From 7e7c353f91b8afb75384c26ae4d36b2a3f061b73 Mon Sep 17 00:00:00 2001
From: Martin Sirringhaus <>
Date: Tue, 12 Dec 2023 09:11:16 +0100
Subject: [PATCH] NSS: Update to 3.90.1 and remove upstreamed patch

---
 nss/mozilla-nss.spec         |  11 +-
 nss/nss-fix-bmo1813401.patch | 501 -----------------------------------
 2 files changed, 2 insertions(+), 510 deletions(-)
 delete mode 100644 nss/nss-fix-bmo1813401.patch

diff --git a/nss/mozilla-nss.spec b/nss/mozilla-nss.spec
index 36804df..19f0677 100644
--- a/nss/mozilla-nss.spec
+++ b/nss/mozilla-nss.spec
@@ -22,9 +22,9 @@
 %define nspr_ver %(rpm -q --queryformat '%%{VERSION}' mozilla-nspr)
 %define nssdbdir %{_sysconfdir}/pki/nssdb
 Name:           mozilla-nss
-Version:        3.90
+Version:        3.90.1
 Release:        0
-%define underscore_version 3_90
+%define underscore_version 3_90_1
 Summary:        Network Security Services
 License:        MPL-2.0
 Group:          System/Libraries
@@ -43,7 +43,6 @@ Source9:        pkcs11.txt
 #Source10:       PayPalEE.cert
 Source11:       nss-util.pc.in
 Source13:       nss-util-config.in
-Source98:       fixed-certs-bmo1813401.tar.gz
 Source99:       %{name}.changes
 Patch1:         nss-opt.patch
 Patch2:         system-nspr.patch
@@ -79,7 +78,6 @@ Patch45:        nss-fips-drbg-libjitter.patch
 Patch46:        nss-allow-slow-tests.patch
 Patch47:        nss-fips-pct-pubkeys.patch
 Patch48:        nss-fix-bmo1836925.patch
-Patch49:        nss-fix-bmo1813401.patch
 %if 0%{?sle_version} >= 120000 && 0%{?sle_version} < 150000
 # aarch64 + gcc4.8 fails to build on SLE-12 due to undefined references
 BuildRequires:  gcc9-c++
@@ -235,11 +233,6 @@ cd nss
 %patch46 -p1
 %patch47 -p1
 %patch48 -p1
-%patch49 -p1
-
-# GNU patch can't handle git binary changes, so we split off the 
-# binaries into it's own tarball and overwrite the old ones here
-tar xvf %{SOURCE98}
 
 # additional CA certificates
 #cd security/nss/lib/ckfw/builtins
diff --git a/nss/nss-fix-bmo1813401.patch b/nss/nss-fix-bmo1813401.patch
deleted file mode 100644
index 6d5de8d..0000000
--- a/nss/nss-fix-bmo1813401.patch
+++ /dev/null
@@ -1,501 +0,0 @@
-# HG changeset patch
-# User John M. Schanck <jschanck@mozilla.com>
-# Date 1692121535 0
-# Node ID 1d565dc7e17dad6d2851b2d6ff522c5d6345ae26
-# Parent  7dc3bdfca66c1eb38b0fd2a7d463d636cc662c2f
-Bug 1813401 - regenerate NameConstraints test certificates. r=djackson
-
-This also changes the validity period of test certs generated by `make-nc`
-from ~10 years to ~20 years.
-
-NOTE: Removed the git binary diffs and moved those to fixed-certs-bmo1813401.tar.gz
-      because `patch` can't handle binary diffs. 
-
-Differential Revision: https://phabricator.services.mozilla.com/D185088
-
-diff --git a/tests/libpkix/certs/make-nc b/tests/libpkix/certs/make-nc
---- a/tests/libpkix/certs/make-nc
-+++ b/tests/libpkix/certs/make-nc
-@@ -6,32 +6,32 @@
- 
- mkdir tmp
- cd tmp
- dd if=/dev/urandom bs=512 count=1 of=noise
- echo "" > pwfile
- 
- certutil -d . -N -f pwfile
- 
--certutil -S -z noise -g 1024 -d . -n ca -s "CN=NSS Test CA,O=BOGUS NSS,L=Mountain View,ST=California,C=US" -t C,C,C -x -m 1 -w -2 -v 120 -1 -2 -5 <<CERTSCRIPT
-+certutil -S -z noise -g 1024 -d . -n ca -s "CN=NSS Test CA,O=BOGUS NSS,L=Mountain View,ST=California,C=US" -t C,C,C -x -m 1 -w -2 -v 240 -1 -2 -5 <<CERTSCRIPT
- 5
- 6
- 9
- n
- y
- 
- n
- 5
- 6
- 7
- 9
- n
- CERTSCRIPT
- 
--certutil -S -z noise -g 1024 -d . -n ica -s "CN=NSS Intermediate CA,O=BOGUS NSS,L=Mountain View,ST=California,C=US" -t ,, -c ca -m 20 -w -1 -v 118 -1 -2 -5 --extNC <<CERTSCRIPT
-+certutil -S -z noise -g 1024 -d . -n ica -s "CN=NSS Intermediate CA,O=BOGUS NSS,L=Mountain View,ST=California,C=US" -t ,, -c ca -m 20 -w -1 -v 238 -1 -2 -5 --extNC <<CERTSCRIPT
- 5
- 6
- 9
- n
- y
- 
- n
- 3
-@@ -41,129 +41,129 @@ n
- n
- 5
- 6
- 7
- 9
- n
- CERTSCRIPT
- 
--certutil -S -z noise -g 1024 -d . -n server1 -s "CN=test.invalid,O=BOGUS NSS,L=Mountain View,ST=California,C=US" -t ,, -c ica -m 40 -v 115 -1 -2 -5 -8 test.invalid <<CERTSCRIPT
-+certutil -S -z noise -g 1024 -d . -n server1 -s "CN=test.invalid,O=BOGUS NSS,L=Mountain View,ST=California,C=US" -t ,, -c ica -m 40 -v 235 -1 -2 -5 -8 test.invalid <<CERTSCRIPT
- 0
- 2
- 3
- 4
- 9
- n
- n
- 
- y
- 0
- 1
- 9
- n
- CERTSCRIPT
- 
--certutil -S -z noise -g 1024 -d . -n server2 -s "CN=another_test.invalid,O=BOGUS NSS,L=Mountain View,ST=California,C=US" -t ,, -c ica -m 41 -v 115 -1 -2 -5 <<CERTSCRIPT
-+certutil -S -z noise -g 1024 -d . -n server2 -s "CN=another_test.invalid,O=BOGUS NSS,L=Mountain View,ST=California,C=US" -t ,, -c ica -m 41 -v 235 -1 -2 -5 <<CERTSCRIPT
- 0
- 2
- 3
- 4
- 9
- n
- n
- 
- y
- 0
- 1
- 9
- n
- CERTSCRIPT
- 
--certutil -S -z noise -g 1024 -d . -n server3 -s "CN=test.example,O=BOGUS NSS,L=Mountain View,ST=California,C=US" -t ,, -c ica -m 42 -v 115 -1 -2 -5 -8 test.example <<CERTSCRIPT
-+certutil -S -z noise -g 1024 -d . -n server3 -s "CN=test.example,O=BOGUS NSS,L=Mountain View,ST=California,C=US" -t ,, -c ica -m 42 -v 235 -1 -2 -5 -8 test.example <<CERTSCRIPT
- 0
- 2
- 3
- 4
- 9
- n
- n
- 
- y
- 0
- 1
- 9
- n
- CERTSCRIPT
- 
--certutil -S -z noise -g 1024 -d . -n ica2 -s "CN=NSS Intermediate CA 2,O=BOGUS NSS,L=Mountain View,ST=California,C=US" -t ,, -c ica -m 21 -w -2 -v 120 -1 -2 -5 <<CERTSCRIPT
-+certutil -S -z noise -g 1024 -d . -n ica2 -s "CN=NSS Intermediate CA 2,O=BOGUS NSS,L=Mountain View,ST=California,C=US" -t ,, -c ica -m 21 -w -2 -v 240 -1 -2 -5 <<CERTSCRIPT
- 5
- 6
- 9
- n
- y
- 
- n
- 5
- 6
- 7
- 9
- n
- CERTSCRIPT
- 
--certutil -S -z noise -g 1024 -d . -n server4 -s "CN=test2.invalid,O=BOGUS NSS,L=Mountain View,ST=California,C=US" -t ,, -c ica2 -m 50 -v 115 -1 -2 -5 -8 test.invalid <<CERTSCRIPT
-+certutil -S -z noise -g 1024 -d . -n server4 -s "CN=test2.invalid,O=BOGUS NSS,L=Mountain View,ST=California,C=US" -t ,, -c ica2 -m 50 -v 235 -1 -2 -5 -8 test.invalid <<CERTSCRIPT
- 0
- 2
- 3
- 4
- 9
- n
- n
- 
- y
- 0
- 1
- 9
- n
- CERTSCRIPT
- 
--certutil -S -z noise -g 1024 -d . -n server5 -s "CN=another_test2.invalid,O=BOGUS NSS,L=Mountain View,ST=California,C=US" -t ,, -c ica2 -m 51 -v 115 -1 -2 -5 <<CERTSCRIPT
-+certutil -S -z noise -g 1024 -d . -n server5 -s "CN=another_test2.invalid,O=BOGUS NSS,L=Mountain View,ST=California,C=US" -t ,, -c ica2 -m 51 -v 235 -1 -2 -5 <<CERTSCRIPT
- 0
- 2
- 3
- 4
- 9
- n
- n
- 
- y
- 0
- 1
- 9
- n
- CERTSCRIPT
- 
- 
--certutil -S -z noise -g 1024 -d . -n server6 -s "CN=test2.example,O=BOGUS NSS,L=Mountain View,ST=California,C=US" -t ,, -c ica2 -m 52 -v 115 -1 -2 -5 -8 test.example <<CERTSCRIPT
-+certutil -S -z noise -g 1024 -d . -n server6 -s "CN=test2.example,O=BOGUS NSS,L=Mountain View,ST=California,C=US" -t ,, -c ica2 -m 52 -v 235 -1 -2 -5 -8 test.example <<CERTSCRIPT
- 0
- 2
- 3
- 4
- 9
- n
- n
- 
- y
- 0
- 1
- 9
- n
- CERTSCRIPT
- 
--certutil -S -z noise -g 1024 -d . -n ica3 -s "CN=NSS Intermediate CA3,O=BOGUS NSS,L=Mountain View,ST=California,C=US" -t ,, -c ca -m 21 -w -1 -v 118 -1 -2 -5 --extNC <<CERTSCRIPT
-+certutil -S -z noise -g 1024 -d . -n ica3 -s "CN=NSS Intermediate CA3,O=BOGUS NSS,L=Mountain View,ST=California,C=US" -t ,, -c ca -m 21 -w -1 -v 238 -1 -2 -5 --extNC <<CERTSCRIPT
- 5
- 6
- 9
- n
- y
- 
- n
- 3
-@@ -177,175 +177,175 @@ n
- n
- 5
- 6
- 7
- 9
- n
- CERTSCRIPT
- 
--certutil -S -z noise -g 1024 -d . -n ica4 -s "CN=NSS Intermediate CA 2,O=Foo,ST=CA,C=US" -t ,, -c ica3 -m 61 -w -2 -v 120 -1 -2 -5 <<CERTSCRIPT
-+certutil -S -z noise -g 1024 -d . -n ica4 -s "CN=NSS Intermediate CA 2,O=Foo,ST=CA,C=US" -t ,, -c ica3 -m 61 -w -2 -v 240 -1 -2 -5 <<CERTSCRIPT
- 5
- 6
- 9
- n
- y
- 
- n
- 5
- 6
- 7
- 9
- n
- CERTSCRIPT
- 
--certutil -S -z noise -g 1024 -d . -n server7 -s "CN=bat.foo.example,ou=bar,O=Foo,ST=CA,C=US" -t ,, -c ica4 -m 41 -v 115 -1 -2 -5 <<CERTSCRIPT
-+certutil -S -z noise -g 1024 -d . -n server7 -s "CN=bat.foo.example,ou=bar,O=Foo,ST=CA,C=US" -t ,, -c ica4 -m 41 -v 235 -1 -2 -5 <<CERTSCRIPT
- 0
- 2
- 3
- 4
- 9
- n
- n
- 
- y
- 0
- 1
- 9
- n
- CERTSCRIPT
- 
--certutil -S -z noise -g 1024 -d . -n server8 -s "CN=bat.foo.example,O=Foo,ST=CA,C=US" -t ,, -c ica4 -m 42 -v 115 -1 -2 -5 <<CERTSCRIPT
-+certutil -S -z noise -g 1024 -d . -n server8 -s "CN=bat.foo.example,O=Foo,ST=CA,C=US" -t ,, -c ica4 -m 42 -v 235 -1 -2 -5 <<CERTSCRIPT
- 0
- 2
- 3
- 4
- 9
- n
- n
- 
- y
- 0
- 1
- 9
- n
- CERTSCRIPT
- 
--certutil -S -z noise -g 1024 -d . -n server9 -s "CN=bat.foo.example,O=Foo,C=US" -t ,, -c ica4 -m 43 -v 115 -1 -2 -5 <<CERTSCRIPT
-+certutil -S -z noise -g 1024 -d . -n server9 -s "CN=bat.foo.example,O=Foo,C=US" -t ,, -c ica4 -m 43 -v 235 -1 -2 -5 <<CERTSCRIPT
- 0
- 2
- 3
- 4
- 9
- n
- n
- 
- y
- 0
- 1
- 9
- n
- CERTSCRIPT
- 
--certutil -S -z noise -g 1024 -d . -n server10 -s "CN=bar.example,O=Foo,ST=CA,C=US" -t ,, -c ica4 -m 44 -v 115 -1 -2 -5 <<CERTSCRIPT
-+certutil -S -z noise -g 1024 -d . -n server10 -s "CN=bar.example,O=Foo,ST=CA,C=US" -t ,, -c ica4 -m 44 -v 235 -1 -2 -5 <<CERTSCRIPT
- 0
- 2
- 3
- 4
- 9
- n
- n
- 
- y
- 0
- 1
- 9
- n
- CERTSCRIPT
- 
--certutil -S -z noise -g 1024 -d . -n server11 -s "CN=site.example,O=Foo,ST=CA,C=US" -t ,, -c ica4 -m 45 -v 115 -1 -2 -5 -8 foo.example <<CERTSCRIPT
-+certutil -S -z noise -g 1024 -d . -n server11 -s "CN=site.example,O=Foo,ST=CA,C=US" -t ,, -c ica4 -m 45 -v 235 -1 -2 -5 -8 foo.example <<CERTSCRIPT
- 0
- 2
- 3
- 4
- 9
- n
- n
- 
- y
- 0
- 1
- 9
- n
- CERTSCRIPT
- 
--certutil -S -z noise -g 1024 -d . -n server12 -s "CN=Honest Achmed,O=Foo,ST=CA,C=US" -t ,, -c ica4 -m 46 -v 115 -1 -2 -5 <<CERTSCRIPT
-+certutil -S -z noise -g 1024 -d . -n server12 -s "CN=Honest Achmed,O=Foo,ST=CA,C=US" -t ,, -c ica4 -m 46 -v 235 -1 -2 -5 <<CERTSCRIPT
- 0
- 2
- 3
- 4
- 9
- n
- n
- 
- y
- 0
- 1
- 9
- n
- CERTSCRIPT
- 
--certutil -S -z noise -g 1024 -d . -n ica5 -s "CN=NSS Intermediate CA 2,O=OtherOrg,ST=CA,C=US" -t ,, -c ica3 -m 62 -w -2 -v 120 -1 -2 -5 <<CERTSCRIPT
-+certutil -S -z noise -g 1024 -d . -n ica5 -s "CN=NSS Intermediate CA 2,O=OtherOrg,ST=CA,C=US" -t ,, -c ica3 -m 62 -w -2 -v 240 -1 -2 -5 <<CERTSCRIPT
- 5
- 6
- 9
- n
- y
- 
- n
- 5
- 6
- 7
- 9
- n
- CERTSCRIPT
- 
--certutil -S -z noise -g 1024 -d . -n server13 -s "CN=bat.foo.example,O=OtherOrg,ST=CA,C=US" -t ,, -c ica5 -m 41 -v 115 -1 -2 -5 <<CERTSCRIPT
-+certutil -S -z noise -g 1024 -d . -n server13 -s "CN=bat.foo.example,O=OtherOrg,ST=CA,C=US" -t ,, -c ica5 -m 41 -v 235 -1 -2 -5 <<CERTSCRIPT
- 0
- 2
- 3
- 4
- 9
- n
- n
- 
- y
- 0
- 1
- 9
- n
- CERTSCRIPT
- 
--certutil -S -z noise -g 1024 -d . -n server14 -s "CN=another.foo.example,O=Foo,ST=CA,C=US" -t ,, -c ica5 -m 490 -v 115 -1 -2 -5 <<CERTSCRIPT
-+certutil -S -z noise -g 1024 -d . -n server14 -s "CN=another.foo.example,O=Foo,ST=CA,C=US" -t ,, -c ica5 -m 490 -v 235 -1 -2 -5 <<CERTSCRIPT
- 0
- 2
- 3
- 4
- 9
- n
- n
- 
- y
- 0
- 1
- 9
- n
- CERTSCRIPT
- 
--certutil -S -z noise -g 1024 -d . -n ncca -s "CN=NSS Name Constrained Root CA,O=BOGUS NSS,L=Mountain View,ST=CA,C=US" -t C,C,C -x -m 2 -w -1 -v 118 -1 -2 -5 --extNC <<CERTSCRIPT
-+certutil -S -z noise -g 1024 -d . -n ncca -s "CN=NSS Name Constrained Root CA,O=BOGUS NSS,L=Mountain View,ST=CA,C=US" -t C,C,C -x -m 2 -w -1 -v 238 -1 -2 -5 --extNC <<CERTSCRIPT
- 5
- 6
- 9
- n
- y
- 
- n
- 3
-@@ -355,114 +355,114 @@ n
- n
- 5
- 6
- 7
- 9
- n
- CERTSCRIPT
- 
--certutil -S -z noise -g 1024 -d . -n ica6 -s "CN=NSS Intermediate CA6,O=OtherOrg,ST=CA,C=US" -t ,, -c ncca -m 63 -w -2 -v 120 -1 -2 -5 <<CERTSCRIPT
-+certutil -S -z noise -g 1024 -d . -n ica6 -s "CN=NSS Intermediate CA6,O=OtherOrg,ST=CA,C=US" -t ,, -c ncca -m 63 -w -2 -v 240 -1 -2 -5 <<CERTSCRIPT
- 5
- 6
- 9
- n
- y
- 
- n
- 5
- 6
- 7
- 9
- n
- CERTSCRIPT
- 
--certutil -S -z noise -g 1024 -d . -n server15 -s "CN=testfoo.invalid,O=BOGUS NSS,L=Mountain View,ST=California,C=US" -t ,, -c ica6 -m 64 -v 115 -1 -2 -5 -8 testfoo.invalid <<CERTSCRIPT
-+certutil -S -z noise -g 1024 -d . -n server15 -s "CN=testfoo.invalid,O=BOGUS NSS,L=Mountain View,ST=California,C=US" -t ,, -c ica6 -m 64 -v 235 -1 -2 -5 -8 testfoo.invalid <<CERTSCRIPT
- 0
- 2
- 3
- 4
- 9
- n
- n
- 
- y
- 0
- 1
- 9
- n
- CERTSCRIPT
- 
--certutil -S -z noise -g 1024 -d . -n server16 -s "CN=another_test3.invalid,O=BOGUS NSS,L=Mountain View,ST=California,C=US" -t ,, -c ica6 -m 65 -v 115 -1 -2 -5 <<CERTSCRIPT
-+certutil -S -z noise -g 1024 -d . -n server16 -s "CN=another_test3.invalid,O=BOGUS NSS,L=Mountain View,ST=California,C=US" -t ,, -c ica6 -m 65 -v 235 -1 -2 -5 <<CERTSCRIPT
- 0
- 2
- 3
- 4
- 9
- n
- n
- 
- y
- 0
- 1
- 9
- n
- CERTSCRIPT
- 
--certutil -S -z noise -g 1024 -d . -n server17 -s "CN=test4.example,O=BOGUS NSS,L=Mountain View,ST=California,C=US" -t ,, -c ica6 -m 66 -v 115 -1 -2 -5 -8 test4.example <<CERTSCRIPT
-+certutil -S -z noise -g 1024 -d . -n server17 -s "CN=test4.example,O=BOGUS NSS,L=Mountain View,ST=California,C=US" -t ,, -c ica6 -m 66 -v 235 -1 -2 -5 -8 test4.example <<CERTSCRIPT
- 0
- 2
- 3
- 4
- 9
- n
- n
- 
- y
- 0
- 1
- 9
- n
- CERTSCRIPT
- 
- #DCISS copy certs
--certutil -S -z noise -g 2048 -d . -n dcisscopy -s "E=igca@sgdn.pm.gouv.fr,CN=IGC/A,OU=DCSSI,O=PM/SGDN,L=Paris,ST=France,C=FR" -t C,C,C -x -m 998899 -w -2 -v 120 -1 -2 -5 <<CERTSCRIPT
-+certutil -S -z noise -g 2048 -d . -n dcisscopy -s "E=igca@sgdn.pm.gouv.fr,CN=IGC/A,OU=DCSSI,O=PM/SGDN,L=Paris,ST=France,C=FR" -t C,C,C -x -m 998899 -w -2 -v 240 -1 -2 -5 <<CERTSCRIPT
- 5
- 6
- 9
- n
- y
- 
- n
- 5
- 6
- 7
- 9
- n
- CERTSCRIPT
- 
- #the following cert MUST not pass
--certutil -S -z noise -g 2048 -d . -n dcissblocked -s "CN=foo.example.com,O=Foo,ST=CA,C=US" -t ,, -c dcisscopy -m 998900 -v 120 -1 -2 -5 <<CERTSCRIPT
-+certutil -S -z noise -g 2048 -d . -n dcissblocked -s "CN=foo.example.com,O=Foo,ST=CA,C=US" -t ,, -c dcisscopy -m 998900 -v 240 -1 -2 -5 <<CERTSCRIPT
- 0
- 2
- 3
- 4
- 9
- n
- n
- 
- y
- 0
- 1
- 9
- n
- CERTSCRIPT
- 
- #the following cert MUST pass
--certutil -S -z noise -g 2048 -d . -n dcissallowed -s "CN=foo.example.fr,O=Foo,ST=CA,C=US" -t ,, -c dcisscopy -m 998901 -v 120 -1 -2 -5 <<CERTSCRIPT
-+certutil -S -z noise -g 2048 -d . -n dcissallowed -s "CN=foo.example.fr,O=Foo,ST=CA,C=US" -t ,, -c dcisscopy -m 998901 -v 240 -1 -2 -5 <<CERTSCRIPT
- 0
- 2
- 3
- 4
- 9
- n
- n
- 
-