.gitignore

@@ -95,4 +95,3 @@ TestUser51.cert
 /nss-3.101-with-nspr-4.35.tar.gz
 /nss-3.103-with-nspr-4.35.tar.gz
 /nss-3.104-with-nspr-4.35.tar.gz
-/nss-3.105-with-nspr-4.35.tar.gz

0001-riscv-workarounds-for-timing.patch

@@ -1,38 +0,0 @@
-From 92025c4ca158dccf4a640ddcf52edda1e8ffd77e Mon Sep 17 00:00:00 2001
-From: David Abdurachmanov <davidlt@rivosinc.com>
-Date: Thu, 14 Nov 2024 11:04:11 +0000
-Subject: [PATCH] riscv workarounds for timing
-
-All current boards are too slow to deliver required timing.
-
-Signed-off-by: David Abdurachmanov <davidlt@rivosinc.com>
-
-diff --git a/nss/tests/dbtests/dbtests.sh b/nss/tests/dbtests/dbtests.sh
-index c82ea85..067b40d 100755
---- a/nss/tests/dbtests/dbtests.sh
-+++ b/nss/tests/dbtests/dbtests.sh
-@@ -366,7 +366,7 @@ dbtest_main()
-       RARRAY=($dtime)
-       TIMEARRAY=(${RARRAY[1]//./ })
-       echo "${TIMEARRAY[0]} seconds"
--      test ${TIMEARRAY[0]} -lt 5
-+      test ${TIMEARRAY[0]} -lt 20
-       ret=$?
-       html_msg ${ret} 0 "certutil dump keys with explicit default trust flags"
-     fi
-diff --git a/nss/tests/sdr/sdr.sh b/nss/tests/sdr/sdr.sh
-index a934460..e7024d2 100755
---- a/nss/tests/sdr/sdr.sh
-+++ b/nss/tests/sdr/sdr.sh
-@@ -146,7 +146,7 @@ sdr_main()
-   RARRAY=($dtime)
-   TIMEARRAY=(${RARRAY[1]//./ })
-   echo "${TIMEARRAY[0]} seconds"
--  html_msg ${TIMEARRAY[0]} 0 "pwdecrypt no time regression"
-+  html_msg ${TIMEARRAY[0]} 1 "pwdecrypt no time regression"
-   export NSS_MAX_MP_PBE_ITERATION_COUNT=$OLD_MAX_PBE_ITERATIONS
- }
- 
--- 
-2.47.0
-

nss-3.101-enable-kyber-policy.patch

@@ -8,6 +8,6 @@ diff -up ./lib/pk11wrap/pk11pars.c.enable_kyber_policy ./lib/pk11wrap/pk11pars.c
 -    { CIPHER_NAME("XYBER768D00"), SEC_OID_XYBER768D00, 0 },
 +    { CIPHER_NAME("XYBER768D00"), SEC_OID_XYBER768D00, 
 +      NSS_USE_ALG_IN_SSL_KX },
-     { CIPHER_NAME("MLKEM768X25519"), SEC_OID_MLKEM768X25519, 0 },
      /* ANSI X9.62 named elliptic curves (characteristic two field) */
      { CIPHER_NAME("C2PNB163V1"), SEC_OID_ANSIX962_EC_C2PNB163V1,
+       NSS_USE_ALG_IN_SSL_KX | NSS_USE_ALG_IN_CERT_SIGNATURE },

nss.spec

@@ -1,5 +1,5 @@
 %global nspr_version 4.35.0
-%global nss_version 3.105.0
+%global nss_version 3.104.0
 # NOTE: To avoid NVR clashes of nspr* packages:
 # - reset %%{nspr_release} to 1, when updating %%{nspr_version}
 # - increment %%{nspr_version}, when updating the NSS part only
@@ -7,7 +7,7 @@
 %global nss_release %baserelease
 # use "%%global nspr_release %%[%%baserelease+n]" to handle offsets when
 # release number between nss and nspr are different.
-%global nspr_release %[%baserelease+29]
+%global nspr_release %[%baserelease+28]
 # only need to update this as we added new
 # algorithms under nss policy control
 %global crypto_policies_version 20240521
@@ -17,7 +17,11 @@
 %global dracut_modules_dir %{dracutlibdir}/modules.d/05nss-softokn/
 %global dracut_conf_dir %{dracutlibdir}/dracut.conf.d
 
+%ifnarch riscv64
 %bcond_without tests
+%else
+%bcond_with tests
+%endif
 %bcond_with dbm
 
 # Produce .chk files for the final stripped binaries
@@ -136,9 +140,6 @@ Patch41:          nss-3.101-enable-kyber-policy.patch
 # fix unused variable warnings
 Patch42:          nss-3.103-unused-cipherwrap2.patch
 
-# riscv workarounds
-Patch50:          0001-riscv-workarounds-for-timing.patch
-
 Patch100:         nspr-config-pc.patch
 Patch101:         nspr-gcc-atomics.patch
 
@@ -1087,11 +1088,8 @@ fi
 
 
 %changelog
-* Wed Nov 14 2024 David Abdurachmanov <davidlt@rivosinc.com> - 3.105.0-1.0.riscv64
+* Wed Nov 13 2024 David Abdurachmanov <davidlt@rivosinc.com> - 3.104.0-1.0.riscv64
-- Fix two tests for riscv64
+- Disable tests on riscv64 for now
-
-* Thu Oct 3 2024 Frantisek Krenzelok <krenzelok.frantisek@gmail.com> - 3.105.0-1
-- Update NSS to 3.105.0
 
 * Wed Sep 4 2024 Frantisek Krenzelok <krenzelok.frantisek@gmail.com> - 3.104.0-1
 - Update NSS to 3.104.0

sources

@@ -1,3 +1,3 @@
 SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403fda3e3d4e7757838061ae56ccf5aac335cb54f254f0a9e6e9c0dd5920b4155a39264525b06
 SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7
-SHA512 (nss-3.105-with-nspr-4.35.tar.gz) = 8fad30acf07bddb501811fac63330816a1b0aaee301d94a4798f08e81be243afe894bd2202996339a7716a60639c0d6c4d20cc2dd407c757a6d3074c5c975673
+SHA512 (nss-3.104-with-nspr-4.35.tar.gz) = 15b3b3f7d29642d86e6930dbe07cc430dbe2c41a0a7bf22167ba37187157a7196d4a198ca788f74f38a60f67e410443e2509218dce6112c468e561fd265c780a