From owner-svn-ports-all@freebsd.org Wed Jan 8 22:53:39 2020 Return-Path: Delivered-To: svn-ports-all@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 6C0AD1FDCD5; Wed, 8 Jan 2020 22:53:39 +0000 (UTC) (envelope-from jbeich@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 47tPg71zkHz4GlB; Wed, 8 Jan 2020 22:53:39 +0000 (UTC) (envelope-from jbeich@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 3F70D1F576; Wed, 8 Jan 2020 22:53:39 +0000 (UTC) (envelope-from jbeich@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id 008MrdoL073477; Wed, 8 Jan 2020 22:53:39 GMT (envelope-from jbeich@FreeBSD.org) Received: (from jbeich@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id 008MrcjS073469; Wed, 8 Jan 2020 22:53:38 GMT (envelope-from jbeich@FreeBSD.org) Message-Id: <202001082253.008MrcjS073469@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: jbeich set sender to jbeich@FreeBSD.org using -f From: Jan Beich Date: Wed, 8 Jan 2020 22:53:38 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-branches@freebsd.org Subject: svn commit: r522463 - in branches/2020Q1/security: ca_root_nss nss nss/files X-SVN-Group: ports-branches X-SVN-Commit-Author: jbeich X-SVN-Commit-Paths: in branches/2020Q1/security: ca_root_nss nss nss/files X-SVN-Commit-Revision: 522463 X-SVN-Commit-Repository: ports MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Jan 2020 22:53:39 -0000 Author: jbeich Date: Wed Jan 8 22:53:37 2020 New Revision: 522463 URL: https://svnweb.freebsd.org/changeset/ports/522463 Log: MFH: r522462 security/nss: update to 3.49 Changes: https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.49_release_notes Changes: https://hg.mozilla.org/projects/nss/shortlog/NSS_3_49_RTM ABI: https://abi-laboratory.pro/tracker/timeline/nss/ Reported by: Repology Approved by: ports-secteam blanket (required by Firefox 73) Modified: branches/2020Q1/security/ca_root_nss/Makefile branches/2020Q1/security/ca_root_nss/distinfo branches/2020Q1/security/nss/Makefile branches/2020Q1/security/nss/distinfo branches/2020Q1/security/nss/files/patch-bug1575843 branches/2020Q1/security/nss/files/patch-lib_freebl_blinit.c Directory Properties: branches/2020Q1/ (props changed) Modified: branches/2020Q1/security/ca_root_nss/Makefile ============================================================================== --- branches/2020Q1/security/ca_root_nss/Makefile Wed Jan 8 22:51:12 2020 (r522462) +++ branches/2020Q1/security/ca_root_nss/Makefile Wed Jan 8 22:53:37 2020 (r522463) @@ -32,7 +32,7 @@ PLIST_SUB+= CERTDIR=${CERTDIR} # !!! Please DO NOT submit patches for new version until it has !!! # !!! been committed there first. !!! # !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! -VERSION_NSS= 3.48 +VERSION_NSS= 3.49 #NSS_SUFFIX= -with-ckbi-1.98 CERTDATA_TXT_PATH= nss-${VERSION_NSS}/nss/lib/ckfw/builtins/certdata.txt BUNDLE_PROCESSOR= MAca-bundle.pl Modified: branches/2020Q1/security/ca_root_nss/distinfo ============================================================================== --- branches/2020Q1/security/ca_root_nss/distinfo Wed Jan 8 22:51:12 2020 (r522462) +++ branches/2020Q1/security/ca_root_nss/distinfo Wed Jan 8 22:53:37 2020 (r522463) @@ -1,3 +1,3 @@ -TIMESTAMP = 1575417811 -SHA256 (nss-3.48.tar.gz) = 3f9c822a86a4e3e1bfe63e2ed0f922d8b7c2e0b7cafe36774b1c627970d0f8ac -SIZE (nss-3.48.tar.gz) = 76481237 +TIMESTAMP = 1578083263 +SHA256 (nss-3.49.tar.gz) = 6738094dc4fd63061118a122bf3999a64fe8c7117fc52f6e81c2279181bde71d +SIZE (nss-3.49.tar.gz) = 76488781 Modified: branches/2020Q1/security/nss/Makefile ============================================================================== --- branches/2020Q1/security/nss/Makefile Wed Jan 8 22:51:12 2020 (r522462) +++ branches/2020Q1/security/nss/Makefile Wed Jan 8 22:53:37 2020 (r522463) @@ -2,7 +2,7 @@ # $FreeBSD$ PORTNAME= nss -PORTVERSION= 3.48 +PORTVERSION= 3.49 CATEGORIES= security MASTER_SITES= MOZILLA/security/${PORTNAME}/releases/${DISTNAME:tu:C/[-.]/_/g}_RTM/src Modified: branches/2020Q1/security/nss/distinfo ============================================================================== --- branches/2020Q1/security/nss/distinfo Wed Jan 8 22:51:12 2020 (r522462) +++ branches/2020Q1/security/nss/distinfo Wed Jan 8 22:53:37 2020 (r522463) @@ -1,3 +1,3 @@ -TIMESTAMP = 1575417811 -SHA256 (nss-3.48.tar.gz) = 3f9c822a86a4e3e1bfe63e2ed0f922d8b7c2e0b7cafe36774b1c627970d0f8ac -SIZE (nss-3.48.tar.gz) = 76481237 +TIMESTAMP = 1578083263 +SHA256 (nss-3.49.tar.gz) = 6738094dc4fd63061118a122bf3999a64fe8c7117fc52f6e81c2279181bde71d +SIZE (nss-3.49.tar.gz) = 76488781 Modified: branches/2020Q1/security/nss/files/patch-bug1575843 ============================================================================== --- branches/2020Q1/security/nss/files/patch-bug1575843 Wed Jan 8 22:51:12 2020 (r522462) +++ branches/2020Q1/security/nss/files/patch-bug1575843 Wed Jan 8 22:53:37 2020 (r522463) @@ -2,9 +2,9 @@ Detect ARM CPU features on FreeBSD. elf_aux_info is similar to getauxval but is nop on aarch64. ---- lib/freebl/blinit.c.orig 2019-08-30 15:46:32 UTC +--- lib/freebl/blinit.c.orig 2020-01-03 20:27:43 UTC +++ lib/freebl/blinit.c -@@ -96,8 +96,8 @@ CheckX86CPUSupport() +@@ -101,8 +101,8 @@ CheckX86CPUSupport() #ifndef __has_include #define __has_include(x) 0 #endif @@ -15,7 +15,7 @@ elf_aux_info is similar to getauxval but is nop on aar /* This might be conflict with host compiler */ #if !defined(__ANDROID__) #include -@@ -106,6 +106,10 @@ extern unsigned long getauxval(unsigned long type) __a +@@ -111,6 +111,10 @@ extern unsigned long getauxval(unsigned long type) __a #else static unsigned long (*getauxval)(unsigned long) = NULL; #endif /* defined(__GNUC__) && __GNUC__ >= 2 && defined(__ELF__)*/ @@ -26,7 +26,7 @@ elf_aux_info is similar to getauxval but is nop on aar #ifndef AT_HWCAP2 #define AT_HWCAP2 26 -@@ -118,6 +122,9 @@ static unsigned long (*getauxval)(unsigned long) = NUL +@@ -123,6 +127,9 @@ static unsigned long (*getauxval)(unsigned long) = NUL /* clang-format on */ #if defined(__aarch64__) @@ -36,15 +36,16 @@ elf_aux_info is similar to getauxval but is nop on aar // Defines from hwcap.h in Linux kernel - ARM64 #ifndef HWCAP_AES #define HWCAP_AES (1 << 3) -@@ -138,6 +145,7 @@ CheckARMSupport() - char *disable_arm_neon = PR_GetEnvSecure("NSS_DISABLE_ARM_NEON"); - char *disable_hw_aes = PR_GetEnvSecure("NSS_DISABLE_HW_AES"); - char *disable_pmull = PR_GetEnvSecure("NSS_DISABLE_PMULL"); -+#if defined(__linux__) +@@ -149,7 +156,7 @@ CheckARMSupport() + arm_pmull_support_ = arm_crypto_support && disable_pmull == NULL; + arm_sha1_support_ = arm_crypto_support; + arm_sha2_support_ = arm_crypto_support; +-#else ++#elif defined(__linux__) if (getauxval) { long hwcaps = getauxval(AT_HWCAP); arm_aes_support_ = hwcaps & HWCAP_AES && disable_hw_aes == NULL; -@@ -145,6 +153,23 @@ CheckARMSupport() +@@ -157,7 +164,23 @@ CheckARMSupport() arm_sha1_support_ = hwcaps & HWCAP_SHA1; arm_sha2_support_ = hwcaps & HWCAP_SHA2; } @@ -64,11 +65,11 @@ elf_aux_info is similar to getauxval but is nop on aar + arm_pmull_support_ = ID_AA64ISAR0_AES_VAL(id_aa64isar0) == ID_AA64ISAR0_AES_PMULL && disable_pmull == NULL; + arm_sha1_support_ = ID_AA64ISAR0_SHA1_VAL(id_aa64isar0) == ID_AA64ISAR0_SHA1_BASE; + arm_sha2_support_ = ID_AA64ISAR0_SHA2_VAL(id_aa64isar0) >= ID_AA64ISAR0_SHA2_BASE; -+#endif /* defined(__linux__) */ + #endif /* aarch64 must support NEON. */ arm_neon_support_ = disable_arm_neon == NULL; } -@@ -187,7 +203,7 @@ GetNeonSupport() +@@ -200,7 +223,7 @@ GetNeonSupport() // If no getauxval, compiler generate NEON instruction by default, // we should allow NOEN support. return PR_TRUE; @@ -77,7 +78,7 @@ elf_aux_info is similar to getauxval but is nop on aar // Android's cpu-features.c detects features by the following logic // // - Call getauxval(AT_HWCAP) -@@ -201,6 +217,10 @@ GetNeonSupport() +@@ -214,6 +237,10 @@ GetNeonSupport() if (getauxval) { return (getauxval(AT_HWCAP) & HWCAP_NEON); } @@ -88,7 +89,7 @@ elf_aux_info is similar to getauxval but is nop on aar #endif /* defined(__ARM_NEON) || defined(__ARM_NEON__) */ return PR_FALSE; } -@@ -249,6 +269,7 @@ void +@@ -262,6 +289,7 @@ void CheckARMSupport() { char *disable_hw_aes = PR_GetEnvSecure("NSS_DISABLE_HW_AES"); @@ -96,7 +97,7 @@ elf_aux_info is similar to getauxval but is nop on aar if (getauxval) { // Android's cpu-features.c uses AT_HWCAP2 for newer features. // AT_HWCAP2 is implemented on newer devices / kernel, so we can trust -@@ -257,13 +278,19 @@ CheckARMSupport() +@@ -270,13 +298,19 @@ CheckARMSupport() // AT_HWCAP2 isn't supported by glibc or Linux kernel, getauxval will // returns 0. long hwcaps = getauxval(AT_HWCAP2); Modified: branches/2020Q1/security/nss/files/patch-lib_freebl_blinit.c ============================================================================== --- branches/2020Q1/security/nss/files/patch-lib_freebl_blinit.c Wed Jan 8 22:51:12 2020 (r522462) +++ branches/2020Q1/security/nss/files/patch-lib_freebl_blinit.c Wed Jan 8 22:53:37 2020 (r522463) @@ -2,9 +2,9 @@ qemu:handle_cpu_signal received signal outside vCPU co https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=240037 ---- lib/freebl/blinit.c.orig 2019-08-30 15:46:32 UTC +--- lib/freebl/blinit.c.orig 2020-01-03 20:27:43 UTC +++ lib/freebl/blinit.c -@@ -163,12 +163,14 @@ CheckARMSupport() +@@ -174,12 +174,14 @@ CheckARMSupport() #ifndef ID_AA64ISAR0_SHA2_VAL #define ID_AA64ISAR0_SHA2_VAL ID_AA64ISAR0_SHA2 #endif @@ -22,6 +22,6 @@ https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=2400 + arm_sha1_support_ = ID_AA64ISAR0_SHA1_VAL(id_aa64isar0) == ID_AA64ISAR0_SHA1_BASE; + arm_sha2_support_ = ID_AA64ISAR0_SHA2_VAL(id_aa64isar0) >= ID_AA64ISAR0_SHA2_BASE; + } - #endif /* defined(__linux__) */ + #endif /* aarch64 must support NEON. */ arm_neon_support_ = disable_arm_neon == NULL;