CVS commit: pkgsrc/devel/nss

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Wed Mar 25 22:48:10 UTC 2026

Modified Files:
        pkgsrc/devel/nss: Makefile distinfo
        pkgsrc/devel/nss/patches: patch-me

Log Message:
nss: update to 3.122.0.

   - Bug 2023209 - ensure permittedSubtrees don't match wildcards that could be outside the permitted tree.
   - Bug 2023664 - run mach doc-lint from generate_release_doc.py.
   - Bug 2023207 - Fix integer underflow in tls13_AEAD when ciphertext is shorter than tag.
   - Bug 2020614 - tls13_CopyEchConfigs uses PR_LIST_TAIL instead of loop variable.
   - Bug 2021911 - fix cipher spec count intermittent CI failures.
   - Bug 2021913 - fix Mlkem768x25519ShareDamager intermittent CI failures.
   - Bug 2023437 - lint the legacy documentation.
   - Bug 2023437 - lint the NSS 3.112.3 release notes.
   - Bug 2023437 - add a doc-lint CI job.
   - Bug 2020224 - Add more useful coverage reports to CI and fail if new commit isn't tested.
   - Bug 1472747 - wrong alert for malformed TLS 1.3 Finished.
   - Bug 1916429 - Swap order of asserts and state check.
   - Bug 2022149 - set correct value of unused curve parameters in tls13_HandleKeyShare.
   - Bug 2017929 - GCM needs to check for various limits in FIPS mode.
   - Bug 2017938 - Get Key Length not working from ED and Montgomery keys.
   - Bug 2017927 - Not all ike modes are FIPS approved. Adjust the indicators when they aren't.
   - Bug 2020721 - fix intermittent ssl.sh test failures on windows runners.
   - Bug 2017918 - FIPS indicators on HKDF needs to be restricted to TLS usage.
   - Bug 2017920 - Generate keys not getting indicators.
   - Bug 2020612 - improve error handling in smime_init_once.
   - Bug 1987288 - Detect CPU features on OpenBSD using elf_aux_info.
   - Bug 2019357 - RSA_EMSAEncodePSS should validate the length of mHash.
   - Bug 2020442 - more robustly distinguish SFTKSessionObject and SFTKTokenObjects.
   - Bug 2019194 - fix missing .S file error in Solaris Makefile builds.
   - Bug 2020486 - fix memory leak in NSC_GenerateKey error path.
   - Bug 2020615 - Missing SECFailure return after FATAL_ERROR in tls13_HandleEncryptedExtensions.
   - Bug 2020613 - release xmit buf lock on dtls13_MaybeSendKeyUpdate error paths.
   - Bug 2020849 - release 1stHandshakeLock on SSL_ResetHandshake error path.
   - Bug 2020188 - avoid null deref in mp_div_d sign normalization.
   - Bug 2017945 - Temp private key lifecycle is broken.
   - Bug 1851073 - protect rwSessionCount with slotLock.
   - Bug 2019224 - Remove invalid PORT_Free().
   - Bug 1828713 - Fix intermittent ClientGreaseKeyShare test failure.
   - Bug 2018200 - Fix kCtxStr len passed to tls_SignOrVerifyUpdate.
   - Bug 2019760 - patch upstream acvp-rust during checkout to avoid build failures.
   - Bug 2019760 - update acvp Dockerfile.
   - Bug 2017997 - CKA_PARAM_SET missing from the CK_ULONG list in softoken.
   - Bug 2018000 - CKA_SEED missing from isPrivate in the database.
   - Bug 2019717 - update abicheck expectation for __nss_InitLock.
   - Bug 2019327 - taskcluster: set NSS_DISABLE_LIBPKIX=1 in test env for static builds.
   - Bug 2019327 - tests: fix setup_policy to use ROOTCERTSFILE for root cert module path.
   - Bug 2019327 - tests: fix selfserv/httpserv PID handling and wait exit code for MSYS_NT.
   - Bug 2019327 - tests: add native_path helper for cross-platform path conversion.
   - Bug 2019327 - tstclnt, strsclnt: avoid DNS lookup for loopback addresses on Windows.
   - Bug 2019090 - avoid platform GCM for x64 iOS emulator builds.
   - Bug 2012002 - remove lock instrumentation feature.
   - Bug 2017923 - Move FIPS indicator structures out of fips_algorithms.h.
   - Bug 2018064 - all.sh is failing in FIPS SSL test in main tree.
   - Bug 1975973 - fix memory leaks in crmf tests.
   - Bug 2012547 - fix unsatisfiable condition in lg_getTrust.
   - Bug 2006218 - allow selfserv makefile build to use system zlib.
   - Bug 2002247 - Add allocation limit to pkcs12 decoding.
   - Bug 2012406 - Add text/html single-line example emails to NSS S/SMIME CMS tests.


To generate a diff of this commit:
cvs rdiff -u -r1.291 -r1.292 pkgsrc/devel/nss/Makefile
cvs rdiff -u -r1.206 -r1.207 pkgsrc/devel/nss/distinfo
cvs rdiff -u -r1.10 -r1.11 pkgsrc/devel/nss/patches/patch-me

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/devel/nss/Makefile
diff -u pkgsrc/devel/nss/Makefile:1.291 pkgsrc/devel/nss/Makefile:1.292
--- pkgsrc/devel/nss/Makefile:1.291     Mon Feb 23 22:49:38 2026
+++ pkgsrc/devel/nss/Makefile   Wed Mar 25 22:48:10 2026
@@ -1,10 +1,10 @@
-# $NetBSD: Makefile,v 1.291 2026/02/23 22:49:38 wiz Exp $
+# $NetBSD: Makefile,v 1.292 2026/03/25 22:48:10 wiz Exp $
 #
 # release notes
 # https://firefox-source-docs.mozilla.org/security/nss/releases/index.html
 
 DISTNAME=              nss-${NSS_RELEASE:S/.0$//}
-NSS_RELEASE=           3.121.0
+NSS_RELEASE=           3.122.0
 PKGNAME=               nss-${NSS_RELEASE}
 CATEGORIES=            devel security
 MASTER_SITES=          ${MASTER_SITE_MOZILLA_ALL:=security/nss/releases/NSS_${NSS_DIST_DIR_VERSION:S/_0$//}_RTM/src/}

Index: pkgsrc/devel/nss/distinfo
diff -u pkgsrc/devel/nss/distinfo:1.206 pkgsrc/devel/nss/distinfo:1.207
--- pkgsrc/devel/nss/distinfo:1.206     Wed Feb 25 21:35:03 2026
+++ pkgsrc/devel/nss/distinfo   Wed Mar 25 22:48:10 2026
@@ -1,10 +1,10 @@
-$NetBSD: distinfo,v 1.206 2026/02/25 21:35:03 wiz Exp $
+$NetBSD: distinfo,v 1.207 2026/03/25 22:48:10 wiz Exp $
 
-BLAKE2s (nss-3.121.tar.gz) = abfcfe489335a3240df9b3dfb3663bf4681893fdeb7ec4751fb1ccd029737661
-SHA512 (nss-3.121.tar.gz) = 799cfb07bb806d3ab2786f7f1e88aa20ad490a0021a931b9382c08b08b6e6728367768335b05e15229f134275ee27ff153afaad78f07b394ef4c0b0e554e130c
-Size (nss-3.121.tar.gz) = 77644546 bytes
+BLAKE2s (nss-3.122.tar.gz) = ed27290da154b71dd6c6a9598031d763881eb0e002d12428e6a83296d23b5093
+SHA512 (nss-3.122.tar.gz) = 53847c2de0e4608b387d5688ecf005a2a78da67408bda31f522539306816e25580d6046656cd5bb7fb9642feb625a904a17d3102573be96a9fd8b46e14037ff7
+Size (nss-3.122.tar.gz) = 77654239 bytes
 SHA1 (patch-md) = ebc903bb19456bfa111fad3c101e3f18168b43b3
-SHA1 (patch-me) = 518044ccba92c0792fc4518c0c6c98d56f7e7c40
+SHA1 (patch-me) = 30aa8b8e22bb687b9c71da40ea9e76b56885d1f8
 SHA1 (patch-mf) = 40e58385fb6f944f463bf00b9aad72bc4ea229d0
 SHA1 (patch-mn) = 5b79783e48249044be1a904a6cfd20ba175b5fd4
 SHA1 (patch-nss_cmd_platlibs.mk) = 01f4350de601b29c94e8a791a28daca226866bb6

Index: pkgsrc/devel/nss/patches/patch-me
diff -u pkgsrc/devel/nss/patches/patch-me:1.10 pkgsrc/devel/nss/patches/patch-me:1.11
--- pkgsrc/devel/nss/patches/patch-me:1.10      Wed Feb 25 21:35:03 2026
+++ pkgsrc/devel/nss/patches/patch-me   Wed Mar 25 22:48:10 2026
@@ -1,10 +1,7 @@
-$NetBSD: patch-me,v 1.10 2026/02/25 21:35:03 wiz Exp $
+$NetBSD: patch-me,v 1.11 2026/03/25 22:48:10 wiz Exp $
 
 clang for SunOS(?)
 
-Try using preprocessed assembler file
-https://bugzilla.mozilla.org/show_bug.cgi?id=2019194
-
 --- nss/lib/freebl/Makefile.orig       2026-02-19 09:30:44.000000000 +0000
 +++ nss/lib/freebl/Makefile
 @@ -508,7 +508,11 @@ else
@@ -19,12 +16,3 @@ https://bugzilla.mozilla.org/show_bug.cg
      endif
      ifeq ($(USE_64),1)
        # Solaris for AMD64
-@@ -517,7 +521,7 @@ else
-           ASFLAGS += -march=opteron -m64 -fPIC
-           MPI_SRCS += mp_comba.c
-           # comment the next four lines to turn off Intel HW acceleration
--          ASFILES += intel-gcm.S
-+          ASFILES += intel-gcm.s
-           EXTRA_SRCS += intel-gcm-wrap.c
-           DEFINES += -DHAVE_PLATFORM_GCM
-           INTEL_GCM = 1