diff --git a/.gitignore b/.gitignore index e69de29..349bfb5 100644 --- a/.gitignore +++ b/.gitignore @@ -0,0 +1,32 @@ +# Local build files +jss-*.src.rpm +jss-*/ +x86_64/ +.build-*.log + +# Releases +jss-4.2.6.tar.gz +/jss-4.2.6.tar.gz +/jss-4.4.0.tar.gz +/jss-4.4.1.tar.gz +/jss-4.4.2.tar.gz +/jss-4.4.3.tar.gz +/jss-4.4.4.tar.gz +/jss-4.5.0-a1.tar.gz +/jss-4.5.0-a2.tar.gz +/jss-4.5.0-a3.tar.gz +/jss-4.5.0-a4.tar.gz +/jss-4.5.0-b1.tar.gz +/jss-4.5.0.tar.gz +/jss-4.5.1.tar.gz +/jss-4.5.2.tar.gz +/jss-4.5.3.tar.gz +/jss-4.6.1.tar.gz +/jss-4.6.2.tar.gz +/jss-4.6.3.tar.gz +/jss-4.6.4.tar.gz +/jss-4.7.0-b2.tar.gz +/jss-4.7.0-b4.tar.gz +/jss-4.7.0.tar.gz +/jss-4.7.2.tar.gz +/jss-4.7.3.tar.gz diff --git a/copr-build.sh b/copr-build.sh new file mode 100755 index 0000000..156c705 --- /dev/null +++ b/copr-build.sh @@ -0,0 +1,9 @@ +#!/bin/sh + +REPO=$1 + +if [ "$REPO" == "" ]; then + REPO="pki-10.6" +fi + +fedpkg copr-build --nowait $REPO diff --git a/jss-crypto-policies-1.patch b/jss-crypto-policies-1.patch new file mode 100644 index 0000000..dc23e85 --- /dev/null +++ b/jss-crypto-policies-1.patch @@ -0,0 +1,49 @@ +From 1fb6097a2ab73ef897d011e7383d7f5f1bf6a1df Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Wed, 1 Jul 2020 12:41:20 -0400 +Subject: [PATCH] Replace SHA-1 signature with SHA-256 + +A recent change in Fedora Rawhide's crypto-policies package caused +failures in the tests like the following: + + Exception in thread "main" java.io.IOException: SocketException cannot read on socket: Error reading from socket: (-12271) SSL peer cannot verify your certificate. + at org.mozilla.jss.ssl.SSLSocket.read(SSLSocket.java:1494) + at org.mozilla.jss.ssl.SSLInputStream.read(SSLInputStream.java:38) + at org.mozilla.jss.ssl.SSLInputStream.read(SSLInputStream.java:25) + at org.mozilla.jss.tests.SSLClientAuth.run(SSLClientAuth.java:435) + at java.lang.Thread.run(Thread.java:748) + Caused by: org.mozilla.jss.ssl.SSLSocketException: Error reading from socket: (-12271) SSL peer cannot verify your certificate. + at org.mozilla.jss.ssl.SSLSocket.socketRead(Native Method) + at org.mozilla.jss.ssl.SSLSocket.read(SSLSocket.java:1488) + ... 4 more + Server exiting + org.mozilla.jss.ssl.SSLSocketException: SSL_ForceHandshake failed: (-8016) Unknown error + at org.mozilla.jss.ssl.SSLSocket.forceHandshake(Native Method) + at org.mozilla.jss.tests.SSLClientAuth.testConnection(SSLClientAuth.java:345) + at org.mozilla.jss.tests.SSLClientAuth.doIt(SSLClientAuth.java:156) + at org.mozilla.jss.tests.SSLClientAuth.main(SSLClientAuth.java:90) + +This was caused by dropping SHA-1 as an allowed hash during handshakes. +However, because SSLClientAuth manually generated its certificate (and +explicitly asked for SHA-1), it failed. + +Switch to SHA-256 instead. + +Signed-off-by: Alexander Scheel +--- + org/mozilla/jss/tests/SSLClientAuth.java | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/org/mozilla/jss/tests/SSLClientAuth.java b/org/mozilla/jss/tests/SSLClientAuth.java +index 6f1fd2b12..bf270a634 100644 +--- a/org/mozilla/jss/tests/SSLClientAuth.java ++++ b/org/mozilla/jss/tests/SSLClientAuth.java +@@ -28,7 +28,7 @@ + + private CryptoManager cm; + public static final SignatureAlgorithm sigAlg = +- SignatureAlgorithm.RSASignatureWithSHA1Digest; ++ SignatureAlgorithm.RSASignatureWithSHA256Digest; + + /** + * Method that generates a certificate for given credential diff --git a/jss-crypto-policies-2.patch b/jss-crypto-policies-2.patch new file mode 100644 index 0000000..71fe8c2 --- /dev/null +++ b/jss-crypto-policies-2.patch @@ -0,0 +1,47 @@ +From 8ed5a82a973922d07d0610fd42c48b2a0ec97d6c Mon Sep 17 00:00:00 2001 +From: Alexander Scheel +Date: Wed, 1 Jul 2020 12:44:53 -0400 +Subject: [PATCH] Remove all legacy DSS/DSA tests + +The only signature algorithm suppoted with DSS is SHA-1, which will soon +become deprecated and broken. DSS itself isn't widely used either, so we +should remove it from the test suite as well. + +Signed-off-by: Alexander Scheel +--- + cmake/JSSTests.cmake | 12 +----------- + 1 file changed, 1 insertion(+), 11 deletions(-) + +diff --git a/cmake/JSSTests.cmake b/cmake/JSSTests.cmake +index a26b95425..a0fe36e22 100644 +--- a/cmake/JSSTests.cmake ++++ b/cmake/JSSTests.cmake +@@ -170,11 +170,6 @@ macro(jss_tests) + COMMAND "org.mozilla.jss.tests.GenerateTestCert" "${RESULTS_NSSDB_OUTPUT_DIR}" "${PASSWORD_FILE}" "30" "localhost" "SHA-256/EC" "CA_ECDSA" "Server_ECDSA" "Client_ECDSA" + DEPENDS "Generate_known_RSA_cert_pair" + ) +- jss_test_java( +- NAME "Generate_known_DSS_cert_pair" +- COMMAND "org.mozilla.jss.tests.GenerateTestCert" "${RESULTS_NSSDB_OUTPUT_DIR}" "${PASSWORD_FILE}" "40" "localhost" "SHA-1/DSA" "CA_DSS" "Server_DSS" "Client_DSS" +- DEPENDS "Generate_known_ECDSA_cert_pair" +- ) + jss_test_exec( + NAME "Create_PKCS11_cert_to_PKCS12_rsa.pfx" + COMMAND "pk12util" "-o" "${RESULTS_NSSDB_OUTPUT_DIR}/rsa.pfx" "-n" "CA_RSA" "-d" "${RESULTS_NSSDB_OUTPUT_DIR}" "-K" "${DB_PWD}" "-W" "${DB_PWD}" +@@ -185,15 +180,10 @@ macro(jss_tests) + COMMAND "pk12util" "-o" "${RESULTS_NSSDB_OUTPUT_DIR}/ecdsa.pfx" "-n" "CA_ECDSA" "-d" "${RESULTS_NSSDB_OUTPUT_DIR}" "-K" "${DB_PWD}" "-W" "${DB_PWD}" + DEPENDS "Generate_known_ECDSA_cert_pair" + ) +- jss_test_exec( +- NAME "Create_PKCS11_cert_to_PKCS12_dss.pfx" +- COMMAND "pk12util" "-o" "${RESULTS_NSSDB_OUTPUT_DIR}/dss.pfx" "-n" "CA_DSS" "-d" "${RESULTS_NSSDB_OUTPUT_DIR}" "-K" "${DB_PWD}" "-W" "${DB_PWD}" +- DEPENDS "Generate_known_DSS_cert_pair" +- ) + jss_test_java( + NAME "List_CA_certs" + COMMAND "org.mozilla.jss.tests.ListCACerts" "${RESULTS_NSSDB_OUTPUT_DIR}" "Verbose" +- DEPENDS "Generate_known_DSS_cert_pair" ++ DEPENDS "Generate_known_ECDSA_cert_pair" + ) + jss_test_java( + NAME "SSLClientAuth" diff --git a/jss.spec b/jss.spec new file mode 100644 index 0000000..401fe38 --- /dev/null +++ b/jss.spec @@ -0,0 +1,275 @@ +################################################################################ +Name: jss +################################################################################ + +Summary: Java Security Services (JSS) +URL: http://www.dogtagpki.org/wiki/JSS +License: MPLv1.1 or GPLv2+ or LGPLv2+ + +Version: 4.7.3 +Release: 1%{?_timestamp}%{?_commit_id}%{?dist} +#global _phase -a1 + +# To generate the source tarball: +# $ git clone https://github.com/dogtagpki/jss.git +# $ cd jss +# $ git tag v4.5. +# $ git push origin v4.5. +# Then go to https://github.com/dogtagpki/jss/releases and download the source +# tarball. +Source: https://github.com/dogtagpki/%{name}/archive/v%{version}%{?_phase}/%{name}-%{version}%{?_phase}.tar.gz + +# To create a patch for all changes since a version tag: +# $ git format-patch \ +# --stdout \ +# \ +# > jss-VERSION-RELEASE.patch +# Patch: jss-VERSION-RELEASE.patch + +################################################################################ +# Build Dependencies +################################################################################ + +# autosetup +BuildRequires: git +BuildRequires: make +BuildRequires: cmake +BuildRequires: zip +BuildRequires: unzip + +BuildRequires: gcc-c++ +BuildRequires: nspr-devel >= 4.13.1 +BuildRequires: nss-devel >= 3.44 +BuildRequires: nss-tools >= 3.44 +BuildRequires: java-devel +BuildRequires: jpackage-utils +BuildRequires: slf4j +BuildRequires: glassfish-jaxb-api +%if 0%{?rhel} && 0%{?rhel} <= 7 +# no slf4j-jdk14 +%else +BuildRequires: slf4j-jdk14 +%endif +BuildRequires: apache-commons-lang + +BuildRequires: junit + +Requires: nss >= 3.44 +Requires: java-headless +Requires: jpackage-utils +Requires: slf4j +Requires: glassfish-jaxb-api +%if 0%{?rhel} && 0%{?rhel} <= 7 +# no slf4j-jdk14 +%else +Requires: slf4j-jdk14 +%endif +Requires: apache-commons-lang + +Conflicts: ldapjdk < 4.20 +Conflicts: idm-console-framework < 1.2 +Conflicts: tomcatjss < 7.3.4 +Conflicts: pki-base < 10.6.5 + +%description +Java Security Services (JSS) is a java native interface which provides a bridge +for java-based applications to use native Network Security Services (NSS). +This only works with gcj. Other JREs require that JCE providers be signed. + +################################################################################ +%package javadoc +################################################################################ + +Summary: Java Security Services (JSS) Javadocs +Requires: jss = %{version}-%{release} + +%description javadoc +This package contains the API documentation for JSS. + +################################################################################ +%prep + +%autosetup -n %{name}-%{version}%{?_phase} -p 1 -S git + +################################################################################ +%build + +%set_build_flags + +[ -z "$JAVA_HOME" ] && export JAVA_HOME=%{_jvmdir}/java + +# Enable compiler optimizations +export BUILD_OPT=1 + +# Generate symbolic info for debuggers +CFLAGS="-g $RPM_OPT_FLAGS" +export CFLAGS + +# Check if we're in FIPS mode +modutil -dbdir /etc/pki/nssdb -chkfips true | grep -q enabled && export FIPS_ENABLED=1 + +# RHEL's CMake doesn't support -B flag. +%if 0%{?rhel} +%{__mkdir_p} %{_vpath_builddir} +cd %{_vpath_builddir} +%endif + +# The Makefile is not thread-safe +%cmake \ + -DJAVA_HOME=%{java_home} \ + -DJAVA_LIB_INSTALL_DIR=%{_jnidir} \ +%if 0%{?rhel} + .. +%else + -B %{_vpath_builddir} +%endif + +%if 0%{?fedora} +cd %{_vpath_builddir} +%endif + +%{__make} all +%{__make} javadoc +ctest --output-on-failure + +################################################################################ +%install + +# There is no install target so we'll do it by hand + +# jars +install -d -m 0755 $RPM_BUILD_ROOT%{_jnidir} +install -m 644 %{_vpath_builddir}/jss4.jar ${RPM_BUILD_ROOT}%{_jnidir}/jss4.jar + +# We have to use the name libjss4.so because this is dynamically +# loaded by the jar file. +install -d -m 0755 $RPM_BUILD_ROOT%{_libdir}/jss +install -m 0755 %{_vpath_builddir}/libjss4.so ${RPM_BUILD_ROOT}%{_libdir}/jss/ +pushd ${RPM_BUILD_ROOT}%{_libdir}/jss + ln -fs %{_jnidir}/jss4.jar jss4.jar +popd + +# javadoc +install -d -m 0755 $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} +cp -rp %{_vpath_builddir}/docs/* $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} +cp -p jss.html $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} +cp -p *.txt $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{version} + +# No ldconfig is required since this library is loaded by Java itself. +################################################################################ +%files + +%defattr(-,root,root,-) +%doc jss.html +%license MPL-1.1.txt gpl.txt lgpl.txt +%{_libdir}/* +%{_jnidir}/* + +################################################################################ +%files javadoc + +%defattr(-,root,root,-) +%{_javadocdir}/%{name}-%{version}/ + +################################################################################ +%changelog +* Fri Sep 11 2020 Dogtag PKI Team - 4.7.3-1 +- Rebase to upstream stable release JSS v4.7.3 + +* Tue Aug 18 2020 Dogtag PKI Team - 4.7.2-1 +- Rebase to upstream stable release JSS v4.7.2 ; fixes FTBFS + +* Sat Aug 01 2020 Fedora Release Engineering - 4.7.0-4 +- Second attempt - Rebuilt for + https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Tue Jul 28 2020 Fedora Release Engineering - 4.7.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Fri Jul 10 2020 Jiri Vanek - 4.7.0-2 +- Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 + +* Thu Jul 09 2020 Dogtag PKI Team - 4.7.0-1 +- Rebase to upstream stable release JSS v4.7.0 + +* Mon Jul 06 2020 Dogtag PKI Team - 4.7.0-0.5 +- Fix build issues with new Crypto-Policies denying SHA-1 usage + +* Tue Jun 30 2020 Dogtag PKI Team - 4.7.0-0.4 +- Rebase to latest upstream JSS v4.7.0-b4 + +* Wed Jun 10 2020 Dogtag PKI Team - 4.7.0-0.2 +- Rebase to latest upstream JSS 4.7.0 +- JSS Provided SSLEngine + +* Mon Apr 27 2020 Dogtag PKI Team - 4.6.4-1 +- Rebase to JSS 4.6.4 +- Fixes memory leak present since v4.6.2 + +* Thu Mar 5 2020 Dogtag PKI Team - 4.6.3-1 +- Rebase to JSS 4.6.3 +- Fixes base64 encoding of CSRs + +* Wed Mar 04 2020 Dogtag PKI Team - 4.6.2-4 +- Fix for PBE errors + +* Tue Jan 28 2020 Dogtag PKI Team - 4.6.2-3 +- Rebuild with new NSS to fix rhbz#1794814 + +* Tue Oct 29 2019 Dogtag PKI Team - 4.6.2-2 +- Fix for rhbz#1766451 + +* Tue Oct 15 2019 Dogtag PKI Team - 4.6.2-1 +- Rebase to JSS 4.6.2 +- Fixes CVE-2019-14823 + +* Thu Aug 08 2019 Dogtag PKI Team - 4.6.1-2 +- Disable unnecessary tests to fix broken s390x + +* Thu Aug 08 2019 Dogtag PKI Team - 4.6.1-1 +- Rebase to JSS 4.6.1 + +* Thu Jul 25 2019 Fedora Release Engineering - 4.5.3-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Mon May 06 2019 Dogtag PKI Team - 4.5.3-2 +- Add AIA OCSP certificate checking patch + +* Tue Mar 19 2019 Dogtag PKI Team - 4.5.3-1 +- Rebase to JSS 4.5.3 + +* Fri Feb 01 2019 Dogtag PKI Team - 4.5.2-3 +- Include nuxwdog patch for netscape.security.util.Utils from PKI + +* Fri Feb 01 2019 Fedora Release Engineering - 4.5.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Mon Jan 14 2019 Dogtag PKI Team 4.5.2-1 +- Rebased to JSS 4.5.2 + +* Thu Nov 29 2018 Dogtag PKI Team 4.5.1-1 +- Rebased to JSS 4.5.1 +- Red Hat Bugzilla #1582323 - DER encoding error for enumerated types with a value of zero +- Red Hat Bugzilla #1534765 - javadoc for org.mozilla.jss.pkix.cms.SignedData.getSignerInfos() is incorrect + +* Fri Aug 10 2018 Dogtag PKI Team 4.5.0-1 +- Rebased to JSS 4.5.0 + +* Tue Aug 07 2018 Dogtag PKI Team 4.5.0-0.6 +- Rebased to JSS 4.5.0-b1 + +* Tue Aug 07 2018 Dogtag PKI Team 4.5.0-0.5 +- Red Hat Bugzilla #1612063 - Do not override system crypto policy (support TLS 1.3) + +* Fri Jul 20 2018 Dogtag PKI Team 4.5.0-0.4 +- Rebased to JSS 4.5.0-a4 +- Red Hat Bugzilla #1604462 - jss: FTBFS in Fedora rawhide + +* Thu Jul 05 2018 Dogtag PKI Team 4.5.0-0.3 +- Rebased to JSS 4.5.0-a3 + +* Fri Jun 22 2018 Dogtag PKI Team 4.5.0-0.2 +- Rebased to JSS 4.5.0-a2 + +* Fri Jun 15 2018 Dogtag PKI Team 4.5.0-0.1 +- Rebased to JSS 4.5.0-a1 diff --git a/sources b/sources new file mode 100644 index 0000000..13d43e8 --- /dev/null +++ b/sources @@ -0,0 +1 @@ +SHA512 (jss-4.7.3.tar.gz) = 9358cf78d99e5e32a07dd457d6b0c916bdf9bf6959efe889f1cb91af75aa79fc419c2d057a40bfbe4e2a4924bffc1cafa04d917622cafe07062bcb633f330f98 diff --git a/sources-update.sh b/sources-update.sh new file mode 100755 index 0000000..96129ca --- /dev/null +++ b/sources-update.sh @@ -0,0 +1,7 @@ +#!/bin/sh + +SOURCE=$1 +TARGET=`basename $1` + +cp $SOURCE $TARGET +sha512sum --tag $TARGET > sources