Commit Graph

385 Commits

Author SHA256 Message Date
Wolfgang Rosenauer
fb6ae8911f Accepting request 390595 from home:michel_mno:branches:mozilla:Factory
-  add nss_gcc6_change.patch
to avoid build error in https://build.opensuse.org/package/show/openSUSE:Factory:Staging:Gcc6/mozilla-nss

OBS-URL: https://build.opensuse.org/request/show/390595
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=211
2016-04-18 20:51:42 +00:00
Dominique Leuenberger
2174d182f2 Accepting request 384318 from mozilla:Factory
- update to NSS 3.22.3
  * required for Firefox 46.0
  * Increase compatibility of TLS extended master secret,
    don't send an empty TLS extension last in the handshake
    (bmo#1243641)

- update to NSS 3.22.2
  New functionality:
  * RSA-PSS signatures are now supported (bmo#1215295)
  * Pseudorandom functions based on hashes other than SHA-1 are now supported
  * Enforce an External Policy on NSS from a config file (bmo#1009429)
  New functions:
  * PK11_SignWithMechanism - an extended version PK11_Sign()
  * PK11_VerifyWithMechanism - an extended version of PK11_Verify()
  * SSL_PeerSignedCertTimestamps - Get signed_certificate_timestamp
    TLS extension data
  * SSL_SetSignedCertTimestamps - Set signed_certificate_timestamp
    TLS extension data
  New types:
  * ssl_signed_cert_timestamp_xtn is added to SSLExtensionType
  * Constants for several object IDs are added to SECOidTag
  New macros:
  * SSL_ENABLE_SIGNED_CERT_TIMESTAMPS
  * NSS_USE_ALG_IN_SSL
  * NSS_USE_POLICY_IN_SSL
  * NSS_RSA_MIN_KEY_SIZE
  * NSS_DH_MIN_KEY_SIZE
  * NSS_DSA_MIN_KEY_SIZE
  * NSS_TLS_VERSION_MIN_POLICY
  * NSS_TLS_VERSION_MAX_POLICY

OBS-URL: https://build.opensuse.org/request/show/384318
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/mozilla-nss?expand=0&rev=113
2016-04-11 07:12:15 +00:00
Wolfgang Rosenauer
a9a3622567 - update to NSS 3.22.3
* required for Firefox 46.0
  * Increase compatibility of TLS extended master secret,
    don't send an empty TLS extension last in the handshake
    (bmo#1243641)

- update to NSS 3.22.2
  New functionality:
  * RSA-PSS signatures are now supported (bmo#1215295)
  * Pseudorandom functions based on hashes other than SHA-1 are now supported
  * Enforce an External Policy on NSS from a config file (bmo#1009429)
  New functions:
  * PK11_SignWithMechanism - an extended version PK11_Sign()
  * PK11_VerifyWithMechanism - an extended version of PK11_Verify()
  * SSL_PeerSignedCertTimestamps - Get signed_certificate_timestamp
    TLS extension data
  * SSL_SetSignedCertTimestamps - Set signed_certificate_timestamp
    TLS extension data
  New types:
  * ssl_signed_cert_timestamp_xtn is added to SSLExtensionType
  * Constants for several object IDs are added to SECOidTag
  New macros:
  * SSL_ENABLE_SIGNED_CERT_TIMESTAMPS
  * NSS_USE_ALG_IN_SSL
  * NSS_USE_POLICY_IN_SSL
  * NSS_RSA_MIN_KEY_SIZE
  * NSS_DH_MIN_KEY_SIZE
  * NSS_DSA_MIN_KEY_SIZE
  * NSS_TLS_VERSION_MIN_POLICY
  * NSS_TLS_VERSION_MAX_POLICY

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=209
2016-04-05 05:56:14 +00:00
Dominique Leuenberger
890082ce2c Accepting request 368766 from mozilla:Factory
- update to NSS 3.21.1 (bmo#969894)
  * required for Firefox 45.0
  * MFSA 2016-35/CVE-2016-1950 (bmo#1245528)
    Buffer overflow during ASN.1 decoding in NSS
    (fixed by requiring 3.21.1)
  * MFSA 2016-36/CVE-2016-1979 (bmo#1185033)
    Use-after-free during processing of DER encoded keys in NSS
    (fixed by requiring 3.21.1)

OBS-URL: https://build.opensuse.org/request/show/368766
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/mozilla-nss?expand=0&rev=112
2016-03-16 09:24:28 +00:00
Wolfgang Rosenauer
4db1acbc24 - update to NSS 3.21.1 (bmo#969894)
* MFSA 2016-35/CVE-2016-1950 (bmo#1245528)
    Buffer overflow during ASN.1 decoding in NSS
    (fixed by requiring 3.21.1)
  * MFSA 2016-36/CVE-2016-1979 (bmo#1185033)
    Use-after-free during processing of DER encoded keys in NSS
    (fixed by requiring 3.21.1)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=207
2016-03-08 22:39:49 +00:00
Wolfgang Rosenauer
83afc800c1 - update to NSS 3.21.1
* required for Firefox 45.0
  * no upstream release notes available

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=206
2016-03-07 15:44:49 +00:00
Dominique Leuenberger
83963b4d89 Accepting request 356139 from mozilla:Factory
- update to NSS 3.21
  * required for Firefox 44.0
  New functionality:
  * certutil now supports a --rename option to change a nickname (bmo#1142209)
  * TLS extended master secret extension (RFC 7627) is supported (bmo#1117022)
  * New info functions added for use during mid-handshake callbacks (bmo#1084669)
  New Functions:
  * NSS_OptionSet - sets NSS global options
  * NSS_OptionGet - gets the current value of NSS global options
  * SECMOD_CreateModuleEx - Create a new SECMODModule structure from module name
    string, module parameters string, NSS specific parameters string, and NSS
    configuration parameter string. The module represented by the module
    structure is not loaded. The difference with SECMOD_CreateModule is the new
    function handles NSS configuration parameter strings.
  * SSL_GetPreliminaryChannelInfo - obtains information about a TLS channel prior
    to the handshake being completed, for use with the callbacks that are invoked
    during the handshake
  * SSL_SignaturePrefSet - configures the enabled signature and hash algorithms
    for TLS
  * SSL_SignaturePrefGet - retrieves the currently configured signature and hash
    algorithms
  * SSL_SignatureMaxCount - obtains the maximum number signature algorithms that
    can be configured with SSL_SignaturePrefSet
  * NSSUTIL_ArgParseModuleSpecEx - takes a module spec and breaks it into shared
    library string, module name string, module parameters string, NSS specific
    parameters string, and NSS configuration parameter strings. The returned
    strings must be freed by the caller. The difference with
    NSS_ArgParseModuleSpec is the new function handles NSS configuration
    parameter strings.
  * NSSUTIL_MkModuleSpecEx - take a shared library string, module name string,

OBS-URL: https://build.opensuse.org/request/show/356139
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/mozilla-nss?expand=0&rev=111
2016-02-03 09:16:06 +00:00
Wolfgang Rosenauer
e133fb3c74 - added nss-bmo1236011.patch to fix compiler error (bmo#1236011)
- disabled testsuite as it currently breaks (bmo#1236340)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=204
2016-01-26 22:49:44 +00:00
Wolfgang Rosenauer
a13639ab95 - update to NSS 3.21
* required for Firefox 44.0
  New functionality:
  * certutil now supports a --rename option to change a nickname (bmo#1142209)
  * TLS extended master secret extension (RFC 7627) is supported (bmo#1117022)
  * New info functions added for use during mid-handshake callbacks (bmo#1084669)
  New Functions:
  * NSS_OptionSet - sets NSS global options
  * NSS_OptionGet - gets the current value of NSS global options
  * SECMOD_CreateModuleEx - Create a new SECMODModule structure from module name
    string, module parameters string, NSS specific parameters string, and NSS
    configuration parameter string. The module represented by the module
    structure is not loaded. The difference with SECMOD_CreateModule is the new
    function handles NSS configuration parameter strings.
  * SSL_GetPreliminaryChannelInfo - obtains information about a TLS channel prior
    to the handshake being completed, for use with the callbacks that are invoked
    during the handshake
  * SSL_SignaturePrefSet - configures the enabled signature and hash algorithms
    for TLS
  * SSL_SignaturePrefGet - retrieves the currently configured signature and hash
    algorithms
  * SSL_SignatureMaxCount - obtains the maximum number signature algorithms that
    can be configured with SSL_SignaturePrefSet
  * NSSUTIL_ArgParseModuleSpecEx - takes a module spec and breaks it into shared
    library string, module name string, module parameters string, NSS specific
    parameters string, and NSS configuration parameter strings. The returned
    strings must be freed by the caller. The difference with
    NSS_ArgParseModuleSpec is the new function handles NSS configuration
    parameter strings.
  * NSSUTIL_MkModuleSpecEx - take a shared library string, module name string,

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=203
2016-01-26 06:30:20 +00:00
Dominique Leuenberger
6db3a0c6eb Accepting request 351733 from mozilla:Factory
Automatic submission by obs-autosubmit

OBS-URL: https://build.opensuse.org/request/show/351733
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/mozilla-nss?expand=0&rev=110
2016-01-05 20:53:14 +00:00
Dominique Leuenberger
c1e4b7a60c Accepting request 350520 from mozilla:Factory
- update to NSS 3.20.2 (bnc#959888)

- update to NSS 3.20.1 (bnc#952810)

OBS-URL: https://build.opensuse.org/request/show/350520
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/mozilla-nss?expand=0&rev=109
2015-12-27 00:59:12 +00:00
Wolfgang Rosenauer
016b870c09 * MFSA 2015-150/CVE-2015-7575 (bmo#1158489)
MD5 signatures accepted within TLS 1.2 ServerKeyExchange in
    server signature

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=200
2015-12-26 07:22:03 +00:00
Wolfgang Rosenauer
3463e0c188 - update to NSS 3.20.2 (bnc#959888)
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=199
2015-12-23 12:24:51 +00:00
Wolfgang Rosenauer
7b02230ef1 - update to NSS 3.20.2
- update to NSS 3.20.1 (bnc#952810)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=198
2015-12-20 10:13:48 +00:00
Wolfgang Rosenauer
262b0bfec9 - update to NSS 4.20.2
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=197
2015-12-19 17:14:46 +00:00
Dominique Leuenberger
32bd2c1b76 Accepting request 342323 from mozilla:Factory
- update to NSS 4.20.1 (bnc#952810)
  * requires NSPR 4.10.10
  * MFSA 2015-133/CVE-2015-7181/CVE-2015-7182 (bmo#1192028, bmo#1202868)
    memory corruption issues

OBS-URL: https://build.opensuse.org/request/show/342323
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/mozilla-nss?expand=0&rev=108
2015-11-08 10:24:50 +00:00
Wolfgang Rosenauer
aa77e12284 - update to NSS 4.20.1 (bnc#952810)
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=195
2015-11-03 19:46:10 +00:00
Wolfgang Rosenauer
bac12b7d9e * MFSA 2015-133/CVE-2015-7181/CVE-2015-7182 (bmo#1192028, bmo#1202868)
memory corruption issues

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=194
2015-11-03 17:24:16 +00:00
Wolfgang Rosenauer
107f9eab33 - update to NSS 4.20.1
* requires NSPR 4.10.10

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=193
2015-10-31 09:29:52 +00:00
Stephan Kulow
16cc82dd1a Accepting request 335620 from mozilla:Factory
Automatic submission by obs-autosubmit

OBS-URL: https://build.opensuse.org/request/show/335620
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/mozilla-nss?expand=0&rev=107
2015-10-03 18:28:20 +00:00
Wolfgang Rosenauer
4453cedcca Accepting request 333502 from Java:Factory
Distribute libfreebl.a along other static libraries. It is needed for java 7 Sun Elliptical Curve Crypto provider

OBS-URL: https://build.opensuse.org/request/show/333502
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=191
2015-09-24 17:37:48 +00:00
Wolfgang Rosenauer
371f571e08 - update to NSS 3.20
New functionality:
  * The TLS library has been extended to support DHE ciphersuites in
    server applications.
  New Functions:
  * SSL_DHEGroupPrefSet - Configure the set of allowed/enabled DHE group
    parameters that can be used by NSS for a server socket.
  * SSL_EnableWeakDHEPrimeGroup - Enable the use of weak DHE group
    parameters that are smaller than the library default's minimum size.
  New Types:
  * SSLDHEGroupType - Enumerates the set of DHE parameters embedded in
    NSS that can be used with function SSL_DHEGroupPrefSet.
  New Macros:
  * SSL_ENABLE_SERVER_DHE - A socket option user to enable or disable
    DHE ciphersuites for a server socket.
  Notable Changes:
  * For backwards compatibility reasons, the server side implementation
    of the TLS library keeps all DHE ciphersuites disabled by default.
    They can be enabled with the new socket option SSL_ENABLE_SERVER_DHE
    and the SSL_OptionSet or the SSL_OptionSetDefault API.
  * The server side implementation of the TLS implementation does not
    support session tickets when using a DHE ciphersuite (see bmo#1174677).
  * Support for the following ciphersuites has been added:
    - TLS_DHE_DSS_WITH_AES_128_GCM_SHA256
    - TLS_DHE_DSS_WITH_AES_128_CBC_SHA256
    - TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
  * By default, the server side TLS implementation will use DHE
    parameters with a size of 2048 bits when using DHE ciphersuites.
  * NSS embeds fixed DHE parameters sized 2048, 3072, 4096, 6144 and
    8192 bits, which were copied from version 08 of the Internet-Draft

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=190
2015-09-24 10:20:12 +00:00
Wolfgang Rosenauer
e87238be07 Accepting request 333436 from Java:Factory
Add blapi.h and algmac.h, in order to be able to build sunec.jar in java 7

OBS-URL: https://build.opensuse.org/request/show/333436
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=189
2015-09-24 09:37:13 +00:00
Stephan Kulow
7bca256381 Accepting request 315776 from mozilla:Factory
Automatic submission by obs-autosubmit

OBS-URL: https://build.opensuse.org/request/show/315776
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/mozilla-nss?expand=0&rev=106
2015-07-19 09:44:24 +00:00
Wolfgang Rosenauer
11da47024a (MFSA 2015-70/CVE-2015-4000)
* NSS incorrectly permits skipping of ServerKeyExchange
    (bmo#1086145) (MFSA 2015-71/CVE-2015-2721)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=187
2015-07-03 05:51:39 +00:00
Dominique Leuenberger
c300477d1a Accepting request 313607 from mozilla:Factory
OBS-URL: https://build.opensuse.org/request/show/313607
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/mozilla-nss?expand=0&rev=105
2015-06-30 08:15:18 +00:00
Wolfgang Rosenauer
440894e094 OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=186 2015-06-24 18:54:42 +00:00
Wolfgang Rosenauer
b075d41608 Accepting request 313427 from home:msmeissn:branches:mozilla:Factory
- as the .chk files are contained in libfreebl3 and libsoftokn
  directly, provide the -hmac alias names to help :42 building.

OBS-URL: https://build.opensuse.org/request/show/313427
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=185
2015-06-24 17:52:00 +00:00
Wolfgang Rosenauer
c13c2fe84e - update to 3.19.2
* required for Firefox 39.0
  * No new functionality is introduced in this release. This release
    addresses a backwards compatibility issue with the NSS 3.19.1
    release.
  * In NSS 3.19.1, the minimum key sizes that the freebl cryptographic
    implementation (part of the softoken cryptographic module used
    by default by NSS) was willing to generate or use was increased
    - for RSA keys, to 512 bits, and for DH keys, 1023 bits. This
    was done as part of a security fix for Bug 1138554 / CVE-2015-4000.
    Applications that requested or attempted to use keys smaller
    then the minimum size would fail. However,  this change in behaviour
    unintentionally broke existing NSS applications that need to
    generate or use such keys, via APIs such as
    SECKEY_CreateRSAPrivateKey or SECKEY_CreateDHPrivateKey.

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=184
2015-06-23 06:04:19 +00:00
Dominique Leuenberger
879f28ea23 Accepting request 309532 from mozilla:Factory
- update to 3.19.1
  No new functionality is introduced in this release. This patch
  release includes a fix for the recently published logjam attack.
  Notable Changes:
  * The minimum strength of keys that libssl will accept for
    finite field algorithms (RSA, Diffie-Hellman, and DSA) have
    been increased to 1023 bits (bmo#1138554).
  * NSS reports the bit length of keys more accurately.  Thus,
    the SECKEY_PublicKeyStrength and SECKEY_PublicKeyStrengthInBits
    functions could report smaller values for values that have
    leading zero values. This affects the key strength values that
    are reported by SSL_GetChannelInfo.

OBS-URL: https://build.opensuse.org/request/show/309532
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/mozilla-nss?expand=0&rev=104
2015-06-03 06:21:07 +00:00
Wolfgang Rosenauer
468ec67421 Notable Changes:
OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=182
2015-06-01 07:53:45 +00:00
Dominique Leuenberger
318c74d1b2 Accepting request 309327 from mozilla:Factory
Automatic submission by obs-autosubmit

OBS-URL: https://build.opensuse.org/request/show/309327
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/mozilla-nss?expand=0&rev=103
2015-06-01 07:48:39 +00:00
Wolfgang Rosenauer
8cb655bd59 - update to 3.19.1
No new functionality is introduced in this release. This patch
  release includes a fix for the recently published logjam attack.
Notable Changes:
  * The minimum strength of keys that libssl will accept for
    finite field algorithms (RSA, Diffie-Hellman, and DSA) have
    been increased to 1023 bits (bmo#1138554).
  * NSS reports the bit length of keys more accurately.  Thus,
    the SECKEY_PublicKeyStrength and SECKEY_PublicKeyStrengthInBits
    functions could report smaller values for values that have
    leading zero values. This affects the key strength values that
    are reported by SSL_GetChannelInfo.

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=180
2015-05-31 13:26:05 +00:00
Wolfgang Rosenauer
fac2c66773 - update to 3.19
* Firefox target release 39
  New functionality:
  * For some certificates, such as root CA certificates, that don't
    embed any constraints, NSS might impose additional constraints,
    such as name constraints. A new API has been added that allows
    to lookup imposed constraints.
  * It is possible to override the directory in which the NSS build
    system will look for the sqlite library.
  New Functions:
  * CERT_GetImposedNameConstraints
  Notable Changes:
  * The SSL 3 protocol has been disabled by default.
  * NSS now more strictly validates TLS extensions and will fail a
    handshake that contains malformed extensions.
  * Fixed a bug related to the ordering of TLS handshake messages.
  * In TLS 1.2 handshakes, NSS advertises support for the SHA512
    hash algorithm, in order to be compatible with TLS servers
    that use certificates with a SHA512 signature.

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=179
2015-05-23 08:54:34 +00:00
Stephan Kulow
c298c0a55c Accepting request 303844 from mozilla:Factory
- update to 3.18.1
  * Firefox target release 38
  * No new functionality is introduced in this release.
  Notable Changes:
  * The following CA certificate had the Websites and Code Signing
    trust bits restored to their original state to allow more time
    to develop a better transition strategy for affected sites:
    - OU = Equifax Secure Certificate Authority
  * The following CA certificate was removed:
    - CN = e-Guven Kok Elektronik Sertifika Hizmet Saglayicisi
  * The following intermediate CA certificate has been added as
    actively distrusted because it was mis-used to issue certificates
    for domain names the holder did not own or control:
    - CN=MCSHOLDING TEST, O=MCSHOLDING, C=EG
  * The version number of the updated root CA list has been set
    to 2.4

OBS-URL: https://build.opensuse.org/request/show/303844
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/mozilla-nss?expand=0&rev=102
2015-04-25 14:47:27 +00:00
Wolfgang Rosenauer
aac1edd658 - update to 3.18.1
* Firefox target release 38
  * No new functionality is introduced in this release.
  Notable Changes:
  * The following CA certificate had the Websites and Code Signing
    trust bits restored to their original state to allow more time
    to develop a better transition strategy for affected sites:
    - OU = Equifax Secure Certificate Authority
  * The following CA certificate was removed:
    - CN = e-Guven Kok Elektronik Sertifika Hizmet Saglayicisi
  * The following intermediate CA certificate has been added as
    actively distrusted because it was mis-used to issue certificates
    for domain names the holder did not own or control:
    - CN=MCSHOLDING TEST, O=MCSHOLDING, C=EG
  * The version number of the updated root CA list has been set
    to 2.4

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=177
2015-04-23 06:38:33 +00:00
Dominique Leuenberger
606cc1d99a Accepting request 294348 from mozilla:Factory
OBS-URL: https://build.opensuse.org/request/show/294348
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/mozilla-nss?expand=0&rev=101
2015-04-07 07:28:49 +00:00
Wolfgang Rosenauer
61e5bbef43 - add the changes file as source so the .src.rpm builds (used for
fake build time)

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=176
2015-04-03 20:30:47 +00:00
Wolfgang Rosenauer
7803242e62 - update to 3.18
* Firefox target release 38
  New functionality:
  * When importing certificates and keys from a PKCS#12 source,
    it's now possible to override the nicknames, prior to importing
    them into the NSS database, using new API
    SEC_PKCS12DecoderRenameCertNicknames.
  * The tstclnt test utility program has new command-line options
    -C, -D, -b and -R.
    Use -C one, two or three times to print information about the
    certificates received from a server, and information about the
    locally found and trusted issuer certificates, to diagnose
    server side configuration issues. It is possible to run tstclnt
    without providing a database (-D). A PKCS#11 library that
    contains root CA certificates can be loaded by tstclnt, which
    may either be the nssckbi library provided by NSS (-b) or
    another compatible library (-R).
  New Functions:
  * SEC_CheckCrlTimes
  * SEC_GetCrlTimes
  * SEC_PKCS12DecoderRenameCertNicknames
  New Types:
  * SEC_PKCS12NicknameRenameCallback
  Notable Changes:
  * The highest TLS protocol version enabled by default has been
    increased from TLS 1.0 to TLS 1.2. Similarly, the highest DTLS
    protocol version enabled by default has been increased from
    DTLS 1.0 to DTLS 1.2.
  * The default key size used by certutil when creating an RSA key
    pair has been increased from 1024 bits to 2048 bits.

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=175
2015-04-03 08:58:03 +00:00
Dominique Leuenberger
500604cb2c Accepting request 284702 from mozilla:Factory
Automatic submission by obs-autosubmit

OBS-URL: https://build.opensuse.org/request/show/284702
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/mozilla-nss?expand=0&rev=100
2015-02-11 15:31:34 +00:00
Wolfgang Rosenauer
7e56ae74c1 - update to 3.17.4
* Firefox target release 36
  Notable Changes:
  * bmo#1084986: If an SSL/TLS connection fails, because client and
                 server don't have any common protocol version enabled,
		 NSS has been changed to report error code
		 SSL_ERROR_UNSUPPORTED_VERSION (instead of reporting
		 SSL_ERROR_NO_CYPHER_OVERLAP).
  * bmo#1112461: libpkix was fixed to prefer the newest certificate,
                 if multiple certificates match.
  * bmo#1094492: fixed a memory corruption issue during failure of
                 keypair generation.
  * bmo#1113632: fixed a failure to reload a PKCS#11 module in FIPS
                 mode.
  * bmo#1119983: fixed interoperability of NSS server code with a
                 LibreSSL client.

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=173
2015-01-31 18:08:08 +00:00
Dominique Leuenberger
67f66049ef Accepting request 267102 from mozilla:Factory
Automatic submission by obs-autosubmit

OBS-URL: https://build.opensuse.org/request/show/267102
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/mozilla-nss?expand=0&rev=99
2015-01-05 03:42:57 +00:00
Wolfgang Rosenauer
f2d1031ce6 - update to 3.17.3
* Firefox target release 36
  New functionality:
  * Support for TLS_FALLBACK_SCSV has been added to the ssltap and
    tstclnt utilities
  Notable Changes:
  * The QuickDER decoder now decodes lengths robustly
    (CVE-2014-1569)
  * The following 1024-bit CA certificates were removed:
    - GTE CyberTrust Global Root
    - Thawte Server CA
    - Thawte Premium Server CA
    - America Online Root Certification Authority 1
    - America Online Root Certification Authority 2
  * The following CA certificates had the Websites and Code Signing
    trust bits turned off:
    - Class 3 Public Primary Certification Authority - G2
    - Equifax Secure eBusiness CA-1
  * The following CA certificates were added:
    - COMODO RSA Certification Authority
    - USERTrust RSA Certification Authority
    - USERTrust ECC Certification Authority
    - GlobalSign ECC Root CA - R4
    - GlobalSign ECC Root CA - R5
  * the version number of the updated root CA list has been set
    to 2.2

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=171
2014-12-27 12:24:22 +00:00
Stephan Kulow
1aee2e618e Accepting request 258176 from mozilla:Factory
Automatic submission by obs-autosubmit

OBS-URL: https://build.opensuse.org/request/show/258176
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/mozilla-nss?expand=0&rev=98
2014-10-29 20:09:05 +00:00
Wolfgang Rosenauer
99b3c1bb3c - update to 3.17.2
Bugfix release
  * bmo#1049435 - Importing an RSA private key fails if p < q
  * bmo#1057161 - NSS hangs with 100% CPU on invalid EC key
  * bmo#1078669 - certutil crashes when using the --certVersion parameter

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=169
2014-10-16 19:19:00 +00:00
Stephan Kulow
cf6015d61e Accepting request 251989 from mozilla:Factory
- update to 3.17.1 (bnc#897890)
  * MFSA 2014-73/CVE-2014-1568 (bmo#1064636, bmo#1069405)
    RSA Signature Forgery in NSS
  * Change library's signature algorithm default to SHA256
  * Add support for draft-ietf-tls-downgrade-scsv
  * Add clang-cl support to the NSS build system
  * Implement TLS 1.3:
    * Part 1. Negotiate TLS 1.3
    * Part 2. Remove deprecated cipher suites andcompression.
  * Add support for little-endian powerpc64

OBS-URL: https://build.opensuse.org/request/show/251989
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/mozilla-nss?expand=0&rev=97
2014-10-01 09:22:06 +00:00
Wolfgang Rosenauer
d2eba15b73 * MFSA 2014-73/CVE-2014-1568 (bmo#1064636, bmo#1069405)
RSA Signature Forgery in NSS

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=167
2014-09-24 19:29:06 +00:00
Wolfgang Rosenauer
3fb5d49790 - update to 3.17.1 (bnc#897890)
* Change library's signature algorithm default to SHA256
  * Add support for draft-ietf-tls-downgrade-scsv
  * Add clang-cl support to the NSS build system
  * Implement TLS 1.3:
    * Part 1. Negotiate TLS 1.3
    * Part 2. Remove deprecated cipher suites andcompression.
  * Add support for little-endian powerpc64

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=166
2014-09-23 21:39:14 +00:00
Stephan Kulow
a2c74afcaf Accepting request 247562 from mozilla:Factory
- update to 3.17
  * required for Firefox 33
  New functionality:
  * When using ECDHE, the TLS server code may be configured to generate
    a fresh ephemeral ECDH key for each handshake, by setting the
    SSL_REUSE_SERVER_ECDHE_KEY socket option to PR_FALSE. The
    SSL_REUSE_SERVER_ECDHE_KEY option defaults to PR_TRUE, which means
    the server's ephemeral ECDH key is reused for multiple handshakes.
    This option does not affect the TLS client code, which always
    generates a fresh ephemeral ECDH key for each handshake.
  New Macros
  * SSL_REUSE_SERVER_ECDHE_KEY
  Notable Changes:
  * The manual pages for the certutil and pp tools have been updated to
    document the new parameters that had been added in NSS 3.16.2.
  * On Windows, the new build variable USE_STATIC_RTL can be used to
    specify the static C runtime library should be used. By default the
    dynamic C runtime library is used.

- update to 3.16.4 (bnc#894201)

OBS-URL: https://build.opensuse.org/request/show/247562
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/mozilla-nss?expand=0&rev=96
2014-09-08 19:28:11 +00:00
Wolfgang Rosenauer
8b17b48d47 - update to 3.17
* required for Firefox 33
  New functionality:
  * When using ECDHE, the TLS server code may be configured to generate
    a fresh ephemeral ECDH key for each handshake, by setting the
    SSL_REUSE_SERVER_ECDHE_KEY socket option to PR_FALSE. The
    SSL_REUSE_SERVER_ECDHE_KEY option defaults to PR_TRUE, which means
    the server's ephemeral ECDH key is reused for multiple handshakes.
    This option does not affect the TLS client code, which always
    generates a fresh ephemeral ECDH key for each handshake.
  New Macros
  * SSL_REUSE_SERVER_ECDHE_KEY
  Notable Changes:
  * The manual pages for the certutil and pp tools have been updated to
    document the new parameters that had been added in NSS 3.16.2.
  * On Windows, the new build variable USE_STATIC_RTL can be used to
    specify the static C runtime library should be used. By default the
    dynamic C runtime library is used.

OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=164
2014-09-04 13:58:20 +00:00