Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package mozilla-nss for openSUSE:Factory checked in at 2026-10-08 15:12:56 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/mozilla-nss (Old) and /work/SRC/openSUSE:Factory/.mozilla-nss.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "mozilla-nss" Thu Oct 8 15:12:56 2026 rev:247 rq:1382991 version:3.129 Changes: -------- --- /work/SRC/openSUSE:Factory/mozilla-nss/mozilla-nss.changes 2026-09-21 12:00:09.467535681 +0200 +++ /work/SRC/openSUSE:Factory/.mozilla-nss.new.3698736/mozilla-nss.changes 2026-10-08 15:13:10.759229739 +0200 @@ -1,0 +2,41 @@ +Wed Sep 30 05:49:36 UTC 2026 - Wolfgang Rosenauer <[email protected]> + +- update to NSS 3.129 + * bmo#2068788 - emit static library names during static build. + * bmo#2067434 - avoid building libcrux twice in makefile builds. + * bmo#2068010 - fix non-linux arm64 makefile builds. + * bmo#2017322 - set CKA_NSS_SERVER_DISTRUST_AFTER for CN=Izenpe.com. + * bmo#2057185 - Document ./mach try and its Mercurial-only caveat in + CLAUDE.md. + * bmo#2056793 - Add tests for concurrent channel info queries during + session replacement. + * bmo#2056793 - take the session cache lock when reading ss->sec.ci.sid. + * bmo#2066046 - Fix a race in STAN_GetNSSCertificate. + * bmo#2066591 - Remove write-only blLib and libraryName statics from + freebl's lowhash_vector. + * bmo#2025246 - fix unknown key error type in ssl_SetAuthKeyBits. + * bmo#2065879 - re-vendor HACL* and simplify run_hacl.sh. + * bmo#2065879 - stop clang-formatting the vendored HACL* code. + * bmo#2068191 - add --dry-run to mach try to print job list. + * bmo#2029288 - avoid integer overflow in PK11_BlockData. + * bmo#2066960 - fix UB in ecperf.c. + * bmo#2067239 - Old coverity issues. + * bmo#2067237 - MLKEM mechinfo needs keys sizes. + * bmo#2066900 - pin NSPR 4.40 in CI. + * bmo#2066266 - ML-KEM-1024 incorrectly allows an explicit encapsulation seed. + * bmo#2066265 - Support for ML-KEM-512 in freebl and softoken. + * bmo#2060316 - remove support for pre-standard Kyber. + * bmo#2065423 - Build NSPR out of tree, into the dist directory. + * bmo#2065423 - Write a machine-readable summary.json for each test run. + * bmo#2065423 - Fail test runs on UBSan errors and on core dumps in + debug builds. + * bmo#2065423 - Link tests_results/latest at the newest test run. + * bmo#2065423 - Resolve ssl_gtest_db.sh against QADIR. + * bmo#2065423 - Generate nss.pc and nss-config into the dist directory. + * bmo#2065423 - Add a --dist option to build.sh. + * bmo#2065219 - Update Cryptofuzz version. + * bmo#2056790 - Use PK11 digest contexts for explicit hashing in cryptohi. +- rebased add-relro-linker-option.patch and + nss-fips-constructor-self-tests.patch + +------------------------------------------------------------------- Old: ---- nss-3.128.tar.gz New: ---- nss-3.129.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ mozilla-nss.spec ++++++ --- /var/tmp/diff_new_pack.RZPx7U/_old 2026-10-08 15:13:15.847442963 +0200 +++ /var/tmp/diff_new_pack.RZPx7U/_new 2026-10-08 15:13:15.848443005 +0200 @@ -40,9 +40,9 @@ %define origname mozilla-nss Name: %{origname}%{psuffix} -Version: 3.128 +Version: 3.129 Release: 0 -%define underscore_version 3_128 +%define underscore_version 3_129 Summary: Network Security Services License: MPL-2.0 Group: System/Libraries ++++++ add-relro-linker-option.patch ++++++ --- /var/tmp/diff_new_pack.RZPx7U/_old 2026-10-08 15:13:15.954447447 +0200 +++ /var/tmp/diff_new_pack.RZPx7U/_new 2026-10-08 15:13:15.958447615 +0200 @@ -5,14 +5,14 @@ @@ -184,6 +184,12 @@ endif endif endif - + +# harden DSOs/executables a bit against exploits +ifeq (2.6,$(firstword $(sort 2.6 $(OS_RELEASE)))) +DSO_LDOPTS+=-Wl,-z,relro +LDFLAGS += -Wl,-z,relro +endif + - # Test toolchain for endianness and set LITTLE_ENDIAN variable accordingly - ENDIANNESS := $(shell echo | $(CC) -dM -E - | grep __BYTE_ORDER__) - ifeq ($(findstring __ORDER_LITTLE_ENDIAN__,$(ENDIANNESS)),__ORDER_LITTLE_ENDIAN__) + USE_SYSTEM_ZLIB = 1 + ZLIB_LIBS = -lz + ++++++ nss-3.128.tar.gz -> nss-3.129.tar.gz ++++++ /work/SRC/openSUSE:Factory/mozilla-nss/nss-3.128.tar.gz /work/SRC/openSUSE:Factory/.mozilla-nss.new.3698736/nss-3.129.tar.gz differ: char 5, line 1 ++++++ nss-fips-constructor-self-tests.patch ++++++ --- /var/tmp/diff_new_pack.RZPx7U/_old 2026-10-08 15:13:16.095453356 +0200 +++ /var/tmp/diff_new_pack.RZPx7U/_new 2026-10-08 15:13:16.098453482 +0200 @@ -42,7 +42,7 @@ =================================================================== --- nss.orig/lib/freebl/blapi.h +++ nss/lib/freebl/blapi.h -@@ -1860,17 +1860,17 @@ extern void BL_Unload(void); +@@ -1855,17 +1855,17 @@ extern void BL_Unload(void); /************************************************************************** * Verify a given Shared library signature * **************************************************************************/ @@ -63,7 +63,7 @@ /*********************************************************************/ extern const SECHashObject *HASH_GetRawHashObject(HASH_HashType hashType); -@@ -1969,6 +1969,9 @@ SECStatus MLDSA_VerifyFinal(MLDSAContext +@@ -1970,6 +1970,9 @@ void MLDSA_DestroyContext(MLDSAContext * */ SECStatus EC_DecompressPublicKey(const SECItem *publicCompressed, const ECParams *params, SECItem *publicUncompressed); @@ -910,7 +910,7 @@ /* Version 3.013 came to here */ -@@ -945,6 +945,9 @@ struct FREEBLVectorStr { +@@ -948,6 +948,9 @@ struct FREEBLVectorStr { /* Add new function pointers at the end of this struct and bump * FREEBL_VERSION at the beginning of this file. */ @@ -924,7 +924,7 @@ =================================================================== --- nss.orig/lib/freebl/manifest.mn +++ nss/lib/freebl/manifest.mn -@@ -102,6 +102,7 @@ PRIVATE_EXPORTS = \ +@@ -98,6 +98,7 @@ PRIVATE_EXPORTS = \ ecl.h \ ecl-curve.h \ eclt.h \ @@ -932,7 +932,7 @@ $(NULL) MPI_HDRS = mpi-config.h mpi.h mpi-priv.h mplogic.h mpprime.h logtab.h mp_gf2m.h -@@ -195,6 +196,7 @@ ALL_HDRS = \ +@@ -189,6 +190,7 @@ ALL_HDRS = \ shsign.h \ vis_proto.h \ seed.h \ @@ -1530,10 +1530,11 @@ =================================================================== --- nss.orig/lib/freebl/ldvector.c +++ nss/lib/freebl/ldvector.c -@@ -462,6 +462,8 @@ static const struct FREEBLVectorStr vect - EC_DecompressPublicKey, - /* End of version 3.032 */ +@@ -464,6 +464,9 @@ static const struct FREEBLVectorStr vect + MLDSA_DestroyContext, + /* End of version 3.033 */ ++ + /* SUSE patch: Goes last */ + BL_FIPSRepeatIntegrityCheck };
