CVS commit: pkgsrc/devel/nss

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Thu Aug 27 21:43:30 UTC 2026

Modified Files:
        pkgsrc/devel/nss: Makefile distinfo

Log Message:
nss: update to 3.128.

Changes in NSS 3.128

- Bug 2063360 - Rejoin the table cells the conversion wrapped mid-construct.
- Bug 2063360 - Generate heading anchors and stop the headings linking to themselves.
- Bug 2063360 - Unlink the self-linking headings in the release notes.
- Bug 2063360 - Point documentation cross-references at the dashed anchors.
- Bug 2063360 - Fix doc-lint in the release process.
- Bug 2066375 - Make fuzz tasks selectable with try syntax.
- Bug 2066375 - Build Cryptofuzz in its own CI task.
- Bug 2066604 - fix EC public key encoding in sftk_PutPubKey.
- Bug 2066183 - set CKA_ID on imported private keys.
- Bug 2017925 - Hash prfs need to be evaluated for indicators.
- Bug 2066327 - rename libcrux gyp target.
- Bug 2066415 - Update BoGo tests to disable ML_DSA Default test.
- Bug 2065354 - unify the two clang-format docker images.
- Bug 2056265 - -trust-cert for TLS BoGo tests.
- Bug 2056235 - DTLS1.2/1.3 - silently discard invalid records.
- Bug 2052273 - Adding -trust-cert support for BoGo DTLS tests.
- Bug 2063443 - nullify dangling pointers in libssl, pk11wrap, and softoken.
- Bug 2027768 - Fix build failure due to missing gcm stubs if on big endian.
- Bug 2065354 - clang-format everything.
- Bug 2065354 - Update clang-format version to 22.
- Bug 2054818 - make mach try work with git-cinnabar checkouts.
- Bug 2054696 - avoid integer overflow in PK11SDR_EncryptWithMechanism.
- Bug 2056778 - fix slot over-release in PK11_FindCertFromDERCertItem.
- Bug 2056789 - fix missing BAD_PARAM_CAST in NSC_DeriveKey CKM_DES3_CBC_ENCRYPT_DATA branch.
- Bug 2064946 - additional ML-DSA ssl gtests.
- Bug 2064644 - ml_dsat.h: portable comments should use block comment style.
- Bug 1983320 - ml-dsa tls tests.
- Bug 2056787 - hold handshake locks longer in SSL_ResetHandshake.
- Bug 1983320 - ML-DSA tests for Sign/Verify, certificates and pkcs12.
- Bug 2056786 - take smime profile lock while updating profile data.
- Bug 2062824 - add defensive null checks in PK11_Encapsulate and PK11_Decapsulate.
- Bug 2062822 - nulled slot in pk11_loadPrivKeyWithFlags leads to token object leak.
- Bug 2062802 - handle ML-KEM in stfk_CopyTokenPrivateKey and stfk_CopyTokenPublicKey.
- Bug 2062450 - Allow unknown hashAlg with ML-DSA in VFY_VerifyDataDirect.
- Bug 2062379 - additional ML-KEM tests.
- Bug 2062375 - handle unknown ML-KEM parameter sets in PK11_ExtractPublicKey.
- Bug 2062373 - missing CKP_NSS_ML_KEM_768 branches in seckey helper functions.
- Bug 2062372 - remove unused sftk_kyber_AllocCiphertextItem function.
- Bug 2060302 - additional ML-DSA tests.
- Bug 2060358 - add wycheproof tests for ML-KEM and ML-DSA.
- Bug 2060302 - vendor libcrux ML-DSA and enable the ML-DSA freebl backend.
- Bug 2060301 - bump libcrux and re-vendor ML-KEM from the combined C extraction.
- Bug 2027352 - validate IV length for CKM_RC2_CBC in pk11_ParamFromIVWithLen.
- Bug 1983320 - ml-dsa tls patch.
- Bug 2056775 - protect nssPKIObject.cryptoContext with a lock.


To generate a diff of this commit:
cvs rdiff -u -r1.300 -r1.301 pkgsrc/devel/nss/Makefile
cvs rdiff -u -r1.214 -r1.215 pkgsrc/devel/nss/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/devel/nss/Makefile
diff -u pkgsrc/devel/nss/Makefile:1.300 pkgsrc/devel/nss/Makefile:1.301
--- pkgsrc/devel/nss/Makefile:1.300     Tue Aug 18 22:24:41 2026
+++ pkgsrc/devel/nss/Makefile   Thu Aug 27 21:43:30 2026
@@ -1,9 +1,9 @@
-# $NetBSD: Makefile,v 1.300 2026/08/18 22:24:41 wiz Exp $
+# $NetBSD: Makefile,v 1.301 2026/08/27 21:43:30 wiz Exp $
 #
 # Release Notes
 # https://firefox-source-docs.mozilla.org/security/nss/releases/index.html
 
-DISTNAME=              nss-3.127
+DISTNAME=              nss-3.128
 CATEGORIES=            devel security
 MASTER_SITES=          ${MASTER_SITE_MOZILLA_ALL:=security/nss/releases/NSS_${PKGVERSION_NOREV:S/./_/g}_RTM/src/}
 

Index: pkgsrc/devel/nss/distinfo
diff -u pkgsrc/devel/nss/distinfo:1.214 pkgsrc/devel/nss/distinfo:1.215
--- pkgsrc/devel/nss/distinfo:1.214     Tue Aug 18 22:24:41 2026
+++ pkgsrc/devel/nss/distinfo   Thu Aug 27 21:43:30 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.214 2026/08/18 22:24:41 wiz Exp $
+$NetBSD: distinfo,v 1.215 2026/08/27 21:43:30 wiz Exp $
 
-BLAKE2s (nss-3.127.tar.gz) = 956138e7098c05619efcc5c37d665a7b51aa00432da1545f76267827da910a14
-SHA512 (nss-3.127.tar.gz) = c5293a6b68201a7d71b635c77cfdad7f032fb57fdd341ed4f2c702ed7f93795485be16f0f6994e079b5234fe362a83c3b82dae1bc335e42f0ad618d2586f23dd
-Size (nss-3.127.tar.gz) = 78736984 bytes
+BLAKE2s (nss-3.128.tar.gz) = 9164db6c9e4c95725ef6d08aa1e686bcba9557473caf150ec4cb7c9d690b88ac
+SHA512 (nss-3.128.tar.gz) = 9cdddf8b449af50f75c6f1917cfa5a4c693e5105e358146218deee5abc7468b11bca91606194de0583536f708d8c4724a18bc5a4978f7e46f367de09df7c7e2f
+Size (nss-3.128.tar.gz) = 87053743 bytes
 SHA1 (patch-md) = ebc903bb19456bfa111fad3c101e3f18168b43b3
 SHA1 (patch-me) = 30aa8b8e22bb687b9c71da40ea9e76b56885d1f8
 SHA1 (patch-mf) = 40e58385fb6f944f463bf00b9aad72bc4ea229d0