summaryrefslogtreecommitdiffstats
path: root/meta/recipes-support/nss
AgeCommit message (Collapse)Author
2017-02-09nss: Fix nss-native so the checksum doesn't change with BUILD_ARCHRichard Purdie
Switching between 32 and 64 bit BUILD_ARCH shows: $ bitbake-diffsigs tmp-sstatesamehash*/stamps/*/nss-native/3.27.1-r0.do_compile.sigdata.* basehash changed from 944cc4554a823ba966aeda0ac3d33b79 to 2475db3659c248d81d0e4dadb3c1b4cd Variable SITEINFO_BITS value changed from '32' to '64' We shouldn't have this dependency and it would fail oe-selftest test_sstate_32_64_same_hash if nss-native were included, therefore exclude it. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-19nss: Add PACKAGE_WRITE_DEPSJussi Kukkonen
nss-native is required in postinst. It's also needed during build so not removed from DEPENDS. Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com>
2017-01-09nss: fix for x32Christopher Larson
This was casting to a pointer, and the pointer sizes are 32-bit on X32, not 64-bit. Adjust as appropriate. Signed-off-by: Christopher Larson <chris_larson@mentor.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-01-09nss: Fix postinstall scriptDavid Vincent
When installing NSS on a read-only rootfs, the current postinstall scriptlet exits after having run the signing part. This causes an error when appending the task because the rest of the script is simply ignored and therefore never run. Signed-off-by: David Vincent <freesilicon@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-10-28nss: update to 3.27.1Alexander Kanavin
Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-09-03nss: update to 3.25Alexander Kanavin
Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-07-20nss: Fix build on mips/clangKhem Raj
This issue is also reported here https://trac.macports.org/ticket/51709 Patch is also from same ticket Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-07-20nss: Fix build with clangKhem Raj
Add a patch to disable a clang specific warning and avoid passing clang options to gcc when we have cross compiler is clang but host compiler is gcc We do not need to use target cflags when building native pieces and hence avoid the inter-mixing of compiler options Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-07-10nss: update to 3.24Alexander Kanavin
Drop merged 0001-Fix-build-failure-on-opensuse-13.1.patch Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-05-13nss: Upgrade to 3.23Khem Raj
Disable Werror on native builds. This helps in building nss-native on build hosts which have gcc < 4.9 eg. ubuntu 14.04 The real issue is that we use headers from native staging sysroot and it has the updated glibc headers which then ends up with errors e.g. | In function 'memset', | inlined from 'sec_PKCS7Encrypt' at p7local.c:715:14: | /usr/include/x86_64-linux-gnu/bits/string3.h:81:30: error: call to '__warn_memset_zero_len' declared with attribute warning: memset used with constant zero length parameter; this could be due to transposed parameters [-Werror] | __warn_memset_zero_len (); | ^ | cc1: all warnings being treated as errors | make[2]: *** [Linux3.4_x86_64_glibc_PTH_64_OPT.OBJ/p7local.o] Error 1 Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-16nss: define RPATH variable for nss-nativeMarkus Lehtonen
Otherwise the nss libs do not get any RPATH/RUNPATH. Consequently, the .so dependencies of nss libs are always searched from the base lib directories of the host (i.e. /lib/ and /usr/lib). This causes problems with nss-native where the .so's should be searched from the base lib directories of the sysroot instead of the host file system. This particular problem has probably been unnoticed as most users are likely to have nss libraries installed on their host system. In this case everything most likely work as expected. [YOCTO #9041] Signed-off-by: Markus Lehtonen <markus.lehtonen@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-01-22nss: Undefine HAVE_SYS_CDEFS_HKhem Raj
nss's build system assumes that cdefs.h is always available on linux which is not the case with musl Signed-off-by: Khem Raj <raj.khem@gmail.com>
2016-01-19nss: update to 3.21Alexander Kanavin
Explicitly disable tests (they were previously implicitly disabled upstream), as they cause various architecture-specific build failures. Add 0001-Fix-build-failure-on-opensuse-13.1.patch that fixes compilation using gcc 4.8. Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-12-16meta: more removals of redunant FILES_${PN}-dbgRoss Burton
In some recipes overly-split -dbg packages were merged into PN-dbg. Unless there's a very good reason, recipes should have a single -dev and -dbg package. Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-12-08package_regex.inc: split the rest of the entries to their recipesAlexander Kanavin
Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-08-16nss: Upgrade 3.19.1 -> 3.19.2Jussi Kukkonen
This is a bug fix release. Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-07-31nss: advance to version 3.19.1Joe Slater
Picks up fixes for CVE-2015-2721 and CVE-2015-2730. Specify previously overlooked license file COPYING. Fold nss.inc into recipe. Signed-off-by: Joe Slater <jslater@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-04-24nss: improve the script signlibs.shJackie Huang
The *.chk files are installed in ${libdir} by nss, which is already known, no need to 'find' to get the file list, and 'ls' is more faster than 'find'. Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-04-09nss: Fix build in x32 ABIAníbal Limón
When try to build nss with x32 ABI enabled fails because it need to be specified USE_X32 env var. [YOCTO #7420] Signed-off-by: Aníbal Limón <anibal.limon@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-04-06nss: generate debug infoJoe Slater
Because the build of nss seems to ignore CFLAGS, we never have put source code in the -dbg package. We do not address the CFLAGS issue, but we do add -g to the definition of CC so that we will generate debug info. We also let package.bbclass populate the -dbg package instead of forcing the contents locally. Signed-off-by: Joe Slater <jslater@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-03-22nss: move /usr/bin/smime to nss-smimeMartin Jansa
* remove perl runtime dependency from main package Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-01-28nss: update package to 3.17.3 and build fixArmin Kuster
Update includes: CVE-2014-1569 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1569 for changelog information see https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.17.3_release_notes We had a build failure on 32 bit hosts so including a patch from: http://git.yoctoproject.org/cgit.cgi/poky-contrib/log/?h=mhatle/dora-misc Wenzong Fan (1): nss: workaround multilib build on 32bit host Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2014-11-12nss: Upgrade to 3.17.2Chong Lu
Signed-off-by: Chong Lu <Chong.Lu@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2014-11-06nss: Upgrade to 3.17Saul Wold
CVE patches removed since they have been implemented upstream Rename patch dir (files) to generic PN name Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2014-09-30nss: nss.pc is not target specificSaul Wold
RPM4 requires an nss-native component Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-09-29nss.inc: Fix LICENSEElizabeth Flanagan
From reading the COPYING and various license headers, the nss LICENSE was incorrect. It's actually MPL-2.0 (not 1.1) with a few different Or instances. Signed-off-by: Elizabeth Flanagan <elizabeth.flanagan@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2014-08-27nss: CVE-2014-1544Li Wang
the patch comes from: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-1544 https://hg.mozilla.org/projects/nss/rev/204f22c527f8 author Robert Relyea <rrelyea@redhat.com> https://bugzilla.mozilla.org/show_bug.cgi?id=963150 Bug 963150: Add nssCertificate_AddRef and nssCertificate_Destroy calls to PK11_ImportCert to prevent nssTrustDomain_AddCertsToCache from freeing the CERTCertificate associated with the NSSCertificate. r=wtc. Signed-off-by: Li Wang <li.wang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-08-06nss*: Replace hardcoded "/etc" with "${sysconfdir}"Robert P. J. Day
Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-07-29nss: CVE-2013-5606Li Wang
the patch comes from: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-5606 https://bugzilla.mozilla.org/show_bug.cgi?id=910438 http://hg.mozilla.org/projects/nss/rev/d29898e0981c The CERT_VerifyCert function in lib/certhigh/certvfy.c in Mozilla Network Security Services (NSS) 3.15 before 3.15.3 provides an unexpected return value for an incompatible key-usage certificate when the CERTVerifyLog argument is valid, which might allow remote attackers to bypass intended access restrictions via a crafted certificate. Signed-off-by: Li Wang <li.wang@windriver.com> Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-06-24nss-3.15.1: fix CVE-2013-1739yzhu1
Mozilla Network Security Services (NSS) before 3.15.2 does not ensure that data structures are initialized before read operations, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a decryption failure. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1739 Signed-off-by: yzhu1 <yanjun.zhu@windriver.com> Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-05-21nss: CVE-2013-1740Li Wang
the patch comes from: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1740 https://bugzilla.mozilla.org/show_bug.cgi?id=919877 https://bugzilla.mozilla.org/show_bug.cgi?id=713933 changeset: 10946:f28426e944ae user: Wan-Teh Chang <wtc@google.com> date: Tue Nov 26 16:44:39 2013 -0800 summary: Bug 713933: Handle the return value of both ssl3_HandleRecord calls changeset: 10945:774c7dec7565 user: Wan-Teh Chang <wtc@google.com> date: Mon Nov 25 19:16:23 2013 -0800 summary: Bug 713933: Declare the |falseStart| local variable in the smallest changeset: 10848:141fae8fb2e8 user: Wan-Teh Chang <wtc@google.com> date: Mon Sep 23 11:25:41 2013 -0700 summary: Bug 681839: Allow SSL_HandshakeNegotiatedExtension to be called before the handshake is finished, r=brian@briansmith.org changeset: 10898:1b9c43d28713 user: Brian Smith <brian@briansmith.org> date: Thu Oct 31 15:40:42 2013 -0700 summary: Bug 713933: Make SSL False Start work with asynchronous certificate validation, r=wtc Signed-off-by: Li Wang <li.wang@windriver.com> Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Saul Wold <sgw@linux.intel.com>
2014-05-21nss: CVE-2014-1492Li Wang
the patch comes from: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1492 https://bugzilla.mozilla.org/show_bug.cgi?id=903885 changeset: 11063:709d4e597979 user: Kai Engert <kaie@kuix.de> date: Wed Mar 05 18:38:55 2014 +0100 summary: Bug 903885, address requests to clarify comments from wtc changeset: 11046:2ffa40a3ff55 tag: tip user: Wan-Teh Chang <wtc@google.com> date: Tue Feb 25 18:17:08 2014 +0100 summary: Bug 903885, fix IDNA wildcard handling v4, r=kaie changeset: 11045:15ea62260c21 user: Christian Heimes <sites@cheimes.de> date: Mon Feb 24 17:50:25 2014 +0100 summary: Bug 903885, fix IDNA wildcard handling, r=kaie Signed-off-by: Li Wang <li.wang@windriver.com> Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Saul Wold <sgw@linux.intel.com>
2014-03-28nss-3.15.1: fix CVE-2013-5605yanjun.zhu
Mozilla Network Security Services (NSS) 3.14 before 3.14.5 and 3.15 before 3.15.3 allows remote attackers to cause a denial of service or possibly have unspecified other impact via invalid handshake packets. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-5605 Signed-off-by: yanjun.zhu <yanjun.zhu@windriver.com> Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-03-28nss-3.15.1: fix CVE-2013-1741yanjun.zhu
Integer overflow in Mozilla Network Security Services (NSS) 3.15 before 3.15.3 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large size value. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1741 Signed-off-by: yanjun.zhu <yanjun.zhu@windriver.com> Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-02-13Revert "nss: avoid to use the hardcode kernel version"Richard Purdie
This reverts commit 4c80c557508e088fe226bfa1834464b505404652. We *cannot* have nss becoming machine specific, that makes no sense.
2014-02-13nss: avoid to use the hardcode kernel versionRoy Li
Read kernel version from ${STAGING_KERNEL_DIR}/kernel-abiversion, to avoid to use the hardcode kernel version. Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-02-02nss: Add nativesdk to BBCLASSEXTEND and bugfixDavid Nyström
Since shsignlibs is used from the nss postinstall hook. It should be included in nativesdk to make offline rootfs construction possible. Signed-off-by: David Nyström <david.nystrom@enea.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2013-10-26nss: don't need set SRC_URI with both += and _appendMing Liu
Signed-off-by: Ming Liu <ming.liu@windriver.com> Signed-off-by: Saul Wold <sgw@linux.intel.com>
2013-09-30nss: Fix return codes in postinstallDavid Nyström
exit 0 was done if $D != NULL, if one or more shlibsign executions fails. Signed-off-by: David Nyström <david.nystrom@enea.com> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2013-07-26nss:fix postinst failed at rootfs timeHongxu Jia
Create checksum file at rootfs time to support read-only rootfs. [YOCTO #4879] Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Saul Wold <sgw@linux.intel.com>
2013-07-12nss: fix incorrect shebang line of perl scriptHongxu Jia
Replace incorrect shebang line with `#!/usr/bin/env perl'. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Saul Wold <sgw@linux.intel.com>
2013-07-12nss: create checksum files for the nss librariesHongxu Jia
Add checksum files required for the NSS softoken to operate in FIPS 140 mode. The shlibsign is invoked to sign the libraries, and it is built for the target architecture and doesn't support cross-compiling so far. Invoke shlibsign at target's first boot time to generate checksum files. https://developer.mozilla.org/en-US/docs/NSS/NSS_Tech_Notes/nss_tech_note6 http://en.wikipedia.org/wiki/FIPS_140 https://bugzilla.mozilla.org/show_bug.cgi?id=681624 Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Saul Wold <sgw@linux.intel.com>
2013-07-12nss: add version 3.15.1Hongxu Jia
Network Security Services (NSS) is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS 5, PKCS 7, PKCS 11, PKCS 12, S/MIME, X.509 v3 certificates, and other security standards. [YOCTO #4096] Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Saul Wold <sgw@linux.intel.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-04-27 13:40:31 +0000