end of property Deleted: svn:eol-style ## -1 +0,0 ## -native \ No newline at end of property Deleted: svn:mime-type ## -1 +0,0 ## -text/plain \ No newline at end of property Index: head/security/nss/files/patch-bug1575843 =================================================================== --- head/security/nss/files/patch-bug1575843 (revision 525756) +++ head/security/nss/files/patch-bug1575843 (nonexistent) @@ -1,94 +0,0 @@ -commit fbde548e8114 -Author: Greg V -Date: Tue Jan 14 16:25:56 2020 +0000 - - Bug 1575843 - Detect AArch64 CPU features on FreeBSD r=jcj - - Environment checks are reogranized to be separate from platform code - to make it impossible to forget to check disable_FEATURE on one platform - but not the other. - - Differential Revision: https://phabricator.services.mozilla.com/D55386 ---- - lib/freebl/blinit.c | 48 +++++++++++++++++++++++++++++++++++++----------- - 1 file changed, 37 insertions(+), 11 deletions(-) - -diff --git lib/freebl/blinit.c lib/freebl/blinit.c -index 050b32113e..4723d3bb16 100644 ---- lib/freebl/blinit.c -+++ lib/freebl/blinit.c -@@ -133,6 +133,8 @@ static unsigned long (*getauxval)(unsigned long) = NULL; - /* clang-format on */ - - #if defined(__aarch64__) -+ -+#if defined(__linux__) - // Defines from hwcap.h in Linux kernel - ARM64 - #ifndef HWCAP_AES - #define HWCAP_AES (1 << 3) -@@ -146,30 +148,54 @@ static unsigned long (*getauxval)(unsigned long) = NULL; - #ifndef HWCAP_SHA2 - #define HWCAP_SHA2 (1 << 6) - #endif -+#endif /* defined(__linux__) */ -+ -+#if defined(__FreeBSD__) -+#include -+#include -+// Support for older version of armreg.h -+#ifndef ID_AA64ISAR0_AES_VAL -+#define ID_AA64ISAR0_AES_VAL ID_AA64ISAR0_AES -+#endif -+#ifndef ID_AA64ISAR0_SHA1_VAL -+#define ID_AA64ISAR0_SHA1_VAL ID_AA64ISAR0_SHA1 -+#endif -+#ifndef ID_AA64ISAR0_SHA2_VAL -+#define ID_AA64ISAR0_SHA2_VAL ID_AA64ISAR0_SHA2 -+#endif -+#endif /* defined(__FreeBSD__) */ - - void - CheckARMSupport() - { -- char *disable_arm_neon = PR_GetEnvSecure("NSS_DISABLE_ARM_NEON"); -- char *disable_hw_aes = PR_GetEnvSecure("NSS_DISABLE_HW_AES"); -- char *disable_pmull = PR_GetEnvSecure("NSS_DISABLE_PMULL"); - #if defined(_WIN64) - BOOL arm_crypto_support = IsProcessorFeaturePresent(PF_ARM_V8_CRYPTO_INSTRUCTIONS_AVAILABLE); -- arm_aes_support_ = arm_crypto_support && disable_hw_aes == NULL; -- arm_pmull_support_ = arm_crypto_support && disable_pmull == NULL; -+ arm_aes_support_ = arm_crypto_support; -+ arm_pmull_support_ = arm_crypto_support; - arm_sha1_support_ = arm_crypto_support; - arm_sha2_support_ = arm_crypto_support; --#else -+#elif defined(__linux__) - if (getauxval) { - long hwcaps = getauxval(AT_HWCAP); -- arm_aes_support_ = hwcaps & HWCAP_AES && disable_hw_aes == NULL; -- arm_pmull_support_ = hwcaps & HWCAP_PMULL && disable_pmull == NULL; -- arm_sha1_support_ = hwcaps & HWCAP_SHA1; -- arm_sha2_support_ = hwcaps & HWCAP_SHA2; -+ arm_aes_support_ = (hwcaps & HWCAP_AES) == HWCAP_AES; -+ arm_pmull_support_ = (hwcaps & HWCAP_PMULL) == HWCAP_PMULL; -+ arm_sha1_support_ = (hwcaps & HWCAP_SHA1) == HWCAP_SHA1; -+ arm_sha2_support_ = (hwcaps & HWCAP_SHA2) == HWCAP_SHA2; -+ } -+#elif defined(__FreeBSD__) -+ /* qemu-user does not support register access from userspace */ -+ if (PR_GetEnvSecure("QEMU_EMULATING") == NULL) { -+ uint64_t isar0 = READ_SPECIALREG(id_aa64isar0_el1); -+ arm_aes_support_ = ID_AA64ISAR0_AES_VAL(isar0) >= ID_AA64ISAR0_AES_BASE; -+ arm_pmull_support_ = ID_AA64ISAR0_AES_VAL(isar0) >= ID_AA64ISAR0_AES_PMULL; -+ arm_sha1_support_ = ID_AA64ISAR0_SHA1_VAL(isar0) >= ID_AA64ISAR0_SHA1_BASE; -+ arm_sha2_support_ = ID_AA64ISAR0_SHA2_VAL(isar0) >= ID_AA64ISAR0_SHA2_BASE; - } - #endif - /* aarch64 must support NEON. */ -- arm_neon_support_ = disable_arm_neon == NULL; -+ arm_neon_support_ = PR_GetEnvSecure("NSS_DISABLE_ARM_NEON") == NULL; -+ arm_aes_support_ &= PR_GetEnvSecure("NSS_DISABLE_HW_AES") == NULL; -+ arm_pmull_support_ &= PR_GetEnvSecure("NSS_DISABLE_PMULL") == NULL; - } - #endif /* defined(__aarch64__) */ - Property changes on: head/security/nss/files/patch-bug1575843 ___________________________________________________________________ Deleted: fbsd:nokeywords ## -1 +0,0 ## -yes \ No newline at end of property Deleted: svn:eol-style ## -1 +0,0 ## -native \ No newline at end of property Deleted: svn:mime-type ## -1 +0,0 ## -text/plain \ No newline at end of property Index: head/security/nss/files/patch-bug1609181 =================================================================== --- head/security/nss/files/patch-bug1609181 (revision 525756) +++ head/security/nss/files/patch-bug1609181 (nonexistent) @@ -1,31 +0,0 @@ -Detect ARM CPU features on FreeBSD. - -Implement `getauxval` via `elf_aux_info` to avoid code duplication. -`AT_HWCAP*` can be used on powerpc* and riscv64 as well. - -diff --git lib/freebl/blinit.c lib/freebl/blinit.c -index 4723d3bb16..63865eb103 100644 ---- lib/freebl/blinit.c -+++ lib/freebl/blinit.c -@@ -122,6 +122,21 @@ extern unsigned long getauxval(unsigned long type) __attribute__((weak)); - static unsigned long (*getauxval)(unsigned long) = NULL; - #endif /* defined(__GNUC__) && __GNUC__ >= 2 && defined(__ELF__)*/ - -+#if defined(__FreeBSD__) && !defined(__aarch64__) && __has_include() -+/* Avoid conflict with static declaration above */ -+#define getauxval freebl_getauxval -+static unsigned long getauxval(unsigned long type) -+{ -+ /* Only AT_HWCAP* return unsigned long */ -+ if (type != AT_HWCAP && type != AT_HWCAP2) -+ return 0; -+ -+ unsigned long ret = 0; -+ elf_aux_info(type, &ret, sizeof(ret)); -+ return ret; -+} -+#endif -+ - #ifndef AT_HWCAP2 - #define AT_HWCAP2 26 - #endif Property changes on: head/security/nss/files/patch-bug1609181 ___________________________________________________________________ Deleted: fbsd:nokeywords ## -1 +0,0 ## -yes \ No newline at end of property Deleted: svn:eol-style ## -1 +0,0 ## -native \ No newline at end of property Deleted: svn:mime-type ## -1 +0,0 ## -text/plain \ No newline at end of property