GNU bug report logs - #71832
[PATCH v5 0/3] [SECURITY] Add nss-rapid; update Librewolf to 128.0.3-1

Previous Next

Full log

View this message in rfc822 format

From: Ian Eure <ian <at> retrospec.tv>
To: 71832 <at> debbugs.gnu.org
Cc: Ian Eure <ian <at> retrospec.tv>
Subject: [bug#71832] [PATCH v5 1/3] gnu: Add nss-rapid.
Date: Tue, 30 Jul 2024 20:54:59 -0700

* gnu/packages/nss.scm (nss-rapid): New variable.

Change-Id: I2bdd2119fb0c857feae9eb2e47a28909b8228cd7
---
 gnu/packages/nss.scm | 80 ++++++++++++++++++++++++++++++++++++++++----
 1 file changed, 74 insertions(+), 6 deletions(-)

diff --git a/gnu/packages/nss.scm b/gnu/packages/nss.scm
index 9224a8ed5a..17f05a65b0 100644
--- a/gnu/packages/nss.scm
+++ b/gnu/packages/nss.scm
@@ -106,6 +106,9 @@ (define-public nspr-4.32
               (base32
                "0v3zds1id71j5a5si42a658fjz8nv2f6zp6w4gqrqmdr6ksz8sxv"))))))
 
+;; nss should track ESRs, but currently doesn't.  When the next ESR it out, it
+;; should get updated.
+
 (define-public nss
   (package
     (name "nss")
@@ -153,13 +156,13 @@ (define-public nss
                 ;; Ensure we are building for the (%current-target-system).
                 #$@(if (%current-target-system)
                        #~((string-append
-                            "OS_TEST="
-                            (string-take #$(%current-target-system)
-                                         (string-index #$(%current-target-system) #\-)))
+                           "OS_TEST="
+                           (string-take #$(%current-target-system)
+                                        (string-index #$(%current-target-system) #\-)))
                           (string-append
-                            "KERNEL=" (cond (#$(target-hurd?) "gnu")
-                                            (#$(target-linux?) "linux")
-                                            (else ""))))
+                           "KERNEL=" (cond (#$(target-hurd?) "gnu")
+                                           (#$(target-linux?) "linux")
+                                           (else ""))))
                        #~())
                 #$@(if (%current-target-system)
                        #~("CROSS_COMPILE=1")
@@ -303,6 +306,71 @@ (define-public nss/fixed
                          (invoke "faketime" "2024-01-23" "./nss/tests/all.sh"))
                        (format #t "test suite not run~%"))))))))))))
 
+;; nss-rapid tracks the rapid release channel.  Unless your package requires a
+;; newer version, you should prefer the `nss' package, which tracks the ESR
+;; channel.
+;;
+;; See https://wiki.mozilla.org/NSS:Release_Versions
+;; and https://wiki.mozilla.org/Rapid_Release_Model
+
+(define-public nss-rapid
+  (package
+   (inherit nss)
+   (name "nss-rapid")
+   (version "3.102.1")
+   (source (origin
+             (inherit (package-source nss))
+             (uri (let ((version-with-underscores
+                         (string-join (string-split version #\.) "_")))
+                    (string-append
+                     "https://ftp.mozilla.org/pub/mozilla.org/security/nss/"
+                     "releases/NSS_" version-with-underscores "_RTM/src/"
+                     "nss-" version ".tar.gz")))
+             (sha256
+              (base32
+               "1k1pjxz0ab4lg8xqggbb8pw77c1q8h4bldi09z4pj5g4hwsjv62l"))))
+   (arguments
+    (substitute-keyword-arguments (package-arguments nss)
+      ((#:phases phases)
+       #~(modify-phases #$phases
+           (replace 'check
+             (lambda* (#:key tests? #:allow-other-keys)
+               (if tests?
+                   (begin
+                     ;; Use 127.0.0.1 instead of $HOST.$DOMSUF as HOSTADDR for
+                     ;; testing.  The latter requires a working DNS or /etc/hosts.
+                     (setenv "DOMSUF" "localdomain")
+                     (setenv "USE_IP" "TRUE")
+                     (setenv "IP_ADDRESS" "127.0.0.1")
+
+                     ;; This specific test is looking at performance "now
+                     ;; verify that we can quickly dump a database", and
+                     ;; we're not testing performance here (especially
+                     ;; since we're using faketime), so raise the
+                     ;; threshold
+                     (substitute* "nss/tests/dbtests/dbtests.sh"
+                       ((" -lt 5") " -lt 50"))
+
+                     ;; Since the test suite is very lengthy, run the test
+                     ;; suite once, not thrice as done by default, by
+                     ;; selecting only the 'standard' cycle.
+                     (setenv "NSS_CYCLES" "standard")
+
+                     ;; The "PayPalEE.cert" certificate expires every six months,
+                     ;; leading to test failures:
+                     ;; <https://bugzilla.mozilla.org/show_bug.cgi?id=609734>.  To
+                     ;; work around that, set the time to roughly the release date.
+                     (invoke "faketime" "2024-01-23" "./nss/tests/all.sh"))
+                   (format #t "test suite not run~%"))))))))
+   (synopsis "Network Security Services (Rapid Release)")
+   (description
+    "Network Security Services (@dfn{NSS}) is a set of libraries designed to
+support cross-platform development of security-enabled client and server
+applications.  Applications built with NSS can support SSL v2 and v3, TLS,
+PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and other
+security standards.
+
+This package tracks the Rapid Release channel, which updates frequently.")))
 (define-public nsncd
   (package
     (name "nsncd")
-- 
2.45.2

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.