RHEL 9.0.0 Alpha bootstrap

The content of this branch was automatically imported from Fedora ELN with the following as its source: https://src.fedoraproject.org/rpms/jss#8d0f659a7b9ac2d0ee7ab02be0de758a28f0b46a
2020-10-15 14:24:53 +02:00 · 2020-10-15 14:24:53 +02:00 · af554a80d1
commit af554a80d1
parent 519540a3b4
7 changed files with 420 additions and 0 deletions
--- a/.gitignore
+++ b/.gitignore
@ -0,0 +1,32 @@
+# Local build files
+jss-*.src.rpm
+jss-*/
+x86_64/
+.build-*.log
+
+# Releases
+jss-4.2.6.tar.gz
+/jss-4.2.6.tar.gz
+/jss-4.4.0.tar.gz
+/jss-4.4.1.tar.gz
+/jss-4.4.2.tar.gz
+/jss-4.4.3.tar.gz
+/jss-4.4.4.tar.gz
+/jss-4.5.0-a1.tar.gz
+/jss-4.5.0-a2.tar.gz
+/jss-4.5.0-a3.tar.gz
+/jss-4.5.0-a4.tar.gz
+/jss-4.5.0-b1.tar.gz
+/jss-4.5.0.tar.gz
+/jss-4.5.1.tar.gz
+/jss-4.5.2.tar.gz
+/jss-4.5.3.tar.gz
+/jss-4.6.1.tar.gz
+/jss-4.6.2.tar.gz
+/jss-4.6.3.tar.gz
+/jss-4.6.4.tar.gz
+/jss-4.7.0-b2.tar.gz
+/jss-4.7.0-b4.tar.gz
+/jss-4.7.0.tar.gz
+/jss-4.7.2.tar.gz
+/jss-4.7.3.tar.gz
--- a/copr-build.sh
+++ b/copr-build.sh
@ -0,0 +1,9 @@
+#!/bin/sh
+
+REPO=$1
+
+if [ "$REPO" == "" ]; then
+    REPO="pki-10.6"
+fi
+
+fedpkg copr-build --nowait $REPO
--- a/jss-crypto-policies-1.patch
+++ b/jss-crypto-policies-1.patch
@ -0,0 +1,49 @@
+From 1fb6097a2ab73ef897d011e7383d7f5f1bf6a1df Mon Sep 17 00:00:00 2001
+From: Alexander Scheel <ascheel@redhat.com>
+Date: Wed, 1 Jul 2020 12:41:20 -0400
+Subject: [PATCH] Replace SHA-1 signature with SHA-256
+
+A recent change in Fedora Rawhide's crypto-policies package caused
+failures in the tests like the following:
+
+    Exception in thread "main" java.io.IOException: SocketException cannot read on socket: Error reading from socket: (-12271) SSL peer cannot verify your certificate.
+        at org.mozilla.jss.ssl.SSLSocket.read(SSLSocket.java:1494)
+        at org.mozilla.jss.ssl.SSLInputStream.read(SSLInputStream.java:38)
+        at org.mozilla.jss.ssl.SSLInputStream.read(SSLInputStream.java:25)
+        at org.mozilla.jss.tests.SSLClientAuth.run(SSLClientAuth.java:435)
+        at java.lang.Thread.run(Thread.java:748)
+    Caused by: org.mozilla.jss.ssl.SSLSocketException: Error reading from socket: (-12271) SSL peer cannot verify your certificate.
+        at org.mozilla.jss.ssl.SSLSocket.socketRead(Native Method)
+        at org.mozilla.jss.ssl.SSLSocket.read(SSLSocket.java:1488)
+        ... 4 more
+    Server exiting
+    org.mozilla.jss.ssl.SSLSocketException: SSL_ForceHandshake failed: (-8016) Unknown error
+        at org.mozilla.jss.ssl.SSLSocket.forceHandshake(Native Method)
+        at org.mozilla.jss.tests.SSLClientAuth.testConnection(SSLClientAuth.java:345)
+        at org.mozilla.jss.tests.SSLClientAuth.doIt(SSLClientAuth.java:156)
+        at org.mozilla.jss.tests.SSLClientAuth.main(SSLClientAuth.java:90)
+
+This was caused by dropping SHA-1 as an allowed hash during handshakes.
+However, because SSLClientAuth manually generated its certificate (and
+explicitly asked for SHA-1), it failed.
+
+Switch to SHA-256 instead.
+
+Signed-off-by: Alexander Scheel <ascheel@redhat.com>
+---
+ org/mozilla/jss/tests/SSLClientAuth.java | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/org/mozilla/jss/tests/SSLClientAuth.java b/org/mozilla/jss/tests/SSLClientAuth.java
+index 6f1fd2b12..bf270a634 100644
+--- a/org/mozilla/jss/tests/SSLClientAuth.java
+++ b/org/mozilla/jss/tests/SSLClientAuth.java
+@@ -28,7 +28,7 @@
+     
+     private CryptoManager cm;
+     public static final SignatureAlgorithm sigAlg =
+-            SignatureAlgorithm.RSASignatureWithSHA1Digest;
+            SignatureAlgorithm.RSASignatureWithSHA256Digest;
+     
+     /**
+      * Method that generates a certificate for given credential
--- a/jss-crypto-policies-2.patch
+++ b/jss-crypto-policies-2.patch
@ -0,0 +1,47 @@
+From 8ed5a82a973922d07d0610fd42c48b2a0ec97d6c Mon Sep 17 00:00:00 2001
+From: Alexander Scheel <ascheel@redhat.com>
+Date: Wed, 1 Jul 2020 12:44:53 -0400
+Subject: [PATCH] Remove all legacy DSS/DSA tests
+
+The only signature algorithm suppoted with DSS is SHA-1, which will soon
+become deprecated and broken. DSS itself isn't widely used either, so we
+should remove it from the test suite as well.
+
+Signed-off-by: Alexander Scheel <ascheel@redhat.com>
+---
+ cmake/JSSTests.cmake | 12 +-----------
+ 1 file changed, 1 insertion(+), 11 deletions(-)
+
+diff --git a/cmake/JSSTests.cmake b/cmake/JSSTests.cmake
+index a26b95425..a0fe36e22 100644
+--- a/cmake/JSSTests.cmake
+++ b/cmake/JSSTests.cmake
+@@ -170,11 +170,6 @@ macro(jss_tests)
+         COMMAND "org.mozilla.jss.tests.GenerateTestCert" "${RESULTS_NSSDB_OUTPUT_DIR}" "${PASSWORD_FILE}" "30" "localhost" "SHA-256/EC" "CA_ECDSA" "Server_ECDSA" "Client_ECDSA"
+         DEPENDS "Generate_known_RSA_cert_pair"
+     )
+-    jss_test_java(
+-        NAME "Generate_known_DSS_cert_pair"
+-        COMMAND "org.mozilla.jss.tests.GenerateTestCert" "${RESULTS_NSSDB_OUTPUT_DIR}" "${PASSWORD_FILE}" "40" "localhost" "SHA-1/DSA" "CA_DSS" "Server_DSS" "Client_DSS"
+-        DEPENDS "Generate_known_ECDSA_cert_pair"
+-    )
+     jss_test_exec(
+         NAME "Create_PKCS11_cert_to_PKCS12_rsa.pfx"
+         COMMAND "pk12util" "-o" "${RESULTS_NSSDB_OUTPUT_DIR}/rsa.pfx" "-n" "CA_RSA" "-d" "${RESULTS_NSSDB_OUTPUT_DIR}" "-K" "${DB_PWD}" "-W" "${DB_PWD}"
+@@ -185,15 +180,10 @@ macro(jss_tests)
+         COMMAND "pk12util" "-o" "${RESULTS_NSSDB_OUTPUT_DIR}/ecdsa.pfx" "-n" "CA_ECDSA" "-d" "${RESULTS_NSSDB_OUTPUT_DIR}" "-K" "${DB_PWD}" "-W" "${DB_PWD}"
+         DEPENDS "Generate_known_ECDSA_cert_pair"
+     )
+-    jss_test_exec(
+-        NAME "Create_PKCS11_cert_to_PKCS12_dss.pfx"
+-        COMMAND "pk12util" "-o" "${RESULTS_NSSDB_OUTPUT_DIR}/dss.pfx" "-n" "CA_DSS" "-d" "${RESULTS_NSSDB_OUTPUT_DIR}" "-K" "${DB_PWD}" "-W" "${DB_PWD}"
+-        DEPENDS "Generate_known_DSS_cert_pair"
+-    )
+     jss_test_java(
+         NAME "List_CA_certs"
+         COMMAND "org.mozilla.jss.tests.ListCACerts" "${RESULTS_NSSDB_OUTPUT_DIR}" "Verbose"
+-        DEPENDS "Generate_known_DSS_cert_pair"
+        DEPENDS "Generate_known_ECDSA_cert_pair"
+     )
+     jss_test_java(
+         NAME "SSLClientAuth"
--- a/jss.spec
+++ b/jss.spec
@ -0,0 +1,275 @@
+################################################################################
+Name:           jss
+################################################################################
+
+Summary:        Java Security Services (JSS)
+URL:            http://www.dogtagpki.org/wiki/JSS
+License:        MPLv1.1 or GPLv2+ or LGPLv2+
+
+Version:        4.7.3
+Release:        1%{?_timestamp}%{?_commit_id}%{?dist}
+#global         _phase -a1
+
+# To generate the source tarball:
+# $ git clone https://github.com/dogtagpki/jss.git
+# $ cd jss
+# $ git tag v4.5.<z>
+# $ git push origin v4.5.<z>
+# Then go to https://github.com/dogtagpki/jss/releases and download the source
+# tarball.
+Source:         https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phase}/%{name}-%{version}%{?_phase}.tar.gz
+
+# To create a patch for all changes since a version tag:
+# $ git format-patch \
+#     --stdout \
+#     <version tag> \
+#     > jss-VERSION-RELEASE.patch
+# Patch: jss-VERSION-RELEASE.patch
+
+################################################################################
+# Build Dependencies
+################################################################################
+
+# autosetup
+BuildRequires:  git
+BuildRequires:  make
+BuildRequires:  cmake
+BuildRequires:  zip
+BuildRequires:  unzip
+
+BuildRequires:  gcc-c++
+BuildRequires:  nspr-devel >= 4.13.1
+BuildRequires:  nss-devel >= 3.44
+BuildRequires:  nss-tools >= 3.44
+BuildRequires:  java-devel
+BuildRequires:  jpackage-utils
+BuildRequires:  slf4j
+BuildRequires:  glassfish-jaxb-api
+%if 0%{?rhel} && 0%{?rhel} <= 7
+# no slf4j-jdk14
+%else
+BuildRequires:  slf4j-jdk14
+%endif
+BuildRequires:  apache-commons-lang
+
+BuildRequires:  junit
+
+Requires:       nss >= 3.44
+Requires:       java-headless
+Requires:       jpackage-utils
+Requires:       slf4j
+Requires:       glassfish-jaxb-api
+%if 0%{?rhel} && 0%{?rhel} <= 7
+# no slf4j-jdk14
+%else
+Requires:       slf4j-jdk14
+%endif
+Requires:       apache-commons-lang
+
+Conflicts:      ldapjdk < 4.20
+Conflicts:      idm-console-framework < 1.2
+Conflicts:      tomcatjss < 7.3.4
+Conflicts:      pki-base < 10.6.5
+
+%description
+Java Security Services (JSS) is a java native interface which provides a bridge
+for java-based applications to use native Network Security Services (NSS).
+This only works with gcj. Other JREs require that JCE providers be signed.
+
+################################################################################
+%package javadoc
+################################################################################
+
+Summary:        Java Security Services (JSS) Javadocs
+Requires:       jss = %{version}-%{release}
+
+%description javadoc
+This package contains the API documentation for JSS.
+
+################################################################################
+%prep
+
+%autosetup -n %{name}-%{version}%{?_phase} -p 1 -S git
+
+################################################################################
+%build
+
+%set_build_flags
+
+[ -z "$JAVA_HOME" ] && export JAVA_HOME=%{_jvmdir}/java
+
+# Enable compiler optimizations
+export BUILD_OPT=1
+
+# Generate symbolic info for debuggers
+CFLAGS="-g $RPM_OPT_FLAGS"
+export CFLAGS
+
+# Check if we're in FIPS mode
+modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENABLED=1
+
+# RHEL's CMake doesn't support -B flag.
+%if 0%{?rhel}
+%{__mkdir_p} %{_vpath_builddir}
+cd %{_vpath_builddir}
+%endif
+
+# The Makefile is not thread-safe
+%cmake \
+    -DJAVA_HOME=%{java_home} \
+    -DJAVA_LIB_INSTALL_DIR=%{_jnidir} \
+%if 0%{?rhel}
+    ..
+%else
+    -B %{_vpath_builddir}
+%endif
+
+%if 0%{?fedora}
+cd %{_vpath_builddir}
+%endif
+
+%{__make} all
+%{__make} javadoc
+ctest --output-on-failure
+
+################################################################################
+%install
+
+# There is no install target so we'll do it by hand
+
+# jars
+install -d -m 0755 $RPM_BUILD_ROOT%{_jnidir}
+install -m 644 %{_vpath_builddir}/jss4.jar ${RPM_BUILD_ROOT}%{_jnidir}/jss4.jar
+
+# We have to use the name libjss4.so because this is dynamically
+# loaded by the jar file.
+install -d -m 0755 $RPM_BUILD_ROOT%{_libdir}/jss
+install -m 0755 %{_vpath_builddir}/libjss4.so ${RPM_BUILD_ROOT}%{_libdir}/jss/
+pushd  ${RPM_BUILD_ROOT}%{_libdir}/jss
+    ln -fs %{_jnidir}/jss4.jar jss4.jar
+popd
+
+# javadoc
+install -d -m 0755 $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version}
+cp -rp %{_vpath_builddir}/docs/* $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version}
+cp -p jss.html $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version}
+cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version}
+
+# No ldconfig is required since this library is loaded by Java itself.
+################################################################################
+%files
+
+%defattr(-,root,root,-)
+%doc jss.html
+%license MPL-1.1.txt gpl.txt lgpl.txt
+%{_libdir}/*
+%{_jnidir}/*
+
+################################################################################
+%files javadoc
+
+%defattr(-,root,root,-)
+%{_javadocdir}/%{name}-%{version}/
+
+################################################################################
+%changelog
+* Fri Sep 11 2020 Dogtag PKI Team <pki-devel@redhat.com> - 4.7.3-1
+- Rebase to upstream stable release JSS v4.7.3
+
+* Tue Aug 18 2020 Dogtag PKI Team <pki-devel@redhat.com> - 4.7.2-1
+- Rebase to upstream stable release JSS v4.7.2 ; fixes FTBFS
+
+* Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 4.7.0-4
+- Second attempt - Rebuilt for
+  https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 4.7.0-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Fri Jul 10 2020 Jiri Vanek <jvanek@redhat.com> - 4.7.0-2
+- Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11
+
+* Thu Jul 09 2020 Dogtag PKI Team <pki-devel@redhat.com> - 4.7.0-1
+- Rebase to upstream stable release JSS v4.7.0
+
+* Mon Jul 06 2020 Dogtag PKI Team <pki-devel@redhat.com> - 4.7.0-0.5
+- Fix build issues with new Crypto-Policies denying SHA-1 usage
+
+* Tue Jun 30 2020 Dogtag PKI Team <pki-devel@redhat.com> - 4.7.0-0.4
+- Rebase to latest upstream JSS v4.7.0-b4
+
+* Wed Jun 10 2020 Dogtag PKI Team <pki-devel@redhat.com> - 4.7.0-0.2
+- Rebase to latest upstream JSS 4.7.0
+- JSS Provided SSLEngine
+
+* Mon Apr 27 2020 Dogtag PKI Team <pki-devel@redhat.com> - 4.6.4-1
+- Rebase to JSS 4.6.4
+- Fixes memory leak present since v4.6.2
+
+* Thu Mar 5 2020 Dogtag PKI Team <pki-devel@redhat.com> - 4.6.3-1
+- Rebase to JSS 4.6.3
+- Fixes base64 encoding of CSRs
+
+* Wed Mar 04 2020 Dogtag PKI Team <pki-devel@redhat.com> - 4.6.2-4
+- Fix for PBE errors
+
+* Tue Jan 28 2020 Dogtag PKI Team <pki-devel@redhat.com> - 4.6.2-3
+- Rebuild with new NSS to fix rhbz#1794814
+
+* Tue Oct 29 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.6.2-2
+- Fix for rhbz#1766451
+
+* Tue Oct 15 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.6.2-1
+- Rebase to JSS 4.6.2
+- Fixes CVE-2019-14823
+
+* Thu Aug 08 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.6.1-2
+- Disable unnecessary tests to fix broken s390x
+
+* Thu Aug 08 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.6.1-1
+- Rebase to JSS 4.6.1
+
+* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 4.5.3-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Mon May 06 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.5.3-2
+- Add AIA OCSP certificate checking patch
+
+* Tue Mar 19 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.5.3-1
+- Rebase to JSS 4.5.3
+
+* Fri Feb 01 2019 Dogtag PKI Team <pki-devel@redhat.com> - 4.5.2-3
+- Include nuxwdog patch for netscape.security.util.Utils from PKI
+
+* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 4.5.2-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Mon Jan 14 2019 Dogtag PKI Team <pki-devel@redhat.com> 4.5.2-1
+- Rebased to JSS 4.5.2
+
+* Thu Nov 29 2018 Dogtag PKI Team <pki-devel@redhat.com> 4.5.1-1
+- Rebased to JSS 4.5.1
+- Red Hat Bugzilla #1582323 - DER encoding error for enumerated types with a value of zero
+- Red Hat Bugzilla #1534765 - javadoc for org.mozilla.jss.pkix.cms.SignedData.getSignerInfos() is incorrect
+
+* Fri Aug 10 2018 Dogtag PKI Team <pki-devel@redhat.com> 4.5.0-1
+- Rebased to JSS 4.5.0
+
+* Tue Aug 07 2018 Dogtag PKI Team <pki-devel@redhat.com> 4.5.0-0.6
+- Rebased to JSS 4.5.0-b1
+
+* Tue Aug 07 2018 Dogtag PKI Team <pki-devel@redhat.com> 4.5.0-0.5
+- Red Hat Bugzilla #1612063 - Do not override system crypto policy (support TLS 1.3)
+
+* Fri Jul 20 2018 Dogtag PKI Team <pki-devel@redhat.com> 4.5.0-0.4
+- Rebased to JSS 4.5.0-a4
+- Red Hat Bugzilla #1604462 - jss: FTBFS in Fedora rawhide
+
+* Thu Jul 05 2018 Dogtag PKI Team <pki-devel@redhat.com> 4.5.0-0.3
+- Rebased to JSS 4.5.0-a3
+
+* Fri Jun 22 2018 Dogtag PKI Team <pki-devel@redhat.com> 4.5.0-0.2
+- Rebased to JSS 4.5.0-a2
+
+* Fri Jun 15 2018 Dogtag PKI Team <pki-devel@redhat.com> 4.5.0-0.1
+- Rebased to JSS 4.5.0-a1
--- a/1
+++ b/1
@ -0,0 +1 @@
+SHA512 (jss-4.7.3.tar.gz) = 9358cf78d99e5e32a07dd457d6b0c916bdf9bf6959efe889f1cb91af75aa79fc419c2d057a40bfbe4e2a4924bffc1cafa04d917622cafe07062bcb633f330f98
--- a/sources-update.sh
+++ b/sources-update.sh
@ -0,0 +1,7 @@
+#!/bin/sh
+
+SOURCE=$1
+TARGET=`basename $1`
+
+cp $SOURCE $TARGET
+sha512sum --tag $TARGET > sources
				`@ -0,0 +1 @@`
				`SHA512 (jss-4.7.3.tar.gz) = 9358cf78d99e5e32a07dd457d6b0c916bdf9bf6959efe889f1cb91af75aa79fc419c2d057a40bfbe4e2a4924bffc1cafa04d917622cafe07062bcb633f330f98`