diff --git a/.gitignore b/.gitignore
index 087ef61..febc09d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,4 @@
-nss-3.12.7.99.4-stripped.tar.bz2
+nss-3.12.8-stripped.tar.bz2
 nss-pem-20100809.tar.bz2
 blank-cert8.db
 blank-key3.db
diff --git a/nss.spec b/nss.spec
index 1bfbfb4..bf438e1 100644
--- a/nss.spec
+++ b/nss.spec
@@ -5,7 +5,7 @@
 
 Summary:          Network Security Services
 Name:             nss
-Version:          3.12.7.99.4
+Version:          3.12.8
 Release:          1%{?dist}
 License:          MPLv1.1 or GPLv2+ or LGPLv2+
 URL:              http://www.mozilla.org/projects/security/pki/nss/
@@ -375,7 +375,7 @@ rm -rf $RPM_BUILD_ROOT/%{_includedir}/nss3/nsslowhash.h
 %{_bindir}/setup-nsssysinit.sh on
 
 %preun sysinit
-%{_bindir}/setup-nsssysinit.sh off
+
 
 %files
 %defattr(-,root,root)
@@ -489,6 +489,12 @@ rm -rf $RPM_BUILD_ROOT/%{_includedir}/nss3/nsslowhash.h
 %{_libdir}/libnssckfw.a
 
 %changelog
+* Thu Sep 23 2010 Elio Maldonado <emaldona@redhat.com> - 3.12.8-1
+- Update to 3.12.8
+- Prevent disabling of nss-sysinit on package upgrade (#636787)
+- Create pkcs11.txt with correct permissions regardless of umask (#636792) 
+- Setup-nsssysinit.sh reports whether nss-sysinit is turned on or off (#636801)
+
 * Sat Sep 18 2010 Elio Maldonado <emaldona@redhat.com> - 3.12.7.99.4-1
 - NSS 3.12.8 RC0
 
diff --git a/setup-nsssysinit.sh b/setup-nsssysinit.sh
index 9c1727b..02042ff 100755
--- a/setup-nsssysinit.sh
+++ b/setup-nsssysinit.sh
@@ -1,18 +1,18 @@
 #!/bin/sh
 #
 # Turns on or off the nss-sysinit module db by editing the
-# global PKCS #11 congiguration file.
+# global PKCS #11 congiguration file. Displays the status.
 #
 # This script can be invoked by the user as super user.
-# It is invoked at nss-sysinit post install time with argument on
-# and at nss-sysinit pre uninstall with argument off. 
+# It is invoked at nss-sysinit post install time with argument on.
 #
 usage()
 {
   cat <<EOF
 Usage: setup-nsssysinit [on|off]
-  on  - turns on nsssysinit
-  off - turns off nsssysinit
+  on     - turns on nsssysinit
+  off    - turns off nsssysinit
+  status - reports whether nsssysinit is turned on or off
 EOF
   exit $1
 }
@@ -33,22 +33,30 @@ fi
 on="1"
 case "$1" in
   on | ON )
+    if [ `grep '^library=libnsssysinit' ${p11conf}` ]; then 
+      exit 0 
+    fi
+    umask 022
     cat ${p11conf} | \
-     sed -e 's/^library=$/library=libnsssysinit.so/' \
-         -e '/^NSS/s/\(Flags=internal\)\(,[^m]\)/\1,moduleDBOnly\2/' > \
-    ${p11conf}.on
+    sed -e 's/^library=$/library=libnsssysinit.so/' \
+        -e '/^NSS/s/\(Flags=internal\)\(,[^m]\)/\1,moduleDBOnly\2/' > \
+        ${p11conf}.on
     mv ${p11conf}.on ${p11conf}
     ;;
   off | OFF )
     if [ ! `grep "^library=libnsssysinit" ${p11conf}` ]; then
       exit 0
     fi
+    umask 022
     cat ${p11conf} | \
     sed -e 's/^library=libnsssysinit.so/library=/' \
         -e '/^NSS/s/Flags=internal,moduleDBOnly/Flags=internal/' > \
         ${p11conf}.off
     mv ${p11conf}.off ${p11conf}
     ;;
+  status )
+    grep -q '^library=libnsssysinit' ${p11conf} && echo 'ON' || echo OFF
+    ;;
   * )
     usage 1 1>&2
     ;;
diff --git a/sources b/sources
index 3235096..2f21992 100644
--- a/sources
+++ b/sources
@@ -1,4 +1,4 @@
-bb9c620f1a33a5f3ce13fe0199909646  nss-3.12.7.99.4-stripped.tar.bz2
+248bc97cb3fd613b23d66fd1d9d8d60a  nss-3.12.8-stripped.tar.bz2
 765fa031d5affa91ab824dd981777ddf  nss-pem-20100809.tar.bz2
 a5ae49867124ac75f029a9a33af31bad  blank-cert8.db
 9315689bbd9f28ceebd47894f99fccbd  blank-key3.db