CVS commit: pkgsrc/devel/nss

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Tue Jul 21 16:40:52 UTC 2026

Modified Files:
        pkgsrc/devel/nss: Makefile distinfo

Log Message:
nss: update to 3.126.

Required by firefox 153.

Changes in NSS 3.126

    Bug 2054731 - reject resumption tokens where wrapped_master_secret_len is too long.
    Bug 2054723 - harden against integer overflows in lowpbe.c.
    Bug 2054697 - fix AES GCM parameter serialization in pk11_GetPBECryptoMechanism.
    Bug 2054695 - handle HMAC truncation when using PK11_Digest* APIs.
    Bug 1329766 - Enable DTLS in BoGo tests.
    Bug 2054616 - reject short ciphertexts in sec_pkcs5_rc2.
    Bug 2027350 - rewrite PK11_SaveContext in terms of PK11_SaveContextAlloc.
    Bug 2050034 - reject long OCSP responses in libpkix http client.
    Bug 2047783 - Set nssckbi version to 2.90.
    Bug 2052097 - remove ePKI Root Certification Authority.
    Bug 2047804 - add Telia v3 Roots.
    Bug 2047800 - add SECOM 2024 Roots.
    Bug 2017374 - remove websites trust bit from Atos TrustedRoot 2011.
    Bug 2039251 - clang format.
    Bug 2052288 - clang format.
    Bug 2053436 - Fix session reference leak in NSC_GetOperationState error paths.
    Bug 2039251 - Use ProcessPrng in RNG_SystemRNG in freebl on Windows.
    Bug 2052650 - Speed up DTLS timers.
    Bug 2053075 - Only use lower PBE iteration count limit in fuzzing builds.
    Bug 2052442 - Update git support for mach clang-format.
    Bug 2052442 - run black over mach.
    Bug 2052437 - Include keythi.h to avoid warning.
    Bug 2029410 - Bound CCM ulMACLen and GCM ulTagBits in pk11_AEADSimulateOp to prevent taglen overflow.
    Bug 2029406 - Validate CKM_AES_CBC_PAD mechanism parameter length in sftk_CryptInit.
    Bug 2019001 - update abicheck expectations.
    Bug 2042337 - Use aarch64 implementation of AES-GCM from AWS-LC.
    Bug 2051752 - add a CI job that runs gtests without hardware crypto support.
    Bug 2051995 - add a faster PORT_SafeZero fallback.
    Bug 2051939 - null check extension array in tls13_CheckCertDelegationUsage.
    Bug 2051754 - update wycheproof AES-GCM test vectors.
    Bug 2027311 - clang format.
    Bug 2052288 - clear greaseEchBuf after constructing HRR.
    Bug 2029321 - validate params length before len-2 subtraction in SECKEY_GetECCOid.
    Bug 2015247 - Fix leak in CERT_EnableOCSPDefaultResponder.
    Bug 2015247 - Fix infinite recursion in FC_AsyncJoin.
    Bug 2015247 - Fix leak of public key in PK11_GenerateKeyPairWithOpFlags.
    Bug 2015247 - Fix leak in jpake_Round2Base.
    Bug 2019001 - add support for ML-KEM-1024 named group.
    Bug 2029750 - Reject undersized IV and key SECItems in PBES2 cipher dispatchers.
    Bug 2027311 - Add defensive checks on generic MECHANISM_PARAM.
    Bug 2029438 - Stop serializing SHA-256 dispatch function pointers in Flatten/Resurrect.
    Bug 2029434 - Reject overflowing quantities in nss_ZNEWARRAY and nss_ZREALLOCARRAY.
    Bug 2029437 - Expand 2-key 3DES key from 16 to 24 bytes (K1||K2||K1) before DES_InitContext.
    Bug 2029701 - Reject mechanism param vs CKA_VALUE_LEN inconsistency in NSC_DeriveKey before indexing key_block.
    Bug 2029763 - Mirror nssCKFWSession_CopyObject sizing loop on the population loop’s iteration order.
    Bug 2051735 - copy correct param string in secmod_MkAppendTokensList.
    Bug 2029816 - remove support for parsing cert comment strings.
    Bug 2051967 - update abicheck expectation.
    Bug 2029779 - Add overflow check to kbkdf_IncrementBuffer and propagate failure to both callers.
    Bug 2027380 - pass offset-adjusted pointer to SEC_ASN1GetSubtemplate in QuickDER call sites.
    Bug 2027375 - account for primitive payload bytes in DER_INDEFINITE contents_length.
    Bug 2027351 - reserve trailing length prefix bytes in PK11_HPKE_ImportContext bounds checks.
    Bug 2027374 - bounds check multibyte DER length in der_capture and der_indefinite_length.
    Bug 2029289 - fix off-by-one offset in pk11_buildNickname cert_id branch.
    Bug 2046579 - fix new ubsan warnings after clang upgrade.
    Bug 2046579 - update tlsfuzzer.
    Bug 2046579 - update tlsinterop.
    Bug 2046579 - upgrade docker images to ubuntu noble.
    Bug 2046579 - rework ci build platform names and aliases.
    Bug 2046579 - extend NSS CI with linux arm64 workers.
    Bug 2050958 - add defensive hash length check in emsa_pss_verify.
    Bug 2029794 - handle NSSCertificate identity changing in __CERT_AddTempCertToPerm.
    Bug 2027388 - add defensive check on pk11_HandUnwrap key size.
    Bug 2049435 - CID 1694497 - a resource leak in sftk_CryptInit() in lib/softoken/pkcs11c.c.
    Bug 2037078 - Implement CMS AuthEnvelopedData decryption (RFC 5083/5084).
    Bug 2046136 - Add a few sanity checks in CMS decoder.
    Bug 2047310 - add PK11_CreatePrivateKeyFromTemplate.
    Bug 2047771 - fix more pre-existing session object leaks.
    Bug 2047771 - avoid leaking session object in PK11_UnwrapPrivKey.
    Bug 2047771 - check for session object leaks in NSS_STRICT_SHUTDOWN mode.
    Bug 2044460 - Change smime_gtest make build to link smime library statically.
    Bug 2046371 - Add test for server rejecting client CertificateRequest.
    Bug 2046371 - Reject TLS 1.3 handshake messages received in the wrong endpoint role.
    Bug 2047218 - bundle NSPR 4.39 with source distribution.

Changes in NSS 3.125

    Bug 2031345 - Set nssckbi version to 2.88.
    Bug 2032612 - Add Cybertrust Japan SecureSign Root CA16.
    Bug 2031314 - Remove Email Trust bit from TrustAsia Global Root CA G3 and G4.
    Bug 2032223 - Remove Entrust Root Certification Authority.
    Bug 2031105 - Remove SecureSign Root CA12.
    Bug 1867436 - Initialize ssl3.hs.echOuterExtensions in ssl_NewSocket.
    Bug 2046220 - replace references to nss-dev/nss with mozilla/nss.
    Bug 2023208 - limit recursion depth in CMS decoder.
    Bug 2027353 - clamp input.len to testString size in pk11_mergeSecretKey.
    Bug 2030561 - NULL pointer dereference in CERT_MergeExtensions.
    Bug 2028954 - CERT_DecodeAVAValue — Integer Overflow in Output Buffer Sizing.
    Bug 2032110 - fix two integer overflows on LLP64 systems.
    Bug 2045688 - Modify an assertion in ssl3_ClientSendAppProtoXtn.
    Bug 2044917 - Import RSA-PSS PKCS#8 private keys.
    Bug 2035521 - Add EC Derive fuzz target.
    Bug 2035522 - Update fuzz/config/tstclnt_arguments.py.
    Bug 2030915 - Add DSAU fuzz target.
    Bug 2031320 - Update ASN1 mutators for fuzzing.
    Bug 2031319 - Update TLS mutators for fuzzing.
    Bug 2031325 - Update TLS certs for fuzzing.
    Bug 2031322 - Update TLS config for fuzzing.
    Bug 2035502 - Extend QuickDER fuzz target.
    Bug 2035501 - Extend PKCS12 fuzz target.
    Bug 2035499 - Extend PKCS8 fuzz target.
    Bug 2031792 - Extend certDN fuzz target.
    Bug 2031790 - Update ASN1 fuzz target.
    Bug 2031323 - Extend PKCS7 fuzz target.
    Bug 2029433 - Bounds-check wrap index in PK11_GetWrapKey to match PK11_SetWrapKey.
    Bug 2029407 - Adding a guard against integer overflow in AESKeyWrap_EncryptKWP.
    Bug 2027376 - Add an integer overflow guard in UpdateBase64Decoder.
    Bug 2032552 - Void out the fd.release in reconfig tests.
    Bug 2029922 - make sftk_FindAttribute return a copy.
    Bug 1652123 - Converted nss parameter schema from voluptuous to msgspec.
    Bug 311577 - drop slot monitor in PK11_ResetToken before calling PK11_InitToken.
    Bug 2042949 - adjust the code to use nspr from github.
    Bug 1885900 - avoid deadlock when PK11_IsLoggedIn is called from PK11_DoPassword.
    Bug 2044134 - test pk11auth.c functions with a non-threadsafe module.
    Bug 311577 - PK11_InitPin sets slot->lastLoginCheck without holding the slot monitor.
    Bug 2027349 - reject empty nickname in PK11_TraverseCertsForNicknameInSlot.
    Bug 2027346 - validate encoded EC params length and tag in SECKEY_ECParamsToKeySize/BasePointOrderLen.
    Bug 2027373 - guard space subtraction in ssl_CallCustomExtensionSenders.
    Bug 2027371 - rewrite labelLen bound in tls13_HkdfExpandLabelGeneral to avoid unsigned overflow.
    Bug 2027362 - bound usageCount in PK11_UnwrapPrivKey to keyTemplate capacity.
    Bug 2027364 - Set tail pointer to null in static slot lists when deallocating.
    Bug 2030102 - avoid leaving a dangling ss->sec.ci.sid on allocation failure.
    Bug 2043887 - guard against integer overflow in CERT_Hexify.
    Bug 2029453 - Reject empty SECItem inputs in sftk_IsSafePrime before indexing data[len-1].
    Bug 2029757 - NUL-terminate within filename field in jar_listtar to bound the filename scan.
    Bug 2029748 - Widen CERT_FormatName length accumulator from unsigned to size_t.
    Bug 2029796 - Bound IKE PRF nonce lengths to prevent CK_ULONG to unsigned int truncation.
    Bug 2029797 - Drop companion arrays on length mismatch in NSS_CMSArray_Sort instead of asserting.
    Bug 2029798 - Operate on a NUL-terminated copy in jar_parse_any to keep manifest scans bounded.
    Bug 2029778 - Reject MD2 contexts with unusedBuffer > MD2_BUFSIZE in Update and End.
    Bug 2029791 - Reserve NUL terminator for CKA_NSS_URL in nssCKObject_GetAttributes.
    Bug 2029807 - Guard padding read against empty output in SEC_PKCS7DecryptContents.
    Bug 2029901 - Guard against keySize overflow in IKE PRF/PRF+ output sizing.
    Bug 2030109 - Allocate values array when overwriting an empty CMS attribute.
    Bug 2030559 - Validate CKA_TOKEN attribute size in nssCKFWObject_SetAttribute.
    Bug 2030563 - Validate CKA_CERTIFICATE_TYPE ulValueLen in nss_cert_type_from_ck_attrib.
    Bug 2030566 - Handle zero-length input in PrepareBitStringForEncoding.
    Bug 2030571 - Length-check raw_manifest before PORT_Strncasecmp prefix dispatch in JAR_parse_manifest.
    Bug 2031902 - Reject CKA_NSS_MODULE_SPEC values that aren’t NUL-terminated within ulValueLen.
    Bug 2031903 - Reject negative PR_Read returns in JAR_digest_file and jar_create_pk7.
    Bug 2041240 - Update Bogo tests to 3fff7111b0eca817466e121059cb4e8b67ade35b.
    Bug 2043243 - doc: import NSS:TryServer wiki page in the tree.
    Bug 2033664 - improve PK11 URI tests.
    Bug 2037205 - avoid nested attributeLock acquisition in sftk_CopyObject.
    Bug 2038536 - doc: fix a typo in “Community — Network Security Services (NSS)”.
    Bug 2037205 - acquire RWLock before key copies in ssl_SetSelfEncryptKeyPair.
    Bug 2027325 - Reject empty nickname in PK11_TraverseCertsForNicknameInSlot.
    Bug 1767921 - require non-null session pointer in sftk_GetContext.
    Bug 1767921 - set session->lastOpWasFIPS while holding session reference.
    Bug 1767921 - atomically claim object removal in sftk_DeleteObject.
    Bug 1767921 - atomically swap session search in NSC_FindObjects*.
    Bug 1767921 - atomically install session contexts in C_*Init.
    Bug 1767921 - hold session reference for context lifetime in C_*Update.
    Bug 1767921 - align softoken session lock with head-bucket hash.
    Bug 1767921 - restore reference counting for SFTKSession.


To generate a diff of this commit:
cvs rdiff -u -r1.297 -r1.298 pkgsrc/devel/nss/Makefile
cvs rdiff -u -r1.211 -r1.212 pkgsrc/devel/nss/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/devel/nss/Makefile
diff -u pkgsrc/devel/nss/Makefile:1.297 pkgsrc/devel/nss/Makefile:1.298
--- pkgsrc/devel/nss/Makefile:1.297     Fri May 15 17:02:47 2026
+++ pkgsrc/devel/nss/Makefile   Tue Jul 21 16:40:52 2026
@@ -1,9 +1,9 @@
-# $NetBSD: Makefile,v 1.297 2026/05/15 17:02:47 wiz Exp $
+# $NetBSD: Makefile,v 1.298 2026/07/21 16:40:52 wiz Exp $
 #
 # Release Notes
 # https://firefox-source-docs.mozilla.org/security/nss/releases/index.html
 
-DISTNAME=              nss-3.124
+DISTNAME=              nss-3.126
 CATEGORIES=            devel security
 MASTER_SITES=          ${MASTER_SITE_MOZILLA_ALL:=security/nss/releases/NSS_${PKGVERSION_NOREV:S/./_/g}_RTM/src/}
 
@@ -133,7 +133,7 @@ MAKE_ENV+=  NSS_ENABLE_TLS_1_3=1
 CFLAGS+=       -DNSS_NO_GCC48
 .endif
 
-NSPR_MINIMUM_VERSION=  4.38.2
+NSPR_MINIMUM_VERSION=  4.39
 
 PKGCONFIG_OVERRIDE=    nss.pc
 

Index: pkgsrc/devel/nss/distinfo
diff -u pkgsrc/devel/nss/distinfo:1.211 pkgsrc/devel/nss/distinfo:1.212
--- pkgsrc/devel/nss/distinfo:1.211     Fri May 15 17:00:56 2026
+++ pkgsrc/devel/nss/distinfo   Tue Jul 21 16:40:52 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.211 2026/05/15 17:00:56 wiz Exp $
+$NetBSD: distinfo,v 1.212 2026/07/21 16:40:52 wiz Exp $
 
-BLAKE2s (nss-3.124.tar.gz) = f013376f9e7a9f2d3078acdce7113a11a21ec5c6ddb21a05428afce3b3163278
-SHA512 (nss-3.124.tar.gz) = 9959977b3cbcb0306c8aeba2c059d4f3646b3144c6401fbc73c14aea364caa92331875354afa79c095b6482b29ae743228d35c1bd510c5124cad5e7c37c5daa2
-Size (nss-3.124.tar.gz) = 78530189 bytes
+BLAKE2s (nss-3.126.tar.gz) = 7bfc5404f3a99f509ed2e692ddd2d05c879faab9650f12fe372bbef079924fbd
+SHA512 (nss-3.126.tar.gz) = 58d3b77e449ce4d3408051f1cf08ee1b7b0d86f8382d5d2103acc097de3503345e78edaf06af824122efe8cdb20eca7c0f295692aedbf5a14676411be27624b9
+Size (nss-3.126.tar.gz) = 78769092 bytes
 SHA1 (patch-md) = ebc903bb19456bfa111fad3c101e3f18168b43b3
 SHA1 (patch-me) = 30aa8b8e22bb687b9c71da40ea9e76b56885d1f8
 SHA1 (patch-mf) = 40e58385fb6f944f463bf00b9aad72bc4ea229d0