CVS commit: pkgsrc/devel/nss

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Thu Sep 10 10:02:10 UTC 2026

Modified Files:
        pkgsrc/devel/nss: Makefile distinfo
Removed Files:
        pkgsrc/devel/nss/patches: patch-nss_coreconf_NetBSD.mk

Log Message:
nss: update to 3.129.

Changes:

    Bug 2068788 - emit static library names during static build.
    Bug 2067434 - avoid building libcrux twice in makefile builds.
    Bug 2068010 - fix non-linux arm64 makefile builds.
    Bug 2017322 - set CKA_NSS_SERVER_DISTRUST_AFTER for CN=Izenpe.com.
    Bug 2057185 - Document ./mach try and its Mercurial-only caveat in CLAUDE.md.
    Bug 2056793 - Add tests for concurrent channel info queries during session replacement.
    Bug 2056793 - take the session cache lock when reading ss->sec.ci.sid.
    Bug 2066046 - Fix a race in STAN_GetNSSCertificate.
    Bug 2066591 - Remove write-only blLib and libraryName statics from freebl's lowhash_vector.
    Bug 2025246 - fix unknown key error type in ssl_SetAuthKeyBits.
    Bug 2065879 - re-vendor HACL* and simplify run_hacl.sh.
    Bug 2065879 - stop clang-formatting the vendored HACL* code.
    Bug 2068191 - add --dry-run to mach try to print job list.
    Bug 2029288 - avoid integer overflow in PK11_BlockData.
    Bug 2066960 - fix UB in ecperf.c.
    Bug 2067239 - Old coverity issues.
    Bug 2067237 - MLKEM mechinfo needs keys sizes.
    Bug 2066900 - pin NSPR 4.40 in CI.
    Bug 2066266 - ML-KEM-1024 incorrectly allows an explicit encapsulation seed.
    Bug 2066265 - Support for ML-KEM-512 in freebl and softoken.
    Bug 2060316 - remove support for pre-standard Kyber.
    Bug 2065423 - Build NSPR out of tree, into the dist directory.
    Bug 2065423 - Write a machine-readable summary.json for each test run.
    Bug 2065423 - Fail test runs on UBSan errors and on core dumps in debug builds.
    Bug 2065423 - Link tests_results/latest at the newest test run.
    Bug 2065423 - Resolve ssl_gtest_db.sh against QADIR.
    Bug 2065423 - Generate nss.pc and nss-config into the dist directory.
    Bug 2065423 - Add a --dist option to build.sh.
    Bug 2065219 - Update Cryptofuzz version.
    Bug 2056790 - Use PK11 digest contexts for explicit hashing in cryptohi.


To generate a diff of this commit:
cvs rdiff -u -r1.302 -r1.303 pkgsrc/devel/nss/Makefile
cvs rdiff -u -r1.217 -r1.218 pkgsrc/devel/nss/distinfo
cvs rdiff -u -r1.7 -r0 pkgsrc/devel/nss/patches/patch-nss_coreconf_NetBSD.mk

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/devel/nss/Makefile
diff -u pkgsrc/devel/nss/Makefile:1.302 pkgsrc/devel/nss/Makefile:1.303
--- pkgsrc/devel/nss/Makefile:1.302     Sun Aug 30 08:43:36 2026
+++ pkgsrc/devel/nss/Makefile   Thu Sep 10 10:02:09 2026
@@ -1,9 +1,9 @@
-# $NetBSD: Makefile,v 1.302 2026/08/30 08:43:36 wiz Exp $
+# $NetBSD: Makefile,v 1.303 2026/09/10 10:02:09 wiz Exp $
 #
 # Release Notes
 # https://firefox-source-docs.mozilla.org/security/nss/releases/index.html
 
-DISTNAME=              nss-3.128
+DISTNAME=              nss-3.129
 CATEGORIES=            devel security
 MASTER_SITES=          ${MASTER_SITE_MOZILLA_ALL:=security/nss/releases/NSS_${PKGVERSION_NOREV:S/./_/g}_RTM/src/}
 
@@ -128,8 +128,6 @@ MAKE_ENV+=  USE_SYSTEM_ZLIB=1
 MAKE_ENV+=     EXTRA_SHARED_LIBS="${COMPILER_RPATH_FLAG}${BUILDLINK_PREFIX.nspr}/lib/nspr ${COMPILER_RPATH_FLAG}${PREFIX}/lib/nss -L${BUILDLINK_PREFIX.nspr}/lib/nspr -lplc4 -lplds4 -lnspr4 
"${LDFLAGS:Q}
 MAKE_ENV+=     NSS_DISABLE_GTESTS=yes
 MAKE_ENV+=     NSS_ENABLE_TLS_1_3=1
-# regression in 3.128
-MAKE_ENV.Darwin+=      LITTLE_ENDIAN=1
 .include "../../mk/compiler.mk"
 .if ${CC_VERSION:Mgcc-4.[0-7]*}
 CFLAGS+=       -DNSS_NO_GCC48
@@ -181,16 +179,20 @@ do-install:
 .endfor
 
 # needed if host is not in DNS
-#TEST_ENV+=    HOST=localhost DOMSUF=localdomain
-# as of 3.120
+TEST_ENV+=     HOST=localhost DOMSUF=localdomain
+# as of 3.129
 # Tests summary:
 # --------------
-# Passed:             11282
-# Failed:             36
+# Passed:             5950
+# Failed:             5
 # Failed with core:   0
 # ASan failures:      0
-# Unknown status:     25
-# TinderboxPrint:Unknown: 25
+# UBSan failures:     0
+# Unknown status:     13
+# TinderboxPrint:Unknown: 13
+# Failed tests:
+#   - STANDARD/ssl
+#   - STANDARD/ssl_gtests
 
 do-test:
        cd ${WRKSRC}/nss/tests && ${SETENV} ${TEST_ENV} bash ./all.sh

Index: pkgsrc/devel/nss/distinfo
diff -u pkgsrc/devel/nss/distinfo:1.217 pkgsrc/devel/nss/distinfo:1.218
--- pkgsrc/devel/nss/distinfo:1.217     Fri Sep  4 09:59:32 2026
+++ pkgsrc/devel/nss/distinfo   Thu Sep 10 10:02:09 2026
@@ -1,15 +1,14 @@
-$NetBSD: distinfo,v 1.217 2026/09/04 09:59:32 tnn Exp $
+$NetBSD: distinfo,v 1.218 2026/09/10 10:02:09 wiz Exp $
 
-BLAKE2s (nss-3.128.tar.gz) = 9164db6c9e4c95725ef6d08aa1e686bcba9557473caf150ec4cb7c9d690b88ac
-SHA512 (nss-3.128.tar.gz) = 9cdddf8b449af50f75c6f1917cfa5a4c693e5105e358146218deee5abc7468b11bca91606194de0583536f708d8c4724a18bc5a4978f7e46f367de09df7c7e2f
-Size (nss-3.128.tar.gz) = 87053743 bytes
+BLAKE2s (nss-3.129.tar.gz) = bda9dba110d063efae30987f5065e88071752716bace7b8c5482f542119d82cd
+SHA512 (nss-3.129.tar.gz) = ffad7bd7dbbd388c88072b21553f533ed721575b1a4dabbbd65a5f62c2f9e4b0e33e45c02d5f3a68b19b364e73f4880ab82924a673bdc2d1754237cde47b6b37
+Size (nss-3.129.tar.gz) = 87255363 bytes
 SHA1 (patch-md) = ebc903bb19456bfa111fad3c101e3f18168b43b3
 SHA1 (patch-me) = 30aa8b8e22bb687b9c71da40ea9e76b56885d1f8
 SHA1 (patch-mf) = 40e58385fb6f944f463bf00b9aad72bc4ea229d0
 SHA1 (patch-mn) = 5b79783e48249044be1a904a6cfd20ba175b5fd4
 SHA1 (patch-nss_cmd_platlibs.mk) = 01f4350de601b29c94e8a791a28daca226866bb6
 SHA1 (patch-nss_cmd_shlibsign_sign.sh) = 7948b7b502a4c148ee185836dde8a84d3aa388af
-SHA1 (patch-nss_coreconf_NetBSD.mk) = 81118eb56f95d6217fecb0c0a9da1b258b630a12
 SHA1 (patch-nss_coreconf_OpenBSD.mk) = 944f71fcaaa7d5b2b3ed008341b1392a65480f2b
 SHA1 (patch-nss_coreconf_command.mk) = a7b682d367825b48f8802fa30cee83f10680bb74
 SHA1 (patch-nss_coreconf_nsinstall_Makefile) = 69981ba7355a4413111754859ef08cbd5e1bf4f4