On Wed, Oct 21, 2026 at 11:51:39AM +0200, Sven Püschel wrote: > Bunch of bugfixes in 3.131 > https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_131.html > > With 3.131.1 they only dropped the certs related to the > eMudhra Intermediate CA Compromise [1]: > https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/vSxZxnOMMvs > > Also dropped the patch adding a pc file and instead using the already > included PC file and adjusting it's variables with a sed command line. > This is based on the ArchLinux build script [2], but a similar sed can > also be found in `nss/build.sh`.
You need to updated host-nns as well. Michael > [1] https://emudhra.we-have-a-problem.com/ > [2] > https://gitlab.archlinux.org/archlinux/packaging/packages/nss/-/blob/f01ebfe4f1024af88a59c25586729956591abac0/PKGBUILD#L68 > > Signed-off-by: Sven Püschel <[email protected]> > --- > patches/nss-3.130/0002-add-nss.pc.in.patch | 27 > ---------------------- > patches/nss-3.130/series | 8 ------- > .../0001-nss-fix-nsinstall-build.patch | 0 > ...HACK-don-t-build-commands-that-need-zlib.patch} | 0 > .../0003-HACK-fix-parallel-building-issue.patch} | 0 > .../0004-fix-dependency-generation.patch} | 0 > patches/nss-3.131.1/series | 7 ++++++ > rules/nss.make | 14 +++++++---- > 8 files changed, 17 insertions(+), 39 deletions(-) > > diff --git a/patches/nss-3.130/0002-add-nss.pc.in.patch > b/patches/nss-3.130/0002-add-nss.pc.in.patch > deleted file mode 100644 > index > addc805b5d39543f587febae968680276a62470b..0000000000000000000000000000000000000000 > --- a/patches/nss-3.130/0002-add-nss.pc.in.patch > +++ /dev/null > @@ -1,27 +0,0 @@ > -From: Lucas Stach <[email protected]> > -Date: Tue, 12 Apr 2016 11:36:26 +0200 > -Subject: [PATCH] add nss.pc.in > - > -Signed-off-by: Michael Olbrich <[email protected]> > ---- > - nss/nss.pc.in | 11 +++++++++++ > - 1 file changed, 11 insertions(+) > - create mode 100644 nss/nss.pc.in > - > -diff --git a/nss/nss.pc.in b/nss/nss.pc.in > -new file mode 100644 > -index 000000000000..b80838f8ca0d > ---- /dev/null > -+++ b/nss/nss.pc.in > -@@ -0,0 +1,11 @@ > -+prefix=/usr > -+exec_prefix=${prefix} > -+libdir=${prefix}/lib > -+includedir=${prefix}/include/nss > -+ > -+Name: NSS > -+Description: Mozilla Network Security Services > -+Version: @VERSION@ > -+Requires: nspr > -+Libs: -lnss3 -lnssutil3 -lsmime3 -lssl3 > -+Cflags: -I${includedir} > diff --git a/patches/nss-3.130/series b/patches/nss-3.130/series > deleted file mode 100644 > index > 534d0d6d69f823d512f432093a912eb00ff7a666..0000000000000000000000000000000000000000 > --- a/patches/nss-3.130/series > +++ /dev/null > @@ -1,8 +0,0 @@ > -# generated by git-ptx-patches > -#tag:base --start-number 1 > -0001-nss-fix-nsinstall-build.patch > -0002-add-nss.pc.in.patch > -0003-HACK-don-t-build-commands-that-need-zlib.patch > -0004-HACK-fix-parallel-building-issue.patch > -0005-fix-dependency-generation.patch > -# 51749efb4fc421b49999aad3745d75b9 - git-ptx-patches magic > diff --git a/patches/nss-3.130/0001-nss-fix-nsinstall-build.patch > b/patches/nss-3.131.1/0001-nss-fix-nsinstall-build.patch > similarity index 100% > rename from patches/nss-3.130/0001-nss-fix-nsinstall-build.patch > rename to patches/nss-3.131.1/0001-nss-fix-nsinstall-build.patch > diff --git > a/patches/nss-3.130/0003-HACK-don-t-build-commands-that-need-zlib.patch > b/patches/nss-3.131.1/0002-HACK-don-t-build-commands-that-need-zlib.patch > similarity index 100% > rename from > patches/nss-3.130/0003-HACK-don-t-build-commands-that-need-zlib.patch > rename to > patches/nss-3.131.1/0002-HACK-don-t-build-commands-that-need-zlib.patch > diff --git a/patches/nss-3.130/0004-HACK-fix-parallel-building-issue.patch > b/patches/nss-3.131.1/0003-HACK-fix-parallel-building-issue.patch > similarity index 100% > rename from patches/nss-3.130/0004-HACK-fix-parallel-building-issue.patch > rename to patches/nss-3.131.1/0003-HACK-fix-parallel-building-issue.patch > diff --git a/patches/nss-3.130/0005-fix-dependency-generation.patch > b/patches/nss-3.131.1/0004-fix-dependency-generation.patch > similarity index 100% > rename from patches/nss-3.130/0005-fix-dependency-generation.patch > rename to patches/nss-3.131.1/0004-fix-dependency-generation.patch > diff --git a/patches/nss-3.131.1/series b/patches/nss-3.131.1/series > new file mode 100644 > index > 0000000000000000000000000000000000000000..ed1f6706e1f31ed11d93ed6918ecae72fce35707 > --- /dev/null > +++ b/patches/nss-3.131.1/series > @@ -0,0 +1,7 @@ > +# generated by git-ptx-patches > +#tag:base --start-number 1 > +0001-nss-fix-nsinstall-build.patch > +0002-HACK-don-t-build-commands-that-need-zlib.patch > +0003-HACK-fix-parallel-building-issue.patch > +0004-fix-dependency-generation.patch > +# ea27330855ed3ed4aac49b9ec8451c08 - git-ptx-patches magic > diff --git a/rules/nss.make b/rules/nss.make > index > 61c4b102c04219e218fb950943679204ec01f501..147d311f24abaeaa90833efb13239451393a965a > 100644 > --- a/rules/nss.make > +++ b/rules/nss.make > @@ -14,8 +14,8 @@ PACKAGES-$(PTXCONF_NSS) += nss > # > # Paths and names > # > -NSS_VERSION := 3.130 > -NSS_SHA256 := > afab9f82c78bfa3e7e8b4a61ac31922675c58203f67ff385a2714df7fe9bd5c5 > +NSS_VERSION := 3.131.1 > +NSS_SHA256 := > b1dbc1d9e7f3f8455dfb6d58ec8f7229d8a8450c629a9e69ef2ef6081f359056 > NSS := nss-$(NSS_VERSION) > NSS_SUFFIX := tar.gz > NSS_URL := > https://ftp.mozilla.org/pub/security/nss/releases/NSS_$(subst > .,_,$(NSS_VERSION))_RTM/src/$(NSS).$(NSS_SUFFIX) > @@ -96,8 +96,14 @@ $(STATEDIR)/nss.install: > $(NSS_PKGDIR)/usr/lib/$(lib).so$(ptx/nl)) > > install -d $(NSS_PKGDIR)/usr/lib/pkgconfig/ > - VERSION=$(NSS_VERSION) ptxd_replace_magic \ > - $(NSS_DIR)/nss/nss.pc.in > > $(NSS_PKGDIR)/usr/lib/pkgconfig/nss.pc > + sed "$(NSS_DIR)/nss/pkg/pkg-config/nss.pc.in" \ > + -e "s,%prefix%,/usr,g" \ > + -e "s,%exec_prefix%,$${prefix},g" \ > + -e "s,%libdir%,/usr/lib,g" \ > + -e "s,%includedir%,/usr/include/nss,g" \ > + -e "s,%NSPR_VERSION%,$(NSPR_VERSION),g" \ > + -e "s,%NSS_VERSION%,$(NSS_VERSION),g" \ > + > "$(NSS_PKGDIR)/usr/lib/pkgconfig/nss.pc" > > @install -v -d $(NSS_PKGDIR)/usr/include/nss > @install -v -m 644 -t $(NSS_PKGDIR)/usr/include/nss > $(NSS_DIR)/dist/public/nss/* > > -- > 2.47.3 > > > -- Pengutronix e.K. | | Steuerwalder Str. 21 | http://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
