diff --git a/mozilla-nss.changes b/mozilla-nss.changes
index dddff5c..9ca6863 100644
--- a/mozilla-nss.changes
+++ b/mozilla-nss.changes
@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Thu Mar 16 09:11:53 UTC 2017 - rguenther@suse.com
+
+- Add nss-fix-hash.patch to fix hash computation (and build with
+  GCC 7 which complains about shifts of boolean values).
+
 -------------------------------------------------------------------
 Mon Feb 20 11:53:55 UTC 2017 - wr@rosenauer.org
 
diff --git a/mozilla-nss.spec b/mozilla-nss.spec
index d70e62a..04079e3 100644
--- a/mozilla-nss.spec
+++ b/mozilla-nss.spec
@@ -56,6 +56,7 @@ Patch5:         renegotiate-transitional.patch
 Patch6:         malloc.patch
 Patch7:         nss-disable-ocsp-test.patch
 Patch8:         nss-sqlitename.patch
+Patch9:         nss-fix-hash.patch
 %define nspr_ver %(rpm -q --queryformat '%{VERSION}' mozilla-nspr)
 PreReq:         mozilla-nspr >= %nspr_ver
 PreReq:         libfreebl3 >= %{nss_softokn_fips_version}
@@ -176,6 +177,7 @@ cd nss
 %endif
 %patch7 -p1
 %patch8 -p1
+%patch9 -p1
 # additional CA certificates
 #cd security/nss/lib/ckfw/builtins
 #cat %{SOURCE2} >> certdata.txt
diff --git a/nss-fix-hash.patch b/nss-fix-hash.patch
new file mode 100644
index 0000000..235cb5b
--- /dev/null
+++ b/nss-fix-hash.patch
@@ -0,0 +1,13 @@
+--- nss/lib/libpkix/pkix_pl_nss/pki/pkix_pl_ocsprequest.c.orig	2017-03-16 09:01:59.024372645 +0000
++++ nss/lib/libpkix/pkix_pl_nss/pki/pkix_pl_ocsprequest.c	2017-03-16 09:02:37.280938434 +0000
+@@ -89,8 +89,8 @@
+         PKIX_HASHCODE(ocspRq->signerCert, &signerHash, plContext,
+                 PKIX_CERTHASHCODEFAILED);
+ 
+-        *pHashcode = (((((extensionHash << 8) || certHash) << 8) ||
+-                dateHash) << 8) || signerHash;
++        *pHashcode = (((((extensionHash << 8) | certHash) << 8) |
++                dateHash) << 8) | signerHash;
+ 
+ cleanup:
+