CVS commit: pkgsrc/devel/nss

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Sat Dec  6 18:57:05 UTC 2025

Modified Files:
        pkgsrc/devel/nss: Makefile distinfo
Removed Files:
        pkgsrc/devel/nss/patches: patch-nss_coreconf_Darwin.mk

Log Message:
nss: update to 3.119.

Build-tested on Darwin by jperkin, thanks!

Changes:

   - Bug 1983320 - Fix ml-dsa return value for SECKEY_PrivateKeyStrengthInBits.
   - Bug 1986352 - Make sure we don't accept ECH if the HRR cookie is ill-formatted.
   - Bug 2002246 - Add a pkcs12 fuzzer with crypto stubbed out.
   - Bug 2003314 - handle errors while setting sanitizers cflags in build.
   - Bug 1986912 - Ignore IVs for AES KW.
   - Bug 2003286 - Update Cryptofuzz version.
   - Bug 2001932 - Fix incorrect logic for SNI selection when ECH is available but disabled.
   - Bug 1975855 - fix forwarding of sqlite_libs in sqlite.gyp.
   - Bug 1999204 - fix CPU_ARCH setting for arm64 makefile builds.
   - Bug 1998094 - remove unused calcThreads variable from cmd/rsaperf.
   - Bug 1978348 - Solving the incorrect tests introduced by extending EKU.
   - Bug 1972054 - Memory leaks in pkcs12 and pkcs7 decoders.
   - Bug 1978348 - Extending parsing with Microsoft Document Signing EKU.
   - Bug 1978348 - Extending parsing with Adobe Document Signing EKU.
   - Bug 1978348 - Extending pkix parsing with document signing EKUs.
   - Bug 2000737 - fix compilation failure on ia32.
   - Bug 2000737 - use hardware x64 GCM in static builds.
   - Bug 2000737 - separate ppc sha512 library from ppc gcm library.
   - Bug 2000737 - simplify cross-compilation from build.sh.
   - Bug 1724353 - use clang's integrated assembler.
   - Bug 2000737 - remove unused MP_IS_LITTLE_ENDIAN defines.
   - Bug 2000737 - fix logic for disabling altivec in gyp builds.
   - Bug 1964722 - free digest objects in SEC_PKCS7DecoderFinish if they haven't already been freed.
   - Bug 1972825 - Add TLS interoperability tests with openssl and gnutls.
   - Bug 1314849 - Ensure we don't send a DTLS1.3 cookie after DTLS1.2 HelloVerifyRequest.
   - Bug 1965329 - add failure checks to pk11_mergeTrust() .
   - Bug 1999517 - pk11wrap selects incorrect slot for CKM_ML_KEM*.


To generate a diff of this commit:
cvs rdiff -u -r1.285 -r1.286 pkgsrc/devel/nss/Makefile
cvs rdiff -u -r1.199 -r1.200 pkgsrc/devel/nss/distinfo
cvs rdiff -u -r1.3 -r0 pkgsrc/devel/nss/patches/patch-nss_coreconf_Darwin.mk

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/devel/nss/Makefile
diff -u pkgsrc/devel/nss/Makefile:1.285 pkgsrc/devel/nss/Makefile:1.286
--- pkgsrc/devel/nss/Makefile:1.285     Tue Nov 18 15:37:04 2025
+++ pkgsrc/devel/nss/Makefile   Sat Dec  6 18:57:04 2025
@@ -1,10 +1,10 @@
-# $NetBSD: Makefile,v 1.285 2025/11/18 15:37:04 wiz Exp $
+# $NetBSD: Makefile,v 1.286 2025/12/06 18:57:04 wiz Exp $
 #
 # release notes
 # https://firefox-source-docs.mozilla.org/security/nss/releases/index.html
 
 DISTNAME=              nss-${NSS_RELEASE:S/.0$//}
-NSS_RELEASE=           3.118.1
+NSS_RELEASE=           3.119.0
 CATEGORIES=            devel security
 MASTER_SITES=          ${MASTER_SITE_MOZILLA_ALL:=security/nss/releases/NSS_${NSS_DIST_DIR_VERSION:S/_0$//}_RTM/src/}
 
@@ -21,7 +21,7 @@ CTF_SUPPORTED=                no # https://smartos.org
 
 USE_GCC_RUNTIME=       yes
 USE_LANGUAGES=         c
-USE_TOOLS+=            gmake perl pax pkg-config
+USE_TOOLS+=            bash:test gmake perl pax pkg-config
 # Fails to detect jobserver on systems where /bin/make and /bin/gmake both
 # exist. This is because nss uses "gmake" explicitly rather than $MAKE to
 # launch subprocesses.
@@ -139,7 +139,7 @@ MOD_MINOR_VERSION=  ${NSS_RELEASE:S/3.//:
 MOD_PATCH_VERSION=     ${NSS_RELEASE:C/[0-9.]*\.//}
 NSS_DIST_DIR_VERSION=  ${MOD_MAJOR_VERSION}_${MOD_MINOR_VERSION}_${MOD_PATCH_VERSION}
 
-NSPR_MINIMUM_VERSION=  4.37
+NSPR_MINIMUM_VERSION=  4.38
 
 PKGCONFIG_OVERRIDE=    nss.pc
 
@@ -186,6 +186,21 @@ do-install:
        ${INSTALL_PROGRAM} ${WRKSRC}/dist/*_OPT.OBJ/bin/${cmd} ${DESTDIR}${PREFIX}/bin
 .endfor
 
+# needed if host is not in DNS
+#TEST_ENV+=    HOST=localhost DOMSUF=localdomain
+# as of 3.119
+# Tests summary:
+# --------------
+# Passed:             11530
+# Failed:             12
+# Failed with core:   0
+# ASan failures:      0
+# Unknown status:     25
+# TinderboxPrint:Unknown: 25
+
+do-test:
+       cd ${WRKSRC}/nss/tests && ${SETENV} ${TEST_ENV} bash ./all.sh
+
 # For consistency of libxul.so link in www/firefox.
 BUILDLINK_API_DEPENDS.sqlite3+=        sqlite3>=3.8.4.2
 .include "../../databases/sqlite3/buildlink3.mk"

Index: pkgsrc/devel/nss/distinfo
diff -u pkgsrc/devel/nss/distinfo:1.199 pkgsrc/devel/nss/distinfo:1.200
--- pkgsrc/devel/nss/distinfo:1.199     Tue Nov 18 15:37:04 2025
+++ pkgsrc/devel/nss/distinfo   Sat Dec  6 18:57:04 2025
@@ -1,15 +1,14 @@
-$NetBSD: distinfo,v 1.199 2025/11/18 15:37:04 wiz Exp $
+$NetBSD: distinfo,v 1.200 2025/12/06 18:57:04 wiz Exp $
 
-BLAKE2s (nss-3.118.1.tar.gz) = b9768aa9fcaa9da64bab11ccccef6cd5e20369a3df5e60076c4fcfd28d50cf84
-SHA512 (nss-3.118.1.tar.gz) = c031b9e200832689c8c02ac3a8327f4d8c74cb10ad1f5cefb8c6a15a469e910e3ea7bacfa617ce4c46d6e77d5a174b1fac89508c94c96e7888ee1838471ab7cc
-Size (nss-3.118.1.tar.gz) = 77625759 bytes
+BLAKE2s (nss-3.119.tar.gz) = 56dc1611891f25ad7499e8489805996342e740b53541fedaef3f70e2608c73a8
+SHA512 (nss-3.119.tar.gz) = f2dc601bf6070c493e7577f4fc5d329fdefe6b1cd09e88680b39f0cd6181bbfdce4eedb67d5c612a13f7ad1e57c8de81b366b6565f9353442b4443e041df26b3
+Size (nss-3.119.tar.gz) = 77633205 bytes
 SHA1 (patch-md) = 8547c9414332c02221b96719dea1e09cb741f4d1
 SHA1 (patch-me) = ffb5f119764c158c0bd789bd18fc77c61f2e9d2b
 SHA1 (patch-mf) = 40e58385fb6f944f463bf00b9aad72bc4ea229d0
 SHA1 (patch-mn) = 5b79783e48249044be1a904a6cfd20ba175b5fd4
 SHA1 (patch-nss_cmd_platlibs.mk) = 01f4350de601b29c94e8a791a28daca226866bb6
 SHA1 (patch-nss_cmd_shlibsign_sign.sh) = 7948b7b502a4c148ee185836dde8a84d3aa388af
-SHA1 (patch-nss_coreconf_Darwin.mk) = 5f40bb2733b88b26a40c5317d1b5edc762dfd18b
 SHA1 (patch-nss_coreconf_OpenBSD.mk) = 944f71fcaaa7d5b2b3ed008341b1392a65480f2b
 SHA1 (patch-nss_coreconf_command.mk) = a7b682d367825b48f8802fa30cee83f10680bb74
 SHA1 (patch-nss_coreconf_nsinstall_Makefile) = 69981ba7355a4413111754859ef08cbd5e1bf4f4