* Fri May 20 2011 Dennis Gilmore <dennis@ausil.us> - 3.12.9-11

- make testsuite failures non fatal on arm
Merge branch 'f14' into f13
2011-05-20 09:20:56 -05:00 · 2011-04-12 14:42:52 -07:00 · 2011-04-12 13:04:06 -07:00 · 2011-04-12 13:01:57 -07:00 · 2011-04-12 12:52:18 -07:00 · 2011-03-26 13:53:48 -07:00
35 changed files with 767 additions and 3016 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1,51 +1,8 @@
+nss-3.12.9-stripped.tar.bz2
+nss-pem-20101125.tar.bz2
 blank-cert8.db
 blank-key3.db
 blank-secmod.db
 blank-cert9.db
 blank-key4.db
 PayPalEE.cert
-TestCA.ca.cert
-TestUser50.cert
-TestUser51.cert
-/PayPalRootCA.cert
-/PayPalICA.cert
-/nss-3.25.0.tar.gz
-/nss-3.26.0.tar.gz
-/nss-3.27.0.tar.gz
-/nss-3.27.2.tar.gz
-/nss-3.28.1.tar.gz
-/nss-3.29.0.tar.gz
-/nss-3.29.1.tar.gz
-/nss-3.30.0.tar.gz
-/nss-3.30.2.tar.gz
-/nss-3.31.0.tar.gz
-/nss-3.32.0.tar.gz
-/nss-3.32.1.tar.gz
-/nss-3.33.0.tar.gz
-/nss-3.34.0.tar.gz
-/nss-3.35.0.tar.gz
-/nss-3.36.0.tar.gz
-/nss-3.36.1.tar.gz
-/nss-3.37.1.tar.gz
-/nss-3.37.3.tar.gz
-/nss-3.38.0.tar.gz
-/nss-3.39.tar.gz
-/nss-3.40.1.tar.gz
-/nss-3.41.tar.gz
-/nss-3.42.tar.gz
-/nss-3.42.1.tar.gz
-/nss-3.43.tar.gz
-/nss-3.44.tar.gz
-/nss-3.44.1.tar.gz
-/nss-3.45.tar.gz
-/nss-3.46.tar.gz
-/nss-3.46.1.tar.gz
-/nss-3.47.tar.gz
-/nss-3.47.1.tar.gz
-/nss-3.48.tar.gz
-/nss-3.49.tar.gz
-/nss-3.49.2.tar.gz
-/nss-3.50.tar.gz
-/nss-3.51.tar.gz
-/nss-3.51.1.tar.gz
-/nss-3.52.tar.gz
--- a/0001-Bug-695011-PEM-logging.patch
+++ b/0001-Bug-695011-PEM-logging.patch
@ -0,0 +1,107 @@
+From 5c61cdba435096ee6e65cee4dc9a473430643c07 Mon Sep 17 00:00:00 2001
+From: Elio Maldonado <emaldona@redhat.com>
+Date: Tue, 12 Apr 2011 09:31:48 -0700
+Subject: [PATCH] Bug 695011 PEM logging
+
+Use NSPR logging facilities for PEM logging to fix a segmenation violation
+caused when user cannot for write a log file created by root
+---
+ mozilla/security/nss/lib/ckfw/pem/ckpem.h |    7 ++++-
+ mozilla/security/nss/lib/ckfw/pem/util.c  |   30 ++++++++++++++++------------
+ 2 files changed, 22 insertions(+), 15 deletions(-)
+
+diff --git a/mozilla/security/nss/lib/ckfw/pem/ckpem.h b/mozilla/security/nss/lib/ckfw/pem/ckpem.h
+index 839d40b..720525e 100644
+--- a/mozilla/security/nss/lib/ckfw/pem/ckpem.h
+++ b/mozilla/security/nss/lib/ckfw/pem/ckpem.h
+@@ -1,3 +1,6 @@
+#ifndef CKPEM_H
+#define CKPEM_H
+
+ #include "nssckmdt.h"
+ #include "nssckfw.h"
+ #include "ckfwtm.h"
+@@ -254,8 +257,8 @@ unsigned int pem_PrivateModulusLen(pemLOWKEYPrivateKey *privk);
+ /* ptoken.c */
+ NSSCKMDToken * pem_NewToken(NSSCKFWInstance *fwInstance, CK_RV *pError);
+ 
+/* util.c */
+ void open_log();
+-void close_log();
+ void plog(const char *fmt, ...);
+ 
+-#define PEM_H 1
+#endif /* CKPEM_H */
+diff --git a/mozilla/security/nss/lib/ckfw/pem/util.c b/mozilla/security/nss/lib/ckfw/pem/util.c
+index 853f418..fafb924 100644
+--- a/mozilla/security/nss/lib/ckfw/pem/util.c
+++ b/mozilla/security/nss/lib/ckfw/pem/util.c
+@@ -41,6 +41,7 @@
+ #include "prtime.h"
+ #include "prlong.h"
+ #include "prerror.h"
+#include "prlog.h"
+ #include "prprf.h"
+ #include "plgetopt.h"
+ #include "prenv.h"
+@@ -51,6 +52,9 @@
+ #include "cryptohi.h"
+ #include "secpkcs7.h"
+ #include "secerr.h"
+
+#include "ckpem.h"
+
+ #include <stdarg.h>
+ 
+ #define CHUNK_SIZE  512
+@@ -267,34 +271,34 @@ ReadDERFromFile(SECItem *** derlist, char *filename, PRBool ascii,
+     return -1;
+ }
+ 
+-FILE *plogfile;
+#ifdef DEBUG
+#define LOGGING_BUFFER_SIZE 400
+#define PEM_DEFAULT_LOG_FILE "/tmp/pkcs11.log"
+static const char *pemLogModuleName = "PEM";
+static PRLogModuleInfo* pemLogModule;
+#endif
+ 
+ void open_log()
+ {
+ #ifdef DEBUG
+-    plogfile = fopen("/tmp/pkcs11.log", "a");
+-#endif
+    const char *nsprLogFile = PR_GetEnv("NSPR_LOG_FILE");
+ 
+-    return;
+-}
+    pemLogModule = PR_NewLogModule(pemLogModuleName);
+ 
+-void close_log()
+-{
+-#ifdef DEBUG
+-    fclose(plogfile);
+    (void) PR_SetLogFile(nsprLogFile ? nsprLogFile : PEM_DEFAULT_LOG_FILE);
+    /* If false, the log file will remain what it was before */
+ #endif
+-    return;
+ }
+ 
+ void plog(const char *fmt, ...)
+ {
+ #ifdef DEBUG
+    char buf[LOGGING_BUFFER_SIZE];
+     va_list ap;
+ 
+     va_start(ap, fmt);
+-    vfprintf(plogfile, fmt, ap);
+    PR_vsnprintf(buf, sizeof(buf), fmt, ap);
+     va_end(ap);
+-
+-    fflush(plogfile);
+    PR_LOG(pemLogModule, PR_LOG_DEBUG, ("%s", buf));
+ #endif
+ }
+-- 
+1.7.4.2
+
--- a/68
+++ b/68
@ -1,68 +0,0 @@
-#requires nspr
-#requires perl
-#requires nss-util
-#requires nss-softokn
-
-mcd $BUILDDIR/nss
-
-export BUILD_OPT=1
-export PKG_CONFIG_ALLOW_SYSTEM_LIBS=1
-export PKG_CONFIG_ALLOW_SYSTEM_CFLAGS=1
-export NSPR_INCLUDE_DIR=/usr/include/nspr
-export NSPR_LIB_DIR=/usr/lib${SUFFIX}
-export NSS_USE_SYSTEM_SQLITE=1
-export NSS_BUILD_WITHOUT_SOFTOKEN=1
-export USE_SYSTEM_SOFTOKEN=1
-export SOFTOKEN_LIB_DIR=/usr/lib${SUFFIX}
-export NSSUTIL_INCLUDE_DIR=/usr/include/nss3
-export NSSUTIL_LIB_DIR=/usr/lib${SUFFIX}
-export USE_SYSTEM_NSSUTIL=1
-export FREEBL_INCLUDE_DIR=/usr/include/nss3
-export FREEBL_LIB_DIR=/usr/lib${SUFFIX}
-export USE_SYSTEM_FREEBL=1
-export NSS_USE_SYSTEM_FREEBL=1
-export FREEBL_NO_DEPEND=1
-export IN_TREE_FREEBL_HEADERS_FIRST=1
-export NSS_BLTEST_NOT_AVAILABLE=1
-export NSS_NO_SSL2_NO_EXPORT=1
-export NSS_ECC_MORE_THAN_SUITE_B=1
-export NSS_NO_PKCS11_BYPASS=1
-#export NSDISTMODE="copy"
-
-if [ "$SUFFIX" = "64" ]; then
-  USE_64=1
-  export USE_64
-fi
-
-(cd $SRC/nss-3.* && mkdir -p dist/private/nss && cp nss/lib/ckfw/nssck.api dist/private/nss/)
-
-make -C $SRC/nss-3.*/nss/coreconf
-make -C $SRC/nss-3.*/nss/lib/dbm
-
-# nss/nssinit.c, ssl/sslcon.c, smime/smimeutil.c and ckfw/builtins/binst.c
-# need nss/verref.h which is exported privately, move it to where it can be found.
-(cd $SRC/nss-3.* && mkdir -p dist/private/nss && cp -a nss/verref.h dist/private/nss/)
-
-make -C $SRC/nss-3.*/nss
-cd $SRC/nss-3.*/nss/coreconf
-make install
-cd $SRC/nss-3.*/nss/lib/dbm
-make install
-cd $SRC/nss-3.*/nss
-make install
-# Copy the binary libraries we want
-NSSLIBS="libnss3.so libnssckbi.so libnsspem.so libnsssysinit.so libsmime3.so libssl3.so"
-# BOZO: temporarily disable FIPS140 support
-#NSSLIBCHKS="libnssdbm3.chk libfreebl3.chk libsoftokn3.chk"
-NSSLIBCHKS=""
-# END BOZO
-cd $SRC/nss-3.*
-for file in $NSSLIBS $NSSLIBCHKS
-do
-  install -p -m 755 dist/*.OBJ/lib/$file /usr/lib${SUFFIX}/
-done
-# Copy the include files we want
-for file in $SRC/nss-*/dist/public/nss/*.h
-do
-  install -p -m 644 $file /usr/include/nss3/
-done
--- a/cert8.db.xml
+++ b/cert8.db.xml
@ -1,59 +0,0 @@
-<?xml version='1.0' encoding='utf-8'?>
-<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
-  "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
-<!ENTITY date SYSTEM "date.xml">
-<!ENTITY version SYSTEM "version.xml">
-]>
-
-<refentry id="cert8.db">
-
-  <refentryinfo>
-    <date>&date;</date>
-    <title>Network Security Services</title>
-    <productname>nss</productname>
-    <productnumber>&version;</productnumber>
-  </refentryinfo>
-
-  <refmeta>
-    <refentrytitle>cert8.db</refentrytitle>
-    <manvolnum>5</manvolnum>
-  </refmeta>
-
-  <refnamediv>
-    <refname>cert8.db</refname>
-    <refpurpose>Legacy NSS certificate database</refpurpose>
-  </refnamediv>
-
-<refsection id="description">
-    <title>Description</title>
-    <para><emphasis>cert8.db</emphasis> is an NSS certificate database.</para>
-  <para>This certificate database is in the legacy database format. Consider migrating to cert9.db and key4.db which are the new sqlite-based shared database format with support for concurrent access.
-  </para>
-  </refsection>
-
-  <refsection>
-    <title>Files</title>
-    <para><filename>/etc/pki/nssdb/cert8.db</filename></para>
-  </refsection>
-
-  <refsection>
-    <title>See also</title>
-    <para>cert9.db(5), key4.db(5), pkcs11.txt(5), </para>
-  </refsection>
-
-  <refsection id="authors">
-    <title>Authors</title>
-    <para>The nss libraries were written and maintained by developers with Netscape, Red Hat,  Sun, Oracle, Mozilla, and Google.</para>
-    <para>Authors: Elio Maldonado &lt;emaldona@redhat.com>.</para>
-  </refsection>
-
-<!-- don't change -->
-  <refsection id="license">
-    <title>LICENSE</title>
-    <para>Licensed under the Mozilla Public License, v. 2.0.  If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla.org/MPL/2.0/.
-    </para>
-
-  </refsection>
-
-
-</refentry>
--- a/cert9.db.xml
+++ b/cert9.db.xml
@ -1,59 +0,0 @@
-<?xml version='1.0' encoding='utf-8'?>
-<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
-  "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
-<!ENTITY date SYSTEM "date.xml">
-<!ENTITY version SYSTEM "version.xml">
-]>
-
-<refentry id="cert9.db">
-
-  <refentryinfo>
-    <date>&date;</date>
-    <title>Network Security Services</title>
-    <productname>nss</productname>
-    <productnumber>&version;</productnumber>
-  </refentryinfo>
-
-  <refmeta>
-    <refentrytitle>cert9.db</refentrytitle>
-    <manvolnum>5</manvolnum>
-  </refmeta>
-
-  <refnamediv>
-    <refname>cert9.db</refname>
-    <refpurpose>NSS certificate database</refpurpose>
-  </refnamediv>
-
-<refsection id="description">
-    <title>Description</title>
-    <para><emphasis>cert9.db</emphasis> is an NSS certificate database.</para>
-  <para>This certificate database is the sqlite-based shared database with support for concurrent access.
-  </para>
-  </refsection>
-
-  <refsection>
-    <title>Files</title>
-    <para><filename>/etc/pki/nssdb/cert9.db</filename></para>
-  </refsection>
-
-  <refsection>
-    <title>See also</title>
-    <para>pkcs11.txt(5)</para>
-  </refsection>
-
-  <refsection id="authors">
-    <title>Authors</title>
-    <para>The nss libraries were written and maintained by developers with Netscape, Red Hat,  Sun, Oracle, Mozilla, and Google.</para>
-    <para>Authors: Elio Maldonado &lt;emaldona@redhat.com>.</para>
-  </refsection>
-
-<!-- don't change -->
-  <refsection id="license">
-    <title>LICENSE</title>
-    <para>Licensed under the Mozilla Public License, v. 2.0.  If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla.org/MPL/2.0/.
-    </para>
-
-  </refsection>
-
-
-</refentry>
--- a/honor-user-trust-preferences.patch
+++ b/honor-user-trust-preferences.patch
@ -0,0 +1,196 @@
+Index: ./mozilla/security/nss/lib/pk11wrap/pk11load.c
+===================================================================
+RCS file: /cvsroot/mozilla/security/nss/lib/pk11wrap/pk11load.c,v
+retrieving revision 1.30
+retrieving revision 1.30.2.2
+diff -u -p -r1.30 -r1.30.2.2
+--- ./mozilla/security/nss/lib/pk11wrap/pk11load.c	30 Apr 2010 07:22:54 -0000	1.30
+++ ./mozilla/security/nss/lib/pk11wrap/pk11load.c	27 Jan 2011 01:35:46 -0000	1.30.2.2
+@@ -178,8 +178,8 @@ secmod_handleReload(SECMODModule *oldMod
+ 	char *oldModuleSpec;
+ 
+ 	if (secmod_IsInternalKeySlot(newModule)) {
+-	    pk11_SetInternalKeySlot(slot);
+-	}
+	    pk11_SetInternalKeySlotIfFirst(slot);
+	} 
+ 	newID = slot->slotID;
+ 	PK11_FreeSlot(slot);
+ 	for (thisChild=children, thisID=ids; thisChild && *thisChild; 
+@@ -550,6 +550,11 @@ secmod_LoadPKCS11Module(SECMODModule *mo
+ 	    /* look down the slot info table */
+ 	    PK11_LoadSlotList(mod->slots[i],mod->slotInfo,mod->slotInfoCount);
+ 	    SECMOD_SetRootCerts(mod->slots[i],mod);
+	    /* explicitly mark the internal slot as such if IsInternalKeySlot()
+	     * is set */
+	    if (secmod_IsInternalKeySlot(mod) && (i == (mod->isFIPS ? 0 : 1))) {
+		pk11_SetInternalKeySlotIfFirst(mod->slots[i]);
+	    } 
+ 	}
+ 	mod->slotCount = slotCount;
+ 	mod->slotInfoCount = 0;
+Index: ./mozilla/security/nss/lib/pk11wrap/pk11priv.h
+===================================================================
+RCS file: /cvsroot/mozilla/security/nss/lib/pk11wrap/pk11priv.h,v
+retrieving revision 1.13
+retrieving revision 1.13.2.2
+diff -u -p -r1.13 -r1.13.2.2
+--- ./mozilla/security/nss/lib/pk11wrap/pk11priv.h	27 Oct 2009 23:04:46 -0000	1.13
+++ ./mozilla/security/nss/lib/pk11wrap/pk11priv.h	27 Jan 2011 01:35:46 -0000	1.13.2.2
+@@ -115,6 +115,7 @@ void PK11_InitSlot(SECMODModule *mod,CK_
+ PRBool PK11_NeedPWInitForSlot(PK11SlotInfo *slot);
+ SECStatus PK11_ReadSlotCerts(PK11SlotInfo *slot);
+ void pk11_SetInternalKeySlot(PK11SlotInfo *slot);
+void pk11_SetInternalKeySlotIfFirst(PK11SlotInfo *slot);
+ 
+ /*********************************************************************
+  *       Mechanism Mapping functions
+Index: ./mozilla/security/nss/lib/pk11wrap/pk11slot.c
+===================================================================
+RCS file: /cvsroot/mozilla/security/nss/lib/pk11wrap/pk11slot.c,v
+retrieving revision 1.101
+retrieving revision 1.101.2.3
+diff -u -p -r1.101 -r1.101.2.3
+--- ./mozilla/security/nss/lib/pk11wrap/pk11slot.c	3 Apr 2010 18:27:31 -0000	1.101
+++ ./mozilla/security/nss/lib/pk11wrap/pk11slot.c	27 Jan 2011 01:35:46 -0000	1.101.2.3
+@@ -1349,7 +1349,7 @@ pk11_isRootSlot(PK11SlotInfo *slot) 
+  * times as tokens are removed and re-inserted.
+  */
+ void
+-PK11_InitSlot(SECMODModule *mod,CK_SLOT_ID slotID,PK11SlotInfo *slot)
+PK11_InitSlot(SECMODModule *mod, CK_SLOT_ID slotID, PK11SlotInfo *slot)
+ {
+     SECStatus rv;
+     char *tmp;
+@@ -1726,6 +1726,12 @@ PK11_NeedUserInit(PK11SlotInfo *slot)
+ }
+ 
+ static PK11SlotInfo *pk11InternalKeySlot = NULL;
+
+/*
+ * Set a new default internal keyslot. If one has already been set, clear it.
+ * Passing NULL falls back to the NSS normally selected default internal key
+ * slot.
+ */
+ void
+ pk11_SetInternalKeySlot(PK11SlotInfo *slot)
+ {
+@@ -1735,6 +1741,20 @@ pk11_SetInternalKeySlot(PK11SlotInfo *sl
+    pk11InternalKeySlot = slot ? PK11_ReferenceSlot(slot) : NULL;
+ }
+ 
+/*
+ * Set a new default internal keyslot if the normal key slot has not already
+ * been overridden. Subsequent calls to this function will be ignored unless
+ * pk11_SetInternalKeySlot is used to clear the current default.
+ */
+void
+pk11_SetInternalKeySlotIfFirst(PK11SlotInfo *slot)
+{
+   if (pk11InternalKeySlot) {
+	return;
+   }
+   pk11InternalKeySlot = slot ? PK11_ReferenceSlot(slot) : NULL;
+}
+
+ 
+ /* get the internal key slot. FIPS has only one slot for both key slots and
+  * default slots */
+Index: ./mozilla/security/nss/lib/sysinit/nsssysinit.c
+===================================================================
+RCS file: /cvsroot/mozilla/security/nss/lib/sysinit/nsssysinit.c,v
+retrieving revision 1.2
+retrieving revision 1.2.2.2
+diff -u -p -r1.2 -r1.2.2.2
+--- ./mozilla/security/nss/lib/sysinit/nsssysinit.c	6 Feb 2010 04:56:37 -0000	1.2
+++ ./mozilla/security/nss/lib/sysinit/nsssysinit.c	26 Jan 2011 00:52:31 -0000	1.2.2.2
+@@ -221,16 +221,16 @@ getFIPSMode(void)
+  * 2 for the key slot, and
+  * 3 for the crypto operations slot fips
+  */
+-#define ORDER_FLAGS "trustOrder=75 cipherOrder=100"
+#define CIPHER_ORDER_FLAGS "cipherOrder=100"
+ #define SLOT_FLAGS \
+ 	"[slotFlags=RSA,RC4,RC2,DES,DH,SHA1,MD5,MD2,SSL,TLS,AES,RANDOM" \
+ 	" askpw=any timeout=30 ]"
+  
+ static const char *nssDefaultFlags =
+-	ORDER_FLAGS " slotParams={0x00000001=" SLOT_FLAGS " }  ";
+	CIPHER_ORDER_FLAGS " slotParams={0x00000001=" SLOT_FLAGS " }  ";
+ 
+ static const char *nssDefaultFIPSFlags =
+-	ORDER_FLAGS " slotParams={0x00000003=" SLOT_FLAGS " }  ";
+	CIPHER_ORDER_FLAGS " slotParams={0x00000003=" SLOT_FLAGS " }  ";
+ 
+ /*
+  * This function builds the list of databases and modules to load, and sets
+@@ -270,7 +270,7 @@ get_list(char *filename, char *stripped_
+ 	    "library= "
+ 	    "module=\"NSS User database\" "
+ 	    "parameters=\"configdir='sql:%s' %s tokenDescription='NSS user database'\" "
+-        "NSS=\"%sflags=internal%s\"",
+        "NSS=\"trustOrder=75 %sflags=internal%s\"",
+         userdb, stripped_parameters, nssflags,
+         isFIPS ? ",FIPS" : "");
+ 
+@@ -284,30 +284,6 @@ get_list(char *filename, char *stripped_
+ 		userdb, stripped_parameters);
+ 	}
+ 
+-#if 0
+-	/* This doesn't actually work. If we register
+-		both this and the sysdb (in either order)
+-		then only one of them actually shows up */
+-
+-    /* Using a NULL filename as a Boolean flag to
+-     * prevent registering both an application-defined
+-     * db and the system db. rhbz #546211.
+-     */
+-    PORT_Assert(filename);
+-    if (sysdb && PL_CompareStrings(filename, sysdb))
+-	    filename = NULL;
+-    else if (userdb && PL_CompareStrings(filename, userdb))
+-	    filename = NULL;
+-
+-    if (filename && !userIsRoot()) {
+-	    module_list[next++] = PR_smprintf(
+-	      "library= "
+-	      "module=\"NSS database\" "
+-	      "parameters=\"configdir='sql:%s' tokenDescription='NSS database sql:%s'\" "
+-	      "NSS=\"%sflags=internal\"",filename, filename, nssflags);
+-    }
+-#endif
+-
+     /* now the system database (always read only unless it's root) */
+     if (sysdb) {
+ 	    const char *readonly = userCanModifySystemDB() ? "" : "flags=readonly";
+@@ -315,7 +291,7 @@ get_list(char *filename, char *stripped_
+ 	      "library= "
+ 	      "module=\"NSS system database\" "
+ 	      "parameters=\"configdir='sql:%s' tokenDescription='NSS system database' %s\" "
+-	      "NSS=\"%sflags=internal,critical\"",sysdb, readonly, nssflags);
+	      "NSS=\"trustOrder=80 %sflags=internal,critical\"",sysdb, readonly, nssflags);
+     }
+ 
+     /* that was the last module */
+@@ -372,9 +348,9 @@ overlapstrcpy(char *target, char *src)
+ 
+ /* determine what options the user was trying to open this database with */
+ /* filename is the directory pointed to by configdir= */
+-/* stripped is the rest of the paramters with configdir= stripped out */
+/* stripped is the rest of the parameters with configdir= stripped out */
+ static SECStatus
+-parse_paramters(char *parameters, char **filename, char **stripped)
+parse_parameters(char *parameters, char **filename, char **stripped)
+ {
+     char *sourcePrev;
+     char *sourceCurr;
+@@ -423,7 +399,7 @@ NSS_ReturnModuleSpecData(unsigned long f
+     char **retString = NULL;
+     SECStatus rv;
+ 
+-    rv = parse_paramters(parameters, &filename, &stripped);
+    rv = parse_parameters(parameters, &filename, &stripped);
+     if (rv != SECSuccess) {
+ 	/* use defaults */
+ 	filename = getSystemDB();
--- a/iquote.patch
+++ b/iquote.patch
@ -1,13 +0,0 @@
-diff -up nss/coreconf/location.mk.iquote nss/coreconf/location.mk
--- nss/coreconf/location.mk.iquote	2017-07-27 16:09:32.000000000 +0200
-+++ nss/coreconf/location.mk	2017-09-06 13:23:14.633611555 +0200
-@@ -75,4 +75,9 @@ ifndef SQLITE_LIB_NAME
-     SQLITE_LIB_NAME = sqlite3
- endif
- 
-+# Prefer in-tree headers over system headers
-+ifdef IN_TREE_FREEBL_HEADERS_FIRST
-+    INCLUDES += -iquote $(DIST)/../public/nss -iquote $(DIST)/../private/nss
-+endif
-+
- MK_LOCATION = included
--- a/key3.db.xml
+++ b/key3.db.xml
@ -1,59 +0,0 @@
-<?xml version='1.0' encoding='utf-8'?>
-<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
-  "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
-<!ENTITY date SYSTEM "date.xml">
-<!ENTITY version SYSTEM "version.xml">
-]>
-
-<refentry id="key3.db">
-
-  <refentryinfo>
-    <date>&date;</date>
-    <title>Network Security Services</title>
-    <productname>nss</productname>
-    <productnumber>&version;</productnumber>
-  </refentryinfo>
-
-  <refmeta>
-    <refentrytitle>key3.db</refentrytitle>
-    <manvolnum>5</manvolnum>
-  </refmeta>
-
-  <refnamediv>
-    <refname>key3.db</refname>
-    <refpurpose>Legacy NSS certificate database</refpurpose>
-  </refnamediv>
-
-<refsection id="description">
-    <title>Description</title>
-    <para><emphasis>key3.db</emphasis> is an NSS certificate database.</para>
-  <para>This is a key database in the legacy database format. Consider migrating to cert9.db and key4.db which  which are the new sqlite-based shared database format with support for concurrent access.
-  </para>
-  </refsection>
-
-  <refsection>
-    <title>Files</title>
-    <para><filename>/etc/pki/nssdb/key3.db</filename></para>
-  </refsection>
-
-  <refsection>
-    <title>See also</title>
-    <para>cert9.db(5), key4.db(5), pkcs11.txt(5), </para>
-  </refsection>
-
-  <refsection id="authors">
-    <title>Authors</title>
-    <para>The nss libraries were written and maintained by developers with Netscape, Red Hat,  Sun, Oracle, Mozilla, and Google.</para>
-    <para>Authors: Elio Maldonado &lt;emaldona@redhat.com>.</para>
-  </refsection>
-
-<!-- don't change -->
-  <refsection id="license">
-    <title>LICENSE</title>
-    <para>Licensed under the Mozilla Public License, v. 2.0.  If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla.org/MPL/2.0/.
-    </para>
-
-  </refsection>
-
-
-</refentry>
--- a/key4.db.xml
+++ b/key4.db.xml
@ -1,59 +0,0 @@
-<?xml version='1.0' encoding='utf-8'?>
-<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
-  "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
-<!ENTITY date SYSTEM "date.xml">
-<!ENTITY version SYSTEM "version.xml">
-]>
-
-<refentry id="key4.db">
-
-  <refentryinfo>
-    <date>&date;</date>
-    <title>Network Security Services</title>
-    <productname>nss</productname>
-    <productnumber>&version;</productnumber>
-  </refentryinfo>
-
-  <refmeta>
-    <refentrytitle>key4.db</refentrytitle>
-    <manvolnum>5</manvolnum>
-  </refmeta>
-
-  <refnamediv>
-    <refname>key4.db</refname>
-    <refpurpose>NSS certificate database</refpurpose>
-  </refnamediv>
-
-<refsection id="description">
-    <title>Description</title>
-    <para><emphasis>key4.db</emphasis> is an NSS key database.</para>
-  <para>This key database is the sqlite-based shared database format with support for concurrent access.
-  </para>
-  </refsection>
-
-  <refsection>
-    <title>Files</title>
-    <para><filename>/etc/pki/nssdb/key4.db</filename></para>
-  </refsection>
-
-  <refsection>
-    <title>See also</title>
-    <para>pkcs11.txt(5)</para>
-  </refsection>
-
-  <refsection id="authors">
-    <title>Authors</title>
-    <para>The nss libraries were written and maintained by developers with Netscape, Red Hat,  Sun, Oracle, Mozilla, and Google.</para>
-    <para>Authors: Elio Maldonado &lt;emaldona@redhat.com>.</para>
-  </refsection>
-
-<!-- don't change -->
-  <refsection id="license">
-    <title>LICENSE</title>
-    <para>Licensed under the Mozilla Public License, v. 2.0.  If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla.org/MPL/2.0/.
-    </para>
-
-  </refsection>
-
-
-</refentry>
--- a/nss-539183.patch
+++ b/nss-539183.patch
@ -1,62 +1,33 @@
--- nss/cmd/httpserv/httpserv.c.539183	2016-05-21 18:31:39.879585420 -0700
-+++ nss/cmd/httpserv/httpserv.c	2016-05-21 18:37:22.374464057 -0700
-@@ -953,23 +953,23 @@
+Index: mozilla/security/nss/cmd/selfserv/selfserv.c
+===================================================================
+RCS file: /cvsroot/mozilla/security/nss/cmd/selfserv/selfserv.c,v
+retrieving revision 1.94
+diff -p -u -8 -r1.94 selfserv.c
+--- mozilla/security/nss/cmd/selfserv/selfserv.c	3 Apr 2010 18:27:27 -0000	1.94
+++ mozilla/security/nss/cmd/selfserv/selfserv.c	24 Feb 2011 02:28:02 -0000
+@@ -1487,21 +1487,21 @@ PRFileDesc *
 getBoundListenSocket(unsigned short port)
 {
-     PRFileDesc *listen_sock;
-     int listenQueueDepth = 5 + (2 * maxThreads);
-     PRStatus prStatus;
-     PRNetAddr addr;
+     PRFileDesc *       listen_sock;
+     int                listenQueueDepth = 5 + (2 * maxThreads);
+     PRStatus	       prStatus;
+     PRNetAddr          addr;
     PRSocketOptionData opt;
 
 -    addr.inet.family = PR_AF_INET;
-    addr.inet.ip = PR_INADDR_ANY;
-    addr.inet.port = PR_htons(port);
+-    addr.inet.ip     = PR_INADDR_ANY;
+-    addr.inet.port   = PR_htons(port);
 +    if (PR_SetNetAddr(PR_IpAddrAny, PR_AF_INET6, port, &addr) != PR_SUCCESS) {
-+        errExit("PR_SetNetAddr");
+	errExit("PR_SetNetAddr");
 +    }
 
 -    listen_sock = PR_NewTCPSocket();
 +    listen_sock = PR_OpenTCPSocket(PR_AF_INET6);
     if (listen_sock == NULL) {
-        errExit("PR_NewTCPSocket");
-+        errExit("PR_OpenTCPSockett");
+ 	errExit("PR_NewTCPSocket");
     }
 
     opt.option = PR_SockOpt_Nonblocking;
     opt.value.non_blocking = PR_FALSE;
     prStatus = PR_SetSocketOption(listen_sock, &opt);
     if (prStatus < 0) {
-         PR_Close(listen_sock);
-         errExit("PR_SetSocketOption(PR_SockOpt_Nonblocking)");
--- nss/cmd/selfserv/selfserv.c.539183	2016-05-21 18:31:39.882585367 -0700
-+++ nss/cmd/selfserv/selfserv.c	2016-05-21 18:41:43.092801174 -0700
-@@ -1711,23 +1711,23 @@
- getBoundListenSocket(unsigned short port)
- {
-     PRFileDesc *listen_sock;
-     int listenQueueDepth = 5 + (2 * maxThreads);
-     PRStatus prStatus;
-     PRNetAddr addr;
-     PRSocketOptionData opt;
- 
-    addr.inet.family = PR_AF_INET;
-    addr.inet.ip = PR_INADDR_ANY;
-    addr.inet.port = PR_htons(port);
-+    if (PR_SetNetAddr(PR_IpAddrAny, PR_AF_INET6, port, &addr) != PR_SUCCESS) {
-+        errExit("PR_SetNetAddr");
-+    }
- 
-    listen_sock = PR_NewTCPSocket();
-+    listen_sock = PR_OpenTCPSocket(PR_AF_INET6);
-     if (listen_sock == NULL) {
-        errExit("PR_NewTCPSocket");
-+        errExit("PR_OpenTCPSocket error");
-     }
- 
-     opt.option = PR_SockOpt_Nonblocking;
-     opt.value.non_blocking = PR_FALSE;
-     prStatus = PR_SetSocketOption(listen_sock, &opt);
-     if (prStatus < 0) {
-         PR_Close(listen_sock);
-         errExit("PR_SetSocketOption(PR_SockOpt_Nonblocking)");
--- a/nss-config.xml
+++ b/nss-config.xml
@ -1,132 +0,0 @@
-<?xml version='1.0' encoding='utf-8'?>
-<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
-  "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
-<!ENTITY date SYSTEM "date.xml">
-<!ENTITY version SYSTEM "version.xml">
-]>
-
-<refentry id="nss-config">
-
-  <refentryinfo>
-    <date>&date;</date>
-    <title>Network Security Services</title>
-    <productname>nss</productname>
-    <productnumber>&version;</productnumber>
-  </refentryinfo>
-
-  <refmeta>
-    <refentrytitle>nss-config</refentrytitle>
-    <manvolnum>1</manvolnum>
-  </refmeta>
-
-  <refnamediv>
-    <refname>nss-config</refname>
-    <refpurpose>Return meta information about nss libraries</refpurpose>
-  </refnamediv>
-
-  <refsynopsisdiv>
-    <cmdsynopsis>
-      <command>nss-config</command>
-      <arg><option>--prefix</option></arg>
-      <arg><option>--exec-prefix</option></arg>
-      <arg><option>--includedir</option></arg>
-      <arg><option>--libs</option></arg>
-      <arg><option>--cflags</option></arg>
-      <arg><option>--libdir</option></arg>
-      <arg><option>--version</option></arg>
-    </cmdsynopsis>
-  </refsynopsisdiv>
-
-<refsection id="description">
-    <title>Description</title>
-
-    <para><command>nss-config</command> is a shell scrip
-    tool which can be used to obtain gcc options for building client pacakges of nspt. </para>
-
-  </refsection>
-  
-  <refsection>
-    <title>Options</title>
-    
-    <variablelist>
-      <varlistentry>
-        <term><option>--prefix</option></term>
-        <listitem><simpara>Returns the top level system directory under which the nss libraries are installed.</simpara></listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><option>--exec-prefix</option></term>
-        <listitem><simpara>returns the top level system directory under which any nss binaries would be installed.</simpara></listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><option>--includedir</option> <replaceable>count</replaceable></term>
-        <listitem><simpara>returns the path to the directory were the nss libraries are installed.</simpara></listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><option>--version</option></term>
-        <listitem><simpara>returns the upstream version of nss in the form major_version-minor_version-patch_version.</simpara></listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><option>--libs</option></term>
-        <listitem><simpara>returns the compiler linking flags.</simpara></listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><option>--cflags</option></term>
-        <listitem><simpara>returns the compiler include flags.</simpara></listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><option>--libdir</option></term>
-        <listitem><simpara>returns the path to the directory were the nss libraries are installed.</simpara></listitem>
-      </varlistentry>
-
-    </variablelist>
-  </refsection>
-
-  <refsection>
-    <title>Examples</title>
-
-    <para>The following example will query for both include path and linkage flags:
-    
-      <programlisting>
-        /usr/bin/nss-config --cflags --libs
-      </programlisting>
-
-    </para>
-
-   
-  </refsection>
-
-  <refsection>
-    <title>Files</title>
-
-    <para><filename>/usr/bin/nss-config</filename></para>
-
-  </refsection>
-
-  <refsection>
-    <title>See also</title>
-    <para>pkg-config(1)</para>
-  </refsection>
-
-  <refsection id="authors">
-    <title>Authors</title>
-    <para>The nss liraries were written and maintained by developers with Netscape, Red Hat,  Sun, Oracle, Mozilla, and Google.</para>
-    <para>
-	Authors: Elio Maldonado &lt;emaldona@redhat.com>.
-    </para>
-  </refsection>
-
-<!-- don't change -->
-  <refsection id="license">
-    <title>LICENSE</title>
-    <para>Licensed under the Mozilla Public License, v. 2.0.  If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla.org/MPL/2.0/.
-    </para>
-  </refsection>
-
-</refentry>
-
--- a/nss-enable-pem.patch
+++ b/nss-enable-pem.patch
@ -0,0 +1,12 @@
+diff -up ./mozilla/security/nss/lib/ckfw/manifest.mn.prepem ./mozilla/security/nss/lib/ckfw/manifest.mn
+--- ./mozilla/security/nss/lib/ckfw/manifest.mn.prepem	2008-08-05 16:34:23.000000000 -0700
+++ ./mozilla/security/nss/lib/ckfw/manifest.mn	2008-08-05 16:34:30.000000000 -0700
+@@ -38,7 +38,7 @@ MANIFEST_CVS_ID = "@(#) $RCSfile: manife
+ 
+ CORE_DEPTH = ../../..
+ 
+-DIRS = builtins 
+DIRS = builtins pem
+ 
+ PRIVATE_EXPORTS = \
+ 	ck.h		  \
--- a/nss-gcm-param-default-pkcs11v2.patch
+++ b/nss-gcm-param-default-pkcs11v2.patch
@ -1,21 +0,0 @@
-diff -up ./lib/util/pkcs11n.h.aes_gcm_pkcs11_v2 ./lib/util/pkcs11n.h
--- ./lib/util/pkcs11n.h.aes_gcm_pkcs11_v2	2020-05-13 13:44:11.312405744 -0700
-+++ ./lib/util/pkcs11n.h	2020-05-13 13:45:23.951723660 -0700
-@@ -605,7 +605,7 @@ typedef struct CK_NSS_GCM_PARAMS {
- typedef CK_NSS_GCM_PARAMS CK_PTR CK_NSS_GCM_PARAMS_PTR;
- 
- /* deprecated #defines. Drop in future NSS releases */
-#ifdef NSS_PKCS11_2_0_COMPAT
-+#ifndef NSS_PKCS11_3_0_STRICT
- 
- /* defines that were changed between NSS's PKCS #11 and the Oasis headers */
- #define CKF_EC_FP CKF_EC_F_P
-@@ -664,7 +664,7 @@ typedef CK_NSS_GCM_PARAMS CK_PTR CK_GCM_
- #define CKT_NETSCAPE_VALID CKT_NSS_VALID
- #define CKT_NETSCAPE_VALID_DELEGATOR CKT_NSS_VALID_DELEGATOR
- #else
-/* use the new CK_GCM_PARAMS if NSS_PKCS11_2_0_COMPAT is not defined */
-+/* use the new CK_GCM_PARAMS if NSS_PKCS11_3_0_STRICT is defined */
- typedef struct CK_GCM_PARAMS_V3 CK_GCM_PARAMS;
- typedef CK_GCM_PARAMS_V3 CK_PTR CK_GCM_PARAMS_PTR;
- #endif
--- a/nss-kremlin-ppc64le.patch
+++ b/nss-kremlin-ppc64le.patch
@ -1,31 +0,0 @@
-Index: nss/lib/freebl/verified/kremlin/include/kremlin/internal/types.h
-===================================================================
--- nss.orig/lib/freebl/verified/kremlin/include/kremlin/internal/types.h
-+++ nss/lib/freebl/verified/kremlin/include/kremlin/internal/types.h
-@@ -56,9 +56,10 @@ typedef const char *Prims_string;
-     !defined(__clang__)
- #include <emmintrin.h>
- typedef __m128i FStar_UInt128_uint128;
-#elif !defined(KRML_VERIFIED_UINT128) && !defined(_MSC_VER) &&           \
-+#elif !defined(KRML_VERIFIED_UINT128) && !defined(_MSC_VER) && \
-     (defined(__x86_64__) || defined(__x86_64) || defined(__aarch64__) || \
-     (defined(__powerpc64__) && defined(__LITTLE_ENDIAN__)))
-+    (defined(__powerpc64__) && defined(__LITTLE_ENDIAN__)) || \
-+     defined(__s390x__))
- typedef unsigned __int128 FStar_UInt128_uint128;
- #elif !defined(KRML_VERIFIED_UINT128) && defined(_MSC_VER) && defined(__clang__)
- typedef __uint128_t FStar_UInt128_uint128;
-Index: nss/lib/freebl/verified/kremlin/kremlib/dist/minimal/fstar_uint128_gcc64.h
-===================================================================
--- nss.orig/lib/freebl/verified/kremlin/kremlib/dist/minimal/fstar_uint128_gcc64.h
-+++ nss/lib/freebl/verified/kremlin/kremlib/dist/minimal/fstar_uint128_gcc64.h
-@@ -26,7 +26,8 @@
- 
- #if !defined(KRML_VERIFIED_UINT128) && (!defined(_MSC_VER) || defined(__clang__)) && \
-     (defined(__x86_64__) || defined(__x86_64) || defined(__aarch64__) ||             \
-     (defined(__powerpc64__) && defined(__LITTLE_ENDIAN__)))
-+    (defined(__powerpc64__) && defined(__LITTLE_ENDIAN__)) || \
-+     defined(__s390x__))
- 
- /* GCC + using native unsigned __int128 support */
- 
--- a/nss-p11-kit.config
+++ b/nss-p11-kit.config
@ -1,4 +0,0 @@
-name=p11-kit-proxy
-library=p11-kit-proxy.so
-
-
--- a/nss-signtool-format.patch
+++ b/nss-signtool-format.patch
@ -1,94 +0,0 @@
-diff --git a/cmd/modutil/install.c b/cmd/modutil/install.c
--- a/cmd/modutil/install.c
-+++ b/cmd/modutil/install.c
-@@ -825,17 +825,20 @@ rm_dash_r(char *path)
- 
-         dir = PR_OpenDir(path);
-         if (!dir) {
-             return -1;
-         }
- 
-         /* Recursively delete all entries in the directory */
-         while ((entry = PR_ReadDir(dir, PR_SKIP_BOTH)) != NULL) {
-            sprintf(filename, "%s/%s", path, entry->name);
-+            if (snprintf(filename, sizeof(filename), "%s/%s", path, entry->name) >= sizeof(filename)) {
-+                PR_CloseDir(dir);
-+                return -1;
-+            }
-             if (rm_dash_r(filename)) {
-                 PR_CloseDir(dir);
-                 return -1;
-             }
-         }
- 
-         if (PR_CloseDir(dir) != PR_SUCCESS) {
-             return -1;
-diff --git a/cmd/signtool/util.c b/cmd/signtool/util.c
--- a/cmd/signtool/util.c
-+++ b/cmd/signtool/util.c
-@@ -132,17 +132,20 @@ rm_dash_r(char *path)
-         if (!dir) {
-             PR_fprintf(errorFD, "Error: Unable to open directory %s.\n", path);
-             errorCount++;
-             return -1;
-         }
- 
-         /* Recursively delete all entries in the directory */
-         while ((entry = PR_ReadDir(dir, PR_SKIP_BOTH)) != NULL) {
-            sprintf(filename, "%s/%s", path, entry->name);
-+            if (snprintf(filename, sizeof(filename), "%s/%s", path, entry->name) >= sizeof(filename)) {
-+                errorCount++;
-+                return -1;
-+            }
-             if (rm_dash_r(filename))
-                 return -1;
-         }
- 
-         if (PR_CloseDir(dir) != PR_SUCCESS) {
-             PR_fprintf(errorFD, "Error: Could not close %s.\n", path);
-             errorCount++;
-             return -1;
-diff --git a/lib/libpkix/pkix/util/pkix_list.c b/lib/libpkix/pkix/util/pkix_list.c
--- a/lib/libpkix/pkix/util/pkix_list.c
-+++ b/lib/libpkix/pkix/util/pkix_list.c
-@@ -1530,17 +1530,17 @@ cleanup:
-  */
- PKIX_Error *
- PKIX_List_SetItem(
-         PKIX_List *list,
-         PKIX_UInt32 index,
-         PKIX_PL_Object *item,
-         void *plContext)
- {
-        PKIX_List *element;
-+        PKIX_List *element = NULL;
- 
-         PKIX_ENTER(LIST, "PKIX_List_SetItem");
-         PKIX_NULLCHECK_ONE(list);
- 
-         if (list->immutable){
-                 PKIX_ERROR(PKIX_OPERATIONNOTPERMITTEDONIMMUTABLELIST);
-         }
- 
-diff --git a/lib/libpkix/pkix_pl_nss/system/pkix_pl_oid.c b/lib/libpkix/pkix_pl_nss/system/pkix_pl_oid.c
--- a/lib/libpkix/pkix_pl_nss/system/pkix_pl_oid.c
-+++ b/lib/libpkix/pkix_pl_nss/system/pkix_pl_oid.c
-@@ -102,17 +102,17 @@ cleanup:
-  */
- static PKIX_Error *
- pkix_pl_OID_Equals(
-         PKIX_PL_Object *first,
-         PKIX_PL_Object *second,
-         PKIX_Boolean *pResult,
-         void *plContext)
- {
-        PKIX_Int32 cmpResult;
-+        PKIX_Int32 cmpResult = 0;
- 
-         PKIX_ENTER(OID, "pkix_pl_OID_Equals");
-         PKIX_NULLCHECK_THREE(first, second, pResult);
- 
-         PKIX_CHECK(pkix_pl_OID_Comparator
-                     (first, second, &cmpResult, plContext),
-                     PKIX_OIDCOMPARATORFAILED);
- 
--- a/nss-softokn-config.in
+++ b/nss-softokn-config.in
@ -1,116 +0,0 @@
-#!/bin/sh
-
-prefix=@prefix@
-
-major_version=@MOD_MAJOR_VERSION@
-minor_version=@MOD_MINOR_VERSION@
-patch_version=@MOD_PATCH_VERSION@
-
-usage()
-{
-	cat <<EOF
-Usage: nss-softokn-config [OPTIONS] [LIBRARIES]
-Options:
-	[--prefix[=DIR]]
-	[--exec-prefix[=DIR]]
-	[--includedir[=DIR]]
-	[--libdir[=DIR]]
-	[--version]
-	[--libs]
-	[--cflags]
-Dynamic Libraries:
-	softokn3 - Requires full dynamic linking
-	freebl3  - for internal use only (and glibc for self-integrity check)
-	nssdbm3  - for internal use only
-Dymamically linked
-EOF
-	exit $1
-}
-
-if test $# -eq 0; then
-	usage 1 1>&2
-fi
-
-while test $# -gt 0; do
-  case "$1" in
-  -*=*) optarg=`echo "$1" | sed 's/[-_a-zA-Z0-9]*=//'` ;;
-  *) optarg= ;;
-  esac
-
-  case $1 in
-    --prefix=*)
-      prefix=$optarg
-      ;;
-    --prefix)
-      echo_prefix=yes
-      ;;
-    --exec-prefix=*)
-      exec_prefix=$optarg
-      ;;
-    --exec-prefix)
-      echo_exec_prefix=yes
-      ;;
-    --includedir=*)
-      includedir=$optarg
-      ;;
-    --includedir)
-      echo_includedir=yes
-      ;;
-    --libdir=*)
-      libdir=$optarg
-      ;;
-    --libdir)
-      echo_libdir=yes
-      ;;
-    --version)
-      echo ${major_version}.${minor_version}.${patch_version}
-      ;;
-    --cflags)
-      echo_cflags=yes
-      ;;
-    --libs)
-      echo_libs=yes
-      ;;
-    *)
-      usage 1 1>&2
-      ;;
-  esac
-  shift
-done
-
-# Set variables that may be dependent upon other variables
-if test -z "$exec_prefix"; then
-    exec_prefix=`pkg-config --variable=exec_prefix nss-softokn`
-fi
-if test -z "$includedir"; then
-    includedir=`pkg-config --variable=includedir nss-softokn`
-fi
-if test -z "$libdir"; then
-    libdir=`pkg-config --variable=libdir nss-softokn`
-fi
-
-if test "$echo_prefix" = "yes"; then
-    echo $prefix
-fi
-
-if test "$echo_exec_prefix" = "yes"; then
-    echo $exec_prefix
-fi
-
-if test "$echo_includedir" = "yes"; then
-    echo $includedir
-fi
-
-if test "$echo_libdir" = "yes"; then
-    echo $libdir
-fi
-
-if test "$echo_cflags" = "yes"; then
-    echo -I$includedir
-fi
-
-if test "$echo_libs" = "yes"; then
-      libdirs="-Wl,-rpath-link,$libdir -L$libdir"
-      echo $libdirs
-fi
-
--- a/nss-softokn-dracut-module-setup.sh
+++ b/nss-softokn-dracut-module-setup.sh
@ -1,18 +0,0 @@
-#!/bin/bash
-# -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*-
-# ex: ts=8 sw=4 sts=4 et filetype=sh
-
-check() {
-    return 255
-}
-
-depends() {
-    return 0
-}
-
-install() {
-    local _dir
-
-    inst_libdir_file libfreeblpriv3.so libfreeblpriv3.chk \
-        libfreebl3.so
-}
--- a/nss-softokn-dracut.conf
+++ b/nss-softokn-dracut.conf
@ -1,3 +0,0 @@
-# turn on nss-softokn module
-
-add_dracutmodules+=" nss-softokn "
--- a/nss-softokn.pc.in
+++ b/nss-softokn.pc.in
@ -1,11 +0,0 @@
-prefix=%prefix%
-exec_prefix=%exec_prefix%
-libdir=%libdir%
-includedir=%includedir%
-
-Name: NSS-SOFTOKN
-Description: Network Security Services Softoken PKCS #11 Module
-Version: %SOFTOKEN_VERSION%
-Requires: nspr >= %NSPR_VERSION%, nss-util >= %NSSUTIL_VERSION%
-Libs: -L${libdir} -lfreebl3 -lnssdbm3 -lsoftokn3
-Cflags: -I${includedir}
--- a/nss-util-config.in
+++ b/nss-util-config.in
@ -1,118 +0,0 @@
-#!/bin/sh
-
-prefix=@prefix@
-
-major_version=@MOD_MAJOR_VERSION@
-minor_version=@MOD_MINOR_VERSION@
-patch_version=@MOD_PATCH_VERSION@
-
-usage()
-{
-	cat <<EOF
-Usage: nss-util-config [OPTIONS] [LIBRARIES]
-Options:
-	[--prefix[=DIR]]
-	[--exec-prefix[=DIR]]
-	[--includedir[=DIR]]
-	[--libdir[=DIR]]
-	[--version]
-	[--libs]
-	[--cflags]
-Dynamic Libraries:
-	nssutil
-EOF
-	exit $1
-}
-
-if test $# -eq 0; then
-	usage 1 1>&2
-fi
-
-lib_nssutil=yes
-
-while test $# -gt 0; do
-  case "$1" in
-  -*=*) optarg=`echo "$1" | sed 's/[-_a-zA-Z0-9]*=//'` ;;
-  *) optarg= ;;
-  esac
-
-  case $1 in
-    --prefix=*)
-      prefix=$optarg
-      ;;
-    --prefix)
-      echo_prefix=yes
-      ;;
-    --exec-prefix=*)
-      exec_prefix=$optarg
-      ;;
-    --exec-prefix)
-      echo_exec_prefix=yes
-      ;;
-    --includedir=*)
-      includedir=$optarg
-      ;;
-    --includedir)
-      echo_includedir=yes
-      ;;
-    --libdir=*)
-      libdir=$optarg
-      ;;
-    --libdir)
-      echo_libdir=yes
-      ;;
-    --version)
-      echo ${major_version}.${minor_version}.${patch_version}
-      ;;
-    --cflags)
-      echo_cflags=yes
-      ;;
-    --libs)
-      echo_libs=yes
-      ;;
-    *)
-      usage 1 1>&2
-      ;;
-  esac
-  shift
-done
-
-# Set variables that may be dependent upon other variables
-if test -z "$exec_prefix"; then
-    exec_prefix=`pkg-config --variable=exec_prefix nss-util`
-fi
-if test -z "$includedir"; then
-    includedir=`pkg-config --variable=includedir nss-util`
-fi
-if test -z "$libdir"; then
-    libdir=`pkg-config --variable=libdir nss-util`
-fi
-
-if test "$echo_prefix" = "yes"; then
-    echo $prefix
-fi
-
-if test "$echo_exec_prefix" = "yes"; then
-    echo $exec_prefix
-fi
-
-if test "$echo_includedir" = "yes"; then
-    echo $includedir
-fi
-
-if test "$echo_libdir" = "yes"; then
-    echo $libdir
-fi
-
-if test "$echo_cflags" = "yes"; then
-    echo -I$includedir
-fi
-
-if test "$echo_libs" = "yes"; then
-      libdirs="-Wl,-rpath-link,$libdir -L$libdir"
-      if test -n "$lib_nssutil"; then
-	libdirs="$libdirs -lnssutil${major_version}"
-      fi
-      echo $libdirs
-fi
-
--- a/nss-util.pc.in
+++ b/nss-util.pc.in
@ -1,11 +0,0 @@
-prefix=%prefix%
-exec_prefix=%exec_prefix%
-libdir=%libdir%
-includedir=%includedir%
-
-Name: NSS-UTIL
-Description: Network Security Services Utility Library
-Version: %NSSUTIL_VERSION%
-Requires: nspr >= %NSPR_VERSION%
-Libs: -L${libdir} -lnssutil3
-Cflags: -I${includedir}
--- a/nss.pc.in
+++ b/nss.pc.in
@ -7,5 +7,5 @@ Name: NSS
 Description: Network Security Services
 Version: %NSS_VERSION%
 Requires: nspr >= %NSPR_VERSION%, nss-util >= %NSSUTIL_VERSION%
-Libs: -L${libdir} -lssl3 -lsmime3 -lnss3
+Libs: -lssl3 -lsmime3 -lnss3
 Cflags: -I${includedir}
--- a/nss.spec
+++ b/nss.spec
--- a/nsspem-642433.patch
+++ b/nsspem-642433.patch
@ -0,0 +1,52 @@
+diff -up ./mozilla/security/nss/lib/ckfw/pem/util.c.642433 ./mozilla/security/nss/lib/ckfw/pem/util.c
+--- ./mozilla/security/nss/lib/ckfw/pem/util.c.642433	2010-11-25 10:49:27.000000000 -0800
+++ ./mozilla/security/nss/lib/ckfw/pem/util.c	2010-12-08 08:02:02.618304926 -0800
+@@ -96,9 +96,6 @@ static SECItem *AllocItem(SECItem * item
+     return (result);
+ 
+   loser:
+-    if (result != NULL) {
+-	SECITEM_FreeItem(result, (item == NULL) ? PR_TRUE : PR_FALSE);
+-    }
+     return (NULL);
+ }
+ 
+@@ -110,7 +107,7 @@ static SECStatus FileToItem(SECItem * ds
+ 
+     prStatus = PR_GetOpenFileInfo(src, &info);
+ 
+-    if (prStatus != PR_SUCCESS) {
+    if (prStatus != PR_SUCCESS || info.type == PR_FILE_DIRECTORY) {
+ 	return SECFailure;
+     }
+ 
+@@ -126,8 +123,7 @@ static SECStatus FileToItem(SECItem * ds
+ 
+     return SECSuccess;
+   loser:
+-    SECITEM_FreeItem(dst, PR_FALSE);
+-    nss_ZFreeIf(dst);
+    nss_ZFreeIf(dst->data);
+     return SECFailure;
+ }
+ 
+@@ -153,6 +149,10 @@ ReadDERFromFile(SECItem *** derlist, cha
+ 
+ 	/* Read in ascii data */
+ 	rv = FileToItem(&filedata, inFile);
+	if (rv != SECSuccess) {
+	    PR_Close(inFile);
+	    return -1;
+	}
+ 	asc = (char *) filedata.data;
+ 	if (!asc) {
+ 	    PR_Close(inFile);
+@@ -252,7 +252,7 @@ ReadDERFromFile(SECItem *** derlist, cha
+     } else {
+ 	/* Read in binary der */
+ 	rv = FileToItem(der, inFile);
+-	if (rv) {
+	if (rv != SECSuccess) {
+ 	    PR_Close(inFile);
+ 	    return -1;
+ 	}
--- a/pkcs11.txt.xml
+++ b/pkcs11.txt.xml
@ -1,56 +0,0 @@
-<?xml version='1.0' encoding='UTF-8'?>
-<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
-  "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
-<!ENTITY date SYSTEM "date.xml">
-<!ENTITY version SYSTEM "version.xml">
-]>
-
-<refentry id="pkcs11.txt">
-
-  <refentryinfo>
-    <date>&date;</date>
-    <title>Network Security Services</title>
-    <productname>nss</productname>
-    <productnumber>&version;</productnumber>
-  </refentryinfo>
-
-  <refmeta>
-    <refentrytitle>pkcs11.txt</refentrytitle>
-    <manvolnum>5</manvolnum>
-  </refmeta>
-
-  <refnamediv>
-    <refname>pkcs11.txt</refname>
-    <refpurpose>NSS PKCS #11 module configuration file</refpurpose>
-  </refnamediv>
-
-  <refsection id="description">
-    <title>Description</title>
-    <para>
-The pkcs11.txt file is used to configure initialization parameters for the nss security module and optionally other pkcs #11 modules.
-    </para>
-    <para>
-For full documentation visit <ulink url="https://developer.mozilla.org/en-US/docs/PKCS11_Module_Specs">PKCS #11 Module Specs</ulink>.
-    </para>
-  </refsection>
-
-  <refsection>
-    <title>Files</title>
-    <para><filename>/etc/pki/nssdb/pkcs11.txt</filename></para>
-  </refsection>
-
-  <refsection id="authors">
-    <title>Authors</title>
-    <para>The nss libraries were written and maintained by developers with Netscape, Red Hat,  Sun, Oracle, Mozilla, and Google.</para>
-    <para>Authors: Elio Maldonado &lt;emaldona@redhat.com>.</para>
-  </refsection>
-
-<!-- don't change -->
-  <refsection id="license">
-    <title>LICENSE</title>
-    <para>Licensed under the Mozilla Public License, v. 2.0.  If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla.org/MPL/2.0/.
-    </para>
-  </refsection>
-
-</refentry>
-
--- a/renegotiate-transitional.patch
+++ b/renegotiate-transitional.patch
@ -0,0 +1,12 @@
+diff -up ./mozilla/security/nss/lib/ssl/sslsock.c.transitional ./mozilla/security/nss/lib/ssl/sslsock.c
+--- ./mozilla/security/nss/lib/ssl/sslsock.c.transitional	2010-09-04 09:46:50.331327676 -0700
+++ ./mozilla/security/nss/lib/ssl/sslsock.c	2010-09-04 09:50:02.814325605 -0700
+@@ -181,7 +181,7 @@ static sslOptions ssl_defaults = {
+     PR_FALSE,   /* noLocks            */
+     PR_FALSE,   /* enableSessionTickets */
+     PR_FALSE,   /* enableDeflate      */
+-    2,          /* enableRenegotiation (default: requires extension) */
+    3,          /* enableRenegotiation (default: transitional) */
+     PR_FALSE,   /* requireSafeNegotiation */
+     PR_FALSE,   /* enableFalseStart   */
+ };
--- a/secmod.db.xml
+++ b/secmod.db.xml
@ -1,63 +0,0 @@
-<?xml version='1.0' encoding='utf-8'?>
-<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
-  "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
-<!ENTITY date SYSTEM "date.xml">
-<!ENTITY version SYSTEM "version.xml">
-]>
-
-<refentry id="secmod.db">
-
-  <refentryinfo>
-    <date>&date;</date>
-    <title>Network Security Services</title>
-    <productname>nss</productname>
-    <productnumber>&version;</productnumber>
-  </refentryinfo>
-
-  <refmeta>
-    <refentrytitle>secmod.db</refentrytitle>
-    <manvolnum>5</manvolnum>
-  </refmeta>
-
-  <refnamediv>
-    <refname>secmod.db</refname>
-    <refpurpose>Legacy NSS security modules database</refpurpose>
-  </refnamediv>
-
-<refsection id="description">
-    <title>Description</title>
-    <para><emphasis>secmod.db</emphasis> is an NSS security modules database.</para>
-  <para>The security modules database is used to keep track of the NSS security modules. The NSS security modules export their services via the PKCS #11 API which NSS uses as its Services Provider Interface.
-  </para>
-  <para>The command line utility <emphasis>modutil</emphasis> is used for managing PKCS #11 module information both within secmod.db files and within hardware tokens.
-  </para>
-  <para>For new applications the recommended way of tracking security modules is via the pkcs11.txt configuration file used in conjunction the new sqlite-based shared database format for certificate and key databases.
-  </para>
-  </refsection>
-
-  <refsection>
-    <title>Files</title>
-    <para><filename>/etc/pki/nssdb/secmod.db</filename></para>
-  </refsection>
-
-  <refsection>
-    <title>See also</title>
-    <para>modutil(1), cert8.db(5), cert9.db(5), key3.db(5), key4.db(5), pkcs11.txt(5)</para>
-  </refsection>
-
-  <refsection id="authors">
-    <title>Authors</title>
-    <para>The nss libraries were written and maintained by developers with Netscape, Red Hat, Sun, Oracle, Mozilla, and Google.</para>
-    <para>Authors: Elio Maldonado &lt;emaldona@redhat.com>.</para>
-  </refsection>
-
-<!-- don't change -->
-  <refsection id="license">
-    <title>LICENSE</title>
-    <para>Licensed under the Mozilla Public License, v. 2.0.  If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla.org/MPL/2.0/.
-    </para>
-
-  </refsection>
-
-
-</refentry>
--- a/setup-nsssysinit.xml
+++ b/setup-nsssysinit.xml
@ -1,106 +0,0 @@
-<?xml version='1.0' encoding='utf-8'?>
-<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
-  "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
-<!ENTITY date SYSTEM "date.xml">
-<!ENTITY version SYSTEM "version.xml">
-]>
-
-<refentry id="setup-nsssysinit">
-
-  <refentryinfo>
-    <date>&date;</date>
-    <title>Network Security Services</title>
-    <productname>nss</productname>
-    <productnumber>&version;</productnumber>
-  </refentryinfo>
-
-  <refmeta>
-    <refentrytitle>setup-nsssysinit</refentrytitle>
-    <manvolnum>1</manvolnum>
-  </refmeta>
-
-  <refnamediv>
-    <refname>setup-nsssysinit</refname>
-    <refpurpose>Query or enable the nss-sysinit module</refpurpose>
-  </refnamediv>
-
-  <refsynopsisdiv>
-    <cmdsynopsis>
-      <command>setup-nsssysinit</command>
-      <arg><option>on</option></arg>
-      <arg><option>off</option></arg>
-      <arg><option>status</option></arg>
-    </cmdsynopsis>
-  </refsynopsisdiv>
-
-<refsection id="description">
-    <title>Description</title>
-    <para><command>setup-nsssysinit</command> is a shell script to query the status of the nss-sysinit module and when run with root priviledge it can enable or disable it. </para>
-  <para>Turns on or off the nss-sysinit module db by editing the global PKCS #11 configuration file. Displays the status. This script can be invoked by the user as super user. It is invoked at nss-sysinit post install time with argument on.
-  </para>
-  </refsection>
-  
-  <refsection>
-    <title>Options</title>
-    
-    <variablelist>
-      <varlistentry>
-        <term><option>on</option></term>
-        <listitem><simpara>Turn on nss-sysinit.</simpara></listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><option>off</option></term>
-        <listitem><simpara>Turn on nss-sysinit.</simpara></listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><option>status</option></term>
-        <listitem><simpara>returns whether nss-syinit is enabled or not.</simpara></listitem>
-      </varlistentry>
-
-    </variablelist>
-  </refsection>
-
-  <refsection>
-    <title>Examples</title>
-
-    <para>The following example will query for the status of nss-sysinit:
-      <programlisting>
-        /usr/bin/setup-nsssysinit status
-      </programlisting>
-    </para>
-
-    <para>The following example, when run as superuser, will turn on nss-sysinit:
-      <programlisting>
-        /usr/bin/setup-nsssysinit on
-      </programlisting>
-    </para>
-
-  </refsection>
-
-  <refsection>
-    <title>Files</title>
-    <para><filename>/usr/bin/setup-nsssysinit</filename></para>
-  </refsection>
-
-  <refsection>
-    <title>See also</title>
-    <para>pkg-config(1)</para>
-  </refsection>
-
-  <refsection id="authors">
-    <title>Authors</title>
-    <para>The nss libraries were written and maintained by developers with Netscape, Red Hat,  Sun, Oracle, Mozilla, and Google.</para>
-    <para>Authors: Elio Maldonado &lt;emaldona@redhat.com>.</para>
-  </refsection>
-
-<!-- don't change -->
-  <refsection id="license">
-    <title>LICENSE</title>
-    <para>Licensed under the Mozilla Public License, v. 2.0.  If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla.org/MPL/2.0/.
-    </para>
-  </refsection>
-
-</refentry>
-
--- a/14
+++ b/14
@ -1,6 +1,8 @@
-SHA512 (blank-cert8.db) = ac131d15708c5f1b5e467831f919f4fc4ba13b60a4bb5fe260c845fa9afcd899a588d21ed52060abaa1bbb29f2b53af8b495d28407183cb03aff1974f95f1d3d
-SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403fda3e3d4e7757838061ae56ccf5aac335cb54f254f0a9e6e9c0dd5920b4155a39264525b06
-SHA512 (blank-key3.db) = 01f7314e9fc8a7c9aa997652624cfcde213d18a6b3bb31840c1a60bbd662e56b5bc3221d13874abb42ce78163b225a6dfce2e1326cf6dd29366ad9c28ba5a71c
-SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7
-SHA512 (blank-secmod.db) = 06a2dbd861839ef6315093459328b500d3832333a34b30e6fac4a2503af337f014a4d319f0f93322409e719142904ce8bc08252ae9a4f37f30d4c3312e900310
-SHA512 (nss-3.52.tar.gz) = a45baf38717bceda03c292b2c01def680a24a846327e17d36044a85e30ed40c68220c78c0a2c3025c11778ee58f5d5eb0fff1b4cd274b95c408fb59e394e62c6
+240c8d61d9c9091e486318e889bc1f2f  nss-3.12.9-stripped.tar.bz2
+e63cddf74c07f0d818d1052ecc6fbb1f  nss-pem-20101125.tar.bz2
+a5ae49867124ac75f029a9a33af31bad  blank-cert8.db
+9315689bbd9f28ceebd47894f99fccbd  blank-key3.db
+73bc040a0542bba387e6dd7fb9fd7d23  blank-secmod.db
+691e663ccc07b7a1eaa6f088e03bf8e2  blank-cert9.db
+2ec9e0606ba40fe65196545564b7cc2a  blank-key4.db
+bf47cecad861efa77d1488ad4a73cb5b  PayPalEE.cert
--- a/swap-internal-key-slot.patch
+++ b/swap-internal-key-slot.patch
@ -0,0 +1,97 @@
+diff -up ./mozilla/security/nss/lib/pk11wrap/pk11pars.c.jss ./mozilla/security/nss/lib/pk11wrap/pk11pars.c
+--- ./mozilla/security/nss/lib/pk11wrap/pk11pars.c.jss	2011-02-11 07:45:38.324083242 -0800
+++ ./mozilla/security/nss/lib/pk11wrap/pk11pars.c	2011-02-11 07:48:14.514166538 -0800
+@@ -258,6 +258,19 @@ secmod_IsInternalKeySlot(SECMODModule *m
+    return (flags & SECMOD_FLAG_INTERNAL_KEY_SLOT) ? PR_TRUE : PR_FALSE;
+ }
+ 
+void
+secmod_SetInternalKeySlotFlag(SECMODModule *mod, PRBool val)
+{
+   char flags = (char) mod->internal;
+
+   if (val)  {
+	flags |= SECMOD_FLAG_INTERNAL_KEY_SLOT;
+   } else {
+	flags &= ~SECMOD_FLAG_INTERNAL_KEY_SLOT;
+   }
+   mod->internal = flags;
+}
+
+ /* forward declarations */
+ static int secmod_escapeSize(const char *string, char quote);
+ static char *secmod_addEscape(const char *string, char quote);
+diff -up ./mozilla/security/nss/lib/pk11wrap/pk11priv.h.jss ./mozilla/security/nss/lib/pk11wrap/pk11priv.h
+--- ./mozilla/security/nss/lib/pk11wrap/pk11priv.h.jss	2011-02-11 07:47:45.037226877 -0800
+++ ./mozilla/security/nss/lib/pk11wrap/pk11priv.h	2011-02-11 07:48:28.854164207 -0800
+@@ -115,6 +115,7 @@ void PK11_InitSlot(SECMODModule *mod,CK_
+ PRBool PK11_NeedPWInitForSlot(PK11SlotInfo *slot);
+ SECStatus PK11_ReadSlotCerts(PK11SlotInfo *slot);
+ void pk11_SetInternalKeySlot(PK11SlotInfo *slot);
+PK11SlotInfo *pk11_SwapInternalKeySlot(PK11SlotInfo *slot);
+ void pk11_SetInternalKeySlotIfFirst(PK11SlotInfo *slot);
+ 
+ /*********************************************************************
+diff -up ./mozilla/security/nss/lib/pk11wrap/pk11slot.c.jss ./mozilla/security/nss/lib/pk11wrap/pk11slot.c
+--- ./mozilla/security/nss/lib/pk11wrap/pk11slot.c.jss	2011-02-11 07:41:11.258746774 -0800
+++ ./mozilla/security/nss/lib/pk11wrap/pk11slot.c	2011-02-11 07:48:51.291595867 -0800
+@@ -1755,6 +1755,18 @@ pk11_SetInternalKeySlotIfFirst(PK11SlotI
+    pk11InternalKeySlot = slot ? PK11_ReferenceSlot(slot) : NULL;
+ }
+ 
+/*
+ * Swap out a default internal keyslot.  Caller owns the Slot Reference
+ */
+PK11SlotInfo *
+pk11_SwapInternalKeySlot(PK11SlotInfo *slot)
+{
+   PK11SlotInfo *swap = pk11InternalKeySlot;
+
+   pk11InternalKeySlot = slot ? PK11_ReferenceSlot(slot) : NULL;
+   return swap;
+}
+
+ 
+ /* get the internal key slot. FIPS has only one slot for both key slots and
+  * default slots */
+diff -up ./mozilla/security/nss/lib/pk11wrap/pk11util.c.jss ./mozilla/security/nss/lib/pk11wrap/pk11util.c
+--- ./mozilla/security/nss/lib/pk11wrap/pk11util.c.jss	2011-02-11 07:40:23.748066635 -0800
+++ ./mozilla/security/nss/lib/pk11wrap/pk11util.c	2011-02-11 07:49:19.674611909 -0800
+@@ -483,13 +483,25 @@ SECMOD_DeleteInternalModule(const char *
+ 				NULL, SECMOD_FIPS_FLAGS);
+ 	}
+ 	if (newModule) {
+	    PK11SlotInfo *slot;
+ 	    newModule->libraryParams = 
+ 	     PORT_ArenaStrdup(newModule->arena,mlp->module->libraryParams);
+	    /* if an explicit internal key slot has been set, reset it */
+	    slot = pk11_SwapInternalKeySlot(NULL);
+	    if (slot) {
+		secmod_SetInternalKeySlotFlag(newModule, PR_TRUE);
+	    }
+ 	    rv = SECMOD_AddModule(newModule);
+ 	    if (rv != SECSuccess) {
+		/* load failed, restore the internal key slot */
+		pk11_SetInternalKeySlot(slot);
+ 		SECMOD_DestroyModule(newModule);
+ 		newModule = NULL;
+ 	    }
+	    /* free the old explicit internal key slot, we now have a new one */
+	    if (slot) {
+		PK11_FreeSlot(slot);
+	    }
+ 	}
+ 	if (newModule == NULL) {
+ 	    SECMODModuleList *last = NULL,*mlp2;
+diff -up ./mozilla/security/nss/lib/pk11wrap/secmodi.h.jss ./mozilla/security/nss/lib/pk11wrap/secmodi.h
+--- ./mozilla/security/nss/lib/pk11wrap/secmodi.h.jss	2011-02-11 07:39:04.685590962 -0800
+++ ./mozilla/security/nss/lib/pk11wrap/secmodi.h	2011-02-11 07:49:28.120021571 -0800
+@@ -90,6 +90,8 @@ SECStatus secmod_LoadPKCS11Module(SECMOD
+ SECStatus SECMOD_UnloadModule(SECMODModule *);
+ void SECMOD_SetInternalModule(SECMODModule *);
+ PRBool secmod_IsInternalKeySlot(SECMODModule *);
+void secmod_SetInternalKeySlotFlag(SECMODModule *mod, PRBool val);
+
+ 
+ /* tools for checking if we are loading the same database twice */
+ typedef struct SECMODConfigListStr SECMODConfigList;
--- a/tests/NSS-tools-should-not-use-SHA1-by-default-when/Makefile
+++ b/tests/NSS-tools-should-not-use-SHA1-by-default-when/Makefile
@ -1,64 +0,0 @@
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Makefile of /CoreOS/nss/Regression/NSS-tools-should-not-use-SHA1-by-default-when
-#   Description: NSS tools should not use SHA1 by default when
-#   Author: Hubert Kario <hkario@redhat.com>
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Copyright (c) 2016 Red Hat, Inc.
-#
-#   This copyrighted material is made available to anyone wishing
-#   to use, modify, copy, or redistribute it subject to the terms
-#   and conditions of the GNU General Public License version 2.
-#
-#   This program is distributed in the hope that it will be
-#   useful, but WITHOUT ANY WARRANTY; without even the implied
-#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
-#   PURPOSE. See the GNU General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public
-#   License along with this program; if not, write to the Free
-#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-#   Boston, MA 02110-1301, USA.
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-export TEST=/CoreOS/nss/Regression/NSS-tools-should-not-use-SHA1-by-default-when
-export TESTVERSION=1.0
-
-BUILT_FILES=
-
-FILES=$(METADATA) runtest.sh Makefile PURPOSE
-
-.PHONY: all install download clean
-
-run: $(FILES) build
-	./runtest.sh
-
-build: $(BUILT_FILES)
-	test -x runtest.sh || chmod a+x runtest.sh
-
-clean:
-	rm -f *~ $(BUILT_FILES)
-
-
-include /usr/share/rhts/lib/rhts-make.include
-
-$(METADATA): Makefile
-	@echo "Owner:           Hubert Kario <hkario@redhat.com>" > $(METADATA)
-	@echo "Name:            $(TEST)" >> $(METADATA)
-	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
-	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
-	@echo "Description:     NSS tools should not use SHA1 by default when" >> $(METADATA)
-	@echo "Type:            Regression" >> $(METADATA)
-	@echo "TestTime:        10m" >> $(METADATA)
-	@echo "RunFor:          nss openssl" >> $(METADATA)
-	@echo "Requires:        nss nss-tools openssl" >> $(METADATA)
-	@echo "Priority:        Normal" >> $(METADATA)
-	@echo "License:         GPLv2" >> $(METADATA)
-	@echo "Confidential:    no" >> $(METADATA)
-	@echo "Destructive:     no" >> $(METADATA)
-	@echo "Releases:        -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA)
-
-	rhts-lint $(METADATA)
--- a/tests/NSS-tools-should-not-use-SHA1-by-default-when/PURPOSE
+++ b/tests/NSS-tools-should-not-use-SHA1-by-default-when/PURPOSE
@ -1,4 +0,0 @@
-PURPOSE of NSS-tools-should-not-use-SHA1-by-default-when
-Description: NSS tools should not use SHA1 by default when
-Author: Hubert Kario <hkario@redhat.com>
-Summary: NSS tools should not use SHA1 by default when generating digital signatures/certificates
--- a/tests/NSS-tools-should-not-use-SHA1-by-default-when/runtest.sh
+++ b/tests/NSS-tools-should-not-use-SHA1-by-default-when/runtest.sh
@ -1,125 +0,0 @@
-#!/bin/bash
-# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   runtest.sh of NSS-tools-should-not-use-SHA1-by-default-when
-#   Description: NSS tools should not use SHA1 by default when
-#   Author: Hubert Kario <hkario@redhat.com>
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Copyright (c) 2016 Red Hat, Inc.
-#
-#   This copyrighted material is made available to anyone wishing
-#   to use, modify, copy, or redistribute it subject to the terms
-#   and conditions of the GNU General Public License version 2.
-#
-#   This program is distributed in the hope that it will be
-#   useful, but WITHOUT ANY WARRANTY; without even the implied
-#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
-#   PURPOSE. See the GNU General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public
-#   License along with this program; if not, write to the Free
-#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-#   Boston, MA 02110-1301, USA.
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-# Include Beaker environment
-. /usr/share/beakerlib/beakerlib.sh || exit 1
-
-PACKAGE="nss"
-PACKAGES="nss openssl"
-DBDIR="nssdb"
-
-rlJournalStart
-    rlPhaseStartSetup
-        rlAssertRpm --all
-        rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
-        rlRun "pushd $TmpDir"
-        rlRun "mkdir nssdb"
-        rlRun "certutil -N -d $DBDIR --empty-password"
-        rlLogInfo "Create a JAR file"
-        rlRun "mkdir java-dir"
-        rlRun "pushd java-dir"
-        rlRun "mkdir META-INF mypackage"
-        rlRun "echo 'Main-Class: mypackage/MyMainFile' > META-INF/MANIFEST.MF"
-        rlRun "echo 'Those are not the droids you are looking for' > mypackage/MyMainFile.class"
-        #rlRun "jar -cfe package.jar mypackage/MyMainFile mypackage/MyMainFile.class"
-        rlRun "popd"
-        #rlRun "mv java-dir/package.jar ."
-    rlPhaseEnd
-
-    rlPhaseStartTest "Self signing certificates"
-        rlRun "dd if=/dev/urandom of=noise bs=1 count=32 >/dev/null"
-        rlRun "certutil -d $DBDIR -S -n 'CA' -t 'cTC,cTC,cTC' -s 'CN=CA' -x -z noise"
-        rlRun -s "certutil -d $DBDIR -L -n 'CA' -a | openssl x509 -noout -text"
-        rlAssertGrep "Signature Algorithm: sha256WithRSAEncryption" "$rlRun_LOG"
-        rlAssertNotGrep "Signature Algorithm: sha1WithRSAEncryption" $rlRun_LOG
-    rlPhaseEnd
-
-    rlPhaseStartTest "Signing certificates"
-        rlRun "dd if=/dev/urandom of=noise bs=1 count=32 >/dev/null"
-        rlRun "certutil -d $DBDIR -S -n 'server' -t 'u,u,u' -s 'CN=server.example.com' -c 'CA' -z noise --nsCertType sslClient,sslServer,objectSigning,smime"
-        rlRun -s "certutil -d $DBDIR -L -n 'server' -a | openssl x509 -noout -text"
-        rlAssertGrep "Signature Algorithm: sha256WithRSAEncryption" "$rlRun_LOG"
-        rlAssertNotGrep "Signature Algorithm: sha1WithRSAEncryption" $rlRun_LOG
-    rlPhaseEnd
-
-    rlPhaseStartTest "Certificate request"
-        rlRun "dd if=/dev/urandom of=noise bs=1 count=32 >/dev/null"
-        rlRun "mkdir srv2db"
-        rlRun "certutil -d srv2db -N --empty-password"
-        rlRun "certutil -d srv2db -R -s CN=www.example.com -o srv2.req -a -z noise"
-        rlRun -s "openssl req -noout -text -in srv2.req"
-        rlAssertGrep "Signature Algorithm: sha256WithRSAEncryption" "$rlRun_LOG"
-        rlAssertNotGrep "Signature Algorithm: sha1WithRSAEncryption" $rlRun_LOG
-        rlRun "certutil -d $DBDIR -C -c 'CA' -i srv2.req -a -o srv2.crt"
-        rlRun -s "openssl x509 -in srv2.crt -noout -text"
-        rlAssertGrep "Signature Algorithm: sha256WithRSAEncryption" "$rlRun_LOG"
-        rlAssertNotGrep "Signature Algorithm: sha1WithRSAEncryption" $rlRun_LOG
-        rlRun "rm -rf srv2db"
-    rlPhaseEnd
-
-    rlPhaseStartTest "Certificate request with SHA1"
-        rlRun "dd if=/dev/urandom of=noise bs=1 count=32 >/dev/null"
-        rlRun "mkdir srv2db"
-        rlRun "certutil -d srv2db -N --empty-password"
-        rlRun "certutil -d srv2db -R -s CN=www.example.com -o srv2.req -a -z noise -Z SHA1"
-        rlRun -s "openssl req -noout -text -in srv2.req"
-        rlAssertGrep "Signature Algorithm: sha1WithRSAEncryption" "$rlRun_LOG"
-        rlRun "certutil -d $DBDIR -C -c 'CA' -i srv2.req -a -o srv2.crt"
-        rlRun -s "openssl x509 -in srv2.crt -noout -text"
-        rlAssertGrep "Signature Algorithm: sha256WithRSAEncryption" "$rlRun_LOG"
-        rlAssertNotGrep "Signature Algorithm: sha1WithRSAEncryption" $rlRun_LOG
-        rlRun "rm -rf srv2db"
-    rlPhaseEnd
-
-    rlPhaseStartTest "Signing CMS messages"
-        rlRun "echo 'This is a document' > document.txt"
-        rlRun "cmsutil -S -d $DBDIR -N 'server' -i document.txt -o document.cms"
-        rlRun -s "openssl cms -in document.cms -inform der -noout -cmsout -print"
-        rlAssertGrep "algorithm: sha256" $rlRun_LOG
-        rlAssertNotGrep "algorithm: sha1" $rlRun_LOG
-    rlPhaseEnd
-
-    rlPhaseStartTest "CRL signing"
-        rlRun "echo $(date --utc +update=%Y%m%d%H%M%SZ) > script"
-        rlRun "echo $(date -d 'next week' --utc +nextupdate=%Y%m%d%H%M%SZ) >> script"
-        rlRun "echo addext crlNumber 0 1245 >>script"
-        rlRun "echo addcert 12 $(date -d 'yesterday' --utc +%Y%m%d%H%M%SZ) >>script"
-        rlRun "echo addext reasonCode 0 0 >>script"
-        rlRun "cat script"
-        rlRun "crlutil -G -c script -d $DBDIR -n CA -o ca.crl"
-        rlRun -s "openssl crl -in ca.crl -inform der -noout -text"
-        rlAssertGrep "Signature Algorithm: sha256WithRSAEncryption" $rlRun_LOG
-        rlAssertNotGrep "Signature Algorithm: sha1WithRSAEncryption" $rlRun_LOG
-    rlPhaseEnd
-
-    rlPhaseStartCleanup
-        rlRun "popd"
-        rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
-    rlPhaseEnd
-rlJournalPrintText
-rlJournalEnd
--- a/tests/tests.yml
+++ b/tests/tests.yml
@ -1,12 +0,0 @@
---
-# This first play always runs on the local staging system
- hosts: localhost
-  roles:
-  - role: standard-test-beakerlib
-    tags:
-    - classic
-    tests:
-    - NSS-tools-should-not-use-SHA1-by-default-when
-    required_packages:
-    - nss-tools
-    - nss
Author	SHA1	Message	Date
Dennis Gilmore	15bb5466dd	* Fri May 20 2011 Dennis Gilmore <dennis@ausil.us> - 3.12.9-11 - make testsuite failures non fatal on arm	2011-05-20 09:20:56 -05:00
Elio Maldonado	aee457a431	Merge branch 'f14' into f13	2011-04-12 14:42:52 -07:00
Elio Maldonado	1b24056ef7	Fix the relase number	2011-04-12 13:04:06 -07:00
Elio Maldonado	4e9256eccb	Merge branch 'f15' into f14, partial merge	2011-04-12 13:01:57 -07:00
Elio Maldonado	11feb7633c	Merge branch 'master' into f15 Fix for Bug 695011 - segfaults on pem logging on debug builds PEM module logging implemented using NSPR logging calls Update the PayPalEE test certificate to a longer lived one	2011-04-12 12:52:18 -07:00
Elio Maldonado	79ce62fe59	Merge branch 'f14' into f13	2011-03-26 13:53:48 -07:00
Elio Maldonado	c400a7a567	Selectively merge branch 'f15' into f14 Update to NSS_3.12.9_WITH_CKBI_1_82_RTM nss security update for compromised certificates see: https://bugzilla.mozilla.org/show_bug.cgi?id=642395	2011-03-26 11:55:23 -07:00
Elio Maldonado	da8533319e	Merge branch 'master' into f15 - Update to NSS_3.12.9_WITH_CKBI_1_82_RTM - nss security update for compromized certificates - see mozilla bug: https://bugzilla.mozilla.org/show_bug.cgi?id=642395	2011-03-25 14:54:45 -07:00
Elio Maldonado	85c352f22b	Merge branch 'f14' into f13	2011-02-25 09:30:30 -08:00
Elio Maldonado	24fd61e0c1	Bug 539183 - Short-term fix for ssl test suites hangs on ipv6 type connections Change selfserv to use a dual-stack IPv6 listening socket, which can accept connections from both IPv4 and IPv6 clients. NSPR's IPv6 sockets have the IPV6_V6ONLY socket option default to false.	2011-02-25 09:21:19 -08:00
Elio Maldonado	1b4bbde082	Bug 539183 - Short-term fix for ssl test suites hangs on ipv6 type connections Change selfserv to use a dual-stack IPv6 listening socket, which can accept connections from both IPv4 and IPv6 clients. NSPR's IPv6 sockets have the IPV6_V6ONLY socket option default to false.	2011-02-24 16:01:12 -08:00
Elio Maldonado	0cac4288f2	Bug 539183 - Short-term fix for ssl test suites hangs on ipv6 type connections Change selfserv to use a dual-stack IPv6 listening socket, which can accept connections from both IPv4 and IPv6 clients. NSPR's IPv6 sockets have the IPV6_V6ONLY socket option default to false.	2011-02-24 15:34:22 -08:00
Elio Maldonado	4f8c61457c	- Run the test suites in the check section (#677809 )	2011-02-18 16:08:50 -08:00
Elio Maldonado	83140e6ec3	- Add to pkcs11-devel a requires on nss-softokn-freebl-freebl (#675196 ) - Remove a header that now nss-softokn-freebl-devel ships - Run the test suites in the check section (#677809)	2011-02-18 15:18:50 -08:00
Elio Maldonado	41067b8b40	- Fix to swap internal key slot on fips mode switches, related to #633043 - Fixes a side effect of the fix for #633043 detcted by the JSS test suite	2011-02-11 09:44:12 -08:00
Elio Maldonado	5abae289d8	- Remove a header that now nss-softokn-freebl-devel ships, related to #675196 - Backing out earlier patch until further testing from upstream for 3.12.10	2011-02-07 16:00:36 -08:00
Elio Maldonado	c2be9c41be	Merge branch 'master' into f14	2011-02-01 17:56:57 -08:00
Elio Maldonado	527750ed60	Merge branch 'master' into f14	2011-01-22 10:04:11 -08:00
Elio Maldonado	92c7fb5676	Merge branch 'master' into f14	2011-01-13 14:04:41 -08:00
Elio Maldonado	576d83be9d	- Fix libpnsspem crash when cacert dir contains other directories (#642433 ) - Added comments to spec file on how build with optimizations turned off	2010-12-10 08:16:05 -08:00
Elio Maldonado	3aff6cd3be	Actually apply all the changes in the commit previous message. Update pem source tar with fixes for 614532 and 596674 Remove patches that we no longer need Tell rpm not to verify md5, size, and modtime of configurations file	2010-11-26 12:20:17 -08:00
Elio Maldonado	e47aa30734	- Update pem source tar with fixes for 614532 and 596674 - Remove 0001-Add-support-for-PKCS-8-encoded-private-keys.patch, no longer needed - Remove 0001-Do-not-define-SEC_SkipTemplate.patch, no longer needed - Tell rpm not to verify md5, size, and modtime of configurations file	2010-11-26 08:57:40 -08:00
Elio Maldonado	6799727d7b	Merge branch 'f14' into f13	2010-11-05 09:00:34 -07:00
Elio Maldonado	768a0d5745	Update test certificate which had expired	2010-11-05 08:44:51 -07:00
Elio Maldonado	e620cdde80	Merge branch 'f14' into f13	2010-11-04 15:05:50 -07:00
Elio Maldonado	68a35a4e2f	Update PayPalEE.cert which had expired	2010-11-04 15:04:05 -07:00
Elio Maldonado	33d3470a50	Merge branch 'f14' into f13	2010-10-07 07:59:23 -07:00
Elio Maldonado	c01002e05f	Move triggerpostun -n nss-sysinit script ahead of the other ones (#639248 )	2010-10-06 20:30:52 -07:00
Elio Maldonado	20dceb30dd	Merge branch 'f14' into f13	2010-10-05 13:16:49 -07:00
Elio Maldonado	5775837bbf	- Update to 3.12.8 - Fix invalid %postun scriptlet (#639248)	2010-10-05 11:47:36 -07:00
Elio Maldonado	43ee0dde79	Merge branch 'f14' into f13	2010-09-30 15:16:53 -07:00
Elio Maldonado	cb9c7979b3	Fix version on triggerpostun scriplet (#636787 )	2010-09-30 14:56:51 -07:00
Elio Maldonado	98913cdefd	Merge branch 'f14' into f13	2010-09-29 15:48:25 -07:00
Elio Maldonado	a3c32434c9	Improve on fixes for bugs #636787 , #636792 , and #636801 Replace posttrans sysinit scriptlet with a triggerpostun one (#636787) Fix and cleanup the setup-nsssysinit.sh script (#636792, #636801)	2010-09-29 15:15:00 -07:00
Elio Maldonado	c7e7247590	Improve on fixes for bugs #636787 , #636792 , and #636801 Replace posttrans sysinit scriptlet with a triggerpostun one (#636787) Fix and cleanup the setup-nsssysinit.sh script (#636792, #636801)	2010-09-29 14:51:02 -07:00
Elio Maldonado	125ad15fa4	Fixes for Bugs 636787, 636792, 636801, and 609612 Prevent of nss-sysinit disabling on package upgrade (#636787): Change system-pkcs11.txt to have nsssyinit turned on by default and add posttrans syninit scriplet as replacement to post and preun ones Create pkcs11.txt with correct permissions regardless of umask (#636792) Setup-nsssysinit.sh reports whether nss-sysinit is turned on or off (#636801) Add provides nss-pkcs11-devel-static to comply with packaging guidelines (#609612)	2010-09-28 15:10:47 -07:00
Elio Maldonado	6b07fe83cc	Remove {nss_util\|nss_softokn}_build_version, BuildRequires must match Requires	2010-09-12 12:41:41 -07:00
Elio Maldonado	ebac350c8b	Merge branch 'f13' into f14	2010-09-11 16:19:26 -07:00
Elio Maldonado	c4f8125ecb	Bump nss_util_build_version and nss_softokn_build_version to 3.12.7	2010-09-11 16:10:43 -07:00
Elio Maldonado	9c7cfa3932	Merge branch 'f13' into f14 Fix unclosed comment in renegotiate-transitional.patch	2010-09-07 08:19:12 -07:00
Elio Maldonado	c953934393	Fix unclosed comment in renegotiate-transitional.patch	2010-09-07 08:10:16 -07:00
Elio Maldonado	87235aed91	Merge with master to update to 3.12.7	2010-09-03 08:14:29 -07:00
Elio Maldonado	fdefa43e4d	Update to 3.12.7 Delete nss-nolocalsql.patch and rely on an NSS_USE_SYSTEM_SQL variable instead. Added BuildRequires on available versions of the development pacakges Added some comments explaing lack of version on nss-sysinit provides	2010-09-03 08:08:47 -07:00
Elio Maldonado	690f79c8fa	Merge branch 'master' into f14	2010-08-30 16:22:04 -07:00
Elio Maldonado	0ade450edc	Merge branch 'master' into f14	2010-08-30 09:59:26 -07:00
Elio Maldonado	e7079bbf54	Merge branch 'master' into f13	2010-08-25 13:17:58 -07:00
Elio Maldonado	b7d02ab064	Merge branch 'master' into f14	2010-08-25 13:14:27 -07:00
Elio Maldonado	94bf03b9c2	Merge branch 'master' into f13	2010-08-14 17:17:39 -07:00
Elio Maldonado	78e9db1518	Merge branch 'master' into f14	2010-08-14 16:17:48 -07:00
Elio Maldonado	9b182d22ed	Merge branch 'master' into f13	2010-08-10 09:29:36 -07:00
Elio Maldonado	93c126b227	deleted nss-pem-20100809.tar.bz2	2010-08-09 22:12:03 -07:00
Elio Maldonado	764f26ca9d	Merge branch 'master' into f14 Conflicts: nss.spec	2010-08-09 22:05:27 -07:00
Elio Maldonado	6e2d989f14	Update source tar to add support for PKCS#8 encoded PEM RSA private key files rhbz#614532	2010-08-09 17:47:13 -07:00
Elio Maldonado	96702ba123	Initial pseudo merge for dist-git setup	2010-08-01 21:08:17 -07:00
Fedora Release Engineering	64fa704d3a	dist-git conversion	2010-07-29 04:33:25 +00:00
Elio Maldonado	7cbeb9c7bc	Require nss-softoken 3.12.6	2010-06-08 19:00:25 +00:00
Elio Maldonado	3ff6f4da98	Fix SIGSEGV within CreateObject #596674	2010-06-07 03:56:21 +00:00
Elio Maldonado	d99a5ee0ec	PEM module fixes: Collect objects searches through all objects, CopyObject returns shallow copy, Fix memory leak in pem_mdCryptoOperationRSAPriv	2010-04-14 20:11:50 +00:00
Elio Maldonado	0a6cda68f8	Retagging	2010-04-08 04:34:16 +00:00
Elio Maldonado	6648a39610	Fix sysinit requires: #576071 , update PayPalEE test cert: #580207	2010-04-08 02:15:39 +00:00
Elio Maldonado	6feac515e8	Use updated test cert - #580207	2010-04-08 02:11:54 +00:00
Elio Maldonado	d8583442b1	Fix nss.pc to not require nss-softokn - resolves: rhbz#575001	2010-03-19 19:05:26 +00:00
Elio Maldonado	c6b2155624	Reenable all tests	2010-03-07 03:46:03 +00:00
Elio Maldonado	fbb4c50e05	Update to 3.12.6	2010-03-06 23:05:19 +00:00
Jesse Keating	5333c595c9	Initialize branch F-13 for nss	2010-02-17 02:13:17 +00:00